Fix potential panic

.github/docker/Dockerfile

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/docker/Dockerfile.usa

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/workflows/docker.yml

@@ -64,14 +64,6 @@ jobs:
           echo "Latest: '$LATEST'."
           echo "LATEST=$LATEST" >>${GITHUB_ENV}
 
-          NEWEST=false
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            NEWEST=true
-          fi
-
-          echo "Newest: '$NEWEST'."
-          echo "NEWEST=$NEWEST" >>${GITHUB_ENV}
-
       - name: Checkout code
         uses: actions/checkout@v7
 
@@ -82,7 +74,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -132,13 +124,6 @@ jobs:
             ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
           fi
 
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            echo "Adding 'pre-release' tag to manifest: '${{ env.FULL_IMAGE_NAME }}:pre-release'."
-            docker buildx imagetools create \
-            --tag ${{ env.FULL_IMAGE_NAME }}:pre-release \
-            ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-          fi
-
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
@@ -146,7 +131,3 @@ jobs:
           if [[ "${{ env.LATEST }}" == "true" ]]; then
             docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:latest
           fi
-
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:pre-release
-          fi

.github/workflows/release-win7.yml

@@ -92,7 +92,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/release.yml

@@ -193,7 +193,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/test.yml

@@ -61,13 +61,15 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
           cache: false
       - name: Check Format
-        run: go run ./infra/vformat/main.go -mode check -pwd ./
+        run: |
+          go install -v mvdan.cc/gofumpt@latest
+          go run ./infra/vformat/main.go -mode check -pwd ./
 
   test:
     needs: check-assets
@@ -83,7 +85,7 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

app/dispatcher/default.go

@@ -162,7 +162,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		p := d.policy.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				inboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  inboundLink.Writer,
@@ -171,7 +171,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				outboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  outboundLink.Writer,
@@ -200,13 +200,13 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 		p := policyManager.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Reader.(*buf.TimeoutWrapperReader).Counter = c
 			}
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  link.Writer,
@@ -223,7 +223,7 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 
 func trackOnlineIP(ctx context.Context, sm stats.Manager, email, ip string) {
 	name := "user>>>" + email + ">>>online"
-	if om, _ := sm.GetOrRegisterOnlineMap(name); om != nil {
+	if om, _ := stats.GetOrRegisterOnlineMap(sm, name); om != nil {
 		om.AddIP(ip)
 		context.AfterFunc(ctx, func() { om.RemoveIP(ip) })
 	}
@@ -470,9 +470,6 @@ func (d *DefaultDispatcher) routedDispatch(ctx context.Context, link *transport.
 				return // DO NOT CHANGE: the traffic shouldn't be processed by default outbound if the specified outbound tag doesn't exist (yet), e.g., VLESS Reverse Proxy
 			}
 		} else {
-			if err != common.ErrNoClue {
-				errors.LogErrorInner(ctx, err, "failed to pick route for ", destination)
-			}
 			errors.LogInfo(ctx, "default route for ", destination)
 		}
 	}

app/dns/config.pb.go

@@ -93,7 +93,6 @@ type NameServer struct {
 	UnexpectedIp    []*geodata.IPRule      `protobuf:"bytes,13,rep,name=unexpected_ip,json=unexpectedIp,proto3" json:"unexpected_ip,omitempty"`
 	ActUnprior      bool                   `protobuf:"varint,14,opt,name=actUnprior,proto3" json:"actUnprior,omitempty"`
 	PolicyID        uint32                 `protobuf:"varint,17,opt,name=policyID,proto3" json:"policyID,omitempty"`
-	Id              string                 `protobuf:"bytes,18,opt,name=id,proto3" json:"id,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
 }
@@ -240,13 +239,6 @@ func (x *NameServer) GetPolicyID() uint32 {
 	return 0
 }
 
-func (x *NameServer) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
 type Config struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// NameServer list used by this DNS client.
@@ -266,10 +258,8 @@ type Config struct {
 	DisableFallback        bool          `protobuf:"varint,10,opt,name=disableFallback,proto3" json:"disableFallback,omitempty"`
 	DisableFallbackIfMatch bool          `protobuf:"varint,11,opt,name=disableFallbackIfMatch,proto3" json:"disableFallbackIfMatch,omitempty"`
 	EnableParallelQuery    bool          `protobuf:"varint,14,opt,name=enableParallelQuery,proto3" json:"enableParallelQuery,omitempty"`
-	// Absolute path to the Lua DNS query script.
-	Script        string `protobuf:"bytes,15,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {
@@ -379,13 +369,6 @@ func (x *Config) GetEnableParallelQuery() bool {
 	return false
 }
 
-func (x *Config) GetScript() string {
-	if x != nil {
-		return x.Script
-	}
-	return ""
-}
-
 type Config_HostMapping struct {
 	state  protoimpl.MessageState `protogen:"open.v1"`
 	Domain *geodata.DomainRule    `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
@@ -452,7 +435,7 @@ var File_app_dns_config_proto protoreflect.FileDescriptor
 
 const file_app_dns_config_proto_rawDesc = "" +
 	"\n" +
-	"\x14app/dns/config.proto\x12\fxray.app.dns\x1a\x1ccommon/net/destination.proto\x1a\x1bcommon/geodata/geodat.proto\"\xee\x05\n" +
+	"\x14app/dns/config.proto\x12\fxray.app.dns\x1a\x1ccommon/net/destination.proto\x1a\x1bcommon/geodata/geodat.proto\"\xde\x05\n" +
 	"\n" +
 	"NameServer\x123\n" +
 	"\aaddress\x18\x01 \x01(\v2\x19.xray.common.net.EndpointR\aaddress\x12\x1b\n" +
@@ -478,11 +461,10 @@ const file_app_dns_config_proto_rawDesc = "" +
 	"\n" +
 	"actUnprior\x18\x0e \x01(\bR\n" +
 	"actUnprior\x12\x1a\n" +
-	"\bpolicyID\x18\x11 \x01(\rR\bpolicyID\x12\x0e\n" +
-	"\x02id\x18\x12 \x01(\tR\x02idB\x0f\n" +
+	"\bpolicyID\x18\x11 \x01(\rR\bpolicyIDB\x0f\n" +
 	"\r_disableCacheB\r\n" +
 	"\v_serveStaleB\x12\n" +
-	"\x10_serveExpiredTTLJ\x04\b\x04\x10\x05\"\x9a\x05\n" +
+	"\x10_serveExpiredTTLJ\x04\b\x04\x10\x05\"\x82\x05\n" +
 	"\x06Config\x129\n" +
 	"\vname_server\x18\x05 \x03(\v2\x18.xray.app.dns.NameServerR\n" +
 	"nameServer\x12\x1b\n" +
@@ -498,8 +480,7 @@ const file_app_dns_config_proto_rawDesc = "" +
 	"\x0fdisableFallback\x18\n" +
 	" \x01(\bR\x0fdisableFallback\x126\n" +
 	"\x16disableFallbackIfMatch\x18\v \x01(\bR\x16disableFallbackIfMatch\x120\n" +
-	"\x13enableParallelQuery\x18\x0e \x01(\bR\x13enableParallelQuery\x12\x16\n" +
-	"\x06script\x18\x0f \x01(\tR\x06script\x1a}\n" +
+	"\x13enableParallelQuery\x18\x0e \x01(\bR\x13enableParallelQuery\x1a}\n" +
 	"\vHostMapping\x127\n" +
 	"\x06domain\x18\x02 \x01(\v2\x1f.xray.common.geodata.DomainRuleR\x06domain\x12\x0e\n" +
 	"\x02ip\x18\x03 \x03(\fR\x02ip\x12%\n" +

app/dns/config.proto

@@ -27,7 +27,6 @@ message NameServer {
   repeated xray.common.geodata.IPRule unexpected_ip = 13;
   bool actUnprior = 14;
   uint32 policyID = 17;
-  string id = 18;
 }
 
 enum QueryStrategy {
@@ -74,7 +73,4 @@ message Config {
   bool disableFallbackIfMatch = 11;
 
   bool enableParallelQuery = 14;
-
-  // Absolute path to the Lua DNS query script.
-  string script = 15;
 }

app/dns/dns.go

@@ -31,8 +31,6 @@ type DNS struct {
 	domainMatcher          geodata.DomainMatcher
 	matcherInfos           []*DomainMatcherInfo
 	checkSystem            bool
-	script                 *scriptEngine
-	scriptPath             string
 }
 
 // DomainMatcherInfo contains information attached to index returned by Server.domainMatcher.
@@ -182,7 +180,6 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		disableFallbackIfMatch: config.DisableFallbackIfMatch,
 		enableParallelQuery:    config.EnableParallelQuery,
 		checkSystem:            checkSystem,
-		scriptPath:             config.Script,
 	}, nil
 }
 
@@ -193,21 +190,11 @@ func (*DNS) Type() interface{} {
 
 // Start implements common.Runnable.
 func (s *DNS) Start() error {
-	if s.scriptPath != "" {
-		engine, err := newScriptEngine(s.scriptPath, s)
-		if err != nil {
-			return errors.New("failed to initialize DNS script").Base(err)
-		}
-		s.script = engine
-	}
 	return nil
 }
 
 // Close implements common.Closable.
 func (s *DNS) Close() error {
-	if s.script != nil {
-		s.script.close()
-	}
 	return nil
 }
 
@@ -270,9 +257,6 @@ func (s *DNS) LookupIP(domain string, option dns.IPOption) ([]net.IP, uint32, er
 	}
 
 	// Name servers lookup
-	if s.script != nil {
-		return s.script.query(domain, option)
-	}
 	if s.enableParallelQuery {
 		return s.parallelQuery(domain, option)
 	} else {

app/dns/lua.go

@@ -1,201 +0,0 @@
-package dns
-
-import (
-	"context"
-	"math"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
-	featureDNS "github.com/xtls/xray-core/features/dns"
-	"github.com/xtls/xray-core/features/dns/localdns"
-	lua "github.com/yuin/gopher-lua"
-)
-
-// luaDNSServer adapts configured and local DNS to the same Lua API.
-type luaDNSServer struct {
-	id    string
-	name  string
-	query func(context.Context, string, featureDNS.IPOption) ([]net.IP, uint32, error)
-}
-
-// RegisterLua makes xray.dns available to scripts backed by client.
-func RegisterLua(L *lua.LState, client featureDNS.Client) {
-	var servers []luaDNSServer
-	switch client := client.(type) {
-	case *DNS:
-		servers = luaServers(client)
-	case *localdns.Client:
-		servers = []luaDNSServer{{
-			id:   "localhost",
-			name: "localhost",
-			query: func(_ context.Context, domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-				return client.LookupIP(domain, option)
-			},
-		}}
-	}
-	registerLua(L, servers, client)
-}
-
-// RegisterLua makes xray.dns available to DNS scripts.
-func (s *DNS) RegisterLua(L *lua.LState) {
-	registerLua(L, luaServers(s), nil)
-}
-
-func luaServers(s *DNS) []luaDNSServer {
-	servers := make([]luaDNSServer, len(s.clients))
-	for i, client := range s.clients {
-		servers[i] = luaDNSServer{id: client.id, name: client.Name(), query: client.QueryIP}
-	}
-	return servers
-}
-
-func registerLua(L *lua.LState, servers []luaDNSServer, client featureDNS.Client) {
-	L.PreloadModule("xray.dns", func(L *lua.LState) int {
-		serverList := L.NewTable()
-		for i, client := range servers {
-			server := L.NewTable()
-
-			server.RawSetString("ID", lua.LString(client.id))
-
-			server.RawSetString("Query", L.NewFunction(func(L *lua.LState) int {
-				domain, ok := L.Get(2).(lua.LString)
-				if !ok {
-					L.RaiseError("server:Query requires a domain")
-					return 0
-				}
-				option := featureDNS.IPOption{
-					IPv4Enable: L.CheckBool(3),
-					IPv6Enable: L.CheckBool(4),
-					FakeEnable: L.CheckBool(5),
-				}
-				ctx := L.Context()
-				if ctx == nil {
-					L.RaiseError("server:Query requires an active DNS query")
-					return 0
-				}
-				var ips []net.IP
-				var ttl uint32
-				var err error
-				if !option.FakeEnable && strings.EqualFold(client.name, "FakeDNS") {
-					err = featureDNS.ErrEmptyResponse
-				} else {
-					ips, ttl, err = client.query(ctx, string(domain), option)
-				}
-				addresses := L.NewUserData()
-				addresses.Value = ips
-				L.Push(addresses)
-				L.Push(lua.LNumber(ttl))
-				if err != nil {
-					ud := L.NewUserData()
-					ud.Value = err
-					L.Push(ud)
-				} else {
-					L.Push(lua.LNil)
-				}
-				return 3
-			}))
-			serverList.RawSetInt(i+1, server)
-		}
-
-		module := L.NewTable()
-		if servers != nil {
-			module.RawSetString("Servers", serverList)
-		}
-		if client != nil {
-			module.RawSetString("Query", newLuaClientQuery(L, client))
-		}
-		L.Push(module)
-		return 1
-	})
-}
-
-func newLuaClientQuery(L *lua.LState, client featureDNS.Client) *lua.LFunction {
-	return L.NewFunction(func(L *lua.LState) int {
-		domain, ok := L.Get(1).(lua.LString)
-		if !ok {
-			L.RaiseError("dns.Query requires a domain")
-			return 0
-		}
-		option := featureDNS.IPOption{
-			IPv4Enable: L.CheckBool(2),
-			IPv6Enable: L.CheckBool(3),
-			FakeEnable: L.CheckBool(4),
-		}
-		if L.Context() == nil {
-			L.RaiseError("dns.Query requires an active DNS query")
-			return 0
-		}
-		ips, ttl, err := client.LookupIP(string(domain), option)
-		addresses := L.NewUserData()
-		addresses.Value = ips
-		L.Push(addresses)
-		L.Push(lua.LNumber(ttl))
-		if err != nil {
-			ud := L.NewUserData()
-			ud.Value = err
-			L.Push(ud)
-		} else {
-			L.Push(lua.LNil)
-		}
-		return 3
-	})
-}
-
-// CallLuaHook invokes HandleDNSQuery in the supplied state.
-// Returned slices and IP bytes may share storage with DNS caches or matcher inputs.
-func (s *DNS) CallLuaHook(L *lua.LState, ctx context.Context, domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-	previous, top := L.Context(), L.GetTop()
-	L.SetContext(ctx)
-	defer func() {
-		L.SetTop(top)
-		if previous == nil {
-			L.RemoveContext()
-		} else {
-			L.SetContext(previous)
-		}
-	}()
-	fn := L.GetGlobal("HandleDNSQuery")
-	if fn.Type() != lua.LTFunction {
-		return nil, 0, errors.New("DNS script must define HandleDNSQuery(domain, ipv4, ipv6, fake)")
-	}
-	if err := L.CallByParam(lua.P{Fn: fn, NRet: 3, Protect: true},
-		lua.LString(strings.ToLower(domain)), lua.LBool(option.IPv4Enable),
-		lua.LBool(option.IPv6Enable), lua.LBool(option.FakeEnable)); err != nil {
-		return nil, 0, err
-	}
-	return readLuaDNSResult(L.Get(-3), L.Get(-2), L.Get(-1))
-}
-
-func readLuaDNSResult(addresses, ttlValue, errorValue lua.LValue) ([]net.IP, uint32, error) {
-	if errorValue != lua.LNil {
-		if ud, ok := errorValue.(*lua.LUserData); ok {
-			if err, ok := ud.Value.(error); ok {
-				return nil, 0, err
-			}
-		}
-		if s, ok := errorValue.(lua.LString); ok {
-			return nil, 0, errors.New(string(s))
-		}
-		return nil, 0, errors.New("DNS script error must be an error or string")
-	}
-	ttl, ok := ttlValue.(lua.LNumber)
-	if !ok || ttl < 0 || ttl > math.MaxUint32 || math.Trunc(float64(ttl)) != float64(ttl) {
-		return nil, 0, errors.New("DNS script returned invalid TTL")
-	}
-	if addresses == lua.LNil {
-		return nil, 0, featureDNS.ErrEmptyResponse
-	}
-	ud, ok := addresses.(*lua.LUserData)
-	if !ok {
-		return nil, 0, errors.New("DNS script IPs must be native IP slice userdata")
-	}
-	ips, ok := ud.Value.([]net.IP)
-	if !ok {
-		return nil, 0, errors.New("DNS script IPs must be native IP slice userdata")
-	}
-	if len(ips) == 0 {
-		return nil, 0, featureDNS.ErrEmptyResponse
-	}
-	return ips, uint32(ttl), nil
-}

app/dns/lua_test.go

@@ -1,296 +0,0 @@
-package dns
-
-import (
-	"context"
-	go_errors "errors"
-	"math"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/net"
-	featureDNS "github.com/xtls/xray-core/features/dns"
-	"github.com/xtls/xray-core/features/dns/localdns"
-	lua "github.com/yuin/gopher-lua"
-)
-
-func TestReadLuaDNSResult(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	want := []net.IP{net.ParseIP("8.8.8.8"), {127, 0, 0, 1}, net.ParseIP("::1")}
-	addresses := L.NewUserData()
-	addresses.Value = want
-	ips, ttl, err := readLuaDNSResult(addresses, lua.LNumber(45), lua.LNil)
-	if err != nil || ttl != 45 || len(ips) != len(want) {
-		t.Fatalf("readLuaDNSResult() = %v, TTL %d, %v", ips, ttl, err)
-	}
-	for i := range want {
-		if !ips[i].Equal(want[i]) {
-			t.Fatalf("IP %d = %v, want %v", i, ips[i], want[i])
-		}
-	}
-}
-
-func TestReadLuaDNSResultValidation(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-
-	for _, tc := range []struct {
-		name   string
-		change func(*[3]lua.LValue)
-		want   string
-	}{
-		{"fractional TTL", func(v *[3]lua.LValue) { v[1] = lua.LNumber(1.5) }, "invalid TTL"},
-		{"oversized TTL", func(v *[3]lua.LValue) { v[1] = lua.LNumber(4294967296) }, "invalid TTL"},
-		{"negative TTL", func(v *[3]lua.LValue) { v[1] = lua.LNumber(-1) }, "invalid TTL"},
-		{"NaN TTL", func(v *[3]lua.LValue) { v[1] = lua.LNumber(math.NaN()) }, "invalid TTL"},
-		{"missing TTL", func(v *[3]lua.LValue) { v[1] = lua.LNil }, "invalid TTL"},
-		{"string IPs", func(v *[3]lua.LValue) { v[0] = lua.LString("127.0.0.1") }, "native IP slice"},
-		{"wrong userdata", func(v *[3]lua.LValue) { v[0].(*lua.LUserData).Value = net.ParseIP("127.0.0.1") }, "native IP slice"},
-		{"script error", func(v *[3]lua.LValue) { v[2] = lua.LString("blocked by script") }, "blocked by script"},
-		{"invalid error", func(v *[3]lua.LValue) { v[2] = lua.LTrue }, "error or string"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			addresses := L.NewUserData()
-			addresses.Value = []net.IP{net.ParseIP("127.0.0.1")}
-			values := [3]lua.LValue{addresses, lua.LNumber(60), lua.LNil}
-			tc.change(&values)
-			_, _, err := readLuaDNSResult(values[0], values[1], values[2])
-			if err == nil || !strings.Contains(err.Error(), tc.want) {
-				t.Fatalf("readLuaDNSResult error = %v, want %q", err, tc.want)
-			}
-		})
-	}
-
-	addresses := L.NewUserData()
-	addresses.Value = []net.IP(nil)
-	for _, empty := range []lua.LValue{addresses, lua.LNil} {
-		if _, _, err := readLuaDNSResult(empty, lua.LNumber(0), lua.LNil); !go_errors.Is(err, featureDNS.ErrEmptyResponse) {
-			t.Fatalf("empty result error = %v, want ErrEmptyResponse", err)
-		}
-	}
-	wantErr := go_errors.New("upstream failed")
-	errorValue := L.NewUserData()
-	errorValue.Value = wantErr
-	if _, _, err := readLuaDNSResult(lua.LNil, lua.LNil, errorValue); err != wantErr {
-		t.Fatalf("upstream error = %v, want original error %v", err, wantErr)
-	}
-}
-
-func TestCallLuaHookCancellation(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	if err := L.DoString(`function HandleDNSQuery(domain, ipv4, ipv6, fake) while true do end end`); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	defer cancel()
-	_, _, err := (&DNS{}).CallLuaHook(L, ctx, "example.com", featureDNS.IPOption{IPv4Enable: true})
-	if err == nil {
-		t.Fatal("CallLuaHook did not stop after context cancellation")
-	}
-	if L.Context() != nil {
-		t.Fatal("CallLuaHook left the canceled context on the Lua state")
-	}
-}
-
-func TestCallLuaHookNormalizesDomain(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	addresses := L.NewUserData()
-	addresses.Value = []net.IP{net.ParseIP("127.0.0.1")}
-	L.SetGlobal("ips", addresses)
-	if err := L.DoString(`
-		function HandleDNSQuery(domain, ipv4, ipv6, fake)
-			assert(domain == "example.com")
-			assert(ipv4 and not ipv6 and not fake)
-			return ips, 60, nil
-		end
-	`); err != nil {
-		t.Fatal(err)
-	}
-	s := &DNS{}
-	if _, _, err := s.CallLuaHook(L, context.Background(), "ExAmPlE.CoM", featureDNS.IPOption{IPv4Enable: true}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestCallLuaHookRestoresState(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		body    string
-		wantErr bool
-	}{
-		{"success", `return ips, 60`, false},
-		{"error", `error("failed")`, true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			L := lua.NewState()
-			defer L.Close()
-			addresses := L.NewUserData()
-			addresses.Value = []net.IP{net.ParseIP("127.0.0.1")}
-			L.SetGlobal("ips", addresses)
-			if err := L.DoString("function HandleDNSQuery() " + tc.body + " end"); err != nil {
-				t.Fatal(err)
-			}
-			previous, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			L.SetContext(previous)
-			L.Push(lua.LTrue)
-			_, _, err := (&DNS{}).CallLuaHook(L, context.Background(), "example.com", featureDNS.IPOption{IPv4Enable: true})
-			if (err != nil) != tc.wantErr {
-				t.Fatalf("hook error = %v, want error %t", err, tc.wantErr)
-			}
-			if L.Context() != previous || L.GetTop() != 1 || L.Get(1) != lua.LTrue {
-				t.Fatal("hook did not restore the previous context and stack")
-			}
-		})
-	}
-}
-
-func TestLuaDNSServerQuery(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	geodata.RegisterLua(L)
-	option := featureDNS.IPOption{IPv4Enable: true}
-	ips := []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("8.8.8.8")}
-	server := &DNS{clients: []*Client{{server: &benchmarkLuaNameServer{ips: ips}, ipOption: &option, timeoutMs: time.Second}}}
-	server.RegisterLua(L)
-	if err := L.DoString(`
-local server = require("xray.dns").Servers[1]
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.0/8")
-function HandleDNSQuery(domain, ipv4, ipv6, fake)
-    local ips, ttl, err = server:Query(domain, ipv4, ipv6, fake)
-    assert(type(ips) == "userdata" and not err)
-    assert(matcher:AnyMatch(ips))
-    local matched = matcher:FilterIPs(ips)
-    return matched, ttl, err
-end
-`); err != nil {
-		t.Fatal(err)
-	}
-	got, ttl, err := server.CallLuaHook(L, context.Background(), "example.com", option)
-	if err != nil || ttl != 60 || len(got) != 1 || !got[0].Equal(ips[0]) {
-		t.Fatalf("server query = %v, TTL %d, %v", got, ttl, err)
-	}
-}
-
-type luaDNSClient struct {
-	featureDNS.Client
-	lookup func(string, featureDNS.IPOption) ([]net.IP, uint32, error)
-}
-
-func (c *luaDNSClient) LookupIP(domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-	return c.lookup(domain, option)
-}
-
-func TestLuaDNSClientQuery(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	L.SetContext(context.Background())
-	defer L.RemoveContext()
-	geodata.RegisterLua(L)
-	want := []net.IP{{127, 0, 0, 1}}
-	client := &luaDNSClient{lookup: func(domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-		if domain != "MiXeD.Example." || !option.IPv4Enable || option.IPv6Enable || !option.FakeEnable {
-			t.Fatalf("dns.Query arguments = %q, %+v", domain, option)
-		}
-		return want, 42, nil
-	}}
-	RegisterLua(L, client)
-	if err := L.DoString(`
-local dns = require("xray.dns")
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.1")
-assert(dns.Servers == nil)
-ips, ttl, err = dns.Query("MiXeD.Example.", true, false, true)
-assert(not err and ttl == 42 and matcher:AnyMatch(ips))
-`); err != nil {
-		t.Fatal(err)
-	}
-	got := L.GetGlobal("ips").(*lua.LUserData).Value.([]net.IP)
-	if &got[0] != &want[0] {
-		t.Fatal("dns.Query copied the IP slice")
-	}
-}
-
-func TestLuaDNSLocalClient(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	L.SetContext(context.Background())
-	defer L.RemoveContext()
-	RegisterLua(L, localdns.New())
-	if err := L.DoString(`
-local dns = require("xray.dns")
-assert(dns.Servers[1].ID == "localhost")
-serverIPs, _, serverErr = dns.Servers[1]:Query("127.0.0.1", true, false, false)
-clientIPs, _, clientErr = dns.Query("127.0.0.1", true, false, false)
-assert(not serverErr and not clientErr)
-`); err != nil {
-		t.Fatal(err)
-	}
-	for _, name := range []string{"serverIPs", "clientIPs"} {
-		ips := L.GetGlobal(name).(*lua.LUserData).Value.([]net.IP)
-		if len(ips) != 1 || !ips[0].Equal(net.ParseIP("127.0.0.1")) {
-			t.Fatalf("%s = %v", name, ips)
-		}
-	}
-}
-
-type benchmarkLuaNameServer struct {
-	ips []net.IP
-}
-
-func (*benchmarkLuaNameServer) Name() string         { return "benchmark" }
-func (*benchmarkLuaNameServer) IsDisableCache() bool { return true }
-func (s *benchmarkLuaNameServer) QueryIP(context.Context, string, featureDNS.IPOption) ([]net.IP, uint32, error) {
-	return s.ips, 60, nil
-}
-
-// BenchmarkLuaDNSHookCall isolates a preloaded Lua hook and its server:Query bridge.
-// The direct case measures the same DNS client without Lua.
-func BenchmarkLuaDNSHookCall(b *testing.B) {
-	option := featureDNS.IPOption{IPv4Enable: true}
-	ip := net.ParseIP("127.0.0.1")
-	upstream := &benchmarkLuaNameServer{ips: []net.IP{ip}}
-	client := &Client{server: upstream, ipOption: &option, timeoutMs: time.Second}
-	server := &DNS{clients: []*Client{client}}
-	L := lua.NewState()
-	defer L.Close()
-	server.RegisterLua(L)
-	if err := L.DoString(`
-local server = require("xray.dns").Servers[1]
-function HandleDNSQuery(domain, ipv4, ipv6, fake)
-    return server:Query(domain, ipv4, ipv6, fake)
-end
-`); err != nil {
-		b.Fatal(err)
-	}
-
-	ctx := context.Background()
-	for _, bench := range []struct {
-		name  string
-		query func() ([]net.IP, uint32, error)
-	}{
-		{"direct", func() ([]net.IP, uint32, error) { return client.QueryIP(ctx, "example.com", option) }},
-		{"lua_hook", func() ([]net.IP, uint32, error) { return server.CallLuaHook(L, ctx, "example.com", option) }},
-	} {
-		b.Run(bench.name, func(b *testing.B) {
-			b.ReportAllocs()
-			b.ResetTimer()
-			var ips []net.IP
-			var ttl uint32
-			var err error
-			for i := 0; i < b.N; i++ {
-				ips, ttl, err = bench.query()
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-			b.StopTimer()
-			if ttl != 60 || len(ips) != 1 || !ips[0].Equal(ip) {
-				b.Fatalf("query() = %v, TTL %d; want %v, TTL 60", ips, ttl, ip)
-			}
-		})
-	}
-}

app/dns/nameserver.go

@@ -29,7 +29,6 @@ type Server interface {
 
 // Client is the interface for DNS client.
 type Client struct {
-	id            string
 	server        Server
 	skipFallback  bool
 	expectedIPs   geodata.IPMatcher
@@ -98,7 +97,7 @@ func NewClient(
 	ipOption dns.IPOption,
 	updateRules func(bool),
 ) (*Client, error) {
-	client := &Client{id: ns.Id}
+	client := &Client{}
 	err := core.RequireFeatures(ctx, func(dispatcher routing.Dispatcher) error {
 		// Create a new server for each client for now
 		server, err := NewServer(ctx, ns.Address.AsDestination(), dispatcher, disableCache, serveStale, serveExpiredTTL, clientIP)

app/dns/nameserver_local.go

@@ -49,5 +49,5 @@ func NewLocalNameServer() *LocalNameServer {
 
 // NewLocalDNSClient creates localdns client object for directly lookup in system DNS.
 func NewLocalDNSClient(ipOption dns.IPOption) *Client {
-	return &Client{id: "localhost", server: NewLocalNameServer(), ipOption: &ipOption}
+	return &Client{server: NewLocalNameServer(), ipOption: &ipOption}
 }

app/dns/script.go

@@ -1,73 +0,0 @@
-package dns
-
-import (
-	"context"
-	"time"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/log"
-	luamgr "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/features/dns"
-	lua "github.com/yuin/gopher-lua"
-)
-
-const scriptExecutionTimeout = 10 * time.Second
-
-type scriptEngine struct {
-	dns  *DNS
-	pool *luamgr.Pool
-}
-
-func newScriptEngine(path string, server *DNS) (*scriptEngine, error) {
-	program, err := luamgr.CompileFile(path)
-	if err != nil {
-		return nil, err
-	}
-	e := &scriptEngine{dns: server}
-	e.pool, err = luamgr.NewPool(server.ctx, func(poolCtx context.Context) (*lua.LState, error) {
-		initCtx, cancel := context.WithTimeout(poolCtx, scriptExecutionTimeout)
-		defer cancel()
-		L, err := program.NewState(initCtx, func(L *lua.LState) {
-			geodata.RegisterLua(L)
-			log.RegisterLua(L)
-			server.RegisterLua(L)
-		})
-		if err != nil {
-			return nil, err
-		}
-		if L.GetGlobal("HandleDNSQuery").Type() != lua.LTFunction {
-			L.Close()
-			return nil, errors.New("DNS script must define HandleDNSQuery(domain, ipv4, ipv6, fake)")
-		}
-		return L, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	errors.LogInfo(server.ctx, "DNS script initialized from ", path)
-	return e, nil
-}
-
-func (e *scriptEngine) close() {
-	e.pool.Close()
-}
-
-func (e *scriptEngine) query(domain string, option dns.IPOption) ([]net.IP, uint32, error) {
-	L, err := e.pool.Acquire()
-	if err != nil {
-		return nil, 0, err
-	}
-	reusable := false
-	defer func() {
-		e.pool.Release(L, reusable)
-	}()
-	queryCtx, cancel := context.WithTimeout(e.pool.Context(), scriptExecutionTimeout)
-	defer cancel()
-	ips, ttl, err := e.dns.CallLuaHook(L, queryCtx, domain, option)
-	if err == nil {
-		reusable = true
-	}
-	return ips, ttl, err
-}

app/dns/script_test.go

@@ -1,197 +0,0 @@
-package dns
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/xtls/xray-core/common/net"
-	featureDNS "github.com/xtls/xray-core/features/dns"
-)
-
-type geoIPScriptNameServer struct {
-	name    string
-	answers map[string]net.IP
-	ttl     uint32
-	calls   int
-}
-
-func (s *geoIPScriptNameServer) Name() string         { return s.name }
-func (s *geoIPScriptNameServer) IsDisableCache() bool { return true }
-
-func (s *geoIPScriptNameServer) QueryIP(ctx context.Context, domain string, _ featureDNS.IPOption) ([]net.IP, uint32, error) {
-	if err := ctx.Err(); err != nil {
-		return nil, 0, err
-	}
-	s.calls++
-	ip, ok := s.answers[domain]
-	if !ok {
-		return nil, 0, featureDNS.ErrEmptyResponse
-	}
-	return []net.IP{ip}, s.ttl, nil
-}
-
-func TestDNSScriptGeoIPFallback(t *testing.T) {
-	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
-	script := `
-local servers = require("xray.dns").Servers
-local us_ips = require("xray.geodata").BuildIPMatcher("geoip:us")
-
-local by_id = {}
-for _, server in ipairs(servers) do
-    by_id[server.ID] = server
-end
-assert(by_id.primary and by_id.fallback, "primary and fallback DNS servers are required")
-
-function HandleDNSQuery(domain, ipv4, ipv6, fake)
-    local ips, ttl, err = by_id.primary:Query(domain, ipv4, ipv6, fake)
-    if not err and us_ips:AnyMatch(ips) then
-        return ips, ttl, nil
-    end
-    return by_id.fallback:Query(domain, ipv4, ipv6, fake)
-end
-`
-	scriptPath := filepath.Join(t.TempDir(), "geoip_fallback.lua")
-	if err := os.WriteFile(scriptPath, []byte(script), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	primary := &geoIPScriptNameServer{
-		name: "primary",
-		answers: map[string]net.IP{
-			"us.example":    net.ParseIP("2001:4860:4860::8888"),
-			"other.example": net.ParseIP("127.0.0.1"),
-		},
-		ttl: 30,
-	}
-	fallback := &geoIPScriptNameServer{
-		name:    "fallback",
-		answers: map[string]net.IP{"other.example": net.ParseIP("9.9.9.9")},
-		ttl:     60,
-	}
-	option := featureDNS.IPOption{IPv4Enable: true, IPv6Enable: true}
-	hosts, err := NewStaticHosts(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	server := &DNS{
-		ctx:        context.Background(),
-		hosts:      hosts,
-		ipOption:   &option,
-		scriptPath: scriptPath,
-		clients: []*Client{
-			{id: "primary", server: primary, ipOption: &option, timeoutMs: 2 * time.Second},
-			{id: "fallback", server: fallback, ipOption: &option, timeoutMs: 2 * time.Second},
-		},
-	}
-	if err := server.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer server.Close()
-
-	for _, tc := range []struct {
-		domain string
-		ip     net.IP
-		ttl    uint32
-	}{
-		{"Us.Example.", net.ParseIP("2001:4860:4860::8888"), 30},
-		{"other.example", net.ParseIP("9.9.9.9"), 60},
-	} {
-		ips, ttl, err := server.LookupIP(tc.domain, option)
-		if err != nil {
-			t.Fatalf("LookupIP(%q): %v", tc.domain, err)
-		}
-		if ttl != tc.ttl || len(ips) != 1 || !ips[0].Equal(tc.ip) {
-			t.Fatalf("LookupIP(%q) = %v, TTL %d; want %v, TTL %d", tc.domain, ips, ttl, tc.ip, tc.ttl)
-		}
-	}
-	if primary.calls != 2 || fallback.calls != 1 {
-		t.Fatalf("upstream calls: primary %d, fallback %d; want 2 and 1", primary.calls, fallback.calls)
-	}
-}
-
-func TestDNSScriptRejectsInvalidStartup(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		script string
-	}{
-		{"syntax", "function HandleDNSQuery("},
-		{"missing hook", "value = 1"},
-		{"top-level error", `error("setup failed")`},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "script.lua")
-			if err := os.WriteFile(path, []byte(tc.script), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			server := &DNS{ctx: context.Background(), scriptPath: path}
-			if err := server.Start(); err == nil {
-				t.Fatal("Start accepted an invalid DNS script")
-			}
-			if server.script != nil {
-				t.Fatal("Start retained a script engine after failure")
-			}
-		})
-	}
-}
-
-func TestDNSScriptHookErrorAndFakeDNSOption(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "script.lua")
-	script := `
-local server = require("xray.dns").Servers[1]
-local log = require("xray.log")
-log.Info("DNS script loaded")
-function HandleDNSQuery(domain, ipv4, ipv6, fake)
-    log.Debug("DNS query: ", domain)
-    if domain == "bad.example" then error("script failure") end
-    local ips, ttl, err = server:Query(domain, ipv4, ipv6, fake)
-    if err then log.Error("DNS failed: ", err) end
-    return ips, ttl, err
-end
-`
-	if err := os.WriteFile(path, []byte(script), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	option := featureDNS.IPOption{IPv4Enable: true}
-	hosts, err := NewStaticHosts(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	upstream := &geoIPScriptNameServer{
-		name:    "FakeDNS",
-		answers: map[string]net.IP{"good.example": net.ParseIP("198.18.0.1")},
-		ttl:     30,
-	}
-	server := &DNS{
-		ctx:        context.Background(),
-		hosts:      hosts,
-		ipOption:   &option,
-		scriptPath: path,
-		clients:    []*Client{{id: "fake", server: upstream, ipOption: &option, timeoutMs: time.Second}},
-	}
-	if err := server.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer server.Close()
-
-	if _, _, err := server.LookupIP("bad.example", option); err == nil || !strings.Contains(err.Error(), "script failure") {
-		t.Fatalf("hook failure = %v, want script failure", err)
-	}
-	if _, _, err := server.LookupIP("good.example", option); err != featureDNS.ErrEmptyResponse {
-		t.Fatalf("FakeDNS without FakeEnable = %v, want ErrEmptyResponse", err)
-	}
-	if upstream.calls != 0 {
-		t.Fatalf("FakeDNS was queried without FakeEnable: %d calls", upstream.calls)
-	}
-	withFake := featureDNS.IPOption{IPv4Enable: true, FakeEnable: true}
-	ips, ttl, err := server.LookupIP("good.example", withFake)
-	if err != nil || ttl != 30 || len(ips) != 1 || !ips[0].Equal(net.ParseIP("198.18.0.1")) {
-		t.Fatalf("FakeDNS with FakeEnable = %v, TTL %d, %v", ips, ttl, err)
-	}
-	if upstream.calls != 1 {
-		t.Fatalf("FakeDNS query count = %d, want 1", upstream.calls)
-	}
-}

app/observatory/observer.go

@@ -78,12 +78,6 @@ func (o *Observer) background() {
 			sleepTime = time.Duration(o.config.ProbeInterval)
 		}
 
-		if len(outbounds) == 0 {
-			errors.LogWarning(o.ctx, "no outbound matches subjectSelector ", o.config.SubjectSelector)
-			time.Sleep(sleepTime)
-			continue
-		}
-
 		if !o.config.EnableConcurrency {
 			sort.Strings(outbounds)
 			for _, v := range outbounds {

app/proxyman/config.pb.go

@@ -330,6 +330,7 @@ type SenderConfig struct {
 	// Send traffic through the given IP. Only IP is allowed.
 	Via               *net.IPOrDomain         `protobuf:"bytes,1,opt,name=via,proto3" json:"via,omitempty"`
 	StreamSettings    *internet.StreamConfig  `protobuf:"bytes,2,opt,name=stream_settings,json=streamSettings,proto3" json:"stream_settings,omitempty"`
+	ProxySettings     *internet.ProxyConfig   `protobuf:"bytes,3,opt,name=proxy_settings,json=proxySettings,proto3" json:"proxy_settings,omitempty"`
 	MultiplexSettings *MultiplexingConfig     `protobuf:"bytes,4,opt,name=multiplex_settings,json=multiplexSettings,proto3" json:"multiplex_settings,omitempty"`
 	ViaCidr           string                  `protobuf:"bytes,5,opt,name=via_cidr,json=viaCidr,proto3" json:"via_cidr,omitempty"`
 	TargetStrategy    internet.DomainStrategy `protobuf:"varint,6,opt,name=target_strategy,json=targetStrategy,proto3,enum=xray.transport.internet.DomainStrategy" json:"target_strategy,omitempty"`
@@ -381,6 +382,13 @@ func (x *SenderConfig) GetStreamSettings() *internet.StreamConfig {
 	return nil
 }
 
+func (x *SenderConfig) GetProxySettings() *internet.ProxyConfig {
+	if x != nil {
+		return x.ProxySettings
+	}
+	return nil
+}
+
 func (x *SenderConfig) GetMultiplexSettings() *MultiplexingConfig {
 	if x != nil {
 		return x.MultiplexSettings
@@ -498,13 +506,14 @@ const file_app_proxyman_config_proto_rawDesc = "" +
 	"\x03tag\x18\x01 \x01(\tR\x03tag\x12M\n" +
 	"\x11receiver_settings\x18\x02 \x01(\v2 .xray.common.serial.TypedMessageR\x10receiverSettings\x12G\n" +
 	"\x0eproxy_settings\x18\x03 \x01(\v2 .xray.common.serial.TypedMessageR\rproxySettings\"\x10\n" +
-	"\x0eOutboundConfig\"\xd6\x02\n" +
+	"\x0eOutboundConfig\"\x9d\x03\n" +
 	"\fSenderConfig\x12-\n" +
 	"\x03via\x18\x01 \x01(\v2\x1b.xray.common.net.IPOrDomainR\x03via\x12N\n" +
-	"\x0fstream_settings\x18\x02 \x01(\v2%.xray.transport.internet.StreamConfigR\x0estreamSettings\x12T\n" +
+	"\x0fstream_settings\x18\x02 \x01(\v2%.xray.transport.internet.StreamConfigR\x0estreamSettings\x12K\n" +
+	"\x0eproxy_settings\x18\x03 \x01(\v2$.xray.transport.internet.ProxyConfigR\rproxySettings\x12T\n" +
 	"\x12multiplex_settings\x18\x04 \x01(\v2%.xray.app.proxyman.MultiplexingConfigR\x11multiplexSettings\x12\x19\n" +
 	"\bvia_cidr\x18\x05 \x01(\tR\aviaCidr\x12P\n" +
-	"\x0ftarget_strategy\x18\x06 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0etargetStrategyJ\x04\b\x03\x10\x04\"\xa4\x01\n" +
+	"\x0ftarget_strategy\x18\x06 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0etargetStrategy\"\xa4\x01\n" +
 	"\x12MultiplexingConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12 \n" +
 	"\vconcurrency\x18\x02 \x01(\x05R\vconcurrency\x12(\n" +
@@ -539,7 +548,8 @@ var file_app_proxyman_config_proto_goTypes = []any{
 	(*net.IPOrDomain)(nil),        // 10: xray.common.net.IPOrDomain
 	(*internet.StreamConfig)(nil), // 11: xray.transport.internet.StreamConfig
 	(*serial.TypedMessage)(nil),   // 12: xray.common.serial.TypedMessage
-	(internet.DomainStrategy)(0),  // 13: xray.transport.internet.DomainStrategy
+	(*internet.ProxyConfig)(nil),  // 13: xray.transport.internet.ProxyConfig
+	(internet.DomainStrategy)(0),  // 14: xray.transport.internet.DomainStrategy
 }
 var file_app_proxyman_config_proto_depIdxs = []int32{
 	7,  // 0: xray.app.proxyman.SniffingConfig.domains_excluded:type_name -> xray.common.geodata.DomainRule
@@ -552,13 +562,14 @@ var file_app_proxyman_config_proto_depIdxs = []int32{
 	12, // 7: xray.app.proxyman.InboundHandlerConfig.proxy_settings:type_name -> xray.common.serial.TypedMessage
 	10, // 8: xray.app.proxyman.SenderConfig.via:type_name -> xray.common.net.IPOrDomain
 	11, // 9: xray.app.proxyman.SenderConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
-	6,  // 10: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
-	13, // 11: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	13, // 10: xray.app.proxyman.SenderConfig.proxy_settings:type_name -> xray.transport.internet.ProxyConfig
+	6,  // 11: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
+	14, // 12: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_app_proxyman_config_proto_init() }

app/proxyman/config.proto

@@ -57,7 +57,7 @@ message SenderConfig {
   // Send traffic through the given IP. Only IP is allowed.
   xray.common.net.IPOrDomain via = 1;
   xray.transport.internet.StreamConfig stream_settings = 2;
-  reserved 3;
+  xray.transport.internet.ProxyConfig proxy_settings = 3;
   MultiplexingConfig multiplex_settings = 4;
   string via_cidr = 5;
   xray.transport.internet.DomainStrategy target_strategy = 6;

app/proxyman/inbound/always.go

@@ -26,7 +26,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -34,7 +34,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

app/proxyman/outbound/handler.go

@@ -15,6 +15,7 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/core"
@@ -25,6 +26,8 @@ import (
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
+	"github.com/xtls/xray-core/transport/internet/tls"
+	"github.com/xtls/xray-core/transport/pipe"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -36,7 +39,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -44,7 +47,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}
@@ -60,6 +63,7 @@ type Handler struct {
 	streamSettings  *internet.MemoryStreamConfig
 	proxyConfig     proto.Message
 	proxy           proxy.Outbound
+	outboundManager outbound.Manager
 	mux             *mux.ClientManager
 	xudp            *mux.ClientManager
 	udp443          string
@@ -73,6 +77,7 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou
 	uplinkCounter, downlinkCounter := getStatCounter(v, config.Tag)
 	h := &Handler{
 		tag:             config.Tag,
+		outboundManager: v.GetFeature(outbound.ManagerType()).(outbound.Manager),
 		uplinkCounter:   uplinkCounter,
 		downlinkCounter: downlinkCounter,
 	}
@@ -103,11 +108,9 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou
 
 	ctx = session.ContextWithFullHandler(ctx, h)
 
-	if h.streamSettings != nil {
-		ctx = session.ContextWithStreamSettings(ctx, h.streamSettings)
-	}
+	newCtx := session.ContextWithStreamSettings(ctx, h.streamSettings)
 
-	rawProxyHandler, err := common.CreateObject(ctx, proxyConfig)
+	rawProxyHandler, err := common.CreateObject(newCtx, proxyConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -194,6 +197,7 @@ func (h *Handler) Dispatch(ctx context.Context, link *transport.Link) {
 				common.Interrupt(link.Reader)
 				return
 			}
+
 		} else {
 			unchangedDomain := ob.Target.Address.Domain()
 			ob.Target.Address = net.IPAddress(ips[dice.Roll(len(ips))])
@@ -266,26 +270,66 @@ func (h *Handler) DestIpAddress() net.IP {
 
 // Dial implements internet.Dialer.
 func (h *Handler) Dial(ctx context.Context, dest net.Destination) (stat.Connection, error) {
-	if h.senderSettings != nil && h.senderSettings.Via != nil {
-		outbounds := session.OutboundsFromContext(ctx)
-		ob := outbounds[len(outbounds)-1]
-		h.SetOutboundGateway(ctx, ob)
+	if h.senderSettings != nil {
+
+		if h.senderSettings.ProxySettings.HasTag() {
+
+			tag := h.senderSettings.ProxySettings.Tag
+			handler := h.outboundManager.GetHandler(tag)
+			if handler != nil {
+				errors.LogDebug(ctx, "proxying to ", tag, " for dest ", dest)
+				outbounds := session.OutboundsFromContext(ctx)
+				ctx = session.ContextWithOutbounds(ctx, append(outbounds, &session.Outbound{
+					Target: dest,
+					Tag:    tag,
+				})) // add another outbound in session ctx
+				opts := pipe.OptionsFromContext(ctx)
+				uplinkReader, uplinkWriter := pipe.New(opts...)
+				downlinkReader, downlinkWriter := pipe.New(opts...)
+
+				go handler.Dispatch(ctx, &transport.Link{Reader: uplinkReader, Writer: downlinkWriter})
+				conn := cnc.NewConnection(cnc.ConnectionInputMulti(uplinkWriter), cnc.ConnectionOutputMulti(downlinkReader))
+
+				if config := tls.ConfigFromStreamSettings(h.streamSettings); config != nil {
+					tlsConfig := config.GetTLSConfig(tls.WithDestination(dest))
+					conn = tls.Client(conn, tlsConfig)
+				}
+
+				return h.getStatCouterConnection(conn), nil
+			}
+
+			errors.LogError(ctx, "failed to get outbound handler with tag: ", tag)
+			return nil, errors.New("failed to get outbound handler with tag: " + tag)
+		}
+
+		if h.senderSettings.Via != nil {
+			outbounds := session.OutboundsFromContext(ctx)
+			ob := outbounds[len(outbounds)-1]
+			h.SetOutboundGateway(ctx, ob)
+		}
 	}
 
 	conn, err := internet.Dial(ctx, dest, h.streamSettings)
 	conn = h.getStatCouterConnection(conn)
+	outbounds := session.OutboundsFromContext(ctx)
+	if outbounds != nil {
+		ob := outbounds[len(outbounds)-1]
+		ob.Conn = conn
+	} else {
+		// for Vision's pre-connect
+	}
 	return conn, err
 }
 
 func (h *Handler) SetOutboundGateway(ctx context.Context, ob *session.Outbound) {
-	if ob.Gateway == nil && h.senderSettings != nil && h.senderSettings.Via != nil &&
-		(h.streamSettings.SocketSettings == nil || len(h.streamSettings.SocketSettings.DialerProxy) == 0) {
+	if ob.Gateway == nil && h.senderSettings != nil && h.senderSettings.Via != nil && !h.senderSettings.ProxySettings.HasTag() && (h.streamSettings.SocketSettings == nil || len(h.streamSettings.SocketSettings.DialerProxy) == 0) {
 		var domain string
 		addr := h.senderSettings.Via.AsAddress()
 		domain = h.senderSettings.Via.GetDomain()
 		switch {
 		case h.senderSettings.ViaCidr != "":
 			ob.Gateway = ParseRandomIP(addr, h.senderSettings.ViaCidr)
+
 		case domain == "origin":
 			if inbound := session.InboundFromContext(ctx); inbound != nil {
 				if inbound.Local.IsValid() && inbound.Local.Address.Family().IsIP() {
@@ -300,9 +344,12 @@ func (h *Handler) SetOutboundGateway(ctx context.Context, ob *session.Outbound)
 					errors.LogDebug(ctx, "use inbound source ip as sendthrough: ", inbound.Source.Address.String())
 				}
 			}
-		default: // case addr.Family().IsDomain():
+		// case addr.Family().IsDomain():
+		default:
 			ob.Gateway = addr
+
 		}
+
 	}
 }
 

app/router/balancing.go

@@ -136,7 +136,7 @@ func (b *Balancer) SelectOutbounds() ([]string, error) {
 
 // GetPrincipleTarget implements routing.BalancerPrincipleTarget
 func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {
-	if b, ok := (*r.balancers.Load())[tag]; ok {
+	if b, ok := r.balancers[tag]; ok {
 		if s, ok := b.strategy.(BalancingPrincipleTarget); ok {
 			candidates, err := b.SelectOutbounds()
 			if err != nil {
@@ -151,7 +151,7 @@ func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {
 
 // SetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) SetOverrideTarget(tag, target string) error {
-	if b, ok := (*r.balancers.Load())[tag]; ok {
+	if b, ok := r.balancers[tag]; ok {
 		b.override.Put(target)
 		return nil
 	}
@@ -160,7 +160,7 @@ func (r *Router) SetOverrideTarget(tag, target string) error {
 
 // GetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) GetOverrideTarget(tag string) (string, error) {
-	if b, ok := (*r.balancers.Load())[tag]; ok {
+	if b, ok := r.balancers[tag]; ok {
 		return b.override.Get(), nil
 	}
 	return "", errors.New("cannot find tag")

app/router/balancing_override.go

@@ -2,8 +2,25 @@ package router
 
 import (
 	sync "sync"
+
+	"github.com/xtls/xray-core/common/errors"
 )
 
+func (r *Router) OverrideBalancer(balancer string, target string) error {
+	var b *Balancer
+	for tag, bl := range r.balancers {
+		if tag == balancer {
+			b = bl
+			break
+		}
+	}
+	if b == nil {
+		return errors.New("balancer '", balancer, "' not found")
+	}
+	b.override.Put(target)
+	return nil
+}
+
 type overrideSettings struct {
 	target string
 }

app/router/condition.go

@@ -5,7 +5,6 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"slices"
 	"strings"
 
@@ -394,22 +393,3 @@ func (m *ProcessNameMatcher) Apply(ctx routing.Context) bool {
 	}
 	return false
 }
-
-// LocalOSMatcher matches the operating system Xray itself is running on. That never
-// changes while Xray is running, so the result is resolved when the rule is built.
-type LocalOSMatcher struct {
-	matched bool
-}
-
-func NewLocalOSMatcher(names []string) *LocalOSMatcher {
-	return &LocalOSMatcher{
-		matched: slices.ContainsFunc(names, func(name string) bool {
-			return strings.EqualFold(name, runtime.GOOS)
-		}),
-	}
-}
-
-// Apply implements Condition.
-func (m *LocalOSMatcher) Apply(_ routing.Context) bool {
-	return m.matched
-}

app/router/condition_test.go

@@ -2,9 +2,7 @@ package router_test
 
 import (
 	"path/filepath"
-	"runtime"
 	"strconv"
-	"strings"
 	"testing"
 
 	. "github.com/xtls/xray-core/app/router"
@@ -345,31 +343,6 @@ func TestChinaSites(t *testing.T) {
 	}
 }
 
-func TestLocalOSRule(t *testing.T) {
-	otherOS := "plan9"
-	if runtime.GOOS == otherOS {
-		otherOS = "linux"
-	}
-
-	cases := []struct {
-		localOS []string
-		output  bool
-	}{
-		{localOS: []string{runtime.GOOS}, output: true},
-		{localOS: []string{otherOS}, output: false},
-		{localOS: []string{otherOS, runtime.GOOS}, output: true},
-		{localOS: []string{strings.ToUpper(runtime.GOOS)}, output: true},
-	}
-
-	for _, test := range cases {
-		cond, err := (&RoutingRule{LocalOs: test.localOS}).BuildCondition()
-		common.Must(err)
-		if got := cond.Apply(withBackground()); got != test.output {
-			t.Errorf("for localOS %v on %s: expected %v, got %v", test.localOS, runtime.GOOS, test.output, got)
-		}
-	}
-}
-
 func BenchmarkMphDomainMatcher(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 	rules, err := geodata.ParseDomainRules([]string{"geosite:cn"}, geodata.Domain_Substr)

app/router/config.go

@@ -33,10 +33,6 @@ func (r *Rule) Apply(ctx routing.Context) bool {
 func (rr *RoutingRule) BuildCondition() (Condition, error) {
 	conds := NewConditionChan()
 
-	if len(rr.LocalOs) > 0 {
-		conds.Add(NewLocalOSMatcher(rr.LocalOs))
-	}
-
 	if len(rr.InboundTag) > 0 {
 		conds.Add(NewInboundTagMatcher(rr.InboundTag))
 	}

app/router/config.pb.go

@@ -107,10 +107,8 @@ type RoutingRule struct {
 	VlessRouteList *net.PortList  `protobuf:"bytes,20,opt,name=vless_route_list,json=vlessRouteList,proto3" json:"vless_route_list,omitempty"`
 	Process        []string       `protobuf:"bytes,21,rep,name=process,proto3" json:"process,omitempty"`
 	Webhook        *WebhookConfig `protobuf:"bytes,22,opt,name=webhook,proto3" json:"webhook,omitempty"`
-	// List of operating systems for matching the one Xray itself is running on.
-	LocalOs       []string `protobuf:"bytes,23,rep,name=local_os,json=localOs,proto3" json:"local_os,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *RoutingRule) Reset() {
@@ -280,13 +278,6 @@ func (x *RoutingRule) GetWebhook() *WebhookConfig {
 	return nil
 }
 
-func (x *RoutingRule) GetLocalOs() []string {
-	if x != nil {
-		return x.LocalOs
-	}
-	return nil
-}
-
 type isRoutingRule_TargetTag interface {
 	isRoutingRule_TargetTag()
 }
@@ -587,10 +578,8 @@ type Config struct {
 	DomainStrategy Config_DomainStrategy  `protobuf:"varint,1,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.app.router.Config_DomainStrategy" json:"domain_strategy,omitempty"`
 	Rule           []*RoutingRule         `protobuf:"bytes,2,rep,name=rule,proto3" json:"rule,omitempty"`
 	BalancingRule  []*BalancingRule       `protobuf:"bytes,3,rep,name=balancing_rule,json=balancingRule,proto3" json:"balancing_rule,omitempty"`
-	// Absolute path to the Lua routing script.
-	Script        string `protobuf:"bytes,4,opt,name=script,proto3" json:"script,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {
@@ -644,18 +633,11 @@ func (x *Config) GetBalancingRule() []*BalancingRule {
 	return nil
 }
 
-func (x *Config) GetScript() string {
-	if x != nil {
-		return x.Script
-	}
-	return ""
-}
-
 var File_app_router_config_proto protoreflect.FileDescriptor
 
 const file_app_router_config_proto_rawDesc = "" +
 	"\n" +
-	"\x17app/router/config.proto\x12\x0fxray.app.router\x1a!common/serial/typed_message.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"\xdc\a\n" +
+	"\x17app/router/config.proto\x12\x0fxray.app.router\x1a!common/serial/typed_message.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"\xc1\a\n" +
 	"\vRoutingRule\x12\x12\n" +
 	"\x03tag\x18\x01 \x01(\tH\x00R\x03tag\x12%\n" +
 	"\rbalancing_tag\x18\f \x01(\tH\x00R\fbalancingTag\x12\x19\n" +
@@ -679,8 +661,7 @@ const file_app_router_config_proto_rawDesc = "" +
 	"\x0flocal_port_list\x18\x12 \x01(\v2\x19.xray.common.net.PortListR\rlocalPortList\x12C\n" +
 	"\x10vless_route_list\x18\x14 \x01(\v2\x19.xray.common.net.PortListR\x0evlessRouteList\x12\x18\n" +
 	"\aprocess\x18\x15 \x03(\tR\aprocess\x128\n" +
-	"\awebhook\x18\x16 \x01(\v2\x1e.xray.app.router.WebhookConfigR\awebhook\x12\x19\n" +
-	"\blocal_os\x18\x17 \x03(\tR\alocalOs\x1a=\n" +
+	"\awebhook\x18\x16 \x01(\v2\x1e.xray.app.router.WebhookConfigR\awebhook\x1a=\n" +
 	"\x0fAttributesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\f\n" +
@@ -708,12 +689,11 @@ const file_app_router_config_proto_rawDesc = "" +
 	"\tbaselines\x18\x03 \x03(\x03R\tbaselines\x12\x1a\n" +
 	"\bexpected\x18\x04 \x01(\x05R\bexpected\x12\x16\n" +
 	"\x06maxRTT\x18\x05 \x01(\x03R\x06maxRTT\x12\x1c\n" +
-	"\ttolerance\x18\x06 \x01(\x02R\ttolerance\"\xae\x02\n" +
+	"\ttolerance\x18\x06 \x01(\x02R\ttolerance\"\x96\x02\n" +
 	"\x06Config\x12O\n" +
 	"\x0fdomain_strategy\x18\x01 \x01(\x0e2&.xray.app.router.Config.DomainStrategyR\x0edomainStrategy\x120\n" +
 	"\x04rule\x18\x02 \x03(\v2\x1c.xray.app.router.RoutingRuleR\x04rule\x12E\n" +
-	"\x0ebalancing_rule\x18\x03 \x03(\v2\x1e.xray.app.router.BalancingRuleR\rbalancingRule\x12\x16\n" +
-	"\x06script\x18\x04 \x01(\tR\x06script\"B\n" +
+	"\x0ebalancing_rule\x18\x03 \x03(\v2\x1e.xray.app.router.BalancingRuleR\rbalancingRule\"B\n" +
 	"\x0eDomainStrategy\x12\b\n" +
 	"\x04AsIs\x10\x00\x12\x10\n" +
 	"\fIpIfNonMatch\x10\x02\x12\x0e\n" +

app/router/config.proto

@@ -56,9 +56,6 @@ message RoutingRule {
 
   repeated string process = 21;
   WebhookConfig webhook = 22;
-
-  // List of operating systems for matching the one Xray itself is running on.
-  repeated string local_os = 23;
 }
 
 message WebhookConfig {
@@ -110,6 +107,4 @@ message Config {
   DomainStrategy domain_strategy = 1;
   repeated RoutingRule rule = 2;
   repeated BalancingRule balancing_rule = 3;
-  // Absolute path to the Lua routing script.
-  string script = 4;
 }

app/router/lua.go

@@ -1,206 +0,0 @@
-package router
-
-import (
-	"context"
-	"runtime"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/features/routing"
-	lua "github.com/yuin/gopher-lua"
-)
-
-const (
-	luaContextType    = "xray.router.Context"
-	luaAttributesType = "xray.router.Attributes"
-)
-
-// RegisterLua makes xray.router available to routing scripts.
-func (r *Router) RegisterLua(L *lua.LState) {
-	registerLuaContext(L)
-
-	L.PreloadModule("xray.router", func(L *lua.LState) int {
-		module := L.NewTable()
-
-		module.RawSetString("NetworkUnknown", lua.LNumber(net.Network_Unknown))
-		module.RawSetString("NetworkTCP", lua.LNumber(net.Network_TCP))
-		module.RawSetString("NetworkUDP", lua.LNumber(net.Network_UDP))
-		module.RawSetString("NetworkUNIX", lua.LNumber(net.Network_UNIX))
-		module.RawSetString("LocalOS", lua.LString(runtime.GOOS))
-
-		module.RawSetString("PickOutbound", L.NewFunction(func(L *lua.LState) int {
-			tag, ok := L.Get(2).(lua.LString)
-			if !ok {
-				L.ArgError(2, "balancer tag must be a string")
-				return 0
-			}
-			balancer, found := (*r.balancers.Load())[string(tag)]
-			if !found {
-				L.Push(lua.LNil)
-				pushLuaError(L, errors.New("balancer ", tag, " not found"))
-				return 2
-			}
-			outboundTag, err := balancer.PickOutbound()
-			L.Push(lua.LString(outboundTag))
-			pushLuaError(L, err)
-			return 2
-		}))
-
-		module.RawSetString("FindProcess", L.NewFunction(func(L *lua.LState) int {
-			pid, name, path, err := findProcess(checkLuaContext(L), net.FindProcess)
-			L.Push(lua.LNumber(pid))
-			L.Push(lua.LString(name))
-			L.Push(lua.LString(path))
-			pushLuaError(L, err)
-			return 4
-		}))
-
-		L.Push(module)
-		return 1
-	})
-}
-
-func registerLuaContext(L *lua.LState) {
-	attributes := L.NewTypeMetatable(luaAttributesType)
-	L.SetField(attributes, "__index", L.NewFunction(func(L *lua.LState) int {
-		values := L.CheckUserData(1).Value.(map[string]string)
-		key := L.CheckString(2)
-		if value, found := values[key]; found {
-			L.Push(lua.LString(value))
-		} else {
-			L.Push(lua.LNil)
-		}
-		return 1
-	}))
-	methods := L.NewTable()
-	L.SetFuncs(methods, map[string]lua.LGFunction{
-		"GetSourceIPs": func(L *lua.LState) int {
-			return pushLuaIPs(L, checkLuaContext(L).GetSourceIPs())
-		},
-		"GetTargetIPs": func(L *lua.LState) int {
-			return pushLuaIPs(L, checkLuaContext(L).GetTargetIPs())
-		},
-		"GetLocalIPs": func(L *lua.LState) int {
-			return pushLuaIPs(L, checkLuaContext(L).GetLocalIPs())
-		},
-		"GetAttributes": func(L *lua.LState) int {
-			values := L.NewUserData()
-			values.Value = checkLuaContext(L).GetAttributes()
-			L.SetMetatable(values, attributes)
-			L.Push(values)
-			return 1
-		},
-	})
-	L.SetField(L.NewTypeMetatable(luaContextType), "__index", methods)
-}
-
-func checkLuaContext(L *lua.LState) routing.Context {
-	ctx, ok := L.CheckUserData(1).Value.(routing.Context)
-	if !ok {
-		L.ArgError(1, "routing context expected")
-	}
-	return ctx
-}
-
-func pushLuaIPs(L *lua.LState, ips []net.IP) int {
-	addresses := L.NewUserData()
-	addresses.Value = ips
-	L.Push(addresses)
-	return 1
-}
-
-func pushLuaError(L *lua.LState, err error) {
-	if err == nil {
-		L.Push(lua.LNil)
-		return
-	}
-	value := L.NewUserData()
-	value.Value = err
-	L.Push(value)
-}
-
-// CallLuaHook invokes HandleRoute in the supplied state.
-func (r *Router) CallLuaHook(L *lua.LState, ctx context.Context, routeCtx routing.Context) (string, string, error) {
-	previous, top := L.Context(), L.GetTop()
-	L.SetContext(ctx)
-	defer func() {
-		L.SetTop(top)
-		if previous == nil {
-			L.RemoveContext()
-		} else {
-			L.SetContext(previous)
-		}
-	}()
-	fn := L.GetGlobal("HandleRoute")
-	if fn.Type() != lua.LTFunction {
-		return "", "", errors.New("routing script must define HandleRoute(...)")
-	}
-	value := L.NewUserData()
-	value.Value = routeCtx
-	L.SetMetatable(value, L.GetTypeMetatable(luaContextType))
-	if err := L.CallByParam(lua.P{Fn: fn, NRet: 3, Protect: true},
-		value, lua.LString(routeCtx.GetInboundTag()), lua.LNumber(routeCtx.GetSourcePort()),
-		lua.LNumber(routeCtx.GetTargetPort()), lua.LNumber(routeCtx.GetLocalPort()),
-		lua.LString(routeCtx.GetTargetDomain()), lua.LNumber(routeCtx.GetNetwork()),
-		lua.LString(routeCtx.GetProtocol()), lua.LString(routeCtx.GetUser()),
-		lua.LNumber(routeCtx.GetVlessRoute()), lua.LBool(routeCtx.GetSkipDNSResolve())); err != nil {
-		return "", "", err
-	}
-	return readLuaRouteResult(L.Get(-3), L.Get(-2), L.Get(-1))
-}
-
-func readLuaRouteResult(tagValue, ruleValue, errorValue lua.LValue) (string, string, error) {
-	if errorValue != lua.LNil {
-		if value, ok := errorValue.(*lua.LUserData); ok {
-			if err, ok := value.Value.(error); ok {
-				return "", "", err
-			}
-		}
-		if value, ok := errorValue.(lua.LString); ok {
-			return "", "", errors.New(string(value))
-		}
-		return "", "", errors.New("routing script error must be an error or string")
-	}
-	if tagValue == lua.LNil {
-		return "", "", nil
-	}
-	tag, ok := tagValue.(lua.LString)
-	if !ok {
-		return "", "", errors.New("routing script outboundTag must be a string or nil")
-	}
-	if tag == "" {
-		return "", "", nil
-	}
-	var ruleTag string
-	if ruleValue != lua.LNil {
-		value, ok := ruleValue.(lua.LString)
-		if !ok {
-			return "", "", errors.New("routing script ruleTag must be a string")
-		}
-		ruleTag = string(value)
-	}
-	return string(tag), ruleTag, nil
-}
-
-type processFinder func(string, string, uint16, string, uint16) (int, string, string, error)
-
-func findProcess(ctx routing.Context, finder processFinder) (int, string, string, error) {
-	sources := ctx.GetSourceIPs()
-	if len(sources) == 0 {
-		return 0, "", "", errors.New("process lookup requires a source IP")
-	}
-	var network string
-	switch ctx.GetNetwork() {
-	case net.Network_TCP:
-		network = "tcp"
-	case net.Network_UDP:
-		network = "udp"
-	default:
-		return 0, "", "", errors.New("process lookup requires TCP or UDP")
-	}
-	targetIP, targetPort := "", uint16(0)
-	if targets := ctx.GetTargetIPs(); len(targets) > 0 {
-		targetIP, targetPort = targets[0].String(), uint16(ctx.GetTargetPort())
-	}
-	return finder(network, sources[0].String(), uint16(ctx.GetSourcePort()), targetIP, targetPort)
-}

app/router/lua_test.go

@@ -1,292 +0,0 @@
-package router
-
-import (
-	"context"
-	go_errors "errors"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/protocol"
-	"github.com/xtls/xray-core/common/session"
-	"github.com/xtls/xray-core/features/routing"
-	routing_session "github.com/xtls/xray-core/features/routing/session"
-	lua "github.com/yuin/gopher-lua"
-)
-
-type luaRouteTestContext struct {
-	*routing_session.Context
-	sourceIPs, targetIPs, localIPs []net.IP
-}
-
-func (c *luaRouteTestContext) GetSourceIPs() []net.IP { return c.sourceIPs }
-func (c *luaRouteTestContext) GetTargetIPs() []net.IP { return c.targetIPs }
-func (c *luaRouteTestContext) GetLocalIPs() []net.IP  { return c.localIPs }
-
-func newLuaRouteTestContext() *luaRouteTestContext {
-	return &luaRouteTestContext{
-		Context: &routing_session.Context{
-			Inbound: &session.Inbound{
-				Tag: "in", VlessRoute: 4321,
-				Source: net.TCPDestination(net.LocalHostIP, 1234),
-				Local:  net.TCPDestination(net.LocalHostIP, 5678),
-				User:   &protocol.MemoryUser{Email: "user@example.com"},
-			},
-			Outbound: &session.Outbound{
-				Target:      net.TCPDestination(net.LocalHostIP, 443),
-				RouteTarget: net.TCPDestination(net.DomainAddress("MiXeD.Example."), 443),
-			},
-			Content: &session.Content{
-				Protocol: "tls", Attributes: map[string]string{"key": "value"}, SkipDNSResolve: true,
-			},
-		},
-		sourceIPs: []net.IP{{127, 0, 0, 2}},
-		targetIPs: []net.IP{{127, 0, 0, 3}},
-		localIPs:  []net.IP{{127, 0, 0, 1}},
-	}
-}
-
-func newLuaRouterState(t *testing.T, script string) (*Router, *lua.LState) {
-	t.Helper()
-	r := new(Router)
-	if err := r.Init(context.Background(), &Config{}, nil, nil, nil); err != nil {
-		t.Fatal(err)
-	}
-	L := lua.NewState()
-	t.Cleanup(L.Close)
-	r.RegisterLua(L)
-	geodata.RegisterLua(L)
-	if err := L.DoString(script); err != nil {
-		t.Fatal(err)
-	}
-	return r, L
-}
-
-func TestLuaRouteBinding(t *testing.T) {
-	r, L := newLuaRouterState(t, `
-local router = require("xray.router")
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.0/8")
-assert(router.NetworkUnknown == 0 and router.NetworkTCP == 2)
-assert(router.NetworkUDP == 3 and router.NetworkUNIX == 4)
-assert(router.BuildIPMatcher == nil and router.BuildDomainMatcher == nil)
-function HandleRoute(ctx, inboundTag, sourcePort, targetPort, localPort,
-    targetDomain, network, protocol, user, vlessRoute, skipDNSResolve, ...)
-    assert(select("#", ...) == 0)
-    assert(inboundTag == "in" and sourcePort == 1234 and targetPort == 443 and localPort == 5678)
-    assert(targetDomain == "MiXeD.Example." and network == router.NetworkTCP)
-    assert(protocol == "tls" and user == "user@example.com" and vlessRoute == 4321 and skipDNSResolve)
-    assert(ctx.GetNetwork == nil and ctx.Context == nil)
-    savedContext = ctx
-    sourceIPs, targetIPs, localIPs = ctx:GetSourceIPs(), ctx:GetTargetIPs(), ctx:GetLocalIPs()
-    attributes = ctx:GetAttributes()
-    assert(matcher:AnyMatch(sourceIPs) and matcher:AnyMatch(targetIPs) and matcher:AnyMatch(localIPs))
-    assert(attributes.key == "value" and attributes.missing == nil)
-    assert(not pcall(function() attributes.key = "changed" end))
-    return "out", "rule"
-end`)
-
-	ctx := newLuaRouteTestContext()
-	tag, rule, err := r.CallLuaHook(L, context.Background(), ctx)
-	if err != nil || tag != "out" || rule != "rule" {
-		t.Fatalf("hook = %q, %q, %v", tag, rule, err)
-	}
-	if L.GetGlobal("savedContext").(*lua.LUserData).Value != ctx {
-		t.Fatal("routing context was copied")
-	}
-	for _, tc := range []struct {
-		name string
-		want []net.IP
-	}{
-		{"sourceIPs", ctx.sourceIPs},
-		{"targetIPs", ctx.targetIPs},
-		{"localIPs", ctx.localIPs},
-	} {
-		got := L.GetGlobal(tc.name).(*lua.LUserData).Value.([]net.IP)
-		if &got[0] != &tc.want[0] {
-			t.Fatalf("%s storage was copied", tc.name)
-		}
-	}
-	ctx.Content.Attributes["key"] = "updated"
-	L.SetGlobal("expectedOS", lua.LString(runtime.GOOS))
-	if err := L.DoString(`
-assert(attributes.key == "updated")
-assert(require("xray.router").LocalOS == expectedOS)`); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestLuaRouteResult(t *testing.T) {
-	nativeErr := go_errors.New("native failure")
-	for _, tc := range []struct {
-		name, body, tag, rule, wantErr string
-		native                         bool
-	}{
-		{name: "route", body: `return "out", "rule"`, tag: "out", rule: "rule"},
-		{name: "no match", body: `return nil`},
-		{name: "empty tag", body: `return ""`},
-		{name: "invalid tag", body: `return 1`, wantErr: "outboundTag"},
-		{name: "invalid rule", body: `return "out", false`, wantErr: "ruleTag"},
-		{name: "string error", body: `return nil, nil, "script failure"`, wantErr: "script failure"},
-		{name: "native error", body: `return nil, nil, nativeError`, native: true},
-		{name: "runtime error", body: `error("runtime failure")`, wantErr: "runtime failure"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			r, L := newLuaRouterState(t, "function HandleRoute() "+tc.body+" end")
-			value := L.NewUserData()
-			value.Value = nativeErr
-			L.SetGlobal("nativeError", value)
-			previous := context.WithValue(context.Background(), struct{}{}, true)
-			L.SetContext(previous)
-			L.Push(lua.LTrue)
-
-			tag, rule, err := r.CallLuaHook(L, context.Background(), &routing_session.Context{})
-			if tag != tc.tag || rule != tc.rule {
-				t.Fatalf("result = %q, %q, %v", tag, rule, err)
-			}
-			switch {
-			case tc.native:
-				if err != nativeErr {
-					t.Fatalf("error = %v, want original error", err)
-				}
-			case tc.wantErr != "":
-				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
-					t.Fatalf("error = %v, want %q", err, tc.wantErr)
-				}
-			case err != nil:
-				t.Fatal(err)
-			}
-			if L.Context() != previous || L.GetTop() != 1 || L.Get(1) != lua.LTrue {
-				t.Fatal("hook did not restore the previous context and stack")
-			}
-		})
-	}
-}
-
-func TestLuaRouteCancellation(t *testing.T) {
-	r, L := newLuaRouterState(t, `function HandleRoute() while true do end end`)
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	if _, _, err := r.CallLuaHook(L, ctx, &routing_session.Context{}); err == nil {
-		t.Fatal("CallLuaHook did not stop after context cancellation")
-	}
-	if L.Context() != nil || L.GetTop() != 0 {
-		t.Fatal("CallLuaHook did not restore the Lua state")
-	}
-}
-
-func TestFindProcess(t *testing.T) {
-	for _, tc := range []struct {
-		name, network, target string
-		targetPort            uint16
-		modify                func(*luaRouteTestContext)
-		wantErr               bool
-	}{
-		{name: "TCP", network: "tcp", target: "127.0.0.3", targetPort: 443},
-		{name: "UDP", network: "udp", target: "127.0.0.3", targetPort: 443, modify: func(c *luaRouteTestContext) {
-			c.Outbound.Target.Network = net.Network_UDP
-		}},
-		{name: "domain target", network: "tcp", modify: func(c *luaRouteTestContext) { c.targetIPs = nil }},
-		{name: "missing source", modify: func(c *luaRouteTestContext) { c.sourceIPs = nil }, wantErr: true},
-		{name: "unsupported network", modify: func(c *luaRouteTestContext) {
-			c.Outbound.Target.Network = net.Network_UNIX
-		}, wantErr: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := newLuaRouteTestContext()
-			if tc.modify != nil {
-				tc.modify(ctx)
-			}
-			called := false
-			pid, name, path, err := findProcess(ctx, func(network, source string, sourcePort uint16, target string, targetPort uint16) (int, string, string, error) {
-				called = true
-				if network != tc.network || source != "127.0.0.2" || sourcePort != 1234 || target != tc.target || targetPort != tc.targetPort {
-					t.Fatalf("endpoints = %s %s:%d -> %s:%d", network, source, sourcePort, target, targetPort)
-				}
-				return 42, "process", "/path/process", nil
-			})
-			if tc.wantErr {
-				if err == nil || called {
-					t.Fatalf("findProcess = %d, %q, %q, %v", pid, name, path, err)
-				}
-				return
-			}
-			if err != nil || !called || pid != 42 || name != "process" || path != "/path/process" {
-				t.Fatalf("findProcess = %d, %q, %q, %v", pid, name, path, err)
-			}
-		})
-	}
-}
-
-// BenchmarkLuaRouteHookCall isolates a preloaded Lua hook and its routing context bridge.
-// The direct case runs an equivalent native routing rule.
-func BenchmarkLuaRouteHookCall(b *testing.B) {
-	r := new(Router)
-	if err := r.Init(context.Background(), &Config{Rule: []*RoutingRule{{
-		TargetTag:  &RoutingRule_Tag{Tag: "out"},
-		RuleTag:    "rule",
-		InboundTag: []string{"in"},
-		Networks:   []net.Network{net.Network_TCP},
-		Ip: []*geodata.IPRule{{
-			Value: &geodata.IPRule_Custom{Custom: &geodata.CIDRRule{
-				Cidr: &geodata.CIDR{Ip: []byte{127, 0, 0, 0}, Prefix: 8},
-			}},
-		}},
-	}}}, nil, nil, nil); err != nil {
-		b.Fatal(err)
-	}
-	L := lua.NewState()
-	defer L.Close()
-	r.RegisterLua(L)
-	geodata.RegisterLua(L)
-	if err := L.DoString(`
-local router = require("xray.router")
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.0/8")
-function HandleRoute(ctx, inboundTag, sourcePort, targetPort, localPort,
-    targetDomain, network, protocol, user, vlessRoute, skipDNSResolve)
-    if inboundTag == "in" and network == router.NetworkTCP and matcher:AnyMatch(ctx:GetTargetIPs()) then
-        return "out", "rule"
-    end
-end
-`); err != nil {
-		b.Fatal(err)
-	}
-
-	ctx := context.Background()
-	routeCtx := newLuaRouteTestContext()
-	for _, benchmark := range []struct {
-		name  string
-		route func() (string, string, error)
-	}{
-		{"direct", func() (string, string, error) {
-			route, err := r.PickRoute(routeCtx)
-			if err != nil {
-				return "", "", err
-			}
-			return route.GetOutboundTag(), route.GetRuleTag(), nil
-		}},
-		{"lua_hook", func() (string, string, error) {
-			return r.CallLuaHook(L, ctx, routeCtx)
-		}},
-	} {
-		b.Run(benchmark.name, func(b *testing.B) {
-			b.ReportAllocs()
-			b.ResetTimer()
-			var tag, rule string
-			var err error
-			for i := 0; i < b.N; i++ {
-				tag, rule, err = benchmark.route()
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-			b.StopTimer()
-			if tag != "out" || rule != "rule" {
-				b.Fatalf("route() = %q, %q; want out, rule", tag, rule)
-			}
-		})
-	}
-}
-
-var _ routing.Context = (*luaRouteTestContext)(nil)

app/router/router.go

@@ -2,9 +2,7 @@ package router
 
 import (
 	"context"
-	"maps"
 	"sync"
-	"sync/atomic"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
@@ -19,10 +17,8 @@ import (
 // Router is an implementation of routing.Router.
 type Router struct {
 	domainStrategy Config_DomainStrategy
-	rules          atomic.Pointer[[]*Rule]
-	scriptPath     string
-	script         *scriptEngine
-	balancers      atomic.Pointer[map[string]*Balancer]
+	rules          []*Rule
+	balancers      map[string]*Balancer
 	dns            dns.Client
 
 	ctx        context.Context
@@ -42,23 +38,61 @@ type Route struct {
 // Init initializes the Router.
 func (r *Router) Init(ctx context.Context, config *Config, d dns.Client, ohm outbound.Manager, dispatcher routing.Dispatcher) error {
 	r.domainStrategy = config.DomainStrategy
-	r.scriptPath = config.Script
 	r.dns = d
 	r.ctx = ctx
 	r.ohm = ohm
 	r.dispatcher = dispatcher
 
-	r.rules.Store(new([]*Rule))
-	r.balancers.Store(&map[string]*Balancer{})
-	return r.ReloadRules(config, false)
+	r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
+	for _, rule := range config.BalancingRule {
+		balancer, err := rule.Build(ohm, dispatcher)
+		if err != nil {
+			return err
+		}
+		balancer.InjectContext(ctx)
+		r.balancers[rule.Tag] = balancer
+	}
+
+	r.rules = make([]*Rule, 0, len(config.Rule))
+	for _, rule := range config.Rule {
+		cond, err := rule.BuildCondition()
+		if err != nil {
+			r.closeWebhooks()
+			return err
+		}
+		rr := &Rule{
+			Condition: cond,
+			Tag:       rule.GetTag(),
+			RuleTag:   rule.GetRuleTag(),
+		}
+		if wh := rule.GetWebhook(); wh != nil {
+			notifier, err := NewWebhookNotifier(wh)
+			if err != nil {
+				r.closeWebhooks()
+				return err
+			}
+			rr.Webhook = notifier
+		}
+		btag := rule.GetBalancingTag()
+		if len(btag) > 0 {
+			brule, found := r.balancers[btag]
+			if !found {
+				if rr.Webhook != nil {
+					rr.Webhook.Close()
+				}
+				r.closeWebhooks()
+				return errors.New("balancer ", btag, " not found")
+			}
+			rr.Balancer = brule
+		}
+		r.rules = append(r.rules, rr)
+	}
+
+	return nil
 }
 
 // PickRoute implements routing.Router.
 func (r *Router) PickRoute(ctx routing.Context) (routing.Route, error) {
-	if r.script != nil {
-		return r.script.pickRoute(ctx)
-	}
-
 	originalCtx := ctx
 	rule, ctx, err := r.pickRouteInternal(ctx)
 	if err != nil {
@@ -90,22 +124,18 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	oldRules := *r.rules.Load()
-	oldBalancers := *r.balancers.Load()
-
-	var newRules []*Rule
-	newBalancers := make(map[string]*Balancer)
-	existTags := make(map[string]bool, len(oldRules)+len(config.Rule))
-	if shouldAppend {
-		newRules = append(newRules, oldRules...)
-		maps.Copy(newBalancers, oldBalancers)
-		for _, rule := range oldRules {
-			existTags[rule.RuleTag] = true
+	if !shouldAppend {
+		for _, rule := range r.rules {
+			if rule.Webhook != nil {
+				rule.Webhook.Close()
+			}
 		}
+		r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
+		r.rules = make([]*Rule, 0, len(config.Rule))
 	}
-
 	for _, rule := range config.BalancingRule {
-		if _, found := newBalancers[rule.Tag]; found {
+		_, found := r.balancers[rule.Tag]
+		if found {
 			return errors.New("duplicate balancer tag")
 		}
 		balancer, err := rule.Build(r.ohm, r.dispatcher)
@@ -113,12 +143,27 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			return err
 		}
 		balancer.InjectContext(r.ctx)
-		newBalancers[rule.Tag] = balancer
+		r.balancers[rule.Tag] = balancer
+	}
+
+	startIdx := len(r.rules)
+	closeNewWebhooks := func() {
+		for i := startIdx; i < len(r.rules); i++ {
+			if r.rules[i].Webhook != nil {
+				r.rules[i].Webhook.Close()
+			}
+		}
+		r.rules = r.rules[:startIdx]
 	}
 
 	for _, rule := range config.Rule {
+		if r.RuleExists(rule.GetRuleTag()) {
+			closeNewWebhooks()
+			return errors.New("duplicate ruleTag ", rule.GetRuleTag())
+		}
 		cond, err := rule.BuildCondition()
 		if err != nil {
+			closeNewWebhooks()
 			return err
 		}
 		rr := &Rule{
@@ -126,64 +171,69 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			Tag:       rule.GetTag(),
 			RuleTag:   rule.GetRuleTag(),
 		}
-		if rr.RuleTag != "" && existTags[rr.RuleTag] {
-			return errors.New("duplicate ruleTag ", rr.RuleTag)
-		}
-		existTags[rr.RuleTag] = true
 		if wh := rule.GetWebhook(); wh != nil {
 			notifier, err := NewWebhookNotifier(wh)
 			if err != nil {
+				closeNewWebhooks()
 				return err
 			}
 			rr.Webhook = notifier
 		}
-		if btag := rule.GetBalancingTag(); len(btag) > 0 {
-			brule, found := newBalancers[btag]
+		btag := rule.GetBalancingTag()
+		if len(btag) > 0 {
+			brule, found := r.balancers[btag]
 			if !found {
+				if rr.Webhook != nil {
+					rr.Webhook.Close()
+				}
+				closeNewWebhooks()
 				return errors.New("balancer ", btag, " not found")
 			}
 			rr.Balancer = brule
 		}
-		newRules = append(newRules, rr)
+		r.rules = append(r.rules, rr)
 	}
 
-	r.balancers.Store(&newBalancers)
-	r.rules.Store(&newRules)
-	if !shouldAppend {
-		closeWebhooks(oldRules)
-	}
 	return nil
 }
 
+func (r *Router) RuleExists(tag string) bool {
+	if tag != "" {
+		for _, rule := range r.rules {
+			if rule.RuleTag == tag {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // RemoveRule implements routing.Router.
 func (r *Router) RemoveRule(tag string) error {
-	if tag == "" {
-		return errors.New("empty tag name!")
-	}
-
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	oldRules := *r.rules.Load()
-	newRules := make([]*Rule, 0, len(oldRules))
-	var removed []*Rule
-	for _, rule := range oldRules {
-		if rule.RuleTag != tag {
-			newRules = append(newRules, rule)
-		} else {
-			removed = append(removed, rule)
+	newRules := []*Rule{}
+	if tag != "" {
+		for _, rule := range r.rules {
+			if rule.RuleTag != tag {
+				newRules = append(newRules, rule)
+			} else if rule.Webhook != nil {
+				rule.Webhook.Close()
+			}
 		}
+		r.rules = newRules
+		return nil
 	}
-	r.rules.Store(&newRules)
-	closeWebhooks(removed)
-	return nil
+	return errors.New("empty tag name!")
 }
 
 // ListRule implements routing.Router
 func (r *Router) ListRule() []routing.Route {
-	rules := *r.rules.Load()
-	ruleList := make([]routing.Route, 0, len(rules))
-	for _, rule := range rules {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	ruleList := make([]routing.Route, 0)
+	for _, rule := range r.rules {
 		ruleList = append(ruleList, &Route{
 			outboundTag: rule.Tag,
 			ruleTag:     rule.RuleTag,
@@ -202,9 +252,7 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 		ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)
 	}
 
-	rules := *r.rules.Load()
-
-	for _, rule := range rules {
+	for _, rule := range r.rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -217,7 +265,7 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 	ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)
 
 	// Try applying rules again if we have IPs.
-	for _, rule := range rules {
+	for _, rule := range r.rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -228,19 +276,12 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 
 // Start implements common.Runnable.
 func (r *Router) Start() error {
-	if r.scriptPath != "" {
-		engine, err := newScriptEngine(r.scriptPath, r)
-		if err != nil {
-			return errors.New("failed to initialize routing script").Base(err)
-		}
-		r.script = engine
-	}
 	return nil
 }
 
-// closeWebhooks closes all webhook notifiers in the given rule set.
-func closeWebhooks(rules []*Rule) {
-	for _, rule := range rules {
+// closeWebhooks closes all webhook notifiers in the current rule set.
+func (r *Router) closeWebhooks() {
+	for _, rule := range r.rules {
 		if rule.Webhook != nil {
 			rule.Webhook.Close()
 		}
@@ -249,12 +290,9 @@ func closeWebhooks(rules []*Rule) {
 
 // Close implements common.Closable.
 func (r *Router) Close() error {
-	if r.script != nil {
-		r.script.close()
-	}
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	closeWebhooks(*r.rules.Load())
+	r.closeWebhooks()
 	return nil
 }
 

app/router/script.go

@@ -1,79 +0,0 @@
-package router
-
-import (
-	"context"
-	"time"
-
-	"github.com/xtls/xray-core/app/dns"
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/log"
-	luamgr "github.com/xtls/xray-core/common/lua"
-	"github.com/xtls/xray-core/features/routing"
-	lua "github.com/yuin/gopher-lua"
-)
-
-const scriptExecutionTimeout = 10 * time.Second
-
-type scriptEngine struct {
-	router *Router
-	pool   *luamgr.Pool
-}
-
-func newScriptEngine(path string, router *Router) (*scriptEngine, error) {
-	program, err := luamgr.CompileFile(path)
-	if err != nil {
-		return nil, err
-	}
-	e := &scriptEngine{router: router}
-	e.pool, err = luamgr.NewPool(router.ctx, func(poolCtx context.Context) (*lua.LState, error) {
-		initCtx, cancel := context.WithTimeout(poolCtx, scriptExecutionTimeout)
-		defer cancel()
-		L, err := program.NewState(initCtx, func(L *lua.LState) {
-			geodata.RegisterLua(L)
-			log.RegisterLua(L)
-			router.RegisterLua(L)
-			dns.RegisterLua(L, router.dns)
-		})
-		if err != nil {
-			return nil, err
-		}
-		if L.GetGlobal("HandleRoute").Type() != lua.LTFunction {
-			L.Close()
-			return nil, errors.New("routing script must define HandleRoute(...)")
-		}
-		return L, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	errors.LogInfo(router.ctx, "routing script initialized from ", path)
-	return e, nil
-}
-
-func (e *scriptEngine) close() {
-	e.pool.Close()
-}
-
-func (e *scriptEngine) pickRoute(ctx routing.Context) (routing.Route, error) {
-	L, err := e.pool.Acquire()
-	if err != nil {
-		return nil, err
-	}
-	reusable := false
-	defer func() {
-		e.pool.Release(L, reusable)
-	}()
-	callCtx, cancel := context.WithTimeout(e.pool.Context(), scriptExecutionTimeout)
-	defer cancel()
-	tag, ruleTag, err := e.router.CallLuaHook(L, callCtx, ctx)
-	if err != nil {
-		return nil, err
-	}
-	reusable = true
-	if tag == "" {
-		return nil, common.ErrNoClue
-	}
-	return &Route{Context: ctx, outboundTag: tag, ruleTag: ruleTag}, nil
-}

app/router/script_test.go

@@ -1,372 +0,0 @@
-package router
-
-import (
-	"context"
-	stdnet "net"
-	"os"
-	"path/filepath"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	wireDNS "github.com/miekg/dns"
-	"github.com/xtls/xray-core/app/dispatcher"
-	appdns "github.com/xtls/xray-core/app/dns"
-	"github.com/xtls/xray-core/app/proxyman"
-	_ "github.com/xtls/xray-core/app/proxyman/outbound"
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/serial"
-	"github.com/xtls/xray-core/core"
-	featureDNS "github.com/xtls/xray-core/features/dns"
-	"github.com/xtls/xray-core/features/outbound"
-	"github.com/xtls/xray-core/features/routing"
-	routing_session "github.com/xtls/xray-core/features/routing/session"
-	"github.com/xtls/xray-core/proxy/blackhole"
-	"github.com/xtls/xray-core/proxy/freedom"
-)
-
-type luaRouteDNSClient struct {
-	featureDNS.Client
-	lookup func(string, featureDNS.IPOption) ([]net.IP, uint32, error)
-}
-
-func (d *luaRouteDNSClient) LookupIP(domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-	return d.lookup(domain, option)
-}
-
-type luaRouteOutboundManager struct{ outbound.Manager }
-
-func (*luaRouteOutboundManager) Select(selectors []string) []string { return selectors }
-
-func writeRouteScript(t *testing.T, script string) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "route.lua")
-	if err := os.WriteFile(path, []byte(script), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	return path
-}
-
-func startLuaRouter(t *testing.T, script string, d featureDNS.Client, config *Config) *Router {
-	t.Helper()
-	if config == nil {
-		config = &Config{}
-	}
-	config.Script = writeRouteScript(t, script)
-	r := new(Router)
-	if err := r.Init(context.Background(), config, d, &luaRouteOutboundManager{}, nil); err != nil {
-		t.Fatal(err)
-	}
-	if err := r.Start(); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if err := r.Close(); err != nil {
-			t.Error(err)
-		}
-	})
-	return r
-}
-
-func TestRouterScriptStartup(t *testing.T) {
-	for _, tc := range []struct{ name, script string }{
-		{"syntax error", "function HandleRoute("},
-		{"missing hook", "value = 1"},
-		{"initialization error", `error("setup failed")`},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			r := new(Router)
-			if err := r.Init(context.Background(), &Config{Script: writeRouteScript(t, tc.script)}, nil, nil, nil); err != nil {
-				t.Fatal(err)
-			}
-			defer r.Close()
-			if err := r.Start(); err == nil {
-				t.Fatal("Start accepted an invalid routing script")
-			}
-		})
-	}
-}
-
-func TestRouterScriptRouting(t *testing.T) {
-	var dnsCalls atomic.Int32
-	d := &luaRouteDNSClient{lookup: func(string, featureDNS.IPOption) ([]net.IP, uint32, error) {
-		dnsCalls.Add(1)
-		return []net.IP{{1, 2, 3, 4}}, 60, nil
-	}}
-	r := startLuaRouter(t, `
-function HandleRoute(ctx, inbound)
-    if inbound == "miss" then return nil end
-    return "lua-out", "lua-rule"
-end`, d, &Config{
-		DomainStrategy: Config_IpOnDemand,
-		Rule: []*RoutingRule{{
-			TargetTag: &RoutingRule_Tag{Tag: "json-out"},
-			Networks:  []net.Network{net.Network_TCP},
-		}},
-	})
-	ctx := newLuaRouteTestContext()
-	ctx.Content.SkipDNSResolve = false
-	route, err := r.PickRoute(ctx)
-	if err != nil || route.GetOutboundTag() != "lua-out" || route.GetRuleTag() != "lua-rule" || route.(*Route).Context != ctx {
-		t.Fatalf("route = %v, %v", route, err)
-	}
-	ctx.Inbound.Tag = "miss"
-	if route, err := r.PickRoute(ctx); route != nil || err != common.ErrNoClue {
-		t.Fatalf("miss = %v, %v", route, err)
-	}
-	if dnsCalls.Load() != 0 {
-		t.Fatal("script routing implicitly resolved DNS")
-	}
-}
-
-func TestRouterScriptModules(t *testing.T) {
-	ips := []net.IP{{127, 0, 0, 7}}
-	calls := 0
-	d := &luaRouteDNSClient{lookup: func(domain string, option featureDNS.IPOption) ([]net.IP, uint32, error) {
-		calls++
-		if domain != "MiXeD.Example." || !option.IPv4Enable || option.IPv6Enable || !option.FakeEnable {
-			t.Fatalf("dns.Query arguments = %q, %+v", domain, option)
-		}
-		return ips, 17, nil
-	}}
-	r := startLuaRouter(t, `
-local dns = require("xray.dns")
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.0/8")
-assert(dns.Servers == nil and type(dns.Query) == "function")
-assert(type(require("xray.log").Info) == "function")
-function HandleRoute(ctx, inbound, sourcePort, targetPort, localPort, domain)
-    local ips, ttl, err = dns.Query(domain, true, false, true)
-    assert(not err and ttl == 17)
-    assert(matcher:AnyMatch(ips) and matcher:AnyMatch(ctx:GetTargetIPs()))
-    return "out"
-end`, d, nil)
-	if _, err := r.PickRoute(newLuaRouteTestContext()); err != nil {
-		t.Fatal(err)
-	}
-	if calls != 1 {
-		t.Fatalf("DNS calls = %d, want 1", calls)
-	}
-}
-
-func TestRouterScriptBalancerReload(t *testing.T) {
-	config := func(tag string) *Config {
-		return &Config{BalancingRule: []*BalancingRule{{
-			Tag: "balance", Strategy: "roundrobin", OutboundSelector: []string{tag},
-		}}}
-	}
-	r := startLuaRouter(t, `
-local router = require("xray.router")
-function HandleRoute()
-    local tag, err = router:PickOutbound("balance")
-    return tag, "balanced", err
-end`, nil, config("old"))
-	pick := func(want string) {
-		t.Helper()
-		route, err := r.PickRoute(&routing_session.Context{})
-		if err != nil || route.GetOutboundTag() != want || route.GetRuleTag() != "balanced" {
-			t.Fatalf("route = %v, %v, want %q", route, err, want)
-		}
-	}
-
-	pick("old")
-	if err := r.SetOverrideTarget("balance", "override"); err != nil {
-		t.Fatal(err)
-	}
-	pick("override")
-	if err := r.SetOverrideTarget("balance", ""); err != nil {
-		t.Fatal(err)
-	}
-	if err := r.ReloadRules(config("new"), false); err != nil {
-		t.Fatal(err)
-	}
-	pick("new")
-}
-
-func TestRouterScriptConcurrentBalancerReload(t *testing.T) {
-	config := func(tag string) *Config {
-		return &Config{BalancingRule: []*BalancingRule{{
-			Tag: "balance", Strategy: "roundrobin", OutboundSelector: []string{tag},
-		}}}
-	}
-	r := startLuaRouter(t, `
-local router = require("xray.router")
-function HandleRoute()
-    local tag, err = router:PickOutbound("balance")
-    return tag, nil, err
-end`, nil, config("a"))
-
-	var wg sync.WaitGroup
-	for range 4 {
-		wg.Go(func() {
-			for range 20 {
-				route, err := r.PickRoute(&routing_session.Context{})
-				if err != nil {
-					t.Errorf("PickRoute: %v", err)
-					return
-				}
-				if tag := route.GetOutboundTag(); tag != "a" && tag != "b" {
-					t.Errorf("unexpected tag %q", tag)
-				}
-			}
-		})
-	}
-	wg.Go(func() {
-		for range 20 {
-			for _, tag := range []string{"a", "b"} {
-				if err := r.ReloadRules(config(tag), false); err != nil {
-					t.Error(err)
-					return
-				}
-			}
-		}
-	})
-	wg.Wait()
-}
-
-func TestRouterScriptStateReuse(t *testing.T) {
-	r := startLuaRouter(t, `
-local calls = 0
-function HandleRoute(ctx, inbound)
-    calls = calls + 1
-    if inbound == "miss" then return nil end
-    if inbound == "fail" then error("failed") end
-    return tostring(calls)
-end`, nil, nil)
-	ctx := newLuaRouteTestContext()
-	pick := func(want string) {
-		t.Helper()
-		route, err := r.PickRoute(ctx)
-		if err != nil || route.GetOutboundTag() != want {
-			t.Fatalf("route = %v, %v, want %q", route, err, want)
-		}
-	}
-
-	pick("1")
-	ctx.Inbound.Tag = "miss"
-	if _, err := r.PickRoute(ctx); err != common.ErrNoClue {
-		t.Fatalf("miss = %v", err)
-	}
-	ctx.Inbound.Tag = "in"
-	pick("3")
-	ctx.Inbound.Tag = "fail"
-	if _, err := r.PickRoute(ctx); err == nil {
-		t.Fatal("script error was ignored")
-	}
-	ctx.Inbound.Tag = "in"
-	pick("1")
-}
-
-func TestRouterScriptDNSDispatcherReentry(t *testing.T) {
-	conn, err := stdnet.ListenPacket("udp4", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	port := conn.LocalAddr().(*stdnet.UDPAddr).Port
-	ready, stopped := make(chan struct{}), make(chan error, 1)
-	var queries atomic.Int32
-	server := &wireDNS.Server{
-		PacketConn: conn,
-		NotifyStartedFunc: func() {
-			close(ready)
-		},
-		Handler: wireDNS.HandlerFunc(func(w wireDNS.ResponseWriter, query *wireDNS.Msg) {
-			queries.Add(1)
-			response := new(wireDNS.Msg).SetReply(query)
-			for _, question := range query.Question {
-				if question.Name == "nested.example." && question.Qtype == wireDNS.TypeA {
-					response.Answer = append(response.Answer, &wireDNS.A{
-						Hdr: wireDNS.RR_Header{Name: question.Name, Rrtype: wireDNS.TypeA, Class: wireDNS.ClassINET, Ttl: 60},
-						A:   stdnet.IP{127, 0, 0, 7},
-					})
-				}
-			}
-			if err := w.WriteMsg(response); err != nil {
-				t.Error(err)
-			}
-		}),
-	}
-	go func() { stopped <- server.ActivateAndServe() }()
-	defer func() {
-		server.Shutdown()
-		select {
-		case err := <-stopped:
-			if err != nil {
-				t.Error(err)
-			}
-		case <-time.After(3 * time.Second):
-			t.Error("DNS server did not stop")
-		}
-	}()
-	select {
-	case <-ready:
-	case err := <-stopped:
-		t.Fatalf("DNS server startup: %v", err)
-	case <-time.After(3 * time.Second):
-		t.Fatal("DNS server did not start")
-	}
-
-	dnsScript := writeRouteScript(t, `
-local server = require("xray.dns").Servers[1]
-function HandleDNSQuery(domain, ipv4, ipv6, fake)
-    return server:Query(domain, ipv4, ipv6, fake)
-end`)
-	routerScript := writeRouteScript(t, `
-local router = require("xray.router")
-local dns = require("xray.dns")
-local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.7")
-local active = false
-function HandleRoute(ctx, inbound, sourcePort, targetPort, localPort, domain, network,
-    protocol, user, vlessRoute, skipDNSResolve)
-    assert(not active, "borrowed Router VM reentered")
-    if inbound == "dns" then
-        assert(network == router.NetworkUDP and skipDNSResolve == false)
-        return "direct", "dns-route"
-    end
-    active = true
-    local ips, ttl, err = dns.Query("nested.example", true, false, false)
-    assert(not err and matcher:AnyMatch(ips) and active)
-    active = false
-    return "direct", "outer-route"
-end`)
-	instance, err := core.New(&core.Config{
-		App: []*serial.TypedMessage{
-			serial.ToTypedMessage(&appdns.Config{
-				Tag: "dns", Script: dnsScript, DisableCache: true,
-				NameServer: []*appdns.NameServer{{
-					Id: "upstream", TimeoutMs: 1000,
-					Address: &net.Endpoint{
-						Network: net.Network_UDP,
-						Address: &net.IPOrDomain{Address: &net.IPOrDomain_Ip{Ip: []byte{127, 0, 0, 1}}},
-						Port:    uint32(port),
-					},
-				}},
-			}),
-			serial.ToTypedMessage(&Config{Script: routerScript}),
-			serial.ToTypedMessage(&dispatcher.Config{}),
-			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
-		},
-		Outbound: []*core.OutboundHandlerConfig{
-			{Tag: "default", ProxySettings: serial.ToTypedMessage(&blackhole.Config{})},
-			{Tag: "direct", ProxySettings: serial.ToTypedMessage(&freedom.Config{
-				FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}},
-			})},
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer instance.Close()
-	if err := instance.Start(); err != nil {
-		t.Fatal(err)
-	}
-	r := instance.GetFeature(routing.RouterType()).(*Router)
-	route, err := r.PickRoute(newLuaRouteTestContext())
-	if err != nil || route.GetOutboundTag() != "direct" || route.GetRuleTag() != "outer-route" {
-		t.Fatalf("nested DNS routing = %v, %v", route, err)
-	}
-	if queries.Load() == 0 {
-		t.Fatal("DNS query did not pass through the dispatcher")
-	}
-}

app/router/webhook.go

@@ -8,7 +8,6 @@ import (
 	"net"
 	"net/http"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -41,7 +40,6 @@ type WebhookNotifier struct {
 	deduplication uint32
 	client        *http.Client
 	seen          sync.Map
-	lastSweep     atomic.Int64
 	done          chan struct{}
 	wg            sync.WaitGroup
 	closeOnce     sync.Once
@@ -79,6 +77,11 @@ func NewWebhookNotifier(cfg *WebhookConfig) (*WebhookNotifier, error) {
 		}
 	}
 
+	if h.deduplication > 0 {
+		h.wg.Add(1)
+		go h.cleanupLoop()
+	}
+
 	return h, nil
 }
 
@@ -198,7 +201,6 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	}
 	ttl := time.Duration(h.deduplication) * time.Second
 	now := time.Now()
-	h.maybeSweep(now, ttl)
 	if v, loaded := h.seen.LoadOrStore(email, now); loaded {
 		if now.Sub(v.(time.Time)) < ttl {
 			return true
@@ -208,23 +210,27 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	return false
 }
 
-func (h *WebhookNotifier) maybeSweep(now time.Time, ttl time.Duration) {
-	last := h.lastSweep.Load()
-	if now.UnixNano()-last < int64(ttl) {
-		return
-	}
-	if !h.lastSweep.CompareAndSwap(last, now.UnixNano()) {
-		return // another goroutine did the sweep
-	}
-	h.seen.Range(func(key, value any) bool {
-		if now.Sub(value.(time.Time)) >= ttl {
-			h.seen.Delete(key)
+func (h *WebhookNotifier) cleanupLoop() {
+	defer h.wg.Done()
+	ttl := time.Duration(h.deduplication) * time.Second
+	ticker := time.NewTicker(ttl)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-h.done:
+			return
+		case <-ticker.C:
+			now := time.Now()
+			h.seen.Range(func(key, value any) bool {
+				if now.Sub(value.(time.Time)) >= ttl {
+					h.seen.Delete(key)
+				}
+				return true
+			})
 		}
-		return true
-	})
+	}
 }
 
-// Only need to call if the Notifier is really used, otherwise GC can clean it
 func (h *WebhookNotifier) Close() error {
 	h.closeOnce.Do(func() {
 		close(h.done)

app/stats/stats.go

@@ -48,20 +48,6 @@ func (m *Manager) RegisterCounter(name string) (stats.Counter, error) {
 	return c, nil
 }
 
-// GetOrRegisterCounter implements stats.Manager.
-func (m *Manager) GetOrRegisterCounter(name string) (stats.Counter, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.counters[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new counter ", name)
-	c := new(Counter)
-	m.counters[name] = c
-	return c, nil
-}
-
 // UnregisterCounter implements stats.Manager.
 func (m *Manager) UnregisterCounter(name string) error {
 	m.access.Lock()
@@ -111,20 +97,6 @@ func (m *Manager) RegisterOnlineMap(name string) (stats.OnlineMap, error) {
 	return om, nil
 }
 
-// GetOrRegisterOnlineMap implements stats.Manager.
-func (m *Manager) GetOrRegisterOnlineMap(name string) (stats.OnlineMap, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if om, found := m.onlineMaps[name]; found {
-		return om, nil
-	}
-	errors.LogDebug(context.Background(), "create new OnlineMap ", name)
-	om := NewOnlineMap()
-	m.onlineMaps[name] = om
-	return om, nil
-}
-
 // UnregisterOnlineMap implements stats.Manager.
 func (m *Manager) UnregisterOnlineMap(name string) error {
 	m.access.Lock()
@@ -177,26 +149,6 @@ func (m *Manager) RegisterChannel(name string) (stats.Channel, error) {
 	return c, nil
 }
 
-// GetOrRegisterChannel implements stats.Manager.
-func (m *Manager) GetOrRegisterChannel(name string) (stats.Channel, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.channels[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new channel ", name)
-	c := NewChannel(&ChannelConfig{BufferSize: 64, Blocking: false})
-	if m.running {
-		// Start before publishing so no goroutine can observe an unstarted channel.
-		if err := c.Start(); err != nil {
-			return nil, err
-		}
-	}
-	m.channels[name] = c
-	return c, nil
-}
-
 // UnregisterChannel implements stats.Manager.
 func (m *Manager) UnregisterChannel(name string) error {
 	m.access.Lock()

common/buf/io.go

@@ -122,7 +122,7 @@ func NewReader(reader io.Reader) Reader {
 	}
 
 	_, isFile := reader.(*os.File)
-	if !isFile && useReadV() {
+	if !isFile && useReadv {
 		if sc, ok := reader.(syscall.Conn); ok {
 			rawConn, err := sc.SyscallConn()
 			if err != nil {

common/buf/readv_reader.go

@@ -5,7 +5,6 @@ package buf
 
 import (
 	"io"
-	"sync/atomic"
 	"syscall"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -144,24 +143,13 @@ func (r *ReadVReader) ReadMultiBuffer() (MultiBuffer, error) {
 	return mb, nil
 }
 
-var useReadv atomic.Bool
-
-func useReadV() bool {
-	return useReadv.Load()
-}
-
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
-	enabled := false
-	switch value {
-	case defaultFlagValue, "auto", "enable":
-		enabled = true
-	}
-	useReadv.Store(enabled)
-	return nil
-}
+var useReadv bool
 
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
+	switch value {
+	case defaultFlagValue, "auto", "enable":
+		useReadv = true
+	}
 }

common/buf/readv_reader_stub.go

@@ -10,9 +10,7 @@ import (
 	"github.com/xtls/xray-core/features/stats"
 )
 
-func useReadV() bool {
-	return false
-}
+const useReadv = false
 
 func NewReadVReader(reader io.Reader, rawConn syscall.RawConn, counter stats.Counter) Reader {
 	panic("not implemented")

common/buf/readv_windows.go

@@ -5,8 +5,7 @@ import (
 )
 
 type windowsReader struct {
-	bufs  []syscall.WSABuf
-	ready bool
+	bufs []syscall.WSABuf
 }
 
 func (r *windowsReader) Init(bs []*Buffer) {
@@ -16,7 +15,6 @@ func (r *windowsReader) Init(bs []*Buffer) {
 	for _, b := range bs {
 		r.bufs = append(r.bufs, syscall.WSABuf{Len: uint32(Size), Buf: &b.v[0]})
 	}
-	r.ready = false
 }
 
 func (r *windowsReader) Clear() {
@@ -27,14 +25,6 @@ func (r *windowsReader) Clear() {
 }
 
 func (r *windowsReader) Read(fd uintptr) int32 {
-	// On the first invocation, we return -1 to indicate "not ready"
-	// to make rawConn.Read wait for readability using the runtime's own mechanism
-	// because syscall.WSARecv() is a blocking call when used with nil OVERLAPPED
-	if !r.ready {
-		r.ready = true
-		return -1
-	}
-
 	var nBytes uint32
 	var flags uint32
 	err := syscall.WSARecv(syscall.Handle(fd), &r.bufs[0], uint32(len(r.bufs)), &nBytes, &flags, nil, nil)

common/buf/writer.go

@@ -118,9 +118,7 @@ func (w *BufferedWriter) Write(b []byte) (int, error) {
 
 		nBytes, err := w.buffer.Write(b)
 		totalBytes += nBytes
-
-		// ErrBufferFull means a partial write, so flush below and continue
-		if err != nil && err != ErrBufferFull {
+		if err != nil {
 			return totalBytes, err
 		}
 		if !w.buffered || w.buffer.IsFull() {

common/crypto/crypto.go

@@ -10,12 +10,12 @@ import (
 
 // [,)
 func RandBetween(from int64, to int64) int64 {
+	if from == to {
+		return from
+	}
 	if from > to {
 		from, to = to, from
 	}
-	if d := to - from; d == 0 || d == 1 {
-		return from
-	}
 	bigInt, _ := rand.Int(rand.Reader, big.NewInt(to-from))
 	return from + bigInt.Int64()
 }

common/geodata/lua.go

@@ -1,58 +0,0 @@
-package geodata
-
-import (
-	lua "github.com/yuin/gopher-lua"
-	luar "layeh.com/gopher-luar"
-)
-
-// RegisterLua makes xray.geodata available to require in an LState.
-func RegisterLua(L *lua.LState) {
-	L.PreloadModule("xray.geodata", func(L *lua.LState) int {
-		module := L.NewTable()
-
-		module.RawSetString("BuildDomainMatcher", L.NewFunction(func(L *lua.LState) int {
-			parsed, err := ParseDomainRules(luaRules(L), Domain_Domain)
-			if err != nil {
-				L.RaiseError("%v", err)
-				return 0
-			}
-			matcher, err := DomainReg.BuildDomainMatcher(parsed)
-			if err != nil {
-				L.RaiseError("%v", err)
-				return 0
-			}
-			L.Push(luar.New(L, matcher))
-			return 1
-		}))
-
-		module.RawSetString("BuildIPMatcher", L.NewFunction(func(L *lua.LState) int {
-			parsed, err := ParseIPRules(luaRules(L))
-			if err != nil {
-				L.RaiseError("%v", err)
-				return 0
-			}
-			matcher, err := IPReg.BuildIPMatcher(parsed)
-			if err != nil {
-				L.RaiseError("%v", err)
-				return 0
-			}
-			L.Push(luar.New(L, matcher))
-			return 1
-		}))
-		L.Push(module)
-		return 1
-	})
-}
-
-func luaRules(L *lua.LState) []string {
-	rules := make([]string, L.GetTop())
-	for i := range rules {
-		value, ok := L.Get(i + 1).(lua.LString)
-		if !ok {
-			L.RaiseError("geodata rules must be strings")
-			return nil
-		}
-		rules[i] = string(value)
-	}
-	return rules
-}

common/geodata/lua_test.go

@@ -1,66 +0,0 @@
-package geodata
-
-import (
-	"testing"
-
-	"github.com/xtls/xray-core/common/net"
-	lua "github.com/yuin/gopher-lua"
-)
-
-func TestLuaIPMatcher(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	RegisterLua(L)
-	ip := L.NewUserData()
-	ip.Value = net.ParseIP("127.0.0.1")
-	L.SetGlobal("ip", ip)
-	ips := L.NewUserData()
-	ips.Value = []net.IP{ip.Value.(net.IP), net.ParseIP("8.8.8.8")}
-	L.SetGlobal("ips", ips)
-	if err := L.DoString(`
-		local matcher = require("xray.geodata").BuildIPMatcher("127.0.0.0/8", "::1")
-		assert(matcher:Match(ip))
-		assert(matcher:AnyMatch(ips))
-		assert(not matcher:Matches(ips))
-		local matched, unmatched = matcher:FilterIPs(ips)
-		assert(type(matched) == "userdata" and type(unmatched) == "userdata")
-		assert(#matched == 1 and #unmatched == 1)
-	`); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestLuaDomainMatcher(t *testing.T) {
-	L := lua.NewState()
-	defer L.Close()
-	RegisterLua(L)
-	if err := L.DoString(`
-		local matcher = require("xray.geodata").BuildDomainMatcher("example.com", "full:other.com")
-		assert(matcher:MatchAny("example.com"))
-		assert(matcher:MatchAny("www.example.com"))
-		assert(matcher:MatchAny("other.com"))
-		assert(not matcher:MatchAny("www.other.com"))
-		assert(#(matcher:Match("www.example.com")) == 1)
-	`); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestLuaMatchersRejectInvalidRules(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		script string
-	}{
-		{"IP rule", `require("xray.geodata").BuildIPMatcher("not-an-ip")`},
-		{"non-string domain rule", `require("xray.geodata").BuildDomainMatcher("example.com", true)`},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			L := lua.NewState()
-			defer L.Close()
-			RegisterLua(L)
-			if err := L.DoString(tc.script); err == nil {
-				t.Fatal("invalid geodata rule was accepted")
-			}
-		})
-	}
-}

common/log/lua.go

@@ -1,50 +0,0 @@
-package log
-
-import (
-	"path/filepath"
-	"strings"
-
-	lua "github.com/yuin/gopher-lua"
-)
-
-// RegisterLua makes xray.log available to require in an LState.
-func RegisterLua(L *lua.LState) {
-	L.PreloadModule("xray.log", func(L *lua.LState) int {
-		module := L.NewTable()
-		for name, severity := range map[string]Severity{
-			"Debug":   Severity_Debug,
-			"Info":    Severity_Info,
-			"Warning": Severity_Warning,
-			"Error":   Severity_Error,
-		} {
-			module.RawSetString(name, L.NewFunction(func(L *lua.LState) int {
-				var content strings.Builder
-				// Prefix with the calling script's filename.
-				if caller, ok := L.GetStack(1); ok {
-					if _, err := L.GetInfo("S", caller, lua.LNil); err == nil && caller.Source != "" {
-						content.WriteString(filepath.Base(strings.TrimPrefix(caller.Source, "@")))
-						content.WriteString(": ")
-					}
-				}
-				for i := 1; i <= L.GetTop(); i++ {
-					value := L.Get(i)
-					// Use Error() for Go errors in userdata.
-					if ud, ok := value.(*lua.LUserData); ok {
-						if err, ok := ud.Value.(error); ok {
-							content.WriteString(err.Error())
-							continue
-						}
-					}
-					content.WriteString(L.ToStringMeta(value).String())
-				}
-				Record(&GeneralMessage{
-					Severity: severity,
-					Content:  content.String(),
-				})
-				return 0
-			}))
-		}
-		L.Push(module)
-		return 1
-	})
-}

common/log/lua_test.go

@@ -1,92 +0,0 @@
-package log
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	lua "github.com/yuin/gopher-lua"
-)
-
-type luaLogHandler struct {
-	messages []Message
-}
-
-func (h *luaLogHandler) Handle(msg Message) {
-	h.messages = append(h.messages, msg)
-}
-
-func TestLuaLog(t *testing.T) {
-	logHandler.RLock()
-	previous := logHandler.Handler
-	logHandler.RUnlock()
-	t.Cleanup(func() { RegisterHandler(previous) })
-	handler := &luaLogHandler{}
-	RegisterHandler(handler)
-
-	L := lua.NewState()
-	defer L.Close()
-	RegisterLua(L)
-	nativeError := L.NewUserData()
-	nativeError.Value = fmt.Errorf("lookup failed: %w", errors.New("upstream timeout"))
-	L.SetGlobal("nativeError", nativeError)
-	path := filepath.Join(t.TempDir(), "logging.lua")
-	if err := os.WriteFile(path, []byte(`
-		local log = require("xray.log")
-		assert(log == require("xray.log"))
-		log.Debug("query: ", "example.com")
-		log.Info("count=", 42, ", enabled=", true, ", value=", nil)
-		log.Warning(setmetatable({}, {
-			__tostring = function() return "fallback" end
-		}))
-		assert(select("#", log.Error("failed")) == 0)
-		log.Error("DNS failed: ", nativeError)
-		log.Warning(nativeError)
-		local ok, err = pcall(function() error("Lua failure", 0) end)
-		assert(not ok)
-		log.Error(err)
-		function logHook()
-			log.Info("hook")
-		end
-	`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := L.DoFile(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := L.DoString(`
-		logHook()
-		require("xray.log").Info("anonymous")
-	`); err != nil {
-		t.Fatal(err)
-	}
-
-	want := []struct {
-		severity Severity
-		message  string
-	}{
-		{Severity_Debug, "[Debug] logging.lua: query: example.com"},
-		{Severity_Info, "[Info] logging.lua: count=42, enabled=true, value=nil"},
-		{Severity_Warning, "[Warning] logging.lua: fallback"},
-		{Severity_Error, "[Error] logging.lua: failed"},
-		{Severity_Error, "[Error] logging.lua: DNS failed: lookup failed: upstream timeout"},
-		{Severity_Warning, "[Warning] logging.lua: lookup failed: upstream timeout"},
-		{Severity_Error, "[Error] logging.lua: Lua failure"},
-		{Severity_Info, "[Info] logging.lua: hook"},
-		{Severity_Info, "[Info] <string>: anonymous"},
-	}
-	if len(handler.messages) != len(want) {
-		t.Fatalf("logged %d messages, want %d", len(handler.messages), len(want))
-	}
-	for i, expected := range want {
-		msg, ok := handler.messages[i].(*GeneralMessage)
-		if !ok {
-			t.Fatalf("message %d has type %T, want *GeneralMessage", i, handler.messages[i])
-		}
-		if msg.Severity != expected.severity || msg.String() != expected.message {
-			t.Errorf("message %d = %q with severity %v, want %q with severity %v", i, msg.String(), msg.Severity, expected.message, expected.severity)
-		}
-	}
-}

common/lua/pool.go

@@ -1,138 +0,0 @@
-package lua
-
-import (
-	"context"
-	"errors"
-	"sync"
-
-	glua "github.com/yuin/gopher-lua"
-)
-
-const maxIdleStates = 16
-
-// LStateFactory must initialize a state fully and observe ctx while doing so.
-// The pool owns any non-nil state it returns, even when it also returns an error.
-type LStateFactory func(ctx context.Context) (*glua.LState, error)
-
-// Pool lends each state to one caller at a time. It grows on contention and
-// keeps up to maxIdleStates idle states until Close. Callers decide whether a
-// state is reusable.
-type Pool struct {
-	ctx    context.Context
-	cancel context.CancelFunc
-
-	factory LStateFactory
-	idle    []*glua.LState
-
-	mu     sync.Mutex
-	active sync.WaitGroup
-	closed bool
-}
-
-// NewPool initializes one state before returning, so top-level errors surface at startup.
-func NewPool(ctx context.Context, factory LStateFactory) (*Pool, error) {
-	poolCtx, cancel := context.WithCancel(ctx)
-
-	// Create one state now to catch factory errors at startup.
-	state, err := factory(poolCtx)
-	if err != nil {
-		cancel()
-		if state != nil {
-			state.Close()
-		}
-		return nil, err
-	}
-	if state == nil {
-		cancel()
-		return nil, errors.New("Lua state factory returned nil")
-	}
-	if err := poolCtx.Err(); err != nil {
-		state.Close()
-		cancel()
-		return nil, err
-	}
-
-	return &Pool{ctx: poolCtx, cancel: cancel, factory: factory, idle: []*glua.LState{state}}, nil
-}
-
-// Context is cancelled by Close. Query contexts should derive from it.
-func (p *Pool) Context() context.Context {
-	return p.ctx
-}
-
-// Acquire returns an initialized exclusive state, growing the pool if necessary.
-func (p *Pool) Acquire() (*glua.LState, error) {
-	p.mu.Lock()
-	if p.closed || p.ctx.Err() != nil {
-		p.mu.Unlock()
-		return nil, p.ctx.Err()
-	}
-
-	p.active.Add(1)
-
-	n := len(p.idle)
-	if n != 0 {
-		state := p.idle[n-1]
-		p.idle = p.idle[:n-1]
-		p.mu.Unlock()
-		return state, nil
-	}
-	p.mu.Unlock()
-
-	// TODO: Limit the total number of states. When the limit is reached, wait
-	// for a Release instead of creating another state; allow the wait to be
-	// cancelled by the caller or by Close.
-	state, err := p.factory(p.ctx)
-	if err == nil && state == nil {
-		err = errors.New("Lua state factory returned nil")
-	}
-	if err != nil {
-		if state != nil {
-			state.Close()
-		}
-		p.active.Done()
-		return nil, err
-	}
-	if err := p.ctx.Err(); err != nil {
-		state.Close()
-		p.active.Done()
-		return nil, err
-	}
-
-	return state, nil
-}
-
-// Release returns a healthy state to the pool and closes a failed or cancelled one.
-func (p *Pool) Release(state *glua.LState, reusable bool) {
-	if reusable {
-		p.mu.Lock()
-		if !p.closed && p.ctx.Err() == nil && len(p.idle) < maxIdleStates {
-			p.idle = append(p.idle, state)
-		} else {
-			reusable = false
-		}
-		p.mu.Unlock()
-	}
-
-	if !reusable {
-		state.Close()
-	}
-
-	p.active.Done()
-}
-
-// Close cancels active work, closes idle states, and waits for borrowed states.
-func (p *Pool) Close() {
-	p.mu.Lock()
-	if !p.closed {
-		p.closed = true
-		p.cancel()
-		for _, state := range p.idle {
-			state.Close()
-		}
-		p.idle = nil
-	}
-	p.mu.Unlock()
-
-	p.active.Wait()
-}

common/lua/pool_test.go

@@ -1,197 +0,0 @@
-package lua
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	glua "github.com/yuin/gopher-lua"
-)
-
-func TestPoolFactoryFailureClosesReturnedState(t *testing.T) {
-	failure := errors.New("factory failed")
-	state := glua.NewState()
-	_, err := NewPool(context.Background(), func(context.Context) (*glua.LState, error) {
-		return state, failure
-	})
-	if !errors.Is(err, failure) || !state.IsClosed() {
-		t.Fatalf("NewPool error = %v, state closed = %t", err, state.IsClosed())
-	}
-
-	var failedState *glua.LState
-	calls := 0
-	pool, err := NewPool(context.Background(), func(context.Context) (*glua.LState, error) {
-		calls++
-		if calls == 1 {
-			return glua.NewState(), nil
-		}
-		failedState = glua.NewState()
-		return failedState, failure
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer pool.Close()
-	borrowed, err := pool.Acquire()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer pool.Release(borrowed, true)
-	_, err = pool.Acquire()
-	if !errors.Is(err, failure) || !failedState.IsClosed() {
-		t.Fatalf("Acquire error = %v, state closed = %t", err, failedState.IsClosed())
-	}
-}
-
-func TestPoolReusesStatesAndLimitsIdle(t *testing.T) {
-	created := 0
-	pool, err := NewPool(context.Background(), func(context.Context) (*glua.LState, error) {
-		created++
-		return glua.NewState(), nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer pool.Close()
-
-	states := make([]*glua.LState, maxIdleStates+3)
-	for i := range states {
-		states[i], err = pool.Acquire()
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, state := range states {
-		pool.Release(state, true)
-	}
-	for i, state := range states {
-		if got, want := state.IsClosed(), i >= maxIdleStates; got != want {
-			t.Fatalf("state %d closed = %t, want %t", i, got, want)
-		}
-	}
-	borrowed, err := pool.Acquire()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if created != len(states) {
-		t.Fatalf("Acquire created %d states, want %d", created, len(states))
-	}
-	pool.Release(borrowed, true)
-}
-
-func TestPoolCloseCancelsAndWaitsForBorrowedState(t *testing.T) {
-	pool, err := NewPool(context.Background(), func(context.Context) (*glua.LState, error) {
-		return glua.NewState(), nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	state, err := pool.Acquire()
-	if err != nil {
-		t.Fatal(err)
-	}
-	done := make(chan struct{})
-	go func() {
-		pool.Close()
-		close(done)
-	}()
-	select {
-	case <-pool.Context().Done():
-	case <-time.After(time.Second):
-		pool.Release(state, false)
-		t.Fatal("Close did not cancel the pool context")
-	}
-	select {
-	case <-done:
-		pool.Release(state, false)
-		t.Fatal("Close returned while a state was borrowed")
-	default:
-	}
-	pool.Release(state, true)
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("Close did not finish after Release")
-	}
-	if !state.IsClosed() {
-		t.Fatal("borrowed state was not closed")
-	}
-	if _, err := pool.Acquire(); !errors.Is(err, context.Canceled) {
-		t.Fatalf("Acquire after Close = %v, want context.Canceled", err)
-	}
-	pool.Close()
-}
-
-func TestPoolCloseCancelsStateCreation(t *testing.T) {
-	started := make(chan struct{})
-	first := true
-	pool, err := NewPool(context.Background(), func(ctx context.Context) (*glua.LState, error) {
-		if first {
-			first = false
-			return glua.NewState(), nil
-		}
-		close(started)
-		<-ctx.Done()
-		return nil, ctx.Err()
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	borrowed, err := pool.Acquire()
-	if err != nil {
-		t.Fatal(err)
-	}
-	acquireDone := make(chan error, 1)
-	go func() {
-		_, err := pool.Acquire()
-		acquireDone <- err
-	}()
-	<-started
-	closeDone := make(chan struct{})
-	go func() {
-		pool.Close()
-		close(closeDone)
-	}()
-	select {
-	case err := <-acquireDone:
-		if !errors.Is(err, context.Canceled) {
-			t.Fatalf("Acquire during Close = %v, want context.Canceled", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("state creation did not stop after Close")
-	}
-	select {
-	case <-closeDone:
-		pool.Release(borrowed, false)
-		t.Fatal("Close returned while the initial state was borrowed")
-	default:
-	}
-	pool.Release(borrowed, true)
-	select {
-	case <-closeDone:
-	case <-time.After(time.Second):
-		t.Fatal("Close did not finish after Release")
-	}
-}
-
-func BenchmarkPoolAcquireRelease(b *testing.B) {
-	pool, err := NewPool(context.Background(), func(context.Context) (*glua.LState, error) {
-		return glua.NewState(), nil
-	})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer pool.Close()
-
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		state, err := pool.Acquire()
-		if err != nil {
-			b.Fatal(err)
-		}
-		pool.Release(state, true)
-	}
-	b.StopTimer()
-}

common/lua/program.go

@@ -1,56 +0,0 @@
-// Package lua provides shared GopherLua programs and state management for Xray scripts.
-package lua
-
-import (
-	"bufio"
-	"context"
-	"os"
-
-	glua "github.com/yuin/gopher-lua"
-	"github.com/yuin/gopher-lua/parse"
-)
-
-// Program holds immutable bytecode that can be run by independent LStates.
-type Program struct {
-	proto *glua.FunctionProto
-}
-
-// CompileFile reads and compiles a Lua file once.
-func CompileFile(path string) (*Program, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	chunk, err := parse.Parse(bufio.NewReader(f), path)
-	if err != nil {
-		return nil, err
-	}
-	proto, err := glua.Compile(chunk, path)
-	if err != nil {
-		return nil, err
-	}
-	return &Program{proto: proto}, nil
-}
-
-// NewState creates a VM, makes modules available, and executes the file top level.
-// Module loaders run only when Lua calls require. Each state gets its own globals.
-// The caller owns the returned state.
-func (p *Program) NewState(ctx context.Context, register func(*glua.LState)) (*glua.LState, error) {
-	L := glua.NewState()
-	if register != nil {
-		register(L)
-	}
-	L.SetContext(ctx)
-	L.Push(L.NewFunctionFromProto(p.proto))
-	err := L.PCall(0, 0, nil)
-	L.RemoveContext()
-	if err == nil {
-		err = ctx.Err()
-	}
-	if err != nil {
-		L.Close()
-		return nil, err
-	}
-	return L, nil
-}

common/lua/program_test.go

@@ -1,55 +0,0 @@
-package lua
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	glua "github.com/yuin/gopher-lua"
-)
-
-func TestProgramStatesAreIndependent(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "state.lua")
-	if err := os.WriteFile(path, []byte("value = (value or 0) + 1"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	program, err := CompileFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	first, err := program.NewState(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer first.Close()
-	first.SetGlobal("value", glua.LNumber(42))
-	second, err := program.NewState(context.Background(), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer second.Close()
-	if got := second.GetGlobal("value"); got != glua.LNumber(1) {
-		t.Fatalf("second state value = %v, want 1", got)
-	}
-}
-
-func TestProgramInitializationObservesCancellation(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "loop.lua")
-	if err := os.WriteFile(path, []byte("while true do end"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	program, err := CompileFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	state, err := program.NewState(ctx, nil)
-	if err == nil || state != nil {
-		if state != nil {
-			state.Close()
-		}
-		t.Fatalf("NewState with canceled context = %v, %v; want nil state and error", state, err)
-	}
-}

common/net/find_process_darwin.go

@@ -1,4 +1,4 @@
-//go:build darwin && !ios
+//go:build darwin
 
 package net
 
@@ -198,9 +198,7 @@ func darwinSocketInfoMatchLevel(info []byte, network string, srcAddr netip.Addr,
 
 	vflag := info[darwinInSockInfoVFlagOff]
 	if srcAddr.Is4() {
-		// Dual-stack sockets expose IPv4-mapped connections as AF_INET6
-		// while marking the endpoint as IPv4 in ini_vflag.
-		if (family != unix.AF_INET && family != unix.AF_INET6) || vflag&darwinInSockInfoIPv4 == 0 {
+		if family != unix.AF_INET || vflag&darwinInSockInfoIPv4 == 0 {
 			return darwinSocketNoMatch
 		}
 	} else {

common/net/find_process_darwin.s

@@ -1,4 +1,4 @@
-//go:build darwin && !ios
+//go:build darwin
 
 #include "textflag.h"
 

common/net/find_process_darwin_test.go

@@ -1,4 +1,4 @@
-//go:build darwin && !ios
+//go:build darwin
 
 package net
 
@@ -52,57 +52,6 @@ func TestFindProcessDarwinTCP(t *testing.T) {
 	assertCurrentProcess(t, pid, name, path)
 }
 
-func TestFindProcessDarwinTCPIPv4Mapped(t *testing.T) {
-	listener, err := stdnet.Listen("tcp4", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-
-	accepted := make(chan stdnet.Conn, 1)
-	go func() {
-		conn, err := listener.Accept()
-		if err == nil {
-			accepted <- conn
-			return
-		}
-		close(accepted)
-	}()
-
-	listenerAddr := listener.Addr().(*stdnet.TCPAddr)
-	fd, err := unix.Socket(unix.AF_INET6, unix.SOCK_STREAM, unix.IPPROTO_TCP)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer unix.Close(fd)
-
-	mappedAddr := [16]byte{10: 0xff, 11: 0xff, 12: 127, 15: 1}
-	if err := unix.Connect(fd, &unix.SockaddrInet6{
-		Port: listenerAddr.Port,
-		Addr: mappedAddr,
-	}); err != nil {
-		t.Fatal(err)
-	}
-
-	serverConn := <-accepted
-	if serverConn == nil {
-		t.Fatal("server did not accept tcp connection")
-	}
-	defer serverConn.Close()
-
-	local, err := unix.Getsockname(fd)
-	if err != nil {
-		t.Fatal(err)
-	}
-	localPort := local.(*unix.SockaddrInet6).Port
-
-	pid, name, path, err := FindProcess("tcp", "127.0.0.1", uint16(localPort), "127.0.0.1", uint16(listenerAddr.Port))
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertCurrentProcess(t, pid, name, path)
-}
-
 func TestFindProcessDarwinUDP(t *testing.T) {
 	conn, err := stdnet.ListenUDP("udp", &stdnet.UDPAddr{IP: stdnet.ParseIP("127.0.0.1")})
 	if err != nil {
@@ -315,18 +264,6 @@ func TestDarwinSocketInfoMatchLevelFallbacks(t *testing.T) {
 	}
 }
 
-func TestDarwinSocketInfoMatchLevelIPv4Mapped(t *testing.T) {
-	src := netip.MustParseAddr("127.0.0.1")
-	dst := netip.MustParseAddr("203.0.113.10")
-	info := newDarwinSocketInfo("tcp", src, 12345, dst, 443)
-	writeDarwinNativeUint32(info, darwinSocketInfoFamilyOff, uint32(unix.AF_INET6))
-
-	level := darwinSocketInfoMatchLevel(info, "tcp", src, 12345, dst, 443, true)
-	if level != darwinSocketExactMatch {
-		t.Fatalf("unexpected match level: got %d, want %d", level, darwinSocketExactMatch)
-	}
-}
-
 func newDarwinSocketInfo(network string, local netip.Addr, localPort uint16, remote netip.Addr, remotePort uint16) []byte {
 	info := make([]byte, darwinSocketFDInfoSize)
 	switch network {

common/net/find_process_ios.go

@@ -1,11 +0,0 @@
-//go:build ios
-
-package net
-
-import (
-	"github.com/xtls/xray-core/common/errors"
-)
-
-func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (int, string, string, error) {
-	return 0, "", "", errors.New("process lookup is not supported on this platform")
-}

common/platform/env_reload.go

@@ -1,40 +0,0 @@
-package platform
-
-import (
-	"errors"
-	"sync"
-)
-
-var envReloadRegistry = struct {
-	sync.RWMutex
-	handlers []func() error
-}{}
-
-// RegisterEnvReload registers an environment reload handler and runs it once
-// immediately so package defaults keep the same behavior as init-time reads.
-func RegisterEnvReload(handler func() error) {
-	if handler == nil {
-		return
-	}
-	envReloadRegistry.Lock()
-	envReloadRegistry.handlers = append(envReloadRegistry.handlers, handler)
-	envReloadRegistry.Unlock()
-	if err := handler(); err != nil {
-		panic(err)
-	}
-}
-
-// ReloadEnvSettings refreshes all registered environment-backed package state.
-func ReloadEnvSettings() error {
-	envReloadRegistry.RLock()
-	handlers := append([]func() error{}, envReloadRegistry.handlers...)
-	envReloadRegistry.RUnlock()
-
-	var errs []error
-	for _, handler := range handlers {
-		if err := handler(); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}

common/platform/platform.go

@@ -1,8 +1,6 @@
 package platform // import "github.com/xtls/xray-core/common/platform"
 
 import (
-	"errors"
-	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -92,49 +90,3 @@ func GetConfDirPath() string {
 	configPath := NewEnvFlag(ConfdirLocation).GetValue(func() string { return "" })
 	return configPath
 }
-
-// ResolveLuaFile finds a local Lua script and returns its absolute path.
-// Relative paths: XRAY_LOCATION_CONFDIR > XRAY_LOCATION_CONFIG > working dir > executable dir.
-func ResolveLuaFile(path string) (string, error) {
-	if path == "" {
-		return "", errors.New("Lua file path is empty")
-	}
-	paths := []string{path}
-	if !filepath.IsAbs(path) {
-		paths = nil
-		for _, dir := range []string{
-			GetConfDirPath(),
-			NewEnvFlag(ConfigLocation).GetValue(func() string { return "" }),
-			".",
-			getExecutableDir(),
-		} {
-			if dir != "" {
-				paths = append(paths, filepath.Join(dir, path))
-			}
-		}
-	}
-	return resolveFile(paths)
-}
-
-func resolveFile(paths []string) (string, error) {
-	var tried []string
-	for _, path := range paths {
-		path, err := filepath.Abs(path)
-		if err != nil {
-			return "", fmt.Errorf("failed to resolve file path: %w", err)
-		}
-		tried = append(tried, path)
-		info, err := os.Stat(path)
-		if errors.Is(err, os.ErrNotExist) {
-			continue
-		}
-		if err != nil {
-			return "", fmt.Errorf("failed to inspect file %q: %w", path, err)
-		}
-		if !info.Mode().IsRegular() {
-			return "", fmt.Errorf("file is not a regular file: %s", path)
-		}
-		return path, nil
-	}
-	return "", fmt.Errorf("file not found; tried %q: %w", tried, os.ErrNotExist)
-}

common/platform/platform_test.go

@@ -1,7 +1,6 @@
 package platform_test
 
 import (
-	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -65,53 +64,3 @@ func TestGetAssetLocation(t *testing.T) {
 		}
 	}
 }
-
-func TestResolveLuaFile(t *testing.T) {
-	workingDir := t.TempDir()
-	t.Chdir(workingDir)
-	executable, err := os.Executable()
-	common.Must(err)
-	file, err := os.CreateTemp(filepath.Dir(executable), "lua-*.lua")
-	common.Must(err)
-	common.Must(file.Close())
-	defer os.Remove(file.Name())
-
-	name := filepath.Base(file.Name())
-	paths := []string{
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(t.TempDir(), name),
-		filepath.Join(workingDir, name),
-		file.Name(),
-	}
-	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
-	for _, path := range paths[:3] {
-		common.Must(os.WriteFile(path, nil, 0o600))
-	}
-	if got, err := ResolveLuaFile(paths[2]); err != nil || got != paths[2] {
-		t.Fatalf("absolute path = %q, %v; want %q", got, err, paths[2])
-	}
-	for i, want := range paths {
-		if i == 2 {
-			t.Setenv(ConfdirLocation, "")
-			t.Setenv(ConfigLocation, "")
-		}
-		if got, err := ResolveLuaFile(name); err != nil || got != want {
-			t.Fatalf("resolved path = %q, %v; want %q", got, err, want)
-		}
-		common.Must(os.Remove(want))
-	}
-	if _, err := ResolveLuaFile(name); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("missing file error = %v", err)
-	}
-
-	t.Setenv(ConfdirLocation, filepath.Dir(paths[0]))
-	t.Setenv(ConfigLocation, filepath.Dir(paths[1]))
-	common.Must(os.Mkdir(paths[0], 0o700))
-	common.Must(os.WriteFile(paths[1], nil, 0o600))
-	for _, path := range []string{"", name, filepath.Join(t.TempDir(), name)} {
-		if _, err := ResolveLuaFile(path); err == nil {
-			t.Fatalf("accepted invalid path %q", path)
-		}
-	}
-}

common/protocol/bittorrent/bittorrent.go

@@ -3,8 +3,11 @@ package bittorrent
 import (
 	"encoding/binary"
 	"errors"
+	"math"
+	"time"
 
 	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
 )
 
 type SniffHeader struct{}
@@ -36,44 +39,50 @@ func SniffUTP(b []byte) (*SniffHeader, error) {
 		return nil, common.ErrNoClue
 	}
 
-	// type 4 (ST_SYN), version 1
-	if b[0] != 0x41 {
+	buffer := buf.FromBytes(b)
+
+	var typeAndVersion uint8
+
+	if binary.Read(buffer, binary.BigEndian, &typeAndVersion) != nil {
+		return nil, common.ErrNoClue
+	} else if b[0]>>4&0xF > 4 || b[0]&0xF != 1 {
 		return nil, errNotBittorrent
 	}
 
-	// timestamp_difference is always 0 in new connections
-	if binary.BigEndian.Uint32(b[8:12]) != 0 {
+	var extension uint8
+
+	if binary.Read(buffer, binary.BigEndian, &extension) != nil {
+		return nil, common.ErrNoClue
+	} else if extension != 0 && extension != 1 {
 		return nil, errNotBittorrent
 	}
 
-	// Walk the extension chain. Selective ack (1) and extension bits (2)
-	extension, offset := b[1], 20
 	for extension != 0 {
-		if len(b) < offset+2 {
+		if extension != 1 {
 			return nil, errNotBittorrent
 		}
-		length := int(b[offset+1])
-		switch extension {
-		case 1: // selective ack
-			if length < 4 || length%4 != 0 {
-				return nil, errNotBittorrent
-			}
-		case 2: // extension bits: fixed 8 bytes, sent in ST_SYN by µTorrent
-			if length != 8 {
-				return nil, errNotBittorrent
-			}
-		default:
-			return nil, errNotBittorrent
+		if binary.Read(buffer, binary.BigEndian, &extension) != nil {
+			return nil, common.ErrNoClue
 		}
-		if len(b) < offset+2+length {
-			return nil, errNotBittorrent
+
+		var length uint8
+		if err := binary.Read(buffer, binary.BigEndian, &length); err != nil {
+			return nil, common.ErrNoClue
+		}
+		if common.Error2(buffer.ReadBytes(int32(length))) != nil {
+			return nil, common.ErrNoClue
 		}
-		extension = b[offset]
-		offset += 2 + length
 	}
 
-	// extensions should consume all ST_SYN payload
-	if len(b) != offset {
+	if common.Error2(buffer.ReadBytes(2)) != nil {
+		return nil, common.ErrNoClue
+	}
+
+	var timestamp uint32
+	if err := binary.Read(buffer, binary.BigEndian, &timestamp); err != nil {
+		return nil, common.ErrNoClue
+	}
+	if math.Abs(float64(time.Now().UnixMicro()-int64(timestamp))) > float64(24*time.Hour) {
 		return nil, errNotBittorrent
 	}
 

common/protocol/bittorrent/bittorrent_test.go

@@ -1,67 +0,0 @@
-package bittorrent
-
-import (
-	"encoding/binary"
-	"testing"
-
-	"github.com/xtls/xray-core/common"
-)
-
-// utpPacket builds the fixed 20-byte header defined by BEP 29.
-func utpPacket(packetType, extension byte, tsDiff uint32, payload ...byte) []byte {
-	b := make([]byte, 20)
-	b[0] = packetType<<4 | 1
-	b[1] = extension
-	binary.BigEndian.PutUint16(b[2:4], 0x4a3f)     // connection_id, random
-	binary.BigEndian.PutUint32(b[4:8], 0x8c3a91d2) // timestamp_microseconds, sender's clock
-	binary.BigEndian.PutUint32(b[8:12], tsDiff)
-	binary.BigEndian.PutUint32(b[12:16], 0x00100000) // wnd_size
-	binary.BigEndian.PutUint16(b[16:18], 0x71ee)     // seq_nr, random in libutp/libtorrent
-	binary.BigEndian.PutUint16(b[18:20], 0x0000)     // ack_nr
-	return append(b, payload...)
-}
-
-func TestSniffUTP(t *testing.T) {
-	selectiveAck := []byte{0, 4, 0xff, 0x00, 0xff, 0x00}
-	wrongVersion := utpPacket(4, 0, 0)
-	wrongVersion[0] = 4<<4 | 2
-
-	cases := []struct {
-		name    string
-		payload []byte
-		err     error
-	}{
-		{"syn", utpPacket(4, 0, 0), nil},
-		{"syn with selective ack", append(utpPacket(4, 1, 0), selectiveAck...), nil},
-		{"syn with extension bits", append(utpPacket(4, 2, 0), 0, 8, 1, 2, 3, 4, 5, 6, 7, 8), nil},
-		{"extension bits with wrong length", append(utpPacket(4, 2, 0), 0, 4, 1, 2, 3, 4), errNotBittorrent},
-		{"syn with nonzero timestamp_difference", utpPacket(4, 0, 0x1234), errNotBittorrent},
-		{"syn with trailing payload", utpPacket(4, 0, 0, 'x'), errNotBittorrent},
-		// txid 0x4100, no EDNS0: the worst case colliding with the uTP header
-		{"dns query", []byte{
-			0x41, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-			0x01, 'a', 0x02, 'c', 'o', 0x00, 0x00, 0x01, 0x00, 0x01,
-		}, errNotBittorrent},
-		{"established connection packets", utpPacket(0, 0, 0x5678, 'x', 'y', 'z'), errNotBittorrent},
-		{"state", utpPacket(2, 0, 0x5678), errNotBittorrent},
-		{"fin", utpPacket(1, 0, 0x5678), errNotBittorrent},
-		{"wrong version", wrongVersion, errNotBittorrent},
-		{"unknown packet type", utpPacket(5, 0, 0), errNotBittorrent},
-		{"unknown extension", utpPacket(4, 2, 0), errNotBittorrent},
-		{"extension chain past the datagram", utpPacket(4, 1, 0, 0, 8, 0xff), errNotBittorrent},
-		{"selective ack not in multiples of 4", append(utpPacket(4, 1, 0), 0, 3, 0xff, 0x00, 0xff), errNotBittorrent},
-		{"shorter than the header", utpPacket(4, 0, 0)[:19], common.ErrNoClue},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			h, err := SniffUTP(c.payload)
-			if err != c.err {
-				t.Fatalf("expected error %v, got %v", c.err, err)
-			}
-			if err == nil && h == nil {
-				t.Fatal("expected a sniff header, got nil")
-			}
-		})
-	}
-}

common/protocol/quic/qtls_go118.go

@@ -1,10 +1,18 @@
 package quic
 
 import (
+	"crypto"
 	"crypto/cipher"
 	_ "crypto/tls"
 	_ "unsafe"
 )
 
+type CipherSuiteTLS13 struct {
+	ID     uint16
+	KeyLen int
+	AEAD   func(key, fixedNonce []byte) cipher.AEAD
+	Hash   crypto.Hash
+}
+
 //go:linkname AEADAESGCMTLS13 crypto/tls.aeadAESGCMTLS13
 func AEADAESGCMTLS13(key, nonceMask []byte) cipher.AEAD

common/protocol/quic/sniff.go

@@ -3,6 +3,7 @@ package quic
 import (
 	"crypto"
 	"crypto/aes"
+	"crypto/tls"
 	"encoding/binary"
 	"io"
 
@@ -27,43 +28,22 @@ func (s SniffHeader) Domain() string {
 	return s.domain
 }
 
-var (
-	errNotQUIC        = errors.New("not quic")
-	errNotQUICInitial = errors.New("not initial packet")
+const (
+	versionDraft29 uint32 = 0xff00001d
+	version1       uint32 = 0x1
 )
 
-type quicVersionSpec struct {
-	ver         uint32
-	typeInitial byte
-	initialSalt []byte
-	labelPrefix string
-}
-
 var (
-	quicDraft29 = quicVersionSpec{
-		ver:         0xff00001d,
-		typeInitial: 0b00,
-		initialSalt: []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99},
-		labelPrefix: "quic",
-	}
-	quicV1 = quicVersionSpec{
-		ver:         0x1,
-		typeInitial: 0b00,
-		initialSalt: []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a},
-		labelPrefix: "quic",
-	}
-	quicV2 = quicVersionSpec{
-		ver:         0x6b3343cf,
-		typeInitial: 0b01,
-		initialSalt: []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9},
-		labelPrefix: "quicv2",
-	}
-
-	quicVersionSpecMap = map[uint32]*quicVersionSpec{
-		quicDraft29.ver: &quicDraft29,
-		quicV1.ver:      &quicV1,
-		quicV2.ver:      &quicV2,
+	quicSaltOld  = []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99}
+	quicSalt     = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	initialSuite = &CipherSuiteTLS13{
+		ID:     tls.TLS_AES_128_GCM_SHA256,
+		KeyLen: 16,
+		AEAD:   AEADAESGCMTLS13,
+		Hash:   crypto.SHA256,
 	}
+	errNotQuic        = errors.New("not quic")
+	errNotQuicInitial = errors.New("not initial packet")
 )
 
 func SniffQUIC(b []byte) (*SniffHeader, error) {
@@ -83,61 +63,60 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 		buffer := buf.FromBytes(b)
 		typeByte, err := buffer.ReadByte()
 		if err != nil {
-			return nil, errNotQUIC
+			return nil, errNotQuic
 		}
 
 		isLongHeader := typeByte&0x80 > 0
 		if !isLongHeader || typeByte&0x40 == 0 {
-			return nil, errNotQUICInitial
+			return nil, errNotQuicInitial
 		}
 
 		vb, err := buffer.ReadBytes(4)
 		if err != nil {
-			return nil, errNotQUIC
+			return nil, errNotQuic
 		}
 
 		versionNumber := binary.BigEndian.Uint32(vb)
-		var s *quicVersionSpec
-		if v, ok := quicVersionSpecMap[versionNumber]; ok {
-			s = v
-		} else {
-			return nil, errNotQUIC
-		}
-
-		var destConnID []byte
-		if l, err := buffer.ReadByte(); err != nil {
-			return nil, errNotQUIC
-		} else if destConnID, err = buffer.ReadBytes(int32(l)); err != nil {
-			return nil, errNotQUIC
-		}
-
-		if l, err := buffer.ReadByte(); err != nil {
-			return nil, errNotQUIC
-		} else if common.Error2(buffer.ReadBytes(int32(l))) != nil {
-			return nil, errNotQUIC
+		if versionNumber != 0 && typeByte&0x40 == 0 {
+			return nil, errNotQuic
+		} else if versionNumber != versionDraft29 && versionNumber != version1 {
+			return nil, errNotQuic
 		}
 
 		packetType := (typeByte & 0x30) >> 4
-		isQUICInitial := packetType == s.typeInitial
+		isQuicInitial := packetType == 0x0
 
-		if isQUICInitial { // Only initial packets have token, see https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.2
-			tokenLen, err := readShortQUICVarint(buffer)
+		var destConnID []byte
+		if l, err := buffer.ReadByte(); err != nil {
+			return nil, errNotQuic
+		} else if destConnID, err = buffer.ReadBytes(int32(l)); err != nil {
+			return nil, errNotQuic
+		}
+
+		if l, err := buffer.ReadByte(); err != nil {
+			return nil, errNotQuic
+		} else if common.Error2(buffer.ReadBytes(int32(l))) != nil {
+			return nil, errNotQuic
+		}
+
+		if isQuicInitial { // Only initial packets have token, see https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.2
+			tokenLen, err := readShortQuicVarint(buffer)
 			if err != nil || tokenLen > int32(len(b)) {
-				return nil, errNotQUIC
+				return nil, errNotQuic
 			}
 
 			if _, err = buffer.ReadBytes(tokenLen); err != nil {
-				return nil, errNotQUIC
+				return nil, errNotQuic
 			}
 		}
 
-		packetLen, err := readShortQUICVarint(buffer)
+		packetLen, err := readShortQuicVarint(buffer)
 		if err != nil {
-			return nil, errNotQUIC
+			return nil, errNotQuic
 		}
 		// packetLen is impossible to be shorter than this
 		if packetLen < 4 {
-			return nil, errNotQUIC
+			return nil, errNotQuic
 		}
 
 		hdrLen := len(b) - int(buffer.Len())
@@ -146,22 +125,26 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 		}
 
 		restPayload := b[hdrLen+int(packetLen):]
-		if !isQUICInitial { // Skip this packet if it's not initial packet
+		if !isQuicInitial { // Skip this packet if it's not initial packet
 			b = restPayload
 			continue
 		}
 
-		salt := s.initialSalt
-		label := s.labelPrefix
+		var salt []byte
+		if versionNumber == version1 {
+			salt = quicSalt
+		} else {
+			salt = quicSaltOld
+		}
 		initialSecret := hkdf.Extract(crypto.SHA256.New, destConnID, salt)
-		secret := hkdfExpandLabel(initialSecret, "client in", crypto.SHA256.Size())
-		hpKey := hkdfExpandLabel(secret, label+" hp", 16)
+		secret := hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "client in", crypto.SHA256.Size())
+		hpKey := hkdfExpandLabel(initialSuite.Hash, secret, []byte{}, "quic hp", initialSuite.KeyLen)
 		block, err := aes.NewCipher(hpKey)
 		if err != nil {
 			return nil, err
 		}
 		if len(b) < hdrLen+4+block.BlockSize() {
-			return nil, errNotQUIC
+			return nil, errNotQuic
 		}
 		cache.Clear()
 		mask := cache.Extend(int32(block.BlockSize()))
@@ -172,8 +155,8 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 			b[hdrLen+i] ^= mask[i+1]
 		}
 
-		key := hkdfExpandLabel(secret, label+" key", 16)
-		iv := hkdfExpandLabel(secret, label+" iv", 12)
+		key := hkdfExpandLabel(crypto.SHA256, secret, []byte{}, "quic key", 16)
+		iv := hkdfExpandLabel(crypto.SHA256, secret, []byte{}, "quic iv", 12)
 		cipher := AEADAESGCMTLS13(key, iv)
 
 		nonce := cache.Extend(int32(cipher.NonceSize()))
@@ -198,44 +181,44 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 			case 0x00: // PADDING frame
 			case 0x01: // PING frame
 			case 0x02, 0x03: // ACK frame
-				if _, err = readShortQUICVarint(buffer); err != nil { // Field: Largest Acknowledged
+				if _, err = readShortQuicVarint(buffer); err != nil { // Field: Largest Acknowledged
 					return nil, io.ErrUnexpectedEOF
 				}
-				if _, err = readShortQUICVarint(buffer); err != nil { // Field: ACK Delay
+				if _, err = readShortQuicVarint(buffer); err != nil { // Field: ACK Delay
 					return nil, io.ErrUnexpectedEOF
 				}
-				ackRangeCount, err := readShortQUICVarint(buffer) // Field: ACK Range Count
+				ackRangeCount, err := readShortQuicVarint(buffer) // Field: ACK Range Count
 				if err != nil {
 					return nil, io.ErrUnexpectedEOF
 				}
-				if _, err = readShortQUICVarint(buffer); err != nil { // Field: First ACK Range
+				if _, err = readShortQuicVarint(buffer); err != nil { // Field: First ACK Range
 					return nil, io.ErrUnexpectedEOF
 				}
 				for i := 0; i < int(ackRangeCount); i++ { // Field: ACK Range
-					if _, err = readShortQUICVarint(buffer); err != nil { // Field: ACK Range -> Gap
+					if _, err = readShortQuicVarint(buffer); err != nil { // Field: ACK Range -> Gap
 						return nil, io.ErrUnexpectedEOF
 					}
-					if _, err = readShortQUICVarint(buffer); err != nil { // Field: ACK Range -> ACK Range Length
+					if _, err = readShortQuicVarint(buffer); err != nil { // Field: ACK Range -> ACK Range Length
 						return nil, io.ErrUnexpectedEOF
 					}
 				}
 				if frameType == 0x03 {
-					if _, err = readShortQUICVarint(buffer); err != nil { // Field: ECN Counts -> ECT0 Count
+					if _, err = readShortQuicVarint(buffer); err != nil { // Field: ECN Counts -> ECT0 Count
 						return nil, io.ErrUnexpectedEOF
 					}
-					if _, err = readShortQUICVarint(buffer); err != nil { // Field: ECN Counts -> ECT1 Count
+					if _, err = readShortQuicVarint(buffer); err != nil { // Field: ECN Counts -> ECT1 Count
 						return nil, io.ErrUnexpectedEOF
 					}
-					if _, err = readShortQUICVarint(buffer); err != nil { //nolint:misspell // Field: ECN Counts -> ECT-CE Count
+					if _, err = readShortQuicVarint(buffer); err != nil { //nolint:misspell // Field: ECN Counts -> ECT-CE Count
 						return nil, io.ErrUnexpectedEOF
 					}
 				}
 			case 0x06: // CRYPTO frame, we will use this frame
-				offset, err := readShortQUICVarint(buffer) // Field: Offset
+				offset, err := readShortQuicVarint(buffer) // Field: Offset
 				if err != nil {
 					return nil, io.ErrUnexpectedEOF
 				}
-				length, err := readShortQUICVarint(buffer) // Field: Length
+				length, err := readShortQuicVarint(buffer) // Field: Length
 				if err != nil || length > buffer.Len() {
 					return nil, io.ErrUnexpectedEOF
 				}
@@ -251,13 +234,13 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 					return nil, io.ErrUnexpectedEOF
 				}
 			case 0x1c: // CONNECTION_CLOSE frame, only 0x1c is permitted in initial packet
-				if _, err = readShortQUICVarint(buffer); err != nil { // Field: Error Code
+				if _, err = readShortQuicVarint(buffer); err != nil { // Field: Error Code
 					return nil, io.ErrUnexpectedEOF
 				}
-				if _, err = readShortQUICVarint(buffer); err != nil { // Field: Frame Type
+				if _, err = readShortQuicVarint(buffer); err != nil { // Field: Frame Type
 					return nil, io.ErrUnexpectedEOF
 				}
-				length, err := readShortQUICVarint(buffer) // Field: Reason Phrase Length
+				length, err := readShortQuicVarint(buffer) // Field: Reason Phrase Length
 				if err != nil {
 					return nil, io.ErrUnexpectedEOF
 				}
@@ -267,7 +250,7 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 			default:
 				// Only above frame types are permitted in initial packet.
 				// See https://www.rfc-editor.org/rfc/rfc9000.html#section-17.2.2-8
-				return nil, errNotQUICInitial
+				return nil, errNotQuicInitial
 			}
 		}
 
@@ -285,33 +268,35 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 	return nil, protocol.ErrProtoNeedMoreData
 }
 
-func hkdfExpandLabel(secret []byte, label string, length int) []byte {
-	b := make([]byte, 0, 2+1+6+len(label)+1)
-	b = binary.BigEndian.AppendUint16(b, uint16(length))
-	b = append(b, byte(6+len(label)))
-	b = append(b, "tls13 "...)
-	b = append(b, label...)
-	b = append(b, 0) // context
+func hkdfExpandLabel(hash crypto.Hash, secret, context []byte, label string, length int) []byte {
+	b := make([]byte, 3, 3+6+len(label)+1+len(context))
+	binary.BigEndian.PutUint16(b, uint16(length))
+	b[2] = uint8(6 + len(label))
+	b = append(b, []byte("tls13 ")...)
+	b = append(b, []byte(label)...)
+	b = b[:3+6+len(label)+1]
+	b[3+6+len(label)] = uint8(len(context))
+	b = append(b, context...)
 
 	out := make([]byte, length)
-	n, err := hkdf.Expand(crypto.SHA256.New, secret, b).Read(out)
+	n, err := hkdf.Expand(hash.New, secret, b).Read(out)
 	if err != nil || n != length {
 		panic("quic: HKDF-Expand-Label invocation failed unexpectedly")
 	}
 	return out
 }
 
-// readShortQUICVarint wraps quicvarint.Read with a max limit for length related fields.
+// readShortQuicVarint wraps quicvarint.Read with a max limit for length related fields.
 // we only handle QUIC Initial so these numbers should not exceed 65535
 // returns int32 to reduce type conversion
-func readShortQUICVarint(reader io.ByteReader) (int32, error) {
+func readShortQuicVarint(reader io.ByteReader) (int32, error) {
 	v, err := quicvarint.Read(reader)
 	if err != nil {
 		return 0, err
 	}
 	if v > 65535 {
 		// not used(
-		return 0, errNotQUICInitial
+		return 0, errNotQuicInitial
 	}
 	return int32(v), nil
 }

common/reflect/marshal_test.go

@@ -207,7 +207,6 @@ func getConfig() string {
       "tag": "XHTTP_IN",
       "streamSettings": {
         "network": "xhttp",
-		"security": "tls",
         "xhttpSettings": {
           "host": "bing.com",
           "path": "/xhttp_client_upload",

common/session/session.go

@@ -70,6 +70,8 @@ type Outbound struct {
 	Tag string
 	// Name of the outbound proxy that handles the connection.
 	Name string
+	// Unused. Conn is actually internet.Connection. May be nil. It is currently nil for outbound with proxySettings
+	Conn net.Conn
 	// CanSpliceCopy is a property for this connection
 	// 1 = can, 2 = after processing protocol info should be able to, 3 = cannot
 	CanSpliceCopy int

common/xudp/xudp.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strconv"
 	"strings"
-	"sync/atomic"
+	"time"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
@@ -27,39 +27,25 @@ var AddrParser = protocol.NewAddressParser(
 )
 
 var (
-	Show    atomic.Bool
-	baseKey atomic.Value
+	Show    bool
+	BaseKey []byte
 )
 
-func reloadEnvSettings() error {
-	Show.Store(strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true")
-	raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" })
-	if raw == "" {
-		ensureBaseKey()
-		return nil
-	}
-	key, _ := base64.RawURLEncoding.DecodeString(raw)
-	if len(key) != 32 {
-		return errors.New(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(key)))
-	}
-	baseKey.Store(append([]byte(nil), key...))
-	return nil
-}
-
-func ensureBaseKey() []byte {
-	if key := baseKey.Load(); key != nil {
-		return key.([]byte)
-	}
-	key := make([]byte, 32)
-	if _, err := rand.Read(key); err != nil {
-		panic(err)
-	}
-	baseKey.Store(key)
-	return key
-}
-
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	if strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true" {
+		Show = true
+	}
+	BaseKey = make([]byte, 32)
+	rand.Read(BaseKey)
+	go func() {
+		time.Sleep(100 * time.Millisecond) // this is not nice, but need to give some time for Android to setup ENV
+		if raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" }); raw != "" {
+			if BaseKey, _ = base64.RawURLEncoding.DecodeString(raw); len(BaseKey) == 32 {
+				return
+			}
+			panic(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(BaseKey)))
+		}
+	}()
 }
 
 func GetGlobalID(ctx context.Context) (globalID [8]byte) {
@@ -68,10 +54,10 @@ func GetGlobalID(ctx context.Context) (globalID [8]byte) {
 	}
 	if inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Source.Network == net.Network_UDP &&
 		(inbound.Name == "dokodemo-door" || inbound.Name == "socks" || inbound.Name == "shadowsocks" || inbound.Name == "tun") {
-		h := blake3.New(8, ensureBaseKey())
+		h := blake3.New(8, BaseKey)
 		h.Write([]byte(inbound.Source.String()))
 		copy(globalID[:], h.Sum(nil))
-		if Show.Load() {
+		if Show {
 			errors.LogInfo(ctx, fmt.Sprintf("XUDP inbound.Source.String(): %v\tglobalID: %v\n", inbound.Source.String(), globalID))
 		}
 	}

core/core.go

@@ -19,8 +19,8 @@ import (
 
 var (
 	Version_x byte = 26
-	Version_y byte = 9
-	Version_z byte = 9
+	Version_y byte = 6
+	Version_z byte = 27
 )
 
 var (

core/xray.go

@@ -187,9 +187,6 @@ func NewWithContext(ctx context.Context, config *Config) (*Instance, error) {
 }
 
 func initInstanceWithConfig(config *Config, server *Instance) (bool, error) {
-	if err := platform.ReloadEnvSettings(); err != nil {
-		return true, errors.New("failed to reload environment settings").Base(err)
-	}
 	server.ctx = context.WithValue(server.ctx, "cone",
 		platform.NewEnvFlag(platform.UseCone).GetValue(func() string { return "" }) != "true")
 

features/policy/policy.go

@@ -3,7 +3,6 @@ package policy
 import (
 	"context"
 	"runtime"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -83,41 +82,32 @@ func ManagerType() interface{} {
 	return (*Manager)(nil)
 }
 
-var defaultBufferSize atomic.Int32
+var defaultBufferSize int32
 
-func reloadEnvSettings() error {
-	defaultBufferSize.Store(readDefaultBufferSize())
-	return nil
-}
-
-func readDefaultBufferSize() int32 {
+func init() {
 	const defaultValue = -17
 	size := platform.NewEnvFlag(platform.BufferSize).GetValueAsInt(defaultValue)
 
 	switch size {
 	case 0:
-		return -1 // For pipe to use unlimited size
+		defaultBufferSize = -1 // For pipe to use unlimited size
 	case defaultValue: // Env flag not defined. Use default values per CPU-arch.
 		switch runtime.GOARCH {
 		case "arm", "mips", "mipsle":
-			return 0
+			defaultBufferSize = 0
 		case "arm64", "mips64", "mips64le":
-			return 4 * 1024 // 4k cache for low-end devices
+			defaultBufferSize = 4 * 1024 // 4k cache for low-end devices
 		default:
-			return 512 * 1024
+			defaultBufferSize = 512 * 1024
 		}
 	default:
-		return int32(size) * 1024 * 1024
+		defaultBufferSize = int32(size) * 1024 * 1024
 	}
 }
 
-func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
-}
-
 func defaultBufferPolicy() Buffer {
 	return Buffer{
-		PerConnection: defaultBufferSize.Load(),
+		PerConnection: defaultBufferSize,
 	}
 }
 

features/stats/stats.go

@@ -81,8 +81,6 @@ type Manager interface {
 
 	// RegisterCounter registers a new counter to the manager. The identifier string must not be empty, and unique among other counters.
 	RegisterCounter(string) (Counter, error)
-	// GetOrRegisterCounter returns the counter by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterCounter(string) (Counter, error)
 	// UnregisterCounter unregisters a counter from the manager by its identifier.
 	UnregisterCounter(string) error
 	// GetCounter returns a counter by its identifier.
@@ -93,8 +91,6 @@ type Manager interface {
 
 	// RegisterOnlineMap registers a new OnlineMap to the manager. The identifier string must not be empty, and unique among other OnlineMaps.
 	RegisterOnlineMap(string) (OnlineMap, error)
-	// GetOrRegisterOnlineMap returns the OnlineMap by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterOnlineMap(string) (OnlineMap, error)
 	// UnregisterOnlineMap unregisters an OnlineMap from the manager by its identifier.
 	UnregisterOnlineMap(string) error
 	// GetOnlineMap returns an OnlineMap by its identifier.
@@ -105,8 +101,6 @@ type Manager interface {
 
 	// RegisterChannel registers a new channel to the manager. The identifier string must not be empty, and unique among other channels.
 	RegisterChannel(string) (Channel, error)
-	// GetOrRegisterChannel returns the channel by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterChannel(string) (Channel, error)
 	// UnregisterChannel unregisters a channel from the manager by its identifier.
 	UnregisterChannel(string) error
 	// GetChannel returns a channel by its identifier.
@@ -116,6 +110,36 @@ type Manager interface {
 	GetAllOnlineUsers() []string
 }
 
+// GetOrRegisterCounter tries to get the StatCounter first. If not exist, it then tries to create a new counter.
+func GetOrRegisterCounter(m Manager, name string) (Counter, error) {
+	counter := m.GetCounter(name)
+	if counter != nil {
+		return counter, nil
+	}
+
+	return m.RegisterCounter(name)
+}
+
+// GetOrRegisterOnlineMap tries to get the OnlineMap first. If not exist, it then tries to create a new OnlineMap.
+func GetOrRegisterOnlineMap(m Manager, name string) (OnlineMap, error) {
+	onlineMap := m.GetOnlineMap(name)
+	if onlineMap != nil {
+		return onlineMap, nil
+	}
+
+	return m.RegisterOnlineMap(name)
+}
+
+// GetOrRegisterChannel tries to get the StatChannel first. If not exist, it then tries to create a new channel.
+func GetOrRegisterChannel(m Manager, name string) (Channel, error) {
+	channel := m.GetChannel(name)
+	if channel != nil {
+		return channel, nil
+	}
+
+	return m.RegisterChannel(name)
+}
+
 // ManagerType returns the type of Manager interface. Can be used to implement common.HasType.
 //
 // xray:api:stable
@@ -136,11 +160,6 @@ func (NoopManager) RegisterCounter(string) (Counter, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterCounter implements Manager.
-func (NoopManager) GetOrRegisterCounter(string) (Counter, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterCounter implements Manager.
 func (NoopManager) UnregisterCounter(string) error {
 	return nil
@@ -159,11 +178,6 @@ func (NoopManager) RegisterOnlineMap(string) (OnlineMap, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterOnlineMap implements Manager.
-func (NoopManager) GetOrRegisterOnlineMap(string) (OnlineMap, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterOnlineMap implements Manager.
 func (NoopManager) UnregisterOnlineMap(string) error {
 	return nil
@@ -182,11 +196,6 @@ func (NoopManager) RegisterChannel(string) (Channel, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterChannel implements Manager.
-func (NoopManager) GetOrRegisterChannel(string) (Channel, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterChannel implements Manager.
 func (NoopManager) UnregisterChannel(string) error {
 	return nil

go.mod

@@ -1,67 +1,62 @@
 module github.com/xtls/xray-core
 
-go 1.27
+go 1.26
 
 require (
-	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/cloudflare/circl v1.6.5
+	github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716
+	github.com/cloudflare/circl v1.6.4
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/klauspost/cpuid/v2 v2.4.0
-	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
-	github.com/miekg/dns v1.1.73
+	github.com/miekg/dns v1.1.72
 	github.com/pelletier/go-toml v1.9.5
-	github.com/pion/stun/v3 v3.1.7
-	github.com/pires/go-proxyproto v0.15.0
+	github.com/pion/stun/v3 v3.1.6
+	github.com/pires/go-proxyproto v0.14.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sagernet/sing v0.5.1
 	github.com/sagernet/sing-shadowsocks v0.2.7
-	github.com/stretchr/testify v1.12.1
+	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0
-	github.com/yuin/gopher-lua v1.1.2
+	github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.57.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.59.0
-	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
+	golang.org/x/net v0.56.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
-	golang.zx2c4.com/wireguard/windows v1.1.1
-	google.golang.org/grpc v1.84.0
-	google.golang.org/protobuf v1.36.12
+	golang.zx2c4.com/wireguard/windows v1.0.1
+	google.golang.org/grpc v1.82.0
+	google.golang.org/protobuf v1.36.11
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
-	layeh.com/gopher-luar v1.0.11
 	lukechampine.com/blake3 v1.4.1
-	mvdan.cc/gofumpt v0.12.0
 )
 
 require (
 	github.com/andybalholm/brotli v1.0.6 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/btree v1.1.2 // indirect
-	github.com/google/gopacket v1.1.19 // indirect
-	github.com/huin/goupnp v1.2.0 // indirect
-	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/juju/ratelimit v1.0.2 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
-	github.com/koron/go-ssdp v0.0.4 // indirect
-	github.com/libp2p/go-netroute v0.2.1 // indirect
-	github.com/pion/dtls/v3 v3.1.5 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/pion/dtls/v3 v3.1.4 // indirect
 	github.com/pion/logging v0.2.4 // indirect
-	github.com/pion/transport/v4 v4.1.0 // indirect
+	github.com/pion/transport/v4 v4.0.2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
+	golang.org/x/tools v0.45.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,16 +1,20 @@
 github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
 github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e h1:5mgtR5gwIgBKMiGI1QdXldZZ+SNor06Nbu1wCBulQBg=
-github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e/go.mod h1:x7qxEvX6MCVtDuBKHj3E+88+BtrbEMuAL5qGUKItjW8=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
-github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
+github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716 h1:J1O+xpLuJWkdYbw5JPGwBqIHs2J8tiEP7Py9lPqkN2I=
+github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716/go.mod h1:Npbg8qBtAZlsAB3FWmqwlVh5jtVG6a4DlYsOylUpvzA=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cloudflare/circl v1.6.4 h1:pOXuDTCEYyzydgUpQ0CQz3LsinKjiSk6nNP5Lt5K64U=
+github.com/cloudflare/circl v1.6.4/go.mod h1:YxarevkLlbaHuWsxG6vmYNWBEsSp4pnp7j+4VljMavY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 h1:Arcl6UOIS/kgO2nW3A65HN+7CMjSDP/gofXL4CZt1V4=
 github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=
-github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
-github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
 github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -19,103 +23,97 @@ github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
-github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/h12w/go-socks5 v0.0.0-20200522160539-76189e178364 h1:5XxdakFhqd9dnXoAZy1Mb2R/DZ6D1e+0bGC/JhucGYI=
 github.com/h12w/go-socks5 v0.0.0-20200522160539-76189e178364/go.mod h1:eDJQioIyy4Yn3MVivT7rv/39gAJTrA7lgmYr8EW950c=
-github.com/huin/goupnp v1.2.0 h1:uOKW26NG1hsSSbXIZ1IR7XP9Gjd1U8pnLaCMgntmkmY=
-github.com/huin/goupnp v1.2.0/go.mod h1:gnGPsThkYa7bFi/KWmEysQRf48l2dvR5bxr2OFckNX8=
-github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
-github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
 github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
-github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
-github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138 h1:YohuNPT/1k3VcThCQlBZ43PCPWPfMRS1zcxWBF2SLK8=
-github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138/go.mod h1:TXQg5tfSy+bUjnhT5728j5j/MBj7keIYqqZ1+8k/ui8=
-github.com/libp2p/go-netroute v0.2.1 h1:V8kVrpD8GK0Riv15/7VN6RbUQ3URNZVosw7H2v9tksU=
-github.com/libp2p/go-netroute v0.2.1/go.mod h1:hraioZr0fhBjG0ZRXJJ6Zj2IVEVNx6tDTFQfSmcq7mQ=
-github.com/miekg/dns v1.1.73 h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=
-github.com/miekg/dns v1.1.73/go.mod h1:RW2Obtfd5NZHvOFe3zYG0W8koWOQtAzyHaLo8vASBuQ=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2 h1:JhzVVoYvbOACxoUmOs6V/G4D5nPVUW73rKvXxP4XUJc=
 github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
-github.com/pion/dtls/v3 v3.1.5 h1:9xJtVsHwMYeSjPp5Hh1FTis4DchnQWtnOa5o+6ygqfc=
-github.com/pion/dtls/v3 v3.1.5/go.mod h1:gz1K4jg6c+fq86oQMH4pilpCEOEPwmEr2jY+VcF/mkU=
+github.com/pion/dtls/v3 v3.1.4 h1:QhvtMflMfu9Kf0RcDC5BJBle4caPskByrKQR6uuYqpY=
+github.com/pion/dtls/v3 v3.1.4/go.mod h1:cr/qotLISUw/9C1m83ZPNZtj9WnXkYLpfCptPqbkInc=
 github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
 github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
-github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
-github.com/pion/transport/v4 v4.1.0 h1:8S+nF2reM2cJuqC6g78OVy2BBgmbdns+acx3jA97BvQ=
-github.com/pion/transport/v4 v4.1.0/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
-github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/pion/stun/v3 v3.1.6 h1:WnhsD0eHCiwCfKNkVx0VJJwr2Y3eV4Ueih3KJ+dfZy8=
+github.com/pion/stun/v3 v3.1.6/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=
+github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=
+github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
+github.com/pires/go-proxyproto v0.14.0 h1:2vIGIfVG8eVRsKF0xukEoeT5RWhDXxBU0uv6smLOKdI=
+github.com/pires/go-proxyproto v0.14.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
 github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af h1:er2acxbi3N1nvEq6HXHUAR1nTWEJmQfqiGR8EVT9rfs=
 github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
-github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/sagernet/sing v0.5.1 h1:mhL/MZVq0TjuvHcpYcFtmSD1BFOxZ/+8ofbNZcg1k1Y=
 github.com/sagernet/sing v0.5.1/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
 github.com/sagernet/sing-shadowsocks v0.2.7 h1:zaopR1tbHEw5Nk6FAkM05wCslV6ahVegEZaKMv9ipx8=
 github.com/sagernet/sing-shadowsocks v0.2.7/go.mod h1:0rIKJZBR65Qi0zwdKezt4s57y/Tl1ofkaq6NlkzVuyE=
-github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
-github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0 h1:rb+fKQFhz+5I2PPuQsNYxI5mUU840XWYtRF0ZBjvkws=
-github.com/xtls/reality v0.0.0-20260908062103-8cdf7bf9c7f0/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
+github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f h1:iy2JRioxmUpoJ3SzbFPyTxHZMbR/rSHP7dOOgYaq1O8=
+github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f/go.mod h1:DsJblcWDGt76+FVqBVwbwRhxyyNJsGV48gJLch0OOWI=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=
-github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
-github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
-golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -123,22 +121,21 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -146,29 +143,27 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
 golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
-golang.zx2c4.com/wireguard/windows v1.1.1 h1:8/H97U1v1PNDNcBsMZgU3KFuND9MQdTsU2NOwmCXArE=
-golang.zx2c4.com/wireguard/windows v1.1.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
+golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
+golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
-google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
-google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 h1:Lk6hARj5UPY47dBep70OD/TIMwikJ5fGUGX0Rm3Xigk=
 gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0/go.mod h1:QkHjoMIBaYtpVufgwv3keYAbln78mBoCuShZrPrer1Q=
 h12.io/socks v1.0.3 h1:Ka3qaQewws4j4/eDQnOdpr4wXsC//dXtWvftlIcCQUo=
 h12.io/socks v1.0.3/go.mod h1:AIhxy1jOId/XCz9BO+EIgNL2rQiPTBNnOfnVnQ+3Eck=
-layeh.com/gopher-luar v1.0.11 h1:8zJudpKI6HWkoh9eyyNFaTM79PY6CAPcIr6X/KTiliw=
-layeh.com/gopher-luar v1.0.11/go.mod h1:TPnIVCZ2RJBndm7ohXyaqfhzjlZ+OA2SZR/YwL8tECk=
 lukechampine.com/blake3 v1.4.1 h1:I3Smz7gso8w4/TunLKec6K2fn+kyKtDxr/xcQEN84Wg=
 lukechampine.com/blake3 v1.4.1/go.mod h1:QFosUxmjB8mnrWFSNwKmvxHpfY72bmD2tQ0kBMM3kwo=
-mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
-mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=

infra/conf/blackhole.go

@@ -1,42 +1,52 @@
 package conf
 
 import (
-	"encoding/base64"
-	"strings"
+	"encoding/json"
 
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/proxy/blackhole"
 	"google.golang.org/protobuf/proto"
 )
 
-type ResponseConfig struct {
-	Type               string `json:"type"`
-	CustomResponseData string `json:"customResponseData"`
+type NoneResponse struct{}
+
+func (*NoneResponse) Build() (proto.Message, error) {
+	return new(blackhole.NoneResponse), nil
+}
+
+type HTTPResponse struct{}
+
+func (*HTTPResponse) Build() (proto.Message, error) {
+	return new(blackhole.HTTPResponse), nil
 }
 
 type BlackholeConfig struct {
-	Response *ResponseConfig `json:"response"`
+	Response json.RawMessage `json:"response"`
 }
 
 func (v *BlackholeConfig) Build() (proto.Message, error) {
 	config := new(blackhole.Config)
 	if v.Response != nil {
-		responseName := strings.ToLower(v.Response.Type)
-		switch responseName {
-		case "none", "":
-			config.Response = &blackhole.Response{Type: "none"}
-		case "http":
-			config.Response = &blackhole.Response{Type: "http"}
-		case "custom":
-			data, err := base64.StdEncoding.DecodeString(v.Response.CustomResponseData)
-			if err != nil {
-				return nil, errors.New("failed to decode custom response data: " + err.Error())
-			}
-			config.Response = &blackhole.Response{Type: "custom", CustomResponseData: data}
-		default:
-			return nil, errors.New("unknown blackhole response: " + responseName)
+		response, _, err := configLoader.Load(v.Response)
+		if err != nil {
+			return nil, errors.New("Config: Failed to parse Blackhole response config.").Base(err)
 		}
+		responseSettings, err := response.(Buildable).Build()
+		if err != nil {
+			return nil, err
+		}
+		config.Response = serial.ToTypedMessage(responseSettings)
 	}
 
 	return config, nil
 }
+
+var configLoader = NewJSONConfigLoader(
+	ConfigCreatorCache{
+		"none": func() interface{} { return new(NoneResponse) },
+		"http": func() interface{} { return new(HTTPResponse) },
+	},
+	"type",
+	"",
+)

infra/conf/blackhole_test.go

@@ -3,6 +3,7 @@ package conf_test
 import (
 	"testing"
 
+	"github.com/xtls/xray-core/common/serial"
 	. "github.com/xtls/xray-core/infra/conf"
 	"github.com/xtls/xray-core/proxy/blackhole"
 )
@@ -21,7 +22,7 @@ func TestHTTPResponseJSON(t *testing.T) {
 			}`,
 			Parser: loadJSON(creator),
 			Output: &blackhole.Config{
-				Response: &blackhole.Response{Type: "http"},
+				Response: serial.ToTypedMessage(&blackhole.HTTPResponse{}),
 			},
 		},
 		{
@@ -31,27 +32,3 @@ func TestHTTPResponseJSON(t *testing.T) {
 		},
 	})
 }
-
-func TestCustomResponseJSON(t *testing.T) {
-	creator := func() Buildable {
-		return new(BlackholeConfig)
-	}
-
-	runMultiTestCase(t, []TestCase{
-		{
-			Input: `{
-				"response": {
-					"type": "custom",
-					"customResponseData": "Y3VzdG9tIHJlc3BvbnNl"
-				}
-			}`,
-			Parser: loadJSON(creator),
-			Output: &blackhole.Config{
-				Response: &blackhole.Response{
-					Type:               "custom",
-					CustomResponseData: []byte("custom response"),
-				},
-			},
-		},
-	})
-}

infra/conf/common.go

@@ -65,9 +65,6 @@ func (v *Address) UnmarshalJSON(data []byte) error {
 }
 
 func (v *Address) Build() *net.IPOrDomain {
-	if v == nil {
-		return nil
-	}
 	return net.NewIPOrDomain(v.Address)
 }
 

infra/conf/dns.go

@@ -14,11 +14,9 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/platform"
 )
 
 type NameServerConfig struct {
-	ID              string     `json:"id"`
 	Address         *Address   `json:"address"`
 	ClientIP        *Address   `json:"clientIp"`
 	Port            uint16     `json:"port"`
@@ -45,7 +43,6 @@ func (c *NameServerConfig) UnmarshalJSON(data []byte) error {
 	}
 
 	var advanced struct {
-		ID              string     `json:"id"`
 		Address         *Address   `json:"address"`
 		ClientIP        *Address   `json:"clientIp"`
 		Port            uint16     `json:"port"`
@@ -63,7 +60,6 @@ func (c *NameServerConfig) UnmarshalJSON(data []byte) error {
 		UnexpectedIPs   StringList `json:"unexpectedIPs"`
 	}
 	if err := json.Unmarshal(data, &advanced); err == nil {
-		c.ID = advanced.ID
 		c.Address = advanced.Address
 		c.ClientIP = advanced.ClientIP
 		c.Port = advanced.Port
@@ -138,7 +134,6 @@ func (c *NameServerConfig) Build() (*dns.NameServer, error) {
 	}
 
 	return &dns.NameServer{
-		Id: c.ID,
 		Address: &net.Endpoint{
 			Network: net.Network_UDP,
 			Address: c.Address.Build(),
@@ -164,7 +159,6 @@ func (c *NameServerConfig) Build() (*dns.NameServer, error) {
 // DNSConfig is a JSON serializable object for dns.Config
 type DNSConfig struct {
 	Servers                []*NameServerConfig `json:"servers"`
-	Script                 string              `json:"script"`
 	Hosts                  *HostsWrapper       `json:"hosts"`
 	ClientIP               *Address            `json:"clientIp"`
 	Tag                    string              `json:"tag"`
@@ -284,14 +278,6 @@ func (c *DNSConfig) Build() (*dns.Config, error) {
 		QueryStrategy:          resolveQueryStrategy(c.QueryStrategy),
 	}
 
-	if c.Script != "" {
-		path, err := platform.ResolveLuaFile(c.Script)
-		if err != nil {
-			return nil, errors.New("failed to resolve DNS script: ", c.Script).Base(err)
-		}
-		config.Script = path
-	}
-
 	if c.ClientIP != nil {
 		if !c.ClientIP.Family().IsIP() {
 			return nil, errors.New("not an IP address:", c.ClientIP.String())

infra/conf/dns_test.go

@@ -2,8 +2,6 @@ package conf_test
 
 import (
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -124,51 +122,3 @@ func TestDNSConfigParsing(t *testing.T) {
 		}
 	}
 }
-
-func TestDNSScriptConfig(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.confdir", dir)
-	path := filepath.Join(dir, "lookup.lua")
-	if err := os.WriteFile(path, []byte("function HandleDNSQuery(domain, ipv4, ipv6, fake) end"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	for _, tc := range []struct {
-		name      string
-		script    string
-		wantError bool
-	}{
-		{"relative", "lookup.lua", false},
-		{"absolute", path, false},
-		{"missing", "missing.lua", true},
-		{"directory", dir, true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			built, err := (&DNSConfig{Script: tc.script}).Build()
-			if tc.wantError {
-				if err == nil {
-					t.Fatal("Build accepted an invalid script path")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if built.Script != path {
-				t.Fatalf("script path = %q, want %q", built.Script, path)
-			}
-		})
-	}
-
-	var parsed DNSConfig
-	if err := json.Unmarshal([]byte(`{"servers":[{"id":"primary","address":"1.1.1.1"}]}`), &parsed); err != nil {
-		t.Fatal(err)
-	}
-	built, err := parsed.Build()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(built.NameServer) != 1 || built.NameServer[0].Id != "primary" {
-		t.Fatalf("nameserver IDs = %v, want primary", built.NameServer)
-	}
-}

infra/conf/env_test.go

@@ -1,59 +0,0 @@
-package conf
-
-import (
-	"encoding/json"
-	"os"
-	"testing"
-)
-
-func TestRootEnvAppliesArbitraryValues(t *testing.T) {
-	const (
-		valueKey = "XRAY_TEST_CONFIG_ENV"
-		emptyKey = "XRAY_TEST_CONFIG_EMPTY"
-	)
-	t.Setenv(valueKey, "before")
-	t.Setenv(emptyKey, "before")
-
-	config := new(Config)
-	if err := json.Unmarshal([]byte(`{
-		"env": {
-			"XRAY_TEST_CONFIG_ENV": "configured",
-			"XRAY_TEST_CONFIG_EMPTY": ""
-		}
-	}`), config); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := config.Build(); err != nil {
-		t.Fatal(err)
-	}
-
-	if got := os.Getenv(valueKey); got != "configured" {
-		t.Fatalf("env %q = %q, want %q", valueKey, got, "configured")
-	}
-	if got := os.Getenv(emptyKey); got != "" {
-		t.Fatalf("env %q = %q, want empty", emptyKey, got)
-	}
-}
-
-func TestEnvConfigOverride(t *testing.T) {
-	base := EnvConfig{
-		"ONE": "one",
-		"TWO": "old",
-	}
-	override := EnvConfig{
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	base.Override(override)
-
-	want := map[string]string{
-		"ONE":   "one",
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	for key, value := range want {
-		if got := base[key]; got != value {
-			t.Fatalf("env %q = %q, want %q", key, got, value)
-		}
-	}
-}

infra/conf/masque.go

@@ -1,37 +0,0 @@
-package conf
-
-import (
-	"net/netip"
-
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/protocol"
-	"github.com/xtls/xray-core/proxy/masque"
-	"google.golang.org/protobuf/proto"
-)
-
-type MasqueClientConfig struct {
-	Address   *Address `json:"address"`
-	Port      uint16   `json:"port"`
-	RemoteDNS []string `json:"remoteDNS"`
-}
-
-func (c *MasqueClientConfig) Build() (proto.Message, error) {
-	if c.Address == nil {
-		return nil, errors.New(`MASQUE: "address" is not set`)
-	}
-	if c.Port == 0 {
-		return nil, errors.New(`MASQUE: "port" is not set`)
-	}
-	for _, s := range c.RemoteDNS {
-		if _, err := netip.ParseAddr(s); err != nil {
-			return nil, errors.New(`MASQUE: invalid "remoteDNS" `, s).Base(err)
-		}
-	}
-	return &masque.ClientConfig{
-		Server: &protocol.ServerEndpoint{
-			Address: c.Address.Build(),
-			Port:    uint32(c.Port),
-		},
-		RemoteDns: c.RemoteDNS,
-	}, nil
-}

infra/conf/masque_test.go

@@ -1,85 +0,0 @@
-package conf_test
-
-import (
-	"encoding/json"
-	"testing"
-
-	. "github.com/xtls/xray-core/infra/conf"
-	"github.com/xtls/xray-core/transport/internet/masque"
-)
-
-func TestMasqueConfig(t *testing.T) {
-	creator := func() Buildable {
-		return new(MasqueConfig)
-	}
-
-	runMultiTestCase(t, []TestCase{
-		{
-			Input:  `{}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/.well-known/masque/ip/*/*/"},
-		},
-		{
-			Input: `{
-				"host": "example.com:8443",
-				"path": "/.well-known/masque/ip/{target}/{ipproto}/",
-				"headers": {"Authorization": "Basic dTpw"}
-			}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{
-				Host:    "example.com:8443",
-				Path:    "/.well-known/masque/ip/*/*/",
-				Headers: map[string]string{"Authorization": "Basic dTpw"},
-			},
-		},
-		{
-			Input:  `{"path": "/masque/ip{?target,ipproto}"}`,
-			Parser: loadJSON(creator),
-			Output: &masque.Config{Path: "/masque/ip?target=*&ipproto=*"},
-		},
-	})
-
-	for _, input := range []string{
-		`{"path": "/masque/{target}/{ipproto}/{dns}"}`,
-		`{"path": "masque"}`,
-		`{"host": "example.com/path"}`,
-		`{"headers": {"host": "example.com"}}`,
-		`{"headers": {"Capsule-Protocol": "?0"}}`,
-		`{"headers": {"X Token": "a"}}`,
-		`{"headers": {"X-Token": "a\r\nb"}}`,
-	} {
-		if _, err := loadJSON(creator)(input); err == nil {
-			t.Errorf("expected an error for %s", input)
-		}
-	}
-}
-
-func TestMasqueOutboundConfig(t *testing.T) {
-	build := func(s string) error {
-		c := new(OutboundDetourConfig)
-		if err := json.Unmarshal([]byte(s), c); err != nil {
-			return err
-		}
-		_, err := c.Build()
-		return err
-	}
-
-	if err := build(`{
-		"protocol": "masque",
-		"settings": {"address": "example.com", "port": 443},
-		"streamSettings": {"network": "masque", "security": "tls"},
-		"mux": {"enabled": false, "concurrency": -1}
-	}`); err != nil {
-		t.Error(err)
-	}
-	for _, input := range []string{
-		`{"protocol": "masque", "settings": {"address": "example.com"}, "streamSettings": {"network": "masque", "security": "tls"}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true}}`,
-		`{"protocol": "masque", "settings": {"address": "example.com", "port": 443}, "streamSettings": {"network": "masque", "security": "tls"}, "mux": {"enabled": true, "concurrency": -1}}`,
-		`{"protocol": "freedom", "streamSettings": {"network": "masque", "security": "tls"}}`,
-	} {
-		if err := build(input); err == nil {
-			t.Errorf("expected an error for %s", input)
-		}
-	}
-}

infra/conf/observatory.go

@@ -23,7 +23,7 @@ func (o *ObservatoryConfig) Build() (proto.Message, error) {
 type BurstObservatoryConfig struct {
 	SubjectSelector []string `json:"subjectSelector"`
 	// health check settings
-	HealthCheck *HealthCheckSettings `json:"pingConfig,omitempty"`
+	HealthCheck *healthCheckSettings `json:"pingConfig,omitempty"`
 }
 
 func (b BurstObservatoryConfig) Build() (proto.Message, error) {

infra/conf/router.go

@@ -7,7 +7,6 @@ import (
 	"github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata"
-	"github.com/xtls/xray-core/common/platform"
 	"github.com/xtls/xray-core/common/serial"
 
 	"google.golang.org/protobuf/proto"
@@ -73,7 +72,6 @@ type RouterConfig struct {
 	RuleList       []json.RawMessage `json:"rules"`
 	DomainStrategy *string           `json:"domainStrategy"`
 	Balancers      []*BalancingRule  `json:"balancers"`
-	Script         string            `json:"script"`
 }
 
 func (c *RouterConfig) getDomainStrategy() router.Config_DomainStrategy {
@@ -94,15 +92,6 @@ func (c *RouterConfig) getDomainStrategy() router.Config_DomainStrategy {
 
 func (c *RouterConfig) Build() (*router.Config, error) {
 	config := new(router.Config)
-
-	if c.Script != "" {
-		path, err := platform.ResolveLuaFile(c.Script)
-		if err != nil {
-			return nil, errors.New("failed to resolve routing script").Base(err)
-		}
-		config.Script = path
-	}
-
 	config.DomainStrategy = c.getDomainStrategy()
 
 	var rawRuleList []json.RawMessage
@@ -159,7 +148,6 @@ func parseFieldRule(msg json.RawMessage) (*router.RoutingRule, error) {
 		LocalIP    *StringList        `json:"localIP"`
 		LocalPort  *PortList          `json:"localPort"`
 		Process    *StringList        `json:"process"`
-		LocalOS    *StringList        `json:"localOS"`
 		Webhook    *WebhookRuleConfig `json:"webhook"`
 	}
 	rawFieldRule := new(RawFieldRule)
@@ -273,10 +261,6 @@ func parseFieldRule(msg json.RawMessage) (*router.RoutingRule, error) {
 		rule.Process = *rawFieldRule.Process
 	}
 
-	if rawFieldRule.LocalOS != nil && len(*rawFieldRule.LocalOS) > 0 {
-		rule.LocalOs = *rawFieldRule.LocalOS
-	}
-
 	if rawFieldRule.Webhook != nil && rawFieldRule.Webhook.URL != "" {
 		rule.Webhook = &router.WebhookConfig{
 			Url:           rawFieldRule.Webhook.URL,

infra/conf/router_strategy.go

@@ -43,8 +43,8 @@ type strategyLeastLoadConfig struct {
 	Tolerance float64 `json:"tolerance,omitempty"`
 }
 
-// HealthCheckSettings holds settings for health Checker
-type HealthCheckSettings struct {
+// healthCheckSettings holds settings for health Checker
+type healthCheckSettings struct {
 	Destination   string            `json:"destination"`
 	Connectivity  string            `json:"connectivity"`
 	Interval      duration.Duration `json:"interval"`
@@ -53,7 +53,7 @@ type HealthCheckSettings struct {
 	HttpMethod    string            `json:"httpMethod"`
 }
 
-func (h HealthCheckSettings) Build() (proto.Message, error) {
+func (h healthCheckSettings) Build() (proto.Message, error) {
 	var httpMethod string
 	if h.HttpMethod == "" {
 		httpMethod = "HEAD"

infra/conf/router_test.go

@@ -2,8 +2,6 @@ package conf_test
 
 import (
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"testing"
 	"time"
 	_ "unsafe"
@@ -238,39 +236,3 @@ func TestRouterConfig(t *testing.T) {
 		},
 	})
 }
-
-func TestRouterScriptConfig(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("xray.location.confdir", dir)
-	path := filepath.Join(dir, "route.lua")
-	if err := os.WriteFile(path, []byte("function HandleRoute() end"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	for _, tc := range []struct {
-		name      string
-		script    string
-		wantError bool
-	}{
-		{"relative", "route.lua", false},
-		{"absolute", path, false},
-		{"missing", "missing.lua", true},
-		{"directory", dir, true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			built, err := (&RouterConfig{Script: tc.script}).Build()
-			if tc.wantError {
-				if err == nil {
-					t.Fatal("Build accepted invalid script path")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if built.Script != path {
-				t.Fatalf("script path = %q, want %q", built.Script, path)
-			}
-		})
-	}
-}

infra/conf/transport_finalmask.go

@@ -1,17 +1,14 @@
 package conf
 
 import (
-	"crypto/x509"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"net/netip"
 	"net/url"
 	"regexp"
 	"strings"
 
-	googleuuid "github.com/google/uuid"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
@@ -23,10 +20,8 @@ import (
 	"github.com/xtls/xray-core/transport/internet/finalmask/realm"
 	"github.com/xtls/xray-core/transport/internet/finalmask/salamander"
 	"github.com/xtls/xray-core/transport/internet/finalmask/sudoku"
-	"github.com/xtls/xray-core/transport/internet/finalmask/udphop"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xdns"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xicmp"
-	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
 	"github.com/xtls/xray-core/transport/internet/tls"
 	"google.golang.org/protobuf/proto"
 )
@@ -72,7 +67,6 @@ var (
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
-		"xmc":           func() interface{} { return new(XMC) },
 	}, "type", "settings")
 
 	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
@@ -84,7 +78,6 @@ var (
 		"xdns":          func() interface{} { return new(Xdns) },
 		"xicmp":         func() interface{} { return new(Xicmp) },
 		"realm":         func() interface{} { return new(Realm) },
-		"udphop":        func() interface{} { return new(UDPHop) },
 	}, "type", "settings")
 )
 
@@ -722,81 +715,6 @@ func (c *Xdns) Build() (proto.Message, error) {
 	}, nil
 }
 
-type XMC struct {
-	Hostname string       `json:"hostname"`
-	Profiles []XMCProfile `json:"profiles"`
-	Password string       `json:"password"`
-}
-
-type XMCProfile struct {
-	// Resolve the UUID by username, then request the session profile with
-	// unsigned=false. Client and server must use the same signed profile.
-	Username          string `json:"username"`
-	UUID              string `json:"uuid"`
-	TexturesValue     string `json:"texturesValue"`
-	TexturesSignature string `json:"texturesSignature"`
-}
-
-var xmcUsernamePattern = regexp.MustCompile(`^[A-Za-z0-9_]{3,16}$`)
-
-func (c *XMCProfile) Build() (*xmc.Profile, error) {
-	if !xmcUsernamePattern.MatchString(c.Username) {
-		return nil, fmt.Errorf("invalid minecraft profile username: %q", c.Username)
-	}
-
-	profileUUID, err := googleuuid.Parse(c.UUID)
-	if err != nil {
-		return nil, fmt.Errorf("invalid minecraft profile UUID: %w", err)
-	}
-	if c.TexturesValue == "" || c.TexturesSignature == "" {
-		return nil, fmt.Errorf("incomplete minecraft profile textures")
-	}
-
-	return &xmc.Profile{
-		Username:          c.Username,
-		Uuid:              append([]byte(nil), profileUUID[:]...),
-		TexturesValue:     c.TexturesValue,
-		TexturesSignature: c.TexturesSignature,
-	}, nil
-}
-
-func (c *XMC) Build() (proto.Message, error) {
-	if len(c.Profiles) == 0 {
-		return nil, fmt.Errorf("minecraft profiles are required")
-	}
-
-	if c.Password == "" {
-		return nil, fmt.Errorf("empty password")
-	}
-
-	rsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)
-	if err != nil {
-		return nil, fmt.Errorf("derive minecraft rsa key: %w", err)
-	}
-
-	rsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("marshal minecraft rsa public key: %w", err)
-	}
-
-	profiles := make([]*xmc.Profile, 0, len(c.Profiles))
-	for i := range c.Profiles {
-		profile, err := c.Profiles[i].Build()
-		if err != nil {
-			return nil, fmt.Errorf("build minecraft profile %d: %w", i, err)
-		}
-		profiles = append(profiles, profile)
-	}
-
-	return &xmc.Config{
-		Password:      c.Password,
-		Hostname:      c.Hostname,
-		RsaPrivateKey: x509.MarshalPKCS1PrivateKey(rsaPrivateKey),
-		RsaPublicKey:  rsaPublicKey,
-		Profiles:      profiles,
-	}, nil
-}
-
 type Xicmp struct {
 	DGRAM bool     `json:"dgram"`
 	IPs   []string `json:"ips"`
@@ -818,11 +736,9 @@ func (c *Xicmp) Build() (proto.Message, error) {
 }
 
 type Realm struct {
-	Url         string             `json:"url"`
-	StunServers []string           `json:"stunServers"`
-	TlsConfig   *TLSConfig         `json:"tlsConfig"`
-	IPMode      string             `json:"ipMode"`
-	PortMapping *realm.PortMapping `json:"portMapping"`
+	Url         string     `json:"url"`
+	StunServers []string   `json:"stunServers"`
+	TlsConfig   *TLSConfig `json:"tlsConfig"`
 }
 
 func (c *Realm) Build() (proto.Message, error) {
@@ -902,54 +818,6 @@ func (c *Realm) Build() (proto.Message, error) {
 		ID:          id,
 		StunServers: stunServers,
 		TlsConfig:   tlsConfig,
-		IPMode:      strings.ToLower(c.IPMode),
-		PortMapping: c.PortMapping,
-	}, nil
-}
-
-type UDPHop struct {
-	Mode        string     `json:"mode"`
-	Interval    Int32Range `json:"interval"`
-	RemoteIPs   []string   `json:"remoteIPs"`
-	RemotePorts PortList   `json:"remotePorts"`
-}
-
-func (c *UDPHop) Build() (proto.Message, error) {
-	var local, remote, remoteOnce bool
-	for _, mode := range strings.Split(c.Mode, ",") {
-		switch strings.ToLower(mode) {
-		case "intervallocal":
-			local = true
-		case "intervalremote":
-			remote = true
-		case "perconnremote":
-			remoteOnce = true
-		default:
-			return nil, errors.New("invalid mode ", mode)
-		}
-	}
-	var remoteIPs []string
-	for _, ip := range c.RemoteIPs {
-		prefix, err := netip.ParsePrefix(ip)
-		if err == nil {
-			remoteIPs = append(remoteIPs, prefix.String())
-			continue
-		}
-		addr, err := netip.ParseAddr(ip)
-		if err == nil {
-			remoteIPs = append(remoteIPs, netip.PrefixFrom(addr, addr.BitLen()).String())
-			continue
-		}
-		return nil, errors.New("invalid ip ", ip)
-	}
-	return &udphop.Config{
-		Local:       local,
-		Remote:      remote,
-		RemoteOnce:  remoteOnce,
-		IntervalMin: int64(c.Interval.From),
-		IntervalMax: int64(c.Interval.To),
-		RemoteIPs:   remoteIPs,
-		RemotePorts: c.RemotePorts.Build().Ports(),
 	}, nil
 }
 
@@ -980,23 +848,20 @@ func (c *Mask) Build(tcp bool) (proto.Message, error) {
 }
 
 type QuicParamsConfig struct {
-	Congestion                    string    `json:"congestion"`
-	Debug                         bool      `json:"debug"`
-	BbrProfile                    string    `json:"bbrProfile"`
-	BrutalUp                      Bandwidth `json:"brutalUp"`
-	BrutalDown                    Bandwidth `json:"brutalDown"`
-	BrutalDisableLossCompensation bool      `json:"brutalDisableLossCompensation"`
-	InitStreamReceiveWindow       uint64    `json:"initStreamReceiveWindow"`
-	MaxStreamReceiveWindow        uint64    `json:"maxStreamReceiveWindow"`
-	InitConnectionReceiveWindow   uint64    `json:"initConnectionReceiveWindow"`
-	MaxConnectionReceiveWindow    uint64    `json:"maxConnectionReceiveWindow"`
-	MaxIdleTimeout                int64     `json:"maxIdleTimeout"`
-	KeepAlivePeriod               int64     `json:"keepAlivePeriod"`
-	DisablePathMTUDiscovery       bool      `json:"disablePathMTUDiscovery"`
-	DisableChromeParrot           bool      `json:"disableChromeParrot"`
-	DisableGSO                    bool      `json:"disableGSO"`
-	MaxIncomingStreams            int64     `json:"maxIncomingStreams"`
-	DisableStatelessReset         bool      `json:"disableStatelessReset"`
+	Congestion                  string    `json:"congestion"`
+	Debug                       bool      `json:"debug"`
+	BbrProfile                  string    `json:"bbrProfile"`
+	BrutalUp                    Bandwidth `json:"brutalUp"`
+	BrutalDown                  Bandwidth `json:"brutalDown"`
+	UdpHop                      UdpHop    `json:"udpHop"`
+	InitStreamReceiveWindow     uint64    `json:"initStreamReceiveWindow"`
+	MaxStreamReceiveWindow      uint64    `json:"maxStreamReceiveWindow"`
+	InitConnectionReceiveWindow uint64    `json:"initConnectionReceiveWindow"`
+	MaxConnectionReceiveWindow  uint64    `json:"maxConnectionReceiveWindow"`
+	MaxIdleTimeout              int64     `json:"maxIdleTimeout"`
+	KeepAlivePeriod             int64     `json:"keepAlivePeriod"`
+	DisablePathMTUDiscovery     bool      `json:"disablePathMTUDiscovery"`
+	MaxIncomingStreams          int64     `json:"maxIncomingStreams"`
 }
 
 type FinalMask struct {

infra/conf/transport_finalmask_xmc_test.go

@@ -1,36 +0,0 @@
-package conf
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
-)
-
-func TestXMCBuildProfile(t *testing.T) {
-	built, err := (&XMC{
-		Password: "test-password",
-		Profiles: []XMCProfile{
-			{
-				Username:          "TestUser",
-				UUID:              "00112233-4455-6677-8899-aabbccddeeff",
-				TexturesValue:     "textures-value",
-				TexturesSignature: "textures-signature",
-			},
-		},
-	}).Build()
-	if err != nil {
-		t.Fatalf("build XMC config: %v", err)
-	}
-	config := built.(*xmc.Config)
-	if len(config.Profiles) != 1 || len(config.Profiles[0].Uuid) != 16 {
-		t.Fatalf("unexpected profiles: %+v", config.Profiles)
-	}
-}
-
-func TestXMCBuildRequiresProfile(t *testing.T) {
-	_, err := (&XMC{Password: "test-password"}).Build()
-	if err == nil || !strings.Contains(err.Error(), "profiles are required") {
-		t.Fatalf("expected required profiles error, got %v", err)
-	}
-}

infra/conf/transport_internet.go

@@ -36,10 +36,6 @@ func (p TransportProtocol) Build() (string, error) {
 		return "", errors.PrintRemovedFeatureError("QUIC transport (without web service, etc.)", "XHTTP stream-one H3")
 	case "hysteria":
 		return "hysteria", nil
-	case "masque":
-		return "masque", nil
-	case "xdrive":
-		return "xdrive", nil
 	default:
 		return "", errors.New("Config: unknown transport protocol: ", p)
 	}
@@ -63,8 +59,6 @@ type StreamConfig struct {
 	WSSettings          *WebSocketConfig   `json:"wsSettings"`
 	HTTPUPGRADESettings *HttpUpgradeConfig `json:"httpupgradeSettings"`
 	HysteriaSettings    *HysteriaConfig    `json:"hysteriaSettings"`
-	MASQUESettings      *MasqueConfig      `json:"masqueSettings"`
-	XDRIVESettings      *XDriveConfig      `json:"xdriveSettings"`
 	SocketSettings      *SocketConfig      `json:"sockopt"`
 }
 
@@ -198,26 +192,6 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 			Settings:     serial.ToTypedMessage(hs),
 		})
 	}
-	if c.MASQUESettings != nil {
-		ms, err := c.MASQUESettings.Build()
-		if err != nil {
-			return nil, errors.New("Failed to build MASQUE config.").Base(err)
-		}
-		config.TransportSettings = append(config.TransportSettings, &internet.TransportConfig{
-			ProtocolName: "masque",
-			Settings:     serial.ToTypedMessage(ms),
-		})
-	}
-	if c.XDRIVESettings != nil {
-		xs, err := c.XDRIVESettings.Build()
-		if err != nil {
-			return nil, errors.New("Failed to build XDRIVE config.").Base(err)
-		}
-		config.TransportSettings = append(config.TransportSettings, &internet.TransportConfig{
-			ProtocolName: "xdrive",
-			Settings:     serial.ToTypedMessage(xs),
-		})
-	}
 	if c.SocketSettings != nil {
 		ss, err := c.SocketSettings.Build()
 		if err != nil {
@@ -279,6 +253,10 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 				return nil, errors.New("unknown congestion control: ", c.FinalMask.QuicParams.Congestion, ", valid values: reno, bbr, brutal, force-brutal")
 			}
 
+			if (c.FinalMask.QuicParams.UdpHop.Interval.From != 0 && c.FinalMask.QuicParams.UdpHop.Interval.From < 5) || (c.FinalMask.QuicParams.UdpHop.Interval.To != 0 && c.FinalMask.QuicParams.UdpHop.Interval.To < 5) {
+				return nil, errors.New("Interval must be at least 5")
+			}
+
 			if c.FinalMask.QuicParams.InitStreamReceiveWindow > 0 && c.FinalMask.QuicParams.InitStreamReceiveWindow < 16384 {
 				return nil, errors.New("InitStreamReceiveWindow must be at least 16384")
 			}
@@ -307,25 +285,44 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 			}
 
 			config.QuicParams = &internet.QuicParams{
-				Congestion:                    c.FinalMask.QuicParams.Congestion,
-				BbrProfile:                    profile,
-				BrutalUp:                      up,
-				BrutalDown:                    down,
-				BrutalDisableLossCompensation: c.FinalMask.QuicParams.BrutalDisableLossCompensation,
-				InitStreamReceiveWindow:       c.FinalMask.QuicParams.InitStreamReceiveWindow,
-				MaxStreamReceiveWindow:        c.FinalMask.QuicParams.MaxStreamReceiveWindow,
-				InitConnReceiveWindow:         c.FinalMask.QuicParams.InitConnectionReceiveWindow,
-				MaxConnReceiveWindow:          c.FinalMask.QuicParams.MaxConnectionReceiveWindow,
-				MaxIdleTimeout:                c.FinalMask.QuicParams.MaxIdleTimeout,
-				KeepAlivePeriod:               c.FinalMask.QuicParams.KeepAlivePeriod,
-				DisablePathMtuDiscovery:       c.FinalMask.QuicParams.DisablePathMTUDiscovery,
-				DisableChromeParrot:           c.FinalMask.QuicParams.DisableChromeParrot,
-				DisableGSO:                    c.FinalMask.QuicParams.DisableGSO,
-				MaxIncomingStreams:            c.FinalMask.QuicParams.MaxIncomingStreams,
-				DisableStatelessReset:         c.FinalMask.QuicParams.DisableStatelessReset,
+				Congestion: c.FinalMask.QuicParams.Congestion,
+				BbrProfile: profile,
+				BrutalUp:   up,
+				BrutalDown: down,
+				UdpHop: &internet.UdpHop{
+					Ports:       c.FinalMask.QuicParams.UdpHop.PortList.Build().Ports(),
+					IntervalMin: int64(c.FinalMask.QuicParams.UdpHop.Interval.From),
+					IntervalMax: int64(c.FinalMask.QuicParams.UdpHop.Interval.To),
+				},
+				InitStreamReceiveWindow: c.FinalMask.QuicParams.InitStreamReceiveWindow,
+				MaxStreamReceiveWindow:  c.FinalMask.QuicParams.MaxStreamReceiveWindow,
+				InitConnReceiveWindow:   c.FinalMask.QuicParams.InitConnectionReceiveWindow,
+				MaxConnReceiveWindow:    c.FinalMask.QuicParams.MaxConnectionReceiveWindow,
+				MaxIdleTimeout:          c.FinalMask.QuicParams.MaxIdleTimeout,
+				KeepAlivePeriod:         c.FinalMask.QuicParams.KeepAlivePeriod,
+				DisablePathMtuDiscovery: c.FinalMask.QuicParams.DisablePathMTUDiscovery,
+				MaxIncomingStreams:      c.FinalMask.QuicParams.MaxIncomingStreams,
 			}
 		}
 	}
 
 	return config, nil
 }
+
+type ProxyConfig struct {
+	Tag string `json:"tag"`
+
+	// TransportLayerProxy: For compatibility.
+	TransportLayerProxy bool `json:"transportLayer"`
+}
+
+// Build implements Buildable.
+func (v *ProxyConfig) Build() (*internet.ProxyConfig, error) {
+	if v.Tag == "" {
+		return nil, errors.New("Proxy tag is not set.")
+	}
+	return &internet.ProxyConfig{
+		Tag:                 v.Tag,
+		TransportLayerProxy: v.TransportLayerProxy,
+	}, nil
+}

infra/conf/transport_method.go

@@ -1,6 +1,7 @@
 package conf
 
 import (
+	"context"
 	"encoding/json"
 	"math/big"
 	"net/url"
@@ -20,12 +21,9 @@ import (
 	"github.com/xtls/xray-core/transport/internet/httpupgrade"
 	"github.com/xtls/xray-core/transport/internet/hysteria"
 	"github.com/xtls/xray-core/transport/internet/kcp"
-	"github.com/xtls/xray-core/transport/internet/masque"
 	"github.com/xtls/xray-core/transport/internet/splithttp"
 	"github.com/xtls/xray-core/transport/internet/tcp"
 	"github.com/xtls/xray-core/transport/internet/websocket"
-	"github.com/xtls/xray-core/transport/internet/xdrive"
-	"golang.org/x/net/http/httpguts"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -452,8 +450,8 @@ func (c *SplitHTTPConfig) Build() (proto.Message, error) {
 		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
 	}
 	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConnections.From = 3
-		c.Xmux.MaxConnections.To = 3
+		c.Xmux.MaxConnections.From = 6
+		c.Xmux.MaxConnections.To = 6
 		c.Xmux.HMaxRequestTimes.From = 600
 		c.Xmux.HMaxRequestTimes.To = 900
 		c.Xmux.HMaxReusableSecs.From = 1800
@@ -536,6 +534,10 @@ type KCPConfig struct {
 
 // Build implements Buildable.
 func (c *KCPConfig) Build() (proto.Message, error) {
+	if c.HeaderConfig != nil || c.Seed != nil {
+		return nil, errors.PrintRemovedFeatureError("mkcp header & seed", "finalmask/udp header-* & mkcp-original & mkcp-aes128gcm")
+	}
+
 	config := common.Must2(internet.CreateTransportConfig(kcp.ProtocolName)).(*kcp.Config)
 
 	if c.Mtu != nil {
@@ -558,16 +560,16 @@ func (c *KCPConfig) Build() (proto.Message, error) {
 	}
 
 	if config.Mtu < 21 {
-		return nil, errors.New("MTU must be at least 21")
+		return nil, errors.New("Mtu must be at least 21").AtError()
 	}
 	if config.Tti < 10 || config.Tti > 1000 {
-		return nil, errors.New("TTI must be between 10 and 1000")
+		return nil, errors.New("invalid mKCP TTI: ", c.Tti).AtError()
 	}
 	if config.CwndMultiplier < 1 {
-		return nil, errors.New("CwndMultiplier must be at least 1")
+		return nil, errors.New("CwndMultiplier must be at least 1").AtError()
 	}
 	if config.GetSendingBufferSize() == 0 {
-		return nil, errors.New("MaxSendingWindow must be at least ", config.Mtu)
+		return nil, errors.New("MaxSendingWindow must be >= Mtu").AtError()
 	}
 
 	return config, nil
@@ -737,6 +739,11 @@ func (b Bandwidth) Bps() (uint64, error) {
 	return uint64(val*float64(mul)) / 8, nil
 }
 
+type UdpHop struct {
+	PortList PortList   `json:"ports"`
+	Interval Int32Range `json:"interval"`
+}
+
 type Masquerade struct {
 	Type string `json:"type"`
 
@@ -744,7 +751,6 @@ type Masquerade struct {
 
 	Url         string `json:"url"`
 	RewriteHost bool   `json:"rewriteHost"`
-	XForwarded  bool   `json:"xForwarded"`
 	Insecure    bool   `json:"insecure"`
 
 	Content    string            `json:"content"`
@@ -753,8 +759,14 @@ type Masquerade struct {
 }
 
 type HysteriaConfig struct {
-	Version        int32      `json:"version"`
-	Auth           string     `json:"auth"`
+	Version int32  `json:"version"`
+	Auth    string `json:"auth"`
+
+	Congestion *string    `json:"congestion"`
+	Up         *Bandwidth `json:"up"`
+	Down       *Bandwidth `json:"down"`
+	UdpHop     *UdpHop    `json:"udphop"`
+
 	UdpIdleTimeout int64      `json:"udpIdleTimeout"`
 	Masquerade     Masquerade `json:"masquerade"`
 }
@@ -764,6 +776,10 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 		return nil, errors.New("version != 2")
 	}
 
+	if c.Congestion != nil || c.Up != nil || c.Down != nil || c.UdpHop != nil {
+		errors.LogWarning(context.Background(), "congestion & up & down & udphop move to finalmask/quicParams")
+	}
+
 	if c.UdpIdleTimeout != 0 && (c.UdpIdleTimeout < 2 || c.UdpIdleTimeout > 600) {
 		return nil, errors.New("UdpIdleTimeout must be between 2 and 600")
 	}
@@ -775,7 +791,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	config.MasqFile = c.Masquerade.Dir
 	config.MasqUrl = c.Masquerade.Url
 	config.MasqUrlRewriteHost = c.Masquerade.RewriteHost
-	config.MasqUrlXForwarded = c.Masquerade.XForwarded
 	config.MasqUrlInsecure = c.Masquerade.Insecure
 	config.MasqString = c.Masquerade.Content
 	config.MasqStringHeaders = c.Masquerade.Headers
@@ -788,46 +803,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	return config, nil
 }
 
-type MasqueConfig struct {
-	Host    string            `json:"host"`
-	Path    string            `json:"path"`
-	Headers map[string]string `json:"headers"`
-}
-
-func (c *MasqueConfig) Build() (proto.Message, error) {
-	path := c.Path
-	if path == "" {
-		path = masque.DefaultPath
-	}
-	path = strings.NewReplacer(
-		"{target}", "*", "{ipproto}", "*",
-		"{?target,ipproto}", "?target=*&ipproto=*", "{?ipproto,target}", "?ipproto=*&target=*",
-		"{&target,ipproto}", "&target=*&ipproto=*", "{&ipproto,target}", "&ipproto=*&target=*",
-	).Replace(path)
-	if !strings.HasPrefix(path, "/") || strings.ContainsAny(path, "{}") {
-		return nil, errors.New(`invalid "path": `, path, `, only the variables {target} and {ipproto} are supported`)
-	}
-	if c.Host != "" {
-		if u, err := url.Parse("https://" + c.Host); err != nil || u.Host != c.Host {
-			return nil, errors.New(`invalid "host": `, c.Host)
-		}
-	}
-	for k, v := range c.Headers {
-		if !httpguts.ValidHeaderFieldName(k) || !httpguts.ValidHeaderFieldValue(v) {
-			return nil, errors.New(`invalid header in "headers": `, strconv.Quote(k))
-		}
-		switch strings.ToLower(k) {
-		case "host", "capsule-protocol":
-			return nil, errors.New(`"headers" can't contain "`, k, `"`)
-		}
-	}
-	return &masque.Config{
-		Host:    c.Host,
-		Path:    path,
-		Headers: c.Headers,
-	}, nil
-}
-
 func readFileOrString(f string, s []string) ([]byte, error) {
 	if len(f) > 0 {
 		return filesystem.ReadCert(f)
@@ -837,50 +812,3 @@ func readFileOrString(f string, s []string) ([]byte, error) {
 	}
 	return nil, errors.New("both file and bytes are empty.")
 }
-
-type XDriveConfig struct {
-	RemoteFolder      string          `json:"remoteFolder"`
-	Service           string          `json:"service"`
-	Secrets           []string        `json:"secrets"`
-	SegmentBytes      uint32          `json:"segmentBytes"`
-	FlushIntervalMs   uint32          `json:"flushIntervalMs"`
-	PollIntervalMs    uint32          `json:"pollIntervalMs"`
-	MaxPollIntervalMs uint32          `json:"maxPollIntervalMs"`
-	SessionTTLSeconds uint32          `json:"sessionTtlSeconds"`
-	Concurrency       uint32          `json:"concurrency"`
-	EagerWindowMs     uint32          `json:"eagerWindowMs"`
-	HoleTimeoutMs     uint32          `json:"holeTimeoutMs"`
-	Template          json.RawMessage `json:"template"`
-}
-
-// Build implements Buildable.
-func (c *XDriveConfig) Build() (proto.Message, error) {
-	switch c.Service {
-	case "local":
-	case "Google Drive":
-		if len(c.Secrets) != 3 {
-			return nil, errors.New("Google Drive needs 3 secrets in order of ClientID, ClientSecret, RefreshToken")
-		}
-	case "template":
-		if len(c.Template) == 0 {
-			return nil, errors.New(`service "template" needs a "template" object`)
-		}
-	default:
-		return nil, errors.New("unsupported service")
-	}
-	config := &xdrive.Config{
-		RemoteFolder:      c.RemoteFolder,
-		Service:           c.Service,
-		Secrets:           c.Secrets,
-		SegmentBytes:      c.SegmentBytes,
-		FlushIntervalMs:   c.FlushIntervalMs,
-		PollIntervalMs:    c.PollIntervalMs,
-		MaxPollIntervalMs: c.MaxPollIntervalMs,
-		SessionTtlSeconds: c.SessionTTLSeconds,
-		Concurrency:       c.Concurrency,
-		EagerWindowMs:     c.EagerWindowMs,
-		HoleTimeoutMs:     c.HoleTimeoutMs,
-		Template:          string(c.Template),
-	}
-	return config, nil
-}

infra/conf/transport_security.go

@@ -113,10 +113,6 @@ func (c *REALITYConfig) Build() (proto.Message, error) {
 					config.MinClientVer[i] = byte(u)
 				}
 			}
-			// errors.LogWarning(context.Background(), `REALITY: Changing "minClientVer" will increase the likelihood of your server's IP being blocked by the GFW`)
-		} else {
-			// config.MinClientVer = []byte{26, 3, 27} // change it at your own risk: https://github.com/XTLS/Xray-core/commit/af7eb68028732a8ee3c0e5d6ab2b8a657bb2e770
-			// errors.LogWarning(context.Background(), `REALITY: The default minimal client version is Xray-core v26.3.27, other clients may be refused to connect`)
 		}
 		if c.MaxClientVer != "" {
 			config.MaxClientVer = make([]byte, 3)
@@ -161,10 +157,8 @@ func (c *REALITYConfig) Build() (proto.Message, error) {
 		}
 
 		for _, sn := range config.ServerNames {
-			sn = strings.ToLower(sn)
-			if strings.HasSuffix(sn, ".ru") || strings.HasSuffix(sn, ".ir") || strings.HasSuffix(sn, ".cn") ||
-				strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") || strings.Contains(sn, "microsoft") {
-				errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target will increase the likelihood of your server's IP being blocked by the GFW`)
+			if strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") {
+				errors.LogWarning(context.Background(), `REALITY: Choosing apple, icloud, etc. as the target may get your IP blocked by the GFW`)
 			}
 		}
 

infra/conf/transport_sockopt.go

@@ -10,7 +10,7 @@ import (
 )
 
 type CustomSockoptConfig struct {
-	System  string `json:"system"`
+	Syetem  string `json:"system"`
 	Network string `json:"network"`
 	Level   string `json:"level"`
 	Opt     string `json:"opt"`
@@ -124,7 +124,7 @@ func (c *SocketConfig) Build() (*internet.SocketConfig, error) {
 
 	for _, copt := range c.CustomSockopt {
 		customSockopt := &internet.CustomSockopt{
-			System:  copt.System,
+			System:  copt.Syetem,
 			Network: copt.Network,
 			Level:   copt.Level,
 			Opt:     copt.Opt,

infra/conf/transport_test.go

@@ -291,76 +291,3 @@ func TestHeaderCustomUDPBuildRejectsExprWithoutArgs(t *testing.T) {
 		t.Fatalf("expected transform arg rejection, got %v", err)
 	}
 }
-
-func TestXDriveStreamConfig(t *testing.T) {
-	config := new(StreamConfig)
-	if err := json.Unmarshal([]byte(`{
-		"method": "xdrive",
-		"xdriveSettings": {
-			"remoteFolder": "/tmp/xdrive",
-			"service": "local"
-		}
-	}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-
-	built, err := config.Build()
-	if err != nil {
-		t.Fatalf("Build: %v", err)
-	}
-	if built.ProtocolName != "xdrive" {
-		t.Fatalf("ProtocolName is %q, want %q", built.ProtocolName, "xdrive")
-	}
-	if len(built.TransportSettings) != 1 || built.TransportSettings[0].ProtocolName != "xdrive" {
-		t.Fatalf("TransportSettings is %v, want a single xdrive entry", built.TransportSettings)
-	}
-}
-
-func TestXDriveRejectsUnknownService(t *testing.T) {
-	config := new(XDriveConfig)
-	if err := json.Unmarshal([]byte(`{"remoteFolder": "/tmp/xdrive", "service": "Dropbox"}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-	if _, err := config.Build(); err == nil {
-		t.Fatal("Build accepted an unsupported service")
-	}
-}
-
-func TestXDriveTemplateStreamConfig(t *testing.T) {
-	config := new(StreamConfig)
-	if err := json.Unmarshal([]byte(`{
-		"method": "xdrive",
-		"xdriveSettings": {
-			"remoteFolder": "folder",
-			"service": "template",
-			"secrets": ["user", "pass"],
-			"template": {
-				"flatten": true,
-				"auth": {"type": "basic", "username": "{secret0}", "password": "{secret1}"},
-				"put": {"method": "PUT", "url": "https://dav.example/{folder}/{name}"},
-				"get": {"method": "GET", "url": "https://dav.example/{folder}/{name}"},
-				"delete": {"method": "DELETE", "url": "https://dav.example/{folder}/{name}"},
-				"list": {"method": "PROPFIND", "url": "https://dav.example/{folder}/", "namesRegex": "<d:href>/folder/([^<]+)</d:href>"}
-			}
-		}
-	}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-	built, err := config.Build()
-	if err != nil {
-		t.Fatalf("Build: %v", err)
-	}
-	if built.ProtocolName != "xdrive" {
-		t.Fatalf("ProtocolName is %q, want xdrive", built.ProtocolName)
-	}
-}
-
-func TestXDriveTemplateNeedsTemplate(t *testing.T) {
-	config := new(XDriveConfig)
-	if err := json.Unmarshal([]byte(`{"remoteFolder": "f", "service": "template"}`), config); err != nil {
-		t.Fatalf("Unmarshal: %v", err)
-	}
-	if _, err := config.Build(); err == nil {
-		t.Fatal("Build accepted a template service without a template")
-	}
-}

infra/conf/tun.go

@@ -1,19 +1,12 @@
 package conf
 
 import (
-	"crypto/rand"
-	"fmt"
-	"math/big"
-	"net"
-	"strconv"
-
 	"github.com/xtls/xray-core/proxy/tun"
 	"google.golang.org/protobuf/proto"
 )
 
 type TunConfig struct {
 	Name                   string   `json:"name"`
-	Desc                   string   `json:"desc"`
 	MTU                    uint32   `json:"mtu"`
 	Gateway                []string `json:"gateway"`
 	DNS                    []string `json:"dns"`
@@ -25,7 +18,6 @@ type TunConfig struct {
 func (v *TunConfig) Build() (proto.Message, error) {
 	config := &tun.Config{
 		Name:                   v.Name,
-		Desc:                   v.Desc,
 		MTU:                    v.MTU,
 		Gateway:                v.Gateway,
 		DNS:                    v.DNS,
@@ -40,71 +32,10 @@ func (v *TunConfig) Build() (proto.Message, error) {
 	}
 
 	if config.Name == "" {
-		name, err := GetAvailableTunName()
-		if err != nil {
-			return nil, err
-		}
-		config.Name = name
-	}
-	if config.Desc == "" {
-		config.Desc = "Wintun"
+		config.Name = "xray0"
 	}
 	if config.MTU == 0 {
 		config.MTU = 1500
 	}
 	return config, nil
 }
-
-const (
-	tunNamePrefix = "utun"
-	minTunIndex   = 10
-	maxTunIndex   = 1024
-)
-
-func GetAvailableTunName() (string, error) {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		return "", fmt.Errorf("fail to get system interface information: %w", err)
-	}
-
-	usedNames := make(map[string]struct{}, len(interfaces))
-	for _, iface := range interfaces {
-		usedNames[iface.Name] = struct{}{}
-	}
-
-	startIndex, err := randomInt(minTunIndex, maxTunIndex)
-	if err != nil {
-		return "", fmt.Errorf("fail to generate valid tun name: %w", err)
-	}
-
-	rangeSize := maxTunIndex - minTunIndex + 1
-
-	for offset := 0; offset < rangeSize; offset++ {
-		index := minTunIndex + (startIndex-minTunIndex+offset)%rangeSize
-		name := tunNamePrefix + strconv.Itoa(index)
-
-		if _, exists := usedNames[name]; !exists {
-			return name, nil
-		}
-	}
-
-	return "", fmt.Errorf(
-		"no available TUN interface name in range %s%d-%s%d",
-		tunNamePrefix,
-		minTunIndex,
-		tunNamePrefix,
-		maxTunIndex,
-	)
-}
-
-func randomInt(min, max int) (int, error) {
-	value, err := rand.Int(
-		rand.Reader,
-		big.NewInt(int64(max-min+1)),
-	)
-	if err != nil {
-		return 0, err
-	}
-
-	return min + int(value.Int64()), nil
-}

infra/conf/vless.go

@@ -312,9 +312,6 @@ func (c *VLessOutboundConfig) Build() (proto.Message, error) {
 				if err := json.Unmarshal(rawUser, account); err != nil {
 					return nil, errors.New(`VLESS users: invalid user`).Base(err)
 				}
-				// validateOutboundTransportSecurity needs to see these
-				c.Encryption = account.Encryption
-				c.Address = rec.Address
 				if account.Reverse != nil { // may not be reached: error json unmarshal
 					return nil, errors.New(`VLESS users: please use simplified outbound's config style to use "reverse"`)
 				}

infra/conf/wireguard.go

@@ -59,13 +59,13 @@ func (c *WireGuardPeerConfig) Build() (*wireguard.PeerConfig, error) {
 type WireGuardConfig struct {
 	IsClient bool `json:""`
 
-	NoKernelTun bool                   `json:"noKernelTun"`
-	SecretKey   string                 `json:"secretKey"`
-	Address     []string               `json:"address"`
-	Peers       []*WireGuardPeerConfig `json:"peers"`
-	MTU         int32                  `json:"mtu"`
-	Reserved    []byte                 `json:"reserved"`
-	DNS         []string               `json:"remoteDNS"`
+	NoKernelTun    bool                   `json:"noKernelTun"`
+	SecretKey      string                 `json:"secretKey"`
+	Address        []string               `json:"address"`
+	Peers          []*WireGuardPeerConfig `json:"peers"`
+	MTU            int32                  `json:"mtu"`
+	Reserved       []byte                 `json:"reserved"`
+	DomainStrategy string                 `json:"domainStrategy"`
 }
 
 func (c *WireGuardConfig) Build() (proto.Message, error) {
@@ -124,9 +124,23 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 	}
 	config.Reserved = c.Reserved
 
+	switch strings.ToLower(c.DomainStrategy) {
+	case "forceip", "":
+		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP
+	case "forceipv4":
+		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP4
+	case "forceipv6":
+		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP6
+	case "forceipv4v6":
+		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP46
+	case "forceipv6v4":
+		config.DomainStrategy = wireguard.DeviceConfig_FORCE_IP64
+	default:
+		return nil, errors.New("unsupported domain strategy: ", c.DomainStrategy)
+	}
+
 	config.IsClient = c.IsClient
 	config.NoKernelTun = c.NoKernelTun
-	config.DNS = c.DNS
 
 	return config, nil
 }

infra/conf/xray.go

@@ -3,7 +3,6 @@ package conf
 import (
 	"context"
 	"encoding/json"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -15,8 +14,6 @@ import (
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/serial"
 	core "github.com/xtls/xray-core/core"
-	"github.com/xtls/xray-core/proxy/freedom"
-	"github.com/xtls/xray-core/proxy/masque"
 	"github.com/xtls/xray-core/transport/internet"
 )
 
@@ -49,7 +46,6 @@ var (
 		"vmess":       func() interface{} { return new(VMessOutboundConfig) },
 		"trojan":      func() interface{} { return new(TrojanClientConfig) },
 		"hysteria":    func() interface{} { return new(HysteriaClientConfig) },
-		"masque":      func() interface{} { return new(MasqueClientConfig) },
 		"dns":         func() interface{} { return new(DNSOutboundConfig) },
 		"wireguard":   func() interface{} { return &WireGuardConfig{IsClient: true} },
 	}, "protocol", "settings")
@@ -143,7 +139,7 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 	// TUN inbound doesn't need port configuration as it uses network interface instead
 	if strings.ToLower(c.Protocol) == "tun" {
 		// Skip port validation for TUN
-	} else if c.ListenOn == nil || len(c.ListenOn.String()) == 0 {
+	} else if c.ListenOn == nil {
 		// Listen on anyip, must set PortList
 		if c.PortList == nil {
 			return nil, errors.New("Listen on AnyIP but no Port(s) set in InboundDetour.")
@@ -179,7 +175,7 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 		receiverSettings.StreamSettings = ss
 		if strings.Contains(ss.SecurityType, "reality") && (receiverSettings.PortList == nil ||
 			len(receiverSettings.PortList.Ports()) != 1 || receiverSettings.PortList.Ports()[0] != 443) {
-			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports will increase the likelihood of your server's IP being blocked by the GFW`)
+			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports may get your IP blocked by the GFW`)
 		}
 	}
 	if c.SniffingConfig != nil {
@@ -219,11 +215,21 @@ type OutboundDetourConfig struct {
 	Tag            string           `json:"tag"`
 	Settings       *json.RawMessage `json:"settings"`
 	StreamSetting  *StreamConfig    `json:"streamSettings"`
-	ProxySettings  *json.RawMessage `json:"proxySettings"`
+	ProxySettings  *ProxyConfig     `json:"proxySettings"`
 	MuxSettings    *MuxConfig       `json:"mux"`
 	TargetStrategy string           `json:"targetStrategy"`
 }
 
+func (c *OutboundDetourConfig) checkChainProxyConfig() error {
+	if c.StreamSetting == nil || c.ProxySettings == nil || c.StreamSetting.SocketSettings == nil {
+		return nil
+	}
+	if len(c.ProxySettings.Tag) > 0 && len(c.StreamSetting.SocketSettings.DialerProxy) > 0 {
+		return errors.New("proxySettings.tag is conflicted with sockopt.dialerProxy").AtWarning()
+	}
+	return nil
+}
+
 func requiresTransportSecurity(address *Address) bool {
 	if address == nil || address.Address == nil {
 		return false
@@ -250,7 +256,7 @@ func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *pr
 	}
 
 	if tjCfg, ok := rawConfig.(*TrojanClientConfig); ok {
-		if requiresTransportSecurity(tjCfg.Servers[0].Address) {
+		if requiresTransportSecurity(tjCfg.Address) {
 			return errors.New("trojan without TLS is prohibited unless the server address is a private IP or domain")
 		}
 	}
@@ -260,10 +266,6 @@ func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *pr
 
 // Build implements Buildable.
 func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
-	if c.ProxySettings != nil {
-		return nil, errors.PrintRemovedFeatureError(`outbound "proxySettings"`, `"streamSettings.sockopt.dialerProxy"`)
-	}
-
 	senderSettings := &proxyman.SenderConfig{}
 	switch strings.ToLower(c.TargetStrategy) {
 	case "asis", "":
@@ -291,6 +293,9 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	default:
 		return nil, errors.New("unsupported target domain strategy: ", c.TargetStrategy)
 	}
+	if err := c.checkChainProxyConfig(); err != nil {
+		return nil, err
+	}
 
 	if c.SendThrough != nil {
 		address := ParseSendThough(c.SendThrough)
@@ -316,6 +321,26 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 		senderSettings.StreamSettings = ss
 	}
 
+	if c.ProxySettings != nil {
+		ps, err := c.ProxySettings.Build()
+		if err != nil {
+			return nil, errors.New("invalid outbound detour proxy settings").Base(err)
+		}
+		if ps.TransportLayerProxy {
+			if senderSettings.StreamSettings != nil {
+				if senderSettings.StreamSettings.SocketSettings != nil {
+					senderSettings.StreamSettings.SocketSettings.DialerProxy = ps.Tag
+				} else {
+					senderSettings.StreamSettings.SocketSettings = &internet.SocketConfig{DialerProxy: ps.Tag}
+				}
+			} else {
+				senderSettings.StreamSettings = &internet.StreamConfig{SocketSettings: &internet.SocketConfig{DialerProxy: ps.Tag}}
+			}
+			ps = nil
+		}
+		senderSettings.ProxySettings = ps
+	}
+
 	if c.MuxSettings != nil {
 		ms, err := c.MuxSettings.Build()
 		if err != nil {
@@ -332,45 +357,12 @@ func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
 	if err != nil {
 		return nil, errors.New("failed to load outbound detour config for protocol ", c.Protocol).Base(err)
 	}
-	ts, err := rawConfig.(Buildable).Build()
-	if err != nil {
-		return nil, errors.New("failed to build outbound handler for protocol ", c.Protocol).Base(err)
-	}
 	if err := validateOutboundTransportSecurity(rawConfig, senderSettings); err != nil {
 		return nil, err
 	}
-
-	if _, ok := ts.(*masque.ClientConfig); ok {
-		if ms := senderSettings.MultiplexSettings; ms != nil && ms.Enabled {
-			return nil, errors.New(`masque outbound does not support "mux"`)
-		}
-	} else if senderSettings.StreamSettings != nil && senderSettings.StreamSettings.ProtocolName == "masque" {
-		return nil, errors.New("the masque transport can only be used by the masque outbound")
-	}
-
-	if fc, ok := ts.(*freedom.Config); ok {
-		if senderSettings.StreamSettings != nil &&
-			senderSettings.StreamSettings.SocketSettings != nil &&
-			senderSettings.StreamSettings.SocketSettings.AddressPortStrategy != internet.AddressPortStrategy_None {
-			return nil, errors.New(`freedom outbound does not support "sockopt.addressPortStrategy"`)
-		}
-
-		var strategy internet.DomainStrategy
-		if strategy = senderSettings.TargetStrategy; strategy != internet.DomainStrategy_AS_IS {
-			errors.LogWarning(context.Background(), `The "outbound.targetStrategy" setting is not supported directly by freedom and has been automatically migrated to "sockopt.domainStrategy" with no behavior change.`)
-			senderSettings.TargetStrategy = internet.DomainStrategy_AS_IS
-		} else if strategy = fc.DomainStrategy; strategy != internet.DomainStrategy_AS_IS {
-			errors.LogWarning(context.Background(), `The "freedom.domainStrategy" setting is deprecated and will be removed. For compatibility, its value has been automatically migrated to "sockopt.domainStrategy". Please update your config before removal.`)
-		}
-		if strategy != internet.DomainStrategy_AS_IS {
-			if senderSettings.StreamSettings == nil {
-				senderSettings.StreamSettings = &internet.StreamConfig{}
-			}
-			if senderSettings.StreamSettings.SocketSettings == nil {
-				senderSettings.StreamSettings.SocketSettings = &internet.SocketConfig{}
-			}
-			senderSettings.StreamSettings.SocketSettings.DomainStrategy = strategy
-		}
+	ts, err := rawConfig.(Buildable).Build()
+	if err != nil {
+		return nil, errors.New("failed to build outbound handler for protocol ", c.Protocol).Base(err)
 	}
 
 	return &core.OutboundHandlerConfig{
@@ -387,20 +379,11 @@ func (c *StatsConfig) Build() (*stats.Config, error) {
 	return &stats.Config{}, nil
 }
 
-type EnvConfig map[string]string
-
-func (c EnvConfig) Override(o EnvConfig) {
-	for key, value := range o {
-		c[key] = value
-	}
-}
-
 type Config struct {
 	// Deprecated: Global transport config is no longer used
 	// left for returning error
 	Transport map[string]json.RawMessage `json:"transport"`
 
-	Env              EnvConfig               `json:"env"`
 	LogConfig        *LogConfig              `json:"log"`
 	RouterConfig     *RouterConfig           `json:"routing"`
 	DNSConfig        *DNSConfig              `json:"dns"`
@@ -456,12 +439,6 @@ func (c *Config) Override(o *Config, fn string) {
 	if o.Transport != nil {
 		c.Transport = o.Transport
 	}
-	if o.Env != nil {
-		if c.Env == nil {
-			c.Env = EnvConfig{}
-		}
-		c.Env.Override(o.Env)
-	}
 	if o.Policy != nil {
 		c.Policy = o.Policy
 	}
@@ -537,12 +514,6 @@ func (c *Config) Override(o *Config, fn string) {
 
 // Build implements Buildable.
 func (c *Config) Build() (*core.Config, error) {
-	for key, value := range c.Env {
-		if err := os.Setenv(key, value); err != nil {
-			return nil, errors.New("failed to apply environment configuration").Base(err)
-		}
-	}
-
 	if err := PostProcessConfigureFile(c); err != nil {
 		return nil, errors.New("failed to post-process configuration file").Base(err)
 	}

infra/vformat/main.go

@@ -1,18 +1,15 @@
 package main
 
 import (
-	"bytes"
+	"errors"
 	"flag"
 	"fmt"
+	"go/build"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
-	"sort"
 	"strings"
-	"sync"
-	"sync/atomic"
-
-	"mvdan.cc/gofumpt/format"
 )
 
 var (
@@ -26,27 +23,101 @@ var (
 	isFormat bool
 )
 
-func getModuleInfo(pwd string) (modPath, langVersion string, err error) {
-	data, err := os.ReadFile(filepath.Join(pwd, "go.mod"))
-	if err != nil {
-		return "", "", err
-	}
-	for _, line := range strings.Split(string(data), "\n") {
-		fields := strings.Fields(line)
-		if len(fields) >= 2 {
-			switch fields[0] {
-			case "module":
-				modPath = fields[1]
-			case "go":
-				langVersion = "go" + strings.TrimPrefix(fields[1], "go")
-			}
+// envFile returns the name of the Go environment configuration file.
+// Copy from https://github.com/golang/go/blob/c4f2a9788a7be04daf931ac54382fbe2cb754938/src/cmd/go/internal/cfg/cfg.go#L150-L166
+func envFile() (string, error) {
+	if file := os.Getenv("GOENV"); file != "" {
+		if file == "off" {
+			return "", errors.New("GOENV=off")
 		}
+		return file, nil
 	}
-	return modPath, langVersion, nil
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	if dir == "" {
+		return "", errors.New("missing user-config dir")
+	}
+	return filepath.Join(dir, "go", "env"), nil
 }
 
-func formatGoSource(src []byte, opts format.Options) ([]byte, error) {
-	return format.Source(src, opts)
+// GetRuntimeEnv returns the value of runtime environment variable,
+// that is set by running following command: `go env -w key=value`.
+func GetRuntimeEnv(key string) (string, error) {
+	file, err := envFile()
+	if err != nil {
+		return "", err
+	}
+	if file == "" {
+		return "", errors.New("missing runtime env file")
+	}
+	var data []byte
+	var runtimeEnv string
+	data, readErr := os.ReadFile(file)
+	if readErr != nil {
+		return "", readErr
+	}
+	envStrings := strings.Split(string(data), "\n")
+	for _, envItem := range envStrings {
+		envItem = strings.TrimSuffix(envItem, "\r")
+		envKeyValue := strings.Split(envItem, "=")
+		if len(envKeyValue) == 2 && strings.TrimSpace(envKeyValue[0]) == key {
+			runtimeEnv = strings.TrimSpace(envKeyValue[1])
+		}
+	}
+	return runtimeEnv, nil
+}
+
+// GetGOBIN returns GOBIN environment variable as a string. It will NOT be empty.
+func GetGOBIN() string {
+	// The one set by user explicitly by `export GOBIN=/path` or `env GOBIN=/path command`
+	GOBIN := os.Getenv("GOBIN")
+	if GOBIN == "" {
+		var err error
+		// The one set by user by running `go env -w GOBIN=/path`
+		GOBIN, err = GetRuntimeEnv("GOBIN")
+		if err != nil {
+			// The default one that Golang uses
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		if GOBIN == "" {
+			return filepath.Join(build.Default.GOPATH, "bin")
+		}
+		return GOBIN
+	}
+	return GOBIN
+}
+
+func Run(binary string, args []string) ([]byte, error) {
+	cmd := exec.Command(binary, args...)
+	cmd.Env = append(cmd.Env, os.Environ()...)
+	output, cmdErr := cmd.CombinedOutput()
+	if cmdErr != nil {
+		return nil, cmdErr
+	}
+	return output, nil
+}
+
+func RunMany(binary string, args, files []string) bool {
+	fmt.Println("Processing with", binary, args, "...")
+
+	formatRequired := false
+	maxTasks := make(chan struct{}, runtime.NumCPU())
+	for _, file := range files {
+		maxTasks <- struct{}{}
+		go func(file string) {
+			output, err := Run(binary, append(args, file))
+			if err != nil {
+				fmt.Println(err)
+			} else if len(output) > 0 {
+				fmt.Println(string(output))
+				formatRequired = true
+			}
+			<-maxTasks
+		}(file)
+	}
+	return formatRequired
 }
 
 func main() {
@@ -79,76 +150,26 @@ func main() {
 	}
 
 	pwd := *directory
-	modPath, langVersion, modErr := getModuleInfo(pwd)
-	if modErr != nil {
-		fmt.Println("Error reading go.mod:", modErr)
+	GOBIN := GetGOBIN()
+	binPath := os.Getenv("PATH")
+	pathSlice := []string{pwd, GOBIN, binPath}
+	binPath = strings.Join(pathSlice, string(os.PathListSeparator))
+	os.Setenv("PATH", binPath)
+
+	suffix := ""
+	if runtime.GOOS == "windows" {
+		suffix = ".exe"
+	}
+	gofmt := "gofumpt" + suffix
+
+	if gofmtPath, err := exec.LookPath(gofmt); err != nil {
+		fmt.Println("Can not find", gofmt, "in system path or current working directory.")
 		os.Exit(1)
-	}
-	opts := format.Options{
-		LangVersion: langVersion,
-		ModulePath:  modPath,
-	}
-
-	if isFormat {
-		fmt.Println("Formatting Go source files...")
-	} else if isCheck {
-		fmt.Println("Checking files thar are not properly formatted...")
-	}
-
-	jobs := make(chan string, runtime.NumCPU())
-	var wg sync.WaitGroup
-	var formatRequired atomic.Bool
-	var hasErrors atomic.Bool
-
-	for i := 0; i < runtime.NumCPU(); i++ {
-		wg.Go(func() {
-			for path := range jobs {
-				src, err := os.ReadFile(path)
-				if err != nil {
-					fmt.Fprintf(os.Stderr, "Error reading %s: %v\n", path, err)
-					hasErrors.Store(true)
-					continue
-				}
-
-				formatted, err := formatGoSource(src, opts)
-				if err != nil {
-					fmt.Fprintf(os.Stderr, "Error formatting %s: %v\n", path, err)
-					hasErrors.Store(true)
-					continue
-				}
-
-				if !bytes.Equal(src, formatted) {
-					var diffText []byte
-					if isDryrun {
-						newName := filepath.ToSlash(path)
-						oldName := newName + ".orig"
-						diffText = diff(oldName, src, newName, formatted)
-					}
-					if isFormat {
-						info, statErr := os.Stat(path)
-						if statErr != nil {
-							fmt.Fprintf(os.Stderr, "Error stating %s: %v\n", path, statErr)
-							hasErrors.Store(true)
-							continue
-						}
-						if writeErr := os.WriteFile(path, formatted, info.Mode().Perm()); writeErr != nil {
-							fmt.Fprintf(os.Stderr, "Error writing %s: %v\n", path, writeErr)
-							hasErrors.Store(true)
-							continue
-						}
-					}
-
-					formatRequired.Store(true)
-					if isDryrun && len(diffText) > 0 {
-						fmt.Printf("%s\n%s", path, diffText)
-					} else {
-						fmt.Println(path)
-					}
-				}
-			}
-		})
+	} else {
+		gofmt = gofmtPath
 	}
 
+	rawFilesSlice := make([]string, 0, 1000)
 	walkErr := filepath.Walk(pwd, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			fmt.Println(err)
@@ -165,206 +186,51 @@ func main() {
 			!strings.HasSuffix(filename, ".pb.go") &&
 			!strings.Contains(dir, filepath.Join("testing", "mocks")) &&
 			!strings.Contains(path, filepath.Join("main", "distro", "all", "all.go")) {
-			jobs <- path
+			rawFilesSlice = append(rawFilesSlice, path)
 		}
 
 		return nil
 	})
-	close(jobs)
-	wg.Wait()
-
 	if walkErr != nil {
 		fmt.Println(walkErr)
 		os.Exit(1)
 	}
 
-	if hasErrors.Load() {
-		os.Exit(1)
-	}
-
 	if isFormat {
-		if formatRequired.Load() {
-			fmt.Println("Do NOT forget to commit file changes.")
+		gofmtArgs := []string{
+			"-l", "-e", "-w",
 		}
+
+		fmt.Println("Formatting Go source files...")
+		RunMany(gofmt, gofmtArgs, rawFilesSlice)
+		fmt.Println("Do NOT forget to commit file changes.")
 	}
 
 	if isCheck {
-		if formatRequired.Load() {
+		gofmtListArgs := []string{
+			"-l", "-e",
+		}
+
+		fmt.Println("Checking files thar are not properly formatted...")
+		formatRequired := RunMany(gofmt, gofmtListArgs, rawFilesSlice)
+		if formatRequired {
 			fmt.Println("Format problem(s) found.")
-			fmt.Println("Please run 'go run ./infra/vformat/main.go' to format the Go source files.")
+		}
+
+		if isDryrun {
+			if formatRequired {
+				gofmtShowArgs := []string{
+					"-d", "-e",
+				}
+				RunMany(gofmt, gofmtShowArgs, rawFilesSlice)
+			}
+		}
+
+		if formatRequired {
+			fmt.Println("Please run 'go install -v mvdan.cc/gofumpt@latest', then run 'go run ./infra/vformat/main.go' to format the Go source files.")
 			os.Exit(1)
 		} else {
 			fmt.Println("All Go source file format check has been passed.")
 		}
 	}
 }
-
-// diff algorithm copied from mvdan.cc/gofumpt/internal/govendor/diff
-type pair struct{ x, y int }
-
-func diff(oldName string, old []byte, newName string, new []byte) []byte {
-	if bytes.Equal(old, new) {
-		return nil
-	}
-	x := diffLines(old)
-	y := diffLines(new)
-
-	var out bytes.Buffer
-	fmt.Fprintf(&out, "diff %s %s\n", oldName, newName)
-	fmt.Fprintf(&out, "--- %s\n", oldName)
-	fmt.Fprintf(&out, "+++ %s\n", newName)
-
-	var (
-		done  pair
-		chunk pair
-		count pair
-		ctext []string
-	)
-	for _, m := range diffTgs(x, y) {
-		if m.x < done.x {
-			continue
-		}
-		start := m
-		for start.x > done.x && start.y > done.y && x[start.x-1] == y[start.y-1] {
-			start.x--
-			start.y--
-		}
-		end := m
-		for end.x < len(x) && end.y < len(y) && x[end.x] == y[end.y] {
-			end.x++
-			end.y++
-		}
-
-		for _, s := range x[done.x:start.x] {
-			ctext = append(ctext, "-"+s)
-			count.x++
-		}
-		for _, s := range y[done.y:start.y] {
-			ctext = append(ctext, "+"+s)
-			count.y++
-		}
-
-		const C = 3
-		if (end.x < len(x) || end.y < len(y)) &&
-			(end.x-start.x < C || (len(ctext) > 0 && end.x-start.x < 2*C)) {
-			for _, s := range x[start.x:end.x] {
-				ctext = append(ctext, " "+s)
-				count.x++
-				count.y++
-			}
-			done = end
-			continue
-		}
-
-		if len(ctext) > 0 {
-			n := end.x - start.x
-			if n > C {
-				n = C
-			}
-			for _, s := range x[start.x : start.x+n] {
-				ctext = append(ctext, " "+s)
-				count.x++
-				count.y++
-			}
-			done = pair{start.x + n, start.y + n}
-
-			if count.x > 0 {
-				chunk.x++
-			}
-			if count.y > 0 {
-				chunk.y++
-			}
-			fmt.Fprintf(&out, "@@ -%d,%d +%d,%d @@\n", chunk.x, count.x, chunk.y, count.y)
-			for _, s := range ctext {
-				out.WriteString(s)
-			}
-			count.x = 0
-			count.y = 0
-			ctext = ctext[:0]
-		}
-
-		if end.x >= len(x) && end.y >= len(y) {
-			break
-		}
-
-		chunk = pair{end.x - C, end.y - C}
-		for _, s := range x[chunk.x:end.x] {
-			ctext = append(ctext, " "+s)
-			count.x++
-			count.y++
-		}
-		done = end
-	}
-
-	return out.Bytes()
-}
-
-func diffLines(x []byte) []string {
-	l := strings.SplitAfter(string(x), "\n")
-	if l[len(l)-1] == "" {
-		l = l[:len(l)-1]
-	} else {
-		l[len(l)-1] += "\n\\ No newline at end of file\n"
-	}
-	return l
-}
-
-func diffTgs(x, y []string) []pair {
-	m := make(map[string]int)
-	for _, s := range x {
-		if c := m[s]; c > -2 {
-			m[s] = c - 1
-		}
-	}
-	for _, s := range y {
-		if c := m[s]; c > -8 {
-			m[s] = c - 4
-		}
-	}
-
-	var xi, yi, inv []int
-	for i, s := range y {
-		if m[s] == -5 {
-			m[s] = len(yi)
-			yi = append(yi, i)
-		}
-	}
-	for i, s := range x {
-		if j, ok := m[s]; ok && j >= 0 {
-			xi = append(xi, i)
-			inv = append(inv, j)
-		}
-	}
-
-	J := inv
-	n := len(xi)
-	T := make([]int, n)
-	L := make([]int, n)
-	for i := range T {
-		T[i] = n + 1
-	}
-	for i := 0; i < n; i++ {
-		k := sort.Search(n, func(k int) bool {
-			return T[k] >= J[i]
-		})
-		T[k] = J[i]
-		L[i] = k + 1
-	}
-	k := 0
-	for _, v := range L {
-		if k < v {
-			k = v
-		}
-	}
-	seq := make([]pair, 2+k)
-	seq[1+k] = pair{len(x), len(y)}
-	lastj := n
-	for i := n - 1; i >= 0; i-- {
-		if L[i] == k && J[i] < lastj {
-			seq[k] = pair{xi[i], yi[J[i]]}
-			k--
-		}
-	}
-	seq[0] = pair{0, 0}
-	return seq
-}

main/distro/all/all.go

@@ -41,7 +41,6 @@ import (
 	_ "github.com/xtls/xray-core/proxy/freedom"
 	_ "github.com/xtls/xray-core/proxy/http"
 	_ "github.com/xtls/xray-core/proxy/loopback"
-	_ "github.com/xtls/xray-core/proxy/masque"
 	_ "github.com/xtls/xray-core/proxy/shadowsocks"
 	_ "github.com/xtls/xray-core/proxy/socks"
 	_ "github.com/xtls/xray-core/proxy/trojan"
@@ -55,14 +54,12 @@ import (
 	_ "github.com/xtls/xray-core/transport/internet/grpc"
 	_ "github.com/xtls/xray-core/transport/internet/httpupgrade"
 	_ "github.com/xtls/xray-core/transport/internet/kcp"
-	_ "github.com/xtls/xray-core/transport/internet/masque"
 	_ "github.com/xtls/xray-core/transport/internet/reality"
 	_ "github.com/xtls/xray-core/transport/internet/splithttp"
 	_ "github.com/xtls/xray-core/transport/internet/tcp"
 	_ "github.com/xtls/xray-core/transport/internet/tls"
 	_ "github.com/xtls/xray-core/transport/internet/udp"
 	_ "github.com/xtls/xray-core/transport/internet/websocket"
-	_ "github.com/xtls/xray-core/transport/internet/xdrive"
 
 	// Transport headers
 	_ "github.com/xtls/xray-core/transport/internet/headers/http"

main/run.go

@@ -36,10 +36,6 @@ The -confdir=dir flag sets a dir with multiple json config
 The -format=json flag sets the format of config files.
 Default "auto".
 
-The config root env object sets process environment variables after all config
-files are parsed. Variables needed to locate or parse config files must be set
-in the process environment before Xray starts.
-
 The -test flag tells Xray to test config files only,
 without launching the server.
 

proxy/blackhole/blackhole.go

@@ -2,15 +2,12 @@
 package blackhole
 
 import (
-	"bytes"
 	"context"
-	"net/http"
 	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/dice"
-	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/common/signal"
@@ -20,34 +17,14 @@ import (
 
 // Handler is an outbound connection that silently swallow the entire payload.
 type Handler struct {
-	response []byte
-}
-
-var http403response = http.Response{
-	StatusCode: 403,
-	ProtoMajor: 1,
-	ProtoMinor: 1,
-	Header: http.Header{
-		"Connection":    {"close"},
-		"Cache-Control": {"max-age=3600, public"},
-	},
+	response ResponseConfig
 }
 
 // New creates a new blackhole handler.
 func New(ctx context.Context, config *Config) (*Handler, error) {
-	response := []byte{}
-	if config.Response != nil {
-		switch config.Response.Type {
-		case "", "none":
-		case "http":
-			var data bytes.Buffer
-			common.Must(http403response.Write(&data))
-			response = data.Bytes()
-		case "custom":
-			response = config.Response.CustomResponseData
-		default:
-			return nil, errors.New("unknown blackhole response: " + config.Response.Type)
-		}
+	response, err := config.GetInternalResponse()
+	if err != nil {
+		return nil, err
 	}
 	return &Handler{
 		response: response,
@@ -60,10 +37,8 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	ob := outbounds[len(outbounds)-1]
 	ob.Name = "blackhole"
 
-	if len(h.response) > 0 {
-		mbc := buf.MultiBufferContainer{}
-		common.Must2(mbc.Write(h.response))
-		link.Writer.WriteMultiBuffer(mbc.MultiBuffer)
+	nBytes := h.response.WriteTo(link.Writer)
+	if nBytes > 0 {
 		// Sleep a little here to make sure the response is sent to client.
 		time.Sleep(time.Second)
 	}

proxy/blackhole/blackhole_test.go

@@ -1,15 +1,12 @@
 package blackhole_test
 
 import (
-	"bufio"
-	"bytes"
 	"context"
-	"crypto/rand"
-	"net/http"
 	"testing"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
+	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/proxy/blackhole"
 	"github.com/xtls/xray-core/transport"
@@ -19,58 +16,27 @@ import (
 func TestBlackholeHTTPResponse(t *testing.T) {
 	ctx := session.ContextWithOutbounds(context.Background(), []*session.Outbound{{}})
 	handler, err := blackhole.New(ctx, &blackhole.Config{
-		Response: &blackhole.Response{Type: "http"},
+		Response: serial.ToTypedMessage(&blackhole.HTTPResponse{}),
 	})
 	common.Must(err)
 
 	reader, writer := pipe.New(pipe.WithoutSizeLimit())
 
-	dataCh := make(chan buf.MultiBuffer, 1)
+	var mb buf.MultiBuffer
+	var rerr error
 	go func() {
-		mb := common.Must2(reader.ReadMultiBuffer())
-		dataCh <- mb
+		b, e := reader.ReadMultiBuffer()
+		mb = b
+		rerr = e
 	}()
+
 	link := transport.Link{
 		Reader: reader,
 		Writer: writer,
 	}
 	common.Must(handler.Process(ctx, &link, nil))
-	mb := <-dataCh
-	data := make([]byte, mb.Len())
-	mb.Copy(data)
-	resp := common.Must2(http.ReadResponse(bufio.NewReader(bytes.NewBuffer(data)), nil))
-	if resp.StatusCode != 403 {
-		t.Errorf("expected 403 response, got %d", resp.StatusCode)
-	}
-}
-
-func TestBlackholeCustomResponse(t *testing.T) {
-	ctx := session.ContextWithOutbounds(context.Background(), []*session.Outbound{{}})
-	// slightly bigger than a buffer
-	expected := make([]byte, buf.Size+1000)
-	if _, err := rand.Read(expected); err != nil {
-		t.Fatal(err)
-	}
-	handler, err := blackhole.New(ctx, &blackhole.Config{
-		Response: &blackhole.Response{
-			Type:               "custom",
-			CustomResponseData: expected,
-		},
-	})
-	common.Must(err)
-
-	reader, writer := pipe.New(pipe.WithoutSizeLimit())
-	var actual buf.MultiBuffer
-	var rerr error
-	go func() {
-		actual, rerr = reader.ReadMultiBuffer()
-	}()
-
-	link := transport.Link{Reader: reader, Writer: writer}
-	common.Must(handler.Process(ctx, &link, nil))
 	common.Must(rerr)
-
-	if actual.String() != string(expected) {
-		t.Errorf("custom response mismatch")
+	if mb.IsEmpty() {
+		t.Error("expect http response, but nothing")
 	}
 }

proxy/blackhole/config.go

@@ -0,0 +1,47 @@
+package blackhole
+
+import (
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/buf"
+)
+
+const (
+	http403response = `HTTP/1.1 403 Forbidden
+Connection: close
+Cache-Control: max-age=3600, public
+Content-Length: 0
+
+
+`
+)
+
+// ResponseConfig is the configuration for blackhole responses.
+type ResponseConfig interface {
+	// WriteTo writes a predefined response to the specified buffer.
+	WriteTo(buf.Writer) int32
+}
+
+// WriteTo implements ResponseConfig.WriteTo().
+func (*NoneResponse) WriteTo(buf.Writer) int32 { return 0 }
+
+// WriteTo implements ResponseConfig.WriteTo().
+func (*HTTPResponse) WriteTo(writer buf.Writer) int32 {
+	b := buf.New()
+	common.Must2(b.WriteString(http403response))
+	n := b.Len()
+	writer.WriteMultiBuffer(buf.MultiBuffer{b})
+	return n
+}
+
+// GetInternalResponse converts response settings from proto to internal data structure.
+func (c *Config) GetInternalResponse() (ResponseConfig, error) {
+	if c.GetResponse() == nil {
+		return new(NoneResponse), nil
+	}
+
+	config, err := c.GetResponse().GetInstance()
+	if err != nil {
+		return nil, err
+	}
+	return config.(ResponseConfig), nil
+}

proxy/blackhole/config.pb.go

@@ -7,6 +7,7 @@
 package blackhole
 
 import (
+	serial "github.com/xtls/xray-core/common/serial"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -21,28 +22,26 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type Response struct {
-	state              protoimpl.MessageState `protogen:"open.v1"`
-	Type               string                 `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	CustomResponseData []byte                 `protobuf:"bytes,2,opt,name=custom_response_data,json=customResponseData,proto3" json:"custom_response_data,omitempty"`
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+type NoneResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *Response) Reset() {
-	*x = Response{}
+func (x *NoneResponse) Reset() {
+	*x = NoneResponse{}
 	mi := &file_proxy_blackhole_config_proto_msgTypes[0]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *Response) String() string {
+func (x *NoneResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Response) ProtoMessage() {}
+func (*NoneResponse) ProtoMessage() {}
 
-func (x *Response) ProtoReflect() protoreflect.Message {
+func (x *NoneResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_proxy_blackhole_config_proto_msgTypes[0]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -54,35 +53,57 @@ func (x *Response) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Response.ProtoReflect.Descriptor instead.
-func (*Response) Descriptor() ([]byte, []int) {
+// Deprecated: Use NoneResponse.ProtoReflect.Descriptor instead.
+func (*NoneResponse) Descriptor() ([]byte, []int) {
 	return file_proxy_blackhole_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Response) GetType() string {
-	if x != nil {
-		return x.Type
-	}
-	return ""
+type HTTPResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *Response) GetCustomResponseData() []byte {
+func (x *HTTPResponse) Reset() {
+	*x = HTTPResponse{}
+	mi := &file_proxy_blackhole_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HTTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPResponse) ProtoMessage() {}
+
+func (x *HTTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_blackhole_config_proto_msgTypes[1]
 	if x != nil {
-		return x.CustomResponseData
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return nil
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPResponse.ProtoReflect.Descriptor instead.
+func (*HTTPResponse) Descriptor() ([]byte, []int) {
+	return file_proxy_blackhole_config_proto_rawDescGZIP(), []int{1}
 }
 
 type Config struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
-	Response      *Response              `protobuf:"bytes,1,opt,name=response,proto3" json:"response,omitempty"`
+	Response      *serial.TypedMessage   `protobuf:"bytes,1,opt,name=response,proto3" json:"response,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {
 	*x = Config{}
-	mi := &file_proxy_blackhole_config_proto_msgTypes[1]
+	mi := &file_proxy_blackhole_config_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -94,7 +115,7 @@ func (x *Config) String() string {
 func (*Config) ProtoMessage() {}
 
 func (x *Config) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_blackhole_config_proto_msgTypes[1]
+	mi := &file_proxy_blackhole_config_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -107,10 +128,10 @@ func (x *Config) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Config.ProtoReflect.Descriptor instead.
 func (*Config) Descriptor() ([]byte, []int) {
-	return file_proxy_blackhole_config_proto_rawDescGZIP(), []int{1}
+	return file_proxy_blackhole_config_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *Config) GetResponse() *Response {
+func (x *Config) GetResponse() *serial.TypedMessage {
 	if x != nil {
 		return x.Response
 	}
@@ -121,12 +142,11 @@ var File_proxy_blackhole_config_proto protoreflect.FileDescriptor
 
 const file_proxy_blackhole_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1cproxy/blackhole/config.proto\x12\x14xray.proxy.blackhole\"P\n" +
-	"\bResponse\x12\x12\n" +
-	"\x04type\x18\x01 \x01(\tR\x04type\x120\n" +
-	"\x14custom_response_data\x18\x02 \x01(\fR\x12customResponseData\"D\n" +
-	"\x06Config\x12:\n" +
-	"\bresponse\x18\x01 \x01(\v2\x1e.xray.proxy.blackhole.ResponseR\bresponseB^\n" +
+	"\x1cproxy/blackhole/config.proto\x12\x14xray.proxy.blackhole\x1a!common/serial/typed_message.proto\"\x0e\n" +
+	"\fNoneResponse\"\x0e\n" +
+	"\fHTTPResponse\"F\n" +
+	"\x06Config\x12<\n" +
+	"\bresponse\x18\x01 \x01(\v2 .xray.common.serial.TypedMessageR\bresponseB^\n" +
 	"\x18com.xray.proxy.blackholeP\x01Z)github.com/xtls/xray-core/proxy/blackhole\xaa\x02\x14Xray.Proxy.Blackholeb\x06proto3"
 
 var (
@@ -141,13 +161,15 @@ func file_proxy_blackhole_config_proto_rawDescGZIP() []byte {
 	return file_proxy_blackhole_config_proto_rawDescData
 }
 
-var file_proxy_blackhole_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_proxy_blackhole_config_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
 var file_proxy_blackhole_config_proto_goTypes = []any{
-	(*Response)(nil), // 0: xray.proxy.blackhole.Response
-	(*Config)(nil),   // 1: xray.proxy.blackhole.Config
+	(*NoneResponse)(nil),        // 0: xray.proxy.blackhole.NoneResponse
+	(*HTTPResponse)(nil),        // 1: xray.proxy.blackhole.HTTPResponse
+	(*Config)(nil),              // 2: xray.proxy.blackhole.Config
+	(*serial.TypedMessage)(nil), // 3: xray.common.serial.TypedMessage
 }
 var file_proxy_blackhole_config_proto_depIdxs = []int32{
-	0, // 0: xray.proxy.blackhole.Config.response:type_name -> xray.proxy.blackhole.Response
+	3, // 0: xray.proxy.blackhole.Config.response:type_name -> xray.common.serial.TypedMessage
 	1, // [1:1] is the sub-list for method output_type
 	1, // [1:1] is the sub-list for method input_type
 	1, // [1:1] is the sub-list for extension type_name
@@ -166,7 +188,7 @@ func file_proxy_blackhole_config_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proxy_blackhole_config_proto_rawDesc), len(file_proxy_blackhole_config_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   3,
 			NumExtensions: 0,
 			NumServices:   0,
 		},