patterniha and Claude Opus 5.5
4ec4fb8aab
TUN inbound: Rename to autoSystemWfpBlockLeak and autoSystemDnsToGateway
...
autoSystemWFP becomes autoSystemWfpBlockLeak, saying that the WFP filters
block leaks, and autoSystemDNS becomes autoSystemDnsToGateway, saying
where it points the system DNS, so that pointing the system DNS at the
gateway on Windows later would fit the same name. Their config fields
keep their numbers; neither was released.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 02:31:00 +03:30
patterniha and Claude Opus 5.5
63de6135cb
TUN inbound: Rename strictRoute to autoSystemWFP
...
It only turns on the Windows Filtering Platform filters, along with Xray
resolving its own lookups while they restrict DNS, so it is named after
what it sets up in the system, like autoSystemRoutingTable and
autoSystemDNS. The config field becomes auto_system_wfp, with the same
number; strictRoute was never released.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 01:22:22 +03:30
patterniha and Claude Opus 5.5
edd916b08e
TUN inbound: Keep Windows' DNS Client from sending DoH/DoT outside the TUN
...
With strictRoute, only port 53 was kept inside the TUN. But Windows' DNS
Client service sends the queries for an interface's DNS servers out
through that interface, whatever the routes say, and since Windows 11
and Server 2022 it may send them over HTTPS or TLS, when that is set up
for the interface (as Windows Settings does) or for the server. Those
left through the physical link.
On those versions, the DNS Client service may now only connect through
the TUN, except for its mDNS and LLMNR. The filters recognize the
service by its SID in the token of its process, as Windows Firewall's
own rules for it do. Earlier versions only query port 53, and may run
the service in one process with others, so they get no such filters.
The port 53 rule stays, for the programs that query a resolver on the
local network themselves, and for those earlier versions.
Tested on Windows 11, elevated: with DoH set on Wi-Fi per adapter, per
network profile or by global auto-upgrade, none of the DNS Client's
connections left through Wi-Fi (WFP logged the drops by the new filter),
names still resolved through the TUN, mDNS and LLMNR still went out, and
other programs were unaffected, also in a real Xray run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 01:09:52 +03:30
patterniha and Claude Opus 5.5
eb29a4e3de
TUN inbound: Make strictRoute false by default
...
Like sing-box's strict_route, strictRoute is now false by default, so the
Windows Filtering Platform filters are only added when it is set to true
(together with autoSystemRoutingTable). With unset meaning false,
strict_route becomes a plain bool field.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-29 14:51:17 +03:30
patterniha and Claude Opus 5.5
2db099b34b
TUN inbound: Block DNS and IPv6 leaks outside the TUN on Windows; Add strictRoute
...
Windows sends name queries to the DNS servers of all interfaces, and a
resolver on the local network (e.g. 192.168.1.1 from DHCP) is reached
through its more specific LAN route instead of the TUN, so DNS leaks
past it. IPv6 bypasses a TUN that cannot carry it.
With autoSystemRoutingTable set, the Windows TUN now adds Windows
Filtering Platform filters, all in one transaction and in a dynamic
session, so that they are removed when Xray exits, even if it crashes:
- DNS (port 53) only goes through the TUN, in both directions: its local
address, and the interface it leaves or arrives by, must be the TUN's.
- IPv6 is blocked in both directions when the TUN has no IPv6 address or
no IPv6 route, except loopback, neighbor and multicast listener
discovery, and DHCPv6.
- Xray's own traffic is exempt: its connections out with a hard permit,
which Windows Firewall rules do not override (like sing-box's
strict_route), connections to its inbounds with an ordinary one.
If the filters cannot be added, the TUN does not start on Windows 10 and
later (only a warning on 7/8). The new `strictRoute` option (true by
default) turns them off.
Also on Windows:
- A warning for `dns` servers outside gateway and autoSystemRoutingTable,
as queries to them cannot go through the TUN and are blocked.
- While DNS is restricted and autoOutboundsInterface is in use, Xray
resolves the names it would ask Windows for itself (Go's resolver on
its own sockets). Those lookups and the `localhost` DNS server skip the
TUN's DNS servers, unless another interface uses them too, instead of
looping back into the TUN.
- The DNS cache is flushed when the TUN starts and stops, and DNS
registration is turned off on the TUN (through netsh before Windows 10
1809).
- Close no longer panics when registering the route or interface change
callbacks failed.
The README's Windows section describes all of it.
Tested on Windows 11, elevated, amd64 and 386: the filters, DNS arriving
through a real Wintun adapter and blocked outside it, the IPv6 block,
Windows Firewall rules, and a real Xray run. Windows 7/8 and Windows 10
before 1809 are untested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-28 08:15:40 +03:30
Esko Mobius and 风扇滑翔翼
7780db9bbe
Finalmask: Fix panic when udpHop or xicmp fails; Restore udpHop's default interval ( #6808 )
...
https://github.com/XTLS/Xray-core/pull/6808#pullrequestreview-5324529175
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-27 22:17:47 +00:00
Artem Lytkin
2953d44734
Geodata: Reduce MPH matcher runtime memory usage ( #6821 )
...
https://github.com/XTLS/Xray-core/pull/6821#issuecomment-5860086534
2026-09-27 21:52:37 +00:00
Artem Lytkin and 风扇滑翔翼
7b8ade3ec5
TUN inbound: Only close the UDP connection that actually finished ( #6814 )
...
https://github.com/XTLS/Xray-core/pull/6814#pullrequestreview-5324536423
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-27 21:06:19 +00:00
Artem Lytkin
5dda894e29
TUN inbound: Reuse existing Wintun adapter by name on Windows again ( #6811 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6780
2026-09-27 20:39:17 +00:00
youugiuhiuh
47a2c2ffdc
TUN inbound: Add autoSystemDNS on Linux (to TUN's gateway) ( #6773 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-4931311976
https://github.com/XTLS/Xray-core/pull/6773#issuecomment-5755516423
https://github.com/XTLS/Xray-core/pull/6807#issuecomment-5807844210
2026-09-27 20:07:53 +00:00
Cluvex
7a018833ec
Proxy: Add MASQUE inbound (IETF CONNECT-IP server, RFC 9484) ( #6844 )
...
Completes https://github.com/XTLS/Xray-core/pull/6807 and https://github.com/XTLS/Xray-core/pull/6810
2026-09-27 19:16:54 +00:00
风扇滑翔翼
65e853ed84
SS2022 proxy: Refactor to remove sing* dependencies ( #6831 )
...
https://github.com/XTLS/Xray-core/pull/4356#issuecomment-2639571931
2026-09-27 18:42:53 +00:00
HuskyDG
3519dfecbd
FakeDNS: Change default FakeIPv6Pool to 2001:2::/48 ( #6815 )
...
https://github.com/XTLS/Xray-core/discussions/5458#discussioncomment-18555021
https://github.com/XTLS/Xray-core/pull/6815#issuecomment-5842712128
2026-09-26 03:52:03 +00:00
Cluvex
df261e4479
MASQUE client: Support HTTP/2 (Extended CONNECT, RFC 8441) ( #6810 )
...
https://github.com/XTLS/Xray-core/pull/6807#issuecomment-5808933074
https://github.com/XTLS/Xray-core/pull/6810#issuecomment-5842441136
2026-09-26 03:49:37 +00:00
风扇滑翔翼
61cad5ec8b
Xray-core: Reduce error log usage for performance ( #6796 )
...
https://github.com/XTLS/Xray-core/pull/6796#issuecomment-5807809588
2026-09-25 17:59:49 +00:00
Artem Lytkin
a642a190ed
Geodata: Prefilter regexp rules by their required literals ( #6818 )
...
https://github.com/XTLS/Xray-core/pull/6818#issuecomment-5833512067
2026-09-25 17:25:52 +00:00
Hossin Asaadi
60e2a0c502
WireGuard proxy: Release packet views after use ( #6801 )
...
https://github.com/XTLS/Xray-core/pull/6801#issuecomment-5807228464
2026-09-24 05:46:26 +00:00
Esko Mobius
7d3e44fee2
Proxy: Add MASQUE outbound & transport (IETF CONNECT-IP, RFC 9484) ( #6807 )
...
Closes https://github.com/XTLS/Xray-core/issues/5495#issuecomment-3710683679
2026-09-24 02:13:37 +00:00
dependabot[bot]
9927942aaa
Bump google.golang.org/grpc from 1.83.2 to 1.84.0 ( #6793 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.2 to 1.84.0.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.2...v1.84.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.84.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-24 02:04:39 +00:00
LjhAUMEM
a308ded2e6
WireGuard outbound: Fix endpoint IP address ( #6804 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6803
2026-09-24 01:59:28 +00:00
dependabot[bot]
7741e9e77e
Bump golang.zx2c4.com/wireguard/windows from 1.0.1 to 1.1.1 ( #6809 )
...
Bumps golang.zx2c4.com/wireguard/windows from 1.0.1 to 1.1.1.
---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
dependency-version: 1.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-24 01:57:16 +00:00
Жора Змейкин and LjhAUMEM
d562d8947d
Hysteria outbound: Fix UDP DATAGRAM truncation with ChromeParrot ( #6788 )
...
https://github.com/XTLS/Xray-core/pull/6788#issuecomment-5751428127
---------
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-09-20 22:51:03 +00:00
Hossin Asaadi
dbb1ea30ba
WireGuard proxy: Prevent panic when closing netTun with a write in flight ( #6778 )
...
https://github.com/XTLS/Xray-core/pull/6778#pullrequestreview-5251957308
2026-09-20 20:07:54 +00:00
LjhAUMEM
efc9e6da62
WireGuard outbound: Remove remoteDNS' "local" mode and domainStrategy ( #6771 )
...
https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5660953757
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751826982
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751831637
2026-09-20 19:07:51 +00:00
LjhAUMEM
8267cf953a
Transport: Refactor to be based on Finalmask's dialer & listener ( #6754 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5645958010
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5720818254
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5751585906
2026-09-20 18:12:50 +00:00
dependabot[bot]
24e6f6d551
Bump golang.org/x/net from 0.58.0 to 0.59.0 ( #6756 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.58.0 to 0.59.0.
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.59.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-20 17:46:51 +00:00
Risaro and RPRX
dcdfc57ccd
XDRIVE transport: Add the Google Drive and "template" backend ( #6748 )
...
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3849778103
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3851839033
https://github.com/XTLS/Xray-core/pull/6745#issuecomment-5627294204
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5660444946
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5719209642
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-09-19 09:03:11 +00:00
RPRX and Risaro
3461c511aa
XDRIVE transport: The universal remote-storage/any-service-based proxy, ignoring IP whitelists ( #5645 )
...
https://github.com/XTLS/Xray-core/pull/5414#issuecomment-3796734827
https://github.com/XTLS/Xray-core/pull/5581#issuecomment-3797134147
https://github.com/XTLS/Xray-core/pull/5645#issuecomment-3899873945
https://github.com/XTLS/Xray-core/pull/6745#issuecomment-5627420177
https://github.com/XTLS/Xray-core/pull/6748#issuecomment-5740443122
---------
Co-authored-by: Risaro <62798663+Risaro@users.noreply.github.com >
2026-09-19 08:23:38 +00:00
SVLAVR and 风扇滑翔翼
c412e77a9b
TUN inbound: Preserve UDP packet destinations with traffic stats ( #6747 )
...
https://github.com/XTLS/Xray-core/pull/6747#issuecomment-5647964551
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-12 20:09:35 +00:00
Kiang and 风扇滑翔翼
ccb69ea5e2
common/buf/readv_windows.go: Fix raw WSARecv blocking thread and preventing connection close ( #6743 )
...
https://github.com/XTLS/Xray-core/pull/6743#issuecomment-5647971870
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-12 19:51:59 +00:00
RPRX
52a412d9e2
Xray-core v26.9.9
...
Sponsor & Donation & NFTs: https://github.com/XTLS/Xray-core/issues/3668
Project X Channel: https://t.me/projectXtls
Announcement of NFTs by Project X: https://github.com/XTLS/Xray-core/discussions/3633
Project X NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
VLESS Post-Quantum Encryption: https://github.com/XTLS/Xray-core/pull/5067
VLESS NFT: https://opensea.io/collection/vless
XHTTP: Beyond REALITY: https://github.com/XTLS/Xray-core/discussions/4113
REALITY NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
2026-09-08 22:25:43 +00:00
LjhAUMEM and RPRX
18a1b5042a
Finalmask: Make "udpHop" a new UDP mask ( #6327 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5592421364
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-09-08 22:15:02 +00:00
patterniha
c26d2eda24
Direct/Freedom outbound: Skip domain resolution and finalRules when using sockopt.dialerProxy ( #6742 )
...
https://github.com/XTLS/Xray-core/pull/6058#issuecomment-5578800461
2026-09-08 18:45:38 +00:00
风扇滑翔翼
a1bf968be9
VLESS config: Fix validateOutboundTransportSecurity() ( #6741 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6737#issuecomment-5587270250
2026-09-08 18:18:12 +00:00
风扇滑翔翼
c037ccd98d
infra/vformat/main.go: Refactor ( #6739 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5581733848
2026-09-08 17:19:15 +00:00
RPRX
37ceb8b4b6
Xray-core v26.9.8
...
Sponsor & Donation & NFTs: https://github.com/XTLS/Xray-core/issues/3668
Project X Channel: https://t.me/projectXtls
Announcement of NFTs by Project X: https://github.com/XTLS/Xray-core/discussions/3633
Project X NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
VLESS Post-Quantum Encryption: https://github.com/XTLS/Xray-core/pull/5067
VLESS NFT: https://opensea.io/collection/vless
XHTTP: Beyond REALITY: https://github.com/XTLS/Xray-core/discussions/4113
REALITY NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
2026-09-08 09:47:24 +00:00
RPRX
fd2ca74822
go.mod: Specify Go 1.27.x
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5581777988
2026-09-08 08:44:33 +00:00
RPRX
47cfe9994a
Update github.com/xtls/reality to 20260908062103
...
https://github.com/XTLS/REALITY/commit/8cdf7bf9c7f09cb9814bf08c3eb877f68b85fba8
https://github.com/XTLS/REALITY/commit/e1986a4d31ca33c087a72ab4644aef1295693b69
https://github.com/XTLS/REALITY/commit/393f8de3ee2d685271d79ee608334e441b2db324
2026-09-08 07:22:54 +00:00
Meow
3e2f040cd8
Direct/Freedom outbound: Better Compatibility ( #6058 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6393
2026-09-08 03:31:25 +00:00
LjhAUMEM
c7245c0336
TUN inbound: Refine Windows support ( #6478 )
...
https://github.com/XTLS/Xray-core/pull/6478#issuecomment-5489052152
2026-09-08 02:51:35 +00:00
Eninspace and 风扇滑翔翼
eef6e63bc1
XHTTP client: Fix a data race in WaitReadCloser ( #6694 )
...
https://github.com/XTLS/Xray-core/pull/6694#issuecomment-5575759500
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-07 22:38:16 +00:00
Hossin Asaadi
6ce8dc53e7
common/buf/writer.go: Fix buffered writes failing when payload exceeds remaining capacity ( #6723 )
...
Fixes https://github.com/XTLS/Xray-core/issues/5287
2026-09-07 21:14:41 +00:00
风扇滑翔翼 and Raaad1on
01a034be53
Blackhole outbound: Add customizable response data support ( #6713 )
...
https://github.com/XTLS/Xray-core/pull/6711#issuecomment-5508683394
---------
Co-authored-by: Raaad1on <djilyawhite@gmail.com >
2026-09-07 21:09:58 +00:00
XXcipherX
de2caf3cef
Hysteria server: Fix Unix masquerade socket path ( #6705 )
...
https://github.com/XTLS/Xray-core/pull/6705#issuecomment-5489788730
2026-09-07 21:01:45 +00:00
dependabot[bot]
cecc88f43c
Bump google.golang.org/grpc from 1.83.1 to 1.83.2 ( #6704 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-07 20:42:22 +00:00
pexcn
cd4ce973e9
WebSocket client: Avoid panic before real dialing in delayDialConn ( #6544 )
...
Fixes https://github.com/teddysun/xray-plugin-android/issues/11
2026-09-01 04:57:10 +00:00
patterniha
fc7b980636
Sockopt: Fix indentation of the CustomSockopt block for Linux ( #6568 )
...
https://github.com/XTLS/Xray-core/pull/6568#issuecomment-5488145252
Fixes https://github.com/XTLS/Xray-core/issues/6564
Fixes https://github.com/XTLS/Xray-core/issues/6602
2026-09-01 04:47:55 +00:00
Younes
8ee131cbbb
HTTP inbound: Fix a potential panic in readResponseAndHandle100Continue() ( #6545 )
2026-09-01 02:59:56 +03:00
Jorik_Smith
2776ea6d74
SS2022 outbound: Close connection to server on early returns ( #6698 )
...
https://github.com/XTLS/Xray-core/pull/6698#issuecomment-5468662565
2026-08-31 23:59:04 +00:00
meanwhile131
5e245b082e
Routing: Export HealthCheckSettings ( #6680 )
2026-08-30 12:19:54 +00:00
