Try pass RST

https://github.com/XTLS/Xray-core/pull/6640#issuecomment-5420106315

Fixes https://github.com/XTLS/Xray-core/issues/6636
Fixes https://github.com/XTLS/Xray-core/issues/6600
...

app/observatory/observer.go

@@ -78,6 +78,12 @@ func (o *Observer) background() {
 			sleepTime = time.Duration(o.config.ProbeInterval)
 		}
 
+		if len(outbounds) == 0 {
+			errors.LogWarning(o.ctx, "no outbound matches subjectSelector ", o.config.SubjectSelector)
+			time.Sleep(sleepTime)
+			continue
+		}
+
 		if !o.config.EnableConcurrency {
 			sort.Strings(outbounds)
 			for _, v := range outbounds {

app/router/balancing.go

@@ -136,7 +136,7 @@ func (b *Balancer) SelectOutbounds() ([]string, error) {
 
 // GetPrincipleTarget implements routing.BalancerPrincipleTarget
 func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		if s, ok := b.strategy.(BalancingPrincipleTarget); ok {
 			candidates, err := b.SelectOutbounds()
 			if err != nil {
@@ -151,7 +151,7 @@ func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {
 
 // SetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) SetOverrideTarget(tag, target string) error {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		b.override.Put(target)
 		return nil
 	}
@@ -160,7 +160,7 @@ func (r *Router) SetOverrideTarget(tag, target string) error {
 
 // GetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) GetOverrideTarget(tag string) (string, error) {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		return b.override.Get(), nil
 	}
 	return "", errors.New("cannot find tag")

app/router/balancing_override.go

@@ -2,25 +2,8 @@ package router
 
 import (
 	sync "sync"
-
-	"github.com/xtls/xray-core/common/errors"
 )
 
-func (r *Router) OverrideBalancer(balancer string, target string) error {
-	var b *Balancer
-	for tag, bl := range r.balancers {
-		if tag == balancer {
-			b = bl
-			break
-		}
-	}
-	if b == nil {
-		return errors.New("balancer '", balancer, "' not found")
-	}
-	b.override.Put(target)
-	return nil
-}
-
 type overrideSettings struct {
 	target string
 }

app/router/router.go

@@ -2,7 +2,9 @@ package router
 
 import (
 	"context"
+	"maps"
 	"sync"
+	"sync/atomic"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
@@ -17,8 +19,8 @@ import (
 // Router is an implementation of routing.Router.
 type Router struct {
 	domainStrategy Config_DomainStrategy
-	rules          []*Rule
-	balancers      map[string]*Balancer
+	rules          atomic.Pointer[[]*Rule]
+	balancers      atomic.Pointer[map[string]*Balancer]
 	dns            dns.Client
 
 	ctx        context.Context
@@ -43,52 +45,9 @@ func (r *Router) Init(ctx context.Context, config *Config, d dns.Client, ohm out
 	r.ohm = ohm
 	r.dispatcher = dispatcher
 
-	r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
-	for _, rule := range config.BalancingRule {
-		balancer, err := rule.Build(ohm, dispatcher)
-		if err != nil {
-			return err
-		}
-		balancer.InjectContext(ctx)
-		r.balancers[rule.Tag] = balancer
-	}
-
-	r.rules = make([]*Rule, 0, len(config.Rule))
-	for _, rule := range config.Rule {
-		cond, err := rule.BuildCondition()
-		if err != nil {
-			r.closeWebhooks()
-			return err
-		}
-		rr := &Rule{
-			Condition: cond,
-			Tag:       rule.GetTag(),
-			RuleTag:   rule.GetRuleTag(),
-		}
-		if wh := rule.GetWebhook(); wh != nil {
-			notifier, err := NewWebhookNotifier(wh)
-			if err != nil {
-				r.closeWebhooks()
-				return err
-			}
-			rr.Webhook = notifier
-		}
-		btag := rule.GetBalancingTag()
-		if len(btag) > 0 {
-			brule, found := r.balancers[btag]
-			if !found {
-				if rr.Webhook != nil {
-					rr.Webhook.Close()
-				}
-				r.closeWebhooks()
-				return errors.New("balancer ", btag, " not found")
-			}
-			rr.Balancer = brule
-		}
-		r.rules = append(r.rules, rr)
-	}
-
-	return nil
+	r.rules.Store(new([]*Rule))
+	r.balancers.Store(&map[string]*Balancer{})
+	return r.ReloadRules(config, false)
 }
 
 // PickRoute implements routing.Router.
@@ -124,18 +83,22 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	if !shouldAppend {
-		for _, rule := range r.rules {
-			if rule.Webhook != nil {
-				rule.Webhook.Close()
-			}
+	oldRules := *r.rules.Load()
+	oldBalancers := *r.balancers.Load()
+
+	var newRules []*Rule
+	newBalancers := make(map[string]*Balancer)
+	existTags := make(map[string]bool, len(oldRules)+len(config.Rule))
+	if shouldAppend {
+		newRules = append(newRules, oldRules...)
+		maps.Copy(newBalancers, oldBalancers)
+		for _, rule := range oldRules {
+			existTags[rule.RuleTag] = true
 		}
-		r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
-		r.rules = make([]*Rule, 0, len(config.Rule))
 	}
+
 	for _, rule := range config.BalancingRule {
-		_, found := r.balancers[rule.Tag]
-		if found {
+		if _, found := newBalancers[rule.Tag]; found {
 			return errors.New("duplicate balancer tag")
 		}
 		balancer, err := rule.Build(r.ohm, r.dispatcher)
@@ -143,27 +106,12 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			return err
 		}
 		balancer.InjectContext(r.ctx)
-		r.balancers[rule.Tag] = balancer
-	}
-
-	startIdx := len(r.rules)
-	closeNewWebhooks := func() {
-		for i := startIdx; i < len(r.rules); i++ {
-			if r.rules[i].Webhook != nil {
-				r.rules[i].Webhook.Close()
-			}
-		}
-		r.rules = r.rules[:startIdx]
+		newBalancers[rule.Tag] = balancer
 	}
 
 	for _, rule := range config.Rule {
-		if r.RuleExists(rule.GetRuleTag()) {
-			closeNewWebhooks()
-			return errors.New("duplicate ruleTag ", rule.GetRuleTag())
-		}
 		cond, err := rule.BuildCondition()
 		if err != nil {
-			closeNewWebhooks()
 			return err
 		}
 		rr := &Rule{
@@ -171,69 +119,64 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			Tag:       rule.GetTag(),
 			RuleTag:   rule.GetRuleTag(),
 		}
+		if rr.RuleTag != "" && existTags[rr.RuleTag] {
+			return errors.New("duplicate ruleTag ", rr.RuleTag)
+		}
+		existTags[rr.RuleTag] = true
 		if wh := rule.GetWebhook(); wh != nil {
 			notifier, err := NewWebhookNotifier(wh)
 			if err != nil {
-				closeNewWebhooks()
 				return err
 			}
 			rr.Webhook = notifier
 		}
-		btag := rule.GetBalancingTag()
-		if len(btag) > 0 {
-			brule, found := r.balancers[btag]
+		if btag := rule.GetBalancingTag(); len(btag) > 0 {
+			brule, found := newBalancers[btag]
 			if !found {
-				if rr.Webhook != nil {
-					rr.Webhook.Close()
-				}
-				closeNewWebhooks()
 				return errors.New("balancer ", btag, " not found")
 			}
 			rr.Balancer = brule
 		}
-		r.rules = append(r.rules, rr)
+		newRules = append(newRules, rr)
 	}
 
+	r.balancers.Store(&newBalancers)
+	r.rules.Store(&newRules)
+	if !shouldAppend {
+		closeWebhooks(oldRules)
+	}
 	return nil
 }
 
-func (r *Router) RuleExists(tag string) bool {
-	if tag != "" {
-		for _, rule := range r.rules {
-			if rule.RuleTag == tag {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 // RemoveRule implements routing.Router.
 func (r *Router) RemoveRule(tag string) error {
+	if tag == "" {
+		return errors.New("empty tag name!")
+	}
+
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	newRules := []*Rule{}
-	if tag != "" {
-		for _, rule := range r.rules {
-			if rule.RuleTag != tag {
-				newRules = append(newRules, rule)
-			} else if rule.Webhook != nil {
-				rule.Webhook.Close()
-			}
+	oldRules := *r.rules.Load()
+	newRules := make([]*Rule, 0, len(oldRules))
+	var removed []*Rule
+	for _, rule := range oldRules {
+		if rule.RuleTag != tag {
+			newRules = append(newRules, rule)
+		} else {
+			removed = append(removed, rule)
 		}
-		r.rules = newRules
-		return nil
 	}
-	return errors.New("empty tag name!")
+	r.rules.Store(&newRules)
+	closeWebhooks(removed)
+	return nil
 }
 
 // ListRule implements routing.Router
 func (r *Router) ListRule() []routing.Route {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	ruleList := make([]routing.Route, 0)
-	for _, rule := range r.rules {
+	rules := *r.rules.Load()
+	ruleList := make([]routing.Route, 0, len(rules))
+	for _, rule := range rules {
 		ruleList = append(ruleList, &Route{
 			outboundTag: rule.Tag,
 			ruleTag:     rule.RuleTag,
@@ -252,7 +195,9 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 		ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)
 	}
 
-	for _, rule := range r.rules {
+	rules := *r.rules.Load()
+
+	for _, rule := range rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -265,7 +210,7 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 	ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)
 
 	// Try applying rules again if we have IPs.
-	for _, rule := range r.rules {
+	for _, rule := range rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -279,9 +224,9 @@ func (r *Router) Start() error {
 	return nil
 }
 
-// closeWebhooks closes all webhook notifiers in the current rule set.
-func (r *Router) closeWebhooks() {
-	for _, rule := range r.rules {
+// closeWebhooks closes all webhook notifiers in the given rule set.
+func closeWebhooks(rules []*Rule) {
+	for _, rule := range rules {
 		if rule.Webhook != nil {
 			rule.Webhook.Close()
 		}
@@ -292,7 +237,7 @@ func (r *Router) closeWebhooks() {
 func (r *Router) Close() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	r.closeWebhooks()
+	closeWebhooks(*r.rules.Load())
 	return nil
 }
 

app/router/webhook.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -40,6 +41,7 @@ type WebhookNotifier struct {
 	deduplication uint32
 	client        *http.Client
 	seen          sync.Map
+	lastSweep     atomic.Int64
 	done          chan struct{}
 	wg            sync.WaitGroup
 	closeOnce     sync.Once
@@ -77,11 +79,6 @@ func NewWebhookNotifier(cfg *WebhookConfig) (*WebhookNotifier, error) {
 		}
 	}
 
-	if h.deduplication > 0 {
-		h.wg.Add(1)
-		go h.cleanupLoop()
-	}
-
 	return h, nil
 }
 
@@ -201,6 +198,7 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	}
 	ttl := time.Duration(h.deduplication) * time.Second
 	now := time.Now()
+	h.maybeSweep(now, ttl)
 	if v, loaded := h.seen.LoadOrStore(email, now); loaded {
 		if now.Sub(v.(time.Time)) < ttl {
 			return true
@@ -210,27 +208,23 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	return false
 }
 
-func (h *WebhookNotifier) cleanupLoop() {
-	defer h.wg.Done()
-	ttl := time.Duration(h.deduplication) * time.Second
-	ticker := time.NewTicker(ttl)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-h.done:
-			return
-		case <-ticker.C:
-			now := time.Now()
-			h.seen.Range(func(key, value any) bool {
-				if now.Sub(value.(time.Time)) >= ttl {
-					h.seen.Delete(key)
-				}
-				return true
-			})
-		}
+func (h *WebhookNotifier) maybeSweep(now time.Time, ttl time.Duration) {
+	last := h.lastSweep.Load()
+	if now.UnixNano()-last < int64(ttl) {
+		return
 	}
+	if !h.lastSweep.CompareAndSwap(last, now.UnixNano()) {
+		return // another goroutine did the sweep
+	}
+	h.seen.Range(func(key, value any) bool {
+		if now.Sub(value.(time.Time)) >= ttl {
+			h.seen.Delete(key)
+		}
+		return true
+	})
 }
 
+// Only need to call if the Notifier is really used, otherwise GC can clean it
 func (h *WebhookNotifier) Close() error {
 	h.closeOnce.Do(func() {
 		close(h.done)

common/protocol/bittorrent/bittorrent.go

@@ -3,11 +3,8 @@ package bittorrent
 import (
 	"encoding/binary"
 	"errors"
-	"math"
-	"time"
 
 	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/buf"
 )
 
 type SniffHeader struct{}
@@ -39,50 +36,44 @@ func SniffUTP(b []byte) (*SniffHeader, error) {
 		return nil, common.ErrNoClue
 	}
 
-	buffer := buf.FromBytes(b)
-
-	var typeAndVersion uint8
-
-	if binary.Read(buffer, binary.BigEndian, &typeAndVersion) != nil {
-		return nil, common.ErrNoClue
-	} else if b[0]>>4&0xF > 4 || b[0]&0xF != 1 {
+	// type 4 (ST_SYN), version 1
+	if b[0] != 0x41 {
 		return nil, errNotBittorrent
 	}
 
-	var extension uint8
-
-	if binary.Read(buffer, binary.BigEndian, &extension) != nil {
-		return nil, common.ErrNoClue
-	} else if extension != 0 && extension != 1 {
+	// timestamp_difference is always 0 in new connections
+	if binary.BigEndian.Uint32(b[8:12]) != 0 {
 		return nil, errNotBittorrent
 	}
 
+	// Walk the extension chain. Selective ack (1) and extension bits (2)
+	extension, offset := b[1], 20
 	for extension != 0 {
-		if extension != 1 {
+		if len(b) < offset+2 {
 			return nil, errNotBittorrent
 		}
-		if binary.Read(buffer, binary.BigEndian, &extension) != nil {
-			return nil, common.ErrNoClue
+		length := int(b[offset+1])
+		switch extension {
+		case 1: // selective ack
+			if length < 4 || length%4 != 0 {
+				return nil, errNotBittorrent
+			}
+		case 2: // extension bits: fixed 8 bytes, sent in ST_SYN by µTorrent
+			if length != 8 {
+				return nil, errNotBittorrent
+			}
+		default:
+			return nil, errNotBittorrent
 		}
-
-		var length uint8
-		if err := binary.Read(buffer, binary.BigEndian, &length); err != nil {
-			return nil, common.ErrNoClue
-		}
-		if common.Error2(buffer.ReadBytes(int32(length))) != nil {
-			return nil, common.ErrNoClue
+		if len(b) < offset+2+length {
+			return nil, errNotBittorrent
 		}
+		extension = b[offset]
+		offset += 2 + length
 	}
 
-	if common.Error2(buffer.ReadBytes(2)) != nil {
-		return nil, common.ErrNoClue
-	}
-
-	var timestamp uint32
-	if err := binary.Read(buffer, binary.BigEndian, &timestamp); err != nil {
-		return nil, common.ErrNoClue
-	}
-	if math.Abs(float64(time.Now().UnixMicro()-int64(timestamp))) > float64(24*time.Hour) {
+	// extensions should consume all ST_SYN payload
+	if len(b) != offset {
 		return nil, errNotBittorrent
 	}
 

common/protocol/bittorrent/bittorrent_test.go

@@ -0,0 +1,67 @@
+package bittorrent
+
+import (
+	"encoding/binary"
+	"testing"
+
+	"github.com/xtls/xray-core/common"
+)
+
+// utpPacket builds the fixed 20-byte header defined by BEP 29.
+func utpPacket(packetType, extension byte, tsDiff uint32, payload ...byte) []byte {
+	b := make([]byte, 20)
+	b[0] = packetType<<4 | 1
+	b[1] = extension
+	binary.BigEndian.PutUint16(b[2:4], 0x4a3f)     // connection_id, random
+	binary.BigEndian.PutUint32(b[4:8], 0x8c3a91d2) // timestamp_microseconds, sender's clock
+	binary.BigEndian.PutUint32(b[8:12], tsDiff)
+	binary.BigEndian.PutUint32(b[12:16], 0x00100000) // wnd_size
+	binary.BigEndian.PutUint16(b[16:18], 0x71ee)     // seq_nr, random in libutp/libtorrent
+	binary.BigEndian.PutUint16(b[18:20], 0x0000)     // ack_nr
+	return append(b, payload...)
+}
+
+func TestSniffUTP(t *testing.T) {
+	selectiveAck := []byte{0, 4, 0xff, 0x00, 0xff, 0x00}
+	wrongVersion := utpPacket(4, 0, 0)
+	wrongVersion[0] = 4<<4 | 2
+
+	cases := []struct {
+		name    string
+		payload []byte
+		err     error
+	}{
+		{"syn", utpPacket(4, 0, 0), nil},
+		{"syn with selective ack", append(utpPacket(4, 1, 0), selectiveAck...), nil},
+		{"syn with extension bits", append(utpPacket(4, 2, 0), 0, 8, 1, 2, 3, 4, 5, 6, 7, 8), nil},
+		{"extension bits with wrong length", append(utpPacket(4, 2, 0), 0, 4, 1, 2, 3, 4), errNotBittorrent},
+		{"syn with nonzero timestamp_difference", utpPacket(4, 0, 0x1234), errNotBittorrent},
+		{"syn with trailing payload", utpPacket(4, 0, 0, 'x'), errNotBittorrent},
+		// txid 0x4100, no EDNS0: the worst case colliding with the uTP header
+		{"dns query", []byte{
+			0x41, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x01, 'a', 0x02, 'c', 'o', 0x00, 0x00, 0x01, 0x00, 0x01,
+		}, errNotBittorrent},
+		{"established connection packets", utpPacket(0, 0, 0x5678, 'x', 'y', 'z'), errNotBittorrent},
+		{"state", utpPacket(2, 0, 0x5678), errNotBittorrent},
+		{"fin", utpPacket(1, 0, 0x5678), errNotBittorrent},
+		{"wrong version", wrongVersion, errNotBittorrent},
+		{"unknown packet type", utpPacket(5, 0, 0), errNotBittorrent},
+		{"unknown extension", utpPacket(4, 2, 0), errNotBittorrent},
+		{"extension chain past the datagram", utpPacket(4, 1, 0, 0, 8, 0xff), errNotBittorrent},
+		{"selective ack not in multiples of 4", append(utpPacket(4, 1, 0), 0, 3, 0xff, 0x00, 0xff), errNotBittorrent},
+		{"shorter than the header", utpPacket(4, 0, 0)[:19], common.ErrNoClue},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h, err := SniffUTP(c.payload)
+			if err != c.err {
+				t.Fatalf("expected error %v, got %v", c.err, err)
+			}
+			if err == nil && h == nil {
+				t.Fatal("expected a sniff header, got nil")
+			}
+		})
+	}
+}

common/reflect/marshal_test.go

@@ -207,6 +207,7 @@ func getConfig() string {
       "tag": "XHTTP_IN",
       "streamSettings": {
         "network": "xhttp",
+		"security": "tls",
         "xhttpSettings": {
           "host": "bing.com",
           "path": "/xhttp_client_upload",

go.mod

@@ -21,7 +21,7 @@ require (
 	github.com/sagernet/sing-shadowsocks v0.2.7
 	github.com/stretchr/testify v1.12.1
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f
+	github.com/xtls/reality v0.0.0-20260827183302-8530a57042be
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
 	golang.org/x/crypto v0.55.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842

go.sum

@@ -73,8 +73,8 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
-github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f h1:iy2JRioxmUpoJ3SzbFPyTxHZMbR/rSHP7dOOgYaq1O8=
-github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
+github.com/xtls/reality v0.0.0-20260827183302-8530a57042be h1:0MCMg+ylSR2kIWtRUgMH+1zk+lRksbH7pIY4lGHSFKY=
+github.com/xtls/reality v0.0.0-20260827183302-8530a57042be/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

infra/conf/common.go

@@ -65,6 +65,9 @@ func (v *Address) UnmarshalJSON(data []byte) error {
 }
 
 func (v *Address) Build() *net.IPOrDomain {
+	if v == nil {
+		return nil
+	}
 	return net.NewIPOrDomain(v.Address)
 }
 

infra/conf/wireguard.go

@@ -66,6 +66,7 @@ type WireGuardConfig struct {
 	MTU            int32                  `json:"mtu"`
 	Reserved       []byte                 `json:"reserved"`
 	DomainStrategy string                 `json:"domainStrategy"`
+	DNS            []string               `json:"remoteDNS"`
 }
 
 func (c *WireGuardConfig) Build() (proto.Message, error) {
@@ -141,6 +142,7 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 
 	config.IsClient = c.IsClient
 	config.NoKernelTun = c.NoKernelTun
+	config.DNS = c.DNS
 
 	return config, nil
 }

infra/conf/xray.go

@@ -140,7 +140,7 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 	// TUN inbound doesn't need port configuration as it uses network interface instead
 	if strings.ToLower(c.Protocol) == "tun" {
 		// Skip port validation for TUN
-	} else if c.ListenOn == nil {
+	} else if c.ListenOn == nil || len(c.ListenOn.String()) == 0 {
 		// Listen on anyip, must set PortList
 		if c.PortList == nil {
 			return nil, errors.New("Listen on AnyIP but no Port(s) set in InboundDetour.")
@@ -251,13 +251,13 @@ func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *pr
 		if vlessCfg.Encryption != "" && vlessCfg.Encryption != "none" {
 			return nil
 		}
-		if requiresTransportSecurity(vlessCfg.Address) {
+		if requiresTransportSecurity(vlessCfg.Vnext[0].Address) {
 			return errors.New("vless without TLS or other encryption is prohibited unless the server address is a private IP or domain")
 		}
 	}
 
 	if tjCfg, ok := rawConfig.(*TrojanClientConfig); ok {
-		if requiresTransportSecurity(tjCfg.Address) {
+		if requiresTransportSecurity(tjCfg.Servers[0].Address) {
 			return errors.New("trojan without TLS is prohibited unless the server address is a private IP or domain")
 		}
 	}
@@ -358,13 +358,13 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	if err != nil {
 		return nil, errors.New("failed to load outbound detour config for protocol ", c.Protocol).Base(err)
 	}
-	if err := validateOutboundTransportSecurity(rawConfig, senderSettings); err != nil {
-		return nil, err
-	}
 	ts, err := rawConfig.(Buildable).Build()
 	if err != nil {
 		return nil, errors.New("failed to build outbound handler for protocol ", c.Protocol).Base(err)
 	}
+	if err := validateOutboundTransportSecurity(rawConfig, senderSettings); err != nil {
+		return nil, err
+	}
 
 	return &core.OutboundHandlerConfig{
 		SenderSettings: serial.ToTypedMessage(senderSettings),

proxy/dokodemo/fakeudp_openbsd.go

@@ -12,12 +12,29 @@ import (
 )
 
 func FakeUDP(addr *net.UDPAddr, mark int) (net.PacketConn, error) {
-	ip4 := addr.IP.To4()
-	if ip4 == nil {
-		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("IPv6 is not supported by the OpenBSD transparent UDP patch")}
+	domain := unix.AF_INET6
+	var sockaddr unix.Sockaddr
+	if ip4 := addr.IP.To4(); ip4 != nil {
+		domain = unix.AF_INET
+		sa := &unix.SockaddrInet4{Port: addr.Port}
+		copy(sa.Addr[:], ip4)
+		sockaddr = sa
+	} else if ip6 := addr.IP.To16(); ip6 != nil {
+		sa := &unix.SockaddrInet6{Port: addr.Port}
+		copy(sa.Addr[:], ip6)
+		if addr.Zone != "" {
+			iface, err := net.InterfaceByName(addr.Zone)
+			if err != nil {
+				return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("resolve zone %s: %w", addr.Zone, err)}
+			}
+			sa.ZoneId = uint32(iface.Index)
+		}
+		sockaddr = sa
+	} else {
+		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("unsupported address %v", addr.IP)}
 	}
 
-	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
+	fd, err := unix.Socket(domain, unix.SOCK_DGRAM, 0)
 	if err != nil {
 		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("socket open: %w", err)}
 	}
@@ -35,9 +52,12 @@ func FakeUDP(addr *net.UDPAddr, mark int) (net.PacketConn, error) {
 	if err = unix.SetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_REUSEADDR, 1); err != nil {
 		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("set socket option SO_REUSEADDR: %w", err)}
 	}
+	// Several client sessions can be answered from the same original
+	// destination at the same time, so the address has to be shareable.
+	if err = unix.SetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
+		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("set socket option SO_REUSEPORT: %w", err)}
+	}
 
-	sockaddr := &unix.SockaddrInet4{Port: addr.Port}
-	copy(sockaddr.Addr[:], ip4)
 	if err = unix.Bind(fd, sockaddr); err != nil {
 		return nil, &net.OpError{Op: "fake", Err: fmt.Errorf("bind %s: %w", addr.String(), err)}
 	}

proxy/http/client.go

@@ -173,15 +173,18 @@ func fillRequestHeader(ctx context.Context, header []*Header) ([]*Header, error)
 	outbounds := session.OutboundsFromContext(ctx)
 	ob := outbounds[len(outbounds)-1]
 
-	if inbound == nil || ob == nil {
-		return nil, errors.New("missing inbound or outbound metadata from context")
+	var src net.Destination
+	if inbound != nil {
+		src = inbound.Source
+	} else {
+		src = net.TCPDestination(net.AnyIP, 0)
 	}
 
 	data := struct {
 		Source net.Destination
 		Target net.Destination
 	}{
-		Source: inbound.Source,
+		Source: src,
 		Target: ob.Target,
 	}
 

proxy/tun/tun_darwin.go

@@ -11,6 +11,8 @@ import (
 	"os"
 	"strconv"
 	"sync"
+	"sync/atomic"
+	"time"
 	"unsafe"
 
 	"github.com/xtls/xray-core/common/buf"
@@ -38,21 +40,111 @@ const (
 	ND6_INFINITE_LIFETIME = 0xFFFFFFFF // netinet6/nd6.h
 )
 
-//go:linkname procyield runtime.procyield
-func procyield(cycles uint32)
-
 type DarwinTun struct {
 	tunFile *os.File
 	options *Config
 	tunFd   int
 	ownsFd  bool // true for macOS (we created the fd), false for iOS (fd from system)
 
+	// Genuinely blocks Wait() until tunFd is readable, instead of the
+	// previous procyield-only busy-spin (dispatchLoop in
+	// stack_gvisor_endpoint.go calls ReadPacket() then Wait() in a tight
+	// loop with no other throttling whenever the queue is empty -- with
+	// only procyield(1), that pins a full CPU core for as long as the
+	// tunnel is up, observed causing severe device heating/thermal
+	// shutdown). nil if kqueue setup failed, in which case Wait() falls
+	// back to a bounded time.Sleep instead. See waitKqueue's own doc
+	// comment for why this is a dedicated type rather than a bare fd.
+	waitKq *waitKqueue
+
 	routeMonitor     *os.File
 	routeMonitorOnce sync.Once
 	systemRoutes     []netip.Prefix
 	gateway          netip.Prefix
 }
 
+// waitKqueue owns a kqueue fd used by DarwinTun.Wait() to block on
+// read-readiness. Closing and waiting can race from different goroutines
+// (Close() from the caller that tears down the tunnel, Wait() from
+// dispatchLoop's own goroutine) -- reviewer feedback on XTLS/Xray-core#6580
+// found that a bare `int` fd field let Close() race Wait()'s use of the
+// same fd number, and on Darwin a closed fd number can be reused by an
+// unrelated concurrent open() before Wait() gets to call Kevent on it,
+// so Wait() could end up polling (or Close() could end up closing) a
+// completely unrelated file descriptor. This type makes closing
+// idempotent (sync.Once) and gates every Kevent call behind an atomic
+// "closed" flag checked immediately before the syscall, so Wait() never
+// issues a kevent syscall against a fd number that Close() has already
+// (or is concurrently) invalidated -- there's still a narrow window where
+// Wait() checks-then-uses the fd, but Close() only actually closes it
+// after Wait() cannot start a new syscall on it (the flag is set first,
+// synchronized with acquire/release semantics), which is sufficient since
+// Wait()'s Kevent call itself is what's being raced, not a fd read/write.
+type waitKqueue struct {
+	fd     int
+	closed atomic.Bool
+	once   sync.Once
+}
+
+// newWaitKqueue creates a kqueue registered for read-readiness on fd, for
+// Wait() to block on. Returns nil if anything fails, so callers can fall
+// back to a bounded sleep rather than error out of NewTun over what is
+// purely a CPU-efficiency concern.
+func newWaitKqueue(fd int) *waitKqueue {
+	kq, err := unix.Kqueue()
+	if err != nil {
+		return nil
+	}
+	_, err = unix.Kevent(kq, []unix.Kevent_t{{
+		Ident:  uint64(fd),
+		Filter: unix.EVFILT_READ,
+		Flags:  unix.EV_ADD | unix.EV_ENABLE,
+	}}, nil, nil)
+	if err != nil {
+		_ = unix.Close(kq)
+		return nil
+	}
+	return &waitKqueue{fd: kq}
+}
+
+// wait blocks until the registered fd is readable, timeout elapses, or a
+// benign interrupt occurs -- all three are "this kqueue is still healthy,
+// the caller should just try again" and return true; the caller
+// (DarwinTun.Wait) doesn't need to distinguish them since it always calls
+// ReadPacket() right after anyway, and that already handles "nothing was
+// actually there" via ErrQueueEmpty. Returns false only when the kqueue
+// itself is no longer usable -- already closed, or the kevent syscall
+// failed for a reason other than EINTR -- see its own call site in
+// DarwinTun.Wait for why a persistent failure must not be silently
+// retried forever (reviewer feedback, XTLS/Xray-core#6580 P2).
+func (w *waitKqueue) wait(timeout time.Duration) (ok bool) {
+	if w.closed.Load() {
+		return false
+	}
+	events := make([]unix.Kevent_t, 1)
+	ts := unix.NsecToTimespec(timeout.Nanoseconds())
+	_, err := unix.Kevent(w.fd, nil, events, &ts)
+	if err != nil {
+		return errors.Is(err, unix.EINTR)
+	}
+	return true
+}
+
+// close marks the kqueue as unusable (so any Wait() call that hasn't yet
+// entered the kevent syscall bails out instead) and closes the underlying
+// fd exactly once, regardless of how many times close is called or
+// whether it races a Wait() already inside its kevent syscall (that call
+// either completes against the still-open fd or returns an error safely
+// -- either way, no other goroutine can be handed this fd number in
+// between the atomic flag flip and the actual close, since nothing else
+// in this type ever creates a new kqueue with the same field).
+func (w *waitKqueue) close() {
+	w.once.Do(func() {
+		w.closed.Store(true)
+		_ = unix.Close(w.fd)
+	})
+}
+
 var (
 	_ Tun          = (*DarwinTun)(nil)
 	_ GVisorDevice = (*DarwinTun)(nil)
@@ -77,6 +169,7 @@ func NewTun(options *Config) (Tun, error) {
 			options: options,
 			tunFd:   fd,
 			ownsFd:  false,
+			waitKq:  newWaitKqueue(fd),
 		}, nil
 	}
 
@@ -103,6 +196,7 @@ func NewTun(options *Config) (Tun, error) {
 		options: options,
 		tunFd:   int(tunFile.Fd()),
 		ownsFd:  true,
+		waitKq:  newWaitKqueue(int(tunFile.Fd())),
 		gateway: gateway,
 	}, nil
 }
@@ -134,6 +228,9 @@ func (t *DarwinTun) Close() error {
 			_ = t.routeMonitor.Close()
 		}
 	})
+	if t.waitKq != nil {
+		t.waitKq.close()
+	}
 	routeErr := t.unsetSystemRoutes()
 	if t.ownsFd {
 		return xerrors.Combine(routeErr, t.tunFile.Close())
@@ -242,9 +339,43 @@ func (t *DarwinTun) ReadPacket() (byte, *stack.PacketBuffer, error) {
 	}), nil
 }
 
-// Wait some cpu cycles
+// Wait blocks until tunFd is readable (or a short timeout elapses), rather
+// than spinning the CPU -- see the waitKq field's own doc comment. A bounded
+// timeout (not an indefinite wait) keeps this responsive to a Close() that
+// happens to race a call already parked here.
+//
+// Reviewer feedback (XTLS/Xray-core#6580, P2): the original version
+// discarded every error from the underlying kevent syscall. dispatchLoop
+// (stack_gvisor_endpoint.go) calls ReadPacket() then Wait() in an
+// unconditional tight loop -- if kevent started failing at runtime for a
+// persistent reason (not just a benign EINTR), Wait() returning
+// immediately every time reintroduces exactly the busy-spin this whole
+// change exists to remove, just routed through a failing syscall instead
+// of procyield. waitKq.wait's own bool return distinguishes "genuinely
+// interrupted, try again" from "this kqueue is unusable now" -- Wait()
+// permanently falls back to the sleep path once that happens, rather than
+// retrying the same broken kqueue forever.
 func (t *DarwinTun) Wait() {
-	procyield(1)
+	if t.waitKq != nil && t.waitKq.wait(time.Second) {
+		return
+	}
+	if t.waitKq != nil {
+		// Persistent kevent failure (not a benign EINTR, and not just
+		// "the 1s timeout elapsed with nothing to read" -- wait() already
+		// returned true for both of those cases above). Stop trusting
+		// this kqueue for the rest of this DarwinTun's lifetime instead of
+		// re-attempting a syscall that's already shown it won't succeed.
+		t.waitKq.close()
+		t.waitKq = nil
+	}
+	// Reviewer feedback (XTLS/Xray-core#6580): procyield here is the same
+	// busy-spin this whole change exists to remove, just gated behind an
+	// edge case (kqueue setup failing, which practically never happens on
+	// real Darwin systems, or having just failed permanently above)
+	// instead of always -- a genuine bounded sleep actually yields the CPU
+	// instead of being a near-instant scheduler hint that lets the tight
+	// dispatchLoop caller spin just as hot as before.
+	time.Sleep(time.Millisecond)
 }
 
 func (t *DarwinTun) newEndpoint() (stack.LinkEndpoint, error) {

proxy/tun/tun_darwin_test.go

@@ -3,7 +3,11 @@
 package tun
 
 import (
+	"sync"
 	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
 )
 
 func TestSelectDarwinGatewayDefault(t *testing.T) {
@@ -47,3 +51,183 @@ func TestSelectDarwinGatewayRequiresUsableLocalAddress(t *testing.T) {
 		t.Fatal("expected error")
 	}
 }
+
+// newTestSocketpair returns a connected AF_UNIX/SOCK_DGRAM pair -- a real
+// fd DarwinTun.Wait's kqueue can register EVFILT_READ against, without
+// needing an actual utun interface (which requires root/network
+// entitlements this test environment doesn't have). Datagram sockets
+// (unlike pipes) support both "write makes readable" and "close makes
+// readable" the same way a tun fd's read-readiness behaves.
+func newTestSocketpair(t *testing.T) (a, b int) {
+	t.Helper()
+	fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_DGRAM, 0)
+	if err != nil {
+		t.Fatalf("socketpair: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = unix.Close(fds[0])
+		_ = unix.Close(fds[1])
+	})
+	return fds[0], fds[1]
+}
+
+// Reviewer feedback, XTLS/Xray-core#6580: "blocking with no data" case --
+// wait() must not return before the timeout when nothing is written.
+func TestWaitKqueueBlocksWithNoData(t *testing.T) {
+	a, _ := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+	defer kq.close()
+
+	start := time.Now()
+	ok := kq.wait(150 * time.Millisecond)
+	elapsed := time.Since(start)
+
+	if !ok {
+		t.Fatal("wait() returned false on a healthy kqueue with a plain timeout")
+	}
+	if elapsed < 100*time.Millisecond {
+		t.Fatalf("wait() returned after only %v, expected it to block close to the 150ms timeout", elapsed)
+	}
+}
+
+// Reviewer feedback: "wake up with a readable fd" case.
+func TestWaitKqueueWakesOnReadable(t *testing.T) {
+	a, b := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+	defer kq.close()
+
+	done := make(chan bool, 1)
+	go func() {
+		done <- kq.wait(5 * time.Second)
+	}()
+
+	time.Sleep(20 * time.Millisecond) // let wait() actually enter the syscall first
+	if _, err := unix.Write(b, []byte{0x1}); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	select {
+	case ok := <-done:
+		if !ok {
+			t.Fatal("wait() returned false after the fd became readable")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("wait() did not wake up within 2s of the fd becoming readable")
+	}
+}
+
+// Reviewer feedback: "timeout" case, explicitly (distinct from the
+// no-data test above, which also checks blocking duration -- this one
+// only checks the return value).
+func TestWaitKqueueTimesOut(t *testing.T) {
+	a, _ := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+	defer kq.close()
+
+	if !kq.wait(50 * time.Millisecond) {
+		t.Fatal("wait() returned false on a plain timeout with no error condition")
+	}
+}
+
+// Reviewer feedback: "Close() wakes a blocked wait" case, and the
+// no-double-close/no-fd-reuse concern (P1) -- close() while wait() is
+// parked in its syscall must not panic, must not leave wait() hung, and a
+// second close() call (from a caller that, say, calls Close() twice on
+// the same DarwinTun) must be safe.
+func TestWaitKqueueCloseDuringWaitIsSafe(t *testing.T) {
+	a, _ := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+
+	started := make(chan struct{})
+	done := make(chan bool, 1)
+	go func() {
+		close(started)
+		done <- kq.wait(5 * time.Second)
+	}()
+
+	<-started
+	time.Sleep(20 * time.Millisecond) // let wait() actually enter the syscall first
+	kq.close()
+	kq.close() // double-close must be idempotent, not panic or double-free the fd
+
+	select {
+	case <-done:
+		// Either true (the close-of-the-underlying-fd unblocked kevent, a
+		// real kqueue behavior) or false (wait() observed the closed flag
+		// first) is acceptable -- what matters is that it returned at all,
+		// promptly, without hanging or crashing.
+	case <-time.After(2 * time.Second):
+		t.Fatal("wait() did not return within 2s of close() being called")
+	}
+
+	// A wait() call *after* close() must return false immediately (the
+	// closed-flag fast path), not attempt a syscall against the
+	// already-closed (and potentially since-reused, on a real system) fd
+	// number.
+	if kq.wait(time.Second) {
+		t.Fatal("wait() returned true after close() -- should short-circuit via the closed flag")
+	}
+}
+
+// Reviewer feedback: "multiple/concurrent close guard" case -- many
+// goroutines calling close() concurrently must close the underlying fd
+// exactly once.
+func TestWaitKqueueConcurrentCloseIsSafe(t *testing.T) {
+	a, _ := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+
+	var wg sync.WaitGroup
+	for range 20 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			kq.close()
+		}()
+	}
+	wg.Wait()
+
+	if !kq.closed.Load() {
+		t.Fatal("closed flag not set after concurrent close() calls")
+	}
+}
+
+// Reviewer feedback: "kevent runtime failure without spinning" case (P2).
+// Simulates a kqueue that has gone bad (closed out from under it, as if a
+// concurrent/erroneous close happened) and confirms wait() reports it as
+// unusable (false) rather than silently returning true forever, which is
+// what DarwinTun.Wait relies on to permanently fall back to the sleep
+// path instead of re-entering a failing syscall on every dispatchLoop
+// iteration.
+func TestWaitKqueueReportsPersistentFailure(t *testing.T) {
+	a, _ := newTestSocketpair(t)
+	kq := newWaitKqueue(a)
+	if kq == nil {
+		t.Fatal("newWaitKqueue returned nil")
+	}
+	// Close the underlying kqueue fd directly (bypassing kq.close(), which
+	// would also set the closed flag) to simulate the fd going bad for a
+	// reason other than this type's own close() -- e.g. some other code
+	// path in the process closing it, or the kernel invalidating it.
+	_ = unix.Close(kq.fd)
+
+	for i := 0; i < 5; i++ {
+		if kq.wait(50 * time.Millisecond) {
+			t.Fatalf("wait() call %d returned true against a closed underlying fd -- should report failure, not spin", i)
+		}
+	}
+}

proxy/wireguard/client.go

@@ -5,9 +5,10 @@ import (
 	"fmt"
 	gonet "net"
 	"net/netip"
-	reflect "reflect"
+	"reflect"
 	"strings"
 	"sync"
+	"time"
 
 	"golang.zx2c4.com/wireguard/tun"
 
@@ -30,6 +31,11 @@ import (
 	"golang.zx2c4.com/wireguard/device"
 )
 
+type entry struct {
+	got  []net.IP
+	time time.Time
+}
+
 type Handler struct {
 	conf          *DeviceConfig
 	policyManager policy.Manager
@@ -43,6 +49,11 @@ type Handler struct {
 	tnet *Net
 	dev  *device.Device
 	mu   sync.Mutex
+
+	// TODO: cache cleanup loop
+	local   bool
+	cache   map[string]entry
+	cacheMu sync.Mutex
 }
 
 func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
@@ -98,6 +109,20 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 		return nil, err
 	}
 
+	local := false
+	dns := conf.DNS
+	if len(dns) == 0 {
+		dns = []string{"1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"}
+	}
+	if len(dns) == 1 && dns[0] == "local" {
+		local = true
+		dns = nil
+	}
+	dnses := make([]netip.Addr, 0, len(dns))
+	for _, dns := range dns {
+		dnses = append(dnses, netip.MustParseAddr(dns))
+	}
+
 	kernelTunSupported, err := KernelTunSupported()
 	if err != nil {
 		errors.LogWarningInner(context.Background(), err, "Failed to check kernel TUN support")
@@ -106,10 +131,10 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 	var tnet *Net
 	if !conf.NoKernelTun && kernelTunSupported {
 		errors.LogWarning(context.Background(), "Using kernel TUN")
-		tun, tnet, err = createKernelTun(localAddresses, []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("1.0.0.1"), netip.MustParseAddr("2606:4700:4700::1111"), netip.MustParseAddr("2606:4700:4700::1001")}, int(conf.Mtu))
+		tun, tnet, err = createKernelTun(localAddresses, dnses, int(conf.Mtu))
 	} else {
 		errors.LogWarning(context.Background(), "Using gVisor TUN")
-		tun, tnet, _, err = CreateNetTUN(localAddresses, []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("1.0.0.1"), netip.MustParseAddr("2606:4700:4700::1111"), netip.MustParseAddr("2606:4700:4700::1001")}, int(conf.Mtu), true)
+		tun, tnet, _, err = CreateNetTUN(localAddresses, dnses, int(conf.Mtu), true)
 	}
 	if err != nil {
 		return nil, err
@@ -126,6 +151,9 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 
 		tun:  tun,
 		tnet: tnet,
+
+		local: local,
+		cache: make(map[string]entry),
 	}, nil
 }
 
@@ -343,31 +371,34 @@ func (h *Handler) init(ctx context.Context) error {
 }
 
 func (h *Handler) resolveLocal(host string) (net.IP, error) {
-	return resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, error) {
-		ips, _, err := h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
-		return ips, err
+	return h.resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, uint32, error) {
+		return h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
 	})
 }
 
 func (h *Handler) resolveRemote(host string) (net.IP, error) {
-	return resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, error) {
-		addrs, err := h.tnet.LookupHost(host)
-		if err != nil {
-			return nil, err
+	return h.resolveDomain(host, h.conf.DomainStrategy, func(host string) ([]net.IP, uint32, error) {
+		if h.local {
+			return h.dns.LookupIP(host, dns.IPOption{IPv4Enable: true, IPv6Enable: true})
 		}
-		ips := make([]net.IP, 0, len(addrs))
-		for _, addr := range addrs {
-			ips = append(ips, net.ParseIP(addr))
-		}
-		return ips, nil
+		return h.tnet.LookupHost(host)
 	})
 }
 
-func resolveDomain(host string, strategy DeviceConfig_DomainStrategy, lookupIP func(host string) ([]net.IP, error)) (net.IP, error) {
+func (h *Handler) resolveDomain(host string, strategy DeviceConfig_DomainStrategy, lookupIP func(host string) ([]net.IP, uint32, error)) (net.IP, error) {
 	if ip := net.ParseIP(host); ip != nil {
 		return ip, nil
 	}
-	ips, err := lookupIP(host)
+	h.cacheMu.Lock()
+	if entry, ok := h.cache[host]; ok {
+		if time.Now().Before(entry.time) {
+			h.cacheMu.Unlock()
+			return entry.got[dice.Roll(len(entry.got))], nil
+		}
+		delete(h.cache, host)
+	}
+	h.cacheMu.Unlock()
+	ips, ttl, err := lookupIP(host)
 	if err != nil {
 		return nil, err
 	}
@@ -407,6 +438,13 @@ func resolveDomain(host string, strategy DeviceConfig_DomainStrategy, lookupIP f
 	if len(got) == 0 {
 		return nil, dns.ErrEmptyResponse
 	}
+	entry := entry{
+		got:  got,
+		time: time.Now().Add(time.Duration(ttl) * time.Second),
+	}
+	h.cacheMu.Lock()
+	h.cache[host] = entry
+	h.cacheMu.Unlock()
 	return got[dice.Roll(len(got))], nil
 }
 

proxy/wireguard/config.pb.go

@@ -164,6 +164,7 @@ type DeviceConfig struct {
 	DomainStrategy DeviceConfig_DomainStrategy `protobuf:"varint,7,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.proxy.wireguard.DeviceConfig_DomainStrategy" json:"domain_strategy,omitempty"`
 	IsClient       bool                        `protobuf:"varint,8,opt,name=is_client,json=isClient,proto3" json:"is_client,omitempty"`
 	NoKernelTun    bool                        `protobuf:"varint,9,opt,name=no_kernel_tun,json=noKernelTun,proto3" json:"no_kernel_tun,omitempty"`
+	DNS            []string                    `protobuf:"bytes,10,rep,name=DNS,proto3" json:"DNS,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -261,6 +262,13 @@ func (x *DeviceConfig) GetNoKernelTun() bool {
 	return false
 }
 
+func (x *DeviceConfig) GetDNS() []string {
+	if x != nil {
+		return x.DNS
+	}
+	return nil
+}
+
 var File_proxy_wireguard_config_proto protoreflect.FileDescriptor
 
 const file_proxy_wireguard_config_proto_rawDesc = "" +
@@ -275,7 +283,7 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
 	"keep_alive\x18\x04 \x01(\tR\tkeepAlive\x12\x1f\n" +
 	"\vallowed_ips\x18\x05 \x03(\tR\n" +
-	"allowedIps\"\xdc\x03\n" +
+	"allowedIps\"\xee\x03\n" +
 	"\fDeviceConfig\x12\x1d\n" +
 	"\n" +
 	"secret_key\x18\x01 \x01(\tR\tsecretKey\x12\x1a\n" +
@@ -286,7 +294,9 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\breserved\x18\x06 \x01(\fR\breserved\x12Z\n" +
 	"\x0fdomain_strategy\x18\a \x01(\x0e21.xray.proxy.wireguard.DeviceConfig.DomainStrategyR\x0edomainStrategy\x12\x1b\n" +
 	"\tis_client\x18\b \x01(\bR\bisClient\x12\"\n" +
-	"\rno_kernel_tun\x18\t \x01(\bR\vnoKernelTun\"\\\n" +
+	"\rno_kernel_tun\x18\t \x01(\bR\vnoKernelTun\x12\x10\n" +
+	"\x03DNS\x18\n" +
+	" \x03(\tR\x03DNS\"\\\n" +
 	"\x0eDomainStrategy\x12\f\n" +
 	"\bFORCE_IP\x10\x00\x12\r\n" +
 	"\tFORCE_IP4\x10\x01\x12\r\n" +

proxy/wireguard/config.proto

@@ -34,4 +34,5 @@ message DeviceConfig {
   DomainStrategy domain_strategy = 7;
   bool is_client = 8;
   bool no_kernel_tun = 9;
+  repeated string DNS = 10;
 }

proxy/wireguard/netstack.go

@@ -248,7 +248,7 @@ var (
 	errTimeout                      = errors.New("i/o timeout")
 )
 
-func (net *Net) LookupHost(host string) (addrs []string, err error) {
+func (net *Net) LookupHost(host string) (addrs []net.IP, ttl uint32, err error) {
 	return net.LookupContextHost(context.Background(), host)
 }
 
@@ -567,9 +567,9 @@ func (tnet *Net) tryOneName(ctx context.Context, name string, qtype dnsmessage.T
 	return dnsmessage.Parser{}, "", lastErr
 }
 
-func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string, error) {
+func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]net.IP, uint32, error) {
 	if host == "" || (!tnet.hasV6 && !tnet.hasV4) {
-		return nil, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
+		return nil, 0, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
 	}
 	zlen := len(host)
 	if strings.IndexByte(host, ':') != -1 {
@@ -578,11 +578,11 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string,
 		}
 	}
 	if ip, err := netip.ParseAddr(host[:zlen]); err == nil {
-		return []string{ip.String()}, nil
+		return []net.IP{ip.AsSlice()}, 0, nil
 	}
 
 	if !isDomainName(host) {
-		return nil, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
+		return nil, 0, &net.DNSError{Err: errNoSuchHost.Error(), Name: host, IsNotFound: true}
 	}
 	type result struct {
 		p      dnsmessage.Parser
@@ -611,6 +611,7 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string,
 			lane <- result{p, server, err}
 		}()
 	}
+	ttl := uint32(300)
 	for l := 0; l < lanes; l++ {
 		result := <-lane
 		if result.error != nil {
@@ -644,6 +645,7 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string,
 					}
 					break loop
 				}
+				ttl = min(ttl, h.TTL)
 				addrsV4 = append(addrsV4, netip.AddrFrom4(a.A))
 
 			case dnsmessage.TypeAAAA:
@@ -656,6 +658,7 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string,
 					}
 					break loop
 				}
+				ttl = min(ttl, h.TTL)
 				addrsV6 = append(addrsV6, netip.AddrFrom16(aaaa.AAAA))
 
 			default:
@@ -680,11 +683,11 @@ func (tnet *Net) LookupContextHost(ctx context.Context, host string) ([]string,
 	}
 
 	if len(addrs) == 0 && lastErr != nil {
-		return nil, lastErr
+		return nil, 0, lastErr
 	}
-	saddrs := make([]string, 0, len(addrs))
+	ips := make([]net.IP, 0, len(addrs))
 	for _, ip := range addrs {
-		saddrs = append(saddrs, ip.String())
+		ips = append(ips, ip.AsSlice())
 	}
-	return saddrs, nil
+	return ips, ttl, nil
 }

transport/internet/sockopt_openbsd.go

@@ -14,11 +14,18 @@ func applyOutboundSocketOptions(network string, address string, fd uintptr, conf
 
 func applyInboundSocketOptions(network string, fd uintptr, config *SocketConfig) error {
 	if config.ReceiveOriginalDestAddress && isUDPSocket(network) {
-		if err := unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVDSTADDR, 1); err != nil {
-			return errors.New("failed to set IP_RECVDSTADDR").Base(err)
+		// Only the options matching the socket's address family are accepted,
+		// so one of the two pairs succeeding is enough.
+		err6 := unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVPKTINFO, 1)
+		if err6 == nil {
+			err6 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVDSTPORT, 1)
 		}
-		if err := unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVDSTPORT, 1); err != nil {
-			return errors.New("failed to set IP_RECVDSTPORT").Base(err)
+		err4 := unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVDSTADDR, 1)
+		if err4 == nil {
+			err4 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVDSTPORT, 1)
+		}
+		if err4 != nil && err6 != nil {
+			return errors.New("failed to enable receiving the original destination").Base(err4)
 		}
 	}
 	return nil

transport/internet/splithttp/client.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/http/httptrace"
 	"sync"
+	"sync/atomic"
 
 	"github.com/apernet/quic-go/http3"
 	"github.com/xtls/xray-core/common"
@@ -32,7 +33,7 @@ type DialerClient interface {
 type DefaultDialerClient struct {
 	transportConfig *Config
 	client          *http.Client
-	closed          bool
+	closed          atomic.Bool
 	httpVersion     string
 	// pool of net.Conn, created using dialUploadConn
 	uploadRawPool  *sync.Pool
@@ -40,7 +41,7 @@ type DefaultDialerClient struct {
 }
 
 func (c *DefaultDialerClient) IsClosed() bool {
-	return c.closed
+	return c.closed.Load()
 }
 
 func (c *DefaultDialerClient) OpenStream(ctx context.Context, url string, sessionId string, body io.Reader, uploadOnly bool) (wrc io.ReadCloser, remoteAddr, localAddr net.Addr, err error) {
@@ -72,7 +73,7 @@ func (c *DefaultDialerClient) OpenStream(ctx context.Context, url string, sessio
 		resp, err := c.client.Do(req)
 		if err != nil {
 			if !uploadOnly { // stream-down is enough
-				c.closed = true
+				c.closed.Store(true)
 				errors.LogInfoInner(ctx, err, "failed to "+method+" "+url)
 			}
 			gotConn.Close()
@@ -108,7 +109,7 @@ func (c *DefaultDialerClient) PostPacket(ctx context.Context, url string, sessio
 	if c.httpVersion != "1.1" {
 		resp, err := c.client.Do(req)
 		if err != nil {
-			c.closed = true
+			c.closed.Store(true)
 			return err
 		}
 
@@ -148,7 +149,7 @@ func (c *DefaultDialerClient) PostPacket(ctx context.Context, url string, sessio
 				if h1UploadConn.UnreadedResponsesCount > 0 {
 					resp, err := http.ReadResponse(h1UploadConn.RespBufReader, req)
 					if err != nil {
-						c.closed = true
+						c.closed.Store(true)
 						return fmt.Errorf("error while reading response: %s", err.Error())
 					}
 					io.Copy(io.Discard, resp.Body)

transport/internet/splithttp/config.go

@@ -1,6 +1,7 @@
 package splithttp
 
 import (
+	"bytes"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -330,14 +331,18 @@ func (c *Config) FillStreamRequest(request *http.Request, sessionId string, seqS
 func (c *Config) FillPacketRequest(request *http.Request, sessionId string, seqStr string, payload buf.MultiBuffer) error {
 	dataPlacement := c.GetNormalizedUplinkDataPlacement()
 
+	data := make([]byte, payload.Len())
+	payload.Copy(data)
+	buf.ReleaseMulti(payload)
+
 	if dataPlacement == PlacementBody || dataPlacement == PlacementAuto {
 		request.Header = c.GetRequestHeader()
-		request.Body = io.NopCloser(&buf.MultiBufferContainer{MultiBuffer: payload})
-		request.ContentLength = int64(payload.Len())
+		request.Body = io.NopCloser(bytes.NewReader(data))
+		request.ContentLength = int64(len(data))
+		request.GetBody = func() (io.ReadCloser, error) {
+			return io.NopCloser(bytes.NewReader(data)), nil
+		}
 	} else {
-		data := make([]byte, payload.Len())
-		payload.Copy(data)
-		buf.ReleaseMulti(payload)
 		switch dataPlacement {
 		case PlacementHeader:
 			request.Header = c.GetRequestHeaderWithPayload(data)

transport/internet/splithttp/config_test.go

@@ -1,9 +1,13 @@
 package splithttp_test
 
 import (
+	"io"
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
 	. "github.com/xtls/xray-core/transport/internet/splithttp"
 )
 
@@ -77,3 +81,35 @@ func Test_GetNormalizedPath(t *testing.T) {
 		})
 	}
 }
+
+func Test_FillPacketRequest_GetBody(t *testing.T) {
+	data := []byte("hello xray")
+	payload := buf.MergeBytes(nil, data)
+
+	req, err := http.NewRequest("POST", "https://example.com/", nil)
+	common.Must(err)
+
+	config := &Config{}
+	config.FillPacketRequest(req, "sess", "0", payload)
+
+	if req.GetBody == nil {
+		t.Fatalf("Expected GetBody to be set")
+	}
+
+	first, err := io.ReadAll(req.Body)
+	common.Must(err)
+
+	if string(data) != string(first) {
+		t.Fatalf("Body mismatch. Format %q and %q are not equal", data, first)
+	}
+
+	body2, err := req.GetBody()
+	common.Must(err)
+
+	second, err := io.ReadAll(body2)
+	common.Must(err)
+
+	if string(data) != string(second) {
+		t.Fatalf("Replayed body mismatch. Format %q and %q are not equal", data, second)
+	}
+}

transport/internet/splithttp/dialer.go

@@ -595,11 +595,12 @@ func (w uploadWriter) Write(b []byte) (int, error) {
 
 	var writed int
 	for _, buff := range buffer.MultiBuffer {
+		n := int(buff.Len())
 		err := w.WriteMultiBuffer(buf.MultiBuffer{buff})
 		if err != nil {
 			return writed, err
 		}
-		writed += int(buff.Len())
+		writed += n
 	}
 	return writed, nil
 }

transport/internet/tcp/hub.go

@@ -42,9 +42,6 @@ func ListenTCP(ctx context.Context, address net.Address, port net.Port, streamSe
 	var listener net.Listener
 	var err error
 	if port == net.Port(0) { // unix
-		if !address.Family().IsDomain() {
-			return nil, errors.New("invalid unix listen: ", address).AtError()
-		}
 		listener, err = internet.ListenSystem(ctx, &net.UnixAddr{
 			Name: address.Domain(),
 			Net:  "unix",

transport/internet/tcp_hub.go

@@ -65,6 +65,9 @@ func ListenTCP(ctx context.Context, address net.Address, port net.Port, settings
 	if address.Family().IsDomain() {
 		return nil, errors.New("domain address is not allowed for listening: ", address.Domain())
 	}
+	if port == 0 {
+		return nil, errors.New("port 0 is not allowed for listening on TCP")
+	}
 
 	protocol := settings.ProtocolName
 	listenFunc := transportListenerCache[protocol]

transport/internet/udp/hub_openbsd.go

@@ -17,23 +17,39 @@ func retrieveOriginalDestFromControlMessages(msgs []unix.SocketControlMessage) n
 	var havePort bool
 
 	for _, msg := range msgs {
-		if msg.Header.Level != unix.IPPROTO_IP {
-			continue
-		}
-
-		switch msg.Header.Type {
-		case unix.IP_RECVDSTADDR:
-			if len(msg.Data) < 4 {
-				continue
+		switch msg.Header.Level {
+		case unix.IPPROTO_IP:
+			switch msg.Header.Type {
+			case unix.IP_RECVDSTADDR:
+				if len(msg.Data) < 4 {
+					continue
+				}
+				ip = append(ip[:0], msg.Data[:4]...)
+				haveAddress = true
+			case unix.IP_RECVDSTPORT:
+				if len(msg.Data) < 2 {
+					continue
+				}
+				port = binary.BigEndian.Uint16(msg.Data[:2])
+				havePort = true
 			}
-			ip = append(ip[:0], msg.Data[:4]...)
-			haveAddress = true
-		case unix.IP_RECVDSTPORT:
-			if len(msg.Data) < 2 {
-				continue
+		case unix.IPPROTO_IPV6:
+			switch msg.Header.Type {
+			case unix.IPV6_PKTINFO:
+				// struct in6_pktinfo: the destination address is followed by
+				// the interface index.
+				if len(msg.Data) < 16 {
+					continue
+				}
+				ip = append(ip[:0], msg.Data[:16]...)
+				haveAddress = true
+			case unix.IPV6_RECVDSTPORT:
+				if len(msg.Data) < 2 {
+					continue
+				}
+				port = binary.BigEndian.Uint16(msg.Data[:2])
+				havePort = true
 			}
-			port = binary.BigEndian.Uint16(msg.Data[:2])
-			havePort = true
 		}
 	}
 

transport/internet/udp/hub_openbsd_test.go

@@ -33,6 +33,36 @@ func TestRetrieveOriginalDestFromControlMessages(t *testing.T) {
 	}
 }
 
+func TestRetrieveOriginalDestFromControlMessagesIPv6(t *testing.T) {
+	// 2001:db8::7 followed by the interface index, as in struct in6_pktinfo.
+	pktinfo := []byte{
+		0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0x07,
+		0x02, 0, 0, 0,
+	}
+	msgs := []unix.SocketControlMessage{
+		{
+			Header: unix.Cmsghdr{Level: unix.IPPROTO_IPV6, Type: unix.IPV6_RECVDSTPORT},
+			Data:   []byte{0x30, 0x39},
+		},
+		{
+			Header: unix.Cmsghdr{Level: unix.IPPROTO_IPV6, Type: unix.IPV6_PKTINFO},
+			Data:   pktinfo,
+		},
+	}
+
+	dest := retrieveOriginalDestFromControlMessages(msgs)
+	if !dest.IsValid() {
+		t.Fatal("destination is invalid")
+	}
+	if got, want := dest.Address.IP().String(), "2001:db8::7"; got != want {
+		t.Fatalf("address = %q, want %q", got, want)
+	}
+	if got, want := dest.Port.Value(), uint16(12345); got != want {
+		t.Fatalf("port = %d, want %d", got, want)
+	}
+}
+
 func TestRetrieveOriginalDestRequiresAddressAndPort(t *testing.T) {
 	tests := [][]unix.SocketControlMessage{
 		{
@@ -47,6 +77,18 @@ func TestRetrieveOriginalDestRequiresAddressAndPort(t *testing.T) {
 				Data:   []byte{0x30, 0x39},
 			},
 		},
+		{
+			{
+				Header: unix.Cmsghdr{Level: unix.IPPROTO_IPV6, Type: unix.IPV6_PKTINFO},
+				Data:   make([]byte, 20),
+			},
+		},
+		{
+			{
+				Header: unix.Cmsghdr{Level: unix.IPPROTO_IPV6, Type: unix.IPV6_RECVDSTPORT},
+				Data:   []byte{0x30, 0x39},
+			},
+		},
 	}
 
 	for _, msgs := range tests {