TUN inbound: Refine gateway and autoSystemRoutingTable on Linux (#6398)

https://github.com/XTLS/Xray-core/pull/6398#issuecomment-4880261591

.github/workflows/docker.yml

@@ -65,7 +65,7 @@ jobs:
           echo "LATEST=$LATEST" >>${GITHUB_ENV}
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/release-win7.yml

@@ -14,13 +14,13 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-wintun-
@@ -83,7 +83,7 @@ jobs:
       CGO_ENABLED: 0
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Show workflow information
         run: |
@@ -119,13 +119,13 @@ jobs:
           # go build -o build_assets/wxray.exe -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-H windowsgui -X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid=" -v ./main
 
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-wintun-

.github/workflows/release.yml

@@ -14,13 +14,13 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-wintun-
@@ -170,7 +170,7 @@ jobs:
       CGO_ENABLED: 0
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up NDK
         if: matrix.goos == 'android'
@@ -225,14 +225,14 @@ jobs:
           fi
 
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
 
       - name: Restore Wintun Cache
         if: matrix.goos == 'windows'
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-wintun-

.github/workflows/scheduled-assets-update.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
@@ -59,7 +59,7 @@ jobs:
             done
 
       - name: Save Geodat Cache
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         if: ${{ steps.update.outputs.unhit }}
         with:
           path: resources
@@ -73,7 +73,7 @@ jobs:
       ASSETHASH: 07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51
     steps:
       - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-wintun-
@@ -129,7 +129,7 @@ jobs:
             fi
 
       - name: Save Wintun Cache
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         if: ${{ steps.update.outputs.unhit }}
         with:
           path: resources

.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-
@@ -40,7 +40,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Check Proto Version Header
         run: |
           head -n 4 core/config.pb.go > ref.txt
@@ -59,7 +59,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -83,14 +83,14 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           check-latest: true
       - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: resources
           key: xray-geodat-

README.md

@@ -73,6 +73,7 @@
   - [Xray_bash_onekey](https://github.com/hello-yunshu/Xray_bash_onekey), [XTool](https://github.com/LordPenguin666/XTool), [VPainLess](https://github.com/vpainless/vpainless)
   - [v2ray-agent](https://github.com/mack-a/v2ray-agent), [Xray_onekey](https://github.com/wulabing/Xray_onekey), [ProxySU](https://github.com/proxysu/ProxySU)
 - Magisk
+  - [Magic_V2Ray](https://github.com/vincentng295/Magic_V2Ray)
   - [Xray_For_Magisk](https://github.com/E7KMbb/Xray_For_Magisk)
 - Homebrew
   - `brew install xray`

app/dns/dnscommon.go

@@ -198,9 +198,14 @@ func parseResponse(payload []byte) (*IPRecord, error) {
 	ipRecord := &IPRecord{
 		ReqID:     h.ID,
 		RCode:     h.RCode,
-		Expire:    now.Add(time.Second * dns_feature.DefaultTTL),
 		RawHeader: &h,
 	}
+	defer func() {
+		// set to default TTL if no valid TTL is found
+		if ipRecord.Expire.IsZero() {
+			ipRecord.Expire = now.Add(time.Second * dns_feature.DefaultTTL)
+		}
+	}()
 
 L:
 	for {
@@ -217,7 +222,7 @@ L:
 			ttl = 1
 		}
 		expire := now.Add(time.Duration(ttl) * time.Second)
-		if ipRecord.Expire.After(expire) {
+		if ipRecord.Expire.IsZero() || ipRecord.Expire.After(expire) {
 			ipRecord.Expire = expire
 		}
 

app/geodata/download.go

@@ -2,6 +2,7 @@ package geodata
 
 import (
 	"context"
+	"crypto/tls"
 	go_errors "errors"
 	"io"
 	"net/http"
@@ -9,6 +10,7 @@ import (
 	"path/filepath"
 	"time"
 
+	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/platform/filesystem"
@@ -16,6 +18,7 @@ import (
 	"github.com/xtls/xray-core/common/utils"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/transport/internet/tagged"
+	"golang.org/x/net/http2"
 )
 
 const idleTimeout = 30 * time.Second
@@ -26,8 +29,9 @@ type stage struct {
 }
 
 type downloader struct {
-	ctx    context.Context
-	client *http.Client
+	ctx         context.Context
+	httpClient  *http.Client
+	httpsClient *http.Client
 }
 
 type idleConn struct {
@@ -53,52 +57,84 @@ func (c *idleConn) Write(b []byte) (int, error) {
 
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
-		ctx:    ctx,
-		client: newClient(ctx, dispatcher, outbound),
+		ctx:         ctx,
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
-	return &http.Client{
-		Transport: &http.Transport{
-			Proxy:             nil,
-			DisableKeepAlives: true,
-			DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
-				var conn net.Conn
-				err := task.Run(ctx, func() error {
-					if tagged.Dialer == nil {
-						return errors.New("tagged dialer is not initialized")
-					}
-					dest, err := net.ParseDestination(network + ":" + address)
-					if err != nil {
-						return errors.New("cannot understand address").Base(err)
-					}
-					c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
-					if err != nil {
-						return errors.New("cannot dial remote address ", dest).Base(err)
-					}
-					conn = c
-					return nil
-				})
-				if err != nil {
-					return nil, errors.New("cannot finish connection").Base(err)
-				}
-				return &idleConn{
-					Conn: conn,
-				}, nil
-			},
-			TLSHandshakeTimeout:   idleTimeout,
-			ResponseHeaderTimeout: idleTimeout,
-		},
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if req.URL.Scheme != "https" {
-				return errors.New("redirected to non-https URL: ", req.URL.String())
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
+	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+		var conn net.Conn
+		err := task.Run(ctx, func() error {
+			if tagged.Dialer == nil {
+				return errors.New("tagged dialer is not initialized")
 			}
-			if len(via) >= 10 {
-				return errors.New("stopped after 10 redirects")
+			dest, err := net.ParseDestination(network + ":" + address)
+			if err != nil {
+				return errors.New("cannot understand address").Base(err)
 			}
+			c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
+			if err != nil {
+				return errors.New("cannot dial remote address ", dest).Base(err)
+			}
+			conn = c
 			return nil
-		},
+		})
+		if err != nil {
+			return nil, errors.New("cannot finish connection").Base(err)
+		}
+		return &idleConn{
+			Conn: conn,
+		}, nil
+	}
+	if isHTTPS {
+		return &http.Client{
+			Transport: &http2.Transport{
+				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+					conn, err := dial(ctx, network, address)
+					if err != nil {
+						return nil, err
+					}
+					host, _, _ := net.SplitHostPort(address)
+					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+					defer cancel()
+					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+						conn.Close()
+						return nil, err
+					}
+					return tlsConn, nil
+				},
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
 	}
 }
 
@@ -160,7 +196,13 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	resp, err := d.client.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}

app/metrics/metrics.go

@@ -2,15 +2,18 @@ package metrics
 
 import (
 	"context"
+	"encoding/json"
+	stderrors "errors"
 	"expvar"
+	stdnet "net"
 	"net/http"
-	_ "net/http/pprof"
+	"net/http/pprof"
 	"strings"
 
 	"github.com/xtls/xray-core/app/observatory"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
+	xnet "github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/extension"
@@ -21,15 +24,17 @@ import (
 type MetricsHandler struct {
 	ohm          outbound.Manager
 	statsManager feature_stats.Manager
-	observatory  extension.Observatory
+	ctx          context.Context
 	tag          string
 	listen       string
-	tcpListener  net.Listener
+	tcpListener  xnet.Listener
+	listener     *OutboundListener
 }
 
 // NewMetricsHandler creates a new MetricsHandler based on the given config.
 func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, error) {
 	c := &MetricsHandler{
+		ctx:    ctx,
 		tag:    config.Tag,
 		listen: config.Listen,
 	}
@@ -37,46 +42,6 @@ func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, er
 		c.statsManager = sm
 		c.ohm = om
 	}))
-	expvar.Publish("stats", expvar.Func(func() interface{} {
-		resp := map[string]map[string]map[string]int64{
-			"inbound":  {},
-			"outbound": {},
-			"user":     {},
-		}
-		c.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
-			nameSplit := strings.Split(name, ">>>")
-			typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
-			if item, found := resp[typeName][tagOrUser]; found {
-				item[direction] = counter.Value()
-			} else {
-				resp[typeName][tagOrUser] = map[string]int64{
-					direction: counter.Value(),
-				}
-			}
-			return true
-		})
-		return resp
-	}))
-	expvar.Publish("observatory", expvar.Func(func() interface{} {
-		if c.observatory == nil {
-			common.Must(core.RequireFeatures(ctx, func(observatory extension.Observatory) error {
-				c.observatory = observatory
-				return nil
-			}))
-			if c.observatory == nil {
-				return nil
-			}
-		}
-		resp := map[string]*observatory.OutboundStatus{}
-		if o, err := c.observatory.GetObservation(context.Background()); err != nil {
-			return err
-		} else {
-			for _, x := range o.(*observatory.ObservationResult).GetStatus() {
-				resp[x.OutboundTag] = x
-			}
-		}
-		return resp
-	}))
 	return c, nil
 }
 
@@ -85,45 +50,172 @@ func (p *MetricsHandler) Type() interface{} {
 }
 
 func (p *MetricsHandler) Start() error {
+	handler := p.httpHandler()
+
 	// direct listen a port if listen is set
 	if p.listen != "" {
-		TCPlistener, err := net.Listen("tcp", p.listen)
+		TCPlistener, err := xnet.Listen("tcp", p.listen)
 		if err != nil {
 			return err
 		}
 		p.tcpListener = TCPlistener
 		errors.LogInfo(context.Background(), "Metrics server listening on ", p.listen)
 
-		go func() {
-			if err := http.Serve(TCPlistener, http.DefaultServeMux); err != nil {
-				errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
-			}
-		}()
+		go p.serve(TCPlistener, handler)
+	}
+
+	if p.tag == "" {
+		if p.tcpListener == nil {
+			return errors.New("metrics must have a tag or listen address")
+		}
+		return nil
 	}
 
 	listener := &OutboundListener{
-		buffer: make(chan net.Conn, 4),
+		buffer: make(chan xnet.Conn, 4),
 		done:   done.New(),
 	}
+	p.listener = listener
 
-	go func() {
-		if err := http.Serve(listener, http.DefaultServeMux); err != nil {
-			errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
-		}
-	}()
+	go p.serve(listener, handler)
 
 	if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
 		errors.LogInfo(context.Background(), "failed to remove existing handler")
 	}
 
-	return p.ohm.AddHandler(context.Background(), &Outbound{
+	if err := p.ohm.AddHandler(context.Background(), &Outbound{
 		tag:      p.tag,
 		listener: listener,
-	})
+	}); err != nil {
+		if closeErr := p.Close(); closeErr != nil {
+			errors.LogErrorInner(context.Background(), closeErr, "failed to close metrics server after start failure")
+		}
+		return err
+	}
+
+	return nil
 }
 
 func (p *MetricsHandler) Close() error {
-	return nil
+	var errs []error
+	if p.tcpListener != nil {
+		errs = append(errs, p.tcpListener.Close())
+		p.tcpListener = nil
+	}
+	if p.listener != nil {
+		errs = append(errs, p.listener.Close())
+		p.listener = nil
+	}
+	if p.ohm != nil && p.tag != "" {
+		if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
+			errors.LogInfo(context.Background(), "failed to remove metrics handler")
+		}
+	}
+	return errors.Combine(errs...)
+}
+
+func (p *MetricsHandler) serve(listener xnet.Listener, handler http.Handler) {
+	if err := http.Serve(listener, handler); err != nil && !isClosedListenerError(err) {
+		errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
+	}
+}
+
+func isClosedListenerError(err error) bool {
+	if err == nil {
+		return true
+	}
+	if stderrors.Is(err, stdnet.ErrClosed) || stderrors.Is(err, http.ErrServerClosed) {
+		return true
+	}
+	errText := err.Error()
+	return strings.Contains(errText, "listen closed") ||
+		strings.Contains(errText, "use of closed network connection")
+}
+
+func (p *MetricsHandler) httpHandler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/debug/vars", p.handleDebugVars)
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	return mux
+}
+
+func (p *MetricsHandler) handleDebugVars(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	vars := map[string]json.RawMessage{}
+	expvar.Do(func(kv expvar.KeyValue) {
+		value := json.RawMessage(kv.Value.String())
+		if !json.Valid(value) {
+			value = json.RawMessage("null")
+		}
+		vars[kv.Key] = value
+	})
+	vars["stats"] = marshalJSON(p.stats())
+	vars["observatory"] = marshalJSON(p.observatoryStatus())
+
+	payload, err := json.Marshal(vars)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Write(payload)
+}
+
+func marshalJSON(value interface{}) json.RawMessage {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return json.RawMessage("null")
+	}
+	return data
+}
+
+func (p *MetricsHandler) stats() map[string]map[string]map[string]int64 {
+	resp := map[string]map[string]map[string]int64{
+		"inbound":  {},
+		"outbound": {},
+		"user":     {},
+	}
+	p.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
+		nameSplit := strings.Split(name, ">>>")
+		if len(nameSplit) < 4 {
+			return true
+		}
+		typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
+		items, found := resp[typeName]
+		if !found {
+			items = map[string]map[string]int64{}
+			resp[typeName] = items
+		}
+		if item, found := items[tagOrUser]; found {
+			item[direction] = counter.Value()
+		} else {
+			items[tagOrUser] = map[string]int64{
+				direction: counter.Value(),
+			}
+		}
+		return true
+	})
+	return resp
+}
+
+func (p *MetricsHandler) observatoryStatus() interface{} {
+	feature := core.MustFromContext(p.ctx).GetFeature(extension.ObservatoryType())
+	if feature == nil {
+		return nil
+	}
+	observatoryFeature := feature.(extension.Observatory)
+	resp := map[string]*observatory.OutboundStatus{}
+	if o, err := observatoryFeature.GetObservation(context.Background()); err != nil {
+		return err
+	} else {
+		for _, x := range o.(*observatory.ObservationResult).GetStatus() {
+			resp[x.OutboundTag] = x
+		}
+	}
+	return resp
 }
 
 func init() {

app/metrics/metrics_test.go

@@ -0,0 +1,161 @@
+package metrics
+
+import (
+	"context"
+	"encoding/json"
+	stdnet "net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/xtls/xray-core/app/dispatcher"
+	"github.com/xtls/xray-core/app/proxyman"
+	_ "github.com/xtls/xray-core/app/proxyman/inbound"
+	_ "github.com/xtls/xray-core/app/proxyman/outbound"
+	appstats "github.com/xtls/xray-core/app/stats"
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/core"
+	feature_outbound "github.com/xtls/xray-core/features/outbound"
+)
+
+func TestMetricsCanRestartInSameProcess(t *testing.T) {
+	for i := 0; i < 2; i++ {
+		server := startMetricsTestServer(t)
+		readMetricsVars(t, server)
+		readMetricsPprof(t, server)
+		if err := server.Close(); err != nil {
+			t.Fatalf("failed to close metrics server: %v", err)
+		}
+	}
+}
+
+func TestMetricsCanRunMultipleInstancesInSameProcess(t *testing.T) {
+	server1 := startMetricsTestServer(t)
+	t.Cleanup(func() {
+		_ = server1.Close()
+	})
+	server2 := startMetricsTestServer(t)
+	t.Cleanup(func() {
+		_ = server2.Close()
+	})
+
+	readMetricsVars(t, server1)
+	readMetricsVars(t, server2)
+}
+
+func TestMetricsListenOnlyWithoutTagDoesNotRegisterOutbound(t *testing.T) {
+	listen := pickMetricsListenAddress(t)
+	server := startMetricsTestServerWithMetricsConfig(t, &Config{
+		Listen: listen,
+	})
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+
+	response, err := http.Get("http://" + listen + "/debug/vars")
+	if err != nil {
+		t.Fatalf("failed to read listen-only metrics: %v", err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("unexpected listen-only metrics status: %d", response.StatusCode)
+	}
+
+	outboundManager := server.GetFeature(feature_outbound.ManagerType()).(feature_outbound.Manager)
+	if handlers := outboundManager.ListHandlers(context.Background()); len(handlers) != 0 {
+		t.Fatalf("listen-only metrics registered outbound handlers: got %d, want 0", len(handlers))
+	}
+}
+
+func startMetricsTestServer(t *testing.T) *core.Instance {
+	return startMetricsTestServerWithMetricsConfig(t, &Config{
+		Tag: "metrics_out",
+	})
+}
+
+func startMetricsTestServerWithMetricsConfig(t *testing.T, metricsConfig *Config) *core.Instance {
+	t.Helper()
+
+	server, err := core.New(metricsTestConfig(metricsConfig))
+	if err != nil {
+		t.Fatalf("failed to create metrics server: %v", err)
+	}
+	if err := server.Start(); err != nil {
+		_ = server.Close()
+		t.Fatalf("failed to start metrics server: %v", err)
+	}
+	return server
+}
+
+func metricsTestConfig(metricsConfig *Config) *core.Config {
+	return &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&dispatcher.Config{}),
+			serial.ToTypedMessage(&proxyman.InboundConfig{}),
+			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
+			serial.ToTypedMessage(&appstats.Config{}),
+			serial.ToTypedMessage(metricsConfig),
+		},
+	}
+}
+
+func pickMetricsListenAddress(t *testing.T) string {
+	t.Helper()
+
+	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to pick metrics listen address: %v", err)
+	}
+	defer listener.Close()
+	return listener.Addr().String()
+}
+
+func readMetricsVars(t *testing.T, server *core.Instance) {
+	t.Helper()
+
+	recorder := httptest.NewRecorder()
+	metricsHandler(t, server).httpHandler().ServeHTTP(
+		recorder,
+		httptest.NewRequest(http.MethodGet, "/debug/vars", nil),
+	)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected metrics vars status: %d", recorder.Code)
+	}
+
+	var payload map[string]interface{}
+	if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
+		t.Fatalf("failed to decode metrics vars: %v", err)
+	}
+	if _, found := payload["stats"]; !found {
+		t.Fatal("metrics vars missing stats")
+	}
+	if _, found := payload["observatory"]; !found {
+		t.Fatal("metrics vars missing observatory")
+	}
+}
+
+func readMetricsPprof(t *testing.T, server *core.Instance) {
+	t.Helper()
+
+	recorder := httptest.NewRecorder()
+	metricsHandler(t, server).httpHandler().ServeHTTP(
+		recorder,
+		httptest.NewRequest(http.MethodGet, "/debug/pprof/goroutine?debug=1", nil),
+	)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected metrics pprof status: %d", recorder.Code)
+	}
+}
+
+func metricsHandler(t *testing.T, server *core.Instance) *MetricsHandler {
+	t.Helper()
+
+	feature := server.GetFeature((*MetricsHandler)(nil))
+	handler, ok := feature.(*MetricsHandler)
+	if !ok || handler == nil {
+		t.Fatal("metrics handler not registered")
+	}
+	return handler
+}

common/geodata/domain_matcher.go

@@ -220,7 +220,7 @@ func parseDomain(d *Domain) (strmatcher.Matcher, error) {
 	case Domain_Regex:
 		return strmatcher.Regex.New(d.Value)
 	case Domain_Domain:
-		return strmatcher.Domain.New(d.Value)
+		return strmatcher.Domain.New(strings.ToLower(d.Value))
 	case Domain_Full:
 		return strmatcher.Full.New(strings.ToLower(d.Value))
 	default:

common/geodata/domain_registry.go

@@ -6,12 +6,14 @@ import (
 	"sync/atomic"
 
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/utils"
+	"github.com/xtls/xray-core/common/uuid"
 )
 
 type DomainRegistry struct {
 	mu       sync.Mutex
 	factory  DomainMatcherFactory
-	matchers []*DynamicDomainMatcher
+	matchers *utils.WeakCacheMap[uuid.UUID, DynamicDomainMatcher]
 }
 
 func (r *DomainRegistry) BuildDomainMatcher(rules []*DomainRule) (DomainMatcher, error) {
@@ -24,7 +26,7 @@ func (r *DomainRegistry) BuildDomainMatcher(rules []*DomainRule) (DomainMatcher,
 	}
 
 	d := NewDynamicDomainMatcher(rules, m)
-	r.matchers = append(r.matchers, d)
+	r.matchers.Store(uuid.New(), d)
 	return d, nil
 }
 
@@ -32,15 +34,20 @@ func (r *DomainRegistry) Reload() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	errors.LogInfo(context.Background(), "reloading GeoSite data for ", len(r.matchers), " domain matcher(s)")
+	var matchers []*DynamicDomainMatcher
+	r.matchers.Range(func(_ uuid.UUID, matcher *DynamicDomainMatcher) bool {
+		matchers = append(matchers, matcher)
+		return true
+	})
+	errors.LogInfo(context.Background(), "reloading GeoSite data for ", len(matchers), " domain matcher(s)")
 
 	factory := newDomainMatcherFactory()
 	type reloadEntry struct {
 		dynamic *DynamicDomainMatcher
 		matcher DomainMatcher
 	}
-	reloaded := make([]reloadEntry, len(r.matchers))
-	for i, d := range r.matchers {
+	reloaded := make([]reloadEntry, len(matchers))
+	for i, d := range matchers {
 		m, err := factory.BuildMatcher(d.rules)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to reload GeoSite data for domain matcher ", i)
@@ -52,13 +59,14 @@ func (r *DomainRegistry) Reload() error {
 		entry.dynamic.Reload(entry.matcher)
 	}
 	r.factory = factory
-	errors.LogInfo(context.Background(), "reloaded GeoSite data for ", len(r.matchers), " domain matcher(s)")
+	errors.LogInfo(context.Background(), "reloaded GeoSite data for ", len(matchers), " domain matcher(s)")
 	return nil
 }
 
 func newDomainRegistry() *DomainRegistry {
 	return &DomainRegistry{
-		factory: newDomainMatcherFactory(),
+		factory:  newDomainMatcherFactory(),
+		matchers: utils.NewWeakCacheMap[uuid.UUID, DynamicDomainMatcher](),
 	}
 }
 

common/geodata/ip_registry.go

@@ -7,25 +7,27 @@ import (
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/utils"
+	"github.com/xtls/xray-core/common/uuid"
 )
 
 type IPRegistry struct {
-	mu           sync.Mutex
-	ipsetFactory *IPSetFactory
-	matchers     []*DynamicIPMatcher
+	mu       sync.Mutex
+	factory  *IPSetFactory
+	matchers *utils.WeakCacheMap[uuid.UUID, DynamicIPMatcher]
 }
 
 func (r *IPRegistry) BuildIPMatcher(rules []*IPRule) (IPMatcher, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	m, err := buildOptimizedIPMatcher(r.ipsetFactory, rules)
+	m, err := buildOptimizedIPMatcher(r.factory, rules)
 	if err != nil {
 		return nil, err
 	}
 
 	d := NewDynamicIPMatcher(rules, m)
-	r.matchers = append(r.matchers, d)
+	r.matchers.Store(uuid.New(), d)
 	return d, nil
 }
 
@@ -33,15 +35,20 @@ func (r *IPRegistry) Reload() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	errors.LogInfo(context.Background(), "reloading GeoIP data for ", len(r.matchers), " IP matcher(s)")
+	var matchers []*DynamicIPMatcher
+	r.matchers.Range(func(_ uuid.UUID, matcher *DynamicIPMatcher) bool {
+		matchers = append(matchers, matcher)
+		return true
+	})
+	errors.LogInfo(context.Background(), "reloading GeoIP data for ", len(matchers), " IP matcher(s)")
 
 	factory := newIPSetFactory()
 	type reloadEntry struct {
 		dynamic *DynamicIPMatcher
 		matcher IPMatcher
 	}
-	reloaded := make([]reloadEntry, len(r.matchers))
-	for i, d := range r.matchers {
+	reloaded := make([]reloadEntry, len(matchers))
+	for i, d := range matchers {
 		m, err := buildOptimizedIPMatcher(factory, d.rules)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to reload GeoIP data for IP matcher ", i)
@@ -52,14 +59,15 @@ func (r *IPRegistry) Reload() error {
 	for _, entry := range reloaded {
 		entry.dynamic.Reload(entry.matcher)
 	}
-	r.ipsetFactory = factory
-	errors.LogInfo(context.Background(), "reloaded GeoIP data for ", len(r.matchers), " IP matcher(s)")
+	r.factory = factory
+	errors.LogInfo(context.Background(), "reloaded GeoIP data for ", len(matchers), " IP matcher(s)")
 	return nil
 }
 
 func newIPRegistry() *IPRegistry {
 	return &IPRegistry{
-		ipsetFactory: newIPSetFactory(),
+		factory:  newIPSetFactory(),
+		matchers: utils.NewWeakCacheMap[uuid.UUID, DynamicIPMatcher](),
 	}
 }
 

common/geodata/rule_parser.go

@@ -138,7 +138,7 @@ func ParseDomainRule(r string, defaultType Domain_Type) (*DomainRule, error) {
 	}
 
 	prefix := 0
-	for _, ext := range [...]string{"ext:", "ext-domain:"} {
+	for _, ext := range [...]string{"ext:", "ext-domain:", "ext-site:"} {
 		if strings.HasPrefix(r, ext) {
 			prefix = len(ext)
 			break
@@ -167,7 +167,7 @@ func ParseDomainRules(rules []string, defaultType Domain_Type) ([]*DomainRule, e
 		}
 
 		prefix := 0
-		for _, ext := range [...]string{"ext:", "ext-domain:"} {
+		for _, ext := range [...]string{"ext:", "ext-domain:", "ext-site:"} {
 			if strings.HasPrefix(r, ext) {
 				prefix = len(ext)
 				break

common/protocol/http/headers.go

@@ -1,25 +1,41 @@
 package http
 
 import (
+	"context"
 	"net/http"
 	"strconv"
 	"strings"
 
+	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 )
 
-// ParseXForwardedFor parses X-Forwarded-For header in http headers, and return the IP list in it.
-func ParseXForwardedFor(header http.Header) []net.Address {
-	xff := header.Get("X-Forwarded-For")
-	if xff == "" {
-		return nil
+// ApplyTrustedXForwardedFor returns remoteAddr overridden by X-Forwarded-For only when a configured trusted header is present.
+func ApplyTrustedXForwardedFor(header http.Header, trusted []string, remoteAddr net.Addr) net.Addr {
+	value := header.Get("X-Forwarded-For")
+	if value == "" {
+		return remoteAddr
 	}
-	list := strings.Split(xff, ",")
-	addrs := make([]net.Address, 0, len(list))
-	for _, proxy := range list {
-		addrs = append(addrs, net.ParseAddress(proxy))
+	for _, t := range trusted {
+		if len(header.Values(t)) > 0 {
+			if idx := strings.IndexByte(value, ','); idx >= 0 {
+				value = value[:idx]
+			}
+			if addr := net.ParseAddress(value); addr.Family().IsIP() {
+				return &net.TCPAddr{
+					IP:   addr.IP(),
+					Port: 0,
+				}
+			}
+			return remoteAddr
+		}
 	}
-	return addrs
+	if len(trusted) == 0 {
+		errors.LogWarning(context.Background(), `received "X-Forwarded-For" from `, remoteAddr, ` but "sockopt.trustedXForwardedFor" is not configured; ignoring it and using the real remote address`)
+	} else {
+		errors.LogError(context.Background(), `ignored potentially forged "X-Forwarded-For" from `, remoteAddr, `: `, value)
+	}
+	return remoteAddr
 }
 
 // RemoveHopByHopHeaders removes hop by hop headers in http header list.

common/protocol/http/headers_test.go

@@ -2,23 +2,48 @@ package http_test
 
 import (
 	"bufio"
+	gonet "net"
 	"net/http"
 	"strings"
 	"testing"
 
-	"github.com/google/go-cmp/cmp"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/net"
 	. "github.com/xtls/xray-core/common/protocol/http"
 )
 
-func TestParseXForwardedFor(t *testing.T) {
-	header := http.Header{}
-	header.Add("X-Forwarded-For", "129.78.138.66, 129.78.64.103")
-	addrs := ParseXForwardedFor(header)
-	if r := cmp.Diff(addrs, []net.Address{net.ParseAddress("129.78.138.66"), net.ParseAddress("129.78.64.103")}); r != "" {
-		t.Error(r)
-	}
+func TestApplyTrustedXForwardedFor(t *testing.T) {
+	remoteAddr := &gonet.TCPAddr{IP: gonet.ParseIP("127.0.0.1"), Port: 12345}
+
+	t.Run("ignore X-Forwarded-For without trusted header", func(t *testing.T) {
+		header := http.Header{}
+		header.Add("X-Forwarded-For", "129.78.138.66, 129.78.64.103")
+
+		if addr := ApplyTrustedXForwardedFor(header, nil, remoteAddr); addr != remoteAddr {
+			t.Fatalf("unexpected remote address: %v", addr)
+		}
+	})
+
+	t.Run("trust X-Forwarded-For", func(t *testing.T) {
+		header := http.Header{}
+		header.Add("X-Forwarded-For", "129.78.138.66, 129.78.64.103")
+		header.Add("X-Trusted-CDN", "")
+
+		addr := ApplyTrustedXForwardedFor(header, []string{"X-Trusted-CDN"}, remoteAddr)
+		if addr.String() != "129.78.138.66:0" {
+			t.Fatalf("unexpected remote address: %v", addr)
+		}
+	})
+
+	t.Run("ignore non-IP X-Forwarded-For", func(t *testing.T) {
+		header := http.Header{}
+		header.Add("X-Forwarded-For", "example.com")
+		header.Add("X-Trusted-CDN", "")
+
+		if addr := ApplyTrustedXForwardedFor(header, []string{"X-Trusted-CDN"}, remoteAddr); addr != remoteAddr {
+			t.Fatalf("unexpected remote address: %v", addr)
+		}
+	})
 }
 
 func TestHopByHopHeadersRemoving(t *testing.T) {

common/utils/weak_cache.go

@@ -1,6 +1,7 @@
 package utils
 
 import (
+	"maps"
 	"runtime"
 	"sync"
 	"weak"
@@ -43,3 +44,16 @@ func (c *WeakCacheMap[K, V]) Store(key K, value *V) {
 		}
 	}, struct{}{})
 }
+
+func (c *WeakCacheMap[K, V]) Range(f func(K, *V) bool) {
+	c.mu.Lock()
+	snapshot := maps.Clone(c.m)
+	c.mu.Unlock()
+	for k, v := range snapshot {
+		if value := v.Value(); value != nil {
+			if !f(k, value) {
+				break
+			}
+		}
+	}
+}

core/core.go

@@ -20,7 +20,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 6
-	Version_z byte = 1
+	Version_z byte = 27
 )
 
 var (

go.mod

@@ -4,16 +4,17 @@ go 1.26
 
 require (
 	github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716
-	github.com/cloudflare/circl v1.6.3
+	github.com/cloudflare/circl v1.6.4
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.3.0
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/miekg/dns v1.1.72
 	github.com/pelletier/go-toml v1.9.5
-	github.com/pion/stun/v3 v3.1.5
-	github.com/pires/go-proxyproto v0.12.0
+	github.com/pion/stun/v3 v3.1.6
+	github.com/pires/go-proxyproto v0.14.0
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sagernet/sing v0.5.1
@@ -30,7 +31,7 @@ require (
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v1.0.1
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0
 	h12.io/socks v1.0.3
@@ -55,7 +56,7 @@ require (
 	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.45.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -4,8 +4,8 @@ github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716 h1:J1O+xpLuJWkd
 github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716/go.mod h1:Npbg8qBtAZlsAB3FWmqwlVh5jtVG6a4DlYsOylUpvzA=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cloudflare/circl v1.6.4 h1:pOXuDTCEYyzydgUpQ0CQz3LsinKjiSk6nNP5Lt5K64U=
+github.com/cloudflare/circl v1.6.4/go.mod h1:YxarevkLlbaHuWsxG6vmYNWBEsSp4pnp7j+4VljMavY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -33,8 +33,8 @@ github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
 github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -49,12 +49,12 @@ github.com/pion/dtls/v3 v3.1.4 h1:QhvtMflMfu9Kf0RcDC5BJBle4caPskByrKQR6uuYqpY=
 github.com/pion/dtls/v3 v3.1.4/go.mod h1:cr/qotLISUw/9C1m83ZPNZtj9WnXkYLpfCptPqbkInc=
 github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
 github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/stun/v3 v3.1.5 h1:Y1FHlhaI6+4UoC5i/zQf4F7JvdZtB24/05oyy/GF1x8=
-github.com/pion/stun/v3 v3.1.5/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=
+github.com/pion/stun/v3 v3.1.6 h1:WnhsD0eHCiwCfKNkVx0VJJwr2Y3eV4Ueih3KJ+dfZy8=
+github.com/pion/stun/v3 v3.1.6/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs=
 github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=
 github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
-github.com/pires/go-proxyproto v0.12.0 h1:TTCxD66dU898tahivkqc3hoceZp7P44FnorWyo9d5vM=
-github.com/pires/go-proxyproto v0.12.0/go.mod h1:qUvfqUMEoX7T8g0q7TQLDnhMjdTrxnG0hvpMn+7ePNI=
+github.com/pires/go-proxyproto v0.14.0 h1:2vIGIfVG8eVRsKF0xukEoeT5RWhDXxBU0uv6smLOKdI=
+github.com/pires/go-proxyproto v0.14.0/go.mod h1:OXsCrKwrK2tXS9YrI5tkHx5xaQlO8FH3lFW76orFh24=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -147,10 +147,10 @@ golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH
 golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

infra/conf/hysteria.go

@@ -22,7 +22,6 @@ func (c *HysteriaClientConfig) Build() (proto.Message, error) {
 	}
 
 	config := &hysteria.ClientConfig{}
-	config.Version = c.Version
 	config.Server = &protocol.ServerEndpoint{
 		Address: c.Address.Build(),
 		Port:    uint32(c.Port),
@@ -44,6 +43,10 @@ type HysteriaServerConfig struct {
 }
 
 func (c *HysteriaServerConfig) Build() (proto.Message, error) {
+	if c.Version != 2 {
+		return nil, errors.New("version != 2")
+	}
+
 	config := new(hysteria.ServerConfig)
 
 	if c.Clients != nil {

infra/conf/loopback.go

@@ -1,14 +1,24 @@
 package conf
 
 import (
+	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/proxy/loopback"
 	"google.golang.org/protobuf/proto"
 )
 
 type LoopbackConfig struct {
-	InboundTag string `json:"inboundTag"`
+	InboundTag string          `json:"inboundTag"`
+	Sniffing   *SniffingConfig `json:"sniffing"`
 }
 
 func (l LoopbackConfig) Build() (proto.Message, error) {
-	return &loopback.Config{InboundTag: l.InboundTag}, nil
+	c := &loopback.Config{InboundTag: l.InboundTag}
+	if l.Sniffing != nil {
+		sc, err := l.Sniffing.Build()
+		if err != nil {
+			return nil, errors.New("failed to build sniffing config").Base(err)
+		}
+		c.Sniffing = sc
+	}
+	return c, nil
 }

infra/conf/transport_internet.go

@@ -404,8 +404,8 @@ func (c *SplitHTTPConfig) Build() (proto.Message, error) {
 		return nil, errors.New("maxConnections cannot be specified together with maxConcurrency")
 	}
 	if c.Xmux == (XmuxConfig{}) {
-		c.Xmux.MaxConcurrency.From = 1
-		c.Xmux.MaxConcurrency.To = 1
+		c.Xmux.MaxConnections.From = 6
+		c.Xmux.MaxConnections.To = 6
 		c.Xmux.HMaxRequestTimes.From = 600
 		c.Xmux.HMaxRequestTimes.To = 900
 		c.Xmux.HMaxReusableSecs.From = 1800
@@ -571,7 +571,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	}
 
 	config := &hysteria.Config{}
-	config.Version = c.Version
 	config.Auth = c.Auth
 	config.UdpIdleTimeout = c.UdpIdleTimeout
 	config.MasqType = c.Masquerade.Type
@@ -1409,10 +1408,12 @@ func (c *HeaderCustomTCP) Build() (proto.Message, error) {
 }
 
 type FragmentMask struct {
-	Packets  string     `json:"packets"`
-	Length   Int32Range `json:"length"`
-	Delay    Int32Range `json:"delay"`
-	MaxSplit Int32Range `json:"maxSplit"`
+	Packets  string       `json:"packets"`
+	Length   Int32Range   `json:"length"`
+	Delay    Int32Range   `json:"delay"`
+	Lengths  []Int32Range `json:"lengths"`
+	Delays   []Int32Range `json:"delays"`
+	MaxSplit Int32Range   `json:"maxSplit"`
 }
 
 func (c *FragmentMask) Build() (proto.Message, error) {
@@ -1437,14 +1438,29 @@ func (c *FragmentMask) Build() (proto.Message, error) {
 		}
 	}
 
-	config.LengthMin = int64(c.Length.From)
-	config.LengthMax = int64(c.Length.To)
-	if config.LengthMin == 0 {
-		return nil, errors.New("LengthMin can't be 0")
+	if len(c.Lengths) > 0 {
+		for _, r := range c.Lengths {
+			config.LengthsMin = append(config.LengthsMin, int64(r.From))
+			config.LengthsMax = append(config.LengthsMax, int64(r.To))
+		}
+	} else {
+		config.LengthsMin = append(config.LengthsMin, int64(c.Length.From))
+		config.LengthsMax = append(config.LengthsMax, int64(c.Length.To))
 	}
 
-	config.DelayMin = int64(c.Delay.From)
-	config.DelayMax = int64(c.Delay.To)
+	if config.LengthsMin[len(config.LengthsMin)-1] == 0 {
+		return nil, errors.New("last lengths entry min can't be 0")
+	}
+
+	if len(c.Delays) > 0 {
+		for _, r := range c.Delays {
+			config.DelaysMin = append(config.DelaysMin, int64(r.From))
+			config.DelaysMax = append(config.DelaysMax, int64(r.To))
+		}
+	} else {
+		config.DelaysMin = append(config.DelaysMin, int64(c.Delay.From))
+		config.DelaysMax = append(config.DelaysMax, int64(c.Delay.To))
+	}
 
 	config.MaxSplitMin = int64(c.MaxSplit.From)
 	config.MaxSplitMax = int64(c.MaxSplit.To)
@@ -1788,12 +1804,15 @@ func (c *MkcpLegacy) Build() (proto.Message, error) {
 }
 
 type Salamander struct {
-	Password   string      `json:"password"`
-	PacketSize *Int32Range `json:"packetSize"`
+	Password   string     `json:"password"`
+	PacketSize Int32Range `json:"packetSize"`
 }
 
 func (c *Salamander) Build() (proto.Message, error) {
-	if c.PacketSize != nil {
+	if c.PacketSize.To > 0 {
+		if c.PacketSize.From <= 0 || c.PacketSize.To > 2048 {
+			return nil, errors.New("gecko: invalid min/max packet size")
+		}
 		return &salamander.GeckoConfig{
 			Password:      c.Password,
 			MinPacketSize: c.PacketSize.From,

infra/conf/wireguard.go

@@ -7,6 +7,9 @@ import (
 	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/protocol"
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/proxy/wireguard"
 	"google.golang.org/protobuf/proto"
 )
@@ -17,9 +20,12 @@ type WireGuardPeerConfig struct {
 	Endpoint     string   `json:"endpoint"`
 	KeepAlive    uint32   `json:"keepAlive"`
 	AllowedIPs   []string `json:"allowedIPs,omitempty"`
+
+	Level uint32 `json:"level"`
+	Email string `json:"email"`
 }
 
-func (c *WireGuardPeerConfig) Build() (proto.Message, error) {
+func (c *WireGuardPeerConfig) Build() (*wireguard.PeerConfig, error) {
 	var err error
 	config := new(wireguard.PeerConfig)
 
@@ -78,14 +84,32 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 		config.Endpoint = c.Address
 	}
 
-	if c.Peers != nil {
+	if c.IsClient {
 		config.Peers = make([]*wireguard.PeerConfig, len(c.Peers))
 		for i, p := range c.Peers {
 			msg, err := p.Build()
 			if err != nil {
 				return nil, err
 			}
-			config.Peers[i] = msg.(*wireguard.PeerConfig)
+			config.Peers[i] = msg
+		}
+	} else {
+		config.Users = make([]*protocol.User, len(c.Peers))
+		processUser := func(idx int) error {
+			p := c.Peers[idx]
+			m, err := p.Build()
+			if err != nil {
+				return err
+			}
+			config.Users[idx] = &protocol.User{
+				Email:   p.Email,
+				Level:   p.Level,
+				Account: serial.ToTypedMessage(m),
+			}
+			return nil
+		}
+		if err := task.ParallelForN(len(c.Peers), processUser); err != nil {
+			return nil, err
 		}
 	}
 

infra/conf/wireguard_test.go

@@ -1,50 +0,0 @@
-package conf_test
-
-import (
-	"testing"
-
-	. "github.com/xtls/xray-core/infra/conf"
-	"github.com/xtls/xray-core/proxy/wireguard"
-)
-
-func TestWireGuardConfig(t *testing.T) {
-	creator := func() Buildable {
-		return new(WireGuardConfig)
-	}
-
-	runMultiTestCase(t, []TestCase{
-		{
-			Input: `{
-				"secretKey": "uJv5tZMDltsiYEn+kUwb0Ll/CXWhMkaSCWWhfPEZM3A=",
-				"address": ["10.1.1.1", "fd59:7153:2388:b5fd:0000:0000:1234:0001"],
-				"peers": [
-					{
-						"publicKey": "6e65ce0be17517110c17d77288ad87e7fd5252dcc7d09b95a39d61db03df832a",
-						"endpoint": "127.0.0.1:1234"
-					}
-				],
-				"mtu": 1300,
-				"workers": 2,
-				"domainStrategy": "ForceIPv6v4",
-				"noKernelTun": false
-			}`,
-			Parser: loadJSON(creator),
-			Output: &wireguard.DeviceConfig{
-				// key converted into hex form
-				SecretKey: "b89bf9b5930396db226049fe914c1bd0b97f0975a13246920965a17cf1193370",
-				Endpoint:  []string{"10.1.1.1", "fd59:7153:2388:b5fd:0000:0000:1234:0001"},
-				Peers: []*wireguard.PeerConfig{
-					{
-						// also can read from hex form directly
-						PublicKey:  "6e65ce0be17517110c17d77288ad87e7fd5252dcc7d09b95a39d61db03df832a",
-						Endpoint:   "127.0.0.1:1234",
-						AllowedIps: []string{"0.0.0.0/0", "::0/0"},
-					},
-				},
-				Mtu:            1300,
-				DomainStrategy: wireguard.DeviceConfig_FORCE_IP64,
-				NoKernelTun:    false,
-			},
-		},
-	})
-}

infra/conf/xray.go

@@ -173,27 +173,6 @@ func (c *InboundDetourConfig) Build() (*core.InboundHandlerConfig, error) {
 			return nil, err
 		}
 		receiverSettings.StreamSettings = ss
-		// TODO: Actually implement this breaking change
-		protocol := ss.GetEffectiveProtocol()
-		if (protocol == "websocket" || protocol == "httpupgrade" || protocol == "splithttp") &&
-			(c.StreamSetting.SocketSettings == nil || len(c.StreamSetting.SocketSettings.TrustedXForwardedFor) == 0) {
-			errors.LogWarning(
-				context.Background(),
-				`====== SECURITY WARNING ======`,
-				"\n",
-				`inbound "`, c.Tag, `" using `, protocol, ` has not configured "sockopt.trustedXForwardedFor".`,
-				"\n",
-				`THIS IS VERY INSECURE!!!`,
-				"\n",
-				`For compatibility, Xray still allows this for now and still trusts X-Forwarded-For implicitly.`,
-				"\n",
-				`Please configure "sockopt.trustedXForwardedFor" immediately.`,
-				"\n",
-				`In future versions, this option must be explicitly set.`,
-				"\n",
-				`====== SECURITY WARNING ======`,
-			)
-		}
 		if strings.Contains(ss.SecurityType, "reality") && (receiverSettings.PortList == nil ||
 			len(receiverSettings.PortList.Ports()) != 1 || receiverSettings.PortList.Ports()[0] != 443) {
 			errors.LogWarning(context.Background(), `REALITY: Listening on non-443 ports may get your IP blocked by the GFW`)

proxy/hysteria/account/config.go

@@ -3,25 +3,32 @@ package account
 import (
 	"sync"
 
-	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
 
+	"github.com/google/uuid"
 	"google.golang.org/protobuf/proto"
 )
 
 func (a *Account) AsAccount() (protocol.Account, error) {
+	var VR net.Port
+	if id, err := uuid.Parse(a.Auth); err == nil {
+		VR = net.PortFromBytes(id[6:8])
+	}
 	return &MemoryAccount{
 		Auth: a.Auth,
+		VR:   VR,
 	}, nil
 }
 
 type MemoryAccount struct {
 	Auth string
+	VR   net.Port
 }
 
-func (a *MemoryAccount) Equals(another protocol.Account) bool {
-	if account, ok := another.(*MemoryAccount); ok {
-		return a.Auth == account.Auth
+func (a *MemoryAccount) Equals(other protocol.Account) bool {
+	if b, ok := other.(*MemoryAccount); ok {
+		return a.Auth == b.Auth
 	}
 	return false
 }
@@ -33,97 +40,105 @@ func (a *MemoryAccount) ToProto() proto.Message {
 }
 
 type Validator struct {
-	emails map[string]struct{}
-	users  map[string]*protocol.MemoryUser
-
-	mutex sync.Mutex
+	users sync.Map
+	ids   sync.Map
+	mu    sync.Mutex
 }
 
 func NewValidator() *Validator {
-	return &Validator{
-		emails: make(map[string]struct{}),
-		users:  make(map[string]*protocol.MemoryUser),
-	}
+	return &Validator{}
 }
 
-func (v *Validator) Add(u *protocol.MemoryUser) error {
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	if u.Email != "" {
-		if _, ok := v.emails[u.Email]; ok {
-			return errors.New("User ", u.Email, " already exists.")
-		}
-		v.emails[u.Email] = struct{}{}
+func (v *Validator) Add(user *protocol.MemoryUser) (err error) {
+	v.mu.Lock()
+	v.users.Store(user.Account.(*MemoryAccount).Auth, user)
+	if id, err := uuid.Parse(user.Account.(*MemoryAccount).Auth); err == nil {
+		id[6] = 0
+		id[7] = 0
+		v.ids.Store(id, user)
 	}
-	v.users[u.Account.(*MemoryAccount).Auth] = u
-
-	return nil
+	v.mu.Unlock()
+	return
 }
 
-func (v *Validator) Del(email string) error {
-	if email == "" {
-		return errors.New("Email must not be empty.")
-	}
-
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	if _, ok := v.emails[email]; !ok {
-		return errors.New("User ", email, " not found.")
-	}
-	delete(v.emails, email)
-	for key, user := range v.users {
-		if user.Email == email {
-			delete(v.users, key)
-			break
+func (v *Validator) DelByEmail(email string) (err error) {
+	v.mu.Lock()
+	if user := v.GetByEmail(email); user != nil {
+		auth := user.Account.(*MemoryAccount).Auth
+		v.users.Delete(auth)
+		if id, err := uuid.Parse(auth); err == nil {
+			id[6] = 0
+			id[7] = 0
+			v.ids.Delete(id)
 		}
 	}
-
-	return nil
+	v.mu.Unlock()
+	return
 }
 
-func (v *Validator) Get(auth string) *protocol.MemoryUser {
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	return v.users[auth]
-}
-
-func (v *Validator) GetByEmail(email string) *protocol.MemoryUser {
-	if email == "" {
-		return nil
-	}
-
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	if _, ok := v.emails[email]; ok {
-		for _, user := range v.users {
-			if user.Email == email {
-				return user
+func (v *Validator) Get(auth string) (user *protocol.MemoryUser) {
+	if id, err := uuid.Parse(auth); err == nil {
+		if user = v.GetByID(id); user != nil {
+			VR := net.PortFromBytes(id[6:8])
+			if user.Account.(*MemoryAccount).VR != VR {
+				user = &protocol.MemoryUser{
+					Email: user.Email,
+					Level: user.Level,
+					Account: &MemoryAccount{
+						Auth: auth,
+						VR:   VR,
+					},
+				}
 			}
 		}
+		return
 	}
-
-	return nil
-}
-
-func (v *Validator) GetAll() []*protocol.MemoryUser {
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	users := make([]*protocol.MemoryUser, 0, len(v.users))
-	for _, user := range v.users {
-		users = append(users, user)
+	if value, ok := v.users.Load(auth); ok {
+		user = value.(*protocol.MemoryUser)
 	}
-
-	return users
+	return
 }
 
-func (v *Validator) GetCount() int64 {
-	v.mutex.Lock()
-	defer v.mutex.Unlock()
-
-	return int64(len(v.users))
+func (v *Validator) GetByID(id uuid.UUID) (user *protocol.MemoryUser) {
+	id[6] = 0
+	id[7] = 0
+	if value, ok := v.ids.Load(id); ok {
+		user = value.(*protocol.MemoryUser)
+	}
+	return
+}
+
+func (v *Validator) GetByEmail(email string) (user *protocol.MemoryUser) {
+	v.users.Range(func(key, value any) bool {
+		if value.(*protocol.MemoryUser).Email == email {
+			user = value.(*protocol.MemoryUser)
+			return false
+		}
+		return true
+	})
+	return
+}
+
+func (v *Validator) GetAll() (users []*protocol.MemoryUser) {
+	v.users.Range(func(key, value any) bool {
+		users = append(users, value.(*protocol.MemoryUser))
+		return true
+	})
+	return
+}
+
+func (v *Validator) GetCount() (count int64) {
+	v.users.Range(func(key, value any) bool {
+		count++
+		return true
+	})
+	return
+}
+
+func (v *Validator) NotEmpty() (not_empty bool) {
+	v.users.Range(func(key, value any) bool {
+		not_empty = true
+		return false
+	})
+	return
 }

proxy/hysteria/config.pb.go

@@ -24,8 +24,7 @@ const (
 
 type ClientConfig struct {
 	state         protoimpl.MessageState   `protogen:"open.v1"`
-	Version       int32                    `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
-	Server        *protocol.ServerEndpoint `protobuf:"bytes,2,opt,name=server,proto3" json:"server,omitempty"`
+	Server        *protocol.ServerEndpoint `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -60,13 +59,6 @@ func (*ClientConfig) Descriptor() ([]byte, []int) {
 	return file_proxy_hysteria_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *ClientConfig) GetVersion() int32 {
-	if x != nil {
-		return x.Version
-	}
-	return 0
-}
-
 func (x *ClientConfig) GetServer() *protocol.ServerEndpoint {
 	if x != nil {
 		return x.Server
@@ -122,10 +114,9 @@ var File_proxy_hysteria_config_proto protoreflect.FileDescriptor
 
 const file_proxy_hysteria_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1bproxy/hysteria/config.proto\x12\x13xray.proxy.hysteria\x1a!common/protocol/server_spec.proto\x1a\x1acommon/protocol/user.proto\"f\n" +
-	"\fClientConfig\x12\x18\n" +
-	"\aversion\x18\x01 \x01(\x05R\aversion\x12<\n" +
-	"\x06server\x18\x02 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"@\n" +
+	"\x1bproxy/hysteria/config.proto\x12\x13xray.proxy.hysteria\x1a!common/protocol/server_spec.proto\x1a\x1acommon/protocol/user.proto\"L\n" +
+	"\fClientConfig\x12<\n" +
+	"\x06server\x18\x01 \x01(\v2$.xray.common.protocol.ServerEndpointR\x06server\"@\n" +
 	"\fServerConfig\x120\n" +
 	"\x05users\x18\x01 \x03(\v2\x1a.xray.common.protocol.UserR\x05usersB[\n" +
 	"\x17com.xray.proxy.hysteriaP\x01Z(github.com/xtls/xray-core/proxy/hysteria\xaa\x02\x13Xray.Proxy.Hysteriab\x06proto3"

proxy/hysteria/config.proto

@@ -10,8 +10,7 @@ import "common/protocol/server_spec.proto";
 import "common/protocol/user.proto";
 
 message ClientConfig {
-  int32 version = 1;
-  xray.common.protocol.ServerEndpoint server = 2;
+  xray.common.protocol.ServerEndpoint server = 1;
 }
 
 message ServerConfig {

proxy/hysteria/server.go

@@ -59,12 +59,12 @@ func (s *Server) HysteriaInboundValidator() *account.Validator {
 	return s.validator
 }
 
-func (s *Server) AddUser(ctx context.Context, u *protocol.MemoryUser) error {
-	return s.validator.Add(u)
+func (s *Server) AddUser(ctx context.Context, user *protocol.MemoryUser) error {
+	return s.validator.Add(user)
 }
 
-func (s *Server) RemoveUser(ctx context.Context, e string) error {
-	return s.validator.Del(e)
+func (s *Server) RemoveUser(ctx context.Context, email string) error {
+	return s.validator.DelByEmail(email)
 }
 
 func (s *Server) GetUser(ctx context.Context, email string) *protocol.MemoryUser {
@@ -91,9 +91,12 @@ func (s *Server) Process(ctx context.Context, network net.Network, conn stat.Con
 
 	iConn := stat.TryUnwrapStatsConn(conn)
 
-	type User interface{ User() *protocol.MemoryUser }
-	if v, ok := iConn.(User); ok && v.User() != nil {
-		inbound.User = v.User()
+	if v, ok := iConn.(interface{ User() *protocol.MemoryUser }); ok {
+		user := v.User()
+		if user != nil {
+			inbound.User = user
+			inbound.VlessRoute = user.Account.(*account.MemoryAccount).VR
+		}
 	}
 
 	if _, ok := iConn.(*hysteria.InterConn); ok {

proxy/loopback/config.pb.go

@@ -7,6 +7,7 @@
 package loopback
 
 import (
+	proxyman "github.com/xtls/xray-core/app/proxyman"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -22,8 +23,9 @@ const (
 )
 
 type Config struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	InboundTag    string                 `protobuf:"bytes,1,opt,name=inbound_tag,json=inboundTag,proto3" json:"inbound_tag,omitempty"`
+	state         protoimpl.MessageState   `protogen:"open.v1"`
+	InboundTag    string                   `protobuf:"bytes,1,opt,name=inbound_tag,json=inboundTag,proto3" json:"inbound_tag,omitempty"`
+	Sniffing      *proxyman.SniffingConfig `protobuf:"bytes,2,opt,name=sniffing,proto3" json:"sniffing,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -65,14 +67,22 @@ func (x *Config) GetInboundTag() string {
 	return ""
 }
 
+func (x *Config) GetSniffing() *proxyman.SniffingConfig {
+	if x != nil {
+		return x.Sniffing
+	}
+	return nil
+}
+
 var File_proxy_loopback_config_proto protoreflect.FileDescriptor
 
 const file_proxy_loopback_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1bproxy/loopback/config.proto\x12\x13xray.proxy.loopback\")\n" +
+	"\x1bproxy/loopback/config.proto\x12\x13xray.proxy.loopback\x1a\x19app/proxyman/config.proto\"h\n" +
 	"\x06Config\x12\x1f\n" +
 	"\vinbound_tag\x18\x01 \x01(\tR\n" +
-	"inboundTagB[\n" +
+	"inboundTag\x12=\n" +
+	"\bsniffing\x18\x02 \x01(\v2!.xray.app.proxyman.SniffingConfigR\bsniffingB[\n" +
 	"\x17com.xray.proxy.loopbackP\x01Z(github.com/xtls/xray-core/proxy/loopback\xaa\x02\x13Xray.Proxy.Loopbackb\x06proto3"
 
 var (
@@ -89,14 +99,16 @@ func file_proxy_loopback_config_proto_rawDescGZIP() []byte {
 
 var file_proxy_loopback_config_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_proxy_loopback_config_proto_goTypes = []any{
-	(*Config)(nil), // 0: xray.proxy.loopback.Config
+	(*Config)(nil),                  // 0: xray.proxy.loopback.Config
+	(*proxyman.SniffingConfig)(nil), // 1: xray.app.proxyman.SniffingConfig
 }
 var file_proxy_loopback_config_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	1, // 0: xray.proxy.loopback.Config.sniffing:type_name -> xray.app.proxyman.SniffingConfig
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
 }
 
 func init() { file_proxy_loopback_config_proto_init() }

proxy/loopback/config.proto

@@ -6,6 +6,9 @@ option go_package = "github.com/xtls/xray-core/proxy/loopback";
 option java_package = "com.xray.proxy.loopback";
 option java_multiple_files = true;
 
+import "app/proxyman/config.proto";
+
 message Config {
   string inbound_tag = 1;
+  xray.app.proxyman.SniffingConfig sniffing = 2;
 }

proxy/loopback/loopback.go

@@ -3,6 +3,7 @@ package loopback
 import (
 	"context"
 
+	proxyman "github.com/xtls/xray-core/app/proxyman"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/session"
@@ -13,7 +14,8 @@ import (
 )
 
 type Loopback struct {
-	config             *Config
+	inboundTag         string
+	sniffingRequest    session.SniffingRequest
 	dispatcherInstance routing.Dispatcher
 }
 
@@ -29,6 +31,7 @@ func (l *Loopback) Process(ctx context.Context, link *transport.Link, _ internet
 	errors.LogInfo(ctx, "opening connection to ", destination)
 	content := new(session.Content)
 	content.SkipDNSResolve = true
+	content.SniffingRequest = l.sniffingRequest
 
 	ctx = session.ContextWithContent(ctx, content)
 	inbound := &session.Inbound{}
@@ -37,20 +40,26 @@ func (l *Loopback) Process(ctx context.Context, link *transport.Link, _ internet
 		// get a shallow copy to avoid modifying the inbound tag in upstream context
 		*inbound = *originInbound
 	}
-	inbound.Tag = l.config.InboundTag
+	inbound.Tag = l.inboundTag
 	ctx = session.ContextWithInbound(ctx, inbound)
 
 	err := l.dispatcherInstance.DispatchLink(ctx, destination, link)
 	if err != nil {
-		errors.New(ctx, "failed to process loopback connection").Base(err)
-		return err
+		return errors.New(ctx, "failed to process loopback connection").Base(err)
 	}
 	return nil
 }
 
 func (l *Loopback) init(config *Config, dispatcherInstance routing.Dispatcher) error {
 	l.dispatcherInstance = dispatcherInstance
-	l.config = config
+	l.inboundTag = config.InboundTag
+	if config.Sniffing.GetEnabled() {
+		request, err := proxyman.BuildSniffingRequest(config.Sniffing)
+		if err != nil {
+			return errors.New("failed to build loopback sniffing request").Base(err).AtError()
+		}
+		l.sniffingRequest = request
+	}
 	return nil
 }
 

proxy/tun/README.md

@@ -14,11 +14,11 @@ Plainly enabling it in the config probably will result nothing, or lock your rou
 
 ## DETAILS
 
-Current implementation does not contain options to configure network level addresses, routing or rules.
-Enabling the feature will result only tun interface up, and that's it. \
-This is explicit decision, significantly simplifying implementation, and allowing any number of custom configurations, consumers could come up with. Network interface is OS level entity, and OS is what should manage it. \
-Working configuration, is tun enabled in Xray config with specific name (e.g. xray0), and OS level configuration to manage "xray0" interface, applying routing and rules on interface up.
-This way consistency of system level routing and rules is ensured from single place of responsibility - the OS itself. \
+By default, enabling the feature will only bring the tun interface up. \
+When configured explicitly, Windows and Linux can also apply interface addresses from `gateway` and on-link routes from `autoSystemRoutingTable`.
+Linux does not configure system DNS from the `dns` field; system DNS remains managed by the OS or distribution-specific network services. \
+For more advanced routing policies or rules, OS level configuration can still manage the named interface (e.g. xray0) when it appears.
+This keeps complex system level routing and rules in a single place of responsibility - the OS itself. \
 Examples of how to achieve this on a simple Linux system (Ubuntu with systemd-networkd) can be found at the end of this README.
 
 Due to this inbound not actually being a proxy, the configuration ignore required listen and port options, and never listen on any port. \

proxy/tun/config.go

@@ -3,8 +3,6 @@ package tun
 import (
 	"context"
 	"net"
-	"sort"
-	"strings"
 	"sync"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -31,95 +29,23 @@ func (updater *InterfaceUpdater) Update() {
 	updater.Lock()
 	defer updater.Unlock()
 
-	if updater.iface != nil {
-		iface, err := net.InterfaceByIndex(updater.iface.Index)
-		if err == nil && iface.Name == updater.iface.Name {
-			return
-		}
-	}
-
-	updater.iface = nil
-
-	interfaces, err := net.Interfaces()
+	got, err := findOutboundInterface(updater.tunIndex, updater.fixedName)
 	if err != nil {
 		errors.LogInfoInner(context.Background(), err, "[tun] failed to update interface")
+		updater.iface = nil
 		return
 	}
 
-	var got *net.Interface
-	if updater.fixedName != "" {
-		for _, iface := range interfaces {
-			if iface.Index == updater.tunIndex {
-				continue
-			}
-			if iface.Name == updater.fixedName {
-				got = &iface
-				break
-			}
-		}
-	} else {
-		var ifs []struct {
-			index int
-			score int
-		}
-		for i, iface := range interfaces {
-			if iface.Index == updater.tunIndex {
-				continue
-			}
-			if strings.Contains(iface.Name, "vEthernet") {
-				continue
-			}
-			if iface.Flags&net.FlagUp == 0 {
-				continue
-			}
-			if iface.Flags&net.FlagLoopback != 0 {
-				continue
-			}
-			addrs, err := iface.Addrs()
-			if err != nil || len(addrs) == 0 {
-				continue
-			}
-			ifs = append(ifs, struct {
-				index int
-				score int
-			}{i, score(&iface, addrs)})
-		}
-		sort.Slice(ifs, func(i, j int) bool {
-			if ifs[i].score != ifs[j].score {
-				return ifs[i].score > ifs[j].score
-			}
-
-			return interfaces[ifs[i].index].Name < interfaces[ifs[j].index].Name
-		})
-		if len(ifs) > 0 {
-			iface := interfaces[ifs[0].index]
-			got = &iface
-		}
-	}
-
 	if got == nil {
 		errors.LogInfo(context.Background(), "[tun] failed to update interface > got == nil")
+		updater.iface = nil
+		return
+	}
+
+	if updater.iface != nil && updater.iface.Index == got.Index && updater.iface.Name == got.Name {
 		return
 	}
 
 	updater.iface = got
 	errors.LogInfo(context.Background(), "[tun] update interface ", got.Name, " ", got.Index)
 }
-
-func score(iface *net.Interface, addrs []net.Addr) int {
-	score := 0
-
-	name := strings.ToLower(iface.Name)
-	if strings.Contains(name, "wlan") || strings.Contains(name, "wi-fi") {
-		score += 2
-	}
-
-	for _, addr := range addrs {
-		if strings.HasPrefix(addr.String(), "192.168.") {
-			score += 1
-			break
-		}
-	}
-
-	return score
-}

proxy/tun/handler.go

@@ -17,6 +17,7 @@ import (
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
 	"github.com/xtls/xray-core/features/routing"
+	"github.com/xtls/xray-core/features/stats"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
@@ -32,6 +33,8 @@ type Handler struct {
 	dispatcher      routing.Dispatcher
 	tag             string
 	sniffingRequest session.SniffingRequest
+	uplinkCounter   stats.Counter
+	downlinkCounter stats.Counter
 }
 
 // ConnectionHandler interface with the only method that stack is going to push new connections to
@@ -59,6 +62,23 @@ func (t *Handler) Init(ctx context.Context, pm policy.Manager, dispatcher routin
 	t.policyManager = pm
 	t.dispatcher = dispatcher
 
+	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundUplink {
+		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
+		name := "inbound>>>" + t.tag + ">>>traffic>>>uplink"
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		if c != nil {
+			t.uplinkCounter = c
+		}
+	}
+	if len(t.tag) > 0 && pm.ForSystem().Stats.InboundDownlink {
+		statsManager := core.MustFromContext(ctx).GetFeature(stats.ManagerType()).(stats.Manager)
+		name := "inbound>>>" + t.tag + ">>>traffic>>>downlink"
+		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		if c != nil {
+			t.downlinkCounter = c
+		}
+	}
+
 	return nil
 }
 
@@ -143,7 +163,22 @@ func (t *Handler) HandleConnection(conn net.Conn, destination net.Destination) {
 	defer cancel()
 	ctx = c.ContextWithID(ctx, session.NewID())
 
-	source := net.DestinationFromAddr(conn.RemoteAddr())
+	// if the connection is already closed, conn.RemoteAddr() will be nil
+	// due to gvisor weird behavior
+	remote := conn.RemoteAddr()
+	if remote == nil {
+		errors.LogInfo(t.ctx, "dropped quickly closed connection")
+		return
+	}
+	source := net.DestinationFromAddr(remote)
+	if t.uplinkCounter != nil || t.downlinkCounter != nil {
+		conn = &stat.CounterConnection{
+			Connection:   conn,
+			ReadCounter:  t.uplinkCounter,
+			WriteCounter: t.downlinkCounter,
+		}
+	}
+
 	inbound := session.Inbound{
 		Name:          "tun",
 		Tag:           t.tag,

proxy/tun/handler_test.go

@@ -0,0 +1,133 @@
+package tun
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/xtls/xray-core/common/buf"
+	xnet "github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/features/routing"
+	"github.com/xtls/xray-core/transport"
+)
+
+type testCounter struct {
+	value int64
+}
+
+func (c *testCounter) Value() int64 {
+	return atomic.LoadInt64(&c.value)
+}
+
+func (c *testCounter) Set(value int64) int64 {
+	return atomic.SwapInt64(&c.value, value)
+}
+
+func (c *testCounter) Add(value int64) int64 {
+	return atomic.AddInt64(&c.value, value) - value
+}
+
+type testConn struct {
+	reader *bytes.Reader
+	writer bytes.Buffer
+}
+
+func newTestConn(input []byte) *testConn {
+	return &testConn{reader: bytes.NewReader(input)}
+}
+
+func (c *testConn) Read(payload []byte) (int, error) {
+	return c.reader.Read(payload)
+}
+
+func (c *testConn) Write(payload []byte) (int, error) {
+	return c.writer.Write(payload)
+}
+
+func (c *testConn) Close() error {
+	return nil
+}
+
+func (c *testConn) LocalAddr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(10, 0, 0, 1), Port: 1080}
+}
+
+func (c *testConn) RemoteAddr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(10, 0, 0, 2), Port: 12345}
+}
+
+func (c *testConn) SetDeadline(time.Time) error {
+	return nil
+}
+
+func (c *testConn) SetReadDeadline(time.Time) error {
+	return nil
+}
+
+func (c *testConn) SetWriteDeadline(time.Time) error {
+	return nil
+}
+
+type testDispatcher struct {
+	writePayload []byte
+	readBytes    int32
+}
+
+func (d *testDispatcher) Type() interface{} {
+	return routing.DispatcherType()
+}
+
+func (d *testDispatcher) Start() error {
+	return nil
+}
+
+func (d *testDispatcher) Close() error {
+	return nil
+}
+
+func (d *testDispatcher) Dispatch(context.Context, xnet.Destination) (*transport.Link, error) {
+	return nil, nil
+}
+
+func (d *testDispatcher) DispatchLink(ctx context.Context, dest xnet.Destination, link *transport.Link) error {
+	mb, err := link.Reader.ReadMultiBuffer()
+	if err != nil {
+		return err
+	}
+	atomic.StoreInt32(&d.readBytes, mb.Len())
+	buf.ReleaseMulti(mb)
+
+	return link.Writer.WriteMultiBuffer(buf.MultiBuffer{buf.FromBytes(d.writePayload)})
+}
+
+func TestHandlerCountsTunConnectionTraffic(t *testing.T) {
+	uplinkCounter := new(testCounter)
+	downlinkCounter := new(testCounter)
+	dispatcher := &testDispatcher{writePayload: []byte("downlink")}
+	conn := newTestConn([]byte("uplink"))
+
+	handler := &Handler{
+		ctx:             context.Background(),
+		config:          &Config{},
+		dispatcher:      dispatcher,
+		uplinkCounter:   uplinkCounter,
+		downlinkCounter: downlinkCounter,
+	}
+	handler.HandleConnection(conn, xnet.TCPDestination(xnet.LocalHostIP, 443))
+
+	if got := uplinkCounter.Value(); got != int64(len("uplink")) {
+		t.Fatalf("unexpected uplink counter: got %d, want %d", got, len("uplink"))
+	}
+	if got := downlinkCounter.Value(); got != int64(len("downlink")) {
+		t.Fatalf("unexpected downlink counter: got %d, want %d", got, len("downlink"))
+	}
+	if got := int(atomic.LoadInt32(&dispatcher.readBytes)); got != len("uplink") {
+		t.Fatalf("dispatcher read unexpected bytes: got %d, want %d", got, len("uplink"))
+	}
+	if got := conn.writer.String(); got != "downlink" {
+		t.Fatalf("connection write mismatch: got %q, want %q", got, "downlink")
+	}
+}

proxy/tun/tun_android.go

@@ -81,3 +81,17 @@ func (t *AndroidTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	if fixedName == "" {
+		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
+	}
+	iface, err := net.InterfaceByName(fixedName)
+	if err != nil {
+		return nil, err
+	}
+	if iface.Index == tunIndex {
+		return nil, errors.New("outbound interface cannot be the TUN interface")
+	}
+	return iface, nil
+}

proxy/tun/tun_darwin.go

@@ -3,16 +3,20 @@
 package tun
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net"
 	"net/netip"
 	"os"
 	"strconv"
+	"sync"
 	"unsafe"
 
 	"github.com/xtls/xray-core/common/buf"
+	xerrors "github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform"
+	"golang.org/x/net/route"
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -42,6 +46,10 @@ type DarwinTun struct {
 	options *Config
 	tunFd   int
 	ownsFd  bool // true for macOS (we created the fd), false for iOS (fd from system)
+
+	routeMonitor     *os.File
+	routeMonitorOnce sync.Once
+	systemRoutes     []netip.Prefix
 }
 
 var (
@@ -92,15 +100,53 @@ func NewTun(options *Config) (Tun, error) {
 }
 
 func (t *DarwinTun) Start() error {
+	if !t.ownsFd {
+		return nil
+	}
+
+	if err := t.setSystemRoutes(); err != nil {
+		return err
+	}
+
+	if updater != nil {
+		fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
+		if err != nil {
+			_ = t.unsetSystemRoutes()
+			return err
+		}
+		t.routeMonitor = os.NewFile(uintptr(fd), "xray-route-monitor")
+		go t.monitorRouteChanges()
+	}
 	return nil
 }
 
 func (t *DarwinTun) Close() error {
+	t.routeMonitorOnce.Do(func() {
+		if t.routeMonitor != nil {
+			_ = t.routeMonitor.Close()
+		}
+	})
+	routeErr := t.unsetSystemRoutes()
 	if t.ownsFd {
-		return t.tunFile.Close()
+		return xerrors.Combine(routeErr, t.tunFile.Close())
 	}
 	// iOS: don't close the fd, it's owned by NetworkExtension
-	return nil
+	return routeErr
+}
+
+func (t *DarwinTun) monitorRouteChanges() {
+	buffer := make([]byte, 64*1024)
+	for {
+		if _, err := t.routeMonitor.Read(buffer); err != nil {
+			if !errors.Is(err, os.ErrClosed) {
+				xerrors.LogInfoInner(context.Background(), err, "[tun] failed to monitor route changes")
+			}
+			return
+		}
+		if updater != nil {
+			updater.Update()
+		}
+	}
 }
 
 func (t *DarwinTun) Name() (string, error) {
@@ -388,3 +434,227 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 
 	return errors.Join(err1, err2)
 }
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	if fixedName != "" {
+		iface, err := net.InterfaceByName(fixedName)
+		if err != nil {
+			return nil, err
+		}
+		if iface.Index == tunIndex {
+			return nil, errors.New("outbound interface cannot be the TUN interface")
+		}
+		return iface, nil
+	}
+
+	rib, err := route.FetchRIB(unix.AF_UNSPEC, route.RIBTypeRoute, 0)
+	if err != nil {
+		return nil, err
+	}
+	messages, err := route.ParseRIB(route.RIBTypeRoute, rib)
+	if err != nil {
+		return nil, err
+	}
+
+	var ipv6Index int
+	for _, message := range messages {
+		routeMessage, ok := message.(*route.RouteMessage)
+		if !ok || routeMessage.Index == tunIndex {
+			continue
+		}
+		if routeMessage.Flags&unix.RTF_UP == 0 || routeMessage.Flags&unix.RTF_GATEWAY == 0 {
+			continue
+		}
+
+		family, ok := defaultRouteFamily(routeMessage)
+		if !ok {
+			continue
+		}
+		if family == unix.AF_INET {
+			return usableDarwinInterface(routeMessage.Index)
+		}
+		if family == unix.AF_INET6 && ipv6Index == 0 {
+			ipv6Index = routeMessage.Index
+		}
+	}
+
+	if ipv6Index != 0 {
+		return usableDarwinInterface(ipv6Index)
+	}
+	return nil, errors.New("default route not found")
+}
+
+func defaultRouteFamily(message *route.RouteMessage) (int, bool) {
+	if len(message.Addrs) <= unix.RTAX_NETMASK {
+		return 0, false
+	}
+
+	switch destination := message.Addrs[unix.RTAX_DST].(type) {
+	case *route.Inet4Addr:
+		mask, ok := message.Addrs[unix.RTAX_NETMASK].(*route.Inet4Addr)
+		if !ok || destination.IP != netip.IPv4Unspecified().As4() {
+			return 0, false
+		}
+		ones, bits := net.IPMask(mask.IP[:]).Size()
+		return unix.AF_INET, ones == 0 && bits == 32
+	case *route.Inet6Addr:
+		mask, ok := message.Addrs[unix.RTAX_NETMASK].(*route.Inet6Addr)
+		if !ok || destination.IP != netip.IPv6Unspecified().As16() {
+			return 0, false
+		}
+		ones, bits := net.IPMask(mask.IP[:]).Size()
+		return unix.AF_INET6, ones == 0 && bits == 128
+	default:
+		return 0, false
+	}
+}
+
+func usableDarwinInterface(index int) (*net.Interface, error) {
+	iface, err := net.InterfaceByIndex(index)
+	if err != nil {
+		return nil, err
+	}
+	if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
+		return nil, errors.New("default route interface is not usable")
+	}
+	return iface, nil
+}
+
+func (t *DarwinTun) setSystemRoutes() error {
+	routes, err := buildDarwinSystemRoutes(t.options.AutoSystemRoutingTable)
+	if err != nil {
+		return err
+	}
+	if len(routes) == 0 {
+		return nil
+	}
+
+	tunIndex, err := t.Index()
+	if err != nil {
+		return err
+	}
+	for _, destination := range routes {
+		if err := execDarwinRoute(unix.RTM_ADD, tunIndex, destination); err != nil {
+			_ = t.unsetSystemRoutes()
+			return xerrors.New("failed to add system route ", destination).Base(err)
+		}
+		t.systemRoutes = append(t.systemRoutes, destination)
+	}
+	return nil
+}
+
+func (t *DarwinTun) unsetSystemRoutes() error {
+	var errs []error
+	tunIndex, indexErr := t.Index()
+	if indexErr != nil && len(t.systemRoutes) > 0 {
+		errs = append(errs, indexErr)
+	}
+	for i := len(t.systemRoutes) - 1; i >= 0; i-- {
+		destination := t.systemRoutes[i]
+		if err := execDarwinRoute(unix.RTM_DELETE, tunIndex, destination); err != nil && !errors.Is(err, unix.ESRCH) {
+			errs = append(errs, xerrors.New("failed to delete system route ", destination).Base(err))
+		}
+	}
+	t.systemRoutes = nil
+	return xerrors.Combine(errs...)
+}
+
+func buildDarwinSystemRoutes(configured []string) ([]netip.Prefix, error) {
+	routes := make([]netip.Prefix, 0, len(configured))
+	seen := make(map[netip.Prefix]struct{})
+
+	appendRoute := func(prefix netip.Prefix) {
+		prefix = prefix.Masked()
+		if _, found := seen[prefix]; found {
+			return
+		}
+		seen[prefix] = struct{}{}
+		routes = append(routes, prefix)
+	}
+
+	for _, value := range configured {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return nil, xerrors.New("invalid system route ", value).Base(err)
+		}
+		prefix = prefix.Masked()
+		if prefix.Bits() == 0 {
+			for _, protected := range darwinProtectedDefaultRoutes(prefix.Addr().Is4()) {
+				appendRoute(protected)
+			}
+			continue
+		}
+		appendRoute(prefix)
+	}
+
+	return routes, nil
+}
+
+func darwinProtectedDefaultRoutes(ipv4 bool) []netip.Prefix {
+	routes := make([]netip.Prefix, 0, 8)
+	for i := 0; i < 8; i++ {
+		if ipv4 {
+			var address [4]byte
+			address[0] = 1 << i
+			routes = append(routes, netip.PrefixFrom(netip.AddrFrom4(address), 8-i))
+		} else {
+			var address [16]byte
+			address[0] = 1 << i
+			routes = append(routes, netip.PrefixFrom(netip.AddrFrom16(address), 8-i))
+		}
+	}
+	return routes
+}
+
+func execDarwinRoute(messageType int, interfaceIndex int, destination netip.Prefix) error {
+	message := route.RouteMessage{
+		Type:    messageType,
+		Version: unix.RTM_VERSION,
+		Flags:   unix.RTF_STATIC | unix.RTF_GATEWAY,
+		Seq:     1,
+	}
+	if messageType == unix.RTM_ADD {
+		message.Flags |= unix.RTF_UP
+	}
+
+	if destination.Addr().Is4() {
+		gatewayPrefix := netip.MustParsePrefix(gateway)
+		message.Addrs = []route.Addr{
+			unix.RTAX_DST:     &route.Inet4Addr{IP: destination.Addr().As4()},
+			unix.RTAX_NETMASK: &route.Inet4Addr{IP: prefixMask4(destination.Bits())},
+			unix.RTAX_GATEWAY: &route.Inet4Addr{IP: gatewayPrefix.Addr().As4()},
+		}
+	} else {
+		message.Flags &^= unix.RTF_GATEWAY
+		message.Index = interfaceIndex
+		message.Addrs = []route.Addr{
+			unix.RTAX_DST:     &route.Inet6Addr{IP: destination.Addr().As16()},
+			unix.RTAX_NETMASK: &route.Inet6Addr{IP: prefixMask6(destination.Bits())},
+			unix.RTAX_GATEWAY: &route.LinkAddr{Index: interfaceIndex},
+		}
+	}
+
+	request, err := message.Marshal()
+	if err != nil {
+		return err
+	}
+	fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
+	if err != nil {
+		return err
+	}
+	defer unix.Close(fd)
+	_, err = unix.Write(fd, request)
+	return err
+}
+
+func prefixMask4(bits int) [4]byte {
+	var mask [4]byte
+	copy(mask[:], net.CIDRMask(bits, 32))
+	return mask
+}
+
+func prefixMask6(bits int) [16]byte {
+	var mask [16]byte
+	copy(mask[:], net.CIDRMask(bits, 128))
+	return mask
+}

proxy/tun/tun_default.go

@@ -42,3 +42,17 @@ func (t *DefaultTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(string, string, uintptr, *net.Interface) error {
 	return errors.New("Tun is not supported on your platform")
 }
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	if fixedName == "" {
+		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
+	}
+	iface, err := net.InterfaceByName(fixedName)
+	if err != nil {
+		return nil, err
+	}
+	if iface.Index == tunIndex {
+		return nil, errors.New("outbound interface cannot be the TUN interface")
+	}
+	return iface, nil
+}

proxy/tun/tun_freebsd.go

@@ -147,3 +147,17 @@ func (t *FreeBSDTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return nil
 }
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	if fixedName == "" {
+		return nil, errors.New("automatic outbound interface selection is not supported on this platform")
+	}
+	iface, err := net.InterfaceByName(fixedName)
+	if err != nil {
+		return nil, err
+	}
+	if iface.Index == tunIndex {
+		return nil, errors.New("outbound interface cannot be the TUN interface")
+	}
+	return iface, nil
+}

proxy/tun/tun_linux.go

@@ -3,9 +3,15 @@
 package tun
 
 import (
+	"context"
 	"net"
+	"net/netip"
+	"strconv"
+	"sync"
 
 	"github.com/vishvananda/netlink"
+	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform"
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
@@ -18,6 +24,12 @@ type LinuxTun struct {
 	tunFd   int
 	tunLink netlink.Link
 	options *Config
+	ownsTun bool
+
+	interfaceAddresses []netlink.Addr
+	systemRoutes       []netlink.Route
+	routeMonitorStop   chan struct{}
+	routeMonitorOnce   sync.Once
 }
 
 // LinuxTun implements Tun
@@ -25,12 +37,24 @@ var _ Tun = (*LinuxTun)(nil)
 
 // NewTun builds new tun interface handler (linux specific)
 func NewTun(options *Config) (Tun, error) {
-	tunFd, err := open(options.Name)
+	tunFd, tunLink, fdProvided, err := openFromEnv(options.Name)
+	if err != nil {
+		return nil, err
+	}
+	if fdProvided {
+		return &LinuxTun{
+			tunFd:   tunFd,
+			tunLink: tunLink,
+			options: options,
+		}, nil
+	}
+
+	tunFd, err = open(options.Name)
 	if err != nil {
 		return nil, err
 	}
 
-	tunLink, err := setup(options.Name, int(options.MTU))
+	tunLink, err = setup(options.Name, int(options.MTU))
 	if err != nil {
 		_ = unix.Close(tunFd)
 		return nil, err
@@ -40,11 +64,59 @@ func NewTun(options *Config) (Tun, error) {
 		tunFd:   tunFd,
 		tunLink: tunLink,
 		options: options,
+		ownsTun: true,
 	}
 
 	return linuxTun, nil
 }
 
+func openFromEnv(expectedName string) (int, netlink.Link, bool, error) {
+	fdStr := platform.NewEnvFlag(platform.TunFdKey).GetValue(func() string { return "" })
+	if fdStr == "" {
+		return -1, nil, false, nil
+	}
+
+	fd, err := strconv.Atoi(fdStr)
+	if err != nil {
+		return -1, nil, true, errors.New("invalid ", platform.TunFdKey).Base(err)
+	}
+	if fd < 3 {
+		return -1, nil, true, errors.New("invalid ", platform.TunFdKey, ": file descriptor must be >= 3")
+	}
+
+	ifr, err := unix.NewIfreq("")
+	if err != nil {
+		return -1, nil, true, err
+	}
+	if err = unix.IoctlIfreq(fd, unix.TUNGETIFF, ifr); err != nil {
+		return -1, nil, true, err
+	}
+
+	flags := ifr.Uint16()
+	if flags&unix.IFF_TUN == 0 {
+		return -1, nil, true, errors.New("invalid ", platform.TunFdKey, ": file descriptor is not a TUN device")
+	}
+	if flags&unix.IFF_NO_PI == 0 {
+		return -1, nil, true, errors.New("invalid ", platform.TunFdKey, ": TUN device must use IFF_NO_PI")
+	}
+
+	actualName := ifr.Name()
+	if expectedName != "" && actualName != expectedName {
+		return -1, nil, true, errors.New("invalid ", platform.TunFdKey, ": TUN device name ", actualName, " does not match configured name ", expectedName)
+	}
+
+	tunLink, err := netlink.LinkByName(actualName)
+	if err != nil {
+		return -1, nil, true, err
+	}
+
+	if err = unix.SetNonblock(fd, true); err != nil {
+		return -1, nil, true, err
+	}
+
+	return fd, tunLink, true, nil
+}
+
 // open the file that implements tun interface in the OS
 func open(name string) (int, error) {
 	fd, err := unix.Open("/dev/net/tun", unix.O_RDWR, 0)
@@ -93,17 +165,47 @@ func setup(name string, MTU int) (netlink.Link, error) {
 
 // Start is called by handler to bring tun interface to life
 func (t *LinuxTun) Start() error {
-	err := netlink.LinkSetUp(t.tunLink)
-	if err != nil {
+	if !t.ownsTun {
+		return nil
+	}
+
+	if err := netlink.LinkSetUp(t.tunLink); err != nil {
 		return err
 	}
 
+	if err := t.setInterfaceAddresses(); err != nil {
+		_ = netlink.LinkSetDown(t.tunLink)
+		return err
+	}
+
+	if err := t.setSystemRoutes(); err != nil {
+		_ = t.unsetInterfaceAddresses()
+		_ = netlink.LinkSetDown(t.tunLink)
+		return err
+	}
+
+	if updater != nil {
+		t.routeMonitorStop = make(chan struct{})
+		go t.monitorRouteChanges()
+	}
+
 	return nil
 }
 
 // Close is called to shut down the tun interface
 func (t *LinuxTun) Close() error {
-	_ = netlink.LinkSetDown(t.tunLink)
+	t.routeMonitorOnce.Do(func() {
+		if t.routeMonitorStop != nil {
+			close(t.routeMonitorStop)
+		}
+	})
+
+	_ = t.unsetSystemRoutes()
+	_ = t.unsetInterfaceAddresses()
+
+	if t.ownsTun {
+		_ = netlink.LinkSetDown(t.tunLink)
+	}
 	_ = unix.Close(t.tunFd)
 
 	return nil
@@ -129,3 +231,176 @@ func (t *LinuxTun) newEndpoint() (stack.LinkEndpoint, error) {
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }
+
+func (t *LinuxTun) setInterfaceAddresses() error {
+	if len(t.options.Gateway) == 0 {
+		return nil
+	}
+	for _, address := range t.options.Gateway {
+		addr, err := netlink.ParseAddr(address)
+		if err != nil {
+			_ = t.unsetInterfaceAddresses()
+			return errors.New("invalid interface address ", address).Base(err)
+		}
+		if err := netlink.AddrAdd(t.tunLink, addr); err != nil {
+			_ = t.unsetInterfaceAddresses()
+			return errors.New("failed to add interface address ", address).Base(err)
+		}
+		t.interfaceAddresses = append(t.interfaceAddresses, *addr)
+	}
+	return nil
+}
+
+func (t *LinuxTun) unsetInterfaceAddresses() error {
+	var errs []error
+	for i := len(t.interfaceAddresses) - 1; i >= 0; i-- {
+		address := t.interfaceAddresses[i]
+		if err := netlink.AddrDel(t.tunLink, &address); err != nil {
+			errs = append(errs, errors.New("failed to delete interface address ", address.String()).Base(err))
+		}
+	}
+	t.interfaceAddresses = nil
+	return errors.Combine(errs...)
+}
+
+func (t *LinuxTun) setSystemRoutes() error {
+	if len(t.options.AutoSystemRoutingTable) == 0 {
+		return nil
+	}
+	tunIndex := t.tunLink.Attrs().Index
+	for _, cidr := range t.options.AutoSystemRoutingTable {
+		prefix, err := netip.ParsePrefix(cidr)
+		if err != nil {
+			return errors.New("invalid system route ", cidr).Base(err)
+		}
+		prefix = prefix.Masked()
+		_, ipNet, _ := net.ParseCIDR(prefix.String())
+		route := netlink.Route{
+			LinkIndex: tunIndex,
+			Dst:       ipNet,
+			Priority:  1,
+		}
+		if err := netlink.RouteAdd(&route); err != nil {
+			_ = t.unsetSystemRoutes()
+			return errors.New("failed to add system route ", cidr).Base(err)
+		}
+		t.systemRoutes = append(t.systemRoutes, route)
+	}
+	return nil
+}
+
+func (t *LinuxTun) unsetSystemRoutes() error {
+	var errs []error
+	for i := len(t.systemRoutes) - 1; i >= 0; i-- {
+		route := t.systemRoutes[i]
+		if err := netlink.RouteDel(&route); err != nil {
+			errs = append(errs, errors.New("failed to delete system route").Base(err))
+		}
+	}
+	t.systemRoutes = nil
+	return errors.Combine(errs...)
+}
+
+func (t *LinuxTun) monitorRouteChanges() {
+	routeCh := make(chan netlink.RouteUpdate)
+	if err := netlink.RouteSubscribe(routeCh, t.routeMonitorStop); err != nil {
+		errors.LogInfoInner(context.Background(), err, "[tun] failed to subscribe route changes")
+		return
+	}
+
+	linkCh := make(chan netlink.LinkUpdate)
+	if err := netlink.LinkSubscribe(linkCh, t.routeMonitorStop); err != nil {
+		errors.LogInfoInner(context.Background(), err, "[tun] failed to subscribe link changes")
+		return
+	}
+
+	for {
+		select {
+		case _, ok := <-routeCh:
+			if !ok {
+				return
+			}
+			if updater != nil {
+				updater.Update()
+			}
+		case _, ok := <-linkCh:
+			if !ok {
+				return
+			}
+			if updater != nil {
+				updater.Update()
+			}
+		case <-t.routeMonitorStop:
+			return
+		}
+	}
+}
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	if fixedName != "" {
+		iface, err := net.InterfaceByName(fixedName)
+		if err != nil {
+			return nil, err
+		}
+		if iface.Index == tunIndex {
+			return nil, errors.New("outbound interface cannot be the TUN interface")
+		}
+		return iface, nil
+	}
+
+	for _, family := range []int{
+		netlink.FAMILY_V4,
+		netlink.FAMILY_V6,
+	} {
+		iface, err := findDefaultInterface(family, tunIndex)
+		if err == nil {
+			return iface, nil
+		}
+	}
+
+	return nil, errors.New("no usable outbound interface found")
+}
+
+func findDefaultInterface(family int, tunIndex int) (*net.Interface, error) {
+	routes, err := netlink.RouteList(nil, family)
+	if err != nil {
+		return nil, err
+	}
+
+	var selected *net.Interface
+	selectedMetric := -1
+
+	for _, route := range routes {
+		if route.Dst != nil {
+			ones, _ := route.Dst.Mask.Size()
+			if ones != 0 {
+				continue
+			}
+		}
+
+		if route.LinkIndex == 0 || route.LinkIndex == tunIndex {
+			continue
+		}
+
+		iface, err := net.InterfaceByIndex(route.LinkIndex)
+		if err != nil {
+			continue
+		}
+
+		if iface.Flags&net.FlagUp == 0 ||
+			iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+
+		if selected == nil || route.Priority < selectedMetric {
+			selected = iface
+			selectedMetric = route.Priority
+		}
+	}
+
+	if selected == nil {
+		return nil, errors.New("physical default route not found")
+	}
+
+	return selected, nil
+}

proxy/tun/tun_windows.go

@@ -8,6 +8,8 @@ import (
 	go_errors "errors"
 	"net"
 	"net/netip"
+	"sort"
+	"strings"
 	"sync"
 	"unsafe"
 
@@ -307,3 +309,77 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 
 	return errors.Combine(err1, err2, err3, err4)
 }
+
+func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, error) {
+	interfaces, err := net.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+
+	if fixedName != "" {
+		for _, iface := range interfaces {
+			if iface.Index != tunIndex && iface.Name == fixedName {
+				return &iface, nil
+			}
+		}
+		return nil, nil
+	}
+
+	var candidates []struct {
+		index int
+		score int
+	}
+	for i, iface := range interfaces {
+		if iface.Index == tunIndex {
+			continue
+		}
+		if strings.Contains(iface.Name, "vEthernet") {
+			continue
+		}
+		if iface.Flags&net.FlagUp == 0 {
+			continue
+		}
+		if iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil || len(addrs) == 0 {
+			continue
+		}
+		candidates = append(candidates, struct {
+			index int
+			score int
+		}{i, scoreWindowsInterface(&iface, addrs)})
+	}
+
+	sort.Slice(candidates, func(i, j int) bool {
+		if candidates[i].score != candidates[j].score {
+			return candidates[i].score > candidates[j].score
+		}
+		return interfaces[candidates[i].index].Name < interfaces[candidates[j].index].Name
+	})
+	if len(candidates) == 0 {
+		return nil, nil
+	}
+
+	iface := interfaces[candidates[0].index]
+	return &iface, nil
+}
+
+func scoreWindowsInterface(iface *net.Interface, addrs []net.Addr) int {
+	score := 0
+
+	name := strings.ToLower(iface.Name)
+	if strings.Contains(name, "wlan") || strings.Contains(name, "wi-fi") {
+		score += 2
+	}
+
+	for _, addr := range addrs {
+		if strings.HasPrefix(addr.String(), "192.168.") {
+			score++
+			break
+		}
+	}
+
+	return score
+}

proxy/wireguard/config.go

@@ -1 +1,60 @@
 package wireguard
+
+import (
+	"encoding/hex"
+	"net/netip"
+
+	"github.com/xtls/xray-core/common/protocol"
+	"google.golang.org/protobuf/proto"
+)
+
+func (p *PeerConfig) AsAccount() (protocol.Account, error) {
+	pub, err := ParseKey(p.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	allowedIPs := make([]netip.Prefix, 0, len(p.AllowedIps))
+	for i := range p.AllowedIps {
+		p, err := netip.ParsePrefix(p.AllowedIps[i])
+		if err != nil {
+			return nil, err
+		}
+		allowedIPs = append(allowedIPs, p)
+	}
+
+	return &MemoryAccount{
+		Pub:          *pub,
+		AllowedIPs:   allowedIPs,
+		PreSharedKey: p.PreSharedKey,
+		KeepAlive:    p.KeepAlive,
+	}, nil
+}
+
+type MemoryAccount struct {
+	Pub          [32]byte
+	AllowedIPs   []netip.Prefix
+	PreSharedKey string
+	KeepAlive    string
+}
+
+func (a *MemoryAccount) Equals(other protocol.Account) bool {
+	if b, ok := other.(*MemoryAccount); ok {
+		return a.Pub == b.Pub
+	}
+	return false
+}
+
+func (a *MemoryAccount) ToProto() proto.Message {
+	allowedIPs := make([]string, 0, len(a.AllowedIPs))
+	for i := range a.AllowedIPs {
+		allowedIPs = append(allowedIPs, a.AllowedIPs[i].String())
+	}
+
+	return &PeerConfig{
+		PublicKey:    hex.EncodeToString(a.Pub[:]),
+		AllowedIps:   allowedIPs,
+		PreSharedKey: a.PreSharedKey,
+		KeepAlive:    a.KeepAlive,
+	}
+}

proxy/wireguard/config.pb.go

@@ -7,6 +7,7 @@
 package wireguard
 
 import (
+	protocol "github.com/xtls/xray-core/common/protocol"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -157,6 +158,7 @@ type DeviceConfig struct {
 	SecretKey      string                      `protobuf:"bytes,1,opt,name=secret_key,json=secretKey,proto3" json:"secret_key,omitempty"`
 	Endpoint       []string                    `protobuf:"bytes,2,rep,name=endpoint,proto3" json:"endpoint,omitempty"`
 	Peers          []*PeerConfig               `protobuf:"bytes,3,rep,name=peers,proto3" json:"peers,omitempty"`
+	Users          []*protocol.User            `protobuf:"bytes,5,rep,name=users,proto3" json:"users,omitempty"`
 	Mtu            int32                       `protobuf:"varint,4,opt,name=mtu,proto3" json:"mtu,omitempty"`
 	Reserved       []byte                      `protobuf:"bytes,6,opt,name=reserved,proto3" json:"reserved,omitempty"`
 	DomainStrategy DeviceConfig_DomainStrategy `protobuf:"varint,7,opt,name=domain_strategy,json=domainStrategy,proto3,enum=xray.proxy.wireguard.DeviceConfig_DomainStrategy" json:"domain_strategy,omitempty"`
@@ -217,6 +219,13 @@ func (x *DeviceConfig) GetPeers() []*PeerConfig {
 	return nil
 }
 
+func (x *DeviceConfig) GetUsers() []*protocol.User {
+	if x != nil {
+		return x.Users
+	}
+	return nil
+}
+
 func (x *DeviceConfig) GetMtu() int32 {
 	if x != nil {
 		return x.Mtu
@@ -256,7 +265,7 @@ var File_proxy_wireguard_config_proto protoreflect.FileDescriptor
 
 const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
-	"\x1cproxy/wireguard/config.proto\x12\x14xray.proxy.wireguard\"\xad\x01\n" +
+	"\x1cproxy/wireguard/config.proto\x12\x14xray.proxy.wireguard\x1a\x1acommon/protocol/user.proto\"\xad\x01\n" +
 	"\n" +
 	"PeerConfig\x12\x1d\n" +
 	"\n" +
@@ -266,12 +275,13 @@ const file_proxy_wireguard_config_proto_rawDesc = "" +
 	"\n" +
 	"keep_alive\x18\x04 \x01(\tR\tkeepAlive\x12\x1f\n" +
 	"\vallowed_ips\x18\x05 \x03(\tR\n" +
-	"allowedIps\"\xaa\x03\n" +
+	"allowedIps\"\xdc\x03\n" +
 	"\fDeviceConfig\x12\x1d\n" +
 	"\n" +
 	"secret_key\x18\x01 \x01(\tR\tsecretKey\x12\x1a\n" +
 	"\bendpoint\x18\x02 \x03(\tR\bendpoint\x126\n" +
-	"\x05peers\x18\x03 \x03(\v2 .xray.proxy.wireguard.PeerConfigR\x05peers\x12\x10\n" +
+	"\x05peers\x18\x03 \x03(\v2 .xray.proxy.wireguard.PeerConfigR\x05peers\x120\n" +
+	"\x05users\x18\x05 \x03(\v2\x1a.xray.common.protocol.UserR\x05users\x12\x10\n" +
 	"\x03mtu\x18\x04 \x01(\x05R\x03mtu\x12\x1a\n" +
 	"\breserved\x18\x06 \x01(\fR\breserved\x12Z\n" +
 	"\x0fdomain_strategy\x18\a \x01(\x0e21.xray.proxy.wireguard.DeviceConfig.DomainStrategyR\x0edomainStrategy\x12\x1b\n" +
@@ -305,15 +315,17 @@ var file_proxy_wireguard_config_proto_goTypes = []any{
 	(DeviceConfig_DomainStrategy)(0), // 0: xray.proxy.wireguard.DeviceConfig.DomainStrategy
 	(*PeerConfig)(nil),               // 1: xray.proxy.wireguard.PeerConfig
 	(*DeviceConfig)(nil),             // 2: xray.proxy.wireguard.DeviceConfig
+	(*protocol.User)(nil),            // 3: xray.common.protocol.User
 }
 var file_proxy_wireguard_config_proto_depIdxs = []int32{
 	1, // 0: xray.proxy.wireguard.DeviceConfig.peers:type_name -> xray.proxy.wireguard.PeerConfig
-	0, // 1: xray.proxy.wireguard.DeviceConfig.domain_strategy:type_name -> xray.proxy.wireguard.DeviceConfig.DomainStrategy
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	3, // 1: xray.proxy.wireguard.DeviceConfig.users:type_name -> xray.common.protocol.User
+	0, // 2: xray.proxy.wireguard.DeviceConfig.domain_strategy:type_name -> xray.proxy.wireguard.DeviceConfig.DomainStrategy
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_proxy_wireguard_config_proto_init() }

proxy/wireguard/config.proto

@@ -6,6 +6,8 @@ option go_package = "github.com/xtls/xray-core/proxy/wireguard";
 option java_package = "com.xray.proxy.wireguard";
 option java_multiple_files = true;
 
+import "common/protocol/user.proto";
+
 message PeerConfig {
   string public_key = 1;
   string pre_shared_key = 2;
@@ -25,6 +27,7 @@ message DeviceConfig {
   string secret_key = 1;
   repeated string endpoint = 2;
   repeated PeerConfig peers = 3;
+  repeated xray.common.protocol.User users = 5;
   int32 mtu = 4;
 
   bytes reserved = 6;

proxy/wireguard/server.go

@@ -2,16 +2,20 @@ package wireguard
 
 import (
 	"context"
+	"encoding/hex"
 	"fmt"
 	"net/netip"
+	"reflect"
 	"strings"
 	"sync"
 
+	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	c "github.com/xtls/xray-core/common/ctx"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/log"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
@@ -20,6 +24,7 @@ import (
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
+	"golang.org/x/crypto/curve25519"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
@@ -42,6 +47,9 @@ type Server struct {
 	stack *stack.Stack
 	dev   *device.Device
 	mu    sync.Mutex
+
+	pub   [32]byte
+	users *sync.Map
 }
 
 func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
@@ -72,15 +80,6 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 		}
 	}
 
-	if len(conf.Peers) == 0 {
-		return nil, errors.New("empty peers")
-	}
-	for _, peer := range conf.Peers {
-		if peer.PublicKey == "" {
-			return nil, errors.New("peer without publickey")
-		}
-	}
-
 	localAddresses := make([]netip.Addr, 0, len(conf.Endpoint))
 	for _, localaddress := range conf.Endpoint {
 		addr, err := netip.ParseAddr(localaddress)
@@ -101,6 +100,19 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 		return nil, err
 	}
 
+	pri := common.Must2(ParseKey(conf.SecretKey))
+	var pub [32]byte
+	curve25519.ScalarBaseMult(&pub, pri)
+
+	users := &sync.Map{}
+	for _, u := range conf.Users {
+		user, err := u.ToMemoryUser()
+		if err != nil {
+			return nil, err
+		}
+		users.Store(user.Account.(*MemoryAccount).Pub, user)
+	}
+
 	return &Server{
 		conf:          conf,
 		ctx:           core.ToBackgroundDetachedContext(ctx),
@@ -116,9 +128,100 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 
 		tun:   tun,
 		stack: stack,
+
+		pub:   pub,
+		users: users,
 	}, nil
 }
 
+func (s *Server) AddUser(ctx context.Context, user *protocol.MemoryUser) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.dev == nil {
+		return errors.New("too early")
+	}
+	peer := user.Account.(*MemoryAccount)
+	if peer.Pub == s.pub {
+		return errors.New("invalid public key")
+	}
+	var sb strings.Builder
+	sb.WriteString("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\n")
+	sb.WriteString("replace_allowed_ips=true\n")
+	for i := range peer.AllowedIPs {
+		sb.WriteString("allowed_ip=" + peer.AllowedIPs[i].String() + "\n")
+	}
+	if peer.PreSharedKey != "" {
+		sb.WriteString("preshared_key=" + peer.PreSharedKey + "\n")
+	}
+	if peer.KeepAlive != "" {
+		sb.WriteString("persistent_keepalive_interval=" + peer.KeepAlive + "\n")
+	}
+	err := s.dev.IpcSet(sb.String())
+	if err != nil {
+		return err
+	}
+	s.users.Store(peer.Pub, user)
+	return nil
+}
+
+func (s *Server) RemoveUser(ctx context.Context, email string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.dev == nil {
+		return errors.New("too early")
+	}
+	if user := s.GetUser(ctx, email); user != nil {
+		peer := user.Account.(*MemoryAccount)
+		err := s.dev.IpcSet("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\nremove=true\n")
+		if err != nil {
+			return err
+		}
+		s.users.Delete(peer.Pub)
+	}
+	return nil
+}
+
+func (s *Server) GetUser(ctx context.Context, email string) (user *protocol.MemoryUser) {
+	s.users.Range(func(key, value any) bool {
+		if value.(*protocol.MemoryUser).Email == email {
+			user = value.(*protocol.MemoryUser)
+			return false
+		}
+		return true
+	})
+	return
+}
+
+func (s *Server) GetUserByAddr(ctx context.Context, addr netip.Addr) (user *protocol.MemoryUser) {
+	s.users.Range(func(key, value any) bool {
+		peer := value.(*protocol.MemoryUser).Account.(*MemoryAccount)
+		for i := range peer.AllowedIPs {
+			if peer.AllowedIPs[i].Contains(addr) {
+				user = value.(*protocol.MemoryUser)
+				return false
+			}
+		}
+		return true
+	})
+	return
+}
+
+func (s *Server) GetUsers(ctx context.Context) (users []*protocol.MemoryUser) {
+	s.users.Range(func(key, value interface{}) bool {
+		users = append(users, value.(*protocol.MemoryUser))
+		return true
+	})
+	return
+}
+
+func (s *Server) GetUsersCount(context.Context) (count int64) {
+	s.users.Range(func(key, value interface{}) bool {
+		count++
+		return true
+	})
+	return
+}
+
 // Network implements proxy.Inbound.Network.
 func (*Server) Network() []net.Network {
 	return []net.Network{}
@@ -196,18 +299,20 @@ func (s *Server) Start() error {
 	dev := device.NewDevice(s.tun, bind, logger)
 	var cfg strings.Builder
 	cfg.WriteString("private_key=" + s.conf.SecretKey + "\n")
-	for _, peer := range s.conf.Peers {
-		cfg.WriteString("public_key=" + peer.PublicKey + "\n")
+	s.users.Range(func(key, value any) bool {
+		peer := value.(*protocol.MemoryUser).Account.(*MemoryAccount)
+		cfg.WriteString("public_key=" + hex.EncodeToString(peer.Pub[:]) + "\n")
+		for i := range peer.AllowedIPs {
+			cfg.WriteString("allowed_ip=" + peer.AllowedIPs[i].String() + "\n")
+		}
 		if peer.PreSharedKey != "" {
 			cfg.WriteString("preshared_key=" + peer.PreSharedKey + "\n")
 		}
-		for _, ip := range peer.AllowedIps {
-			cfg.WriteString("allowed_ip=" + ip + "\n")
-		}
 		if peer.KeepAlive != "" {
 			cfg.WriteString("persistent_keepalive_interval=" + peer.KeepAlive + "\n")
 		}
-	}
+		return true
+	})
 	err := dev.IpcSet(cfg.String())
 	if err != nil {
 		return err
@@ -227,12 +332,36 @@ func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
 	defer cancel()
 	ctx = c.ContextWithID(ctx, session.NewID())
 
-	source := net.DestinationFromAddr(conn.RemoteAddr())
+	remote := conn.RemoteAddr()
+	if remote == nil {
+		errors.LogError(context.Background(), "nil remote")
+		return
+	}
+
+	var addr netip.Addr
+	switch v := remote.(type) {
+	case *net.TCPAddr:
+		addr, _ = netip.AddrFromSlice(v.IP)
+	case *net.UDPAddr:
+		addr, _ = netip.AddrFromSlice(v.IP)
+	default:
+		errors.LogError(context.Background(), "invalid addr type ", reflect.TypeOf(v))
+		return
+	}
+
+	user := s.GetUserByAddr(context.TODO(), addr)
+	if user == nil {
+		errors.LogError(context.Background(), "nil user form ", remote, " to ", dest)
+		return
+	}
+
+	source := net.DestinationFromAddr(remote)
 	inbound := session.Inbound{
 		Name:          "wireguard",
 		Tag:           s.tag,
 		CanSpliceCopy: 3,
 		Source:        source,
+		User:          user,
 	}
 
 	ctx = session.ContextWithInbound(ctx, &inbound)
@@ -257,3 +386,14 @@ func (s *Server) HandleConnection(conn net.Conn, dest net.Destination) {
 		errors.LogError(ctx, errors.New("connection closed").Base(err))
 	}
 }
+
+func ParseKey(str string) (*[32]byte, error) {
+	slice, err := hex.DecodeString(str)
+	if err != nil {
+		return nil, err
+	}
+	if len(slice) != 32 {
+		return nil, errors.New("len(slice) != 32")
+	}
+	return (*[32]byte)(slice), nil
+}

transport/internet/finalmask/finalmask.go

@@ -3,6 +3,7 @@ package finalmask
 import (
 	"context"
 	"net"
+	"slices"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
@@ -28,7 +29,7 @@ func NewUdpmaskManager(udpmasks []Udpmask) *UdpmaskManager {
 func (m *UdpmaskManager) WrapPacketConnClient(raw net.PacketConn) (net.PacketConn, error) {
 	var sizes []int
 	var conns []net.PacketConn
-	for i, mask := range m.udpmasks {
+	for i, mask := range slices.Backward(m.udpmasks) {
 		if _, ok := mask.(headerConn); ok {
 			conn, err := mask.WrapPacketConnClient(nil, i, len(m.udpmasks)-1)
 			if err != nil {
@@ -61,7 +62,7 @@ func (m *UdpmaskManager) WrapPacketConnClient(raw net.PacketConn) (net.PacketCon
 func (m *UdpmaskManager) WrapPacketConnServer(raw net.PacketConn) (net.PacketConn, error) {
 	var sizes []int
 	var conns []net.PacketConn
-	for i, mask := range m.udpmasks {
+	for i, mask := range slices.Backward(m.udpmasks) {
 		if _, ok := mask.(headerConn); ok {
 			conn, err := mask.WrapPacketConnServer(nil, i, len(m.udpmasks)-1)
 			if err != nil {
@@ -124,7 +125,7 @@ func (c *headerManagerConn) ReadFrom(p []byte) (n int, addr net.Addr, err error)
 		if err != nil {
 			return n, addr, err
 		}
-		b = b[:n]
+		buf := b[:n]
 
 		sum := 0
 		for _, size := range c.sizes {
@@ -132,24 +133,24 @@ func (c *headerManagerConn) ReadFrom(p []byte) (n int, addr net.Addr, err error)
 		}
 
 		if n < sum {
-			errors.LogError(context.Background(), "[mask] drop packet from ", addr, " with size ", len(b))
+			errors.LogError(context.Background(), "[mask] drop packet from ", addr, " with size ", n)
 			continue
 		}
 
 		for i := range c.conns {
-			n, _, err = c.conns[i].ReadFrom(b)
+			n, _, err = c.conns[i].ReadFrom(buf)
 			if err != nil {
-				errors.LogErrorInner(context.Background(), err, "[mask] drop packet from ", addr, " with size ", len(b))
+				errors.LogErrorInner(context.Background(), err, "[mask] drop packet from ", addr, " with size ", n)
 				break
 			}
-			b = b[c.sizes[i] : n+c.sizes[i]]
+			buf = buf[c.sizes[i] : n+c.sizes[i]]
 		}
 
 		if err != nil {
 			continue
 		}
 
-		return copy(p, b), addr, nil
+		return copy(p, buf), addr, nil
 	}
 }
 
@@ -212,7 +213,7 @@ func NewTcpmaskManager(tcpmasks []Tcpmask) *TcpmaskManager {
 
 func (m *TcpmaskManager) WrapConnClient(raw net.Conn) (net.Conn, error) {
 	var err error
-	for _, mask := range m.tcpmasks {
+	for _, mask := range slices.Backward(m.tcpmasks) {
 		raw, err = mask.WrapConnClient(raw)
 		if err != nil {
 			return nil, err
@@ -223,7 +224,7 @@ func (m *TcpmaskManager) WrapConnClient(raw net.Conn) (net.Conn, error) {
 
 func (m *TcpmaskManager) WrapConnServer(raw net.Conn) (net.Conn, error) {
 	var err error
-	for _, mask := range m.tcpmasks {
+	for _, mask := range slices.Backward(m.tcpmasks) {
 		raw, err = mask.WrapConnServer(raw)
 		if err != nil {
 			return nil, err

transport/internet/finalmask/fragment/config.pb.go

@@ -25,12 +25,12 @@ type Config struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	PacketsFrom   int64                  `protobuf:"varint,1,opt,name=packets_from,json=packetsFrom,proto3" json:"packets_from,omitempty"`
 	PacketsTo     int64                  `protobuf:"varint,2,opt,name=packets_to,json=packetsTo,proto3" json:"packets_to,omitempty"`
-	LengthMin     int64                  `protobuf:"varint,3,opt,name=length_min,json=lengthMin,proto3" json:"length_min,omitempty"`
-	LengthMax     int64                  `protobuf:"varint,4,opt,name=length_max,json=lengthMax,proto3" json:"length_max,omitempty"`
-	DelayMin      int64                  `protobuf:"varint,5,opt,name=delay_min,json=delayMin,proto3" json:"delay_min,omitempty"`
-	DelayMax      int64                  `protobuf:"varint,6,opt,name=delay_max,json=delayMax,proto3" json:"delay_max,omitempty"`
 	MaxSplitMin   int64                  `protobuf:"varint,7,opt,name=max_split_min,json=maxSplitMin,proto3" json:"max_split_min,omitempty"`
 	MaxSplitMax   int64                  `protobuf:"varint,8,opt,name=max_split_max,json=maxSplitMax,proto3" json:"max_split_max,omitempty"`
+	LengthsMin    []int64                `protobuf:"varint,9,rep,packed,name=lengths_min,json=lengthsMin,proto3" json:"lengths_min,omitempty"`
+	LengthsMax    []int64                `protobuf:"varint,10,rep,packed,name=lengths_max,json=lengthsMax,proto3" json:"lengths_max,omitempty"`
+	DelaysMin     []int64                `protobuf:"varint,11,rep,packed,name=delays_min,json=delaysMin,proto3" json:"delays_min,omitempty"`
+	DelaysMax     []int64                `protobuf:"varint,12,rep,packed,name=delays_max,json=delaysMax,proto3" json:"delays_max,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -79,34 +79,6 @@ func (x *Config) GetPacketsTo() int64 {
 	return 0
 }
 
-func (x *Config) GetLengthMin() int64 {
-	if x != nil {
-		return x.LengthMin
-	}
-	return 0
-}
-
-func (x *Config) GetLengthMax() int64 {
-	if x != nil {
-		return x.LengthMax
-	}
-	return 0
-}
-
-func (x *Config) GetDelayMin() int64 {
-	if x != nil {
-		return x.DelayMin
-	}
-	return 0
-}
-
-func (x *Config) GetDelayMax() int64 {
-	if x != nil {
-		return x.DelayMax
-	}
-	return 0
-}
-
 func (x *Config) GetMaxSplitMin() int64 {
 	if x != nil {
 		return x.MaxSplitMin
@@ -121,23 +93,54 @@ func (x *Config) GetMaxSplitMax() int64 {
 	return 0
 }
 
+func (x *Config) GetLengthsMin() []int64 {
+	if x != nil {
+		return x.LengthsMin
+	}
+	return nil
+}
+
+func (x *Config) GetLengthsMax() []int64 {
+	if x != nil {
+		return x.LengthsMax
+	}
+	return nil
+}
+
+func (x *Config) GetDelaysMin() []int64 {
+	if x != nil {
+		return x.DelaysMin
+	}
+	return nil
+}
+
+func (x *Config) GetDelaysMax() []int64 {
+	if x != nil {
+		return x.DelaysMax
+	}
+	return nil
+}
+
 var File_transport_internet_finalmask_fragment_config_proto protoreflect.FileDescriptor
 
 const file_transport_internet_finalmask_fragment_config_proto_rawDesc = "" +
 	"\n" +
-	"2transport/internet/finalmask/fragment/config.proto\x12*xray.transport.internet.finalmask.fragment\"\x8a\x02\n" +
+	"2transport/internet/finalmask/fragment/config.proto\x12*xray.transport.internet.finalmask.fragment\"\x92\x02\n" +
 	"\x06Config\x12!\n" +
 	"\fpackets_from\x18\x01 \x01(\x03R\vpacketsFrom\x12\x1d\n" +
 	"\n" +
-	"packets_to\x18\x02 \x01(\x03R\tpacketsTo\x12\x1d\n" +
-	"\n" +
-	"length_min\x18\x03 \x01(\x03R\tlengthMin\x12\x1d\n" +
-	"\n" +
-	"length_max\x18\x04 \x01(\x03R\tlengthMax\x12\x1b\n" +
-	"\tdelay_min\x18\x05 \x01(\x03R\bdelayMin\x12\x1b\n" +
-	"\tdelay_max\x18\x06 \x01(\x03R\bdelayMax\x12\"\n" +
+	"packets_to\x18\x02 \x01(\x03R\tpacketsTo\x12\"\n" +
 	"\rmax_split_min\x18\a \x01(\x03R\vmaxSplitMin\x12\"\n" +
-	"\rmax_split_max\x18\b \x01(\x03R\vmaxSplitMaxB\xa0\x01\n" +
+	"\rmax_split_max\x18\b \x01(\x03R\vmaxSplitMax\x12\x1f\n" +
+	"\vlengths_min\x18\t \x03(\x03R\n" +
+	"lengthsMin\x12\x1f\n" +
+	"\vlengths_max\x18\n" +
+	" \x03(\x03R\n" +
+	"lengthsMax\x12\x1d\n" +
+	"\n" +
+	"delays_min\x18\v \x03(\x03R\tdelaysMin\x12\x1d\n" +
+	"\n" +
+	"delays_max\x18\f \x03(\x03R\tdelaysMaxB\xa0\x01\n" +
 	".com.xray.transport.internet.finalmask.fragmentP\x01Z?github.com/xtls/xray-core/transport/internet/finalmask/fragment\xaa\x02*Xray.Transport.Internet.Finalmask.Fragmentb\x06proto3"
 
 var (

transport/internet/finalmask/fragment/config.proto

@@ -9,10 +9,10 @@ option java_multiple_files = true;
 message Config {
   int64 packets_from = 1;
   int64 packets_to = 2;
-  int64 length_min = 3;
-  int64 length_max = 4;
-  int64 delay_min = 5;
-  int64 delay_max = 6;
   int64 max_split_min = 7;
   int64 max_split_max = 8;
+  repeated int64 lengths_min = 9;
+  repeated int64 lengths_max = 10;
+  repeated int64 delays_min = 11;
+  repeated int64 delays_max = 12;
 }

transport/internet/finalmask/fragment/conn.go

@@ -43,6 +43,29 @@ func (c *fragmentConn) Splice() bool {
 	return true
 }
 
+// lengthForSegment returns the length range (min, max) for the given segment index (0-based).
+// Clamps to the last entry when the index exceeds the list length.
+func (c *fragmentConn) lengthForSegment(segIdx int) (int64, int64) {
+	if segIdx >= len(c.config.LengthsMin) {
+		segIdx = len(c.config.LengthsMin) - 1
+	}
+	return c.config.LengthsMin[segIdx], c.config.LengthsMax[segIdx]
+}
+
+// delayForSegment returns the delay range (min, max) for the given segment index (0-based).
+// Clamps to the last entry when the index exceeds the list length.
+func (c *fragmentConn) delayForSegment(segIdx int) (int64, int64) {
+	if segIdx >= len(c.config.DelaysMin) {
+		segIdx = len(c.config.DelaysMin) - 1
+	}
+	return c.config.DelaysMin[segIdx], c.config.DelaysMax[segIdx]
+}
+
+// mergeTlsHelloSegments returns true only when delays has exactly one zero entry.
+func (c *fragmentConn) mergeTlsHelloSegments() bool {
+	return len(c.config.DelaysMax) == 1 && c.config.DelaysMax[0] == 0
+}
+
 func (c *fragmentConn) Write(p []byte) (n int, err error) {
 	c.count++
 
@@ -57,12 +80,13 @@ func (c *fragmentConn) Write(p []byte) (n int, err error) {
 		data := p[5:recordLen]
 		buff := make([]byte, 2048)
 		var hello []byte
+		mergeHello := c.mergeTlsHelloSegments()
 		maxSplit := crypto.RandBetween(c.config.MaxSplitMin, c.config.MaxSplitMax)
 		var splitNum int64
 		for from := 0; ; {
-			to := from + int(crypto.RandBetween(c.config.LengthMin, c.config.LengthMax))
-			splitNum++
-			if to > len(data) || (maxSplit > 0 && splitNum >= maxSplit) {
+			lengthMin, lengthMax := c.lengthForSegment(int(splitNum))
+			to := from + int(crypto.RandBetween(lengthMin, lengthMax))
+			if to > len(data) || (maxSplit > 0 && splitNum+1 >= maxSplit) {
 				to = len(data)
 			}
 			l := to - from
@@ -74,15 +98,19 @@ func (c *fragmentConn) Write(p []byte) (n int, err error) {
 			from = to
 			buff[3] = byte(l >> 8)
 			buff[4] = byte(l)
-			if c.config.DelayMax == 0 {
+			if mergeHello {
 				hello = append(hello, buff[:5+l]...)
 			} else {
+				delayMin, delayMax := c.delayForSegment(int(splitNum))
 				_, err := c.Conn.Write(buff[:5+l])
-				time.Sleep(time.Duration(crypto.RandBetween(c.config.DelayMin, c.config.DelayMax)) * time.Millisecond)
+				if delayMax > 0 {
+					time.Sleep(time.Duration(crypto.RandBetween(delayMin, delayMax)) * time.Millisecond)
+				}
 				if err != nil {
 					return 0, err
 				}
 			}
+			splitNum++
 			if from == len(data) {
 				if len(hello) > 0 {
 					_, err := c.Conn.Write(hello)
@@ -107,9 +135,9 @@ func (c *fragmentConn) Write(p []byte) (n int, err error) {
 	maxSplit := crypto.RandBetween(c.config.MaxSplitMin, c.config.MaxSplitMax)
 	var splitNum int64
 	for from := 0; ; {
-		to := from + int(crypto.RandBetween(c.config.LengthMin, c.config.LengthMax))
-		splitNum++
-		if to > len(p) || (maxSplit > 0 && splitNum >= maxSplit) {
+		lengthMin, lengthMax := c.lengthForSegment(int(splitNum))
+		to := from + int(crypto.RandBetween(lengthMin, lengthMax))
+		if to > len(p) || (maxSplit > 0 && splitNum+1 >= maxSplit) {
 			to = len(p)
 		}
 		n, err := c.Conn.Write(p[from:to])
@@ -117,7 +145,11 @@ func (c *fragmentConn) Write(p []byte) (n int, err error) {
 		if err != nil {
 			return from, err
 		}
-		time.Sleep(time.Duration(crypto.RandBetween(c.config.DelayMin, c.config.DelayMax)) * time.Millisecond)
+		delayMin, delayMax := c.delayForSegment(int(splitNum))
+		if delayMax > 0 {
+			time.Sleep(time.Duration(crypto.RandBetween(delayMin, delayMax)) * time.Millisecond)
+		}
+		splitNum++
 		if from >= len(p) {
 			return from, nil
 		}

transport/internet/finalmask/sudoku/sudoku_test.go

@@ -372,7 +372,6 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 							{
 								ProtocolName: "hysteria",
 								Settings: serial.ToTypedMessage(&hytransport.Config{
-									Version:        2,
 									Auth:           auth,
 									UdpIdleTimeout: 60,
 								}),
@@ -421,7 +420,6 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 		Outbound: []*core.OutboundHandlerConfig{
 			{
 				ProxySettings: serial.ToTypedMessage(&hyproxy.ClientConfig{
-					Version: 2,
 					Server: &protocol.ServerEndpoint{
 						Address: xnet.NewIPOrDomain(xnet.LocalHostIP),
 						Port:    uint32(relayPort),
@@ -437,7 +435,6 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in
 							{
 								ProtocolName: "hysteria",
 								Settings: serial.ToTypedMessage(&hytransport.Config{
-									Version:        2,
 									Auth:           auth,
 									UdpIdleTimeout: 60,
 								}),

transport/internet/grpc/dial.go

@@ -62,7 +62,7 @@ func dialgRPC(ctx context.Context, dest net.Destination, streamSettings *interne
 		if err != nil {
 			return nil, errors.New("Cannot dial gRPC").Base(err)
 		}
-		return encoding.NewMultiHunkConn(grpcService, nil), nil
+		return encoding.NewMultiHunkConn(grpcService, nil, nil), nil
 	}
 
 	errors.LogDebug(ctx, "using gRPC tun mode service name: `"+grpcSettings.getServiceName()+"` stream name: `"+grpcSettings.getTunStreamName()+"`")
@@ -71,7 +71,7 @@ func dialgRPC(ctx context.Context, dest net.Destination, streamSettings *interne
 		return nil, errors.New("Cannot dial gRPC").Base(err)
 	}
 
-	return encoding.NewHunkConn(grpcService, nil), nil
+	return encoding.NewHunkConn(grpcService, nil, nil), nil
 }
 
 func getGrpcClient(ctx context.Context, dest net.Destination, streamSettings *internet.MemoryStreamConfig) (*grpc.ClientConn, error) {

transport/internet/grpc/encoding/hunkconn.go

@@ -9,8 +9,6 @@ import (
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/common/signal/done"
-	"google.golang.org/grpc/metadata"
-	"google.golang.org/grpc/peer"
 )
 
 type HunkConn interface {
@@ -38,31 +36,8 @@ func NewHunkReadWriter(hc HunkConn, cancel context.CancelFunc) *HunkReaderWriter
 	return &HunkReaderWriter{hc, cancel, done.New(), nil, 0}
 }
 
-func NewHunkConn(hc HunkConn, cancel context.CancelFunc) net.Conn {
-	var rAddr net.Addr
-	pr, ok := peer.FromContext(hc.Context())
-	if ok {
-		rAddr = pr.Addr
-	} else {
-		rAddr = &net.TCPAddr{
-			IP:   []byte{0, 0, 0, 0},
-			Port: 0,
-		}
-	}
-
-	md, ok := metadata.FromIncomingContext(hc.Context())
-	if ok {
-		header := md.Get("x-real-ip")
-		if len(header) > 0 {
-			realip := net.ParseAddress(header[0])
-			if realip.Family().IsIP() {
-				rAddr = &net.TCPAddr{
-					IP:   realip.IP(),
-					Port: 0,
-				}
-			}
-		}
-	}
+func NewHunkConn(hc HunkConn, cancel context.CancelFunc, trustedXForwardedFor []string) net.Conn {
+	rAddr := remoteAddrFromContext(hc.Context(), trustedXForwardedFor)
 	wrc := NewHunkReadWriter(hc, cancel)
 	return cnc.NewConnection(
 		cnc.ConnectionInput(wrc),

transport/internet/grpc/encoding/multiconn.go

@@ -3,15 +3,12 @@ package encoding
 import (
 	"context"
 	"io"
-	"net"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
-	xnet "github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/common/signal/done"
-	"google.golang.org/grpc/metadata"
-	"google.golang.org/grpc/peer"
 )
 
 type MultiHunkConn interface {
@@ -34,31 +31,8 @@ func NewMultiHunkReadWriter(hc MultiHunkConn, cancel context.CancelFunc) *MultiH
 	return &MultiHunkReaderWriter{hc, cancel, done.New(), nil}
 }
 
-func NewMultiHunkConn(hc MultiHunkConn, cancel context.CancelFunc) net.Conn {
-	var rAddr net.Addr
-	pr, ok := peer.FromContext(hc.Context())
-	if ok {
-		rAddr = pr.Addr
-	} else {
-		rAddr = &net.TCPAddr{
-			IP:   []byte{0, 0, 0, 0},
-			Port: 0,
-		}
-	}
-
-	md, ok := metadata.FromIncomingContext(hc.Context())
-	if ok {
-		header := md.Get("x-real-ip")
-		if len(header) > 0 {
-			realip := xnet.ParseAddress(header[0])
-			if realip.Family().IsIP() {
-				rAddr = &net.TCPAddr{
-					IP:   realip.IP(),
-					Port: 0,
-				}
-			}
-		}
-	}
+func NewMultiHunkConn(hc MultiHunkConn, cancel context.CancelFunc, trustedXForwardedFor []string) net.Conn {
+	rAddr := remoteAddrFromContext(hc.Context(), trustedXForwardedFor)
 	wrc := NewMultiHunkReadWriter(hc, cancel)
 	return cnc.NewConnection(
 		cnc.ConnectionInputMulti(wrc),

transport/internet/grpc/encoding/remoteaddr.go

@@ -0,0 +1,58 @@
+package encoding
+
+import (
+	"context"
+	"strings"
+
+	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/net"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+)
+
+func remoteAddrFromContext(ctx context.Context, trusted []string) net.Addr {
+	var remoteAddr net.Addr
+	if pr, ok := peer.FromContext(ctx); ok {
+		remoteAddr = pr.Addr
+	} else {
+		remoteAddr = &net.TCPAddr{
+			IP:   []byte{0, 0, 0, 0},
+			Port: 0,
+		}
+	}
+
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return remoteAddr
+	}
+
+	if forwardedAddr := parseTrustedXForwardedFor(md, trusted, remoteAddr); forwardedAddr != nil && forwardedAddr.Family().IsIP() {
+		remoteAddr = &net.TCPAddr{
+			IP:   forwardedAddr.IP(),
+			Port: 0,
+		}
+	}
+	return remoteAddr
+}
+
+func parseTrustedXForwardedFor(md metadata.MD, trusted []string, remoteAddr net.Addr) net.Address {
+	values := md.Get("X-Forwarded-For")
+	if len(values) == 0 || values[0] == "" {
+		return nil
+	}
+	value := values[0]
+	for _, t := range trusted {
+		if len(md.Get(t)) > 0 {
+			if idx := strings.IndexByte(value, ','); idx >= 0 {
+				value = value[:idx]
+			}
+			return net.ParseAddress(value)
+		}
+	}
+	if len(trusted) == 0 {
+		errors.LogWarning(context.Background(), `received "X-Forwarded-For" from `, remoteAddr, ` but "sockopt.trustedXForwardedFor" is not configured; ignoring it and using the real remote address`)
+	} else {
+		errors.LogError(context.Background(), `ignored potentially forged "X-Forwarded-For" from `, remoteAddr, `: `, value)
+	}
+	return nil
+}

transport/internet/grpc/encoding/remoteaddr_test.go

@@ -0,0 +1,53 @@
+package encoding
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+)
+
+func TestRemoteAddrFromContext(t *testing.T) {
+	tests := []struct {
+		name                  string
+		metadata              metadata.MD
+		trustedXForwardedFor  []string
+		expectedRemoteAddress string
+	}{
+		{
+			name:                  "trust X-Forwarded-For when configured",
+			metadata:              metadata.Pairs("X-Forwarded-For", "2.2.2.2, 3.3.3.3"),
+			trustedXForwardedFor:  []string{"X-Forwarded-For"},
+			expectedRemoteAddress: "2.2.2.2:0",
+		},
+		{
+			name:                  "trust X-Forwarded-For with trusted marker",
+			metadata:              metadata.Pairs("X-Forwarded-For", "4.4.4.4", "X-Trusted-CDN", "1"),
+			trustedXForwardedFor:  []string{"X-Trusted-CDN"},
+			expectedRemoteAddress: "4.4.4.4:0",
+		},
+		{
+			name:                  "ignore X-Forwarded-For without trusted marker",
+			metadata:              metadata.Pairs("X-Forwarded-For", "5.5.5.5"),
+			trustedXForwardedFor:  []string{"X-Trusted-CDN"},
+			expectedRemoteAddress: "127.0.0.1:12345",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := peer.NewContext(metadata.NewIncomingContext(context.Background(), test.metadata), &peer.Peer{
+				Addr: &net.TCPAddr{
+					IP:   net.ParseIP("127.0.0.1"),
+					Port: 12345,
+				},
+			})
+			remoteAddr := remoteAddrFromContext(ctx, test.trustedXForwardedFor)
+			if remoteAddr.String() != test.expectedRemoteAddress {
+				t.Fatalf("unexpected remote address: %s", remoteAddr.String())
+			}
+		})
+	}
+}

transport/internet/grpc/hub.go

@@ -19,24 +19,25 @@ import (
 
 type Listener struct {
 	encoding.UnimplementedGRPCServiceServer
-	ctx     context.Context
-	handler internet.ConnHandler
-	local   net.Addr
-	config  *Config
+	ctx                  context.Context
+	handler              internet.ConnHandler
+	local                net.Addr
+	config               *Config
+	trustedXForwardedFor []string
 
 	s *grpc.Server
 }
 
 func (l Listener) Tun(server encoding.GRPCService_TunServer) error {
 	tunCtx, cancel := context.WithCancel(l.ctx)
-	l.handler(encoding.NewHunkConn(server, cancel))
+	l.handler(encoding.NewHunkConn(server, cancel, l.trustedXForwardedFor))
 	<-tunCtx.Done()
 	return nil
 }
 
 func (l Listener) TunMulti(server encoding.GRPCService_TunMultiServer) error {
 	tunCtx, cancel := context.WithCancel(l.ctx)
-	l.handler(encoding.NewMultiHunkConn(server, cancel))
+	l.handler(encoding.NewMultiHunkConn(server, cancel, l.trustedXForwardedFor))
 	<-tunCtx.Done()
 	return nil
 }
@@ -74,6 +75,9 @@ func Listen(ctx context.Context, address net.Address, port net.Port, settings *i
 	}
 
 	listener.ctx = ctx
+	if settings.SocketSettings != nil {
+		listener.trustedXForwardedFor = settings.SocketSettings.TrustedXForwardedFor
+	}
 
 	config := tls.ConfigFromStreamSettings(settings)
 

transport/internet/httpupgrade/httpupgrade_test.go

@@ -138,6 +138,9 @@ func TestDialWithRemoteAddr(t *testing.T) {
 		ProtocolSettings: &Config{
 			Path: "httpupgrade",
 		},
+		SocketSettings: &internet.SocketConfig{
+			TrustedXForwardedFor: []string{"X-Forwarded-For"},
+		},
 	}, func(conn stat.Connection) {
 		go func(c stat.Connection) {
 			defer c.Close()

transport/internet/httpupgrade/hub.go

@@ -80,24 +80,12 @@ func (s *server) upgrade(conn net.Conn) (stat.Connection, error) {
 		return nil, err
 	}
 
-	var forwardedAddrs []net.Address
-	if s.socketSettings != nil && len(s.socketSettings.TrustedXForwardedFor) > 0 {
-		for _, key := range s.socketSettings.TrustedXForwardedFor {
-			if len(req.Header.Values(key)) > 0 {
-				forwardedAddrs = http_proto.ParseXForwardedFor(req.Header)
-				break
-			}
-		}
-	} else {
-		forwardedAddrs = http_proto.ParseXForwardedFor(req.Header)
-	}
 	remoteAddr := conn.RemoteAddr()
-	if len(forwardedAddrs) > 0 && forwardedAddrs[0].Family().IsIP() {
-		remoteAddr = &net.TCPAddr{
-			IP:   forwardedAddrs[0].IP(),
-			Port: int(0),
-		}
+	var trustedXFF []string
+	if s.socketSettings != nil {
+		trustedXFF = s.socketSettings.TrustedXForwardedFor
 	}
+	remoteAddr = http_proto.ApplyTrustedXForwardedFor(req.Header, trustedXFF, remoteAddr)
 
 	return stat.Connection(newConnection(conn, remoteAddr)), nil
 }

transport/internet/hysteria/config.pb.go

@@ -23,7 +23,6 @@ const (
 
 type Config struct {
 	state                protoimpl.MessageState `protogen:"open.v1"`
-	Version              int32                  `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
 	Auth                 string                 `protobuf:"bytes,2,opt,name=auth,proto3" json:"auth,omitempty"`
 	UdpIdleTimeout       int64                  `protobuf:"varint,3,opt,name=udp_idle_timeout,json=udpIdleTimeout,proto3" json:"udp_idle_timeout,omitempty"`
 	MasqType             string                 `protobuf:"bytes,4,opt,name=masq_type,json=masqType,proto3" json:"masq_type,omitempty"`
@@ -68,13 +67,6 @@ func (*Config) Descriptor() ([]byte, []int) {
 	return file_transport_internet_hysteria_config_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *Config) GetVersion() int32 {
-	if x != nil {
-		return x.Version
-	}
-	return 0
-}
-
 func (x *Config) GetAuth() string {
 	if x != nil {
 		return x.Auth
@@ -149,9 +141,8 @@ var File_transport_internet_hysteria_config_proto protoreflect.FileDescriptor
 
 const file_transport_internet_hysteria_config_proto_rawDesc = "" +
 	"\n" +
-	"(transport/internet/hysteria/config.proto\x12 xray.transport.internet.hysteria\"\xa3\x04\n" +
-	"\x06Config\x12\x18\n" +
-	"\aversion\x18\x01 \x01(\x05R\aversion\x12\x12\n" +
+	"(transport/internet/hysteria/config.proto\x12 xray.transport.internet.hysteria\"\x8f\x04\n" +
+	"\x06Config\x12\x12\n" +
 	"\x04auth\x18\x02 \x01(\tR\x04auth\x12(\n" +
 	"\x10udp_idle_timeout\x18\x03 \x01(\x03R\x0eudpIdleTimeout\x12\x1b\n" +
 	"\tmasq_type\x18\x04 \x01(\tR\bmasqType\x12\x1b\n" +
@@ -166,7 +157,7 @@ const file_transport_internet_hysteria_config_proto_rawDesc = "" +
 	"\x17masq_string_status_code\x18\v \x01(\x05R\x14masqStringStatusCode\x1aD\n" +
 	"\x16MasqStringHeadersEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x82\x01\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x01\x10\x02B\x82\x01\n" +
 	"$com.xray.transport.internet.hysteriaP\x01Z5github.com/xtls/xray-core/transport/internet/hysteria\xaa\x02 Xray.Transport.Internet.Hysteriab\x06proto3"
 
 var (

transport/internet/hysteria/config.proto

@@ -7,7 +7,7 @@ option java_package = "com.xray.transport.internet.hysteria";
 option java_multiple_files = true;
 
 message Config {
-  int32 version = 1;
+  reserved 1;
   string auth = 2;
 
   int64 udp_idle_timeout = 3;

transport/internet/hysteria/hub.go

@@ -58,7 +58,7 @@ func (h *httpHandler) AuthHTTP(w http.ResponseWriter, r *http.Request) bool {
 
 		var user *protocol.MemoryUser
 		var ok bool
-		if h.validator != nil && h.validator.GetCount() > 0 {
+		if h.validator != nil && h.validator.NotEmpty() {
 			user = h.validator.Get(auth)
 		} else if h.config.Auth != "" {
 			ok = auth == h.config.Auth

transport/internet/splithttp/client.go

@@ -9,6 +9,7 @@ import (
 	"net/http/httptrace"
 	"sync"
 
+	"github.com/apernet/quic-go/http3"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
@@ -59,7 +60,11 @@ func (c *DefaultDialerClient) OpenStream(ctx context.Context, url string, sessio
 	if body != nil {
 		method = c.transportConfig.GetNormalizedUplinkHTTPMethod() // stream-up/one
 	}
-	req, _ := http.NewRequestWithContext(context.WithoutCancel(ctx), method, url, body)
+	req, err := http.NewRequestWithContext(context.WithoutCancel(ctx), method, url, body)
+	if err != nil {
+		errors.LogInfoInner(ctx, err, "failed to create HTTP request for "+url)
+		return nil, nil, nil, err
+	}
 	c.transportConfig.FillStreamRequest(req, sessionId, "")
 
 	wrc = &WaitReadCloser{Wait: make(chan struct{})}
@@ -172,6 +177,15 @@ func (c *DefaultDialerClient) PostPacket(ctx context.Context, url string, sessio
 	return nil
 }
 
+// HTTP/1.1 and HTTP/2 will close itself, we only handle HTTP/3 here
+func (c *DefaultDialerClient) Close() error {
+	transport := c.client.Transport
+	if h3Transport, ok := transport.(*http3.Transport); ok {
+		h3Transport.Close()
+	}
+	return nil
+}
+
 type WaitReadCloser struct {
 	Wait chan struct{}
 	io.ReadCloser

transport/internet/splithttp/dialer.go

@@ -259,6 +259,7 @@ func createHTTPClient(dest net.Destination, streamSettings *internet.MemoryStrea
 				if err != nil {
 					return nil, err
 				}
+				context.AfterFunc(conn.Context(), func() { pktConn.Close() })
 
 				switch quicParams.Congestion {
 				case "reno":
@@ -425,10 +426,10 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 	}
 
 	if xmuxClient != nil {
-		xmuxClient.OpenUsage.Add(1)
+		xmuxClient.AddRunning()
 	}
 	if xmuxClient2 != nil && xmuxClient2 != xmuxClient {
-		xmuxClient2.OpenUsage.Add(1)
+		xmuxClient2.AddRunning()
 	}
 	var closed atomic.Int32
 
@@ -440,10 +441,10 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 				return
 			}
 			if xmuxClient != nil {
-				xmuxClient.OpenUsage.Add(-1)
+				xmuxClient.DoneRunning()
 			}
 			if xmuxClient2 != nil && xmuxClient2 != xmuxClient {
-				xmuxClient2.OpenUsage.Add(-1)
+				xmuxClient2.DoneRunning()
 			}
 		},
 	}

transport/internet/splithttp/hub.go

@@ -146,6 +146,7 @@ func (h *requestHandler) ServeHTTP(writer http.ResponseWriter, request *http.Req
 		writer.WriteHeader(http.StatusBadRequest)
 		return
 	}
+	obfsPaddingAccepted := h.config.XPaddingObfsMode && paddingValue != ""
 
 	sessionId, seqStr := h.config.ExtractMetaFromRequest(request, h.path)
 
@@ -155,17 +156,6 @@ func (h *requestHandler) ServeHTTP(writer http.ResponseWriter, request *http.Req
 		return
 	}
 
-	var forwardedAddrs []net.Address
-	if h.socketSettings != nil && len(h.socketSettings.TrustedXForwardedFor) > 0 {
-		for _, key := range h.socketSettings.TrustedXForwardedFor {
-			if len(request.Header.Values(key)) > 0 {
-				forwardedAddrs = http_proto.ParseXForwardedFor(request.Header)
-				break
-			}
-		}
-	} else {
-		forwardedAddrs = http_proto.ParseXForwardedFor(request.Header)
-	}
 	var remoteAddr net.Addr
 	var err error
 	remoteAddr, err = net.ResolveTCPAddr("tcp", request.RemoteAddr)
@@ -181,12 +171,11 @@ func (h *requestHandler) ServeHTTP(writer http.ResponseWriter, request *http.Req
 			Port: remoteAddr.(*net.TCPAddr).Port,
 		}
 	}
-	if len(forwardedAddrs) > 0 && forwardedAddrs[0].Family().IsIP() {
-		remoteAddr = &net.TCPAddr{
-			IP:   forwardedAddrs[0].IP(),
-			Port: 0,
-		}
+	var trustedXFF []string
+	if h.socketSettings != nil {
+		trustedXFF = h.socketSettings.TrustedXForwardedFor
 	}
+	remoteAddr = http_proto.ApplyTrustedXForwardedFor(request.Header, trustedXFF, remoteAddr)
 
 	var currentSession *httpSession
 	if sessionId != "" {
@@ -227,8 +216,8 @@ func (h *requestHandler) ServeHTTP(writer http.ResponseWriter, request *http.Req
 				writer.Header().Set("Cache-Control", "no-store")
 				writer.WriteHeader(http.StatusOK)
 				scStreamUpServerSecs := h.config.GetNormalizedScStreamUpServerSecs()
-				referrer := request.Header.Get("Referer")
-				if referrer != "" && scStreamUpServerSecs.To > 0 {
+				hasLegacyRefererCompatMarker := request.Header.Get("Referer") != ""
+				if (hasLegacyRefererCompatMarker || obfsPaddingAccepted) && scStreamUpServerSecs.To > 0 {
 					go func() {
 						for {
 							_, err := httpSC.Write(bytes.Repeat([]byte{'X'}, int(h.config.GetNormalizedXPaddingBytes().rand())))
@@ -595,9 +584,7 @@ func (ln *Listener) Addr() net.Addr {
 // Close implements net.Listener.Close().
 func (ln *Listener) Close() error {
 	if ln.h3server != nil {
-		if err := ln.h3server.Close(); err != nil {
-			return err
-		}
+		return ln.h3server.Close()
 	} else if ln.listener != nil {
 		return ln.listener.Close()
 	}

transport/internet/splithttp/mux.go

@@ -8,6 +8,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 )
 
@@ -17,10 +18,27 @@ type XmuxConn interface {
 
 type XmuxClient struct {
 	XmuxConn     XmuxConn
-	OpenUsage    atomic.Int32
+	Running      atomic.Int32
 	leftUsage    int32
 	LeftRequests atomic.Int32
 	UnreusableAt time.Time
+	NotUsed      atomic.Bool
+}
+
+func (c *XmuxClient) AddRunning() {
+	c.Running.Add(1)
+}
+
+func (c *XmuxClient) DoneRunning() {
+	c.Running.Add(-1)
+	c.maybeClose()
+}
+
+// close the XmuxConn if it is not used and has no running requests
+func (c *XmuxClient) maybeClose() {
+	if c.NotUsed.Load() && c.Running.Load() <= 0 {
+		common.Close(c.XmuxConn)
+	}
 }
 
 type XmuxManager struct {
@@ -68,10 +86,12 @@ func (m *XmuxManager) GetXmuxClient(ctx context.Context) *XmuxClient { // when l
 			xmuxClient.LeftRequests.Load() <= 0 ||
 			(xmuxClient.UnreusableAt != time.Time{} && time.Now().After(xmuxClient.UnreusableAt)) {
 			errors.LogDebug(ctx, "XMUX: removing xmuxClient, IsClosed() = ", xmuxClient.XmuxConn.IsClosed(),
-				", OpenUsage = ", xmuxClient.OpenUsage.Load(),
+				", Running = ", xmuxClient.Running.Load(),
 				", leftUsage = ", xmuxClient.leftUsage,
 				", LeftRequests = ", xmuxClient.LeftRequests.Load(),
 				", UnreusableAt = ", xmuxClient.UnreusableAt)
+			xmuxClient.NotUsed.Store(true)
+			xmuxClient.maybeClose()
 			m.xmuxClients = append(m.xmuxClients[:i], m.xmuxClients[i+1:]...)
 		} else {
 			i++
@@ -91,7 +111,7 @@ func (m *XmuxManager) GetXmuxClient(ctx context.Context) *XmuxClient { // when l
 	xmuxClients := make([]*XmuxClient, 0)
 	if m.concurrency > 0 {
 		for _, xmuxClient := range m.xmuxClients {
-			if xmuxClient.OpenUsage.Load() < m.concurrency {
+			if xmuxClient.Running.Load() < m.concurrency {
 				xmuxClients = append(xmuxClients, xmuxClient)
 			}
 		}

transport/internet/splithttp/mux_test.go

@@ -63,7 +63,7 @@ func TestMaxConcurrency(t *testing.T) {
 	xmuxClients := make(map[interface{}]struct{})
 	for i := 0; i < 64; i++ {
 		xmuxClient := xmuxManager.GetXmuxClient(context.Background())
-		xmuxClient.OpenUsage.Add(1)
+		xmuxClient.AddRunning()
 		xmuxClients[xmuxClient] = struct{}{}
 	}
 
@@ -82,7 +82,7 @@ func TestDefault(t *testing.T) {
 	xmuxClients := make(map[interface{}]struct{})
 	for i := 0; i < 64; i++ {
 		xmuxClient := xmuxManager.GetXmuxClient(context.Background())
-		xmuxClient.OpenUsage.Add(1)
+		xmuxClient.AddRunning()
 		xmuxClients[xmuxClient] = struct{}{}
 	}
 

transport/internet/splithttp/splithttp_test.go

@@ -88,6 +88,9 @@ func TestDialWithRemoteAddr(t *testing.T) {
 		ProtocolSettings: &Config{
 			Path: "sh",
 		},
+		SocketSettings: &internet.SocketConfig{
+			TrustedXForwardedFor: []string{"X-Forwarded-For"},
+		},
 	}, func(conn stat.Connection) {
 		go func(c stat.Connection) {
 			defer c.Close()

transport/internet/splithttp/upload_queue.go

@@ -6,27 +6,25 @@ package splithttp
 import (
 	"container/heap"
 	"io"
-	"runtime"
-	"sync"
+	"sync/atomic"
 
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/signal/done"
 )
 
 type Packet struct {
-	Reader  io.ReadCloser
+	Reader  *httpServerConn
 	Payload []byte
 	Seq     uint64
 }
 
 type uploadQueue struct {
-	reader          io.ReadCloser
-	nomore          bool
-	pushedPackets   chan Packet
-	writeCloseMutex sync.Mutex
-	heap            uploadHeap
-	nextSeq         uint64
-	closed          bool
-	maxPackets      int
+	reader        atomic.Pointer[httpServerConn]
+	pushedPackets chan Packet
+	heap          uploadHeap
+	nextSeq       uint64
+	maxPackets    int
+	closed        *done.Instance
 }
 
 func NewUploadQueue(maxPackets int) *uploadQueue {
@@ -34,73 +32,53 @@ func NewUploadQueue(maxPackets int) *uploadQueue {
 		pushedPackets: make(chan Packet, maxPackets),
 		heap:          uploadHeap{},
 		nextSeq:       0,
-		closed:        false,
+		closed:        done.New(),
 		maxPackets:    maxPackets,
 	}
 }
 
 func (h *uploadQueue) Push(p Packet) error {
-	h.writeCloseMutex.Lock()
-	defer h.writeCloseMutex.Unlock()
-
-	if h.closed {
-		return errors.New("packet queue closed")
-	}
-	if h.nomore {
+	if h.reader.Load() != nil || (p.Reader != nil && !h.reader.CompareAndSwap(nil, p.Reader)) {
 		return errors.New("h.reader already exists")
 	}
-	if p.Reader != nil {
-		h.nomore = true
+	select {
+	case h.pushedPackets <- p: // no panic
+		if h.closed.Done() {
+			return errors.New("packet queue closed")
+		}
+		return nil
+	case <-h.closed.Wait():
+		return errors.New("packet queue closed")
 	}
-	h.pushedPackets <- p
-	return nil
 }
 
 func (h *uploadQueue) Close() error {
-	h.writeCloseMutex.Lock()
-	defer h.writeCloseMutex.Unlock()
-
-	if !h.closed {
-		h.closed = true
-		runtime.Gosched() // hope Read() gets the packet
-	f:
-		for {
-			select {
-			case p := <-h.pushedPackets:
-				if p.Reader != nil {
-					h.reader = p.Reader
-				}
-			default:
-				break f
-			}
-		}
-		close(h.pushedPackets)
-	}
-	if h.reader != nil {
-		return h.reader.Close()
+	h.closed.Close()
+	if reader := h.reader.Load(); reader != nil {
+		return reader.Close()
 	}
 	return nil
 }
 
 func (h *uploadQueue) Read(b []byte) (int, error) {
-	if h.reader != nil {
-		return h.reader.Read(b)
+	if reader := h.reader.Load(); reader != nil {
+		return reader.Read(b)
 	}
 
-	if h.closed {
+	if h.closed.Done() {
 		return 0, io.EOF
 	}
 
 	if len(h.heap) == 0 {
-		packet, more := <-h.pushedPackets
-		if !more {
+		select {
+		case p := <-h.pushedPackets:
+			if p.Reader != nil {
+				return p.Reader.Read(b)
+			}
+			heap.Push(&h.heap, p)
+		case <-h.closed.Wait():
 			return 0, io.EOF
 		}
-		if packet.Reader != nil {
-			h.reader = packet.Reader
-			return h.reader.Read(b)
-		}
-		heap.Push(&h.heap, packet)
 	}
 
 	for len(h.heap) > 0 {
@@ -131,11 +109,12 @@ func (h *uploadQueue) Read(b []byte) (int, error) {
 				return 0, errors.New("packet queue is too large")
 			}
 			heap.Push(&h.heap, packet)
-			packet2, more := <-h.pushedPackets
-			if !more {
+			select {
+			case p := <-h.pushedPackets:
+				heap.Push(&h.heap, p)
+			case <-h.closed.Wait():
 				return 0, io.EOF
 			}
-			heap.Push(&h.heap, packet2)
 		}
 	}
 

transport/internet/websocket/hub.go

@@ -65,24 +65,12 @@ func (h *requestHandler) ServeHTTP(writer http.ResponseWriter, request *http.Req
 		return
 	}
 
-	var forwardedAddrs []net.Address
-	if h.socketSettings != nil && len(h.socketSettings.TrustedXForwardedFor) > 0 {
-		for _, key := range h.socketSettings.TrustedXForwardedFor {
-			if len(request.Header.Values(key)) > 0 {
-				forwardedAddrs = http_proto.ParseXForwardedFor(request.Header)
-				break
-			}
-		}
-	} else {
-		forwardedAddrs = http_proto.ParseXForwardedFor(request.Header)
-	}
 	remoteAddr := conn.RemoteAddr()
-	if len(forwardedAddrs) > 0 && forwardedAddrs[0].Family().IsIP() {
-		remoteAddr = &net.TCPAddr{
-			IP:   forwardedAddrs[0].IP(),
-			Port: int(0),
-		}
+	var trustedXFF []string
+	if h.socketSettings != nil {
+		trustedXFF = h.socketSettings.TrustedXForwardedFor
 	}
+	remoteAddr = http_proto.ApplyTrustedXForwardedFor(request.Header, trustedXFF, remoteAddr)
 
 	h.ln.addConn(NewConnection(conn, remoteAddr, extraReader, h.ln.config.HeartbeatPeriod))
 }

transport/internet/websocket/ws_test.go

@@ -79,6 +79,9 @@ func TestDialWithRemoteAddr(t *testing.T) {
 		ProtocolSettings: &Config{
 			Path: "ws",
 		},
+		SocketSettings: &internet.SocketConfig{
+			TrustedXForwardedFor: []string{"X-Forwarded-For"},
+		},
 	}, func(conn stat.Connection) {
 		go func(c stat.Connection) {
 			defer c.Close()