mirror of
https://github.com/XTLS/Xray-core.git
synced 2026-11-02 16:36:58 +00:00
patternihaandClaude Opus 5.5
468f745fc2
autoSystemWfpBlockLeak now also takes:
- "all": everything outside the TUN, IPv4 and IPv6, in both directions, so
nothing but Xray leaves except through the TUN.
- "tcp", "udp": all ports of that protocol, also written "tcp/0", "udp/0".
- "tcp/<low>-<high>", "udp/<low>-<high>": a range of ports, matched with
FWP_MATCH_RANGE, as two conditions on the same field would match when
either does.
- "icmp": ICMP and ICMPv6, e.g. ping. It takes no port: in ICMP filters the
local port holds the type, and "icmp/0" would read as the echo reply.
Values are normalized: "tcp/0" and "tcp/1-65535" become "tcp", and
"tcp/53-53" becomes "tcp/53".
Whatever is blocked, loopback, which cannot leave the system, and what
Windows itself needs on the local link now always stay allowed: DHCP, DHCPv6,
and IPv6 neighbor and multicast listener discovery. These used to be allowed
only along with "misconfigtun", so "udp" or "icmp" would otherwise have cut
DHCP or IPv6 neighbor discovery, and "tcp" any local proxy, Xray's own
inbounds included. Loopback being allowed means that with "dns", a local
resolver on 127.0.0.1:53 now works for other programs (its own queries to
port 53 or 853 outside the TUN stay blocked), and the DNS Client service
may use it.
"all" reuses the filters of "misconfigtun", which now also let everything
through the TUN, for both IP versions whatever the routes.
On other TUN options: keeping the system's DNS inside the TUN, with "all",
"dns", "windnsclient", or anything covering TCP or UDP port 53 ("udp",
"tcp/50-60", ...), needs dns, as Windows can no longer reach the DNS
servers of the other interfaces; the config is rejected otherwise. Like the
other values, the new ones need autoSystemRoutingTable. The filters do not
need autoOutboundsInterface, as Xray is allowed by its app ID; it still
keeps Xray's own connections out of the TUN's routes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
77 lines
2.6 KiB
Go
77 lines
2.6 KiB
Go
package tun
|
|
|
|
import (
|
|
"slices"
|
|
"testing"
|
|
)
|
|
|
|
func TestExpandWfpBlockLeak(t *testing.T) {
|
|
for _, c := range []struct {
|
|
values []string
|
|
leaks []string
|
|
systemDNS bool
|
|
}{
|
|
{nil, nil, false},
|
|
{[]string{"dns"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}, true},
|
|
{[]string{"DNS", "MisconfigTUN"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853", "misconfigtun"}, true},
|
|
{[]string{"tcp/853", "dns", "TCP/0853"}, []string{"tcp/853", "udp/53", "tcp/53", "windnsclient", "udp/853"}, true},
|
|
{[]string{"tcp/853", "udp/853", "misconfigtun"}, []string{"tcp/853", "udp/853", "misconfigtun"}, false},
|
|
{[]string{"udp/65535", "tcp/1"}, []string{"udp/65535", "tcp/1"}, false},
|
|
{[]string{"tcp/53"}, []string{"tcp/53"}, true},
|
|
{[]string{"windnsclient"}, []string{"windnsclient"}, true},
|
|
{[]string{"ALL"}, []string{"all"}, true},
|
|
{[]string{"tcp", "TCP/0", "udp/0", "UDP"}, []string{"tcp", "udp"}, true},
|
|
{[]string{"tcp/1-65535", "udp/1-65535"}, []string{"tcp", "udp"}, true},
|
|
{[]string{"udp/10-20", "udp/53-53", "tcp/50-60"}, []string{"udp/10-20", "udp/53", "tcp/50-60"}, true},
|
|
{[]string{"tcp/54-60", "udp/1-52"}, []string{"tcp/54-60", "udp/1-52"}, false},
|
|
{[]string{"ICMP", "icmp"}, []string{"icmp"}, false},
|
|
} {
|
|
leaks, err := ExpandWfpBlockLeak(c.values)
|
|
if err != nil {
|
|
t.Errorf("%v: %v", c.values, err)
|
|
continue
|
|
}
|
|
if !slices.Equal(leaks, c.leaks) {
|
|
t.Errorf("%v: got %v, want %v", c.values, leaks, c.leaks)
|
|
}
|
|
if got := BlocksSystemDNS(leaks); got != c.systemDNS {
|
|
t.Errorf("%v: BlocksSystemDNS() = %v", c.values, got)
|
|
}
|
|
}
|
|
for _, value := range []string{
|
|
"", "ip", "tcp/", "udp/65536", "tcp/-1", "tcp/+53", "tcp/53/1", "udp/abc", "icmp/0", "icmp/8", "tcp:53", " dns",
|
|
"tcp/0-10", "tcp/20-10", "tcp/5-", "tcp/-5", "tcp/1-2-3", "tcp/1-65536", "udp/ 53", "all/0",
|
|
} {
|
|
if _, err := ExpandWfpBlockLeak([]string{value}); err == nil {
|
|
t.Errorf("%q was accepted", value)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLeakTrafficCovers(t *testing.T) {
|
|
for _, c := range []struct {
|
|
value string
|
|
protocol string
|
|
port uint16
|
|
covers bool
|
|
}{
|
|
{"tcp", "tcp", 1, true},
|
|
{"tcp", "udp", 53, false},
|
|
{"udp/53", "udp", 53, true},
|
|
{"udp/53", "udp", 54, false},
|
|
{"tcp/10-20", "tcp", 10, true},
|
|
{"tcp/10-20", "tcp", 20, true},
|
|
{"tcp/10-20", "tcp", 21, false},
|
|
{"tcp/10-20", "tcp", 9, false},
|
|
} {
|
|
traffic, ok := parseLeakTraffic(c.value)
|
|
if !ok {
|
|
t.Errorf("%q was not parsed", c.value)
|
|
continue
|
|
}
|
|
if got := traffic.covers(c.protocol, c.port); got != c.covers {
|
|
t.Errorf("%q covers %s/%d = %v", c.value, c.protocol, c.port, got)
|
|
}
|
|
}
|
|
}
|