Add NewClient()

.github/workflows/release-win7.yml

@@ -72,7 +72,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Trigger Asset Update Workflow if Assets Missing
         if: steps.check-assets.outputs.missing == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -176,7 +176,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/test.yml

@@ -47,7 +47,7 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v5
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           check-latest: true

README.md

@@ -44,7 +44,6 @@
   - [teddysun/xray](https://hub.docker.com/r/teddysun/xray)
   - [wulabing/xray_docker](https://github.com/wulabing/xray_docker)
 - Web Panel - **WARNING: Please DO NOT USE plain HTTP panels like 3X-UI**, as they are believed to be bribed by Iran GFW for supporting plain HTTP by default and refused to change (https://github.com/XTLS/Xray-core/pull/3884#issuecomment-2439595331), which has already put many users' data security in danger in the past few years. **If you are already using 3X-UI, please switch to the following panels, which are verified to support HTTPS and SSH port forwarding only:**
-  - [X-Panel](https://github.com/xeefei/X-Panel)
   - [Remnawave](https://github.com/remnawave/panel)
   - [Marzban](https://github.com/Gozargah/Marzban)
   - [Xray-UI](https://github.com/qist/xray-ui)

app/dispatcher/default.go

@@ -483,9 +483,6 @@ func (d *DefaultDispatcher) routedDispatch(ctx context.Context, link *transport.
 				handler = h
 			} else {
 				errors.LogWarning(ctx, "non existing outTag: ", outTag)
-				common.Close(link.Writer)
-				common.Interrupt(link.Reader)
-				return // DO NOT CHANGE: the traffic shouldn't be processed by default outbound if the specified outbound tag doesn't exist (yet), e.g., VLESS Reverse Proxy
 			}
 		} else {
 			errors.LogInfo(ctx, "default route for ", destination)

app/proxyman/command/command.go

@@ -71,9 +71,6 @@ type handlerServer struct {
 }
 
 func (s *handlerServer) AddInbound(ctx context.Context, request *AddInboundRequest) (*AddInboundResponse, error) {
-	if request.Inbound == nil {
-		return nil, errors.New("inbound config is nil")
-	}
 	if err := core.AddInboundHandler(s.s, request.Inbound); err != nil {
 		return nil, err
 	}
@@ -166,9 +163,6 @@ func (s *handlerServer) GetInboundUsersCount(ctx context.Context, request *GetIn
 }
 
 func (s *handlerServer) AddOutbound(ctx context.Context, request *AddOutboundRequest) (*AddOutboundResponse, error) {
-	if request.Outbound == nil {
-		return nil, errors.New("outbound config is nil")
-	}
 	if err := core.AddOutboundHandler(s.s, request.Outbound); err != nil {
 		return nil, err
 	}

app/proxyman/config.go

@@ -1 +1,23 @@
 package proxyman
+
+func (s *AllocationStrategy) GetConcurrencyValue() uint32 {
+	if s == nil || s.Concurrency == nil {
+		return 3
+	}
+	return s.Concurrency.Value
+}
+
+func (s *AllocationStrategy) GetRefreshValue() uint32 {
+	if s == nil || s.Refresh == nil {
+		return 5
+	}
+	return s.Refresh.Value
+}
+
+func (c *ReceiverConfig) GetEffectiveSniffingSettings() *SniffingConfig {
+	if c.SniffingSettings != nil {
+		return c.SniffingSettings
+	}
+
+	return nil
+}

app/proxyman/config.pb.go

@@ -23,6 +23,58 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type AllocationStrategy_Type int32
+
+const (
+	// Always allocate all connection handlers.
+	AllocationStrategy_Always AllocationStrategy_Type = 0
+	// Randomly allocate specific range of handlers.
+	AllocationStrategy_Random AllocationStrategy_Type = 1
+	// External. Not supported yet.
+	AllocationStrategy_External AllocationStrategy_Type = 2
+)
+
+// Enum value maps for AllocationStrategy_Type.
+var (
+	AllocationStrategy_Type_name = map[int32]string{
+		0: "Always",
+		1: "Random",
+		2: "External",
+	}
+	AllocationStrategy_Type_value = map[string]int32{
+		"Always":   0,
+		"Random":   1,
+		"External": 2,
+	}
+)
+
+func (x AllocationStrategy_Type) Enum() *AllocationStrategy_Type {
+	p := new(AllocationStrategy_Type)
+	*p = x
+	return p
+}
+
+func (x AllocationStrategy_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AllocationStrategy_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_app_proxyman_config_proto_enumTypes[0].Descriptor()
+}
+
+func (AllocationStrategy_Type) Type() protoreflect.EnumType {
+	return &file_app_proxyman_config_proto_enumTypes[0]
+}
+
+func (x AllocationStrategy_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AllocationStrategy_Type.Descriptor instead.
+func (AllocationStrategy_Type) EnumDescriptor() ([]byte, []int) {
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{1, 0}
+}
+
 type InboundConfig struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -59,6 +111,71 @@ func (*InboundConfig) Descriptor() ([]byte, []int) {
 	return file_app_proxyman_config_proto_rawDescGZIP(), []int{0}
 }
 
+type AllocationStrategy struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type AllocationStrategy_Type `protobuf:"varint,1,opt,name=type,proto3,enum=xray.app.proxyman.AllocationStrategy_Type" json:"type,omitempty"`
+	// Number of handlers (ports) running in parallel.
+	// Default value is 3 if unset.
+	Concurrency *AllocationStrategy_AllocationStrategyConcurrency `protobuf:"bytes,2,opt,name=concurrency,proto3" json:"concurrency,omitempty"`
+	// Number of minutes before a handler is regenerated.
+	// Default value is 5 if unset.
+	Refresh *AllocationStrategy_AllocationStrategyRefresh `protobuf:"bytes,3,opt,name=refresh,proto3" json:"refresh,omitempty"`
+}
+
+func (x *AllocationStrategy) Reset() {
+	*x = AllocationStrategy{}
+	mi := &file_app_proxyman_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AllocationStrategy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AllocationStrategy) ProtoMessage() {}
+
+func (x *AllocationStrategy) ProtoReflect() protoreflect.Message {
+	mi := &file_app_proxyman_config_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AllocationStrategy.ProtoReflect.Descriptor instead.
+func (*AllocationStrategy) Descriptor() ([]byte, []int) {
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AllocationStrategy) GetType() AllocationStrategy_Type {
+	if x != nil {
+		return x.Type
+	}
+	return AllocationStrategy_Always
+}
+
+func (x *AllocationStrategy) GetConcurrency() *AllocationStrategy_AllocationStrategyConcurrency {
+	if x != nil {
+		return x.Concurrency
+	}
+	return nil
+}
+
+func (x *AllocationStrategy) GetRefresh() *AllocationStrategy_AllocationStrategyRefresh {
+	if x != nil {
+		return x.Refresh
+	}
+	return nil
+}
+
 type SniffingConfig struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -79,7 +196,7 @@ type SniffingConfig struct {
 
 func (x *SniffingConfig) Reset() {
 	*x = SniffingConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[1]
+	mi := &file_app_proxyman_config_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -91,7 +208,7 @@ func (x *SniffingConfig) String() string {
 func (*SniffingConfig) ProtoMessage() {}
 
 func (x *SniffingConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[1]
+	mi := &file_app_proxyman_config_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -104,7 +221,7 @@ func (x *SniffingConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SniffingConfig.ProtoReflect.Descriptor instead.
 func (*SniffingConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{1}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *SniffingConfig) GetEnabled() bool {
@@ -151,14 +268,15 @@ type ReceiverConfig struct {
 	PortList *net.PortList `protobuf:"bytes,1,opt,name=port_list,json=portList,proto3" json:"port_list,omitempty"`
 	// Listen specifies the IP address that the Receiver should listen on.
 	Listen                     *net.IPOrDomain        `protobuf:"bytes,2,opt,name=listen,proto3" json:"listen,omitempty"`
-	StreamSettings             *internet.StreamConfig `protobuf:"bytes,3,opt,name=stream_settings,json=streamSettings,proto3" json:"stream_settings,omitempty"`
+	AllocationStrategy         *AllocationStrategy    `protobuf:"bytes,3,opt,name=allocation_strategy,json=allocationStrategy,proto3" json:"allocation_strategy,omitempty"`
-	ReceiveOriginalDestination bool                   `protobuf:"varint,4,opt,name=receive_original_destination,json=receiveOriginalDestination,proto3" json:"receive_original_destination,omitempty"`
+	StreamSettings             *internet.StreamConfig `protobuf:"bytes,4,opt,name=stream_settings,json=streamSettings,proto3" json:"stream_settings,omitempty"`
-	SniffingSettings           *SniffingConfig        `protobuf:"bytes,6,opt,name=sniffing_settings,json=sniffingSettings,proto3" json:"sniffing_settings,omitempty"`
+	ReceiveOriginalDestination bool                   `protobuf:"varint,5,opt,name=receive_original_destination,json=receiveOriginalDestination,proto3" json:"receive_original_destination,omitempty"`
+	SniffingSettings           *SniffingConfig        `protobuf:"bytes,7,opt,name=sniffing_settings,json=sniffingSettings,proto3" json:"sniffing_settings,omitempty"`
 }
 
 func (x *ReceiverConfig) Reset() {
 	*x = ReceiverConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[2]
+	mi := &file_app_proxyman_config_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -170,7 +288,7 @@ func (x *ReceiverConfig) String() string {
 func (*ReceiverConfig) ProtoMessage() {}
 
 func (x *ReceiverConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[2]
+	mi := &file_app_proxyman_config_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -183,7 +301,7 @@ func (x *ReceiverConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReceiverConfig.ProtoReflect.Descriptor instead.
 func (*ReceiverConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{2}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ReceiverConfig) GetPortList() *net.PortList {
@@ -200,6 +318,13 @@ func (x *ReceiverConfig) GetListen() *net.IPOrDomain {
 	return nil
 }
 
+func (x *ReceiverConfig) GetAllocationStrategy() *AllocationStrategy {
+	if x != nil {
+		return x.AllocationStrategy
+	}
+	return nil
+}
+
 func (x *ReceiverConfig) GetStreamSettings() *internet.StreamConfig {
 	if x != nil {
 		return x.StreamSettings
@@ -233,7 +358,7 @@ type InboundHandlerConfig struct {
 
 func (x *InboundHandlerConfig) Reset() {
 	*x = InboundHandlerConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[3]
+	mi := &file_app_proxyman_config_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -245,7 +370,7 @@ func (x *InboundHandlerConfig) String() string {
 func (*InboundHandlerConfig) ProtoMessage() {}
 
 func (x *InboundHandlerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[3]
+	mi := &file_app_proxyman_config_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -258,7 +383,7 @@ func (x *InboundHandlerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InboundHandlerConfig.ProtoReflect.Descriptor instead.
 func (*InboundHandlerConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{3}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *InboundHandlerConfig) GetTag() string {
@@ -290,7 +415,7 @@ type OutboundConfig struct {
 
 func (x *OutboundConfig) Reset() {
 	*x = OutboundConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[4]
+	mi := &file_app_proxyman_config_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -302,7 +427,7 @@ func (x *OutboundConfig) String() string {
 func (*OutboundConfig) ProtoMessage() {}
 
 func (x *OutboundConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[4]
+	mi := &file_app_proxyman_config_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -315,7 +440,7 @@ func (x *OutboundConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OutboundConfig.ProtoReflect.Descriptor instead.
 func (*OutboundConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{4}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{5}
 }
 
 type SenderConfig struct {
@@ -334,7 +459,7 @@ type SenderConfig struct {
 
 func (x *SenderConfig) Reset() {
 	*x = SenderConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[5]
+	mi := &file_app_proxyman_config_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -346,7 +471,7 @@ func (x *SenderConfig) String() string {
 func (*SenderConfig) ProtoMessage() {}
 
 func (x *SenderConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[5]
+	mi := &file_app_proxyman_config_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -359,7 +484,7 @@ func (x *SenderConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SenderConfig.ProtoReflect.Descriptor instead.
 func (*SenderConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{5}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *SenderConfig) GetVia() *net.IPOrDomain {
@@ -421,7 +546,7 @@ type MultiplexingConfig struct {
 
 func (x *MultiplexingConfig) Reset() {
 	*x = MultiplexingConfig{}
-	mi := &file_app_proxyman_config_proto_msgTypes[6]
+	mi := &file_app_proxyman_config_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -433,7 +558,7 @@ func (x *MultiplexingConfig) String() string {
 func (*MultiplexingConfig) ProtoMessage() {}
 
 func (x *MultiplexingConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_app_proxyman_config_proto_msgTypes[6]
+	mi := &file_app_proxyman_config_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -446,7 +571,7 @@ func (x *MultiplexingConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MultiplexingConfig.ProtoReflect.Descriptor instead.
 func (*MultiplexingConfig) Descriptor() ([]byte, []int) {
-	return file_app_proxyman_config_proto_rawDescGZIP(), []int{6}
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *MultiplexingConfig) GetEnabled() bool {
@@ -477,6 +602,96 @@ func (x *MultiplexingConfig) GetXudpProxyUDP443() string {
 	return ""
 }
 
+type AllocationStrategy_AllocationStrategyConcurrency struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Value uint32 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *AllocationStrategy_AllocationStrategyConcurrency) Reset() {
+	*x = AllocationStrategy_AllocationStrategyConcurrency{}
+	mi := &file_app_proxyman_config_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AllocationStrategy_AllocationStrategyConcurrency) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AllocationStrategy_AllocationStrategyConcurrency) ProtoMessage() {}
+
+func (x *AllocationStrategy_AllocationStrategyConcurrency) ProtoReflect() protoreflect.Message {
+	mi := &file_app_proxyman_config_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AllocationStrategy_AllocationStrategyConcurrency.ProtoReflect.Descriptor instead.
+func (*AllocationStrategy_AllocationStrategyConcurrency) Descriptor() ([]byte, []int) {
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *AllocationStrategy_AllocationStrategyConcurrency) GetValue() uint32 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+type AllocationStrategy_AllocationStrategyRefresh struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Value uint32 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *AllocationStrategy_AllocationStrategyRefresh) Reset() {
+	*x = AllocationStrategy_AllocationStrategyRefresh{}
+	mi := &file_app_proxyman_config_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AllocationStrategy_AllocationStrategyRefresh) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AllocationStrategy_AllocationStrategyRefresh) ProtoMessage() {}
+
+func (x *AllocationStrategy_AllocationStrategyRefresh) ProtoReflect() protoreflect.Message {
+	mi := &file_app_proxyman_config_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AllocationStrategy_AllocationStrategyRefresh.ProtoReflect.Descriptor instead.
+func (*AllocationStrategy_AllocationStrategyRefresh) Descriptor() ([]byte, []int) {
+	return file_app_proxyman_config_proto_rawDescGZIP(), []int{1, 1}
+}
+
+func (x *AllocationStrategy_AllocationStrategyRefresh) GetValue() uint32 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
 var File_app_proxyman_config_proto protoreflect.FileDescriptor
 
 var file_app_proxyman_config_proto_rawDesc = []byte{
@@ -491,98 +706,130 @@ var file_app_proxyman_config_proto_rawDesc = []byte{
 	0x1a, 0x21, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x2f,
 	0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x22, 0x0f, 0x0a, 0x0d, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x22, 0xcc, 0x01, 0x0a, 0x0e, 0x53, 0x6e, 0x69, 0x66, 0x66, 0x69, 0x6e,
+	0x6e, 0x66, 0x69, 0x67, 0x22, 0xae, 0x03, 0x0a, 0x12, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74,
-	0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x3e, 0x0a, 0x04, 0x74,
-	0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x78, 0x72, 0x61, 0x79,
-	0x64, 0x12, 0x31, 0x0a, 0x14, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x41, 0x6c,
-	0x5f, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
-	0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4f, 0x76, 0x65, 0x72,
+	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x65, 0x0a, 0x0b, 0x63,
-	0x72, 0x69, 0x64, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x5f,
+	0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x64, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f,
+	0x32, 0x43, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x64, 0x12,
+	0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53,
-	0x23, 0x0a, 0x0d, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x6f, 0x6e, 0x6c, 0x79,
+	0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72,
-	0x4f, 0x6e, 0x6c, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x6f, 0x6e,
+	0x72, 0x65, 0x6e, 0x63, 0x79, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e,
-	0x6c, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x4f,
+	0x63, 0x79, 0x12, 0x59, 0x0a, 0x07, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x18, 0x03, 0x20,
-	0x6e, 0x6c, 0x79, 0x22, 0xe5, 0x02, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72,
+	0x01, 0x28, 0x0b, 0x32, 0x3f, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x09, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x6c,
+	0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x78, 0x72, 0x61, 0x79,
+	0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x65, 0x66,
-	0x4c, 0x69, 0x73, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x33,
+	0x72, 0x65, 0x73, 0x68, 0x52, 0x07, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x1a, 0x35, 0x0a,
-	0x0a, 0x06, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x1d, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74,
-	0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74,
+	0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x14,
-	0x2e, 0x49, 0x50, 0x4f, 0x72, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x06, 0x6c, 0x69, 0x73,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x76,
-	0x74, 0x65, 0x6e, 0x12, 0x4e, 0x0a, 0x0f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x5f, 0x73, 0x65,
+	0x61, 0x6c, 0x75, 0x65, 0x1a, 0x31, 0x0a, 0x19, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78,
+	0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
-	0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e,
+	0x68, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d,
-	0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x2c, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12,
-	0x66, 0x69, 0x67, 0x52, 0x0e, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x0a, 0x0a, 0x06, 0x41, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x52,
-	0x6e, 0x67, 0x73, 0x12, 0x40, 0x0a, 0x1c, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x5f, 0x6f,
+	0x61, 0x6e, 0x64, 0x6f, 0x6d, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x45, 0x78, 0x74, 0x65, 0x72,
-	0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x6e, 0x61, 0x6c, 0x10, 0x02, 0x22, 0xcc, 0x01, 0x0a, 0x0e, 0x53, 0x6e, 0x69, 0x66, 0x66, 0x69,
-	0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x65, 0x63, 0x65, 0x69,
+	0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x76, 0x65, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e,
+	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e, 0x0a, 0x11, 0x73, 0x6e, 0x69, 0x66, 0x66, 0x69, 0x6e,
+	0x65, 0x64, 0x12, 0x31, 0x0a, 0x14, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-	0x67, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x6e, 0x5f, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
-	0x32, 0x21, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78,
+	0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4f, 0x76, 0x65,
-	0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x53, 0x6e, 0x69, 0x66, 0x66, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e,
+	0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
-	0x66, 0x69, 0x67, 0x52, 0x10, 0x73, 0x6e, 0x69, 0x66, 0x66, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74,
+	0x5f, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x64, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x74, 0x69, 0x6e, 0x67, 0x73, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x22, 0xc0, 0x01, 0x0a, 0x14,
+	0x0f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x64,
-	0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x43, 0x6f,
+	0x12, 0x23, 0x0a, 0x0d, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x6f, 0x6e, 0x6c,
-	0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x61, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x09, 0x52, 0x03, 0x74, 0x61, 0x67, 0x12, 0x4d, 0x0a, 0x11, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76,
+	0x61, 0x4f, 0x6e, 0x6c, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x6f,
-	0x65, 0x72, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x6e, 0x6c, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x0b, 0x32, 0x20, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4f, 0x6e, 0x6c, 0x79, 0x22, 0xbd, 0x03, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65,
-	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x09, 0x70, 0x6f, 0x72, 0x74, 0x5f,
-	0x61, 0x67, 0x65, 0x52, 0x10, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x53, 0x65, 0x74,
+	0x6c, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x78, 0x72, 0x61,
-	0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x47, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x73,
+	0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74, 0x2e, 0x50, 0x6f, 0x72,
-	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x74, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x12,
-	0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x73, 0x65, 0x72, 0x69,
+	0x33, 0x0a, 0x06, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x61, 0x6c, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x52,
+	0x1b, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65,
-	0x0d, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x10,
+	0x74, 0x2e, 0x49, 0x50, 0x4f, 0x72, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x06, 0x6c, 0x69,
-	0x0a, 0x0e, 0x4f, 0x75, 0x74, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x73, 0x74, 0x65, 0x6e, 0x12, 0x56, 0x0a, 0x13, 0x61, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x22, 0x9d, 0x03, 0x0a, 0x0c, 0x53, 0x65, 0x6e, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x67, 0x12, 0x2d, 0x0a, 0x03, 0x76, 0x69, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74,
+	0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x2e, 0x49, 0x50, 0x4f, 0x72, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x03, 0x76, 0x69, 0x61,
+	0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x12, 0x61, 0x6c, 0x6c, 0x6f, 0x63, 0x61,
-	0x12, 0x4e, 0x0a, 0x0f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x4e, 0x0a, 0x0f,
-	0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18,
-	0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61,
-	0x6e, 0x65, 0x74, 0x2e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e,
-	0x52, 0x0e, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73,
+	0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x73, 0x74,
-	0x12, 0x4b, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x72, 0x65, 0x61, 0x6d, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x40, 0x0a, 0x1c,
-	0x67, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e,
+	0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c,
-	0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x5f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01,
-	0x65, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d,
+	0x28, 0x08, 0x52, 0x1a, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x4f, 0x72, 0x69, 0x67, 0x69,
-	0x70, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x54, 0x0a,
+	0x6e, 0x61, 0x6c, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e,
-	0x12, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
+	0x0a, 0x11, 0x73, 0x6e, 0x69, 0x66, 0x66, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79,
+	0x6e, 0x67, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x78, 0x72, 0x61, 0x79,
-	0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x4d, 0x75,
+	0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x53, 0x6e,
+	0x69, 0x66, 0x66, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x10, 0x73, 0x6e,
+	0x69, 0x66, 0x66, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x4a, 0x04,
+	0x08, 0x06, 0x10, 0x07, 0x22, 0xc0, 0x01, 0x0a, 0x14, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
+	0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a,
+	0x03, 0x74, 0x61, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x74, 0x61, 0x67, 0x12,
+	0x4d, 0x0a, 0x11, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x78, 0x72, 0x61,
+	0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x2e,
+	0x54, 0x79, 0x70, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x52, 0x10, 0x72, 0x65,
+	0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x47,
+	0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x2e, 0x54, 0x79, 0x70, 0x65,
+	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x52, 0x0d, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x10, 0x0a, 0x0e, 0x4f, 0x75, 0x74, 0x62, 0x6f,
+	0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x9d, 0x03, 0x0a, 0x0c, 0x53, 0x65,
+	0x6e, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x0a, 0x03, 0x76, 0x69,
+	0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74, 0x2e, 0x49, 0x50, 0x4f, 0x72, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x52, 0x03, 0x76, 0x69, 0x61, 0x12, 0x4e, 0x0a, 0x0f, 0x73, 0x74, 0x72,
+	0x65, 0x61, 0x6d, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70,
+	0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x53, 0x74, 0x72,
+	0x65, 0x61, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x73, 0x74, 0x72, 0x65, 0x61,
+	0x6d, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x4b, 0x0a, 0x0e, 0x70, 0x72, 0x6f,
+	0x78, 0x79, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65,
+	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x54, 0x0a, 0x12, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70,
+	0x6c, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72,
+	0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x2e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x78,
+	0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x11, 0x6d, 0x75, 0x6c, 0x74, 0x69,
+	0x70, 0x6c, 0x65, 0x78, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x19, 0x0a, 0x08,
+	0x76, 0x69, 0x61, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x76, 0x69, 0x61, 0x43, 0x69, 0x64, 0x72, 0x12, 0x50, 0x0a, 0x0f, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x27, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x0e, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x22, 0xa4, 0x01, 0x0a, 0x12, 0x4d, 0x75,
 	0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x11, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x78, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x6e, 0x67, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x76, 0x69, 0x61, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18,
+	0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x6f,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x69, 0x61, 0x43, 0x69, 0x64, 0x72, 0x12, 0x50,
+	0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x0a, 0x0f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67,
+	0x0b, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x28, 0x0a, 0x0f,
-	0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x74,
+	0x78, 0x75, 0x64, 0x70, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x18,
-	0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
+	0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0f, 0x78, 0x75, 0x64, 0x70, 0x43, 0x6f, 0x6e, 0x63, 0x75,
-	0x74, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
+	0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x28, 0x0a, 0x0f, 0x78, 0x75, 0x64, 0x70, 0x50, 0x72,
-	0x52, 0x0e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
+	0x6f, 0x78, 0x79, 0x55, 0x44, 0x50, 0x34, 0x34, 0x33, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x22, 0xa4, 0x01, 0x0a, 0x12, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x6e,
-	0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65,
-	0x6e, 0x63, 0x79, 0x12, 0x28, 0x0a, 0x0f, 0x78, 0x75, 0x64, 0x70, 0x43, 0x6f, 0x6e, 0x63, 0x75,
-	0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0f, 0x78, 0x75,
-	0x64, 0x70, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x28, 0x0a,
 	0x0f, 0x78, 0x75, 0x64, 0x70, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x55, 0x44, 0x50, 0x34, 0x34, 0x33,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x78, 0x75, 0x64, 0x70, 0x50, 0x72, 0x6f, 0x78,
+	0x42, 0x55, 0x0a, 0x15, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70,
-	0x79, 0x55, 0x44, 0x50, 0x34, 0x34, 0x33, 0x42, 0x55, 0x0a, 0x15, 0x63, 0x6f, 0x6d, 0x2e, 0x78,
+	0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x50, 0x01, 0x5a, 0x26, 0x67, 0x69, 0x74,
-	0x72, 0x61, 0x79, 0x2e, 0x61, 0x70, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61,
-	0x50, 0x01, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78,
+	0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79,
-	0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x61, 0x70,
+	0x6d, 0x61, 0x6e, 0xaa, 0x02, 0x11, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x41, 0x70, 0x70, 0x2e, 0x50,
-	0x70, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0xaa, 0x02, 0x11, 0x58, 0x72, 0x61,
+	0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-	0x79, 0x2e, 0x41, 0x70, 0x70, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x6d, 0x61, 0x6e, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -597,39 +844,48 @@ func file_app_proxyman_config_proto_rawDescGZIP() []byte {
 	return file_app_proxyman_config_proto_rawDescData
 }
 
-var file_app_proxyman_config_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_app_proxyman_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_app_proxyman_config_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_app_proxyman_config_proto_goTypes = []any{
-	(*InboundConfig)(nil),         // 0: xray.app.proxyman.InboundConfig
+	(AllocationStrategy_Type)(0),                             // 0: xray.app.proxyman.AllocationStrategy.Type
-	(*SniffingConfig)(nil),        // 1: xray.app.proxyman.SniffingConfig
+	(*InboundConfig)(nil),                                    // 1: xray.app.proxyman.InboundConfig
-	(*ReceiverConfig)(nil),        // 2: xray.app.proxyman.ReceiverConfig
+	(*AllocationStrategy)(nil),                               // 2: xray.app.proxyman.AllocationStrategy
-	(*InboundHandlerConfig)(nil),  // 3: xray.app.proxyman.InboundHandlerConfig
+	(*SniffingConfig)(nil),                                   // 3: xray.app.proxyman.SniffingConfig
-	(*OutboundConfig)(nil),        // 4: xray.app.proxyman.OutboundConfig
+	(*ReceiverConfig)(nil),                                   // 4: xray.app.proxyman.ReceiverConfig
-	(*SenderConfig)(nil),          // 5: xray.app.proxyman.SenderConfig
+	(*InboundHandlerConfig)(nil),                             // 5: xray.app.proxyman.InboundHandlerConfig
-	(*MultiplexingConfig)(nil),    // 6: xray.app.proxyman.MultiplexingConfig
+	(*OutboundConfig)(nil),                                   // 6: xray.app.proxyman.OutboundConfig
-	(*net.PortList)(nil),          // 7: xray.common.net.PortList
+	(*SenderConfig)(nil),                                     // 7: xray.app.proxyman.SenderConfig
-	(*net.IPOrDomain)(nil),        // 8: xray.common.net.IPOrDomain
+	(*MultiplexingConfig)(nil),                               // 8: xray.app.proxyman.MultiplexingConfig
-	(*internet.StreamConfig)(nil), // 9: xray.transport.internet.StreamConfig
+	(*AllocationStrategy_AllocationStrategyConcurrency)(nil), // 9: xray.app.proxyman.AllocationStrategy.AllocationStrategyConcurrency
-	(*serial.TypedMessage)(nil),   // 10: xray.common.serial.TypedMessage
+	(*AllocationStrategy_AllocationStrategyRefresh)(nil),     // 10: xray.app.proxyman.AllocationStrategy.AllocationStrategyRefresh
-	(*internet.ProxyConfig)(nil),  // 11: xray.transport.internet.ProxyConfig
+	(*net.PortList)(nil),                                     // 11: xray.common.net.PortList
-	(internet.DomainStrategy)(0),  // 12: xray.transport.internet.DomainStrategy
+	(*net.IPOrDomain)(nil),                                   // 12: xray.common.net.IPOrDomain
+	(*internet.StreamConfig)(nil),                            // 13: xray.transport.internet.StreamConfig
+	(*serial.TypedMessage)(nil),                              // 14: xray.common.serial.TypedMessage
+	(*internet.ProxyConfig)(nil),                             // 15: xray.transport.internet.ProxyConfig
+	(internet.DomainStrategy)(0),                             // 16: xray.transport.internet.DomainStrategy
 }
 var file_app_proxyman_config_proto_depIdxs = []int32{
-	7,  // 0: xray.app.proxyman.ReceiverConfig.port_list:type_name -> xray.common.net.PortList
+	0,  // 0: xray.app.proxyman.AllocationStrategy.type:type_name -> xray.app.proxyman.AllocationStrategy.Type
-	8,  // 1: xray.app.proxyman.ReceiverConfig.listen:type_name -> xray.common.net.IPOrDomain
+	9,  // 1: xray.app.proxyman.AllocationStrategy.concurrency:type_name -> xray.app.proxyman.AllocationStrategy.AllocationStrategyConcurrency
-	9,  // 2: xray.app.proxyman.ReceiverConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
+	10, // 2: xray.app.proxyman.AllocationStrategy.refresh:type_name -> xray.app.proxyman.AllocationStrategy.AllocationStrategyRefresh
-	1,  // 3: xray.app.proxyman.ReceiverConfig.sniffing_settings:type_name -> xray.app.proxyman.SniffingConfig
+	11, // 3: xray.app.proxyman.ReceiverConfig.port_list:type_name -> xray.common.net.PortList
-	10, // 4: xray.app.proxyman.InboundHandlerConfig.receiver_settings:type_name -> xray.common.serial.TypedMessage
+	12, // 4: xray.app.proxyman.ReceiverConfig.listen:type_name -> xray.common.net.IPOrDomain
-	10, // 5: xray.app.proxyman.InboundHandlerConfig.proxy_settings:type_name -> xray.common.serial.TypedMessage
+	2,  // 5: xray.app.proxyman.ReceiverConfig.allocation_strategy:type_name -> xray.app.proxyman.AllocationStrategy
-	8,  // 6: xray.app.proxyman.SenderConfig.via:type_name -> xray.common.net.IPOrDomain
+	13, // 6: xray.app.proxyman.ReceiverConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
-	9,  // 7: xray.app.proxyman.SenderConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
+	3,  // 7: xray.app.proxyman.ReceiverConfig.sniffing_settings:type_name -> xray.app.proxyman.SniffingConfig
-	11, // 8: xray.app.proxyman.SenderConfig.proxy_settings:type_name -> xray.transport.internet.ProxyConfig
+	14, // 8: xray.app.proxyman.InboundHandlerConfig.receiver_settings:type_name -> xray.common.serial.TypedMessage
-	6,  // 9: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
+	14, // 9: xray.app.proxyman.InboundHandlerConfig.proxy_settings:type_name -> xray.common.serial.TypedMessage
-	12, // 10: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
+	12, // 10: xray.app.proxyman.SenderConfig.via:type_name -> xray.common.net.IPOrDomain
-	11, // [11:11] is the sub-list for method output_type
+	13, // 11: xray.app.proxyman.SenderConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
-	11, // [11:11] is the sub-list for method input_type
+	15, // 12: xray.app.proxyman.SenderConfig.proxy_settings:type_name -> xray.transport.internet.ProxyConfig
-	11, // [11:11] is the sub-list for extension type_name
+	8,  // 13: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
-	11, // [11:11] is the sub-list for extension extendee
+	16, // 14: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
-	0,  // [0:11] is the sub-list for field type_name
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_app_proxyman_config_proto_init() }
@@ -642,13 +898,14 @@ func file_app_proxyman_config_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_app_proxyman_config_proto_rawDesc,
-			NumEnums:      0,
+			NumEnums:      1,
-			NumMessages:   7,
+			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
 		GoTypes:           file_app_proxyman_config_proto_goTypes,
 		DependencyIndexes: file_app_proxyman_config_proto_depIdxs,
+		EnumInfos:         file_app_proxyman_config_proto_enumTypes,
 		MessageInfos:      file_app_proxyman_config_proto_msgTypes,
 	}.Build()
 	File_app_proxyman_config_proto = out.File

app/proxyman/config.proto

@@ -13,6 +13,33 @@ import "common/serial/typed_message.proto";
 
 message InboundConfig {}
 
+message AllocationStrategy {
+  enum Type {
+    // Always allocate all connection handlers.
+    Always = 0;
+
+    // Randomly allocate specific range of handlers.
+    Random = 1;
+
+    // External. Not supported yet.
+    External = 2;
+  }
+
+  Type type = 1;
+
+  message AllocationStrategyConcurrency { uint32 value = 1; }
+
+  // Number of handlers (ports) running in parallel.
+  // Default value is 3 if unset.
+  AllocationStrategyConcurrency concurrency = 2;
+
+  message AllocationStrategyRefresh { uint32 value = 1; }
+
+  // Number of minutes before a handler is regenerated.
+  // Default value is 5 if unset.
+  AllocationStrategyRefresh refresh = 3;
+}
+
 message SniffingConfig {
   // Whether or not to enable content sniffing on an inbound connection.
   bool enabled = 1;
@@ -35,10 +62,11 @@ message ReceiverConfig {
   xray.common.net.PortList port_list = 1;
   // Listen specifies the IP address that the Receiver should listen on.
   xray.common.net.IPOrDomain listen = 2;
-  xray.transport.internet.StreamConfig stream_settings = 3;
+  AllocationStrategy allocation_strategy = 3;
-  bool receive_original_destination = 4;
+  xray.transport.internet.StreamConfig stream_settings = 4;
-  reserved 5;
+  bool receive_original_destination = 5;
-  SniffingConfig sniffing_settings = 6;
+  reserved 6;
+  SniffingConfig sniffing_settings = 7;
 }
 
 message InboundHandlerConfig {

app/proxyman/inbound/always.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/xtls/xray-core/app/proxyman"
 	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
@@ -102,7 +103,7 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *
 				stream:          mss,
 				tag:             tag,
 				dispatcher:      h.mux,
-				sniffingConfig:  receiverConfig.SniffingSettings,
+				sniffingConfig:  receiverConfig.GetEffectiveSniffingSettings(),
 				uplinkCounter:   uplinkCounter,
 				downlinkCounter: downlinkCounter,
 				ctx:             ctx,
@@ -124,7 +125,7 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *
 						recvOrigDest:    receiverConfig.ReceiveOriginalDestination,
 						tag:             tag,
 						dispatcher:      h.mux,
-						sniffingConfig:  receiverConfig.SniffingSettings,
+						sniffingConfig:  receiverConfig.GetEffectiveSniffingSettings(),
 						uplinkCounter:   uplinkCounter,
 						downlinkCounter: downlinkCounter,
 						ctx:             ctx,
@@ -139,7 +140,7 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *
 						address:         address,
 						port:            net.Port(port),
 						dispatcher:      h.mux,
-						sniffingConfig:  receiverConfig.SniffingSettings,
+						sniffingConfig:  receiverConfig.GetEffectiveSniffingSettings(),
 						uplinkCounter:   uplinkCounter,
 						downlinkCounter: downlinkCounter,
 						stream:          mss,
@@ -177,6 +178,14 @@ func (h *AlwaysOnInboundHandler) Close() error {
 	return nil
 }
 
+func (h *AlwaysOnInboundHandler) GetRandomInboundProxy() (interface{}, net.Port, int) {
+	if len(h.workers) == 0 {
+		return nil, 0, 0
+	}
+	w := h.workers[dice.Roll(len(h.workers))]
+	return w.Proxy(), w.Port(), 9999
+}
+
 func (h *AlwaysOnInboundHandler) Tag() string {
 	return h.tag
 }

app/proxyman/inbound/dynamic.go

@@ -0,0 +1,222 @@
+package inbound
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/xtls/xray-core/app/proxyman"
+	"github.com/xtls/xray-core/common/dice"
+	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/mux"
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/common/task"
+	"github.com/xtls/xray-core/core"
+	"github.com/xtls/xray-core/proxy"
+	"github.com/xtls/xray-core/transport/internet"
+	"google.golang.org/protobuf/proto"
+)
+
+type DynamicInboundHandler struct {
+	tag            string
+	v              *core.Instance
+	proxyConfig    interface{}
+	receiverConfig *proxyman.ReceiverConfig
+	streamSettings *internet.MemoryStreamConfig
+	portMutex      sync.Mutex
+	portsInUse     map[net.Port]struct{}
+	workerMutex    sync.RWMutex
+	worker         []worker
+	lastRefresh    time.Time
+	mux            *mux.Server
+	task           *task.Periodic
+
+	ctx context.Context
+}
+
+func NewDynamicInboundHandler(ctx context.Context, tag string, receiverConfig *proxyman.ReceiverConfig, proxyConfig interface{}) (*DynamicInboundHandler, error) {
+	v := core.MustFromContext(ctx)
+	h := &DynamicInboundHandler{
+		tag:            tag,
+		proxyConfig:    proxyConfig,
+		receiverConfig: receiverConfig,
+		portsInUse:     make(map[net.Port]struct{}),
+		mux:            mux.NewServer(ctx),
+		v:              v,
+		ctx:            ctx,
+	}
+
+	mss, err := internet.ToMemoryStreamConfig(receiverConfig.StreamSettings)
+	if err != nil {
+		return nil, errors.New("failed to parse stream settings").Base(err).AtWarning()
+	}
+	if receiverConfig.ReceiveOriginalDestination {
+		if mss.SocketSettings == nil {
+			mss.SocketSettings = &internet.SocketConfig{}
+		}
+		if mss.SocketSettings.Tproxy == internet.SocketConfig_Off {
+			mss.SocketSettings.Tproxy = internet.SocketConfig_Redirect
+		}
+		mss.SocketSettings.ReceiveOriginalDestAddress = true
+	}
+
+	h.streamSettings = mss
+
+	h.task = &task.Periodic{
+		Interval: time.Minute * time.Duration(h.receiverConfig.AllocationStrategy.GetRefreshValue()),
+		Execute:  h.refresh,
+	}
+
+	return h, nil
+}
+
+func (h *DynamicInboundHandler) allocatePort() net.Port {
+	allPorts := []int32{}
+	for _, pr := range h.receiverConfig.PortList.Range {
+		for i := pr.From; i <= pr.To; i++ {
+			allPorts = append(allPorts, int32(i))
+		}
+	}
+	h.portMutex.Lock()
+	defer h.portMutex.Unlock()
+
+	for {
+		r := dice.Roll(len(allPorts))
+		port := net.Port(allPorts[r])
+		_, used := h.portsInUse[port]
+		if !used {
+			h.portsInUse[port] = struct{}{}
+			return port
+		}
+	}
+}
+
+func (h *DynamicInboundHandler) closeWorkers(workers []worker) {
+	ports2Del := make([]net.Port, len(workers))
+	for idx, worker := range workers {
+		ports2Del[idx] = worker.Port()
+		if err := worker.Close(); err != nil {
+			errors.LogInfoInner(h.ctx, err, "failed to close worker")
+		}
+	}
+
+	h.portMutex.Lock()
+	for _, port := range ports2Del {
+		delete(h.portsInUse, port)
+	}
+	h.portMutex.Unlock()
+}
+
+func (h *DynamicInboundHandler) refresh() error {
+	h.lastRefresh = time.Now()
+
+	timeout := time.Minute * time.Duration(h.receiverConfig.AllocationStrategy.GetRefreshValue()) * 2
+	concurrency := h.receiverConfig.AllocationStrategy.GetConcurrencyValue()
+	workers := make([]worker, 0, concurrency)
+
+	address := h.receiverConfig.Listen.AsAddress()
+	if address == nil {
+		address = net.AnyIP
+	}
+
+	uplinkCounter, downlinkCounter := getStatCounter(h.v, h.tag)
+
+	for i := uint32(0); i < concurrency; i++ {
+		port := h.allocatePort()
+		rawProxy, err := core.CreateObject(h.v, h.proxyConfig)
+		if err != nil {
+			errors.LogWarningInner(h.ctx, err, "failed to create proxy instance")
+			continue
+		}
+		p := rawProxy.(proxy.Inbound)
+		nl := p.Network()
+		if net.HasNetwork(nl, net.Network_TCP) {
+			worker := &tcpWorker{
+				tag:             h.tag,
+				address:         address,
+				port:            port,
+				proxy:           p,
+				stream:          h.streamSettings,
+				recvOrigDest:    h.receiverConfig.ReceiveOriginalDestination,
+				dispatcher:      h.mux,
+				sniffingConfig:  h.receiverConfig.GetEffectiveSniffingSettings(),
+				uplinkCounter:   uplinkCounter,
+				downlinkCounter: downlinkCounter,
+				ctx:             h.ctx,
+			}
+			if err := worker.Start(); err != nil {
+				errors.LogWarningInner(h.ctx, err, "failed to create TCP worker")
+				continue
+			}
+			workers = append(workers, worker)
+		}
+
+		if net.HasNetwork(nl, net.Network_UDP) {
+			worker := &udpWorker{
+				tag:             h.tag,
+				proxy:           p,
+				address:         address,
+				port:            port,
+				dispatcher:      h.mux,
+				sniffingConfig:  h.receiverConfig.GetEffectiveSniffingSettings(),
+				uplinkCounter:   uplinkCounter,
+				downlinkCounter: downlinkCounter,
+				stream:          h.streamSettings,
+				ctx:             h.ctx,
+			}
+			if err := worker.Start(); err != nil {
+				errors.LogWarningInner(h.ctx, err, "failed to create UDP worker")
+				continue
+			}
+			workers = append(workers, worker)
+		}
+	}
+
+	h.workerMutex.Lock()
+	h.worker = workers
+	h.workerMutex.Unlock()
+
+	time.AfterFunc(timeout, func() {
+		h.closeWorkers(workers)
+	})
+
+	return nil
+}
+
+func (h *DynamicInboundHandler) Start() error {
+	return h.task.Start()
+}
+
+func (h *DynamicInboundHandler) Close() error {
+	return h.task.Close()
+}
+
+func (h *DynamicInboundHandler) GetRandomInboundProxy() (interface{}, net.Port, int) {
+	h.workerMutex.RLock()
+	defer h.workerMutex.RUnlock()
+
+	if len(h.worker) == 0 {
+		return nil, 0, 0
+	}
+	w := h.worker[dice.Roll(len(h.worker))]
+	expire := h.receiverConfig.AllocationStrategy.GetRefreshValue() - uint32(time.Since(h.lastRefresh)/time.Minute)
+	return w.Proxy(), w.Port(), int(expire)
+}
+
+func (h *DynamicInboundHandler) Tag() string {
+	return h.tag
+}
+
+// ReceiverSettings implements inbound.Handler.
+func (h *DynamicInboundHandler) ReceiverSettings() *serial.TypedMessage {
+	return serial.ToTypedMessage(h.receiverConfig)
+}
+
+// ProxySettings implements inbound.Handler.
+func (h *DynamicInboundHandler) ProxySettings() *serial.TypedMessage {
+	if v, ok := h.proxyConfig.(proto.Message); ok {
+		return serial.ToTypedMessage(v)
+	}
+	return nil
+}

app/proxyman/inbound/inbound.go

@@ -178,7 +178,15 @@ func NewHandler(ctx context.Context, config *core.InboundHandlerConfig) (inbound
 		ctx = session.ContextWithAllowedNetwork(ctx, net.Network_UDP)
 	}
 
-	return NewAlwaysOnInboundHandler(ctx, tag, receiverSettings, proxySettings)
+	allocStrategy := receiverSettings.AllocationStrategy
+	if allocStrategy == nil || allocStrategy.Type == proxyman.AllocationStrategy_Always {
+		return NewAlwaysOnInboundHandler(ctx, tag, receiverSettings, proxySettings)
+	}
+
+	if allocStrategy.Type == proxyman.AllocationStrategy_Random {
+		return NewDynamicInboundHandler(ctx, tag, receiverSettings, proxySettings)
+	}
+	return nil, errors.New("unknown allocation strategy: ", receiverSettings.AllocationStrategy.Type).AtError()
 }
 
 func init() {

app/proxyman/inbound/worker.go

@@ -2,7 +2,6 @@ package inbound
 
 import (
 	"context"
-	gonet "net"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -77,25 +76,7 @@ func (w *tcpWorker) callback(conn stat.Connection) {
 		case internet.SocketConfig_TProxy:
 			dest = net.DestinationFromAddr(conn.LocalAddr())
 		}
-
 		if dest.IsValid() {
-			// Check if try to connect to this inbound itself (can cause loopback)
-			var isLoopBack bool
-			if w.address == net.AnyIP || w.address == net.AnyIPv6 {
-				if dest.Port.Value() == w.port.Value() && IsLocal(dest.Address.IP()) {
-					isLoopBack = true
-				}
-			} else {
-				if w.hub.Addr().String() == dest.NetAddr() {
-					isLoopBack = true
-				}
-			}
-			if isLoopBack {
-				cancel()
-				conn.Close()
-				errors.LogError(ctx, errors.New("loopback connection detected"))
-				return
-			}
 			outbounds[0].Target = dest
 		}
 	}
@@ -563,18 +544,3 @@ func (w *dsWorker) Close() error {
 
 	return nil
 }
-
-func IsLocal(ip net.IP) bool {
-	addrs, err := gonet.InterfaceAddrs()
-	if err != nil {
-		return false
-	}
-	for _, addr := range addrs {
-		if ipnet, ok := addr.(*gonet.IPNet); ok {
-			if ipnet.IP.Equal(ip) {
-				return true
-			}
-		}
-	}
-	return false
-}

app/proxyman/outbound/handler.go

@@ -108,8 +108,6 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou
 	}
 	h.proxyConfig = proxyConfig
 
-	ctx = session.ContextWithHandler(ctx, h)
-
 	rawProxyHandler, err := common.CreateObject(ctx, proxyConfig)
 	if err != nil {
 		return nil, err

app/reverse/bridge.go

@@ -9,7 +9,6 @@ import (
 	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/common/signal"
 	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/transport"
@@ -54,11 +53,6 @@ func (b *Bridge) cleanup() {
 		if w.IsActive() {
 			activeWorkers = append(activeWorkers, w)
 		}
-		if w.Closed() {
-			if w.Timer != nil {
-				w.Timer.SetTimeout(0)
-			}
-		}
 	}
 
 	if len(activeWorkers) != len(b.workers) {
@@ -100,11 +94,10 @@ func (b *Bridge) Close() error {
 }
 
 type BridgeWorker struct {
-	Tag        string
+	tag        string
-	Worker     *mux.ServerWorker
+	worker     *mux.ServerWorker
-	Dispatcher routing.Dispatcher
+	dispatcher routing.Dispatcher
-	State      Control_State
+	state      Control_State
-	Timer      *signal.ActivityTimer
 }
 
 func NewBridgeWorker(domain string, tag string, d routing.Dispatcher) (*BridgeWorker, error) {
@@ -122,20 +115,16 @@ func NewBridgeWorker(domain string, tag string, d routing.Dispatcher) (*BridgeWo
 	}
 
 	w := &BridgeWorker{
-		Dispatcher: d,
+		dispatcher: d,
-		Tag:        tag,
+		tag:        tag,
 	}
 
 	worker, err := mux.NewServerWorker(context.Background(), w, link)
 	if err != nil {
 		return nil, err
 	}
-	w.Worker = worker
+	w.worker = worker
 
-	terminate := func() {
-		worker.Close()
-	}
-	w.Timer = signal.CancelAfterInactivity(ctx, terminate, 60*time.Second)
 	return w, nil
 }
 
@@ -152,15 +141,11 @@ func (w *BridgeWorker) Close() error {
 }
 
 func (w *BridgeWorker) IsActive() bool {
-	return w.State == Control_ACTIVE && !w.Worker.Closed()
+	return w.state == Control_ACTIVE && !w.worker.Closed()
-}
-
-func (w *BridgeWorker) Closed() bool {
-	return w.Worker.Closed()
 }
 
 func (w *BridgeWorker) Connections() uint32 {
-	return w.Worker.ActiveConnections()
+	return w.worker.ActiveConnections()
 }
 
 func (w *BridgeWorker) handleInternalConn(link *transport.Link) {
@@ -168,29 +153,16 @@ func (w *BridgeWorker) handleInternalConn(link *transport.Link) {
 	for {
 		mb, err := reader.ReadMultiBuffer()
 		if err != nil {
-			if w.Timer != nil {
+			break
-				if w.Closed() {
-					w.Timer.SetTimeout(0)
-				} else {
-					w.Timer.SetTimeout(24 * time.Hour)
-				}
-			}
-			return
-		}
-		if w.Timer != nil {
-			w.Timer.Update()
 		}
 		for _, b := range mb {
 			var ctl Control
 			if err := proto.Unmarshal(b.Bytes(), &ctl); err != nil {
 				errors.LogInfoInner(context.Background(), err, "failed to parse proto message")
-				if w.Timer != nil {
+				break
-					w.Timer.SetTimeout(0)
-				}
-				return
 			}
-			if ctl.State != w.State {
+			if ctl.State != w.state {
-				w.State = ctl.State
+				w.state = ctl.State
 			}
 		}
 	}
@@ -199,9 +171,9 @@ func (w *BridgeWorker) handleInternalConn(link *transport.Link) {
 func (w *BridgeWorker) Dispatch(ctx context.Context, dest net.Destination) (*transport.Link, error) {
 	if !isInternalDomain(dest) {
 		ctx = session.ContextWithInbound(ctx, &session.Inbound{
-			Tag: w.Tag,
+			Tag: w.tag,
 		})
-		return w.Dispatcher.Dispatch(ctx, dest)
+		return w.dispatcher.Dispatch(ctx, dest)
 	}
 
 	opt := []pipe.Option{pipe.WithSizeLimit(16 * 1024)}
@@ -222,12 +194,12 @@ func (w *BridgeWorker) Dispatch(ctx context.Context, dest net.Destination) (*tra
 func (w *BridgeWorker) DispatchLink(ctx context.Context, dest net.Destination, link *transport.Link) error {
 	if !isInternalDomain(dest) {
 		ctx = session.ContextWithInbound(ctx, &session.Inbound{
-			Tag: w.Tag,
+			Tag: w.tag,
 		})
-		return w.Dispatcher.DispatchLink(ctx, dest, link)
+		return w.dispatcher.DispatchLink(ctx, dest, link)
 	}
 
-	link = w.Dispatcher.(*dispatcher.DefaultDispatcher).WrapLink(ctx, link)
+	link = w.dispatcher.(*dispatcher.DefaultDispatcher).WrapLink(ctx, link)
 	w.handleInternalConn(link)
 
 	return nil

app/reverse/portal.go

@@ -12,7 +12,6 @@ import (
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/common/signal"
 	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/features/outbound"
 	"github.com/xtls/xray-core/transport"
@@ -83,21 +82,9 @@ func (p *Portal) HandleConnection(ctx context.Context, link *transport.Link) err
 		}
 
 		p.picker.AddWorker(worker)
-
-		if _, ok := link.Reader.(*pipe.Reader); !ok {
-			select {
-			case <-ctx.Done():
-			case <-muxClient.WaitClosed():
-			}
-		}
 		return nil
 	}
 
-	if ob.Target.Network == net.Network_UDP && ob.OriginalTarget.Address != nil && ob.OriginalTarget.Address != ob.Target.Address {
-		link.Reader = &buf.EndpointOverrideReader{Reader: link.Reader, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
-		link.Writer = &buf.EndpointOverrideWriter{Writer: link.Writer, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
-	}
-
 	return p.client.Dispatch(ctx, link)
 }
 
@@ -114,7 +101,6 @@ func (o *Outbound) Dispatch(ctx context.Context, link *transport.Link) {
 	if err := o.portal.HandleConnection(ctx, link); err != nil {
 		errors.LogInfoInner(ctx, err, "failed to process reverse connection")
 		common.Interrupt(link.Writer)
-		common.Interrupt(link.Reader)
 	}
 }
 
@@ -160,8 +146,6 @@ func (p *StaticMuxPicker) cleanup() error {
 	for _, w := range p.workers {
 		if !w.Closed() {
 			activeWorkers = append(activeWorkers, w)
-		} else {
-			w.timer.SetTimeout(0)
 		}
 	}
 
@@ -228,7 +212,6 @@ type PortalWorker struct {
 	reader   buf.Reader
 	draining bool
 	counter  uint32
-	timer    *signal.ActivityTimer
 }
 
 func NewPortalWorker(client *mux.ClientWorker) (*PortalWorker, error) {
@@ -248,14 +231,10 @@ func NewPortalWorker(client *mux.ClientWorker) (*PortalWorker, error) {
 	if !f {
 		return nil, errors.New("unable to dispatch control connection")
 	}
-	terminate := func() {
-		client.Close()
-	}
 	w := &PortalWorker{
 		client: client,
 		reader: downlinkReader,
 		writer: uplinkWriter,
-		timer:  signal.CancelAfterInactivity(ctx, terminate, 24*time.Hour), // // prevent leak
 	}
 	w.control = &task.Periodic{
 		Execute:  w.heartbeat,
@@ -282,6 +261,7 @@ func (w *PortalWorker) heartbeat() error {
 		msg.State = Control_DRAIN
 
 		defer func() {
+			w.client.GetTimer().Reset(time.Second * 16)
 			common.Close(w.writer)
 			common.Interrupt(w.reader)
 			w.writer = nil
@@ -293,7 +273,6 @@ func (w *PortalWorker) heartbeat() error {
 		b, err := proto.Marshal(msg)
 		common.Must(err)
 		mb := buf.MergeBytes(nil, b)
-		w.timer.Update()
 		return w.writer.WriteMultiBuffer(mb)
 	}
 	return nil

app/reverse/reverse.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	internalDomain = "reverse"
+	internalDomain = "reverse.internal.v2fly.org" // make reverse proxy compatible with v2fly
 )
 
 func isDomain(dest net.Destination, domain string) bool {

common/mux/client.go

@@ -215,20 +215,14 @@ func (m *ClientWorker) Closed() bool {
 	return m.done.Done()
 }
 
-func (m *ClientWorker) WaitClosed() <-chan struct{} {
+func (m *ClientWorker) GetTimer() *time.Ticker {
-	return m.done.Wait()
+	return m.timer
-}
-
-func (m *ClientWorker) Close() error {
-	return m.done.Close()
 }
 
 func (m *ClientWorker) monitor() {
 	defer m.timer.Stop()
 
 	for {
-		checkSize := m.sessionManager.Size()
-		checkCount := m.sessionManager.Count()
 		select {
 		case <-m.done.Wait():
 			m.sessionManager.Close()
@@ -236,7 +230,8 @@ func (m *ClientWorker) monitor() {
 			common.Interrupt(m.link.Reader)
 			return
 		case <-m.timer.C:
-			if m.sessionManager.CloseIfNoSessionAndIdle(checkSize, checkCount) {
+			size := m.sessionManager.Size()
+			if size == 0 && m.sessionManager.CloseIfNoSession() {
 				common.Must(m.done.Close())
 			}
 		}
@@ -256,7 +251,7 @@ func writeFirstPayload(reader buf.Reader, writer *Writer) error {
 	return nil
 }
 
-func fetchInput(ctx context.Context, s *Session, output buf.Writer) {
+func fetchInput(ctx context.Context, s *Session, output buf.Writer, timer *time.Ticker) {
 	outbounds := session.OutboundsFromContext(ctx)
 	ob := outbounds[len(outbounds)-1]
 	transferType := protocol.TransferTypeStream
@@ -267,6 +262,7 @@ func fetchInput(ctx context.Context, s *Session, output buf.Writer) {
 	writer := NewWriter(s.ID, ob.Target, output, transferType, xudp.GetGlobalID(ctx))
 	defer s.Close(false)
 	defer writer.Close()
+	defer timer.Reset(time.Second * 16)
 
 	errors.LogInfo(ctx, "dispatching request to ", ob.Target)
 	if err := writeFirstPayload(s.input, writer); err != nil {
@@ -316,12 +312,10 @@ func (m *ClientWorker) Dispatch(ctx context.Context, link *transport.Link) bool
 	}
 	s.input = link.Reader
 	s.output = link.Writer
-	go fetchInput(ctx, s, m.link.Writer)
+	if _, ok := link.Reader.(*pipe.Reader); ok {
-	if _, ok := link.Reader.(*pipe.Reader); !ok {
+		go fetchInput(ctx, s, m.link.Writer, m.timer)
-		select {
+	} else {
-		case <-ctx.Done():
+		fetchInput(ctx, s, m.link.Writer, m.timer)
-		case <-s.done.Wait():
-		}
 	}
 	return true
 }

common/mux/server.go

@@ -3,7 +3,6 @@ package mux
 import (
 	"context"
 	"io"
-	"time"
 
 	"github.com/xtls/xray-core/app/dispatcher"
 	"github.com/xtls/xray-core/common"
@@ -13,7 +12,6 @@ import (
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/transport"
@@ -65,15 +63,8 @@ func (s *Server) DispatchLink(ctx context.Context, dest net.Destination, link *t
 		return s.dispatcher.DispatchLink(ctx, dest, link)
 	}
 	link = s.dispatcher.(*dispatcher.DefaultDispatcher).WrapLink(ctx, link)
-	worker, err := NewServerWorker(ctx, s.dispatcher, link)
+	_, err := NewServerWorker(ctx, s.dispatcher, link)
-	if err != nil {
+	return err
-		return err
-	}
-	select {
-	case <-ctx.Done():
-	case <-worker.done.Wait():
-	}
-	return nil
 }
 
 // Start implements common.Runnable.
@@ -90,8 +81,6 @@ type ServerWorker struct {
 	dispatcher     routing.Dispatcher
 	link           *transport.Link
 	sessionManager *SessionManager
-	done           *done.Instance
-	timer          *time.Ticker
 }
 
 func NewServerWorker(ctx context.Context, d routing.Dispatcher, link *transport.Link) (*ServerWorker, error) {
@@ -99,14 +88,15 @@ func NewServerWorker(ctx context.Context, d routing.Dispatcher, link *transport.
 		dispatcher:     d,
 		link:           link,
 		sessionManager: NewSessionManager(),
-		done:           done.New(),
-		timer:          time.NewTicker(60 * time.Second),
 	}
 	if inbound := session.InboundFromContext(ctx); inbound != nil {
 		inbound.CanSpliceCopy = 3
 	}
-	go worker.run(ctx)
+	if _, ok := link.Reader.(*pipe.Reader); ok {
-	go worker.monitor()
+		go worker.run(ctx)
+	} else {
+		worker.run(ctx)
+	}
 	return worker, nil
 }
 
@@ -121,40 +111,12 @@ func handle(ctx context.Context, s *Session, output buf.Writer) {
 	s.Close(false)
 }
 
-func (w *ServerWorker) monitor() {
-	defer w.timer.Stop()
-
-	for {
-		checkSize := w.sessionManager.Size()
-		checkCount := w.sessionManager.Count()
-		select {
-		case <-w.done.Wait():
-			w.sessionManager.Close()
-			common.Interrupt(w.link.Writer)
-			common.Interrupt(w.link.Reader)
-			return
-		case <-w.timer.C:
-			if w.sessionManager.CloseIfNoSessionAndIdle(checkSize, checkCount) {
-				common.Must(w.done.Close())
-			}
-		}
-	}
-}
-
 func (w *ServerWorker) ActiveConnections() uint32 {
 	return uint32(w.sessionManager.Size())
 }
 
 func (w *ServerWorker) Closed() bool {
-	return w.done.Done()
+	return w.sessionManager.Closed()
-}
-
-func (w *ServerWorker) WaitClosed() <-chan struct{} {
-	return w.done.Wait()
-}
-
-func (w *ServerWorker) Close() error {
-	return w.done.Close()
 }
 
 func (w *ServerWorker) handleStatusKeepAlive(meta *FrameMetadata, reader *buf.BufferedReader) error {
@@ -355,12 +317,12 @@ func (w *ServerWorker) handleFrame(ctx context.Context, reader *buf.BufferedRead
 }
 
 func (w *ServerWorker) run(ctx context.Context) {
-	defer func() {
-		common.Must(w.done.Close())
-	}()
-
 	reader := &buf.BufferedReader{Reader: w.link.Reader}
 
+	defer w.sessionManager.Close()
+	defer common.Interrupt(w.link.Reader)
+	defer common.Interrupt(w.link.Writer)
+
 	for {
 		select {
 		case <-ctx.Done():

common/mux/session.go

@@ -12,7 +12,6 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
-	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/transport/pipe"
 )
 
@@ -54,7 +53,7 @@ func (m *SessionManager) Count() int {
 func (m *SessionManager) Allocate(Strategy *ClientStrategy) *Session {
 	m.Lock()
 	defer m.Unlock()
-
+	
 	MaxConcurrency := int(Strategy.MaxConcurrency)
 	MaxConnection := uint16(Strategy.MaxConnection)
 
@@ -66,7 +65,6 @@ func (m *SessionManager) Allocate(Strategy *ClientStrategy) *Session {
 	s := &Session{
 		ID:     m.count,
 		parent: m,
-		done:   done.New(),
 	}
 	m.sessions[s.ID] = s
 	return s
@@ -117,7 +115,7 @@ func (m *SessionManager) Get(id uint16) (*Session, bool) {
 	return s, found
 }
 
-func (m *SessionManager) CloseIfNoSessionAndIdle(checkSize int, checkCount int) bool {
+func (m *SessionManager) CloseIfNoSession() bool {
 	m.Lock()
 	defer m.Unlock()
 
@@ -125,13 +123,11 @@ func (m *SessionManager) CloseIfNoSessionAndIdle(checkSize int, checkCount int)
 		return true
 	}
 
-	if len(m.sessions) != 0 || checkSize != 0 || checkCount != int(m.count) {
+	if len(m.sessions) != 0 {
 		return false
 	}
 
 	m.closed = true
-
-	m.sessions = nil
 	return true
 }
 
@@ -161,7 +157,6 @@ type Session struct {
 	ID           uint16
 	transferType protocol.TransferType
 	closed       bool
-	done         *done.Instance
 	XUDP         *XUDP
 }
 
@@ -176,9 +171,6 @@ func (s *Session) Close(locked bool) error {
 		return nil
 	}
 	s.closed = true
-	if s.done != nil {
-		s.done.Close()
-	}
 	if s.XUDP == nil {
 		common.Interrupt(s.input)
 		common.Close(s.output)

common/mux/session_test.go

@@ -41,11 +41,11 @@ func TestSessionManagerClose(t *testing.T) {
 	m := NewSessionManager()
 	s := m.Allocate(&ClientStrategy{})
 
-	if m.CloseIfNoSessionAndIdle(m.Size(), m.Count()) {
+	if m.CloseIfNoSession() {
 		t.Error("able to close")
 	}
 	m.Remove(false, s.ID)
-	if !m.CloseIfNoSessionAndIdle(m.Size(), m.Count()) {
+	if !m.CloseIfNoSession() {
 		t.Error("not able to close")
 	}
 }

common/protocol/headers.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/xtls/xray-core/common/bitmask"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/uuid"
 	"golang.org/x/sys/cpu"
 )
 
@@ -15,12 +16,11 @@ const (
 	RequestCommandTCP = RequestCommand(0x01)
 	RequestCommandUDP = RequestCommand(0x02)
 	RequestCommandMux = RequestCommand(0x03)
-	RequestCommandRvs = RequestCommand(0x04)
 )
 
 func (c RequestCommand) TransferType() TransferType {
 	switch c {
-	case RequestCommandTCP, RequestCommandMux, RequestCommandRvs:
+	case RequestCommandTCP, RequestCommandMux:
 		return TransferTypeStream
 	case RequestCommandUDP:
 		return TransferTypePacket
@@ -70,6 +70,14 @@ type ResponseHeader struct {
 	Command ResponseCommand
 }
 
+type CommandSwitchAccount struct {
+	Host     net.Address
+	Port     net.Port
+	ID       uuid.UUID
+	Level    uint32
+	ValidMin byte
+}
+
 var (
 	// Keep in sync with crypto/tls/cipher_suites.go.
 	hasGCMAsmAMD64 = cpu.X86.HasAES && cpu.X86.HasPCLMULQDQ && cpu.X86.HasSSE41 && cpu.X86.HasSSSE3

common/protocol/http/client.go

@@ -0,0 +1,34 @@
+package http
+
+import (
+	"context"
+	gohttp "net/http"
+
+	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/transport/internet"
+)
+
+// NewClient creates an HTTP client with with internal dialer and using the given sockopt.
+// sockopt can only have one or empty.
+func NewClient(sockopt ...*internet.SocketConfig) *gohttp.Client {
+	var Sockopt *internet.SocketConfig
+	switch len(sockopt) {
+	case 0:
+	case 1:
+		Sockopt = sockopt[0]
+	default:
+		panic("sockopt can only be nil or have one")
+	}
+	httpClient := &gohttp.Client{
+		Transport: &gohttp.Transport{
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				dest, err := net.ParseDestination(network + ":" + addr)
+				if err != nil {
+					return nil, err
+				}
+				return internet.DialSystem(ctx, dest, Sockopt)
+			},
+		},
+	}
+	return httpClient
+}

common/protocol/server_picker.go

@@ -0,0 +1,89 @@
+package protocol
+
+import (
+	"sync"
+)
+
+type ServerList struct {
+	sync.RWMutex
+	servers []*ServerSpec
+}
+
+func NewServerList() *ServerList {
+	return &ServerList{}
+}
+
+func (sl *ServerList) AddServer(server *ServerSpec) {
+	sl.Lock()
+	defer sl.Unlock()
+
+	sl.servers = append(sl.servers, server)
+}
+
+func (sl *ServerList) Size() uint32 {
+	sl.RLock()
+	defer sl.RUnlock()
+
+	return uint32(len(sl.servers))
+}
+
+func (sl *ServerList) GetServer(idx uint32) *ServerSpec {
+	sl.Lock()
+	defer sl.Unlock()
+
+	for {
+		if idx >= uint32(len(sl.servers)) {
+			return nil
+		}
+
+		server := sl.servers[idx]
+		if !server.IsValid() {
+			sl.removeServer(idx)
+			continue
+		}
+
+		return server
+	}
+}
+
+func (sl *ServerList) removeServer(idx uint32) {
+	n := len(sl.servers)
+	sl.servers[idx] = sl.servers[n-1]
+	sl.servers = sl.servers[:n-1]
+}
+
+type ServerPicker interface {
+	PickServer() *ServerSpec
+}
+
+type RoundRobinServerPicker struct {
+	sync.Mutex
+	serverlist *ServerList
+	nextIndex  uint32
+}
+
+func NewRoundRobinServerPicker(serverlist *ServerList) *RoundRobinServerPicker {
+	return &RoundRobinServerPicker{
+		serverlist: serverlist,
+		nextIndex:  0,
+	}
+}
+
+func (p *RoundRobinServerPicker) PickServer() *ServerSpec {
+	p.Lock()
+	defer p.Unlock()
+
+	next := p.nextIndex
+	server := p.serverlist.GetServer(next)
+	if server == nil {
+		next = 0
+		server = p.serverlist.GetServer(0)
+	}
+	next++
+	if next >= p.serverlist.Size() {
+		next = 0
+	}
+	p.nextIndex = next
+
+	return server
+}

common/protocol/server_picker_test.go

@@ -0,0 +1,71 @@
+package protocol_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/xtls/xray-core/common/net"
+	. "github.com/xtls/xray-core/common/protocol"
+)
+
+func TestServerList(t *testing.T) {
+	list := NewServerList()
+	list.AddServer(NewServerSpec(net.TCPDestination(net.LocalHostIP, net.Port(1)), AlwaysValid()))
+	if list.Size() != 1 {
+		t.Error("list size: ", list.Size())
+	}
+	list.AddServer(NewServerSpec(net.TCPDestination(net.LocalHostIP, net.Port(2)), BeforeTime(time.Now().Add(time.Second))))
+	if list.Size() != 2 {
+		t.Error("list.size: ", list.Size())
+	}
+
+	server := list.GetServer(1)
+	if server.Destination().Port != 2 {
+		t.Error("server: ", server.Destination())
+	}
+	time.Sleep(2 * time.Second)
+	server = list.GetServer(1)
+	if server != nil {
+		t.Error("server: ", server)
+	}
+
+	server = list.GetServer(0)
+	if server.Destination().Port != 1 {
+		t.Error("server: ", server.Destination())
+	}
+}
+
+func TestServerPicker(t *testing.T) {
+	list := NewServerList()
+	list.AddServer(NewServerSpec(net.TCPDestination(net.LocalHostIP, net.Port(1)), AlwaysValid()))
+	list.AddServer(NewServerSpec(net.TCPDestination(net.LocalHostIP, net.Port(2)), BeforeTime(time.Now().Add(time.Second))))
+	list.AddServer(NewServerSpec(net.TCPDestination(net.LocalHostIP, net.Port(3)), BeforeTime(time.Now().Add(time.Second))))
+
+	picker := NewRoundRobinServerPicker(list)
+	server := picker.PickServer()
+	if server.Destination().Port != 1 {
+		t.Error("server: ", server.Destination())
+	}
+	server = picker.PickServer()
+	if server.Destination().Port != 2 {
+		t.Error("server: ", server.Destination())
+	}
+	server = picker.PickServer()
+	if server.Destination().Port != 3 {
+		t.Error("server: ", server.Destination())
+	}
+	server = picker.PickServer()
+	if server.Destination().Port != 1 {
+		t.Error("server: ", server.Destination())
+	}
+
+	time.Sleep(2 * time.Second)
+	server = picker.PickServer()
+	if server.Destination().Port != 1 {
+		t.Error("server: ", server.Destination())
+	}
+	server = picker.PickServer()
+	if server.Destination().Port != 1 {
+		t.Error("server: ", server.Destination())
+	}
+}

common/protocol/server_spec.go

@@ -1,30 +1,122 @@
 package protocol
 
 import (
+	"sync"
+	"time"
+
+	"github.com/xtls/xray-core/common/dice"
 	"github.com/xtls/xray-core/common/net"
 )
 
-type ServerSpec struct {
+type ValidationStrategy interface {
-	Destination  net.Destination
+	IsValid() bool
-	User         *MemoryUser
+	Invalidate()
 }
 
-func NewServerSpec(dest net.Destination, user *MemoryUser) *ServerSpec {
+type alwaysValidStrategy struct{}
+
+func AlwaysValid() ValidationStrategy {
+	return alwaysValidStrategy{}
+}
+
+func (alwaysValidStrategy) IsValid() bool {
+	return true
+}
+
+func (alwaysValidStrategy) Invalidate() {}
+
+type timeoutValidStrategy struct {
+	until time.Time
+}
+
+func BeforeTime(t time.Time) ValidationStrategy {
+	return &timeoutValidStrategy{
+		until: t,
+	}
+}
+
+func (s *timeoutValidStrategy) IsValid() bool {
+	return s.until.After(time.Now())
+}
+
+func (s *timeoutValidStrategy) Invalidate() {
+	s.until = time.Time{}
+}
+
+type ServerSpec struct {
+	sync.RWMutex
+	dest  net.Destination
+	users []*MemoryUser
+	valid ValidationStrategy
+}
+
+func NewServerSpec(dest net.Destination, valid ValidationStrategy, users ...*MemoryUser) *ServerSpec {
 	return &ServerSpec{
-		Destination: dest,
+		dest:  dest,
-		User:        user,
+		users: users,
+		valid: valid,
 	}
 }
 
 func NewServerSpecFromPB(spec *ServerEndpoint) (*ServerSpec, error) {
 	dest := net.TCPDestination(spec.Address.AsAddress(), net.Port(spec.Port))
-	var dUser *MemoryUser
+	mUsers := make([]*MemoryUser, len(spec.User))
-	if spec.User != nil {
+	for idx, u := range spec.User {
-		user, err := spec.User.ToMemoryUser()
+		mUser, err := u.ToMemoryUser()
 		if err != nil {
 			return nil, err
 		}
-		dUser = user
+		mUsers[idx] = mUser
 	}
-	return NewServerSpec(dest, dUser), nil
+	return NewServerSpec(dest, AlwaysValid(), mUsers...), nil
+}
+
+func (s *ServerSpec) Destination() net.Destination {
+	return s.dest
+}
+
+func (s *ServerSpec) HasUser(user *MemoryUser) bool {
+	s.RLock()
+	defer s.RUnlock()
+
+	for _, u := range s.users {
+		if u.Account.Equals(user.Account) {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *ServerSpec) AddUser(user *MemoryUser) {
+	if s.HasUser(user) {
+		return
+	}
+
+	s.Lock()
+	defer s.Unlock()
+
+	s.users = append(s.users, user)
+}
+
+func (s *ServerSpec) PickUser() *MemoryUser {
+	s.RLock()
+	defer s.RUnlock()
+
+	userCount := len(s.users)
+	switch userCount {
+	case 0:
+		return nil
+	case 1:
+		return s.users[0]
+	default:
+		return s.users[dice.Roll(userCount)]
+	}
+}
+
+func (s *ServerSpec) IsValid() bool {
+	return s.valid.IsValid()
+}
+
+func (s *ServerSpec) Invalidate() {
+	s.valid.Invalidate()
 }

common/protocol/server_spec.pb.go

@@ -28,7 +28,7 @@ type ServerEndpoint struct {
 
 	Address *net.IPOrDomain `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
 	Port    uint32          `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
-	User    *User           `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
+	User    []*User         `protobuf:"bytes,3,rep,name=user,proto3" json:"user,omitempty"`
 }
 
 func (x *ServerEndpoint) Reset() {
@@ -75,7 +75,7 @@ func (x *ServerEndpoint) GetPort() uint32 {
 	return 0
 }
 
-func (x *ServerEndpoint) GetUser() *User {
+func (x *ServerEndpoint) GetUser() []*User {
 	if x != nil {
 		return x.User
 	}
@@ -98,7 +98,7 @@ var file_common_protocol_server_spec_proto_rawDesc = []byte{
 	0x6e, 0x2e, 0x6e, 0x65, 0x74, 0x2e, 0x49, 0x50, 0x4f, 0x72, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
 	0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72,
 	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x2e, 0x0a,
-	0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x78, 0x72,
+	0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x78, 0x72,
 	0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
 	0x6f, 0x6c, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x42, 0x5e, 0x0a,
 	0x18, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,

common/protocol/server_spec.proto

@@ -12,5 +12,5 @@ import "common/protocol/user.proto";
 message ServerEndpoint {
   xray.common.net.IPOrDomain address = 1;
   uint32 port = 2;
-  xray.common.protocol.User user = 3;
+  repeated xray.common.protocol.User user = 3;
 }

common/protocol/server_spec_test.go

@@ -0,0 +1,79 @@
+package protocol_test
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/net"
+	. "github.com/xtls/xray-core/common/protocol"
+	"github.com/xtls/xray-core/common/uuid"
+	"github.com/xtls/xray-core/proxy/vmess"
+)
+
+func TestAlwaysValidStrategy(t *testing.T) {
+	strategy := AlwaysValid()
+	if !strategy.IsValid() {
+		t.Error("strategy not valid")
+	}
+	strategy.Invalidate()
+	if !strategy.IsValid() {
+		t.Error("strategy not valid")
+	}
+}
+
+func TestTimeoutValidStrategy(t *testing.T) {
+	strategy := BeforeTime(time.Now().Add(2 * time.Second))
+	if !strategy.IsValid() {
+		t.Error("strategy not valid")
+	}
+	time.Sleep(3 * time.Second)
+	if strategy.IsValid() {
+		t.Error("strategy is valid")
+	}
+
+	strategy = BeforeTime(time.Now().Add(2 * time.Second))
+	strategy.Invalidate()
+	if strategy.IsValid() {
+		t.Error("strategy is valid")
+	}
+}
+
+func TestUserInServerSpec(t *testing.T) {
+	uuid1 := uuid.New()
+	uuid2 := uuid.New()
+
+	toAccount := func(a *vmess.Account) Account {
+		account, err := a.AsAccount()
+		common.Must(err)
+		return account
+	}
+
+	spec := NewServerSpec(net.Destination{}, AlwaysValid(), &MemoryUser{
+		Email:   "test1@example.com",
+		Account: toAccount(&vmess.Account{Id: uuid1.String()}),
+	})
+	if spec.HasUser(&MemoryUser{
+		Email:   "test1@example.com",
+		Account: toAccount(&vmess.Account{Id: uuid2.String()}),
+	}) {
+		t.Error("has user: ", uuid2)
+	}
+
+	spec.AddUser(&MemoryUser{Email: "test2@example.com"})
+	if !spec.HasUser(&MemoryUser{
+		Email:   "test1@example.com",
+		Account: toAccount(&vmess.Account{Id: uuid1.String()}),
+	}) {
+		t.Error("not having user: ", uuid1)
+	}
+}
+
+func TestPickUser(t *testing.T) {
+	spec := NewServerSpec(net.Destination{}, AlwaysValid(), &MemoryUser{Email: "test1@example.com"}, &MemoryUser{Email: "test2@example.com"}, &MemoryUser{Email: "test3@example.com"})
+	user := spec.PickUser()
+	if !strings.HasSuffix(user.Email, "@example.com") {
+		t.Error("user: ", user.Email)
+	}
+}

common/session/context.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/xtls/xray-core/common/ctx"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/features/outbound"
 	"github.com/xtls/xray-core/features/routing"
 )
 
@@ -17,13 +16,13 @@ const (
 	inboundSessionKey         ctx.SessionKey = 1
 	outboundSessionKey        ctx.SessionKey = 2
 	contentSessionKey         ctx.SessionKey = 3
-	muxPreferredSessionKey    ctx.SessionKey = 4  // unused
+	muxPreferredSessionKey    ctx.SessionKey = 4 // unused
-	sockoptSessionKey         ctx.SessionKey = 5  // used by dokodemo to only receive sockopt.Mark
+	sockoptSessionKey         ctx.SessionKey = 5 // used by dokodemo to only receive sockopt.Mark
-	trackedConnectionErrorKey ctx.SessionKey = 6  // used by observer to get outbound error
+	trackedConnectionErrorKey ctx.SessionKey = 6 // used by observer to get outbound error
-	dispatcherKey             ctx.SessionKey = 7  // used by ss2022 inbounds to get dispatcher
+	dispatcherKey             ctx.SessionKey = 7 // used by ss2022 inbounds to get dispatcher
-	timeoutOnlyKey            ctx.SessionKey = 8  // mux context's child contexts to only cancel when its own traffic times out
+	timeoutOnlyKey            ctx.SessionKey = 8 // mux context's child contexts to only cancel when its own traffic times out
-	allowedNetworkKey         ctx.SessionKey = 9  // muxcool server control incoming request tcp/udp
+	allowedNetworkKey         ctx.SessionKey = 9 // muxcool server control incoming request tcp/udp
-	handlerSessionKey         ctx.SessionKey = 10 // outbound gets full handler
+	handlerSessionKey         ctx.SessionKey = 10 // unused
 	mitmAlpn11Key             ctx.SessionKey = 11 // used by TLS dialer
 	mitmServerNameKey         ctx.SessionKey = 12 // used by TLS dialer
 )
@@ -164,17 +163,6 @@ func AllowedNetworkFromContext(ctx context.Context) net.Network {
 	return net.Network_Unknown
 }
 
-func ContextWithHandler(ctx context.Context, handler outbound.Handler) context.Context {
-	return context.WithValue(ctx, handlerSessionKey, handler)
-}
-
-func HandlerFromContext(ctx context.Context) outbound.Handler {
-	if val, ok := ctx.Value(handlerSessionKey).(outbound.Handler); ok {
-		return val
-	}
-	return nil
-}
-
 func ContextWithMitmAlpn11(ctx context.Context, alpn11 bool) context.Context {
 	return context.WithValue(ctx, mitmAlpn11Key, alpn11)
 }

core/core.go

@@ -19,7 +19,7 @@ import (
 var (
 	Version_x byte = 25
 	Version_y byte = 9
-	Version_z byte = 11
+	Version_z byte = 5
 )
 
 var (

core/xray_test.go

@@ -63,13 +63,17 @@ func TestXrayClose(t *testing.T) {
 		Outbound: []*OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(0),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:  &protocol.User{
+							Port:    uint32(0),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),

features/inbound/inbound.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/features"
 )
@@ -19,6 +20,9 @@ type Handler interface {
 	ReceiverSettings() *serial.TypedMessage
 	// Returns the active proxy settings.
 	ProxySettings() *serial.TypedMessage
+
+	// Deprecated: Do not use in new code.
+	GetRandomInboundProxy() (interface{}, net.Port, int)
 }
 
 // Manager is a feature that manages InboundHandlers.

go.mod

@@ -19,15 +19,15 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/v2fly/ss-bloomring v0.0.0-20210312155135-28617310f63e
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/reality v0.0.0-20250904214705-431b6ff8c67c
+	github.com/xtls/reality v0.0.0-20250828044527-046fad5ab64f
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.42.0
+	golang.org/x/crypto v0.41.0
-	golang.org/x/net v0.44.0
+	golang.org/x/net v0.43.0
-	golang.org/x/sync v0.17.0
+	golang.org/x/sync v0.16.0
-	golang.org/x/sys v0.36.0
+	golang.org/x/sys v0.35.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
-	google.golang.org/grpc v1.75.1
+	google.golang.org/grpc v1.75.0
-	google.golang.org/protobuf v1.36.9
+	google.golang.org/protobuf v1.36.8
 	gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5
 	h12.io/socks v1.0.3
 	lukechampine.com/blake3 v1.4.1
@@ -47,10 +47,10 @@ require (
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.uber.org/mock v0.5.0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/mod v0.26.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools v0.35.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect

go.sum

@@ -75,8 +75,8 @@ github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/xtls/reality v0.0.0-20250904214705-431b6ff8c67c h1:LHLhQY3mKXSpTcQAkjFR4/6ar3rXjQryNeM7khK3AHU=
+github.com/xtls/reality v0.0.0-20250828044527-046fad5ab64f h1:o1Kryl9qEYYzNep9RId9DM1kBn8tBrcK5UJnti/l0NI=
-github.com/xtls/reality v0.0.0-20250904214705-431b6ff8c67c/go.mod h1:XxvnCCgBee4WWE0bc4E+a7wbk8gkJ/rS0vNVNtC5qp0=
+github.com/xtls/reality v0.0.0-20250828044527-046fad5ab64f/go.mod h1:XxvnCCgBee4WWE0bc4E+a7wbk8gkJ/rS0vNVNtC5qp0=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
@@ -96,20 +96,20 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -117,21 +117,21 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
 golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -143,10 +143,10 @@ gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

infra/conf/http.go

@@ -51,65 +51,31 @@ type HTTPRemoteConfig struct {
 }
 
 type HTTPClientConfig struct {
-	Address  *Address          	 `json:"address"`
+	Servers []*HTTPRemoteConfig `json:"servers"`
-	Port     uint16            	 `json:"port"`
+	Headers map[string]string   `json:"headers"`
-	Level    uint32              `json:"level"`
-	Email    string              `json:"email"`
-	Username string              `json:"user"`
-	Password string              `json:"pass"`
-	Servers  []*HTTPRemoteConfig `json:"servers"`
-	Headers  map[string]string   `json:"headers"`
 }
 
 func (v *HTTPClientConfig) Build() (proto.Message, error) {
 	config := new(http.ClientConfig)
-	if v.Address != nil {
+	config.Server = make([]*protocol.ServerEndpoint, len(v.Servers))
-		v.Servers = []*HTTPRemoteConfig{
+	for idx, serverConfig := range v.Servers {
-			{
-				Address: v.Address,
-				Port:    v.Port,
-			},
-		}
-		if len(v.Username) > 0 {
-			v.Servers[0].Users = []json.RawMessage{{}}
-		}
-	}
-	if len(v.Servers) != 1 {
-		return nil, errors.New(`HTTP settings: "servers" should have one and only one member. Multiple endpoints in "servers" should use multiple HTTP outbounds and routing balancer instead`)
-	}
-	for _, serverConfig := range v.Servers {
-		if len(serverConfig.Users) > 1 {
-			return nil, errors.New(`HTTP servers: "users" should have one member at most. Multiple members in "users" should use multiple HTTP outbounds and routing balancer instead`)
-		}
 		server := &protocol.ServerEndpoint{
 			Address: serverConfig.Address.Build(),
 			Port:    uint32(serverConfig.Port),
 		}
 		for _, rawUser := range serverConfig.Users {
 			user := new(protocol.User)
-			if v.Address != nil {
+			if err := json.Unmarshal(rawUser, user); err != nil {
-				user.Level = v.Level
+				return nil, errors.New("failed to parse HTTP user").Base(err).AtError()
-				user.Email = v.Email
-			} else {
-				if err := json.Unmarshal(rawUser, user); err != nil {
-					return nil, errors.New("failed to parse HTTP user").Base(err).AtError()
-				}
 			}
 			account := new(HTTPAccount)
-			if v.Address != nil {
+			if err := json.Unmarshal(rawUser, account); err != nil {
-				account.Username = v.Username
+				return nil, errors.New("failed to parse HTTP account").Base(err).AtError()
-				account.Password = v.Password
-			} else {
-				if err := json.Unmarshal(rawUser, account); err != nil {
-					return nil, errors.New("failed to parse HTTP account").Base(err).AtError()
-				}
 			}
 			user.Account = serial.ToTypedMessage(account.Build())
-			server.User = user
+			server.User = append(server.User, user)
-			break
 		}
-		config.Server = server
+		config.Server[idx] = server
-		break
 	}
 	config.Header = make([]*http.Header, 0, 32)
 	for key, value := range v.Headers {

infra/conf/shadowsocks.go

@@ -162,46 +162,22 @@ func buildShadowsocks2022(v *ShadowsocksServerConfig) (proto.Message, error) {
 type ShadowsocksServerTarget struct {
 	Address    *Address `json:"address"`
 	Port       uint16   `json:"port"`
-	Level      byte     `json:"level"`
-	Email      string   `json:"email"`
 	Cipher     string   `json:"method"`
 	Password   string   `json:"password"`
+	Email      string   `json:"email"`
+	Level      byte     `json:"level"`
 	IVCheck    bool     `json:"ivCheck"`
 	UoT        bool     `json:"uot"`
 	UoTVersion int      `json:"uotVersion"`
 }
 
 type ShadowsocksClientConfig struct {
-	Address    *Address                   `json:"address"`
+	Servers []*ShadowsocksServerTarget `json:"servers"`
-	Port       uint16                     `json:"port"`
-	Level      byte                       `json:"level"`
-	Email      string                     `json:"email"`
-	Cipher     string                     `json:"method"`
-	Password   string                     `json:"password"`
-	IVCheck    bool                       `json:"ivCheck"`
-	UoT        bool                       `json:"uot"`
-	UoTVersion int                        `json:"uotVersion"`
-	Servers    []*ShadowsocksServerTarget `json:"servers"`
 }
 
 func (v *ShadowsocksClientConfig) Build() (proto.Message, error) {
-	if v.Address != nil {
+	if len(v.Servers) == 0 {
-		v.Servers = []*ShadowsocksServerTarget{
+		return nil, errors.New("0 Shadowsocks server configured.")
-			{
-				Address:    v.Address,
-				Port:       v.Port,
-				Level:      v.Level,
-				Email:      v.Email,
-				Cipher:     v.Cipher,
-				Password:   v.Password,
-				IVCheck:    v.IVCheck,
-				UoT:        v.UoT,
-				UoTVersion: v.UoTVersion,
-			},
-		}
-	}
-	if len(v.Servers) != 1 {
-		return nil, errors.New(`Shadowsocks settings: "servers" should have one and only one member. Multiple endpoints in "servers" should use multiple Shadowsocks outbounds and routing balancer instead`)
 	}
 
 	if len(v.Servers) == 1 {
@@ -229,7 +205,8 @@ func (v *ShadowsocksClientConfig) Build() (proto.Message, error) {
 	}
 
 	config := new(shadowsocks.ClientConfig)
-	for _, server := range v.Servers {
+	serverSpecs := make([]*protocol.ServerEndpoint, len(v.Servers))
+	for idx, server := range v.Servers {
 		if C.Contains(shadowaead_2022.List, server.Cipher) {
 			return nil, errors.New("Shadowsocks 2022 accept no multi servers")
 		}
@@ -255,16 +232,19 @@ func (v *ShadowsocksClientConfig) Build() (proto.Message, error) {
 		ss := &protocol.ServerEndpoint{
 			Address: server.Address.Build(),
 			Port:    uint32(server.Port),
-			User:    &protocol.User{
+			User: []*protocol.User{
-				Level:   uint32(server.Level),
+				{
-				Email:   server.Email,
+					Level:   uint32(server.Level),
-				Account: serial.ToTypedMessage(account),
+					Email:   server.Email,
+					Account: serial.ToTypedMessage(account),
+				},
 			},
 		}
 
-		config.Server = ss
+		serverSpecs[idx] = ss
-		break
 	}
 
+	config.Server = serverSpecs
+
 	return config, nil
 }

infra/conf/socks.go

@@ -70,64 +70,30 @@ type SocksRemoteConfig struct {
 }
 
 type SocksClientConfig struct {
-	Address  *Address             `json:"address"`
+	Servers []*SocksRemoteConfig `json:"servers"`
-	Port     uint16               `json:"port"`
-	Level    uint32               `json:"level"`
-	Email    string               `json:"email"`
-	Username string               `json:"user"`
-	Password string               `json:"pass"`
-	Servers  []*SocksRemoteConfig `json:"servers"`
 }
 
 func (v *SocksClientConfig) Build() (proto.Message, error) {
 	config := new(socks.ClientConfig)
-	if v.Address != nil {
+	config.Server = make([]*protocol.ServerEndpoint, len(v.Servers))
-		v.Servers = []*SocksRemoteConfig{
+	for idx, serverConfig := range v.Servers {
-			{
-				Address: v.Address,
-				Port:    v.Port,
-			},
-		}
-		if len(v.Username) > 0 {
-			v.Servers[0].Users = []json.RawMessage{{}}
-		}
-	}
-	if len(v.Servers) != 1 {
-		return nil, errors.New(`SOCKS settings: "servers" should have one and only one member. Multiple endpoints in "servers" should use multiple SOCKS outbounds and routing balancer instead`)
-	}
-	for _, serverConfig := range v.Servers {
-		if len(serverConfig.Users) > 1 {
-			return nil, errors.New(`SOCKS servers: "users" should have one member at most. Multiple members in "users" should use multiple SOCKS outbounds and routing balancer instead`)
-		}
 		server := &protocol.ServerEndpoint{
 			Address: serverConfig.Address.Build(),
 			Port:    uint32(serverConfig.Port),
 		}
 		for _, rawUser := range serverConfig.Users {
 			user := new(protocol.User)
-			if v.Address != nil {
+			if err := json.Unmarshal(rawUser, user); err != nil {
-				user.Level = v.Level
+				return nil, errors.New("failed to parse Socks user").Base(err).AtError()
-				user.Email = v.Email
-			} else {
-				if err := json.Unmarshal(rawUser, user); err != nil {
-					return nil, errors.New("failed to parse Socks user").Base(err).AtError()
-				}
 			}
 			account := new(SocksAccount)
-			if v.Address != nil {
+			if err := json.Unmarshal(rawUser, account); err != nil {
-				account.Username = v.Username
+				return nil, errors.New("failed to parse socks account").Base(err).AtError()
-				account.Password = v.Password
-			} else {
-				if err := json.Unmarshal(rawUser, account); err != nil {
-					return nil, errors.New("failed to parse socks account").Base(err).AtError()
-				}
 			}
 			user.Account = serial.ToTypedMessage(account.Build())
-			server.User = user
+			server.User = append(server.User, user)
-			break
 		}
-		config.Server = server
+		config.Server[idx] = server
-		break
 	}
 	return config, nil
 }

infra/conf/socks_test.go

@@ -65,47 +65,24 @@ func TestSocksOutboundConfig(t *testing.T) {
 			}`,
 			Parser: loadJSON(creator),
 			Output: &socks.ClientConfig{
-				Server: &protocol.ServerEndpoint{
+				Server: []*protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
+					{
-						Address: &net.IPOrDomain_Ip{
+						Address: &net.IPOrDomain{
-							Ip: []byte{127, 0, 0, 1},
+							Address: &net.IPOrDomain_Ip{
+								Ip: []byte{127, 0, 0, 1},
+							},
 						},
-					},
+						Port: 1234,
-					Port: 1234,
+						User: []*protocol.User{
-					User: &protocol.User{
+							{
-						Email: "test@email.com",
+								Email: "test@email.com",
-						Account: serial.ToTypedMessage(&socks.Account{
+								Account: serial.ToTypedMessage(&socks.Account{
-							Username: "test user",
+									Username: "test user",
-							Password: "test pass",
+									Password: "test pass",
-						}),
+								}),
-					},
+							},
-				},
-			},
-		},
-		{
-			Input: `{
-				"address": "127.0.0.1",
-				"port": 1234,
-				"user": "test user",
-				"pass": "test pass",
-				"email": "test@email.com"
-			}`,
-			Parser: loadJSON(creator),
-			Output: &socks.ClientConfig{
-				Server: &protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
-						Address: &net.IPOrDomain_Ip{
-							Ip: []byte{127, 0, 0, 1},
 						},
 					},
-					Port: 1234,
-					User: &protocol.User{
-						Email: "test@email.com",
-						Account: serial.ToTypedMessage(&socks.Account{
-							Username: "test user",
-							Password: "test pass",
-						}),
-					},
 				},
 			},
 		},

infra/conf/trojan.go

@@ -20,44 +20,28 @@ import (
 type TrojanServerTarget struct {
 	Address  *Address `json:"address"`
 	Port     uint16   `json:"port"`
-	Level    byte     `json:"level"`
-	Email    string   `json:"email"`
 	Password string   `json:"password"`
+	Email    string   `json:"email"`
+	Level    byte     `json:"level"`
 	Flow     string   `json:"flow"`
 }
 
 // TrojanClientConfig is configuration of trojan servers
 type TrojanClientConfig struct {
-	Address  *Address              `json:"address"`
+	Servers []*TrojanServerTarget `json:"servers"`
-	Port     uint16                `json:"port"`
-	Level    byte                  `json:"level"`
-	Email    string                `json:"email"`
-	Password string                `json:"password"`
-	Flow     string                `json:"flow"`
-	Servers  []*TrojanServerTarget `json:"servers"`
 }
 
 // Build implements Buildable
 func (c *TrojanClientConfig) Build() (proto.Message, error) {
-	if c.Address != nil {
+	if len(c.Servers) == 0 {
-		c.Servers = []*TrojanServerTarget{
+		return nil, errors.New("0 Trojan server configured.")
-			{
-				Address:  c.Address,
-				Port:     c.Port,
-				Level:    c.Level,
-				Email:    c.Email,
-				Password: c.Password,
-				Flow:     c.Flow,
-			},
-		}
-	}
-	if len(c.Servers) != 1 {
-		return nil, errors.New(`Trojan settings: "servers" should have one and only one member. Multiple endpoints in "servers" should use multiple Trojan outbounds and routing balancer instead`)
 	}
 
-	config := &trojan.ClientConfig{}
+	config := &trojan.ClientConfig{
+		Server: make([]*protocol.ServerEndpoint, len(c.Servers)),
+	}
 
-	for _, rec := range c.Servers {
+	for idx, rec := range c.Servers {
 		if rec.Address == nil {
 			return nil, errors.New("Trojan server address is not set.")
 		}
@@ -71,19 +55,19 @@ func (c *TrojanClientConfig) Build() (proto.Message, error) {
 			return nil, errors.PrintRemovedFeatureError(`Flow for Trojan`, ``)
 		}
 
-		config.Server = &protocol.ServerEndpoint{
+		config.Server[idx] = &protocol.ServerEndpoint{
 			Address: rec.Address.Build(),
 			Port:    uint32(rec.Port),
-			User:    &protocol.User{
+			User: []*protocol.User{
-				Level: uint32(rec.Level),
+				{
-				Email: rec.Email,
+					Level: uint32(rec.Level),
-				Account: serial.ToTypedMessage(&trojan.Account{
+					Email: rec.Email,
-					Password: rec.Password,
+					Account: serial.ToTypedMessage(&trojan.Account{
-				}),
+						Password: rec.Password,
+					}),
+				},
 			},
 		}
-
-		break
 	}
 
 	return config, nil

infra/conf/vless.go

@@ -77,10 +77,6 @@ func (c *VLessInboundConfig) Build() (proto.Message, error) {
 			return nil, errors.New(`VLESS clients: "encryption" should not be in inbound settings`)
 		}
 
-		if account.Reverse != nil && account.Reverse.Tag == "" {
-			return nil, errors.New(`VLESS clients: "tag" can't be empty for "reverse"`)
-		}
-
 		user.Account = serial.ToTypedMessage(account)
 		config.Clients[idx] = user
 	}
@@ -203,65 +199,37 @@ type VLessOutboundVnext struct {
 }
 
 type VLessOutboundConfig struct {
-	Address    *Address              `json:"address"`
+	Vnext []*VLessOutboundVnext `json:"vnext"`
-	Port       uint16                `json:"port"`
-	Level      uint32                `json:"level"`
-	Email      string                `json:"email"`
-	Id         string                `json:"id"`
-	Flow       string                `json:"flow"`
-	Seed       string                `json:"seed"`
-	Encryption string                `json:"encryption"`
-	Reverse    *vless.Reverse        `json:"reverse"`
-	Vnext      []*VLessOutboundVnext `json:"vnext"`
 }
 
 // Build implements Buildable
 func (c *VLessOutboundConfig) Build() (proto.Message, error) {
 	config := new(outbound.Config)
-	if c.Address != nil {
+
-		c.Vnext = []*VLessOutboundVnext{
-			{
-				Address: c.Address,
-				Port:    c.Port,
-				Users:   []json.RawMessage{{}},
-			},
-		}
-	}
 	if len(c.Vnext) != 1 {
-		return nil, errors.New(`VLESS settings: "vnext" should have one and only one member. Multiple endpoints in "vnext" should use multiple VLESS outbounds and routing balancer instead`)
+		return nil, errors.New(`VLESS settings: "vnext" should have one and only one member`)
 	}
-	for _, rec := range c.Vnext {
+	config.Vnext = make([]*protocol.ServerEndpoint, len(c.Vnext))
+	for idx, rec := range c.Vnext {
 		if rec.Address == nil {
 			return nil, errors.New(`VLESS vnext: "address" is not set`)
 		}
 		if len(rec.Users) != 1 {
-			return nil, errors.New(`VLESS vnext: "users" should have one and only one member. Multiple members in "users" should use multiple VLESS outbounds and routing balancer instead`)
+			return nil, errors.New(`VLESS vnext: "users" should have one and only one member`)
 		}
 		spec := &protocol.ServerEndpoint{
 			Address: rec.Address.Build(),
 			Port:    uint32(rec.Port),
+			User:    make([]*protocol.User, len(rec.Users)),
 		}
-		for _, rawUser := range rec.Users {
+		for idx, rawUser := range rec.Users {
 			user := new(protocol.User)
-			if c.Address != nil {
+			if err := json.Unmarshal(rawUser, user); err != nil {
-				user.Level = c.Level
+				return nil, errors.New(`VLESS users: invalid user`).Base(err)
-				user.Email = c.Email
-			} else {
-				if err := json.Unmarshal(rawUser, user); err != nil {
-					return nil, errors.New(`VLESS users: invalid user`).Base(err)
-				}
 			}
 			account := new(vless.Account)
-			if c.Address != nil {
+			if err := json.Unmarshal(rawUser, account); err != nil {
-				account.Id = c.Id
+				return nil, errors.New(`VLESS users: invalid user`).Base(err)
-				account.Flow = c.Flow
-				//account.Seed = c.Seed
-				account.Encryption = c.Encryption
-				account.Reverse = c.Reverse
-			} else {
-				if err := json.Unmarshal(rawUser, account); err != nil {
-					return nil, errors.New(`VLESS users: invalid user`).Base(err)
-				}
 			}
 
 			u, err := uuid.ParseString(account.Id)
@@ -320,16 +288,10 @@ func (c *VLessOutboundConfig) Build() (proto.Message, error) {
 				return nil, errors.New(`VLESS users: unsupported "encryption": ` + account.Encryption)
 			}
 
-			if account.Reverse != nil && account.Reverse.Tag == "" {
-				return nil, errors.New(`VLESS clients: "tag" can't be empty for "reverse"`)
-			}
-
 			user.Account = serial.ToTypedMessage(account)
-			spec.User = user
+			spec.User[idx] = user
-			break
 		}
-		config.Vnext = spec
+		config.Vnext[idx] = spec
-		break
 	}
 
 	return config, nil

infra/conf/vless_test.go

@@ -35,50 +35,25 @@ func TestVLessOutbound(t *testing.T) {
 			}`,
 			Parser: loadJSON(creator),
 			Output: &outbound.Config{
-				Vnext: &protocol.ServerEndpoint{
+				Vnext: []*protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
+					{
-						Address: &net.IPOrDomain_Domain{
+						Address: &net.IPOrDomain{
-							Domain: "example.com",
+							Address: &net.IPOrDomain_Domain{
+								Domain: "example.com",
+							},
 						},
-					},
+						Port: 443,
-					Port: 443,
+						User: []*protocol.User{
-					User: &protocol.User{
+							{
-						Account: serial.ToTypedMessage(&vless.Account{
+								Account: serial.ToTypedMessage(&vless.Account{
-							Id:         "27848739-7e62-4138-9fd3-098a63964b6b",
+									Id:         "27848739-7e62-4138-9fd3-098a63964b6b",
-							Flow:       "xtls-rprx-vision-udp443",
+									Flow:       "xtls-rprx-vision-udp443",
-							Encryption: "none",
+									Encryption: "none",
-						}),
+								}),
-						Level: 0,
+								Level: 0,
-					},
+							},
-				},
-			},
-		},
-		{
-			Input: `{
-				"address": "example.com",
-				"port": 443,
-				"id": "27848739-7e62-4138-9fd3-098a63964b6b",
-				"flow": "xtls-rprx-vision-udp443",
-				"encryption": "none",
-				"level": 0
-			}`,
-			Parser: loadJSON(creator),
-			Output: &outbound.Config{
-				Vnext: &protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
-						Address: &net.IPOrDomain_Domain{
-							Domain: "example.com",
 						},
 					},
-					Port: 443,
-					User: &protocol.User{
-						Account: serial.ToTypedMessage(&vless.Account{
-							Id:         "27848739-7e62-4138-9fd3-098a63964b6b",
-							Flow:       "xtls-rprx-vision-udp443",
-							Encryption: "none",
-						}),
-						Level: 0,
-					},
 				},
 			},
 		},

infra/conf/vmess.go

@@ -46,6 +46,17 @@ func (a *VMessAccount) Build() *vmess.Account {
 	}
 }
 
+type VMessDetourConfig struct {
+	ToTag string `json:"to"`
+}
+
+// Build implements Buildable
+func (c *VMessDetourConfig) Build() *inbound.DetourConfig {
+	return &inbound.DetourConfig{
+		To: c.ToTag,
+	}
+}
+
 type VMessDefaultConfig struct {
 	Level byte `json:"level"`
 }
@@ -60,6 +71,7 @@ func (c *VMessDefaultConfig) Build() *inbound.DefaultConfig {
 type VMessInboundConfig struct {
 	Users        []json.RawMessage   `json:"clients"`
 	Defaults     *VMessDefaultConfig `json:"default"`
+	DetourConfig *VMessDetourConfig  `json:"detour"`
 }
 
 // Build implements Buildable
@@ -70,6 +82,10 @@ func (c *VMessInboundConfig) Build() (proto.Message, error) {
 		config.Default = c.Defaults.Build()
 	}
 
+	if c.DetourConfig != nil {
+		config.Detour = c.DetourConfig.Build()
+	}
+
 	config.User = make([]*protocol.User, len(c.Users))
 	for idx, rawData := range c.Users {
 		user := new(protocol.User)
@@ -101,37 +117,23 @@ type VMessOutboundTarget struct {
 }
 
 type VMessOutboundConfig struct {
-	Address     *Address               `json:"address"`
+	Receivers []*VMessOutboundTarget `json:"vnext"`
-	Port        uint16                 `json:"port"`
-	Level       uint32                 `json:"level"`
-	Email       string                 `json:"email"`
-	ID          string                 `json:"id"`
-	Security    string                 `json:"security"`
-	Experiments string                 `json:"experiments"`
-	Receivers   []*VMessOutboundTarget `json:"vnext"`
 }
 
 // Build implements Buildable
 func (c *VMessOutboundConfig) Build() (proto.Message, error) {
 	config := new(outbound.Config)
-	if c.Address != nil {
+
-		c.Receivers = []*VMessOutboundTarget{
+	if len(c.Receivers) == 0 {
-			{
+		return nil, errors.New("0 VMess receiver configured")
-				Address: c.Address,
-				Port:    c.Port,
-				Users:   []json.RawMessage{{}},
-			},
-		}
 	}
-	if len(c.Receivers) != 1 {
+	serverSpecs := make([]*protocol.ServerEndpoint, len(c.Receivers))
-		return nil, errors.New(`VMess settings: "vnext" should have one and only one member. Multiple endpoints in "vnext" should use multiple VMess outbounds and routing balancer instead`)
+	for idx, rec := range c.Receivers {
-	}
+		if len(rec.Users) == 0 {
-	for _, rec := range c.Receivers {
+			return nil, errors.New("0 user configured for VMess outbound")
-		if len(rec.Users) != 1 {
-			return nil, errors.New(`VMess vnext: "users" should have one and only one member. Multiple members in "users" should use multiple VMess outbounds and routing balancer instead`)
 		}
 		if rec.Address == nil {
-			return nil, errors.New(`VMess vnext: "address" is not set`)
+			return nil, errors.New("address is not set in VMess outbound config")
 		}
 		spec := &protocol.ServerEndpoint{
 			Address: rec.Address.Build(),
@@ -139,23 +141,12 @@ func (c *VMessOutboundConfig) Build() (proto.Message, error) {
 		}
 		for _, rawUser := range rec.Users {
 			user := new(protocol.User)
-			if c.Address != nil {
+			if err := json.Unmarshal(rawUser, user); err != nil {
-				user.Level = c.Level
+				return nil, errors.New("invalid VMess user").Base(err)
-				user.Email = c.Email
-			} else {
-				if err := json.Unmarshal(rawUser, user); err != nil {
-					return nil, errors.New("invalid VMess user").Base(err)
-				}
 			}
 			account := new(VMessAccount)
-			if c.Address != nil {
+			if err := json.Unmarshal(rawUser, account); err != nil {
-				account.ID = c.ID
+				return nil, errors.New("invalid VMess user").Base(err)
-				account.Security = c.Security
-				account.Experiments = c.Experiments
-			} else {
-				if err := json.Unmarshal(rawUser, account); err != nil {
-					return nil, errors.New("invalid VMess user").Base(err)
-				}
 			}
 
 			u, err := uuid.ParseString(account.ID)
@@ -165,11 +156,10 @@ func (c *VMessOutboundConfig) Build() (proto.Message, error) {
 			account.ID = u.String()
 
 			user.Account = serial.ToTypedMessage(account.Build())
-			spec.User = user
+			spec.User = append(spec.User, user)
-			break
 		}
-		config.Receiver = spec
+		serverSpecs[idx] = spec
-		break
 	}
+	config.Receiver = serverSpecs
 	return config, nil
 }

infra/conf/vmess_test.go

@@ -34,52 +34,26 @@ func TestVMessOutbound(t *testing.T) {
 			}`,
 			Parser: loadJSON(creator),
 			Output: &outbound.Config{
-				Receiver: &protocol.ServerEndpoint{
+				Receiver: []*protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
+					{
-						Address: &net.IPOrDomain_Ip{
+						Address: &net.IPOrDomain{
-							Ip: []byte{127, 0, 0, 1},
+							Address: &net.IPOrDomain_Ip{
-						},
+								Ip: []byte{127, 0, 0, 1},
-					},
-					Port: 80,
-					User: &protocol.User{
-						Email: "love@example.com",
-						Level: 255,
-						Account: serial.ToTypedMessage(&vmess.Account{
-							Id: "e641f5ad-9397-41e3-bf1a-e8740dfed019",
-							SecuritySettings: &protocol.SecurityConfig{
-								Type: protocol.SecurityType_AUTO,
 							},
-						}),
-					},
-				},
-			},
-		},
-		{
-			Input: `{
-				"address": "127.0.0.1",
-				"port": 80,
-				"id": "e641f5ad-9397-41e3-bf1a-e8740dfed019",
-				"email": "love@example.com",
-				"level": 255
-			}`,
-			Parser: loadJSON(creator),
-			Output: &outbound.Config{
-				Receiver: &protocol.ServerEndpoint{
-					Address: &net.IPOrDomain{
-						Address: &net.IPOrDomain_Ip{
-							Ip: []byte{127, 0, 0, 1},
 						},
-					},
+						Port: 80,
-					Port: 80,
+						User: []*protocol.User{
-					User: &protocol.User{
+							{
-						Email: "love@example.com",
+								Email: "love@example.com",
-						Level: 255,
+								Level: 255,
-						Account: serial.ToTypedMessage(&vmess.Account{
+								Account: serial.ToTypedMessage(&vmess.Account{
-							Id: "e641f5ad-9397-41e3-bf1a-e8740dfed019",
+									Id: "e641f5ad-9397-41e3-bf1a-e8740dfed019",
-							SecuritySettings: &protocol.SecurityConfig{
+									SecuritySettings: &protocol.SecurityConfig{
-								Type: protocol.SecurityType_AUTO,
+										Type: protocol.SecurityType_AUTO,
+									},
+								}),
 							},
-						}),
+						},
 					},
 				},
 			},
@@ -105,7 +79,11 @@ func TestVMessInbound(t *testing.T) {
 				],
 				"default": {
 					"level": 0
-				}
+				},
+				"detour": {
+					"to": "tag_to_detour"
+				},
+				"disableInsecureEncryption": true
 			}`,
 			Parser: loadJSON(creator),
 			Output: &inbound.Config{
@@ -124,6 +102,9 @@ func TestVMessInbound(t *testing.T) {
 				Default: &inbound.DefaultConfig{
 					Level: 0,
 				},
+				Detour: &inbound.DetourConfig{
+					To: "tag_to_detour",
+				},
 			},
 		},
 	})

infra/conf/xray.go

@@ -3,6 +3,7 @@ package conf
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"log"
 	"os"
 	"path/filepath"
@@ -119,12 +120,47 @@ func (m *MuxConfig) Build() (*proxyman.MultiplexingConfig, error) {
 	}, nil
 }
 
+type InboundDetourAllocationConfig struct {
+	Strategy    string  `json:"strategy"`
+	Concurrency *uint32 `json:"concurrency"`
+	RefreshMin  *uint32 `json:"refresh"`
+}
+
+// Build implements Buildable.
+func (c *InboundDetourAllocationConfig) Build() (*proxyman.AllocationStrategy, error) {
+	config := new(proxyman.AllocationStrategy)
+	switch strings.ToLower(c.Strategy) {
+	case "always":
+		config.Type = proxyman.AllocationStrategy_Always
+	case "random":
+		config.Type = proxyman.AllocationStrategy_Random
+	case "external":
+		config.Type = proxyman.AllocationStrategy_External
+	default:
+		return nil, errors.New("unknown allocation strategy: ", c.Strategy)
+	}
+	if c.Concurrency != nil {
+		config.Concurrency = &proxyman.AllocationStrategy_AllocationStrategyConcurrency{
+			Value: *c.Concurrency,
+		}
+	}
+
+	if c.RefreshMin != nil {
+		config.Refresh = &proxyman.AllocationStrategy_AllocationStrategyRefresh{
+			Value: *c.RefreshMin,
+		}
+	}
+
+	return config, nil
+}
+
 type InboundDetourConfig struct {
 	Protocol       string                         `json:"protocol"`
 	PortList       *PortList                      `json:"port"`
 	ListenOn       *Address                       `json:"listen"`
 	Settings       *json.RawMessage               `json:"settings"`
 	Tag            string                         `json:"tag"`
+	Allocation     *InboundDetourAllocationConfig `json:"allocate"`
 	StreamSetting  *StreamConfig                  `json:"streamSettings"`
 	SniffingConfig *SniffingConfig                `json:"sniffing"`
 }
@@ -161,6 +197,30 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 		}
 	}
 
+	if c.Allocation != nil {
+		concurrency := -1
+		if c.Allocation.Concurrency != nil && c.Allocation.Strategy == "random" {
+			concurrency = int(*c.Allocation.Concurrency)
+		}
+		portRange := 0
+
+		for _, pr := range c.PortList.Range {
+			portRange += int(pr.To - pr.From + 1)
+		}
+		if concurrency >= 0 && concurrency >= portRange {
+			var ports strings.Builder
+			for _, pr := range c.PortList.Range {
+				fmt.Fprintf(&ports, "%d-%d ", pr.From, pr.To)
+			}
+			return nil, errors.New("not enough ports. concurrency = ", concurrency, " ports: ", ports.String())
+		}
+
+		as, err := c.Allocation.Build()
+		if err != nil {
+			return nil, err
+		}
+		receiverSettings.AllocationStrategy = as
+	}
 	if c.StreamSetting != nil {
 		ss, err := c.StreamSetting.Build()
 		if err != nil {

infra/conf/xray_test.go

@@ -58,6 +58,10 @@ func TestXrayConfig(t *testing.T) {
 					},
 					"protocol": "vmess",
 					"port": "443-500",
+					"allocate": {
+						"strategy": "random",
+						"concurrency": 3
+					},
 					"settings": {
 						"clients": [
 							{
@@ -119,6 +123,12 @@ func TestXrayConfig(t *testing.T) {
 								From: 443,
 								To:   500,
 							}}},
+							AllocationStrategy: &proxyman.AllocationStrategy{
+								Type: proxyman.AllocationStrategy_Random,
+								Concurrency: &proxyman.AllocationStrategy_AllocationStrategyConcurrency{
+									Value: 3,
+								},
+							},
 							StreamSettings: &internet.StreamConfig{
 								ProtocolName: "websocket",
 								TransportSettings: []*internet.TransportConfig{

main/commands/all/tls/ping.go

@@ -92,7 +92,7 @@ func executePing(cmd *base.Command, args []string) {
 	fmt.Println("-------------------")
 	fmt.Println("Pinging with SNI")
 	{
-		tcpConn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: ip, Port: TargetPort})
+		tcpConn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: ip, Port: 443})
 		if err != nil {
 			base.Fatalf("Failed to dial tcp: %s", err)
 		}

proxy/http/client.go

@@ -31,7 +31,7 @@ import (
 )
 
 type Client struct {
-	server        *protocol.ServerSpec
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 	header        []*Header
 }
@@ -48,17 +48,21 @@ var (
 
 // NewClient create a new http client based on the given config.
 func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
-	if config.Server == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no target server found`)
+	for _, rec := range config.Server {
+		s, err := protocol.NewServerSpecFromPB(rec)
+		if err != nil {
+			return nil, errors.New("failed to get server spec").Base(err)
+		}
+		serverList.AddServer(s)
 	}
-	server, err := protocol.NewServerSpecFromPB(config.Server)
+	if serverList.Size() == 0 {
-	if err != nil {
+		return nil, errors.New("0 target server")
-		return nil, errors.New("failed to get server spec").Base(err)
 	}
 
 	v := core.MustFromContext(ctx)
 	return &Client{
-		server:        server,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 		header:        config.Header,
 	}, nil
@@ -80,9 +84,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 		return errors.New("UDP is not supported by HTTP outbound")
 	}
 
-	server := c.server
+	var user *protocol.MemoryUser
-	dest := server.Destination
-	user := server.User
 	var conn stat.Connection
 
 	mbuf, _ := link.Reader.ReadMultiBuffer()
@@ -100,6 +102,10 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	}
 
 	if err := retry.ExponentialBackoff(5, 100).On(func() error {
+		server := c.serverPicker.PickServer()
+		dest := server.Destination()
+		user = server.PickUser()
+
 		netConn, err := setUpHTTPTunnel(ctx, dest, targetAddr, user, dialer, header, firstPayload)
 		if netConn != nil {
 			if _, ok := netConn.(*http2Conn); !ok {

proxy/http/config.pb.go

@@ -196,8 +196,8 @@ type ClientConfig struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Sever is a list of HTTP server addresses.
-	Server *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	Server []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=server,proto3" json:"server,omitempty"`
-	Header []*Header                `protobuf:"bytes,2,rep,name=header,proto3" json:"header,omitempty"`
+	Header []*Header                  `protobuf:"bytes,2,rep,name=header,proto3" json:"header,omitempty"`
 }
 
 func (x *ClientConfig) Reset() {
@@ -230,7 +230,7 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_http_config_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
+func (x *ClientConfig) GetServer() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
 	}
@@ -275,7 +275,7 @@ var file_proxy_http_config_proto_rawDesc = []byte{
 	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
 	0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x7d, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43,
 	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d,
 	0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x53, 0x65, 0x72,
 	0x76, 0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52, 0x06, 0x73, 0x65, 0x72,
 	0x76, 0x65, 0x72, 0x12, 0x2f, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x02, 0x20,

proxy/http/config.proto

@@ -28,6 +28,6 @@ message Header {
 // ClientConfig is the protobuf config for HTTP proxy client.
 message ClientConfig {
   // Sever is a list of HTTP server addresses.
-  xray.common.protocol.ServerEndpoint server = 1;
+  repeated xray.common.protocol.ServerEndpoint server = 1;
   repeated Header header = 2;
 }

proxy/proxy.go

@@ -678,10 +678,10 @@ func CopyRawConnIfExist(ctx context.Context, readerConn net.Conn, writerConn net
 			errors.LogInfo(ctx, "CopyRawConn splice")
 			statWriter, _ := writer.(*dispatcher.SizeStatWriter)
 			//runtime.Gosched() // necessary
-			time.Sleep(time.Millisecond)     // without this, there will be a rare ssl error for freedom splice
+			time.Sleep(time.Millisecond)    // without this, there will be a rare ssl error for freedom splice
-			timer.SetTimeout(24 * time.Hour) // prevent leak, just in case
+			timer.SetTimeout(8 * time.Hour) // prevent leak, just in case
 			if inTimer != nil {
-				inTimer.SetTimeout(24 * time.Hour)
+				inTimer.SetTimeout(8 * time.Hour)
 			}
 			w, err := tc.ReadFrom(readerConn)
 			if readCounter != nil {

proxy/shadowsocks/client.go

@@ -22,23 +22,27 @@ import (
 
 // Client is a inbound handler for Shadowsocks protocol
 type Client struct {
-	server        *protocol.ServerSpec
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 }
 
 // NewClient create a new Shadowsocks client.
 func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
-	if config.Server == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no target server found`)
+	for _, rec := range config.Server {
+		s, err := protocol.NewServerSpecFromPB(rec)
+		if err != nil {
+			return nil, errors.New("failed to parse server spec").Base(err)
+		}
+		serverList.AddServer(s)
 	}
-	server, err := protocol.NewServerSpecFromPB(config.Server)
+	if serverList.Size() == 0 {
-	if err != nil {
+		return nil, errors.New("0 server")
-		return nil, errors.New("failed to get server spec").Base(err)
 	}
 
 	v := core.MustFromContext(ctx)
 	client := &Client{
-		server:        server,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 	}
 	return client, nil
@@ -56,12 +60,13 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	destination := ob.Target
 	network := destination.Network
 
-	server := c.server
+	var server *protocol.ServerSpec
-	dest := server.Destination
-	dest.Network = network
 	var conn stat.Connection
 
 	err := retry.ExponentialBackoff(5, 100).On(func() error {
+		server = c.serverPicker.PickServer()
+		dest := server.Destination()
+		dest.Network = network
 		rawConn, err := dialer.Dial(ctx, dest)
 		if err != nil {
 			return err
@@ -73,7 +78,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	if err != nil {
 		return errors.New("failed to find an available destination").AtWarning().Base(err)
 	}
-	errors.LogInfo(ctx, "tunneling request to ", destination, " via ", network, ":", server.Destination.NetAddr())
+	errors.LogInfo(ctx, "tunneling request to ", destination, " via ", network, ":", server.Destination().NetAddr())
 
 	defer conn.Close()
 
@@ -88,7 +93,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 		request.Command = protocol.RequestCommandUDP
 	}
 
-	user := server.User
+	user := server.PickUser()
 	_, ok := user.Account.(*MemoryAccount)
 	if !ok {
 		return errors.New("user account is not valid")

proxy/shadowsocks/config.pb.go

@@ -199,7 +199,7 @@ type ClientConfig struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Server *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	Server []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=server,proto3" json:"server,omitempty"`
 }
 
 func (x *ClientConfig) Reset() {
@@ -232,7 +232,7 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_shadowsocks_config_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
+func (x *ClientConfig) GetServer() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
 	}
@@ -268,7 +268,7 @@ var file_proxy_shadowsocks_config_proto_rawDesc = []byte{
 	0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x6e, 0x65, 0x74, 0x2e, 0x4e,
 	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x22,
 	0x4c, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
 	0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x6e, 0x64,
 	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2a, 0x74, 0x0a,

proxy/shadowsocks/config.proto

@@ -32,5 +32,5 @@ message ServerConfig {
 }
 
 message ClientConfig {
-  xray.common.protocol.ServerEndpoint server = 1;
+  repeated xray.common.protocol.ServerEndpoint server = 1;
 }

proxy/socks/client.go

@@ -22,23 +22,27 @@ import (
 
 // Client is a Socks5 client.
 type Client struct {
-	server        *protocol.ServerSpec
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 }
 
 // NewClient create a new Socks5 client based on the given config.
 func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
-	if config.Server == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no target server found`)
+	for _, rec := range config.Server {
+		s, err := protocol.NewServerSpecFromPB(rec)
+		if err != nil {
+			return nil, errors.New("failed to get server spec").Base(err)
+		}
+		serverList.AddServer(s)
 	}
-	server, err := protocol.NewServerSpecFromPB(config.Server)
+	if serverList.Size() == 0 {
-	if err != nil {
+		return nil, errors.New("0 target server")
-		return nil, errors.New("failed to get server spec").Base(err)
 	}
 
 	v := core.MustFromContext(ctx)
 	c := &Client{
-		server:        server,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 	}
 
@@ -58,12 +62,15 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	destination := ob.Target
 
 	// Outbound server.
-	server := c.server
+	var server *protocol.ServerSpec
-	dest := server.Destination
+	// Outbound server's destination.
+	var dest net.Destination
 	// Connection to the outbound server.
 	var conn stat.Connection
 
 	if err := retry.ExponentialBackoff(5, 100).On(func() error {
+		server = c.serverPicker.PickServer()
+		dest = server.Destination()
 		rawConn, err := dialer.Dial(ctx, dest)
 		if err != nil {
 			return err
@@ -94,7 +101,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 		request.Command = protocol.RequestCommandUDP
 	}
 
-	user := server.User
+	user := server.PickUser()
 	if user != nil {
 		request.User = user
 		p = c.policyManager.ForLevel(user.Level)

proxy/socks/config.pb.go

@@ -210,7 +210,7 @@ type ClientConfig struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Sever is a list of Socks server addresses.
-	Server *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	Server []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=server,proto3" json:"server,omitempty"`
 }
 
 func (x *ClientConfig) Reset() {
@@ -243,7 +243,7 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_socks_config_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
+func (x *ClientConfig) GetServer() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
 	}
@@ -286,7 +286,7 @@ var file_proxy_socks_config_proto_rawDesc = []byte{
 	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
 	0x3a, 0x02, 0x38, 0x01, 0x22, 0x4c, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f,
 	0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
 	0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76,
 	0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76,
 	0x65, 0x72, 0x2a, 0x25, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b,

proxy/socks/config.proto

@@ -35,5 +35,5 @@ message ServerConfig {
 // ClientConfig is the protobuf config for Socks client.
 message ClientConfig {
   // Sever is a list of Socks server addresses.
-  xray.common.protocol.ServerEndpoint server = 1;
+  repeated xray.common.protocol.ServerEndpoint server = 1;
 }

proxy/trojan/client.go

@@ -22,23 +22,27 @@ import (
 
 // Client is a inbound handler for trojan protocol
 type Client struct {
-	server        *protocol.ServerSpec
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 }
 
 // NewClient create a new trojan client.
 func NewClient(ctx context.Context, config *ClientConfig) (*Client, error) {
-	if config.Server == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no target server found`)
+	for _, rec := range config.Server {
+		s, err := protocol.NewServerSpecFromPB(rec)
+		if err != nil {
+			return nil, errors.New("failed to parse server spec").Base(err)
+		}
+		serverList.AddServer(s)
 	}
-	server, err := protocol.NewServerSpecFromPB(config.Server)
+	if serverList.Size() == 0 {
-	if err != nil {
+		return nil, errors.New("0 server")
-		return nil, errors.New("failed to get server spec").Base(err)
 	}
 
 	v := core.MustFromContext(ctx)
 	client := &Client{
-		server:        server,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 	}
 	return client, nil
@@ -56,11 +60,12 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	destination := ob.Target
 	network := destination.Network
 
-	server := c.server
+	var server *protocol.ServerSpec
 	var conn stat.Connection
 
 	err := retry.ExponentialBackoff(5, 100).On(func() error {
-		rawConn, err := dialer.Dial(ctx, server.Destination)
+		server = c.serverPicker.PickServer()
+		rawConn, err := dialer.Dial(ctx, server.Destination())
 		if err != nil {
 			return err
 		}
@@ -71,11 +76,11 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	if err != nil {
 		return errors.New("failed to find an available destination").AtWarning().Base(err)
 	}
-	errors.LogInfo(ctx, "tunneling request to ", destination, " via ", server.Destination.NetAddr())
+	errors.LogInfo(ctx, "tunneling request to ", destination, " via ", server.Destination().NetAddr())
 
 	defer conn.Close()
 
-	user := server.User
+	user := server.PickUser()
 	account, ok := user.Account.(*MemoryAccount)
 	if !ok {
 		return errors.New("user account is not valid")

proxy/trojan/config.pb.go

@@ -156,7 +156,7 @@ type ClientConfig struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Server *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	Server []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=server,proto3" json:"server,omitempty"`
 }
 
 func (x *ClientConfig) Reset() {
@@ -189,7 +189,7 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_trojan_config_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
+func (x *ClientConfig) GetServer() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
 	}
@@ -271,7 +271,7 @@ var file_proxy_trojan_config_proto_rawDesc = []byte{
 	0x04, 0x64, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x78, 0x76, 0x65, 0x72, 0x18, 0x06, 0x20,
 	0x01, 0x28, 0x04, 0x52, 0x04, 0x78, 0x76, 0x65, 0x72, 0x22, 0x4c, 0x0a, 0x0c, 0x43, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79,
+	0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61, 0x79,
 	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
 	0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52,
 	0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x22, 0x7b, 0x0a, 0x0c, 0x53, 0x65, 0x72, 0x76, 0x65,

proxy/trojan/config.proto

@@ -23,7 +23,7 @@ message Fallback {
 }
 
 message ClientConfig {
-  xray.common.protocol.ServerEndpoint server = 1;
+  repeated xray.common.protocol.ServerEndpoint server = 1;
 }
 
 message ServerConfig {

proxy/vless/account.go

@@ -21,7 +21,6 @@ func (a *Account) AsAccount() (protocol.Account, error) {
 		XorMode:    a.XorMode,
 		Seconds:    a.Seconds,
 		Padding:    a.Padding,
-		Reverse:    a.Reverse,
 	}, nil
 }
 
@@ -36,8 +35,6 @@ type MemoryAccount struct {
 	XorMode    uint32
 	Seconds    uint32
 	Padding    string
-
-	Reverse *Reverse
 }
 
 // Equals implements protocol.Account.Equals().
@@ -57,6 +54,5 @@ func (a *MemoryAccount) ToProto() proto.Message {
 		XorMode:    a.XorMode,
 		Seconds:    a.Seconds,
 		Padding:    a.Padding,
-		Reverse:    a.Reverse,
 	}
 }

proxy/vless/account.pb.go

@@ -20,51 +20,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type Reverse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Tag string `protobuf:"bytes,1,opt,name=tag,proto3" json:"tag,omitempty"`
-}
-
-func (x *Reverse) Reset() {
-	*x = Reverse{}
-	mi := &file_proxy_vless_account_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *Reverse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Reverse) ProtoMessage() {}
-
-func (x *Reverse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_vless_account_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Reverse.ProtoReflect.Descriptor instead.
-func (*Reverse) Descriptor() ([]byte, []int) {
-	return file_proxy_vless_account_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *Reverse) GetTag() string {
-	if x != nil {
-		return x.Tag
-	}
-	return ""
-}
-
 type Account struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -73,17 +28,16 @@ type Account struct {
 	// ID of the account, in the form of a UUID, e.g., "66ad4540-b58c-4ad2-9926-ea63445a9b57".
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// Flow settings. May be "xtls-rprx-vision".
-	Flow       string   `protobuf:"bytes,2,opt,name=flow,proto3" json:"flow,omitempty"`
+	Flow       string `protobuf:"bytes,2,opt,name=flow,proto3" json:"flow,omitempty"`
-	Encryption string   `protobuf:"bytes,3,opt,name=encryption,proto3" json:"encryption,omitempty"`
+	Encryption string `protobuf:"bytes,3,opt,name=encryption,proto3" json:"encryption,omitempty"`
-	XorMode    uint32   `protobuf:"varint,4,opt,name=xorMode,proto3" json:"xorMode,omitempty"`
+	XorMode    uint32 `protobuf:"varint,4,opt,name=xorMode,proto3" json:"xorMode,omitempty"`
-	Seconds    uint32   `protobuf:"varint,5,opt,name=seconds,proto3" json:"seconds,omitempty"`
+	Seconds    uint32 `protobuf:"varint,5,opt,name=seconds,proto3" json:"seconds,omitempty"`
-	Padding    string   `protobuf:"bytes,6,opt,name=padding,proto3" json:"padding,omitempty"`
+	Padding    string `protobuf:"bytes,6,opt,name=padding,proto3" json:"padding,omitempty"`
-	Reverse    *Reverse `protobuf:"bytes,7,opt,name=reverse,proto3" json:"reverse,omitempty"`
 }
 
 func (x *Account) Reset() {
 	*x = Account{}
-	mi := &file_proxy_vless_account_proto_msgTypes[1]
+	mi := &file_proxy_vless_account_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -95,7 +49,7 @@ func (x *Account) String() string {
 func (*Account) ProtoMessage() {}
 
 func (x *Account) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_vless_account_proto_msgTypes[1]
+	mi := &file_proxy_vless_account_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -108,7 +62,7 @@ func (x *Account) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Account.ProtoReflect.Descriptor instead.
 func (*Account) Descriptor() ([]byte, []int) {
-	return file_proxy_vless_account_proto_rawDescGZIP(), []int{1}
+	return file_proxy_vless_account_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *Account) GetId() string {
@@ -153,40 +107,28 @@ func (x *Account) GetPadding() string {
 	return ""
 }
 
-func (x *Account) GetReverse() *Reverse {
-	if x != nil {
-		return x.Reverse
-	}
-	return nil
-}
-
 var File_proxy_vless_account_proto protoreflect.FileDescriptor
 
 var file_proxy_vless_account_proto_rawDesc = []byte{
 	0x0a, 0x19, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x76, 0x6c, 0x65, 0x73, 0x73, 0x2f, 0x61, 0x63,
 	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x78, 0x72, 0x61,
-	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6c, 0x65, 0x73, 0x73, 0x22, 0x1b, 0x0a,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6c, 0x65, 0x73, 0x73, 0x22, 0x9b, 0x01,
-	0x07, 0x52, 0x65, 0x76, 0x65, 0x72, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x61, 0x67, 0x18,
+	0x0a, 0x07, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x74, 0x61, 0x67, 0x22, 0xd0, 0x01, 0x0a, 0x07, 0x41,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x6c, 0x6f,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x1e, 0x0a,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x18, 0x02,
+	0x0a, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x6e,
+	0x09, 0x52, 0x0a, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x07, 0x78, 0x6f, 0x72, 0x4d, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
-	0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x78, 0x6f,
+	0x78, 0x6f, 0x72, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x6f, 0x6e,
-	0x72, 0x4d, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x78, 0x6f, 0x72,
+	0x64, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64,
-	0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x06, 0x20, 0x01,
-	0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x18,
+	0x28, 0x09, 0x52, 0x07, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x42, 0x52, 0x0a, 0x14, 0x63,
-	0x0a, 0x07, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6c,
-	0x07, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x33, 0x0a, 0x07, 0x72, 0x65, 0x76, 0x65,
+	0x65, 0x73, 0x73, 0x50, 0x01, 0x5a, 0x25, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x72, 0x73, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x78, 0x72, 0x61, 0x79,
+	0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6c, 0x65, 0x73, 0x73, 0x2e, 0x52, 0x65, 0x76,
+	0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x76, 0x6c, 0x65, 0x73, 0x73, 0xaa, 0x02, 0x10, 0x58,
-	0x65, 0x72, 0x73, 0x65, 0x52, 0x07, 0x72, 0x65, 0x76, 0x65, 0x72, 0x73, 0x65, 0x42, 0x52, 0x0a,
+	0x72, 0x61, 0x79, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x56, 0x6c, 0x65, 0x73, 0x73, 0x62,
-	0x14, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-	0x76, 0x6c, 0x65, 0x73, 0x73, 0x50, 0x01, 0x5a, 0x25, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f,
-	0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x76, 0x6c, 0x65, 0x73, 0x73, 0xaa, 0x02,
-	0x10, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x56, 0x6c, 0x65, 0x73,
-	0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -201,18 +143,16 @@ func file_proxy_vless_account_proto_rawDescGZIP() []byte {
 	return file_proxy_vless_account_proto_rawDescData
 }
 
-var file_proxy_vless_account_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_proxy_vless_account_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_proxy_vless_account_proto_goTypes = []any{
-	(*Reverse)(nil), // 0: xray.proxy.vless.Reverse
+	(*Account)(nil), // 0: xray.proxy.vless.Account
-	(*Account)(nil), // 1: xray.proxy.vless.Account
 }
 var file_proxy_vless_account_proto_depIdxs = []int32{
-	0, // 0: xray.proxy.vless.Account.reverse:type_name -> xray.proxy.vless.Reverse
+	0, // [0:0] is the sub-list for method output_type
-	1, // [1:1] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
-	1, // [1:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
-	1, // [1:1] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
-	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
-	0, // [0:1] is the sub-list for field type_name
 }
 
 func init() { file_proxy_vless_account_proto_init() }
@@ -226,7 +166,7 @@ func file_proxy_vless_account_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_vless_account_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   1,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

proxy/vless/account.proto

@@ -6,10 +6,6 @@ option go_package = "github.com/xtls/xray-core/proxy/vless";
 option java_package = "com.xray.proxy.vless";
 option java_multiple_files = true;
 
-message Reverse {
-  string tag = 1;
-}
-
 message Account {
   // ID of the account, in the form of a UUID, e.g., "66ad4540-b58c-4ad2-9926-ea63445a9b57".
   string id = 1;
@@ -20,6 +16,4 @@ message Account {
   uint32 xorMode = 4;
   uint32 seconds = 5;
   string padding = 6;
-
-  Reverse reverse = 7;
 }

proxy/vless/encoding/encoding.go

@@ -46,7 +46,7 @@ func EncodeRequestHeader(writer io.Writer, request *protocol.RequestHeader, requ
 		return errors.New("failed to write request command").Base(err)
 	}
 
-	if request.Command != protocol.RequestCommandMux && request.Command != protocol.RequestCommandRvs {
+	if request.Command != protocol.RequestCommandMux {
 		if err := addrParser.WriteAddressPort(&buffer, request.Address, request.Port); err != nil {
 			return errors.New("failed to write request address and port").Base(err)
 		}
@@ -112,8 +112,7 @@ func DecodeRequestHeader(isfb bool, first *buf.Buffer, reader io.Reader, validat
 		switch request.Command {
 		case protocol.RequestCommandMux:
 			request.Address = net.DomainAddress("v1.mux.cool")
-		case protocol.RequestCommandRvs:
+			request.Port = 0
-			request.Address = net.DomainAddress("v1.rvs.cool")
 		case protocol.RequestCommandTCP, protocol.RequestCommandUDP:
 			if addr, port, err := addrParser.ReadAddressPort(&buffer, reader); err == nil {
 				request.Address = addr

proxy/vless/inbound/inbound.go

@@ -12,24 +12,19 @@ import (
 	"time"
 	"unsafe"
 
-	"github.com/xtls/xray-core/app/dispatcher"
-	"github.com/xtls/xray-core/app/reverse"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/log"
-	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/retry"
-	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/common/signal"
 	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/dns"
 	feature_inbound "github.com/xtls/xray-core/features/inbound"
-	"github.com/xtls/xray-core/features/outbound"
 	"github.com/xtls/xray-core/features/policy"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/proxy"
@@ -71,14 +66,12 @@ func init() {
 
 // Handler is an inbound connection handler that handles messages in VLess protocol.
 type Handler struct {
-	inboundHandlerManager  feature_inbound.Manager
+	inboundHandlerManager feature_inbound.Manager
-	policyManager          policy.Manager
+	policyManager         policy.Manager
-	validator              vless.Validator
+	validator             vless.Validator
-	decryption             *encryption.ServerInstance
+	dns                   dns.Client
-	outboundHandlerManager outbound.Manager
+	decryption            *encryption.ServerInstance
-	defaultDispatcher      *dispatcher.DefaultDispatcher
+	fallbacks             map[string]map[string]map[string]*Fallback // or nil
-	ctx                    context.Context
-	fallbacks              map[string]map[string]map[string]*Fallback // or nil
 	// regexps               map[string]*regexp.Regexp       // or nil
 }
 
@@ -86,12 +79,10 @@ type Handler struct {
 func New(ctx context.Context, config *Config, dc dns.Client, validator vless.Validator) (*Handler, error) {
 	v := core.MustFromContext(ctx)
 	handler := &Handler{
-		inboundHandlerManager:  v.GetFeature(feature_inbound.ManagerType()).(feature_inbound.Manager),
+		inboundHandlerManager: v.GetFeature(feature_inbound.ManagerType()).(feature_inbound.Manager),
-		policyManager:          v.GetFeature(policy.ManagerType()).(policy.Manager),
+		policyManager:         v.GetFeature(policy.ManagerType()).(policy.Manager),
-		validator:              validator,
+		dns:                   dc,
-		outboundHandlerManager: v.GetFeature(outbound.ManagerType()).(outbound.Manager),
+		validator:             validator,
-		defaultDispatcher:      v.GetFeature(routing.DispatcherType()).(*dispatcher.DefaultDispatcher),
-		ctx:                    ctx,
 	}
 
 	if config.Decryption != "" && config.Decryption != "none" {
@@ -183,49 +174,11 @@ func isMuxAndNotXUDP(request *protocol.RequestHeader, first *buf.Buffer) bool {
 		firstBytes[6] == 2) // Network type: UDP
 }
 
-func (h *Handler) GetReverse(a *vless.MemoryAccount) (*Reverse, error) {
-	u := h.validator.Get(a.ID.UUID())
-	if u == nil {
-		return nil, errors.New("reverse: user " + a.ID.String() + " doesn't exist anymore")
-	}
-	a = u.Account.(*vless.MemoryAccount)
-	if a.Reverse == nil || a.Reverse.Tag == "" {
-		return nil, errors.New("reverse: user " + a.ID.String() + " is not allowed to create reverse proxy")
-	}
-	r := h.outboundHandlerManager.GetHandler(a.Reverse.Tag)
-	if r == nil {
-		picker, _ := reverse.NewStaticMuxPicker()
-		r = &Reverse{tag: a.Reverse.Tag, picker: picker, client: &mux.ClientManager{Picker: picker}}
-		for len(h.outboundHandlerManager.ListHandlers(h.ctx)) == 0 {
-			time.Sleep(time.Second) // prevents this outbound from becoming the default outbound
-		}
-		if err := h.outboundHandlerManager.AddHandler(h.ctx, r); err != nil {
-			return nil, err
-		}
-	}
-	if r, ok := r.(*Reverse); ok {
-		return r, nil
-	}
-	return nil, errors.New("reverse: outbound " + a.Reverse.Tag + " is not type Reverse")
-}
-
-func (h *Handler) RemoveReverse(u *protocol.MemoryUser) {
-	if u != nil {
-		a := u.Account.(*vless.MemoryAccount)
-		if a.Reverse != nil && a.Reverse.Tag != "" {
-			h.outboundHandlerManager.RemoveHandler(h.ctx, a.Reverse.Tag)
-		}
-	}
-}
-
 // Close implements common.Closable.Close().
 func (h *Handler) Close() error {
 	if h.decryption != nil {
 		h.decryption.Close()
 	}
-	for _, u := range h.validator.GetAll() {
-		h.RemoveReverse(u)
-	}
 	return errors.Combine(common.Close(h.validator))
 }
 
@@ -236,7 +189,6 @@ func (h *Handler) AddUser(ctx context.Context, u *protocol.MemoryUser) error {
 
 // RemoveUser implements proxy.UserManager.RemoveUser().
 func (h *Handler) RemoveUser(ctx context.Context, e string) error {
-	h.RemoveReverse(h.validator.GetByEmail(e))
 	return h.validator.Del(e)
 }
 
@@ -548,8 +500,7 @@ func (h *Handler) Process(ctx context.Context, network net.Network, connection s
 			switch request.Command {
 			case protocol.RequestCommandUDP:
 				return errors.New(requestAddons.Flow + " doesn't support UDP").AtWarning()
-			case protocol.RequestCommandMux, protocol.RequestCommandRvs:
+			case protocol.RequestCommandMux:
-				inbound.CanSpliceCopy = 3
 				fallthrough // we will break Mux connections that contain TCP requests
 			case protocol.RequestCommandTCP:
 				var t reflect.Type
@@ -614,14 +565,6 @@ func (h *Handler) Process(ctx context.Context, network net.Network, connection s
 	clientWriter := encoding.EncodeBodyAddons(bufferWriter, request, requestAddons, trafficState, false, ctx, connection, nil)
 	bufferWriter.SetFlushNext()
 
-	if request.Command == protocol.RequestCommandRvs {
-		r, err := h.GetReverse(account)
-		if err != nil {
-			return err
-		}
-		return r.NewMux(ctx, h.defaultDispatcher.WrapLink(ctx, &transport.Link{Reader: clientReader, Writer: clientWriter}))
-	}
-
 	if err := dispatcher.DispatchLink(ctx, request.Destination(), &transport.Link{
 		Reader: clientReader,
 		Writer: clientWriter},
@@ -630,58 +573,3 @@ func (h *Handler) Process(ctx context.Context, network net.Network, connection s
 	}
 	return nil
 }
-
-type Reverse struct {
-	tag    string
-	picker *reverse.StaticMuxPicker
-	client *mux.ClientManager
-}
-
-func (r *Reverse) Tag() string {
-	return r.tag
-}
-
-func (r *Reverse) NewMux(ctx context.Context, link *transport.Link) error {
-	muxClient, err := mux.NewClientWorker(*link, mux.ClientStrategy{})
-	if err != nil {
-		return errors.New("failed to create mux client worker").Base(err).AtWarning()
-	}
-	worker, err := reverse.NewPortalWorker(muxClient)
-	if err != nil {
-		return errors.New("failed to create portal worker").Base(err).AtWarning()
-	}
-	r.picker.AddWorker(worker)
-	select {
-	case <-ctx.Done():
-	case <-muxClient.WaitClosed():
-	}
-	return nil
-}
-
-func (r *Reverse) Dispatch(ctx context.Context, link *transport.Link) {
-	outbounds := session.OutboundsFromContext(ctx)
-	ob := outbounds[len(outbounds)-1]
-	if ob != nil {
-		if ob.Target.Network == net.Network_UDP && ob.OriginalTarget.Address != nil && ob.OriginalTarget.Address != ob.Target.Address {
-			link.Reader = &buf.EndpointOverrideReader{Reader: link.Reader, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
-			link.Writer = &buf.EndpointOverrideWriter{Writer: link.Writer, Dest: ob.Target.Address, OriginalDest: ob.OriginalTarget.Address}
-		}
-		r.client.Dispatch(ctx, link)
-	}
-}
-
-func (r *Reverse) Start() error {
-	return nil
-}
-
-func (r *Reverse) Close() error {
-	return nil
-}
-
-func (r *Reverse) SenderSettings() *serial.TypedMessage {
-	return nil
-}
-
-func (r *Reverse) ProxySettings() *serial.TypedMessage {
-	return nil
-}

proxy/vless/outbound/config.pb.go

@@ -26,7 +26,7 @@ type Config struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Vnext *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=vnext,proto3" json:"vnext,omitempty"`
+	Vnext []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=vnext,proto3" json:"vnext,omitempty"`
 }
 
 func (x *Config) Reset() {
@@ -59,7 +59,7 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_proxy_vless_outbound_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetVnext() *protocol.ServerEndpoint {
+func (x *Config) GetVnext() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Vnext
 	}
@@ -76,7 +76,7 @@ var file_proxy_vless_outbound_config_proto_rawDesc = []byte{
 	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
 	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x70, 0x65, 0x63, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x22, 0x44, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3a, 0x0a, 0x05, 0x76,
-	0x6e, 0x65, 0x78, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61,
+	0x6e, 0x65, 0x78, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x78, 0x72, 0x61,
 	0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
 	0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
 	0x52, 0x05, 0x76, 0x6e, 0x65, 0x78, 0x74, 0x42, 0x6d, 0x0a, 0x1d, 0x63, 0x6f, 0x6d, 0x2e, 0x78,

proxy/vless/outbound/config.proto

@@ -9,5 +9,5 @@ option java_multiple_files = true;
 import "common/protocol/server_spec.proto";
 
 message Config {
-  xray.common.protocol.ServerEndpoint vnext = 1;
+  repeated xray.common.protocol.ServerEndpoint vnext = 1;
 }

proxy/vless/outbound/outbound.go

@@ -11,12 +11,9 @@ import (
 	"unsafe"
 
 	utls "github.com/refraction-networking/utls"
-	proxyman "github.com/xtls/xray-core/app/proxyman/outbound"
-	"github.com/xtls/xray-core/app/reverse"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/retry"
@@ -26,7 +23,6 @@ import (
 	"github.com/xtls/xray-core/common/xudp"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
-	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/proxy"
 	"github.com/xtls/xray-core/proxy/vless"
 	"github.com/xtls/xray-core/proxy/vless/encoding"
@@ -36,7 +32,6 @@ import (
 	"github.com/xtls/xray-core/transport/internet/reality"
 	"github.com/xtls/xray-core/transport/internet/stat"
 	"github.com/xtls/xray-core/transport/internet/tls"
-	"github.com/xtls/xray-core/transport/pipe"
 )
 
 func init() {
@@ -47,31 +42,33 @@ func init() {
 
 // Handler is an outbound connection handler for VLess protocol.
 type Handler struct {
-	server        *protocol.ServerSpec
+	serverList    *protocol.ServerList
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 	cone          bool
 	encryption    *encryption.ClientInstance
-	reverse       *Reverse
 }
 
 // New creates a new VLess outbound handler.
 func New(ctx context.Context, config *Config) (*Handler, error) {
-	if config.Vnext == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no vnext found`)
+	for _, rec := range config.Vnext {
-	}
+		s, err := protocol.NewServerSpecFromPB(rec)
-	server, err := protocol.NewServerSpecFromPB(config.Vnext)
+		if err != nil {
-	if err != nil {
+			return nil, errors.New("failed to parse server spec").Base(err).AtError()
-		return nil, errors.New("failed to get server spec").Base(err).AtError()
+		}
+		serverList.AddServer(s)
 	}
 
 	v := core.MustFromContext(ctx)
 	handler := &Handler{
-		server:        server,
+		serverList:    serverList,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 		cone:          ctx.Value("cone").(bool),
 	}
 
-	a := handler.server.User.Account.(*vless.MemoryAccount)
+	a := handler.serverPicker.PickServer().PickUser().Account.(*vless.MemoryAccount)
 	if a.Encryption != "" && a.Encryption != "none" {
 		s := strings.Split(a.Encryption, ".")
 		var nfsPKeysBytes [][]byte
@@ -85,49 +82,24 @@ func New(ctx context.Context, config *Config) (*Handler, error) {
 		}
 	}
 
-	if a.Reverse != nil {
-		handler.reverse = &Reverse{
-			tag:        a.Reverse.Tag,
-			dispatcher: v.GetFeature(routing.DispatcherType()).(routing.Dispatcher),
-			ctx:        ctx,
-			handler:    handler,
-		}
-		handler.reverse.monitorTask = &task.Periodic{
-			Execute:  handler.reverse.monitor,
-			Interval: time.Second * 2,
-		}
-		go func() {
-			time.Sleep(2 * time.Second)
-			handler.reverse.Start()
-		}()
-	}
-
 	return handler, nil
 }
 
-// Close implements common.Closable.Close().
-func (h *Handler) Close() error {
-	if h.reverse != nil {
-		return h.reverse.Close()
-	}
-	return nil
-}
-
 // Process implements proxy.Outbound.Process().
 func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer internet.Dialer) error {
 	outbounds := session.OutboundsFromContext(ctx)
 	ob := outbounds[len(outbounds)-1]
-	if !ob.Target.IsValid() && ob.Target.Address.String() != "v1.rvs.cool" {
+	if !ob.Target.IsValid() {
 		return errors.New("target not specified").AtError()
 	}
 	ob.Name = "vless"
 
-	rec := h.server
+	var rec *protocol.ServerSpec
 	var conn stat.Connection
-
 	if err := retry.ExponentialBackoff(5, 200).On(func() error {
+		rec = h.serverPicker.PickServer()
 		var err error
-		conn, err = dialer.Dial(ctx, rec.Destination)
+		conn, err = dialer.Dial(ctx, rec.Destination())
 		if err != nil {
 			return err
 		}
@@ -142,7 +114,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		iConn = statConn.Connection
 	}
 	target := ob.Target
-	errors.LogInfo(ctx, "tunneling request to ", target, " via ", rec.Destination.NetAddr())
+	errors.LogInfo(ctx, "tunneling request to ", target, " via ", rec.Destination().NetAddr())
 
 	if h.encryption != nil {
 		var err error
@@ -155,21 +127,13 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	if target.Network == net.Network_UDP {
 		command = protocol.RequestCommandUDP
 	}
-	if target.Address.Family().IsDomain() {
+	if target.Address.Family().IsDomain() && target.Address.Domain() == "v1.mux.cool" {
-		switch target.Address.Domain() {
+		command = protocol.RequestCommandMux
-		case "v1.mux.cool":
-			command = protocol.RequestCommandMux
-		case "v1.rvs.cool":
-			if target.Network != net.Network_Unknown {
-				return errors.New("nice try baby").AtError()
-			}
-			command = protocol.RequestCommandRvs
-		}
 	}
 
 	request := &protocol.RequestHeader{
 		Version: encoding.Version,
-		User:    rec.User,
+		User:    rec.PickUser(),
 		Command: command,
 		Address: target.Address,
 		Port:    target.Port,
@@ -357,67 +321,3 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 
 	return nil
 }
-
-type Reverse struct {
-	tag         string
-	dispatcher  routing.Dispatcher
-	ctx         context.Context
-	handler     *Handler
-	workers     []*reverse.BridgeWorker
-	monitorTask *task.Periodic
-}
-
-func (r *Reverse) monitor() error {
-	var activeWorkers []*reverse.BridgeWorker
-	for _, w := range r.workers {
-		if w.IsActive() {
-			activeWorkers = append(activeWorkers, w)
-		}
-	}
-	if len(activeWorkers) != len(r.workers) {
-		r.workers = activeWorkers
-	}
-
-	var numConnections uint32
-	var numWorker uint32
-	for _, w := range r.workers {
-		if w.IsActive() {
-			numConnections += w.Connections()
-			numWorker++
-		}
-	}
-	if numWorker == 0 || numConnections/numWorker > 16 {
-		reader1, writer1 := pipe.New(pipe.WithSizeLimit(2 * buf.Size))
-		reader2, writer2 := pipe.New(pipe.WithSizeLimit(2 * buf.Size))
-		link1 := &transport.Link{Reader: reader1, Writer: writer2}
-		link2 := &transport.Link{Reader: reader2, Writer: writer1}
-		w := &reverse.BridgeWorker{
-			Tag:        r.tag,
-			Dispatcher: r.dispatcher,
-		}
-		worker, err := mux.NewServerWorker(r.ctx, w, link1)
-		if err != nil {
-			errors.LogWarningInner(r.ctx, err, "failed to create mux server worker")
-			return nil
-		}
-		w.Worker = worker
-		r.workers = append(r.workers, w)
-		go func() {
-			ctx := session.ContextWithOutbounds(r.ctx, []*session.Outbound{{
-				Target: net.Destination{Address: net.DomainAddress("v1.rvs.cool")},
-			}})
-			r.handler.Process(ctx, link2, session.HandlerFromContext(ctx).(*proxyman.Handler))
-			common.Interrupt(reader1)
-			common.Interrupt(reader2)
-		}()
-	}
-	return nil
-}
-
-func (r *Reverse) Start() error {
-	return r.monitorTask.Start()
-}
-
-func (r *Reverse) Close() error {
-	return r.monitorTask.Close()
-}

proxy/vmess/aead/authid.go

@@ -10,17 +10,15 @@ import (
 	"hash/crc32"
 	"io"
 	"math"
-	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/antireplay"
+	"github.com/xtls/xray-core/proxy/vmess/vtime"
 )
 
 var (
-	ErrNotFound     = errors.New("user do not exist")
+	ErrNotFound = errors.New("user do not exist")
-	ErrNeagtiveTime = errors.New("timestamp is negative")
+	ErrReplay   = errors.New("replayed request")
-	ErrInvalidTime  = errors.New("invalid timestamp, perhaps unsynchronized time")
-	ErrReplay       = errors.New("replayed request")
 )
 
 func CreateAuthID(cmdKey []byte, time int64) [16]byte {
@@ -104,11 +102,11 @@ func (a *AuthIDDecoderHolder) Match(authID [16]byte) (interface{}, error) {
 		}
 
 		if t < 0 {
-			return nil, ErrNeagtiveTime
+			continue
 		}
 
-		if math.Abs(math.Abs(float64(t))-float64(time.Now().Unix())) > 120 {
+		if math.Abs(math.Abs(float64(t))-float64(vtime.Now().Unix())) > 120 {
-			return nil, ErrInvalidTime
+			continue
 		}
 
 		if !a.filter.Check(authID[:]) {

proxy/vmess/aead/encrypt.go

@@ -5,14 +5,14 @@ import (
 	"crypto/rand"
 	"encoding/binary"
 	"io"
-	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/crypto"
+	"github.com/xtls/xray-core/proxy/vmess/vtime"
 )
 
 func SealVMessAEADHeader(key [16]byte, data []byte) []byte {
-	generatedAuthID := CreateAuthID(key[:], time.Now().Unix())
+	generatedAuthID := CreateAuthID(key[:], vtime.Now().Unix())
 
 	connectionNonce := make([]byte, 8)
 	if _, err := io.ReadFull(rand.Reader, connectionNonce); err != nil {

proxy/vmess/encoding/commands.go

@@ -7,7 +7,10 @@ import (
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/common/uuid"
 )
 
 var (
@@ -26,6 +29,9 @@ func MarshalCommand(command interface{}, writer io.Writer) error {
 	var cmdID byte
 	var factory CommandFactory
 	switch command.(type) {
+	case *protocol.CommandSwitchAccount:
+		factory = new(CommandSwitchAccountFactory)
+		cmdID = 1
 	default:
 		return ErrUnknownCommand
 	}
@@ -61,6 +67,8 @@ func UnmarshalCommand(cmdID byte, data []byte) (protocol.ResponseCommand, error)
 
 	var factory CommandFactory
 	switch cmdID {
+	case 1:
+		factory = new(CommandSwitchAccountFactory)
 	default:
 		return nil, ErrUnknownCommand
 	}
@@ -71,3 +79,67 @@ type CommandFactory interface {
 	Marshal(command interface{}, writer io.Writer) error
 	Unmarshal(data []byte) (interface{}, error)
 }
+
+type CommandSwitchAccountFactory struct{}
+
+func (f *CommandSwitchAccountFactory) Marshal(command interface{}, writer io.Writer) error {
+	cmd, ok := command.(*protocol.CommandSwitchAccount)
+	if !ok {
+		return ErrCommandTypeMismatch
+	}
+
+	hostStr := ""
+	if cmd.Host != nil {
+		hostStr = cmd.Host.String()
+	}
+	common.Must2(writer.Write([]byte{byte(len(hostStr))}))
+
+	if len(hostStr) > 0 {
+		common.Must2(writer.Write([]byte(hostStr)))
+	}
+
+	common.Must2(serial.WriteUint16(writer, cmd.Port.Value()))
+
+	idBytes := cmd.ID.Bytes()
+	common.Must2(writer.Write(idBytes))
+	common.Must2(serial.WriteUint16(writer, 0)) // compatible with legacy alterId
+	common.Must2(writer.Write([]byte{byte(cmd.Level)}))
+
+	common.Must2(writer.Write([]byte{cmd.ValidMin}))
+	return nil
+}
+
+func (f *CommandSwitchAccountFactory) Unmarshal(data []byte) (interface{}, error) {
+	cmd := new(protocol.CommandSwitchAccount)
+	if len(data) == 0 {
+		return nil, ErrInsufficientLength
+	}
+	lenHost := int(data[0])
+	if len(data) < lenHost+1 {
+		return nil, ErrInsufficientLength
+	}
+	if lenHost > 0 {
+		cmd.Host = net.ParseAddress(string(data[1 : 1+lenHost]))
+	}
+	portStart := 1 + lenHost
+	if len(data) < portStart+2 {
+		return nil, ErrInsufficientLength
+	}
+	cmd.Port = net.PortFromBytes(data[portStart : portStart+2])
+	idStart := portStart + 2
+	if len(data) < idStart+16 {
+		return nil, ErrInsufficientLength
+	}
+	cmd.ID, _ = uuid.ParseBytes(data[idStart : idStart+16])
+	levelStart := idStart + 16 + 2
+	if len(data) < levelStart+1 {
+		return nil, ErrInsufficientLength
+	}
+	cmd.Level = uint32(data[levelStart])
+	timeStart := levelStart + 1
+	if len(data) < timeStart+1 {
+		return nil, ErrInsufficientLength
+	}
+	cmd.ValidMin = data[timeStart]
+	return cmd, nil
+}

proxy/vmess/encoding/commands_test.go

@@ -0,0 +1,55 @@
+package encoding_test
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
+	"github.com/xtls/xray-core/common/protocol"
+	"github.com/xtls/xray-core/common/uuid"
+	. "github.com/xtls/xray-core/proxy/vmess/encoding"
+)
+
+func TestSwitchAccount(t *testing.T) {
+	sa := &protocol.CommandSwitchAccount{
+		Port:     1234,
+		ID:       uuid.New(),
+		Level:    128,
+		ValidMin: 16,
+	}
+
+	buffer := buf.New()
+	common.Must(MarshalCommand(sa, buffer))
+
+	cmd, err := UnmarshalCommand(1, buffer.BytesFrom(2))
+	common.Must(err)
+
+	sa2, ok := cmd.(*protocol.CommandSwitchAccount)
+	if !ok {
+		t.Fatal("failed to convert command to CommandSwitchAccount")
+	}
+	if r := cmp.Diff(sa2, sa); r != "" {
+		t.Error(r)
+	}
+}
+
+func TestSwitchAccountBugOffByOne(t *testing.T) {
+	sa := &protocol.CommandSwitchAccount{
+		Port:     1234,
+		ID:       uuid.New(),
+		Level:    128,
+		ValidMin: 16,
+	}
+
+	buffer := buf.New()
+	csaf := CommandSwitchAccountFactory{}
+	common.Must(csaf.Marshal(sa, buffer))
+
+	Payload := buffer.Bytes()
+
+	cmd, err := csaf.Unmarshal(Payload[:len(Payload)-1])
+	assert.Error(t, err)
+	assert.Nil(t, cmd)
+}

proxy/vmess/inbound/config.pb.go

@@ -118,6 +118,7 @@ type Config struct {
 
 	User    []*protocol.User `protobuf:"bytes,1,rep,name=user,proto3" json:"user,omitempty"`
 	Default *DefaultConfig   `protobuf:"bytes,2,opt,name=default,proto3" json:"default,omitempty"`
+	Detour  *DetourConfig    `protobuf:"bytes,3,opt,name=detour,proto3" json:"detour,omitempty"` // 4 is for legacy setting
 }
 
 func (x *Config) Reset() {
@@ -164,6 +165,13 @@ func (x *Config) GetDefault() *DefaultConfig {
 	return nil
 }
 
+func (x *Config) GetDetour() *DetourConfig {
+	if x != nil {
+		return x.Detour
+	}
+	return nil
+}
+
 var File_proxy_vmess_inbound_config_proto protoreflect.FileDescriptor
 
 var file_proxy_vmess_inbound_config_proto_rawDesc = []byte{
@@ -177,21 +185,26 @@ var file_proxy_vmess_inbound_config_proto_rawDesc = []byte{
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x74, 0x6f, 0x22, 0x25, 0x0a, 0x0d, 0x44, 0x65, 0x66, 0x61,
 	0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x65, 0x76,
 	0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x22,
-	0x7b, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2e, 0x0a, 0x04, 0x75, 0x73, 0x65,
+	0xbb, 0x01, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2e, 0x0a, 0x04, 0x75, 0x73,
-	0x72, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x63,
+	0x65, 0x72, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x55,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e,
-	0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x41, 0x0a, 0x07, 0x64, 0x65, 0x66,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x41, 0x0a, 0x07, 0x64, 0x65,
-	0x61, 0x75, 0x6c, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x78, 0x72, 0x61,
+	0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x78, 0x72,
-	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6d, 0x65, 0x73, 0x73, 0x2e, 0x69, 0x6e,
+	0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6d, 0x65, 0x73, 0x73, 0x2e, 0x69,
-	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x2e, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e,
+	0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x2e, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x6f,
-	0x66, 0x69, 0x67, 0x52, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x42, 0x6a, 0x0a, 0x1c,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x12, 0x3e, 0x0a,
-	0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76,
+	0x06, 0x64, 0x65, 0x74, 0x6f, 0x75, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e,
-	0x6d, 0x65, 0x73, 0x73, 0x2e, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x50, 0x01, 0x5a, 0x2d,
+	0x78, 0x72, 0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x76, 0x6d, 0x65, 0x73, 0x73,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73, 0x2f,
+	0x2e, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x2e, 0x44, 0x65, 0x74, 0x6f, 0x75, 0x72, 0x43,
-	0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x64, 0x65, 0x74, 0x6f, 0x75, 0x72, 0x42, 0x6a, 0x0a,
-	0x76, 0x6d, 0x65, 0x73, 0x73, 0x2f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0xaa, 0x02, 0x18,
+	0x1c, 0x63, 0x6f, 0x6d, 0x2e, 0x78, 0x72, 0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e,
-	0x58, 0x72, 0x61, 0x79, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x56, 0x6d, 0x65, 0x73, 0x73,
+	0x76, 0x6d, 0x65, 0x73, 0x73, 0x2e, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x50, 0x01, 0x5a,
-	0x2e, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x78, 0x74, 0x6c, 0x73,
+	0x2f, 0x78, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79,
+	0x2f, 0x76, 0x6d, 0x65, 0x73, 0x73, 0x2f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0xaa, 0x02,
+	0x18, 0x58, 0x72, 0x61, 0x79, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x56, 0x6d, 0x65, 0x73,
+	0x73, 0x2e, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
@@ -216,11 +229,12 @@ var file_proxy_vmess_inbound_config_proto_goTypes = []any{
 var file_proxy_vmess_inbound_config_proto_depIdxs = []int32{
 	3, // 0: xray.proxy.vmess.inbound.Config.user:type_name -> xray.common.protocol.User
 	1, // 1: xray.proxy.vmess.inbound.Config.default:type_name -> xray.proxy.vmess.inbound.DefaultConfig
-	2, // [2:2] is the sub-list for method output_type
+	0, // 2: xray.proxy.vmess.inbound.Config.detour:type_name -> xray.proxy.vmess.inbound.DetourConfig
-	2, // [2:2] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension extendee
+	3, // [3:3] is the sub-list for extension type_name
-	0, // [0:2] is the sub-list for field type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_proxy_vmess_inbound_config_proto_init() }

proxy/vmess/inbound/config.proto

@@ -19,4 +19,6 @@ message DefaultConfig {
 message Config {
   repeated xray.common.protocol.User user = 1;
   DefaultConfig default = 2;
+  DetourConfig detour = 3;
+  // 4 is for legacy setting
 }

proxy/vmess/inbound/inbound.go

@@ -106,6 +106,7 @@ type Handler struct {
 	inboundHandlerManager feature_inbound.Manager
 	clients               *vmess.TimedUserValidator
 	usersByEmail          *userByEmail
+	detours               *DetourConfig
 	sessionHistory        *encoding.SessionHistory
 }
 
@@ -116,6 +117,7 @@ func New(ctx context.Context, config *Config) (*Handler, error) {
 		policyManager:         v.GetFeature(policy.ManagerType()).(policy.Manager),
 		inboundHandlerManager: v.GetFeature(feature_inbound.ManagerType()).(feature_inbound.Manager),
 		clients:               vmess.NewTimedUserValidator(),
+		detours:               config.Detour,
 		usersByEmail:          newUserByEmail(config.GetDefaultValue()),
 		sessionHistory:        encoding.NewSessionHistory(),
 	}
@@ -321,8 +323,38 @@ func (h *Handler) Process(ctx context.Context, network net.Network, connection s
 	return nil
 }
 
-// Stub command generator
 func (h *Handler) generateCommand(ctx context.Context, request *protocol.RequestHeader) protocol.ResponseCommand {
+	if h.detours != nil {
+		tag := h.detours.To
+		if h.inboundHandlerManager != nil {
+			handler, err := h.inboundHandlerManager.GetHandler(ctx, tag)
+			if err != nil {
+				errors.LogWarningInner(ctx, err, "failed to get detour handler: ", tag)
+				return nil
+			}
+			proxyHandler, port, availableMin := handler.GetRandomInboundProxy()
+			inboundHandler, ok := proxyHandler.(*Handler)
+			if ok && inboundHandler != nil {
+				if availableMin > 255 {
+					availableMin = 255
+				}
+
+				errors.LogDebug(ctx, "pick detour handler for port ", port, " for ", availableMin, " minutes.")
+				user := inboundHandler.GetOrGenerateUser(request.User.Email)
+				if user == nil {
+					return nil
+				}
+				account := user.Account.(*vmess.MemoryAccount)
+				return &protocol.CommandSwitchAccount{
+					Port:     port,
+					ID:       account.ID.UUID(),
+					Level:    user.Level,
+					ValidMin: byte(availableMin),
+				}
+			}
+		}
+	}
+
 	return nil
 }
 

proxy/vmess/outbound/command.go

@@ -1,14 +1,41 @@
 package outbound
 
 import (
+	"time"
 
+	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
+	"github.com/xtls/xray-core/proxy/vmess"
 )
 
-// As a stub command consumer.
+func (h *Handler) handleSwitchAccount(cmd *protocol.CommandSwitchAccount) {
+	rawAccount := &vmess.Account{
+		Id: cmd.ID.String(),
+		SecuritySettings: &protocol.SecurityConfig{
+			Type: protocol.SecurityType_AUTO,
+		},
+	}
+
+	account, err := rawAccount.AsAccount()
+	common.Must(err)
+	user := &protocol.MemoryUser{
+		Email:   "",
+		Level:   cmd.Level,
+		Account: account,
+	}
+	dest := net.TCPDestination(cmd.Host, cmd.Port)
+	until := time.Now().Add(time.Duration(cmd.ValidMin) * time.Minute)
+	h.serverList.AddServer(protocol.NewServerSpec(dest, protocol.BeforeTime(until), user))
+}
+
 func (h *Handler) handleCommand(dest net.Destination, cmd protocol.ResponseCommand) {
-	switch cmd.(type) {
+	switch typedCommand := cmd.(type) {
+	case *protocol.CommandSwitchAccount:
+		if typedCommand.Host == nil {
+			typedCommand.Host = dest.Address
+		}
+		h.handleSwitchAccount(typedCommand)
 	default:
 	}
 }

proxy/vmess/outbound/config.pb.go

@@ -26,7 +26,7 @@ type Config struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Receiver *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=Receiver,proto3" json:"Receiver,omitempty"`
+	Receiver []*protocol.ServerEndpoint `protobuf:"bytes,1,rep,name=Receiver,proto3" json:"Receiver,omitempty"`
 }
 
 func (x *Config) Reset() {
@@ -59,7 +59,7 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_proxy_vmess_outbound_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetReceiver() *protocol.ServerEndpoint {
+func (x *Config) GetReceiver() []*protocol.ServerEndpoint {
 	if x != nil {
 		return x.Receiver
 	}
@@ -76,7 +76,7 @@ var file_proxy_vmess_outbound_config_proto_rawDesc = []byte{
 	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
 	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x70, 0x65, 0x63, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x22, 0x4a, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x40, 0x0a, 0x08, 0x52,
-	0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
 	0x78, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f,
 	0x69, 0x6e, 0x74, 0x52, 0x08, 0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x72, 0x42, 0x6d, 0x0a,

proxy/vmess/outbound/config.proto

@@ -9,5 +9,5 @@ option java_multiple_files = true;
 import "common/protocol/server_spec.proto";
 
 message Config {
-  xray.common.protocol.ServerEndpoint Receiver = 1;
+  repeated xray.common.protocol.ServerEndpoint Receiver = 1;
 }

proxy/vmess/outbound/outbound.go

@@ -29,24 +29,27 @@ import (
 
 // Handler is an outbound connection handler for VMess protocol.
 type Handler struct {
-	server        *protocol.ServerSpec
+	serverList    *protocol.ServerList
+	serverPicker  protocol.ServerPicker
 	policyManager policy.Manager
 	cone          bool
 }
 
 // New creates a new VMess outbound handler.
 func New(ctx context.Context, config *Config) (*Handler, error) {
-	if config.Receiver == nil {
+	serverList := protocol.NewServerList()
-		return nil, errors.New(`no vnext found`)
+	for _, rec := range config.Receiver {
-	}
+		s, err := protocol.NewServerSpecFromPB(rec)
-	server, err := protocol.NewServerSpecFromPB(config.Receiver)
+		if err != nil {
-	if err != nil {
+			return nil, errors.New("failed to parse server spec").Base(err)
-		return nil, errors.New("failed to get server spec").Base(err)
+		}
+		serverList.AddServer(s)
 	}
 
 	v := core.MustFromContext(ctx)
 	handler := &Handler{
-		server:        server,
+		serverList:    serverList,
+		serverPicker:  protocol.NewRoundRobinServerPicker(serverList),
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 		cone:          ctx.Value("cone").(bool),
 	}
@@ -64,11 +67,11 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	ob.Name = "vmess"
 	ob.CanSpliceCopy = 3
 
-	rec := h.server
+	var rec *protocol.ServerSpec
 	var conn stat.Connection
-
 	err := retry.ExponentialBackoff(5, 200).On(func() error {
-		rawConn, err := dialer.Dial(ctx, rec.Destination)
+		rec = h.serverPicker.PickServer()
+		rawConn, err := dialer.Dial(ctx, rec.Destination())
 		if err != nil {
 			return err
 		}
@@ -82,7 +85,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	defer conn.Close()
 
 	target := ob.Target
-	errors.LogInfo(ctx, "tunneling request to ", target, " via ", rec.Destination.NetAddr())
+	errors.LogInfo(ctx, "tunneling request to ", target, " via ", rec.Destination().NetAddr())
 
 	command := protocol.RequestCommandTCP
 	if target.Network == net.Network_UDP {
@@ -92,7 +95,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		command = protocol.RequestCommandMux
 	}
 
-	user := rec.User
+	user := rec.PickUser()
 	request := &protocol.RequestHeader{
 		Version: encoding.Version,
 		User:    user,
@@ -199,7 +202,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 		if err != nil {
 			return errors.New("failed to read header").Base(err)
 		}
-		h.handleCommand(rec.Destination, header.Command)
+		h.handleCommand(rec.Destination(), header.Command)
 
 		bodyReader, err := session.DecodeResponseBody(request, reader)
 		if err != nil {

proxy/vmess/vtime/vtime.go

@@ -0,0 +1,74 @@
+package vtime
+
+import (
+	"context"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform"
+	"github.com/xtls/xray-core/common/protocol/http"
+)
+
+var timeOffset atomic.Pointer[time.Duration]
+var initOnce sync.Once
+
+func updateTimeMonitor(ctx context.Context, domain string) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(10 * time.Minute):
+			err := updateTime(domain)
+			if err != nil {
+				errors.LogError(ctx, err)
+			}
+		}
+	}
+}
+
+func updateTime(domain string) error {
+	httpClient := http.NewClient()
+	resp, err := httpClient.Get(domain)
+	if err != nil {
+		return errors.New("Failed to access monitor domain").Base(err)
+	}
+	timeHeader := resp.Header.Get("Date")
+	remoteTime, err := time.Parse(time.RFC1123, timeHeader)
+	if err != nil {
+		return errors.New("Failed to parse time from monitor domain").Base(err)
+	}
+	localTime := time.Now()
+	offset := remoteTime.Sub(localTime)
+	if offset < 2*time.Second && offset > -2*time.Second {
+		errors.LogWarning(context.Background(), "Time offset too small, ignoring:", offset)
+		return nil
+	}
+	timeOffset.Store(&offset)
+	return nil
+}
+
+func Now() time.Time {
+	initOnce.Do(func() {
+		timeOffset.Store(new(time.Duration))
+		go func() {
+			domain := platform.NewEnvFlag("xray.vmess.time.domain").GetValue(func() string { return "https://apple.com" })
+			if domain == "" {
+				errors.LogError(context.Background(), "vmess time domain is empty, skip time sync")
+				return
+			}
+			err := updateTime(domain)
+			if err != nil {
+				errors.LogError(context.Background(), err)
+			}
+			errors.LogWarning(context.Background(), "Initial time offset for vmess:", timeOffset.Load())
+			// only one sync should be enough, so disable periodic update for now
+			//go updateTimeMonitor(context.TODO(), domain)
+		}()
+		runtime.Gosched()
+	})
+	offset := timeOffset.Load()
+	return time.Now().Add(*offset)
+}

testing/scenarios/command_test.go

@@ -423,16 +423,20 @@ func TestCommanderAddRemoveUser(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: u2.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: u2.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -596,16 +600,20 @@ func TestCommanderStats(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),

testing/scenarios/dokodemo_test.go

@@ -94,13 +94,17 @@ func TestDokodemoTCP(t *testing.T) {
 			Outbound: []*core.OutboundHandlerConfig{
 				{
 					ProxySettings: serial.ToTypedMessage(&outbound.Config{
-						Receiver: &protocol.ServerEndpoint{
+						Receiver: []*protocol.ServerEndpoint{
-							Address: net.NewIPOrDomain(net.LocalHostIP),
+							{
-							Port:    uint32(serverPort),
+								Address: net.NewIPOrDomain(net.LocalHostIP),
-							User:    &protocol.User{
+								Port:    uint32(serverPort),
-								Account: serial.ToTypedMessage(&vmess.Account{
+								User: []*protocol.User{
-									Id: userID.String(),
+									{
-								}),
+										Account: serial.ToTypedMessage(&vmess.Account{
+											Id: userID.String(),
+										}),
+									},
+								},
 							},
 						},
 					}),
@@ -186,13 +190,17 @@ func TestDokodemoUDP(t *testing.T) {
 			Outbound: []*core.OutboundHandlerConfig{
 				{
 					ProxySettings: serial.ToTypedMessage(&outbound.Config{
-						Receiver: &protocol.ServerEndpoint{
+						Receiver: []*protocol.ServerEndpoint{
-							Address: net.NewIPOrDomain(net.LocalHostIP),
+							{
-							Port:    uint32(serverPort),
+								Address: net.NewIPOrDomain(net.LocalHostIP),
-							User:    &protocol.User{
+								Port:    uint32(serverPort),
-								Account: serial.ToTypedMessage(&vmess.Account{
+								User: []*protocol.User{
-									Id: userID.String(),
+									{
-								}),
+										Account: serial.ToTypedMessage(&vmess.Account{
+											Id: userID.String(),
+										}),
+									},
+								},
 							},
 						},
 					}),

testing/scenarios/feature_test.go

@@ -170,13 +170,17 @@ func TestProxy(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: serverUserID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: serverUserID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -189,13 +193,17 @@ func TestProxy(t *testing.T) {
 			{
 				Tag: "proxy",
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(proxyPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(proxyPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: proxyUserID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: proxyUserID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -300,13 +308,17 @@ func TestProxyOverKCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: serverUserID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: serverUserID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -322,13 +334,17 @@ func TestProxyOverKCP(t *testing.T) {
 			{
 				Tag: "proxy",
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(proxyPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(proxyPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: proxyUserID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: proxyUserID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -669,16 +685,20 @@ func TestDialXray(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User: &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),

testing/scenarios/policy_test.go

@@ -119,16 +119,20 @@ func TestVMessClosing(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -219,16 +223,20 @@ func TestZeroBuffer(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),

testing/scenarios/reverse_test.go

@@ -155,16 +155,20 @@ func TestReverseProxy(t *testing.T) {
 			{
 				Tag: "reverse",
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(reversePort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(reversePort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -344,16 +348,20 @@ func TestReverseProxyLongRunning(t *testing.T) {
 			{
 				Tag: "reverse",
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(reversePort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(reversePort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),

testing/scenarios/shadowsocks_test.go

@@ -75,11 +75,15 @@ func TestShadowsocksChaCha20Poly1305TCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
-					Server:    &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: account,
+							User: []*protocol.User{
+								{
+									Account: account,
+								},
+							},
 						},
 					},
 				}),
@@ -167,11 +171,15 @@ func TestShadowsocksAES256GCMTCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: account,
+							User: []*protocol.User{
+								{
+									Account: account,
+								},
+							},
 						},
 					},
 				}),
@@ -260,11 +268,15 @@ func TestShadowsocksAES128GCMUDP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: account,
+							User: []*protocol.User{
+								{
+									Account: account,
+								},
+							},
 						},
 					},
 				}),
@@ -358,11 +370,15 @@ func TestShadowsocksAES128GCMUDPMux(t *testing.T) {
 					},
 				}),
 				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: account,
+							User: []*protocol.User{
+								{
+									Account: account,
+								},
+							},
 						},
 					},
 				}),
@@ -439,11 +455,15 @@ func TestShadowsocksNone(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&shadowsocks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: account,
+							User: []*protocol.User{
+								{
+									Account: account,
+								},
+							},
 						},
 					},
 				}),

testing/scenarios/socks_test.go

@@ -73,14 +73,18 @@ func TestSocksBridgeTCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&socks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&socks.Account{
+							User: []*protocol.User{
-								Username: "Test Account",
+								{
-								Password: "Test Password",
+									Account: serial.ToTypedMessage(&socks.Account{
-							}),
+										Username: "Test Account",
+										Password: "Test Password",
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -148,14 +152,18 @@ func TestSocksWithHttpRequest(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&http.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&http.Account{
+							User: []*protocol.User{
-								Username: "Test Account",
+								{
-								Password: "Test Password",
+									Account: serial.ToTypedMessage(&http.Account{
-							}),
+										Username: "Test Account",
+										Password: "Test Password",
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -248,14 +256,18 @@ func TestSocksBridageUDP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&socks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&socks.Account{
+							User: []*protocol.User{
-								Username: "Test Account",
+								{
-								Password: "Test Password",
+									Account: serial.ToTypedMessage(&socks.Account{
-							}),
+										Username: "Test Account",
+										Password: "Test Password",
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -363,9 +375,11 @@ func TestSocksBridageUDPWithRouting(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&socks.ClientConfig{
-					Server: &protocol.ServerEndpoint{
+					Server: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
+							Port:    uint32(serverPort),
+						},
 					},
 				}),
 			},

testing/scenarios/tls_test.go

@@ -89,13 +89,17 @@ func TestSimpleTLSConnection(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -200,13 +204,17 @@ func TestAutoIssuingCertificate(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -301,13 +309,17 @@ func TestTLSOverKCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -397,13 +409,17 @@ func TestTLSOverWebSocket(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -509,13 +525,17 @@ func TestGRPC(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -621,13 +641,17 @@ func TestGRPCMultiMode(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -728,13 +752,17 @@ func TestSimpleTLSConnectionPinned(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -826,13 +854,17 @@ func TestSimpleTLSConnectionPinnedWrongCert(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -923,13 +955,17 @@ func TestUTLSConnectionPinned(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -1022,13 +1058,17 @@ func TestUTLSConnectionPinnedWrongCert(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),

testing/scenarios/transport_test.go

@@ -85,13 +85,17 @@ func TestHTTPConnectionHeader(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),

testing/scenarios/vless_test.go

@@ -94,13 +94,17 @@ func TestVless(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Vnext: &protocol.ServerEndpoint{
+					Vnext: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vless.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vless.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -195,13 +199,17 @@ func TestVlessTls(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Vnext: &protocol.ServerEndpoint{
+					Vnext: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vless.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-							}),
+									Account: serial.ToTypedMessage(&vless.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -314,14 +322,18 @@ func TestVlessXtlsVision(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Vnext: &protocol.ServerEndpoint{
+					Vnext: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vless.Account{
+							User: []*protocol.User{
-								Id:   userID.String(),
+								{
-								Flow: vless.XRV,
+									Account: serial.ToTypedMessage(&vless.Account{
-							}),
+										Id:   userID.String(),
+										Flow: vless.XRV,
+									}),
+								},
+							},
 						},
 					},
 				}),
@@ -444,14 +456,18 @@ func TestVlessXtlsVisionReality(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Vnext: &protocol.ServerEndpoint{
+					Vnext: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vless.Account{
+							User: []*protocol.User{
-								Id:   userID.String(),
+								{
-								Flow: vless.XRV,
+									Account: serial.ToTypedMessage(&vless.Account{
-							}),
+										Id:   userID.String(),
+										Flow: vless.XRV,
+									}),
+								},
+							},
 						},
 					},
 				}),

testing/scenarios/vmess_test.go

@@ -26,6 +26,147 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
+func TestVMessDynamicPort(t *testing.T) {
+	tcpServer := tcp.Server{
+		MsgProcessor: xor,
+	}
+	dest, err := tcpServer.Start()
+	common.Must(err)
+	defer tcpServer.Close()
+
+	userID := protocol.NewID(uuid.New())
+
+	retry := 1
+	serverPort := tcp.PickPort()
+	for {
+		serverConfig := &core.Config{
+			App: []*serial.TypedMessage{
+				serial.ToTypedMessage(&log.Config{
+					ErrorLogLevel: clog.Severity_Debug,
+					ErrorLogType:  log.LogType_Console,
+				}),
+			},
+			Inbound: []*core.InboundHandlerConfig{
+				{
+					ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+						PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(serverPort)}},
+						Listen:   net.NewIPOrDomain(net.LocalHostIP),
+					}),
+					ProxySettings: serial.ToTypedMessage(&inbound.Config{
+						User: []*protocol.User{
+							{
+								Account: serial.ToTypedMessage(&vmess.Account{
+									Id: userID.String(),
+								}),
+							},
+						},
+						Detour: &inbound.DetourConfig{
+							To: "detour",
+						},
+					}),
+				},
+				{
+					ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+						PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(serverPort + 100)}},
+						Listen:   net.NewIPOrDomain(net.LocalHostIP),
+					}),
+					ProxySettings: serial.ToTypedMessage(&dokodemo.Config{
+						Address:  net.NewIPOrDomain(dest.Address),
+						Port:     uint32(dest.Port),
+						Networks: []net.Network{net.Network_TCP},
+					}),
+				},
+				{
+					ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+						PortList: &net.PortList{
+							Range: []*net.PortRange{{From: uint32(serverPort + 1), To: uint32(serverPort + 99)}},
+						},
+
+						Listen: net.NewIPOrDomain(net.LocalHostIP),
+						AllocationStrategy: &proxyman.AllocationStrategy{
+							Type: proxyman.AllocationStrategy_Random,
+							Concurrency: &proxyman.AllocationStrategy_AllocationStrategyConcurrency{
+								Value: 2,
+							},
+							Refresh: &proxyman.AllocationStrategy_AllocationStrategyRefresh{
+								Value: 5,
+							},
+						},
+					}),
+					ProxySettings: serial.ToTypedMessage(&inbound.Config{}),
+					Tag:           "detour",
+				},
+			},
+			Outbound: []*core.OutboundHandlerConfig{
+				{
+					ProxySettings: serial.ToTypedMessage(&freedom.Config{}),
+				},
+			},
+		}
+
+		server, _ := InitializeServerConfig(serverConfig)
+		if server != nil && WaitConnAvailableWithTest(t, testTCPConn(serverPort+100, 1024, time.Second*2)) {
+			defer CloseServer(server)
+			break
+		}
+		retry += 1
+		if retry > 5 {
+			t.Fatal("All attempts failed to start server")
+		}
+		serverPort = tcp.PickPort()
+	}
+
+	clientPort := tcp.PickPort()
+	clientConfig := &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&log.Config{
+				ErrorLogLevel: clog.Severity_Debug,
+				ErrorLogType:  log.LogType_Console,
+			}),
+		},
+		Inbound: []*core.InboundHandlerConfig{
+			{
+				ReceiverSettings: serial.ToTypedMessage(&proxyman.ReceiverConfig{
+					PortList: &net.PortList{Range: []*net.PortRange{net.SinglePortRange(clientPort)}},
+					Listen:   net.NewIPOrDomain(net.LocalHostIP),
+				}),
+				ProxySettings: serial.ToTypedMessage(&dokodemo.Config{
+					Address:  net.NewIPOrDomain(dest.Address),
+					Port:     uint32(dest.Port),
+					Networks: []net.Network{net.Network_TCP},
+				}),
+			},
+		},
+		Outbound: []*core.OutboundHandlerConfig{
+			{
+				ProxySettings: serial.ToTypedMessage(&outbound.Config{
+					Receiver: []*protocol.ServerEndpoint{
+						{
+							Address: net.NewIPOrDomain(net.LocalHostIP),
+							Port:    uint32(serverPort),
+							User: []*protocol.User{
+								{
+									Account: serial.ToTypedMessage(&vmess.Account{
+										Id: userID.String(),
+									}),
+								},
+							},
+						},
+					},
+				}),
+			},
+		},
+	}
+
+	server, err := InitializeServerConfig(clientConfig)
+	common.Must(err)
+	defer CloseServer(server)
+
+	if !WaitConnAvailableWithTest(t, testTCPConn(clientPort, 1024, time.Second*2)) {
+		t.Fail()
+	}
+}
+
 func TestVMessGCM(t *testing.T) {
 	tcpServer := tcp.Server{
 		MsgProcessor: xor,
@@ -91,16 +232,20 @@ func TestVMessGCM(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id:               userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -189,16 +334,20 @@ func TestVMessGCMReadv(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id:               userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -290,16 +439,20 @@ func TestVMessGCMUDP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id:               userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -385,16 +538,20 @@ func TestVMessChacha20(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id:               userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_CHACHA20_POLY1305,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_CHACHA20_POLY1305,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -481,16 +638,20 @@ func TestVMessNone(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_NONE,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_NONE,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -579,16 +740,20 @@ func TestVMessKCP(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User: &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -701,16 +866,20 @@ func TestVMessKCPLarge(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -830,16 +999,20 @@ func TestVMessGCMMux(t *testing.T) {
 					},
 				}),
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -953,16 +1126,20 @@ func TestVMessGCMMuxUDP(t *testing.T) {
 					},
 				}),
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -1056,16 +1233,20 @@ func TestVMessZero(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_ZERO,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_ZERO,
+										},
+									}),
 								},
-							}),
+							},
 						},
 					},
 				}),
@@ -1151,17 +1332,21 @@ func TestVMessGCMLengthAuth(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+										TestsEnabled: "AuthenticatedLength",
+									}),
 								},
-								TestsEnabled: "AuthenticatedLength",
+							},
-							}),
 						},
 					},
 				}),
@@ -1251,17 +1436,21 @@ func TestVMessGCMLengthAuthPlusNoTerminationSignal(t *testing.T) {
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&outbound.Config{
-					Receiver: &protocol.ServerEndpoint{
+					Receiver: []*protocol.ServerEndpoint{
-						Address: net.NewIPOrDomain(net.LocalHostIP),
+						{
-						Port:    uint32(serverPort),
+							Address: net.NewIPOrDomain(net.LocalHostIP),
-						User:    &protocol.User{
+							Port:    uint32(serverPort),
-							Account: serial.ToTypedMessage(&vmess.Account{
+							User: []*protocol.User{
-								Id: userID.String(),
+								{
-								SecuritySettings: &protocol.SecurityConfig{
+									Account: serial.ToTypedMessage(&vmess.Account{
-									Type: protocol.SecurityType_AES128_GCM,
+										Id: userID.String(),
+										SecuritySettings: &protocol.SecurityConfig{
+											Type: protocol.SecurityType_AES128_GCM,
+										},
+										TestsEnabled: "AuthenticatedLength|NoTerminationSignal",
+									}),
 								},
-								TestsEnabled: "AuthenticatedLength|NoTerminationSignal",
+							},
-							}),
 						},
 					},
 				}),

transport/internet/kcp/cryptreal.go

@@ -9,5 +9,5 @@ import (
 
 func NewAEADAESGCMBasedOnSeed(seed string) cipher.AEAD {
 	hashedSeed := sha256.Sum256([]byte(seed))
-	return crypto.NewAesGcm(hashedSeed[:16])
+	return crypto.NewAesGcm(hashedSeed[:])
 }