TUN inbound: IPv6 entries in dns keep the TUN from starting on Windows when IPv6 cannot be set up, as in gateway and autoSystemRoutingTable

Follow-up to #7325: an IPv6 server in dns now asks for IPv6 as well.
When the adapter has no IPv6 interface, or refuses its IPv6 DNS servers,
the TUN fails to start instead of starting without them. Without IPv6 in
any of the three, both are still skipped: the IPv6 DNS servers that Xray
sets on every start are none then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/docker/Dockerfile

@@ -20,7 +20,7 @@ RUN cat <<EOF >/tmp/usr/local/etc/xray/00_log.json
 {
   "log": {
     "error": "/var/log/xray/error.log",
-    "loglevel": "warning",
+    "logLevel": "warning",
     "access": "none",
     "dnsLog": false
   }

.github/docker/Dockerfile.usa

@@ -20,7 +20,7 @@ RUN cat <<EOF >/tmp/usr/local/etc/xray/00_log.json
 {
   "log": {
     "error": "/var/log/xray/error.log",
-    "loglevel": "warning",
+    "logLevel": "warning",
     "access": "none",
     "dnsLog": false
   }

common/reflect/marshal_test.go

@@ -134,7 +134,7 @@ func TestMarshalConfigJson(t *testing.T) {
 func getConfig() string {
 	return `{
   "log": {
-    "loglevel": "debug"
+    "logLevel": "debug"
   },
   "stats": {},
   "policy": {

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.1
+	github.com/klauspost/cpuid/v2 v2.4.2
 	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5

go.sum

@@ -35,8 +35,8 @@ github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
 github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
-github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.4.2 h1:xRw7IZEsAgVCp6trS/DgWbTAqpixhmywgVgBjYGg1bQ=
+github.com/klauspost/cpuid/v2 v2.4.2/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

infra/conf/freedom.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
+	"github.com/xtls/xray-core/common/log"
 	xnet "github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/proxy/freedom"
@@ -48,6 +49,8 @@ type FreedomFinalRuleConfig struct {
 	Network    *NetworkList `json:"network"`
 	Port       *PortList    `json:"port"`
 	IP         *StringList  `json:"ip"`
+	Delay      *Int32Range  `json:"delay"`
+	LogLevel   string       `json:"logLevel"`
 	BlockDelay *Int32Range  `json:"blockDelay"`
 }
 
@@ -280,10 +283,37 @@ func (c *FreedomFinalRuleConfig) Build() (*freedom.FinalRuleConfig, error) {
 	}
 
 	if c.BlockDelay != nil {
-		rule.BlockDelay = &freedom.Range{
-			Min: uint64(c.BlockDelay.From),
-			Max: uint64(c.BlockDelay.To),
+		errors.PrintDeprecatedFeatureWarning("finalRules.blockDelay", "finalRules.delay")
+		c.Delay = c.BlockDelay
+	}
+
+	if rule.Action != freedom.RuleAction_Block {
+		if c.Delay != nil || c.LogLevel != "" {
+			return nil, errors.New("delay and logLevel are only supported for block finalRules")
 		}
+		return rule, nil
+	}
+
+	if c.Delay != nil {
+		rule.Delay = &freedom.Range{
+			Min: uint64(c.Delay.From),
+			Max: uint64(c.Delay.To),
+		}
+	}
+
+	switch strings.ToLower(c.LogLevel) {
+	case "", "info":
+		rule.LogLevel = log.Severity_Info.Enum()
+	case "none":
+		rule.LogLevel = log.Severity_Unknown.Enum()
+	case "debug":
+		rule.LogLevel = log.Severity_Debug.Enum()
+	case "warning":
+		rule.LogLevel = log.Severity_Warning.Enum()
+	case "error":
+		rule.LogLevel = log.Severity_Error.Enum()
+	default:
+		return nil, errors.New("unknown finalRules.logLevel: ", c.LogLevel)
 	}
 
 	return rule, nil

infra/conf/freedom_test.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/xtls/xray-core/common/geodata"
+	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	. "github.com/xtls/xray-core/infra/conf"
@@ -46,7 +47,8 @@ func TestFreedomConfig(t *testing.T) {
 					"network": "tcp,udp",
 					"port": "53,443",
 					"ip": ["10.0.0.0/8", "2001:db8::/32"],
-					"blockDelay": "30-60"
+					"delay": "30-60",
+					"logLevel": "debug"
 				}, {
 					"action": "allow",
 					"network": ["udp"]
@@ -86,10 +88,8 @@ func TestFreedomConfig(t *testing.T) {
 								},
 							},
 						},
-						BlockDelay: &freedom.Range{
-							Min: 30,
-							Max: 60,
-						},
+						Delay:    &freedom.Range{Min: 30, Max: 60},
+						LogLevel: log.Severity_Debug.Enum(),
 					},
 					{
 						Action:   freedom.RuleAction_Allow,

infra/conf/log.go

@@ -18,7 +18,7 @@ func DefaultLogConfig() *log.Config {
 type LogConfig struct {
 	AccessLog   string `json:"access"`
 	ErrorLog    string `json:"error"`
-	LogLevel    string `json:"loglevel"`
+	LogLevel    string `json:"logLevel"`
 	DNSLog      bool   `json:"dnsLog"`
 	MaskAddress string `json:"maskAddress"`
 }

infra/conf/serial/loader_test.go

@@ -18,7 +18,7 @@ func TestLoaderError(t *testing.T) {
 				"log": {
 					// abcd
 					0,
-					"loglevel": "info"
+					"logLevel": "info"
 				}
 		}`,
 			Output: "line 4 char 6",
@@ -27,7 +27,7 @@ func TestLoaderError(t *testing.T) {
 			Input: `{
 				"log": {
 					// abcd
-					"loglevel": "info",
+					"logLevel": "info",
 				}
 		}`,
 			Output: "line 5 char 5",

infra/conf/xray_test.go

@@ -42,7 +42,7 @@ func TestXrayConfig(t *testing.T) {
 			Input: `{
 				"log": {
 					"access": "/var/log/xray/access.log",
-					"loglevel": "error",
+					"logLevel": "error",
 					"error": "/var/log/xray/error.log"
 				},
 				"inbounds": [{

proxy/freedom/config.pb.go

@@ -8,6 +8,7 @@ package freedom
 
 import (
 	geodata "github.com/xtls/xray-core/common/geodata"
+	log "github.com/xtls/xray-core/common/log"
 	net "github.com/xtls/xray-core/common/net"
 	protocol "github.com/xtls/xray-core/common/protocol"
 	internet "github.com/xtls/xray-core/transport/internet"
@@ -357,7 +358,8 @@ type FinalRuleConfig struct {
 	Networks      []net.Network          `protobuf:"varint,2,rep,packed,name=networks,proto3,enum=xray.common.net.Network" json:"networks,omitempty"`
 	PortList      *net.PortList          `protobuf:"bytes,3,opt,name=port_list,json=portList,proto3" json:"port_list,omitempty"`
 	Ip            []*geodata.IPRule      `protobuf:"bytes,4,rep,name=ip,proto3" json:"ip,omitempty"`
-	BlockDelay    *Range                 `protobuf:"bytes,5,opt,name=block_delay,json=blockDelay,proto3" json:"block_delay,omitempty"`
+	Delay         *Range                 `protobuf:"bytes,5,opt,name=delay,proto3" json:"delay,omitempty"`
+	LogLevel      *log.Severity          `protobuf:"varint,6,opt,name=log_level,json=logLevel,proto3,enum=xray.common.log.Severity,oneof" json:"log_level,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -420,13 +422,20 @@ func (x *FinalRuleConfig) GetIp() []*geodata.IPRule {
 	return nil
 }
 
-func (x *FinalRuleConfig) GetBlockDelay() *Range {
+func (x *FinalRuleConfig) GetDelay() *Range {
 	if x != nil {
-		return x.BlockDelay
+		return x.Delay
 	}
 	return nil
 }
 
+func (x *FinalRuleConfig) GetLogLevel() log.Severity {
+	if x != nil && x.LogLevel != nil {
+		return *x.LogLevel
+	}
+	return log.Severity(0)
+}
+
 type Config struct {
 	state               protoimpl.MessageState  `protogen:"open.v1"`
 	DomainStrategy      internet.DomainStrategy `protobuf:"varint,1,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.transport.internet.DomainStrategy" json:"domain_strategy,omitempty"`
@@ -523,7 +532,7 @@ var File_proxy_freedom_config_proto protoreflect.FileDescriptor
 
 const file_proxy_freedom_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1aproxy/freedom/config.proto\x12\x12xray.proxy.freedom\x1a!common/protocol/server_spec.proto\x1a\x1ftransport/internet/config.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"S\n" +
+	"\x1aproxy/freedom/config.proto\x12\x12xray.proxy.freedom\x1a!common/protocol/server_spec.proto\x1a\x1ftransport/internet/config.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\x1a\x14common/log/log.proto\"S\n" +
 	"\x13DestinationOverride\x12<\n" +
 	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"\x98\x02\n" +
 	"\bFragment\x12!\n" +
@@ -549,14 +558,16 @@ const file_proxy_freedom_config_proto_rawDesc = "" +
 	"\bapply_to\x18\x06 \x01(\tR\aapplyTo\"+\n" +
 	"\x05Range\x12\x10\n" +
 	"\x03min\x18\x01 \x01(\x04R\x03min\x12\x10\n" +
-	"\x03max\x18\x02 \x01(\x04R\x03max\"\xa0\x02\n" +
+	"\x03max\x18\x02 \x01(\x04R\x03max\"\xe0\x02\n" +
 	"\x0fFinalRuleConfig\x126\n" +
 	"\x06action\x18\x01 \x01(\x0e2\x1e.xray.proxy.freedom.RuleActionR\x06action\x124\n" +
 	"\bnetworks\x18\x02 \x03(\x0e2\x18.xray.common.net.NetworkR\bnetworks\x126\n" +
 	"\tport_list\x18\x03 \x01(\v2\x19.xray.common.net.PortListR\bportList\x12+\n" +
-	"\x02ip\x18\x04 \x03(\v2\x1b.xray.common.geodata.IPRuleR\x02ip\x12:\n" +
-	"\vblock_delay\x18\x05 \x01(\v2\x19.xray.proxy.freedom.RangeR\n" +
-	"blockDelay\"\xaf\x03\n" +
+	"\x02ip\x18\x04 \x03(\v2\x1b.xray.common.geodata.IPRuleR\x02ip\x12/\n" +
+	"\x05delay\x18\x05 \x01(\v2\x19.xray.proxy.freedom.RangeR\x05delay\x12;\n" +
+	"\tlog_level\x18\x06 \x01(\x0e2\x19.xray.common.log.SeverityH\x00R\blogLevel\x88\x01\x01B\f\n" +
+	"\n" +
+	"_log_level\"\xaf\x03\n" +
 	"\x06Config\x12P\n" +
 	"\x0fdomain_strategy\x18\x01 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0edomainStrategy\x12Z\n" +
 	"\x14destination_override\x18\x03 \x01(\v2'.xray.proxy.freedom.DestinationOverrideR\x13destinationOverride\x12\x1d\n" +
@@ -599,7 +610,8 @@ var file_proxy_freedom_config_proto_goTypes = []any{
 	(net.Network)(0),                // 8: xray.common.net.Network
 	(*net.PortList)(nil),            // 9: xray.common.net.PortList
 	(*geodata.IPRule)(nil),          // 10: xray.common.geodata.IPRule
-	(internet.DomainStrategy)(0),    // 11: xray.transport.internet.DomainStrategy
+	(log.Severity)(0),               // 11: xray.common.log.Severity
+	(internet.DomainStrategy)(0),    // 12: xray.transport.internet.DomainStrategy
 }
 var file_proxy_freedom_config_proto_depIdxs = []int32{
 	7,  // 0: xray.proxy.freedom.DestinationOverride.server:type_name -> xray.common.protocol.ServerEndpoint
@@ -607,17 +619,18 @@ var file_proxy_freedom_config_proto_depIdxs = []int32{
 	8,  // 2: xray.proxy.freedom.FinalRuleConfig.networks:type_name -> xray.common.net.Network
 	9,  // 3: xray.proxy.freedom.FinalRuleConfig.port_list:type_name -> xray.common.net.PortList
 	10, // 4: xray.proxy.freedom.FinalRuleConfig.ip:type_name -> xray.common.geodata.IPRule
-	4,  // 5: xray.proxy.freedom.FinalRuleConfig.block_delay:type_name -> xray.proxy.freedom.Range
-	11, // 6: xray.proxy.freedom.Config.domain_strategy:type_name -> xray.transport.internet.DomainStrategy
-	1,  // 7: xray.proxy.freedom.Config.destination_override:type_name -> xray.proxy.freedom.DestinationOverride
-	2,  // 8: xray.proxy.freedom.Config.fragment:type_name -> xray.proxy.freedom.Fragment
-	3,  // 9: xray.proxy.freedom.Config.noises:type_name -> xray.proxy.freedom.Noise
-	5,  // 10: xray.proxy.freedom.Config.final_rules:type_name -> xray.proxy.freedom.FinalRuleConfig
-	11, // [11:11] is the sub-list for method output_type
-	11, // [11:11] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	4,  // 5: xray.proxy.freedom.FinalRuleConfig.delay:type_name -> xray.proxy.freedom.Range
+	11, // 6: xray.proxy.freedom.FinalRuleConfig.log_level:type_name -> xray.common.log.Severity
+	12, // 7: xray.proxy.freedom.Config.domain_strategy:type_name -> xray.transport.internet.DomainStrategy
+	1,  // 8: xray.proxy.freedom.Config.destination_override:type_name -> xray.proxy.freedom.DestinationOverride
+	2,  // 9: xray.proxy.freedom.Config.fragment:type_name -> xray.proxy.freedom.Fragment
+	3,  // 10: xray.proxy.freedom.Config.noises:type_name -> xray.proxy.freedom.Noise
+	5,  // 11: xray.proxy.freedom.Config.final_rules:type_name -> xray.proxy.freedom.FinalRuleConfig
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_proxy_freedom_config_proto_init() }
@@ -625,6 +638,7 @@ func file_proxy_freedom_config_proto_init() {
 	if File_proxy_freedom_config_proto != nil {
 		return
 	}
+	file_proxy_freedom_config_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{

proxy/freedom/config.proto

@@ -11,6 +11,7 @@ import "transport/internet/config.proto";
 import "common/net/port.proto";
 import "common/net/network.proto";
 import "common/geodata/geodat.proto";
+import "common/log/log.proto";
 
 message DestinationOverride {
   xray.common.protocol.ServerEndpoint server = 1;
@@ -51,7 +52,8 @@ message FinalRuleConfig {
   repeated xray.common.net.Network networks = 2;
   xray.common.net.PortList port_list = 3;
   repeated xray.common.geodata.IPRule ip = 4;
-  Range block_delay = 5;
+  Range delay = 5;
+  optional xray.common.log.Severity log_level = 6;
 }
 
 message Config {

proxy/freedom/freedom.go

@@ -15,6 +15,7 @@ import (
 	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
+	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/platform"
 	"github.com/xtls/xray-core/common/retry"
@@ -72,23 +73,26 @@ func init() {
 	}
 
 	defaultBlockPrivateRule = &FinalRule{
-		action:  RuleAction_Block,
-		network: allNetworks,
-		ip:      geodata.GetPrivateIPMatcher(),
+		action:   RuleAction_Block,
+		network:  allNetworks,
+		ip:       geodata.GetPrivateIPMatcher(),
+		logLevel: log.Severity_Warning.Enum(),
 	}
 
 	defaultBlockAllRule = &FinalRule{
-		action:  RuleAction_Block,
-		network: allNetworks,
+		action:   RuleAction_Block,
+		network:  allNetworks,
+		logLevel: log.Severity_Warning.Enum(),
 	}
 }
 
 type FinalRule struct {
-	action     RuleAction
-	network    [8]bool
-	port       net.MemoryPortList
-	ip         geodata.IPMatcher
-	blockDelay *Range
+	action   RuleAction
+	network  [8]bool
+	port     net.MemoryPortList
+	ip       geodata.IPMatcher
+	delay    *Range
+	logLevel *log.Severity
 }
 
 // Handler handles Freedom connections.
@@ -102,8 +106,9 @@ type Handler struct {
 
 func buildFinalRule(config *FinalRuleConfig) (*FinalRule, error) {
 	rule := &FinalRule{
-		action:     config.GetAction(),
-		blockDelay: config.GetBlockDelay(),
+		action:   config.GetAction(),
+		delay:    config.GetDelay(),
+		logLevel: config.LogLevel,
 	}
 
 	if len(config.Networks) == 0 {
@@ -164,7 +169,7 @@ func getDefaultFinalRule(inbound *session.Inbound) *FinalRule {
 	switch inbound.Name {
 	case "vless-reverse":
 		return defaultBlockAllRule
-	case "vless", "vmess", "trojan", "hysteria", "wireguard":
+	case "vless", "vmess", "trojan", "hysteria", "wireguard", "masque":
 		return defaultBlockPrivateRule
 	default:
 		if strings.HasPrefix(inbound.Name, "shadowsocks") {
@@ -212,12 +217,12 @@ func (h *Handler) policy() policy.Session {
 	return p
 }
 
-func (h *Handler) blockDelay(rule *FinalRule) time.Duration {
+func (r *FinalRule) blockDuration() time.Duration {
 	min := uint64(30)
 	max := uint64(90)
-	if rule.blockDelay != nil {
-		min = rule.blockDelay.Min
-		max = rule.blockDelay.Max
+	if r.delay != nil {
+		min = r.delay.Min
+		max = r.delay.Max
 	}
 	span := max - min
 	if max < min {
@@ -226,9 +231,26 @@ func (h *Handler) blockDelay(rule *FinalRule) time.Duration {
 	return time.Duration(min+uint64(dice.Roll(int(span+1)))) * time.Second
 }
 
+func (r *FinalRule) log(ctx context.Context, msg ...interface{}) {
+	level := log.Severity_Info
+	if r.logLevel != nil {
+		level = *r.logLevel
+	}
+	switch level {
+	case log.Severity_Debug:
+		errors.LogDebug(ctx, msg...)
+	case log.Severity_Info:
+		errors.LogInfo(ctx, msg...)
+	case log.Severity_Warning:
+		errors.LogWarning(ctx, msg...)
+	case log.Severity_Error:
+		errors.LogError(ctx, msg...)
+	}
+}
+
 func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *FinalRule, dest *net.Destination) error {
-	delay := h.blockDelay(rule)
-	errors.LogInfo(ctx, "blocked target: ", *dest, ", blackholing connection for ", delay)
+	delay := rule.blockDuration()
+	rule.log(ctx, "target blocked by a finalrule: ", *dest, ", blackholing connection for ", delay)
 	defer common.Close(output)
 	done := make(chan struct{})
 	go func() { // a DispatchLink inbound's reader ignores Interrupt, so don't wait for this copy
@@ -240,7 +262,7 @@ func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Wr
 	case <-time.After(delay):
 		common.Interrupt(input)
 		common.Interrupt(output)
-		errors.LogInfo(ctx, "closed blackholed connection to blocked target: ", *dest)
+		rule.log(ctx, "closed blackholed connection to blocked target: ", *dest)
 	}
 	return nil
 }

proxy/tun/README.md

@@ -223,7 +223,7 @@ To make it start, wintun.dll specific for your Windows/arch must be present next
 
 After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running. A Wintun adapter that already has that name is reused.
 
-With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
+With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway`, `dns` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
 
 When `dns` is set, those servers are applied to the adapter. Windows is kept from registering the TUN's addresses in DNS, and its DNS cache is flushed when the TUN starts and stops. Xray's own lookups through the system's DNS servers, like those of the `localhost` DNS server with `autoOutboundsInterface`, skip them, unless another interface uses them as well, as they would lead back into the TUN.
 

proxy/tun/tun_windows.go

@@ -115,6 +115,7 @@ func (t *WindowsTun) Start() (err error) {
 	for _, ip := range t.options.DNS {
 		dns = append(dns, netip.MustParseAddr(ip))
 	}
+	dns6 := slices.ContainsFunc(dns, netip.Addr.Is6)
 
 	var route4, route6 bool
 	routesMap := make(map[winipcfg.RouteData]struct{})
@@ -175,7 +176,7 @@ startOver:
 		if err != nil {
 			// With IPv6 disabled system-wide (DisabledComponents), the adapter has no
 			// IPv6 interface at all. Skip the family unless the config asks for it.
-			if err == windows.ERROR_NOT_FOUND && family == windows.AF_INET6 && !address6 && !route6 {
+			if err == windows.ERROR_NOT_FOUND && family == windows.AF_INET6 && !address6 && !route6 && !dns6 {
 				continue
 			}
 			return err
@@ -201,6 +202,12 @@ startOver:
 		}
 		err = t.luid.SetDNS(family, dns, nil)
 		if err != nil {
+			// Skip IPv6 the config does not ask for also when setting its DNS
+			// servers fails, as reported on Windows 11 24H2 with IPv6 disabled
+			// (Access is denied).
+			if family == windows.AF_INET6 && !address6 && !route6 && !dns6 {
+				continue
+			}
 			firstErr = errors.New("unable to set DNS").Base(err)
 			if err == windows.ERROR_NOT_FOUND {
 				goto startOver

proxy/wireguard/bind.go

@@ -17,7 +17,7 @@ import (
 
 type bind struct {
 	ctx         context.Context
-	resolveFunc func(host string) (net.IP, error)
+	resolveFunc func(ctx context.Context, host string) (net.IP, error)
 	listenFunc  func(ctx context.Context) (net.PacketConn, error)
 	downFunc    func() error
 	reserved    []byte
@@ -143,7 +143,11 @@ func (b *bind) ParseEndpoint(s string) (conn.Endpoint, error) {
 	if port < 0 || port > 65535 {
 		return nil, errors.New("invalid port " + sport)
 	}
-	ip, err := b.resolveFunc(host)
+	// up sets the connection's context right before it hands over the endpoint
+	b.mu.Lock()
+	ctx := b.ctx
+	b.mu.Unlock()
+	ip, err := b.resolveFunc(ctx, host)
 	if err != nil {
 		return nil, err
 	}

proxy/wireguard/client.go

@@ -323,12 +323,12 @@ func (h *Handler) up(ctx context.Context) error {
 	return h.dev.Up()
 }
 
-func MakeResolveLocal(d dns.Client, streamSettings *internet.MemoryStreamConfig) func(host string) (net.IP, error) {
-	return func(host string) (net.IP, error) {
+func MakeResolveLocal(d dns.Client, streamSettings *internet.MemoryStreamConfig) func(ctx context.Context, host string) (net.IP, error) {
+	return func(ctx context.Context, host string) (net.IP, error) {
 		if ip := net.ParseIP(host); ip != nil {
 			return ip, nil
 		}
-		ips, _, err := d.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
+		ips, err := lookupIPContext(ctx, d, host)
 		if err != nil {
 			return nil, err
 		}
@@ -368,6 +368,27 @@ func MakeResolveLocal(d dns.Client, streamSettings *internet.MemoryStreamConfig)
 	}
 }
 
+func lookupIPContext(ctx context.Context, d dns.Client, host string) ([]net.IP, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	type result struct {
+		ips []net.IP
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		ips, _, err := d.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
+		done <- result{ips, err}
+	}()
+	select {
+	case r := <-done:
+		return r.ips, r.err
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
 type UDPConnClient struct {
 	net.PacketConn
 	Dest *net.UDPAddr

testing/scenarios/vless_test.go

@@ -661,7 +661,7 @@ func TestVlessRealityFingerprints(t *testing.T) {
 	wg.Wait()
 }
 
-// A blocked connection must be closed after blockDelay even while the client keeps it open and sends nothing.
+// A blocked connection must close after finalRules.delay even while the client keeps it open and sends nothing.
 func TestVlessBlockDelay(t *testing.T) {
 	tcpServer := tcp.Server{
 		MsgProcessor: xor,
@@ -671,7 +671,7 @@ func TestVlessBlockDelay(t *testing.T) {
 	defer tcpServer.Close()
 
 	for _, delay := range []uint64{0, 1} {
-		t.Run(fmt.Sprint("blockDelay=", delay), func(t *testing.T) {
+		t.Run(fmt.Sprint("delay=", delay), func(t *testing.T) {
 			userID := protocol.NewID(uuid.New())
 			serverPort := tcp.PickPort()
 			serverConfig := &core.Config{
@@ -697,8 +697,8 @@ func TestVlessBlockDelay(t *testing.T) {
 						ProxySettings: serial.ToTypedMessage(&freedom.Config{
 							FinalRules: []*freedom.FinalRuleConfig{
 								{
-									Action:     freedom.RuleAction_Block,
-									BlockDelay: &freedom.Range{Min: delay, Max: delay},
+									Action: freedom.RuleAction_Block,
+									Delay:  &freedom.Range{Min: delay, Max: delay},
 								},
 							},
 						}),
@@ -726,15 +726,15 @@ func TestVlessBlockDelay(t *testing.T) {
 				Port:    dest.Port,
 			}, &encoding.Addons{}))
 
-			blockDelay := time.Duration(delay) * time.Second
-			common.Must(conn.SetReadDeadline(time.Now().Add(blockDelay + 5*time.Second)))
+			blockDuration := time.Duration(delay) * time.Second
+			common.Must(conn.SetReadDeadline(time.Now().Add(blockDuration + 5*time.Second)))
 			_, err = io.Copy(io.Discard, conn)
 			elapsed := time.Since(start)
 			if err, ok := err.(net.Error); ok && err.Timeout() {
 				t.Fatalf("connection is still open after %v", elapsed)
 			}
-			if elapsed < blockDelay {
-				t.Fatalf("connection is closed after %v, before blockDelay", elapsed)
+			if elapsed < blockDuration {
+				t.Fatalf("connection is closed after %v, before finalRules.delay", elapsed)
 			}
 		})
 	}

transport/internet/finalmask/udphop/conn.go

@@ -6,6 +6,7 @@ import (
 	goerrors "errors"
 	"io"
 	mrand "math/rand"
+	stdnet "net"
 	"net/netip"
 	"sync"
 	"time"
@@ -164,7 +165,7 @@ func (c *udpHopConn) recv(conn net.PacketConn) {
 		n, addr, err := conn.ReadFrom(p)
 		if err != nil {
 			pool.Put(p[:cap(p)])
-			if c.closed() {
+			if c.closed() || goerrors.Is(err, stdnet.ErrClosed) {
 				return
 			}
 			var netErr net.Error

transport/internet/xdrive/local.go

@@ -72,7 +72,7 @@ func (s *localStorage) Get(ctx context.Context, name string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	data, err := os.ReadFile(full)
+	data, err := readFile(ctx, full)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, errNotFound

transport/internet/xdrive/local_other.go

@@ -0,0 +1,12 @@
+//go:build !windows
+
+package xdrive
+
+import (
+	"context"
+	"os"
+)
+
+func readFile(_ context.Context, name string) ([]byte, error) {
+	return os.ReadFile(name)
+}

transport/internet/xdrive/local_windows.go

@@ -0,0 +1,30 @@
+package xdrive
+
+import (
+	"context"
+	"errors"
+	"os"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+// readFile retries os.ReadFile for up to 2 seconds on sharing violations:
+// os.Rename (MoveFileEx) in Put holds the file with DELETE access, which
+// os.ReadFile does not share, until a moment after its new name appears in List
+func readFile(ctx context.Context, name string) ([]byte, error) {
+	deadline := time.Now().Add(2 * time.Second)
+	delay := time.Millisecond
+	for {
+		data, err := os.ReadFile(name)
+		if !errors.Is(err, windows.ERROR_SHARING_VIOLATION) || time.Now().Add(delay).After(deadline) {
+			return data, err
+		}
+		select {
+		case <-ctx.Done():
+			return nil, err
+		case <-time.After(delay):
+		}
+		delay = min(2*delay, 100*time.Millisecond)
+	}
+}

transport/internet/xdrive/local_windows_test.go

@@ -0,0 +1,57 @@
+package xdrive
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+func TestLocalSharingViolation(t *testing.T) {
+	storage, err := newLocalStorage(t.TempDir())
+	if err != nil {
+		t.Fatalf("newLocalStorage: %v", err)
+	}
+	const name = "streams/session/c2s/000000000.seg"
+	if err := storage.Put(context.Background(), name, []byte("segment")); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+	full, err := storage.resolve(name)
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	path, err := windows.UTF16PtrFromString(full)
+	if err != nil {
+		t.Fatalf("UTF16PtrFromString: %v", err)
+	}
+
+	// os.Rename holds the file like this until a moment after its new name
+	// appears
+	handle, err := windows.CreateFile(path, windows.DELETE,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil, windows.OPEN_EXISTING, 0, 0)
+	if err != nil {
+		t.Fatalf("CreateFile: %v", err)
+	}
+	var once sync.Once
+	release := func() { once.Do(func() { windows.CloseHandle(handle) }) }
+	defer release()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	if _, err := storage.Get(ctx, name); !errors.Is(err, windows.ERROR_SHARING_VIOLATION) {
+		t.Fatalf("Get returned %v while the file is held, want a sharing violation", err)
+	}
+
+	time.AfterFunc(100*time.Millisecond, release)
+	data, err := storage.Get(context.Background(), name)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if string(data) != "segment" {
+		t.Fatalf("Get returned %q, want %q", data, "segment")
+	}
+}