Fix WireGuard inbound domain-based routing by storing sniffing config at init time

The root cause of issue #4760 was that the sniffing configuration and inbound tag
were being stored during Process() instead of at initialization time. This caused
a race condition where concurrent connections would overwrite each other's session
information, breaking domain-based routing.

The fix follows the same pattern as the TUN handler:
- Save tag and sniffingRequest during NewServer (at creation time)
- Use these saved values in forwardConnection for each new connection

This ensures that each connection uses the correct sniffing configuration that was
set for the inbound, regardless of concurrent connections from multiple WireGuard peers.

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>

SECURITY.md

@@ -1,5 +0,0 @@
-# Security Policy
-
-If you found an issue related to security vulnerability or protocol-identification problem, please report it to us via "[Report a vulnerability](https://github.com/XTLS/Xray-core/security/advisories/new)" privately, instead of publish it publicly before we release the fixed version.
-
-Thanks for your contribution to the FREE Internet!

app/dns/dns.go

@@ -12,12 +12,15 @@ import (
 	"sync"
 	"time"
 
+	router "github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/common/strmatcher"
 	"github.com/xtls/xray-core/features/dns"
+	"google.golang.org/protobuf/proto"
 )
 
 // DNS is a DNS rely server.
@@ -97,6 +100,25 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 	}
 
 	for _, ns := range config.NameServer {
+		if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+			err := parseDomains(ns)
+			if err != nil {
+				return nil, errors.New("failed to parse dns domain rules: ").Base(err)
+			}
+
+			expectedGeoip, err := router.GetGeoIPList(ns.ExpectedGeoip)
+			if err != nil {
+				return nil, errors.New("failed to parse dns expectIPs rules: ").Base(err)
+			}
+			ns.ExpectedGeoip = expectedGeoip
+
+			unexpectedGeoip, err := router.GetGeoIPList(ns.UnexpectedGeoip)
+			if err != nil {
+				return nil, errors.New("failed to parse dns unexpectedGeoip rules: ").Base(err)
+			}
+			ns.UnexpectedGeoip = unexpectedGeoip
+
+		}
 		domainRuleCount += len(ns.PrioritizedDomain)
 	}
 
@@ -580,3 +602,76 @@ func detectGUIPlatform() bool {
 	}
 	return false
 }
+
+func parseDomains(ns *NameServer) error {
+	pureDomains := []*router.Domain{}
+
+	// convert to pure domain
+	for _, pd := range ns.PrioritizedDomain {
+		pureDomains = append(pureDomains, &router.Domain{
+			Type:  router.Domain_Type(pd.Type),
+			Value: pd.Domain,
+		})
+	}
+
+	domainList := []*router.Domain{}
+	for _, domain := range pureDomains {
+		val := strings.Split(domain.Value, "_")
+		if len(val) >= 2 {
+
+			fileName := val[0]
+			code := val[1]
+
+			bs, err := filesystem.ReadAsset(fileName)
+			if err != nil {
+				return errors.New("failed to load file: ", fileName).Base(err)
+			}
+			bs = filesystem.Find(bs, []byte(code))
+			var geosite router.GeoSite
+
+			if err := proto.Unmarshal(bs, &geosite); err != nil {
+				return errors.New("failed Unmarshal :").Base(err)
+			}
+
+			// parse attr
+			if len(val) == 3 {
+				siteWithAttr := strings.Split(val[2], ",")
+				attrs := router.ParseAttrs(siteWithAttr)
+				if !attrs.IsEmpty() {
+					filteredDomains := make([]*router.Domain, 0, len(pureDomains))
+					for _, domain := range geosite.Domain {
+						if attrs.Match(domain) {
+							filteredDomains = append(filteredDomains, domain)
+						}
+					}
+					geosite.Domain = filteredDomains
+				}
+
+			}
+
+			domainList = append(domainList, geosite.Domain...)
+
+			// update ns.OriginalRules Size
+			ruleTag := strings.Join(val, ":")
+			for i, oRule := range ns.OriginalRules {
+				if oRule.Rule == strings.ToLower(ruleTag) {
+					ns.OriginalRules[i].Size = uint32(len(geosite.Domain))
+				}
+			}
+
+		} else {
+			domainList = append(domainList, domain)
+		}
+	}
+
+	// convert back to NameServer_PriorityDomain
+	ns.PrioritizedDomain = []*NameServer_PriorityDomain{}
+	for _, pd := range domainList {
+		ns.PrioritizedDomain = append(ns.PrioritizedDomain, &NameServer_PriorityDomain{
+			Type:   ToDomainMatchingType(pd.Type),
+			Domain: pd.Value,
+		})
+	}
+
+	return nil
+}

app/dns/dns_test.go

@@ -541,7 +541,7 @@ func TestIPMatch(t *testing.T) {
 						},
 						ExpectedGeoip: []*router.GeoIP{
 							{
-								CountryCode: "local",
+								// local
 								Cidr: []*router.CIDR{
 									{
 										// inner ip, will not match
@@ -565,7 +565,7 @@ func TestIPMatch(t *testing.T) {
 						},
 						ExpectedGeoip: []*router.GeoIP{
 							{
-								CountryCode: "test",
+								// test
 								Cidr: []*router.CIDR{
 									{
 										Ip:     []byte{8, 8, 8, 8},
@@ -574,7 +574,7 @@ func TestIPMatch(t *testing.T) {
 								},
 							},
 							{
-								CountryCode: "test",
+								// test
 								Cidr: []*router.CIDR{
 									{
 										Ip:     []byte{8, 8, 8, 4},
@@ -669,7 +669,7 @@ func TestLocalDomain(t *testing.T) {
 						},
 						ExpectedGeoip: []*router.GeoIP{
 							{ // Will match localhost, localhost-a and localhost-b,
-								CountryCode: "local",
+								// local
 								Cidr: []*router.CIDR{
 									{Ip: []byte{127, 0, 0, 2}, Prefix: 32},
 									{Ip: []byte{127, 0, 0, 3}, Prefix: 32},

app/dns/nameserver.go

@@ -297,3 +297,18 @@ func ResolveIpOptionOverride(queryStrategy QueryStrategy, ipOption dns.IPOption)
 		return ipOption
 	}
 }
+
+func ToDomainMatchingType(t router.Domain_Type) DomainMatchingType {
+	switch t {
+	case router.Domain_Domain:
+		return DomainMatchingType_Subdomain
+	case router.Domain_Full:
+		return DomainMatchingType_Full
+	case router.Domain_Plain:
+		return DomainMatchingType_Keyword
+	case router.Domain_Regex:
+		return DomainMatchingType_Regex
+	default:
+		panic("unknown domain type")
+	}
+}

app/router/condition.go

@@ -309,6 +309,48 @@ func (m *AttributeMatcher) Apply(ctx routing.Context) bool {
 	return m.Match(attributes)
 }
 
+// Geo attribute
+type GeoAttributeMatcher interface {
+	Match(*Domain) bool
+}
+
+type GeoBooleanMatcher string
+
+func (m GeoBooleanMatcher) Match(domain *Domain) bool {
+	for _, attr := range domain.Attribute {
+		if attr.Key == string(m) {
+			return true
+		}
+	}
+	return false
+}
+
+type GeoAttributeList struct {
+	Matcher []GeoAttributeMatcher
+}
+
+func (al *GeoAttributeList) Match(domain *Domain) bool {
+	for _, matcher := range al.Matcher {
+		if !matcher.Match(domain) {
+			return false
+		}
+	}
+	return true
+}
+
+func (al *GeoAttributeList) IsEmpty() bool {
+	return len(al.Matcher) == 0
+}
+
+func ParseAttrs(attrs []string) *GeoAttributeList {
+	al := new(GeoAttributeList)
+	for _, attr := range attrs {
+		lc := strings.ToLower(attr)
+		al.Matcher = append(al.Matcher, GeoBooleanMatcher(lc))
+	}
+	return al
+}
+
 type ProcessNameMatcher struct {
 	ProcessNames  []string
 	AbsPaths      []string
@@ -397,4 +439,4 @@ func (m *ProcessNameMatcher) Apply(ctx routing.Context) bool {
 		}
 	}
 	return false
-}
+}

app/router/condition_geoip_test.go

@@ -1,40 +1,17 @@
 package router_test
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/platform"
-	"github.com/xtls/xray-core/common/platform/filesystem"
-	"google.golang.org/protobuf/proto"
+	"github.com/xtls/xray-core/infra/conf"
 )
 
-func getAssetPath(file string) (string, error) {
-	path := platform.GetAssetLocation(file)
-	_, err := os.Stat(path)
-	if os.IsNotExist(err) {
-		path := filepath.Join("..", "..", "resources", file)
-		_, err := os.Stat(path)
-		if os.IsNotExist(err) {
-			return "", fmt.Errorf("can't find %s in standard asset locations or {project_root}/resources", file)
-		}
-		if err != nil {
-			return "", fmt.Errorf("can't stat %s: %v", path, err)
-		}
-		return path, nil
-	}
-	if err != nil {
-		return "", fmt.Errorf("can't stat %s: %v", path, err)
-	}
-
-	return path, nil
-}
-
 func TestGeoIPMatcher(t *testing.T) {
 	cidrList := []*router.CIDR{
 		{Ip: []byte{0, 0, 0, 0}, Prefix: 8},
@@ -182,12 +159,11 @@ func TestGeoIPReverseMatcher(t *testing.T) {
 }
 
 func TestGeoIPMatcher4CN(t *testing.T) {
-	ips, err := loadGeoIP("CN")
+	geo := "geoip:cn"
+	geoip, err := loadGeoIP(geo)
 	common.Must(err)
 
-	matcher, err := router.BuildOptimizedGeoIPMatcher(&router.GeoIP{
-		Cidr: ips,
-	})
+	matcher, err := router.BuildOptimizedGeoIPMatcher(geoip)
 	common.Must(err)
 
 	if matcher.Match([]byte{8, 8, 8, 8}) {
@@ -196,12 +172,11 @@ func TestGeoIPMatcher4CN(t *testing.T) {
 }
 
 func TestGeoIPMatcher6US(t *testing.T) {
-	ips, err := loadGeoIP("US")
+	geo := "geoip:us"
+	geoip, err := loadGeoIP(geo)
 	common.Must(err)
 
-	matcher, err := router.BuildOptimizedGeoIPMatcher(&router.GeoIP{
-		Cidr: ips,
-	})
+	matcher, err := router.BuildOptimizedGeoIPMatcher(geoip)
 	common.Must(err)
 
 	if !matcher.Match(net.ParseAddress("2001:4860:4860::8888").IP()) {
@@ -209,37 +184,34 @@ func TestGeoIPMatcher6US(t *testing.T) {
 	}
 }
 
-func loadGeoIP(country string) ([]*router.CIDR, error) {
-	path, err := getAssetPath("geoip.dat")
-	if err != nil {
-		return nil, err
-	}
-	geoipBytes, err := filesystem.ReadFile(path)
+func loadGeoIP(geo string) (*router.GeoIP, error) {
+	os.Setenv("XRAY_LOCATION_ASSET", filepath.Join("..", "..", "resources"))
+
+	geoip, err := conf.ToCidrList([]string{geo})
 	if err != nil {
 		return nil, err
 	}
 
-	var geoipList router.GeoIPList
-	if err := proto.Unmarshal(geoipBytes, &geoipList); err != nil {
-		return nil, err
-	}
-
-	for _, geoip := range geoipList.Entry {
-		if geoip.CountryCode == country {
-			return geoip.Cidr, nil
+	if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+		geoip, err = router.GetGeoIPList(geoip)
+		if err != nil {
+			return nil, err
 		}
 	}
 
-	panic("country not found: " + country)
+	if len(geoip) == 0 {
+		panic("country not found: " + geo)
+	}
+
+	return geoip[0], nil
 }
 
 func BenchmarkGeoIPMatcher4CN(b *testing.B) {
-	ips, err := loadGeoIP("CN")
+	geo := "geoip:cn"
+	geoip, err := loadGeoIP(geo)
 	common.Must(err)
 
-	matcher, err := router.BuildOptimizedGeoIPMatcher(&router.GeoIP{
-		Cidr: ips,
-	})
+	matcher, err := router.BuildOptimizedGeoIPMatcher(geoip)
 	common.Must(err)
 
 	b.ResetTimer()
@@ -250,12 +222,11 @@ func BenchmarkGeoIPMatcher4CN(b *testing.B) {
 }
 
 func BenchmarkGeoIPMatcher6US(b *testing.B) {
-	ips, err := loadGeoIP("US")
+	geo := "geoip:us"
+	geoip, err := loadGeoIP(geo)
 	common.Must(err)
 
-	matcher, err := router.BuildOptimizedGeoIPMatcher(&router.GeoIP{
-		Cidr: ips,
-	})
+	matcher, err := router.BuildOptimizedGeoIPMatcher(geoip)
 	common.Must(err)
 
 	b.ResetTimer()

app/router/condition_test.go

@@ -1,20 +1,22 @@
 package router_test
 
 import (
+	"os"
+	"path/filepath"
+	"runtime"
 	"strconv"
 	"testing"
 
+	"github.com/xtls/xray-core/app/router"
 	. "github.com/xtls/xray-core/app/router"
 	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/common/protocol"
 	"github.com/xtls/xray-core/common/protocol/http"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/features/routing"
 	routing_session "github.com/xtls/xray-core/features/routing/session"
-	"google.golang.org/protobuf/proto"
+	"github.com/xtls/xray-core/infra/conf"
 )
 
 func withBackground() routing.Context {
@@ -300,32 +302,25 @@ func TestRoutingRule(t *testing.T) {
 	}
 }
 
-func loadGeoSite(country string) ([]*Domain, error) {
-	path, err := getAssetPath("geosite.dat")
-	if err != nil {
-		return nil, err
-	}
-	geositeBytes, err := filesystem.ReadFile(path)
+func loadGeoSiteDomains(geo string) ([]*Domain, error) {
+	os.Setenv("XRAY_LOCATION_ASSET", filepath.Join("..", "..", "resources"))
+
+	domains, err := conf.ParseDomainRule(geo)
 	if err != nil {
 		return nil, err
 	}
 
-	var geositeList GeoSiteList
-	if err := proto.Unmarshal(geositeBytes, &geositeList); err != nil {
-		return nil, err
-	}
-
-	for _, site := range geositeList.Entry {
-		if site.CountryCode == country {
-			return site.Domain, nil
+	if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+		domains, err = router.GetDomainList(domains)
+		if err != nil {
+			return nil, err
 		}
 	}
-
-	return nil, errors.New("country not found: " + country)
+	return domains, nil
 }
 
 func TestChinaSites(t *testing.T) {
-	domains, err := loadGeoSite("CN")
+	domains, err := loadGeoSiteDomains("geosite:cn")
 	common.Must(err)
 
 	acMatcher, err := NewMphMatcherGroup(domains)
@@ -366,8 +361,50 @@ func TestChinaSites(t *testing.T) {
 	}
 }
 
+func TestChinaSitesWithAttrs(t *testing.T) {
+	domains, err := loadGeoSiteDomains("geosite:google@cn")
+	common.Must(err)
+
+	acMatcher, err := NewMphMatcherGroup(domains)
+	common.Must(err)
+
+	type TestCase struct {
+		Domain string
+		Output bool
+	}
+	testCases := []TestCase{
+		{
+			Domain: "google.cn",
+			Output: true,
+		},
+		{
+			Domain: "recaptcha.net",
+			Output: true,
+		},
+		{
+			Domain: "164.com",
+			Output: false,
+		},
+		{
+			Domain: "164.com",
+			Output: false,
+		},
+	}
+
+	for i := 0; i < 1024; i++ {
+		testCases = append(testCases, TestCase{Domain: strconv.Itoa(i) + ".not-exists.com", Output: false})
+	}
+
+	for _, testCase := range testCases {
+		r := acMatcher.ApplyDomain(testCase.Domain)
+		if r != testCase.Output {
+			t.Error("ACDomainMatcher expected output ", testCase.Output, " for domain ", testCase.Domain, " but got ", r)
+		}
+	}
+}
+
 func BenchmarkMphDomainMatcher(b *testing.B) {
-	domains, err := loadGeoSite("CN")
+	domains, err := loadGeoSiteDomains("geosite:cn")
 	common.Must(err)
 
 	matcher, err := NewMphMatcherGroup(domains)
@@ -412,11 +449,11 @@ func BenchmarkMultiGeoIPMatcher(b *testing.B) {
 	var geoips []*GeoIP
 
 	{
-		ips, err := loadGeoIP("CN")
+		ips, err := loadGeoIP("geoip:cn")
 		common.Must(err)
 		geoips = append(geoips, &GeoIP{
 			CountryCode: "CN",
-			Cidr:        ips,
+			Cidr:        ips.Cidr,
 		})
 	}
 
@@ -425,25 +462,25 @@ func BenchmarkMultiGeoIPMatcher(b *testing.B) {
 		common.Must(err)
 		geoips = append(geoips, &GeoIP{
 			CountryCode: "JP",
-			Cidr:        ips,
+			Cidr:        ips.Cidr,
 		})
 	}
 
 	{
-		ips, err := loadGeoIP("CA")
+		ips, err := loadGeoIP("geoip:ca")
 		common.Must(err)
 		geoips = append(geoips, &GeoIP{
 			CountryCode: "CA",
-			Cidr:        ips,
+			Cidr:        ips.Cidr,
 		})
 	}
 
 	{
-		ips, err := loadGeoIP("US")
+		ips, err := loadGeoIP("geoip:us")
 		common.Must(err)
 		geoips = append(geoips, &GeoIP{
 			CountryCode: "US",
-			Cidr:        ips,
+			Cidr:        ips.Cidr,
 		})
 	}
 

app/router/config.go

@@ -3,11 +3,14 @@ package router
 import (
 	"context"
 	"regexp"
+	"runtime"
 	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/platform/filesystem"
 	"github.com/xtls/xray-core/features/outbound"
 	"github.com/xtls/xray-core/features/routing"
+	"google.golang.org/protobuf/proto"
 )
 
 type Rule struct {
@@ -73,7 +76,15 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 	}
 
 	if len(rr.Geoip) > 0 {
-		cond, err := NewIPMatcher(rr.Geoip, MatcherAsType_Target)
+		geoip := rr.Geoip
+		if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+			var err error
+			geoip, err = GetGeoIPList(rr.Geoip)
+			if err != nil {
+				return nil, errors.New("failed to build geoip from mmap").Base(err)
+			}
+		}
+		cond, err := NewIPMatcher(geoip, MatcherAsType_Target)
 		if err != nil {
 			return nil, err
 		}
@@ -98,11 +109,20 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 	}
 
 	if len(rr.Domain) > 0 {
-		matcher, err := NewMphMatcherGroup(rr.Domain)
+		domains := rr.Domain
+		if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+			var err error
+			domains, err = GetDomainList(rr.Domain)
+			if err != nil {
+				return nil, errors.New("failed to build domains from mmap").Base(err)
+			}
+		}
+
+		matcher, err := NewMphMatcherGroup(domains)
 		if err != nil {
 			return nil, errors.New("failed to build domain condition with MphDomainMatcher").Base(err)
 		}
-		errors.LogDebug(context.Background(), "MphDomainMatcher is enabled for ", len(rr.Domain), " domain rule(s)")
+		errors.LogDebug(context.Background(), "MphDomainMatcher is enabled for ", len(domains), " domain rule(s)")
 		conds.Add(matcher)
 	}
 
@@ -163,3 +183,80 @@ func (br *BalancingRule) Build(ohm outbound.Manager, dispatcher routing.Dispatch
 		return nil, errors.New("unrecognized balancer type")
 	}
 }
+
+func GetGeoIPList(ips []*GeoIP) ([]*GeoIP, error) {
+	geoipList := []*GeoIP{}
+	for _, ip := range ips {
+		if ip.CountryCode != "" {
+			val := strings.Split(ip.CountryCode, "_")
+			fileName := "geoip.dat"
+			if len(val) == 2 {
+				fileName = strings.ToLower(val[0])
+			}
+			bs, err := filesystem.ReadAsset(fileName)
+			if err != nil {
+				return nil, errors.New("failed to load file: ", fileName).Base(err)
+			}
+			bs = filesystem.Find(bs, []byte(ip.CountryCode))
+
+			var geoip GeoIP
+
+			if err := proto.Unmarshal(bs, &geoip); err != nil {
+				return nil, errors.New("failed Unmarshal :").Base(err)
+			}
+			geoipList = append(geoipList, &geoip)
+
+		} else {
+			geoipList = append(geoipList, ip)
+		}
+	}
+	return geoipList, nil
+
+}
+
+func GetDomainList(domains []*Domain) ([]*Domain, error) {
+	domainList := []*Domain{}
+	for _, domain := range domains {
+		val := strings.Split(domain.Value, "_")
+
+		if len(val) >= 2 {
+
+			fileName := val[0]
+			code := val[1]
+
+			bs, err := filesystem.ReadAsset(fileName)
+			if err != nil {
+				return nil, errors.New("failed to load file: ", fileName).Base(err)
+			}
+			bs = filesystem.Find(bs, []byte(code))
+			var geosite GeoSite
+
+			if err := proto.Unmarshal(bs, &geosite); err != nil {
+				return nil, errors.New("failed Unmarshal :").Base(err)
+			}
+
+			// parse attr
+			if len(val) == 3 {
+				siteWithAttr := strings.Split(val[2], ",")
+				attrs := ParseAttrs(siteWithAttr)
+
+				if !attrs.IsEmpty() {
+					filteredDomains := make([]*Domain, 0, len(domains))
+					for _, domain := range geosite.Domain {
+						if attrs.Match(domain) {
+							filteredDomains = append(filteredDomains, domain)
+						}
+					}
+					geosite.Domain = filteredDomains
+				}
+
+			}
+
+			domainList = append(domainList, geosite.Domain...)
+
+		} else {
+			domainList = append(domainList, domain)
+		}
+	}
+	return domainList, nil
+}

common/platform/filesystem/asset_tools.go

@@ -0,0 +1,52 @@
+package filesystem
+
+func DecodeVarint(buf []byte) (x uint64, n int) {
+	for shift := uint(0); shift < 64; shift += 7 {
+		if n >= len(buf) {
+			return 0, 0
+		}
+		b := uint64(buf[n])
+		n++
+		x |= (b & 0x7F) << shift
+		if (b & 0x80) == 0 {
+			return x, n
+		}
+	}
+
+	// The number is too large to represent in a 64-bit value.
+	return 0, 0
+}
+
+func Find(data, code []byte) []byte {
+	codeL := len(code)
+	if codeL == 0 {
+		return nil
+	}
+	for {
+		dataL := len(data)
+		if dataL < 2 {
+			return nil
+		}
+		x, y := DecodeVarint(data[1:])
+		if x == 0 && y == 0 {
+			return nil
+		}
+		headL, bodyL := 1+y, int(x)
+		dataL -= headL
+		if dataL < bodyL {
+			return nil
+		}
+		data = data[headL:]
+		if int(data[1]) == codeL {
+			for i := 0; i < codeL && data[2+i] == code[i]; i++ {
+				if i+1 == codeL {
+					return data[:bodyL]
+				}
+			}
+		}
+		if dataL == bodyL {
+			return nil
+		}
+		data = data[bodyL:]
+	}
+}

common/platform/filesystem/file.go

@@ -1,9 +1,12 @@
+//go:build !windows && !wasm
+
 package filesystem
 
 import (
 	"io"
 	"os"
 	"path/filepath"
+	"syscall"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -16,6 +19,29 @@ var NewFileReader FileReaderFunc = func(path string) (io.ReadCloser, error) {
 }
 
 func ReadFile(path string) ([]byte, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	stat, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+
+	size := stat.Size()
+	if size == 0 {
+		return []byte{}, nil
+	}
+
+	// use mmap to save RAM
+	bs, err := syscall.Mmap(int(file.Fd()), 0, int(size), syscall.PROT_READ, syscall.MAP_SHARED)
+	if err == nil {
+		return bs, nil
+	}
+
+	// fallback
 	reader, err := NewFileReader(path)
 	if err != nil {
 		return nil, err

common/platform/filesystem/file_other.go

@@ -0,0 +1,54 @@
+//go:build windows || wasm
+
+package filesystem
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/xtls/xray-core/common/buf"
+	"github.com/xtls/xray-core/common/platform"
+)
+
+type FileReaderFunc func(path string) (io.ReadCloser, error)
+
+var NewFileReader FileReaderFunc = func(path string) (io.ReadCloser, error) {
+	return os.Open(path)
+}
+
+func ReadFile(path string) ([]byte, error) {
+	reader, err := NewFileReader(path)
+	if err != nil {
+		return nil, err
+	}
+	defer reader.Close()
+
+	return buf.ReadAllToBytes(reader)
+}
+
+func ReadAsset(file string) ([]byte, error) {
+	return ReadFile(platform.GetAssetLocation(file))
+}
+
+func ReadCert(file string) ([]byte, error) {
+	if filepath.IsAbs(file) {
+		return ReadFile(file)
+	}
+	return ReadFile(platform.GetCertLocation(file))
+}
+
+func CopyFile(dst string, src string) error {
+	bytes, err := ReadFile(src)
+	if err != nil {
+		return err
+	}
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	_, err = f.Write(bytes)
+	return err
+}

common/platform/windows.go

@@ -3,7 +3,9 @@
 
 package platform
 
-import "path/filepath"
+import (
+	"path/filepath"
+)
 
 func LineSeparator() string {
 	return "\r\n"
@@ -12,6 +14,7 @@ func LineSeparator() string {
 // GetAssetLocation searches for `file` in the env dir and the executable dir
 func GetAssetLocation(file string) string {
 	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
+
 	return filepath.Join(assetPath, file)
 }
 

core/core.go

@@ -19,7 +19,7 @@ import (
 var (
 	Version_x byte = 26
 	Version_y byte = 1
-	Version_z byte = 18
+	Version_z byte = 13
 )
 
 var (

go.mod

@@ -1,6 +1,6 @@
 module github.com/xtls/xray-core
 
-go 1.25.6
+go 1.25.5
 
 require (
 	github.com/apernet/quic-go v0.57.2-0.20260111184307-eec823306178

infra/conf/dns.go

@@ -80,21 +80,6 @@ func (c *NameServerConfig) UnmarshalJSON(data []byte) error {
 	return errors.New("failed to parse name server: ", string(data))
 }
 
-func toDomainMatchingType(t router.Domain_Type) dns.DomainMatchingType {
-	switch t {
-	case router.Domain_Domain:
-		return dns.DomainMatchingType_Subdomain
-	case router.Domain_Full:
-		return dns.DomainMatchingType_Full
-	case router.Domain_Plain:
-		return dns.DomainMatchingType_Keyword
-	case router.Domain_Regex:
-		return dns.DomainMatchingType_Regex
-	default:
-		panic("unknown domain type")
-	}
-}
-
 func (c *NameServerConfig) Build() (*dns.NameServer, error) {
 	if c.Address == nil {
 		return nil, errors.New("NameServer address is not specified.")
@@ -104,14 +89,14 @@ func (c *NameServerConfig) Build() (*dns.NameServer, error) {
 	var originalRules []*dns.NameServer_OriginalRule
 
 	for _, rule := range c.Domains {
-		parsedDomain, err := parseDomainRule(rule)
+		parsedDomain, err := ParseDomainRule(rule)
 		if err != nil {
 			return nil, errors.New("invalid domain rule: ", rule).Base(err)
 		}
 
 		for _, pd := range parsedDomain {
 			domains = append(domains, &dns.NameServer_PriorityDomain{
-				Type:   toDomainMatchingType(pd.Type),
+				Type:   dns.ToDomainMatchingType(pd.Type),
 				Domain: pd.Value,
 			})
 		}

infra/conf/router.go

@@ -203,17 +203,23 @@ func loadFile(file string) ([]byte, error) {
 func loadIP(file, code string) ([]*router.CIDR, error) {
 	index := file + ":" + code
 	if IPCache[index] == nil {
-		bs, err := loadFile(file)
-		if err != nil {
-			return nil, errors.New("failed to load file: ", file).Base(err)
-		}
-		bs = find(bs, []byte(code))
-		if bs == nil {
-			return nil, errors.New("code not found in ", file, ": ", code)
-		}
 		var geoip router.GeoIP
-		if err := proto.Unmarshal(bs, &geoip); err != nil {
-			return nil, errors.New("error unmarshal IP in ", file, ": ", code).Base(err)
+
+		if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+			// dont pass code becuase we have country code in top level router.GeoIP
+			geoip = router.GeoIP{Cidr: []*router.CIDR{}}
+		} else {
+			bs, err := loadFile(file)
+			if err != nil {
+				return nil, errors.New("failed to load file: ", file).Base(err)
+			}
+			bs = filesystem.Find(bs, []byte(code))
+			if bs == nil {
+				return nil, errors.New("code not found in ", file, ": ", code)
+			}
+			if err := proto.Unmarshal(bs, &geoip); err != nil {
+				return nil, errors.New("error unmarshal IP in ", file, ": ", code).Base(err)
+			}
 		}
 		defer runtime.GC()     // or debug.FreeOSMemory()
 		return geoip.Cidr, nil // do not cache geoip
@@ -225,18 +231,28 @@ func loadIP(file, code string) ([]*router.CIDR, error) {
 func loadSite(file, code string) ([]*router.Domain, error) {
 	index := file + ":" + code
 	if SiteCache[index] == nil {
-		bs, err := loadFile(file)
-		if err != nil {
-			return nil, errors.New("failed to load file: ", file).Base(err)
-		}
-		bs = find(bs, []byte(code))
-		if bs == nil {
-			return nil, errors.New("list not found in ", file, ": ", code)
-		}
 		var geosite router.GeoSite
-		if err := proto.Unmarshal(bs, &geosite); err != nil {
-			return nil, errors.New("error unmarshal Site in ", file, ": ", code).Base(err)
+
+		if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+			// pass file:code so can build optimized matcher later
+			domain := router.Domain{Value: file + "_" + code}
+			geosite = router.GeoSite{Domain: []*router.Domain{&domain}}
+
+		} else {
+
+			bs, err := loadFile(file)
+			if err != nil {
+				return nil, errors.New("failed to load file: ", file).Base(err)
+			}
+			bs = filesystem.Find(bs, []byte(code))
+			if bs == nil {
+				return nil, errors.New("list not found in ", file, ": ", code)
+			}
+			if err := proto.Unmarshal(bs, &geosite); err != nil {
+				return nil, errors.New("error unmarshal Site in ", file, ": ", code).Base(err)
+			}
 		}
+
 		defer runtime.GC()         // or debug.FreeOSMemory()
 		return geosite.Domain, nil // do not cache geosite
 		SiteCache[index] = &geosite
@@ -244,105 +260,13 @@ func loadSite(file, code string) ([]*router.Domain, error) {
 	return SiteCache[index].Domain, nil
 }
 
-func DecodeVarint(buf []byte) (x uint64, n int) {
-	for shift := uint(0); shift < 64; shift += 7 {
-		if n >= len(buf) {
-			return 0, 0
-		}
-		b := uint64(buf[n])
-		n++
-		x |= (b & 0x7F) << shift
-		if (b & 0x80) == 0 {
-			return x, n
-		}
-	}
-
-	// The number is too large to represent in a 64-bit value.
-	return 0, 0
-}
-
-func find(data, code []byte) []byte {
-	codeL := len(code)
-	if codeL == 0 {
-		return nil
-	}
-	for {
-		dataL := len(data)
-		if dataL < 2 {
-			return nil
-		}
-		x, y := DecodeVarint(data[1:])
-		if x == 0 && y == 0 {
-			return nil
-		}
-		headL, bodyL := 1+y, int(x)
-		dataL -= headL
-		if dataL < bodyL {
-			return nil
-		}
-		data = data[headL:]
-		if int(data[1]) == codeL {
-			for i := 0; i < codeL && data[2+i] == code[i]; i++ {
-				if i+1 == codeL {
-					return data[:bodyL]
-				}
-			}
-		}
-		if dataL == bodyL {
-			return nil
-		}
-		data = data[bodyL:]
-	}
-}
-
-type AttributeMatcher interface {
-	Match(*router.Domain) bool
-}
-
-type BooleanMatcher string
-
-func (m BooleanMatcher) Match(domain *router.Domain) bool {
-	for _, attr := range domain.Attribute {
-		if attr.Key == string(m) {
-			return true
-		}
-	}
-	return false
-}
-
-type AttributeList struct {
-	matcher []AttributeMatcher
-}
-
-func (al *AttributeList) Match(domain *router.Domain) bool {
-	for _, matcher := range al.matcher {
-		if !matcher.Match(domain) {
-			return false
-		}
-	}
-	return true
-}
-
-func (al *AttributeList) IsEmpty() bool {
-	return len(al.matcher) == 0
-}
-
-func parseAttrs(attrs []string) *AttributeList {
-	al := new(AttributeList)
-	for _, attr := range attrs {
-		lc := strings.ToLower(attr)
-		al.matcher = append(al.matcher, BooleanMatcher(lc))
-	}
-	return al
-}
-
 func loadGeositeWithAttr(file string, siteWithAttr string) ([]*router.Domain, error) {
 	parts := strings.Split(siteWithAttr, "@")
 	if len(parts) == 0 {
 		return nil, errors.New("empty site")
 	}
 	country := strings.ToUpper(parts[0])
-	attrs := parseAttrs(parts[1:])
+	attrs := router.ParseAttrs(parts[1:])
 	domains, err := loadSite(file, country)
 	if err != nil {
 		return nil, err
@@ -352,6 +276,11 @@ func loadGeositeWithAttr(file string, siteWithAttr string) ([]*router.Domain, er
 		return domains, nil
 	}
 
+	if runtime.GOOS != "windows" && runtime.GOOS != "wasm" {
+		domains[0].Value = domains[0].Value + "_" + strings.Join(parts[1:], ",")
+		return domains, nil
+	}
+
 	filteredDomains := make([]*router.Domain, 0, len(domains))
 	for _, domain := range domains {
 		if attrs.Match(domain) {
@@ -362,7 +291,7 @@ func loadGeositeWithAttr(file string, siteWithAttr string) ([]*router.Domain, er
 	return filteredDomains, nil
 }
 
-func parseDomainRule(domain string) ([]*router.Domain, error) {
+func ParseDomainRule(domain string) ([]*router.Domain, error) {
 	if strings.HasPrefix(domain, "geosite:") {
 		country := strings.ToUpper(domain[8:])
 		domains, err := loadGeositeWithAttr("geosite.dat", country)
@@ -560,7 +489,7 @@ func parseFieldRule(msg json.RawMessage) (*router.RoutingRule, error) {
 
 	if rawFieldRule.Domain != nil {
 		for _, domain := range *rawFieldRule.Domain {
-			rules, err := parseDomainRule(domain)
+			rules, err := ParseDomainRule(domain)
 			if err != nil {
 				return nil, errors.New("failed to parse domain rule: ", domain).Base(err)
 			}
@@ -570,7 +499,7 @@ func parseFieldRule(msg json.RawMessage) (*router.RoutingRule, error) {
 
 	if rawFieldRule.Domains != nil {
 		for _, domain := range *rawFieldRule.Domains {
-			rules, err := parseDomainRule(domain)
+			rules, err := ParseDomainRule(domain)
 			if err != nil {
 				return nil, errors.New("failed to parse domain rule: ", domain).Base(err)
 			}

infra/conf/shadowsocks.go

@@ -50,8 +50,6 @@ type ShadowsocksServerConfig struct {
 }
 
 func (v *ShadowsocksServerConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("Shadowsocks", "VLESS Encryption")
-
 	if C.Contains(shadowaead_2022.List, v.Cipher) {
 		return buildShadowsocks2022(v)
 	}
@@ -187,8 +185,6 @@ type ShadowsocksClientConfig struct {
 }
 
 func (v *ShadowsocksClientConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("Shadowsocks", "VLESS Encryption")
-
 	if v.Address != nil {
 		v.Servers = []*ShadowsocksServerTarget{
 			{
@@ -259,7 +255,7 @@ func (v *ShadowsocksClientConfig) Build() (proto.Message, error) {
 		ss := &protocol.ServerEndpoint{
 			Address: server.Address.Build(),
 			Port:    uint32(server.Port),
-			User: &protocol.User{
+			User:    &protocol.User{
 				Level:   uint32(server.Level),
 				Email:   server.Email,
 				Account: serial.ToTypedMessage(account),

infra/conf/transport_internet.go

@@ -391,12 +391,11 @@ type UdpHop struct {
 }
 
 type HysteriaConfig struct {
-	Version    int32     `json:"version"`
-	Auth       string    `json:"auth"`
-	Congestion string    `json:"congestion"`
-	Up         Bandwidth `json:"up"`
-	Down       Bandwidth `json:"down"`
-	UdpHop     UdpHop    `json:"udphop"`
+	Version int32     `json:"version"`
+	Auth    string    `json:"auth"`
+	Up      Bandwidth `json:"up"`
+	Down    Bandwidth `json:"down"`
+	UdpHop  UdpHop    `json:"udphop"`
 
 	InitStreamReceiveWindow     uint64 `json:"initStreamReceiveWindow"`
 	MaxStreamReceiveWindow      uint64 `json:"maxStreamReceiveWindow"`
@@ -411,7 +410,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	if c.Version != 2 {
 		return nil, errors.New("version != 2")
 	}
-
 	up, err := c.Up.Bps()
 	if err != nil {
 		return nil, err
@@ -420,12 +418,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	if err != nil {
 		return nil, err
 	}
-
-	c.Congestion = strings.ToLower(c.Congestion)
-	if c.Congestion == "force-brutal" && up == 0 {
-		return nil, errors.New("force-brutal require up")
-	}
-
 	var hop *PortList
 	if err := json.Unmarshal(c.UdpHop.PortList, &hop); err != nil {
 		hop = &PortList{}
@@ -463,7 +455,6 @@ func (c *HysteriaConfig) Build() (proto.Message, error) {
 	config := &hysteria.Config{}
 	config.Version = c.Version
 	config.Auth = c.Auth
-	config.Congestion = c.Congestion
 	config.Up = up
 	config.Down = down
 	config.Ports = hop.Build().Ports()
@@ -596,9 +587,6 @@ func (c *TLSConfig) Build() (proto.Message, error) {
 	}
 	serverName := c.ServerName
 	config.AllowInsecure = c.Insecure
-	if config.AllowInsecure {
-		errors.PrintDeprecatedFeatureWarning("allowInsecure", "pinnedPeerCertSha256")
-	}
 	if len(c.ServerName) > 0 {
 		config.ServerName = serverName
 	}

infra/conf/trojan.go

@@ -39,8 +39,6 @@ type TrojanClientConfig struct {
 
 // Build implements Buildable
 func (c *TrojanClientConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("Trojan", "VLESS with flow")
-
 	if c.Address != nil {
 		c.Servers = []*TrojanServerTarget{
 			{
@@ -76,7 +74,7 @@ func (c *TrojanClientConfig) Build() (proto.Message, error) {
 		config.Server = &protocol.ServerEndpoint{
 			Address: rec.Address.Build(),
 			Port:    uint32(rec.Port),
-			User: &protocol.User{
+			User:    &protocol.User{
 				Level: uint32(rec.Level),
 				Email: rec.Email,
 				Account: serial.ToTypedMessage(&trojan.Account{
@@ -117,8 +115,6 @@ type TrojanServerConfig struct {
 
 // Build implements Buildable
 func (c *TrojanServerConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("Trojan", "VLESS with flow")
-
 	config := &trojan.ServerConfig{
 		Users: make([]*protocol.User, len(c.Clients)),
 	}

infra/conf/vless.go

@@ -42,6 +42,8 @@ func (c *VLessInboundConfig) Build() (proto.Message, error) {
 	config := new(inbound.Config)
 	config.Clients = make([]*protocol.User, len(c.Clients))
 	switch c.Flow {
+	case vless.None:
+		c.Flow = ""
 	case "", vless.XRV:
 	default:
 		return nil, errors.New(`VLESS "settings.flow" doesn't support "` + c.Flow + `" in this version`)
@@ -65,13 +67,12 @@ func (c *VLessInboundConfig) Build() (proto.Message, error) {
 		switch account.Flow {
 		case "":
 			account.Flow = c.Flow
+		case vless.None:
+			account.Flow = ""
 		case vless.XRV:
 		default:
 			return nil, errors.New(`VLESS clients: "flow" doesn't support "` + account.Flow + `" in this version`)
 		}
-		if account.Flow == "" {
-			errors.PrintDeprecatedFeatureWarning("VLESS without flow", "VLESS with flow")
-		}
 
 		if len(account.Testseed) < 4 {
 			account.Testseed = c.Testseed
@@ -279,9 +280,7 @@ func (c *VLessOutboundConfig) Build() (proto.Message, error) {
 			account.Id = u.String()
 
 			switch account.Flow {
-			case "":
-				errors.PrintDeprecatedFeatureWarning("VLESS without flow", "VLESS with flow")
-			case vless.XRV, vless.XRV + "-udp443":
+			case "", vless.XRV, vless.XRV + "-udp443":
 			default:
 				return nil, errors.New(`VLESS users: "flow" doesn't support "` + account.Flow + `" in this version`)
 			}

infra/conf/vmess.go

@@ -58,14 +58,12 @@ func (c *VMessDefaultConfig) Build() *inbound.DefaultConfig {
 }
 
 type VMessInboundConfig struct {
-	Users    []json.RawMessage   `json:"clients"`
-	Defaults *VMessDefaultConfig `json:"default"`
+	Users        []json.RawMessage   `json:"clients"`
+	Defaults     *VMessDefaultConfig `json:"default"`
 }
 
 // Build implements Buildable
 func (c *VMessInboundConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("VMess", "VLESS Encryption")
-
 	config := &inbound.Config{}
 
 	if c.Defaults != nil {
@@ -115,8 +113,6 @@ type VMessOutboundConfig struct {
 
 // Build implements Buildable
 func (c *VMessOutboundConfig) Build() (proto.Message, error) {
-	errors.PrintDeprecatedFeatureWarning("VMess", "VLESS Encryption")
-
 	config := new(outbound.Config)
 	if c.Address != nil {
 		c.Receivers = []*VMessOutboundTarget{

proxy/hysteria/client.go

@@ -17,7 +17,6 @@ import (
 	"github.com/xtls/xray-core/common/task"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/policy"
-	hyCtx "github.com/xtls/xray-core/proxy/hysteria/ctx"
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/hysteria"
@@ -56,7 +55,7 @@ func (c *Client) Process(ctx context.Context, link *transport.Link, dialer inter
 	ob.CanSpliceCopy = 3
 	target := ob.Target
 
-	conn, err := dialer.Dial(hyCtx.ContextWithRequireDatagram(ctx, target.Network == net.Network_UDP), c.server.Destination)
+	conn, err := dialer.Dial(ctx, c.server.Destination)
 	if err != nil {
 		return errors.New("failed to find an available destination").AtWarning().Base(err)
 	}

proxy/hysteria/ctx/ctx.go

@@ -1,23 +0,0 @@
-package ctx
-
-import (
-	"context"
-)
-
-type key int
-
-const (
-	requireDatagram key = iota
-)
-
-func ContextWithRequireDatagram(ctx context.Context, udp bool) context.Context {
-	if !udp {
-		return ctx
-	}
-	return context.WithValue(ctx, requireDatagram, struct{}{})
-}
-
-func RequireDatagramFromContext(ctx context.Context) bool {
-	_, ok := ctx.Value(requireDatagram).(struct{})
-	return ok
-}

proxy/tun/tun_darwin.go

@@ -1,169 +0,0 @@
-//go:build darwin
-
-package tun
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-const (
-	utunControlName = "com.apple.net.utun_control"
-	utunOptIfName   = 2
-	sysprotoControl = 2
-)
-
-type DarwinTun struct {
-	tunFd   int
-	name    string
-	options TunOptions
-}
-
-var _ Tun = (*DarwinTun)(nil)
-var _ GVisorTun = (*DarwinTun)(nil)
-
-func NewTun(options TunOptions) (Tun, error) {
-	tunFd, name, err := openUTun(options.Name)
-	if err != nil {
-		return nil, err
-	}
-
-	return &DarwinTun{
-		tunFd:   tunFd,
-		name:    name,
-		options: options,
-	}, nil
-}
-
-func (t *DarwinTun) Start() error {
-	if t.options.MTU > 0 {
-		if err := setMTU(t.name, int(t.options.MTU)); err != nil {
-			return err
-		}
-	}
-	return setState(t.name, true)
-}
-
-func (t *DarwinTun) Close() error {
-	_ = setState(t.name, false)
-	return unix.Close(t.tunFd)
-}
-
-func (t *DarwinTun) newEndpoint() (stack.LinkEndpoint, error) {
-	return newDarwinEndpoint(t.tunFd, t.options.MTU), nil
-}
-
-func openUTun(name string) (int, string, error) {
-	fd, err := unix.Socket(unix.AF_SYSTEM, unix.SOCK_DGRAM, sysprotoControl)
-	if err != nil {
-		return -1, "", err
-	}
-
-	ctlInfo := &unix.CtlInfo{}
-	copy(ctlInfo.Name[:], utunControlName)
-	if err := unix.IoctlCtlInfo(fd, ctlInfo); err != nil {
-		_ = unix.Close(fd)
-		return -1, "", err
-	}
-
-	sockaddr := &unix.SockaddrCtl{
-		ID:   ctlInfo.Id,
-		Unit: parseUTunUnit(name),
-	}
-
-	if err := unix.Connect(fd, sockaddr); err != nil {
-		_ = unix.Close(fd)
-		return -1, "", err
-	}
-
-	if err := unix.SetNonblock(fd, true); err != nil {
-		_ = unix.Close(fd)
-		return -1, "", err
-	}
-
-	tunName, err := unix.GetsockoptString(fd, sysprotoControl, utunOptIfName)
-	if err != nil {
-		_ = unix.Close(fd)
-		return -1, "", err
-	}
-
-	tunName = strings.TrimRight(tunName, "\x00")
-	if tunName == "" {
-		_ = unix.Close(fd)
-		return -1, "", errors.New("empty utun name")
-	}
-
-	return fd, tunName, nil
-}
-
-func parseUTunUnit(name string) uint32 {
-	var unit uint32
-	if _, err := fmt.Sscanf(name, "utun%d", &unit); err != nil {
-		return 0
-	}
-	return unit + 1
-}
-
-type ifreqMTU struct {
-	Name [unix.IFNAMSIZ]byte
-	MTU  int32
-	_    [12]byte
-}
-
-type ifreqFlags struct {
-	Name  [unix.IFNAMSIZ]byte
-	Flags int16
-	_     [14]byte
-}
-
-func setMTU(name string, mtu int) error {
-	if mtu <= 0 {
-		return nil
-	}
-
-	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = unix.Close(fd) }()
-
-	ifr := ifreqMTU{MTU: int32(mtu)}
-	copy(ifr.Name[:], name)
-	return ioctlPtr(fd, unix.SIOCSIFMTU, unsafe.Pointer(&ifr))
-}
-
-func setState(name string, up bool) error {
-	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = unix.Close(fd) }()
-
-	ifr := ifreqFlags{}
-	copy(ifr.Name[:], name)
-
-	if err := ioctlPtr(fd, unix.SIOCGIFFLAGS, unsafe.Pointer(&ifr)); err != nil {
-		return err
-	}
-
-	if up {
-		ifr.Flags |= unix.IFF_UP
-	} else {
-		ifr.Flags &^= unix.IFF_UP
-	}
-
-	return ioctlPtr(fd, unix.SIOCSIFFLAGS, unsafe.Pointer(&ifr))
-}
-
-func ioctlPtr(fd int, req uint, arg unsafe.Pointer) error {
-	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
-	if errno != 0 {
-		return errno
-	}
-	return nil
-}

proxy/tun/tun_darwin_endpoint.go

@@ -1,201 +0,0 @@
-//go:build darwin
-
-package tun
-
-import (
-	"context"
-	"encoding/binary"
-	"errors"
-
-	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-const utunHeaderSize = 4
-
-var ErrUnsupportedNetworkProtocol = errors.New("unsupported ip version")
-
-// DarwinEndpoint implements GVisor stack.LinkEndpoint
-var _ stack.LinkEndpoint = (*DarwinEndpoint)(nil)
-
-type DarwinEndpoint struct {
-	tunFd            int
-	mtu              uint32
-	dispatcherCancel context.CancelFunc
-}
-
-func newDarwinEndpoint(tunFd int, mtu uint32) *DarwinEndpoint {
-	return &DarwinEndpoint{
-		tunFd: tunFd,
-		mtu:   mtu,
-	}
-}
-
-func (e *DarwinEndpoint) MTU() uint32 {
-	return e.mtu
-}
-
-func (e *DarwinEndpoint) SetMTU(_ uint32) {
-	// not Implemented, as it is not expected GVisor will be asking tun device to be modified
-}
-
-func (e *DarwinEndpoint) MaxHeaderLength() uint16 {
-	return 0
-}
-
-func (e *DarwinEndpoint) LinkAddress() tcpip.LinkAddress {
-	return ""
-}
-
-func (e *DarwinEndpoint) SetLinkAddress(_ tcpip.LinkAddress) {
-	// not Implemented, as it is not expected GVisor will be asking tun device to be modified
-}
-
-func (e *DarwinEndpoint) Capabilities() stack.LinkEndpointCapabilities {
-	return stack.CapabilityRXChecksumOffload
-}
-
-func (e *DarwinEndpoint) Attach(dispatcher stack.NetworkDispatcher) {
-	if e.dispatcherCancel != nil {
-		e.dispatcherCancel()
-		e.dispatcherCancel = nil
-	}
-
-	if dispatcher != nil {
-		ctx, cancel := context.WithCancel(context.Background())
-		go e.dispatchLoop(ctx, dispatcher)
-		e.dispatcherCancel = cancel
-	}
-}
-
-func (e *DarwinEndpoint) IsAttached() bool {
-	return e.dispatcherCancel != nil
-}
-
-func (e *DarwinEndpoint) Wait() {
-}
-
-func (e *DarwinEndpoint) ARPHardwareType() header.ARPHardwareType {
-	return header.ARPHardwareNone
-}
-
-func (e *DarwinEndpoint) AddHeader(buffer *stack.PacketBuffer) {
-	// tun interface doesn't have link layer header, it will be added by the OS
-}
-
-func (e *DarwinEndpoint) ParseHeader(ptr *stack.PacketBuffer) bool {
-	return true
-}
-
-func (e *DarwinEndpoint) Close() {
-	if e.dispatcherCancel != nil {
-		e.dispatcherCancel()
-		e.dispatcherCancel = nil
-	}
-}
-
-func (e *DarwinEndpoint) SetOnCloseAction(_ func()) {
-}
-
-func (e *DarwinEndpoint) WritePackets(packetBufferList stack.PacketBufferList) (int, tcpip.Error) {
-	var n int
-	for _, packetBuffer := range packetBufferList.AsSlice() {
-		family, err := ipFamilyFromPacket(packetBuffer)
-		if err != nil {
-			return n, &tcpip.ErrAborted{}
-		}
-
-		var headerBytes [utunHeaderSize]byte
-		binary.BigEndian.PutUint32(headerBytes[:], family)
-
-		writeSlices := append([][]byte{headerBytes[:]}, packetBuffer.AsSlices()...)
-		if _, err := unix.Writev(e.tunFd, writeSlices); err != nil {
-			if errors.Is(err, unix.EAGAIN) {
-				return n, &tcpip.ErrWouldBlock{}
-			}
-			return n, &tcpip.ErrAborted{}
-		}
-		n++
-	}
-	return n, nil
-}
-
-func (e *DarwinEndpoint) dispatchLoop(ctx context.Context, dispatcher stack.NetworkDispatcher) {
-	readSize := int(e.mtu)
-	if readSize <= 0 {
-		readSize = 65535
-	}
-	readSize += utunHeaderSize
-
-	buf := make([]byte, readSize)
-	for ctx.Err() == nil {
-
-		n, err := unix.Read(e.tunFd, buf)
-		if err != nil {
-			if errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EINTR) {
-				continue
-			}
-			e.Attach(nil)
-			return
-		}
-		if n <= utunHeaderSize {
-			continue
-		}
-
-		networkProtocol, packet, err := parseUTunPacket(buf[:n])
-		if errors.Is(err, ErrUnsupportedNetworkProtocol) {
-			continue
-		}
-		if err != nil {
-			e.Attach(nil)
-			return
-		}
-
-		dispatcher.DeliverNetworkPacket(networkProtocol, packet)
-		packet.DecRef()
-	}
-}
-
-func parseUTunPacket(packet []byte) (tcpip.NetworkProtocolNumber, *stack.PacketBuffer, error) {
-	if len(packet) <= utunHeaderSize {
-		return 0, nil, errors.New("packet too short")
-	}
-
-	family := binary.BigEndian.Uint32(packet[:utunHeaderSize])
-	var networkProtocol tcpip.NetworkProtocolNumber
-	switch family {
-	case uint32(unix.AF_INET):
-		networkProtocol = header.IPv4ProtocolNumber
-	case uint32(unix.AF_INET6):
-		networkProtocol = header.IPv6ProtocolNumber
-	default:
-		return 0, nil, ErrUnsupportedNetworkProtocol
-	}
-
-	payload := packet[utunHeaderSize:]
-	packetBuffer := buffer.MakeWithData(payload)
-	return networkProtocol, stack.NewPacketBuffer(stack.PacketBufferOptions{
-		Payload:           packetBuffer,
-		IsForwardedPacket: true,
-	}), nil
-}
-
-func ipFamilyFromPacket(packetBuffer *stack.PacketBuffer) (uint32, error) {
-	for _, slice := range packetBuffer.AsSlices() {
-		if len(slice) == 0 {
-			continue
-		}
-		switch header.IPVersion(slice) {
-		case header.IPv4Version:
-			return uint32(unix.AF_INET), nil
-		case header.IPv6Version:
-			return uint32(unix.AF_INET6), nil
-		default:
-			return 0, ErrUnsupportedNetworkProtocol
-		}
-	}
-	return 0, errors.New("empty packet")
-}

proxy/tun/tun_default.go

@@ -1,4 +1,4 @@
-//go:build !linux && !windows && !android && !darwin
+//go:build !linux && !windows && !android
 
 package tun
 

proxy/wireguard/server.go

@@ -26,15 +26,15 @@ var nullDestination = net.TCPDestination(net.AnyIP, 0)
 type Server struct {
 	bindServer *netBindServer
 
-	info          routingInfo
-	policyManager policy.Manager
+	info            routingInfo
+	policyManager   policy.Manager
+	tag             string
+	sniffingRequest session.SniffingRequest
 }
 
 type routingInfo struct {
-	ctx         context.Context
-	dispatcher  routing.Dispatcher
-	inboundTag  *session.Inbound
-	contentTag  *session.Content
+	ctx        context.Context
+	dispatcher routing.Dispatcher
 }
 
 func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
@@ -58,6 +58,14 @@ func NewServer(ctx context.Context, conf *DeviceConfig) (*Server, error) {
 		policyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),
 	}
 
+	// Retrieve tag and sniffing config from context (set by AlwaysOnInboundHandler)
+	if inbound := session.InboundFromContext(ctx); inbound != nil {
+		server.tag = inbound.Tag
+	}
+	if content := session.ContentFromContext(ctx); content != nil {
+		server.sniffingRequest = content.SniffingRequest
+	}
+
 	tun, err := conf.createTun()(endpoints, int(conf.Mtu), server.forwardConnection)
 	if err != nil {
 		return nil, err
@@ -81,8 +89,6 @@ func (s *Server) Process(ctx context.Context, network net.Network, conn stat.Con
 	s.info = routingInfo{
 		ctx:        ctx,
 		dispatcher: dispatcher,
-		inboundTag: session.InboundFromContext(ctx),
-		contentTag: session.ContentFromContext(ctx),
 	}
 
 	ep, err := s.bindServer.ParseEndpoint(conn.RemoteAddr().String())
@@ -129,21 +135,21 @@ func (s *Server) forwardConnection(dest net.Destination, conn net.Conn) {
 	ctx, cancel := context.WithCancel(core.ToBackgroundDetachedContext(s.info.ctx))
 	sid := session.NewID()
 	ctx = c.ContextWithID(ctx, sid)
-	inbound := session.Inbound{} // since promiscuousModeHandler mixed-up context, we shallow copy inbound (tag) and content (configs)
-	if s.info.inboundTag != nil {
-		inbound = *s.info.inboundTag
-	}
-	inbound.Name = "wireguard"
-	inbound.CanSpliceCopy = 3
 
-	// overwrite the source to use the tun address for each sub context.
-	// Since gvisor.ForwarderRequest doesn't provide any info to associate the sub-context with the Parent context
-	// Currently we have no way to link to the original source address
-	inbound.Source = net.DestinationFromAddr(conn.RemoteAddr())
-	ctx = session.ContextWithInbound(ctx, &inbound)
-	if s.info.contentTag != nil {
-		ctx = session.ContextWithContent(ctx, s.info.contentTag)
+	inbound := session.Inbound{
+		Name:          "wireguard",
+		Tag:           s.tag,
+		CanSpliceCopy: 3,
+		// overwrite the source to use the tun address for each sub context.
+		// Since gvisor.ForwarderRequest doesn't provide any info to associate the sub-context with the Parent context
+		// Currently we have no way to link to the original source address
+		Source: net.DestinationFromAddr(conn.RemoteAddr()),
 	}
+
+	ctx = session.ContextWithInbound(ctx, &inbound)
+	ctx = session.ContextWithContent(ctx, &session.Content{
+		SniffingRequest: s.sniffingRequest,
+	})
 	ctx = session.SubContextFromMuxInbound(ctx)
 
 	plcy := s.policyManager.ForLevel(0)

transport/internet/hysteria/config.pb.go

@@ -25,18 +25,17 @@ type Config struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	Version                 int32                  `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
 	Auth                    string                 `protobuf:"bytes,2,opt,name=auth,proto3" json:"auth,omitempty"`
-	Congestion              string                 `protobuf:"bytes,3,opt,name=congestion,proto3" json:"congestion,omitempty"`
-	Up                      uint64                 `protobuf:"varint,4,opt,name=up,proto3" json:"up,omitempty"`
-	Down                    uint64                 `protobuf:"varint,5,opt,name=down,proto3" json:"down,omitempty"`
-	Ports                   []uint32               `protobuf:"varint,6,rep,packed,name=ports,proto3" json:"ports,omitempty"`
-	Interval                int64                  `protobuf:"varint,7,opt,name=interval,proto3" json:"interval,omitempty"`
-	InitStreamReceiveWindow uint64                 `protobuf:"varint,8,opt,name=init_stream_receive_window,json=initStreamReceiveWindow,proto3" json:"init_stream_receive_window,omitempty"`
-	MaxStreamReceiveWindow  uint64                 `protobuf:"varint,9,opt,name=max_stream_receive_window,json=maxStreamReceiveWindow,proto3" json:"max_stream_receive_window,omitempty"`
-	InitConnReceiveWindow   uint64                 `protobuf:"varint,10,opt,name=init_conn_receive_window,json=initConnReceiveWindow,proto3" json:"init_conn_receive_window,omitempty"`
-	MaxConnReceiveWindow    uint64                 `protobuf:"varint,11,opt,name=max_conn_receive_window,json=maxConnReceiveWindow,proto3" json:"max_conn_receive_window,omitempty"`
-	MaxIdleTimeout          int64                  `protobuf:"varint,12,opt,name=max_idle_timeout,json=maxIdleTimeout,proto3" json:"max_idle_timeout,omitempty"`
-	KeepAlivePeriod         int64                  `protobuf:"varint,13,opt,name=keep_alive_period,json=keepAlivePeriod,proto3" json:"keep_alive_period,omitempty"`
-	DisablePathMtuDiscovery bool                   `protobuf:"varint,14,opt,name=disable_path_mtu_discovery,json=disablePathMtuDiscovery,proto3" json:"disable_path_mtu_discovery,omitempty"`
+	Up                      uint64                 `protobuf:"varint,3,opt,name=up,proto3" json:"up,omitempty"`
+	Down                    uint64                 `protobuf:"varint,4,opt,name=down,proto3" json:"down,omitempty"`
+	Ports                   []uint32               `protobuf:"varint,5,rep,packed,name=ports,proto3" json:"ports,omitempty"`
+	Interval                int64                  `protobuf:"varint,6,opt,name=interval,proto3" json:"interval,omitempty"`
+	InitStreamReceiveWindow uint64                 `protobuf:"varint,7,opt,name=init_stream_receive_window,json=initStreamReceiveWindow,proto3" json:"init_stream_receive_window,omitempty"`
+	MaxStreamReceiveWindow  uint64                 `protobuf:"varint,8,opt,name=max_stream_receive_window,json=maxStreamReceiveWindow,proto3" json:"max_stream_receive_window,omitempty"`
+	InitConnReceiveWindow   uint64                 `protobuf:"varint,9,opt,name=init_conn_receive_window,json=initConnReceiveWindow,proto3" json:"init_conn_receive_window,omitempty"`
+	MaxConnReceiveWindow    uint64                 `protobuf:"varint,10,opt,name=max_conn_receive_window,json=maxConnReceiveWindow,proto3" json:"max_conn_receive_window,omitempty"`
+	MaxIdleTimeout          int64                  `protobuf:"varint,11,opt,name=max_idle_timeout,json=maxIdleTimeout,proto3" json:"max_idle_timeout,omitempty"`
+	KeepAlivePeriod         int64                  `protobuf:"varint,12,opt,name=keep_alive_period,json=keepAlivePeriod,proto3" json:"keep_alive_period,omitempty"`
+	DisablePathMtuDiscovery bool                   `protobuf:"varint,13,opt,name=disable_path_mtu_discovery,json=disablePathMtuDiscovery,proto3" json:"disable_path_mtu_discovery,omitempty"`
 	unknownFields           protoimpl.UnknownFields
 	sizeCache               protoimpl.SizeCache
 }
@@ -85,13 +84,6 @@ func (x *Config) GetAuth() string {
 	return ""
 }
 
-func (x *Config) GetCongestion() string {
-	if x != nil {
-		return x.Congestion
-	}
-	return ""
-}
-
 func (x *Config) GetUp() uint64 {
 	if x != nil {
 		return x.Up
@@ -173,25 +165,22 @@ var File_transport_internet_hysteria_config_proto protoreflect.FileDescriptor
 
 const file_transport_internet_hysteria_config_proto_rawDesc = "" +
 	"\n" +
-	"(transport/internet/hysteria/config.proto\x12 xray.transport.internet.hysteria\"\xa7\x04\n" +
+	"(transport/internet/hysteria/config.proto\x12 xray.transport.internet.hysteria\"\x87\x04\n" +
 	"\x06Config\x12\x18\n" +
 	"\aversion\x18\x01 \x01(\x05R\aversion\x12\x12\n" +
-	"\x04auth\x18\x02 \x01(\tR\x04auth\x12\x1e\n" +
-	"\n" +
-	"congestion\x18\x03 \x01(\tR\n" +
-	"congestion\x12\x0e\n" +
-	"\x02up\x18\x04 \x01(\x04R\x02up\x12\x12\n" +
-	"\x04down\x18\x05 \x01(\x04R\x04down\x12\x14\n" +
-	"\x05ports\x18\x06 \x03(\rR\x05ports\x12\x1a\n" +
-	"\binterval\x18\a \x01(\x03R\binterval\x12;\n" +
-	"\x1ainit_stream_receive_window\x18\b \x01(\x04R\x17initStreamReceiveWindow\x129\n" +
-	"\x19max_stream_receive_window\x18\t \x01(\x04R\x16maxStreamReceiveWindow\x127\n" +
-	"\x18init_conn_receive_window\x18\n" +
-	" \x01(\x04R\x15initConnReceiveWindow\x125\n" +
-	"\x17max_conn_receive_window\x18\v \x01(\x04R\x14maxConnReceiveWindow\x12(\n" +
-	"\x10max_idle_timeout\x18\f \x01(\x03R\x0emaxIdleTimeout\x12*\n" +
-	"\x11keep_alive_period\x18\r \x01(\x03R\x0fkeepAlivePeriod\x12;\n" +
-	"\x1adisable_path_mtu_discovery\x18\x0e \x01(\bR\x17disablePathMtuDiscoveryB\x82\x01\n" +
+	"\x04auth\x18\x02 \x01(\tR\x04auth\x12\x0e\n" +
+	"\x02up\x18\x03 \x01(\x04R\x02up\x12\x12\n" +
+	"\x04down\x18\x04 \x01(\x04R\x04down\x12\x14\n" +
+	"\x05ports\x18\x05 \x03(\rR\x05ports\x12\x1a\n" +
+	"\binterval\x18\x06 \x01(\x03R\binterval\x12;\n" +
+	"\x1ainit_stream_receive_window\x18\a \x01(\x04R\x17initStreamReceiveWindow\x129\n" +
+	"\x19max_stream_receive_window\x18\b \x01(\x04R\x16maxStreamReceiveWindow\x127\n" +
+	"\x18init_conn_receive_window\x18\t \x01(\x04R\x15initConnReceiveWindow\x125\n" +
+	"\x17max_conn_receive_window\x18\n" +
+	" \x01(\x04R\x14maxConnReceiveWindow\x12(\n" +
+	"\x10max_idle_timeout\x18\v \x01(\x03R\x0emaxIdleTimeout\x12*\n" +
+	"\x11keep_alive_period\x18\f \x01(\x03R\x0fkeepAlivePeriod\x12;\n" +
+	"\x1adisable_path_mtu_discovery\x18\r \x01(\bR\x17disablePathMtuDiscoveryB\x82\x01\n" +
 	"$com.xray.transport.internet.hysteriaP\x01Z5github.com/xtls/xray-core/transport/internet/hysteria\xaa\x02 Xray.Transport.Internet.Hysteriab\x06proto3"
 
 var (

transport/internet/hysteria/config.proto

@@ -9,18 +9,17 @@ option java_multiple_files = true;
 message Config {
   int32 version = 1;
   string auth = 2;
-  string congestion = 3;
-  uint64 up = 4;
-  uint64 down = 5;
-  repeated uint32 ports = 6;
-  int64 interval = 7;
+  uint64 up = 3;
+  uint64 down = 4;
+  repeated uint32 ports = 5;
+  int64 interval = 6;
 
-  uint64 init_stream_receive_window = 8;
-  uint64 max_stream_receive_window = 9;
-  uint64 init_conn_receive_window = 10;
-  uint64 max_conn_receive_window = 11;
-  int64 max_idle_timeout = 12;
-  int64 keep_alive_period = 13;
-  bool disable_path_mtu_discovery = 14;
+  uint64 init_stream_receive_window = 7;
+  uint64 max_stream_receive_window = 8;
+  uint64 init_conn_receive_window = 9;
+  uint64 max_conn_receive_window = 10;
+  int64 max_idle_timeout = 11;
+  int64 keep_alive_period = 12;
+  bool disable_path_mtu_discovery = 13;
 }
 

transport/internet/hysteria/conn.go

@@ -64,9 +64,6 @@ func (i *InterUdpConn) Read(p []byte) (int, error) {
 		return 0, io.EOF
 	}
 	n := copy(p, b)
-	if n != len(b) {
-		return 0, io.ErrShortBuffer
-	}
 	return n, nil
 }
 

transport/internet/hysteria/dialer.go

@@ -16,8 +16,8 @@ import (
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/common/task"
-	hyCtx "github.com/xtls/xray-core/proxy/hysteria/ctx"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/finalmask"
 	"github.com/xtls/xray-core/transport/internet/hysteria/congestion"
@@ -115,8 +115,8 @@ type client struct {
 	conn           *quic.Conn
 	config         *Config
 	tlsConfig      *go_tls.Config
-	socketConfig   *internet.SocketConfig
 	udpmaskManager *finalmask.UdpmaskManager
+	socketConfig   *internet.SocketConfig
 	udpSM          *udpSessionManager
 	mutex          sync.Mutex
 }
@@ -243,25 +243,10 @@ func (c *client) dial() error {
 	serverAuto := resp.Header.Get(CommonHeaderCCRX)
 	serverDown, _ := strconv.ParseUint(serverAuto, 10, 64)
 
-	switch c.config.Congestion {
-	case "reno":
-		errors.LogDebug(c.ctx, "congestion reno")
-	case "bbr":
-		errors.LogDebug(c.ctx, "congestion bbr")
+	if serverAuto == "auto" || c.config.Up == 0 || serverDown == 0 {
 		congestion.UseBBR(quicConn)
-	case "brutal", "":
-		if serverAuto == "auto" || c.config.Up == 0 || serverDown == 0 {
-			errors.LogDebug(c.ctx, "congestion bbr")
-			congestion.UseBBR(quicConn)
-		} else {
-			errors.LogDebug(c.ctx, "congestion brutal bytes per second ", min(c.config.Up, serverDown))
-			congestion.UseBrutal(quicConn, min(c.config.Up, serverDown))
-		}
-	case "force-brutal":
-		errors.LogDebug(c.ctx, "congestion brutal bytes per second ", c.config.Up)
-		congestion.UseBrutal(quicConn, c.config.Up)
-	default:
-		errors.LogDebug(c.ctx, "congestion reno")
+	} else {
+		congestion.UseBrutal(quicConn, min(c.config.Up, serverDown))
 	}
 
 	c.pktConn = pktConn
@@ -378,7 +363,6 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 		return nil, errors.New("tls config is nil")
 	}
 
-	requireDatagram := hyCtx.RequireDatagramFromContext(ctx)
 	addr := dest.NetAddr()
 	config := streamSettings.ProtocolSettings.(*Config)
 
@@ -391,15 +375,18 @@ func Dial(ctx context.Context, dest net.Destination, streamSettings *internet.Me
 			dest:           dest,
 			config:         config,
 			tlsConfig:      tlsConfig.GetTLSConfig(),
-			socketConfig:   streamSettings.SocketSettings,
 			udpmaskManager: streamSettings.UdpmaskManager,
+			socketConfig:   streamSettings.SocketSettings,
 		}
 		manger.m[addr] = c
 	}
 	c.setCtx(ctx)
 	manger.mutex.Unlock()
 
-	if requireDatagram {
+	outbounds := session.OutboundsFromContext(ctx)
+	targetUdp := len(outbounds) > 0 && outbounds[len(outbounds)-1].Target.Network == net.Network_UDP
+
+	if targetUdp {
 		return c.udp()
 	}
 	return c.tcp()

transport/internet/tls/pin_test.go

@@ -1,15 +1,12 @@
 package tls
 
 import (
-	"crypto/tls"
 	"crypto/x509"
 	"encoding/hex"
 	"encoding/pem"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/protocol/tls/cert"
 )
 
 func TestCalculateCertHash(t *testing.T) {
@@ -98,60 +95,3 @@ uI6HqHFD3iEct8fBkYfQiwH2e1eu9OwgujiWHsutyK8VvzVB3/YnhQ/TzciRjPqz
 		assert.Equal(t, fingerprint, hash)
 	})
 }
-
-func TestVerifyPeerLeafCert(t *testing.T) {
-	leafCert := cert.MustGenerate(nil, cert.DNSNames("example.com"))
-	leaf := common.Must2(x509.ParseCertificate(leafCert.Certificate))
-
-	caHash := GenerateCertHash(leafCert.Certificate)
-
-	r := &RandCarrier{
-		Config: &tls.Config{
-			ServerName: "example.com",
-		},
-		PinnedPeerCertSha256: [][]byte{caHash},
-	}
-
-	rawCerts := [][]byte{leaf.Raw}
-	err := r.verifyPeerCert(rawCerts, nil)
-	if err != nil {
-		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
-	}
-
-	// make the pinned hash incorrect
-	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyPeerCert(rawCerts, nil)
-	if err == nil {
-		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
-	}
-}
-
-func TestVerifyPeerCACert(t *testing.T) {
-	caCert := cert.MustGenerate(nil, cert.Authority(true), cert.KeyUsage(x509.KeyUsageCertSign))
-	ca := common.Must2(x509.ParseCertificate(caCert.Certificate))
-
-	leafCert := cert.MustGenerate(caCert, cert.DNSNames("example.com"))
-	leaf := common.Must2(x509.ParseCertificate(leafCert.Certificate))
-
-	caHash := GenerateCertHash(ca)
-
-	r := &RandCarrier{
-		Config: &tls.Config{
-			ServerName: "example.com",
-		},
-		PinnedPeerCertSha256: [][]byte{caHash},
-	}
-
-	rawCerts := [][]byte{leaf.Raw, ca.Raw}
-	err := r.verifyPeerCert(rawCerts, nil)
-	if err != nil {
-		t.Fatal("expected to verify leaf cert signed by pinned CA, but got error:", err)
-	}
-
-	// make the pinned hash incorrect
-	r.PinnedPeerCertSha256[0][0] += 1
-	err = r.verifyPeerCert(rawCerts, nil)
-	if err == nil {
-		t.Fatal("expected to fail verifying leaf cert with incorrect pinned CA hash, but got no error")
-	}
-}