TUN inbound: Block DNS and IPv6 leaks outside the TUN on Windows; Add strictRoute

Windows sends name queries to the DNS servers of all interfaces, and a
resolver on the local network (e.g. 192.168.1.1 from DHCP) is reached
through its more specific LAN route instead of the TUN, so DNS leaks
past it. IPv6 bypasses a TUN that cannot carry it.

With autoSystemRoutingTable set, the Windows TUN now adds Windows
Filtering Platform filters, all in one transaction and in a dynamic
session, so that they are removed when Xray exits, even if it crashes:
- DNS (port 53) only goes through the TUN, in both directions: its local
  address, and the interface it leaves or arrives by, must be the TUN's.
- IPv6 is blocked in both directions when the TUN has no IPv6 address or
  no IPv6 route, except loopback, neighbor and multicast listener
  discovery, and DHCPv6.
- Xray's own traffic is exempt: its connections out with a hard permit,
  which Windows Firewall rules do not override (like sing-box's
  strict_route), connections to its inbounds with an ordinary one.
If the filters cannot be added, the TUN does not start on Windows 10 and
later (only a warning on 7/8). The new `strictRoute` option (true by
default) turns them off.

Also on Windows:
- A warning for `dns` servers outside gateway and autoSystemRoutingTable,
  as queries to them cannot go through the TUN and are blocked.
- While DNS is restricted and autoOutboundsInterface is in use, Xray
  resolves the names it would ask Windows for itself (Go's resolver on
  its own sockets). Those lookups and the `localhost` DNS server skip the
  TUN's DNS servers, unless another interface uses them too, instead of
  looping back into the TUN.
- The DNS cache is flushed when the TUN starts and stops, and DNS
  registration is turned off on the TUN (through netsh before Windows 10
  1809).
- Close no longer panics when registering the route or interface change
  callbacks failed.
The README's Windows section describes all of it.

Tested on Windows 11, elevated, amd64 and 386: the filters, DNS arriving
through a real Wintun adapter and blocked outside it, the IPv6 block,
Windows Firewall rules, and a real Xray run. Windows 7/8 and Windows 10
before 1809 are untested.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

transport/internet/dns_skip.go

@@ -0,0 +1,32 @@
+package internet
+
+import (
+	"net/netip"
+	"slices"
+	"sync/atomic"
+)
+
+var skippedDNSServers atomic.Pointer[[]netip.Addr]
+
+// SkipDNSServers has the queries Xray sends to the system's DNS servers on its
+// own, like those of localdns, skip servers until it is called again. The DNS
+// servers of a TUN are only meant for what goes through it: queried by Xray
+// itself they lead back into it, or nowhere.
+func SkipDNSServers(servers []netip.Addr) {
+	skipped := make([]netip.Addr, len(servers))
+	for i, server := range servers {
+		skipped[i] = server.Unmap()
+	}
+	skippedDNSServers.Store(&skipped)
+}
+
+// IsSkippedDNSServer reports whether address, a DNS server as host:port, is to
+// be skipped, see SkipDNSServers.
+func IsSkippedDNSServer(address string) bool {
+	skipped := skippedDNSServers.Load()
+	if skipped == nil {
+		return false
+	}
+	server, err := netip.ParseAddrPort(address)
+	return err == nil && slices.Contains(*skipped, server.Addr().Unmap())
+}

transport/internet/dns_skip_test.go

@@ -0,0 +1,27 @@
+package internet_test
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/xtls/xray-core/transport/internet"
+)
+
+func TestSkipDNSServers(t *testing.T) {
+	internet.SkipDNSServers([]netip.Addr{netip.MustParseAddr("::ffff:203.0.113.53"), netip.MustParseAddr("2001:db8::53")})
+	t.Cleanup(func() { internet.SkipDNSServers(nil) })
+	for address, want := range map[string]bool{
+		"203.0.113.53:53":   true,
+		"[2001:db8::53]:53": true,
+		"198.51.100.53:53":  false,
+		"localhost:53":      false,
+	} {
+		if got := internet.IsSkippedDNSServer(address); got != want {
+			t.Errorf("IsSkippedDNSServer(%q) = %v, want %v", address, got, want)
+		}
+	}
+	internet.SkipDNSServers(nil)
+	if internet.IsSkippedDNSServer("203.0.113.53:53") {
+		t.Error("still skipped after SkipDNSServers(nil)")
+	}
+}