Update handler.go

.github/docker/Dockerfile

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/docker/Dockerfile.usa

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/workflows/docker.yml

@@ -64,14 +64,6 @@ jobs:
           echo "Latest: '$LATEST'."
           echo "LATEST=$LATEST" >>${GITHUB_ENV}
 
-          NEWEST=false
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            NEWEST=true
-          fi
-
-          echo "Newest: '$NEWEST'."
-          echo "NEWEST=$NEWEST" >>${GITHUB_ENV}
-
       - name: Checkout code
         uses: actions/checkout@v7
 
@@ -132,13 +124,6 @@ jobs:
             ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
           fi
 
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            echo "Adding 'pre-release' tag to manifest: '${{ env.FULL_IMAGE_NAME }}:pre-release'."
-            docker buildx imagetools create \
-            --tag ${{ env.FULL_IMAGE_NAME }}:pre-release \
-            ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-          fi
-
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
@@ -146,7 +131,3 @@ jobs:
           if [[ "${{ env.LATEST }}" == "true" ]]; then
             docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:latest
           fi
-
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:pre-release
-          fi

.github/workflows/release-win7.yml

@@ -14,13 +14,13 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-wintun-
@@ -92,7 +92,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -119,13 +119,13 @@ jobs:
           # go build -o build_assets/wxray.exe -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-H windowsgui -X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid=" -v ./main
 
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-wintun-

.github/workflows/release.yml

@@ -14,13 +14,13 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-wintun-
@@ -193,7 +193,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -225,14 +225,14 @@ jobs:
           fi
 
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
         if: matrix.goos == 'windows'
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-wintun-

.github/workflows/scheduled-assets-update.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
@@ -59,7 +59,7 @@ jobs:
             done
 
       - name: Save Geodat Cache
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@v5
         if: ${{ steps.update.outputs.unhit }}
         with:
           path: resources
@@ -73,7 +73,7 @@ jobs:
       ASSETHASH: 07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51
     steps:
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-wintun-
@@ -129,7 +129,7 @@ jobs:
             fi
 
       - name: Save Wintun Cache
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@v5
         if: ${{ steps.update.outputs.unhit }}
         with:
           path: resources

.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-
@@ -61,7 +61,7 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -85,12 +85,12 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@v5
         with:
           path: resources
           key: xray-geodat-

README.md

@@ -73,7 +73,6 @@
   - [Xray_bash_onekey](https://github.com/hello-yunshu/Xray_bash_onekey), [XTool](https://github.com/LordPenguin666/XTool), [VPainLess](https://github.com/vpainless/vpainless)
   - [v2ray-agent](https://github.com/mack-a/v2ray-agent), [Xray_onekey](https://github.com/wulabing/Xray_onekey), [ProxySU](https://github.com/proxysu/ProxySU)
 - Magisk
-  - [Magic_V2Ray](https://github.com/vincentng295/Magic_V2Ray)
   - [Xray_For_Magisk](https://github.com/E7KMbb/Xray_For_Magisk)
 - Homebrew
   - `brew install xray`

app/dispatcher/default.go

@@ -162,7 +162,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		p := d.policy.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				inboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  inboundLink.Writer,
@@ -171,7 +171,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				outboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  outboundLink.Writer,
@@ -200,13 +200,13 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 		p := policyManager.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Reader.(*buf.TimeoutWrapperReader).Counter = c
 			}
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  link.Writer,
@@ -223,7 +223,7 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 
 func trackOnlineIP(ctx context.Context, sm stats.Manager, email, ip string) {
 	name := "user>>>" + email + ">>>online"
-	if om, _ := sm.GetOrRegisterOnlineMap(name); om != nil {
+	if om, _ := stats.GetOrRegisterOnlineMap(sm, name); om != nil {
 		om.AddIP(ip)
 		context.AfterFunc(ctx, func() { om.RemoveIP(ip) })
 	}

app/dns/dnscommon.go

@@ -198,14 +198,9 @@ func parseResponse(payload []byte) (*IPRecord, error) {
 	ipRecord := &IPRecord{
 		ReqID:     h.ID,
 		RCode:     h.RCode,
+		Expire:    now.Add(time.Second * dns_feature.DefaultTTL),
 		RawHeader: &h,
 	}
-	defer func() {
-		// set to default TTL if no valid TTL is found
-		if ipRecord.Expire.IsZero() {
-			ipRecord.Expire = now.Add(time.Second * dns_feature.DefaultTTL)
-		}
-	}()
 
 L:
 	for {
@@ -222,7 +217,7 @@ L:
 			ttl = 1
 		}
 		expire := now.Add(time.Duration(ttl) * time.Second)
-		if ipRecord.Expire.IsZero() || ipRecord.Expire.After(expire) {
+		if ipRecord.Expire.After(expire) {
 			ipRecord.Expire = expire
 		}
 

app/geodata/download.go

@@ -2,7 +2,6 @@ package geodata
 
 import (
 	"context"
-	"crypto/tls"
 	go_errors "errors"
 	"io"
 	"net/http"
@@ -10,7 +9,6 @@ import (
 	"path/filepath"
 	"time"
 
-	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/platform/filesystem"
@@ -18,7 +16,6 @@ import (
 	"github.com/xtls/xray-core/common/utils"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/transport/internet/tagged"
-	"golang.org/x/net/http2"
 )
 
 const idleTimeout = 30 * time.Second
@@ -29,9 +26,8 @@ type stage struct {
 }
 
 type downloader struct {
-	ctx         context.Context
-	httpClient  *http.Client
-	httpsClient *http.Client
+	ctx    context.Context
+	client *http.Client
 }
 
 type idleConn struct {
@@ -57,84 +53,52 @@ func (c *idleConn) Write(b []byte) (int, error) {
 
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
-		ctx:         ctx,
-		httpClient:  newClient(ctx, dispatcher, outbound, false),
-		httpsClient: newClient(ctx, dispatcher, outbound, true),
+		ctx:    ctx,
+		client: newClient(ctx, dispatcher, outbound),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
-	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
-		var conn net.Conn
-		err := task.Run(ctx, func() error {
-			if tagged.Dialer == nil {
-				return errors.New("tagged dialer is not initialized")
-			}
-			dest, err := net.ParseDestination(network + ":" + address)
-			if err != nil {
-				return errors.New("cannot understand address").Base(err)
-			}
-			c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
-			if err != nil {
-				return errors.New("cannot dial remote address ", dest).Base(err)
-			}
-			conn = c
-			return nil
-		})
-		if err != nil {
-			return nil, errors.New("cannot finish connection").Base(err)
-		}
-		return &idleConn{
-			Conn: conn,
-		}, nil
-	}
-	if isHTTPS {
-		return &http.Client{
-			Transport: &http2.Transport{
-				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
-					conn, err := dial(ctx, network, address)
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			Proxy:             nil,
+			DisableKeepAlives: true,
+			DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
+				var conn net.Conn
+				err := task.Run(ctx, func() error {
+					if tagged.Dialer == nil {
+						return errors.New("tagged dialer is not initialized")
+					}
+					dest, err := net.ParseDestination(network + ":" + address)
 					if err != nil {
-						return nil, err
+						return errors.New("cannot understand address").Base(err)
 					}
-					host, _, _ := net.SplitHostPort(address)
-					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
-					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
-					defer cancel()
-					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
-						conn.Close()
-						return nil, err
+					c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
+					if err != nil {
+						return errors.New("cannot dial remote address ", dest).Base(err)
 					}
-					return tlsConn, nil
-				},
-			},
-			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-				if req.URL.Scheme != "https" {
-					return errors.New("redirected to non-https URL: ", req.URL.String())
+					conn = c
+					return nil
+				})
+				if err != nil {
+					return nil, errors.New("cannot finish connection").Base(err)
 				}
-				if len(via) >= 10 {
-					return errors.New("stopped after 10 redirects")
-				}
-				return nil
+				return &idleConn{
+					Conn: conn,
+				}, nil
 			},
-		}
-	} else {
-		return &http.Client{
-			Transport: &http.Transport{
-				Proxy:                 nil,
-				DisableKeepAlives:     true,
-				DialContext:           dial,
-				ResponseHeaderTimeout: idleTimeout,
-			},
-			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-				if req.URL.Scheme != "https" {
-					return errors.New("redirected to non-https URL: ", req.URL.String())
-				}
-				if len(via) >= 10 {
-					return errors.New("stopped after 10 redirects")
-				}
-				return nil
-			},
-		}
+			TLSHandshakeTimeout:   idleTimeout,
+			ResponseHeaderTimeout: idleTimeout,
+		},
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if req.URL.Scheme != "https" {
+				return errors.New("redirected to non-https URL: ", req.URL.String())
+			}
+			if len(via) >= 10 {
+				return errors.New("stopped after 10 redirects")
+			}
+			return nil
+		},
 	}
 }
 
@@ -196,13 +160,7 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	var client *http.Client
-	if req.URL.Scheme == "https" {
-		client = d.httpsClient
-	} else {
-		client = d.httpClient
-	}
-	resp, err := client.Do(req)
+	resp, err := d.client.Do(req)
 	if err != nil {
 		return err
 	}

app/metrics/metrics.go

@@ -2,18 +2,15 @@ package metrics
 
 import (
 	"context"
-	"encoding/json"
-	stderrors "errors"
 	"expvar"
-	stdnet "net"
 	"net/http"
-	"net/http/pprof"
+	_ "net/http/pprof"
 	"strings"
 
 	"github.com/xtls/xray-core/app/observatory"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
-	xnet "github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/extension"
@@ -24,17 +21,15 @@ import (
 type MetricsHandler struct {
 	ohm          outbound.Manager
 	statsManager feature_stats.Manager
-	ctx          context.Context
+	observatory  extension.Observatory
 	tag          string
 	listen       string
-	tcpListener  xnet.Listener
-	listener     *OutboundListener
+	tcpListener  net.Listener
 }
 
 // NewMetricsHandler creates a new MetricsHandler based on the given config.
 func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, error) {
 	c := &MetricsHandler{
-		ctx:    ctx,
 		tag:    config.Tag,
 		listen: config.Listen,
 	}
@@ -42,6 +37,46 @@ func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, er
 		c.statsManager = sm
 		c.ohm = om
 	}))
+	expvar.Publish("stats", expvar.Func(func() interface{} {
+		resp := map[string]map[string]map[string]int64{
+			"inbound":  {},
+			"outbound": {},
+			"user":     {},
+		}
+		c.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
+			nameSplit := strings.Split(name, ">>>")
+			typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
+			if item, found := resp[typeName][tagOrUser]; found {
+				item[direction] = counter.Value()
+			} else {
+				resp[typeName][tagOrUser] = map[string]int64{
+					direction: counter.Value(),
+				}
+			}
+			return true
+		})
+		return resp
+	}))
+	expvar.Publish("observatory", expvar.Func(func() interface{} {
+		if c.observatory == nil {
+			common.Must(core.RequireFeatures(ctx, func(observatory extension.Observatory) error {
+				c.observatory = observatory
+				return nil
+			}))
+			if c.observatory == nil {
+				return nil
+			}
+		}
+		resp := map[string]*observatory.OutboundStatus{}
+		if o, err := c.observatory.GetObservation(context.Background()); err != nil {
+			return err
+		} else {
+			for _, x := range o.(*observatory.ObservationResult).GetStatus() {
+				resp[x.OutboundTag] = x
+			}
+		}
+		return resp
+	}))
 	return c, nil
 }
 
@@ -50,172 +85,45 @@ func (p *MetricsHandler) Type() interface{} {
 }
 
 func (p *MetricsHandler) Start() error {
-	handler := p.httpHandler()
-
 	// direct listen a port if listen is set
 	if p.listen != "" {
-		TCPlistener, err := xnet.Listen("tcp", p.listen)
+		TCPlistener, err := net.Listen("tcp", p.listen)
 		if err != nil {
 			return err
 		}
 		p.tcpListener = TCPlistener
 		errors.LogInfo(context.Background(), "Metrics server listening on ", p.listen)
 
-		go p.serve(TCPlistener, handler)
-	}
-
-	if p.tag == "" {
-		if p.tcpListener == nil {
-			return errors.New("metrics must have a tag or listen address")
-		}
-		return nil
+		go func() {
+			if err := http.Serve(TCPlistener, http.DefaultServeMux); err != nil {
+				errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
+			}
+		}()
 	}
 
 	listener := &OutboundListener{
-		buffer: make(chan xnet.Conn, 4),
+		buffer: make(chan net.Conn, 4),
 		done:   done.New(),
 	}
-	p.listener = listener
 
-	go p.serve(listener, handler)
+	go func() {
+		if err := http.Serve(listener, http.DefaultServeMux); err != nil {
+			errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
+		}
+	}()
 
 	if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
 		errors.LogInfo(context.Background(), "failed to remove existing handler")
 	}
 
-	if err := p.ohm.AddHandler(context.Background(), &Outbound{
+	return p.ohm.AddHandler(context.Background(), &Outbound{
 		tag:      p.tag,
 		listener: listener,
-	}); err != nil {
-		if closeErr := p.Close(); closeErr != nil {
-			errors.LogErrorInner(context.Background(), closeErr, "failed to close metrics server after start failure")
-		}
-		return err
-	}
-
-	return nil
+	})
 }
 
 func (p *MetricsHandler) Close() error {
-	var errs []error
-	if p.tcpListener != nil {
-		errs = append(errs, p.tcpListener.Close())
-		p.tcpListener = nil
-	}
-	if p.listener != nil {
-		errs = append(errs, p.listener.Close())
-		p.listener = nil
-	}
-	if p.ohm != nil && p.tag != "" {
-		if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
-			errors.LogInfo(context.Background(), "failed to remove metrics handler")
-		}
-	}
-	return errors.Combine(errs...)
-}
-
-func (p *MetricsHandler) serve(listener xnet.Listener, handler http.Handler) {
-	if err := http.Serve(listener, handler); err != nil && !isClosedListenerError(err) {
-		errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
-	}
-}
-
-func isClosedListenerError(err error) bool {
-	if err == nil {
-		return true
-	}
-	if stderrors.Is(err, stdnet.ErrClosed) || stderrors.Is(err, http.ErrServerClosed) {
-		return true
-	}
-	errText := err.Error()
-	return strings.Contains(errText, "listen closed") ||
-		strings.Contains(errText, "use of closed network connection")
-}
-
-func (p *MetricsHandler) httpHandler() http.Handler {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/debug/vars", p.handleDebugVars)
-	mux.HandleFunc("/debug/pprof/", pprof.Index)
-	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	return mux
-}
-
-func (p *MetricsHandler) handleDebugVars(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	vars := map[string]json.RawMessage{}
-	expvar.Do(func(kv expvar.KeyValue) {
-		value := json.RawMessage(kv.Value.String())
-		if !json.Valid(value) {
-			value = json.RawMessage("null")
-		}
-		vars[kv.Key] = value
-	})
-	vars["stats"] = marshalJSON(p.stats())
-	vars["observatory"] = marshalJSON(p.observatoryStatus())
-
-	payload, err := json.Marshal(vars)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	w.Write(payload)
-}
-
-func marshalJSON(value interface{}) json.RawMessage {
-	data, err := json.Marshal(value)
-	if err != nil {
-		return json.RawMessage("null")
-	}
-	return data
-}
-
-func (p *MetricsHandler) stats() map[string]map[string]map[string]int64 {
-	resp := map[string]map[string]map[string]int64{
-		"inbound":  {},
-		"outbound": {},
-		"user":     {},
-	}
-	p.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
-		nameSplit := strings.Split(name, ">>>")
-		if len(nameSplit) < 4 {
-			return true
-		}
-		typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
-		items, found := resp[typeName]
-		if !found {
-			items = map[string]map[string]int64{}
-			resp[typeName] = items
-		}
-		if item, found := items[tagOrUser]; found {
-			item[direction] = counter.Value()
-		} else {
-			items[tagOrUser] = map[string]int64{
-				direction: counter.Value(),
-			}
-		}
-		return true
-	})
-	return resp
-}
-
-func (p *MetricsHandler) observatoryStatus() interface{} {
-	feature := core.MustFromContext(p.ctx).GetFeature(extension.ObservatoryType())
-	if feature == nil {
-		return nil
-	}
-	observatoryFeature := feature.(extension.Observatory)
-	resp := map[string]*observatory.OutboundStatus{}
-	if o, err := observatoryFeature.GetObservation(context.Background()); err != nil {
-		return err
-	} else {
-		for _, x := range o.(*observatory.ObservationResult).GetStatus() {
-			resp[x.OutboundTag] = x
-		}
-	}
-	return resp
+	return nil
 }
 
 func init() {

app/metrics/metrics_test.go

@@ -1,161 +0,0 @@
-package metrics
-
-import (
-	"context"
-	"encoding/json"
-	stdnet "net"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/xtls/xray-core/app/dispatcher"
-	"github.com/xtls/xray-core/app/proxyman"
-	_ "github.com/xtls/xray-core/app/proxyman/inbound"
-	_ "github.com/xtls/xray-core/app/proxyman/outbound"
-	appstats "github.com/xtls/xray-core/app/stats"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
-	feature_outbound "github.com/xtls/xray-core/features/outbound"
-)
-
-func TestMetricsCanRestartInSameProcess(t *testing.T) {
-	for i := 0; i < 2; i++ {
-		server := startMetricsTestServer(t)
-		readMetricsVars(t, server)
-		readMetricsPprof(t, server)
-		if err := server.Close(); err != nil {
-			t.Fatalf("failed to close metrics server: %v", err)
-		}
-	}
-}
-
-func TestMetricsCanRunMultipleInstancesInSameProcess(t *testing.T) {
-	server1 := startMetricsTestServer(t)
-	t.Cleanup(func() {
-		_ = server1.Close()
-	})
-	server2 := startMetricsTestServer(t)
-	t.Cleanup(func() {
-		_ = server2.Close()
-	})
-
-	readMetricsVars(t, server1)
-	readMetricsVars(t, server2)
-}
-
-func TestMetricsListenOnlyWithoutTagDoesNotRegisterOutbound(t *testing.T) {
-	listen := pickMetricsListenAddress(t)
-	server := startMetricsTestServerWithMetricsConfig(t, &Config{
-		Listen: listen,
-	})
-	t.Cleanup(func() {
-		_ = server.Close()
-	})
-
-	response, err := http.Get("http://" + listen + "/debug/vars")
-	if err != nil {
-		t.Fatalf("failed to read listen-only metrics: %v", err)
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
-		t.Fatalf("unexpected listen-only metrics status: %d", response.StatusCode)
-	}
-
-	outboundManager := server.GetFeature(feature_outbound.ManagerType()).(feature_outbound.Manager)
-	if handlers := outboundManager.ListHandlers(context.Background()); len(handlers) != 0 {
-		t.Fatalf("listen-only metrics registered outbound handlers: got %d, want 0", len(handlers))
-	}
-}
-
-func startMetricsTestServer(t *testing.T) *core.Instance {
-	return startMetricsTestServerWithMetricsConfig(t, &Config{
-		Tag: "metrics_out",
-	})
-}
-
-func startMetricsTestServerWithMetricsConfig(t *testing.T, metricsConfig *Config) *core.Instance {
-	t.Helper()
-
-	server, err := core.New(metricsTestConfig(metricsConfig))
-	if err != nil {
-		t.Fatalf("failed to create metrics server: %v", err)
-	}
-	if err := server.Start(); err != nil {
-		_ = server.Close()
-		t.Fatalf("failed to start metrics server: %v", err)
-	}
-	return server
-}
-
-func metricsTestConfig(metricsConfig *Config) *core.Config {
-	return &core.Config{
-		App: []*serial.TypedMessage{
-			serial.ToTypedMessage(&dispatcher.Config{}),
-			serial.ToTypedMessage(&proxyman.InboundConfig{}),
-			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
-			serial.ToTypedMessage(&appstats.Config{}),
-			serial.ToTypedMessage(metricsConfig),
-		},
-	}
-}
-
-func pickMetricsListenAddress(t *testing.T) string {
-	t.Helper()
-
-	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("failed to pick metrics listen address: %v", err)
-	}
-	defer listener.Close()
-	return listener.Addr().String()
-}
-
-func readMetricsVars(t *testing.T, server *core.Instance) {
-	t.Helper()
-
-	recorder := httptest.NewRecorder()
-	metricsHandler(t, server).httpHandler().ServeHTTP(
-		recorder,
-		httptest.NewRequest(http.MethodGet, "/debug/vars", nil),
-	)
-
-	if recorder.Code != http.StatusOK {
-		t.Fatalf("unexpected metrics vars status: %d", recorder.Code)
-	}
-
-	var payload map[string]interface{}
-	if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
-		t.Fatalf("failed to decode metrics vars: %v", err)
-	}
-	if _, found := payload["stats"]; !found {
-		t.Fatal("metrics vars missing stats")
-	}
-	if _, found := payload["observatory"]; !found {
-		t.Fatal("metrics vars missing observatory")
-	}
-}
-
-func readMetricsPprof(t *testing.T, server *core.Instance) {
-	t.Helper()
-
-	recorder := httptest.NewRecorder()
-	metricsHandler(t, server).httpHandler().ServeHTTP(
-		recorder,
-		httptest.NewRequest(http.MethodGet, "/debug/pprof/goroutine?debug=1", nil),
-	)
-
-	if recorder.Code != http.StatusOK {
-		t.Fatalf("unexpected metrics pprof status: %d", recorder.Code)
-	}
-}
-
-func metricsHandler(t *testing.T, server *core.Instance) *MetricsHandler {
-	t.Helper()
-
-	feature := server.GetFeature((*MetricsHandler)(nil))
-	handler, ok := feature.(*MetricsHandler)
-	if !ok || handler == nil {
-		t.Fatal("metrics handler not registered")
-	}
-	return handler
-}

app/proxyman/inbound/always.go

@@ -26,7 +26,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -34,7 +34,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

app/proxyman/outbound/handler.go

@@ -39,7 +39,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -47,7 +47,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

app/stats/stats.go

@@ -48,20 +48,6 @@ func (m *Manager) RegisterCounter(name string) (stats.Counter, error) {
 	return c, nil
 }
 
-// GetOrRegisterCounter implements stats.Manager.
-func (m *Manager) GetOrRegisterCounter(name string) (stats.Counter, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.counters[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new counter ", name)
-	c := new(Counter)
-	m.counters[name] = c
-	return c, nil
-}
-
 // UnregisterCounter implements stats.Manager.
 func (m *Manager) UnregisterCounter(name string) error {
 	m.access.Lock()
@@ -111,20 +97,6 @@ func (m *Manager) RegisterOnlineMap(name string) (stats.OnlineMap, error) {
 	return om, nil
 }
 
-// GetOrRegisterOnlineMap implements stats.Manager.
-func (m *Manager) GetOrRegisterOnlineMap(name string) (stats.OnlineMap, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if om, found := m.onlineMaps[name]; found {
-		return om, nil
-	}
-	errors.LogDebug(context.Background(), "create new OnlineMap ", name)
-	om := NewOnlineMap()
-	m.onlineMaps[name] = om
-	return om, nil
-}
-
 // UnregisterOnlineMap implements stats.Manager.
 func (m *Manager) UnregisterOnlineMap(name string) error {
 	m.access.Lock()
@@ -177,26 +149,6 @@ func (m *Manager) RegisterChannel(name string) (stats.Channel, error) {
 	return c, nil
 }
 
-// GetOrRegisterChannel implements stats.Manager.
-func (m *Manager) GetOrRegisterChannel(name string) (stats.Channel, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.channels[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new channel ", name)
-	c := NewChannel(&ChannelConfig{BufferSize: 64, Blocking: false})
-	if m.running {
-		// Start before publishing so no goroutine can observe an unstarted channel.
-		if err := c.Start(); err != nil {
-			return nil, err
-		}
-	}
-	m.channels[name] = c
-	return c, nil
-}
-
 // UnregisterChannel implements stats.Manager.
 func (m *Manager) UnregisterChannel(name string) error {
 	m.access.Lock()

common/buf/io.go

@@ -122,7 +122,7 @@ func NewReader(reader io.Reader) Reader {
 	}
 
 	_, isFile := reader.(*os.File)
-	if !isFile && useReadV() {
+	if !isFile && useReadv {
 		if sc, ok := reader.(syscall.Conn); ok {
 			rawConn, err := sc.SyscallConn()
 			if err != nil {

common/buf/readv_reader.go

@@ -5,7 +5,6 @@ package buf
 
 import (
 	"io"
-	"sync/atomic"
 	"syscall"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -144,24 +143,13 @@ func (r *ReadVReader) ReadMultiBuffer() (MultiBuffer, error) {
 	return mb, nil
 }
 
-var useReadv atomic.Bool
-
-func useReadV() bool {
-	return useReadv.Load()
-}
-
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
-	enabled := false
-	switch value {
-	case defaultFlagValue, "auto", "enable":
-		enabled = true
-	}
-	useReadv.Store(enabled)
-	return nil
-}
+var useReadv bool
 
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
+	switch value {
+	case defaultFlagValue, "auto", "enable":
+		useReadv = true
+	}
 }

common/buf/readv_reader_stub.go

@@ -10,9 +10,7 @@ import (
 	"github.com/xtls/xray-core/features/stats"
 )
 
-func useReadV() bool {
-	return false
-}
+const useReadv = false
 
 func NewReadVReader(reader io.Reader, rawConn syscall.RawConn, counter stats.Counter) Reader {
 	panic("not implemented")

common/geodata/consts.go

@@ -1,49 +0,0 @@
-package geodata
-
-import (
-	"sync"
-
-	"github.com/xtls/xray-core/common"
-)
-
-var privateIPMatcher = sync.OnceValue(func() IPMatcher {
-	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
-		"0.0.0.0/8",
-		"10.0.0.0/8",
-		"100.64.0.0/10",
-		"127.0.0.0/8",
-		"169.254.0.0/16",
-		"172.16.0.0/12",
-		"192.0.0.0/24",
-		"192.0.2.0/24",
-		"192.88.99.0/24",
-		"192.168.0.0/16",
-		"198.18.0.0/15",
-		"198.51.100.0/24",
-		"203.0.113.0/24",
-		"224.0.0.0/3",
-		"::/127",
-		"fc00::/7",
-		"fe80::/10",
-		"ff00::/8",
-	}))))
-})
-
-func GetPrivateIPMatcher() IPMatcher { return privateIPMatcher() }
-
-var privateDomainMatcher = sync.OnceValue(func() DomainMatcher {
-	return common.Must2(DomainReg.BuildDomainMatcher(common.Must2(ParseDomainRules([]string{
-		"lan",
-		"localdomain",
-		"example",
-		"invalid",
-		"localhost",
-		"test",
-		"local",
-		"home.arpa",
-		"internal",
-		"regexp:^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$", // Dotless domains
-	}, Domain_Domain))))
-})
-
-func GetPrivateDomainMatcher() DomainMatcher { return privateDomainMatcher() }

common/net/find_process_darwin.go

@@ -1,348 +0,0 @@
-//go:build darwin && !ios
-
-package net
-
-import (
-	"bytes"
-	"net"
-	"net/netip"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-const (
-	darwinProcPIDListFDs      = 1
-	darwinProcPIDFDSocketInfo = 3
-	darwinProcFDTypeSocket    = 2
-	darwinProcFDInfoSize      = 8
-	darwinSocketFDInfoSize    = 792
-	darwinSocketFDInfoPSIOff  = 24
-	darwinSocketInfoProtoOff  = darwinSocketFDInfoPSIOff + 156
-	darwinSocketInfoFamilyOff = darwinSocketFDInfoPSIOff + 160
-	darwinSocketInfoKindOff   = darwinSocketFDInfoPSIOff + 232
-	darwinSocketInfoInSockOff = darwinSocketFDInfoPSIOff + 240
-	darwinInSockInfoFPortOff  = darwinSocketInfoInSockOff
-	darwinInSockInfoLPortOff  = darwinSocketInfoInSockOff + 4
-	darwinInSockInfoVFlagOff  = darwinSocketInfoInSockOff + 24
-	darwinInSockInfoFAddrOff  = darwinSocketInfoInSockOff + 32
-	darwinInSockInfoLAddrOff  = darwinSocketInfoInSockOff + 48
-	darwinInSockInfoSize      = 80
-	darwinInSockInfoIPv4      = 0x1
-	darwinInSockInfoIPv6      = 0x2
-	darwinSockInfoIN          = 1
-	darwinSockInfoTCP         = 2
-)
-
-type darwinSocketMatchLevel int
-
-const (
-	darwinSocketNoMatch darwinSocketMatchLevel = iota
-	darwinSocketPortMatch
-	darwinSocketRemoteMatch
-	darwinSocketLocalMatch
-	darwinSocketExactMatch
-)
-
-func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {
-	isLocal, err := IsLocal(net.ParseIP(srcIP))
-	if err != nil {
-		return 0, "", "", errors.New("failed to determine if address is local: ", err)
-	}
-	if !isLocal {
-		return 0, "", "", ErrNotLocal
-	}
-	if network != "tcp" && network != "udp" {
-		panic("Unsupported network type for process lookup.")
-	}
-
-	srcAddr, err := netip.ParseAddr(srcIP)
-	if err != nil {
-		return 0, "", "", errors.New("invalid source IP address: ", srcIP)
-	}
-	srcAddr = srcAddr.Unmap()
-
-	var dstAddr netip.Addr
-	hasDstAddr := false
-	if destIP != "" && destPort != 0 {
-		dstAddr, err = netip.ParseAddr(destIP)
-		if err != nil {
-			return 0, "", "", errors.New("invalid destination IP address: ", destIP)
-		}
-		dstAddr = dstAddr.Unmap()
-		hasDstAddr = true
-	}
-
-	processes, err := unix.SysctlKinfoProcSlice("kern.proc.all")
-	if err != nil {
-		return 0, "", "", errors.New("failed to list processes").Base(err)
-	}
-
-	var bestPID int32
-	bestLevel := darwinSocketNoMatch
-	ambiguousBest := false
-
-	for _, process := range processes {
-		pid := process.Proc.P_pid
-		if pid <= 0 {
-			continue
-		}
-
-		matchLevel, err := darwinProcessSocketMatchLevel(pid, network, srcAddr, srcPort, dstAddr, destPort, hasDstAddr)
-		if err != nil || matchLevel == darwinSocketNoMatch {
-			continue
-		}
-		if matchLevel == darwinSocketExactMatch {
-			bestPID = pid
-			bestLevel = matchLevel
-			ambiguousBest = false
-			break
-		}
-		if matchLevel > bestLevel {
-			bestPID = pid
-			bestLevel = matchLevel
-			ambiguousBest = false
-			continue
-		}
-		if matchLevel == bestLevel {
-			ambiguousBest = true
-		}
-	}
-
-	if bestLevel == darwinSocketNoMatch {
-		return 0, "", "", errors.New("process not found for ", network, " connection from ", srcIP, ":", srcPort, " to ", destIP, ":", destPort)
-	}
-	if ambiguousBest {
-		return 0, "", "", errors.New("ambiguous process match for ", network, " connection from ", srcIP, ":", srcPort, " to ", destIP, ":", destPort)
-	}
-
-	absPath, err := darwinProcessPath(bestPID)
-	if err != nil {
-		return 0, "", "", errors.New("could not get process path for PID ", bestPID, ": ", err)
-	}
-
-	absPath = filepath.ToSlash(absPath)
-	return int(bestPID), filepath.Base(absPath), absPath, nil
-}
-
-func darwinProcessSocketMatchLevel(pid int32, network string, srcAddr netip.Addr, srcPort uint16, dstAddr netip.Addr, dstPort uint16, hasDstAddr bool) (darwinSocketMatchLevel, error) {
-	fds, err := darwinProcessFDs(pid)
-	if err != nil {
-		return darwinSocketNoMatch, err
-	}
-
-	bestLevel := darwinSocketNoMatch
-	info := make([]byte, darwinSocketFDInfoSize)
-	for fd := 0; fd+darwinProcFDInfoSize <= len(fds); fd += darwinProcFDInfoSize {
-		fdNumber := int32(darwinReadNativeUint32(fds[fd : fd+4]))
-		fdType := darwinReadNativeUint32(fds[fd+4 : fd+8])
-		if fdType != darwinProcFDTypeSocket {
-			continue
-		}
-
-		n, err := darwinProcPIDFDInfo(pid, fdNumber, darwinProcPIDFDSocketInfo, info)
-		if err != nil || n < darwinSocketInfoInSockOff+darwinInSockInfoSize {
-			continue
-		}
-		level := darwinSocketInfoMatchLevel(info[:n], network, srcAddr, srcPort, dstAddr, dstPort, hasDstAddr)
-		if level == darwinSocketExactMatch {
-			return level, nil
-		}
-		if level > bestLevel {
-			bestLevel = level
-		}
-	}
-
-	return bestLevel, nil
-}
-
-func darwinProcessFDs(pid int32) ([]byte, error) {
-	n, err := darwinProcPIDInfo(pid, darwinProcPIDListFDs, 0, nil)
-	if err != nil {
-		return nil, err
-	}
-	if n <= 0 {
-		return nil, nil
-	}
-
-	buf := make([]byte, n)
-	n, err = darwinProcPIDInfo(pid, darwinProcPIDListFDs, 0, buf)
-	if err != nil {
-		return nil, err
-	}
-	return buf[:n], nil
-}
-
-func darwinSocketInfoMatchLevel(info []byte, network string, srcAddr netip.Addr, srcPort uint16, dstAddr netip.Addr, dstPort uint16, hasDstAddr bool) darwinSocketMatchLevel {
-	protocol := int(darwinReadNativeUint32(info[darwinSocketInfoProtoOff : darwinSocketInfoProtoOff+4]))
-	family := int(darwinReadNativeUint32(info[darwinSocketInfoFamilyOff : darwinSocketInfoFamilyOff+4]))
-	kind := int(darwinReadNativeUint32(info[darwinSocketInfoKindOff : darwinSocketInfoKindOff+4]))
-
-	switch network {
-	case "tcp":
-		if protocol != unix.IPPROTO_TCP || kind != darwinSockInfoTCP {
-			return darwinSocketNoMatch
-		}
-	case "udp":
-		if protocol != unix.IPPROTO_UDP || kind != darwinSockInfoIN {
-			return darwinSocketNoMatch
-		}
-	default:
-		return darwinSocketNoMatch
-	}
-
-	vflag := info[darwinInSockInfoVFlagOff]
-	if srcAddr.Is4() {
-		if family != unix.AF_INET || vflag&darwinInSockInfoIPv4 == 0 {
-			return darwinSocketNoMatch
-		}
-	} else {
-		if family != unix.AF_INET6 || vflag&darwinInSockInfoIPv6 == 0 {
-			return darwinSocketNoMatch
-		}
-	}
-
-	localPort := int32(darwinReadNativeUint32(info[darwinInSockInfoLPortOff : darwinInSockInfoLPortOff+4]))
-	if !darwinPortMatches(localPort, srcPort) {
-		return darwinSocketNoMatch
-	}
-	localAddrMatches := darwinAddrMatchesOrUnspecified(info[darwinInSockInfoLAddrOff:darwinInSockInfoLAddrOff+16], srcAddr)
-
-	foreignAddrRaw := info[darwinInSockInfoFAddrOff : darwinInSockInfoFAddrOff+16]
-	foreignPort := int32(darwinReadNativeUint32(info[darwinInSockInfoFPortOff : darwinInSockInfoFPortOff+4]))
-
-	if !hasDstAddr {
-		if localAddrMatches {
-			return darwinSocketExactMatch
-		}
-		return darwinSocketNoMatch
-	}
-
-	remoteMatches := darwinPortMatches(foreignPort, dstPort) && darwinAddrMatches(foreignAddrRaw, dstAddr)
-	if network == "udp" && darwinEndpointIsZero(foreignAddrRaw, foreignPort) && localAddrMatches {
-		return darwinSocketExactMatch
-	}
-	switch {
-	case localAddrMatches && remoteMatches:
-		return darwinSocketExactMatch
-	case localAddrMatches:
-		return darwinSocketLocalMatch
-	case remoteMatches:
-		return darwinSocketRemoteMatch
-	default:
-		return darwinSocketPortMatch
-	}
-}
-
-func darwinPortMatches(value int32, port uint16) bool {
-	raw := uint16(value)
-	return raw == port || darwinNtohs(raw) == port
-}
-
-func darwinNtohs(value uint16) uint16 {
-	return value<<8 | value>>8
-}
-
-func darwinAddrMatches(raw []byte, addr netip.Addr) bool {
-	if addr.Is4() {
-		ip := addr.As4()
-		return bytes.Equal(raw[12:16], ip[:])
-	}
-	ip := addr.As16()
-	return bytes.Equal(raw, ip[:])
-}
-
-func darwinAddrMatchesOrUnspecified(raw []byte, addr netip.Addr) bool {
-	if darwinAddrMatches(raw, addr) {
-		return true
-	}
-	if addr.Is4() {
-		return darwinBytesAreZero(raw[12:16])
-	}
-	return darwinBytesAreZero(raw)
-}
-
-func darwinEndpointIsZero(rawAddr []byte, port int32) bool {
-	return uint32(port) == 0 && darwinBytesAreZero(rawAddr)
-}
-
-func darwinBytesAreZero(raw []byte) bool {
-	for _, value := range raw {
-		if value != 0 {
-			return false
-		}
-	}
-	return true
-}
-
-func darwinReadNativeUint32(b []byte) uint32 {
-	return *(*uint32)(unsafe.Pointer(&b[0]))
-}
-
-func darwinProcessPath(pid int32) (string, error) {
-	buf := make([]byte, unix.PathMax)
-	n, err := darwinProcPIDPath(pid, buf)
-	if err != nil {
-		return "", err
-	}
-	if n <= 0 {
-		return "", errors.New("empty process path")
-	}
-	return strings.TrimRight(string(buf[:n]), "\x00"), nil
-}
-
-func darwinProcPIDInfo(pid int32, flavor int, arg uint64, buf []byte) (int, error) {
-	var ptr unsafe.Pointer
-	if len(buf) > 0 {
-		ptr = unsafe.Pointer(&buf[0])
-	}
-
-	r0, _, errno := syscall_syscall6(libc_proc_pidinfo_trampoline_addr, uintptr(pid), uintptr(flavor), uintptr(arg), uintptr(ptr), uintptr(len(buf)), 0)
-	if errno != 0 {
-		return 0, errno
-	}
-	return int(r0), nil
-}
-
-func darwinProcPIDFDInfo(pid int32, fd int32, flavor int, buf []byte) (int, error) {
-	var ptr unsafe.Pointer
-	if len(buf) > 0 {
-		ptr = unsafe.Pointer(&buf[0])
-	}
-
-	r0, _, errno := syscall_syscall6(libc_proc_pidfdinfo_trampoline_addr, uintptr(pid), uintptr(fd), uintptr(flavor), uintptr(ptr), uintptr(len(buf)), 0)
-	if errno != 0 {
-		return 0, errno
-	}
-	return int(r0), nil
-}
-
-func darwinProcPIDPath(pid int32, buf []byte) (int, error) {
-	r0, _, errno := syscall_syscall6(libc_proc_pidpath_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)), 0, 0, 0)
-	if errno != 0 {
-		return 0, errno
-	}
-	return int(r0), nil
-}
-
-var libc_proc_pidinfo_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_proc_pidinfo proc_pidinfo "/usr/lib/libproc.dylib"
-
-var libc_proc_pidfdinfo_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_proc_pidfdinfo proc_pidfdinfo "/usr/lib/libproc.dylib"
-
-var libc_proc_pidpath_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_proc_pidpath proc_pidpath "/usr/lib/libproc.dylib"
-
-// Implemented in the runtime package (runtime/sys_darwin.go).
-func syscall_syscall6(fn, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno)
-
-//go:linkname syscall_syscall6 syscall.syscall6

common/net/find_process_darwin.s

@@ -1,18 +0,0 @@
-//go:build darwin && !ios
-
-#include "textflag.h"
-
-TEXT libc_proc_pidinfo_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_proc_pidinfo(SB)
-GLOBL	·libc_proc_pidinfo_trampoline_addr(SB), RODATA, $8
-DATA	·libc_proc_pidinfo_trampoline_addr(SB)/8, $libc_proc_pidinfo_trampoline<>(SB)
-
-TEXT libc_proc_pidfdinfo_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_proc_pidfdinfo(SB)
-GLOBL	·libc_proc_pidfdinfo_trampoline_addr(SB), RODATA, $8
-DATA	·libc_proc_pidfdinfo_trampoline_addr(SB)/8, $libc_proc_pidfdinfo_trampoline<>(SB)
-
-TEXT libc_proc_pidpath_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_proc_pidpath(SB)
-GLOBL	·libc_proc_pidpath_trampoline_addr(SB), RODATA, $8
-DATA	·libc_proc_pidpath_trampoline_addr(SB)/8, $libc_proc_pidpath_trampoline<>(SB)

common/net/find_process_darwin_test.go

@@ -1,293 +0,0 @@
-//go:build darwin && !ios
-
-package net
-
-import (
-	stdnet "net"
-	"net/netip"
-	"os"
-	"testing"
-	"time"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-func TestFindProcessDarwinTCP(t *testing.T) {
-	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-
-	accepted := make(chan stdnet.Conn, 1)
-	go func() {
-		conn, err := listener.Accept()
-		if err == nil {
-			accepted <- conn
-			return
-		}
-		close(accepted)
-	}()
-
-	conn, err := stdnet.Dial("tcp", listener.Addr().String())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-
-	serverConn := <-accepted
-	if serverConn == nil {
-		t.Fatal("server did not accept tcp connection")
-	}
-	defer serverConn.Close()
-
-	local := conn.LocalAddr().(*stdnet.TCPAddr)
-	remote := conn.RemoteAddr().(*stdnet.TCPAddr)
-
-	pid, name, path, err := FindProcess("tcp", local.IP.String(), uint16(local.Port), remote.IP.String(), uint16(remote.Port))
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertCurrentProcess(t, pid, name, path)
-}
-
-func TestFindProcessDarwinUDP(t *testing.T) {
-	conn, err := stdnet.ListenUDP("udp", &stdnet.UDPAddr{IP: stdnet.ParseIP("127.0.0.1")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-
-	local := conn.LocalAddr().(*stdnet.UDPAddr)
-
-	pid, name, path, err := FindProcess("udp", local.IP.String(), uint16(local.Port), "", 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertCurrentProcess(t, pid, name, path)
-}
-
-func TestFindProcessDarwinNonLocal(t *testing.T) {
-	_, _, _, err := FindProcess("tcp", "203.0.113.1", 80, "", 0)
-	if err != ErrNotLocal {
-		t.Fatalf("expected ErrNotLocal, got %v", err)
-	}
-}
-
-func TestFindProcessDarwinUnsupportedNetwork(t *testing.T) {
-	defer func() {
-		if recover() == nil {
-			t.Fatal("expected panic")
-		}
-	}()
-
-	_, _, _, _ = FindProcess("icmp", "127.0.0.1", 0, "", 0)
-}
-
-func assertCurrentProcess(t *testing.T, pid int, name string, path string) {
-	t.Helper()
-
-	if pid != os.Getpid() {
-		t.Fatalf("expected pid %d, got %d (%s, %s)", os.Getpid(), pid, name, path)
-	}
-
-	executable, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if path == "" || name == "" {
-		t.Fatalf("expected process path and name, got name=%q path=%q", name, path)
-	}
-	if sameFile(executable, path) {
-		return
-	}
-	t.Fatalf("expected executable %q, got %q", executable, path)
-}
-
-func sameFile(left string, right string) bool {
-	leftInfo, leftErr := os.Stat(left)
-	rightInfo, rightErr := os.Stat(right)
-	if leftErr != nil || rightErr != nil {
-		return false
-	}
-	return os.SameFile(leftInfo, rightInfo)
-}
-
-func TestFindProcessDarwinTCPWithoutDestination(t *testing.T) {
-	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-
-	accepted := make(chan stdnet.Conn, 1)
-	go func() {
-		conn, err := listener.Accept()
-		if err == nil {
-			accepted <- conn
-			return
-		}
-		close(accepted)
-	}()
-
-	conn, err := stdnet.DialTimeout("tcp", listener.Addr().String(), time.Second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-
-	serverConn := <-accepted
-	if serverConn == nil {
-		t.Fatal("server did not accept tcp connection")
-	}
-	defer serverConn.Close()
-
-	local := conn.LocalAddr().(*stdnet.TCPAddr)
-	pid, name, path, err := FindProcess("tcp", local.IP.String(), uint16(local.Port), "", 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertCurrentProcess(t, pid, name, path)
-}
-
-func TestFindProcessDarwinTCPWithDifferentDestination(t *testing.T) {
-	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-
-	accepted := make(chan stdnet.Conn, 1)
-	go func() {
-		conn, err := listener.Accept()
-		if err == nil {
-			accepted <- conn
-			return
-		}
-		close(accepted)
-	}()
-
-	conn, err := stdnet.DialTimeout("tcp", listener.Addr().String(), time.Second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-
-	serverConn := <-accepted
-	if serverConn == nil {
-		t.Fatal("server did not accept tcp connection")
-	}
-	defer serverConn.Close()
-
-	local := conn.LocalAddr().(*stdnet.TCPAddr)
-	pid, name, path, err := FindProcess("tcp", local.IP.String(), uint16(local.Port), "203.0.113.10", 443)
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertCurrentProcess(t, pid, name, path)
-}
-
-func TestDarwinSocketInfoMatchLevelFallbacks(t *testing.T) {
-	src := netip.MustParseAddr("198.18.0.2")
-	dst := netip.MustParseAddr("203.0.113.10")
-	otherLocal := netip.MustParseAddr("192.168.1.10")
-	otherRemote := netip.MustParseAddr("198.51.100.10")
-	unspecifiedLocal := netip.MustParseAddr("0.0.0.0")
-
-	tests := []struct {
-		name      string
-		local     netip.Addr
-		remote    netip.Addr
-		hasDst    bool
-		wantLevel darwinSocketMatchLevel
-	}{
-		{
-			name:      "exact",
-			local:     src,
-			remote:    dst,
-			hasDst:    true,
-			wantLevel: darwinSocketExactMatch,
-		},
-		{
-			name:      "unspecified local with matching remote",
-			local:     unspecifiedLocal,
-			remote:    dst,
-			hasDst:    true,
-			wantLevel: darwinSocketExactMatch,
-		},
-		{
-			name:      "unspecified local without destination",
-			local:     unspecifiedLocal,
-			remote:    otherRemote,
-			hasDst:    false,
-			wantLevel: darwinSocketExactMatch,
-		},
-		{
-			name:      "local match with different remote",
-			local:     src,
-			remote:    otherRemote,
-			hasDst:    true,
-			wantLevel: darwinSocketLocalMatch,
-		},
-		{
-			name:      "remote match with different local",
-			local:     otherLocal,
-			remote:    dst,
-			hasDst:    true,
-			wantLevel: darwinSocketRemoteMatch,
-		},
-		{
-			name:      "port only with destination",
-			local:     otherLocal,
-			remote:    otherRemote,
-			hasDst:    true,
-			wantLevel: darwinSocketPortMatch,
-		},
-		{
-			name:      "different local without destination",
-			local:     otherLocal,
-			remote:    otherRemote,
-			hasDst:    false,
-			wantLevel: darwinSocketNoMatch,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			info := newDarwinSocketInfo("tcp", test.local, 12345, test.remote, 443)
-			level := darwinSocketInfoMatchLevel(info, "tcp", src, 12345, dst, 443, test.hasDst)
-			if level != test.wantLevel {
-				t.Fatalf("unexpected match level: got %d, want %d", level, test.wantLevel)
-			}
-		})
-	}
-}
-
-func newDarwinSocketInfo(network string, local netip.Addr, localPort uint16, remote netip.Addr, remotePort uint16) []byte {
-	info := make([]byte, darwinSocketFDInfoSize)
-	switch network {
-	case "tcp":
-		writeDarwinNativeUint32(info, darwinSocketInfoProtoOff, uint32(unix.IPPROTO_TCP))
-		writeDarwinNativeUint32(info, darwinSocketInfoKindOff, uint32(darwinSockInfoTCP))
-	case "udp":
-		writeDarwinNativeUint32(info, darwinSocketInfoProtoOff, uint32(unix.IPPROTO_UDP))
-		writeDarwinNativeUint32(info, darwinSocketInfoKindOff, uint32(darwinSockInfoIN))
-	}
-	writeDarwinNativeUint32(info, darwinSocketInfoFamilyOff, uint32(unix.AF_INET))
-	info[darwinInSockInfoVFlagOff] = darwinInSockInfoIPv4
-	writeDarwinNativeUint32(info, darwinInSockInfoLPortOff, uint32(localPort))
-	writeDarwinNativeUint32(info, darwinInSockInfoFPortOff, uint32(remotePort))
-	copyDarwinIPv4(info[darwinInSockInfoLAddrOff:darwinInSockInfoLAddrOff+16], local)
-	copyDarwinIPv4(info[darwinInSockInfoFAddrOff:darwinInSockInfoFAddrOff+16], remote)
-	return info
-}
-
-func writeDarwinNativeUint32(b []byte, offset int, value uint32) {
-	*(*uint32)(unsafe.Pointer(&b[offset])) = value
-}
-
-func copyDarwinIPv4(dst []byte, addr netip.Addr) {
-	ip := addr.As4()
-	copy(dst[12:16], ip[:])
-}

common/net/find_process_ios.go

@@ -1,11 +0,0 @@
-//go:build ios
-
-package net
-
-import (
-	"github.com/xtls/xray-core/common/errors"
-)
-
-func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (int, string, string, error) {
-	return 0, "", "", errors.New("process lookup is not supported on this platform")
-}

common/net/find_process_others.go

@@ -1,4 +1,4 @@
-//go:build !windows && !linux && !android && !darwin
+//go:build !windows && !linux && !android
 
 package net
 

common/platform/env_reload.go

@@ -1,40 +0,0 @@
-package platform
-
-import (
-	"errors"
-	"sync"
-)
-
-var envReloadRegistry = struct {
-	sync.RWMutex
-	handlers []func() error
-}{}
-
-// RegisterEnvReload registers an environment reload handler and runs it once
-// immediately so package defaults keep the same behavior as init-time reads.
-func RegisterEnvReload(handler func() error) {
-	if handler == nil {
-		return
-	}
-	envReloadRegistry.Lock()
-	envReloadRegistry.handlers = append(envReloadRegistry.handlers, handler)
-	envReloadRegistry.Unlock()
-	if err := handler(); err != nil {
-		panic(err)
-	}
-}
-
-// ReloadEnvSettings refreshes all registered environment-backed package state.
-func ReloadEnvSettings() error {
-	envReloadRegistry.RLock()
-	handlers := append([]func() error{}, envReloadRegistry.handlers...)
-	envReloadRegistry.RUnlock()
-
-	var errs []error
-	for _, handler := range handlers {
-		if err := handler(); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}

common/protocol/headers.pb.go

@@ -28,6 +28,8 @@ const (
 	SecurityType_AUTO              SecurityType = 2
 	SecurityType_AES128_GCM        SecurityType = 3
 	SecurityType_CHACHA20_POLY1305 SecurityType = 4
+	SecurityType_NONE              SecurityType = 5 // [DEPRECATED 2023-06]
+	SecurityType_ZERO              SecurityType = 6
 )
 
 // Enum value maps for SecurityType.
@@ -37,12 +39,16 @@ var (
 		2: "AUTO",
 		3: "AES128_GCM",
 		4: "CHACHA20_POLY1305",
+		5: "NONE",
+		6: "ZERO",
 	}
 	SecurityType_value = map[string]int32{
 		"UNKNOWN":           0,
 		"AUTO":              2,
 		"AES128_GCM":        3,
 		"CHACHA20_POLY1305": 4,
+		"NONE":              5,
+		"ZERO":              6,
 	}
 )
 
@@ -123,13 +129,15 @@ const file_common_protocol_headers_proto_rawDesc = "" +
 	"\n" +
 	"\x1dcommon/protocol/headers.proto\x12\x14xray.common.protocol\"H\n" +
 	"\x0eSecurityConfig\x126\n" +
-	"\x04type\x18\x01 \x01(\x0e2\".xray.common.protocol.SecurityTypeR\x04type*L\n" +
+	"\x04type\x18\x01 \x01(\x0e2\".xray.common.protocol.SecurityTypeR\x04type*`\n" +
 	"\fSecurityType\x12\v\n" +
 	"\aUNKNOWN\x10\x00\x12\b\n" +
 	"\x04AUTO\x10\x02\x12\x0e\n" +
 	"\n" +
 	"AES128_GCM\x10\x03\x12\x15\n" +
-	"\x11CHACHA20_POLY1305\x10\x04B^\n" +
+	"\x11CHACHA20_POLY1305\x10\x04\x12\b\n" +
+	"\x04NONE\x10\x05\x12\b\n" +
+	"\x04ZERO\x10\x06B^\n" +
 	"\x18com.xray.common.protocolP\x01Z)github.com/xtls/xray-core/common/protocol\xaa\x02\x14Xray.Common.Protocolb\x06proto3"
 
 var (

common/protocol/headers.proto

@@ -11,6 +11,8 @@ enum SecurityType {
   AUTO = 2;
   AES128_GCM = 3;
   CHACHA20_POLY1305 = 4;
+  NONE = 5; // [DEPRECATED 2023-06] 
+  ZERO = 6;
 }
 
 message SecurityConfig {

common/protocol/quic/sniff.go

@@ -143,9 +143,7 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 		if err != nil {
 			return nil, err
 		}
-		if len(b) < hdrLen+4+block.BlockSize() {
-			return nil, errNotQuic
-		}
+
 		cache.Clear()
 		mask := cache.Extend(int32(block.BlockSize()))
 		block.Encrypt(mask, b[hdrLen+4:hdrLen+4+len(mask)])

common/xudp/xudp.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strconv"
 	"strings"
-	"sync/atomic"
+	"time"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
@@ -27,39 +27,25 @@ var AddrParser = protocol.NewAddressParser(
 )
 
 var (
-	Show    atomic.Bool
-	baseKey atomic.Value
+	Show    bool
+	BaseKey []byte
 )
 
-func reloadEnvSettings() error {
-	Show.Store(strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true")
-	raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" })
-	if raw == "" {
-		ensureBaseKey()
-		return nil
-	}
-	key, _ := base64.RawURLEncoding.DecodeString(raw)
-	if len(key) != 32 {
-		return errors.New(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(key)))
-	}
-	baseKey.Store(append([]byte(nil), key...))
-	return nil
-}
-
-func ensureBaseKey() []byte {
-	if key := baseKey.Load(); key != nil {
-		return key.([]byte)
-	}
-	key := make([]byte, 32)
-	if _, err := rand.Read(key); err != nil {
-		panic(err)
-	}
-	baseKey.Store(key)
-	return key
-}
-
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	if strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true" {
+		Show = true
+	}
+	BaseKey = make([]byte, 32)
+	rand.Read(BaseKey)
+	go func() {
+		time.Sleep(100 * time.Millisecond) // this is not nice, but need to give some time for Android to setup ENV
+		if raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" }); raw != "" {
+			if BaseKey, _ = base64.RawURLEncoding.DecodeString(raw); len(BaseKey) == 32 {
+				return
+			}
+			panic(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(BaseKey)))
+		}
+	}()
 }
 
 func GetGlobalID(ctx context.Context) (globalID [8]byte) {
@@ -68,10 +54,10 @@ func GetGlobalID(ctx context.Context) (globalID [8]byte) {
 	}
 	if inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Source.Network == net.Network_UDP &&
 		(inbound.Name == "dokodemo-door" || inbound.Name == "socks" || inbound.Name == "shadowsocks" || inbound.Name == "tun") {
-		h := blake3.New(8, ensureBaseKey())
+		h := blake3.New(8, BaseKey)
 		h.Write([]byte(inbound.Source.String()))
 		copy(globalID[:], h.Sum(nil))
-		if Show.Load() {
+		if Show {
 			errors.LogInfo(ctx, fmt.Sprintf("XUDP inbound.Source.String(): %v\tglobalID: %v\n", inbound.Source.String(), globalID))
 		}
 	}

core/core.go

@@ -19,8 +19,8 @@ import (
 
 var (
 	Version_x byte = 26
-	Version_y byte = 7
-	Version_z byte = 28
+	Version_y byte = 6
+	Version_z byte = 22
 )
 
 var (

core/xray.go

@@ -187,9 +187,6 @@ func NewWithContext(ctx context.Context, config *Config) (*Instance, error) {
 }
 
 func initInstanceWithConfig(config *Config, server *Instance) (bool, error) {
-	if err := platform.ReloadEnvSettings(); err != nil {
-		return true, errors.New("failed to reload environment settings").Base(err)
-	}
 	server.ctx = context.WithValue(server.ctx, "cone",
 		platform.NewEnvFlag(platform.UseCone).GetValue(func() string { return "" }) != "true")
 

features/policy/policy.go

@@ -3,7 +3,6 @@ package policy
 import (
 	"context"
 	"runtime"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -83,41 +82,32 @@ func ManagerType() interface{} {
 	return (*Manager)(nil)
 }
 
-var defaultBufferSize atomic.Int32
+var defaultBufferSize int32
 
-func reloadEnvSettings() error {
-	defaultBufferSize.Store(readDefaultBufferSize())
-	return nil
-}
-
-func readDefaultBufferSize() int32 {
+func init() {
 	const defaultValue = -17
 	size := platform.NewEnvFlag(platform.BufferSize).GetValueAsInt(defaultValue)
 
 	switch size {
 	case 0:
-		return -1 // For pipe to use unlimited size
+		defaultBufferSize = -1 // For pipe to use unlimited size
 	case defaultValue: // Env flag not defined. Use default values per CPU-arch.
 		switch runtime.GOARCH {
 		case "arm", "mips", "mipsle":
-			return 0
+			defaultBufferSize = 0
 		case "arm64", "mips64", "mips64le":
-			return 4 * 1024 // 4k cache for low-end devices
+			defaultBufferSize = 4 * 1024 // 4k cache for low-end devices
 		default:
-			return 512 * 1024
+			defaultBufferSize = 512 * 1024
 		}
 	default:
-		return int32(size) * 1024 * 1024
+		defaultBufferSize = int32(size) * 1024 * 1024
 	}
 }
 
-func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
-}
-
 func defaultBufferPolicy() Buffer {
 	return Buffer{
-		PerConnection: defaultBufferSize.Load(),
+		PerConnection: defaultBufferSize,
 	}
 }
 

features/stats/stats.go

@@ -81,8 +81,6 @@ type Manager interface {
 
 	// RegisterCounter registers a new counter to the manager. The identifier string must not be empty, and unique among other counters.
 	RegisterCounter(string) (Counter, error)
-	// GetOrRegisterCounter returns the counter by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterCounter(string) (Counter, error)
 	// UnregisterCounter unregisters a counter from the manager by its identifier.
 	UnregisterCounter(string) error
 	// GetCounter returns a counter by its identifier.
@@ -93,8 +91,6 @@ type Manager interface {
 
 	// RegisterOnlineMap registers a new OnlineMap to the manager. The identifier string must not be empty, and unique among other OnlineMaps.
 	RegisterOnlineMap(string) (OnlineMap, error)
-	// GetOrRegisterOnlineMap returns the OnlineMap by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterOnlineMap(string) (OnlineMap, error)
 	// UnregisterOnlineMap unregisters an OnlineMap from the manager by its identifier.
 	UnregisterOnlineMap(string) error
 	// GetOnlineMap returns an OnlineMap by its identifier.
@@ -105,8 +101,6 @@ type Manager interface {
 
 	// RegisterChannel registers a new channel to the manager. The identifier string must not be empty, and unique among other channels.
 	RegisterChannel(string) (Channel, error)
-	// GetOrRegisterChannel returns the channel by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterChannel(string) (Channel, error)
 	// UnregisterChannel unregisters a channel from the manager by its identifier.
 	UnregisterChannel(string) error
 	// GetChannel returns a channel by its identifier.
@@ -116,6 +110,36 @@ type Manager interface {
 	GetAllOnlineUsers() []string
 }
 
+// GetOrRegisterCounter tries to get the StatCounter first. If not exist, it then tries to create a new counter.
+func GetOrRegisterCounter(m Manager, name string) (Counter, error) {
+	counter := m.GetCounter(name)
+	if counter != nil {
+		return counter, nil
+	}
+
+	return m.RegisterCounter(name)
+}
+
+// GetOrRegisterOnlineMap tries to get the OnlineMap first. If not exist, it then tries to create a new OnlineMap.
+func GetOrRegisterOnlineMap(m Manager, name string) (OnlineMap, error) {
+	onlineMap := m.GetOnlineMap(name)
+	if onlineMap != nil {
+		return onlineMap, nil
+	}
+
+	return m.RegisterOnlineMap(name)
+}
+
+// GetOrRegisterChannel tries to get the StatChannel first. If not exist, it then tries to create a new channel.
+func GetOrRegisterChannel(m Manager, name string) (Channel, error) {
+	channel := m.GetChannel(name)
+	if channel != nil {
+		return channel, nil
+	}
+
+	return m.RegisterChannel(name)
+}
+
 // ManagerType returns the type of Manager interface. Can be used to implement common.HasType.
 //
 // xray:api:stable
@@ -136,11 +160,6 @@ func (NoopManager) RegisterCounter(string) (Counter, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterCounter implements Manager.
-func (NoopManager) GetOrRegisterCounter(string) (Counter, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterCounter implements Manager.
 func (NoopManager) UnregisterCounter(string) error {
 	return nil
@@ -159,11 +178,6 @@ func (NoopManager) RegisterOnlineMap(string) (OnlineMap, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterOnlineMap implements Manager.
-func (NoopManager) GetOrRegisterOnlineMap(string) (OnlineMap, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterOnlineMap implements Manager.
 func (NoopManager) UnregisterOnlineMap(string) error {
 	return nil
@@ -182,11 +196,6 @@ func (NoopManager) RegisterChannel(string) (Channel, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterChannel implements Manager.
-func (NoopManager) GetOrRegisterChannel(string) (Channel, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterChannel implements Manager.
 func (NoopManager) UnregisterChannel(string) error {
 	return nil

go.mod

@@ -8,13 +8,12 @@ require (
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
-	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.0
+	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/miekg/dns v1.1.72
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.6
-	github.com/pires/go-proxyproto v0.15.0
+	github.com/pires/go-proxyproto v0.12.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sagernet/sing v0.5.1
@@ -23,15 +22,15 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.57.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/net v0.56.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.0.1
-	google.golang.org/grpc v1.82.1
+	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.11
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
@@ -52,11 +51,11 @@ require (
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	golang.org/x/tools v0.45.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -33,8 +33,8 @@ github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
 github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -53,8 +53,8 @@ github.com/pion/stun/v3 v3.1.6 h1:WnhsD0eHCiwCfKNkVx0VJJwr2Y3eV4Ueih3KJ+dfZy8=
 github.com/pion/stun/v3 v3.1.6/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=
 github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=
 github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
+github.com/pires/go-proxyproto v0.12.0 h1:TTCxD66dU898tahivkqc3hoceZp7P44FnorWyo9d5vM=
+github.com/pires/go-proxyproto v0.12.0/go.mod h1:qUvfqUMEoX7T8g0q7TQLDnhMjdTrxnG0hvpMn+7ePNI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -98,22 +98,22 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -121,21 +121,21 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -147,10 +147,10 @@ golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH
 golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/env_test.go

@@ -1,59 +0,0 @@
-package conf
-
-import (
-	"encoding/json"
-	"os"
-	"testing"
-)
-
-func TestRootEnvAppliesArbitraryValues(t *testing.T) {
-	const (
-		valueKey = "XRAY_TEST_CONFIG_ENV"
-		emptyKey = "XRAY_TEST_CONFIG_EMPTY"
-	)
-	t.Setenv(valueKey, "before")
-	t.Setenv(emptyKey, "before")
-
-	config := new(Config)
-	if err := json.Unmarshal([]byte(`{
-		"env": {
-			"XRAY_TEST_CONFIG_ENV": "configured",
-			"XRAY_TEST_CONFIG_EMPTY": ""
-		}
-	}`), config); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := config.Build(); err != nil {
-		t.Fatal(err)
-	}
-
-	if got := os.Getenv(valueKey); got != "configured" {
-		t.Fatalf("env %q = %q, want %q", valueKey, got, "configured")
-	}
-	if got := os.Getenv(emptyKey); got != "" {
-		t.Fatalf("env %q = %q, want empty", emptyKey, got)
-	}
-}
-
-func TestEnvConfigOverride(t *testing.T) {
-	base := EnvConfig{
-		"ONE": "one",
-		"TWO": "old",
-	}
-	override := EnvConfig{
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	base.Override(override)
-
-	want := map[string]string{
-		"ONE":   "one",
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	for key, value := range want {
-		if got := base[key]; got != value {
-			t.Fatalf("env %q = %q, want %q", key, got, value)
-		}
-	}
-}

infra/conf/grpc.go

@@ -0,0 +1,41 @@
+package conf
+
+import (
+	"github.com/xtls/xray-core/transport/internet/grpc"
+	"google.golang.org/protobuf/proto"
+)
+
+type GRPCConfig struct {
+	Authority           string `json:"authority"`
+	ServiceName         string `json:"serviceName"`
+	MultiMode           bool   `json:"multiMode"`
+	IdleTimeout         int32  `json:"idle_timeout"`
+	HealthCheckTimeout  int32  `json:"health_check_timeout"`
+	PermitWithoutStream bool   `json:"permit_without_stream"`
+	InitialWindowsSize  int32  `json:"initial_windows_size"`
+	UserAgent           string `json:"user_agent"`
+}
+
+func (g *GRPCConfig) Build() (proto.Message, error) {
+	if g.IdleTimeout <= 0 {
+		g.IdleTimeout = 0
+	}
+	if g.HealthCheckTimeout <= 0 {
+		g.HealthCheckTimeout = 0
+	}
+	if g.InitialWindowsSize < 0 {
+		// default window size of gRPC-go
+		g.InitialWindowsSize = 0
+	}
+
+	return &grpc.Config{
+		Authority:           g.Authority,
+		ServiceName:         g.ServiceName,
+		MultiMode:           g.MultiMode,
+		IdleTimeout:         g.IdleTimeout,
+		HealthCheckTimeout:  g.HealthCheckTimeout,
+		PermitWithoutStream: g.PermitWithoutStream,
+		InitialWindowsSize:  g.InitialWindowsSize,
+		UserAgent:           g.UserAgent,
+	}, nil
+}

infra/conf/hysteria.go

@@ -22,6 +22,7 @@ func (c *HysteriaClientConfig) Build() (proto.Message, error) {
 	}
 
 	config := &hysteria.ClientConfig{}
+	config.Version = c.Version
 	config.Server = &protocol.ServerEndpoint{
 		Address: c.Address.Build(),
 		Port:    uint32(c.Port),
@@ -43,10 +44,6 @@ type HysteriaServerConfig struct {
 }
 
 func (c *HysteriaServerConfig) Build() (proto.Message, error) {
-	if c.Version != 2 {
-		return nil, errors.New("version != 2")
-	}
-
 	config := new(hysteria.ServerConfig)
 
 	if c.Clients != nil {

infra/conf/shadowsocks.go

@@ -24,6 +24,8 @@ func cipherFromString(c string) shadowsocks.CipherType {
 		return shadowsocks.CipherType_CHACHA20_POLY1305
 	case "xchacha20-poly1305", "aead_xchacha20_poly1305", "xchacha20-ietf-poly1305":
 		return shadowsocks.CipherType_XCHACHA20_POLY1305
+	case "none", "plain":
+		return shadowsocks.CipherType_NONE
 	default:
 		return shadowsocks.CipherType_UNKNOWN
 	}

infra/conf/transport_authenticators.go

@@ -0,0 +1,208 @@
+package conf
+
+import (
+	"sort"
+
+	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/utils"
+	"github.com/xtls/xray-core/transport/internet/headers/http"
+	"github.com/xtls/xray-core/transport/internet/headers/noop"
+	"google.golang.org/protobuf/proto"
+)
+
+type NoOpConnectionAuthenticator struct{}
+
+func (NoOpConnectionAuthenticator) Build() (proto.Message, error) {
+	return new(noop.ConnectionConfig), nil
+}
+
+type AuthenticatorRequest struct {
+	Version string                 `json:"version"`
+	Method  string                 `json:"method"`
+	Path    StringList             `json:"path"`
+	Headers map[string]*StringList `json:"headers"`
+}
+
+func sortMapKeys(m map[string]*StringList) []string {
+	var keys []string
+	for key := range m {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func (v *AuthenticatorRequest) Build() (*http.RequestConfig, error) {
+	config := &http.RequestConfig{
+		Uri: []string{"/"},
+		Header: []*http.Header{
+			{
+				Name:  "Host",
+				Value: []string{"www.baidu.com", "www.bing.com"},
+			},
+			{
+				Name:  "User-Agent",
+				Value: []string{utils.ChromeUA},
+			},
+			{
+				Name:  "Sec-CH-UA",
+				Value: []string{utils.ChromeUACH},
+			},
+			{
+				Name:  "Sec-CH-UA-Mobile",
+				Value: []string{"?0"},
+			},
+			{
+				Name:  "Sec-CH-UA-Platform",
+				Value: []string{"Windows"},
+			},
+			{
+				Name:  "Sec-Fetch-Mode",
+				Value: []string{"no-cors", "cors", "same-origin"},
+			},
+			{
+				Name:  "Sec-Fetch-Dest",
+				Value: []string{"empty"},
+			},
+			{
+				Name:  "Sec-Fetch-Site",
+				Value: []string{"none"},
+			},
+			{
+				Name:  "Sec-Fetch-User",
+				Value: []string{"?1"},
+			},
+			{
+				Name:  "Accept-Encoding",
+				Value: []string{"gzip, deflate"},
+			},
+			{
+				Name:  "Connection",
+				Value: []string{"keep-alive"},
+			},
+			{
+				Name:  "Pragma",
+				Value: []string{"no-cache"},
+			},
+		},
+	}
+
+	if len(v.Version) > 0 {
+		config.Version = &http.Version{Value: v.Version}
+	}
+
+	if len(v.Method) > 0 {
+		config.Method = &http.Method{Value: v.Method}
+	}
+
+	if len(v.Path) > 0 {
+		config.Uri = append([]string(nil), v.Path...)
+	}
+
+	if len(v.Headers) > 0 {
+		config.Header = make([]*http.Header, 0, len(v.Headers))
+		headerNames := sortMapKeys(v.Headers)
+		for _, key := range headerNames {
+			value := v.Headers[key]
+			if value == nil {
+				return nil, errors.New("empty HTTP header value: " + key).AtError()
+			}
+			config.Header = append(config.Header, &http.Header{
+				Name:  key,
+				Value: append([]string(nil), (*value)...),
+			})
+		}
+	}
+
+	return config, nil
+}
+
+type AuthenticatorResponse struct {
+	Version string                 `json:"version"`
+	Status  string                 `json:"status"`
+	Reason  string                 `json:"reason"`
+	Headers map[string]*StringList `json:"headers"`
+}
+
+func (v *AuthenticatorResponse) Build() (*http.ResponseConfig, error) {
+	config := &http.ResponseConfig{
+		Header: []*http.Header{
+			{
+				Name:  "Content-Type",
+				Value: []string{"application/octet-stream", "video/mpeg"},
+			},
+			{
+				Name:  "Transfer-Encoding",
+				Value: []string{"chunked"},
+			},
+			{
+				Name:  "Connection",
+				Value: []string{"keep-alive"},
+			},
+			{
+				Name:  "Pragma",
+				Value: []string{"no-cache"},
+			},
+			{
+				Name:  "Cache-Control",
+				Value: []string{"private", "no-cache"},
+			},
+		},
+	}
+
+	if len(v.Version) > 0 {
+		config.Version = &http.Version{Value: v.Version}
+	}
+
+	if len(v.Status) > 0 || len(v.Reason) > 0 {
+		config.Status = &http.Status{
+			Code:   "200",
+			Reason: "OK",
+		}
+		if len(v.Status) > 0 {
+			config.Status.Code = v.Status
+		}
+		if len(v.Reason) > 0 {
+			config.Status.Reason = v.Reason
+		}
+	}
+
+	if len(v.Headers) > 0 {
+		config.Header = make([]*http.Header, 0, len(v.Headers))
+		headerNames := sortMapKeys(v.Headers)
+		for _, key := range headerNames {
+			value := v.Headers[key]
+			if value == nil {
+				return nil, errors.New("empty HTTP header value: " + key).AtError()
+			}
+			config.Header = append(config.Header, &http.Header{
+				Name:  key,
+				Value: append([]string(nil), (*value)...),
+			})
+		}
+	}
+
+	return config, nil
+}
+
+type Authenticator struct {
+	Request  AuthenticatorRequest  `json:"request"`
+	Response AuthenticatorResponse `json:"response"`
+}
+
+func (v *Authenticator) Build() (proto.Message, error) {
+	config := new(http.Config)
+	requestConfig, err := v.Request.Build()
+	if err != nil {
+		return nil, err
+	}
+	config.Request = requestConfig
+
+	responseConfig, err := v.Response.Build()
+	if err != nil {
+		return nil, err
+	}
+	config.Response = responseConfig
+
+	return config, nil
+}

infra/conf/transport_finalmask.go

@@ -1,951 +0,0 @@
-package conf
-
-import (
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"net/netip"
-	"net/url"
-	"regexp"
-	"strings"
-
-	googleuuid "github.com/google/uuid"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
-	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
-	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/aes128gcm"
-	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/header"
-	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/original"
-	"github.com/xtls/xray-core/transport/internet/finalmask/noise"
-	"github.com/xtls/xray-core/transport/internet/finalmask/realm"
-	"github.com/xtls/xray-core/transport/internet/finalmask/salamander"
-	"github.com/xtls/xray-core/transport/internet/finalmask/sudoku"
-	"github.com/xtls/xray-core/transport/internet/finalmask/xdns"
-	"github.com/xtls/xray-core/transport/internet/finalmask/xicmp"
-	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
-	"github.com/xtls/xray-core/transport/internet/tls"
-	"google.golang.org/protobuf/proto"
-)
-
-func PraseByteSlice(data json.RawMessage, typ string) ([]byte, error) {
-	switch strings.ToLower(typ) {
-	case "", "array":
-		if len(data) == 0 {
-			return data, nil
-		}
-		var packet []byte
-		if err := json.Unmarshal(data, &packet); err != nil {
-			return nil, err
-		}
-		return packet, nil
-	case "str":
-		var str string
-		if err := json.Unmarshal(data, &str); err != nil {
-			return nil, err
-		}
-		return []byte(str), nil
-	case "hex":
-		var str string
-		if err := json.Unmarshal(data, &str); err != nil {
-			return nil, err
-		}
-		return hex.DecodeString(str)
-	case "base64":
-		var str string
-		if err := json.Unmarshal(data, &str); err != nil {
-			return nil, err
-		}
-		return base64.StdEncoding.DecodeString(str)
-	default:
-		return nil, errors.New("unknown type")
-	}
-}
-
-var (
-	customVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
-
-	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
-		"fragment":      func() interface{} { return new(FragmentMask) },
-		"sudoku":        func() interface{} { return new(Sudoku) },
-		"xmc":           func() interface{} { return new(XMC) },
-	}, "type", "settings")
-
-	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
-		"header-custom": func() interface{} { return new(HeaderCustomUDP) },
-		"mkcp-legacy":   func() interface{} { return new(MkcpLegacy) },
-		"noise":         func() interface{} { return new(NoiseMask) },
-		"salamander":    func() interface{} { return new(Salamander) },
-		"sudoku":        func() interface{} { return new(Sudoku) },
-		"xdns":          func() interface{} { return new(Xdns) },
-		"xicmp":         func() interface{} { return new(Xicmp) },
-		"realm":         func() interface{} { return new(Realm) },
-	}, "type", "settings")
-)
-
-type TCPItem struct {
-	Delay     Int32Range       `json:"delay"`
-	Rand      int32            `json:"rand"`
-	RandRange *Int32Range      `json:"randRange"`
-	Capture   string           `json:"capture"`
-	Type      string           `json:"type"`
-	Reuse     string           `json:"reuse"`
-	Transform *CustomTransform `json:"transform"`
-	Packet    json.RawMessage  `json:"packet"`
-}
-
-type HeaderCustomTCP struct {
-	Clients [][]TCPItem `json:"clients"`
-	Servers [][]TCPItem `json:"servers"`
-	Errors  [][]TCPItem `json:"errors"`
-}
-
-func (c *HeaderCustomTCP) Build() (proto.Message, error) {
-	for _, value := range c.Clients {
-		for _, item := range value {
-			if err := validateCustomItemSpec(item.Capture, item.Packet, item.Rand, item.Reuse, item.Transform); err != nil {
-				return nil, err
-			}
-		}
-	}
-	for _, value := range c.Servers {
-		for _, item := range value {
-			if err := validateCustomItemSpec(item.Capture, item.Packet, item.Rand, item.Reuse, item.Transform); err != nil {
-				return nil, err
-			}
-		}
-	}
-	for _, value := range c.Errors {
-		for _, item := range value {
-			if err := validateCustomItemSpec(item.Capture, item.Packet, item.Rand, item.Reuse, item.Transform); err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	errInvalidRange := errors.New("invalid randRange")
-
-	clients := make([]*custom.TCPSequence, len(c.Clients))
-	for i, value := range c.Clients {
-		clients[i] = &custom.TCPSequence{}
-		for _, item := range value {
-			if item.RandRange == nil {
-				item.RandRange = &Int32Range{From: 0, To: 255}
-			}
-			if item.RandRange.From < 0 || item.RandRange.To > 255 {
-				return nil, errInvalidRange
-			}
-			var err error
-			if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-				return nil, err
-			}
-			transform, err := buildCustomTransform(item.Transform)
-			if err != nil {
-				return nil, err
-			}
-			clients[i].Sequence = append(clients[i].Sequence, &custom.TCPItem{
-				DelayMin: int64(item.Delay.From),
-				DelayMax: int64(item.Delay.To),
-				Rand:     item.Rand,
-				RandMin:  item.RandRange.From,
-				RandMax:  item.RandRange.To,
-				Packet:   item.Packet,
-				Save:     item.Capture,
-				Var:      item.Reuse,
-				Expr:     transform,
-			})
-		}
-	}
-
-	servers := make([]*custom.TCPSequence, len(c.Servers))
-	for i, value := range c.Servers {
-		servers[i] = &custom.TCPSequence{}
-		for _, item := range value {
-			if item.RandRange == nil {
-				item.RandRange = &Int32Range{From: 0, To: 255}
-			}
-			if item.RandRange.From < 0 || item.RandRange.To > 255 {
-				return nil, errInvalidRange
-			}
-			var err error
-			if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-				return nil, err
-			}
-			transform, err := buildCustomTransform(item.Transform)
-			if err != nil {
-				return nil, err
-			}
-			servers[i].Sequence = append(servers[i].Sequence, &custom.TCPItem{
-				DelayMin: int64(item.Delay.From),
-				DelayMax: int64(item.Delay.To),
-				Rand:     item.Rand,
-				RandMin:  item.RandRange.From,
-				RandMax:  item.RandRange.To,
-				Packet:   item.Packet,
-				Save:     item.Capture,
-				Var:      item.Reuse,
-				Expr:     transform,
-			})
-		}
-	}
-
-	errors := make([]*custom.TCPSequence, len(c.Errors))
-	for i, value := range c.Errors {
-		errors[i] = &custom.TCPSequence{}
-		for _, item := range value {
-			if item.RandRange == nil {
-				item.RandRange = &Int32Range{From: 0, To: 255}
-			}
-			if item.RandRange.From < 0 || item.RandRange.To > 255 {
-				return nil, errInvalidRange
-			}
-			var err error
-			if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-				return nil, err
-			}
-			transform, err := buildCustomTransform(item.Transform)
-			if err != nil {
-				return nil, err
-			}
-			errors[i].Sequence = append(errors[i].Sequence, &custom.TCPItem{
-				DelayMin: int64(item.Delay.From),
-				DelayMax: int64(item.Delay.To),
-				Rand:     item.Rand,
-				RandMin:  item.RandRange.From,
-				RandMax:  item.RandRange.To,
-				Packet:   item.Packet,
-				Save:     item.Capture,
-				Var:      item.Reuse,
-				Expr:     transform,
-			})
-		}
-	}
-
-	return &custom.TCPConfig{
-		Clients: clients,
-		Servers: servers,
-		Errors:  errors,
-	}, nil
-}
-
-type FragmentMask struct {
-	Packets  string       `json:"packets"`
-	Length   Int32Range   `json:"length"`
-	Delay    Int32Range   `json:"delay"`
-	Lengths  []Int32Range `json:"lengths"`
-	Delays   []Int32Range `json:"delays"`
-	MaxSplit Int32Range   `json:"maxSplit"`
-}
-
-func (c *FragmentMask) Build() (proto.Message, error) {
-	config := &fragment.Config{}
-
-	switch strings.ToLower(c.Packets) {
-	case "tlshello":
-		config.PacketsFrom = 0
-		config.PacketsTo = 1
-	case "":
-		config.PacketsFrom = 0
-		config.PacketsTo = 0
-	default:
-		from, to, err := ParseRangeString(c.Packets)
-		if err != nil {
-			return nil, errors.New("Invalid PacketsFrom").Base(err)
-		}
-		config.PacketsFrom = int64(from)
-		config.PacketsTo = int64(to)
-		if config.PacketsFrom == 0 {
-			return nil, errors.New("PacketsFrom can't be 0")
-		}
-	}
-
-	if len(c.Lengths) > 0 {
-		for _, r := range c.Lengths {
-			config.LengthsMin = append(config.LengthsMin, int64(r.From))
-			config.LengthsMax = append(config.LengthsMax, int64(r.To))
-		}
-	} else {
-		config.LengthsMin = append(config.LengthsMin, int64(c.Length.From))
-		config.LengthsMax = append(config.LengthsMax, int64(c.Length.To))
-	}
-
-	if config.LengthsMin[len(config.LengthsMin)-1] == 0 {
-		return nil, errors.New("last lengths entry min can't be 0")
-	}
-
-	if len(c.Delays) > 0 {
-		for _, r := range c.Delays {
-			config.DelaysMin = append(config.DelaysMin, int64(r.From))
-			config.DelaysMax = append(config.DelaysMax, int64(r.To))
-		}
-	} else {
-		config.DelaysMin = append(config.DelaysMin, int64(c.Delay.From))
-		config.DelaysMax = append(config.DelaysMax, int64(c.Delay.To))
-	}
-
-	config.MaxSplitMin = int64(c.MaxSplit.From)
-	config.MaxSplitMax = int64(c.MaxSplit.To)
-
-	return config, nil
-}
-
-type NoiseItem struct {
-	Rand      Int32Range      `json:"rand"`
-	RandRange *Int32Range     `json:"randRange"`
-	Type      string          `json:"type"`
-	Packet    json.RawMessage `json:"packet"`
-	Delay     Int32Range      `json:"delay"`
-}
-
-type NoiseMask struct {
-	Reset Int32Range  `json:"reset"`
-	Noise []NoiseItem `json:"noise"`
-}
-
-func (c *NoiseMask) Build() (proto.Message, error) {
-	for _, item := range c.Noise {
-		if len(item.Packet) > 0 && item.Rand.To > 0 {
-			return nil, errors.New("len(item.Packet) > 0 && item.Rand.To > 0")
-		}
-	}
-
-	noiseSlice := make([]*noise.Item, 0, len(c.Noise))
-	for _, item := range c.Noise {
-		if item.RandRange == nil {
-			item.RandRange = &Int32Range{From: 0, To: 255}
-		}
-		if item.RandRange.From < 0 || item.RandRange.To > 255 {
-			return nil, errors.New("invalid randRange")
-		}
-		var err error
-		if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-			return nil, err
-		}
-		noiseSlice = append(noiseSlice, &noise.Item{
-			RandMin:      int64(item.Rand.From),
-			RandMax:      int64(item.Rand.To),
-			RandRangeMin: item.RandRange.From,
-			RandRangeMax: item.RandRange.To,
-			Packet:       item.Packet,
-			DelayMin:     int64(item.Delay.From),
-			DelayMax:     int64(item.Delay.To),
-		})
-	}
-
-	return &noise.Config{
-		ResetMin: int64(c.Reset.From),
-		ResetMax: int64(c.Reset.To),
-		Items:    noiseSlice,
-	}, nil
-}
-
-type UDPItem struct {
-	Rand      int32            `json:"rand"`
-	RandRange *Int32Range      `json:"randRange"`
-	Capture   string           `json:"capture"`
-	Type      string           `json:"type"`
-	Reuse     string           `json:"reuse"`
-	Transform *CustomTransform `json:"transform"`
-	Packet    json.RawMessage  `json:"packet"`
-}
-
-type CustomTransform struct {
-	Op   string               `json:"op"`
-	Args []CustomTransformArg `json:"args"`
-}
-
-type CustomTransformArg struct {
-	Type      string           `json:"type"`
-	Bytes     json.RawMessage  `json:"bytes"`
-	U64       *uint64          `json:"u64"`
-	Reuse     string           `json:"reuse"`
-	Metadata  string           `json:"metadata"`
-	Transform *CustomTransform `json:"transform"`
-}
-
-func validateCustomVarName(name string) error {
-	if name == "" {
-		return nil
-	}
-	if !customVarNamePattern.MatchString(name) {
-		return errors.New("invalid variable name")
-	}
-	return nil
-}
-
-func validateCustomItemSpec(capture string, packet json.RawMessage, rand int32, reuse string, transform *CustomTransform) error {
-	if err := validateCustomVarName(capture); err != nil {
-		return err
-	}
-	if err := validateCustomVarName(reuse); err != nil {
-		return err
-	}
-
-	kindCount := 0
-	if len(packet) > 0 {
-		kindCount++
-	}
-	if rand > 0 {
-		kindCount++
-	}
-	if reuse != "" {
-		kindCount++
-	}
-	if transform != nil {
-		kindCount++
-	}
-	if kindCount > 1 {
-		return errors.New("exactly one item kind must be set")
-	}
-	if kindCount == 0 && capture != "" {
-		return errors.New("exactly one item kind must be set")
-	}
-
-	return nil
-}
-
-func buildCustomTransform(transform *CustomTransform) (*custom.Expr, error) {
-	if transform == nil {
-		return nil, nil
-	}
-	if transform.Op == "" {
-		return nil, errors.New("transform op is required")
-	}
-	if len(transform.Args) == 0 {
-		return nil, errors.New("transform args are required")
-	}
-
-	args := make([]*custom.ExprArg, 0, len(transform.Args))
-	for _, arg := range transform.Args {
-		parsedArg, err := buildCustomTransformArg(arg)
-		if err != nil {
-			return nil, err
-		}
-		args = append(args, parsedArg)
-	}
-
-	return &custom.Expr{
-		Op:   transform.Op,
-		Args: args,
-	}, nil
-}
-
-func buildCustomTransformArg(arg CustomTransformArg) (*custom.ExprArg, error) {
-	kindCount := 0
-	if len(arg.Bytes) > 0 {
-		kindCount++
-	}
-	if arg.U64 != nil {
-		kindCount++
-	}
-	if arg.Reuse != "" {
-		kindCount++
-	}
-	if arg.Metadata != "" {
-		kindCount++
-	}
-	if arg.Transform != nil {
-		kindCount++
-	}
-	if kindCount != 1 {
-		return nil, errors.New("transform arg must set exactly one value")
-	}
-
-	if len(arg.Bytes) > 0 {
-		value, err := PraseByteSlice(arg.Bytes, arg.Type)
-		if err != nil {
-			return nil, err
-		}
-		return &custom.ExprArg{
-			Value: &custom.ExprArg_Bytes{
-				Bytes: value,
-			},
-		}, nil
-	}
-	if arg.U64 != nil {
-		return &custom.ExprArg{
-			Value: &custom.ExprArg_U64{
-				U64: *arg.U64,
-			},
-		}, nil
-	}
-	if arg.Reuse != "" {
-		if err := validateCustomVarName(arg.Reuse); err != nil {
-			return nil, err
-		}
-		return &custom.ExprArg{
-			Value: &custom.ExprArg_Var{
-				Var: arg.Reuse,
-			},
-		}, nil
-	}
-	if arg.Metadata != "" {
-		return &custom.ExprArg{
-			Value: &custom.ExprArg_Metadata{
-				Metadata: arg.Metadata,
-			},
-		}, nil
-	}
-
-	parsedExpr, err := buildCustomTransform(arg.Transform)
-	if err != nil {
-		return nil, err
-	}
-	return &custom.ExprArg{
-		Value: &custom.ExprArg_Expr{
-			Expr: parsedExpr,
-		},
-	}, nil
-}
-
-type HeaderCustomUDP struct {
-	Mode   string    `json:"mode"`
-	Client []UDPItem `json:"client"`
-	Server []UDPItem `json:"server"`
-}
-
-func (c *HeaderCustomUDP) Build() (proto.Message, error) {
-	switch c.Mode {
-	case "", "prefix", "standalone":
-	default:
-		return nil, errors.New("unknown udp mode")
-	}
-
-	for _, item := range c.Client {
-		if err := validateCustomItemSpec(item.Capture, item.Packet, item.Rand, item.Reuse, item.Transform); err != nil {
-			return nil, err
-		}
-	}
-	for _, item := range c.Server {
-		if err := validateCustomItemSpec(item.Capture, item.Packet, item.Rand, item.Reuse, item.Transform); err != nil {
-			return nil, err
-		}
-	}
-
-	client := make([]*custom.UDPItem, 0, len(c.Client))
-	for _, item := range c.Client {
-		if item.RandRange == nil {
-			item.RandRange = &Int32Range{From: 0, To: 255}
-		}
-		if item.RandRange.From < 0 || item.RandRange.To > 255 {
-			return nil, errors.New("invalid randRange")
-		}
-		var err error
-		if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-			return nil, err
-		}
-		transform, err := buildCustomTransform(item.Transform)
-		if err != nil {
-			return nil, err
-		}
-		client = append(client, &custom.UDPItem{
-			Rand:    item.Rand,
-			RandMin: item.RandRange.From,
-			RandMax: item.RandRange.To,
-			Packet:  item.Packet,
-			Save:    item.Capture,
-			Var:     item.Reuse,
-			Expr:    transform,
-		})
-	}
-
-	server := make([]*custom.UDPItem, 0, len(c.Server))
-	for _, item := range c.Server {
-		if item.RandRange == nil {
-			item.RandRange = &Int32Range{From: 0, To: 255}
-		}
-		if item.RandRange.From < 0 || item.RandRange.To > 255 {
-			return nil, errors.New("invalid randRange")
-		}
-		var err error
-		if item.Packet, err = PraseByteSlice(item.Packet, item.Type); err != nil {
-			return nil, err
-		}
-		transform, err := buildCustomTransform(item.Transform)
-		if err != nil {
-			return nil, err
-		}
-		server = append(server, &custom.UDPItem{
-			Rand:    item.Rand,
-			RandMin: item.RandRange.From,
-			RandMax: item.RandRange.To,
-			Packet:  item.Packet,
-			Save:    item.Capture,
-			Var:     item.Reuse,
-			Expr:    transform,
-		})
-	}
-
-	if c.Mode == "standalone" {
-		return &custom.UDPStandaloneConfig{
-			Client: client,
-			Server: server,
-		}, nil
-	} else {
-		return &custom.UDPConfig{
-			Client: client,
-			Server: server,
-		}, nil
-	}
-}
-
-type MkcpLegacy struct {
-	Header string `json:"header"`
-	Value  string `json:"value"`
-}
-
-func (c *MkcpLegacy) Build() (proto.Message, error) {
-	if len(c.Header) == 0 {
-		if len(c.Value) == 0 {
-			return &original.Config{}, nil
-		} else {
-			return &aes128gcm.Config{Password: c.Value}, nil
-		}
-	}
-	switch strings.ToLower(c.Header) {
-	case "dns":
-		domain := c.Value
-		if len(domain) == 0 {
-			domain = "www.baidu.com"
-		}
-		return &header.Config{ID: 0, Domain: domain}, nil
-	case "dtls":
-		return &header.Config{ID: 1}, nil
-	case "srtp":
-		return &header.Config{ID: 2}, nil
-	case "utp":
-		return &header.Config{ID: 3}, nil
-	case "wechat":
-		return &header.Config{ID: 4}, nil
-	case "wireguard":
-		return &header.Config{ID: 5}, nil
-	default:
-		return nil, errors.New("invalid header ", c.Header)
-	}
-}
-
-type Salamander struct {
-	Password   string     `json:"password"`
-	PacketSize Int32Range `json:"packetSize"`
-}
-
-func (c *Salamander) Build() (proto.Message, error) {
-	if c.PacketSize.To > 0 {
-		if c.PacketSize.From <= 0 || c.PacketSize.To > 2048 {
-			return nil, errors.New("gecko: invalid min/max packet size")
-		}
-		return &salamander.GeckoConfig{
-			Password:      c.Password,
-			MinPacketSize: c.PacketSize.From,
-			MaxPacketSize: c.PacketSize.To,
-		}, nil
-	}
-	return &salamander.Config{
-		Password: c.Password,
-	}, nil
-}
-
-type Sudoku struct {
-	Password string `json:"password"`
-	ASCII    string `json:"ascii"`
-
-	CustomTable       string   `json:"customTable"`
-	LegacyCustomTable string   `json:"custom_table"`
-	CustomTables      []string `json:"customTables"`
-	LegacyCustomSets  []string `json:"custom_tables"`
-
-	PaddingMin       uint32 `json:"paddingMin"`
-	LegacyPaddingMin uint32 `json:"padding_min"`
-	PaddingMax       uint32 `json:"paddingMax"`
-	LegacyPaddingMax uint32 `json:"padding_max"`
-}
-
-func (c *Sudoku) Build() (proto.Message, error) {
-	customTable := c.CustomTable
-	if customTable == "" {
-		customTable = c.LegacyCustomTable
-	}
-	customTables := c.CustomTables
-	if len(customTables) == 0 {
-		customTables = c.LegacyCustomSets
-	}
-
-	paddingMin := c.PaddingMin
-	if paddingMin == 0 {
-		paddingMin = c.LegacyPaddingMin
-	}
-	paddingMax := c.PaddingMax
-	if paddingMax == 0 {
-		paddingMax = c.LegacyPaddingMax
-	}
-
-	return &sudoku.Config{
-		Password:     c.Password,
-		Ascii:        c.ASCII,
-		CustomTable:  customTable,
-		CustomTables: customTables,
-		PaddingMin:   paddingMin,
-		PaddingMax:   paddingMax,
-	}, nil
-}
-
-type Xdns struct {
-	Domain json.RawMessage `json:"domain"`
-
-	Domains   []string `json:"domains"`
-	Resolvers []string `json:"resolvers"`
-}
-
-func (c *Xdns) Build() (proto.Message, error) {
-	if c.Domain != nil {
-		return nil, errors.PrintRemovedFeatureError("domain", "domains(server) & resolvers(client)")
-	}
-
-	if len(c.Domains) == 0 && len(c.Resolvers) == 0 {
-		return nil, errors.New("empty domains & empty resolvers")
-	}
-
-	for _, r := range c.Resolvers {
-		if !strings.Contains(r, "+udp://") {
-			return nil, errors.New("invalid resolver ", r)
-		}
-	}
-
-	return &xdns.Config{
-		Domains:   c.Domains,
-		Resolvers: c.Resolvers,
-	}, nil
-}
-
-type XMC struct {
-	Hostname string       `json:"hostname"`
-	Profiles []XMCProfile `json:"profiles"`
-	Password string       `json:"password"`
-}
-
-type XMCProfile struct {
-	// Resolve the UUID by username, then request the session profile with
-	// unsigned=false. Client and server must use the same signed profile.
-	Username          string `json:"username"`
-	UUID              string `json:"uuid"`
-	TexturesValue     string `json:"texturesValue"`
-	TexturesSignature string `json:"texturesSignature"`
-}
-
-var xmcUsernamePattern = regexp.MustCompile(`^[A-Za-z0-9_]{3,16}$`)
-
-func (c *XMCProfile) Build() (*xmc.Profile, error) {
-	if !xmcUsernamePattern.MatchString(c.Username) {
-		return nil, fmt.Errorf("invalid minecraft profile username: %q", c.Username)
-	}
-
-	profileUUID, err := googleuuid.Parse(c.UUID)
-	if err != nil {
-		return nil, fmt.Errorf("invalid minecraft profile UUID: %w", err)
-	}
-	if c.TexturesValue == "" || c.TexturesSignature == "" {
-		return nil, fmt.Errorf("incomplete minecraft profile textures")
-	}
-
-	return &xmc.Profile{
-		Username:          c.Username,
-		Uuid:              append([]byte(nil), profileUUID[:]...),
-		TexturesValue:     c.TexturesValue,
-		TexturesSignature: c.TexturesSignature,
-	}, nil
-}
-
-func (c *XMC) Build() (proto.Message, error) {
-	if len(c.Profiles) == 0 {
-		return nil, fmt.Errorf("minecraft profiles are required")
-	}
-
-	if c.Password == "" {
-		return nil, fmt.Errorf("empty password")
-	}
-
-	rsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)
-	if err != nil {
-		return nil, fmt.Errorf("derive minecraft rsa key: %w", err)
-	}
-
-	rsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("marshal minecraft rsa public key: %w", err)
-	}
-
-	profiles := make([]*xmc.Profile, 0, len(c.Profiles))
-	for i := range c.Profiles {
-		profile, err := c.Profiles[i].Build()
-		if err != nil {
-			return nil, fmt.Errorf("build minecraft profile %d: %w", i, err)
-		}
-		profiles = append(profiles, profile)
-	}
-
-	return &xmc.Config{
-		Password:      c.Password,
-		Hostname:      c.Hostname,
-		RsaPrivateKey: x509.MarshalPKCS1PrivateKey(rsaPrivateKey),
-		RsaPublicKey:  rsaPublicKey,
-		Profiles:      profiles,
-	}, nil
-}
-
-type Xicmp struct {
-	DGRAM bool     `json:"dgram"`
-	IPs   []string `json:"ips"`
-}
-
-func (c *Xicmp) Build() (proto.Message, error) {
-	for _, ip := range c.IPs {
-		if _, err := netip.ParseAddr(ip); err != nil {
-			return nil, err
-		}
-	}
-
-	config := &xicmp.Config{
-		DGRAM: c.DGRAM,
-		IPs:   c.IPs,
-	}
-
-	return config, nil
-}
-
-type Realm struct {
-	Url         string     `json:"url"`
-	StunServers []string   `json:"stunServers"`
-	TlsConfig   *TLSConfig `json:"tlsConfig"`
-}
-
-func (c *Realm) Build() (proto.Message, error) {
-	var scheme, host, port, token, id string
-	var stunServers []string
-	var tlsConfig *tls.Config
-
-	u, err := url.Parse(c.Url)
-	if err != nil {
-		return nil, err
-	}
-
-	switch u.Scheme {
-	case "realm":
-		scheme = "https"
-	case "realm+http":
-		scheme = "http"
-	default:
-		return nil, errors.New("invalid scheme", u.Scheme)
-	}
-
-	host = u.Hostname()
-	if host == "" {
-		return nil, errors.New("invalid host", host)
-	}
-
-	port = u.Port()
-	if port == "" {
-		port = "443"
-		if scheme == "http" {
-			port = "80"
-		}
-	}
-
-	token, err = url.PathUnescape(u.User.String())
-	if err != nil {
-		return nil, err
-	}
-	if token == "" {
-		return nil, errors.New("invalid token", token)
-	}
-
-	id, err = url.PathUnescape(strings.TrimPrefix(u.EscapedPath(), "/"))
-	if err != nil {
-		return nil, err
-	}
-	if id == "" {
-		return nil, errors.New("invalid id", id)
-	}
-
-	if len(c.StunServers) == 0 {
-		return nil, errors.New("empty stunServers")
-	}
-
-	for _, s := range c.StunServers {
-		_, _, err = net.SplitHostPort(s)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	stunServers = c.StunServers
-
-	if c.TlsConfig != nil {
-		tc, err := c.TlsConfig.Build()
-		if err != nil {
-			return nil, err
-		}
-		tlsConfig = tc.(*tls.Config)
-	}
-
-	return &realm.Config{
-		Scheme:      scheme,
-		Host:        host,
-		Port:        port,
-		Token:       token,
-		ID:          id,
-		StunServers: stunServers,
-		TlsConfig:   tlsConfig,
-	}, nil
-}
-
-type Mask struct {
-	Type     string           `json:"type"`
-	Settings *json.RawMessage `json:"settings"`
-}
-
-func (c *Mask) Build(tcp bool) (proto.Message, error) {
-	loader := udpmaskLoader
-	if tcp {
-		loader = tcpmaskLoader
-	}
-
-	settings := []byte("{}")
-	if c.Settings != nil {
-		settings = ([]byte)(*c.Settings)
-	}
-	rawConfig, err := loader.LoadWithID(settings, c.Type)
-	if err != nil {
-		return nil, err
-	}
-	ts, err := rawConfig.(Buildable).Build()
-	if err != nil {
-		return nil, err
-	}
-	return ts, nil
-}
-
-type QuicParamsConfig struct {
-	Congestion                  string    `json:"congestion"`
-	Debug                       bool      `json:"debug"`
-	BbrProfile                  string    `json:"bbrProfile"`
-	BrutalUp                    Bandwidth `json:"brutalUp"`
-	BrutalDown                  Bandwidth `json:"brutalDown"`
-	UdpHop                      UdpHop    `json:"udpHop"`
-	InitStreamReceiveWindow     uint64    `json:"initStreamReceiveWindow"`
-	MaxStreamReceiveWindow      uint64    `json:"maxStreamReceiveWindow"`
-	InitConnectionReceiveWindow uint64    `json:"initConnectionReceiveWindow"`
-	MaxConnectionReceiveWindow  uint64    `json:"maxConnectionReceiveWindow"`
-	MaxIdleTimeout              int64     `json:"maxIdleTimeout"`
-	KeepAlivePeriod             int64     `json:"keepAlivePeriod"`
-	DisablePathMTUDiscovery     bool      `json:"disablePathMTUDiscovery"`
-	MaxIncomingStreams          int64     `json:"maxIncomingStreams"`
-}
-
-type FinalMask struct {
-	Tcp        []Mask            `json:"tcp"`
-	Udp        []Mask            `json:"udp"`
-	QuicParams *QuicParamsConfig `json:"quicParams"`
-}

infra/conf/transport_finalmask_xmc_test.go

@@ -1,36 +0,0 @@
-package conf
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
-)
-
-func TestXMCBuildProfile(t *testing.T) {
-	built, err := (&XMC{
-		Password: "test-password",
-		Profiles: []XMCProfile{
-			{
-				Username:          "TestUser",
-				UUID:              "00112233-4455-6677-8899-aabbccddeeff",
-				TexturesValue:     "textures-value",
-				TexturesSignature: "textures-signature",
-			},
-		},
-	}).Build()
-	if err != nil {
-		t.Fatalf("build XMC config: %v", err)
-	}
-	config := built.(*xmc.Config)
-	if len(config.Profiles) != 1 || len(config.Profiles[0].Uuid) != 16 {
-		t.Fatalf("unexpected profiles: %+v", config.Profiles)
-	}
-}
-
-func TestXMCBuildRequiresProfile(t *testing.T) {
-	_, err := (&XMC{Password: "test-password"}).Build()
-	if err == nil || !strings.Contains(err.Error(), "profiles are required") {
-		t.Fatalf("expected required profiles error, got %v", err)
-	}
-}

infra/conf/transport_method.go

@@ -1,814 +0,0 @@
-package conf
-
-import (
-	"context"
-	"encoding/json"
-	"math/big"
-	"net/url"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/platform/filesystem"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/common/utils"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/grpc"
-	"github.com/xtls/xray-core/transport/internet/headers/http"
-	"github.com/xtls/xray-core/transport/internet/headers/noop"
-	"github.com/xtls/xray-core/transport/internet/httpupgrade"
-	"github.com/xtls/xray-core/transport/internet/hysteria"
-	"github.com/xtls/xray-core/transport/internet/kcp"
-	"github.com/xtls/xray-core/transport/internet/splithttp"
-	"github.com/xtls/xray-core/transport/internet/tcp"
-	"github.com/xtls/xray-core/transport/internet/websocket"
-	"google.golang.org/protobuf/proto"
-)
-
-type NoOpConnectionAuthenticator struct{}
-
-func (NoOpConnectionAuthenticator) Build() (proto.Message, error) {
-	return new(noop.ConnectionConfig), nil
-}
-
-type AuthenticatorRequest struct {
-	Version string                 `json:"version"`
-	Method  string                 `json:"method"`
-	Path    StringList             `json:"path"`
-	Headers map[string]*StringList `json:"headers"`
-}
-
-func sortMapKeys(m map[string]*StringList) []string {
-	var keys []string
-	for key := range m {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-	return keys
-}
-
-func (v *AuthenticatorRequest) Build() (*http.RequestConfig, error) {
-	config := &http.RequestConfig{
-		Uri: []string{"/"},
-		Header: []*http.Header{
-			{
-				Name:  "Host",
-				Value: []string{"www.baidu.com", "www.bing.com"},
-			},
-			{
-				Name:  "User-Agent",
-				Value: []string{utils.ChromeUA},
-			},
-			{
-				Name:  "Sec-CH-UA",
-				Value: []string{utils.ChromeUACH},
-			},
-			{
-				Name:  "Sec-CH-UA-Mobile",
-				Value: []string{"?0"},
-			},
-			{
-				Name:  "Sec-CH-UA-Platform",
-				Value: []string{"Windows"},
-			},
-			{
-				Name:  "Sec-Fetch-Mode",
-				Value: []string{"no-cors", "cors", "same-origin"},
-			},
-			{
-				Name:  "Sec-Fetch-Dest",
-				Value: []string{"empty"},
-			},
-			{
-				Name:  "Sec-Fetch-Site",
-				Value: []string{"none"},
-			},
-			{
-				Name:  "Sec-Fetch-User",
-				Value: []string{"?1"},
-			},
-			{
-				Name:  "Accept-Encoding",
-				Value: []string{"gzip, deflate"},
-			},
-			{
-				Name:  "Connection",
-				Value: []string{"keep-alive"},
-			},
-			{
-				Name:  "Pragma",
-				Value: []string{"no-cache"},
-			},
-		},
-	}
-
-	if len(v.Version) > 0 {
-		config.Version = &http.Version{Value: v.Version}
-	}
-
-	if len(v.Method) > 0 {
-		config.Method = &http.Method{Value: v.Method}
-	}
-
-	if len(v.Path) > 0 {
-		config.Uri = append([]string(nil), v.Path...)
-	}
-
-	if len(v.Headers) > 0 {
-		config.Header = make([]*http.Header, 0, len(v.Headers))
-		headerNames := sortMapKeys(v.Headers)
-		for _, key := range headerNames {
-			value := v.Headers[key]
-			if value == nil {
-				return nil, errors.New("empty HTTP header value: " + key).AtError()
-			}
-			config.Header = append(config.Header, &http.Header{
-				Name:  key,
-				Value: append([]string(nil), (*value)...),
-			})
-		}
-	}
-
-	return config, nil
-}
-
-type AuthenticatorResponse struct {
-	Version string                 `json:"version"`
-	Status  string                 `json:"status"`
-	Reason  string                 `json:"reason"`
-	Headers map[string]*StringList `json:"headers"`
-}
-
-func (v *AuthenticatorResponse) Build() (*http.ResponseConfig, error) {
-	config := &http.ResponseConfig{
-		Header: []*http.Header{
-			{
-				Name:  "Content-Type",
-				Value: []string{"application/octet-stream", "video/mpeg"},
-			},
-			{
-				Name:  "Transfer-Encoding",
-				Value: []string{"chunked"},
-			},
-			{
-				Name:  "Connection",
-				Value: []string{"keep-alive"},
-			},
-			{
-				Name:  "Pragma",
-				Value: []string{"no-cache"},
-			},
-			{
-				Name:  "Cache-Control",
-				Value: []string{"private", "no-cache"},
-			},
-		},
-	}
-
-	if len(v.Version) > 0 {
-		config.Version = &http.Version{Value: v.Version}
-	}
-
-	if len(v.Status) > 0 || len(v.Reason) > 0 {
-		config.Status = &http.Status{
-			Code:   "200",
-			Reason: "OK",
-		}
-		if len(v.Status) > 0 {
-			config.Status.Code = v.Status
-		}
-		if len(v.Reason) > 0 {
-			config.Status.Reason = v.Reason
-		}
-	}
-
-	if len(v.Headers) > 0 {
-		config.Header = make([]*http.Header, 0, len(v.Headers))
-		headerNames := sortMapKeys(v.Headers)
-		for _, key := range headerNames {
-			value := v.Headers[key]
-			if value == nil {
-				return nil, errors.New("empty HTTP header value: " + key).AtError()
-			}
-			config.Header = append(config.Header, &http.Header{
-				Name:  key,
-				Value: append([]string(nil), (*value)...),
-			})
-		}
-	}
-
-	return config, nil
-}
-
-type Authenticator struct {
-	Request  AuthenticatorRequest  `json:"request"`
-	Response AuthenticatorResponse `json:"response"`
-}
-
-func (v *Authenticator) Build() (proto.Message, error) {
-	config := new(http.Config)
-	requestConfig, err := v.Request.Build()
-	if err != nil {
-		return nil, err
-	}
-	config.Request = requestConfig
-
-	responseConfig, err := v.Response.Build()
-	if err != nil {
-		return nil, err
-	}
-	config.Response = responseConfig
-
-	return config, nil
-}
-
-var tcpHeaderLoader = NewJSONConfigLoader(ConfigCreatorCache{
-	"none": func() interface{} { return new(NoOpConnectionAuthenticator) },
-	"http": func() interface{} { return new(Authenticator) },
-}, "type", "")
-
-type TCPConfig struct {
-	HeaderConfig        json.RawMessage `json:"header"`
-	AcceptProxyProtocol bool            `json:"acceptProxyProtocol"`
-}
-
-// Build implements Buildable.
-func (c *TCPConfig) Build() (proto.Message, error) {
-	config := new(tcp.Config)
-	if len(c.HeaderConfig) > 0 {
-		headerConfig, _, err := tcpHeaderLoader.Load(c.HeaderConfig)
-		if err != nil {
-			return nil, errors.New("invalid TCP header config").Base(err).AtError()
-		}
-		ts, err := headerConfig.(Buildable).Build()
-		if err != nil {
-			return nil, errors.New("invalid TCP header config").Base(err).AtError()
-		}
-		config.HeaderSettings = serial.ToTypedMessage(ts)
-	}
-	if c.AcceptProxyProtocol {
-		config.AcceptProxyProtocol = c.AcceptProxyProtocol
-	}
-	return config, nil
-}
-
-type SplitHTTPConfig struct {
-	Host                 string            `json:"host"`
-	Path                 string            `json:"path"`
-	Mode                 string            `json:"mode"`
-	Headers              map[string]string `json:"headers"`
-	XPaddingBytes        Int32Range        `json:"xPaddingBytes"`
-	XPaddingObfsMode     bool              `json:"xPaddingObfsMode"`
-	XPaddingKey          string            `json:"xPaddingKey"`
-	XPaddingHeader       string            `json:"xPaddingHeader"`
-	XPaddingPlacement    string            `json:"xPaddingPlacement"`
-	XPaddingMethod       string            `json:"xPaddingMethod"`
-	UplinkHTTPMethod     string            `json:"uplinkHTTPMethod"`
-	SessionIDPlacement   string            `json:"sessionIDPlacement"`
-	SessionIDKey         string            `json:"sessionIDKey"`
-	SessionIDTable       string            `json:"sessionIDTable"`
-	SessionIDLength      Int32Range        `json:"sessionIDLength"`
-	SeqPlacement         string            `json:"seqPlacement"`
-	SeqKey               string            `json:"seqKey"`
-	UplinkDataPlacement  string            `json:"uplinkDataPlacement"`
-	UplinkDataKey        string            `json:"uplinkDataKey"`
-	UplinkChunkSize      Int32Range        `json:"uplinkChunkSize"`
-	NoGRPCHeader         bool              `json:"noGRPCHeader"`
-	NoSSEHeader          bool              `json:"noSSEHeader"`
-	ScMaxEachPostBytes   Int32Range        `json:"scMaxEachPostBytes"`
-	ScMinPostsIntervalMs Int32Range        `json:"scMinPostsIntervalMs"`
-	ScMaxBufferedPosts   int64             `json:"scMaxBufferedPosts"`
-	ScStreamUpServerSecs Int32Range        `json:"scStreamUpServerSecs"`
-	ServerMaxHeaderBytes int32             `json:"serverMaxHeaderBytes"`
-	Xmux                 XmuxConfig        `json:"xmux"`
-	DownloadSettings     *StreamConfig     `json:"downloadSettings"`
-	Extra                json.RawMessage   `json:"extra"`
-}
-
-type XmuxConfig struct {
-	MaxConcurrency   Int32Range `json:"maxConcurrency"`
-	MaxConnections   Int32Range `json:"maxConnections"`
-	CMaxReuseTimes   Int32Range `json:"cMaxReuseTimes"`
-	HMaxRequestTimes Int32Range `json:"hMaxRequestTimes"`
-	HMaxReusableSecs Int32Range `json:"hMaxReusableSecs"`
-	HKeepAlivePeriod int64      `json:"hKeepAlivePeriod"`
-}
-
-func newRangeConfig(input Int32Range) *splithttp.RangeConfig {
-	return &splithttp.RangeConfig{
-		From: input.From,
-		To:   input.To,
-	}
-}
-
-// Build implements Buildable.
-func (c *SplitHTTPConfig) Build() (proto.Message, error) {
-	if c.Extra != nil {
-		var extra SplitHTTPConfig
-		if err := json.Unmarshal(c.Extra, &extra); err != nil {
-			return nil, errors.New(`Failed to unmarshal "extra".`).Base(err)
-		}
-		extra.Host = c.Host
-		extra.Path = c.Path
-		extra.Mode = c.Mode
-		c = &extra
-	}
-
-	switch c.Mode {
-	case "":
-		c.Mode = "auto"
-	case "auto", "packet-up", "stream-up", "stream-one":
-	default:
-		return nil, errors.New("unsupported mode: " + c.Mode)
-	}
-
-	// Priority (client): host > serverName > address
-	for k := range c.Headers {
-		if strings.ToLower(k) == "host" {
-			return nil, errors.New(`"headers" can't contain "host"`)
-		}
-	}
-
-	if c.XPaddingBytes != (Int32Range{}) && (c.XPaddingBytes.From <= 0 || c.XPaddingBytes.To <= 0) {
-		return nil, errors.New("xPaddingBytes cannot be disabled")
-	}
-
-	if c.XPaddingKey == "" {
-		c.XPaddingKey = "x_padding"
-	}
-
-	if c.XPaddingHeader == "" {
-		c.XPaddingHeader = "X-Padding"
-	}
-
-	switch c.XPaddingPlacement {
-	case "":
-		c.XPaddingPlacement = "queryInHeader"
-	case "cookie", "header", "query", "queryInHeader":
-	default:
-		return nil, errors.New("unsupported padding placement: " + c.XPaddingPlacement)
-	}
-
-	switch c.XPaddingMethod {
-	case "":
-		c.XPaddingMethod = "repeat-x"
-	case "repeat-x", "tokenish":
-	default:
-		return nil, errors.New("unsupported padding method: " + c.XPaddingMethod)
-	}
-
-	switch c.UplinkDataPlacement {
-	case "":
-		c.UplinkDataPlacement = splithttp.PlacementAuto
-	case splithttp.PlacementAuto, splithttp.PlacementBody:
-	case splithttp.PlacementCookie, splithttp.PlacementHeader:
-		if c.Mode != "packet-up" {
-			return nil, errors.New("UplinkDataPlacement can be " + c.UplinkDataPlacement + " only in packet-up mode")
-		}
-	default:
-		return nil, errors.New("unsupported uplink data placement: " + c.UplinkDataPlacement)
-	}
-
-	if c.UplinkHTTPMethod == "" {
-		c.UplinkHTTPMethod = "POST"
-	}
-	c.UplinkHTTPMethod = strings.ToUpper(c.UplinkHTTPMethod)
-
-	if c.UplinkHTTPMethod == "GET" && c.Mode != "packet-up" {
-		return nil, errors.New("uplinkHTTPMethod can be GET only in packet-up mode")
-	}
-
-	switch c.SessionIDPlacement {
-	case "":
-		c.SessionIDPlacement = "path"
-	case "path", "cookie", "header", "query":
-	default:
-		return nil, errors.New("unsupported session placement: " + c.SessionIDPlacement)
-	}
-
-	switch c.SeqPlacement {
-	case "":
-		c.SeqPlacement = "path"
-	case "path", "cookie", "header", "query":
-	default:
-		return nil, errors.New("unsupported seq placement: " + c.SeqPlacement)
-	}
-
-	if c.SessionIDPlacement != "path" && c.SessionIDKey == "" {
-		switch c.SessionIDPlacement {
-		case "cookie", "query":
-			c.SessionIDKey = "x_session"
-		case "header":
-			c.SessionIDKey = "X-Session"
-		}
-	}
-
-	if c.SessionIDTable != "" {
-		if predefined, ok := splithttp.PredefinedTable[c.SessionIDTable]; ok {
-			c.SessionIDTable = predefined
-		}
-		room := roomSize(len(c.SessionIDTable), c.SessionIDLength.From, c.SessionIDLength.To)
-		// 2.1B possiblities should be enough
-		if room.Cmp(big.NewInt(2<<30)) < 0 {
-			return nil, errors.New("sessionIDTable or sessionIDLength is too small")
-		}
-		if c.SessionIDLength.From <= 0 {
-			return nil, errors.New("sessionIDLength.from must be greater than 0")
-		}
-		for i := 0; i < len(c.SessionIDTable); i++ {
-			if c.SessionIDTable[i] >= 0x80 {
-				return nil, errors.New("sessionIDTable must contain only ASCII characters")
-			}
-		}
-	}
-
-	if c.SeqPlacement != "path" && c.SeqKey == "" {
-		switch c.SeqPlacement {
-		case "cookie", "query":
-			c.SeqKey = "x_seq"
-		case "header":
-			c.SeqKey = "X-Seq"
-		}
-	}
-
-	if c.UplinkDataPlacement != splithttp.PlacementBody && c.UplinkDataKey == "" {
-		switch c.UplinkDataPlacement {
-		case splithttp.PlacementCookie:
-			c.UplinkDataKey = "x_data"
-		case splithttp.PlacementAuto, splithttp.PlacementHeader:
-			c.UplinkDataKey = "X-Data"
-		}
-	}
-
-	if c.ServerMaxHeaderBytes < 0 {
-		return nil, errors.New("invalid negative value of maxHeaderBytes")
-	}
-
-	if c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {
-		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
-	}
-	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConnections.From = 3
-		c.Xmux.MaxConnections.To = 3
-		c.Xmux.HMaxRequestTimes.From = 600
-		c.Xmux.HMaxRequestTimes.To = 900
-		c.Xmux.HMaxReusableSecs.From = 1800
-		c.Xmux.HMaxReusableSecs.To = 3000
-	}
-
-	config := &splithttp.Config{
-		Host:                 c.Host,
-		Path:                 c.Path,
-		Mode:                 c.Mode,
-		Headers:              c.Headers,
-		XPaddingBytes:        newRangeConfig(c.XPaddingBytes),
-		XPaddingObfsMode:     c.XPaddingObfsMode,
-		XPaddingKey:          c.XPaddingKey,
-		XPaddingHeader:       c.XPaddingHeader,
-		XPaddingPlacement:    c.XPaddingPlacement,
-		XPaddingMethod:       c.XPaddingMethod,
-		UplinkHTTPMethod:     c.UplinkHTTPMethod,
-		SessionIDPlacement:   c.SessionIDPlacement,
-		SeqPlacement:         c.SeqPlacement,
-		SessionIDKey:         c.SessionIDKey,
-		SeqKey:               c.SeqKey,
-		UplinkDataPlacement:  c.UplinkDataPlacement,
-		UplinkDataKey:        c.UplinkDataKey,
-		UplinkChunkSize:      newRangeConfig(c.UplinkChunkSize),
-		NoGRPCHeader:         c.NoGRPCHeader,
-		NoSSEHeader:          c.NoSSEHeader,
-		ScMaxEachPostBytes:   newRangeConfig(c.ScMaxEachPostBytes),
-		ScMinPostsIntervalMs: newRangeConfig(c.ScMinPostsIntervalMs),
-		ScMaxBufferedPosts:   c.ScMaxBufferedPosts,
-		ScStreamUpServerSecs: newRangeConfig(c.ScStreamUpServerSecs),
-		ServerMaxHeaderBytes: c.ServerMaxHeaderBytes,
-		SessionIDTable:       c.SessionIDTable,
-		SessionIDLength:      newRangeConfig(c.SessionIDLength),
-		Xmux: &splithttp.XmuxConfig{
-			MaxConcurrency:   newRangeConfig(c.Xmux.MaxConcurrency),
-			MaxConnections:   newRangeConfig(c.Xmux.MaxConnections),
-			CMaxReuseTimes:   newRangeConfig(c.Xmux.CMaxReuseTimes),
-			HMaxRequestTimes: newRangeConfig(c.Xmux.HMaxRequestTimes),
-			HMaxReusableSecs: newRangeConfig(c.Xmux.HMaxReusableSecs),
-			HKeepAlivePeriod: c.Xmux.HKeepAlivePeriod,
-		},
-	}
-
-	if c.DownloadSettings != nil {
-		if c.Mode == "stream-one" {
-			return nil, errors.New(`Can not use "downloadSettings" in "stream-one" mode.`)
-		}
-		var err error
-		if config.DownloadSettings, err = c.DownloadSettings.Build(); err != nil {
-			return nil, errors.New(`Failed to build "downloadSettings".`).Base(err)
-		}
-	}
-
-	return config, nil
-}
-
-func roomSize(tableSize int, min, max int32) *big.Int {
-	base := big.NewInt(int64(tableSize))
-	sum := new(big.Int)
-	term := new(big.Int)
-	for k := min; k <= max; k++ {
-		term.Exp(base, big.NewInt(int64(k)), nil)
-		sum.Add(sum, term)
-	}
-	return sum
-}
-
-type KCPConfig struct {
-	Mtu              *uint32 `json:"mtu"`
-	Tti              *uint32 `json:"tti"`
-	UpCap            *uint32 `json:"uplinkCapacity"`
-	DownCap          *uint32 `json:"downlinkCapacity"`
-	CwndMultiplier   *uint32 `json:"cwndMultiplier"`
-	MaxSendingWindow *uint32 `json:"maxSendingWindow"`
-
-	HeaderConfig json.RawMessage `json:"header"`
-	Seed         *string         `json:"seed"`
-}
-
-// Build implements Buildable.
-func (c *KCPConfig) Build() (proto.Message, error) {
-	if c.HeaderConfig != nil || c.Seed != nil {
-		return nil, errors.PrintRemovedFeatureError("mkcp header & seed", "finalmask/udp header-* & mkcp-original & mkcp-aes128gcm")
-	}
-
-	config := common.Must2(internet.CreateTransportConfig(kcp.ProtocolName)).(*kcp.Config)
-
-	if c.Mtu != nil {
-		config.Mtu = *c.Mtu
-	}
-	if c.Tti != nil {
-		config.Tti = *c.Tti
-	}
-	if c.UpCap != nil {
-		config.UplinkCapacity = *c.UpCap
-	}
-	if c.DownCap != nil {
-		config.DownlinkCapacity = *c.DownCap
-	}
-	if c.CwndMultiplier != nil {
-		config.CwndMultiplier = *c.CwndMultiplier
-	}
-	if c.MaxSendingWindow != nil {
-		config.MaxSendingWindow = *c.MaxSendingWindow
-	}
-
-	if config.Mtu < 21 {
-		return nil, errors.New("Mtu must be at least 21").AtError()
-	}
-	if config.Tti < 10 || config.Tti > 1000 {
-		return nil, errors.New("invalid mKCP TTI: ", c.Tti).AtError()
-	}
-	if config.CwndMultiplier < 1 {
-		return nil, errors.New("CwndMultiplier must be at least 1").AtError()
-	}
-	if config.GetSendingBufferSize() == 0 {
-		return nil, errors.New("MaxSendingWindow must be >= Mtu").AtError()
-	}
-
-	return config, nil
-}
-
-type GRPCConfig struct {
-	Authority           string `json:"authority"`
-	ServiceName         string `json:"serviceName"`
-	MultiMode           bool   `json:"multiMode"`
-	IdleTimeout         int32  `json:"idle_timeout"`
-	HealthCheckTimeout  int32  `json:"health_check_timeout"`
-	PermitWithoutStream bool   `json:"permit_without_stream"`
-	InitialWindowsSize  int32  `json:"initial_windows_size"`
-	UserAgent           string `json:"user_agent"`
-}
-
-func (g *GRPCConfig) Build() (proto.Message, error) {
-	if g.IdleTimeout <= 0 {
-		g.IdleTimeout = 0
-	}
-	if g.HealthCheckTimeout <= 0 {
-		g.HealthCheckTimeout = 0
-	}
-	if g.InitialWindowsSize < 0 {
-		// default window size of gRPC-go
-		g.InitialWindowsSize = 0
-	}
-
-	return &grpc.Config{
-		Authority:           g.Authority,
-		ServiceName:         g.ServiceName,
-		MultiMode:           g.MultiMode,
-		IdleTimeout:         g.IdleTimeout,
-		HealthCheckTimeout:  g.HealthCheckTimeout,
-		PermitWithoutStream: g.PermitWithoutStream,
-		InitialWindowsSize:  g.InitialWindowsSize,
-		UserAgent:           g.UserAgent,
-	}, nil
-}
-
-type WebSocketConfig struct {
-	Host                string            `json:"host"`
-	Path                string            `json:"path"`
-	Headers             map[string]string `json:"headers"`
-	AcceptProxyProtocol bool              `json:"acceptProxyProtocol"`
-	HeartbeatPeriod     uint32            `json:"heartbeatPeriod"`
-}
-
-// Build implements Buildable.
-func (c *WebSocketConfig) Build() (proto.Message, error) {
-	path := c.Path
-	var ed uint32
-	if u, err := url.Parse(path); err == nil {
-		if q := u.Query(); q.Get("ed") != "" {
-			Ed, _ := strconv.Atoi(q.Get("ed"))
-			ed = uint32(Ed)
-			q.Del("ed")
-			u.RawQuery = q.Encode()
-			path = u.String()
-		}
-	}
-	// Priority (client): host > serverName > address
-	for k, v := range c.Headers {
-		if strings.ToLower(k) == "host" {
-			errors.PrintDeprecatedFeatureWarning(`"host" in "headers"`, `independent "host"`)
-			if c.Host == "" {
-				c.Host = v
-			}
-			delete(c.Headers, k)
-		}
-	}
-	config := &websocket.Config{
-		Path:                path,
-		Host:                c.Host,
-		Header:              c.Headers,
-		AcceptProxyProtocol: c.AcceptProxyProtocol,
-		Ed:                  ed,
-		HeartbeatPeriod:     c.HeartbeatPeriod,
-	}
-	return config, nil
-}
-
-type HttpUpgradeConfig struct {
-	Host                string            `json:"host"`
-	Path                string            `json:"path"`
-	Headers             map[string]string `json:"headers"`
-	AcceptProxyProtocol bool              `json:"acceptProxyProtocol"`
-}
-
-// Build implements Buildable.
-func (c *HttpUpgradeConfig) Build() (proto.Message, error) {
-	path := c.Path
-	var ed uint32
-	if u, err := url.Parse(path); err == nil {
-		if q := u.Query(); q.Get("ed") != "" {
-			Ed, _ := strconv.Atoi(q.Get("ed"))
-			ed = uint32(Ed)
-			q.Del("ed")
-			u.RawQuery = q.Encode()
-			path = u.String()
-		}
-	}
-	// Priority (client): host > serverName > address
-	for k := range c.Headers {
-		if strings.ToLower(k) == "host" {
-			return nil, errors.New(`"headers" can't contain "host"`)
-		}
-	}
-	config := &httpupgrade.Config{
-		Path:                path,
-		Host:                c.Host,
-		Header:              c.Headers,
-		AcceptProxyProtocol: c.AcceptProxyProtocol,
-		Ed:                  ed,
-	}
-	return config, nil
-}
-
-const (
-	Byte     = 1
-	Kilobyte = 1024 * Byte
-	Megabyte = 1024 * Kilobyte
-	Gigabyte = 1024 * Megabyte
-	Terabyte = 1024 * Gigabyte
-)
-
-type Bandwidth string
-
-func (b Bandwidth) Bps() (uint64, error) {
-	s := strings.TrimSpace(strings.ToLower(string(b)))
-	if s == "" {
-		return 0, nil
-	}
-
-	idx := len(s)
-	for i, c := range s {
-		if (c < '0' || c > '9') && c != '.' {
-			idx = i
-			break
-		}
-	}
-
-	numStr := s[:idx]
-	unit := strings.TrimSpace(s[idx:])
-
-	val, err := strconv.ParseFloat(numStr, 64)
-	if err != nil {
-		return 0, err
-	}
-
-	mul := uint64(1)
-	switch unit {
-	case "", "b", "bps":
-		mul = Byte
-	case "k", "kb", "kbps":
-		mul = Kilobyte
-	case "m", "mb", "mbps":
-		mul = Megabyte
-	case "g", "gb", "gbps":
-		mul = Gigabyte
-	case "t", "tb", "tbps":
-		mul = Terabyte
-	default:
-		return 0, errors.New("unsupported unit: " + unit)
-	}
-
-	return uint64(val*float64(mul)) / 8, nil
-}
-
-type UdpHop struct {
-	PortList PortList   `json:"ports"`
-	Interval Int32Range `json:"interval"`
-}
-
-type Masquerade struct {
-	Type string `json:"type"`
-
-	Dir string `json:"dir"`
-
-	Url         string `json:"url"`
-	RewriteHost bool   `json:"rewriteHost"`
-	Insecure    bool   `json:"insecure"`
-
-	Content    string            `json:"content"`
-	Headers    map[string]string `json:"headers"`
-	StatusCode int32             `json:"statusCode"`
-}
-
-type HysteriaConfig struct {
-	Version int32  `json:"version"`
-	Auth    string `json:"auth"`
-
-	Congestion *string    `json:"congestion"`
-	Up         *Bandwidth `json:"up"`
-	Down       *Bandwidth `json:"down"`
-	UdpHop     *UdpHop    `json:"udphop"`
-
-	UdpIdleTimeout int64      `json:"udpIdleTimeout"`
-	Masquerade     Masquerade `json:"masquerade"`
-}
-
-func (c *HysteriaConfig) Build() (proto.Message, error) {
-	if c.Version != 2 {
-		return nil, errors.New("version != 2")
-	}
-
-	if c.Congestion != nil || c.Up != nil || c.Down != nil || c.UdpHop != nil {
-		errors.LogWarning(context.Background(), "congestion & up & down & udphop move to finalmask/quicParams")
-	}
-
-	if c.UdpIdleTimeout != 0 && (c.UdpIdleTimeout < 2 || c.UdpIdleTimeout > 600) {
-		return nil, errors.New("UdpIdleTimeout must be between 2 and 600")
-	}
-
-	config := &hysteria.Config{}
-	config.Auth = c.Auth
-	config.UdpIdleTimeout = c.UdpIdleTimeout
-	config.MasqType = c.Masquerade.Type
-	config.MasqFile = c.Masquerade.Dir
-	config.MasqUrl = c.Masquerade.Url
-	config.MasqUrlRewriteHost = c.Masquerade.RewriteHost
-	config.MasqUrlInsecure = c.Masquerade.Insecure
-	config.MasqString = c.Masquerade.Content
-	config.MasqStringHeaders = c.Masquerade.Headers
-	config.MasqStringStatusCode = c.Masquerade.StatusCode
-
-	if config.UdpIdleTimeout == 0 {
-		config.UdpIdleTimeout = 60
-	}
-
-	return config, nil
-}
-
-func readFileOrString(f string, s []string) ([]byte, error) {
-	if len(f) > 0 {
-		return filesystem.ReadCert(f)
-	}
-	if len(s) > 0 {
-		return []byte(strings.Join(s, "\n")), nil
-	}
-	return nil, errors.New("both file and bytes are empty.")
-}

infra/conf/transport_security.go

@@ -1,408 +0,0 @@
-package conf
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"net/url"
-	"runtime"
-	"strconv"
-	"strings"
-	"syscall"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet/reality"
-	"github.com/xtls/xray-core/transport/internet/tls"
-	"google.golang.org/protobuf/proto"
-)
-
-type LimitFallback struct {
-	AfterBytes       uint64
-	BytesPerSec      uint64
-	BurstBytesPerSec uint64
-}
-
-type REALITYConfig struct {
-	MasterKeyLog string          `json:"masterKeyLog"`
-	Show         bool            `json:"show"`
-	Target       json.RawMessage `json:"target"`
-	Dest         json.RawMessage `json:"dest"`
-	Type         string          `json:"type"`
-	Xver         uint64          `json:"xver"`
-	ServerNames  []string        `json:"serverNames"`
-	PrivateKey   string          `json:"privateKey"`
-	MinClientVer string          `json:"minClientVer"`
-	MaxClientVer string          `json:"maxClientVer"`
-	MaxTimeDiff  uint64          `json:"maxTimeDiff"`
-	ShortIds     []string        `json:"shortIds"`
-	Mldsa65Seed  string          `json:"mldsa65Seed"`
-
-	LimitFallbackUpload   LimitFallback `json:"limitFallbackUpload"`
-	LimitFallbackDownload LimitFallback `json:"limitFallbackDownload"`
-
-	Fingerprint   string `json:"fingerprint"`
-	ServerName    string `json:"serverName"`
-	Password      string `json:"password"`
-	PublicKey     string `json:"publicKey"`
-	ShortId       string `json:"shortId"`
-	Mldsa65Verify string `json:"mldsa65Verify"`
-	SpiderX       string `json:"spiderX"`
-}
-
-func (c *REALITYConfig) Build() (proto.Message, error) {
-	config := new(reality.Config)
-	config.MasterKeyLog = c.MasterKeyLog
-	config.Show = c.Show
-	var err error
-	if c.Target != nil {
-		c.Dest = c.Target
-	}
-	if c.Dest != nil {
-		var i uint16
-		var s string
-		if err = json.Unmarshal(c.Dest, &i); err == nil {
-			s = strconv.Itoa(int(i))
-		} else {
-			_ = json.Unmarshal(c.Dest, &s)
-		}
-		if c.Type == "" && s != "" {
-			switch s[0] {
-			case '@', '/':
-				c.Type = "unix"
-				if s[0] == '@' && len(s) > 1 && s[1] == '@' && (runtime.GOOS == "linux" || runtime.GOOS == "android") {
-					fullAddr := make([]byte, len(syscall.RawSockaddrUnix{}.Path)) // may need padding to work with haproxy
-					copy(fullAddr, s[1:])
-					s = string(fullAddr)
-				}
-			default:
-				if _, err = strconv.Atoi(s); err == nil {
-					s = "localhost:" + s
-				}
-				if _, _, err = net.SplitHostPort(s); err == nil {
-					c.Type = "tcp"
-				}
-			}
-		}
-		if c.Type == "" {
-			return nil, errors.New(`please fill in a valid value for "target"`)
-		}
-		if c.Xver > 2 {
-			return nil, errors.New(`invalid PROXY protocol version, "xver" only accepts 0, 1, 2`)
-		}
-		if len(c.ServerNames) == 0 {
-			return nil, errors.New(`empty "serverNames"`)
-		}
-		if c.PrivateKey == "" {
-			return nil, errors.New(`empty "privateKey"`)
-		}
-		if config.PrivateKey, err = base64.RawURLEncoding.DecodeString(c.PrivateKey); err != nil || len(config.PrivateKey) != 32 {
-			return nil, errors.New(`invalid "privateKey": `, c.PrivateKey)
-		}
-		if c.MinClientVer != "" {
-			config.MinClientVer = make([]byte, 3)
-			var u uint64
-			for i, s := range strings.Split(c.MinClientVer, ".") {
-				if i == 3 {
-					return nil, errors.New(`invalid "minClientVer": `, c.MinClientVer)
-				}
-				if u, err = strconv.ParseUint(s, 10, 8); err != nil {
-					return nil, errors.New(`"minClientVer[`, i, `]" should be less than 256`)
-				} else {
-					config.MinClientVer[i] = byte(u)
-				}
-			}
-			errors.LogWarning(context.Background(), `REALITY: Changing "minClientVer" will increase the likelihood of your server's IP being blocked by the GFW`)
-		} else {
-			config.MinClientVer = []byte{26, 3, 27} // change it at your own risk: https://github.com/XTLS/Xray-core/commit/af7eb68028732a8ee3c0e5d6ab2b8a657bb2e770
-			errors.LogWarning(context.Background(), `REALITY: The default minimal client version is Xray-core v26.3.27, other clients may be refused to connect`)
-		}
-		if c.MaxClientVer != "" {
-			config.MaxClientVer = make([]byte, 3)
-			var u uint64
-			for i, s := range strings.Split(c.MaxClientVer, ".") {
-				if i == 3 {
-					return nil, errors.New(`invalid "maxClientVer": `, c.MaxClientVer)
-				}
-				if u, err = strconv.ParseUint(s, 10, 8); err != nil {
-					return nil, errors.New(`"maxClientVer[`, i, `]" should be less than 256`)
-				} else {
-					config.MaxClientVer[i] = byte(u)
-				}
-			}
-		}
-		if len(c.ShortIds) == 0 {
-			return nil, errors.New(`empty "shortIds"`)
-		}
-		config.ShortIds = make([][]byte, len(c.ShortIds))
-		for i, s := range c.ShortIds {
-			if len(s) > 16 {
-				return nil, errors.New(`too long "shortIds[`, i, `]": `, s)
-			}
-			config.ShortIds[i] = make([]byte, 8)
-			if _, err = hex.Decode(config.ShortIds[i], []byte(s)); err != nil {
-				return nil, errors.New(`invalid "shortIds[`, i, `]": `, s)
-			}
-		}
-		config.Dest = s
-		config.Type = c.Type
-		config.Xver = c.Xver
-		config.ServerNames = c.ServerNames
-		config.MaxTimeDiff = c.MaxTimeDiff
-
-		if c.Mldsa65Seed != "" {
-			if c.Mldsa65Seed == c.PrivateKey {
-				return nil, errors.New(`"mldsa65Seed" and "privateKey" can not be the same value: `, c.Mldsa65Seed)
-			}
-			if config.Mldsa65Seed, err = base64.RawURLEncoding.DecodeString(c.Mldsa65Seed); err != nil || len(config.Mldsa65Seed) != 32 {
-				return nil, errors.New(`invalid "mldsa65Seed": `, c.Mldsa65Seed)
-			}
-		}
-
-		for _, sn := range config.ServerNames {
-			sn = strings.ToLower(sn)
-			if strings.HasSuffix(sn, ".ru") || strings.HasSuffix(sn, ".ir") || strings.HasSuffix(sn, ".cn") ||
-				strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") || strings.Contains(sn, "microsoft") {
-				errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target will increase the likelihood of your server's IP being blocked by the GFW`)
-			}
-		}
-
-		config.LimitFallbackUpload = new(reality.LimitFallback)
-		config.LimitFallbackUpload.AfterBytes = c.LimitFallbackUpload.AfterBytes
-		config.LimitFallbackUpload.BytesPerSec = c.LimitFallbackUpload.BytesPerSec
-		config.LimitFallbackUpload.BurstBytesPerSec = c.LimitFallbackUpload.BurstBytesPerSec
-		config.LimitFallbackDownload = new(reality.LimitFallback)
-		config.LimitFallbackDownload.AfterBytes = c.LimitFallbackDownload.AfterBytes
-		config.LimitFallbackDownload.BytesPerSec = c.LimitFallbackDownload.BytesPerSec
-		config.LimitFallbackDownload.BurstBytesPerSec = c.LimitFallbackDownload.BurstBytesPerSec
-	} else {
-		config.Fingerprint = strings.ToLower(c.Fingerprint)
-		if config.Fingerprint == "unsafe" || config.Fingerprint == "hellogolang" {
-			return nil, errors.New(`invalid "fingerprint": `, config.Fingerprint)
-		}
-		if tls.GetFingerprint(config.Fingerprint) == nil {
-			return nil, errors.New(`unknown "fingerprint": `, config.Fingerprint)
-		}
-		if len(c.ServerNames) != 0 {
-			return nil, errors.New(`non-empty "serverNames", please use "serverName" instead`)
-		}
-		if c.Password != "" {
-			c.PublicKey = c.Password
-		}
-		if c.PublicKey == "" {
-			return nil, errors.New(`empty "password"`)
-		}
-		if config.PublicKey, err = base64.RawURLEncoding.DecodeString(c.PublicKey); err != nil || len(config.PublicKey) != 32 {
-			return nil, errors.New(`invalid "password": `, c.PublicKey)
-		}
-		if len(c.ShortIds) != 0 {
-			return nil, errors.New(`non-empty "shortIds", please use "shortId" instead`)
-		}
-		if len(c.ShortId) > 16 {
-			return nil, errors.New(`too long "shortId": `, c.ShortId)
-		}
-		config.ShortId = make([]byte, 8)
-		if _, err = hex.Decode(config.ShortId, []byte(c.ShortId)); err != nil {
-			return nil, errors.New(`invalid "shortId": `, c.ShortId)
-		}
-		if c.Mldsa65Verify != "" {
-			if config.Mldsa65Verify, err = base64.RawURLEncoding.DecodeString(c.Mldsa65Verify); err != nil || len(config.Mldsa65Verify) != 1952 {
-				return nil, errors.New(`invalid "mldsa65Verify": `, c.Mldsa65Verify)
-			}
-		}
-		if c.SpiderX == "" {
-			c.SpiderX = "/"
-		}
-		if c.SpiderX[0] != '/' {
-			return nil, errors.New(`invalid "spiderX": `, c.SpiderX)
-		}
-		config.SpiderY = make([]int64, 10)
-		u, _ := url.Parse(c.SpiderX)
-		q := u.Query()
-		parse := func(param string, index int) {
-			if q.Get(param) != "" {
-				s := strings.Split(q.Get(param), "-")
-				if len(s) == 1 {
-					config.SpiderY[index], _ = strconv.ParseInt(s[0], 10, 64)
-					config.SpiderY[index+1], _ = strconv.ParseInt(s[0], 10, 64)
-				} else {
-					config.SpiderY[index], _ = strconv.ParseInt(s[0], 10, 64)
-					config.SpiderY[index+1], _ = strconv.ParseInt(s[1], 10, 64)
-				}
-			}
-			q.Del(param)
-		}
-		parse("p", 0) // padding
-		parse("c", 2) // concurrency
-		parse("t", 4) // times
-		parse("i", 6) // interval
-		parse("r", 8) // return
-		u.RawQuery = q.Encode()
-		config.SpiderX = u.String()
-		config.ServerName = c.ServerName
-	}
-	return config, nil
-}
-
-type TLSCertConfig struct {
-	CertFile       string   `json:"certificateFile"`
-	CertStr        []string `json:"certificate"`
-	KeyFile        string   `json:"keyFile"`
-	KeyStr         []string `json:"key"`
-	Usage          string   `json:"usage"`
-	OcspStapling   uint64   `json:"ocspStapling"`
-	OneTimeLoading bool     `json:"oneTimeLoading"`
-	BuildChain     bool     `json:"buildChain"`
-}
-
-// Build implements Buildable.
-func (c *TLSCertConfig) Build() (*tls.Certificate, error) {
-	certificate := new(tls.Certificate)
-
-	cert, err := readFileOrString(c.CertFile, c.CertStr)
-	if err != nil {
-		return nil, errors.New("failed to parse certificate").Base(err)
-	}
-	certificate.Certificate = cert
-	certificate.CertificatePath = c.CertFile
-
-	if len(c.KeyFile) > 0 || len(c.KeyStr) > 0 {
-		key, err := readFileOrString(c.KeyFile, c.KeyStr)
-		if err != nil {
-			return nil, errors.New("failed to parse key").Base(err)
-		}
-		certificate.Key = key
-		certificate.KeyPath = c.KeyFile
-	}
-
-	switch strings.ToLower(c.Usage) {
-	case "encipherment":
-		certificate.Usage = tls.Certificate_ENCIPHERMENT
-	case "verify":
-		certificate.Usage = tls.Certificate_AUTHORITY_VERIFY
-	case "issue":
-		certificate.Usage = tls.Certificate_AUTHORITY_ISSUE
-	default:
-		certificate.Usage = tls.Certificate_ENCIPHERMENT
-	}
-	if certificate.KeyPath == "" && certificate.CertificatePath == "" {
-		certificate.OneTimeLoading = true
-	} else {
-		certificate.OneTimeLoading = c.OneTimeLoading
-	}
-	certificate.OcspStapling = c.OcspStapling
-	certificate.BuildChain = c.BuildChain
-
-	return certificate, nil
-}
-
-type TLSConfig struct {
-	AllowInsecure           bool             `json:"allowInsecure"`
-	Certs                   []*TLSCertConfig `json:"certificates"`
-	ServerName              string           `json:"serverName"`
-	ALPN                    *StringList      `json:"alpn"`
-	EnableSessionResumption bool             `json:"enableSessionResumption"`
-	DisableSystemRoot       bool             `json:"disableSystemRoot"`
-	MinVersion              string           `json:"minVersion"`
-	MaxVersion              string           `json:"maxVersion"`
-	CipherSuites            string           `json:"cipherSuites"`
-	Fingerprint             string           `json:"fingerprint"`
-	RejectUnknownSNI        bool             `json:"rejectUnknownSni"`
-	CurvePreferences        *StringList      `json:"curvePreferences"`
-	MasterKeyLog            string           `json:"masterKeyLog"`
-	PinnedPeerCertSha256    string           `json:"pinnedPeerCertSha256"`
-	VerifyPeerCertByName    string           `json:"verifyPeerCertByName"`
-	ECHServerKeys           string           `json:"echServerKeys"`
-	ECHConfigList           string           `json:"echConfigList"`
-	ECHSocketSettings       *SocketConfig    `json:"echSockopt"`
-}
-
-// Build implements Buildable.
-func (c *TLSConfig) Build() (proto.Message, error) {
-	config := new(tls.Config)
-	config.Certificate = make([]*tls.Certificate, len(c.Certs))
-	for idx, certConf := range c.Certs {
-		cert, err := certConf.Build()
-		if err != nil {
-			return nil, err
-		}
-		config.Certificate[idx] = cert
-	}
-	serverName := c.ServerName
-	if len(c.ServerName) > 0 {
-		config.ServerName = serverName
-	}
-	if c.ALPN != nil && len(*c.ALPN) > 0 {
-		config.NextProtocol = []string(*c.ALPN)
-	}
-	if len(config.NextProtocol) > 1 {
-		for _, p := range config.NextProtocol {
-			if tls.IsFromMitm(p) {
-				return nil, errors.New(`only one element is allowed in "alpn" when using "fromMitm" in it`)
-			}
-		}
-	}
-	if c.CurvePreferences != nil && len(*c.CurvePreferences) > 0 {
-		config.CurvePreferences = []string(*c.CurvePreferences)
-	}
-	config.EnableSessionResumption = c.EnableSessionResumption
-	config.DisableSystemRoot = c.DisableSystemRoot
-	config.MinVersion = c.MinVersion
-	config.MaxVersion = c.MaxVersion
-	config.CipherSuites = c.CipherSuites
-	config.Fingerprint = strings.ToLower(c.Fingerprint)
-	if config.Fingerprint != "unsafe" && tls.GetFingerprint(config.Fingerprint) == nil {
-		return nil, errors.New(`unknown "fingerprint": `, config.Fingerprint)
-	}
-	config.RejectUnknownSni = c.RejectUnknownSNI
-	config.MasterKeyLog = c.MasterKeyLog
-
-	if c.AllowInsecure {
-		return nil, errors.PrintRemovedFeatureError(`"allowInsecure"`, `"pinnedPeerCertSha256"(pcs) and "verifyPeerCertByName"(vcn)`)
-	}
-	if c.PinnedPeerCertSha256 != "" {
-		for v := range strings.SplitSeq(c.PinnedPeerCertSha256, ",") {
-			v = strings.TrimSpace(v)
-			if v == "" {
-				continue
-			}
-			// remove colons for OpenSSL format
-			hashValue, err := hex.DecodeString(strings.ReplaceAll(v, ":", ""))
-			if err != nil {
-				return nil, err
-			}
-			if len(hashValue) != 32 {
-				return nil, errors.New("incorrect pinnedPeerCertSha256 length: ", v)
-			}
-			config.PinnedPeerCertSha256 = append(config.PinnedPeerCertSha256, hashValue)
-		}
-	}
-	if c.VerifyPeerCertByName != "" {
-		for v := range strings.SplitSeq(c.VerifyPeerCertByName, ",") {
-			v = strings.TrimSpace(v)
-			if v == "" {
-				continue
-			}
-			config.VerifyPeerCertByName = append(config.VerifyPeerCertByName, v)
-		}
-	}
-
-	if c.ECHServerKeys != "" {
-		EchPrivateKey, err := base64.StdEncoding.DecodeString(c.ECHServerKeys)
-		if err != nil {
-			return nil, errors.New("invalid ECH Config", c.ECHServerKeys)
-		}
-		config.EchServerKeys = EchPrivateKey
-	}
-	config.EchConfigList = c.ECHConfigList
-	if c.ECHSocketSettings != nil {
-		ss, err := c.ECHSocketSettings.Build()
-		if err != nil {
-			return nil, errors.New("Failed to build ech sockopt.").Base(err)
-		}
-		config.EchSocketSettings = ss
-	}
-
-	return config, nil
-}

infra/conf/transport_sockopt.go

@@ -1,187 +0,0 @@
-package conf
-
-import (
-	"encoding/json"
-	"math"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/transport/internet"
-)
-
-type CustomSockoptConfig struct {
-	System  string `json:"system"`
-	Network string `json:"network"`
-	Level   string `json:"level"`
-	Opt     string `json:"opt"`
-	Value   string `json:"value"`
-	Type    string `json:"type"`
-}
-
-type HappyEyeballsConfig struct {
-	PrioritizeIPv6   bool   `json:"prioritizeIPv6"`
-	TryDelayMs       uint64 `json:"tryDelayMs"`
-	Interleave       uint32 `json:"interleave"`
-	MaxConcurrentTry uint32 `json:"maxConcurrentTry"`
-}
-
-func (h *HappyEyeballsConfig) UnmarshalJSON(data []byte) error {
-	innerHappyEyeballsConfig := struct {
-		PrioritizeIPv6   bool   `json:"prioritizeIPv6"`
-		TryDelayMs       uint64 `json:"tryDelayMs"`
-		Interleave       uint32 `json:"interleave"`
-		MaxConcurrentTry uint32 `json:"maxConcurrentTry"`
-	}{PrioritizeIPv6: false, Interleave: 1, TryDelayMs: 0, MaxConcurrentTry: 4}
-	if err := json.Unmarshal(data, &innerHappyEyeballsConfig); err != nil {
-		return err
-	}
-	h.PrioritizeIPv6 = innerHappyEyeballsConfig.PrioritizeIPv6
-	h.TryDelayMs = innerHappyEyeballsConfig.TryDelayMs
-	h.Interleave = innerHappyEyeballsConfig.Interleave
-	h.MaxConcurrentTry = innerHappyEyeballsConfig.MaxConcurrentTry
-	return nil
-}
-
-type SocketConfig struct {
-	Mark                  int32                  `json:"mark"`
-	TFO                   interface{}            `json:"tcpFastOpen"`
-	TProxy                string                 `json:"tproxy"`
-	AcceptProxyProtocol   bool                   `json:"acceptProxyProtocol"`
-	DomainStrategy        string                 `json:"domainStrategy"`
-	DialerProxy           string                 `json:"dialerProxy"`
-	TCPKeepAliveInterval  int32                  `json:"tcpKeepAliveInterval"`
-	TCPKeepAliveIdle      int32                  `json:"tcpKeepAliveIdle"`
-	TCPCongestion         string                 `json:"tcpCongestion"`
-	TCPWindowClamp        int32                  `json:"tcpWindowClamp"`
-	TCPMaxSeg             int32                  `json:"tcpMaxSeg"`
-	Penetrate             bool                   `json:"penetrate"`
-	TCPUserTimeout        int32                  `json:"tcpUserTimeout"`
-	V6only                bool                   `json:"v6only"`
-	Interface             string                 `json:"interface"`
-	TcpMptcp              bool                   `json:"tcpMptcp"`
-	CustomSockopt         []*CustomSockoptConfig `json:"customSockopt"`
-	AddressPortStrategy   string                 `json:"addressPortStrategy"`
-	HappyEyeballsSettings *HappyEyeballsConfig   `json:"happyEyeballs"`
-	TrustedXForwardedFor  []string               `json:"trustedXForwardedFor"`
-}
-
-// Build implements Buildable.
-func (c *SocketConfig) Build() (*internet.SocketConfig, error) {
-	tfo := int32(0) // don't invoke setsockopt() for TFO
-	if c.TFO != nil {
-		switch v := c.TFO.(type) {
-		case bool:
-			if v {
-				tfo = 256
-			} else {
-				tfo = -1 // TFO need to be disabled
-			}
-		case float64:
-			tfo = int32(math.Min(v, math.MaxInt32))
-		default:
-			return nil, errors.New("tcpFastOpen: only boolean and integer value is acceptable")
-		}
-	}
-	var tproxy internet.SocketConfig_TProxyMode
-	switch strings.ToLower(c.TProxy) {
-	case "tproxy":
-		tproxy = internet.SocketConfig_TProxy
-	case "redirect":
-		tproxy = internet.SocketConfig_Redirect
-	default:
-		tproxy = internet.SocketConfig_Off
-	}
-
-	dStrategy := internet.DomainStrategy_AS_IS
-	switch strings.ToLower(c.DomainStrategy) {
-	case "asis", "":
-		dStrategy = internet.DomainStrategy_AS_IS
-	case "useip":
-		dStrategy = internet.DomainStrategy_USE_IP
-	case "useipv4":
-		dStrategy = internet.DomainStrategy_USE_IP4
-	case "useipv6":
-		dStrategy = internet.DomainStrategy_USE_IP6
-	case "useipv4v6":
-		dStrategy = internet.DomainStrategy_USE_IP46
-	case "useipv6v4":
-		dStrategy = internet.DomainStrategy_USE_IP64
-	case "forceip":
-		dStrategy = internet.DomainStrategy_FORCE_IP
-	case "forceipv4":
-		dStrategy = internet.DomainStrategy_FORCE_IP4
-	case "forceipv6":
-		dStrategy = internet.DomainStrategy_FORCE_IP6
-	case "forceipv4v6":
-		dStrategy = internet.DomainStrategy_FORCE_IP46
-	case "forceipv6v4":
-		dStrategy = internet.DomainStrategy_FORCE_IP64
-	default:
-		return nil, errors.New("unsupported domain strategy: ", c.DomainStrategy)
-	}
-
-	var customSockopts []*internet.CustomSockopt
-
-	for _, copt := range c.CustomSockopt {
-		customSockopt := &internet.CustomSockopt{
-			System:  copt.System,
-			Network: copt.Network,
-			Level:   copt.Level,
-			Opt:     copt.Opt,
-			Value:   copt.Value,
-			Type:    copt.Type,
-		}
-		customSockopts = append(customSockopts, customSockopt)
-	}
-
-	addressPortStrategy := internet.AddressPortStrategy_None
-	switch strings.ToLower(c.AddressPortStrategy) {
-	case "none", "":
-		addressPortStrategy = internet.AddressPortStrategy_None
-	case "srvportonly":
-		addressPortStrategy = internet.AddressPortStrategy_SrvPortOnly
-	case "srvaddressonly":
-		addressPortStrategy = internet.AddressPortStrategy_SrvAddressOnly
-	case "srvportandaddress":
-		addressPortStrategy = internet.AddressPortStrategy_SrvPortAndAddress
-	case "txtportonly":
-		addressPortStrategy = internet.AddressPortStrategy_TxtPortOnly
-	case "txtaddressonly":
-		addressPortStrategy = internet.AddressPortStrategy_TxtAddressOnly
-	case "txtportandaddress":
-		addressPortStrategy = internet.AddressPortStrategy_TxtPortAndAddress
-	default:
-		return nil, errors.New("unsupported address and port strategy: ", c.AddressPortStrategy)
-	}
-
-	happyEyeballs := &internet.HappyEyeballsConfig{Interleave: 1, PrioritizeIpv6: false, TryDelayMs: 0, MaxConcurrentTry: 4}
-	if c.HappyEyeballsSettings != nil {
-		happyEyeballs.PrioritizeIpv6 = c.HappyEyeballsSettings.PrioritizeIPv6
-		happyEyeballs.Interleave = c.HappyEyeballsSettings.Interleave
-		happyEyeballs.TryDelayMs = c.HappyEyeballsSettings.TryDelayMs
-		happyEyeballs.MaxConcurrentTry = c.HappyEyeballsSettings.MaxConcurrentTry
-	}
-
-	return &internet.SocketConfig{
-		Mark:                 c.Mark,
-		Tfo:                  tfo,
-		Tproxy:               tproxy,
-		DomainStrategy:       dStrategy,
-		AcceptProxyProtocol:  c.AcceptProxyProtocol,
-		DialerProxy:          c.DialerProxy,
-		TcpKeepAliveInterval: c.TCPKeepAliveInterval,
-		TcpKeepAliveIdle:     c.TCPKeepAliveIdle,
-		TcpCongestion:        c.TCPCongestion,
-		TcpWindowClamp:       c.TCPWindowClamp,
-		TcpMaxSeg:            c.TCPMaxSeg,
-		Penetrate:            c.Penetrate,
-		TcpUserTimeout:       c.TCPUserTimeout,
-		V6Only:               c.V6only,
-		Interface:            c.Interface,
-		TcpMptcp:             c.TcpMptcp,
-		CustomSockopt:        customSockopts,
-		AddressPortStrategy:  addressPortStrategy,
-		HappyEyeballs:        happyEyeballs,
-		TrustedXForwardedFor: c.TrustedXForwardedFor,
-	}, nil
-}

infra/conf/tun.go

@@ -1,19 +1,12 @@
 package conf
 
 import (
-	"crypto/rand"
-	"fmt"
-	"math/big"
-	"net"
-	"strconv"
-
 	"github.com/xtls/xray-core/proxy/tun"
 	"google.golang.org/protobuf/proto"
 )
 
 type TunConfig struct {
 	Name                   string   `json:"name"`
-	Desc                   string   `json:"desc"`
 	MTU                    uint32   `json:"mtu"`
 	Gateway                []string `json:"gateway"`
 	DNS                    []string `json:"dns"`
@@ -25,7 +18,6 @@ type TunConfig struct {
 func (v *TunConfig) Build() (proto.Message, error) {
 	config := &tun.Config{
 		Name:                   v.Name,
-		Desc:                   v.Desc,
 		MTU:                    v.MTU,
 		Gateway:                v.Gateway,
 		DNS:                    v.DNS,
@@ -40,71 +32,10 @@ func (v *TunConfig) Build() (proto.Message, error) {
 	}
 
 	if config.Name == "" {
-		name, err := GetAvailableTunName()
-		if err != nil {
-			return nil, err
-		}
-		config.Name = name
-	}
-	if config.Desc == "" {
-		config.Desc = "Wintun"
+		config.Name = "xray0"
 	}
 	if config.MTU == 0 {
 		config.MTU = 1500
 	}
 	return config, nil
 }
-
-const (
-	tunNamePrefix = "utun"
-	minTunIndex   = 10
-	maxTunIndex   = 1024
-)
-
-func GetAvailableTunName() (string, error) {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		return "", fmt.Errorf("fail to get system interface information: %w", err)
-	}
-
-	usedNames := make(map[string]struct{}, len(interfaces))
-	for _, iface := range interfaces {
-		usedNames[iface.Name] = struct{}{}
-	}
-
-	startIndex, err := randomInt(minTunIndex, maxTunIndex)
-	if err != nil {
-		return "", fmt.Errorf("fail to generate valid tun name: %w", err)
-	}
-
-	rangeSize := maxTunIndex - minTunIndex + 1
-
-	for offset := 0; offset < rangeSize; offset++ {
-		index := minTunIndex + (startIndex-minTunIndex+offset)%rangeSize
-		name := tunNamePrefix + strconv.Itoa(index)
-
-		if _, exists := usedNames[name]; !exists {
-			return name, nil
-		}
-	}
-
-	return "", fmt.Errorf(
-		"no available TUN interface name in range %s%d-%s%d",
-		tunNamePrefix,
-		minTunIndex,
-		tunNamePrefix,
-		maxTunIndex,
-	)
-}
-
-func randomInt(min, max int) (int, error) {
-	value, err := rand.Int(
-		rand.Reader,
-		big.NewInt(int64(max-min+1)),
-	)
-	if err != nil {
-		return 0, err
-	}
-
-	return min + int(value.Int64()), nil
-}

infra/conf/vmess.go

@@ -31,6 +31,10 @@ func (a *VMessAccount) Build() *vmess.Account {
 		st = protocol.SecurityType_CHACHA20_POLY1305
 	case "auto":
 		st = protocol.SecurityType_AUTO
+	case "none":
+		st = protocol.SecurityType_NONE
+	case "zero":
+		st = protocol.SecurityType_ZERO
 	default:
 		st = protocol.SecurityType_AUTO
 	}

infra/conf/wireguard.go

@@ -7,9 +7,6 @@ import (
 	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/protocol"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/proxy/wireguard"
 	"google.golang.org/protobuf/proto"
 )
@@ -20,12 +17,9 @@ type WireGuardPeerConfig struct {
 	Endpoint     string   `json:"endpoint"`
 	KeepAlive    uint32   `json:"keepAlive"`
 	AllowedIPs   []string `json:"allowedIPs,omitempty"`
-
-	Level uint32 `json:"level"`
-	Email string `json:"email"`
 }
 
-func (c *WireGuardPeerConfig) Build() (*wireguard.PeerConfig, error) {
+func (c *WireGuardPeerConfig) Build() (proto.Message, error) {
 	var err error
 	config := new(wireguard.PeerConfig)
 
@@ -84,32 +78,14 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 		config.Endpoint = c.Address
 	}
 
-	if c.IsClient {
+	if c.Peers != nil {
 		config.Peers = make([]*wireguard.PeerConfig, len(c.Peers))
 		for i, p := range c.Peers {
 			msg, err := p.Build()
 			if err != nil {
 				return nil, err
 			}
-			config.Peers[i] = msg
-		}
-	} else {
-		config.Users = make([]*protocol.User, len(c.Peers))
-		processUser := func(idx int) error {
-			p := c.Peers[idx]
-			m, err := p.Build()
-			if err != nil {
-				return err
-			}
-			config.Users[idx] = &protocol.User{
-				Email:   p.Email,
-				Level:   p.Level,
-				Account: serial.ToTypedMessage(m),
-			}
-			return nil
-		}
-		if err := task.ParallelForN(len(c.Peers), processUser); err != nil {
-			return nil, err
+			config.Peers[i] = msg.(*wireguard.PeerConfig)
 		}
 	}
 

infra/conf/wireguard_test.go

@@ -0,0 +1,50 @@
+package conf_test
+
+import (
+	"testing"
+
+	. "github.com/xtls/xray-core/infra/conf"
+	"github.com/xtls/xray-core/proxy/wireguard"
+)
+
+func TestWireGuardConfig(t *testing.T) {
+	creator := func() Buildable {
+		return new(WireGuardConfig)
+	}
+
+	runMultiTestCase(t, []TestCase{
+		{
+			Input: `{
+				"secretKey": "uJv5tZMDltsiYEn+kUwb0Ll/CXWhMkaSCWWhfPEZM3A=",
+				"address": ["10.1.1.1", "fd59:7153:2388:b5fd:0000:0000:1234:0001"],
+				"peers": [
+					{
+						"publicKey": "6e65ce0be17517110c17d77288ad87e7fd5252dcc7d09b95a39d61db03df832a",
+						"endpoint": "127.0.0.1:1234"
+					}
+				],
+				"mtu": 1300,
+				"workers": 2,
+				"domainStrategy": "ForceIPv6v4",
+				"noKernelTun": false
+			}`,
+			Parser: loadJSON(creator),
+			Output: &wireguard.DeviceConfig{
+				// key converted into hex form
+				SecretKey: "b89bf9b5930396db226049fe914c1bd0b97f0975a13246920965a17cf1193370",
+				Endpoint:  []string{"10.1.1.1", "fd59:7153:2388:b5fd:0000:0000:1234:0001"},
+				Peers: []*wireguard.PeerConfig{
+					{
+						// also can read from hex form directly
+						PublicKey:  "6e65ce0be17517110c17d77288ad87e7fd5252dcc7d09b95a39d61db03df832a",
+						Endpoint:   "127.0.0.1:1234",
+						AllowedIps: []string{"0.0.0.0/0", "::0/0"},
+					},
+				},
+				Mtu:            1300,
+				DomainStrategy: wireguard.DeviceConfig_FORCE_IP64,
+				NoKernelTun:    false,
+			},
+		},
+	})
+}

infra/conf/xray.go

@@ -3,7 +3,6 @@ package conf
 import (
 	"context"
 	"encoding/json"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -176,7 +175,7 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 		receiverSettings.StreamSettings = ss
 		if strings.Contains(ss.SecurityType, "reality") && (receiverSettings.PortList == nil ||
 			len(receiverSettings.PortList.Ports()) != 1 || receiverSettings.PortList.Ports()[0] != 443) {
-			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports will increase the likelihood of your server's IP being blocked by the GFW`)
+			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports may get your IP blocked by the GFW`)
 		}
 	}
 	if c.SniffingConfig != nil {
@@ -231,40 +230,6 @@ func (c *OutboundDetourConfig) checkChainProxyConfig() error {
 	return nil
 }
 
-func requiresTransportSecurity(address *Address) bool {
-	if address == nil || address.Address == nil {
-		return false
-	}
-	if address.Family().IsIP() {
-		return !geodata.GetPrivateIPMatcher().Match(address.IP())
-	}
-	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
-	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)
-}
-
-func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *proxyman.SenderConfig) error {
-	if senderSettings.StreamSettings != nil && senderSettings.StreamSettings.GetSecurityType() != "" {
-		return nil
-	}
-
-	if vlessCfg, ok := rawConfig.(*VLessOutboundConfig); ok {
-		if vlessCfg.Encryption != "" && vlessCfg.Encryption != "none" {
-			return nil
-		}
-		if requiresTransportSecurity(vlessCfg.Address) {
-			return errors.New("vless without TLS or other encryption is prohibited unless the server address is a private IP or domain")
-		}
-	}
-
-	if tjCfg, ok := rawConfig.(*TrojanClientConfig); ok {
-		if requiresTransportSecurity(tjCfg.Address) {
-			return errors.New("trojan without TLS is prohibited unless the server address is a private IP or domain")
-		}
-	}
-
-	return nil
-}
-
 // Build implements Buildable.
 func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	senderSettings := &proxyman.SenderConfig{}
@@ -358,9 +323,6 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	if err != nil {
 		return nil, errors.New("failed to load outbound detour config for protocol ", c.Protocol).Base(err)
 	}
-	if err := validateOutboundTransportSecurity(rawConfig, senderSettings); err != nil {
-		return nil, err
-	}
 	ts, err := rawConfig.(Buildable).Build()
 	if err != nil {
 		return nil, errors.New("failed to build outbound handler for protocol ", c.Protocol).Base(err)
@@ -380,20 +342,11 @@ func (c *StatsConfig) Build() (*stats.Config, error) {
 	return &stats.Config{}, nil
 }
 
-type EnvConfig map[string]string
-
-func (c EnvConfig) Override(o EnvConfig) {
-	for key, value := range o {
-		c[key] = value
-	}
-}
-
 type Config struct {
 	// Deprecated: Global transport config is no longer used
 	// left for returning error
 	Transport map[string]json.RawMessage `json:"transport"`
 
-	Env              EnvConfig               `json:"env"`
 	LogConfig        *LogConfig              `json:"log"`
 	RouterConfig     *RouterConfig           `json:"routing"`
 	DNSConfig        *DNSConfig              `json:"dns"`
@@ -449,12 +402,6 @@ func (c *Config) Override(o *Config, fn string) {
 	if o.Transport != nil {
 		c.Transport = o.Transport
 	}
-	if o.Env != nil {
-		if c.Env == nil {
-			c.Env = EnvConfig{}
-		}
-		c.Env.Override(o.Env)
-	}
 	if o.Policy != nil {
 		c.Policy = o.Policy
 	}
@@ -530,12 +477,6 @@ func (c *Config) Override(o *Config, fn string) {
 
 // Build implements Buildable.
 func (c *Config) Build() (*core.Config, error) {
-	for key, value := range c.Env {
-		if err := os.Setenv(key, value); err != nil {
-			return nil, errors.New("failed to apply environment configuration").Base(err)
-		}
-	}
-
 	if err := PostProcessConfigureFile(c); err != nil {
 		return nil, errors.New("failed to post-process configuration file").Base(err)
 	}

main/run.go

@@ -36,10 +36,6 @@ The -confdir=dir flag sets a dir with multiple json config
 The -format=json flag sets the format of config files.
 Default "auto".
 
-The config root env object sets process environment variables after all config
-files are parsed. Variables needed to locate or parse config files must be set
-in the process environment before Xray starts.
-
 The -test flag tells Xray to test config files only,
 without launching the server.
 

proxy/freedom/freedom.go

@@ -5,7 +5,6 @@ import (
 	"crypto/rand"
 	"io"
 	"strings"
-	"sync/atomic"
 	"time"
 
 	"github.com/pires/go-proxyproto"
@@ -32,24 +31,12 @@ import (
 )
 
 var (
-	useSplice               atomic.Bool
+	useSplice               bool
 	allNetworks             [8]bool
 	defaultBlockPrivateRule *FinalRule
 	defaultBlockAllRule     *FinalRule
 )
 
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	value := platform.NewEnvFlag(platform.UseFreedomSplice).GetValue(func() string { return defaultFlagValue })
-	enabled := false
-	switch value {
-	case defaultFlagValue, "auto", "enable":
-		enabled = true
-	}
-	useSplice.Store(enabled)
-	return nil
-}
-
 func init() {
 	common.Must(common.RegisterConfig((*Config)(nil), func(ctx context.Context, config interface{}) (interface{}, error) {
 		h := new(Handler)
@@ -61,7 +48,12 @@ func init() {
 		return h, nil
 	}))
 
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+	value := platform.NewEnvFlag(platform.UseFreedomSplice).GetValue(func() string { return defaultFlagValue })
+	switch value {
+	case defaultFlagValue, "auto", "enable":
+		useSplice = true
+	}
 
 	for i := range allNetworks {
 		allNetworks[i] = true
@@ -70,7 +62,26 @@ func init() {
 	defaultBlockPrivateRule = &FinalRule{
 		action:  RuleAction_Block,
 		network: allNetworks,
-		ip:      geodata.GetPrivateIPMatcher(),
+		ip: common.Must2(geodata.IPReg.BuildIPMatcher(common.Must2(geodata.ParseIPRules([]string{
+			"0.0.0.0/8",
+			"10.0.0.0/8",
+			"100.64.0.0/10",
+			"127.0.0.0/8",
+			"169.254.0.0/16",
+			"172.16.0.0/12",
+			"192.0.0.0/24",
+			"192.0.2.0/24",
+			"192.88.99.0/24",
+			"192.168.0.0/16",
+			"198.18.0.0/15",
+			"198.51.100.0/24",
+			"203.0.113.0/24",
+			"224.0.0.0/3",
+			"::/127",
+			"fc00::/7",
+			"fe80::/10",
+			"ff00::/8",
+		})))),
 	}
 
 	defaultBlockAllRule = &FinalRule{
@@ -430,7 +441,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 
 	responseDone := func() error {
 		defer timer.SetTimeout(plcy.Timeouts.UplinkOnly)
-		if destination.Network == net.Network_TCP && useSplice.Load() && proxy.IsRAWTransportWithoutSecurity(conn) { // it would be tls conn in special use case of MITM, we need to let link handle traffic
+		if destination.Network == net.Network_TCP && useSplice && proxy.IsRAWTransportWithoutSecurity(conn) { // it would be tls conn in special use case of MITM, we need to let link handle traffic
 			var writeConn net.Conn
 			var inTimer *signal.ActivityTimer
 			if inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Conn != nil {

proxy/hysteria/account/config.go

@@ -3,32 +3,25 @@ package account
 import (
 	"sync"
 
-	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/protocol"
 
-	"github.com/google/uuid"
 	"google.golang.org/protobuf/proto"
 )
 
 func (a *Account) AsAccount() (protocol.Account, error) {
-	var VR net.Port
-	if id, err := uuid.Parse(a.Auth); err == nil {
-		VR = net.PortFromBytes(id[6:8])
-	}
 	return &MemoryAccount{
 		Auth: a.Auth,
-		VR:   VR,
 	}, nil
 }
 
 type MemoryAccount struct {
 	Auth string
-	VR   net.Port
 }
 
-func (a *MemoryAccount) Equals(other protocol.Account) bool {
-	if b, ok := other.(*MemoryAccount); ok {
-		return a.Auth == b.Auth
+func (a *MemoryAccount) Equals(another protocol.Account) bool {
+	if account, ok := another.(*MemoryAccount); ok {
+		return a.Auth == account.Auth
 	}
 	return false
 }
@@ -40,105 +33,97 @@ func (a *MemoryAccount) ToProto() proto.Message {
 }
 
 type Validator struct {
-	users sync.Map
-	ids   sync.Map
-	mu    sync.Mutex
+	emails map[string]struct{}
+	users  map[string]*protocol.MemoryUser
+
+	mutex sync.Mutex
 }
 
 func NewValidator() *Validator {
-	return &Validator{}
-}
-
-func (v *Validator) Add(user *protocol.MemoryUser) (err error) {
-	v.mu.Lock()
-	v.users.Store(user.Account.(*MemoryAccount).Auth, user)
-	if id, err := uuid.Parse(user.Account.(*MemoryAccount).Auth); err == nil {
-		id[6] = 0
-		id[7] = 0
-		v.ids.Store(id, user)
+	return &Validator{
+		emails: make(map[string]struct{}),
+		users:  make(map[string]*protocol.MemoryUser),
 	}
-	v.mu.Unlock()
-	return
 }
 
-func (v *Validator) DelByEmail(email string) (err error) {
-	v.mu.Lock()
-	if user := v.GetByEmail(email); user != nil {
-		auth := user.Account.(*MemoryAccount).Auth
-		v.users.Delete(auth)
-		if id, err := uuid.Parse(auth); err == nil {
-			id[6] = 0
-			id[7] = 0
-			v.ids.Delete(id)
+func (v *Validator) Add(u *protocol.MemoryUser) error {
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
+
+	if u.Email != "" {
+		if _, ok := v.emails[u.Email]; ok {
+			return errors.New("User ", u.Email, " already exists.")
+		}
+		v.emails[u.Email] = struct{}{}
+	}
+	v.users[u.Account.(*MemoryAccount).Auth] = u
+
+	return nil
+}
+
+func (v *Validator) Del(email string) error {
+	if email == "" {
+		return errors.New("Email must not be empty.")
+	}
+
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
+
+	if _, ok := v.emails[email]; !ok {
+		return errors.New("User ", email, " not found.")
+	}
+	delete(v.emails, email)
+	for key, user := range v.users {
+		if user.Email == email {
+			delete(v.users, key)
+			break
 		}
 	}
-	v.mu.Unlock()
-	return
+
+	return nil
 }
 
-func (v *Validator) Get(auth string) (user *protocol.MemoryUser) {
-	if id, err := uuid.Parse(auth); err == nil {
-		if user = v.GetByID(id); user != nil {
-			VR := net.PortFromBytes(id[6:8])
-			if user.Account.(*MemoryAccount).VR != VR {
-				user = &protocol.MemoryUser{
-					Email: user.Email,
-					Level: user.Level,
-					Account: &MemoryAccount{
-						Auth: auth,
-						VR:   VR,
-					},
-				}
+func (v *Validator) Get(auth string) *protocol.MemoryUser {
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
+
+	return v.users[auth]
+}
+
+func (v *Validator) GetByEmail(email string) *protocol.MemoryUser {
+	if email == "" {
+		return nil
+	}
+
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
+
+	if _, ok := v.emails[email]; ok {
+		for _, user := range v.users {
+			if user.Email == email {
+				return user
 			}
 		}
-		return
 	}
-	if value, ok := v.users.Load(auth); ok {
-		user = value.(*protocol.MemoryUser)
+
+	return nil
+}
+
+func (v *Validator) GetAll() []*protocol.MemoryUser {
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
+
+	users := make([]*protocol.MemoryUser, 0, len(v.users))
+	for _, user := range v.users {
+		users = append(users, user)
 	}
-	return
+
+	return users
 }
 
-func (v *Validator) GetByID(id uuid.UUID) (user *protocol.MemoryUser) {
-	id[6] = 0
-	id[7] = 0
-	if value, ok := v.ids.Load(id); ok {
-		user = value.(*protocol.MemoryUser)
-	}
-	return
-}
+func (v *Validator) GetCount() int64 {
+	v.mutex.Lock()
+	defer v.mutex.Unlock()
 
-func (v *Validator) GetByEmail(email string) (user *protocol.MemoryUser) {
-	v.users.Range(func(key, value any) bool {
-		if value.(*protocol.MemoryUser).Email == email {
-			user = value.(*protocol.MemoryUser)
-			return false
-		}
-		return true
-	})
-	return
-}
-
-func (v *Validator) GetAll() (users []*protocol.MemoryUser) {
-	v.users.Range(func(key, value any) bool {
-		users = append(users, value.(*protocol.MemoryUser))
-		return true
-	})
-	return
-}
-
-func (v *Validator) GetCount() (count int64) {
-	v.users.Range(func(key, value any) bool {
-		count++
-		return true
-	})
-	return
-}
-
-func (v *Validator) NotEmpty() (not_empty bool) {
-	v.users.Range(func(key, value any) bool {
-		not_empty = true
-		return false
-	})
-	return
+	return int64(len(v.users))
 }

proxy/hysteria/config.pb.go

@@ -24,7 +24,8 @@ const (
 
 type ClientConfig struct {
 	state         protoimpl.MessageState   `protogen:"open.v1"`
-	Server        *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	Version       int32                    `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+	Server        *protocol.ServerEndpoint `protobuf:"bytes,2,opt,name=server,proto3" json:"server,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -59,6 +60,13 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_hysteria_config_proto_rawDescGZIP(), []int{0}
 }
 
+func (x *ClientConfig) GetVersion() int32 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
 func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
@@ -114,9 +122,10 @@ var File_proxy_hysteria_config_proto protoreflect.FileDescriptor
 
 const file_proxy_hysteria_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1bproxy/hysteria/config.proto\x12\x13xray.proxy.hysteria\x1a!common/protocol/server_spec.proto\x1a\x1acommon/protocol/user.proto\"L\n" +
-	"\fClientConfig\x12<\n" +
-	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"@\n" +
+	"\x1bproxy/hysteria/config.proto\x12\x13xray.proxy.hysteria\x1a!common/protocol/server_spec.proto\x1a\x1acommon/protocol/user.proto\"f\n" +
+	"\fClientConfig\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\x05R\aversion\x12<\n" +
+	"\x06server\x18\x02 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"@\n" +
 	"\fServerConfig\x120\n" +
 	"\x05users\x18\x01 \x03(\v2\x1a.xray.common.protocol.UserR\x05usersB[\n" +
 	"\x17com.xray.proxy.hysteriaP\x01Z(github.com/xtls/xray-core/proxy/hysteria\xaa\x02\x13Xray.Proxy.Hysteriab\x06proto3"

proxy/hysteria/config.proto

@@ -10,7 +10,8 @@ import "common/protocol/server_spec.proto";
 import "common/protocol/user.proto";
 
 message ClientConfig {
-  xray.common.protocol.ServerEndpoint server = 1;
+  int32 version = 1;
+  xray.common.protocol.ServerEndpoint server = 2;
 }
 
 message ServerConfig {

proxy/hysteria/server.go

@@ -59,12 +59,12 @@ func (s *Server) HysteriaInboundValidator() *account.Validator {
 	return s.validator
 }
 
-func (s *Server) AddUser(ctx context.Context, user *protocol.MemoryUser) error {
-	return s.validator.Add(user)
+func (s *Server) AddUser(ctx context.Context, u *protocol.MemoryUser) error {
+	return s.validator.Add(u)
 }
 
-func (s *Server) RemoveUser(ctx context.Context, email string) error {
-	return s.validator.DelByEmail(email)
+func (s *Server) RemoveUser(ctx context.Context, e string) error {
+	return s.validator.Del(e)
 }
 
 func (s *Server) GetUser(ctx context.Context, email string) *protocol.MemoryUser {
@@ -91,12 +91,9 @@ func (s *Server) Process(ctx context.Context, network net.Network, conn stat.Con
 
 	iConn := stat.TryUnwrapStatsConn(conn)
 
-	if v, ok := iConn.(interface{ User() *protocol.MemoryUser }); ok {
-		user := v.User()
-		if user != nil {
-			inbound.User = user
-			inbound.VlessRoute = user.Account.(*account.MemoryAccount).VR
-		}
+	type User interface{ User() *protocol.MemoryUser }
+	if v, ok := iConn.(User); ok && v.User() != nil {
+		inbound.User = v.User()
 	}
 
 	if _, ok := iConn.(*hysteria.InterConn); ok {

proxy/shadowsocks/config.go

@@ -85,6 +85,8 @@ func (a *Account) getCipher() (Cipher, error) {
 			IVBytes:         32,
 			AEADAuthCreator: createXChaCha20Poly1305,
 		}, nil
+	case CipherType_NONE:
+		return NoneCipher{}, nil
 	default:
 		return nil, errors.New("Unsupported cipher.")
 	}
@@ -184,6 +186,30 @@ func (c *AEADCipher) DecodePacket(key []byte, b *buf.Buffer) error {
 	return nil
 }
 
+type NoneCipher struct{}
+
+func (NoneCipher) KeySize() int32 { return 0 }
+func (NoneCipher) IVSize() int32  { return 0 }
+func (NoneCipher) IsAEAD() bool {
+	return false
+}
+
+func (NoneCipher) NewDecryptionReader(key []byte, iv []byte, reader io.Reader) (buf.Reader, error) {
+	return buf.NewReader(reader), nil
+}
+
+func (NoneCipher) NewEncryptionWriter(key []byte, iv []byte, writer io.Writer) (buf.Writer, error) {
+	return buf.NewWriter(writer), nil
+}
+
+func (NoneCipher) EncodePacket(key []byte, b *buf.Buffer) error {
+	return nil
+}
+
+func (NoneCipher) DecodePacket(key []byte, b *buf.Buffer) error {
+	return nil
+}
+
 func passwordToCipherKey(password []byte, keySize int32) []byte {
 	key := make([]byte, 0, keySize)
 

proxy/shadowsocks/config.pb.go

@@ -31,6 +31,7 @@ const (
 	CipherType_AES_256_GCM        CipherType = 6
 	CipherType_CHACHA20_POLY1305  CipherType = 7
 	CipherType_XCHACHA20_POLY1305 CipherType = 8
+	CipherType_NONE               CipherType = 9
 )
 
 // Enum value maps for CipherType.
@@ -41,6 +42,7 @@ var (
 		6: "AES_256_GCM",
 		7: "CHACHA20_POLY1305",
 		8: "XCHACHA20_POLY1305",
+		9: "NONE",
 	}
 	CipherType_value = map[string]int32{
 		"UNKNOWN":            0,
@@ -48,6 +50,7 @@ var (
 		"AES_256_GCM":        6,
 		"CHACHA20_POLY1305":  7,
 		"XCHACHA20_POLY1305": 8,
+		"NONE":               9,
 	}
 )
 
@@ -248,14 +251,15 @@ const file_proxy_shadowsocks_config_proto_rawDesc = "" +
 	"\x05users\x18\x01 \x03(\v2\x1a.xray.common.protocol.UserR\x05users\x122\n" +
 	"\anetwork\x18\x02 \x03(\x0e2\x18.xray.common.net.NetworkR\anetwork\"L\n" +
 	"\fClientConfig\x12<\n" +
-	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server*j\n" +
+	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server*t\n" +
 	"\n" +
 	"CipherType\x12\v\n" +
 	"\aUNKNOWN\x10\x00\x12\x0f\n" +
 	"\vAES_128_GCM\x10\x05\x12\x0f\n" +
 	"\vAES_256_GCM\x10\x06\x12\x15\n" +
 	"\x11CHACHA20_POLY1305\x10\a\x12\x16\n" +
-	"\x12XCHACHA20_POLY1305\x10\bBd\n" +
+	"\x12XCHACHA20_POLY1305\x10\b\x12\b\n" +
+	"\x04NONE\x10\tBd\n" +
 	"\x1acom.xray.proxy.shadowsocksP\x01Z+github.com/xtls/xray-core/proxy/shadowsocks\xaa\x02\x16Xray.Proxy.Shadowsocksb\x06proto3"
 
 var (

proxy/shadowsocks/config.proto

@@ -23,6 +23,7 @@ enum CipherType {
   AES_256_GCM = 6;
   CHACHA20_POLY1305 = 7;
   XCHACHA20_POLY1305 = 8;
+  NONE = 9;
 }
 
 message ServerConfig {

proxy/shadowsocks/protocol_test.go

@@ -38,6 +38,19 @@ func TestUDPEncodingDecoding(t *testing.T) {
 				}),
 			},
 		},
+		{
+			Version: Version,
+			Command: protocol.RequestCommandUDP,
+			Address: net.LocalHostIP,
+			Port:    1234,
+			User: &protocol.MemoryUser{
+				Email: "love@example.com",
+				Account: toAccount(&Account{
+					Password:   "123",
+					CipherType: CipherType_NONE,
+				}),
+			},
+		},
 	}
 
 	for _, request := range testRequests {
@@ -67,6 +80,10 @@ func TestUDPDecodingWithPayloadTooShort(t *testing.T) {
 			Password:   "password",
 			CipherType: CipherType_AES_128_GCM,
 		}),
+		toAccount(&Account{
+			Password:   "password",
+			CipherType: CipherType_NONE,
+		}),
 	}
 
 	for _, account := range testAccounts {

proxy/shadowsocks/validator.go

@@ -145,6 +145,7 @@ func (v *Validator) Get(bs []byte, command protocol.RequestCommand) (u *protocol
 		} else {
 			u = user
 			ivLen = user.Account.(*MemoryAccount).Cipher.IVSize()
+			// err = user.Account.(*MemoryAccount).CheckIV(bs[:ivLen]) // The IV size of None Cipher is 0.
 			return
 		}
 	}

proxy/tun/README.md

@@ -14,12 +14,11 @@ Plainly enabling it in the config probably will result nothing, or lock your rou
 
 ## DETAILS
 
-By default, enabling the feature will only bring the tun interface up. \
-When configured explicitly, Windows and Linux can apply interface addresses from `gateway`, while macOS uses the first IPv4 prefix from `gateway` to configure the utun point-to-point address. \
-Windows, Linux and macOS can also apply system routes from `autoSystemRoutingTable`.
-Linux and macOS do not configure system DNS from the `dns` field; system DNS remains managed by the OS or distribution-specific network services. \
-For more advanced routing policies or rules, OS level configuration can still manage the named interface (e.g. xray0) when it appears.
-This keeps complex system level routing and rules in a single place of responsibility - the OS itself. \
+Current implementation does not contain options to configure network level addresses, routing or rules.
+Enabling the feature will result only tun interface up, and that's it. \
+This is explicit decision, significantly simplifying implementation, and allowing any number of custom configurations, consumers could come up with. Network interface is OS level entity, and OS is what should manage it. \
+Working configuration, is tun enabled in Xray config with specific name (e.g. xray0), and OS level configuration to manage "xray0" interface, applying routing and rules on interface up.
+This way consistency of system level routing and rules is ensured from single place of responsibility - the OS itself. \
 Examples of how to achieve this on a simple Linux system (Ubuntu with systemd-networkd) can be found at the end of this README.
 
 Due to this inbound not actually being a proxy, the configuration ignore required listen and port options, and never listen on any port. \
@@ -31,17 +30,13 @@ Here is simple Xray config snippet to enable the inbound:
       "port": 0,
       "protocol": "tun",
       "settings": {
-        "name": "utun10",
-        "desc": "Wintun",
-        "mtu": 1500
+        "name": "xray0",
+        "MTU": 1492
       }
     }
   ],
 ```
 
-`desc` sets the Windows Wintun adapter tunnel type and defaults to `Wintun`.
-It is ignored on other platforms.
-
 ## SUPPORTED FEATURES
 
 - IPv4 and IPv6
@@ -211,11 +206,6 @@ ifconfig
 Produced list will have all system interfaces listed, from which you will see how many "utun" ones already exists.
 It's not required to select next available number, e.g. if you have utun1-utun7 interfaces, it's not required to have "utun8" in the config. You can choose any available name, even utun20, to get surely available interface number.
 
-macOS requires the utun interface to have a point-to-point IPv4 address before IPv4 routes can use it. \
-By default Xray uses `169.254.10.1/30` as the remote gateway address and assigns the next address in the prefix to the local utun side. \
-You can override this by setting `gateway`; macOS uses the first IPv4 prefix in the list. IPv6 `gateway` entries are not used for utun addressing, and IPv6 routes use the interface route instead. \
-The `dns` field does not change macOS system DNS.
-
 To attach routing to the interface, route command like following can be executed:
 ```
 sudo route add -net 1.1.1.0/24 -iface utun10
@@ -224,7 +214,6 @@ sudo route add -net 1.1.1.0/24 -iface utun10
 sudo route add -inet6 -host 2606:4700:4700::1111 -iface utun10
 sudo route add -inet6 -host 2606:4700:4700::1001 -iface utun10
 ```
-Alternatively, configure `autoSystemRoutingTable` and Xray will add and remove those system routes while it is running.
 Important to remember that everything written above about Linux routing concept, also apply to Mac OS X. If you simply route default route through utun interface, that will result network loop and immediate network failure.
 
 ## ANDROID SUPPORT

proxy/tun/config.go

@@ -3,6 +3,8 @@ package tun
 import (
 	"context"
 	"net"
+	"sort"
+	"strings"
 	"sync"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -29,23 +31,95 @@ func (updater *InterfaceUpdater) Update() {
 	updater.Lock()
 	defer updater.Unlock()
 
-	got, err := findOutboundInterface(updater.tunIndex, updater.fixedName)
+	if updater.iface != nil {
+		iface, err := net.InterfaceByIndex(updater.iface.Index)
+		if err == nil && iface.Name == updater.iface.Name {
+			return
+		}
+	}
+
+	updater.iface = nil
+
+	interfaces, err := net.Interfaces()
 	if err != nil {
 		errors.LogInfoInner(context.Background(), err, "[tun] failed to update interface")
-		updater.iface = nil
 		return
 	}
 
+	var got *net.Interface
+	if updater.fixedName != "" {
+		for _, iface := range interfaces {
+			if iface.Index == updater.tunIndex {
+				continue
+			}
+			if iface.Name == updater.fixedName {
+				got = &iface
+				break
+			}
+		}
+	} else {
+		var ifs []struct {
+			index int
+			score int
+		}
+		for i, iface := range interfaces {
+			if iface.Index == updater.tunIndex {
+				continue
+			}
+			if strings.Contains(iface.Name, "vEthernet") {
+				continue
+			}
+			if iface.Flags&net.FlagUp == 0 {
+				continue
+			}
+			if iface.Flags&net.FlagLoopback != 0 {
+				continue
+			}
+			addrs, err := iface.Addrs()
+			if err != nil || len(addrs) == 0 {
+				continue
+			}
+			ifs = append(ifs, struct {
+				index int
+				score int
+			}{i, score(&iface, addrs)})
+		}
+		sort.Slice(ifs, func(i, j int) bool {
+			if ifs[i].score != ifs[j].score {
+				return ifs[i].score > ifs[j].score
+			}
+
+			return interfaces[ifs[i].index].Name < interfaces[ifs[j].index].Name
+		})
+		if len(ifs) > 0 {
+			iface := interfaces[ifs[0].index]
+			got = &iface
+		}
+	}
+
 	if got == nil {
 		errors.LogInfo(context.Background(), "[tun] failed to update interface > got == nil")
-		updater.iface = nil
-		return
-	}
-
-	if updater.iface != nil && updater.iface.Index == got.Index && updater.iface.Name == got.Name {
 		return
 	}
 
 	updater.iface = got
 	errors.LogInfo(context.Background(), "[tun] update interface ", got.Name, " ", got.Index)
 }
+
+func score(iface *net.Interface, addrs []net.Addr) int {
+	score := 0
+
+	name := strings.ToLower(iface.Name)
+	if strings.Contains(name, "wlan") || strings.Contains(name, "wi-fi") {
+		score += 2
+	}
+
+	for _, addr := range addrs {
+		if strings.HasPrefix(addr.String(), "192.168.") {
+			score += 1
+			break
+		}
+	}
+
+	return score
+}

proxy/tun/config.pb.go

@@ -7,12 +7,11 @@
 package tun
 
 import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
-
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 )
 
 const (
@@ -31,7 +30,6 @@ type Config struct {
 	UserLevel              uint32                 `protobuf:"varint,5,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
 	AutoSystemRoutingTable []string               `protobuf:"bytes,6,rep,name=auto_system_routing_table,json=autoSystemRoutingTable,proto3" json:"auto_system_routing_table,omitempty"`
 	AutoOutboundsInterface string                 `protobuf:"bytes,7,opt,name=auto_outbounds_interface,json=autoOutboundsInterface,proto3" json:"auto_outbounds_interface,omitempty"`
-	Desc                   string                 `protobuf:"bytes,8,opt,name=desc,proto3" json:"desc,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -115,18 +113,11 @@ func (x *Config) GetAutoOutboundsInterface() string {
 	return ""
 }
 
-func (x *Config) GetDesc() string {
-	if x != nil {
-		return x.Desc
-	}
-	return ""
-}
-
 var File_proxy_tun_config_proto protoreflect.FileDescriptor
 
 const file_proxy_tun_config_proto_rawDesc = "" +
 	"\n" +
-	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\x82\x02\n" +
+	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\xee\x01\n" +
 	"\x06Config\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
 	"\x03MTU\x18\x02 \x01(\rR\x03MTU\x12\x18\n" +
@@ -135,8 +126,7 @@ const file_proxy_tun_config_proto_rawDesc = "" +
 	"\n" +
 	"user_level\x18\x05 \x01(\rR\tuserLevel\x129\n" +
 	"\x19auto_system_routing_table\x18\x06 \x03(\tR\x16autoSystemRoutingTable\x128\n" +
-	"\x18auto_outbounds_interface\x18\a \x01(\tR\x16autoOutboundsInterface\x12\x12\n" +
-	"\x04desc\x18\b \x01(\tR\x04descBL\n" +
+	"\x18auto_outbounds_interface\x18\a \x01(\tR\x16autoOutboundsInterfaceBL\n" +
 	"\x12com.xray.proxy.tunP\x01Z#github.com/xtls/xray-core/proxy/tun\xaa\x02\x0eXray.Proxy.Tunb\x06proto3"
 
 var (

proxy/tun/config.proto

@@ -14,5 +14,4 @@ message Config {
   uint32 user_level = 5;
   repeated string auto_system_routing_table = 6;
   string auto_outbounds_interface = 7;
-  string desc = 8;
 }

proxy/tun/handler.go

@@ -17,7 +17,6 @@ import (
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
 	"github.com/xtls/xray-core/features/routing"
-	"github.com/xtls/xray-core/features/stats"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
@@ -33,8 +32,6 @@ type Handler struct {
 	dispatcher      routing.Dispatcher
 	tag             string
 	sniffingRequest session.SniffingRequest
-	uplinkCounter   stats.Counter
-	downlinkCounter stats.Counter
 }
 
 // ConnectionHandler interface with the only method that stack is going to push new connections to
@@ -62,23 +59,6 @@ func (t *Handler) Init(ctx context.Context, pm policy.Manager, dispatcher routin
 	t.policyManager = pm
 	t.dispatcher = dispatcher
 
-	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundUplink {
-		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
-		name := "inbound>>>" + t.tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
-		if c != nil {
-			t.uplinkCounter = c
-		}
-	}
-	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundDownlink {
-		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
-		name := "inbound>>>" + t.tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
-		if c != nil {
-			t.downlinkCounter = c
-		}
-	}
-
 	return nil
 }
 
@@ -171,14 +151,6 @@ func (t *Handler) HandleConnection(conn net.Conn, destination net.Destination) {
 		return
 	}
 	source := net.DestinationFromAddr(remote)
-	if t.uplinkCounter != nil || t.downlinkCounter != nil {
-		conn = &stat.CounterConnection{
-			Connection:   conn,
-			ReadCounter:  t.uplinkCounter,
-			WriteCounter: t.downlinkCounter,
-		}
-	}
-
 	inbound := session.Inbound{
 		Name:          "tun",
 		Tag:           t.tag,

proxy/tun/handler_test.go

@@ -1,133 +0,0 @@
-package tun
-
-import (
-	"bytes"
-	"context"
-	"net"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/xtls/xray-core/common/buf"
-	xnet "github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/features/routing"
-	"github.com/xtls/xray-core/transport"
-)
-
-type testCounter struct {
-	value int64
-}
-
-func (c *testCounter) Value() int64 {
-	return atomic.LoadInt64(&c.value)
-}
-
-func (c *testCounter) Set(value int64) int64 {
-	return atomic.SwapInt64(&c.value, value)
-}
-
-func (c *testCounter) Add(value int64) int64 {
-	return atomic.AddInt64(&c.value, value) - value
-}
-
-type testConn struct {
-	reader *bytes.Reader
-	writer bytes.Buffer
-}
-
-func newTestConn(input []byte) *testConn {
-	return &testConn{reader: bytes.NewReader(input)}
-}
-
-func (c *testConn) Read(payload []byte) (int, error) {
-	return c.reader.Read(payload)
-}
-
-func (c *testConn) Write(payload []byte) (int, error) {
-	return c.writer.Write(payload)
-}
-
-func (c *testConn) Close() error {
-	return nil
-}
-
-func (c *testConn) LocalAddr() net.Addr {
-	return &net.TCPAddr{IP: net.IPv4(10, 0, 0, 1), Port: 1080}
-}
-
-func (c *testConn) RemoteAddr() net.Addr {
-	return &net.TCPAddr{IP: net.IPv4(10, 0, 0, 2), Port: 12345}
-}
-
-func (c *testConn) SetDeadline(time.Time) error {
-	return nil
-}
-
-func (c *testConn) SetReadDeadline(time.Time) error {
-	return nil
-}
-
-func (c *testConn) SetWriteDeadline(time.Time) error {
-	return nil
-}
-
-type testDispatcher struct {
-	writePayload []byte
-	readBytes    int32
-}
-
-func (d *testDispatcher) Type() interface{} {
-	return routing.DispatcherType()
-}
-
-func (d *testDispatcher) Start() error {
-	return nil
-}
-
-func (d *testDispatcher) Close() error {
-	return nil
-}
-
-func (d *testDispatcher) Dispatch(context.Context, xnet.Destination) (*transport.Link, error) {
-	return nil, nil
-}
-
-func (d *testDispatcher) DispatchLink(ctx context.Context, dest xnet.Destination, link *transport.Link) error {
-	mb, err := link.Reader.ReadMultiBuffer()
-	if err != nil {
-		return err
-	}
-	atomic.StoreInt32(&d.readBytes, mb.Len())
-	buf.ReleaseMulti(mb)
-
-	return link.Writer.WriteMultiBuffer(buf.MultiBuffer{buf.FromBytes(d.writePayload)})
-}
-
-func TestHandlerCountsTunConnectionTraffic(t *testing.T) {
-	uplinkCounter := new(testCounter)
-	downlinkCounter := new(testCounter)
-	dispatcher := &testDispatcher{writePayload: []byte("downlink")}
-	conn := newTestConn([]byte("uplink"))
-
-	handler := &Handler{
-		ctx:             context.Background(),
-		config:          &Config{},
-		dispatcher:      dispatcher,
-		uplinkCounter:   uplinkCounter,
-		downlinkCounter: downlinkCounter,
-	}
-	handler.HandleConnection(conn, xnet.TCPDestination(xnet.LocalHostIP, 443))
-
-	if got := uplinkCounter.Value(); got != int64(len("uplink")) {
-		t.Fatalf("unexpected uplink counter: got %d, want %d", got, len("uplink"))
-	}
-	if got := downlinkCounter.Value(); got != int64(len("downlink")) {
-		t.Fatalf("unexpected downlink counter: got %d, want %d", got, len("downlink"))
-	}
-	if got := int(atomic.LoadInt32(&dispatcher.readBytes)); got != len("uplink") {
-		t.Fatalf("dispatcher read unexpected bytes: got %d, want %d", got, len("uplink"))
-	}
-	if got := conn.writer.String(); got != "downlink" {
-		t.Fatalf("connection write mismatch: got %q, want %q", got, "downlink")
-	}
-}

proxy/tun/tun_android.go

@@ -81,17 +81,3 @@ func (t *AndroidTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	if fixedName == "" {
-		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
-	}
-	iface, err := net.InterfaceByName(fixedName)
-	if err != nil {
-		return nil, err
-	}
-	if iface.Index == tunIndex {
-		return nil, errors.New("outbound interface cannot be the TUN interface")
-	}
-	return iface, nil
-}

proxy/tun/tun_darwin.go

@@ -3,20 +3,16 @@
 package tun
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"net"
 	"net/netip"
 	"os"
 	"strconv"
-	"sync"
 	"unsafe"
 
 	"github.com/xtls/xray-core/common/buf"
-	xerrors "github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform"
-	"golang.org/x/net/route"
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -24,11 +20,11 @@ import (
 )
 
 const (
-	utunControlName      = "com.apple.net.utun_control"
-	sysprotoControl      = 2
-	defaultDarwinGateway = "169.254.10.1/30"
-	utunHeaderSize       = 4
-	UTUN_OPT_IFNAME      = 2
+	utunControlName = "com.apple.net.utun_control"
+	sysprotoControl = 2
+	gateway         = "169.254.10.1/30"
+	utunHeaderSize  = 4
+	UTUN_OPT_IFNAME = 2
 )
 
 const (
@@ -46,11 +42,6 @@ type DarwinTun struct {
 	options *Config
 	tunFd   int
 	ownsFd  bool // true for macOS (we created the fd), false for iOS (fd from system)
-
-	routeMonitor     *os.File
-	routeMonitorOnce sync.Once
-	systemRoutes     []netip.Prefix
-	gateway          netip.Prefix
 }
 
 var (
@@ -86,13 +77,7 @@ func NewTun(options *Config) (Tun, error) {
 		return nil, err
 	}
 
-	gateway, err := selectDarwinGateway(options.Gateway)
-	if err != nil {
-		_ = tunFile.Close()
-		return nil, err
-	}
-
-	err = setup(options.Name, options.MTU, gateway)
+	err = setup(options.Name, options.MTU)
 	if err != nil {
 		_ = tunFile.Close()
 		return nil, err
@@ -103,58 +88,19 @@ func NewTun(options *Config) (Tun, error) {
 		options: options,
 		tunFd:   int(tunFile.Fd()),
 		ownsFd:  true,
-		gateway: gateway,
 	}, nil
 }
 
 func (t *DarwinTun) Start() error {
-	if !t.ownsFd {
-		return nil
-	}
-
-	if err := t.setSystemRoutes(); err != nil {
-		return err
-	}
-
-	if updater != nil {
-		fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
-		if err != nil {
-			_ = t.unsetSystemRoutes()
-			return err
-		}
-		t.routeMonitor = os.NewFile(uintptr(fd), "xray-route-monitor")
-		go t.monitorRouteChanges()
-	}
 	return nil
 }
 
 func (t *DarwinTun) Close() error {
-	t.routeMonitorOnce.Do(func() {
-		if t.routeMonitor != nil {
-			_ = t.routeMonitor.Close()
-		}
-	})
-	routeErr := t.unsetSystemRoutes()
 	if t.ownsFd {
-		return xerrors.Combine(routeErr, t.tunFile.Close())
+		return t.tunFile.Close()
 	}
 	// iOS: don't close the fd, it's owned by NetworkExtension
-	return routeErr
-}
-
-func (t *DarwinTun) monitorRouteChanges() {
-	buffer := make([]byte, 64*1024)
-	for {
-		if _, err := t.routeMonitor.Read(buffer); err != nil {
-			if !errors.Is(err, os.ErrClosed) {
-				xerrors.LogInfoInner(context.Background(), err, "[tun] failed to monitor route changes")
-			}
-			return
-		}
-		if updater != nil {
-			updater.Update()
-		}
-	}
+	return nil
 }
 
 func (t *DarwinTun) Name() (string, error) {
@@ -289,56 +235,24 @@ func open(name string) (*os.File, error) {
 }
 
 // setup the interface by name
-func setup(name string, MTU uint32, gateway netip.Prefix) error {
+func setup(name string, MTU uint32) error {
 	if err := setMTU(name, MTU); err != nil {
 		return err
 	}
 
 	/*
 	 * Darwin routing require tunnel type interface to have local and remote address, to be routable.
-	 * To simplify inevitable task, assign the interface static ip address.
+	 * To simplify inevitable task, assign the interface static ip address, which in current implementation
+	 * is just some random ip from link-local pool, allowing to not bother about existing routing intersection.
 	 */
-	if err := setIPAddress(name, gateway); err != nil {
+	syntheticIP, _ := netip.ParsePrefix(gateway)
+	if err := setIPAddress(name, syntheticIP); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func selectDarwinGateway(configured []string) (netip.Prefix, error) {
-	if len(configured) == 0 {
-		return netip.ParsePrefix(defaultDarwinGateway)
-	}
-
-	for _, value := range configured {
-		prefix, err := netip.ParsePrefix(value)
-		if err != nil {
-			return netip.Prefix{}, xerrors.New("invalid macOS gateway ", value).Base(err)
-		}
-		if !prefix.Addr().Is4() {
-			continue
-		}
-		local, ok := nextDarwinLocalIPv4(prefix)
-		if !ok || !prefix.Contains(local) {
-			return netip.Prefix{}, xerrors.New("macOS gateway ", value, " must contain at least one usable local IPv4 address after the gateway address")
-		}
-		return prefix, nil
-	}
-
-	return netip.Prefix{}, xerrors.New("macOS gateway requires at least one IPv4 prefix")
-}
-
-func nextDarwinLocalIPv4(gateway netip.Prefix) (netip.Addr, bool) {
-	local4 := gateway.Addr().As4()
-	for i := len(local4) - 1; i >= 0; i-- {
-		local4[i]++
-		if local4[i] != 0 {
-			return netip.AddrFrom4(local4), true
-		}
-	}
-	return netip.Addr{}, false
-}
-
 // setMTU sets MTU on the interface by given name
 func setMTU(name string, mtu uint32) error {
 	socket, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
@@ -384,11 +298,8 @@ func setIPAddress(name string, gateway netip.Prefix) error {
 	defer unix.Close(socket4)
 
 	// assume local ip address is next one from the remote address
-	local, ok := nextDarwinLocalIPv4(gateway)
-	if !ok || !gateway.Contains(local) {
-		return xerrors.New("macOS gateway ", gateway.String(), " must contain at least one usable local IPv4 address after the gateway address")
-	}
-	local4 := local.As4()
+	local4 := gateway.Addr().As4()
+	local4[3]++
 
 	// fill the configuration for ipv4
 	ifReq4 := ifAliasReq4{
@@ -477,226 +388,3 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 
 	return errors.Join(err1, err2)
 }
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	if fixedName != "" {
-		iface, err := net.InterfaceByName(fixedName)
-		if err != nil {
-			return nil, err
-		}
-		if iface.Index == tunIndex {
-			return nil, errors.New("outbound interface cannot be the TUN interface")
-		}
-		return iface, nil
-	}
-
-	rib, err := route.FetchRIB(unix.AF_UNSPEC, route.RIBTypeRoute, 0)
-	if err != nil {
-		return nil, err
-	}
-	messages, err := route.ParseRIB(route.RIBTypeRoute, rib)
-	if err != nil {
-		return nil, err
-	}
-
-	var ipv6Index int
-	for _, message := range messages {
-		routeMessage, ok := message.(*route.RouteMessage)
-		if !ok || routeMessage.Index == tunIndex {
-			continue
-		}
-		if routeMessage.Flags&unix.RTF_UP == 0 || routeMessage.Flags&unix.RTF_GATEWAY == 0 {
-			continue
-		}
-
-		family, ok := defaultRouteFamily(routeMessage)
-		if !ok {
-			continue
-		}
-		if family == unix.AF_INET {
-			return usableDarwinInterface(routeMessage.Index)
-		}
-		if family == unix.AF_INET6 && ipv6Index == 0 {
-			ipv6Index = routeMessage.Index
-		}
-	}
-
-	if ipv6Index != 0 {
-		return usableDarwinInterface(ipv6Index)
-	}
-	return nil, errors.New("default route not found")
-}
-
-func defaultRouteFamily(message *route.RouteMessage) (int, bool) {
-	if len(message.Addrs) <= unix.RTAX_NETMASK {
-		return 0, false
-	}
-
-	switch destination := message.Addrs[unix.RTAX_DST].(type) {
-	case *route.Inet4Addr:
-		mask, ok := message.Addrs[unix.RTAX_NETMASK].(*route.Inet4Addr)
-		if !ok || destination.IP != netip.IPv4Unspecified().As4() {
-			return 0, false
-		}
-		ones, bits := net.IPMask(mask.IP[:]).Size()
-		return unix.AF_INET, ones == 0 && bits == 32
-	case *route.Inet6Addr:
-		mask, ok := message.Addrs[unix.RTAX_NETMASK].(*route.Inet6Addr)
-		if !ok || destination.IP != netip.IPv6Unspecified().As16() {
-			return 0, false
-		}
-		ones, bits := net.IPMask(mask.IP[:]).Size()
-		return unix.AF_INET6, ones == 0 && bits == 128
-	default:
-		return 0, false
-	}
-}
-
-func usableDarwinInterface(index int) (*net.Interface, error) {
-	iface, err := net.InterfaceByIndex(index)
-	if err != nil {
-		return nil, err
-	}
-	if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
-		return nil, errors.New("default route interface is not usable")
-	}
-	return iface, nil
-}
-
-func (t *DarwinTun) setSystemRoutes() error {
-	routes, err := buildDarwinSystemRoutes(t.options.AutoSystemRoutingTable)
-	if err != nil {
-		return err
-	}
-	if len(routes) == 0 {
-		return nil
-	}
-
-	tunIndex, err := t.Index()
-	if err != nil {
-		return err
-	}
-	for _, destination := range routes {
-		if err := execDarwinRoute(unix.RTM_ADD, tunIndex, destination, t.gateway); err != nil {
-			_ = t.unsetSystemRoutes()
-			return xerrors.New("failed to add system route ", destination).Base(err)
-		}
-		t.systemRoutes = append(t.systemRoutes, destination)
-	}
-	return nil
-}
-
-func (t *DarwinTun) unsetSystemRoutes() error {
-	var errs []error
-	tunIndex, indexErr := t.Index()
-	if indexErr != nil && len(t.systemRoutes) > 0 {
-		errs = append(errs, indexErr)
-	}
-	for i := len(t.systemRoutes) - 1; i >= 0; i-- {
-		destination := t.systemRoutes[i]
-		if err := execDarwinRoute(unix.RTM_DELETE, tunIndex, destination, t.gateway); err != nil && !errors.Is(err, unix.ESRCH) {
-			errs = append(errs, xerrors.New("failed to delete system route ", destination).Base(err))
-		}
-	}
-	t.systemRoutes = nil
-	return xerrors.Combine(errs...)
-}
-
-func buildDarwinSystemRoutes(configured []string) ([]netip.Prefix, error) {
-	routes := make([]netip.Prefix, 0, len(configured))
-	seen := make(map[netip.Prefix]struct{})
-
-	appendRoute := func(prefix netip.Prefix) {
-		prefix = prefix.Masked()
-		if _, found := seen[prefix]; found {
-			return
-		}
-		seen[prefix] = struct{}{}
-		routes = append(routes, prefix)
-	}
-
-	for _, value := range configured {
-		prefix, err := netip.ParsePrefix(value)
-		if err != nil {
-			return nil, xerrors.New("invalid system route ", value).Base(err)
-		}
-		prefix = prefix.Masked()
-		if prefix.Bits() == 0 {
-			for _, protected := range darwinProtectedDefaultRoutes(prefix.Addr().Is4()) {
-				appendRoute(protected)
-			}
-			continue
-		}
-		appendRoute(prefix)
-	}
-
-	return routes, nil
-}
-
-func darwinProtectedDefaultRoutes(ipv4 bool) []netip.Prefix {
-	routes := make([]netip.Prefix, 0, 8)
-	for i := 0; i < 8; i++ {
-		if ipv4 {
-			var address [4]byte
-			address[0] = 1 << i
-			routes = append(routes, netip.PrefixFrom(netip.AddrFrom4(address), 8-i))
-		} else {
-			var address [16]byte
-			address[0] = 1 << i
-			routes = append(routes, netip.PrefixFrom(netip.AddrFrom16(address), 8-i))
-		}
-	}
-	return routes
-}
-
-func execDarwinRoute(messageType int, interfaceIndex int, destination netip.Prefix, gateway netip.Prefix) error {
-	message := route.RouteMessage{
-		Type:    messageType,
-		Version: unix.RTM_VERSION,
-		Flags:   unix.RTF_STATIC | unix.RTF_GATEWAY,
-		Seq:     1,
-	}
-	if messageType == unix.RTM_ADD {
-		message.Flags |= unix.RTF_UP
-	}
-
-	if destination.Addr().Is4() {
-		message.Addrs = []route.Addr{
-			unix.RTAX_DST:     &route.Inet4Addr{IP: destination.Addr().As4()},
-			unix.RTAX_NETMASK: &route.Inet4Addr{IP: prefixMask4(destination.Bits())},
-			unix.RTAX_GATEWAY: &route.Inet4Addr{IP: gateway.Addr().As4()},
-		}
-	} else {
-		message.Flags &^= unix.RTF_GATEWAY
-		message.Index = interfaceIndex
-		message.Addrs = []route.Addr{
-			unix.RTAX_DST:     &route.Inet6Addr{IP: destination.Addr().As16()},
-			unix.RTAX_NETMASK: &route.Inet6Addr{IP: prefixMask6(destination.Bits())},
-			unix.RTAX_GATEWAY: &route.LinkAddr{Index: interfaceIndex},
-		}
-	}
-
-	request, err := message.Marshal()
-	if err != nil {
-		return err
-	}
-	fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
-	if err != nil {
-		return err
-	}
-	defer unix.Close(fd)
-	_, err = unix.Write(fd, request)
-	return err
-}
-
-func prefixMask4(bits int) [4]byte {
-	var mask [4]byte
-	copy(mask[:], net.CIDRMask(bits, 32))
-	return mask
-}
-
-func prefixMask6(bits int) [16]byte {
-	var mask [16]byte
-	copy(mask[:], net.CIDRMask(bits, 128))
-	return mask
-}

proxy/tun/tun_darwin_test.go

@@ -1,49 +0,0 @@
-//go:build darwin
-
-package tun
-
-import (
-	"testing"
-)
-
-func TestSelectDarwinGatewayDefault(t *testing.T) {
-	gateway, err := selectDarwinGateway(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := gateway.String(); got != defaultDarwinGateway {
-		t.Fatalf("unexpected default gateway: got %s, want %s", got, defaultDarwinGateway)
-	}
-}
-
-func TestSelectDarwinGatewayConfiguredIPv4(t *testing.T) {
-	gateway, err := selectDarwinGateway([]string{"198.18.0.1/15"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := gateway.String(); got != "198.18.0.1/15" {
-		t.Fatalf("unexpected gateway: got %s", got)
-	}
-}
-
-func TestSelectDarwinGatewaySkipsIPv6(t *testing.T) {
-	gateway, err := selectDarwinGateway([]string{"fc00::1/64", "198.18.0.1/15"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := gateway.String(); got != "198.18.0.1/15" {
-		t.Fatalf("unexpected gateway: got %s", got)
-	}
-}
-
-func TestSelectDarwinGatewayRequiresIPv4(t *testing.T) {
-	if _, err := selectDarwinGateway([]string{"fc00::1/64"}); err == nil {
-		t.Fatal("expected error")
-	}
-}
-
-func TestSelectDarwinGatewayRequiresUsableLocalAddress(t *testing.T) {
-	if _, err := selectDarwinGateway([]string{"198.18.0.1/32"}); err == nil {
-		t.Fatal("expected error")
-	}
-}

proxy/tun/tun_default.go

@@ -42,17 +42,3 @@ func (t *DefaultTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(string, string, uintptr, *net.Interface) error {
 	return errors.New("Tun is not supported on your platform")
 }
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	if fixedName == "" {
-		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
-	}
-	iface, err := net.InterfaceByName(fixedName)
-	if err != nil {
-		return nil, err
-	}
-	if iface.Index == tunIndex {
-		return nil, errors.New("outbound interface cannot be the TUN interface")
-	}
-	return iface, nil
-}

proxy/tun/tun_freebsd.go

@@ -147,17 +147,3 @@ func (t *FreeBSDTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return nil
 }
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	if fixedName == "" {
-		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
-	}
-	iface, err := net.InterfaceByName(fixedName)
-	if err != nil {
-		return nil, err
-	}
-	if iface.Index == tunIndex {
-		return nil, errors.New("outbound interface cannot be the TUN interface")
-	}
-	return iface, nil
-}

proxy/tun/tun_linux.go

@@ -3,11 +3,8 @@
 package tun
 
 import (
-	"context"
 	"net"
-	"net/netip"
 	"strconv"
-	"sync"
 
 	"github.com/vishvananda/netlink"
 	"github.com/xtls/xray-core/common/errors"
@@ -25,11 +22,6 @@ type LinuxTun struct {
 	tunLink netlink.Link
 	options *Config
 	ownsTun bool
-
-	interfaceAddresses []netlink.Addr
-	systemRoutes       []netlink.Route
-	routeMonitorStop   chan struct{}
-	routeMonitorOnce   sync.Once
 }
 
 // LinuxTun implements Tun
@@ -169,40 +161,16 @@ func (t *LinuxTun) Start() error {
 		return nil
 	}
 
-	if err := netlink.LinkSetUp(t.tunLink); err != nil {
+	err := netlink.LinkSetUp(t.tunLink)
+	if err != nil {
 		return err
 	}
 
-	if err := t.setInterfaceAddresses(); err != nil {
-		_ = netlink.LinkSetDown(t.tunLink)
-		return err
-	}
-
-	if err := t.setSystemRoutes(); err != nil {
-		_ = t.unsetInterfaceAddresses()
-		_ = netlink.LinkSetDown(t.tunLink)
-		return err
-	}
-
-	if updater != nil {
-		t.routeMonitorStop = make(chan struct{})
-		go t.monitorRouteChanges()
-	}
-
 	return nil
 }
 
 // Close is called to shut down the tun interface
 func (t *LinuxTun) Close() error {
-	t.routeMonitorOnce.Do(func() {
-		if t.routeMonitorStop != nil {
-			close(t.routeMonitorStop)
-		}
-	})
-
-	_ = t.unsetSystemRoutes()
-	_ = t.unsetInterfaceAddresses()
-
 	if t.ownsTun {
 		_ = netlink.LinkSetDown(t.tunLink)
 	}
@@ -231,176 +199,3 @@ func (t *LinuxTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }
-
-func (t *LinuxTun) setInterfaceAddresses() error {
-	if len(t.options.Gateway) == 0 {
-		return nil
-	}
-	for _, address := range t.options.Gateway {
-		addr, err := netlink.ParseAddr(address)
-		if err != nil {
-			_ = t.unsetInterfaceAddresses()
-			return errors.New("invalid interface address ", address).Base(err)
-		}
-		if err := netlink.AddrAdd(t.tunLink, addr); err != nil {
-			_ = t.unsetInterfaceAddresses()
-			return errors.New("failed to add interface address ", address).Base(err)
-		}
-		t.interfaceAddresses = append(t.interfaceAddresses, *addr)
-	}
-	return nil
-}
-
-func (t *LinuxTun) unsetInterfaceAddresses() error {
-	var errs []error
-	for i := len(t.interfaceAddresses) - 1; i >= 0; i-- {
-		address := t.interfaceAddresses[i]
-		if err := netlink.AddrDel(t.tunLink, &address); err != nil {
-			errs = append(errs, errors.New("failed to delete interface address ", address.String()).Base(err))
-		}
-	}
-	t.interfaceAddresses = nil
-	return errors.Combine(errs...)
-}
-
-func (t *LinuxTun) setSystemRoutes() error {
-	if len(t.options.AutoSystemRoutingTable) == 0 {
-		return nil
-	}
-	tunIndex := t.tunLink.Attrs().Index
-	for _, cidr := range t.options.AutoSystemRoutingTable {
-		prefix, err := netip.ParsePrefix(cidr)
-		if err != nil {
-			return errors.New("invalid system route ", cidr).Base(err)
-		}
-		prefix = prefix.Masked()
-		_, ipNet, _ := net.ParseCIDR(prefix.String())
-		route := netlink.Route{
-			LinkIndex: tunIndex,
-			Dst:       ipNet,
-			Priority:  1,
-		}
-		if err := netlink.RouteAdd(&route); err != nil {
-			_ = t.unsetSystemRoutes()
-			return errors.New("failed to add system route ", cidr).Base(err)
-		}
-		t.systemRoutes = append(t.systemRoutes, route)
-	}
-	return nil
-}
-
-func (t *LinuxTun) unsetSystemRoutes() error {
-	var errs []error
-	for i := len(t.systemRoutes) - 1; i >= 0; i-- {
-		route := t.systemRoutes[i]
-		if err := netlink.RouteDel(&route); err != nil {
-			errs = append(errs, errors.New("failed to delete system route").Base(err))
-		}
-	}
-	t.systemRoutes = nil
-	return errors.Combine(errs...)
-}
-
-func (t *LinuxTun) monitorRouteChanges() {
-	routeCh := make(chan netlink.RouteUpdate)
-	if err := netlink.RouteSubscribe(routeCh, t.routeMonitorStop); err != nil {
-		errors.LogInfoInner(context.Background(), err, "[tun] failed to subscribe route changes")
-		return
-	}
-
-	linkCh := make(chan netlink.LinkUpdate)
-	if err := netlink.LinkSubscribe(linkCh, t.routeMonitorStop); err != nil {
-		errors.LogInfoInner(context.Background(), err, "[tun] failed to subscribe link changes")
-		return
-	}
-
-	for {
-		select {
-		case _, ok := <-routeCh:
-			if !ok {
-				return
-			}
-			if updater != nil {
-				updater.Update()
-			}
-		case _, ok := <-linkCh:
-			if !ok {
-				return
-			}
-			if updater != nil {
-				updater.Update()
-			}
-		case <-t.routeMonitorStop:
-			return
-		}
-	}
-}
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	if fixedName != "" {
-		iface, err := net.InterfaceByName(fixedName)
-		if err != nil {
-			return nil, err
-		}
-		if iface.Index == tunIndex {
-			return nil, errors.New("outbound interface cannot be the TUN interface")
-		}
-		return iface, nil
-	}
-
-	for _, family := range []int{
-		netlink.FAMILY_V4,
-		netlink.FAMILY_V6,
-	} {
-		iface, err := findDefaultInterface(family, tunIndex)
-		if err == nil {
-			return iface, nil
-		}
-	}
-
-	return nil, errors.New("no usable outbound interface found")
-}
-
-func findDefaultInterface(family int, tunIndex int) (*net.Interface, error) {
-	routes, err := netlink.RouteList(nil, family)
-	if err != nil {
-		return nil, err
-	}
-
-	var selected *net.Interface
-	selectedMetric := -1
-
-	for _, route := range routes {
-		if route.Dst != nil {
-			ones, _ := route.Dst.Mask.Size()
-			if ones != 0 {
-				continue
-			}
-		}
-
-		if route.LinkIndex == 0 || route.LinkIndex == tunIndex {
-			continue
-		}
-
-		iface, err := net.InterfaceByIndex(route.LinkIndex)
-		if err != nil {
-			continue
-		}
-
-		if iface.Flags&net.FlagUp == 0 ||
-			iface.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-
-		if selected == nil || route.Priority < selectedMetric {
-			selected = iface
-			selectedMetric = route.Priority
-		}
-	}
-
-	if selected == nil {
-		return nil, errors.New("physical default route not found")
-	}
-
-	return selected, nil
-}

proxy/tun/tun_windows.go

@@ -8,8 +8,6 @@ import (
 	go_errors "errors"
 	"net"
 	"net/netip"
-	"sort"
-	"strings"
 	"sync"
 	"unsafe"
 
@@ -50,7 +48,7 @@ var _ GVisorDevice = (*WindowsTun)(nil)
 // interface with the same name exist, it tried to be reused.
 func NewTun(options *Config) (Tun, error) {
 	// instantiate wintun adapter
-	adapter, err := open(options.Name, options.Desc)
+	adapter, err := open(options.Name)
 	if err != nil {
 		return nil, err
 	}
@@ -73,12 +71,12 @@ func NewTun(options *Config) (Tun, error) {
 	return tun, nil
 }
 
-func open(name, desc string) (*wintun.Adapter, error) {
+func open(name string) (*wintun.Adapter, error) {
 	// generate a deterministic GUID from the adapter name
 	id := md5.Sum([]byte(name))
 	guid := (*windows.GUID)(unsafe.Pointer(&id[0]))
 	// try to create adapter anew
-	adapter, err := wintun.CreateAdapter(name, desc, guid)
+	adapter, err := wintun.CreateAdapter(name, "Xray", guid)
 	if err == nil {
 		return adapter, nil
 	}
@@ -309,77 +307,3 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 
 	return errors.Combine(err1, err2, err3, err4)
 }
-
-func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		return nil, err
-	}
-
-	if fixedName != "" {
-		for _, iface := range interfaces {
-			if iface.Index != tunIndex && iface.Name == fixedName {
-				return &iface, nil
-			}
-		}
-		return nil, nil
-	}
-
-	var candidates []struct {
-		index int
-		score int
-	}
-	for i, iface := range interfaces {
-		if iface.Index == tunIndex {
-			continue
-		}
-		if strings.Contains(iface.Name, "vEthernet") {
-			continue
-		}
-		if iface.Flags&net.FlagUp == 0 {
-			continue
-		}
-		if iface.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-		addrs, err := iface.Addrs()
-		if err != nil || len(addrs) == 0 {
-			continue
-		}
-		candidates = append(candidates, struct {
-			index int
-			score int
-		}{i, scoreWindowsInterface(&iface, addrs)})
-	}
-
-	sort.Slice(candidates, func(i, j int) bool {
-		if candidates[i].score != candidates[j].score {
-			return candidates[i].score > candidates[j].score
-		}
-		return interfaces[candidates[i].index].Name < interfaces[candidates[j].index].Name
-	})
-	if len(candidates) == 0 {
-		return nil, nil
-	}
-
-	iface := interfaces[candidates[0].index]
-	return &iface, nil
-}
-
-func scoreWindowsInterface(iface *net.Interface, addrs []net.Addr) int {
-	score := 0
-
-	name := strings.ToLower(iface.Name)
-	if strings.Contains(name, "wlan") || strings.Contains(name, "wi-fi") {
-		score += 2
-	}
-
-	for _, addr := range addrs {
-		if strings.HasPrefix(addr.String(), "192.168.") {
-			score++
-			break
-		}
-	}
-
-	return score
-}

proxy/vmess/encoding/auth.go

@@ -17,6 +17,27 @@ func Authenticate(b []byte) uint32 {
 	return fnv1hash.Sum32()
 }
 
+// [DEPRECATED 2023-06]
+type NoOpAuthenticator struct{}
+
+func (NoOpAuthenticator) NonceSize() int {
+	return 0
+}
+
+func (NoOpAuthenticator) Overhead() int {
+	return 0
+}
+
+// Seal implements AEAD.Seal().
+func (NoOpAuthenticator) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
+	return append(dst[:0], plaintext...)
+}
+
+// Open implements AEAD.Open().
+func (NoOpAuthenticator) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
+	return append(dst[:0], ciphertext...), nil
+}
+
 // GenerateChacha20Poly1305Key generates a 32-byte key from a given 16-byte array.
 func GenerateChacha20Poly1305Key(b []byte) []byte {
 	key := make([]byte, 32)

proxy/vmess/encoding/client.go

@@ -116,6 +116,20 @@ func (c *ClientSession) EncodeRequestBody(request *protocol.RequestHeader, write
 	}
 
 	switch request.Security {
+	case protocol.SecurityType_NONE:
+		if request.Option.Has(protocol.RequestOptionChunkStream) {
+			if request.Command.TransferType() == protocol.TransferTypeStream {
+				return crypto.NewChunkStreamWriter(sizeParser, writer), nil
+			}
+			auth := &crypto.AEADAuthenticator{
+				AEAD:                    new(NoOpAuthenticator),
+				NonceGenerator:          crypto.GenerateEmptyBytes(),
+				AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
+			}
+			return crypto.NewAuthenticationWriter(auth, sizeParser, writer, protocol.TransferTypePacket, padding), nil
+		}
+
+		return buf.NewWriter(writer), nil
 	case protocol.SecurityType_AES128_GCM:
 		aead := crypto.NewAesGcm(c.requestBodyKey[:])
 		auth := &crypto.AEADAuthenticator{
@@ -253,6 +267,22 @@ func (c *ClientSession) DecodeResponseBody(request *protocol.RequestHeader, read
 	}
 
 	switch request.Security {
+	case protocol.SecurityType_NONE:
+		if request.Option.Has(protocol.RequestOptionChunkStream) {
+			if request.Command.TransferType() == protocol.TransferTypeStream {
+				return crypto.NewChunkStreamReader(sizeParser, reader), nil
+			}
+
+			auth := &crypto.AEADAuthenticator{
+				AEAD:                    new(NoOpAuthenticator),
+				NonceGenerator:          crypto.GenerateEmptyBytes(),
+				AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
+			}
+
+			return crypto.NewAuthenticationReader(auth, sizeParser, reader, protocol.TransferTypePacket, padding), nil
+		}
+
+		return buf.NewReader(reader), nil
 	case protocol.SecurityType_AES128_GCM:
 		aead := crypto.NewAesGcm(c.responseBodyKey[:])
 

proxy/vmess/encoding/server.go

@@ -262,6 +262,21 @@ func (s *ServerSession) DecodeRequestBody(request *protocol.RequestHeader, reade
 	}
 
 	switch request.Security {
+	case protocol.SecurityType_NONE:
+		if request.Option.Has(protocol.RequestOptionChunkStream) {
+			if request.Command.TransferType() == protocol.TransferTypeStream {
+				return crypto.NewChunkStreamReader(sizeParser, reader), nil
+			}
+
+			auth := &crypto.AEADAuthenticator{
+				AEAD:                    new(NoOpAuthenticator),
+				NonceGenerator:          crypto.GenerateEmptyBytes(),
+				AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
+			}
+			return crypto.NewAuthenticationReader(auth, sizeParser, reader, protocol.TransferTypePacket, padding), nil
+		}
+		return buf.NewReader(reader), nil
+
 	case protocol.SecurityType_AES128_GCM:
 		aead := crypto.NewAesGcm(s.requestBodyKey[:])
 		auth := &crypto.AEADAuthenticator{
@@ -369,6 +384,21 @@ func (s *ServerSession) EncodeResponseBody(request *protocol.RequestHeader, writ
 	}
 
 	switch request.Security {
+	case protocol.SecurityType_NONE:
+		if request.Option.Has(protocol.RequestOptionChunkStream) {
+			if request.Command.TransferType() == protocol.TransferTypeStream {
+				return crypto.NewChunkStreamWriter(sizeParser, writer), nil
+			}
+
+			auth := &crypto.AEADAuthenticator{
+				AEAD:                    new(NoOpAuthenticator),
+				NonceGenerator:          crypto.GenerateEmptyBytes(),
+				AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
+			}
+			return crypto.NewAuthenticationWriter(auth, sizeParser, writer, protocol.TransferTypePacket, padding), nil
+		}
+		return buf.NewWriter(writer), nil
+
 	case protocol.SecurityType_AES128_GCM:
 		aead := crypto.NewAesGcm(s.responseBodyKey[:])
 		auth := &crypto.AEADAuthenticator{

proxy/vmess/outbound/outbound.go

@@ -5,7 +5,6 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"hash/crc64"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common"
@@ -106,7 +105,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	account := request.User.Account.(*vmess.MemoryAccount)
 	request.Security = account.Security
 
-	if request.Security == protocol.SecurityType_AES128_GCM || request.Security == protocol.SecurityType_CHACHA20_POLY1305 {
+	if request.Security == protocol.SecurityType_AES128_GCM || request.Security == protocol.SecurityType_NONE || request.Security == protocol.SecurityType_CHACHA20_POLY1305 {
 		request.Option.Set(protocol.RequestOptionChunkMasking)
 	}
 
@@ -114,6 +113,12 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		request.Option.Set(protocol.RequestOptionGlobalPadding)
 	}
 
+	if request.Security == protocol.SecurityType_ZERO {
+		request.Security = protocol.SecurityType_NONE
+		request.Option.Clear(protocol.RequestOptionChunkStream)
+		request.Option.Clear(protocol.RequestOptionChunkMasking)
+	}
+
 	if account.AuthenticatedLengthExperiment {
 		request.Option.Set(protocol.RequestOptionAuthenticatedLength)
 	}
@@ -219,17 +224,10 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	return nil
 }
 
-var enablePadding atomic.Bool
+var enablePadding = false
 
 func shouldEnablePadding(s protocol.SecurityType) bool {
-	return enablePadding.Load() || s == protocol.SecurityType_AES128_GCM || s == protocol.SecurityType_CHACHA20_POLY1305 || s == protocol.SecurityType_AUTO
-}
-
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	paddingValue := platform.NewEnvFlag(platform.UseVmessPadding).GetValue(func() string { return defaultFlagValue })
-	enablePadding.Store(paddingValue != defaultFlagValue)
-	return nil
+	return enablePadding || s == protocol.SecurityType_AES128_GCM || s == protocol.SecurityType_CHACHA20_POLY1305 || s == protocol.SecurityType_AUTO
 }
 
 func init() {
@@ -237,5 +235,10 @@ func init() {
 		return New(ctx, config.(*Config))
 	}))
 
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+
+	paddingValue := platform.NewEnvFlag(platform.UseVmessPadding).GetValue(func() string { return defaultFlagValue })
+	if paddingValue != defaultFlagValue {
+		enablePadding = true
+	}
 }

proxy/wireguard/client.go

@@ -57,7 +57,7 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -65,7 +65,7 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}
@@ -139,7 +139,13 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	ob.Name = "wireguard"
 	ob.CanSpliceCopy = 3
 
-	if err := h.init(ctx); err != nil {
+	if h.dev == nil {
+		if err := h.init(ctx); err != nil {
+			return err
+		}
+	}
+
+	if err := h.dev.Up(); err != nil {
 		return err
 	}
 
@@ -252,11 +258,8 @@ func (h *Handler) Close() (err error) {
 func (h *Handler) init(ctx context.Context) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if h.tun == nil {
-		return errors.New("closed")
-	}
 	if h.dev != nil {
-		return h.dev.Up()
+		return nil
 	}
 	resolveFunc := h.resolveLocal
 	listenFunc := func() (net.PacketConn, error) {

proxy/wireguard/config.go

@@ -1,60 +1 @@
 package wireguard
-
-import (
-	"encoding/hex"
-	"net/netip"
-
-	"github.com/xtls/xray-core/common/protocol"
-	"google.golang.org/protobuf/proto"
-)
-
-func (p *PeerConfig) AsAccount() (protocol.Account, error) {
-	pub, err := ParseKey(p.PublicKey)
-	if err != nil {
-		return nil, err
-	}
-
-	allowedIPs := make([]netip.Prefix, 0, len(p.AllowedIps))
-	for i := range p.AllowedIps {
-		p, err := netip.ParsePrefix(p.AllowedIps[i])
-		if err != nil {
-			return nil, err
-		}
-		allowedIPs = append(allowedIPs, p)
-	}
-
-	return &MemoryAccount{
-		Pub:          *pub,
-		AllowedIPs:   allowedIPs,
-		PreSharedKey: p.PreSharedKey,
-		KeepAlive:    p.KeepAlive,
-	}, nil
-}
-
-type MemoryAccount struct {
-	Pub          [32]byte
-	AllowedIPs   []netip.Prefix
-	PreSharedKey string
-	KeepAlive    string
-}
-
-func (a *MemoryAccount) Equals(other protocol.Account) bool {
-	if b, ok := other.(*MemoryAccount); ok {
-		return a.Pub == b.Pub
-	}
-	return false
-}
-
-func (a *MemoryAccount) ToProto() proto.Message {
-	allowedIPs := make([]string, 0, len(a.AllowedIPs))
-	for i := range a.AllowedIPs {
-		allowedIPs = append(allowedIPs, a.AllowedIPs[i].String())
-	}
-
-	return &PeerConfig{
-		PublicKey:    hex.EncodeToString(a.Pub[:]),
-		AllowedIps:   allowedIPs,
-		PreSharedKey: a.PreSharedKey,
-		KeepAlive:    a.KeepAlive,
-	}
-}

proxy/wireguard/config.pb.go

@@ -7,7 +7,6 @@
 package wireguard
 
 import (
-	protocol "github.com/xtls/xray-core/common/protocol"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -158,7 +157,6 @@ type DeviceConfig struct {
 	SecretKey      string                      `protobuf:"bytes,1,opt,name=secret_key,json=secretKey,proto3" json:"secret_key,omitempty"`
 	Endpoint       []string                    `protobuf:"bytes,2,rep,name=endpoint,proto3" json:"endpoint,omitempty"`
 	Peers          []*PeerConfig               `protobuf:"bytes,3,rep,name=peers,proto3" json:"peers,omitempty"`
-	Users          []*protocol.User            `protobuf:"bytes,5,rep,name=users,proto3" json:"users,omitempty"`
 	Mtu            int32                       `protobuf:"varint,4,opt,name=mtu,proto3" json:"mtu,omitempty"`
 	Reserved       []byte                      `protobuf:"bytes,6,opt,name=reserved,proto3" json:"reserved,omitempty"`
 	DomainStrategy DeviceConfig_DomainStrategy `protobuf:"varint,7,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.proxy.wireguard.DeviceConfig_DomainStrategy" json:"domain_strategy,omitempty"`
@@ -219,13 +217,6 @@ func (x *DeviceConfig) GetPeers() []*PeerConfig {
 	return nil
 }
 
-func (x *DeviceConfig) GetUsers() []*protocol.User {
-	if x != nil {
-		return x.Users
-	}
-	return nil
-}
-
 func (x *DeviceConfig) GetMtu() int32 {
 	if x != nil {
 		return x.Mtu
@@ -265,7 +256,7 @@ var File_proxy_wireguard_config_proto protoreflect.FileDescriptor
 
 const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1cproxy/wireguard/config.proto\x12\x14xray.proxy.wireguard\x1a\x1acommon/protocol/user.proto\"\xad\x01\n" +
+	"\x1cproxy/wireguard/config.proto\x12\x14xray.proxy.wireguard\"\xad\x01\n" +
 	"\n" +
 	"PeerConfig\x12\x1d\n" +
 	"\n" +
@@ -275,13 +266,12 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
 	"keep_alive\x18\x04 \x01(\tR\tkeepAlive\x12\x1f\n" +
 	"\vallowed_ips\x18\x05 \x03(\tR\n" +
-	"allowedIps\"\xdc\x03\n" +
+	"allowedIps\"\xaa\x03\n" +
 	"\fDeviceConfig\x12\x1d\n" +
 	"\n" +
 	"secret_key\x18\x01 \x01(\tR\tsecretKey\x12\x1a\n" +
 	"\bendpoint\x18\x02 \x03(\tR\bendpoint\x126\n" +
-	"\x05peers\x18\x03 \x03(\v2 .xray.proxy.wireguard.PeerConfigR\x05peers\x120\n" +
-	"\x05users\x18\x05 \x03(\v2\x1a.xray.common.protocol.UserR\x05users\x12\x10\n" +
+	"\x05peers\x18\x03 \x03(\v2 .xray.proxy.wireguard.PeerConfigR\x05peers\x12\x10\n" +
 	"\x03mtu\x18\x04 \x01(\x05R\x03mtu\x12\x1a\n" +
 	"\breserved\x18\x06 \x01(\fR\breserved\x12Z\n" +
 	"\x0fdomain_strategy\x18\a \x01(\x0e21.xray.proxy.wireguard.DeviceConfig.DomainStrategyR\x0edomainStrategy\x12\x1b\n" +
@@ -315,17 +305,15 @@ var file_proxy_wireguard_config_proto_goTypes = []any{
 	(DeviceConfig_DomainStrategy)(0), // 0: xray.proxy.wireguard.DeviceConfig.DomainStrategy
 	(*PeerConfig)(nil),               // 1: xray.proxy.wireguard.PeerConfig
 	(*DeviceConfig)(nil),             // 2: xray.proxy.wireguard.DeviceConfig
-	(*protocol.User)(nil),            // 3: xray.common.protocol.User
 }
 var file_proxy_wireguard_config_proto_depIdxs = []int32{
 	1, // 0: xray.proxy.wireguard.DeviceConfig.peers:type_name -> xray.proxy.wireguard.PeerConfig
-	3, // 1: xray.proxy.wireguard.DeviceConfig.users:type_name -> xray.common.protocol.User
-	0, // 2: xray.proxy.wireguard.DeviceConfig.domain_strategy:type_name -> xray.proxy.wireguard.DeviceConfig.DomainStrategy
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	0, // 1: xray.proxy.wireguard.DeviceConfig.domain_strategy:type_name -> xray.proxy.wireguard.DeviceConfig.DomainStrategy
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_proxy_wireguard_config_proto_init() }

proxy/wireguard/config.proto

@@ -6,8 +6,6 @@ option go_package = "github.com/xtls/xray-core/proxy/wireguard";
 option java_package = "com.xray.proxy.wireguard";
 option java_multiple_files = true;
 
-import "common/protocol/user.proto";
-
 message PeerConfig {
   string public_key = 1;
   string pre_shared_key = 2;
@@ -27,7 +25,6 @@ message DeviceConfig {
   string secret_key = 1;
   repeated string endpoint = 2;
   repeated PeerConfig peers = 3;
-  repeated xray.common.protocol.User users = 5;
   int32 mtu = 4;
 
   bytes reserved = 6;

proxy/wireguard/server.go

@@ -2,20 +2,16 @@ package wireguard
 
 import (
 	"context"
-	"encoding/hex"
 	"fmt"
 	"net/netip"
-	"reflect"
 	"strings"
 	"sync"
 
-	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	c "github.com/xtls/xray-core/common/ctx"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
@@ -24,7 +20,6 @@ import (
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
-	"golang.org/x/crypto/curve25519"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
@@ -47,9 +42,6 @@ type Server struct {
 	stack *stack.Stack
 	dev   *device.Device
 	mu    sync.Mutex
-
-	pub   [32]byte
-	users *sync.Map
 }
 
 func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
@@ -66,7 +58,7 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -74,12 +66,21 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}
 	}
 
+	if len(conf.Peers) == 0 {
+		return nil, errors.New("empty peers")
+	}
+	for _, peer := range conf.Peers {
+		if peer.PublicKey == "" {
+			return nil, errors.New("peer without publickey")
+		}
+	}
+
 	localAddresses := make([]netip.Addr, 0, len(conf.Endpoint))
 	for _, localaddress := range conf.Endpoint {
 		addr, err := netip.ParseAddr(localaddress)
@@ -100,19 +101,6 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 		return nil, err
 	}
 
-	pri := common.Must2(ParseKey(conf.SecretKey))
-	var pub [32]byte
-	curve25519.ScalarBaseMult(&pub, pri)
-
-	users := &sync.Map{}
-	for _, u := range conf.Users {
-		user, err := u.ToMemoryUser()
-		if err != nil {
-			return nil, err
-		}
-		users.Store(user.Account.(*MemoryAccount).Pub, user)
-	}
-
 	return &Server{
 		conf:          conf,
 		ctx:           core.ToBackgroundDetachedContext(ctx),
@@ -128,100 +116,9 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 
 		tun:   tun,
 		stack: stack,
-
-		pub:   pub,
-		users: users,
 	}, nil
 }
 
-func (s *Server) AddUser(ctx context.Context, user *protocol.MemoryUser) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.dev == nil {
-		return errors.New("too early")
-	}
-	peer := user.Account.(*MemoryAccount)
-	if peer.Pub == s.pub {
-		return errors.New("invalid public key")
-	}
-	var sb strings.Builder
-	sb.WriteString("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\n")
-	sb.WriteString("replace_allowed_ips=true\n")
-	for i := range peer.AllowedIPs {
-		sb.WriteString("allowed_ip=" + peer.AllowedIPs[i].String() + "\n")
-	}
-	if peer.PreSharedKey != "" {
-		sb.WriteString("preshared_key=" + peer.PreSharedKey + "\n")
-	}
-	if peer.KeepAlive != "" {
-		sb.WriteString("persistent_keepalive_interval=" + peer.KeepAlive + "\n")
-	}
-	err := s.dev.IpcSet(sb.String())
-	if err != nil {
-		return err
-	}
-	s.users.Store(peer.Pub, user)
-	return nil
-}
-
-func (s *Server) RemoveUser(ctx context.Context, email string) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.dev == nil {
-		return errors.New("too early")
-	}
-	if user := s.GetUser(ctx, email); user != nil {
-		peer := user.Account.(*MemoryAccount)
-		err := s.dev.IpcSet("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\nremove=true\n")
-		if err != nil {
-			return err
-		}
-		s.users.Delete(peer.Pub)
-	}
-	return nil
-}
-
-func (s *Server) GetUser(ctx context.Context, email string) (user *protocol.MemoryUser) {
-	s.users.Range(func(key, value any) bool {
-		if value.(*protocol.MemoryUser).Email == email {
-			user = value.(*protocol.MemoryUser)
-			return false
-		}
-		return true
-	})
-	return
-}
-
-func (s *Server) GetUserByAddr(ctx context.Context, addr netip.Addr) (user *protocol.MemoryUser) {
-	s.users.Range(func(key, value any) bool {
-		peer := value.(*protocol.MemoryUser).Account.(*MemoryAccount)
-		for i := range peer.AllowedIPs {
-			if peer.AllowedIPs[i].Contains(addr) {
-				user = value.(*protocol.MemoryUser)
-				return false
-			}
-		}
-		return true
-	})
-	return
-}
-
-func (s *Server) GetUsers(ctx context.Context) (users []*protocol.MemoryUser) {
-	s.users.Range(func(key, value interface{}) bool {
-		users = append(users, value.(*protocol.MemoryUser))
-		return true
-	})
-	return
-}
-
-func (s *Server) GetUsersCount(context.Context) (count int64) {
-	s.users.Range(func(key, value interface{}) bool {
-		count++
-		return true
-	})
-	return
-}
-
 // Network implements proxy.Inbound.Network.
 func (*Server) Network() []net.Network {
 	return []net.Network{}
@@ -299,20 +196,18 @@ func (s *Server) Start() error {
 	dev := device.NewDevice(s.tun, bind, logger)
 	var cfg strings.Builder
 	cfg.WriteString("private_key=" + s.conf.SecretKey + "\n")
-	s.users.Range(func(key, value any) bool {
-		peer := value.(*protocol.MemoryUser).Account.(*MemoryAccount)
-		cfg.WriteString("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\n")
-		for i := range peer.AllowedIPs {
-			cfg.WriteString("allowed_ip=" + peer.AllowedIPs[i].String() + "\n")
-		}
+	for _, peer := range s.conf.Peers {
+		cfg.WriteString("public_key=" + peer.PublicKey + "\n")
 		if peer.PreSharedKey != "" {
 			cfg.WriteString("preshared_key=" + peer.PreSharedKey + "\n")
 		}
+		for _, ip := range peer.AllowedIps {
+			cfg.WriteString("allowed_ip=" + ip + "\n")
+		}
 		if peer.KeepAlive != "" {
 			cfg.WriteString("persistent_keepalive_interval=" + peer.KeepAlive + "\n")
 		}
-		return true
-	})
+	}
 	err := dev.IpcSet(cfg.String())
 	if err != nil {
 		return err
@@ -332,36 +227,12 @@ func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
 	defer cancel()
 	ctx = c.ContextWithID(ctx, session.NewID())
 
-	remote := conn.RemoteAddr()
-	if remote == nil {
-		errors.LogError(context.Background(), "nil remote")
-		return
-	}
-
-	var addr netip.Addr
-	switch v := remote.(type) {
-	case *net.TCPAddr:
-		addr, _ = netip.AddrFromSlice(v.IP)
-	case *net.UDPAddr:
-		addr, _ = netip.AddrFromSlice(v.IP)
-	default:
-		errors.LogError(context.Background(), "invalid addr type ", reflect.TypeOf(v))
-		return
-	}
-
-	user := s.GetUserByAddr(context.TODO(), addr)
-	if user == nil {
-		errors.LogError(context.Background(), "nil user form ", remote, " to ", dest)
-		return
-	}
-
-	source := net.DestinationFromAddr(remote)
+	source := net.DestinationFromAddr(conn.RemoteAddr())
 	inbound := session.Inbound{
 		Name:          "wireguard",
 		Tag:           s.tag,
 		CanSpliceCopy: 3,
 		Source:        source,
-		User:          user,
 	}
 
 	ctx = session.ContextWithInbound(ctx, &inbound)
@@ -386,14 +257,3 @@ func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
 		errors.LogError(ctx, errors.New("connection closed").Base(err))
 	}
 }
-
-func ParseKey(str string) (*[32]byte, error) {
-	slice, err := hex.DecodeString(str)
-	if err != nil {
-		return nil, err
-	}
-	if len(slice) != 32 {
-		return nil, errors.New("len(slice) != 32")
-	}
-	return (*[32]byte)(slice), nil
-}

testing/scenarios/shadowsocks_test.go

@@ -390,3 +390,88 @@ func TestShadowsocksAES128GCMUDPMux(t *testing.T) {
 		t.Error(err)
 	}
 }
+
+func TestShadowsocksNone(t *testing.T) {
+	tcpServer := tcp.Server{
+		MsgProcessor: xor,
+	}
+	dest, err := tcpServer.Start()
+	common.Must(err)
+
+	defer tcpServer.Close()
+
+	account := serial.ToTypedMessage(&shadowsocks.Account{
+		Password:   "shadowsocks-password",
+		CipherType: shadowsocks.CipherType_NONE,
+	})
+
+	serverPort := tcp.PickPort()
+	serverConfig := &core.Config{
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(serverPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&shadowsocks.ServerConfig{
+					Users: []*protocol.User{{
+						Account: account,
+						Level:   1,
+					}},
+					Network: []net.Network{net.Network_TCP},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&freedom.Config{
+					FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}},
+				}),
+			},
+		},
+	}
+
+	clientPort := tcp.PickPort()
+	clientConfig := &core.Config{
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(clientPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&dokodemo.Config{
+					RewriteAddress:  net.NewIPOrDomain(dest.Address),
+					RewritePort:     uint32(dest.Port),
+					AllowedNetworks: []net.Network{net.Network_TCP},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
+					Server: &protocol.ServerEndpoint{
+						Address: net.NewIPOrDomain(net.LocalHostIP),
+						Port:    uint32(serverPort),
+						User: &protocol.User{
+							Account: account,
+						},
+					},
+				}),
+			},
+		},
+	}
+
+	servers, err := InitializeServerConfigs(serverConfig, clientConfig)
+	common.Must(err)
+
+	defer CloseAllServers(servers)
+
+	var errGroup errgroup.Group
+	for range 3 {
+		errGroup.Go(testTCPConn(clientPort, 10240*1024, time.Second*20))
+	}
+
+	if err := errGroup.Wait(); err != nil {
+		t.Fatal(err)
+	}
+}

testing/scenarios/vmess_test.go

@@ -423,6 +423,103 @@ func TestVMessChacha20(t *testing.T) {
 	}
 }
 
+func TestVMessNone(t *testing.T) {
+	tcpServer := tcp.Server{
+		MsgProcessor: xor,
+	}
+	dest, err := tcpServer.Start()
+	common.Must(err)
+	defer tcpServer.Close()
+
+	userID := protocol.NewID(uuid.New())
+	serverPort := tcp.PickPort()
+	serverConfig := &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&log.Config{
+				ErrorLogLevel: clog.Severity_Debug,
+				ErrorLogType:  log.LogType_Console,
+			}),
+		},
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(serverPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&inbound.Config{
+					User: []*protocol.User{
+						{
+							Account: serial.ToTypedMessage(&vmess.Account{
+								Id: userID.String(),
+							}),
+						},
+					},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&freedom.Config{
+					FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}},
+				}),
+			},
+		},
+	}
+
+	clientPort := tcp.PickPort()
+	clientConfig := &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&log.Config{
+				ErrorLogLevel: clog.Severity_Debug,
+				ErrorLogType:  log.LogType_Console,
+			}),
+		},
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(clientPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&dokodemo.Config{
+					RewriteAddress:  net.NewIPOrDomain(dest.Address),
+					RewritePort:     uint32(dest.Port),
+					AllowedNetworks: []net.Network{net.Network_TCP},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&outbound.Config{
+					Receiver: &protocol.ServerEndpoint{
+						Address: net.NewIPOrDomain(net.LocalHostIP),
+						Port:    uint32(serverPort),
+						User: &protocol.User{
+							Account: serial.ToTypedMessage(&vmess.Account{
+								Id: userID.String(),
+								SecuritySettings: &protocol.SecurityConfig{
+									Type: protocol.SecurityType_NONE,
+								},
+							}),
+						},
+					},
+				}),
+			},
+		},
+	}
+
+	servers, err := InitializeServerConfigs(serverConfig, clientConfig)
+	common.Must(err)
+	defer CloseAllServers(servers)
+
+	var errg errgroup.Group
+	for range 3 {
+		errg.Go(testTCPConn(clientPort, 1024*1024, time.Second*30))
+	}
+	if err := errg.Wait(); err != nil {
+		t.Error(err)
+	}
+}
+
 func TestVMessKCP(t *testing.T) {
 	tcpServer := tcp.Server{
 		MsgProcessor: xor,
@@ -873,6 +970,103 @@ func TestVMessGCMMuxUDP(t *testing.T) {
 	}()
 }
 
+func TestVMessZero(t *testing.T) {
+	tcpServer := tcp.Server{
+		MsgProcessor: xor,
+	}
+	dest, err := tcpServer.Start()
+	common.Must(err)
+	defer tcpServer.Close()
+
+	userID := protocol.NewID(uuid.New())
+	serverPort := tcp.PickPort()
+	serverConfig := &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&log.Config{
+				ErrorLogLevel: clog.Severity_Debug,
+				ErrorLogType:  log.LogType_Console,
+			}),
+		},
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(serverPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&inbound.Config{
+					User: []*protocol.User{
+						{
+							Account: serial.ToTypedMessage(&vmess.Account{
+								Id: userID.String(),
+							}),
+						},
+					},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&freedom.Config{
+					FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}},
+				}),
+			},
+		},
+	}
+
+	clientPort := tcp.PickPort()
+	clientConfig := &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&log.Config{
+				ErrorLogLevel: clog.Severity_Debug,
+				ErrorLogType:  log.LogType_Console,
+			}),
+		},
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(clientPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&dokodemo.Config{
+					RewriteAddress:  net.NewIPOrDomain(dest.Address),
+					RewritePort:     uint32(dest.Port),
+					AllowedNetworks: []net.Network{net.Network_TCP},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&outbound.Config{
+					Receiver: &protocol.ServerEndpoint{
+						Address: net.NewIPOrDomain(net.LocalHostIP),
+						Port:    uint32(serverPort),
+						User: &protocol.User{
+							Account: serial.ToTypedMessage(&vmess.Account{
+								Id: userID.String(),
+								SecuritySettings: &protocol.SecurityConfig{
+									Type: protocol.SecurityType_ZERO,
+								},
+							}),
+						},
+					},
+				}),
+			},
+		},
+	}
+
+	servers, err := InitializeServerConfigs(serverConfig, clientConfig)
+	common.Must(err)
+	defer CloseAllServers(servers)
+
+	var errg errgroup.Group
+	for range 3 {
+		errg.Go(testTCPConn(clientPort, 1024*1024, time.Second*30))
+	}
+	if err := errg.Wait(); err != nil {
+		t.Error(err)
+	}
+}
+
 func TestVMessGCMLengthAuth(t *testing.T) {
 	tcpServer := tcp.Server{
 		MsgProcessor: xor,

transport/internet/browser_dialer/dialer.go

@@ -27,10 +27,9 @@ type task struct {
 }
 
 var (
-	conns       chan *websocket.Conn
-	server      *http.Server
-	currentAddr string
-	mu          sync.Mutex
+	conns  chan *websocket.Conn
+	server *http.Server
+	mu     sync.Mutex
 )
 
 var upgrader = &websocket.Upgrader{
@@ -48,13 +47,8 @@ func Reload() {
 	mu.Lock()
 	defer mu.Unlock()
 
-	if addr == currentAddr && (addr == "" || server != nil) {
-		return
-	}
-
 	if server != nil {
 		server.Close()
-		server = nil
 	}
 	if HasBrowserDialer() {
 		for len(conns) > 0 {
@@ -66,7 +60,6 @@ func Reload() {
 		}
 		conns = nil
 	}
-	currentAddr = addr
 	if addr != "" {
 		token := uuid.New()
 		csrfToken := token.String()
@@ -227,8 +220,5 @@ func CheckOK(conn *websocket.Conn) error {
 }
 
 func init() {
-	platform.RegisterEnvReload(func() error {
-		Reload()
-		return nil
-	})
+	Reload()
 }

transport/internet/finalmask/sudoku/sudoku_test.go

@@ -372,6 +372,7 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 							{
 								ProtocolName: "hysteria",
 								Settings: serial.ToTypedMessage(&hytransport.Config{
+									Version:        2,
 									Auth:           auth,
 									UdpIdleTimeout: 60,
 								}),
@@ -420,6 +421,7 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&hyproxy.ClientConfig{
+					Version: 2,
 					Server: &protocol.ServerEndpoint{
 						Address: xnet.NewIPOrDomain(xnet.LocalHostIP),
 						Port:    uint32(relayPort),
@@ -435,6 +437,7 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 							{
 								ProtocolName: "hysteria",
 								Settings: serial.ToTypedMessage(&hytransport.Config{
+									Version:        2,
 									Auth:           auth,
 									UdpIdleTimeout: 60,
 								}),

transport/internet/finalmask/xmc/cfb8.go

@@ -1,138 +0,0 @@
-package xmc
-
-// Copied from https://github.com/Tnze/go-mc/blob/539b4a3a7f030332eb58b8a946116ae7907630d2/net/CFB8/cfb8.go
-
-import (
-	"crypto/cipher"
-	"crypto/subtle"
-	"unsafe"
-)
-
-type cfb8 struct {
-	c         cipher.Block
-	blockSize int
-	ivPos     int
-	iv        []byte
-	de        bool
-}
-
-func newCFB8Decrypt(c cipher.Block, iv []byte) *cfb8 {
-	return newCFB8(c, iv, true)
-}
-
-func newCFB8Encrypt(c cipher.Block, iv []byte) *cfb8 {
-	return newCFB8(c, iv, false)
-}
-
-func newCFB8(c cipher.Block, iv []byte, de bool) *cfb8 {
-	cp := make([]byte, len(iv)*3)
-	copy(cp, iv)
-	return &cfb8{
-		c:         c,
-		blockSize: c.BlockSize(),
-		iv:        cp,
-		de:        de,
-	}
-}
-
-func (cf *cfb8) XORKeyStream(dst, src []byte) {
-	if len(src) == 0 {
-		return
-	}
-	if len(dst) < len(src) {
-		panic("cfb8: output smaller than input")
-	}
-
-	// If dst and src does not overlap in first block size,
-	// and the length of src is greater than 2*blockSize,
-	// we can use an optimized implementation.
-	if len(src) > cf.blockSize<<1 &&
-		(uintptr(unsafe.Pointer(&dst[0]))+uintptr(cf.blockSize) <= uintptr(unsafe.Pointer(&src[0])) ||
-			uintptr(unsafe.Pointer(&src[0]))+uintptr(len(src)) <= uintptr(unsafe.Pointer(&dst[0]))) {
-		// encrypt/decrypt first blockSize bytes
-		// After this, the IV will come to the same as
-		// the last blockSize of ciphertext, so
-		// we can reuse them without copy.
-		cf.xorKeyStream(dst, src[:cf.blockSize])
-		var ciphertext []byte
-		if cf.de {
-			ciphertext = src
-		} else {
-			ciphertext = dst
-		}
-		dst = dst[cf.blockSize:]
-		src = src[cf.blockSize:]
-		iv := cf.iv
-		_ = iv[0] // bounds check hint to compiler; see golang.org/issue/14808
-		var (
-			i   int
-			val byte
-		)
-		dst = dst[:len(src)]
-		if cf.de && // and requires to be non-overlapping at all
-			uintptr(unsafe.Pointer(&dst[0])) <= uintptr(unsafe.Pointer(&src[len(src)-1])) &&
-			uintptr(unsafe.Pointer(&src[0])) <= uintptr(unsafe.Pointer(&dst[len(dst)-1])) {
-			for i = 0; i < len(src)-cf.blockSize; i += 1 {
-				cf.c.Encrypt(dst[i:], ciphertext[i:])
-			}
-			subtle.XORBytes(dst, src[:i], dst)
-			for ; i < len(src); i += 1 {
-				cf.c.Encrypt(iv, ciphertext[i:])
-				dst[i] = src[i] ^ iv[0]
-			}
-		} else {
-			_ = ciphertext[len(src)]
-			for i, val = range src {
-				cf.c.Encrypt(iv, ciphertext[i:])
-				dst[i] = val ^ iv[0]
-			}
-			// for-range does not increase i in the last loop,
-			// compared to the classic for clause
-			i += 1
-		}
-		// copy the current IV for next operation
-		copy(iv, ciphertext[i:i+cf.blockSize])
-		cf.ivPos = 0
-		return
-	}
-
-	cf.xorKeyStream(dst, src)
-}
-
-func (cf *cfb8) xorKeyStream(dst, src []byte) {
-	dst = dst[:len(src)] // remove bounds check in loop
-	for i, val := range src {
-		posPlusBlockSize := cf.ivPos + cf.blockSize
-		// fast mod; 2*blockSize must be a non-negative integer power of 2
-		tempPos := posPlusBlockSize & (cf.blockSize<<1 - 1)
-		// reuse space to store encrypted block
-		cf.c.Encrypt(cf.iv[tempPos:], cf.iv[cf.ivPos:])
-		// Only the first byte of the encrypted block is used
-		// for encryption/decryption, other bytes are ignored.
-		val ^= cf.iv[tempPos]
-
-		if cf.ivPos == cf.blockSize<<1 {
-			// bound reached; move to next round for next operation
-			// copy next block to the start of the ring buffer
-			copy(cf.iv, cf.iv[cf.ivPos+1:])
-			// insert the encrypted byte to the end of IV
-			if cf.de {
-				cf.iv[cf.blockSize-1] = src[i]
-			} else {
-				cf.iv[cf.blockSize-1] = val
-			}
-			cf.ivPos = 0
-		} else {
-			// insert the encrypted byte to the end of IV
-			if cf.de {
-				cf.iv[posPlusBlockSize] = src[i]
-			} else {
-				cf.iv[posPlusBlockSize] = val
-			}
-			// move to next block
-			cf.ivPos += 1
-		}
-
-		dst[i] = val
-	}
-}

transport/internet/finalmask/xmc/client.go

@@ -1,287 +0,0 @@
-package xmc
-
-import (
-	"bufio"
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"fmt"
-	"io"
-	"math/big"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-)
-
-type clientConn struct {
-	reader io.Reader
-	writer io.Writer
-	c      net.Conn
-
-	state clientState
-
-	handshakeLock   sync.Mutex
-	lifecycleMu     sync.Mutex
-	closed          bool
-	profiles        []loginProfile
-	password        string
-	rsaPublicKey    []byte
-	hostname        string
-	paddingSchedule []paddingTurn
-	packet          *packetStream
-	deadlines       *connectionDeadlines
-}
-
-type clientState int
-
-var (
-	clientStateHandshake clientState = 1
-	clientStateProxy     clientState = 2
-)
-
-func newClientConn(c net.Conn, profiles []loginProfile, password string, rsaPublicKey []byte, hostname string) (*clientConn, error) {
-	if len(rsaPublicKey) == 0 {
-		return nil, fmt.Errorf("empty rsa public key")
-	}
-	if len(profiles) == 0 {
-		return nil, fmt.Errorf("empty profiles")
-	}
-	paddingSchedule, err := newClientPaddingSchedule2612()
-	if err != nil {
-		return nil, fmt.Errorf("select padding profile: %w", err)
-	}
-	return &clientConn{
-		reader:          bufio.NewReader(c),
-		writer:          c,
-		c:               c,
-		state:           clientStateHandshake,
-		handshakeLock:   sync.Mutex{},
-		profiles:        profiles,
-		password:        password,
-		rsaPublicKey:    rsaPublicKey,
-		hostname:        hostname,
-		paddingSchedule: paddingSchedule,
-		deadlines:       newConnectionDeadlines(c),
-	}, nil
-}
-
-func (c *clientConn) handshake() error {
-	c.handshakeLock.Lock()
-	defer c.handshakeLock.Unlock()
-
-	if c.state != clientStateHandshake {
-		return nil
-	}
-
-	if err := c.deadlines.beginHandshake(); err != nil {
-		return fmt.Errorf("set deadline: %w", err)
-	}
-	defer func() { _ = c.deadlines.endHandshake() }()
-
-	var (
-		protocolVersion Varint        = Varint(775)
-		serverAddress   String        = String(c.hostname)
-		serverPort      UnsignedShort = UnsignedShort(25565)
-		nextState       Varint        = Varint(2)
-	)
-
-	host, portString, err := net.SplitHostPort(c.c.RemoteAddr().String())
-	if err == nil {
-		port, err := strconv.Atoi(portString)
-		if err == nil {
-			serverPort = UnsignedShort(port)
-		}
-
-		if serverAddress == "" {
-			serverAddress = String(host)
-		}
-	}
-
-	err = writePacket(c.writer, 0x00, &protocolVersion, &serverAddress, &serverPort, &nextState)
-	if err != nil {
-		return fmt.Errorf("write handshake packet: %w", err)
-	}
-
-	// Login Start
-	randomProfile, err := rand.Int(rand.Reader, big.NewInt(int64(len(c.profiles))))
-	if err != nil {
-		return fmt.Errorf("select profile: %w", err)
-	}
-	selectedProfile := c.profiles[randomProfile.Int64()]
-	username := String(selectedProfile.Username)
-
-	err = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)
-	if err != nil {
-		return fmt.Errorf("write login start: %w", err)
-	}
-
-	// Encryption Request
-	pkt, err := readPacket(c.reader)
-	if err != nil {
-		return fmt.Errorf("read encryption request: %w", err)
-	}
-
-	if pkt.packetID != 0x01 {
-		return fmt.Errorf("bad encrypt request packet id")
-	}
-
-	var (
-		serverId    String
-		publicKey   Bytes
-		verifyToken Bytes
-	)
-
-	err = pkt.readFields(&serverId, &publicKey, &verifyToken)
-	if err != nil {
-		return fmt.Errorf("read encryption request fields: %w", err)
-	}
-
-	if !bytes.Equal(publicKey, c.rsaPublicKey) {
-		return fmt.Errorf("server public key mismatch")
-	}
-
-	k, err := x509.ParsePKIXPublicKey(publicKey)
-	if err != nil {
-		return fmt.Errorf("parse server public key: %w", err)
-	}
-
-	rsaPublicKey, ok := k.(*rsa.PublicKey)
-	if !ok {
-		return fmt.Errorf("parse server public key: not rsa")
-	}
-
-	sharedSecret := make([]byte, 16)
-	if _, err = rand.Read(sharedSecret); err != nil {
-		return fmt.Errorf("generate shared secret: %w", err)
-	}
-
-	encryptedSharedSecret, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("encrypt shared secret: %w", err)
-	}
-
-	verifyToken = append(verifyToken, []byte(c.password)...) // append pre-shared password
-
-	encryptedVerifyToken, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, verifyToken)
-	if err != nil {
-		return fmt.Errorf("encrypt verify token: %w", err)
-	}
-
-	// Send Encryption Response
-	err = writePacket(
-		c.writer,
-		0x01,
-		(*Bytes)(&encryptedSharedSecret),
-		(*Bytes)(&encryptedVerifyToken),
-	)
-	if err != nil {
-		return fmt.Errorf("write encryption response: %w", err)
-	}
-
-	// Enable encryption
-	c.reader, err = newCryptoReader(c.reader, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("new crypto reader: %w", err)
-	}
-
-	c.writer, err = newCryptoWriter(c.writer, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("new crypto writer: %w", err)
-	}
-
-	pkt, err = readPacket(c.reader)
-	if err != nil {
-		return fmt.Errorf("read login finished: %w", err)
-	}
-	if pkt.packetID == 0x00 {
-		var reason String
-		if readErr := pkt.readFields(&reason); readErr != nil {
-			return fmt.Errorf("authentication rejected")
-		}
-		return fmt.Errorf("authentication rejected: %s", reason)
-	}
-	if pkt.packetID != 0x02 {
-		return fmt.Errorf("bad login finished packet id: %d", pkt.packetID)
-	}
-
-	receivedProfile, err := readLoginSuccess(pkt)
-	if err != nil {
-		return fmt.Errorf("read login finished fields: %w", err)
-	}
-	if receivedProfile != selectedProfile {
-		return fmt.Errorf("login profile mismatch")
-	}
-	loginAcknowledgedLength, err := writePacketWithLength(c.writer, 0x03)
-	if err != nil {
-		return fmt.Errorf("write login acknowledged: %w", err)
-	}
-	if err = runPaddingSchedule(c.reader, c.writer, true, loginAcknowledgedLength, c.paddingSchedule); err != nil {
-		return fmt.Errorf("run startup padding: %w", err)
-	}
-
-	packet := newPacketStream(c.reader, c.writer, true)
-	c.lifecycleMu.Lock()
-	if c.closed {
-		c.lifecycleMu.Unlock()
-		packet.Stop()
-		return net.ErrClosed
-	}
-	c.packet = packet
-	c.reader = packet
-	c.writer = packet
-	c.state = clientStateProxy
-	c.lifecycleMu.Unlock()
-
-	return nil
-}
-
-func (c *clientConn) Read(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.reader.Read(b)
-}
-
-func (c *clientConn) Write(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.writer.Write(b)
-}
-
-func (c *clientConn) Close() error {
-	c.lifecycleMu.Lock()
-	c.closed = true
-	packet := c.packet
-	c.lifecycleMu.Unlock()
-	if packet != nil {
-		packet.Stop()
-	}
-	return c.c.Close()
-}
-
-func (c *clientConn) LocalAddr() net.Addr {
-	return c.c.LocalAddr()
-}
-
-func (c *clientConn) RemoteAddr() net.Addr {
-	return c.c.RemoteAddr()
-}
-
-func (c *clientConn) SetDeadline(t time.Time) error {
-	return c.deadlines.setDeadline(t)
-}
-
-func (c *clientConn) SetReadDeadline(t time.Time) error {
-	return c.deadlines.setReadDeadline(t)
-}
-
-func (c *clientConn) SetWriteDeadline(t time.Time) error {
-	return c.deadlines.setWriteDeadline(t)
-}

transport/internet/finalmask/xmc/config.go

@@ -1,35 +0,0 @@
-package xmc
-
-import (
-	"fmt"
-	"net"
-)
-
-func (c *Config) TCP() {
-}
-
-func (c *Config) WrapConnClient(conn net.Conn) (net.Conn, error) {
-	profiles, err := profilesFromConfig(c.Profiles)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-	cc, err := newClientConn(conn, profiles, c.Password, c.RsaPublicKey, c.Hostname)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-
-	return cc, nil
-}
-
-func (c *Config) WrapConnServer(conn net.Conn) (net.Conn, error) {
-	profiles, err := profilesFromConfig(c.Profiles)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-	cc, err := wrapConnServer(conn, profiles, c.Password, c.RsaPrivateKey, c.RsaPublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-
-	return cc, nil
-}

transport/internet/finalmask/xmc/config.pb.go

@@ -1,238 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.11
-// 	protoc        v6.33.5
-// source: transport/internet/finalmask/xmc/config.proto
-
-package xmc
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type Profile struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// Resolve the UUID from https://api.mojang.com/users/profiles/minecraft/{username}.
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Uuid     []byte `protobuf:"bytes,2,opt,name=uuid,proto3" json:"uuid,omitempty"`
-	// Copy the signed textures property returned by
-	// https://sessionserver.mojang.com/session/minecraft/profile/{uuid}?unsigned=false.
-	TexturesValue     string `protobuf:"bytes,3,opt,name=textures_value,json=texturesValue,proto3" json:"textures_value,omitempty"`
-	TexturesSignature string `protobuf:"bytes,4,opt,name=textures_signature,json=texturesSignature,proto3" json:"textures_signature,omitempty"`
-	unknownFields     protoimpl.UnknownFields
-	sizeCache         protoimpl.SizeCache
-}
-
-func (x *Profile) Reset() {
-	*x = Profile{}
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *Profile) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Profile) ProtoMessage() {}
-
-func (x *Profile) ProtoReflect() protoreflect.Message {
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Profile.ProtoReflect.Descriptor instead.
-func (*Profile) Descriptor() ([]byte, []int) {
-	return file_transport_internet_finalmask_xmc_config_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *Profile) GetUsername() string {
-	if x != nil {
-		return x.Username
-	}
-	return ""
-}
-
-func (x *Profile) GetUuid() []byte {
-	if x != nil {
-		return x.Uuid
-	}
-	return nil
-}
-
-func (x *Profile) GetTexturesValue() string {
-	if x != nil {
-		return x.TexturesValue
-	}
-	return ""
-}
-
-func (x *Profile) GetTexturesSignature() string {
-	if x != nil {
-		return x.TexturesSignature
-	}
-	return ""
-}
-
-type Config struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Password      string                 `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
-	RsaPrivateKey []byte                 `protobuf:"bytes,8,opt,name=rsa_private_key,json=rsaPrivateKey,proto3" json:"rsa_private_key,omitempty"`
-	RsaPublicKey  []byte                 `protobuf:"bytes,9,opt,name=rsa_public_key,json=rsaPublicKey,proto3" json:"rsa_public_key,omitempty"`
-	Hostname      string                 `protobuf:"bytes,10,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	Profiles      []*Profile             `protobuf:"bytes,11,rep,name=profiles,proto3" json:"profiles,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *Config) Reset() {
-	*x = Config{}
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *Config) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Config) ProtoMessage() {}
-
-func (x *Config) ProtoReflect() protoreflect.Message {
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[1]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Config.ProtoReflect.Descriptor instead.
-func (*Config) Descriptor() ([]byte, []int) {
-	return file_transport_internet_finalmask_xmc_config_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *Config) GetPassword() string {
-	if x != nil {
-		return x.Password
-	}
-	return ""
-}
-
-func (x *Config) GetRsaPrivateKey() []byte {
-	if x != nil {
-		return x.RsaPrivateKey
-	}
-	return nil
-}
-
-func (x *Config) GetRsaPublicKey() []byte {
-	if x != nil {
-		return x.RsaPublicKey
-	}
-	return nil
-}
-
-func (x *Config) GetHostname() string {
-	if x != nil {
-		return x.Hostname
-	}
-	return ""
-}
-
-func (x *Config) GetProfiles() []*Profile {
-	if x != nil {
-		return x.Profiles
-	}
-	return nil
-}
-
-var File_transport_internet_finalmask_xmc_config_proto protoreflect.FileDescriptor
-
-const file_transport_internet_finalmask_xmc_config_proto_rawDesc = "" +
-	"\n" +
-	"-transport/internet/finalmask/xmc/config.proto\x12%xray.transport.internet.finalmask.xmc\"\x8f\x01\n" +
-	"\aProfile\x12\x1a\n" +
-	"\busername\x18\x01 \x01(\tR\busername\x12\x12\n" +
-	"\x04uuid\x18\x02 \x01(\fR\x04uuid\x12%\n" +
-	"\x0etextures_value\x18\x03 \x01(\tR\rtexturesValue\x12-\n" +
-	"\x12textures_signature\x18\x04 \x01(\tR\x11texturesSignature\"\xe0\x01\n" +
-	"\x06Config\x12\x1a\n" +
-	"\bpassword\x18\x01 \x01(\tR\bpassword\x12&\n" +
-	"\x0frsa_private_key\x18\b \x01(\fR\rrsaPrivateKey\x12$\n" +
-	"\x0ersa_public_key\x18\t \x01(\fR\frsaPublicKey\x12\x1a\n" +
-	"\bhostname\x18\n" +
-	" \x01(\tR\bhostname\x12J\n" +
-	"\bprofiles\x18\v \x03(\v2..xray.transport.internet.finalmask.xmc.ProfileR\bprofilesJ\x04\b\x02\x10\x03B\x91\x01\n" +
-	")com.xray.transport.internet.finalmask.xmcP\x01Z:github.com/xtls/xray-core/transport/internet/finalmask/xmc\xaa\x02%Xray.Transport.Internet.Finalmask.XMCb\x06proto3"
-
-var (
-	file_transport_internet_finalmask_xmc_config_proto_rawDescOnce sync.Once
-	file_transport_internet_finalmask_xmc_config_proto_rawDescData []byte
-)
-
-func file_transport_internet_finalmask_xmc_config_proto_rawDescGZIP() []byte {
-	file_transport_internet_finalmask_xmc_config_proto_rawDescOnce.Do(func() {
-		file_transport_internet_finalmask_xmc_config_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_transport_internet_finalmask_xmc_config_proto_rawDesc), len(file_transport_internet_finalmask_xmc_config_proto_rawDesc)))
-	})
-	return file_transport_internet_finalmask_xmc_config_proto_rawDescData
-}
-
-var file_transport_internet_finalmask_xmc_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_transport_internet_finalmask_xmc_config_proto_goTypes = []any{
-	(*Profile)(nil), // 0: xray.transport.internet.finalmask.xmc.Profile
-	(*Config)(nil),  // 1: xray.transport.internet.finalmask.xmc.Config
-}
-var file_transport_internet_finalmask_xmc_config_proto_depIdxs = []int32{
-	0, // 0: xray.transport.internet.finalmask.xmc.Config.profiles:type_name -> xray.transport.internet.finalmask.xmc.Profile
-	1, // [1:1] is the sub-list for method output_type
-	1, // [1:1] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension extendee
-	0, // [0:1] is the sub-list for field type_name
-}
-
-func init() { file_transport_internet_finalmask_xmc_config_proto_init() }
-func file_transport_internet_finalmask_xmc_config_proto_init() {
-	if File_transport_internet_finalmask_xmc_config_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_transport_internet_finalmask_xmc_config_proto_rawDesc), len(file_transport_internet_finalmask_xmc_config_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   2,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_transport_internet_finalmask_xmc_config_proto_goTypes,
-		DependencyIndexes: file_transport_internet_finalmask_xmc_config_proto_depIdxs,
-		MessageInfos:      file_transport_internet_finalmask_xmc_config_proto_msgTypes,
-	}.Build()
-	File_transport_internet_finalmask_xmc_config_proto = out.File
-	file_transport_internet_finalmask_xmc_config_proto_goTypes = nil
-	file_transport_internet_finalmask_xmc_config_proto_depIdxs = nil
-}

transport/internet/finalmask/xmc/config.proto

@@ -1,26 +0,0 @@
-syntax = "proto3";
-
-package xray.transport.internet.finalmask.xmc;
-option csharp_namespace = "Xray.Transport.Internet.Finalmask.XMC";
-option go_package = "github.com/xtls/xray-core/transport/internet/finalmask/xmc";
-option java_package = "com.xray.transport.internet.finalmask.xmc";
-option java_multiple_files = true;
-
-message Profile {
-    // Resolve the UUID from https://api.mojang.com/users/profiles/minecraft/{username}.
-    string username = 1;
-    bytes uuid = 2;
-    // Copy the signed textures property returned by
-    // https://sessionserver.mojang.com/session/minecraft/profile/{uuid}?unsigned=false.
-    string textures_value = 3;
-    string textures_signature = 4;
-}
-
-message Config {
-    string password = 1;
-    reserved 2;
-    bytes rsa_private_key = 8;
-    bytes rsa_public_key = 9;
-    string hostname = 10;
-    repeated Profile profiles = 11;
-}

transport/internet/finalmask/xmc/deadline.go

@@ -1,85 +0,0 @@
-package xmc
-
-import (
-	"net"
-	"sync"
-	"time"
-)
-
-const handshakeTimeout = 2 * time.Minute
-
-type connectionDeadlines struct {
-	mu sync.Mutex
-	c  net.Conn
-
-	read      time.Time
-	write     time.Time
-	handshake time.Time
-}
-
-func newConnectionDeadlines(c net.Conn) *connectionDeadlines {
-	return &connectionDeadlines{c: c}
-}
-
-func (d *connectionDeadlines) beginHandshake() error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.handshake = time.Now().Add(handshakeTimeout)
-	if err := d.applyLocked(); err != nil {
-		d.handshake = time.Time{}
-		_ = d.applyLocked()
-		return err
-	}
-	return nil
-}
-
-func (d *connectionDeadlines) endHandshake() error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.handshake = time.Time{}
-	return d.applyLocked()
-}
-
-func (d *connectionDeadlines) setDeadline(t time.Time) error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.read = t
-	d.write = t
-	return d.applyLocked()
-}
-
-func (d *connectionDeadlines) setReadDeadline(t time.Time) error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.read = t
-	return d.c.SetReadDeadline(earlierDeadline(d.read, d.handshake))
-}
-
-func (d *connectionDeadlines) setWriteDeadline(t time.Time) error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.write = t
-	return d.c.SetWriteDeadline(earlierDeadline(d.write, d.handshake))
-}
-
-func (d *connectionDeadlines) applyLocked() error {
-	if err := d.c.SetReadDeadline(earlierDeadline(d.read, d.handshake)); err != nil {
-		return err
-	}
-	return d.c.SetWriteDeadline(earlierDeadline(d.write, d.handshake))
-}
-
-func earlierDeadline(user, internal time.Time) time.Time {
-	if internal.IsZero() {
-		return user
-	}
-	if user.IsZero() || internal.Before(user) {
-		return internal
-	}
-	return user
-}

transport/internet/finalmask/xmc/deadline_test.go

@@ -1,81 +0,0 @@
-package xmc
-
-import (
-	"net"
-	"sync"
-	"testing"
-	"time"
-)
-
-func TestConnectionDeadlinesRestoreCallerValues(t *testing.T) {
-	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
-
-	recording := &deadlineRecordingConn{Conn: client}
-	deadlines := newConnectionDeadlines(recording)
-	callerDeadline := time.Now().Add(10 * time.Minute)
-	if err := deadlines.setDeadline(callerDeadline); err != nil {
-		t.Fatal(err)
-	}
-	if err := deadlines.beginHandshake(); err != nil {
-		t.Fatal(err)
-	}
-
-	read, write := recording.currentDeadlines()
-	if !read.Before(callerDeadline) || !write.Before(callerDeadline) {
-		t.Fatalf("handshake deadlines = %s/%s, caller = %s", read, write, callerDeadline)
-	}
-
-	shortReadDeadline := time.Now().Add(time.Second)
-	if err := deadlines.setReadDeadline(shortReadDeadline); err != nil {
-		t.Fatal(err)
-	}
-	read, _ = recording.currentDeadlines()
-	if !read.Equal(shortReadDeadline) {
-		t.Fatalf("read deadline = %s, want %s", read, shortReadDeadline)
-	}
-
-	if err := deadlines.endHandshake(); err != nil {
-		t.Fatal(err)
-	}
-	read, write = recording.currentDeadlines()
-	if !read.Equal(shortReadDeadline) || !write.Equal(callerDeadline) {
-		t.Fatalf("restored deadlines = %s/%s, want %s/%s", read, write, shortReadDeadline, callerDeadline)
-	}
-}
-
-type deadlineRecordingConn struct {
-	net.Conn
-	mu    sync.Mutex
-	read  time.Time
-	write time.Time
-}
-
-func (c *deadlineRecordingConn) SetDeadline(t time.Time) error {
-	c.mu.Lock()
-	c.read = t
-	c.write = t
-	c.mu.Unlock()
-	return c.Conn.SetDeadline(t)
-}
-
-func (c *deadlineRecordingConn) SetReadDeadline(t time.Time) error {
-	c.mu.Lock()
-	c.read = t
-	c.mu.Unlock()
-	return c.Conn.SetReadDeadline(t)
-}
-
-func (c *deadlineRecordingConn) SetWriteDeadline(t time.Time) error {
-	c.mu.Lock()
-	c.write = t
-	c.mu.Unlock()
-	return c.Conn.SetWriteDeadline(t)
-}
-
-func (c *deadlineRecordingConn) currentDeadlines() (time.Time, time.Time) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.read, c.write
-}

transport/internet/finalmask/xmc/derivation.go

@@ -1,103 +0,0 @@
-package xmc
-
-import (
-	"crypto/rsa"
-	"crypto/sha256"
-	"fmt"
-	"math/big"
-)
-
-type sha256Stream struct {
-	seed    []byte
-	counter uint64
-	buf     []byte
-}
-
-func newSHA256Stream(seed []byte) *sha256Stream {
-	return &sha256Stream{
-		seed: seed,
-	}
-}
-
-func (s *sha256Stream) Read(p []byte) (n int, err error) {
-	for len(p) > len(s.buf) {
-		h := sha256.New()
-		h.Write(s.seed)
-		h.Write([]byte(fmt.Sprintf("-%d", s.counter)))
-		s.counter++
-		s.buf = append(s.buf, h.Sum(nil)...)
-	}
-	n = copy(p, s.buf)
-	s.buf = s.buf[n:]
-	return n, nil
-}
-
-func derivePrime(stream *sha256Stream) *big.Int {
-	pBytes := make([]byte, 64) // 512 bits
-	_, _ = stream.Read(pBytes)
-	pBytes[0] |= 0xc0  // ensure it is big enough so p*q is 1024 bits
-	pBytes[63] |= 0x01 // ensure odd
-
-	p := new(big.Int).SetBytes(pBytes)
-	for {
-		if p.ProbablyPrime(20) {
-			pMinus1 := new(big.Int).Sub(p, big.NewInt(1))
-			e := big.NewInt(65537)
-			gcd := new(big.Int).GCD(nil, nil, pMinus1, e)
-			if gcd.Cmp(big.NewInt(1)) == 0 {
-				return p
-			}
-		}
-		p.Add(p, big.NewInt(2))
-	}
-}
-
-// DeriveRSAKey derives a 1024-bit RSA private key from a password.
-func DeriveRSAKey(password string) (*rsa.PrivateKey, error) {
-	seed := []byte(password)
-
-	pStream := newSHA256Stream(append(seed, []byte("-p-prime")...))
-	qStream := newSHA256Stream(append(seed, []byte("-q-prime")...))
-
-	p := derivePrime(pStream)
-	q := derivePrime(qStream)
-
-	// ensure p != q (if they are, let's search q further)
-	for p.Cmp(q) == 0 {
-		q.Add(q, big.NewInt(2))
-		for {
-			if q.ProbablyPrime(20) {
-				qMinus1 := new(big.Int).Sub(q, big.NewInt(1))
-				e := big.NewInt(65537)
-				gcd := new(big.Int).GCD(nil, nil, qMinus1, e)
-				if gcd.Cmp(big.NewInt(1)) == 0 {
-					break
-				}
-			}
-			q.Add(q, big.NewInt(2))
-		}
-	}
-
-	n := new(big.Int).Mul(p, q)
-	pMinus1 := new(big.Int).Sub(p, big.NewInt(1))
-	qMinus1 := new(big.Int).Sub(q, big.NewInt(1))
-	totient := new(big.Int).Mul(pMinus1, qMinus1)
-
-	e := big.NewInt(65537)
-	d := new(big.Int).ModInverse(e, totient)
-	if d == nil {
-		return nil, fmt.Errorf("failed to compute mod inverse")
-	}
-
-	priv := &rsa.PrivateKey{
-		PublicKey: rsa.PublicKey{
-			N: n,
-			E: 65537,
-		},
-		D:      d,
-		Primes: []*big.Int{p, q},
-	}
-	priv.Precompute()
-
-	return priv, nil
-}

transport/internet/finalmask/xmc/derivation_test.go

@@ -1,58 +0,0 @@
-package xmc
-
-import (
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/hex"
-	"testing"
-)
-
-func TestDeriveRSAKey(t *testing.T) {
-	password := "my-very-secret-password-12345"
-
-	key1, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key: %v", err)
-	}
-
-	err = key1.Validate()
-	if err != nil {
-		t.Fatalf("key is not valid RSA key: %v", err)
-	}
-
-	key2, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key second time: %v", err)
-	}
-
-	// Verify determinism
-	if key1.D.Cmp(key2.D) != 0 || key1.N.Cmp(key2.N) != 0 {
-		t.Errorf("derived keys are not identical for the same password")
-	}
-
-	// Verify different passwords yield different keys
-	keyDifferent, err := DeriveRSAKey(password + "-different")
-	if err != nil {
-		t.Fatalf("failed to derive different key: %v", err)
-	}
-
-	if key1.D.Cmp(keyDifferent.D) == 0 || key1.N.Cmp(keyDifferent.N) == 0 {
-		t.Errorf("derived keys are identical for different passwords")
-	}
-}
-
-func TestDeriveRSAKeyGoldenPrivateKey(t *testing.T) {
-	const password = "deterministic-rsa-key-golden"
-	const wantPKCS1DERHash = "3a8c4ad56a6fb42dab73c4d5fc3af754460a2db1441edc0970cbc7f4e0798d2f"
-
-	key, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key: %v", err)
-	}
-
-	gotHash := sha256.Sum256(x509.MarshalPKCS1PrivateKey(key))
-	got := hex.EncodeToString(gotHash[:])
-	if got != wantPKCS1DERHash {
-		t.Fatalf("derived private key changed\nwant sha256: %s\n got sha256: %s", wantPKCS1DERHash, got)
-	}
-}

transport/internet/finalmask/xmc/handshake_test.go

@@ -1,390 +0,0 @@
-package xmc
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"crypto/x509"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-func deriveTestRSAKey(t *testing.T, password string) ([]byte, []byte) {
-	t.Helper()
-
-	key, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive rsa key: %v", err)
-	}
-
-	publicKey, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
-	if err != nil {
-		t.Fatalf("failed to marshal public key: %v", err)
-	}
-
-	return x509.MarshalPKCS1PrivateKey(key), publicKey
-}
-
-func testLoginProfile(username string) loginProfile {
-	profile := loginProfile{
-		Username:          username,
-		TexturesValue:     strings.Repeat("texture-value-", 40),
-		TexturesSignature: strings.Repeat("texture-signature-", 24),
-	}
-	digest := sha256.Sum256([]byte(username))
-	copy(profile.UUID[:], digest[:16])
-	profile.UUID[6] = (profile.UUID[6] & 0x0f) | 0x40
-	profile.UUID[8] = (profile.UUID[8] & 0x3f) | 0x80
-	return profile
-}
-
-func TestHandshakeSuccess(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("failed to listen: %v", err)
-	}
-	defer ln.Close()
-
-	password := "super-secure-shared-key-12345"
-	profiles := []loginProfile{testLoginProfile("test_user")}
-	privateKey, publicKey := deriveTestRSAKey(t, password)
-
-	go func() {
-		rawConn, err := ln.Accept()
-		if err != nil {
-			return
-		}
-		defer rawConn.Close()
-
-		server, err := wrapConnServer(rawConn, profiles, password, privateKey, publicKey)
-		if err != nil {
-			t.Errorf("failed to wrap server: %v", err)
-			return
-		}
-
-		buf := make([]byte, 1024)
-		n, err := server.Read(buf)
-		if err != nil {
-			t.Errorf("server read error: %v", err)
-			return
-		}
-
-		if !bytes.Equal(buf[:n], []byte("hello server")) {
-			t.Errorf("unexpected payload from client: %s", string(buf[:n]))
-			return
-		}
-
-		_, err = server.Write([]byte("hello client"))
-		if err != nil {
-			t.Errorf("server write error: %v", err)
-			return
-		}
-	}()
-
-	clientRaw, err := net.Dial("tcp", ln.Addr().String())
-	if err != nil {
-		t.Fatalf("failed to dial: %v", err)
-	}
-	defer clientRaw.Close()
-
-	client, err := newClientConn(clientRaw, profiles, password, publicKey, "localhost")
-	if err != nil {
-		t.Fatalf("failed to create client: %v", err)
-	}
-
-	_, err = client.Write([]byte("hello server"))
-	if err != nil {
-		t.Fatalf("client write error: %v", err)
-	}
-
-	buf := make([]byte, 1024)
-	n, err := client.Read(buf)
-	if err != nil {
-		t.Fatalf("client read error: %v", err)
-	}
-
-	if !bytes.Equal(buf[:n], []byte("hello client")) {
-		t.Errorf("unexpected payload from server: %s", string(buf[:n]))
-	}
-}
-
-func TestHandshakePasswordMismatch(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("failed to listen: %v", err)
-	}
-	defer ln.Close()
-
-	clientPassword := "client-secret-123"
-	serverPassword := "server-secret-456"
-	profiles := []loginProfile{testLoginProfile("test_user")}
-	serverPrivateKey, serverPublicKey := deriveTestRSAKey(t, serverPassword)
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-
-		rawConn, err := ln.Accept()
-		if err != nil {
-			return
-		}
-		defer rawConn.Close()
-
-		server, err := wrapConnServer(rawConn, profiles, serverPassword, serverPrivateKey, serverPublicKey)
-		if err != nil {
-			// Wrapping is synchronous and shouldn't fail initially simply because key derivation works with any string
-			t.Logf("wrapped server: %v", err)
-		}
-
-		// When client sends data, handshake happens and should fail
-		buf := make([]byte, 1024)
-		_, err = server.Read(buf)
-		if err == nil {
-			t.Errorf("expected handshake to fail due to password mismatch, but it succeeded")
-		} else {
-			t.Logf("server read failed as expected: %v", err)
-		}
-	}()
-
-	clientRaw, err := net.Dial("tcp", ln.Addr().String())
-	if err != nil {
-		t.Fatalf("failed to dial: %v", err)
-	}
-	defer clientRaw.Close()
-
-	client, err := newClientConn(clientRaw, profiles, clientPassword, serverPublicKey, "localhost")
-	if err != nil {
-		t.Fatalf("failed to create client: %v", err)
-	}
-
-	err = client.handshake()
-	if err == nil {
-		t.Fatal("expected client handshake to fail due to password mismatch")
-	}
-
-	wg.Wait()
-
-	// Check if we lost connection or received error
-	t.Log("Handshake mismatch tested")
-}
-
-func TestHandshakeNetPipeWithKeepAlive(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer clientRaw.Close()
-	defer serverRaw.Close()
-
-	const password = "net-pipe-shared-key"
-	profiles := []loginProfile{testLoginProfile("pipe_user")}
-	privateKey, publicKey := deriveTestRSAKey(t, password)
-	serverDone := make(chan error, 1)
-
-	go func() {
-		server, err := wrapConnServer(serverRaw, profiles, password, privateKey, publicKey)
-		if err != nil {
-			serverDone <- err
-			return
-		}
-
-		request := make([]byte, len("hello server"))
-		if _, err = io.ReadFull(server, request); err != nil {
-			serverDone <- fmt.Errorf("read request: %w", err)
-			return
-		}
-		if string(request) != "hello server" {
-			serverDone <- fmt.Errorf("unexpected request: %q", request)
-			return
-		}
-
-		followupDone := make(chan error, 1)
-		go func() {
-			followup := make([]byte, len("after keepalive"))
-			_, readErr := io.ReadFull(server, followup)
-			if readErr == nil && string(followup) != "after keepalive" {
-				readErr = fmt.Errorf("unexpected followup: %q", followup)
-			}
-			followupDone <- readErr
-		}()
-
-		if err = server.packet.writeKeepAlive(Long(42)); err != nil {
-			serverDone <- fmt.Errorf("write keep-alive: %w", err)
-			return
-		}
-		if _, err = server.Write([]byte("hello client")); err != nil {
-			serverDone <- fmt.Errorf("write response: %w", err)
-			return
-		}
-		serverDone <- <-followupDone
-	}()
-
-	client, err := newClientConn(clientRaw, profiles, password, publicKey, "localhost")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = client.Write([]byte("hello server")); err != nil {
-		t.Fatalf("write request: %v", err)
-	}
-	response := make([]byte, len("hello client"))
-	if _, err = io.ReadFull(client, response); err != nil {
-		t.Fatalf("read response: %v", err)
-	}
-	if string(response) != "hello client" {
-		t.Fatalf("unexpected response: %q", response)
-	}
-	if _, err = client.Write([]byte("after keepalive")); err != nil {
-		t.Fatalf("write followup: %v", err)
-	}
-
-	select {
-	case err = <-serverDone:
-		if err != nil {
-			t.Fatal(err)
-		}
-	case <-time.After(5 * time.Second):
-		t.Fatal("net.Pipe handshake timed out")
-	}
-}
-
-func TestStatusQueryUnaffected(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer clientRaw.Close()
-	defer serverRaw.Close()
-
-	const password = "status-shared-key"
-	profiles := []loginProfile{testLoginProfile("status_user")}
-	privateKey, publicKey := deriveTestRSAKey(t, password)
-	serverDone := make(chan error, 1)
-	go func() {
-		server, err := wrapConnServer(serverRaw, profiles, password, privateKey, publicKey)
-		if err == nil {
-			err = server.handshake()
-		}
-		serverDone <- err
-	}()
-
-	protocolVersion := Varint(775)
-	serverAddress := String("localhost")
-	serverPort := UnsignedShort(25565)
-	nextState := Varint(1)
-	if err := writePacket(clientRaw, 0x00, &protocolVersion, &serverAddress, &serverPort, &nextState); err != nil {
-		t.Fatal(err)
-	}
-	if err := writePacket(clientRaw, 0x00); err != nil {
-		t.Fatal(err)
-	}
-	response, err := readPacket(clientRaw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if response.packetID != 0x00 {
-		t.Fatalf("status packet id = %d", response.packetID)
-	}
-	var responseJSON String
-	if err = response.readFields(&responseJSON); err != nil {
-		t.Fatal(err)
-	}
-	if string(responseJSON) != statusResponse {
-		t.Fatalf("status response = %q", responseJSON)
-	}
-
-	payload := Long(0x0102030405060708)
-	if err = writePacket(clientRaw, 0x01, &payload); err != nil {
-		t.Fatal(err)
-	}
-	pong, err := readPacket(clientRaw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var receivedPayload Long
-	if pong.packetID != 0x01 {
-		t.Fatalf("pong packet id = %d", pong.packetID)
-	}
-	if err = pong.readFields(&receivedPayload); err != nil {
-		t.Fatal(err)
-	}
-	if receivedPayload != payload {
-		t.Fatalf("pong payload = %x", receivedPayload)
-	}
-
-	select {
-	case err = <-serverDone:
-		if err == nil || !strings.Contains(err.Error(), "ping") {
-			t.Fatalf("server error = %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("status handshake timed out")
-	}
-}
-
-func TestClientHandshakeHonorsCallerDeadline(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer clientRaw.Close()
-	defer serverRaw.Close()
-
-	const password = "deadline-shared-key"
-	profiles := []loginProfile{testLoginProfile("deadline_user")}
-	_, publicKey := deriveTestRSAKey(t, password)
-	client, err := newClientConn(clientRaw, profiles, password, publicKey, "localhost")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = client.SetDeadline(time.Now().Add(30 * time.Millisecond)); err != nil {
-		t.Fatal(err)
-	}
-
-	started := time.Now()
-	_, err = client.Write([]byte("blocked"))
-	var netErr net.Error
-	if !errors.As(err, &netErr) || !netErr.Timeout() {
-		t.Fatalf("error = %v, want network timeout", err)
-	}
-	if elapsed := time.Since(started); elapsed > 500*time.Millisecond {
-		t.Fatalf("caller deadline took %s", elapsed)
-	}
-}
-
-func TestClientCloseInterruptsHandshake(t *testing.T) {
-	clientRaw, serverRaw := net.Pipe()
-	defer serverRaw.Close()
-
-	const password = "close-shared-key"
-	profiles := []loginProfile{testLoginProfile("close_user")}
-	_, publicKey := deriveTestRSAKey(t, password)
-	client, err := newClientConn(clientRaw, profiles, password, publicKey, "localhost")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	done := make(chan error, 1)
-	go func() {
-		_, writeErr := client.Write([]byte("blocked"))
-		done <- writeErr
-	}()
-	time.Sleep(20 * time.Millisecond)
-	if err = client.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	select {
-	case err = <-done:
-		if err == nil {
-			t.Fatal("handshake unexpectedly succeeded after close")
-		}
-	case <-time.After(time.Second):
-		t.Fatal("close did not interrupt handshake")
-	}
-}
-
-func TestValidateLoginAcknowledgedPacketRejectsData(t *testing.T) {
-	if err := validateLoginAcknowledgedPacket(&mcPacket{packetID: 0x03}); err != nil {
-		t.Fatalf("valid login acknowledged packet: %v", err)
-	}
-	if err := validateLoginAcknowledgedPacket(&mcPacket{packetID: 0x03, data: []byte{0x00}}); err == nil {
-		t.Fatal("login acknowledged packet with trailing data was accepted")
-	}
-}

transport/internet/finalmask/xmc/packet_stream.go

@@ -1,184 +0,0 @@
-package xmc
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-const (
-	configurationClientboundCustomPayload = 0x01
-	configurationServerboundCustomPayload = 0x02
-	configurationKeepAlive                = 0x04
-
-	packetChannel   = "xmc:data"
-	maxPacketData   = 24 * 1024
-	keepAlivePeriod = 15 * time.Second
-)
-
-// packetStream carries the raw proxy byte stream in Minecraft configuration
-// custom payload packets. The configuration state provides bidirectional
-// payload packets and keep-alives without requiring version-specific world data.
-type packetStream struct {
-	reader   io.Reader
-	writer   io.Writer
-	isClient bool
-
-	readMu  sync.Mutex
-	writeMu sync.Mutex
-	pending []byte
-
-	keepAliveID atomic.Int64
-	done        chan struct{}
-	stopOnce    sync.Once
-}
-
-func newPacketStream(reader io.Reader, writer io.Writer, isClient bool) *packetStream {
-	s := &packetStream{
-		reader:   reader,
-		writer:   writer,
-		isClient: isClient,
-		done:     make(chan struct{}),
-	}
-	if !isClient {
-		go s.keepAliveLoop()
-	}
-	return s
-}
-
-func (s *packetStream) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-
-	s.readMu.Lock()
-	defer s.readMu.Unlock()
-
-	if len(s.pending) > 0 {
-		n := copy(p, s.pending)
-		s.pending = s.pending[n:]
-		return n, nil
-	}
-
-	for {
-		packet, err := readPacket(s.reader)
-		if err != nil {
-			return 0, fmt.Errorf("read minecraft packet stream: %w", err)
-		}
-
-		if packet.packetID == s.remoteCustomPayloadID() {
-			payload, ok, err := parseCustomPayload(packet)
-			if err != nil {
-				return 0, err
-			}
-			if !ok || len(payload) == 0 {
-				continue
-			}
-
-			n := copy(p, payload)
-			if n < len(payload) {
-				s.pending = append(s.pending[:0], payload[n:]...)
-			}
-			return n, nil
-		}
-
-		if packet.packetID == configurationKeepAlive {
-			var id Long
-			if err := packet.readFields(&id); err != nil {
-				return 0, fmt.Errorf("read minecraft keep-alive: %w", err)
-			}
-			if s.isClient {
-				if err := s.writeKeepAlive(id); err != nil {
-					return 0, err
-				}
-			}
-		}
-	}
-}
-
-func (s *packetStream) Write(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-
-	s.writeMu.Lock()
-	defer s.writeMu.Unlock()
-
-	written := 0
-	for written < len(p) {
-		end := written + maxPacketData
-		if end > len(p) {
-			end = len(p)
-		}
-		channel := String(packetChannel)
-		payload := RestBytes(p[written:end])
-		if err := writePacket(s.writer, s.localCustomPayloadID(), &channel, &payload); err != nil {
-			return written, fmt.Errorf("write minecraft custom payload: %w", err)
-		}
-		written = end
-	}
-
-	return written, nil
-}
-
-func (s *packetStream) Stop() {
-	s.stopOnce.Do(func() { close(s.done) })
-}
-
-func (s *packetStream) localCustomPayloadID() int {
-	if s.isClient {
-		return configurationServerboundCustomPayload
-	}
-	return configurationClientboundCustomPayload
-}
-
-func (s *packetStream) remoteCustomPayloadID() int {
-	if s.isClient {
-		return configurationClientboundCustomPayload
-	}
-	return configurationServerboundCustomPayload
-}
-
-func parseCustomPayload(packet *mcPacket) ([]byte, bool, error) {
-	r := bytes.NewReader(packet.data)
-	var channel String
-	if err := channel.readFrom(r); err != nil {
-		return nil, false, fmt.Errorf("read minecraft custom payload channel: %w", err)
-	}
-	if string(channel) != packetChannel {
-		return nil, false, nil
-	}
-	payload := make([]byte, r.Len())
-	if _, err := io.ReadFull(r, payload); err != nil {
-		return nil, false, fmt.Errorf("read minecraft custom payload data: %w", err)
-	}
-	return payload, true, nil
-}
-
-func (s *packetStream) writeKeepAlive(id Long) error {
-	s.writeMu.Lock()
-	defer s.writeMu.Unlock()
-	if err := writePacket(s.writer, configurationKeepAlive, &id); err != nil {
-		return fmt.Errorf("write minecraft keep-alive: %w", err)
-	}
-	return nil
-}
-
-func (s *packetStream) keepAliveLoop() {
-	ticker := time.NewTicker(keepAlivePeriod)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			id := Long(s.keepAliveID.Add(1))
-			if err := s.writeKeepAlive(id); err != nil {
-				return
-			}
-		case <-s.done:
-			return
-		}
-	}
-}