Disable default MPTCP listener

infra/conf/tun.go

@@ -6,7 +6,9 @@ import (
 	"math/big"
 	"net"
 	"runtime"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/proxy/tun"
@@ -37,22 +39,25 @@ func (v *TunConfig) Build() (proto.Message, error) {
 		AutoSystemRoutingTable: v.AutoSystemRoutingTable,
 		AutoSystemDnsToGateway: v.AutoSystemDnsToGateway,
 	}
-	leaks, err := tun.ExpandWfpBlockLeak(v.AutoSystemWfpBlockLeak)
-	if err != nil {
-		return nil, err
+	for _, leak := range v.AutoSystemWfpBlockLeak {
+		switch leak := strings.ToLower(leak); leak {
+		case "dns", "misconfigtun":
+			config.AutoSystemWfpBlockLeak = append(config.AutoSystemWfpBlockLeak, leak)
+		default:
+			return nil, errors.New("unknown autoSystemWfpBlockLeak value: ", leak)
+		}
 	}
-	config.AutoSystemWfpBlockLeak = leaks
 	// Each option needs other settings on the system it takes effect on: the
-	// filters go along with the routes of autoSystemRoutingTable, keeping the
-	// system's DNS inside the TUN needs DNS servers on it, and
-	// autoSystemDnsToGateway points the system DNS at the gateway.
+	// filters go along with the routes of autoSystemRoutingTable, "dns" lets
+	// DNS through the TUN only, and autoSystemDnsToGateway points the system
+	// DNS at the gateway.
 	switch runtime.GOOS {
 	case "windows":
-		if len(leaks) > 0 && len(v.AutoSystemRoutingTable) == 0 {
+		if len(config.AutoSystemWfpBlockLeak) > 0 && len(v.AutoSystemRoutingTable) == 0 {
 			return nil, errors.New("autoSystemWfpBlockLeak needs autoSystemRoutingTable to be set")
 		}
-		if tun.BlocksSystemDNS(leaks) && len(v.DNS) == 0 {
-			return nil, errors.New(`autoSystemWfpBlockLeak "dns", "udp/53", "tcp/53" or "windnsclient" needs dns to be set`)
+		if slices.Contains(config.AutoSystemWfpBlockLeak, "dns") && len(v.DNS) == 0 {
+			return nil, errors.New(`autoSystemWfpBlockLeak "dns" needs dns to be set`)
 		}
 	case "linux", "freebsd":
 		if v.AutoSystemDnsToGateway && len(v.Gateway) == 0 {

infra/conf/tun_test.go

@@ -29,17 +29,12 @@ func TestTunConfigAutoSystem(t *testing.T) {
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns", "misconfigtun"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853", "misconfigtun"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns", "misconfigtun"}},
 		},
 		{
 			Input:  `{"name": "xray0", "dns": ["1.1.1.1"], "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["DNS"]}`,
 			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}},
-		},
-		{
-			Input:  `{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["TCP/853", "udp/853", "tcp/0853"]}`,
-			Parser: loadJSON(creator),
-			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"tcp/853", "udp/853"}},
+			Output: &tun.Config{Name: "xray0", Desc: "Wintun", MTU: 1500, DNS: []string{"1.1.1.1"}, AutoSystemRoutingTable: []string{"0.0.0.0/0"}, AutoOutboundsInterface: "auto", AutoSystemWfpBlockLeak: []string{"dns"}},
 		},
 	})
 }
@@ -54,9 +49,6 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 		{`{"name": "xray0", "autoSystemWfpBlockLeak": ["misconfigtun"]}`, []string{"windows"}},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["misconfigtun"]}`, nil},
 		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["dns"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["udp/53"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["windnsclient"]}`, []string{"windows"}},
-		{`{"name": "xray0", "autoSystemRoutingTable": ["0.0.0.0/0"], "autoSystemWfpBlockLeak": ["tcp/853", "udp/853"]}`, nil},
 		{`{"name": "xray0", "autoSystemDnsToGateway": true}`, []string{"linux", "freebsd"}},
 	} {
 		config := new(TunConfig)
@@ -70,13 +62,11 @@ func TestTunConfigAutoSystemNeeds(t *testing.T) {
 }
 
 func TestTunConfigAutoSystemWfpBlockLeakUnknown(t *testing.T) {
-	for _, value := range []string{"ip", "tcp/0", "icmp/1"} {
-		config := new(TunConfig)
-		if err := json.Unmarshal([]byte(`{"name": "xray0", "autoSystemWfpBlockLeak": ["dns", "`+value+`"]}`), config); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := config.Build(); err == nil {
-			t.Errorf("autoSystemWfpBlockLeak value %q was accepted", value)
-		}
+	config := new(TunConfig)
+	if err := json.Unmarshal([]byte(`{"name": "xray0", "autoSystemWfpBlockLeak": ["dns", "ip"]}`), config); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := config.Build(); err == nil {
+		t.Error("an unknown autoSystemWfpBlockLeak value was accepted")
 	}
 }

proxy/tun/README.md

@@ -23,10 +23,6 @@ For more advanced routing policies or rules, OS level configuration can still ma
 This keeps complex system level routing and rules in a single place of responsibility - the OS itself. \
 Examples of how to achieve this on a simple Linux system (Ubuntu with systemd-networkd) can be found at the end of this README.
 
-Packets are handled by Xray-core's own lightweight TCP/IP stack, which replaced gVisor (XTLS/Xray-core#7130).
-
-With `autoSystemRoutingTable`, Xray's own connections are kept out of the TUN through `autoOutboundsInterface` (then `"auto"` by default): each of their sockets is bound to another interface, the one named there, or with `"auto"` the one of the default route (Android needs the name). Linux and Android bind with `SO_BINDTODEVICE`, Windows with `IP_UNICAST_IF` and `IPV6_UNICAST_IF`, macOS and iOS with `IP_BOUND_IF` and `IPV6_BOUND_IF`, and FreeBSD switches them to another routing table (see [FreeBSD SUPPORT](#freebsd-support)). Connections to loopback addresses, TCP and UDP, stay unbound. If a socket cannot be bound, the connection fails rather than leave unbound, where it could loop back into the TUN (XTLS/Xray-core#7173).
-
 ### SYSTEM DNS ON LINUX AND FREEBSD (`autoSystemDnsToGateway`)
 
 On Linux and FreeBSD, setting `autoSystemDnsToGateway` to `true` lets the inbound point the system resolver at the tun interface, so name lookups resolve through Xray instead of going out over the physical link. It is off by default, and it exists only on those two systems. This section describes Linux; the FreeBSD differences follow in [SYSTEM DNS ON FREEBSD](#system-dns-on-freebsd).
@@ -219,16 +215,12 @@ All in all systemd-networkd and its derivatives (like netplan or NetworkManager)
 Windows version of the same functionality is implemented through Wintun library. \
 To make it start, wintun.dll specific for your Windows/arch must be present next to Xray.exe binary.
 
-After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running. A Wintun adapter that already has that name is reused.
-
-With IPv6 disabled system-wide (the `DisabledComponents` registry value), the adapter has no IPv6, and the TUN starts with IPv4 only, unless `gateway` or `autoSystemRoutingTable` has IPv6 entries, which then keep it from starting.
+After the start network adapter with the name you chose in the config will be created in the system, and exist while Xray is running.
 
 When `dns` is set, those servers are applied to the adapter. Windows is kept from registering the TUN's addresses in DNS, and its DNS cache is flushed when the TUN starts and stops.
 
-With `autoSystemWfpBlockLeak`, which needs `autoSystemRoutingTable` (the config is rejected otherwise), Xray also adds Windows Filtering Platform filters that keep traffic of every program but Xray itself from leaving outside the TUN, each kind chosen by a value in the list, e.g. `"autoSystemWfpBlockLeak": ["dns", "misconfigtun"]`:
-- `"tcp/<port>"`, `"udp/<port>"`: connections to that TCP or UDP port only go through the TUN, e.g. `"tcp/853"`.
-- `"windnsclient"`: Windows' DNS Client service cannot connect outside the TUN at all, except for name resolution on the local network (LLMNR, mDNS). On Windows 11 and Server 2022 and later, it may send name queries over HTTPS or TLS, to any port. Earlier versions only query port 53, so there it does nothing.
-- `"dns"`: stands for `"udp/53"`, `"tcp/53"`, `"windnsclient"`, `"tcp/853"` (DNS over TLS) and `"udp/853"` (DNS over QUIC). Windows keeps sending name queries to the DNS servers of the other interfaces as well, out through those interfaces whatever the routes say, and other programs reach a resolver on the local network (e.g. `192.168.1.1` handed out by DHCP) through its more specific LAN route instead of the TUN. Keeping the system's DNS inside the TUN like this, with `"dns"`, `"udp/53"`, `"tcp/53"` or `"windnsclient"`, needs `dns` (the config is rejected otherwise). The `dns` servers then have to lie within `gateway` or `autoSystemRoutingTable` (a warning is logged otherwise), and DNS servers that should be reached directly belong in Xray's own `dns` settings.
+With `autoSystemWfpBlockLeak`, which needs `autoSystemRoutingTable` (the config is rejected otherwise), Xray also adds Windows Filtering Platform filters that keep two kinds of traffic of every program but Xray itself from leaving outside the TUN, each chosen by a value in the list, e.g. `"autoSystemWfpBlockLeak": ["dns", "misconfigtun"]`:
+- `"dns"` (needs `dns`, the config is rejected otherwise): DNS (port 53) only goes through the TUN. Windows keeps sending name queries to the DNS servers of the other interfaces as well, out through those interfaces whatever the routes say, and other programs reach a resolver on the local network (e.g. `192.168.1.1` handed out by DHCP) through its more specific LAN route instead of the TUN. On Windows 11 and Server 2022 and later, where those queries may also go over HTTPS or TLS, Windows' DNS Client service cannot connect outside the TUN at all, except for name resolution on the local network (LLMNR, mDNS). The `dns` servers therefore have to lie within `gateway` or `autoSystemRoutingTable` (a warning is logged otherwise), and DNS servers that should be reached directly belong in Xray's own `dns` settings.
 - `"misconfigtun"`: an IP version without routes in `autoSystemRoutingTable`, IPv4 or IPv6, is blocked entirely, in both directions, as it would bypass the TUN. Only loopback and what Windows itself needs on the local link (DHCP, and for IPv6 neighbor and multicast listener discovery) remain allowed. An address of that version in `gateway` is not needed: without one, Windows gives the TUN link-local addresses itself, an IPv6 one at once and an IPv4 one from `169.254.0.0/16` after some seconds (until then, IPv4 routed to the TUN is unreachable), and what is routed to the TUN goes through it with those.
 
 With the filters in place, Xray's own connections out also get past Windows Firewall's block rules (other firewalls may still block them), while connections to Xray's inbounds stay subject to them.
@@ -241,8 +233,6 @@ If the filters cannot be added, Xray does not start. They are removed when Xray
 
 `autoOutboundsInterface` (the default with `autoSystemRoutingTable`) keeps Xray's own connections out of the TUN by binding them to another interface, which Windows only honors while that interface has weak host send and forwarding off for the IP versions routed to the TUN. Otherwise, Windows sends them into the TUN, from that interface's address, and they stall. While the TUN runs, Xray therefore turns weak host send off on that interface, and on again when it stops or another interface takes over. Forwarding cannot be turned off this way, as Mobile Hotspot and Internet Connection Sharing need it, so a warning is logged while it is on. Having the hotspot share the TUN instead of that interface (Settings, Mobile hotspot, Share my internet connection from) moves forwarding to the TUN, where it does no harm, and sends the hotspot's devices through Xray as well.
 
-An outbound interface with only IPv4 or only IPv6 works as well: a UDP socket opened for both IP versions, which such an interface cannot be bound to, is opened again for the destination's version only, and IPv6 TCP is bound for IPv6 alone, so connections of the missing version fail rather than leave through another interface (XTLS/Xray-core#7214).
-
 You can give the adapter ip address manually, you can live Windows to give it autogenerated ip address (which take few seconds), it doesn't matter, the traffic going _through_ the interface will be forwarded into the app for proxying. \
 Minimal configuration that will work for local machine is routing passing the traffic on-link through the interface.
 You will need the interface id for that, unfortunately it is going to change with every Xray start due to implementation ambiguity between Xray and wintun driver.
@@ -317,7 +307,6 @@ sudo route add -inet6 -host 2606:4700:4700::1111 -iface utun10
 sudo route add -inet6 -host 2606:4700:4700::1001 -iface utun10
 ```
 Alternatively, configure `autoSystemRoutingTable` and Xray will add and remove those system routes while it is running.
-Xray's own connections are then kept out of the TUN through `autoOutboundsInterface`: an IPv4 socket is bound with `IP_BOUND_IF`, an IPv6 or dual-stack one with `IPV6_BOUND_IF`, which covers the IPv4 traffic of a dual-stack socket as well, since macOS rejects `IP_BOUND_IF` on IPv6 sockets (XTLS/Xray-core#7230).
 Important to remember that everything written above about Linux routing concept, also apply to Mac OS X. If you simply route default route through utun interface, that will result network loop and immediate network failure.
 
 ## ANDROID SUPPORT
@@ -349,7 +338,7 @@ let tunFd = ((0 ... 1024).first { (_ fd: Int32) -> Bool in var len = socklen_t(b
 }!
 ```
 
-Set the environment variable `xray.tun.fd` (or `XRAY_TUN_FD`) to the fd number before starting Xray. This can be done from Swift/Objective-C or by exposing a Go function via gomobile bindings. Xray works on a duplicate of the fd and closes only that, so the fd itself stays NetworkExtension's (XTLS/Xray-core#6883).
+Set the environment variable `xray.tun.fd` (or `XRAY_TUN_FD`) to the fd number before starting Xray. This can be done from Swift/Objective-C or by exposing a Go function via gomobile bindings.
 
 Build using gomobile for iOS framework integration:
 ```

proxy/tun/tun_windows.go

@@ -247,31 +247,30 @@ startOver:
 	}
 
 	// With autoSystemWfpBlockLeak, once the system routes lead to the TUN,
-	// keep connections to the ports given ("dns" stands for those of DNS),
-	// Windows' DNS Client service, and an IP version no route of which leads
-	// to the TUN ("misconfigtun"), from leaving through the other interfaces.
-	// Addresses do not matter: without one of a version in gateway, Windows
-	// gives the TUN a link-local one.
-	leaks, err := ExpandWfpBlockLeak(t.options.AutoSystemWfpBlockLeak)
-	if err != nil {
-		return err
-	}
-	block := newLeakFilters(leaks, route4, route6)
-	if route4 || route6 {
-		if slices.Contains(leaks, "windnsclient") && !block.dnsClient {
-			errors.LogInfo(context.Background(), "[tun] windnsclient skipped: before Windows 11 and Server 2022, the DNS Client service only queries port 53")
-		}
-		if block.systemDNS() && len(dns) == 0 {
-			return errors.New("keeping the system's DNS inside the TUN needs dns to be set")
-		}
-	}
-	if blocked := block.String(); (route4 || route6) && blocked != "" {
-		if t.wfp, err = blockLeaks(t.luid, block); err != nil {
+	// keep DNS ("dns", if dns is set), and an IP version no route of which
+	// leads to the TUN ("misconfigtun"), from leaving through the other
+	// interfaces. Addresses do not matter: without one of a version in
+	// gateway, Windows gives the TUN a link-local one.
+	leaks := t.options.AutoSystemWfpBlockLeak
+	blockDNS := slices.Contains(leaks, "dns") && len(dns) > 0
+	blockIPv4 := slices.Contains(leaks, "misconfigtun") && !route4
+	blockIPv6 := slices.Contains(leaks, "misconfigtun") && !route6
+	if (route4 || route6) && (blockDNS || blockIPv4 || blockIPv6) {
+		if t.wfp, err = blockLeaks(t.luid, blockDNS, blockIPv4, blockIPv6); err != nil {
+			var blocked []string
+			for _, b := range []struct {
+				on   bool
+				what string
+			}{{blockDNS, "DNS"}, {blockIPv4, "IPv4"}, {blockIPv6, "IPv6"}} {
+				if b.on {
+					blocked = append(blocked, b.what)
+				}
+			}
 			// Rather no TUN than a leaking one.
-			return errors.New("unable to block ", blocked, " outside the TUN (remove autoSystemWfpBlockLeak to run without)").Base(err)
+			return errors.New("unable to block ", strings.Join(blocked, " and "), " outside the TUN (remove autoSystemWfpBlockLeak to run without)").Base(err)
 		}
-		errors.LogInfo(context.Background(), "[tun] blocked outside the TUN: ", blocked)
-		if block.systemDNS() {
+		errors.LogInfo(context.Background(), "[tun] outside the TUN, blocked DNS: ", blockDNS, ", blocked IPv4: ", blockIPv4, ", blocked IPv6: ", blockIPv6)
+		if blockDNS {
 			covered := slices.Clone(addresses)
 			for _, route := range routesData {
 				covered = append(covered, route.Destination)

proxy/tun/tun_windows_wfp.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"runtime"
 	"slices"
-	"strings"
 	"unsafe"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -171,79 +170,19 @@ func condition(field *windows.GUID, typ uint32, value uintptr) fwpmFilterConditi
 	}
 }
 
-// leakFilters is what blockLeaks keeps from leaving outside the TUN.
-type leakFilters struct {
-	ports      []leakPort // connections to these ports
-	dnsClient  bool       // Windows' DNS Client service
-	ipv4, ipv6 bool       // an IP version altogether
-}
-
-// newLeakFilters turns expanded autoSystemWfpBlockLeak values into the filters
-// for a TUN that the routes of route4 (IPv4) and route6 (IPv6) lead to.
-func newLeakFilters(leaks []string, route4, route6 bool) leakFilters {
-	var block leakFilters
-	for _, leak := range leaks {
-		switch leak {
-		case "windnsclient":
-			block.dnsClient = dnsClientUsesAnyPort()
-		case "misconfigtun":
-			block.ipv4, block.ipv6 = !route4, !route6
-		default:
-			if port, ok := parseLeakPort(leak); ok {
-				block.ports = append(block.ports, port)
-			}
-		}
-	}
-	return block
-}
-
-// String lists what block keeps inside the TUN, or is empty for nothing.
-func (block leakFilters) String() string {
-	var blocked []string
-	for _, port := range block.ports {
-		blocked = append(blocked, port.String())
-	}
-	for _, b := range []struct {
-		on   bool
-		what string
-	}{{block.dnsClient, "windnsclient"}, {block.ipv4, "IPv4"}, {block.ipv6, "IPv6"}} {
-		if b.on {
-			blocked = append(blocked, b.what)
-		}
-	}
-	return strings.Join(blocked, ", ")
-}
-
-// systemDNS tells whether block keeps the system's DNS inside the TUN.
-func (block leakFilters) systemDNS() bool {
-	return block.dnsClient || slices.ContainsFunc(block.ports, func(port leakPort) bool { return port.port == 53 })
-}
-
-// dnsClientUsesAnyPort tells whether Windows' DNS Client service may send its
-// queries over HTTPS or TLS, and so to any port, which it does since Windows 11
-// and Server 2022 (build 20348). Earlier versions only query port 53, and may
-// run the service in one process with others, which its filters would catch
-// as well.
-func dnsClientUsesAnyPort() bool {
-	_, _, build := windows.RtlGetNtVersionNumbers()
-	return build >= 20348
-}
-
 // blockLeaks keeps traffic from leaving through interfaces other than tun,
 // for every program but Xray itself, whose outbounds (DNS included) use the
 // other interfaces on purpose:
 //
-//   - ports: connections to these TCP or UDP ports may only go through the
-//     TUN, those of DNS (53), DNS over TLS (TCP 853) and DNS over QUIC (UDP
-//     853) with "dns". Windows sends a name query to the DNS servers of all
-//     interfaces, not only to those of the TUN: to the first server of each
-//     interface, then to all of them when no answer arrives within a second or
-//     two. It sends the queries for the servers of an interface out through
-//     that interface, whatever the routes say, and other programs reach an
-//     on-link resolver, like 192.168.1.1 from DHCP, through its LAN route,
-//     which is more specific than the TUN's default route.
-//   - dnsClient: since Windows 11 and Server 2022, Windows may also send its
-//     queries over HTTPS or TLS, to any port, so its DNS Client service may not
+//   - dns: DNS (port 53) may only go through the TUN. Windows sends a name
+//     query to the DNS servers of all interfaces, not only to those of the TUN:
+//     to the first server of each interface, then to all of them when no answer
+//     arrives within a second or two. It sends the queries for the servers of
+//     an interface out through that interface, whatever the routes say, and
+//     other programs reach an on-link resolver, like 192.168.1.1 from DHCP,
+//     through its LAN route, which is more specific than the TUN's default
+//     route. Since Windows 11 and Server 2022, Windows may also send its
+//     queries over HTTPS or TLS, so there its DNS Client service may not
 //     connect outside the TUN at all, except for name resolution on the local
 //     link (mDNS, LLMNR).
 //   - ipv4, ipv6: no IPv4, or no IPv6, at all, in either direction, for a TUN
@@ -257,7 +196,7 @@ func dnsClientUsesAnyPort() bool {
 //
 // The filters live in a dynamic WFP session: closing the returned engine handle
 // with closeWFPEngine deletes them, and so does Windows when the process dies.
-func blockLeaks(tun winipcfg.LUID, block leakFilters) (windows.Handle, error) {
+func blockLeaks(tun winipcfg.LUID, dns, ipv4, ipv6 bool) (windows.Handle, error) {
 	engine, err := openWFPEngine()
 	if err != nil {
 		return 0, err
@@ -266,7 +205,7 @@ func blockLeaks(tun winipcfg.LUID, block leakFilters) (windows.Handle, error) {
 		closeWFPEngine(engine)
 		return 0, errors.New("FwpmTransactionBegin0 failed").Base(err)
 	}
-	err = addLeakFilters(engine, tun, block)
+	err = addLeakFilters(engine, tun, dns, ipv4, ipv6)
 	if err == nil {
 		if err = fwpmResult(procFwpmTransactionCommit0.Call(uintptr(engine))); err != nil {
 			err = errors.New("FwpmTransactionCommit0 failed").Base(err)
@@ -303,7 +242,7 @@ func closeWFPEngine(engine windows.Handle) {
 
 // addLeakFilters adds the filters of blockLeaks in a sublayer of their own.
 // blockLeaks runs it in a transaction, so that they take effect all at once.
-func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters) error {
+func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, dns, ipv4, ipv6 bool) error {
 	exe, err := os.Executable()
 	if err != nil {
 		return err
@@ -346,55 +285,51 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 	// hard permit. Connections from outside to Xray get an ordinary one, so
 	// that firewalls keep guarding its inbounds.
 	self := condition(&fwpmConditionALEAppID, fwpByteBlobType, uintptr(unsafe.Pointer(appID)))
-	// A connection goes through the TUN when its local address is the TUN's,
-	// and it also leaves, or arrives, through the TUN. The local address alone
+	dns53 := condition(&fwpmConditionIPRemotePort, fwpUint16, 53)
+	// DNS goes through the TUN when its local address is the TUN's, and it
+	// also leaves, or arrives, through the TUN. The local address alone
 	// decides by default, but with weak host sending or receiving enabled,
 	// packets of the TUN's address can use other interfaces. (The next hop,
 	// the interface replies would leave by, is not known for arriving ones.)
 	onTUN := func(field *windows.GUID) fwpmFilterCondition0 {
 		return condition(field, fwpUint64, uintptr(unsafe.Pointer(tunLUID)))
 	}
+	out := []fwpmFilterCondition0{dns53, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPNexthopInterface)}
+	in := []fwpmFilterCondition0{dns53, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPArrivalInterface)}
 	for _, layer := range []struct {
-		key       *windows.GUID
-		selfFlags uint32
-		via       *windows.GUID // the interface that has to be the TUN as well
+		key        *windows.GUID
+		selfFlags  uint32
+		throughTUN []fwpmFilterCondition0
 	}{
-		{&fwpmLayerALEAuthConnectV4, fwpmFilterFlagClearActionRight, &fwpmConditionIPNexthopInterface},
-		{&fwpmLayerALEAuthRecvAcceptV4, 0, &fwpmConditionIPArrivalInterface},
-		{&fwpmLayerALEAuthConnectV6, fwpmFilterFlagClearActionRight, &fwpmConditionIPNexthopInterface},
-		{&fwpmLayerALEAuthRecvAcceptV6, 0, &fwpmConditionIPArrivalInterface},
+		{&fwpmLayerALEAuthConnectV4, fwpmFilterFlagClearActionRight, out},
+		{&fwpmLayerALEAuthRecvAcceptV4, 0, in},
+		{&fwpmLayerALEAuthConnectV6, fwpmFilterFlagClearActionRight, out},
+		{&fwpmLayerALEAuthRecvAcceptV6, 0, in},
 	} {
 		if err := add(layer.key, "permit Xray", layer.selfFlags, fwpActionPermit, 4, self); err != nil {
 			return err
 		}
-		for _, port := range block.ports {
-			protocol := uintptr(windows.IPPROTO_UDP)
-			if port.tcp {
-				protocol = windows.IPPROTO_TCP
-			}
-			toPort := []fwpmFilterCondition0{
-				condition(&fwpmConditionIPProtocol, fwpUint8, protocol),
-				condition(&fwpmConditionIPRemotePort, fwpUint16, uintptr(port.port)),
-			}
-			throughTUN := slices.Concat(toPort, []fwpmFilterCondition0{onTUN(&fwpmConditionIPLocalInterface), onTUN(layer.via)})
-			if err := add(layer.key, "permit "+port.String()+" through the TUN", 0, fwpActionPermit, 3, throughTUN...); err != nil {
+		if dns {
+			if err := add(layer.key, "permit DNS through the TUN", 0, fwpActionPermit, 3, layer.throughTUN...); err != nil {
 				return err
 			}
-			if err := add(layer.key, "block "+port.String(), 0, fwpActionBlock, 2, toPort...); err != nil {
+			if err := add(layer.key, "block DNS", 0, fwpActionBlock, 2, dns53); err != nil {
 				return err
 			}
 		}
 	}
 
-	// Since Windows 11 and Server 2022, the DNS Client service may also send
-	// the queries for an interface's servers over HTTPS or TLS, out through
-	// that interface and to any port. So there it may only connect through
-	// the TUN, except for mDNS and LLMNR, which stay on the local link (over
-	// an IP version only while it is not blocked altogether). Like Windows
-	// Firewall's rules for it, the filters recognize the service by its SID,
+	// Since Windows 11 and Server 2022 (build 20348), the DNS Client service
+	// may also send the queries for an interface's servers over HTTPS or TLS,
+	// out through that interface and to any port. So there it may only
+	// connect through the TUN, except for mDNS and LLMNR, which stay on the
+	// local link (over an IP version only while it is not blocked altogether).
+	// Earlier versions only query port 53, and may run the service in one
+	// process with others, which the filters would catch as well. Like
+	// Windows Firewall's rules for it, they recognize the service by its SID,
 	// which Windows puts in the token of its process: the security descriptor
 	// grants that SID the right to match (FWP_ACTRL_MATCH_FILTER, CC in SDDL).
-	if block.dnsClient {
+	if _, _, build := windows.RtlGetNtVersionNumbers(); dns && build >= 20348 {
 		sd, err := windows.SecurityDescriptorFromString("O:SYG:SYD:(A;;CCRC;;;" + dnsClientSID + ")")
 		if err != nil {
 			return err
@@ -408,8 +343,8 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 			key       *windows.GUID
 			localLink bool
 		}{
-			{&fwpmLayerALEAuthConnectV4, !block.ipv4},
-			{&fwpmLayerALEAuthConnectV6, !block.ipv6},
+			{&fwpmLayerALEAuthConnectV4, !ipv4},
+			{&fwpmLayerALEAuthConnectV6, !ipv6},
 		} {
 			if err := add(layer.key, "permit the DNS Client service through the TUN", 0, fwpActionPermit, 3, dnsClient, onTUN(&fwpmConditionIPLocalInterface), onTUN(&fwpmConditionIPNexthopInterface)); err != nil {
 				return err
@@ -432,7 +367,7 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 		matchType:      fwpMatchFlagsAllSet,
 		conditionValue: fwpValue0{typ: fwpUint32, value: fwpConditionFlagIsLoopback},
 	}
-	if block.ipv4 {
+	if ipv4 {
 		// DHCP keeps the addresses of the other interfaces, which Xray's own
 		// connections use.
 		dhcp := []fwpmFilterCondition0{
@@ -452,7 +387,7 @@ func addLeakFilters(engine windows.Handle, tun winipcfg.LUID, block leakFilters)
 			}
 		}
 	}
-	if block.ipv6 {
+	if ipv6 {
 		// Neighbor and multicast listener discovery, ICMPv6 130-137 and 143,
 		// whose type and code sit where the local and remote port are.
 		discovery := []fwpmFilterCondition0{condition(&fwpmConditionIPProtocol, fwpUint8, windows.IPPROTO_ICMPV6)}

proxy/tun/tun_windows_wfp_test.go

@@ -114,38 +114,11 @@ func TestLeakFiltersAccepted(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	leaks, err := ExpandWfpBlockLeak([]string{"dns", "misconfigtun", "tcp/443"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	block := newLeakFilters(leaks, false, false)
-	block.dnsClient = true // whatever the Windows version
-	if err := addLeakFilters(engine, loopback, block); err != nil {
+	if err := addLeakFilters(engine, loopback, true, true, true); err != nil {
 		skipUnlessElevated(err)
 	}
 }
 
-func TestNewLeakFilters(t *testing.T) {
-	leaks, err := ExpandWfpBlockLeak([]string{"dns", "misconfigtun"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	block := newLeakFilters(leaks, true, false)
-	want := "udp/53, tcp/53, tcp/853, udp/853, IPv6"
-	if dnsClientUsesAnyPort() {
-		want = "udp/53, tcp/53, tcp/853, udp/853, windnsclient, IPv6"
-	}
-	if got := block.String(); got != want {
-		t.Errorf("String() = %q, want %q", got, want)
-	}
-	if !block.systemDNS() {
-		t.Error("systemDNS() = false with dns")
-	}
-	if block := newLeakFilters([]string{"tcp/853", "udp/853", "misconfigtun"}, true, true); block.String() != "tcp/853, udp/853" || block.systemDNS() {
-		t.Errorf("tcp/853, udp/853: %q, systemDNS() = %v", block.String(), block.systemDNS())
-	}
-}
-
 func TestDNSClientSID(t *testing.T) {
 	sid, _, _, err := windows.LookupSID("", `NT SERVICE\Dnscache`)
 	if err != nil {

proxy/tun/wfp_leak.go

@@ -1,79 +0,0 @@
-package tun
-
-import (
-	"slices"
-	"strconv"
-	"strings"
-
-	"github.com/xtls/xray-core/common/errors"
-)
-
-// dnsLeaks is what "dns" in autoSystemWfpBlockLeak stands for: DNS over UDP and
-// TCP, Windows' DNS Client service, which may also use other protocols and
-// ports, DNS over TLS, and DNS over QUIC.
-var dnsLeaks = []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}
-
-// leakPort is a "tcp/<port>" or "udp/<port>" value of autoSystemWfpBlockLeak:
-// connections to that port may only go through the TUN.
-type leakPort struct {
-	tcp  bool
-	port uint16
-}
-
-func (p leakPort) String() string {
-	if p.tcp {
-		return "tcp/" + strconv.Itoa(int(p.port))
-	}
-	return "udp/" + strconv.Itoa(int(p.port))
-}
-
-// parseLeakPort parses a lower case "tcp/<port>" or "udp/<port>" value.
-func parseLeakPort(value string) (leakPort, bool) {
-	protocol, port, ok := strings.Cut(value, "/")
-	if !ok || protocol != "tcp" && protocol != "udp" {
-		return leakPort{}, false
-	}
-	n, err := strconv.ParseUint(port, 10, 16)
-	if err != nil || n == 0 {
-		return leakPort{}, false
-	}
-	return leakPort{tcp: protocol == "tcp", port: uint16(n)}, true
-}
-
-// ExpandWfpBlockLeak checks the values of autoSystemWfpBlockLeak and returns
-// them in lower case, in order and without duplicates, with "dns" replaced by
-// what it stands for.
-func ExpandWfpBlockLeak(values []string) ([]string, error) {
-	var leaks []string
-	add := func(leak string) {
-		if !slices.Contains(leaks, leak) {
-			leaks = append(leaks, leak)
-		}
-	}
-	for _, value := range values {
-		switch value = strings.ToLower(value); value {
-		case "dns":
-			for _, leak := range dnsLeaks {
-				add(leak)
-			}
-		case "windnsclient", "misconfigtun":
-			add(value)
-		default:
-			port, ok := parseLeakPort(value)
-			if !ok {
-				return nil, errors.New("unknown autoSystemWfpBlockLeak value: ", value)
-			}
-			add(port.String())
-		}
-	}
-	return leaks, nil
-}
-
-// BlocksSystemDNS tells whether expanded autoSystemWfpBlockLeak values keep the
-// system's DNS (port 53, or Windows' DNS Client service) inside the TUN, which
-// then needs DNS servers of its own.
-func BlocksSystemDNS(leaks []string) bool {
-	return slices.ContainsFunc(leaks, func(leak string) bool {
-		return leak == "udp/53" || leak == "tcp/53" || leak == "windnsclient"
-	})
-}

proxy/tun/wfp_leak_test.go

@@ -1,40 +0,0 @@
-package tun
-
-import (
-	"slices"
-	"testing"
-)
-
-func TestExpandWfpBlockLeak(t *testing.T) {
-	for _, c := range []struct {
-		values    []string
-		leaks     []string
-		systemDNS bool
-	}{
-		{nil, nil, false},
-		{[]string{"dns"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853"}, true},
-		{[]string{"DNS", "MisconfigTUN"}, []string{"udp/53", "tcp/53", "windnsclient", "tcp/853", "udp/853", "misconfigtun"}, true},
-		{[]string{"tcp/853", "dns", "TCP/0853"}, []string{"tcp/853", "udp/53", "tcp/53", "windnsclient", "udp/853"}, true},
-		{[]string{"tcp/853", "udp/853", "misconfigtun"}, []string{"tcp/853", "udp/853", "misconfigtun"}, false},
-		{[]string{"udp/65535", "tcp/1"}, []string{"udp/65535", "tcp/1"}, false},
-		{[]string{"tcp/53"}, []string{"tcp/53"}, true},
-		{[]string{"windnsclient"}, []string{"windnsclient"}, true},
-	} {
-		leaks, err := ExpandWfpBlockLeak(c.values)
-		if err != nil {
-			t.Errorf("%v: %v", c.values, err)
-			continue
-		}
-		if !slices.Equal(leaks, c.leaks) {
-			t.Errorf("%v: got %v, want %v", c.values, leaks, c.leaks)
-		}
-		if got := BlocksSystemDNS(leaks); got != c.systemDNS {
-			t.Errorf("%v: BlocksSystemDNS() = %v", c.values, got)
-		}
-	}
-	for _, value := range []string{"", "ip", "tcp", "tcp/", "tcp/0", "udp/65536", "tcp/-1", "tcp/+53", "tcp/53/1", "udp/abc", "icmp/1", "tcp:53", " dns"} {
-		if _, err := ExpandWfpBlockLeak([]string{value}); err == nil {
-			t.Errorf("%q was accepted", value)
-		}
-	}
-}

transport/internet/system_listener.go

@@ -89,6 +89,9 @@ func (dl *DefaultListener) Listen(ctx context.Context, addr net.Addr, sockopt *S
 		lc.Control = getControlFunc(ctx, sockopt, dl.controllers)
 		// default disable keepalive
 		lc.KeepAlive = -1
+		// MPTCP is enabled by default golang listener
+		// due to CVE-2026-98432, MPTCP should be disabled by default
+		lc.SetMultipathTCP(false)
 		if sockopt != nil {
 			if sockopt.TcpKeepAliveIdle*sockopt.TcpKeepAliveInterval < 0 {
 				return nil, errors.New("invalid TcpKeepAliveIdle or TcpKeepAliveInterval value: ", sockopt.TcpKeepAliveIdle, " ", sockopt.TcpKeepAliveInterval)