Pinning ca must have serverName

.github/docker/Dockerfile

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/docker/Dockerfile.usa

@@ -37,7 +37,6 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
-RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json
 
 # Create log files

.github/workflows/docker.yml

@@ -64,14 +64,6 @@ jobs:
           echo "Latest: '$LATEST'."
           echo "LATEST=$LATEST" >>${GITHUB_ENV}
 
-          NEWEST=false
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            NEWEST=true
-          fi
-
-          echo "Newest: '$NEWEST'."
-          echo "NEWEST=$NEWEST" >>${GITHUB_ENV}
-
       - name: Checkout code
         uses: actions/checkout@v7
 
@@ -132,13 +124,6 @@ jobs:
             ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
           fi
 
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            echo "Adding 'pre-release' tag to manifest: '${{ env.FULL_IMAGE_NAME }}:pre-release'."
-            docker buildx imagetools create \
-            --tag ${{ env.FULL_IMAGE_NAME }}:pre-release \
-            ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-          fi
-
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
@@ -146,7 +131,3 @@ jobs:
           if [[ "${{ env.LATEST }}" == "true" ]]; then
             docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:latest
           fi
-
-          if [[ "${{ env.NEWEST }}" == "true" ]]; then
-            docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:pre-release
-          fi

.github/workflows/release-win7.yml

@@ -92,7 +92,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/release.yml

@@ -193,7 +193,7 @@ jobs:
           echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

.github/workflows/test.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
@@ -85,7 +85,7 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true

app/dispatcher/default.go

@@ -162,7 +162,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		p := d.policy.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				inboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  inboundLink.Writer,
@@ -171,7 +171,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
 				outboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  outboundLink.Writer,
@@ -200,13 +200,13 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 		p := policyManager.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Reader.(*buf.TimeoutWrapperReader).Counter = c
 			}
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
+			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
 				link.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  link.Writer,
@@ -223,7 +223,7 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 
 func trackOnlineIP(ctx context.Context, sm stats.Manager, email, ip string) {
 	name := "user>>>" + email + ">>>online"
-	if om, _ := sm.GetOrRegisterOnlineMap(name); om != nil {
+	if om, _ := stats.GetOrRegisterOnlineMap(sm, name); om != nil {
 		om.AddIP(ip)
 		context.AfterFunc(ctx, func() { om.RemoveIP(ip) })
 	}

app/proxyman/inbound/always.go

@@ -26,7 +26,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -34,7 +34,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

app/proxyman/outbound/handler.go

@@ -39,7 +39,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -47,7 +47,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

app/stats/stats.go

@@ -48,20 +48,6 @@ func (m *Manager) RegisterCounter(name string) (stats.Counter, error) {
 	return c, nil
 }
 
-// GetOrRegisterCounter implements stats.Manager.
-func (m *Manager) GetOrRegisterCounter(name string) (stats.Counter, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.counters[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new counter ", name)
-	c := new(Counter)
-	m.counters[name] = c
-	return c, nil
-}
-
 // UnregisterCounter implements stats.Manager.
 func (m *Manager) UnregisterCounter(name string) error {
 	m.access.Lock()
@@ -111,20 +97,6 @@ func (m *Manager) RegisterOnlineMap(name string) (stats.OnlineMap, error) {
 	return om, nil
 }
 
-// GetOrRegisterOnlineMap implements stats.Manager.
-func (m *Manager) GetOrRegisterOnlineMap(name string) (stats.OnlineMap, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if om, found := m.onlineMaps[name]; found {
-		return om, nil
-	}
-	errors.LogDebug(context.Background(), "create new OnlineMap ", name)
-	om := NewOnlineMap()
-	m.onlineMaps[name] = om
-	return om, nil
-}
-
 // UnregisterOnlineMap implements stats.Manager.
 func (m *Manager) UnregisterOnlineMap(name string) error {
 	m.access.Lock()
@@ -177,26 +149,6 @@ func (m *Manager) RegisterChannel(name string) (stats.Channel, error) {
 	return c, nil
 }
 
-// GetOrRegisterChannel implements stats.Manager.
-func (m *Manager) GetOrRegisterChannel(name string) (stats.Channel, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-
-	if c, found := m.channels[name]; found {
-		return c, nil
-	}
-	errors.LogDebug(context.Background(), "create new channel ", name)
-	c := NewChannel(&ChannelConfig{BufferSize: 64, Blocking: false})
-	if m.running {
-		// Start before publishing so no goroutine can observe an unstarted channel.
-		if err := c.Start(); err != nil {
-			return nil, err
-		}
-	}
-	m.channels[name] = c
-	return c, nil
-}
-
 // UnregisterChannel implements stats.Manager.
 func (m *Manager) UnregisterChannel(name string) error {
 	m.access.Lock()

common/buf/io.go

@@ -122,7 +122,7 @@ func NewReader(reader io.Reader) Reader {
 	}
 
 	_, isFile := reader.(*os.File)
-	if !isFile && useReadV() {
+	if !isFile && useReadv {
 		if sc, ok := reader.(syscall.Conn); ok {
 			rawConn, err := sc.SyscallConn()
 			if err != nil {

common/buf/readv_reader.go

@@ -5,7 +5,6 @@ package buf
 
 import (
 	"io"
-	"sync/atomic"
 	"syscall"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -144,24 +143,13 @@ func (r *ReadVReader) ReadMultiBuffer() (MultiBuffer, error) {
 	return mb, nil
 }
 
-var useReadv atomic.Bool
-
-func useReadV() bool {
-	return useReadv.Load()
-}
-
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
-	enabled := false
-	switch value {
-	case defaultFlagValue, "auto", "enable":
-		enabled = true
-	}
-	useReadv.Store(enabled)
-	return nil
-}
+var useReadv bool
 
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
+	switch value {
+	case defaultFlagValue, "auto", "enable":
+		useReadv = true
+	}
 }

common/buf/readv_reader_stub.go

@@ -10,9 +10,7 @@ import (
 	"github.com/xtls/xray-core/features/stats"
 )
 
-func useReadV() bool {
-	return false
-}
+const useReadv = false
 
 func NewReadVReader(reader io.Reader, rawConn syscall.RawConn, counter stats.Counter) Reader {
 	panic("not implemented")

common/platform/env_reload.go

@@ -1,40 +0,0 @@
-package platform
-
-import (
-	"errors"
-	"sync"
-)
-
-var envReloadRegistry = struct {
-	sync.RWMutex
-	handlers []func() error
-}{}
-
-// RegisterEnvReload registers an environment reload handler and runs it once
-// immediately so package defaults keep the same behavior as init-time reads.
-func RegisterEnvReload(handler func() error) {
-	if handler == nil {
-		return
-	}
-	envReloadRegistry.Lock()
-	envReloadRegistry.handlers = append(envReloadRegistry.handlers, handler)
-	envReloadRegistry.Unlock()
-	if err := handler(); err != nil {
-		panic(err)
-	}
-}
-
-// ReloadEnvSettings refreshes all registered environment-backed package state.
-func ReloadEnvSettings() error {
-	envReloadRegistry.RLock()
-	handlers := append([]func() error{}, envReloadRegistry.handlers...)
-	envReloadRegistry.RUnlock()
-
-	var errs []error
-	for _, handler := range handlers {
-		if err := handler(); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}

common/protocol/quic/sniff.go

@@ -143,9 +143,7 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 		if err != nil {
 			return nil, err
 		}
-		if len(b) < hdrLen+4+block.BlockSize() {
-			return nil, errNotQuic
-		}
+
 		cache.Clear()
 		mask := cache.Extend(int32(block.BlockSize()))
 		block.Encrypt(mask, b[hdrLen+4:hdrLen+4+len(mask)])

common/xudp/xudp.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strconv"
 	"strings"
-	"sync/atomic"
+	"time"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
@@ -27,39 +27,25 @@ var AddrParser = protocol.NewAddressParser(
 )
 
 var (
-	Show    atomic.Bool
-	baseKey atomic.Value
+	Show    bool
+	BaseKey []byte
 )
 
-func reloadEnvSettings() error {
-	Show.Store(strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true")
-	raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" })
-	if raw == "" {
-		ensureBaseKey()
-		return nil
-	}
-	key, _ := base64.RawURLEncoding.DecodeString(raw)
-	if len(key) != 32 {
-		return errors.New(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(key)))
-	}
-	baseKey.Store(append([]byte(nil), key...))
-	return nil
-}
-
-func ensureBaseKey() []byte {
-	if key := baseKey.Load(); key != nil {
-		return key.([]byte)
-	}
-	key := make([]byte, 32)
-	if _, err := rand.Read(key); err != nil {
-		panic(err)
-	}
-	baseKey.Store(key)
-	return key
-}
-
 func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
+	if strings.ToLower(platform.NewEnvFlag(platform.XUDPLog).GetValue(func() string { return "" })) == "true" {
+		Show = true
+	}
+	BaseKey = make([]byte, 32)
+	rand.Read(BaseKey)
+	go func() {
+		time.Sleep(100 * time.Millisecond) // this is not nice, but need to give some time for Android to setup ENV
+		if raw := platform.NewEnvFlag(platform.XUDPBaseKey).GetValue(func() string { return "" }); raw != "" {
+			if BaseKey, _ = base64.RawURLEncoding.DecodeString(raw); len(BaseKey) == 32 {
+				return
+			}
+			panic(platform.XUDPBaseKey + ": invalid value (BaseKey must be 32 bytes): " + raw + " len " + strconv.Itoa(len(BaseKey)))
+		}
+	}()
 }
 
 func GetGlobalID(ctx context.Context) (globalID [8]byte) {
@@ -68,10 +54,10 @@ func GetGlobalID(ctx context.Context) (globalID [8]byte) {
 	}
 	if inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Source.Network == net.Network_UDP &&
 		(inbound.Name == "dokodemo-door" || inbound.Name == "socks" || inbound.Name == "shadowsocks" || inbound.Name == "tun") {
-		h := blake3.New(8, ensureBaseKey())
+		h := blake3.New(8, BaseKey)
 		h.Write([]byte(inbound.Source.String()))
 		copy(globalID[:], h.Sum(nil))
-		if Show.Load() {
+		if Show {
 			errors.LogInfo(ctx, fmt.Sprintf("XUDP inbound.Source.String(): %v\tglobalID: %v\n", inbound.Source.String(), globalID))
 		}
 	}

core/core.go

@@ -19,8 +19,8 @@ import (
 
 var (
 	Version_x byte = 26
-	Version_y byte = 7
-	Version_z byte = 11
+	Version_y byte = 6
+	Version_z byte = 27
 )
 
 var (

core/xray.go

@@ -187,9 +187,6 @@ func NewWithContext(ctx context.Context, config *Config) (*Instance, error) {
 }
 
 func initInstanceWithConfig(config *Config, server *Instance) (bool, error) {
-	if err := platform.ReloadEnvSettings(); err != nil {
-		return true, errors.New("failed to reload environment settings").Base(err)
-	}
 	server.ctx = context.WithValue(server.ctx, "cone",
 		platform.NewEnvFlag(platform.UseCone).GetValue(func() string { return "" }) != "true")
 

features/policy/policy.go

@@ -3,7 +3,6 @@ package policy
 import (
 	"context"
 	"runtime"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common/platform"
@@ -83,41 +82,32 @@ func ManagerType() interface{} {
 	return (*Manager)(nil)
 }
 
-var defaultBufferSize atomic.Int32
+var defaultBufferSize int32
 
-func reloadEnvSettings() error {
-	defaultBufferSize.Store(readDefaultBufferSize())
-	return nil
-}
-
-func readDefaultBufferSize() int32 {
+func init() {
 	const defaultValue = -17
 	size := platform.NewEnvFlag(platform.BufferSize).GetValueAsInt(defaultValue)
 
 	switch size {
 	case 0:
-		return -1 // For pipe to use unlimited size
+		defaultBufferSize = -1 // For pipe to use unlimited size
 	case defaultValue: // Env flag not defined. Use default values per CPU-arch.
 		switch runtime.GOARCH {
 		case "arm", "mips", "mipsle":
-			return 0
+			defaultBufferSize = 0
 		case "arm64", "mips64", "mips64le":
-			return 4 * 1024 // 4k cache for low-end devices
+			defaultBufferSize = 4 * 1024 // 4k cache for low-end devices
 		default:
-			return 512 * 1024
+			defaultBufferSize = 512 * 1024
 		}
 	default:
-		return int32(size) * 1024 * 1024
+		defaultBufferSize = int32(size) * 1024 * 1024
 	}
 }
 
-func init() {
-	platform.RegisterEnvReload(reloadEnvSettings)
-}
-
 func defaultBufferPolicy() Buffer {
 	return Buffer{
-		PerConnection: defaultBufferSize.Load(),
+		PerConnection: defaultBufferSize,
 	}
 }
 

features/stats/stats.go

@@ -81,8 +81,6 @@ type Manager interface {
 
 	// RegisterCounter registers a new counter to the manager. The identifier string must not be empty, and unique among other counters.
 	RegisterCounter(string) (Counter, error)
-	// GetOrRegisterCounter returns the counter by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterCounter(string) (Counter, error)
 	// UnregisterCounter unregisters a counter from the manager by its identifier.
 	UnregisterCounter(string) error
 	// GetCounter returns a counter by its identifier.
@@ -93,8 +91,6 @@ type Manager interface {
 
 	// RegisterOnlineMap registers a new OnlineMap to the manager. The identifier string must not be empty, and unique among other OnlineMaps.
 	RegisterOnlineMap(string) (OnlineMap, error)
-	// GetOrRegisterOnlineMap returns the OnlineMap by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterOnlineMap(string) (OnlineMap, error)
 	// UnregisterOnlineMap unregisters an OnlineMap from the manager by its identifier.
 	UnregisterOnlineMap(string) error
 	// GetOnlineMap returns an OnlineMap by its identifier.
@@ -105,8 +101,6 @@ type Manager interface {
 
 	// RegisterChannel registers a new channel to the manager. The identifier string must not be empty, and unique among other channels.
 	RegisterChannel(string) (Channel, error)
-	// GetOrRegisterChannel returns the channel by its identifier, atomically creating and registering it if absent.
-	GetOrRegisterChannel(string) (Channel, error)
 	// UnregisterChannel unregisters a channel from the manager by its identifier.
 	UnregisterChannel(string) error
 	// GetChannel returns a channel by its identifier.
@@ -116,6 +110,36 @@ type Manager interface {
 	GetAllOnlineUsers() []string
 }
 
+// GetOrRegisterCounter tries to get the StatCounter first. If not exist, it then tries to create a new counter.
+func GetOrRegisterCounter(m Manager, name string) (Counter, error) {
+	counter := m.GetCounter(name)
+	if counter != nil {
+		return counter, nil
+	}
+
+	return m.RegisterCounter(name)
+}
+
+// GetOrRegisterOnlineMap tries to get the OnlineMap first. If not exist, it then tries to create a new OnlineMap.
+func GetOrRegisterOnlineMap(m Manager, name string) (OnlineMap, error) {
+	onlineMap := m.GetOnlineMap(name)
+	if onlineMap != nil {
+		return onlineMap, nil
+	}
+
+	return m.RegisterOnlineMap(name)
+}
+
+// GetOrRegisterChannel tries to get the StatChannel first. If not exist, it then tries to create a new channel.
+func GetOrRegisterChannel(m Manager, name string) (Channel, error) {
+	channel := m.GetChannel(name)
+	if channel != nil {
+		return channel, nil
+	}
+
+	return m.RegisterChannel(name)
+}
+
 // ManagerType returns the type of Manager interface. Can be used to implement common.HasType.
 //
 // xray:api:stable
@@ -136,11 +160,6 @@ func (NoopManager) RegisterCounter(string) (Counter, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterCounter implements Manager.
-func (NoopManager) GetOrRegisterCounter(string) (Counter, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterCounter implements Manager.
 func (NoopManager) UnregisterCounter(string) error {
 	return nil
@@ -159,11 +178,6 @@ func (NoopManager) RegisterOnlineMap(string) (OnlineMap, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterOnlineMap implements Manager.
-func (NoopManager) GetOrRegisterOnlineMap(string) (OnlineMap, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterOnlineMap implements Manager.
 func (NoopManager) UnregisterOnlineMap(string) error {
 	return nil
@@ -182,11 +196,6 @@ func (NoopManager) RegisterChannel(string) (Channel, error) {
 	return nil, errors.New("not implemented")
 }
 
-// GetOrRegisterChannel implements Manager.
-func (NoopManager) GetOrRegisterChannel(string) (Channel, error) {
-	return nil, errors.New("not implemented")
-}
-
 // UnregisterChannel implements Manager.
 func (NoopManager) UnregisterChannel(string) error {
 	return nil

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/miekg/dns v1.1.72
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pion/stun/v3 v3.1.6
-	github.com/pires/go-proxyproto v0.15.0
+	github.com/pires/go-proxyproto v0.14.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sagernet/sing v0.5.1
@@ -23,15 +23,15 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/net v0.57.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/net v0.56.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.0.1
-	google.golang.org/grpc v1.82.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
@@ -52,10 +52,10 @@ require (
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -53,8 +53,8 @@ github.com/pion/stun/v3 v3.1.6 h1:WnhsD0eHCiwCfKNkVx0VJJwr2Y3eV4Ueih3KJ+dfZy8=
 github.com/pion/stun/v3 v3.1.6/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=
 github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=
 github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.15.0 h1:dTshmNbFm/D+0+sbrxUuddPOZ5Y0B7c5NhtsBkm6LqI=
-github.com/pires/go-proxyproto v0.15.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
+github.com/pires/go-proxyproto v0.14.0 h1:2vIGIfVG8eVRsKF0xukEoeT5RWhDXxBU0uv6smLOKdI=
+github.com/pires/go-proxyproto v0.14.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -98,22 +98,22 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBs
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
 golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -121,21 +121,21 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -149,8 +149,8 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/env_test.go

@@ -1,59 +0,0 @@
-package conf
-
-import (
-	"encoding/json"
-	"os"
-	"testing"
-)
-
-func TestRootEnvAppliesArbitraryValues(t *testing.T) {
-	const (
-		valueKey = "XRAY_TEST_CONFIG_ENV"
-		emptyKey = "XRAY_TEST_CONFIG_EMPTY"
-	)
-	t.Setenv(valueKey, "before")
-	t.Setenv(emptyKey, "before")
-
-	config := new(Config)
-	if err := json.Unmarshal([]byte(`{
-		"env": {
-			"XRAY_TEST_CONFIG_ENV": "configured",
-			"XRAY_TEST_CONFIG_EMPTY": ""
-		}
-	}`), config); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := config.Build(); err != nil {
-		t.Fatal(err)
-	}
-
-	if got := os.Getenv(valueKey); got != "configured" {
-		t.Fatalf("env %q = %q, want %q", valueKey, got, "configured")
-	}
-	if got := os.Getenv(emptyKey); got != "" {
-		t.Fatalf("env %q = %q, want empty", emptyKey, got)
-	}
-}
-
-func TestEnvConfigOverride(t *testing.T) {
-	base := EnvConfig{
-		"ONE": "one",
-		"TWO": "old",
-	}
-	override := EnvConfig{
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	base.Override(override)
-
-	want := map[string]string{
-		"ONE":   "one",
-		"TWO":   "new",
-		"THREE": "three",
-	}
-	for key, value := range want {
-		if got := base[key]; got != value {
-			t.Fatalf("env %q = %q, want %q", key, got, value)
-		}
-	}
-}

infra/conf/transport_finalmask.go

@@ -1,11 +1,9 @@
 package conf
 
 import (
-	"crypto/x509"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"net/netip"
 	"net/url"
 	"regexp"
@@ -24,7 +22,6 @@ import (
 	"github.com/xtls/xray-core/transport/internet/finalmask/sudoku"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xdns"
 	"github.com/xtls/xray-core/transport/internet/finalmask/xicmp"
-	"github.com/xtls/xray-core/transport/internet/finalmask/xmc"
 	"github.com/xtls/xray-core/transport/internet/tls"
 	"google.golang.org/protobuf/proto"
 )
@@ -70,7 +67,6 @@ var (
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
-		"xmc":           func() interface{} { return new(XMC) },
 	}, "type", "settings")
 
 	udpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
@@ -719,40 +715,6 @@ func (c *Xdns) Build() (proto.Message, error) {
 	}, nil
 }
 
-type XMC struct {
-	Hostname  string   `json:"hostname"`
-	Usernames []string `json:"usernames"`
-	Password  string   `json:"password"`
-}
-
-func (c *XMC) Build() (proto.Message, error) {
-	if len(c.Usernames) == 0 {
-		c.Usernames = []string{"Dream"}
-	}
-
-	if c.Password == "" {
-		return nil, fmt.Errorf("empty password")
-	}
-
-	rsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)
-	if err != nil {
-		return nil, fmt.Errorf("derive minecraft rsa key: %w", err)
-	}
-
-	rsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("marshal minecraft rsa public key: %w", err)
-	}
-
-	return &xmc.Config{
-		Password:      c.Password,
-		Usernames:     c.Usernames,
-		Hostname:      c.Hostname,
-		RsaPrivateKey: x509.MarshalPKCS1PrivateKey(rsaPrivateKey),
-		RsaPublicKey:  rsaPublicKey,
-	}, nil
-}
-
 type Xicmp struct {
 	DGRAM bool     `json:"dgram"`
 	IPs   []string `json:"ips"`

infra/conf/transport_security.go

@@ -113,10 +113,6 @@ func (c *REALITYConfig) Build() (proto.Message, error) {
 					config.MinClientVer[i] = byte(u)
 				}
 			}
-			errors.LogWarning(context.Background(), `REALITY: Changing "minClientVer" will increase the likelihood of your server's IP being blocked by the GFW`)
-		} else {
-			config.MinClientVer = []byte{26, 3, 27} // change it at your own risk: https://github.com/XTLS/Xray-core/commit/af7eb68028732a8ee3c0e5d6ab2b8a657bb2e770
-			errors.LogWarning(context.Background(), `REALITY: The default minimal client version is Xray-core v26.3.27, other clients may be refused to connect`)
 		}
 		if c.MaxClientVer != "" {
 			config.MaxClientVer = make([]byte, 3)
@@ -161,10 +157,8 @@ func (c *REALITYConfig) Build() (proto.Message, error) {
 		}
 
 		for _, sn := range config.ServerNames {
-			sn = strings.ToLower(sn)
-			if strings.HasSuffix(sn, ".ru") || strings.HasSuffix(sn, ".ir") || strings.HasSuffix(sn, ".cn") ||
-				strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") || strings.Contains(sn, "microsoft") {
-				errors.LogWarning(context.Background(), `REALITY: Choosing "`, sn, `" as the target will increase the likelihood of your server's IP being blocked by the GFW`)
+			if strings.Contains(sn, "apple") || strings.Contains(sn, "icloud") {
+				errors.LogWarning(context.Background(), `REALITY: Choosing apple, icloud, etc. as the target may get your IP blocked by the GFW`)
 			}
 		}
 

infra/conf/tun.go

@@ -1,19 +1,12 @@
 package conf
 
 import (
-	"crypto/rand"
-	"fmt"
-	"math/big"
-	"net"
-	"strconv"
-
 	"github.com/xtls/xray-core/proxy/tun"
 	"google.golang.org/protobuf/proto"
 )
 
 type TunConfig struct {
 	Name                   string   `json:"name"`
-	Desc                   string   `json:"desc"`
 	MTU                    uint32   `json:"mtu"`
 	Gateway                []string `json:"gateway"`
 	DNS                    []string `json:"dns"`
@@ -25,7 +18,6 @@ type TunConfig struct {
 func (v *TunConfig) Build() (proto.Message, error) {
 	config := &tun.Config{
 		Name:                   v.Name,
-		Desc:                   v.Desc,
 		MTU:                    v.MTU,
 		Gateway:                v.Gateway,
 		DNS:                    v.DNS,
@@ -40,71 +32,10 @@ func (v *TunConfig) Build() (proto.Message, error) {
 	}
 
 	if config.Name == "" {
-		name, err := GetAvailableTunName()
-		if err != nil {
-			return nil, err
-		}
-		config.Name = name
-	}
-	if config.Desc == "" {
-		config.Desc = "Wintun"
+		config.Name = "xray0"
 	}
 	if config.MTU == 0 {
 		config.MTU = 1500
 	}
 	return config, nil
 }
-
-const (
-	tunNamePrefix = "utun"
-	minTunIndex   = 10
-	maxTunIndex   = 1024
-)
-
-func GetAvailableTunName() (string, error) {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		return "", fmt.Errorf("fail to get system interface information: %w", err)
-	}
-
-	usedNames := make(map[string]struct{}, len(interfaces))
-	for _, iface := range interfaces {
-		usedNames[iface.Name] = struct{}{}
-	}
-
-	startIndex, err := randomInt(minTunIndex, maxTunIndex)
-	if err != nil {
-		return "", fmt.Errorf("fail to generate valid tun name: %w", err)
-	}
-
-	rangeSize := maxTunIndex - minTunIndex + 1
-
-	for offset := 0; offset < rangeSize; offset++ {
-		index := minTunIndex + (startIndex-minTunIndex+offset)%rangeSize
-		name := tunNamePrefix + strconv.Itoa(index)
-
-		if _, exists := usedNames[name]; !exists {
-			return name, nil
-		}
-	}
-
-	return "", fmt.Errorf(
-		"no available TUN interface name in range %s%d-%s%d",
-		tunNamePrefix,
-		minTunIndex,
-		tunNamePrefix,
-		maxTunIndex,
-	)
-}
-
-func randomInt(min, max int) (int, error) {
-	value, err := rand.Int(
-		rand.Reader,
-		big.NewInt(int64(max-min+1)),
-	)
-	if err != nil {
-		return 0, err
-	}
-
-	return min + int(value.Int64()), nil
-}

infra/conf/xray.go

@@ -3,7 +3,6 @@ package conf
 import (
 	"context"
 	"encoding/json"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -176,7 +175,7 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 		receiverSettings.StreamSettings = ss
 		if strings.Contains(ss.SecurityType, "reality") && (receiverSettings.PortList == nil ||
 			len(receiverSettings.PortList.Ports()) != 1 || receiverSettings.PortList.Ports()[0] != 443) {
-			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports will increase the likelihood of your server's IP being blocked by the GFW`)
+			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports may get your IP blocked by the GFW`)
 		}
 	}
 	if c.SniffingConfig != nil {
@@ -380,20 +379,11 @@ func (c *StatsConfig) Build() (*stats.Config, error) {
 	return &stats.Config{}, nil
 }
 
-type EnvConfig map[string]string
-
-func (c EnvConfig) Override(o EnvConfig) {
-	for key, value := range o {
-		c[key] = value
-	}
-}
-
 type Config struct {
 	// Deprecated: Global transport config is no longer used
 	// left for returning error
 	Transport map[string]json.RawMessage `json:"transport"`
 
-	Env              EnvConfig               `json:"env"`
 	LogConfig        *LogConfig              `json:"log"`
 	RouterConfig     *RouterConfig           `json:"routing"`
 	DNSConfig        *DNSConfig              `json:"dns"`
@@ -449,12 +439,6 @@ func (c *Config) Override(o *Config, fn string) {
 	if o.Transport != nil {
 		c.Transport = o.Transport
 	}
-	if o.Env != nil {
-		if c.Env == nil {
-			c.Env = EnvConfig{}
-		}
-		c.Env.Override(o.Env)
-	}
 	if o.Policy != nil {
 		c.Policy = o.Policy
 	}
@@ -530,12 +514,6 @@ func (c *Config) Override(o *Config, fn string) {
 
 // Build implements Buildable.
 func (c *Config) Build() (*core.Config, error) {
-	for key, value := range c.Env {
-		if err := os.Setenv(key, value); err != nil {
-			return nil, errors.New("failed to apply environment configuration").Base(err)
-		}
-	}
-
 	if err := PostProcessConfigureFile(c); err != nil {
 		return nil, errors.New("failed to post-process configuration file").Base(err)
 	}

main/run.go

@@ -36,10 +36,6 @@ The -confdir=dir flag sets a dir with multiple json config
 The -format=json flag sets the format of config files.
 Default "auto".
 
-The config root env object sets process environment variables after all config
-files are parsed. Variables needed to locate or parse config files must be set
-in the process environment before Xray starts.
-
 The -test flag tells Xray to test config files only,
 without launching the server.
 

proxy/freedom/freedom.go

@@ -5,7 +5,6 @@ import (
 	"crypto/rand"
 	"io"
 	"strings"
-	"sync/atomic"
 	"time"
 
 	"github.com/pires/go-proxyproto"
@@ -32,24 +31,12 @@ import (
 )
 
 var (
-	useSplice               atomic.Bool
+	useSplice               bool
 	allNetworks             [8]bool
 	defaultBlockPrivateRule *FinalRule
 	defaultBlockAllRule     *FinalRule
 )
 
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	value := platform.NewEnvFlag(platform.UseFreedomSplice).GetValue(func() string { return defaultFlagValue })
-	enabled := false
-	switch value {
-	case defaultFlagValue, "auto", "enable":
-		enabled = true
-	}
-	useSplice.Store(enabled)
-	return nil
-}
-
 func init() {
 	common.Must(common.RegisterConfig((*Config)(nil), func(ctx context.Context, config interface{}) (interface{}, error) {
 		h := new(Handler)
@@ -61,7 +48,12 @@ func init() {
 		return h, nil
 	}))
 
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+	value := platform.NewEnvFlag(platform.UseFreedomSplice).GetValue(func() string { return defaultFlagValue })
+	switch value {
+	case defaultFlagValue, "auto", "enable":
+		useSplice = true
+	}
 
 	for i := range allNetworks {
 		allNetworks[i] = true
@@ -430,7 +422,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 
 	responseDone := func() error {
 		defer timer.SetTimeout(plcy.Timeouts.UplinkOnly)
-		if destination.Network == net.Network_TCP && useSplice.Load() && proxy.IsRAWTransportWithoutSecurity(conn) { // it would be tls conn in special use case of MITM, we need to let link handle traffic
+		if destination.Network == net.Network_TCP && useSplice && proxy.IsRAWTransportWithoutSecurity(conn) { // it would be tls conn in special use case of MITM, we need to let link handle traffic
 			var writeConn net.Conn
 			var inTimer *signal.ActivityTimer
 			if inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Conn != nil {

proxy/tun/README.md

@@ -31,17 +31,13 @@ Here is simple Xray config snippet to enable the inbound:
       "port": 0,
       "protocol": "tun",
       "settings": {
-        "name": "utun10",
-        "desc": "Wintun",
-        "mtu": 1500
+        "name": "xray0",
+        "MTU": 1492
       }
     }
   ],
 ```
 
-`desc` sets the Windows Wintun adapter tunnel type and defaults to `Wintun`.
-It is ignored on other platforms.
-
 ## SUPPORTED FEATURES
 
 - IPv4 and IPv6

proxy/tun/config.pb.go

@@ -7,12 +7,11 @@
 package tun
 
 import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
-
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 )
 
 const (
@@ -31,7 +30,6 @@ type Config struct {
 	UserLevel              uint32                 `protobuf:"varint,5,opt,name=user_level,json=userLevel,proto3" json:"user_level,omitempty"`
 	AutoSystemRoutingTable []string               `protobuf:"bytes,6,rep,name=auto_system_routing_table,json=autoSystemRoutingTable,proto3" json:"auto_system_routing_table,omitempty"`
 	AutoOutboundsInterface string                 `protobuf:"bytes,7,opt,name=auto_outbounds_interface,json=autoOutboundsInterface,proto3" json:"auto_outbounds_interface,omitempty"`
-	Desc                   string                 `protobuf:"bytes,8,opt,name=desc,proto3" json:"desc,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -115,18 +113,11 @@ func (x *Config) GetAutoOutboundsInterface() string {
 	return ""
 }
 
-func (x *Config) GetDesc() string {
-	if x != nil {
-		return x.Desc
-	}
-	return ""
-}
-
 var File_proxy_tun_config_proto protoreflect.FileDescriptor
 
 const file_proxy_tun_config_proto_rawDesc = "" +
 	"\n" +
-	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\x82\x02\n" +
+	"\x16proxy/tun/config.proto\x12\x0exray.proxy.tun\"\xee\x01\n" +
 	"\x06Config\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
 	"\x03MTU\x18\x02 \x01(\rR\x03MTU\x12\x18\n" +
@@ -135,8 +126,7 @@ const file_proxy_tun_config_proto_rawDesc = "" +
 	"\n" +
 	"user_level\x18\x05 \x01(\rR\tuserLevel\x129\n" +
 	"\x19auto_system_routing_table\x18\x06 \x03(\tR\x16autoSystemRoutingTable\x128\n" +
-	"\x18auto_outbounds_interface\x18\a \x01(\tR\x16autoOutboundsInterface\x12\x12\n" +
-	"\x04desc\x18\b \x01(\tR\x04descBL\n" +
+	"\x18auto_outbounds_interface\x18\a \x01(\tR\x16autoOutboundsInterfaceBL\n" +
 	"\x12com.xray.proxy.tunP\x01Z#github.com/xtls/xray-core/proxy/tun\xaa\x02\x0eXray.Proxy.Tunb\x06proto3"
 
 var (

proxy/tun/config.proto

@@ -14,5 +14,4 @@ message Config {
   uint32 user_level = 5;
   repeated string auto_system_routing_table = 6;
   string auto_outbounds_interface = 7;
-  string desc = 8;
 }

proxy/tun/handler.go

@@ -65,7 +65,7 @@ func (t *Handler) Init(ctx context.Context, pm policy.Manager, dispatcher routin
 	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundUplink {
 		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + t.tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			t.uplinkCounter = c
 		}
@@ -73,7 +73,7 @@ func (t *Handler) Init(ctx context.Context, pm policy.Manager, dispatcher routin
 	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundDownlink {
 		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + t.tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			t.downlinkCounter = c
 		}

proxy/tun/tun_windows.go

@@ -50,7 +50,7 @@ var _ GVisorDevice = (*WindowsTun)(nil)
 // interface with the same name exist, it tried to be reused.
 func NewTun(options *Config) (Tun, error) {
 	// instantiate wintun adapter
-	adapter, err := open(options.Name, options.Desc)
+	adapter, err := open(options.Name)
 	if err != nil {
 		return nil, err
 	}
@@ -73,12 +73,12 @@ func NewTun(options *Config) (Tun, error) {
 	return tun, nil
 }
 
-func open(name, desc string) (*wintun.Adapter, error) {
+func open(name string) (*wintun.Adapter, error) {
 	// generate a deterministic GUID from the adapter name
 	id := md5.Sum([]byte(name))
 	guid := (*windows.GUID)(unsafe.Pointer(&id[0]))
 	// try to create adapter anew
-	adapter, err := wintun.CreateAdapter(name, desc, guid)
+	adapter, err := wintun.CreateAdapter(name, "Xray", guid)
 	if err == nil {
 		return adapter, nil
 	}

proxy/vmess/outbound/outbound.go

@@ -5,7 +5,6 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"hash/crc64"
-	"sync/atomic"
 	"time"
 
 	"github.com/xtls/xray-core/common"
@@ -219,17 +218,10 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	return nil
 }
 
-var enablePadding atomic.Bool
+var enablePadding = false
 
 func shouldEnablePadding(s protocol.SecurityType) bool {
-	return enablePadding.Load() || s == protocol.SecurityType_AES128_GCM || s == protocol.SecurityType_CHACHA20_POLY1305 || s == protocol.SecurityType_AUTO
-}
-
-func reloadEnvSettings() error {
-	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
-	paddingValue := platform.NewEnvFlag(platform.UseVmessPadding).GetValue(func() string { return defaultFlagValue })
-	enablePadding.Store(paddingValue != defaultFlagValue)
-	return nil
+	return enablePadding || s == protocol.SecurityType_AES128_GCM || s == protocol.SecurityType_CHACHA20_POLY1305 || s == protocol.SecurityType_AUTO
 }
 
 func init() {
@@ -237,5 +229,10 @@ func init() {
 		return New(ctx, config.(*Config))
 	}))
 
-	platform.RegisterEnvReload(reloadEnvSettings)
+	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
+
+	paddingValue := platform.NewEnvFlag(platform.UseVmessPadding).GetValue(func() string { return defaultFlagValue })
+	if paddingValue != defaultFlagValue {
+		enablePadding = true
+	}
 }

proxy/wireguard/client.go

@@ -57,7 +57,7 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -65,7 +65,7 @@ func NewClient(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}
@@ -139,7 +139,13 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
 	ob.Name = "wireguard"
 	ob.CanSpliceCopy = 3
 
-	if err := h.init(ctx); err != nil {
+	if h.dev == nil {
+		if err := h.init(ctx); err != nil {
+			return err
+		}
+	}
+
+	if err := h.dev.Up(); err != nil {
 		return err
 	}
 
@@ -252,11 +258,8 @@ func (h *Handler) Close() (err error) {
 func (h *Handler) init(ctx context.Context) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if h.tun == nil {
-		return errors.New("closed")
-	}
 	if h.dev != nil {
-		return h.dev.Up()
+		return nil
 	}
 	resolveFunc := h.resolveLocal
 	listenFunc := func() (net.PacketConn, error) {

proxy/wireguard/server.go

@@ -66,7 +66,7 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -74,7 +74,7 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 	if len(tag) > 0 && p.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := statsManager.GetOrRegisterCounter(name)
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
 		if c != nil {
 			downlinkCounter = c
 		}

transport/internet/browser_dialer/dialer.go

@@ -27,10 +27,9 @@ type task struct {
 }
 
 var (
-	conns       chan *websocket.Conn
-	server      *http.Server
-	currentAddr string
-	mu          sync.Mutex
+	conns  chan *websocket.Conn
+	server *http.Server
+	mu     sync.Mutex
 )
 
 var upgrader = &websocket.Upgrader{
@@ -48,13 +47,8 @@ func Reload() {
 	mu.Lock()
 	defer mu.Unlock()
 
-	if addr == currentAddr && (addr == "" || server != nil) {
-		return
-	}
-
 	if server != nil {
 		server.Close()
-		server = nil
 	}
 	if HasBrowserDialer() {
 		for len(conns) > 0 {
@@ -66,7 +60,6 @@ func Reload() {
 		}
 		conns = nil
 	}
-	currentAddr = addr
 	if addr != "" {
 		token := uuid.New()
 		csrfToken := token.String()
@@ -227,8 +220,5 @@ func CheckOK(conn *websocket.Conn) error {
 }
 
 func init() {
-	platform.RegisterEnvReload(func() error {
-		Reload()
-		return nil
-	})
+	Reload()
 }

transport/internet/finalmask/xmc/cfb8.go

@@ -1,138 +0,0 @@
-package xmc
-
-// Copied from https://github.com/Tnze/go-mc/blob/539b4a3a7f030332eb58b8a946116ae7907630d2/net/CFB8/cfb8.go
-
-import (
-	"crypto/cipher"
-	"crypto/subtle"
-	"unsafe"
-)
-
-type cfb8 struct {
-	c         cipher.Block
-	blockSize int
-	ivPos     int
-	iv        []byte
-	de        bool
-}
-
-func newCFB8Decrypt(c cipher.Block, iv []byte) *cfb8 {
-	return newCFB8(c, iv, true)
-}
-
-func newCFB8Encrypt(c cipher.Block, iv []byte) *cfb8 {
-	return newCFB8(c, iv, false)
-}
-
-func newCFB8(c cipher.Block, iv []byte, de bool) *cfb8 {
-	cp := make([]byte, len(iv)*3)
-	copy(cp, iv)
-	return &cfb8{
-		c:         c,
-		blockSize: c.BlockSize(),
-		iv:        cp,
-		de:        de,
-	}
-}
-
-func (cf *cfb8) XORKeyStream(dst, src []byte) {
-	if len(src) == 0 {
-		return
-	}
-	if len(dst) < len(src) {
-		panic("cfb8: output smaller than input")
-	}
-
-	// If dst and src does not overlap in first block size,
-	// and the length of src is greater than 2*blockSize,
-	// we can use an optimized implementation.
-	if len(src) > cf.blockSize<<1 &&
-		(uintptr(unsafe.Pointer(&dst[0]))+uintptr(cf.blockSize) <= uintptr(unsafe.Pointer(&src[0])) ||
-			uintptr(unsafe.Pointer(&src[0]))+uintptr(len(src)) <= uintptr(unsafe.Pointer(&dst[0]))) {
-		// encrypt/decrypt first blockSize bytes
-		// After this, the IV will come to the same as
-		// the last blockSize of ciphertext, so
-		// we can reuse them without copy.
-		cf.xorKeyStream(dst, src[:cf.blockSize])
-		var ciphertext []byte
-		if cf.de {
-			ciphertext = src
-		} else {
-			ciphertext = dst
-		}
-		dst = dst[cf.blockSize:]
-		src = src[cf.blockSize:]
-		iv := cf.iv
-		_ = iv[0] // bounds check hint to compiler; see golang.org/issue/14808
-		var (
-			i   int
-			val byte
-		)
-		dst = dst[:len(src)]
-		if cf.de && // and requires to be non-overlapping at all
-			uintptr(unsafe.Pointer(&dst[0])) <= uintptr(unsafe.Pointer(&src[len(src)-1])) &&
-			uintptr(unsafe.Pointer(&src[0])) <= uintptr(unsafe.Pointer(&dst[len(dst)-1])) {
-			for i = 0; i < len(src)-cf.blockSize; i += 1 {
-				cf.c.Encrypt(dst[i:], ciphertext[i:])
-			}
-			subtle.XORBytes(dst, src[:i], dst)
-			for ; i < len(src); i += 1 {
-				cf.c.Encrypt(iv, ciphertext[i:])
-				dst[i] = src[i] ^ iv[0]
-			}
-		} else {
-			_ = ciphertext[len(src)]
-			for i, val = range src {
-				cf.c.Encrypt(iv, ciphertext[i:])
-				dst[i] = val ^ iv[0]
-			}
-			// for-range does not increase i in the last loop,
-			// compared to the classic for clause
-			i += 1
-		}
-		// copy the current IV for next operation
-		copy(iv, ciphertext[i:i+cf.blockSize])
-		cf.ivPos = 0
-		return
-	}
-
-	cf.xorKeyStream(dst, src)
-}
-
-func (cf *cfb8) xorKeyStream(dst, src []byte) {
-	dst = dst[:len(src)] // remove bounds check in loop
-	for i, val := range src {
-		posPlusBlockSize := cf.ivPos + cf.blockSize
-		// fast mod; 2*blockSize must be a non-negative integer power of 2
-		tempPos := posPlusBlockSize & (cf.blockSize<<1 - 1)
-		// reuse space to store encrypted block
-		cf.c.Encrypt(cf.iv[tempPos:], cf.iv[cf.ivPos:])
-		// Only the first byte of the encrypted block is used
-		// for encryption/decryption, other bytes are ignored.
-		val ^= cf.iv[tempPos]
-
-		if cf.ivPos == cf.blockSize<<1 {
-			// bound reached; move to next round for next operation
-			// copy next block to the start of the ring buffer
-			copy(cf.iv, cf.iv[cf.ivPos+1:])
-			// insert the encrypted byte to the end of IV
-			if cf.de {
-				cf.iv[cf.blockSize-1] = src[i]
-			} else {
-				cf.iv[cf.blockSize-1] = val
-			}
-			cf.ivPos = 0
-		} else {
-			// insert the encrypted byte to the end of IV
-			if cf.de {
-				cf.iv[posPlusBlockSize] = src[i]
-			} else {
-				cf.iv[posPlusBlockSize] = val
-			}
-			// move to next block
-			cf.ivPos += 1
-		}
-
-		dst[i] = val
-	}
-}

transport/internet/finalmask/xmc/client.go

@@ -1,236 +0,0 @@
-package xmc
-
-import (
-	"bufio"
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/sha256"
-	"crypto/x509"
-	"fmt"
-	"io"
-	"math/big"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-)
-
-type clientConn struct {
-	reader io.Reader
-	writer io.Writer
-	c      net.Conn
-
-	state clientState
-
-	handshakeLock sync.Mutex
-	usernames     []string
-	password      string
-	rsaPublicKey  []byte
-	hostname      string
-}
-
-type clientState int
-
-var (
-	clientStateHandshake clientState = 1
-	clientStateProxy     clientState = 2
-)
-
-func newClientConn(c net.Conn, usernames []string, password string, rsaPublicKey []byte, hostname string) (*clientConn, error) {
-	if len(rsaPublicKey) == 0 {
-		return nil, fmt.Errorf("empty rsa public key")
-	}
-
-	return &clientConn{
-		reader:        bufio.NewReader(c),
-		writer:        c,
-		c:             c,
-		state:         clientStateHandshake,
-		handshakeLock: sync.Mutex{},
-		usernames:     usernames,
-		password:      password,
-		rsaPublicKey:  rsaPublicKey,
-		hostname:      hostname,
-	}, nil
-}
-
-func (c *clientConn) handshake() error {
-	c.handshakeLock.Lock()
-	defer c.handshakeLock.Unlock()
-
-	if c.state != clientStateHandshake {
-		return nil
-	}
-
-	// Handshake timeout
-	err := c.c.SetDeadline(time.Now().Add(time.Second * 30))
-	if err != nil {
-		return fmt.Errorf("set deadline: %w", err)
-	}
-	defer c.c.SetDeadline(time.Time{})
-
-	var (
-		protocolVersion Varint        = Varint(775)
-		serverAddress   String        = String(c.hostname)
-		serverPort      UnsignedShort = UnsignedShort(25565)
-		nextState       Varint        = Varint(2)
-	)
-
-	host, portString, err := net.SplitHostPort(c.c.RemoteAddr().String())
-	if err == nil {
-		port, err := strconv.Atoi(portString)
-		if err == nil {
-			serverPort = UnsignedShort(port)
-		}
-
-		if serverAddress == "" {
-			serverAddress = String(host)
-		}
-	}
-
-	err = writePacket(c.writer, 0x00, &protocolVersion, &serverAddress, &serverPort, &nextState)
-	if err != nil {
-		return fmt.Errorf("write handshake packet: %w", err)
-	}
-
-	// Login Start
-	var (
-		username    string
-		offlineUUID UUID
-	)
-
-	randomUsername, _ := rand.Int(rand.Reader, big.NewInt(int64(len(c.usernames))))
-	username = c.usernames[randomUsername.Int64()]
-	generateOfflineUUID(&offlineUUID, string(username))
-
-	err = writePacket(c.writer, 0x00, new(String(username)), &offlineUUID)
-	if err != nil {
-		return fmt.Errorf("write login start: %w", err)
-	}
-
-	// Encryption Request
-	pkt, err := readPacket(c.reader)
-	if err != nil {
-		return fmt.Errorf("read encryption request: %w", err)
-	}
-
-	if pkt.packetID != 0x01 {
-		return fmt.Errorf("bad encrypt request packet id")
-	}
-
-	var (
-		serverId    String
-		publicKey   Bytes
-		verifyToken Bytes
-	)
-
-	err = pkt.readFields(&serverId, &publicKey, &verifyToken)
-	if err != nil {
-		return fmt.Errorf("read encryption request fields: %w", err)
-	}
-
-	if !bytes.Equal(publicKey, c.rsaPublicKey) {
-		return fmt.Errorf("server public key mismatch")
-	}
-
-	k, err := x509.ParsePKIXPublicKey(publicKey)
-	if err != nil {
-		return fmt.Errorf("parse server public key: %w", err)
-	}
-
-	rsaPublicKey, ok := k.(*rsa.PublicKey)
-	if !ok {
-		return fmt.Errorf("parse server public key: not rsa")
-	}
-
-	sharedSecret := make([]byte, 16)
-	rand.Read(sharedSecret)
-
-	encryptedSharedSecret, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("encrypt shared secret: %w", err)
-	}
-
-	verifyToken = append(verifyToken, []byte(c.password)...) // append pre-shared password
-
-	encryptedVerifyToken, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, verifyToken)
-	if err != nil {
-		return fmt.Errorf("encrypt verify token: %w", err)
-	}
-
-	// Send Encryption Response
-	err = writePacket(
-		c.writer,
-		0x01,
-		(*Bytes)(&encryptedSharedSecret),
-		(*Bytes)(&encryptedVerifyToken),
-	)
-	if err != nil {
-		return fmt.Errorf("write encryption response: %w", err)
-	}
-
-	// Enable encryption
-	c.reader, err = newCryptoReader(c.reader, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("new crypto reader: %w", err)
-	}
-
-	c.writer, err = newCryptoWriter(c.writer, sharedSecret)
-	if err != nil {
-		return fmt.Errorf("new crypto writer: %w", err)
-	}
-
-	c.state = clientStateProxy
-
-	return nil
-}
-
-func (c *clientConn) Read(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.reader.Read(b)
-}
-
-func (c *clientConn) Write(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.writer.Write(b)
-}
-
-func (c *clientConn) Close() error {
-	return c.c.Close()
-}
-
-func (c *clientConn) LocalAddr() net.Addr {
-	return c.c.LocalAddr()
-}
-
-func (c *clientConn) RemoteAddr() net.Addr {
-	return c.c.RemoteAddr()
-}
-
-func (c *clientConn) SetDeadline(t time.Time) error {
-	return c.c.SetDeadline(t)
-}
-
-func (c *clientConn) SetReadDeadline(t time.Time) error {
-	return c.c.SetReadDeadline(t)
-}
-
-func (c *clientConn) SetWriteDeadline(t time.Time) error {
-	return c.c.SetWriteDeadline(t)
-}
-
-func generateOfflineUUID(uuid *UUID, username string) {
-	h := sha256.Sum256([]byte("OfflinePlayer:" + username))
-	copy(uuid[:], h[:16])
-	uuid[6] = (uuid[6] & 0x0f) | 0x30 // UUID version 3
-	uuid[8] = (uuid[8] & 0x3f) | 0x80 // UUID variant
-}

transport/internet/finalmask/xmc/config.go

@@ -1,27 +0,0 @@
-package xmc
-
-import (
-	"fmt"
-	"net"
-)
-
-func (c *Config) TCP() {
-}
-
-func (c *Config) WrapConnClient(conn net.Conn) (net.Conn, error) {
-	cc, err := newClientConn(conn, c.Usernames, c.Password, c.RsaPublicKey, c.Hostname)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-
-	return cc, nil
-}
-
-func (c *Config) WrapConnServer(conn net.Conn) (net.Conn, error) {
-	cc, err := wrapConnServer(conn, c.Password, c.RsaPrivateKey, c.RsaPublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("minecraft finalmask: %w", err)
-	}
-
-	return cc, nil
-}

transport/internet/finalmask/xmc/config.pb.go

@@ -1,160 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.36.11
-// 	protoc        v6.33.5
-// source: transport/internet/finalmask/xmc/config.proto
-
-package xmc
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type Config struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Password      string                 `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
-	Usernames     []string               `protobuf:"bytes,2,rep,name=usernames,proto3" json:"usernames,omitempty"`
-	RsaPrivateKey []byte                 `protobuf:"bytes,8,opt,name=rsa_private_key,json=rsaPrivateKey,proto3" json:"rsa_private_key,omitempty"`
-	RsaPublicKey  []byte                 `protobuf:"bytes,9,opt,name=rsa_public_key,json=rsaPublicKey,proto3" json:"rsa_public_key,omitempty"`
-	Hostname      string                 `protobuf:"bytes,10,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *Config) Reset() {
-	*x = Config{}
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *Config) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Config) ProtoMessage() {}
-
-func (x *Config) ProtoReflect() protoreflect.Message {
-	mi := &file_transport_internet_finalmask_xmc_config_proto_msgTypes[0]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Config.ProtoReflect.Descriptor instead.
-func (*Config) Descriptor() ([]byte, []int) {
-	return file_transport_internet_finalmask_xmc_config_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *Config) GetPassword() string {
-	if x != nil {
-		return x.Password
-	}
-	return ""
-}
-
-func (x *Config) GetUsernames() []string {
-	if x != nil {
-		return x.Usernames
-	}
-	return nil
-}
-
-func (x *Config) GetRsaPrivateKey() []byte {
-	if x != nil {
-		return x.RsaPrivateKey
-	}
-	return nil
-}
-
-func (x *Config) GetRsaPublicKey() []byte {
-	if x != nil {
-		return x.RsaPublicKey
-	}
-	return nil
-}
-
-func (x *Config) GetHostname() string {
-	if x != nil {
-		return x.Hostname
-	}
-	return ""
-}
-
-var File_transport_internet_finalmask_xmc_config_proto protoreflect.FileDescriptor
-
-const file_transport_internet_finalmask_xmc_config_proto_rawDesc = "" +
-	"\n" +
-	"-transport/internet/finalmask/xmc/config.proto\x12%xray.transport.internet.finalmask.xmc\"\xac\x01\n" +
-	"\x06Config\x12\x1a\n" +
-	"\bpassword\x18\x01 \x01(\tR\bpassword\x12\x1c\n" +
-	"\tusernames\x18\x02 \x03(\tR\tusernames\x12&\n" +
-	"\x0frsa_private_key\x18\b \x01(\fR\rrsaPrivateKey\x12$\n" +
-	"\x0ersa_public_key\x18\t \x01(\fR\frsaPublicKey\x12\x1a\n" +
-	"\bhostname\x18\n" +
-	" \x01(\tR\bhostnameB\x91\x01\n" +
-	")com.xray.transport.internet.finalmask.xmcP\x01Z:github.com/xtls/xray-core/transport/internet/finalmask/xmc\xaa\x02%Xray.Transport.Internet.Finalmask.XMCb\x06proto3"
-
-var (
-	file_transport_internet_finalmask_xmc_config_proto_rawDescOnce sync.Once
-	file_transport_internet_finalmask_xmc_config_proto_rawDescData []byte
-)
-
-func file_transport_internet_finalmask_xmc_config_proto_rawDescGZIP() []byte {
-	file_transport_internet_finalmask_xmc_config_proto_rawDescOnce.Do(func() {
-		file_transport_internet_finalmask_xmc_config_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_transport_internet_finalmask_xmc_config_proto_rawDesc), len(file_transport_internet_finalmask_xmc_config_proto_rawDesc)))
-	})
-	return file_transport_internet_finalmask_xmc_config_proto_rawDescData
-}
-
-var file_transport_internet_finalmask_xmc_config_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_transport_internet_finalmask_xmc_config_proto_goTypes = []any{
-	(*Config)(nil), // 0: xray.transport.internet.finalmask.xmc.Config
-}
-var file_transport_internet_finalmask_xmc_config_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_transport_internet_finalmask_xmc_config_proto_init() }
-func file_transport_internet_finalmask_xmc_config_proto_init() {
-	if File_transport_internet_finalmask_xmc_config_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: unsafe.Slice(unsafe.StringData(file_transport_internet_finalmask_xmc_config_proto_rawDesc), len(file_transport_internet_finalmask_xmc_config_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   1,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_transport_internet_finalmask_xmc_config_proto_goTypes,
-		DependencyIndexes: file_transport_internet_finalmask_xmc_config_proto_depIdxs,
-		MessageInfos:      file_transport_internet_finalmask_xmc_config_proto_msgTypes,
-	}.Build()
-	File_transport_internet_finalmask_xmc_config_proto = out.File
-	file_transport_internet_finalmask_xmc_config_proto_goTypes = nil
-	file_transport_internet_finalmask_xmc_config_proto_depIdxs = nil
-}

transport/internet/finalmask/xmc/config.proto

@@ -1,16 +0,0 @@
-syntax = "proto3";
-
-package xray.transport.internet.finalmask.xmc;
-option csharp_namespace = "Xray.Transport.Internet.Finalmask.XMC";
-option go_package = "github.com/xtls/xray-core/transport/internet/finalmask/xmc";
-option java_package = "com.xray.transport.internet.finalmask.xmc";
-option java_multiple_files = true;
-
-
-message Config {
-    string password = 1;
-    repeated string usernames = 2;
-    bytes rsa_private_key = 8;
-    bytes rsa_public_key = 9;
-    string hostname = 10;
-}

transport/internet/finalmask/xmc/derivation.go

@@ -1,103 +0,0 @@
-package xmc
-
-import (
-	"crypto/rsa"
-	"crypto/sha256"
-	"fmt"
-	"math/big"
-)
-
-type sha256Stream struct {
-	seed    []byte
-	counter uint64
-	buf     []byte
-}
-
-func newSHA256Stream(seed []byte) *sha256Stream {
-	return &sha256Stream{
-		seed: seed,
-	}
-}
-
-func (s *sha256Stream) Read(p []byte) (n int, err error) {
-	for len(p) > len(s.buf) {
-		h := sha256.New()
-		h.Write(s.seed)
-		h.Write([]byte(fmt.Sprintf("-%d", s.counter)))
-		s.counter++
-		s.buf = append(s.buf, h.Sum(nil)...)
-	}
-	n = copy(p, s.buf)
-	s.buf = s.buf[n:]
-	return n, nil
-}
-
-func derivePrime(stream *sha256Stream) *big.Int {
-	pBytes := make([]byte, 64) // 512 bits
-	_, _ = stream.Read(pBytes)
-	pBytes[0] |= 0xc0  // ensure it is big enough so p*q is 1024 bits
-	pBytes[63] |= 0x01 // ensure odd
-
-	p := new(big.Int).SetBytes(pBytes)
-	for {
-		if p.ProbablyPrime(20) {
-			pMinus1 := new(big.Int).Sub(p, big.NewInt(1))
-			e := big.NewInt(65537)
-			gcd := new(big.Int).GCD(nil, nil, pMinus1, e)
-			if gcd.Cmp(big.NewInt(1)) == 0 {
-				return p
-			}
-		}
-		p.Add(p, big.NewInt(2))
-	}
-}
-
-// DeriveRSAKey derives a 1024-bit RSA private key from a password.
-func DeriveRSAKey(password string) (*rsa.PrivateKey, error) {
-	seed := []byte(password)
-
-	pStream := newSHA256Stream(append(seed, []byte("-p-prime")...))
-	qStream := newSHA256Stream(append(seed, []byte("-q-prime")...))
-
-	p := derivePrime(pStream)
-	q := derivePrime(qStream)
-
-	// ensure p != q (if they are, let's search q further)
-	for p.Cmp(q) == 0 {
-		q.Add(q, big.NewInt(2))
-		for {
-			if q.ProbablyPrime(20) {
-				qMinus1 := new(big.Int).Sub(q, big.NewInt(1))
-				e := big.NewInt(65537)
-				gcd := new(big.Int).GCD(nil, nil, qMinus1, e)
-				if gcd.Cmp(big.NewInt(1)) == 0 {
-					break
-				}
-			}
-			q.Add(q, big.NewInt(2))
-		}
-	}
-
-	n := new(big.Int).Mul(p, q)
-	pMinus1 := new(big.Int).Sub(p, big.NewInt(1))
-	qMinus1 := new(big.Int).Sub(q, big.NewInt(1))
-	totient := new(big.Int).Mul(pMinus1, qMinus1)
-
-	e := big.NewInt(65537)
-	d := new(big.Int).ModInverse(e, totient)
-	if d == nil {
-		return nil, fmt.Errorf("failed to compute mod inverse")
-	}
-
-	priv := &rsa.PrivateKey{
-		PublicKey: rsa.PublicKey{
-			N: n,
-			E: 65537,
-		},
-		D:      d,
-		Primes: []*big.Int{p, q},
-	}
-	priv.Precompute()
-
-	return priv, nil
-}

transport/internet/finalmask/xmc/derivation_test.go

@@ -1,58 +0,0 @@
-package xmc
-
-import (
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/hex"
-	"testing"
-)
-
-func TestDeriveRSAKey(t *testing.T) {
-	password := "my-very-secret-password-12345"
-
-	key1, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key: %v", err)
-	}
-
-	err = key1.Validate()
-	if err != nil {
-		t.Fatalf("key is not valid RSA key: %v", err)
-	}
-
-	key2, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key second time: %v", err)
-	}
-
-	// Verify determinism
-	if key1.D.Cmp(key2.D) != 0 || key1.N.Cmp(key2.N) != 0 {
-		t.Errorf("derived keys are not identical for the same password")
-	}
-
-	// Verify different passwords yield different keys
-	keyDifferent, err := DeriveRSAKey(password + "-different")
-	if err != nil {
-		t.Fatalf("failed to derive different key: %v", err)
-	}
-
-	if key1.D.Cmp(keyDifferent.D) == 0 || key1.N.Cmp(keyDifferent.N) == 0 {
-		t.Errorf("derived keys are identical for different passwords")
-	}
-}
-
-func TestDeriveRSAKeyGoldenPrivateKey(t *testing.T) {
-	const password = "deterministic-rsa-key-golden"
-	const wantPKCS1DERHash = "3a8c4ad56a6fb42dab73c4d5fc3af754460a2db1441edc0970cbc7f4e0798d2f"
-
-	key, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive key: %v", err)
-	}
-
-	gotHash := sha256.Sum256(x509.MarshalPKCS1PrivateKey(key))
-	got := hex.EncodeToString(gotHash[:])
-	if got != wantPKCS1DERHash {
-		t.Fatalf("derived private key changed\nwant sha256: %s\n got sha256: %s", wantPKCS1DERHash, got)
-	}
-}

transport/internet/finalmask/xmc/handshake_test.go

@@ -1,158 +0,0 @@
-package xmc
-
-import (
-	"bytes"
-	"crypto/x509"
-	"net"
-	"sync"
-	"testing"
-)
-
-func deriveTestRSAKey(t *testing.T, password string) ([]byte, []byte) {
-	t.Helper()
-
-	key, err := DeriveRSAKey(password)
-	if err != nil {
-		t.Fatalf("failed to derive rsa key: %v", err)
-	}
-
-	publicKey, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
-	if err != nil {
-		t.Fatalf("failed to marshal public key: %v", err)
-	}
-
-	return x509.MarshalPKCS1PrivateKey(key), publicKey
-}
-
-func TestHandshakeSuccess(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("failed to listen: %v", err)
-	}
-	defer ln.Close()
-
-	password := "super-secure-shared-key-12345"
-	usernames := []string{"test_user"}
-	privateKey, publicKey := deriveTestRSAKey(t, password)
-
-	go func() {
-		rawConn, err := ln.Accept()
-		if err != nil {
-			return
-		}
-		defer rawConn.Close()
-
-		server, err := wrapConnServer(rawConn, password, privateKey, publicKey)
-		if err != nil {
-			t.Errorf("failed to wrap server: %v", err)
-			return
-		}
-
-		buf := make([]byte, 1024)
-		n, err := server.Read(buf)
-		if err != nil {
-			t.Errorf("server read error: %v", err)
-			return
-		}
-
-		if !bytes.Equal(buf[:n], []byte("hello server")) {
-			t.Errorf("unexpected payload from client: %s", string(buf[:n]))
-			return
-		}
-
-		_, err = server.Write([]byte("hello client"))
-		if err != nil {
-			t.Errorf("server write error: %v", err)
-			return
-		}
-	}()
-
-	clientRaw, err := net.Dial("tcp", ln.Addr().String())
-	if err != nil {
-		t.Fatalf("failed to dial: %v", err)
-	}
-	defer clientRaw.Close()
-
-	client, err := newClientConn(clientRaw, usernames, password, publicKey, "localhost")
-	if err != nil {
-		t.Fatalf("failed to create client: %v", err)
-	}
-
-	_, err = client.Write([]byte("hello server"))
-	if err != nil {
-		t.Fatalf("client write error: %v", err)
-	}
-
-	buf := make([]byte, 1024)
-	n, err := client.Read(buf)
-	if err != nil {
-		t.Fatalf("client read error: %v", err)
-	}
-
-	if !bytes.Equal(buf[:n], []byte("hello client")) {
-		t.Errorf("unexpected payload from server: %s", string(buf[:n]))
-	}
-}
-
-func TestHandshakePasswordMismatch(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("failed to listen: %v", err)
-	}
-	defer ln.Close()
-
-	clientPassword := "client-secret-123"
-	serverPassword := "server-secret-456"
-	usernames := []string{"test_user"}
-	serverPrivateKey, serverPublicKey := deriveTestRSAKey(t, serverPassword)
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-
-		rawConn, err := ln.Accept()
-		if err != nil {
-			return
-		}
-		defer rawConn.Close()
-
-		server, err := wrapConnServer(rawConn, serverPassword, serverPrivateKey, serverPublicKey)
-		if err != nil {
-			// Wrapping is synchronous and shouldn't fail initially simply because key derivation works with any string
-			t.Logf("wrapped server: %v", err)
-		}
-
-		// When client sends data, handshake happens and should fail
-		buf := make([]byte, 1024)
-		_, err = server.Read(buf)
-		if err == nil {
-			t.Errorf("expected handshake to fail due to password mismatch, but it succeeded")
-		} else {
-			t.Logf("server read failed as expected: %v", err)
-		}
-	}()
-
-	clientRaw, err := net.Dial("tcp", ln.Addr().String())
-	if err != nil {
-		t.Fatalf("failed to dial: %v", err)
-	}
-	defer clientRaw.Close()
-
-	client, err := newClientConn(clientRaw, usernames, clientPassword, serverPublicKey, "localhost")
-	if err != nil {
-		t.Fatalf("failed to create client: %v", err)
-	}
-
-	err = client.handshake()
-	if err != nil {
-		t.Fatalf("client handshake err: %v", err)
-	}
-
-	_, _ = client.Write([]byte{0x1, 0x2, 0x3, 0x4})
-
-	wg.Wait()
-
-	// Check if we lost connection or received error
-	t.Log("Handshake mismatch tested")
-}

transport/internet/finalmask/xmc/protocol.go

@@ -1,335 +0,0 @@
-// Minecraft protocol
-package xmc
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-)
-
-type field interface {
-	readFrom(r io.Reader) error
-	writeTo(w io.Writer) error
-}
-
-type mcPacket struct {
-	packetID int
-	data     []byte
-}
-
-func readPacket(b io.Reader) (*mcPacket, error) {
-	var packetLength Varint
-	err := packetLength.readFrom(b)
-	if err != nil {
-		return nil, fmt.Errorf("read packet length: %w", err)
-	}
-
-	var packetID Varint
-	err = packetID.readFrom(b)
-	if err != nil {
-		return nil, fmt.Errorf("read packet ID: %w", err)
-	}
-
-	dataLength := int(packetLength) - varintSize(packetID)
-	if dataLength < 0 || dataLength > 1024*32 {
-		return nil, fmt.Errorf("read packet: bad length: %d", dataLength)
-	}
-
-	data := make([]byte, dataLength)
-	_, err = io.ReadFull(b, data)
-	if err != nil {
-		return nil, fmt.Errorf("read packet data: %w", err)
-	}
-
-	return &mcPacket{
-		packetID: int(packetID),
-		data:     data,
-	}, nil
-}
-
-func (p *mcPacket) readFields(fields ...field) error {
-	r := bytes.NewReader(p.data)
-
-	for _, field := range fields {
-		err := field.readFrom(r)
-		if err != nil {
-			return fmt.Errorf("read packet field: %w", err)
-		}
-	}
-
-	return nil
-}
-
-type Varint int32
-
-func (v *Varint) readFrom(r io.Reader) error {
-	SEGMENT_BITS := byte(0x7F)
-	CONTINUE_BIT := byte(0x80)
-
-	var err error
-
-	var value int32 = 0
-	var position int32 = 0
-	var currentByte byte
-
-	for true {
-		currentByte, err = readByte(r)
-		if err != nil {
-			return fmt.Errorf("read varint: %w", err)
-		}
-		value |= int32(currentByte&SEGMENT_BITS) << position
-
-		if (currentByte & CONTINUE_BIT) == 0 {
-			break
-		}
-
-		position += 7
-
-		if position >= 32 {
-			return fmt.Errorf("read varint: too large")
-		}
-	}
-
-	*v = Varint(value)
-
-	return nil
-}
-
-func (v *Varint) writeTo(w io.Writer) error {
-	SEGMENT_BITS := byte(0x7F)
-	CONTINUE_BIT := byte(0x80)
-
-	value := int32(*v)
-
-	for {
-		currentByte := byte(value & int32(SEGMENT_BITS))
-		value >>= 7
-		if value != 0 {
-			currentByte |= CONTINUE_BIT
-		}
-
-		_, err := w.Write([]byte{currentByte})
-		if err != nil {
-			return fmt.Errorf("write varint: %w", err)
-		}
-
-		if value == 0 {
-			break
-		}
-	}
-
-	return nil
-}
-
-func varintSize(value Varint) int {
-	size := 0
-	for {
-		size++
-		value >>= 7
-		if value == 0 {
-			break
-		}
-	}
-	return size
-}
-
-type String string
-
-func (v *String) readFrom(r io.Reader) error {
-	var length Varint = 0
-
-	err := length.readFrom(r)
-	if err != nil {
-		return fmt.Errorf("read string: %w", err)
-	}
-
-	if length < 0 || length > 4096 {
-		return fmt.Errorf("read string: bad length: %d", length)
-	}
-
-	buf := make([]byte, length)
-	_, err = io.ReadFull(r, buf)
-	if err != nil {
-		return fmt.Errorf("read string: %w", err)
-	}
-
-	*v = String(string(buf))
-
-	return nil
-}
-
-func (v *String) writeTo(w io.Writer) error {
-	strBytes := []byte(*v)
-	length := Varint(len(strBytes))
-
-	err := length.writeTo(w)
-	if err != nil {
-		return fmt.Errorf("write string: %w", err)
-	}
-
-	_, err = w.Write(strBytes)
-	if err != nil {
-		return fmt.Errorf("write string: %w", err)
-	}
-
-	return nil
-}
-
-type UnsignedShort uint16
-
-func (v *UnsignedShort) readFrom(r io.Reader) error {
-	var buf [2]byte
-	_, err := io.ReadFull(r, buf[:])
-	if err != nil {
-		return fmt.Errorf("read unsigned short: %w", err)
-	}
-
-	*v = UnsignedShort(buf[0])<<8 | UnsignedShort(buf[1])
-
-	return nil
-}
-
-func (v *UnsignedShort) writeTo(w io.Writer) error {
-	buf := []byte{byte(*v >> 8), byte(*v & 0xFF)}
-	_, err := w.Write(buf)
-	if err != nil {
-		return fmt.Errorf("write unsigned short: %w", err)
-	}
-	return nil
-}
-
-type Long int64
-
-func (v *Long) readFrom(r io.Reader) error {
-	var buf [8]byte
-	_, err := io.ReadFull(r, buf[:])
-	if err != nil {
-		return fmt.Errorf("read long: %w", err)
-	}
-
-	*v = Long(buf[0])<<56 | Long(buf[1])<<48 | Long(buf[2])<<40 | Long(buf[3])<<32 |
-		Long(buf[4])<<24 | Long(buf[5])<<16 | Long(buf[6])<<8 | Long(buf[7])
-
-	return nil
-}
-
-func (v *Long) writeTo(w io.Writer) error {
-	buf := []byte{
-		byte(*v >> 56), byte((*v >> 48) & 0xFF), byte((*v >> 40) & 0xFF), byte((*v >> 32) & 0xFF),
-		byte((*v >> 24) & 0xFF), byte((*v >> 16) & 0xFF), byte((*v >> 8) & 0xFF), byte(*v & 0xFF),
-	}
-
-	_, err := w.Write(buf)
-	if err != nil {
-		return fmt.Errorf("write long: %w", err)
-	}
-
-	return nil
-}
-
-type UUID [16]byte
-
-func (v *UUID) readFrom(r io.Reader) error {
-	_, err := io.ReadFull(r, v[:])
-	if err != nil {
-		return fmt.Errorf("read UUID: %w", err)
-	}
-
-	return nil
-}
-
-func (v *UUID) writeTo(w io.Writer) error {
-	_, err := w.Write(v[:])
-	if err != nil {
-		return fmt.Errorf("write UUID: %w", err)
-	}
-	return nil
-}
-
-type Bytes []byte
-
-func (v *Bytes) readFrom(r io.Reader) error {
-	var length Varint
-	err := length.readFrom(r)
-	if err != nil {
-		return fmt.Errorf("read bytes: %w", err)
-	}
-
-	if length < 0 || length >= 1024 {
-		return fmt.Errorf("read bytes: invalid size: %d", err)
-	}
-
-	buf := make([]byte, length)
-
-	_, err = io.ReadFull(r, buf)
-	if err != nil {
-		return fmt.Errorf("read bytes: %w", err)
-	}
-
-	*v = append([]byte(*v), buf...)
-
-	return nil
-}
-
-func (v *Bytes) writeTo(w io.Writer) error {
-	length := Varint(len(*v))
-	err := length.writeTo(w)
-	if err != nil {
-		return fmt.Errorf("write bytes length: %w", err)
-	}
-
-	_, err = w.Write(*v)
-	if err != nil {
-		return fmt.Errorf("write bytes: %w", err)
-	}
-
-	return nil
-}
-
-func readByte(r io.Reader) (byte, error) {
-	var buf [1]byte
-	_, err := io.ReadFull(r, buf[:])
-	if err != nil {
-		return 0, fmt.Errorf("read byte: %w", err)
-	}
-
-	return buf[0], nil
-}
-
-func writePacket(w io.Writer, packetID int, fields ...field) error {
-	var dataBuf bytes.Buffer
-
-	for _, field := range fields {
-		err := field.writeTo(&dataBuf)
-		if err != nil {
-			return fmt.Errorf("write packet field: %w", err)
-		}
-	}
-
-	var buf bytes.Buffer
-
-	var packetLength Varint = Varint(varintSize(Varint(packetID)) + dataBuf.Len())
-	err := packetLength.writeTo(&buf)
-	if err != nil {
-		return fmt.Errorf("write packet length: %w", err)
-	}
-
-	var packetIDVarint Varint = Varint(packetID)
-	err = packetIDVarint.writeTo(&buf)
-	if err != nil {
-		return fmt.Errorf("write packet ID: %w", err)
-	}
-
-	buf.Write(dataBuf.Bytes())
-
-	_, err = w.Write(buf.Bytes())
-	if err != nil {
-		return fmt.Errorf("write packet data: %w", err)
-	}
-
-	return nil
-}
-
-func writeDisconnectPacket(w io.Writer, reason string) error {
-	return writePacket(w, 0x00, new(String(reason)))
-}

transport/internet/finalmask/xmc/server.go

@@ -1,289 +0,0 @@
-package xmc
-
-import (
-	"bufio"
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/subtle"
-	"crypto/x509"
-	"fmt"
-	"io"
-	"net"
-	"sync"
-	"time"
-)
-
-// Response by vanilla 26.1.2 server.
-var statusResponse = `{"description":"A Minecraft Server","players":{"max":20,"online":0},"version":{"name":"26.1.2","protocol":775},"enforcesSecureChat":true}`
-
-type serverState int
-
-var (
-	serverStateHandshake serverState = 1
-	serverStateProxy     serverState = 3
-)
-
-type serverConn struct {
-	reader io.Reader
-	writer io.Writer
-	c      net.Conn
-
-	state serverState
-
-	handshakeLock sync.Mutex
-	password      string
-	rsaPrivateKey *rsa.PrivateKey
-	rsaPublicKey  []byte
-}
-
-func (c *serverConn) handshake() error {
-	c.handshakeLock.Lock()
-	defer c.handshakeLock.Unlock()
-
-	if c.state != serverStateHandshake {
-		return nil
-	}
-
-	// handshake timeout
-	err := c.c.SetDeadline(time.Now().Add(time.Second * 30))
-	if err != nil {
-		return fmt.Errorf("set deadline: %w", err)
-	}
-	defer c.c.SetDeadline(time.Time{})
-
-	var (
-		protocolVersion Varint
-		serverAddress   String
-		serverPort      UnsignedShort
-		nextState       Varint
-	)
-
-	// handshake packet
-
-	pkt, err := readPacket(c.reader)
-	if err != nil {
-		return fmt.Errorf("read handshake packet: %w", err)
-	}
-
-	if pkt.packetID != 0 {
-		return fmt.Errorf("bad handshake packet id")
-	}
-
-	err = pkt.readFields(&protocolVersion, &serverAddress, &serverPort, &nextState)
-	if err != nil {
-		return fmt.Errorf("read handshake packet: %w", err)
-	}
-
-	switch nextState {
-	case 1:
-
-		// Ping
-
-		for range 2 {
-
-			pkt, err := readPacket(c.reader)
-			if err != nil {
-				return fmt.Errorf("read packet: %w", err)
-			}
-
-			switch pkt.packetID {
-			case 0: // Status Request
-
-				err = writePacket(c.writer, 0, new(String(statusResponse)))
-				if err != nil {
-					return fmt.Errorf("write status response: %w", err)
-				}
-
-			case 1: // Ping
-
-				var payload Long
-				err = pkt.readFields(&payload)
-				if err != nil {
-					return fmt.Errorf("read ping packet: %w", err)
-				}
-
-				err = writePacket(c.writer, 1, &payload)
-				if err != nil {
-					return fmt.Errorf("write ping response: %w", err)
-				}
-
-			}
-
-		}
-
-		return fmt.Errorf("ping")
-
-	case 2:
-
-		// Login
-
-		// login start
-
-		pkt, err := readPacket(c.reader)
-		if err != nil {
-			return fmt.Errorf("read login start packet: %w", err)
-		}
-
-		if pkt.packetID != 0 {
-			return fmt.Errorf("bad login start packet id")
-		}
-
-		var (
-			username String
-			uuid     UUID
-		)
-
-		err = pkt.readFields(&username, &uuid)
-		if err != nil {
-			return fmt.Errorf("read login start packet: %w", err)
-		}
-
-		// encrypt request
-
-		var (
-			serverId           String = String("")
-			publicKey          Bytes  = Bytes(c.rsaPublicKey)
-			verifyToken        Bytes  = Bytes(make([]byte, 4))
-			shouldAuthenticate Varint = Varint(1)
-		)
-
-		rand.Read(verifyToken)
-
-		err = writePacket(c.writer, 0x01, &serverId, &publicKey, &verifyToken, &shouldAuthenticate)
-		if err != nil {
-			return fmt.Errorf("write encryption request: %w", err)
-		}
-
-		// encrypt response
-
-		var (
-			encryptedSharedSecret Bytes
-			encryptedVerifyToken  Bytes
-
-			sharedSecret         []byte
-			decryptedVerifyToken []byte
-		)
-
-		pkt, err = readPacket(c.reader)
-		if err != nil {
-			return fmt.Errorf("read encrypt response: %w", err)
-		}
-
-		if pkt.packetID != 0x01 {
-			return fmt.Errorf("bad encrypt response packet id")
-		}
-
-		err = pkt.readFields(&encryptedSharedSecret, &encryptedVerifyToken)
-		if err != nil {
-			return fmt.Errorf("read encrypt response: %w", err)
-		}
-
-		sharedSecret, err = rsa.DecryptPKCS1v15(rand.Reader, c.rsaPrivateKey, encryptedSharedSecret)
-		if err != nil {
-			return fmt.Errorf("decrypt shared secret: %w", err)
-		}
-
-		decryptedVerifyToken, err = rsa.DecryptPKCS1v15(rand.Reader, c.rsaPrivateKey, encryptedVerifyToken)
-		if err != nil {
-			return fmt.Errorf("decrypt verify token: %w", err)
-		}
-
-		if len(decryptedVerifyToken) < 4 || !bytes.Equal(verifyToken, decryptedVerifyToken[:4]) {
-			return fmt.Errorf("verify token mismatch")
-		}
-
-		c.reader, err = newCryptoReader(c.reader, sharedSecret)
-		if err != nil {
-			return fmt.Errorf("new crypto reader: %w", err)
-		}
-
-		c.writer, err = newCryptoWriter(c.writer, sharedSecret)
-		if err != nil {
-			return fmt.Errorf("new crypto writer: %w", err)
-		}
-
-		// verify password
-		receivedPassword := decryptedVerifyToken[4:]
-
-		if subtle.ConstantTimeCompare(receivedPassword, []byte(c.password)) != 1 {
-			writeDisconnectPacket(c.writer, `{"type":"translatable","translate":"multiplayer.disconnect.authservers_down"}`)
-			return fmt.Errorf("bad password")
-		}
-
-		c.state = serverStateProxy
-
-		return nil
-
-	default:
-		return fmt.Errorf("bad handshake packet: bad next state: %d", nextState)
-	}
-}
-
-func (c *serverConn) Read(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.reader.Read(b)
-}
-
-func (c *serverConn) Write(b []byte) (int, error) {
-	err := c.handshake()
-	if err != nil {
-		return 0, fmt.Errorf("handshake: %w", err)
-	}
-
-	return c.writer.Write(b)
-}
-
-func (c *serverConn) Close() error {
-	return c.c.Close()
-}
-
-func (c *serverConn) LocalAddr() net.Addr {
-	return c.c.LocalAddr()
-}
-
-func (c *serverConn) RemoteAddr() net.Addr {
-	return c.c.RemoteAddr()
-}
-
-func (c *serverConn) SetDeadline(t time.Time) error {
-	return c.c.SetDeadline(t)
-}
-
-func (c *serverConn) SetReadDeadline(t time.Time) error {
-	return c.c.SetReadDeadline(t)
-}
-
-func (c *serverConn) SetWriteDeadline(t time.Time) error {
-	return c.c.SetWriteDeadline(t)
-}
-
-func wrapConnServer(c net.Conn, password string, rsaPrivateKeyDER []byte, rsaPublicKey []byte) (*serverConn, error) {
-	if len(rsaPrivateKeyDER) == 0 {
-		return nil, fmt.Errorf("empty rsa private key")
-	}
-	if len(rsaPublicKey) == 0 {
-		return nil, fmt.Errorf("empty rsa public key")
-	}
-
-	rsaPrivateKey, err := x509.ParsePKCS1PrivateKey(rsaPrivateKeyDER)
-	if err != nil {
-		return nil, fmt.Errorf("parse rsa private key: %w", err)
-	}
-
-	s := &serverConn{
-		reader:        bufio.NewReader(c),
-		writer:        c,
-		c:             c,
-		state:         serverStateHandshake,
-		password:      password,
-		rsaPrivateKey: rsaPrivateKey,
-		rsaPublicKey:  rsaPublicKey,
-	}
-
-	return s, nil
-}

transport/internet/finalmask/xmc/stream.go

@@ -1,68 +0,0 @@
-// Minecraft stream cipher
-package xmc
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"fmt"
-	"io"
-)
-
-type cryptoStream struct {
-	stream cipher.Stream
-	r      io.Reader
-	w      io.Writer
-}
-
-func newCryptoReader(r io.Reader, sharedSecret []byte) (*cryptoStream, error) {
-	blockCipher, err := aes.NewCipher(sharedSecret)
-	if err != nil {
-		return nil, fmt.Errorf("new aes cipher: %w", err)
-	}
-
-	stream := newCFB8Decrypt(blockCipher, sharedSecret)
-
-	return &cryptoStream{stream: stream, r: r}, nil
-}
-
-func (c *cryptoStream) Read(b []byte) (int, error) {
-	if c.r == nil {
-		panic("read on a write-only crypto stream")
-	}
-
-	n, err := c.r.Read(b)
-	if err != nil {
-		return 0, fmt.Errorf("crypto reader: read: %w", err)
-	}
-
-	c.stream.XORKeyStream(b[:n], b[:n])
-
-	return n, nil
-}
-
-func newCryptoWriter(w io.Writer, sharedSecret []byte) (*cryptoStream, error) {
-	blockCipher, err := aes.NewCipher(sharedSecret)
-	if err != nil {
-		return nil, fmt.Errorf("new aes cipher: %w", err)
-	}
-
-	stream := newCFB8Encrypt(blockCipher, sharedSecret)
-
-	return &cryptoStream{stream: stream, w: w}, nil
-}
-
-func (c *cryptoStream) Write(b []byte) (int, error) {
-	if c.w == nil {
-		panic("write on a read-only crypto stream")
-	}
-
-	encrypted := make([]byte, len(b))
-	c.stream.XORKeyStream(encrypted, b)
-
-	n, err := c.w.Write(encrypted)
-	if err != nil {
-		return 0, fmt.Errorf("crypto writer: write: %w", err)
-	}
-
-	return n, nil
-}

transport/internet/httpupgrade/hub.go

@@ -4,10 +4,8 @@ import (
 	"bufio"
 	"context"
 	"crypto/tls"
-	"io"
 	"net/http"
 	"strings"
-	"time"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
@@ -45,11 +43,7 @@ func (s *server) Handle(conn net.Conn) {
 
 // upgrade execute a fake websocket upgrade process and return the available connection
 func (s *server) upgrade(conn net.Conn) (stat.Connection, error) {
-	// timeout and header limit are the same as websocket
-	conn.SetReadDeadline(time.Now().Add(time.Second * 4))
-	defer conn.SetReadDeadline(time.Time{})
-	connReader := bufio.NewReader(io.LimitReader(conn, 12288))
-
+	connReader := bufio.NewReader(conn)
 	req, err := http.ReadRequest(connReader)
 	if err != nil {
 		return nil, err
@@ -100,15 +94,7 @@ func (s *server) keepAccepting() {
 	for {
 		conn, err := s.innnerListener.Accept()
 		if err != nil {
-			errStr := err.Error()
-			if strings.Contains(errStr, "closed") {
-				break
-			}
-			errors.LogWarningInner(context.Background(), err, "failed to accept raw connections")
-			if strings.Contains(errStr, "too many") {
-				time.Sleep(time.Millisecond * 500)
-			}
-			continue
+			return
 		}
 		go s.Handle(conn)
 	}

transport/internet/tls/config.go

@@ -13,7 +13,6 @@ import (
 	"sync"
 	"time"
 
-	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/ocsp"
@@ -23,7 +22,6 @@ import (
 )
 
 var globalSessionCache = tls.NewLRUClientSessionCache(128)
-var uGlobalSessionCache = utls.NewLRUClientSessionCache(128)
 
 // ParseCertificate converts a cert.Certificate to Certificate.
 func ParseCertificate(c *cert.Certificate) *Certificate {
@@ -282,10 +280,12 @@ func (c *Config) parseServerName() string {
 	return c.ServerName
 }
 
-// Note: Remember to update uVerifyConnectionAdapter if this function needs more fields in the future.
-func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
-	certs := cs.PeerCertificates
-	// extract x509 certificates from cs.PeerCertificates
+func (r *RandCarrier) verifyPeerCert(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) (err error) {
+	// extract x509 certificates from rawCerts (verifiedChains will be nil if InsecureSkipVerify is true)
+	certs := make([]*x509.Certificate, len(rawCerts))
+	for i, asn1Data := range rawCerts {
+		certs[i], _ = x509.ParseCertificate(asn1Data)
+	}
 	if len(certs) == 0 {
 		return errors.New("unexpected certs")
 	}
@@ -325,7 +325,7 @@ func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
 			}
 		}
 		if verifyResult == foundCA {
-			return errors.New("peer cert is invalid (against pinned CA and verifyPeerCertByName)")
+			errors.New("peer cert is invalid (against pinned CA and verifyPeerCertByName)")
 		}
 		return errors.New("peer cert is invalid (against root CAs and verifyPeerCertByName)")
 	}
@@ -352,18 +352,6 @@ func (r *RandCarrier) verifyConnection(cs tls.ConnectionState) error {
 	return nil // r.PinnedPeerCertSha256==nil && r.verifyPeerCertByName==nil
 }
 
-func uVerifyConnectionAdapter(f func(tls.ConnectionState) error) func(utls.ConnectionState) error {
-	if f == nil {
-		return nil
-	}
-	return func(cs utls.ConnectionState) error {
-		standardCS := tls.ConnectionState{
-			PeerCertificates: cs.PeerCertificates,
-		}
-		return f(standardCS)
-	}
-}
-
 type RandCarrier struct {
 	Config               *tls.Config
 	RootCAs              *x509.CertPool
@@ -401,7 +389,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 		RootCAs:                root,
 		NextProtos:             slices.Clone(c.NextProtocol),
 		SessionTicketsDisabled: !c.EnableSessionResumption,
-		VerifyConnection:       randCarrier.verifyConnection,
+		VerifyPeerCertificate:  randCarrier.verifyPeerCert,
 	}
 	randCarrier.Config = config
 	if len(c.VerifyPeerCertByName) > 0 {
@@ -465,13 +453,9 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 		for _, s := range tls.CipherSuites() {
 			id[s.Name] = s.ID
 		}
-		for _, s := range tls.InsecureCipherSuites() {
-			id[s.Name] = s.ID
-		}
 		for n := range strings.SplitSeq(c.CipherSuites, ":") {
-			n = strings.TrimSpace(n)
-			if v, ok := id[n]; ok {
-				config.CipherSuites = append(config.CipherSuites, v)
+			if id[n] != 0 {
+				config.CipherSuites = append(config.CipherSuites, id[n])
 			}
 		}
 	}

transport/internet/tls/pin_test.go

@@ -110,15 +110,15 @@ func TestVerifyPeerLeafCert(t *testing.T) {
 		PinnedPeerCertSha256: [][]byte{leafHash[:]},
 	}
 
-	cs := tls.ConnectionState{PeerCertificates: []*x509.Certificate{leaf}}
-	err := r.verifyConnection(cs)
+	rawCerts := [][]byte{leaf.Raw}
+	err := r.verifyPeerCert(rawCerts, nil)
 	if err != nil {
 		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
 	}
 
 	// make the pinned hash incorrect
 	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyConnection(cs)
+	err = r.verifyPeerCert(rawCerts, nil)
 	if err == nil {
 		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
 	}
@@ -138,15 +138,15 @@ func TestVerifyPeerCACert(t *testing.T) {
 		PinnedPeerCertSha256: [][]byte{caHash[:]},
 	}
 
-	cs := tls.ConnectionState{PeerCertificates: []*x509.Certificate{leaf, ca}}
-	err := r.verifyConnection(cs)
+	rawCerts := [][]byte{leaf.Raw, ca.Raw}
+	err := r.verifyPeerCert(rawCerts, nil)
 	if err != nil {
 		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
 	}
 
 	// make the pinned hash incorrect
 	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyConnection(cs)
+	err = r.verifyPeerCert(rawCerts, nil)
 	if err == nil {
 		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
 	}

transport/internet/tls/tls.go

@@ -152,16 +152,11 @@ func copyConfig(c *tls.Config) *utls.Config {
 		RootCAs:                        c.RootCAs,
 		ServerName:                     c.ServerName,
 		InsecureSkipVerify:             c.InsecureSkipVerify,
-		VerifyConnection:               uVerifyConnectionAdapter(c.VerifyConnection),
-		SessionTicketsDisabled:         c.SessionTicketsDisabled,
+		VerifyPeerCertificate:          c.VerifyPeerCertificate,
 		KeyLogWriter:                   c.KeyLogWriter,
 		EncryptedClientHelloConfigList: c.EncryptedClientHelloConfigList,
 		NextProtos:                     c.NextProtos,
 	}
-	if c.ClientSessionCache != nil {
-		config.ClientSessionCache = uGlobalSessionCache
-	}
-
 	return config
 }