Xray-core v26.9.30

Sponsor & Donation & NFTs: https://github.com/XTLS/Xray-core/issues/3668 Project X Channel: https://t.me/projectXtls Announcement of NFTs by Project X: https://github.com/XTLS/Xray-core/discussions/3633 Project X NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1 VLESS Post-Quantum Encryption: https://github.com/XTLS/Xray-core/pull/5067 VLESS NFT: https://opensea.io/collection/vless XHTTP: Beyond REALITY: https://github.com/XTLS/Xray-core/discussions/4113 REALITY NFT: https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
TUN inbound: Add autoSystemWfpBlockLeak on Windows (blocks "dns" and "misconfigtun" IPv4/IPv6 traffic leaks outside the TUN); Rename autoSystemDNS to autoSystemDnsToGateway on Linux (and change some behaviors) (#6853 )
2026-09-30 10:57:57 +03:00 · 2026-09-30 07:40:04 +00:00 · 2026-09-30 06:26:16 +00:00 · 2026-09-30 13:16:27 +08:00 · 2026-09-30 03:11:12 +00:00 · 2026-09-29 19:25:53 +00:00
581 changed files with 48148 additions and 14362 deletions
@@ -0,0 +1 @@
+powershell.exe -ExecutionPolicy Bypass -File ".\xray_no_window.ps1"
@@ -0,0 +1 @@
+Start-Process -FilePath ".\xray.exe" -ArgumentList "-config .\config.json" -WindowStyle Hidden
@@ -0,0 +1 @@
+CreateObject("Wscript.Shell").Run "xray.exe -config config.json",0
@@ -37,6 +37,7 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
+RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json

 # Create log files
@@ -37,6 +37,7 @@ RUN echo '{}' >/tmp/usr/local/etc/xray/08_fakedns.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/09_metrics.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/10_observatory.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/11_geodata.json
+RUN echo '{}' >/tmp/usr/local/etc/xray/12_env.json
 RUN echo '{}' >/tmp/usr/local/etc/xray/99_version.json

 # Create log files
@@ -64,8 +64,16 @@ jobs:
          echo "Latest: '$LATEST'."
          echo "LATEST=$LATEST" >>${GITHUB_ENV}

+          NEWEST=false
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            NEWEST=true
+          fi
+
+          echo "Newest: '$NEWEST'."
+          echo "NEWEST=$NEWEST" >>${GITHUB_ENV}
+
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
@@ -74,7 +82,7 @@ jobs:
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -124,6 +132,13 @@ jobs:
            ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
          fi

+          if [[ "${{ env.NEWEST }}" == "true" ]]; then
+            echo "Adding 'pre-release' tag to manifest: '${{ env.FULL_IMAGE_NAME }}:pre-release'."
+            docker buildx imagetools create \
+            --tag ${{ env.FULL_IMAGE_NAME }}:pre-release \
+            ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
+          fi
+
      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ env.IMAGE_TAG }}
@@ -131,3 +146,7 @@ jobs:
          if [[ "${{ env.LATEST }}" == "true" ]]; then
            docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:latest
          fi
+
+          if [[ "${{ env.NEWEST }}" == "true" ]]; then
+            docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:pre-release
+          fi
@@ -11,15 +11,16 @@ on:
 jobs:
  check-assets:
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-

      - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-wintun-
@@ -75,13 +76,14 @@ jobs:
      fail-fast: false

    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    env:
      GOOS: ${{ matrix.goos}}
      GOARCH: ${{ matrix.goarch }}
      CGO_ENABLED: 0
    steps:
      - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Show workflow information
        run: |
@@ -90,7 +92,7 @@ jobs:
          echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
@@ -117,13 +119,13 @@ jobs:
          # go build -o build_assets/wxray.exe -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-H windowsgui -X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid=" -v ./main

      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-

      - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-wintun-
@@ -132,15 +134,17 @@ jobs:
        run: |
          mv -f resources/geo* build_assets/
          if [[ ${GOOS} == 'windows' ]]; then
-            echo 'CreateObject("Wscript.Shell").Run "xray.exe -config config.json",0' > build_assets/xray_no_window.vbs
-            echo 'Start-Process -FilePath ".\xray.exe" -ArgumentList "-config .\config.json" -WindowStyle Hidden' > build_assets/xray_no_window.ps1
+            cp .github/build/windows/* build_assets/
+          fi
+          if [[ ${GOOS} == 'windows' ]]; then
+            echo 'Adding Wintun into packages'
            if [[ ${GOARCH} == 'amd64' ]]; then
              mv resources/wintun/bin/amd64/wintun.dll build_assets/
            fi
            if [[ ${GOARCH} == '386' ]]; then
              mv resources/wintun/bin/x86/wintun.dll build_assets/
            fi
-            mv resources/wintun/LICENSE.txt build_assets/LICENSE-wintun.txt
+            mv resources/wintun/LICENSE.txt build_assets/LICENSE-Wintun
          fi

      - name: Copy README.md & LICENSE
@@ -11,15 +11,16 @@ on:
 jobs:
  check-assets:
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-

      - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-wintun-
@@ -161,6 +162,7 @@ jobs:
      fail-fast: false

    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    env:
      GOOS: ${{ matrix.goos }}
      GOARCH: ${{ matrix.goarch }}
@@ -168,7 +170,7 @@ jobs:
      CGO_ENABLED: 0
    steps:
      - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up NDK
        if: matrix.goos == 'android'
@@ -191,7 +193,7 @@ jobs:
          echo "ASSET_NAME=$_NAME" >> $GITHUB_ENV

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
@@ -208,6 +210,9 @@ jobs:
            go build -o build_assets/xray.exe -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid=" -v ./main
            # The line below is for without running conhost.exe version. Commented for not being used. Provided for reference.
            # go build -o build_assets/wxray.exe -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-H windowsgui -X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid=" -v ./main
+          elif [[ ${GOOS} == 'android' ]]; then
+            echo 'Building Xray for Android...'
+            go build -o build_assets/xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-X github.com/xtls/xray-core/core.build=${COMMID} -s -w -buildid= -checklinkname=0" -v ./main
          else
            echo 'Building Xray...'
            if [[ ${GOARCH} == 'mips' || ${GOARCH} == 'mipsle' ]]; then
@@ -220,14 +225,14 @@ jobs:
          fi

      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-

      - name: Restore Wintun Cache
        if: matrix.goos == 'windows'
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-wintun-
@@ -236,8 +241,10 @@ jobs:
        run: |
          mv -f resources/geo* build_assets/
          if [[ ${GOOS} == 'windows' ]]; then
-            echo 'CreateObject("Wscript.Shell").Run "xray.exe -config config.json",0' > build_assets/xray_no_window.vbs
-            echo 'Start-Process -FilePath ".\xray.exe" -ArgumentList "-config .\config.json" -WindowStyle Hidden' > build_assets/xray_no_window.ps1
+            cp .github/build/windows/* build_assets/
+          fi
+          if [[ ${GOOS} == 'windows' ]]; then
+            echo 'Adding Wintun into packages'
            if [[ ${GOARCH} == 'amd64' ]]; then
              mv resources/wintun/bin/amd64/wintun.dll build_assets/
            fi
@@ -247,7 +254,7 @@ jobs:
            if [[ ${GOARCH} == 'arm64' ]]; then
              mv resources/wintun/bin/arm64/wintun.dll build_assets/
            fi
-            mv resources/wintun/LICENSE.txt build_assets/LICENSE-wintun.txt
+            mv resources/wintun/LICENSE.txt build_assets/LICENSE-Wintun
          fi

      - name: Copy README.md & LICENSE
@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-
@@ -59,7 +59,7 @@ jobs:
            done

      - name: Save Geodat Cache
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
        if: ${{ steps.update.outputs.unhit }}
        with:
          path: resources
@@ -68,9 +68,12 @@ jobs:
  wintun:
    if: github.event.schedule == '30 22 * * *' || github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
+    env:
+      ASSETVER: 0.14.1
+      ASSETHASH: 07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51
    steps:
      - name: Restore Wintun Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-wintun-
@@ -96,7 +99,6 @@ jobs:
              echo -e "Checking if wintun.dll for ${ARCHITECTURE} exists..."
              if [ -s "./resources/wintun/bin/${ARCHITECTURE}/wintun.dll" ]; then
                  echo -e "wintun.dll for ${ARCHITECTURE} exists"
-                  continue
              else
                  echo -e "wintun.dll for ${ARCHITECTURE} is missing"
                  missing=true
@@ -113,16 +115,21 @@ jobs:
            fi
            if [[ "$missing" == true ]]; then
              FILENAME=wintun.zip
-              DOWNLOAD_FILE=wintun-0.14.1.zip
+              DOWNLOAD_FILE=wintun-${ASSETVER}.zip
              echo -e "Downloading https://www.wintun.net/builds/${DOWNLOAD_FILE}..."
              curl -L "https://www.wintun.net/builds/${DOWNLOAD_FILE}" -o "${FILENAME}"
-              echo -e "Unpacking wintun..."
-              unzip -u ${FILENAME} -d resources/
-              echo "unhit=true" >> $GITHUB_OUTPUT
+              if [[ "$(sha256sum "./${FILENAME}" | awk -F ' ' '{print $1}')" == "${ASSETHASH}" ]]; then
+                echo -e "Unpacking wintun..."
+                unzip -u ${FILENAME} -d resources/
+                echo "unhit=true" >> $GITHUB_OUTPUT
+              else
+                echo -e "Digest of ${FILENAME} mismatch."
+                exit 1
+              fi
            fi

      - name: Save Wintun Cache
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
        if: ${{ steps.update.outputs.unhit }}
        with:
          path: resources
@@ -1,4 +1,4 @@
-name: Test
+name: Tests and Checkings

 on:
  push:
@@ -8,9 +8,10 @@ on:
 jobs:
  check-assets:
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-
@@ -36,9 +37,10 @@ jobs:

  check-proto:
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Check Proto Version Header
        run: |
          head -n 4 core/config.pb.go > ref.txt
@@ -50,8 +52,26 @@ jobs:
            fi
          done

+  check-format:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v7
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: false
+      - name: Check Format
+        run: go run ./infra/vformat/main.go -mode check -pwd ./
+
  test:
    needs: check-assets
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    permissions:
      contents: read
    runs-on: ${{ matrix.os }}
@@ -61,14 +81,14 @@ jobs:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
      - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
      - name: Restore Geodat Cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
        with:
          path: resources
          key: xray-geodat-
@@ -73,7 +73,7 @@
  - [Xray_bash_onekey](https://github.com/hello-yunshu/Xray_bash_onekey), [XTool](https://github.com/LordPenguin666/XTool), [VPainLess](https://github.com/vpainless/vpainless)
  - [v2ray-agent](https://github.com/mack-a/v2ray-agent), [Xray_onekey](https://github.com/wulabing/Xray_onekey), [ProxySU](https://github.com/proxysu/ProxySU)
 - Magisk
-  - [Xray4Magisk](https://github.com/Asterisk4Magisk/Xray4Magisk)
+  - [Magic_V2Ray](https://github.com/vincentng295/Magic_V2Ray)
  - [Xray_For_Magisk](https://github.com/E7KMbb/Xray_For_Magisk)
 - Homebrew
  - `brew install xray`
@@ -120,6 +120,7 @@
  - [XrayFA](https://github.com/Q7DF1/XrayFA)
  - [AnyPortal](https://github.com/AnyPortal/AnyPortal)
  - [OneXray](https://github.com/OneXray/OneXray)
+  - [AsteriskNG](https://github.com/Asterisk4Magisk/AsteriskNG)
 - iOS & macOS arm64 & tvOS
  - [Happ](https://apps.apple.com/app/happ-proxy-utility/id6504287215) | [Happ RU](https://apps.apple.com/ru/app/happ-proxy-utility-plus/id6746188973) | [Happ tvOS](https://apps.apple.com/us/app/happ-proxy-utility-for-tv/id6748297274)
  - [Streisand](https://apps.apple.com/app/streisand/id6450534064)
@@ -145,6 +146,8 @@
  - [v2rayN](https://github.com/2dust/v2rayN)
  - [GenyConnect](https://github.com/genyleap/GenyConnect)
  - [OneXray](https://github.com/OneXray/OneXray)
+- HarmonyOS
+  - [Hey](https://github.com/popsiclelmlm/Hey)

 ## Others that support VLESS, XTLS, REALITY, XUDP, PLUX...

@@ -162,6 +165,7 @@
  - [xtls-sdk](https://github.com/remnawave/xtls-sdk)
  - [xtlsapi](https://github.com/hiddify/xtlsapi)
  - [AndroidLibXrayLite](https://github.com/2dust/AndroidLibXrayLite)
+  - [flutter_vless](https://github.com/XIIIFOX/flutter_vless)
  - [Xray-core-python](https://github.com/LorenEteval/Xray-core-python)
  - [xray-api](https://github.com/XVGuardian/xray-api)
 - [XrayR](https://github.com/XrayR-project/XrayR)
@@ -183,6 +187,27 @@
 - [Xray-core v1.0.0](https://github.com/XTLS/Xray-core/releases/tag/v1.0.0) was forked from [v2fly-core 9a03cc5](https://github.com/v2fly/v2ray-core/commit/9a03cc5c98d04cc28320fcee26dbc236b3291256), and we have made & accumulated a huge number of enhancements over time, check [the release notes for each version](https://github.com/XTLS/Xray-core/releases).
 - For third-party projects used in [Xray-core](https://github.com/XTLS/Xray-core), check your local or [the latest go.mod](https://github.com/XTLS/Xray-core/blob/main/go.mod).

+### Bundled Third-Party Components Redistribution
+
+**Certain optional features dynamically load third-party components. These optional components are separate works distributed under their own licenses, and are bundled into the ZIP package for ease of use. Users may replace these components under the licenses from these components.**
+
+These components include:
+
+#### Wintun
+
+This distribution contains unmodified official precompiled and pre-signed Wintun binaries.
+
+- Project: Wintun
+- Copyright: Copyright (C) 2018-2021 WireGuard LLC. All Rights Reserved.
+- Redistribution License: Prebuilt Binaries License (PBL) bundled with official precompiled and pre-signed binaries from wintun.net
+- Component(s): wintun.dll
+- Source: https://www.wintun.net/
+- Included in:
+  - Windows x86 (windows-32, win7-32)
+  - Windows x86-64 (windows-64, win7-64)
+  - Windows AArch64 (windows-arm64)
+- Notes: Wintun is an optional runtime-loaded component only used for TUN inbound functionality on supported Windows platforms.
+
 ## One-line Compilation

 ### Windows (PowerShell)
@@ -206,6 +231,13 @@ Make sure that you are using the same Go version, and remember to set the git co
 CGO_ENABLED=0 go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-X github.com/xtls/xray-core/core.build=REPLACE -s -w -buildid=" -v ./main
 ```

+For Android:
+
+```bash
+GOOS=android GOARCH=arm64 CGO_ENABLED=1 CC=/path/to/aarch64-linux-android24-clang go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-X github.com/xtls/xray-core/core.build=REPLACE -s -w -buildid= -checklinkname=0" -v ./main
+GOOS=android GOARCH=amd64 CGO_ENABLED=1 CC=/path/to/x86_64-linux-android24-clang go build -o xray -trimpath -buildvcs=false -gcflags="all=-l=4" -ldflags="-X github.com/xtls/xray-core/core.build=REPLACE -s -w -buildid= -checklinkname=0" -v ./main
+```
+
 If you are compiling a 32-bit MIPS/MIPSLE target, use this command instead:

 ```bash
@@ -3,15 +3,15 @@ package commander
 import (
 	"context"
 	"net"
+	"strings"
 	"sync"
-    "strings"

 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/signal/done"
 	core "github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/outbound"
-    "github.com/xtls/xray-core/transport/internet"
+	"github.com/xtls/xray-core/transport/internet"
 	"google.golang.org/grpc"
 )

@@ -69,16 +69,15 @@ func (c *Commander) Start() error {
 	}
 	c.Unlock()

-	var listen = func(listener net.Listener) {
+	listen := func(listener net.Listener) {
 		if err := c.server.Serve(listener); err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to start grpc server")
 		}
 	}

-
 	if len(c.listen) > 0 {
 		var addr net.Addr
-		
+
 		if strings.HasPrefix(c.listen, "/") || strings.HasPrefix(c.listen, "@") {
 			addr = &net.UnixAddr{Name: c.listen, Net: "unix"}
 		} else {
@@ -89,7 +88,7 @@ func (c *Commander) Start() error {
 			}
 			addr = tcpAddr
 		}
-        l, err := internet.ListenSystem(context.Background(), addr, nil)
+		l, err := internet.ListenSystem(context.Background(), addr, nil)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "API server failed to listen on ", c.listen)
 			return err
@@ -162,7 +162,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		p := d.policy.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
+			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
 				inboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  inboundLink.Writer,
@@ -171,7 +171,7 @@ func (d *DefaultDispatcher) getLink(ctx context.Context) (*transport.Link, *tran
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := stats.GetOrRegisterCounter(d.stats, name); c != nil {
+			if c, _ := d.stats.GetOrRegisterCounter(name); c != nil {
 				outboundLink.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  outboundLink.Writer,
@@ -200,13 +200,13 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st
 		p := policyManager.ForLevel(user.Level)
 		if p.Stats.UserUplink {
 			name := "user>>>" + user.Email + ">>>traffic>>>uplink"
-			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
+			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
 				link.Reader.(*buf.TimeoutWrapperReader).Counter = c
 			}
 		}
 		if p.Stats.UserDownlink {
 			name := "user>>>" + user.Email + ">>>traffic>>>downlink"
-			if c, _ := stats.GetOrRegisterCounter(statsManager, name); c != nil {
+			if c, _ := statsManager.GetOrRegisterCounter(name); c != nil {
 				link.Writer = &SizeStatWriter{
 					Counter: c,
 					Writer:  link.Writer,
@@ -223,7 +223,7 @@ func WrapLink(ctx context.Context, policyManager policy.Manager, statsManager st

 func trackOnlineIP(ctx context.Context, sm stats.Manager, email, ip string) {
 	name := "user>>>" + email + ">>>online"
-	if om, _ := stats.GetOrRegisterOnlineMap(sm, name); om != nil {
+	if om, _ := sm.GetOrRegisterOnlineMap(name); om != nil {
 		om.AddIP(ip)
 		context.AfterFunc(ctx, func() { om.RemoveIP(ip) })
 	}
@@ -23,7 +23,7 @@ func newFakeDNSSniffer(ctx context.Context) (protocolSnifferWithMetadata, error)
 	}

 	if fakeDNSEngine == nil {
-		errNotInit := errors.New("FakeDNSEngine is not initialized, but such a sniffer is used").AtError()
+		errNotInit := errors.New("FakeDNSEngine is not initialized, but such a sniffer is used")
 		return protocolSnifferWithMetadata{}, errNotInit
 	}
 	return protocolSnifferWithMetadata{protocolSniffer: func(ctx context.Context, bytes []byte) (SniffResult, error) {
@@ -139,7 +139,8 @@ func (c *CacheController) writeAndShrink(expiredKeys []string) {

 	if lenAfter == 0 {
 		if c.highWatermark >= minSizeForEmptyRebuild {
-			errors.LogDebug(context.Background(), c.name,
+			errors.LogDebug(
+				context.Background(), c.name,
 				" rebuilding empty cache map to reclaim memory.",
 				" size_before_cleanup=", lenBefore,
 				" peak_size_before_rebuild=", c.highWatermark,
@@ -153,7 +154,8 @@ func (c *CacheController) writeAndShrink(expiredKeys []string) {

 	if reductionFromPeak := c.highWatermark - lenAfter; reductionFromPeak > shrinkAbsoluteThreshold &&
 		float64(reductionFromPeak) > float64(c.highWatermark)*shrinkRatioThreshold {
-		errors.LogDebug(context.Background(), c.name,
+		errors.LogDebug(
+			context.Background(), c.name,
 			" shrinking cache map to reclaim memory.",
 			" new_size=", lenAfter,
 			" peak_size_before_shrink=", c.highWatermark,
@@ -165,7 +167,6 @@ func (c *CacheController) writeAndShrink(expiredKeys []string) {
 		c.highWatermark = lenAfter
 		go c.migrate()
 	}
-
 }

 type migrationEntry struct {
@@ -28,7 +28,7 @@ func toNetIP(addrs []net.Address) ([]net.IP, error) {
 		if addr.Family().IsIP() {
 			ips = append(ips, addr.IP())
 		} else {
-			return nil, errors.New("Failed to convert address", addr, "to Net IP.").AtWarning()
+			return nil, errors.New("Failed to convert address", addr, "to Net IP.")
 		}
 	}
 	return ips, nil
@@ -86,7 +86,7 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 		return nil, errors.New("failed to create hosts").Base(err)
 	}

-	var defaultTag = config.Tag
+	defaultTag := config.Tag
 	if len(config.Tag) == 0 {
 		defaultTag = generateRandomTag()
 	}
@@ -139,7 +139,7 @@ func New(ctx context.Context, config *Config) (*DNS, error) {
 			serveExpiredTTL = *ns.ServeExpiredTTL
 		}

-		var tag = defaultTag
+		tag := defaultTag
 		if len(ns.Tag) > 0 {
 			tag = ns.Tag
 		}
@@ -212,6 +212,28 @@ func (s *DNS) IsOwnLink(ctx context.Context) bool {
 	return false
 }

+// MayUseSystemResolver reports whether any name server configured here could
+// still resolve through the system resolver. That is what happens when no name
+// server is configured at all, and it is also what a name server pointed at
+// "localhost" does. Callers that are about to redirect the system resolver need
+// to know, because a resolution path that reaches it would then loop back to
+// them.
+//
+// Any such server is enough: name servers can be selected per domain, so a
+// single local one makes some query reach the system resolver even when
+// independent upstreams are configured alongside it.
+func (s *DNS) MayUseSystemResolver() bool {
+	if len(s.clients) == 0 {
+		return true
+	}
+	for _, client := range s.clients {
+		if _, isLocal := client.server.(*LocalNameServer); isLocal {
+			return true
+		}
+	}
+	return false
+}
+
 // LookupIP implements dns.Client.
 func (s *DNS) LookupIP(domain string, option dns.IPOption) ([]net.IP, uint32, error) {
 	// Normalize the FQDN form query
@@ -0,0 +1,59 @@
+package dns
+
+import (
+	"context"
+	"testing"
+
+	"github.com/xtls/xray-core/common/net"
+	feature_dns "github.com/xtls/xray-core/features/dns"
+)
+
+// fakeServer stands in for any name server that is not the system resolver.
+type fakeServer struct{}
+
+func (fakeServer) Name() string         { return "fake" }
+func (fakeServer) IsDisableCache() bool { return false }
+func (fakeServer) QueryIP(context.Context, string, feature_dns.IPOption) ([]net.IP, uint32, error) {
+	return nil, 0, nil
+}
+
+// Callers that are about to redirect the system resolver rely on this to tell
+// whether any resolution path could still reach the system resolver, so the
+// mixed shape has to be reported as reachable: a domain-specific rule can
+// select the system resolver even when an independent upstream also exists.
+func TestMayUseSystemResolver(t *testing.T) {
+	tests := []struct {
+		name    string
+		clients []*Client
+		want    bool
+	}{
+		{
+			name: "no clients at all",
+			want: true,
+		},
+		{
+			name:    "only the system resolver",
+			clients: []*Client{{server: NewLocalNameServer()}},
+			want:    true,
+		},
+		{
+			name:    "the system resolver alongside an independent name server",
+			clients: []*Client{{server: fakeServer{}}, {server: NewLocalNameServer()}},
+			want:    true,
+		},
+		{
+			name:    "only independent name servers",
+			clients: []*Client{{server: fakeServer{}}},
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := &DNS{clients: tt.clients}
+			if got := server.MayUseSystemResolver(); got != tt.want {
+				t.Errorf("MayUseSystemResolver() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
@@ -127,15 +127,20 @@ func genEDNS0Options(clientIP net.IP, padding int) *dnsmessage.Resource {
 	return opt
 }

-func buildReqMsgs(domain string, option dns_feature.IPOption, reqIDGen func() uint16, reqOpts *dnsmessage.Resource) []*dnsRequest {
+func buildReqMsgs(domain string, option dns_feature.IPOption, reqIDGen func() uint16, reqOpts *dnsmessage.Resource) ([]*dnsRequest, error) {
+	name, err := dnsmessage.NewName(domain)
+	if err != nil {
+		return nil, err
+	}
+
 	qA := dnsmessage.Question{
-		Name:  dnsmessage.MustNewName(domain),
+		Name:  name,
 		Type:  dnsmessage.TypeA,
 		Class: dnsmessage.ClassINET,
 	}

 	qAAAA := dnsmessage.Question{
-		Name:  dnsmessage.MustNewName(domain),
+		Name:  name,
 		Type:  dnsmessage.TypeAAAA,
 		Class: dnsmessage.ClassINET,
 	}
@@ -175,7 +180,7 @@ func buildReqMsgs(domain string, option dns_feature.IPOption, reqIDGen func() ui
 		})
 	}

-	return reqs
+	return reqs, nil
 }

 // parseResponse parses DNS answers from the returned payload
@@ -183,19 +188,24 @@ func parseResponse(payload []byte) (*IPRecord, error) {
 	var parser dnsmessage.Parser
 	h, err := parser.Start(payload)
 	if err != nil {
-		return nil, errors.New("failed to parse DNS response").Base(err).AtWarning()
+		return nil, errors.New("failed to parse DNS response").Base(err)
 	}
 	if err := parser.SkipAllQuestions(); err != nil {
-		return nil, errors.New("failed to skip questions in DNS response").Base(err).AtWarning()
+		return nil, errors.New("failed to skip questions in DNS response").Base(err)
 	}

 	now := time.Now()
 	ipRecord := &IPRecord{
 		ReqID:     h.ID,
 		RCode:     h.RCode,
-		Expire:    now.Add(time.Second * dns_feature.DefaultTTL),
 		RawHeader: &h,
 	}
+	defer func() {
+		// set to default TTL if no valid TTL is found
+		if ipRecord.Expire.IsZero() {
+			ipRecord.Expire = now.Add(time.Second * dns_feature.DefaultTTL)
+		}
+	}()

 L:
 	for {
@@ -212,7 +222,7 @@ L:
 			ttl = 1
 		}
 		expire := now.Add(time.Duration(ttl) * time.Second)
-		if ipRecord.Expire.After(expire) {
+		if ipRecord.Expire.IsZero() || ipRecord.Expire.After(expire) {
 			ipRecord.Expire = expire
 		}

@@ -2,6 +2,7 @@ package dns

 import (
 	"math/rand"
+	"strings"
 	"testing"
 	"time"

@@ -24,7 +25,8 @@ func Test_parseResponse(t *testing.T) {

 	ans = new(dns.Msg)
 	ans.Id = 1
-	ans.Answer = append(ans.Answer,
+	ans.Answer = append(
+		ans.Answer,
 		common.Must2(dns.NewRR("google.com. IN CNAME m.test.google.com")),
 		common.Must2(dns.NewRR("google.com. IN CNAME fake.google.com")),
 		common.Must2(dns.NewRR("google.com. IN A 8.8.8.8")),
@@ -34,7 +36,8 @@ func Test_parseResponse(t *testing.T) {

 	ans = new(dns.Msg)
 	ans.Id = 2
-	ans.Answer = append(ans.Answer,
+	ans.Answer = append(
+		ans.Answer,
 		common.Must2(dns.NewRR("google.com. IN CNAME m.test.google.com")),
 		common.Must2(dns.NewRR("google.com. IN CNAME fake.google.com")),
 		common.Must2(dns.NewRR("google.com. IN CNAME m.test.google.com")),
@@ -131,10 +134,15 @@ func Test_buildReqMsgs(t *testing.T) {
 			IPv6Enable: false,
 			FakeEnable: false,
 		}, nil}, 0},
+		{"name too long", args{strings.Repeat("a", 256), dns_feature.IPOption{
+			IPv4Enable: true,
+			IPv6Enable: true,
+			FakeEnable: false,
+		}, nil}, 0},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := buildReqMsgs(tt.args.domain, tt.args.option, stubID, tt.args.reqOpts); !(len(got) == tt.want) {
+			if got, _ := buildReqMsgs(tt.args.domain, tt.args.option, stubID, tt.args.reqOpts); !(len(got) == tt.want) {
 				t.Errorf("buildReqMsgs() = %v, want %v", got, tt.want)
 			}
 		})
@@ -58,7 +58,7 @@ func NewFakeDNSHolder() (*Holder, error) {
 	var err error

 	if fkdns, err = NewFakeDNSHolderConfigOnly(nil); err != nil {
-		return nil, errors.New("Unable to create Fake Dns Engine").Base(err).AtError()
+		return nil, errors.New("Unable to create Fake Dns Engine").Base(err)
 	}
 	err = fkdns.initialize(dns.FakeIPv4Pool, 65535)
 	if err != nil {
@@ -80,13 +80,13 @@ func (fkdns *Holder) initialize(ipPoolCidr string, lruSize int) error {
 	var err error

 	if _, ipRange, err = net.ParseCIDR(ipPoolCidr); err != nil {
-		return errors.New("Unable to parse CIDR for Fake DNS IP assignment").Base(err).AtError()
+		return errors.New("Unable to parse CIDR for Fake DNS IP assignment").Base(err)
 	}

 	ones, bits := ipRange.Mask.Size()
 	rooms := bits - ones
 	if math.Log2(float64(lruSize)) >= float64(rooms) {
-		return errors.New("LRU size is bigger than subnet size").AtError()
+		return errors.New("LRU size is bigger than subnet size")
 	}
 	fkdns.domainToIP = cache.NewLru(lruSize)
 	fkdns.ipRange = ipRange
@@ -129,15 +129,16 @@ func TestFakeDnsHolderCreateMappingAndRollOver(t *testing.T) {
 }

 func TestFakeDNSMulti(t *testing.T) {
-	fakeMulti, err := NewFakeDNSHolderMulti(&FakeDnsPoolMulti{
-		Pools: []*FakeDnsPool{{
-			IpPool:  "240.0.0.0/12",
-			LruSize: 256,
-		}, {
-			IpPool:  "fddd:c5b4:ff5f:f4f0::/64",
-			LruSize: 256,
-		}},
-	},
+	fakeMulti, err := NewFakeDNSHolderMulti(
+		&FakeDnsPoolMulti{
+			Pools: []*FakeDnsPool{{
+				IpPool:  "240.0.0.0/12",
+				LruSize: 256,
+			}, {
+				IpPool:  "fddd:c5b4:ff5f:f4f0::/64",
+				LruSize: 256,
+			}},
+		},
 	)
 	common.Must(err)

@@ -84,7 +84,7 @@ func NewServer(ctx context.Context, dest net.Destination, dispatcher routing.Dis
 	if dest.Network == net.Network_UDP { // UDP classic DNS mode
 		return NewClassicNameServer(dest, dispatcher, disableCache, serveStale, serveExpiredTTL, clientIP), nil
 	}
-	return nil, errors.New("No available name server could be created from ", dest).AtWarning()
+	return nil, errors.New("No available name server could be created from ", dest)
 }

 // NewClient creates a DNS client managing a name server with client IP, domain rules and expected IPs.
@@ -102,7 +102,7 @@ func NewClient(
 		// Create a new server for each client for now
 		server, err := NewServer(ctx, ns.Address.AsDestination(), dispatcher, disableCache, serveStale, serveExpiredTTL, clientIP)
 		if err != nil {
-			return errors.New("failed to create nameserver").Base(err).AtWarning()
+			return errors.New("failed to create nameserver").Base(err)
 		}

 		_, isLocalDNS := server.(*LocalNameServer)
@@ -113,7 +113,7 @@ func NewClient(
 		if len(ns.ExpectedIp) > 0 {
 			expectedMatcher, err = geodata.IPReg.BuildIPMatcher(ns.ExpectedIp)
 			if err != nil {
-				return errors.New("failed to create expected ip matcher").Base(err).AtWarning()
+				return errors.New("failed to create expected ip matcher").Base(err)
 			}
 		}

@@ -122,7 +122,7 @@ func NewClient(
 		if len(ns.UnexpectedIp) > 0 {
 			unexpectedMatcher, err = geodata.IPReg.BuildIPMatcher(ns.UnexpectedIp)
 			if err != nil {
-				return errors.New("failed to create unexpected ip matcher").Base(err).AtWarning()
+				return errors.New("failed to create unexpected ip matcher").Base(err)
 			}
 		}

@@ -135,7 +135,7 @@ func NewClient(
 			}
 		}

-		var timeoutMs = 4000 * time.Millisecond
+		timeoutMs := 4000 * time.Millisecond
 		if ns.TimeoutMs > 0 {
 			timeoutMs = time.Duration(ns.TimeoutMs) * time.Millisecond
 		}
@@ -137,14 +137,32 @@ func (s *DoHNameServer) sendQuery(ctx context.Context, noResponseErrCh chan<- er
 	if s.Name()+"." == "DOH//"+fqdn {
 		errors.LogError(ctx, s.Name(), " tries to resolve itself! Use IP or set \"hosts\" instead")
 		if noResponseErrCh != nil {
-			noResponseErrCh <- errors.New("tries to resolve itself!", s.Name())
+			err := errors.New("tries to resolve itself!", s.Name())
+			if option.IPv4Enable {
+				noResponseErrCh <- err
+			}
+			if option.IPv6Enable {
+				noResponseErrCh <- err
+			}
 		}
 		return
 	}

 	// As we don't want our traffic pattern looks like DoH, we use Random-Length Padding instead of Block-Length Padding recommended in RFC 8467
 	// Although DoH server like 1.1.1.1 will pad the response to Block-Length 468, at least it is better than no padding for response at all
-	reqs := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, int(crypto.RandBetween(100, 300))))
+	reqs, err := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, int(crypto.RandBetween(100, 300))))
+	if err != nil {
+		errors.LogErrorInner(ctx, err, "failed to build dns query for ", fqdn)
+		if noResponseErrCh != nil {
+			if option.IPv4Enable {
+				noResponseErrCh <- err
+			}
+			if option.IPv6Enable {
+				noResponseErrCh <- err
+			}
+		}
+		return
+	}

 	var deadline time.Time
 	if d, ok := ctx.Deadline(); ok {
@@ -27,7 +27,7 @@ func (s *FakeDNSServer) IsDisableCache() bool {

 func (f *FakeDNSServer) QueryIP(ctx context.Context, domain string, opt dns.IPOption) ([]net.IP, uint32, error) {
 	if f.fakeDNSEngine == nil {
-		return nil, 0, errors.New("Unable to locate a fake DNS Engine").AtError()
+		return nil, 0, errors.New("Unable to locate a fake DNS Engine")
 	}

 	var ips []net.Address
@@ -39,7 +39,7 @@ func (f *FakeDNSServer) QueryIP(ctx context.Context, domain string, opt dns.IPOp

 	netIP, err := toNetIP(ips)
 	if err != nil {
-		return nil, 0, errors.New("Unable to convert IP to net ip").Base(err).AtError()
+		return nil, 0, errors.New("Unable to convert IP to net ip").Base(err)
 	}

 	errors.LogInfo(ctx, f.Name(), " got answer: ", domain, " -> ", ips)
@@ -18,7 +18,6 @@ type LocalNameServer struct {

 // QueryIP implements Server.
 func (s *LocalNameServer) QueryIP(ctx context.Context, domain string, option dns.IPOption) (ips []net.IP, ttl uint32, err error) {
-
 	start := time.Now()
 	ips, ttl, err = s.client.LookupIP(domain, option)

@@ -78,7 +78,19 @@ func (s *QUICNameServer) getCacheController() *CacheController { return s.cacheC
 func (s *QUICNameServer) sendQuery(ctx context.Context, noResponseErrCh chan<- error, fqdn string, option dns_feature.IPOption) {
 	errors.LogInfo(ctx, s.Name(), " querying: ", fqdn)

-	reqs := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	reqs, err := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	if err != nil {
+		errors.LogErrorInner(ctx, err, "failed to build dns query for ", fqdn)
+		if noResponseErrCh != nil {
+			if option.IPv4Enable {
+				noResponseErrCh <- err
+			}
+			if option.IPv6Enable {
+				noResponseErrCh <- err
+			}
+		}
+		return
+	}

 	var deadline time.Time
 	if d, ok := ctx.Deadline(); ok {
@@ -113,7 +113,19 @@ func (s *TCPNameServer) getCacheController() *CacheController {
 func (s *TCPNameServer) sendQuery(ctx context.Context, noResponseErrCh chan<- error, fqdn string, option dns_feature.IPOption) {
 	errors.LogInfo(ctx, s.Name(), " querying DNS for: ", fqdn)

-	reqs := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	reqs, err := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	if err != nil {
+		errors.LogErrorInner(ctx, err, "failed to build dns query for ", fqdn)
+		if noResponseErrCh != nil {
+			if option.IPv4Enable {
+				noResponseErrCh <- err
+			}
+			if option.IPv6Enable {
+				noResponseErrCh <- err
+			}
+		}
+		return
+	}

 	var deadline time.Time
 	if d, ok := ctx.Deadline(); ok {
@@ -131,8 +131,6 @@ func (s *ClassicNameServer) HandleResponse(ctx context.Context, packet *udp_prot
 			newReq.msg = &newMsg
 			s.addPendingRequest(&newReq)
 			b, _ := dns.PackMessage(newReq.msg)
-			copyDest := net.UDPDestination(s.address.Address, s.address.Port)
-			b.UDP = &copyDest
 			s.udpServer.Dispatch(toDnsContext(newReq.ctx, s.address.String()), *s.address, b)
 			return
 		}
@@ -163,7 +161,19 @@ func (s *ClassicNameServer) getCacheController() *CacheController {
 func (s *ClassicNameServer) sendQuery(ctx context.Context, noResponseErrCh chan<- error, fqdn string, option dns_feature.IPOption) {
 	errors.LogInfo(ctx, s.Name(), " querying DNS for: ", fqdn)

-	reqs := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	reqs, err := buildReqMsgs(fqdn, option, s.newReqID, genEDNS0Options(s.clientIP, 0))
+	if err != nil {
+		errors.LogErrorInner(ctx, err, "failed to build dns query for ", fqdn)
+		if noResponseErrCh != nil {
+			if option.IPv4Enable {
+				noResponseErrCh <- err
+			}
+			if option.IPv6Enable {
+				noResponseErrCh <- err
+			}
+		}
+		return
+	}

 	for _, req := range reqs {
 		udpReq := &udpDnsRequest{
@@ -179,8 +189,6 @@ func (s *ClassicNameServer) sendQuery(ctx context.Context, noResponseErrCh chan<
 			}
 			return
 		}
-		copyDest := net.UDPDestination(s.address.Address, s.address.Port)
-		b.UDP = &copyDest
 		s.udpServer.Dispatch(toDnsContext(ctx, s.address.String()), *s.address, b)
 	}
 }
@@ -2,6 +2,7 @@ package geodata

 import (
 	"context"
+	"crypto/tls"
 	go_errors "errors"
 	"io"
 	"net/http"
@@ -9,6 +10,7 @@ import (
 	"path/filepath"
 	"time"

+	utls "github.com/refraction-networking/utls"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/platform/filesystem"
@@ -16,6 +18,7 @@ import (
 	"github.com/xtls/xray-core/common/utils"
 	"github.com/xtls/xray-core/features/routing"
 	"github.com/xtls/xray-core/transport/internet/tagged"
+	"golang.org/x/net/http2"
 )

 const idleTimeout = 30 * time.Second
@@ -26,8 +29,9 @@ type stage struct {
 }

 type downloader struct {
-	ctx    context.Context
-	client *http.Client
+	ctx         context.Context
+	httpClient  *http.Client
+	httpsClient *http.Client
 }

 type idleConn struct {
@@ -53,52 +57,84 @@ func (c *idleConn) Write(b []byte) (int, error) {

 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
-		ctx:    ctx,
-		client: newClient(ctx, dispatcher, outbound),
+		ctx:         ctx,
+		httpClient:  newClient(ctx, dispatcher, outbound, false),
+		httpsClient: newClient(ctx, dispatcher, outbound, true),
 	}
 }

-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
-	return &http.Client{
-		Transport: &http.Transport{
-			Proxy:             nil,
-			DisableKeepAlives: true,
-			DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
-				var conn net.Conn
-				err := task.Run(ctx, func() error {
-					if tagged.Dialer == nil {
-						return errors.New("tagged dialer is not initialized")
-					}
-					dest, err := net.ParseDestination(network + ":" + address)
-					if err != nil {
-						return errors.New("cannot understand address").Base(err)
-					}
-					c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
-					if err != nil {
-						return errors.New("cannot dial remote address ", dest).Base(err)
-					}
-					conn = c
-					return nil
-				})
-				if err != nil {
-					return nil, errors.New("cannot finish connection").Base(err)
-				}
-				return &idleConn{
-					Conn: conn,
-				}, nil
-			},
-			TLSHandshakeTimeout:   idleTimeout,
-			ResponseHeaderTimeout: idleTimeout,
-		},
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if req.URL.Scheme != "https" {
-				return errors.New("redirected to non-https URL: ", req.URL.String())
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
+	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+		var conn net.Conn
+		err := task.Run(ctx, func() error {
+			if tagged.Dialer == nil {
+				return errors.New("tagged dialer is not initialized")
 			}
-			if len(via) >= 10 {
-				return errors.New("stopped after 10 redirects")
+			dest, err := net.ParseDestination(network + ":" + address)
+			if err != nil {
+				return errors.New("cannot understand address").Base(err)
 			}
+			c, err := tagged.Dialer(baseCtx, dispatcher, dest, outbound)
+			if err != nil {
+				return errors.New("cannot dial remote address ", dest).Base(err)
+			}
+			conn = c
 			return nil
-		},
+		})
+		if err != nil {
+			return nil, errors.New("cannot finish connection").Base(err)
+		}
+		return &idleConn{
+			Conn: conn,
+		}, nil
+	}
+	if isHTTPS {
+		return &http.Client{
+			Transport: &http2.Transport{
+				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+					conn, err := dial(ctx, network, address)
+					if err != nil {
+						return nil, err
+					}
+					host, _, _ := net.SplitHostPort(address)
+					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+					defer cancel()
+					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+						conn.Close()
+						return nil, err
+					}
+					return tlsConn, nil
+				},
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
+	} else {
+		return &http.Client{
+			Transport: &http.Transport{
+				Proxy:                 nil,
+				DisableKeepAlives:     true,
+				DialContext:           dial,
+				ResponseHeaderTimeout: idleTimeout,
+			},
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if req.URL.Scheme != "https" {
+					return errors.New("redirected to non-https URL: ", req.URL.String())
+				}
+				if len(via) >= 10 {
+					return errors.New("stopped after 10 redirects")
+				}
+				return nil
+			},
+		}
 	}
 }

@@ -160,7 +196,13 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")

-	resp, err := d.client.Do(req)
+	var client *http.Client
+	if req.URL.Scheme == "https" {
+		client = d.httpsClient
+	} else {
+		client = d.httpClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return err
 	}
@@ -89,10 +89,10 @@ func (g *Instance) startInternal() error {
 	g.active = true

 	if err := g.initAccessLogger(); err != nil {
-		return errors.New("failed to initialize access logger").Base(err).AtWarning()
+		return errors.New("failed to initialize access logger").Base(err)
 	}
 	if err := g.initErrorLogger(); err != nil {
-		return errors.New("failed to initialize error logger").Base(err).AtWarning()
+		return errors.New("failed to initialize error logger").Base(err)
 	}

 	return nil
@@ -141,6 +141,10 @@ func (g *Instance) Handle(msg log.Message) {
 	}
 }

+func (g *Instance) Severity() log.Severity {
+	return g.config.ErrorLogLevel
+}
+
 // Close implements common.Closable.Close().
 func (g *Instance) Close() error {
 	errors.LogDebug(context.Background(), "Logger closing")
@@ -2,15 +2,18 @@ package metrics

 import (
 	"context"
+	"encoding/json"
+	stderrors "errors"
 	"expvar"
+	stdnet "net"
 	"net/http"
-	_ "net/http/pprof"
+	"net/http/pprof"
 	"strings"

 	"github.com/xtls/xray-core/app/observatory"
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
+	xnet "github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/signal/done"
 	"github.com/xtls/xray-core/core"
 	"github.com/xtls/xray-core/features/extension"
@@ -21,15 +24,17 @@ import (
 type MetricsHandler struct {
 	ohm          outbound.Manager
 	statsManager feature_stats.Manager
-	observatory  extension.Observatory
+	ctx          context.Context
 	tag          string
 	listen       string
-	tcpListener  net.Listener
+	tcpListener  xnet.Listener
+	listener     *OutboundListener
 }

 // NewMetricsHandler creates a new MetricsHandler based on the given config.
 func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, error) {
 	c := &MetricsHandler{
+		ctx:    ctx,
 		tag:    config.Tag,
 		listen: config.Listen,
 	}
@@ -37,46 +42,6 @@ func NewMetricsHandler(ctx context.Context, config *Config) (*MetricsHandler, er
 		c.statsManager = sm
 		c.ohm = om
 	}))
-	expvar.Publish("stats", expvar.Func(func() interface{} {
-		resp := map[string]map[string]map[string]int64{
-			"inbound":  {},
-			"outbound": {},
-			"user":     {},
-		}
-		c.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
-			nameSplit := strings.Split(name, ">>>")
-			typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
-			if item, found := resp[typeName][tagOrUser]; found {
-				item[direction] = counter.Value()
-			} else {
-				resp[typeName][tagOrUser] = map[string]int64{
-					direction: counter.Value(),
-				}
-			}
-			return true
-		})
-		return resp
-	}))
-	expvar.Publish("observatory", expvar.Func(func() interface{} {
-		if c.observatory == nil {
-			common.Must(core.RequireFeatures(ctx, func(observatory extension.Observatory) error {
-				c.observatory = observatory
-				return nil
-			}))
-			if c.observatory == nil {
-				return nil
-			}
-		}
-		resp := map[string]*observatory.OutboundStatus{}
-		if o, err := c.observatory.GetObservation(context.Background()); err != nil {
-			return err
-		} else {
-			for _, x := range o.(*observatory.ObservationResult).GetStatus() {
-				resp[x.OutboundTag] = x
-			}
-		}
-		return resp
-	}))
 	return c, nil
 }

@@ -85,46 +50,172 @@ func (p *MetricsHandler) Type() interface{} {
 }

 func (p *MetricsHandler) Start() error {
+	handler := p.httpHandler()

 	// direct listen a port if listen is set
 	if p.listen != "" {
-		TCPlistener, err := net.Listen("tcp", p.listen)
+		TCPlistener, err := xnet.Listen("tcp", p.listen)
 		if err != nil {
 			return err
 		}
 		p.tcpListener = TCPlistener
 		errors.LogInfo(context.Background(), "Metrics server listening on ", p.listen)

-		go func() {
-			if err := http.Serve(TCPlistener, http.DefaultServeMux); err != nil {
-				errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
-			}
-		}()
+		go p.serve(TCPlistener, handler)
+	}
+
+	if p.tag == "" {
+		if p.tcpListener == nil {
+			return errors.New("metrics must have a tag or listen address")
+		}
+		return nil
 	}

 	listener := &OutboundListener{
-		buffer: make(chan net.Conn, 4),
+		buffer: make(chan xnet.Conn, 4),
 		done:   done.New(),
 	}
+	p.listener = listener

-	go func() {
-		if err := http.Serve(listener, http.DefaultServeMux); err != nil {
-			errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
-		}
-	}()
+	go p.serve(listener, handler)

 	if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
 		errors.LogInfo(context.Background(), "failed to remove existing handler")
 	}

-	return p.ohm.AddHandler(context.Background(), &Outbound{
+	if err := p.ohm.AddHandler(context.Background(), &Outbound{
 		tag:      p.tag,
 		listener: listener,
-	})
+	}); err != nil {
+		if closeErr := p.Close(); closeErr != nil {
+			errors.LogErrorInner(context.Background(), closeErr, "failed to close metrics server after start failure")
+		}
+		return err
+	}
+
+	return nil
 }

 func (p *MetricsHandler) Close() error {
-	return nil
+	var errs []error
+	if p.tcpListener != nil {
+		errs = append(errs, p.tcpListener.Close())
+		p.tcpListener = nil
+	}
+	if p.listener != nil {
+		errs = append(errs, p.listener.Close())
+		p.listener = nil
+	}
+	if p.ohm != nil && p.tag != "" {
+		if err := p.ohm.RemoveHandler(context.Background(), p.tag); err != nil {
+			errors.LogInfo(context.Background(), "failed to remove metrics handler")
+		}
+	}
+	return errors.Combine(errs...)
+}
+
+func (p *MetricsHandler) serve(listener xnet.Listener, handler http.Handler) {
+	if err := http.Serve(listener, handler); err != nil && !isClosedListenerError(err) {
+		errors.LogErrorInner(context.Background(), err, "failed to start metrics server")
+	}
+}
+
+func isClosedListenerError(err error) bool {
+	if err == nil {
+		return true
+	}
+	if stderrors.Is(err, stdnet.ErrClosed) || stderrors.Is(err, http.ErrServerClosed) {
+		return true
+	}
+	errText := err.Error()
+	return strings.Contains(errText, "listen closed") ||
+		strings.Contains(errText, "use of closed network connection")
+}
+
+func (p *MetricsHandler) httpHandler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/debug/vars", p.handleDebugVars)
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	return mux
+}
+
+func (p *MetricsHandler) handleDebugVars(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	vars := map[string]json.RawMessage{}
+	expvar.Do(func(kv expvar.KeyValue) {
+		value := json.RawMessage(kv.Value.String())
+		if !json.Valid(value) {
+			value = json.RawMessage("null")
+		}
+		vars[kv.Key] = value
+	})
+	vars["stats"] = marshalJSON(p.stats())
+	vars["observatory"] = marshalJSON(p.observatoryStatus())
+
+	payload, err := json.Marshal(vars)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Write(payload)
+}
+
+func marshalJSON(value interface{}) json.RawMessage {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return json.RawMessage("null")
+	}
+	return data
+}
+
+func (p *MetricsHandler) stats() map[string]map[string]map[string]int64 {
+	resp := map[string]map[string]map[string]int64{
+		"inbound":  {},
+		"outbound": {},
+		"user":     {},
+	}
+	p.statsManager.VisitCounters(func(name string, counter feature_stats.Counter) bool {
+		nameSplit := strings.Split(name, ">>>")
+		if len(nameSplit) < 4 {
+			return true
+		}
+		typeName, tagOrUser, direction := nameSplit[0], nameSplit[1], nameSplit[3]
+		items, found := resp[typeName]
+		if !found {
+			items = map[string]map[string]int64{}
+			resp[typeName] = items
+		}
+		if item, found := items[tagOrUser]; found {
+			item[direction] = counter.Value()
+		} else {
+			items[tagOrUser] = map[string]int64{
+				direction: counter.Value(),
+			}
+		}
+		return true
+	})
+	return resp
+}
+
+func (p *MetricsHandler) observatoryStatus() interface{} {
+	feature := core.MustFromContext(p.ctx).GetFeature(extension.ObservatoryType())
+	if feature == nil {
+		return nil
+	}
+	observatoryFeature := feature.(extension.Observatory)
+	resp := map[string]*observatory.OutboundStatus{}
+	if o, err := observatoryFeature.GetObservation(context.Background()); err != nil {
+		return err
+	} else {
+		for _, x := range o.(*observatory.ObservationResult).GetStatus() {
+			resp[x.OutboundTag] = x
+		}
+	}
+	return resp
 }

 func init() {
@@ -0,0 +1,161 @@
+package metrics
+
+import (
+	"context"
+	"encoding/json"
+	stdnet "net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/xtls/xray-core/app/dispatcher"
+	"github.com/xtls/xray-core/app/proxyman"
+	_ "github.com/xtls/xray-core/app/proxyman/inbound"
+	_ "github.com/xtls/xray-core/app/proxyman/outbound"
+	appstats "github.com/xtls/xray-core/app/stats"
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/core"
+	feature_outbound "github.com/xtls/xray-core/features/outbound"
+)
+
+func TestMetricsCanRestartInSameProcess(t *testing.T) {
+	for i := 0; i < 2; i++ {
+		server := startMetricsTestServer(t)
+		readMetricsVars(t, server)
+		readMetricsPprof(t, server)
+		if err := server.Close(); err != nil {
+			t.Fatalf("failed to close metrics server: %v", err)
+		}
+	}
+}
+
+func TestMetricsCanRunMultipleInstancesInSameProcess(t *testing.T) {
+	server1 := startMetricsTestServer(t)
+	t.Cleanup(func() {
+		_ = server1.Close()
+	})
+	server2 := startMetricsTestServer(t)
+	t.Cleanup(func() {
+		_ = server2.Close()
+	})
+
+	readMetricsVars(t, server1)
+	readMetricsVars(t, server2)
+}
+
+func TestMetricsListenOnlyWithoutTagDoesNotRegisterOutbound(t *testing.T) {
+	listen := pickMetricsListenAddress(t)
+	server := startMetricsTestServerWithMetricsConfig(t, &Config{
+		Listen: listen,
+	})
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+
+	response, err := http.Get("http://" + listen + "/debug/vars")
+	if err != nil {
+		t.Fatalf("failed to read listen-only metrics: %v", err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("unexpected listen-only metrics status: %d", response.StatusCode)
+	}
+
+	outboundManager := server.GetFeature(feature_outbound.ManagerType()).(feature_outbound.Manager)
+	if handlers := outboundManager.ListHandlers(context.Background()); len(handlers) != 0 {
+		t.Fatalf("listen-only metrics registered outbound handlers: got %d, want 0", len(handlers))
+	}
+}
+
+func startMetricsTestServer(t *testing.T) *core.Instance {
+	return startMetricsTestServerWithMetricsConfig(t, &Config{
+		Tag: "metrics_out",
+	})
+}
+
+func startMetricsTestServerWithMetricsConfig(t *testing.T, metricsConfig *Config) *core.Instance {
+	t.Helper()
+
+	server, err := core.New(metricsTestConfig(metricsConfig))
+	if err != nil {
+		t.Fatalf("failed to create metrics server: %v", err)
+	}
+	if err := server.Start(); err != nil {
+		_ = server.Close()
+		t.Fatalf("failed to start metrics server: %v", err)
+	}
+	return server
+}
+
+func metricsTestConfig(metricsConfig *Config) *core.Config {
+	return &core.Config{
+		App: []*serial.TypedMessage{
+			serial.ToTypedMessage(&dispatcher.Config{}),
+			serial.ToTypedMessage(&proxyman.InboundConfig{}),
+			serial.ToTypedMessage(&proxyman.OutboundConfig{}),
+			serial.ToTypedMessage(&appstats.Config{}),
+			serial.ToTypedMessage(metricsConfig),
+		},
+	}
+}
+
+func pickMetricsListenAddress(t *testing.T) string {
+	t.Helper()
+
+	listener, err := stdnet.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to pick metrics listen address: %v", err)
+	}
+	defer listener.Close()
+	return listener.Addr().String()
+}
+
+func readMetricsVars(t *testing.T, server *core.Instance) {
+	t.Helper()
+
+	recorder := httptest.NewRecorder()
+	metricsHandler(t, server).httpHandler().ServeHTTP(
+		recorder,
+		httptest.NewRequest(http.MethodGet, "/debug/vars", nil),
+	)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected metrics vars status: %d", recorder.Code)
+	}
+
+	var payload map[string]interface{}
+	if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
+		t.Fatalf("failed to decode metrics vars: %v", err)
+	}
+	if _, found := payload["stats"]; !found {
+		t.Fatal("metrics vars missing stats")
+	}
+	if _, found := payload["observatory"]; !found {
+		t.Fatal("metrics vars missing observatory")
+	}
+}
+
+func readMetricsPprof(t *testing.T, server *core.Instance) {
+	t.Helper()
+
+	recorder := httptest.NewRecorder()
+	metricsHandler(t, server).httpHandler().ServeHTTP(
+		recorder,
+		httptest.NewRequest(http.MethodGet, "/debug/pprof/goroutine?debug=1", nil),
+	)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected metrics pprof status: %d", recorder.Code)
+	}
+}
+
+func metricsHandler(t *testing.T, server *core.Instance) *MetricsHandler {
+	t.Helper()
+
+	feature := server.GetFeature((*MetricsHandler)(nil))
+	handler, ok := feature.(*MetricsHandler)
+	if !ok || handler == nil {
+		t.Fatal("metrics handler not registered")
+	}
+	return handler
+}
@@ -2,7 +2,6 @@ package burst

 import (
 	"context"
-
 	"sync"

 	"github.com/xtls/xray-core/app/observatory"
@@ -72,7 +71,6 @@ func (o *Observer) Start() error {
 		o.hp.StartScheduler(func() ([]string, error) {
 			hs, ok := o.ohm.(outbound.HandlerSelector)
 			if !ok {
-
 				return nil, errors.New("outbound.Manager is not a HandlerSelector")
 			}

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"

 	"github.com/xtls/xray-core/common/dice"
@@ -24,11 +25,12 @@ type HealthPingSettings struct {

 // HealthPing is the health checker for balancers
 type HealthPing struct {
-	ctx         context.Context
-	dispatcher  routing.Dispatcher
-	access      sync.Mutex
-	ticker      *time.Ticker
-	tickerClose chan struct{}
+	ctx           context.Context
+	cancelCtx     context.CancelFunc
+	cancelPending atomic.Pointer[context.CancelFunc]
+	dispatcher    routing.Dispatcher
+	access        sync.Mutex
+	ticker        *time.Ticker

 	Settings *HealthPingSettings
 	Results  map[string]*HealthPingRTTS
@@ -62,10 +64,10 @@ func NewHealthPing(ctx context.Context, dispatcher routing.Dispatcher, config *H
 		settings.Destination = "https://connectivitycheck.gstatic.com/generate_204"
 	}
 	if settings.Interval == 0 {
-		settings.Interval = time.Duration(1) * time.Minute
-	} else if settings.Interval < 10 {
+		settings.Interval = 1 * time.Minute
+	} else if settings.Interval < 10*time.Second {
 		errors.LogWarning(ctx, "health check interval is too small, 10s is applied")
-		settings.Interval = time.Duration(10) * time.Second
+		settings.Interval = 10 * time.Second
 	}
 	if settings.SamplingCount <= 0 {
 		settings.SamplingCount = 10
@@ -73,10 +75,12 @@ func NewHealthPing(ctx context.Context, dispatcher routing.Dispatcher, config *H
 	if settings.Timeout <= 0 {
 		// results are saved after all health pings finish,
 		// a larger timeout could possibly makes checks run longer
-		settings.Timeout = time.Duration(5) * time.Second
+		settings.Timeout = 5 * time.Second
 	}
+	ctx, cancel := context.WithCancel(ctx)
 	return &HealthPing{
 		ctx:        ctx,
+		cancelCtx:  cancel,
 		dispatcher: dispatcher,
 		Settings:   settings,
 		Results:    nil,
@@ -90,9 +94,9 @@ func (h *HealthPing) StartScheduler(selector func() ([]string, error)) {
 	}
 	interval := h.Settings.Interval * time.Duration(h.Settings.SamplingCount)
 	ticker := time.NewTicker(interval)
-	tickerClose := make(chan struct{})
 	h.ticker = ticker
-	h.tickerClose = tickerClose
+
+	// init run to get a fast check result
 	go func() {
 		tags, err := selector()
 		if err != nil {
@@ -110,13 +114,20 @@ func (h *HealthPing) StartScheduler(selector func() ([]string, error)) {
 					errors.LogWarning(h.ctx, "error select outbounds for scheduled health check: ", err)
 					return
 				}
-				h.doCheck(tags, interval, h.Settings.SamplingCount)
+				subCtx, cancel := context.WithCancel(h.ctx)
+				old := h.cancelPending.Swap(&cancel)
+				if old != nil {
+					errors.LogDebug(h.ctx, "scheduled health check not finished before next round, canceling previous one")
+					(*old)()
+				}
+				h.doCheck(subCtx, tags, interval, h.Settings.SamplingCount)
+				h.cancelPending.CompareAndSwap(&cancel, nil)
 				h.Cleanup(tags)
 			}()
 			select {
 			case <-ticker.C:
 				continue
-			case <-tickerClose:
+			case <-h.ctx.Done():
 				return
 			}
 		}
@@ -130,8 +141,7 @@ func (h *HealthPing) StopScheduler() {
 	}
 	h.ticker.Stop()
 	h.ticker = nil
-	close(h.tickerClose)
-	h.tickerClose = nil
+	h.cancelCtx()
 }

 // Check implements the HealthChecker
@@ -140,7 +150,7 @@ func (h *HealthPing) Check(tags []string) error {
 		return nil
 	}
 	errors.LogInfo(h.ctx, "perform one-time health check for tags ", tags)
-	h.doCheck(tags, 0, 1)
+	h.doCheck(h.ctx, tags, 0, 1)
 	return nil
 }

@@ -151,13 +161,14 @@ type rtt struct {

 // doCheck performs the 'rounds' amount checks in given 'duration'. You should make
 // sure all tags are valid for current balancer
-func (h *HealthPing) doCheck(tags []string, duration time.Duration, rounds int) {
+// cancel ctx will stop all pending checks
+func (h *HealthPing) doCheck(ctx context.Context, tags []string, duration time.Duration, rounds int) {
 	count := len(tags) * rounds
 	if count == 0 {
 		return
 	}
 	ch := make(chan *rtt, count)
-
+	timers := make([]*time.Timer, 0, count)
 	for _, tag := range tags {
 		handler := tag
 		client := newPingClient(
@@ -172,7 +183,7 @@ func (h *HealthPing) doCheck(tags []string, duration time.Duration, rounds int)
 			if duration > 0 {
 				delay = time.Duration(dice.RollInt63n(int64(duration)))
 			}
-			time.AfterFunc(delay, func() {
+			timers = append(timers, time.AfterFunc(delay, func() {
 				errors.LogDebug(h.ctx, "checking ", handler)
 				delay, err := client.MeasureDelay(h.Settings.HttpMethod)
 				if err == nil {
@@ -200,14 +211,21 @@ func (h *HealthPing) doCheck(tags []string, duration time.Duration, rounds int)
 					handler: handler,
 					value:   rttFailed,
 				}
-			})
+			}))
 		}
 	}
 	for i := 0; i < count; i++ {
-		rtt := <-ch
-		if rtt.value > 0 {
-			// should not put results when network is down
-			h.PutResult(rtt.handler, rtt.value)
+		select {
+		case rtt := <-ch:
+			if rtt.value > 0 {
+				// should not put results when network is down
+				h.PutResult(rtt.handler, rtt.value)
+			}
+		case <-ctx.Done():
+			for _, timer := range timers {
+				timer.Stop()
+			}
+			return
 		}
 	}
 }
@@ -59,7 +59,7 @@ func (h *HealthPingRTTS) Put(d time.Duration) {
 	if h.rtts == nil {
 		h.rtts = make([]*pingRTT, h.cap)
 		for i := 0; i < h.cap; i++ {
-			h.rtts[i] = &pingRTT{}
+			h.rtts[i] = &pingRTT{value: rttUntested}
 		}
 		h.idx = -1
 	}
@@ -88,7 +88,7 @@ func (h *HealthPingRTTS) getStatistics() *HealthPingStats {
 	validRTTs := make([]time.Duration, 0)
 	for _, rtt := range h.rtts {
 		switch {
-		case rtt.value == 0 || time.Since(rtt.time) > h.validity:
+		case rtt.value == rttUntested || time.Since(rtt.time) > h.validity:
 			continue
 		case rtt.value == rttFailed:
 			stats.Fail++
@@ -78,6 +78,12 @@ func (o *Observer) background() {
 			sleepTime = time.Duration(o.config.ProbeInterval)
 		}

+		if len(outbounds) == 0 {
+			errors.LogWarning(o.ctx, "no outbound matches subjectSelector ", o.config.SubjectSelector)
+			time.Sleep(sleepTime)
+			continue
+		}
+
 		if !o.config.EnableConcurrency {
 			sort.Strings(outbounds)
 			for _, v := range outbounds {
@@ -186,7 +192,7 @@ func (o *Observer) probe(outbound string) ProbeResult {
 		return nil
 	})
 	if err != nil {
-		var errorMessage = "the outbound " + outbound + " is dead: GET request failed:" + err.Error() + "with outbound handler report underlying connection failed"
+		errorMessage := "the outbound " + outbound + " is dead: GET request failed:" + err.Error() + "with outbound handler report underlying connection failed"
 		errors.LogInfoInner(o.ctx, errorCollectorForRequest.UnderlyingError(), errorMessage)
 		return ProbeResult{Alive: false, LastErrorReason: errorMessage}
 	}
@@ -138,7 +138,7 @@ func (s *handlerServer) GetInboundUsers(ctx context.Context, request *GetInbound
 	if len(request.Email) > 0 {
 		return &GetInboundUserResponse{Users: []*protocol.User{protocol.ToProtoUser(um.GetUser(ctx, request.Email))}}, nil
 	}
-	var result = make([]*protocol.User, 0, 100)
+	result := make([]*protocol.User, 0, 100)
 	users := um.GetUsers(ctx)
 	for _, u := range users {
 		result = append(result, protocol.ToProtoUser(u))
@@ -330,7 +330,6 @@ type SenderConfig struct {
 	// Send traffic through the given IP. Only IP is allowed.
 	Via               *net.IPOrDomain         `protobuf:"bytes,1,opt,name=via,proto3" json:"via,omitempty"`
 	StreamSettings    *internet.StreamConfig  `protobuf:"bytes,2,opt,name=stream_settings,json=streamSettings,proto3" json:"stream_settings,omitempty"`
-	ProxySettings     *internet.ProxyConfig   `protobuf:"bytes,3,opt,name=proxy_settings,json=proxySettings,proto3" json:"proxy_settings,omitempty"`
 	MultiplexSettings *MultiplexingConfig     `protobuf:"bytes,4,opt,name=multiplex_settings,json=multiplexSettings,proto3" json:"multiplex_settings,omitempty"`
 	ViaCidr           string                  `protobuf:"bytes,5,opt,name=via_cidr,json=viaCidr,proto3" json:"via_cidr,omitempty"`
 	TargetStrategy    internet.DomainStrategy `protobuf:"varint,6,opt,name=target_strategy,json=targetStrategy,proto3,enum=xray.transport.internet.DomainStrategy" json:"target_strategy,omitempty"`
@@ -382,13 +381,6 @@ func (x *SenderConfig) GetStreamSettings() *internet.StreamConfig {
 	return nil
 }

-func (x *SenderConfig) GetProxySettings() *internet.ProxyConfig {
-	if x != nil {
-		return x.ProxySettings
-	}
-	return nil
-}
-
 func (x *SenderConfig) GetMultiplexSettings() *MultiplexingConfig {
 	if x != nil {
 		return x.MultiplexSettings
@@ -506,14 +498,13 @@ const file_app_proxyman_config_proto_rawDesc = "" +
 	"\x03tag\x18\x01 \x01(\tR\x03tag\x12M\n" +
 	"\x11receiver_settings\x18\x02 \x01(\v2 .xray.common.serial.TypedMessageR\x10receiverSettings\x12G\n" +
 	"\x0eproxy_settings\x18\x03 \x01(\v2 .xray.common.serial.TypedMessageR\rproxySettings\"\x10\n" +
-	"\x0eOutboundConfig\"\x9d\x03\n" +
+	"\x0eOutboundConfig\"\xd6\x02\n" +
 	"\fSenderConfig\x12-\n" +
 	"\x03via\x18\x01 \x01(\v2\x1b.xray.common.net.IPOrDomainR\x03via\x12N\n" +
-	"\x0fstream_settings\x18\x02 \x01(\v2%.xray.transport.internet.StreamConfigR\x0estreamSettings\x12K\n" +
-	"\x0eproxy_settings\x18\x03 \x01(\v2$.xray.transport.internet.ProxyConfigR\rproxySettings\x12T\n" +
+	"\x0fstream_settings\x18\x02 \x01(\v2%.xray.transport.internet.StreamConfigR\x0estreamSettings\x12T\n" +
 	"\x12multiplex_settings\x18\x04 \x01(\v2%.xray.app.proxyman.MultiplexingConfigR\x11multiplexSettings\x12\x19\n" +
 	"\bvia_cidr\x18\x05 \x01(\tR\aviaCidr\x12P\n" +
-	"\x0ftarget_strategy\x18\x06 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0etargetStrategy\"\xa4\x01\n" +
+	"\x0ftarget_strategy\x18\x06 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0etargetStrategyJ\x04\b\x03\x10\x04\"\xa4\x01\n" +
 	"\x12MultiplexingConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12 \n" +
 	"\vconcurrency\x18\x02 \x01(\x05R\vconcurrency\x12(\n" +
@@ -548,8 +539,7 @@ var file_app_proxyman_config_proto_goTypes = []any{
 	(*net.IPOrDomain)(nil),        // 10: xray.common.net.IPOrDomain
 	(*internet.StreamConfig)(nil), // 11: xray.transport.internet.StreamConfig
 	(*serial.TypedMessage)(nil),   // 12: xray.common.serial.TypedMessage
-	(*internet.ProxyConfig)(nil),  // 13: xray.transport.internet.ProxyConfig
-	(internet.DomainStrategy)(0),  // 14: xray.transport.internet.DomainStrategy
+	(internet.DomainStrategy)(0),  // 13: xray.transport.internet.DomainStrategy
 }
 var file_app_proxyman_config_proto_depIdxs = []int32{
 	7,  // 0: xray.app.proxyman.SniffingConfig.domains_excluded:type_name -> xray.common.geodata.DomainRule
@@ -562,14 +552,13 @@ var file_app_proxyman_config_proto_depIdxs = []int32{
 	12, // 7: xray.app.proxyman.InboundHandlerConfig.proxy_settings:type_name -> xray.common.serial.TypedMessage
 	10, // 8: xray.app.proxyman.SenderConfig.via:type_name -> xray.common.net.IPOrDomain
 	11, // 9: xray.app.proxyman.SenderConfig.stream_settings:type_name -> xray.transport.internet.StreamConfig
-	13, // 10: xray.app.proxyman.SenderConfig.proxy_settings:type_name -> xray.transport.internet.ProxyConfig
-	6,  // 11: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
-	14, // 12: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
-	13, // [13:13] is the sub-list for method output_type
-	13, // [13:13] is the sub-list for method input_type
-	13, // [13:13] is the sub-list for extension type_name
-	13, // [13:13] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	6,  // 10: xray.app.proxyman.SenderConfig.multiplex_settings:type_name -> xray.app.proxyman.MultiplexingConfig
+	13, // 11: xray.app.proxyman.SenderConfig.target_strategy:type_name -> xray.transport.internet.DomainStrategy
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }

 func init() { file_app_proxyman_config_proto_init() }
@@ -57,7 +57,7 @@ message SenderConfig {
  // Send traffic through the given IP. Only IP is allowed.
  xray.common.net.IPOrDomain via = 1;
  xray.transport.internet.StreamConfig stream_settings = 2;
-  xray.transport.internet.ProxyConfig proxy_settings = 3;
+  reserved 3;
  MultiplexingConfig multiplex_settings = 4;
  string via_cidr = 5;
  xray.transport.internet.DomainStrategy target_strategy = 6;
@@ -26,7 +26,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		c, _ := statsManager.GetOrRegisterCounter(name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -34,7 +34,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.InboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "inbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		c, _ := statsManager.GetOrRegisterCounter(name)
 		if c != nil {
 			downlinkCounter = c
 		}
@@ -57,16 +57,23 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *
 	if err != nil {
 		return nil, err
 	}
-
-	// Set tag and sniffing config in context before creating proxy
-	// This allows proxies like TUN to access these settings
-	ctx = session.ContextWithInbound(ctx, &session.Inbound{Tag: tag})
-	if receiverConfig.SniffingSettings != nil {
-		ctx = session.ContextWithContent(ctx, &session.Content{
-			SniffingRequest: sniffingRequest,
-		})
+	src := net.TCPDestination(net.AnyIP, 0)
+	if receiverConfig.Listen != nil {
+		src.Address = receiverConfig.Listen.AsAddress()
 	}
-	rawProxy, err := common.CreateObject(ctx, proxyConfig)
+	if receiverConfig.PortList != nil && len(receiverConfig.PortList.Range) > 0 {
+		src.Port = net.Port(receiverConfig.PortList.Range[0].From)
+	}
+	mss, err := internet.ToMemoryStreamConfig(receiverConfig.StreamSettings)
+	if err != nil {
+		return nil, errors.New("failed to parse stream config").Base(err)
+	}
+
+	newCtx := session.ContextWithInbound(ctx, &session.Inbound{Tag: tag, Source: src})
+	newCtx = session.ContextWithContent(newCtx, &session.Content{SniffingRequest: sniffingRequest})
+	newCtx = session.ContextWithStreamSettings(newCtx, mss)
+
+	rawProxy, err := common.CreateObject(newCtx, proxyConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -92,11 +99,6 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *
 		address = net.AnyIP
 	}

-	mss, err := internet.ToMemoryStreamConfig(receiverConfig.StreamSettings)
-	if err != nil {
-		return nil, errors.New("failed to parse stream config").Base(err).AtWarning()
-	}
-
 	if receiverConfig.ReceiveOriginalDestination {
 		if mss.SocketSettings == nil {
 			mss.SocketSettings = &internet.SocketConfig{}
@@ -170,6 +172,12 @@ func NewAlwaysOnInboundHandler(ctx context.Context, tag string, receiverConfig *

 // Start implements common.Runnable.
 func (h *AlwaysOnInboundHandler) Start() error {
+	// for inbound without worker (TUN)
+	if run, ok := h.proxy.(common.Runnable); ok {
+		if err := run.Start(); err != nil {
+			return errors.New("failed to start proxy").Base(err)
+		}
+	}
 	for _, worker := range h.workers {
 		if err := worker.Start(); err != nil {
 			return err
@@ -16,10 +16,10 @@ import (

 // Manager manages all inbound handlers.
 type Manager struct {
-	access          sync.RWMutex
+	access           sync.RWMutex
 	untaggedHandlers []inbound.Handler
-	taggedHandlers  map[string]inbound.Handler
-	running         bool
+	taggedHandlers   map[string]inbound.Handler
+	running          bool
 }

 // New returns a new Manager for inbound handlers.
@@ -165,7 +165,7 @@ func NewHandler(ctx context.Context, config *core.InboundHandlerConfig) (inbound

 	receiverSettings, ok := rawReceiverSettings.(*proxyman.ReceiverConfig)
 	if !ok {
-		return nil, errors.New("not a ReceiverConfig").AtError()
+		return nil, errors.New("not a ReceiverConfig")
 	}

 	streamSettings := receiverSettings.StreamSettings
@@ -142,7 +142,7 @@ func (w *tcpWorker) Start() error {
 		go w.callback(conn)
 	})
 	if err != nil {
-		return errors.New("failed to listen TCP on ", w.port).AtWarning().Base(err)
+		return errors.New("failed to listen TCP on ", w.port).Base(err)
 	}
 	w.hub = hub
 	return nil
@@ -528,7 +528,7 @@ func (w *dsWorker) Start() error {
 		go w.callback(conn)
 	})
 	if err != nil {
-		return errors.New("failed to listen Unix Domain Socket on ", w.address).AtWarning().Base(err)
+		return errors.New("failed to listen Unix Domain Socket on ", w.address).Base(err)
 	}
 	w.hub = hub
 	return nil
@@ -6,7 +6,6 @@ import (
 	goerrors "errors"
 	"io"
 	"math/big"
-	"os"

 	"github.com/xtls/xray-core/common/dice"

@@ -16,7 +15,6 @@ import (
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/mux"
 	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/common/net/cnc"
 	"github.com/xtls/xray-core/common/serial"
 	"github.com/xtls/xray-core/common/session"
 	"github.com/xtls/xray-core/core"
@@ -27,8 +25,6 @@ import (
 	"github.com/xtls/xray-core/transport"
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/stat"
-	"github.com/xtls/xray-core/transport/internet/tls"
-	"github.com/xtls/xray-core/transport/pipe"
 	"google.golang.org/protobuf/proto"
 )

@@ -40,7 +36,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundUplink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>uplink"
-		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		c, _ := statsManager.GetOrRegisterCounter(name)
 		if c != nil {
 			uplinkCounter = c
 		}
@@ -48,7 +44,7 @@ func getStatCounter(v *core.Instance, tag string) (stats.Counter, stats.Counter)
 	if len(tag) > 0 && policy.ForSystem().Stats.OutboundDownlink {
 		statsManager := v.GetFeature(stats.ManagerType()).(stats.Manager)
 		name := "outbound>>>" + tag + ">>>traffic>>>downlink"
-		c, _ := stats.GetOrRegisterCounter(statsManager, name)
+		c, _ := statsManager.GetOrRegisterCounter(name)
 		if c != nil {
 			downlinkCounter = c
 		}
@@ -64,7 +60,6 @@ type Handler struct {
 	streamSettings  *internet.MemoryStreamConfig
 	proxyConfig     proto.Message
 	proxy           proxy.Outbound
-	outboundManager outbound.Manager
 	mux             *mux.ClientManager
 	xudp            *mux.ClientManager
 	udp443          string
@@ -78,7 +73,6 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou
 	uplinkCounter, downlinkCounter := getStatCounter(v, config.Tag)
 	h := &Handler{
 		tag:             config.Tag,
-		outboundManager: v.GetFeature(outbound.ManagerType()).(outbound.Manager),
 		uplinkCounter:   uplinkCounter,
 		downlinkCounter: downlinkCounter,
 	}
@@ -93,7 +87,7 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou
 			h.senderSettings = s
 			mss, err := internet.ToMemoryStreamConfig(s.StreamSettings)
 			if err != nil {
-				return nil, errors.New("failed to parse stream settings").Base(err).AtWarning()
+				return nil, errors.New("failed to parse stream settings").Base(err)
 			}
 			h.streamSettings = mss
 		default:
@@ -109,6 +103,10 @@ func NewHandler(ctx context.Context, config *core.OutboundHandlerConfig) (outbou

 	ctx = session.ContextWithFullHandler(ctx, h)

+	if h.streamSettings != nil {
+		ctx = session.ContextWithStreamSettings(ctx, h.streamSettings)
+	}
+
 	rawProxyHandler, err := common.CreateObject(ctx, proxyConfig)
 	if err != nil {
 		return nil, err
@@ -196,7 +194,6 @@ func (h *Handler) Dispatch(ctx context.Context, link *transport.Link) {
 				common.Interrupt(link.Reader)
 				return
 			}
-
 		} else {
 			unchangedDomain := ob.Target.Address.Domain()
 			ob.Target.Address = net.IPAddress(ips[dice.Roll(len(ips))])
@@ -220,7 +217,7 @@ func (h *Handler) Dispatch(ctx context.Context, link *transport.Link) {
 		if ob.Target.Network == net.Network_UDP && ob.Target.Port == 443 {
 			switch h.udp443 {
 			case "reject":
-				test(errors.New("XUDP rejected UDP/443 traffic").AtInfo())
+				test(errors.New("XUDP rejected UDP/443 traffic"))
 				return
 			case "skip":
 				goto out
@@ -269,71 +266,26 @@ func (h *Handler) DestIpAddress() net.IP {

 // Dial implements internet.Dialer.
 func (h *Handler) Dial(ctx context.Context, dest net.Destination) (stat.Connection, error) {
-	if h.senderSettings != nil {
-
-		if h.senderSettings.ProxySettings.HasTag() {
-
-			tag := h.senderSettings.ProxySettings.Tag
-			handler := h.outboundManager.GetHandler(tag)
-			if handler != nil {
-				errors.LogDebug(ctx, "proxying to ", tag, " for dest ", dest)
-				outbounds := session.OutboundsFromContext(ctx)
-				ctx = session.ContextWithOutbounds(ctx, append(outbounds, &session.Outbound{
-					Target: dest,
-					Tag:    tag,
-				})) // add another outbound in session ctx
-				opts := pipe.OptionsFromContext(ctx)
-				uplinkReader, uplinkWriter := pipe.New(opts...)
-				downlinkReader, downlinkWriter := pipe.New(opts...)
-
-				go handler.Dispatch(ctx, &transport.Link{Reader: uplinkReader, Writer: downlinkWriter})
-				conn := cnc.NewConnection(cnc.ConnectionInputMulti(uplinkWriter), cnc.ConnectionOutputMulti(downlinkReader))
-
-				if config := tls.ConfigFromStreamSettings(h.streamSettings); config != nil {
-					tlsConfig := config.GetTLSConfig(tls.WithDestination(dest))
-					conn = tls.Client(conn, tlsConfig)
-				}
-
-				return h.getStatCouterConnection(conn), nil
-			}
-
-			errors.LogError(ctx, "failed to get outbound handler with tag: ", tag)
-			return nil, errors.New("failed to get outbound handler with tag: " + tag)
-		}
-
-		if h.senderSettings.Via != nil {
-			outbounds := session.OutboundsFromContext(ctx)
-			ob := outbounds[len(outbounds)-1]
-			h.SetOutboundGateway(ctx, ob)
-		}
-
-	}
-
-	if conn, err := h.getUoTConnection(ctx, dest); err != os.ErrInvalid {
-		return conn, err
+	if h.senderSettings != nil && h.senderSettings.Via != nil {
+		outbounds := session.OutboundsFromContext(ctx)
+		ob := outbounds[len(outbounds)-1]
+		h.SetOutboundGateway(ctx, ob)
 	}

 	conn, err := internet.Dial(ctx, dest, h.streamSettings)
 	conn = h.getStatCouterConnection(conn)
-	outbounds := session.OutboundsFromContext(ctx)
-	if outbounds != nil {
-		ob := outbounds[len(outbounds)-1]
-		ob.Conn = conn
-	} else {
-		// for Vision's pre-connect
-	}
 	return conn, err
 }

 func (h *Handler) SetOutboundGateway(ctx context.Context, ob *session.Outbound) {
-	if ob.Gateway == nil && h.senderSettings != nil && h.senderSettings.Via != nil && !h.senderSettings.ProxySettings.HasTag() && (h.streamSettings.SocketSettings == nil || len(h.streamSettings.SocketSettings.DialerProxy) == 0) {
+	if ob.Gateway == nil && h.senderSettings != nil && h.senderSettings.Via != nil &&
+		(h.streamSettings.SocketSettings == nil || len(h.streamSettings.SocketSettings.DialerProxy) == 0) {
 		var domain string
 		addr := h.senderSettings.Via.AsAddress()
 		domain = h.senderSettings.Via.GetDomain()
 		switch {
 		case h.senderSettings.ViaCidr != "":
 			ob.Gateway = ParseRandomIP(addr, h.senderSettings.ViaCidr)
-
 		case domain == "origin":
 			if inbound := session.InboundFromContext(ctx); inbound != nil {
 				if inbound.Local.IsValid() && inbound.Local.Address.Family().IsIP() {
@@ -348,12 +300,9 @@ func (h *Handler) SetOutboundGateway(ctx context.Context, ob *session.Outbound)
 					errors.LogDebug(ctx, "use inbound source ip as sendthrough: ", inbound.Source.Address.String())
 				}
 			}
-		//case addr.Family().IsDomain():
-		default:
+		default: // case addr.Family().IsDomain():
 			ob.Gateway = addr
-
 		}
-
 	}
 }

@@ -396,7 +345,6 @@ func (h *Handler) ProxySettings() *serial.TypedMessage {
 }

 func ParseRandomIP(addr net.Address, prefix string) net.Address {
-
 	_, ipnet, _ := net.ParseCIDR(addr.IP().String() + "/" + prefix)

 	ones, bits := ipnet.Mask.Size()
@@ -22,8 +22,8 @@ import (
 )

 func TestInterfaces(t *testing.T) {
-	_ = (outbound.Handler)(new(Handler))
-	_ = (outbound.Manager)(new(Manager))
+	_ = outbound.Handler(new(Handler))
+	_ = outbound.Manager(new(Manager))
 }

 const xrayKey core.XrayKey = 1
@@ -43,7 +43,7 @@ func TestOutboundWithoutStatCounter(t *testing.T) {
 	}

 	v, _ := core.New(config)
-	v.AddFeature((outbound.Manager)(new(Manager)))
+	v.AddFeature(outbound.Manager(new(Manager)))
 	ctx := context.WithValue(context.Background(), xrayKey, v)
 	ctx = session.ContextWithOutbounds(ctx, []*session.Outbound{{}})
 	h, _ := NewHandler(ctx, &core.OutboundHandlerConfig{
@@ -73,7 +73,7 @@ func TestOutboundWithStatCounter(t *testing.T) {
 	}

 	v, _ := core.New(config)
-	v.AddFeature((outbound.Manager)(new(Manager)))
+	v.AddFeature(outbound.Manager(new(Manager)))
 	ctx := context.WithValue(context.Background(), xrayKey, v)
 	ctx = session.ContextWithOutbounds(ctx, []*session.Outbound{{}})
 	h, _ := NewHandler(ctx, &core.OutboundHandlerConfig{
@@ -88,7 +88,6 @@ func TestOutboundWithStatCounter(t *testing.T) {
 }

 func TestTagsCache(t *testing.T) {
-
 	test_duration := 10 * time.Second
 	threads_num := 50
 	delay := 10 * time.Millisecond
@@ -162,7 +162,6 @@ func (m *Manager) ListHandlers(ctx context.Context) []outbound.Handler {

 // Select implements outbound.HandlerSelector.
 func (m *Manager) Select(selectors []string) []string {
-
 	key := strings.Join(selectors, ",")
 	if cache, ok := m.tagsCache.Load(key); ok {
 		return cache.([]string)
@@ -1,35 +0,0 @@
-package outbound
-
-import (
-	"context"
-	"os"
-
-	"github.com/sagernet/sing/common/uot"
-	"github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/net"
-	"github.com/xtls/xray-core/transport/internet"
-	"github.com/xtls/xray-core/transport/internet/stat"
-)
-
-func (h *Handler) getUoTConnection(ctx context.Context, dest net.Destination) (stat.Connection, error) {
-	if dest.Address == nil {
-		return nil, errors.New("nil destination address")
-	}
-	if !dest.Address.Family().IsDomain() {
-		return nil, os.ErrInvalid
-	}
-	var uotVersion int
-	if dest.Address.Domain() == uot.MagicAddress {
-		uotVersion = uot.Version
-	} else if dest.Address.Domain() == uot.LegacyMagicAddress {
-		uotVersion = uot.LegacyVersion
-	} else {
-		return nil, os.ErrInvalid
-	}
-	packetConn, err := internet.ListenSystemPacket(ctx, &net.UDPAddr{IP: net.AnyIP.IP(), Port: 0}, h.streamSettings.SocketSettings)
-	if err != nil {
-		return nil, errors.New("unable to listen socket").Base(err)
-	}
-	conn := uot.NewServerConn(packetConn, uotVersion)
-	return h.getStatCouterConnection(conn), nil
-}
@@ -68,13 +68,13 @@ func (p *Portal) HandleConnection(ctx context.Context, link *transport.Link) err
 	outbounds := session.OutboundsFromContext(ctx)
 	ob := outbounds[len(outbounds)-1]
 	if ob == nil {
-		return errors.New("outbound metadata not found").AtError()
+		return errors.New("outbound metadata not found")
 	}

 	if isDomain(ob.Target, p.domain) {
 		muxClient, err := mux.NewClientWorker(*link, mux.ClientStrategy{})
 		if err != nil {
-			return errors.New("failed to create mux client worker").Base(err).AtWarning()
+			return errors.New("failed to create mux client worker").Base(err)
 		}

 		worker, err := NewPortalWorker(muxClient)
@@ -136,7 +136,7 @@ func (b *Balancer) SelectOutbounds() ([]string, error) {

 // GetPrincipleTarget implements routing.BalancerPrincipleTarget
 func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		if s, ok := b.strategy.(BalancingPrincipleTarget); ok {
 			candidates, err := b.SelectOutbounds()
 			if err != nil {
@@ -151,7 +151,7 @@ func (r *Router) GetPrincipleTarget(tag string) ([]string, error) {

 // SetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) SetOverrideTarget(tag, target string) error {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		b.override.Put(target)
 		return nil
 	}
@@ -160,7 +160,7 @@ func (r *Router) SetOverrideTarget(tag, target string) error {

 // GetOverrideTarget implements routing.BalancerOverrider
 func (r *Router) GetOverrideTarget(tag string) (string, error) {
-	if b, ok := r.balancers[tag]; ok {
+	if b, ok := (*r.balancers.Load())[tag]; ok {
 		return b.override.Get(), nil
 	}
 	return "", errors.New("cannot find tag")
@@ -2,25 +2,8 @@ package router

 import (
 	sync "sync"
-
-	"github.com/xtls/xray-core/common/errors"
 )

-func (r *Router) OverrideBalancer(balancer string, target string) error {
-	var b *Balancer
-	for tag, bl := range r.balancers {
-		if tag == balancer {
-			b = bl
-			break
-		}
-	}
-	if b == nil {
-		return errors.New("balancer '", balancer, "' not found")
-	}
-	b.override.Put(target)
-	return nil
-}
-
 type overrideSettings struct {
 	target string
 }
@@ -58,7 +58,6 @@ func (s *routingServer) AddRule(ctx context.Context, request *AddRuleRequest) (*
 		return &AddRuleResponse{}, bo.AddRule(request.Config, request.ShouldAppend)
 	}
 	return nil, errors.New("unsupported router implementation")
-
 }

 func (s *routingServer) RemoveRule(ctx context.Context, request *RemoveRuleRequest) (*RemoveRuleResponse, error) {
@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"slices"
 	"strings"

@@ -393,3 +394,22 @@ func (m *ProcessNameMatcher) Apply(ctx routing.Context) bool {
 	}
 	return false
 }
+
+// LocalOSMatcher matches the operating system Xray itself is running on. That never
+// changes while Xray is running, so the result is resolved when the rule is built.
+type LocalOSMatcher struct {
+	matched bool
+}
+
+func NewLocalOSMatcher(names []string) *LocalOSMatcher {
+	return &LocalOSMatcher{
+		matched: slices.ContainsFunc(names, func(name string) bool {
+			return strings.EqualFold(name, runtime.GOOS)
+		}),
+	}
+}
+
+// Apply implements Condition.
+func (m *LocalOSMatcher) Apply(_ routing.Context) bool {
+	return m.matched
+}
@@ -2,7 +2,9 @@ package router_test

 import (
 	"path/filepath"
+	"runtime"
 	"strconv"
+	"strings"
 	"testing"

 	. "github.com/xtls/xray-core/app/router"
@@ -343,6 +345,31 @@ func TestChinaSites(t *testing.T) {
 	}
 }

+func TestLocalOSRule(t *testing.T) {
+	otherOS := "plan9"
+	if runtime.GOOS == otherOS {
+		otherOS = "linux"
+	}
+
+	cases := []struct {
+		localOS []string
+		output  bool
+	}{
+		{localOS: []string{runtime.GOOS}, output: true},
+		{localOS: []string{otherOS}, output: false},
+		{localOS: []string{otherOS, runtime.GOOS}, output: true},
+		{localOS: []string{strings.ToUpper(runtime.GOOS)}, output: true},
+	}
+
+	for _, test := range cases {
+		cond, err := (&RoutingRule{LocalOs: test.localOS}).BuildCondition()
+		common.Must(err)
+		if got := cond.Apply(withBackground()); got != test.output {
+			t.Errorf("for localOS %v on %s: expected %v, got %v", test.localOS, runtime.GOOS, test.output, got)
+		}
+	}
+}
+
 func BenchmarkMphDomainMatcher(b *testing.B) {
 	b.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
 	rules, err := geodata.ParseDomainRules([]string{"geosite:cn"}, geodata.Domain_Substr)
@@ -33,6 +33,10 @@ func (r *Rule) Apply(ctx routing.Context) bool {
 func (rr *RoutingRule) BuildCondition() (Condition, error) {
 	conds := NewConditionChan()

+	if len(rr.LocalOs) > 0 {
+		conds.Add(NewLocalOSMatcher(rr.LocalOs))
+	}
+
 	if len(rr.InboundTag) > 0 {
 		conds.Add(NewInboundTagMatcher(rr.InboundTag))
 	}
@@ -111,7 +115,7 @@ func (rr *RoutingRule) BuildCondition() (Condition, error) {
 	}

 	if conds.Len() == 0 {
-		return nil, errors.New("this rule has no effective fields").AtWarning()
+		return nil, errors.New("this rule has no effective fields")
 	}

 	return conds, nil
@@ -141,7 +145,7 @@ func (br *BalancingRule) Build(ohm outbound.Manager, dispatcher routing.Dispatch
 		}
 		s, ok := i.(*StrategyLeastLoadConfig)
 		if !ok {
-			return nil, errors.New("not a StrategyLeastLoadConfig").AtError()
+			return nil, errors.New("not a StrategyLeastLoadConfig")
 		}
 		leastLoadStrategy := NewLeastLoadStrategy(s)
 		return &Balancer{
@@ -107,8 +107,10 @@ type RoutingRule struct {
 	VlessRouteList *net.PortList  `protobuf:"bytes,20,opt,name=vless_route_list,json=vlessRouteList,proto3" json:"vless_route_list,omitempty"`
 	Process        []string       `protobuf:"bytes,21,rep,name=process,proto3" json:"process,omitempty"`
 	Webhook        *WebhookConfig `protobuf:"bytes,22,opt,name=webhook,proto3" json:"webhook,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// List of operating systems for matching the one Xray itself is running on.
+	LocalOs       []string `protobuf:"bytes,23,rep,name=local_os,json=localOs,proto3" json:"local_os,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }

 func (x *RoutingRule) Reset() {
@@ -278,6 +280,13 @@ func (x *RoutingRule) GetWebhook() *WebhookConfig {
 	return nil
 }

+func (x *RoutingRule) GetLocalOs() []string {
+	if x != nil {
+		return x.LocalOs
+	}
+	return nil
+}
+
 type isRoutingRule_TargetTag interface {
 	isRoutingRule_TargetTag()
 }
@@ -637,7 +646,7 @@ var File_app_router_config_proto protoreflect.FileDescriptor

 const file_app_router_config_proto_rawDesc = "" +
 	"\n" +
-	"\x17app/router/config.proto\x12\x0fxray.app.router\x1a!common/serial/typed_message.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"\xc1\a\n" +
+	"\x17app/router/config.proto\x12\x0fxray.app.router\x1a!common/serial/typed_message.proto\x1a\x15common/net/port.proto\x1a\x18common/net/network.proto\x1a\x1bcommon/geodata/geodat.proto\"\xdc\a\n" +
 	"\vRoutingRule\x12\x12\n" +
 	"\x03tag\x18\x01 \x01(\tH\x00R\x03tag\x12%\n" +
 	"\rbalancing_tag\x18\f \x01(\tH\x00R\fbalancingTag\x12\x19\n" +
@@ -661,7 +670,8 @@ const file_app_router_config_proto_rawDesc = "" +
 	"\x0flocal_port_list\x18\x12 \x01(\v2\x19.xray.common.net.PortListR\rlocalPortList\x12C\n" +
 	"\x10vless_route_list\x18\x14 \x01(\v2\x19.xray.common.net.PortListR\x0evlessRouteList\x12\x18\n" +
 	"\aprocess\x18\x15 \x03(\tR\aprocess\x128\n" +
-	"\awebhook\x18\x16 \x01(\v2\x1e.xray.app.router.WebhookConfigR\awebhook\x1a=\n" +
+	"\awebhook\x18\x16 \x01(\v2\x1e.xray.app.router.WebhookConfigR\awebhook\x12\x19\n" +
+	"\blocal_os\x18\x17 \x03(\tR\alocalOs\x1a=\n" +
 	"\x0fAttributesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\f\n" +
@@ -56,6 +56,9 @@ message RoutingRule {

  repeated string process = 21;
  WebhookConfig webhook = 22;
+
+  // List of operating systems for matching the one Xray itself is running on.
+  repeated string local_os = 23;
 }

 message WebhookConfig {
@@ -2,7 +2,9 @@ package router

 import (
 	"context"
+	"maps"
 	"sync"
+	"sync/atomic"

 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/errors"
@@ -17,8 +19,8 @@ import (
 // Router is an implementation of routing.Router.
 type Router struct {
 	domainStrategy Config_DomainStrategy
-	rules          []*Rule
-	balancers      map[string]*Balancer
+	rules          atomic.Pointer[[]*Rule]
+	balancers      atomic.Pointer[map[string]*Balancer]
 	dns            dns.Client

 	ctx        context.Context
@@ -43,52 +45,9 @@ func (r *Router) Init(ctx context.Context, config *Config, d dns.Client, ohm out
 	r.ohm = ohm
 	r.dispatcher = dispatcher

-	r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
-	for _, rule := range config.BalancingRule {
-		balancer, err := rule.Build(ohm, dispatcher)
-		if err != nil {
-			return err
-		}
-		balancer.InjectContext(ctx)
-		r.balancers[rule.Tag] = balancer
-	}
-
-	r.rules = make([]*Rule, 0, len(config.Rule))
-	for _, rule := range config.Rule {
-		cond, err := rule.BuildCondition()
-		if err != nil {
-			r.closeWebhooks()
-			return err
-		}
-		rr := &Rule{
-			Condition: cond,
-			Tag:       rule.GetTag(),
-			RuleTag:   rule.GetRuleTag(),
-		}
-		if wh := rule.GetWebhook(); wh != nil {
-			notifier, err := NewWebhookNotifier(wh)
-			if err != nil {
-				r.closeWebhooks()
-				return err
-			}
-			rr.Webhook = notifier
-		}
-		btag := rule.GetBalancingTag()
-		if len(btag) > 0 {
-			brule, found := r.balancers[btag]
-			if !found {
-				if rr.Webhook != nil {
-					rr.Webhook.Close()
-				}
-				r.closeWebhooks()
-				return errors.New("balancer ", btag, " not found")
-			}
-			rr.Balancer = brule
-		}
-		r.rules = append(r.rules, rr)
-	}
-
-	return nil
+	r.rules.Store(new([]*Rule))
+	r.balancers.Store(&map[string]*Balancer{})
+	return r.ReloadRules(config, false)
 }

 // PickRoute implements routing.Router.
@@ -110,7 +69,6 @@ func (r *Router) PickRoute(ctx routing.Context) (routing.Route, error) {

 // AddRule implements routing.Router.
 func (r *Router) AddRule(config *serial.TypedMessage, shouldAppend bool) error {
-
 	inst, err := config.GetInstance()
 	if err != nil {
 		return err
@@ -125,18 +83,22 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()

-	if !shouldAppend {
-		for _, rule := range r.rules {
-			if rule.Webhook != nil {
-				rule.Webhook.Close()
-			}
+	oldRules := *r.rules.Load()
+	oldBalancers := *r.balancers.Load()
+
+	var newRules []*Rule
+	newBalancers := make(map[string]*Balancer)
+	existTags := make(map[string]bool, len(oldRules)+len(config.Rule))
+	if shouldAppend {
+		newRules = append(newRules, oldRules...)
+		maps.Copy(newBalancers, oldBalancers)
+		for _, rule := range oldRules {
+			existTags[rule.RuleTag] = true
 		}
-		r.balancers = make(map[string]*Balancer, len(config.BalancingRule))
-		r.rules = make([]*Rule, 0, len(config.Rule))
 	}
+
 	for _, rule := range config.BalancingRule {
-		_, found := r.balancers[rule.Tag]
-		if found {
+		if _, found := newBalancers[rule.Tag]; found {
 			return errors.New("duplicate balancer tag")
 		}
 		balancer, err := rule.Build(r.ohm, r.dispatcher)
@@ -144,27 +106,12 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			return err
 		}
 		balancer.InjectContext(r.ctx)
-		r.balancers[rule.Tag] = balancer
-	}
-
-	startIdx := len(r.rules)
-	closeNewWebhooks := func() {
-		for i := startIdx; i < len(r.rules); i++ {
-			if r.rules[i].Webhook != nil {
-				r.rules[i].Webhook.Close()
-			}
-		}
-		r.rules = r.rules[:startIdx]
+		newBalancers[rule.Tag] = balancer
 	}

 	for _, rule := range config.Rule {
-		if r.RuleExists(rule.GetRuleTag()) {
-			closeNewWebhooks()
-			return errors.New("duplicate ruleTag ", rule.GetRuleTag())
-		}
 		cond, err := rule.BuildCondition()
 		if err != nil {
-			closeNewWebhooks()
 			return err
 		}
 		rr := &Rule{
@@ -172,70 +119,64 @@ func (r *Router) ReloadRules(config *Config, shouldAppend bool) error {
 			Tag:       rule.GetTag(),
 			RuleTag:   rule.GetRuleTag(),
 		}
+		if rr.RuleTag != "" && existTags[rr.RuleTag] {
+			return errors.New("duplicate ruleTag ", rr.RuleTag)
+		}
+		existTags[rr.RuleTag] = true
 		if wh := rule.GetWebhook(); wh != nil {
 			notifier, err := NewWebhookNotifier(wh)
 			if err != nil {
-				closeNewWebhooks()
 				return err
 			}
 			rr.Webhook = notifier
 		}
-		btag := rule.GetBalancingTag()
-		if len(btag) > 0 {
-			brule, found := r.balancers[btag]
+		if btag := rule.GetBalancingTag(); len(btag) > 0 {
+			brule, found := newBalancers[btag]
 			if !found {
-				if rr.Webhook != nil {
-					rr.Webhook.Close()
-				}
-				closeNewWebhooks()
 				return errors.New("balancer ", btag, " not found")
 			}
 			rr.Balancer = brule
 		}
-		r.rules = append(r.rules, rr)
+		newRules = append(newRules, rr)
 	}

+	r.balancers.Store(&newBalancers)
+	r.rules.Store(&newRules)
+	if !shouldAppend {
+		closeWebhooks(oldRules)
+	}
 	return nil
 }

-func (r *Router) RuleExists(tag string) bool {
-	if tag != "" {
-		for _, rule := range r.rules {
-			if rule.RuleTag == tag {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 // RemoveRule implements routing.Router.
 func (r *Router) RemoveRule(tag string) error {
+	if tag == "" {
+		return errors.New("empty tag name!")
+	}
+
 	r.mu.Lock()
 	defer r.mu.Unlock()

-	newRules := []*Rule{}
-	if tag != "" {
-		for _, rule := range r.rules {
-			if rule.RuleTag != tag {
-				newRules = append(newRules, rule)
-			} else if rule.Webhook != nil {
-				rule.Webhook.Close()
-			}
+	oldRules := *r.rules.Load()
+	newRules := make([]*Rule, 0, len(oldRules))
+	var removed []*Rule
+	for _, rule := range oldRules {
+		if rule.RuleTag != tag {
+			newRules = append(newRules, rule)
+		} else {
+			removed = append(removed, rule)
 		}
-		r.rules = newRules
-		return nil
 	}
-	return errors.New("empty tag name!")
-
+	r.rules.Store(&newRules)
+	closeWebhooks(removed)
+	return nil
 }

 // ListRule implements routing.Router
 func (r *Router) ListRule() []routing.Route {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	ruleList := make([]routing.Route, 0)
-	for _, rule := range r.rules {
+	rules := *r.rules.Load()
+	ruleList := make([]routing.Route, 0, len(rules))
+	for _, rule := range rules {
 		ruleList = append(ruleList, &Route{
 			outboundTag: rule.Tag,
 			ruleTag:     rule.RuleTag,
@@ -254,7 +195,9 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 		ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)
 	}

-	for _, rule := range r.rules {
+	rules := *r.rules.Load()
+
+	for _, rule := range rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -267,7 +210,7 @@ func (r *Router) pickRouteInternal(ctx routing.Context) (*Rule, routing.Context,
 	ctx = routing_dns.ContextWithDNSClient(ctx, r.dns)

 	// Try applying rules again if we have IPs.
-	for _, rule := range r.rules {
+	for _, rule := range rules {
 		if rule.Apply(ctx) {
 			return rule, ctx, nil
 		}
@@ -281,9 +224,9 @@ func (r *Router) Start() error {
 	return nil
 }

-// closeWebhooks closes all webhook notifiers in the current rule set.
-func (r *Router) closeWebhooks() {
-	for _, rule := range r.rules {
+// closeWebhooks closes all webhook notifiers in the given rule set.
+func closeWebhooks(rules []*Rule) {
+	for _, rule := range rules {
 		if rule.Webhook != nil {
 			rule.Webhook.Close()
 		}
@@ -294,7 +237,7 @@ func (r *Router) closeWebhooks() {
 func (r *Router) Close() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	r.closeWebhooks()
+	closeWebhooks(*r.rules.Load())
 	return nil
 }

@@ -3,6 +3,7 @@ package router
 import (
 	"context"
 	"math"
+	"slices"
 	"sort"
 	"time"

@@ -77,7 +78,7 @@ func (s *LeastLoadStrategy) PickOutbound(candidates []string) string {
 }

 func (s *LeastLoadStrategy) pickOutbounds(candidates []string) []*node {
-	qualified := s.getNodes(candidates, time.Duration(s.settings.MaxRTT))
+	qualified := s.getNodes(candidates)
 	selects := s.selectLeastLoad(qualified)
 	return selects
 }
@@ -138,7 +139,7 @@ func (s *LeastLoadStrategy) selectLeastLoad(nodes []*node) []*node {
 	return nodes[:count]
 }

-func (s *LeastLoadStrategy) getNodes(candidates []string, maxRTT time.Duration) []*node {
+func (s *LeastLoadStrategy) getNodes(candidates []string) []*node {
 	if s.observer == nil {
 		errors.LogError(s.ctx, "observer is nil")
 		return make([]*node, 0)
@@ -151,12 +152,10 @@ func (s *LeastLoadStrategy) getNodes(candidates []string, maxRTT time.Duration)

 	results := observeResult.(*observatory.ObservationResult)

-	outboundlist := outboundList(candidates)
-
 	var ret []*node

 	for _, v := range results.Status {
-		if v.Alive && (v.Delay < maxRTT.Milliseconds() || maxRTT == 0) && outboundlist.contains(v.OutboundTag) {
+		if s.shouldSelectNode(v, candidates) {
 			record := &node{
 				Tag:              v.OutboundTag,
 				CountAll:         1,
@@ -172,8 +171,8 @@ func (s *LeastLoadStrategy) getNodes(candidates []string, maxRTT time.Duration)
 				record.RTTDeviationCost = time.Duration(s.costs.Apply(v.OutboundTag, float64(v.HealthPing.Deviation)))
 				record.CountAll = int(v.HealthPing.All)
 				record.CountFail = int(v.HealthPing.Fail)
-
 			}
+
 			ret = append(ret, record)
 		}
 	}
@@ -182,6 +181,23 @@ func (s *LeastLoadStrategy) getNodes(candidates []string, maxRTT time.Duration)
 	return ret
 }

+func (s *LeastLoadStrategy) shouldSelectNode(v *observatory.OutboundStatus, candidates []string) bool {
+	maxRTT := time.Duration(s.settings.MaxRTT)
+	if !v.Alive {
+		return false
+	}
+	if maxRTT != 0 && v.Delay >= maxRTT.Milliseconds() {
+		return false
+	}
+	if !slices.Contains(candidates, v.OutboundTag) {
+		return false
+	}
+	if v.HealthPing != nil && v.HealthPing.All > 0 && s.settings.Tolerance > 0 && float64(v.HealthPing.Fail)/float64(v.HealthPing.All) > float64(s.settings.Tolerance) {
+		return false
+	}
+	return true
+}
+
 func leastloadSort(nodes []*node) {
 	sort.Slice(nodes, func(i, j int) bool {
 		left := nodes[i]
@@ -85,6 +85,7 @@ func TestSelectLeastExpected(t *testing.T) {
 		t.Errorf("expected: %v, actual: %v", expected, len(ns))
 	}
 }
+
 func TestSelectLeastExpected2(t *testing.T) {
 	strategy := &LeastLoadStrategy{
 		settings: &StrategyLeastLoadConfig{
@@ -102,6 +103,7 @@ func TestSelectLeastExpected2(t *testing.T) {
 		t.Errorf("expected: %v, actual: %v", expected, len(ns))
 	}
 }
+
 func TestSelectLeastExpectedAndBaselines(t *testing.T) {
 	strategy := &LeastLoadStrategy{
 		settings: &StrategyLeastLoadConfig{
@@ -122,6 +124,7 @@ func TestSelectLeastExpectedAndBaselines(t *testing.T) {
 		t.Errorf("expected: %v, actual: %v", expected, len(ns))
 	}
 }
+
 func TestSelectLeastExpectedAndBaselines2(t *testing.T) {
 	strategy := &LeastLoadStrategy{
 		settings: &StrategyLeastLoadConfig{
@@ -142,6 +145,7 @@ func TestSelectLeastExpectedAndBaselines2(t *testing.T) {
 		t.Errorf("expected: %v, actual: %v", expected, len(ns))
 	}
 }
+
 func TestSelectLeastLoadBaselines(t *testing.T) {
 	strategy := &LeastLoadStrategy{
 		settings: &StrategyLeastLoadConfig{
@@ -160,6 +164,7 @@ func TestSelectLeastLoadBaselines(t *testing.T) {
 		t.Errorf("expected: %v, actual: %v", expected, len(ns))
 	}
 }
+
 func TestSelectLeastLoadBaselinesNoQualified(t *testing.T) {
 	strategy := &LeastLoadStrategy{
 		settings: &StrategyLeastLoadConfig{
@@ -7,61 +7,16 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"path/filepath"
-	"runtime"
-	"strings"
 	"sync"
-	"syscall"
+	"sync/atomic"
 	"time"

 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/utils"
 	"github.com/xtls/xray-core/features/routing"
 	routing_session "github.com/xtls/xray-core/features/routing/session"
 )

-// parseURL splits a webhook URL into an HTTP URL and an optional Unix socket
-// path. For regular http/https URLs the input is returned unchanged with an
-// empty socketPath. For Unix sockets the format is:
-//
-//	/path/to/socket.sock:/http/path
-//	@abstract:/http/path
-//	@@padded:/http/path
-//
-// The :/ separator after the socket path delimits the HTTP request path.
-// If omitted, "/" is used.
-func parseURL(raw string) (httpURL, socketPath string) {
-	if len(raw) == 0 || (!filepath.IsAbs(raw) && raw[0] != '@') {
-		return raw, ""
-	}
-	if idx := strings.Index(raw, ":/"); idx >= 0 {
-		return "http://localhost" + raw[idx+1:], raw[:idx]
-	}
-	return "http://localhost/", raw
-}
-
-// resolveSocketPath applies platform-specific transformations to a Unix
-// socket path, matching the behaviour of the listen side in
-// transport/internet/system_listener.go.
-//
-// For abstract sockets (prefix @) on Linux/Android:
-//   - single @ — used as-is (lock-free abstract socket)
-//   - double @@ — stripped to single @ and padded to
-//     syscall.RawSockaddrUnix{}.Path length (HAProxy compat)
-func resolveSocketPath(path string) string {
-	if len(path) == 0 || path[0] != '@' {
-		return path
-	}
-	if runtime.GOOS != "linux" && runtime.GOOS != "android" {
-		return path
-	}
-	if len(path) > 1 && path[1] == '@' {
-		fullAddr := make([]byte, len(syscall.RawSockaddrUnix{}.Path))
-		copy(fullAddr, path[1:])
-		return string(fullAddr)
-	}
-	return path
-}
-
 func ptr[T any](v T) *T { return &v }

 type event struct {
@@ -86,6 +41,7 @@ type WebhookNotifier struct {
 	deduplication uint32
 	client        *http.Client
 	seen          sync.Map
+	lastSweep     atomic.Int64
 	done          chan struct{}
 	wg            sync.WaitGroup
 	closeOnce     sync.Once
@@ -96,7 +52,7 @@ func NewWebhookNotifier(cfg *WebhookConfig) (*WebhookNotifier, error) {
 		return nil, nil
 	}

-	httpURL, socketPath := parseURL(cfg.Url)
+	httpURL, socketPath := utils.SplitHTTPUnixURL(cfg.Url)
 	h := &WebhookNotifier{
 		url:           httpURL,
 		deduplication: cfg.Deduplication,
@@ -107,7 +63,7 @@ func NewWebhookNotifier(cfg *WebhookConfig) (*WebhookNotifier, error) {
 	}

 	if socketPath != "" {
-		dialAddr := resolveSocketPath(socketPath)
+		dialAddr := utils.ResolveSocketPath(socketPath)
 		h.client.Transport = &http.Transport{
 			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
 				var d net.Dialer
@@ -123,11 +79,6 @@ func NewWebhookNotifier(cfg *WebhookConfig) (*WebhookNotifier, error) {
 		}
 	}

-	if h.deduplication > 0 {
-		h.wg.Add(1)
-		go h.cleanupLoop()
-	}
-
 	return h, nil
 }

@@ -247,6 +198,7 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	}
 	ttl := time.Duration(h.deduplication) * time.Second
 	now := time.Now()
+	h.maybeSweep(now, ttl)
 	if v, loaded := h.seen.LoadOrStore(email, now); loaded {
 		if now.Sub(v.(time.Time)) < ttl {
 			return true
@@ -256,27 +208,23 @@ func (h *WebhookNotifier) isDuplicate(email string) bool {
 	return false
 }

-func (h *WebhookNotifier) cleanupLoop() {
-	defer h.wg.Done()
-	ttl := time.Duration(h.deduplication) * time.Second
-	ticker := time.NewTicker(ttl)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-h.done:
-			return
-		case <-ticker.C:
-			now := time.Now()
-			h.seen.Range(func(key, value any) bool {
-				if now.Sub(value.(time.Time)) >= ttl {
-					h.seen.Delete(key)
-				}
-				return true
-			})
-		}
+func (h *WebhookNotifier) maybeSweep(now time.Time, ttl time.Duration) {
+	last := h.lastSweep.Load()
+	if now.UnixNano()-last < int64(ttl) {
+		return
 	}
+	if !h.lastSweep.CompareAndSwap(last, now.UnixNano()) {
+		return // another goroutine did the sweep
+	}
+	h.seen.Range(func(key, value any) bool {
+		if now.Sub(value.(time.Time)) >= ttl {
+			h.seen.Delete(key)
+		}
+		return true
+	})
 }

+// Only need to call if the Notifier is really used, otherwise GC can clean it
 func (h *WebhookNotifier) Close() error {
 	h.closeOnce.Do(func() {
 		close(h.done)
@@ -48,6 +48,20 @@ func (m *Manager) RegisterCounter(name string) (stats.Counter, error) {
 	return c, nil
 }

+// GetOrRegisterCounter implements stats.Manager.
+func (m *Manager) GetOrRegisterCounter(name string) (stats.Counter, error) {
+	m.access.Lock()
+	defer m.access.Unlock()
+
+	if c, found := m.counters[name]; found {
+		return c, nil
+	}
+	errors.LogDebug(context.Background(), "create new counter ", name)
+	c := new(Counter)
+	m.counters[name] = c
+	return c, nil
+}
+
 // UnregisterCounter implements stats.Manager.
 func (m *Manager) UnregisterCounter(name string) error {
 	m.access.Lock()
@@ -97,6 +111,20 @@ func (m *Manager) RegisterOnlineMap(name string) (stats.OnlineMap, error) {
 	return om, nil
 }

+// GetOrRegisterOnlineMap implements stats.Manager.
+func (m *Manager) GetOrRegisterOnlineMap(name string) (stats.OnlineMap, error) {
+	m.access.Lock()
+	defer m.access.Unlock()
+
+	if om, found := m.onlineMaps[name]; found {
+		return om, nil
+	}
+	errors.LogDebug(context.Background(), "create new OnlineMap ", name)
+	om := NewOnlineMap()
+	m.onlineMaps[name] = om
+	return om, nil
+}
+
 // UnregisterOnlineMap implements stats.Manager.
 func (m *Manager) UnregisterOnlineMap(name string) error {
 	m.access.Lock()
@@ -149,6 +177,26 @@ func (m *Manager) RegisterChannel(name string) (stats.Channel, error) {
 	return c, nil
 }

+// GetOrRegisterChannel implements stats.Manager.
+func (m *Manager) GetOrRegisterChannel(name string) (stats.Channel, error) {
+	m.access.Lock()
+	defer m.access.Unlock()
+
+	if c, found := m.channels[name]; found {
+		return c, nil
+	}
+	errors.LogDebug(context.Background(), "create new channel ", name)
+	c := NewChannel(&ChannelConfig{BufferSize: 64, Blocking: false})
+	if m.running {
+		// Start before publishing so no goroutine can observe an unstarted channel.
+		if err := c.Start(); err != nil {
+			return nil, err
+		}
+	}
+	m.channels[name] = c
+	return c, nil
+}
+
 // UnregisterChannel implements stats.Manager.
 func (m *Manager) UnregisterChannel(name string) error {
 	m.access.Lock()
@@ -11,7 +11,7 @@ import (
 )

 func TestInterface(t *testing.T) {
-	_ = (stats.Manager)(new(Manager))
+	_ = stats.Manager(new(Manager))
 }

 func TestStatsChannelRunnable(t *testing.T) {
@@ -2,10 +2,11 @@ package version

 import (
 	"context"
-	"github.com/xtls/xray-core/common"
-	"github.com/xtls/xray-core/common/errors"
 	"strconv"
 	"strings"
+
+	"github.com/xtls/xray-core/common"
+	"github.com/xtls/xray-core/common/errors"
 )

 type Version struct {
@@ -122,7 +122,7 @@ func NewReader(reader io.Reader) Reader {
 	}

 	_, isFile := reader.(*os.File)
-	if !isFile && useReadv {
+	if !isFile && useReadV() {
 		if sc, ok := reader.(syscall.Conn); ok {
 			rawConn, err := sc.SyscallConn()
 			if err != nil {
@@ -38,8 +38,8 @@ func MergeMulti(dest MultiBuffer, src MultiBuffer) (MultiBuffer, MultiBuffer) {
 // MergeBytes merges the given bytes into MultiBuffer and return the new address of the merged MultiBuffer.
 func MergeBytes(dest MultiBuffer, src []byte) MultiBuffer {
 	n := len(dest)
-	if n > 0 && !(dest)[n-1].IsFull() {
-		nBytes, _ := (dest)[n-1].Write(src)
+	if n > 0 && !dest[n-1].IsFull() {
+		nBytes, _ := dest[n-1].Write(src)
 		src = src[nBytes:]
 	}

@@ -121,11 +121,11 @@ func TestPacketReader_ReadMultiBuffer(t *testing.T) {
 }

 func TestReaderInterface(t *testing.T) {
-	_ = (io.Reader)(new(ReadVReader))
-	_ = (Reader)(new(ReadVReader))
+	_ = io.Reader(new(ReadVReader))
+	_ = Reader(new(ReadVReader))

-	_ = (Reader)(new(BufferedReader))
-	_ = (io.Reader)(new(BufferedReader))
-	_ = (io.ByteReader)(new(BufferedReader))
-	_ = (io.WriterTo)(new(BufferedReader))
+	_ = Reader(new(BufferedReader))
+	_ = io.Reader(new(BufferedReader))
+	_ = io.ByteReader(new(BufferedReader))
+	_ = io.WriterTo(new(BufferedReader))
 }
@@ -19,7 +19,7 @@ func (r *posixReader) Init(bs []*Buffer) {
 	}
 	for idx, b := range bs {
 		iovecs = append(iovecs, syscall.Iovec{
-			Base: &(b.v[0]),
+			Base: &b.v[0],
 		})
 		iovecs[idx].SetLen(int(Size))
 	}
@@ -5,6 +5,7 @@ package buf

 import (
 	"io"
+	"sync/atomic"
 	"syscall"

 	"github.com/xtls/xray-core/common/platform"
@@ -143,13 +144,24 @@ func (r *ReadVReader) ReadMultiBuffer() (MultiBuffer, error) {
 	return mb, nil
 }

-var useReadv bool
+var useReadv atomic.Bool

-func init() {
+func useReadV() bool {
+	return useReadv.Load()
+}
+
+func reloadEnvSettings() error {
 	const defaultFlagValue = "NOT_DEFINED_AT_ALL"
 	value := platform.NewEnvFlag(platform.UseReadV).GetValue(func() string { return defaultFlagValue })
+	enabled := false
 	switch value {
 	case defaultFlagValue, "auto", "enable":
-		useReadv = true
+		enabled = true
 	}
+	useReadv.Store(enabled)
+	return nil
+}
+
+func init() {
+	platform.RegisterEnvReload(reloadEnvSettings)
 }
@@ -10,7 +10,9 @@ import (
 	"github.com/xtls/xray-core/features/stats"
 )

-const useReadv = false
+func useReadV() bool {
+	return false
+}

 func NewReadVReader(reader io.Reader, rawConn syscall.RawConn, counter stats.Counter) Reader {
 	panic("not implemented")
@@ -5,7 +5,8 @@ import (
 )

 type windowsReader struct {
-	bufs []syscall.WSABuf
+	bufs  []syscall.WSABuf
+	ready bool
 }

 func (r *windowsReader) Init(bs []*Buffer) {
@@ -15,6 +16,7 @@ func (r *windowsReader) Init(bs []*Buffer) {
 	for _, b := range bs {
 		r.bufs = append(r.bufs, syscall.WSABuf{Len: uint32(Size), Buf: &b.v[0]})
 	}
+	r.ready = false
 }

 func (r *windowsReader) Clear() {
@@ -25,6 +27,14 @@ func (r *windowsReader) Clear() {
 }

 func (r *windowsReader) Read(fd uintptr) int32 {
+	// On the first invocation, we return -1 to indicate "not ready"
+	// to make rawConn.Read wait for readability using the runtime's own mechanism
+	// because syscall.WSARecv() is a blocking call when used with nil OVERLAPPED
+	if !r.ready {
+		r.ready = true
+		return -1
+	}
+
 	var nBytes uint32
 	var flags uint32
 	err := syscall.WSARecv(syscall.Handle(fd), &r.bufs[0], uint32(len(r.bufs)), &nBytes, &flags, nil, nil)
@@ -118,7 +118,9 @@ func (w *BufferedWriter) Write(b []byte) (int, error) {

 		nBytes, err := w.buffer.Write(b)
 		totalBytes += nBytes
-		if err != nil {
+
+		// ErrBufferFull means a partial write, so flush below and continue
+		if err != nil && err != ErrBufferFull {
 			return totalBytes, err
 		}
 		if !w.buffered || w.buffer.IsFull() {
@@ -10,12 +10,12 @@ import (

 // [,)
 func RandBetween(from int64, to int64) int64 {
-	if from == to {
-		return from
-	}
 	if from > to {
 		from, to = to, from
 	}
+	if d := to - from; d == 0 || d == 1 {
+		return from
+	}
 	bigInt, _ := rand.Int(rand.Reader, big.NewInt(to-from))
 	return from + bigInt.Int64()
 }
@@ -18,17 +18,12 @@ type hasInnerError interface {
 	Unwrap() error
 }

-type hasSeverity interface {
-	Severity() log.Severity
-}
-
 // Error is an error object with underlying error.
 type Error struct {
-	prefix   []interface{}
-	message  []interface{}
-	caller   string
-	inner    error
-	severity log.Severity
+	prefix  []interface{}
+	message []interface{}
+	caller  string
+	inner   error
 }

 // Error implements error.Error().
@@ -69,46 +64,6 @@ func (err *Error) Base(e error) *Error {
 	return err
 }

-func (err *Error) atSeverity(s log.Severity) *Error {
-	err.severity = s
-	return err
-}
-
-func (err *Error) Severity() log.Severity {
-	if err.inner == nil {
-		return err.severity
-	}
-
-	if s, ok := err.inner.(hasSeverity); ok {
-		as := s.Severity()
-		if as < err.severity {
-			return as
-		}
-	}
-
-	return err.severity
-}
-
-// AtDebug sets the severity to debug.
-func (err *Error) AtDebug() *Error {
-	return err.atSeverity(log.Severity_Debug)
-}
-
-// AtInfo sets the severity to info.
-func (err *Error) AtInfo() *Error {
-	return err.atSeverity(log.Severity_Info)
-}
-
-// AtWarning sets the severity to warning.
-func (err *Error) AtWarning() *Error {
-	return err.atSeverity(log.Severity_Warning)
-}
-
-// AtError sets the severity to error.
-func (err *Error) AtError() *Error {
-	return err.atSeverity(log.Severity_Error)
-}
-
 // String returns the string representation of this error.
 func (err *Error) String() string {
 	return err.Error()
@@ -132,9 +87,8 @@ func New(msg ...interface{}) *Error {
 		details = details[:i]
 	}
 	return &Error{
-		message:  msg,
-		severity: log.Severity_Info,
-		caller:   details,
+		message: msg,
+		caller:  details,
 	}
 }

@@ -171,6 +125,9 @@ func LogErrorInner(ctx context.Context, inner error, msg ...interface{}) {
 }

 func doLog(ctx context.Context, inner error, severity log.Severity, msg ...interface{}) {
+	if log.GetSeverity() < severity {
+		return
+	}
 	pc, _, _, _ := runtime.Caller(2)
 	details := runtime.FuncForPC(pc).Name()
 	if len(details) >= trim {
@@ -181,10 +138,9 @@ func doLog(ctx context.Context, inner error, severity log.Severity, msg ...inter
 		details = details[:i]
 	}
 	err := &Error{
-		message:  msg,
-		severity: severity,
-		caller:   details,
-		inner:    inner,
+		message: msg,
+		caller:  details,
+		inner:   inner,
 	}
 	if ctx != nil && ctx != context.Background() {
 		id := uint32(c.IDFromContext(ctx))
@@ -193,7 +149,7 @@ func doLog(ctx context.Context, inner error, severity log.Severity, msg ...inter
 		}
 	}
 	log.Record(&log.GeneralMessage{
-		Severity: GetSeverity(err),
+		Severity: severity,
 		Content:  err,
 	})
 }
@@ -217,11 +173,3 @@ L:
 	}
 	return err
 }
-
-// GetSeverity returns the actual severity of the error, including inner errors.
-func GetSeverity(err error) log.Severity {
-	if s, ok := err.(hasSeverity); ok {
-		return s.Severity()
-	}
-	return log.Severity_Info
-}
@@ -7,30 +7,21 @@ import (

 	"github.com/google/go-cmp/cmp"
 	. "github.com/xtls/xray-core/common/errors"
-	"github.com/xtls/xray-core/common/log"
 )

 func TestError(t *testing.T) {
 	err := New("TestError")
-	if v := GetSeverity(err); v != log.Severity_Info {
-		t.Error("severity: ", v)
+	if v := err.Error(); !strings.Contains(v, "TestError") {
+		t.Error("error: ", v)
 	}

 	err = New("TestError2").Base(io.EOF)
-	if v := GetSeverity(err); v != log.Severity_Info {
-		t.Error("severity: ", v)
+	if v := err.Error(); !strings.Contains(v, "EOF") {
+		t.Error("error: ", v)
 	}

-	err = New("TestError3").Base(io.EOF).AtWarning()
-	if v := GetSeverity(err); v != log.Severity_Warning {
-		t.Error("severity: ", v)
-	}
-
-	err = New("TestError4").Base(io.EOF).AtWarning()
-	err = New("TestError5").Base(err)
-	if v := GetSeverity(err); v != log.Severity_Warning {
-		t.Error("severity: ", v)
-	}
+	err = New("TestError3").Base(io.EOF)
+	err = New("TestError4").Base(err)
 	if v := err.Error(); !strings.Contains(v, "EOF") {
 		t.Error("error: ", v)
 	}
@@ -0,0 +1,49 @@
+package geodata
+
+import (
+	"sync"
+
+	"github.com/xtls/xray-core/common"
+)
+
+var privateIPMatcher = sync.OnceValue(func() IPMatcher {
+	return common.Must2(IPReg.BuildIPMatcher(common.Must2(ParseIPRules([]string{
+		"0.0.0.0/8",
+		"10.0.0.0/8",
+		"100.64.0.0/10",
+		"127.0.0.0/8",
+		"169.254.0.0/16",
+		"172.16.0.0/12",
+		"192.0.0.0/24",
+		"192.0.2.0/24",
+		"192.88.99.0/24",
+		"192.168.0.0/16",
+		"198.18.0.0/15",
+		"198.51.100.0/24",
+		"203.0.113.0/24",
+		"224.0.0.0/3",
+		"::/127",
+		"fc00::/7",
+		"fe80::/10",
+		"ff00::/8",
+	}))))
+})
+
+func GetPrivateIPMatcher() IPMatcher { return privateIPMatcher() }
+
+var privateDomainMatcher = sync.OnceValue(func() DomainMatcher {
+	return common.Must2(DomainReg.BuildDomainMatcher(common.Must2(ParseDomainRules([]string{
+		"lan",
+		"localdomain",
+		"example",
+		"invalid",
+		"localhost",
+		"test",
+		"local",
+		"home.arpa",
+		"internal",
+		"regexp:^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$", // Dotless domains
+	}, Domain_Domain))))
+})
+
+func GetPrivateDomainMatcher() DomainMatcher { return privateDomainMatcher() }
@@ -8,6 +8,7 @@ import (

 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/geodata/strmatcher"
+	"github.com/xtls/xray-core/common/utils"
 )

 type DomainMatcher interface {
@@ -25,7 +26,7 @@ type DomainMatcherFactory interface {

 type MphDomainMatcherFactory struct {
 	sync.Mutex
-	shared map[string]strmatcher.MatcherGroup // TODO: cleanup
+	shared *utils.WeakCacheMap[string, strmatcher.MphValueMatcher]
 }

 func buildDomainRulesKey(rules []*DomainRule) string {
@@ -65,7 +66,7 @@ func (f *MphDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainMatch
 	if key != "" {
 		f.Lock()
 		defer f.Unlock()
-		if g := f.shared[key]; g != nil {
+		if g, ok := f.shared.Load(key); ok {
 			errors.LogDebug(context.Background(), "geodata mph domain matcher cache HIT for ", len(rules), " rules")
 			return g, nil
 		}
@@ -81,19 +82,10 @@ func (f *MphDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainMatch
 			}
 			g.Add(m, uint32(i))
 		case *DomainRule_Geosite:
-			domains, err := loadSiteWithAttrs(v.Geosite.File, v.Geosite.Code, v.Geosite.Attrs)
+			err := loadSiteMatchers(v.Geosite, func(m strmatcher.Matcher) { g.Add(m, uint32(i)) })
 			if err != nil {
 				return nil, err
 			}
-			for j, d := range domains {
-				domains[j] = nil // peak mem
-				m, err := parseDomain(d)
-				if err != nil {
-					errors.LogError(context.Background(), "ignore invalid geosite entry in ", v.Geosite.File, ":", v.Geosite.Code, " at index ", j, ", ", err)
-					continue
-				}
-				g.Add(m, uint32(i))
-			}
 		default:
 			panic("unknown domain rule type")
 		}
@@ -102,55 +94,45 @@ func (f *MphDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainMatch
 		return nil, err
 	}
 	if key != "" {
-		f.shared[key] = g
+		f.shared.Store(key, g)
 	}
 	return g, nil
 }

-type CompactDomainMatcherFactory struct {
+type CompactMphDomainMatcherFactory struct {
 	sync.Mutex
-	shared map[string]strmatcher.MatcherSet // TODO: cleanup
+	shared *utils.WeakCacheMap[string, strmatcher.MphValueMatcher]
 }

-func (f *CompactDomainMatcherFactory) getOrCreateFrom(rule *GeoSiteRule) (strmatcher.MatcherSet, error) {
+func (f *CompactMphDomainMatcherFactory) getOrCreateFrom(rule *GeoSiteRule) (*strmatcher.MphValueMatcher, error) {
 	key := rule.File + ":" + rule.Code + "@" + rule.Attrs

 	f.Lock()
 	defer f.Unlock()

-	if s := f.shared[key]; s != nil {
+	if s, ok := f.shared.Load(key); ok {
 		errors.LogDebug(context.Background(), "geodata geosite matcher cache HIT ", key)
 		return s, nil
 	}
 	errors.LogDebug(context.Background(), "geodata geosite matcher cache MISS ", key)

-	s := strmatcher.NewLinearAnyMatcher()
-	domains, err := loadSiteWithAttrs(rule.File, rule.Code, rule.Attrs)
-	if err != nil {
+	s := strmatcher.NewMphValueMatcher()
+	if err := loadSiteMatchers(rule, func(m strmatcher.Matcher) { s.Add(m, 0) }); err != nil {
 		return nil, err
 	}
-	for i, d := range domains {
-		domains[i] = nil // peak mem
-		m, err := parseDomain(d)
-		if err != nil {
-			errors.LogError(context.Background(), "ignore invalid geosite entry in ", rule.File, ":", rule.Code, " at index ", i, ", ", err)
-			continue
-		}
-		s.Add(m)
+	if err := s.Build(); err != nil {
+		return nil, err
 	}
-	f.shared[key] = s
-	return s, err
+	f.shared.Store(key, s)
+	return s, nil
 }

 // BuildMatcher implements DomainMatcherFactory.
-func (f *CompactDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainMatcher, error) {
+func (f *CompactMphDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainMatcher, error) {
 	if len(rules) == 0 {
 		return nil, errors.New("empty domain rule list")
 	}
-	compact := &CompactDomainMatcher{
-		matchers: make([]strmatcher.MatcherSet, 0, len(rules)),
-		values:   make([]uint32, 0, len(rules)),
-	}
+	compact := new(CompactMphDomainMatcher)
 	for i, r := range rules {
 		switch v := r.Value.(type) {
 		case *DomainRule_Custom:
@@ -167,8 +149,7 @@ func (f *CompactDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainM
 			if err != nil {
 				return nil, err
 			}
-			compact.matchers = append(compact.matchers, m)
-			compact.values = append(compact.values, uint32(i))
+			compact.combiner.Add(m, uint32(i))
 		default:
 			panic("unknown domain rule type")
 		}
@@ -176,37 +157,40 @@ func (f *CompactDomainMatcherFactory) BuildMatcher(rules []*DomainRule) (DomainM
 	return compact, nil
 }

-type CompactDomainMatcher struct {
+type CompactMphDomainMatcher struct {
 	custom   strmatcher.ValueMatcher
-	matchers []strmatcher.MatcherSet
-	values   []uint32
+	combiner strmatcher.MphValueMatcherCombiner
 }

 // Match implements DomainMatcher.
-func (c *CompactDomainMatcher) Match(input string) []uint32 {
-	var result []uint32
+func (c *CompactMphDomainMatcher) Match(input string) []uint32 {
+	result := c.combiner.Match(input)
 	if c.custom != nil {
-		result = append(result, c.custom.Match(input)...)
-	}
-	for i, m := range c.matchers {
-		if m.MatchAny(input) {
-			result = append(result, c.values[i])
-		}
+		result = append(c.custom.Match(input), result...)
 	}
 	return result
 }

 // MatchAny implements DomainMatcher.
-func (c *CompactDomainMatcher) MatchAny(input string) bool {
+func (c *CompactMphDomainMatcher) MatchAny(input string) bool {
 	if c.custom != nil && c.custom.MatchAny(input) {
 		return true
 	}
-	for _, m := range c.matchers {
-		if m.MatchAny(input) {
-			return true
+	return c.combiner.MatchAny(input)
+}
+
+// loadSiteMatchers calls add with a matcher for every domain of the geosite rule and logs the invalid ones.
+func loadSiteMatchers(rule *GeoSiteRule, add func(strmatcher.Matcher)) error {
+	i := 0
+	return loadSite(rule.File, rule.Code, rule.Attrs, func(t Domain_Type, value []byte) {
+		m, err := parseDomain(&Domain{Type: t, Value: string(value)})
+		if err != nil {
+			errors.LogError(context.Background(), "ignore invalid geosite entry in ", rule.File, ":", rule.Code, " at index ", i, ", ", err)
+		} else {
+			add(m)
 		}
-	}
-	return false
+		i++
+	})
 }

 func parseDomain(d *Domain) (strmatcher.Matcher, error) {
@@ -219,7 +203,7 @@ func parseDomain(d *Domain) (strmatcher.Matcher, error) {
 	case Domain_Regex:
 		return strmatcher.Regex.New(d.Value)
 	case Domain_Domain:
-		return strmatcher.Domain.New(d.Value)
+		return strmatcher.Domain.New(strings.ToLower(d.Value))
 	case Domain_Full:
 		return strmatcher.Full.New(strings.ToLower(d.Value))
 	default:
@@ -230,8 +214,8 @@ func parseDomain(d *Domain) (strmatcher.Matcher, error) {
 func newDomainMatcherFactory() DomainMatcherFactory {
 	switch runtime.GOOS {
 	case "ios", "android":
-		return &CompactDomainMatcherFactory{shared: make(map[string]strmatcher.MatcherSet)}
+		return &CompactMphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()}
 	default:
-		return &MphDomainMatcherFactory{shared: make(map[string]strmatcher.MatcherGroup)}
+		return &MphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()}
 	}
 }
@@ -4,13 +4,15 @@ import (
 	"path/filepath"
 	"reflect"
 	"slices"
+	"sync"
 	"testing"

 	"github.com/xtls/xray-core/common/geodata/strmatcher"
+	"github.com/xtls/xray-core/common/utils"
 )

 func TestCompactDomainMatcher_PreservesCustomRuleIndices(t *testing.T) {
-	factory := &CompactDomainMatcherFactory{shared: make(map[string]strmatcher.MatcherSet)}
+	factory := &CompactMphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()}
 	matcher, err := factory.BuildMatcher([]*DomainRule{
 		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "example.com"}}},
 		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Domain, Value: "example.com"}}},
@@ -31,7 +33,7 @@ func TestCompactDomainMatcher_PreservesCustomRuleIndices(t *testing.T) {
 func TestCompactDomainMatcher_PreservesMixedRuleIndices(t *testing.T) {
 	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))

-	factory := &CompactDomainMatcherFactory{shared: make(map[string]strmatcher.MatcherSet)}
+	factory := &CompactMphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()}
 	matcher, err := factory.BuildMatcher([]*DomainRule{
 		{Value: &DomainRule_Geosite{Geosite: &GeoSiteRule{File: DefaultGeoSiteDat, Code: "CN"}}},
 		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "163.com"}}},
@@ -50,10 +52,11 @@ func TestCompactDomainMatcher_PreservesMixedRuleIndices(t *testing.T) {
 }

 func TestMphDomainMatcher_MatchReturnsDetachedSlice(t *testing.T) {
-	matcher, err := (&MphDomainMatcherFactory{shared: make(map[string]strmatcher.MatcherGroup)}).BuildMatcher([]*DomainRule{
-		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "example.com"}}},
-		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Domain, Value: "example.com"}}},
-	})
+	matcher, err := (&MphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()}).
+		BuildMatcher([]*DomainRule{
+			{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "example.com"}}},
+			{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Domain, Value: "example.com"}}},
+		})
 	if err != nil {
 		t.Fatalf("BuildMatcher() failed: %v", err)
 	}
@@ -70,3 +73,76 @@ func TestMphDomainMatcher_MatchReturnsDetachedSlice(t *testing.T) {
 		t.Fatalf("Match() after caller mutation = %v, want %v", gotAgain, []uint32{0, 1})
 	}
 }
+
+// DNS sorts every Match result in place, so a matcher must never hand out a
+// slice it keeps, also when only its keyword or regex part matches.
+func TestDomainMatcher_MatchResultsCanBeSortedConcurrently(t *testing.T) {
+	t.Setenv("xray.location.asset", filepath.Join("..", "..", "resources"))
+
+	rules := []*DomainRule{
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "example.com"}}},
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Domain, Value: "example.com"}}},
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Substr, Value: "exam"}}},
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Regex, Value: `^ex.*\.org$`}}},
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Substr, Value: "exam"}}},
+		{Value: &DomainRule_Geosite{Geosite: &GeoSiteRule{File: DefaultGeoSiteDat, Code: "CN"}}},
+		{Value: &DomainRule_Custom{Custom: &Domain{Type: Domain_Full, Value: "only.full.test"}}},
+	}
+	cases := []struct {
+		input string
+		want  []uint32
+	}{
+		{"example.com", []uint32{0, 1, 2, 4}},
+		{"www.example.com", []uint32{1, 2, 4}},
+		{"exam.net", []uint32{2, 4}}, // keyword part only
+		{"example.org", []uint32{2, 3, 4}},
+		{"163.com", []uint32{5}},
+		{"www.163.com", []uint32{5}},
+		{"only.full.test", []uint32{6}}, // full part only
+		{"nomatch.test", nil},
+	}
+	factories := map[string]DomainMatcherFactory{
+		"mph":     &MphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()},
+		"compact": &CompactMphDomainMatcherFactory{shared: utils.NewWeakCacheMap[string, strmatcher.MphValueMatcher]()},
+	}
+	for name, factory := range factories {
+		t.Run(name, func(t *testing.T) {
+			matcher, err := factory.BuildMatcher(rules)
+			if err != nil {
+				t.Fatalf("BuildMatcher() failed: %v", err)
+			}
+			for _, c := range cases {
+				got := matcher.Match(c.input)
+				if sorted := slices.Sorted(slices.Values(got)); !slices.Equal(sorted, c.want) {
+					t.Fatalf("Match(%q) = %v, want %v", c.input, sorted, c.want)
+				}
+				got = got[:cap(got)]
+				for j := range got {
+					got[j] = ^uint32(0)
+				}
+				if again := slices.Sorted(slices.Values(matcher.Match(c.input))); !slices.Equal(again, c.want) {
+					t.Fatalf("Match(%q) after caller mutation = %v, want %v", c.input, again, c.want)
+				}
+			}
+
+			var wg sync.WaitGroup
+			for range 8 {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					for range 500 {
+						for _, c := range cases {
+							got := matcher.Match(c.input)
+							slices.Sort(got)
+							if !slices.Equal(got, c.want) {
+								t.Errorf("Match(%q) = %v, want %v", c.input, got, c.want)
+								return
+							}
+						}
+					}
+				}()
+			}
+			wg.Wait()
+		})
+	}
+}
@@ -6,12 +6,14 @@ import (
 	"sync/atomic"

 	"github.com/xtls/xray-core/common/errors"
+	"github.com/xtls/xray-core/common/utils"
+	"github.com/xtls/xray-core/common/uuid"
 )

 type DomainRegistry struct {
 	mu       sync.Mutex
 	factory  DomainMatcherFactory
-	matchers []*DynamicDomainMatcher
+	matchers *utils.WeakCacheMap[uuid.UUID, DynamicDomainMatcher]
 }

 func (r *DomainRegistry) BuildDomainMatcher(rules []*DomainRule) (DomainMatcher, error) {
@@ -24,7 +26,7 @@ func (r *DomainRegistry) BuildDomainMatcher(rules []*DomainRule) (DomainMatcher,
 	}

 	d := NewDynamicDomainMatcher(rules, m)
-	r.matchers = append(r.matchers, d)
+	r.matchers.Store(uuid.New(), d)
 	return d, nil
 }

@@ -32,15 +34,20 @@ func (r *DomainRegistry) Reload() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()

-	errors.LogInfo(context.Background(), "reloading GeoSite data for ", len(r.matchers), " domain matcher(s)")
+	var matchers []*DynamicDomainMatcher
+	r.matchers.Range(func(_ uuid.UUID, matcher *DynamicDomainMatcher) bool {
+		matchers = append(matchers, matcher)
+		return true
+	})
+	errors.LogInfo(context.Background(), "reloading GeoSite data for ", len(matchers), " domain matcher(s)")

 	factory := newDomainMatcherFactory()
 	type reloadEntry struct {
 		dynamic *DynamicDomainMatcher
 		matcher DomainMatcher
 	}
-	reloaded := make([]reloadEntry, len(r.matchers))
-	for i, d := range r.matchers {
+	reloaded := make([]reloadEntry, len(matchers))
+	for i, d := range matchers {
 		m, err := factory.BuildMatcher(d.rules)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to reload GeoSite data for domain matcher ", i)
@@ -52,13 +59,14 @@ func (r *DomainRegistry) Reload() error {
 		entry.dynamic.Reload(entry.matcher)
 	}
 	r.factory = factory
-	errors.LogInfo(context.Background(), "reloaded GeoSite data for ", len(r.matchers), " domain matcher(s)")
+	errors.LogInfo(context.Background(), "reloaded GeoSite data for ", len(matchers), " domain matcher(s)")
 	return nil
 }

 func newDomainRegistry() *DomainRegistry {
 	return &DomainRegistry{
-		factory: newDomainMatcherFactory(),
+		factory:  newDomainMatcherFactory(),
+		matchers: utils.NewWeakCacheMap[uuid.UUID, DynamicDomainMatcher](),
 	}
 }

@@ -5,11 +5,14 @@ import (
 	"bytes"
 	"io"
 	"runtime"
+	"slices"
 	"strings"
+	"unicode/utf8"

 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform/filesystem"

+	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
 )

@@ -52,17 +55,56 @@ func loadIP(file, code string) ([]*CIDR, error) {
 	return geoip.Cidr, nil
 }

-func loadSite(file, code string) ([]*Domain, error) {
-	bs, err := loadFile(file, code)
+// loadSite calls fn, in file order, with the type and value of every domain of the geosite code
+// that has all the "@"-separated attrs. It decodes the entry while reading the file instead of
+// unmarshalling it into a []*Domain, so value is only valid during fn.
+func loadSite(file, code, attrs string, fn func(Domain_Type, []byte)) error {
+	runtime.GC() // peak mem
+	r, err := filesystem.OpenAsset(file)
 	if err != nil {
-		return nil, err
+		return errors.New("failed to open ", file).Base(err)
 	}
-	defer runtime.GC() // peak mem
-	var geosite GeoSite
-	if err := proto.Unmarshal(bs, &geosite); err != nil {
-		return nil, errors.New("error unmarshal Site in ", file, ":", code).Base(err)
+	defer r.Close()
+	br := bufio.NewReaderSize(r, 64*1024)
+	n, err := seek(br, []byte(code))
+	if err != nil {
+		return errors.New("failed to load code ", code, " from ", file).Base(err)
 	}
-	return geosite.Domain, nil
+	loadErr := func(err error) error {
+		if err == io.EOF {
+			err = io.ErrUnexpectedEOF
+		}
+		return errors.New("failed to load code ", code, " from ", file).Base(err)
+	}
+	unmarshalErr := func(err error) error {
+		return errors.New("error unmarshal Site in ", file, ":", code).Base(err)
+	}
+	d := newSiteDecoder(attrs, fn)
+	for n > 0 {
+		w, err := br.Peek(min(n, br.Size()))
+		if err != nil {
+			return loadErr(err)
+		}
+		used, err := d.decode(w, len(w) < n)
+		if err != nil {
+			return unmarshalErr(err)
+		}
+		if used == 0 {
+			break // a field longer than the buffer
+		}
+		br.Discard(used)
+		n -= used
+	}
+	if n > 0 {
+		w := make([]byte, n)
+		if _, err := io.ReadFull(br, w); err != nil {
+			return loadErr(err)
+		}
+		if _, err := d.decode(w, false); err != nil {
+			return unmarshalErr(err)
+		}
+	}
+	return nil
 }

 func decodeVarint(br *bufio.Reader) (uint64, error) {
@@ -82,68 +124,63 @@ func decodeVarint(br *bufio.Reader) (uint64, error) {
 }

 func find(r io.Reader, code []byte, readBody bool) ([]byte, error) {
+	br := bufio.NewReaderSize(r, 64*1024)
+	bodyL, err := seek(br, code)
+	if err != nil || !readBody {
+		return nil, err
+	}
+	out := make([]byte, bodyL)
+	if _, err := io.ReadFull(br, out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// seek advances br to the body of the entry for code and returns the body length.
+func seek(br *bufio.Reader, code []byte) (int, error) {
 	codeL := len(code)
 	if codeL == 0 {
-		return nil, errors.New("empty code")
+		return 0, errors.New("empty code")
 	}
-
-	br := bufio.NewReaderSize(r, 64*1024)
 	need := 2 + codeL // TODO: if code too long
-	prefixBuf := make([]byte, need)

 	for {
 		if _, err := br.ReadByte(); err != nil {
-			return nil, err
+			return 0, err
 		}

 		x, err := decodeVarint(br)
 		if err != nil {
-			return nil, err
+			return 0, err
 		}
 		bodyL := int(x)
 		if bodyL <= 0 {
-			return nil, errors.New("invalid body length: ", bodyL)
+			return 0, errors.New("invalid body length: ", bodyL)
 		}

-		prefixL := bodyL
-		if prefixL > need {
-			prefixL = need
-		}
-		prefix := prefixBuf[:prefixL]
-		if _, err := io.ReadFull(br, prefix); err != nil {
-			return nil, err
-		}
-
-		match := false
-		if bodyL >= need {
-			if int(prefix[1]) == codeL && bytes.Equal(prefix[2:need], code) {
-				if !readBody {
-					return nil, nil
-				}
-				match = true
+		// Peek no more than the buffer holds: a code longer than the buffer cannot match a single
+		// length byte anyway, so a short peek only skips it, as base find (io.ReadFull) does.
+		prefix, err := br.Peek(min(bodyL, need, br.Size()))
+		if err != nil {
+			if err == io.EOF && len(prefix) > 0 {
+				err = io.ErrUnexpectedEOF // as io.ReadFull
 			}
+			return 0, err
 		}
-
-		remain := bodyL - prefixL
-		if match {
-			out := make([]byte, bodyL)
-			copy(out, prefix)
-			if remain > 0 {
-				if _, err := io.ReadFull(br, out[prefixL:]); err != nil {
-					return nil, err
-				}
-			}
-			return out, nil
+		if bodyL >= need && len(prefix) >= need && int(prefix[1]) == codeL && bytes.Equal(prefix[2:], code) {
+			return bodyL, nil
 		}
-
-		if remain > 0 {
-			if _, err := br.Discard(remain); err != nil {
-				return nil, err
-			}
+		if _, err := br.Discard(bodyL); err != nil {
+			return 0, err
 		}
 	}
 }

+// AttributeMatcher, HasAttrMatcher, AllAttrsMatcher and NewAllAttrsMatcher are the exported
+// attribute helpers that have been part of this package's API since #5814. The streaming loader
+// above filters attributes itself without building a *Domain, so it does not use them, but they
+// are kept for external callers. Their behaviour is unchanged.
+
 type AttributeMatcher interface {
 	Match(*Domain) bool
 }
@@ -185,23 +222,137 @@ func NewAllAttrsMatcher(attrs string) AttributeMatcher {
 	return m
 }

-func loadSiteWithAttrs(file, code, attrs string) ([]*Domain, error) {
-	domains, err := loadSite(file, code)
-	if err != nil {
-		return nil, err
-	}
+var errInvalidUTF8 = errors.New("string field contains invalid UTF-8")

-	matcher := NewAllAttrsMatcher(attrs)
-	if matcher == nil {
-		return domains, nil
-	}
+type siteDecoder struct {
+	want []string
+	has  []bool
+	fn   func(Domain_Type, []byte)
+}

-	filtered := make([]*Domain, 0, len(domains))
-	for _, d := range domains {
-		if matcher.Match(d) {
-			filtered = append(filtered, d)
+func newSiteDecoder(attrs string, fn func(Domain_Type, []byte)) *siteDecoder {
+	d := &siteDecoder{fn: fn}
+	if attrs != "" {
+		d.want = strings.Split(attrs, "@")
+		d.has = make([]bool, len(d.want))
+	}
+	return d
+}
+
+// decode walks the whole fields at the start of b, a part of an encoded GeoSite (see geodat.proto),
+// calls fn for every domain that has all attrs and returns how many bytes it used. A field cut off
+// by the end of b is an error unless more is set. It accepts and rejects what proto.Unmarshal does.
+func (d *siteDecoder) decode(b []byte, more bool) (int, error) {
+	used := 0
+	for used < len(b) {
+		f, n, err := consumeField(b[used:])
+		if err == io.ErrUnexpectedEOF && more {
+			break
+		}
+		if err != nil {
+			return used, err
+		}
+		used += n
+		if f.typ != protowire.BytesType {
+			continue
+		}
+		switch f.num {
+		case 1: // code
+			if !utf8.Valid(f.v) {
+				return used, errInvalidUTF8
+			}
+		case 2: // domain
+			t, value, err := decodeDomain(f.v, d.want, d.has)
+			if err != nil {
+				return used, err
+			}
+			if !slices.Contains(d.has, false) {
+				d.fn(t, value)
+			}
 		}
 	}
+	return used, nil
+}

-	return filtered, nil
+// decodeDomain decodes an encoded Domain and sets has[i] if one of its attributes has the key want[i].
+func decodeDomain(b []byte, want []string, has []bool) (t Domain_Type, value []byte, err error) {
+	clear(has)
+	for len(b) > 0 {
+		f, n, err := consumeField(b)
+		if err != nil {
+			return 0, nil, err
+		}
+		b = b[n:]
+		switch {
+		case f.num == 1 && f.typ == protowire.VarintType: // type
+			t = Domain_Type(f.x)
+		case f.num == 2 && f.typ == protowire.BytesType: // value
+			if !utf8.Valid(f.v) {
+				return 0, nil, errInvalidUTF8
+			}
+			value = f.v
+		case f.num == 3 && f.typ == protowire.BytesType: // attribute
+			key, err := decodeAttributeKey(f.v)
+			if err != nil {
+				return 0, nil, err
+			}
+			for i, w := range want {
+				if string(key) == w {
+					has[i] = true
+				}
+			}
+		}
+	}
+	return t, value, nil
+}
+
+// decodeAttributeKey returns the key of an encoded Domain.Attribute.
+func decodeAttributeKey(b []byte) ([]byte, error) {
+	var key []byte
+	for len(b) > 0 {
+		f, n, err := consumeField(b)
+		if err != nil {
+			return nil, err
+		}
+		b = b[n:]
+		if f.num == 1 && f.typ == protowire.BytesType {
+			if !utf8.Valid(f.v) {
+				return nil, errInvalidUTF8
+			}
+			key = f.v
+		}
+	}
+	return key, nil
+}
+
+type protoField struct {
+	num protowire.Number
+	typ protowire.Type
+	v   []byte // payload of a length-delimited field
+	x   uint64 // value of a varint field
+}
+
+// consumeField parses the first field of an encoded message and returns it with its length.
+func consumeField(b []byte) (protoField, int, error) {
+	num, typ, n := protowire.ConsumeTag(b)
+	if n < 0 {
+		return protoField{}, 0, protowire.ParseError(n)
+	}
+	if num > protowire.MaxValidNumber {
+		return protoField{}, 0, errors.New("invalid field number ", num)
+	}
+	f := protoField{num: num, typ: typ}
+	var m int
+	switch typ {
+	case protowire.BytesType:
+		f.v, m = protowire.ConsumeBytes(b[n:])
+	case protowire.VarintType:
+		f.x, m = protowire.ConsumeVarint(b[n:])
+	default:
+		m = protowire.ConsumeFieldValue(num, typ, b[n:])
+	}
+	if m < 0 {
+		return protoField{}, 0, protowire.ParseError(m)
+	}
+	return f, n + m, nil
 }
@@ -0,0 +1,283 @@
+package geodata
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"google.golang.org/protobuf/encoding/protowire"
+	"google.golang.org/protobuf/proto"
+)
+
+type siteEntry struct {
+	Type  Domain_Type
+	Value string
+}
+
+// unmarshalSite is what loadSite used to do: proto.Unmarshal, then keep the domains that have all attrs.
+func unmarshalSite(b []byte, attrs string) ([]siteEntry, error) {
+	var site GeoSite
+	if err := proto.Unmarshal(b, &site); err != nil {
+		return nil, err
+	}
+	var entries []siteEntry
+	for _, d := range site.Domain {
+		ok := true
+		for _, key := range strings.Split(attrs, "@") {
+			ok = ok && (attrs == "" || slices.ContainsFunc(d.Attribute, func(a *Domain_Attribute) bool { return a.Key == key }))
+		}
+		if ok {
+			entries = append(entries, siteEntry{d.Type, d.Value})
+		}
+	}
+	return entries, nil
+}
+
+func checkDecodeSite(t *testing.T, name string, b []byte, attrs string) {
+	t.Helper()
+	want, wantErr := unmarshalSite(b, attrs)
+	var got []siteEntry
+	_, err := newSiteDecoder(attrs, func(typ Domain_Type, value []byte) {
+		got = append(got, siteEntry{typ, string(value)})
+	}).decode(b, false)
+	if (err == nil) != (wantErr == nil) {
+		t.Fatalf("%s@%s: error %v, proto.Unmarshal: %v", name, attrs, err, wantErr)
+	}
+	if err == nil && !slices.Equal(got, want) {
+		t.Fatalf("%s@%s: got %v, want %v", name, attrs, got, want)
+	}
+}
+
+func TestDecodeSiteMatchesUnmarshal(t *testing.T) {
+	bs, err := os.ReadFile(filepath.Join("..", "..", "resources", DefaultGeoSiteDat))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for len(bs) > 0 {
+		num, typ, n := protowire.ConsumeTag(bs)
+		if n < 0 || num != 1 || typ != protowire.BytesType {
+			t.Fatal("unexpected GeoSiteList field")
+		}
+		entry, m := protowire.ConsumeBytes(bs[n:])
+		if m < 0 {
+			t.Fatal(protowire.ParseError(m))
+		}
+		bs = bs[n+m:]
+
+		var site GeoSite
+		if err := proto.Unmarshal(entry, &site); err != nil {
+			t.Fatal(err)
+		}
+		queries := []string{"", "none"}
+		for _, d := range site.Domain {
+			for _, a := range d.Attribute {
+				if !slices.Contains(queries, a.Key) {
+					queries = append(queries, a.Key, a.Key+"@none")
+				}
+			}
+		}
+		for _, attrs := range queries {
+			checkDecodeSite(t, site.Code, entry, attrs)
+		}
+	}
+}
+
+func TestDecodeSiteUnusualEncodings(t *testing.T) {
+	field := func(num protowire.Number, v []byte) []byte {
+		return protowire.AppendBytes(protowire.AppendTag(nil, num, protowire.BytesType), v)
+	}
+	typ := func(v Domain_Type) []byte {
+		return protowire.AppendVarint(protowire.AppendTag(nil, 1, protowire.VarintType), uint64(v))
+	}
+	value := func(s string) []byte { return field(2, []byte(s)) }
+	attr := func(keys ...string) []byte {
+		var b []byte
+		for _, k := range keys {
+			b = append(b, field(1, []byte(k))...)
+		}
+		return field(3, b)
+	}
+	domain := func(fields ...[]byte) []byte { return field(2, slices.Concat(fields...)) }
+	unknown := protowire.AppendFixed32(protowire.AppendTag(nil, 9, protowire.Fixed32Type), 1)
+
+	for name, b := range map[string][]byte{
+		"unknown field":   domain(typ(Domain_Full), unknown, value("example.com")),
+		"repeated value":  domain(value("a.com"), typ(Domain_Full), value("b.com")),
+		"repeated type":   domain(typ(Domain_Full), value("a.com"), typ(Domain_Regex)),
+		"repeated key":    domain(value("a.com"), attr("cn", "ads")),
+		"type as bytes":   domain(field(1, []byte("x")), value("a.com")),
+		"no value":        domain(typ(Domain_Domain), attr("cn")),
+		"truncated":       domain(typ(Domain_Full), value("example.com"))[:10],
+		"invalid utf8":    domain(value("example.\xff")),
+		"invalid key":     domain(value("a.com"), attr("\xff")),
+		"bad field":       protowire.AppendVarint(protowire.AppendTag(nil, protowire.MaxValidNumber+1, protowire.VarintType), 1),
+		"stray end group": protowire.AppendTag(nil, 5, protowire.EndGroupType),
+	} {
+		for _, attrs := range []string{"", "cn", "ads", "cn@ads"} {
+			checkDecodeSite(t, name, b, attrs)
+		}
+	}
+}
+
+// TestLoadSiteReadsInPieces covers what real lists never do: an entry far longer than the read
+// buffer, with a field longer than the buffer in the middle, and a file cut short.
+func TestLoadSiteReadsInPieces(t *testing.T) {
+	site := &GeoSite{Code: "BIG"}
+	for i := range 5000 {
+		d := &Domain{Type: Domain_Domain, Value: strings.Repeat("x", i%40) + ".example.com"}
+		if i%3 == 0 {
+			d.Attribute = []*Domain_Attribute{{Key: "cn"}}
+		}
+		if i == 2500 {
+			d = &Domain{Type: Domain_Regex, Value: strings.Repeat("a", 100_000)}
+		}
+		site.Domain = append(site.Domain, d)
+	}
+	list := &GeoSiteList{Entry: []*GeoSite{{Code: "SMALL", Domain: []*Domain{{Type: Domain_Full, Value: "a.com"}}}, site}}
+	bs, err := proto.Marshal(list)
+	if err != nil {
+		t.Fatal(err)
+	}
+	entry, err := proto.Marshal(site)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	t.Setenv("xray.location.asset", dir)
+	write := func(b []byte) {
+		if err := os.WriteFile(filepath.Join(dir, "big.dat"), b, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, attrs := range []string{"", "cn"} {
+		want, _ := unmarshalSite(entry, attrs)
+		var got []siteEntry
+		write(bs)
+		err := loadSite("big.dat", "BIG", attrs, func(typ Domain_Type, value []byte) {
+			got = append(got, siteEntry{typ, string(value)})
+		})
+		if err != nil || !slices.Equal(got, want) {
+			t.Fatalf("attrs %q: %d entries, want %d, error %v", attrs, len(got), len(want), err)
+		}
+		for _, cut := range []int{30_000, len(bs) - 150_000, len(bs) - 1} {
+			write(bs[:cut])
+			if err := loadSite("big.dat", "BIG", attrs, func(Domain_Type, []byte) {}); err == nil {
+				t.Fatalf("file cut at %d of %d: no error", cut, len(bs))
+			}
+		}
+	}
+}
+
+// oneEntryGeoSiteFile wraps an encoded GeoSite as a one-entry GeoSiteList, the file loadSite reads.
+func oneEntryGeoSiteFile(entry []byte) []byte {
+	return protowire.AppendBytes(protowire.AppendTag(nil, 1, protowire.BytesType), entry)
+}
+
+// TestLoadSiteWindowedMatchesSingleShot checks that the windowed reader in loadSite (its Peek/Discard
+// loop, the more-break when a field is cut by a window edge, the used==0 fallback for a field longer
+// than the buffer, and the tail path) reaches exactly the same result as decoding the whole entry at
+// once, for a category several 64 KiB windows long, valid and then mutated near a window edge and
+// early in the file: same error-or-not, and the same emitted (type, value) sequence when both accept.
+func TestLoadSiteWindowedMatchesSingleShot(t *testing.T) {
+	const window = 64 * 1024
+	site := &GeoSite{Code: "BIG"}
+	for i := range 12000 { // ~250 KiB, four windows
+		d := &Domain{Type: Domain_Domain, Value: fmt.Sprintf("host%d.%s.example.com", i, strings.Repeat("y", i%30))}
+		if i%3 == 0 {
+			d.Attribute = []*Domain_Attribute{{Key: "cn"}}
+		}
+		site.Domain = append(site.Domain, d)
+	}
+	// a field longer than the buffer, straddling the third window, to force the used==0 fallback
+	site.Domain = slices.Insert(site.Domain, 8000, &Domain{Type: Domain_Regex, Value: strings.Repeat("a", 90_000)})
+	entry, err := proto.Marshal(site)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	t.Setenv("xray.location.asset", dir)
+
+	// mutations of the encoded entry: unchanged, a byte flipped at several offsets (early windows and
+	// either side of a window edge), and truncations at the same places.
+	type mut struct {
+		name string
+		make func([]byte) []byte
+	}
+	muts := []mut{{"valid", func(b []byte) []byte { return b }}}
+	for _, off := range []int{3, 40, 4000, window - 1, window, window + 1, 2*window - 2, 2 * window} {
+		if off < len(entry) {
+			off := off
+			muts = append(muts, mut{fmt.Sprintf("flip@%d", off), func(b []byte) []byte {
+				c := slices.Clone(b)
+				c[off] ^= 0xff
+				return c
+			}})
+			muts = append(muts, mut{fmt.Sprintf("cut@%d", off), func(b []byte) []byte { return slices.Clone(b[:off]) }})
+		}
+	}
+
+	for _, attrs := range []string{"", "cn"} {
+		for _, m := range muts {
+			e := m.make(entry)
+			// single-shot reference: decode the whole entry in one call
+			var want []siteEntry
+			_, wantErr := newSiteDecoder(attrs, func(typ Domain_Type, value []byte) {
+				want = append(want, siteEntry{typ, string(value)})
+			}).decode(e, false)
+			// windowed: loadSite reads the file 64 KiB at a time
+			if err := os.WriteFile(filepath.Join(dir, "w.dat"), oneEntryGeoSiteFile(e), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			var got []siteEntry
+			gotErr := loadSite("w.dat", "BIG", attrs, func(typ Domain_Type, value []byte) {
+				got = append(got, siteEntry{typ, string(value)})
+			})
+			if (gotErr == nil) != (wantErr == nil) {
+				t.Fatalf("%s attrs=%q: windowed err %v, single-shot err %v", m.name, attrs, gotErr, wantErr)
+			}
+			if gotErr == nil && !slices.Equal(got, want) {
+				t.Fatalf("%s attrs=%q: windowed got %d entries, single-shot %d", m.name, attrs, len(got), len(want))
+			}
+		}
+	}
+}
+
+// TestLoadSiteLongCode covers a geosite entry whose code is longer than the 64 KiB read buffer. seek
+// must skip it (find compares a single length byte, so it never matches such a code) and still find a
+// later entry, and looking the long code up must fail cleanly, like a missing code, not panic.
+func TestLoadSiteLongCode(t *testing.T) {
+	longCode := strings.Repeat("Z", 70000)
+	list := &GeoSiteList{Entry: []*GeoSite{
+		{Code: "FIRST", Domain: []*Domain{{Type: Domain_Full, Value: "first.com"}}},
+		{Code: longCode, Domain: []*Domain{{Type: Domain_Full, Value: "huge.com"}}},
+		{Code: "AFTER", Domain: []*Domain{{Type: Domain_Domain, Value: "after.com"}}},
+	}}
+	bs, err := proto.Marshal(list)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	t.Setenv("xray.location.asset", dir)
+	if err := os.WriteFile(filepath.Join(dir, "lc.dat"), bs, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	collect := func(code string) ([]siteEntry, error) {
+		var got []siteEntry
+		err := loadSite("lc.dat", code, "", func(typ Domain_Type, value []byte) {
+			got = append(got, siteEntry{typ, string(value)})
+		})
+		return got, err
+	}
+	if got, err := collect("FIRST"); err != nil || !slices.Equal(got, []siteEntry{{Domain_Full, "first.com"}}) {
+		t.Fatalf("FIRST: %v %v", got, err)
+	}
+	if got, err := collect("AFTER"); err != nil || !slices.Equal(got, []siteEntry{{Domain_Domain, "after.com"}}) {
+		t.Fatalf("AFTER (past the oversized entry): %v %v", got, err)
+	}
+	if _, err := collect(longCode); err == nil {
+		t.Fatal("oversized code: expected a not-found error, got nil")
+	}
+}
@@ -11,6 +11,7 @@ import (

 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/utils"

 	"go4.org/netipx"
 )
@@ -806,7 +807,7 @@ func (mm *HeuristicMultiIPMatcher) SetReverse(reverse bool) {

 type IPSetFactory struct {
 	sync.Mutex
-	shared map[string]*IPSet // TODO: cleanup
+	shared *utils.WeakCacheMap[string, IPSet]
 }

 func (f *IPSetFactory) GetOrCreateFromGeoIPRules(rules []*GeoIPRule) (*IPSet, error) {
@@ -815,7 +816,7 @@ func (f *IPSetFactory) GetOrCreateFromGeoIPRules(rules []*GeoIPRule) (*IPSet, er
 	f.Lock()
 	defer f.Unlock()

-	if ipset := f.shared[key]; ipset != nil {
+	if ipset, ok := f.shared.Load(key); ok {
 		errors.LogDebug(context.Background(), "geodata geoip matcher cache HIT ", key)
 		return ipset, nil
 	}
@@ -835,7 +836,7 @@ func (f *IPSetFactory) GetOrCreateFromGeoIPRules(rules []*GeoIPRule) (*IPSet, er
 		return nil
 	})
 	if err == nil {
-		f.shared[key] = ipset
+		f.shared.Store(key, ipset)
 	}
 	return ipset, err
 }
@@ -1018,5 +1019,5 @@ func buildOptimizedIPMatcher(f *IPSetFactory, rules []*IPRule) (IPMatcher, error
 }

 func newIPSetFactory() *IPSetFactory {
-	return &IPSetFactory{shared: make(map[string]*IPSet)}
+	return &IPSetFactory{shared: utils.NewWeakCacheMap[string, IPSet]()}
 }
@@ -315,7 +315,7 @@ func TestIPMatcherAnyMatchAndMatches(t *testing.T) {
 	}

 	if !matcher.AnyMatch([]net.IP{
-		net.IP{},
+		{},
 		ip("1.1.1.1"),
 		ip("8.8.8.8"),
 	}) {
@@ -345,7 +345,7 @@ func TestIPMatcherAnyMatchAndMatches(t *testing.T) {

 	if matcher.Matches([]net.IP{
 		ip("8.8.8.8"),
-		net.IP{},
+		{},
 	}) {
 		t.Fatal("expect Matches to be false when any IP is invalid")
 	}
@@ -362,7 +362,7 @@ func TestIPMatcherFilterIPs(t *testing.T) {
 	}

 	matched, unmatched := matcher.FilterIPs([]net.IP{
-		net.IP{},
+		{},
 		ip("8.8.8.8"),
 		ip("91.108.255.254"),
 		ip("1.1.1.1"),
@@ -7,25 +7,27 @@ import (

 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/net"
+	"github.com/xtls/xray-core/common/utils"
+	"github.com/xtls/xray-core/common/uuid"
 )

 type IPRegistry struct {
-	mu           sync.Mutex
-	ipsetFactory *IPSetFactory
-	matchers     []*DynamicIPMatcher
+	mu       sync.Mutex
+	factory  *IPSetFactory
+	matchers *utils.WeakCacheMap[uuid.UUID, DynamicIPMatcher]
 }

 func (r *IPRegistry) BuildIPMatcher(rules []*IPRule) (IPMatcher, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()

-	m, err := buildOptimizedIPMatcher(r.ipsetFactory, rules)
+	m, err := buildOptimizedIPMatcher(r.factory, rules)
 	if err != nil {
 		return nil, err
 	}

 	d := NewDynamicIPMatcher(rules, m)
-	r.matchers = append(r.matchers, d)
+	r.matchers.Store(uuid.New(), d)
 	return d, nil
 }

@@ -33,15 +35,20 @@ func (r *IPRegistry) Reload() error {
 	r.mu.Lock()
 	defer r.mu.Unlock()

-	errors.LogInfo(context.Background(), "reloading GeoIP data for ", len(r.matchers), " IP matcher(s)")
+	var matchers []*DynamicIPMatcher
+	r.matchers.Range(func(_ uuid.UUID, matcher *DynamicIPMatcher) bool {
+		matchers = append(matchers, matcher)
+		return true
+	})
+	errors.LogInfo(context.Background(), "reloading GeoIP data for ", len(matchers), " IP matcher(s)")

 	factory := newIPSetFactory()
 	type reloadEntry struct {
 		dynamic *DynamicIPMatcher
 		matcher IPMatcher
 	}
-	reloaded := make([]reloadEntry, len(r.matchers))
-	for i, d := range r.matchers {
+	reloaded := make([]reloadEntry, len(matchers))
+	for i, d := range matchers {
 		m, err := buildOptimizedIPMatcher(factory, d.rules)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to reload GeoIP data for IP matcher ", i)
@@ -52,14 +59,15 @@ func (r *IPRegistry) Reload() error {
 	for _, entry := range reloaded {
 		entry.dynamic.Reload(entry.matcher)
 	}
-	r.ipsetFactory = factory
-	errors.LogInfo(context.Background(), "reloaded GeoIP data for ", len(r.matchers), " IP matcher(s)")
+	r.factory = factory
+	errors.LogInfo(context.Background(), "reloaded GeoIP data for ", len(matchers), " IP matcher(s)")
 	return nil
 }

 func newIPRegistry() *IPRegistry {
 	return &IPRegistry{
-		ipsetFactory: newIPSetFactory(),
+		factory:  newIPSetFactory(),
+		matchers: utils.NewWeakCacheMap[uuid.UUID, DynamicIPMatcher](),
 	}
 }

@@ -138,7 +138,7 @@ func ParseDomainRule(r string, defaultType Domain_Type) (*DomainRule, error) {
 	}

 	prefix := 0
-	for _, ext := range [...]string{"ext:", "ext-domain:"} {
+	for _, ext := range [...]string{"ext:", "ext-domain:", "ext-site:"} {
 		if strings.HasPrefix(r, ext) {
 			prefix = len(ext)
 			break
@@ -167,7 +167,7 @@ func ParseDomainRules(rules []string, defaultType Domain_Type) ([]*DomainRule, e
 		}

 		prefix := 0
-		for _, ext := range [...]string{"ext:", "ext-domain:"} {
+		for _, ext := range [...]string{"ext:", "ext-domain:", "ext-site:"} {
 			if strings.HasPrefix(r, ext) {
 				prefix = len(ext)
 				break
@@ -1,6 +1,7 @@
 package strmatcher_test

 import (
+	"regexp"
 	"strconv"
 	"testing"

@@ -72,6 +73,64 @@ func BenchmarkSubstrMatcher(b *testing.B) {
 	})
 }

+func BenchmarkRegexMatcher(b *testing.B) {
+	patterns := []string{ // taken from geosite
+		`(^|\.)91porn\.(best|com|cool|fun|group|party|plus|site|tw|work)$`,
+		`(^|\.)91porn[0-9]{3}\.me$`,
+		`(^|\.)apiproxy-device-prod-nlb-.+\.amazonaws\.com$`,
+		`(^|\.)dualstack\.apiproxy-.+\.amazonaws\.com$`,
+		`(^|\.)aqdk[0-9]{3}\.com$`,
+		`(^|\.)bilibili3(0[1-9]|1[0-2])\.xyz$`,
+		`(^|\.)byyum([3589]|2[235689]|3[34]|4[1-9]|5[1-79]|6[0134679])?\.com$`,
+		`(^|\.)fiftymvapi\..+$`,
+		`(^|\.)gossipfuli[0-9]{3,4}\.xyz$`,
+		`(^|\.)kpkuang\.(bond|fun|info|one|us)$`,
+		`(^|\.)rule34\.(asia|us|world|xxx|xyz)$`,
+		`(^|\.)[a-z][1-9][0-9][a-z]\.com$`,
+		`.+\.awsdns-[0-9][0-9]\.(co\.uk|com|net|org)$`,
+		`.+\.dkr\.ecr\.[^\.]+\.amazonaws\.com$`,
+		`^(.+\.)*zh\.okaapps\.com$`,
+		`^cdn\d-epicgames-\d+\.file\.myqcloud\.com$`,
+		`^chatgpt-async-webps-prod-\S+-\d+\.webpubsub\.azure\.com$`,
+		`^r+[0-9]+(---|\.)sn-(2x3|ni5|j5o)\w{5}\.googlevideo\.com$`,
+		`^speed\.(coe|open)\.ad\.[a-z]{2,6}\.prod\.hosts\.ooklaserver\.net$`,
+		`javdb\d+\.com$`,
+	}
+	domains := []string{
+		"www.google.com", "rr3---sn-4g5edndy.googlevideo.com", "r1---sn-2x3abcde.googlevideo.com", "i.ytimg.com",
+		"graph.facebook.com", "api.twitter.com", "www.baidu.com", "github.com", "objects.githubusercontent.com",
+		"login.microsoftonline.com", "e1234.dscb.akamaiedge.net", "d1a2b3c4d5e6f7.cloudfront.net",
+		"s3.us-east-1.amazonaws.com", "123456789012.dkr.ecr.us-east-1.amazonaws.com", "www.wikipedia.org",
+		"discord.com", "telegram.org", "store.steampowered.com", "www.91porn.com", "ns-1234.awsdns-12.org",
+	}
+	bench := func(b *testing.B, ctor func(pattern string) func(string) bool) {
+		var matchers []func(string) bool
+		for _, p := range patterns {
+			matchers = append(matchers, ctor(p))
+		}
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			for _, d := range domains {
+				for _, match := range matchers {
+					_ = match(d)
+				}
+			}
+		}
+	}
+	b.Run("regexp", func(b *testing.B) {
+		bench(b, func(pattern string) func(string) bool {
+			return regexp.MustCompile(pattern).MatchString
+		})
+	})
+	b.Run("prefilter", func(b *testing.B) {
+		bench(b, func(pattern string) func(string) bool {
+			m, err := Regex.New(pattern)
+			common.Must(err)
+			return m.Match
+		})
+	})
+}
+
 // Utility functions for benchmark

 func benchmarkMatcherType(b *testing.B, t Type, ctor func() MatcherGroup) {
@@ -52,7 +52,9 @@ func (g *MphIndexMatcher) Add(matcher Matcher) uint32 {
 func (g *MphIndexMatcher) Build() error {
 	if g.mph != nil {
 		runtime.GC() // peak mem
-		g.mph.Build()
+		if err := g.mph.Build(); err != nil {
+			return err
+		}
 	}
 	runtime.GC() // peak mem
 	if g.ac != nil {
@@ -64,23 +66,17 @@ func (g *MphIndexMatcher) Build() error {

 // Match implements IndexMatcher.Match.
 func (g *MphIndexMatcher) Match(input string) []uint32 {
-	result := make([][]uint32, 0, 5)
+	var result []uint32
 	if g.mph != nil {
-		if matches := g.mph.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = g.mph.Match(input) // a new slice, returned without another copy
 	}
 	if g.ac != nil {
-		if matches := g.ac.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = append(result, g.ac.Match(input)...)
 	}
 	if g.regex != nil {
-		if matches := g.regex.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = append(result, g.regex.Match(input)...)
 	}
-	return CompositeMatches(result)
+	return result
 }

 // MatchAny implements IndexMatcher.MatchAny.
@@ -78,6 +78,10 @@ func TestMphIndexMatcher(t *testing.T) {
 			Input:  "example.com",
 			Output: []uint32{10, 4},
 		},
+		{
+			Input:  "apis.org",
+			Output: []uint32{2, 6},
+		},
 	}
 	matcherGroup := NewMphIndexMatcher()
 	for _, rule := range rules {
@@ -87,8 +91,13 @@ func TestMphIndexMatcher(t *testing.T) {
 	}
 	matcherGroup.Build()
 	for _, test := range cases {
-		if m := matcherGroup.Match(test.Input); !reflect.DeepEqual(m, test.Output) {
+		m := matcherGroup.Match(test.Input)
+		if !reflect.DeepEqual(m, test.Output) {
 			t.Error("unexpected output: ", m, " for test case ", test)
 		}
+		clear(m) // the caller owns the result, so this must not change the next one
+		if m := matcherGroup.Match(test.Input); !reflect.DeepEqual(m, test.Output) {
+			t.Error("unexpected output after clearing the previous one: ", m, " for test case ", test)
+		}
 	}
 }
@@ -1,198 +1,440 @@
 package strmatcher

 import (
-	"math/bits"
-	"runtime"
-	"sort"
+	"bytes"
+	"cmp"
+	"encoding/binary"
+	"errors"
+	"math"
+	"slices"
 	"strings"
 	"unsafe"
 )

-// PrimeRK is the prime base used in Rabin-Karp algorithm.
-const PrimeRK = 16777619
-
-// RollingHash calculates the rolling murmurHash of given string based on a provided suffix hash.
-func RollingHash(hash uint32, input string) uint32 {
-	for i := len(input) - 1; i >= 0; i-- {
-		hash = hash*PrimeRK + uint32(input[i])
-	}
-	return hash
-}
-
-// MemHash is the hash function used by go map, it utilizes available hardware instructions(behaves
-// as aeshash if aes instruction is available).
-// With different seed, each MemHash<seed> performs as distinct hash functions.
-func MemHash(seed uint32, input string) uint32 {
-	return uint32(strhash(unsafe.Pointer(&input), uintptr(seed))) // nosemgrep
-}
-
+// Flags of a level1 slot, stored above the record offset.
 const (
-	mphMatchTypeCount = 2 // Full and Domain
+	mphDomain  = 1 << 31 // matches the pattern and its subdomains
+	mphFull    = 1 << 30 // matches the pattern only
+	mphParent  = 1 << 29 // matches subdomains only, from a pattern with a leading dot
+	mphOffMask = mphParent - 1
 )

-type mphRuleInfo struct {
-	rollingHash uint32
-	matchers    [mphMatchTypeCount][]uint32
+// Kinds of an added pattern, indexes of mphKinds.
+const (
+	mphKindFull = iota
+	mphKindParent
+	mphKindDomain
+)
+
+// mphKinds are the slot flags in the order Match reports their values.
+var mphKinds = [...]uint32{mphFull, mphParent, mphDomain}
+
+// mphMultipliers are odd multipliers for the suffix hash. Build moves to the next one if two patterns collide.
+var mphMultipliers = [...]uint64{0x9e3779b97f4a7c15, 0xc2b2ae3d27d4eb4f, 0x165667b19e3779f9, 0x27d4eb2f165667c5}
+
+var (
+	errMphCollision = errors.New("strmatcher: suffix hash collision in MphMatcherGroup")
+	errMphBuilt     = errors.New("strmatcher: MphMatcherGroup is already built")
+)
+
+type mphEntry struct {
+	off   uint32 // pattern start in buf
+	value uint32
+	n     uint32 // pattern length
+	kind  uint8
 }

-// MphMatcherGroup is an implementation of MatcherGroup.
-// It implements Rabin-Karp algorithm and minimal perfect hash table for Full and Domain matcher.
+// MphMatcherGroup is an implementation of MatcherGroup for Full and Domain matchers.
+// Each distinct pattern is stored once as a record in arena: its length (255 means a uvarint length follows),
+// its bytes and, if the group holds more than one distinct value, its values. A minimal perfect hash table
+// built with hash, displace and compress (http://cmph.sourceforge.net/papers/esa09.pdf) maps a pattern to its
+// record. Patterns are hashed from the right, so one pass over the input hashes all its parent domains.
 type MphMatcherGroup struct {
-	rules      []string   // RuleIdx -> pattern string, index 0 reserved for failed lookup
-	values     [][]uint32 // RuleIdx -> registered matcher values for the pattern (Full Matcher takes precedence)
-	level0     []uint32   // RollingHash & Mask -> seed for Memhash
-	level0Mask uint32     // Mask restricting RollingHash to 0 ~ len(level0)
-	level1     []uint32   // Memhash<seed> & Mask -> stored index for rules
-	level1Mask uint32     // Mask for restricting Memhash<seed> to 0 ~ len(level1)
-	ruleInfos  *map[string]mphRuleInfo
+	arena  string
+	level0 []uint16 // bucket -> seed
+	level1 []uint32 // slot -> flags | record offset
+	fp     []uint8  // slot -> low byte of its pattern's hash, rejects most misses without reading arena
+	n0, n1 uint32
+	mul    uint64 // multiplier of the suffix hash
+	single uint32 // the only value if !multi
+	multi  bool
+
+	buf     []byte // build only, patterns in Add order
+	entries []mphEntry
 }

 func NewMphMatcherGroup() *MphMatcherGroup {
-	return &MphMatcherGroup{
-		rules:      []string{""},
-		values:     [][]uint32{nil},
-		level0:     nil,
-		level0Mask: 0,
-		level1:     nil,
-		level1Mask: 0,
-		ruleInfos:  &map[string]mphRuleInfo{}, // Only used for building, destroyed after build complete
-	}
+	return new(MphMatcherGroup)
 }

 // AddFullMatcher implements MatcherGroupForFull.
 func (g *MphMatcherGroup) AddFullMatcher(matcher FullMatcher, value uint32) {
-	pattern := strings.ToLower(matcher.Pattern())
-	g.addPattern(0, "", pattern, matcher.Type(), value)
+	g.add(matcher.Pattern(), mphKindFull, value)
 }

 // AddDomainMatcher implements MatcherGroupForDomain.
 func (g *MphMatcherGroup) AddDomainMatcher(matcher DomainMatcher, value uint32) {
-	pattern := strings.ToLower(matcher.Pattern())
-	hash := g.addPattern(0, "", pattern, matcher.Type(), value) // For full domain match
-	g.addPattern(hash, pattern, ".", matcher.Type(), value)     // For partial domain match
+	g.add(matcher.Pattern(), mphKindDomain, value)
 }

-func (g *MphMatcherGroup) addPattern(suffixHash uint32, suffixPattern string, pattern string, matcherType Type, value uint32) uint32 {
-	fullPattern := pattern + suffixPattern
-	info, found := (*g.ruleInfos)[fullPattern]
-	if !found {
-		info = mphRuleInfo{rollingHash: RollingHash(suffixHash, pattern)}
-		g.rules = append(g.rules, fullPattern)
-		g.values = append(g.values, nil)
+func (g *MphMatcherGroup) add(pattern string, kind uint8, value uint32) {
+	if g.arena != "" {
+		panic(errMphBuilt)
+	}
+	pattern = strings.ToLower(pattern)
+	off := uint32(len(g.buf))
+	g.buf = append(g.buf, pattern...)
+	g.entries = append(g.entries, mphEntry{off: off, value: value, n: uint32(len(pattern)), kind: kind})
+	if len(pattern) > 0 && pattern[0] == '.' {
+		// ".x" has always matched "*.x" as well, so it also gets a parent-only record for "x"
+		g.entries = append(g.entries, mphEntry{off: off + 1, value: value, n: uint32(len(pattern) - 1), kind: mphKindParent})
 	}
-	info.matchers[matcherType] = append(info.matchers[matcherType], value)
-	(*g.ruleInfos)[fullPattern] = info
-	return info.rollingHash
 }

-// Build builds a minimal perfect hash table for insert rules.
-// Algorithm used: Hash, displace, and compress. See http://cmph.sourceforge.net/papers/esa09.pdf
+func (g *MphMatcherGroup) key(i uint32) []byte {
+	e := &g.entries[i]
+	return g.buf[e.off : e.off+e.n]
+}
+
+// Build builds the hash table. It must be called once, after the last Add.
 func (g *MphMatcherGroup) Build() error {
-	ruleCount := len(*g.ruleInfos)
-	g.level0 = make([]uint32, nextPow2(ruleCount/4))
-	g.level0Mask = uint32(len(g.level0) - 1)
-	g.level1 = make([]uint32, nextPow2(ruleCount))
-	g.level1Mask = uint32(len(g.level1) - 1)
-
-	// Create buckets based on all rule's rolling hash
-	buckets := make([][]uint32, len(g.level0))
-	for ruleIdx := 1; ruleIdx < len(g.rules); ruleIdx++ { // Traverse rules starting from index 1 (0 reserved for failed lookup)
-		ruleInfo := (*g.ruleInfos)[g.rules[ruleIdx]]
-		bucketIdx := ruleInfo.rollingHash & g.level0Mask
-		buckets[bucketIdx] = append(buckets[bucketIdx], uint32(ruleIdx))
-		g.values[ruleIdx] = append(ruleInfo.matchers[Full], ruleInfo.matchers[Domain]...) // nolint:gocritic
+	if g.arena != "" {
+		return errMphBuilt
 	}
-	g.ruleInfos = nil // Set ruleInfos nil to release memory
-	runtime.GC()      // peak mem
-
-	// Sort buckets in descending order with respect to each bucket's size
-	bucketIdxs := make([]int, len(buckets))
-	for bucketIdx := range buckets {
-		bucketIdxs[bucketIdx] = bucketIdx
+	if uint64(len(g.buf)) > math.MaxUint32 {
+		return errors.New("too many rules for MphMatcherGroup")
 	}
-	sort.Slice(bucketIdxs, func(i, j int) bool { return len(buckets[bucketIdxs[i]]) > len(buckets[bucketIdxs[j]]) })
+	recs := g.writeRecords()
+	if len(g.arena) > mphOffMask {
+		return errors.New("too many rules for MphMatcherGroup")
+	}
+	hashes := make([]uint64, len(recs))
+	for _, mul := range mphMultipliers {
+		for i, rec := range recs {
+			hashes[i] = mphMix(mphHash(mul, g.recKey(rec)))
+		}
+		g.mul = mul
+		if err := g.place(recs, hashes); err != errMphCollision {
+			return err
+		}
+	}
+	return errMphCollision
+}

-	// Exercise Hash, Displace, and Compress algorithm to construct minimal perfect hash table
-	occupied := make([]bool, len(g.level1)) // Whether a second-level hash has been already used
-	hashedBucket := make([]uint32, 0, 4)    // Second-level hashes for each rule in a specific bucket
-	for _, bucketIdx := range bucketIdxs {
-		bucket := buckets[bucketIdx]
-		hashedBucket = hashedBucket[:0]
-		seed := uint32(0)
-		for len(hashedBucket) != len(bucket) {
-			for _, ruleIdx := range bucket {
-				memHash := MemHash(seed, g.rules[ruleIdx]) & g.level1Mask
-				if occupied[memHash] { // Collision occurred with this seed
-					for _, hash := range hashedBucket { // Revert all values in this hashed bucket
-						occupied[hash] = false
-						g.level1[hash] = 0
-					}
-					hashedBucket = hashedBucket[:0]
-					seed++ // Try next seed
-					break
-				}
-				occupied[memHash] = true
-				g.level1[memHash] = ruleIdx // The final value in the hash table
-				hashedBucket = append(hashedBucket, memHash)
+// writeRecords writes one record per distinct pattern to arena and returns flags | offset of each.
+func (g *MphMatcherGroup) writeRecords() []uint32 {
+	g.multi = false
+	if len(g.entries) > 0 {
+		g.single = g.entries[0].value
+		for _, e := range g.entries {
+			if e.value != g.single {
+				g.multi = true
+				break
 			}
 		}
-		g.level0[bucketIdx] = seed // Displacement value for this bucket
+	}
+	// Equal patterns become neighbours in Add order, so their values keep their priority
+	order := make([]uint32, len(g.entries))
+	for i := range order {
+		order[i] = uint32(i)
+	}
+	slices.SortFunc(order, func(a, b uint32) int {
+		return cmp.Or(bytes.Compare(g.key(a), g.key(b)), cmp.Compare(a, b))
+	})
+
+	size := len(g.buf) + len(g.entries) + 2
+	if g.multi {
+		size += 3 * len(g.entries)
+	}
+	arena := make([]byte, 0, size)
+	recs := make([]uint32, 0, len(order))
+	var vals [len(mphKinds)][]uint32
+	for i := 0; i < len(order); {
+		k := g.key(order[i])
+		for t := range vals {
+			vals[t] = vals[t][:0]
+		}
+		for ; i < len(order) && bytes.Equal(g.key(order[i]), k); i++ {
+			e := &g.entries[order[i]]
+			if !slices.Contains(vals[e.kind], e.value) {
+				vals[e.kind] = append(vals[e.kind], e.value)
+			}
+		}
+		rec := uint32(len(arena))
+		if len(k) < 255 {
+			arena = append(arena, byte(len(k)))
+		} else {
+			arena = binary.AppendUvarint(append(arena, 255), uint64(len(k)))
+		}
+		arena = append(arena, k...)
+		for t, v := range vals {
+			if len(v) == 0 {
+				continue
+			}
+			rec |= mphKinds[t]
+			if g.multi {
+				arena = binary.AppendUvarint(arena, uint64(len(v)))
+				for _, x := range v {
+					arena = binary.AppendUvarint(arena, uint64(x))
+				}
+			}
+		}
+		recs = append(recs, rec)
+	}
+	// Lookups may point one byte past a pattern, and an empty group needs a record at offset 0 for empty slots
+	arena = append(arena, 0)
+	if len(recs) == 0 {
+		arena = append(arena, 0)
+	}
+	g.buf, g.entries = nil, nil
+	if cap(arena)-len(arena) > len(arena)/32 {
+		arena = slices.Clone(arena)
+	}
+	g.arena = unsafe.String(unsafe.SliceData(arena), len(arena)) // arena is not written after this
+	return recs
+}
+
+// place fills level0, level1 and fp: records are bucketed by hash, and each bucket, largest first, gets
+// the first seed that puts all its records in free slots.
+func (g *MphMatcherGroup) place(recs []uint32, hashes []uint64) error {
+	r := len(recs)
+	n0, n1 := max(1, r/3), max(1, r+r/99)
+	g.n0, g.n1 = uint32(n0), uint32(n1)
+	g.level0 = make([]uint16, n0)
+	g.level1 = make([]uint32, n1)
+	g.fp = make([]uint8, n1)
+
+	start := make([]uint32, n0+1)
+	for _, h := range hashes {
+		start[g.bucket(h)+1]++
+	}
+	for b := range n0 {
+		start[b+1] += start[b]
+	}
+	members := make([]uint32, r)
+	fill := slices.Clone(start[:n0])
+	for i, h := range hashes {
+		b := g.bucket(h)
+		members[fill[b]] = uint32(i)
+		fill[b]++
+	}
+	fill = nil
+	buckets := make([]uint32, n0)
+	for b := range buckets {
+		buckets[b] = uint32(b)
+	}
+	slices.SortStableFunc(buckets, func(a, b uint32) int {
+		return cmp.Compare(start[b+1]-start[b], start[a+1]-start[a])
+	})
+
+	occupied := make([]uint64, (n1+63)/64)
+	var slots []uint32
+next:
+	for _, b := range buckets {
+		m := members[start[b]:start[b+1]]
+		if len(m) == 0 {
+			break
+		}
+		for i := range m {
+			for j := range i {
+				if hashes[m[i]] == hashes[m[j]] {
+					return errMphCollision // no seed can separate them
+				}
+			}
+		}
+	search:
+		for seed := range math.MaxUint16 + 1 {
+			slots = slots[:0]
+			for _, ri := range m {
+				s := g.slot(hashes[ri], uint16(seed))
+				if occupied[s/64]&(1<<(s%64)) != 0 || slices.Contains(slots, s) {
+					continue search
+				}
+				slots = append(slots, s)
+			}
+			for k, ri := range m {
+				s := slots[k]
+				occupied[s/64] |= 1 << (s % 64)
+				g.level1[s] = recs[ri]
+				g.fp[s] = uint8(hashes[ri])
+			}
+			g.level0[b] = uint16(seed)
+			continue next
+		}
+		return errors.New("strmatcher: no seed found for a bucket in MphMatcherGroup")
 	}
 	return nil
 }

-// Lookup searches for input in minimal perfect hash table and returns its index. 0 indicates not found.
-func (g *MphMatcherGroup) Lookup(rollingHash uint32, input string) uint32 {
-	i0 := rollingHash & g.level0Mask
-	seed := g.level0[i0]
-	i1 := MemHash(seed, input) & g.level1Mask
-	if n := g.level1[i1]; g.rules[n] == input {
-		return n
+// mphHash is the suffix hash of s, taken from the right: the hash of s[i:] is the state after reading s[i].
+func mphHash(mul uint64, s string) uint64 {
+	h := uint64(0)
+	for i := len(s) - 1; i >= 0; i-- {
+		h = h*mul + uint64(s[i])
+	}
+	return h
+}
+
+// mphMix spreads the weak low bits of a suffix hash.
+func mphMix(h uint64) uint64 {
+	h ^= h >> 32
+	h *= 0xd6e8feb86659fd93
+	return h ^ h>>32
+}
+
+func (g *MphMatcherGroup) bucket(f uint64) uint32 {
+	return uint32(((f >> 32) * uint64(g.n0)) >> 32)
+}
+
+func (g *MphMatcherGroup) slot(f uint64, seed uint16) uint32 {
+	x := ((f ^ uint64(seed)*0x9e3779b97f4a7c15) * 0xc4ceb9fe1a85ec53) >> 32
+	return uint32((x * uint64(g.n1)) >> 32)
+}
+
+func (g *MphMatcherGroup) uvarint(p uint32) (x, next uint32) {
+	for shift := 0; ; shift += 7 {
+		c := g.arena[p]
+		p++
+		x |= uint32(c&0x7f) << shift
+		if c < 0x80 {
+			return x, p
+		}
+	}
+}
+
+// recSpan returns where the pattern of the record at off starts and how long it is.
+func (g *MphMatcherGroup) recSpan(off uint32) (p, n uint32) {
+	n, p = uint32(g.arena[off]), off+1
+	if n == 255 {
+		n, p = g.uvarint(p)
+	}
+	return p, n
+}
+
+func (g *MphMatcherGroup) recKey(rec uint32) string {
+	p, n := g.recSpan(rec & mphOffMask)
+	return g.arena[p : p+n]
+}
+
+// lookup returns the level1 entry of s, or 0 if s is not a pattern. h is the suffix hash of s.
+func (g *MphMatcherGroup) lookup(h uint64, s string) uint32 {
+	f := mphMix(h)
+	// bucket < n0 == len(level0) and slot < n1 == len(level1) == len(fp), skip the bounds checks
+	seed := *(*uint16)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(g.level0)), uintptr(g.bucket(f))*2))
+	slot := uintptr(g.slot(f, seed))
+	if *(*uint8)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(g.fp)), slot)) != uint8(f) {
+		return 0
+	}
+	e := *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(g.level1)), slot*4))
+	if len(s) < 255 {
+		// A record whose length byte is len(s) has len(s) pattern bytes after it
+		p := unsafe.Add(unsafe.Pointer(unsafe.StringData(g.arena)), e&mphOffMask)
+		if int(*(*byte)(p)) == len(s) && unsafe.String((*byte)(unsafe.Add(p, 1)), len(s)) == s {
+			return e
+		}
+		return 0
+	}
+	if g.recKey(e) == s {
+		return e
 	}
 	return 0
 }

-// Match implements MatcherGroup.Match.
-func (g *MphMatcherGroup) Match(input string) []uint32 {
-	matches := make([][]uint32, 0, 5)
-	hash := uint32(0)
-	for i := len(input) - 1; i >= 0; i-- {
-		hash = hash*PrimeRK + uint32(input[i])
-		if input[i] == '.' {
-			if mphIdx := g.Lookup(hash, input[i:]); mphIdx != 0 {
-				matches = append(matches, g.values[mphIdx])
+// appendValues appends the values of record e for the flags in want, in mphKinds order.
+func (g *MphMatcherGroup) appendValues(dst []uint32, e, want uint32) []uint32 {
+	if !g.multi {
+		for _, flag := range mphKinds {
+			if e&want&flag != 0 {
+				dst = append(dst, g.single)
+			}
+		}
+		return dst
+	}
+	if e&want == 0 {
+		return dst
+	}
+	p, n := g.recSpan(e & mphOffMask)
+	p += n
+	for _, flag := range mphKinds {
+		if e&flag == 0 {
+			continue
+		}
+		var count, v uint32
+		for count, p = g.uvarint(p); count > 0; count-- {
+			v, p = g.uvarint(p)
+			if want&flag != 0 {
+				dst = append(dst, v)
 			}
 		}
 	}
-	if mphIdx := g.Lookup(hash, input); mphIdx != 0 {
-		matches = append(matches, g.values[mphIdx])
+	return dst
+}
+
+// Match implements MatcherGroup.Match. Values of an exact match come first (Full, then Domain), then those of
+// the parent domains, nearest first.
+func (g *MphMatcherGroup) Match(input string) []uint32 {
+	var stack [8]uint32
+	parents := stack[:0] // TLD side first
+	h, mul := uint64(0), g.mul
+	for i := len(input) - 1; i >= 0; i-- {
+		if input[i] == '.' {
+			if e := g.lookup(h, input[i+1:]); e&(mphDomain|mphParent) != 0 {
+				parents = append(parents, e)
+			}
+		}
+		h = h*mul + uint64(input[i])
 	}
-	return CompositeMatchesReverse(matches)
+	exact := g.lookup(h, input)
+	if exact&(mphFull|mphDomain) == 0 && len(parents) == 0 {
+		return nil
+	}
+	result := g.appendValues(make([]uint32, 0, len(parents)+1), exact, mphFull|mphDomain)
+	for k := len(parents) - 1; k >= 0; k-- {
+		result = g.appendValues(result, parents[k], mphParent|mphDomain)
+	}
+	return result
 }

 // MatchAny implements MatcherGroup.MatchAny.
 func (g *MphMatcherGroup) MatchAny(input string) bool {
-	hash := uint32(0)
+	h, mul := uint64(0), g.mul
+	for i := len(input) - 1; i >= 0; i-- {
+		if input[i] == '.' && g.lookup(h, input[i+1:])&(mphDomain|mphParent) != 0 {
+			return true
+		}
+		h = h*mul + uint64(input[i])
+	}
+	return g.lookup(h, input)&(mphFull|mphDomain) != 0
+}
+
+// mphSuffix is the suffix hash of input[off:], a parent domain of the input.
+type mphSuffix struct {
+	h   uint64
+	off int
+}
+
+// mphSuffixes appends the suffix hashes of the parent domains of input to dst, TLD side first, and returns them
+// with the hash of input itself: what MatchAny computes, computed once for several groups.
+func mphSuffixes(dst []mphSuffix, mul uint64, input string) ([]mphSuffix, uint64) {
+	h := uint64(0)
 	for i := len(input) - 1; i >= 0; i-- {
-		hash = hash*PrimeRK + uint32(input[i])
 		if input[i] == '.' {
-			if g.Lookup(hash, input[i:]) != 0 {
-				return true
-			}
+			dst = append(dst, mphSuffix{h, i + 1})
+		}
+		h = h*mul + uint64(input[i])
+	}
+	return dst, h
+}
+
+// matchAnyHashed is MatchAny with parents and h from mphSuffixes(_, mul, input).
+func (g *MphMatcherGroup) matchAnyHashed(input string, parents []mphSuffix, h, mul uint64) bool {
+	if g.mul != mul {
+		return g.MatchAny(input) // built with a later multiplier after a collision
+	}
+	for _, p := range parents {
+		if g.lookup(p.h, input[p.off:])&(mphDomain|mphParent) != 0 {
+			return true
 		}
 	}
-	return g.Lookup(hash, input) != 0
+	return g.lookup(h, input)&(mphFull|mphDomain) != 0
 }
-
-func nextPow2(v int) int {
-	if v <= 1 {
-		return 1
-	}
-	const MaxUInt = ^uint(0)
-	n := (MaxUInt >> bits.LeadingZeros(uint(v))) + 1
-	return int(n)
-}
-
-//go:noescape
-//go:linkname strhash runtime.strhash
-func strhash(p unsafe.Pointer, h uintptr) uintptr
@@ -0,0 +1,108 @@
+package strmatcher
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestMphMatcherGroupHashCollision(t *testing.T) {
+	saved := mphMultipliers
+	defer func() { mphMultipliers = saved }()
+
+	mphMultipliers[0] = 1 // anagrams collide
+	g := NewMphMatcherGroup()
+	g.AddFullMatcher(FullMatcher("ab.com"), 1)
+	g.AddDomainMatcher(DomainMatcher("ba.com"), 2)
+	g.AddDomainMatcher(DomainMatcher("com"), 3)
+	if err := g.Build(); err != nil {
+		t.Fatal(err)
+	}
+	if g.mul != saved[1] {
+		t.Errorf("multiplier %#x, want the second one %#x", g.mul, saved[1])
+	}
+	for input, want := range map[string][]uint32{"ab.com": {1, 3}, "x.ba.com": {2, 3}, "x.ab.com": {3}, "ba.com": {2, 3}} {
+		if m := g.Match(input); !slices.Equal(m, want) {
+			t.Errorf("Match(%q) = %v, want %v", input, m, want)
+		}
+	}
+
+	// Thue-Morse strings of 2048 bytes and their complements collide for every odd multiplier
+	mphMultipliers = saved
+	a, b := make([]byte, 2048), make([]byte, 2048)
+	for i := range a {
+		a[i], b[i] = "ab"[bitsOnes(i)%2], "ba"[bitsOnes(i)%2]
+	}
+	g = NewMphMatcherGroup()
+	g.AddFullMatcher(FullMatcher(a), 1)
+	g.AddFullMatcher(FullMatcher(b), 1)
+	if err := g.Build(); err != errMphCollision {
+		t.Errorf("Build() = %v, want %v", err, errMphCollision)
+	}
+}
+
+func bitsOnes(i int) int {
+	n := 0
+	for ; i > 0; i &= i - 1 {
+		n++
+	}
+	return n
+}
+
+func TestMphValueMatcherCombiner(t *testing.T) {
+	build := func(matchers ...Matcher) *MphValueMatcher {
+		m := NewMphValueMatcher()
+		for _, x := range matchers {
+			m.Add(x, 0)
+		}
+		if err := m.Build(); err != nil {
+			t.Fatal(err)
+		}
+		return m
+	}
+	regex, err := Regex.New(`^a\d+\.net$`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	saved := mphMultipliers
+	t.Cleanup(func() { mphMultipliers = saved })
+	mphMultipliers[0] = 1 // anagrams collide, so this one falls back to its own hash pass
+	collided := build(FullMatcher("ab.com"), DomainMatcher("ba.com"))
+	mphMultipliers = saved
+	if collided.mph.mul == mphMultipliers[0] {
+		t.Fatal("collided matcher uses the first multiplier")
+	}
+	matchers := []*MphValueMatcher{
+		build(DomainMatcher("example.com"), FullMatcher("full.org"), DomainMatcher(".dot.io")),
+		collided,
+		build(regex, SubstrMatcher("keyword")),
+		build(),
+		build(DomainMatcher("com"), DomainMatcher("a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s")),
+	}
+	var s MphValueMatcherCombiner
+	for i, m := range matchers {
+		s.Add(m, uint32(10+i))
+	}
+	inputs := []string{
+		"", ".", "..", "com", "example.com", "www.example.com", "xexample.com", "example.com.", "full.org", "x.full.org",
+		"dot.io", "x.dot.io", ".dot.io", "ab.com", "x.ab.com", "ba.com", "x.ba.com", "a12.net", "a12.net.x", "my-keyword.org",
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s", "0.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s", "b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s",
+		"x.y.z.1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.ab.com", "x.y.z.1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.org",
+	}
+	for _, input := range inputs {
+		var want []uint32
+		for i, m := range matchers {
+			if m.MatchAny(input) {
+				want = append(want, uint32(10+i))
+			}
+		}
+		if got := s.Match(input); !slices.Equal(got, want) {
+			t.Errorf("Match(%q) = %v, want %v", input, got, want)
+		}
+		if got := s.MatchAny(input); got != (len(want) > 0) {
+			t.Errorf("MatchAny(%q) = %v", input, got)
+		}
+	}
+	if n := testing.AllocsPerRun(100, func() { s.MatchAny("www.a.b.c.example.org") }); n != 0 {
+		t.Errorf("MatchAny allocates %v times", n)
+	}
+}
@@ -1,7 +1,10 @@
 package strmatcher_test

 import (
+	"math/rand"
 	"reflect"
+	"slices"
+	"strings"
 	"testing"

 	"github.com/xtls/xray-core/common"
@@ -276,3 +279,142 @@ func TestEmptyMphMatcherGroup(t *testing.T) {
 		t.Error("Expect [], but ", r)
 	}
 }
+
+func TestMphMatcherGroupRandom(t *testing.T) {
+	inputs := []string{""} // All strings over "ab." up to 7 bytes
+	for i := 0; len(inputs[i]) < 7; i++ {
+		for _, c := range []string{"a", "b", "."} {
+			inputs = append(inputs, inputs[i]+c)
+		}
+	}
+	for seed := int64(0); seed < 300; seed++ {
+		r := rand.New(rand.NewSource(seed))
+		g := NewMphMatcherGroup()
+		full, domain := map[string][]uint32{}, map[string][]uint32{} // Stored pattern -> values
+		for value := uint32(r.Intn(200)); value > 0; value-- {
+			pattern := make([]byte, r.Intn(8))
+			for i := range pattern {
+				pattern[i] = "ab."[r.Intn(3)]
+			}
+			if p := string(pattern); r.Intn(2) == 0 {
+				g.AddFullMatcher(FullMatcher(p), value)
+				full[p] = append(full[p], value)
+			} else {
+				g.AddDomainMatcher(DomainMatcher(p), value)
+				domain[p] = append(domain[p], value)
+				domain["."+p] = append(domain["."+p], value)
+			}
+		}
+		common.Must(g.Build())
+		for _, input := range inputs {
+			keys := []string{input} // Whole input first, then "." suffixes from longest to shortest
+			for i := range len(input) {
+				if input[i] == '.' {
+					keys = append(keys, input[i:])
+				}
+			}
+			var want []uint32
+			for _, k := range keys {
+				want = append(append(want, full[k]...), domain[k]...)
+			}
+			// Compared as sets: Match reports a value once per matching pattern, and orders them differently
+			// from want for patterns and inputs with a leading dot
+			m := g.Match(input)
+			if !slices.Equal(sortedSet(m), sortedSet(want)) {
+				t.Fatalf("seed %d: Match(%q) = %v, want %v", seed, input, m, want)
+			}
+			if m := g.MatchAny(input); m != (len(want) > 0) {
+				t.Fatalf("seed %d: MatchAny(%q) = %v", seed, input, m)
+			}
+		}
+	}
+}
+
+func TestMphMatcherGroupAppend(t *testing.T) {
+	g := NewMphMatcherGroup()
+	g.AddFullMatcher(FullMatcher("a.com"), 1)
+	g.AddFullMatcher(FullMatcher("b.com"), 2)
+	g.Build()
+	if m := append(g.Match("a.com"), 3); !slices.Equal(m, []uint32{1, 3}) {
+		t.Error("expect [1 3], but ", m)
+	}
+	if m := g.Match("b.com"); !slices.Equal(m, []uint32{2}) {
+		t.Error("expect [2], but ", m)
+	}
+}
+
+func sortedSet(v []uint32) []uint32 {
+	v = slices.Clone(v)
+	slices.Sort(v)
+	return slices.Compact(v)
+}
+
+func TestMphMatcherGroupLongPattern(t *testing.T) {
+	long := strings.Repeat("a", 300) + ".com"
+	for _, values := range [][4]uint32{{1, 2, 3, 4}, {7, 7, 7, 7}} {
+		g := NewMphMatcherGroup()
+		g.AddDomainMatcher(DomainMatcher(long), values[0])
+		g.AddFullMatcher(FullMatcher("x."+long), values[1])
+		g.AddFullMatcher(FullMatcher(long[:255]), values[2]) // the shortest pattern stored with a long length
+		g.AddFullMatcher(FullMatcher(long[:254]), values[3])
+		common.Must(g.Build())
+		cases := []struct {
+			input string
+			want  []uint32
+		}{
+			{long, []uint32{values[0]}},
+			{"www." + long, []uint32{values[0]}},
+			{"x." + long, []uint32{values[1], values[0]}},
+			{long[1:], nil},
+			{"a" + long, nil},
+			{long[:255], []uint32{values[2]}},
+			{long[:254], []uint32{values[3]}},
+			{long[:256], nil},
+			{long[:253], nil},
+		}
+		for _, c := range cases {
+			if m := g.Match(c.input); !slices.Equal(m, c.want) {
+				t.Errorf("Match(%d bytes) = %v, want %v", len(c.input), m, c.want)
+			}
+			if m := g.MatchAny(c.input); m != (c.want != nil) {
+				t.Errorf("MatchAny(%d bytes) = %v", len(c.input), m)
+			}
+		}
+	}
+
+	// A pattern longer than 65535 bytes builds and matches: a record's length is a uvarint,
+	// so the only cap was the build-time length field, now widened to uint32.
+	huge := strings.Repeat("a", 70000)
+	g := NewMphMatcherGroup()
+	g.AddFullMatcher(FullMatcher(strings.Repeat("a", 65535)), 1)
+	g.AddDomainMatcher(DomainMatcher(huge+".com"), 2)
+	g.AddFullMatcher(FullMatcher("a.com"), 3)
+	common.Must(g.Build())
+	if !g.MatchAny(strings.Repeat("a", 65535)) || g.MatchAny(strings.Repeat("a", 65534)) {
+		t.Error("wrong answer for a 65535-byte pattern")
+	}
+	if m := g.Match(huge + ".com"); !slices.Equal(m, []uint32{2}) {
+		t.Errorf("Match(%d-byte input) = %v, want [2]", len(huge)+4, m)
+	}
+	if m := g.Match("x." + huge + ".com"); !slices.Equal(m, []uint32{2}) {
+		t.Errorf("Match(subdomain of a %d-byte pattern) = %v, want [2]", len(huge)+4, m)
+	}
+	if g.MatchAny(huge) { // the 70000-byte label on its own is not a rule
+		t.Error("unexpected match for the bare 70000-byte label")
+	}
+}
+
+func TestMphMatcherGroupBuildOnce(t *testing.T) {
+	g := NewMphMatcherGroup()
+	g.AddFullMatcher(FullMatcher("a.com"), 1)
+	common.Must(g.Build())
+	if err := g.Build(); err == nil || !g.MatchAny("a.com") {
+		t.Errorf("second Build() = %v, MatchAny(a.com) = %v", err, g.MatchAny("a.com"))
+	}
+	defer func() {
+		if recover() == nil {
+			t.Error("Add after Build did not panic")
+		}
+	}()
+	g.AddDomainMatcher(DomainMatcher("b.com"), 2)
+}
@@ -2,9 +2,12 @@ package strmatcher

 import (
 	"errors"
+	"math/bits"
 	"regexp"
+	"regexp/syntax"
 	"slices"
 	"strings"
+	"unicode"
 	"unicode/utf8"

 	"golang.org/x/net/idna"
@@ -73,7 +76,274 @@ func (m SubstrMatcher) Match(s string) bool {

 // RegexMatcher is an implementation of Matcher.
 type RegexMatcher struct {
-	pattern *regexp.Regexp
+	pattern  *regexp.Regexp
+	literals []string  // every match contains all of them, longest first
+	tail     []byteSet // tail[i] holds the bytes a matching input can have i bytes before its end
+	rest     *byteSet  // the bytes it can have further before, nil if any
+}
+
+func newRegexMatcher(pattern string) (Matcher, error) {
+	regex, err := regexp.Compile(pattern)
+	if err != nil {
+		return nil, err
+	}
+	m := &RegexMatcher{pattern: regex}
+	if re, err := syntax.Parse(pattern, syntax.Perl); err == nil { // same flags as regexp.Compile
+		m.literals = requiredLiterals(re, nil)
+		slices.SortStableFunc(m.literals, func(a, b string) int { return len(b) - len(a) })
+		m.tail, m.rest = tailGuard(re)
+	}
+	return m, nil
+}
+
+// byteSet is a set of bytes. The bytes >= 0x80 share one bit with 0x7f.
+type byteSet [4]uint32
+
+func (s *byteSet) add(c byte)      { c = min(c, 0x7f); s[c>>5] |= 1 << (c & 31) }
+func (s *byteSet) has(c byte) bool { c = min(c, 0x7f); return s[c>>5]&(1<<(c&31)) != 0 }
+func (s *byteSet) or(t *byteSet) {
+	for i := range s {
+		s[i] |= t[i]
+	}
+}
+
+var allBytes = byteSet{^uint32(0), ^uint32(0), ^uint32(0), ^uint32(0)}
+
+// tailLen is how many positions before the end of the input tailGuard tells apart.
+const tailLen = 8
+
+// tailBudget caps how many repetition steps tailGuard walks. Only nested repeats can make the
+// walk explode, so only they are charged: a flat pattern, however long, is walked once and keeps
+// its guard.
+const tailBudget = 100000
+
+// tailWalk is a set of positions in the input, counted in bytes before its end.
+type tailWalk struct {
+	at   uint32 // bit i: exactly i bytes before the end, for i < tailLen
+	far  bool   // tailLen or more bytes before the end
+	free bool   // not tied to the end of the input yet
+}
+
+func (w tailWalk) union(v tailWalk) tailWalk {
+	return tailWalk{w.at | v.at, w.far || v.far, w.free || v.free}
+}
+
+type tailBuilder struct {
+	tail [tailLen]byteSet
+	rest byteSet
+	void bool
+	work int
+}
+
+// tailGuard walks re backwards from the end of the input and collects the bytes an input
+// matching re can have at each position before its end. It returns nil, nil when a branch
+// of re does not end with $ or when nested repeats push the walk past tailBudget.
+func tailGuard(re *syntax.Regexp) ([]byteSet, *byteSet) {
+	var b tailBuilder
+	w := b.walk(re, tailWalk{free: true})
+	b.stop(w)
+	if b.void {
+		return nil, nil
+	}
+	if w.at != 0 { // a match can start here, so any bytes can come before
+		for i := bits.TrailingZeros32(w.at); i < tailLen; i++ {
+			b.tail[i] = allBytes
+		}
+	}
+	if w.at != 0 || w.far {
+		b.rest = allBytes
+	}
+	n := tailLen
+	for n > 0 && b.tail[n-1] == b.rest {
+		n--
+	}
+	var tail []byteSet
+	if n > 0 {
+		tail = slices.Clone(b.tail[:n])
+	}
+	if b.rest != allBytes {
+		rest := b.rest
+		return tail, &rest
+	}
+	return tail, nil
+}
+
+// stop ends the paths of w. One that never met $ lets its match be followed by anything.
+func (b *tailBuilder) stop(w tailWalk) {
+	if w.free {
+		b.void = true
+	}
+}
+
+func (b *tailBuilder) walk(re *syntax.Regexp, w tailWalk) tailWalk {
+	if w == (tailWalk{}) || b.void {
+		return w
+	}
+	switch re.Op {
+	case syntax.OpNoMatch:
+		return tailWalk{}
+	case syntax.OpLiteral:
+		for i := len(re.Rune) - 1; i >= 0; i-- {
+			var set byteSet
+			set.add(byte(min(re.Rune[i], utf8.RuneSelf)))
+			if re.Flags&syntax.FoldCase != 0 {
+				for f := unicode.SimpleFold(re.Rune[i]); f != re.Rune[i]; f = unicode.SimpleFold(f) {
+					set.add(byte(min(f, utf8.RuneSelf)))
+				}
+			}
+			w = b.step(w, &set)
+		}
+		return w
+	case syntax.OpCharClass:
+		var set byteSet
+		for i := 0; i+1 < len(re.Rune); i += 2 {
+			for r := min(re.Rune[i], utf8.RuneSelf); r <= min(re.Rune[i+1], utf8.RuneSelf); r++ {
+				set.add(byte(r))
+			}
+		}
+		return b.step(w, &set)
+	case syntax.OpAnyChar, syntax.OpAnyCharNotNL: // a domain has no \n to reject
+		return b.step(w, &allBytes)
+	case syntax.OpBeginText: // nothing comes before
+		b.stop(w)
+		return tailWalk{}
+	case syntax.OpEndText:
+		out := tailWalk{at: w.at & 1}
+		if w.free {
+			out.at = 1
+		}
+		return out
+	case syntax.OpCapture:
+		return b.walk(re.Sub[0], w)
+	case syntax.OpConcat:
+		for i := len(re.Sub) - 1; i >= 0; i-- {
+			w = b.walk(re.Sub[i], w)
+		}
+		return w
+	case syntax.OpAlternate:
+		var out tailWalk
+		for _, sub := range re.Sub {
+			out = out.union(b.walk(sub, w))
+		}
+		return out
+	case syntax.OpQuest:
+		return b.repeat(re.Sub[0], w, 1)
+	case syntax.OpStar:
+		return b.repeat(re.Sub[0], w, -1)
+	case syntax.OpPlus:
+		return b.repeat(re.Sub[0], b.walk(re.Sub[0], w), -1)
+	case syntax.OpRepeat:
+		for i := 0; i < re.Min; i++ {
+			if b.charge() {
+				return w
+			}
+			w = b.walk(re.Sub[0], w)
+		}
+		if re.Max < 0 {
+			return b.repeat(re.Sub[0], w, -1)
+		}
+		return b.repeat(re.Sub[0], w, re.Max-re.Min)
+	}
+	return w // empty match, line and word boundaries: no constraint
+}
+
+// charge counts one repetition step and reports whether the walk has run out of budget. Only
+// repeats re-walk their body, so charging them alone bounds the blow-up of nested repeats while
+// leaving a single linear pass, of any length, free.
+func (b *tailBuilder) charge() bool {
+	b.work++
+	if b.work > tailBudget {
+		b.void = true
+	}
+	return b.void
+}
+
+// repeat walks back over up to n more repetitions of re, any number if n < 0.
+func (b *tailBuilder) repeat(re *syntax.Regexp, w tailWalk, n int) tailWalk {
+	for ; n != 0; n-- {
+		if b.charge() {
+			return w
+		}
+		next := w.union(b.walk(re, w))
+		if next == w {
+			break
+		}
+		w = next
+	}
+	return w
+}
+
+// step walks back over one character whose last byte is in set. A character that can be
+// non-ASCII can take up to 4 bytes, all >= 0x80; regexp matches an invalid byte as U+FFFD.
+func (b *tailBuilder) step(w tailWalk, set *byteSet) tailWalk {
+	out := tailWalk{far: w.far, free: w.free}
+	if w.far {
+		b.rest.or(set)
+	}
+	width := 1
+	if set.has(0x80) {
+		width = utf8.UTFMax
+	}
+	for i := 0; i < tailLen; i++ {
+		if w.at&(1<<i) == 0 {
+			continue
+		}
+		b.tail[i].or(set)
+		for n := 1; n <= width; n++ {
+			if j := i + n; j < tailLen {
+				out.at |= 1 << j
+				if n < width {
+					b.tail[j].add(0x80)
+				}
+			} else {
+				out.far = true
+				if n < width {
+					b.rest.add(0x80)
+				}
+			}
+		}
+	}
+	return out
+}
+
+// mayMatch reports whether s passes the tail guard.
+func (m *RegexMatcher) mayMatch(s string) bool {
+	n := len(s)
+	if m.rest == nil {
+		n = min(n, len(m.tail))
+	}
+	for i := 0; i < n; i++ {
+		set := m.rest
+		if i < len(m.tail) {
+			set = &m.tail[i]
+		}
+		if !set.has(s[len(s)-1-i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// requiredLiterals appends to dst the case-sensitive strings that every match of re contains.
+func requiredLiterals(re *syntax.Regexp, dst []string) []string {
+	switch re.Op {
+	case syntax.OpLiteral:
+		// regexp matches U+FFFD against invalid UTF-8 bytes, strings.Contains does not
+		if re.Flags&syntax.FoldCase == 0 && !slices.Contains(re.Rune, utf8.RuneError) {
+			dst = append(dst, string(re.Rune))
+		}
+	case syntax.OpCapture, syntax.OpPlus:
+		dst = requiredLiterals(re.Sub[0], dst)
+	case syntax.OpRepeat:
+		if re.Min > 0 {
+			dst = requiredLiterals(re.Sub[0], dst)
+		}
+	case syntax.OpConcat:
+		for _, sub := range re.Sub {
+			dst = requiredLiterals(sub, dst)
+		}
+	}
+	return dst
 }

 func (*RegexMatcher) Type() Type {
@@ -89,6 +359,14 @@ func (m *RegexMatcher) String() string {
 }

 func (m *RegexMatcher) Match(s string) bool {
+	if !m.mayMatch(s) {
+		return false
+	}
+	for _, l := range m.literals {
+		if !strings.Contains(s, l) {
+			return false
+		}
+	}
 	return m.pattern.MatchString(s)
 }

@@ -102,11 +380,7 @@ func (t Type) New(pattern string) (Matcher, error) {
 	case Domain:
 		return DomainMatcher(pattern), nil
 	case Regex: // 1. regex matching is case-sensitive
-		regex, err := regexp.Compile(pattern)
-		if err != nil {
-			return nil, err
-		}
-		return &RegexMatcher{pattern: regex}, nil
+		return newRegexMatcher(pattern)
 	default:
 		return nil, errors.New("unknown matcher type")
 	}
@@ -135,11 +409,7 @@ func (t Type) NewDomainPattern(pattern string) (Matcher, error) {
 		}
 		return DomainMatcher(pattern), nil
 	case Regex: // Regex's charset not in LDH subset
-		regex, err := regexp.Compile(pattern)
-		if err != nil {
-			return nil, err
-		}
-		return &RegexMatcher{pattern: regex}, nil
+		return newRegexMatcher(pattern)
 	default:
 		return nil, errors.New("unknown matcher type")
 	}
@@ -0,0 +1,233 @@
+package strmatcher
+
+import (
+	"hash/fnv"
+	"math/rand/v2"
+	"regexp"
+	"regexp/syntax"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"unicode"
+	"unicode/utf8"
+)
+
+var regexLiteralCases = []struct {
+	pattern  string
+	literals []string
+}{
+	{`(^|\.)91porn\.(best|com)$`, []string{"91porn."}},
+	{`.+\.awsdns-cn-[0-9][0-9]\.(biz|com|net|top)$`, []string{".awsdns-cn-", "."}},
+	{`^r+[0-9]+(---|\.)sn-(2x3|ni5|j5o)\w{5}\.googlevideo\.com$`, []string{".googlevideo.com", "sn-", "r"}},
+	{`(?i)abc`, nil},
+	{`ab(?i:CD)ef`, []string{"ab", "ef"}},
+	{`(abc)?x`, []string{"x"}},
+	{`(abc)*x`, []string{"x"}},
+	{`x{0,3}yy`, []string{"yy"}},
+	{`(ab)+c{2}`, []string{"ab", "c"}},
+	{`abc|abd`, []string{"ab"}},
+	{`\Qa.b\E`, []string{"a.b"}},
+	{`a\x{FFFD}b`, nil},
+	{`^[^.]+$`, nil},
+}
+
+func TestRegexRequiredLiterals(t *testing.T) {
+	for _, test := range regexLiteralCases {
+		m, err := newRegexMatcher(test.pattern)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := m.(*RegexMatcher).literals; !slices.Equal(got, test.literals) {
+			t.Errorf("%s: got %q, want %q", test.pattern, got, test.literals)
+		}
+	}
+}
+
+var regexTailCases = []struct {
+	pattern string
+	guard   bool
+	match   []string // inputs the pattern matches
+	reject  []string // inputs the tail guard alone rejects
+}{
+	{`^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`, true, []string{"a", "localhost", "x-1"}, []string{"www.example.com", "localhost.", "LOCALHOST", "a b"}},
+	{`(^|\.)[a-z][1-9][0-9][a-z]\.com$`, true, []string{"a12b.com", "x.q10z.com"}, []string{"google.com", "a12b.co", "a12b.com.", "ab12.com"}},
+	{`^hses[1-7]?\.akamaized\.net$`, true, []string{"hses.akamaized.net", "hses3.akamaized.net"}, []string{"xhses.akamaized.net", "www.hses.akamaized.net"}},
+	{`(?i)k\.net$`, true, []string{"k.net", "K.NET", "\u212a.net"}, []string{"x.net", "k.nex"}},
+	{`[^.]+\.cn$`, true, []string{"a.cn", "\xff.cn", "\u4e2d.cn"}, []string{"a.cnn", "a.c"}},
+	{`\x{FFFD}$`, true, []string{"\xff", "a\xc3", "\uFFFD"}, []string{"a", "\xff."}},
+	{`^.\.cn$`, true, []string{"a.cn", "\u4E2D.cn", "\xff.cn"}, []string{"ab.cn"}},
+	{`^$`, true, []string{""}, []string{"a"}},
+	{`(^|\.)youyuapi\..+$`, false, []string{"youyuapi.com"}, nil},
+	{`abc`, false, []string{"abc", "xabcx"}, nil},
+	{`^ab`, false, []string{"ab", "abc"}, nil},
+	{`a$|b`, false, []string{"a", "bx"}, nil},
+	{`(?m)a$`, false, []string{"a", "a\nb"}, nil},
+	{strings.Repeat(`(?:abcdefgh(?:a`, 20) + strings.Repeat(`)*)*`, 20) + `\.com$`, false, []string{".com", "abcdefgha.com"}, nil}, // over tailBudget
+}
+
+func TestRegexTailGuard(t *testing.T) {
+	for _, test := range regexTailCases {
+		m, err := newRegexMatcher(test.pattern)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rm := m.(*RegexMatcher)
+		if guard := rm.tail != nil || rm.rest != nil; guard != test.guard {
+			t.Errorf("%s: guard %v, want %v", test.pattern, guard, test.guard)
+		}
+		for _, s := range test.match {
+			if !rm.pattern.MatchString(s) || !rm.Match(s) {
+				t.Errorf("%s: %q does not match", test.pattern, s)
+			}
+		}
+		for _, s := range test.reject {
+			if rm.pattern.MatchString(s) || rm.mayMatch(s) {
+				t.Errorf("%s: %q passes the guard", test.pattern, s)
+			}
+		}
+	}
+}
+
+// TestRegexTailGuardFlatAlternation checks that a long but non-recursive pattern keeps its
+// guard. Only nested repeats are charged against tailBudget, so a flat alternation of many
+// names, however large, is walked once and guarded; its guard is checked against regexp.
+func TestRegexTailGuardFlatAlternation(t *testing.T) {
+	var sb strings.Builder
+	sb.WriteString("(?:")
+	for i := 0; i < 20000; i++ {
+		if i > 0 {
+			sb.WriteByte('|')
+		}
+		sb.WriteString("name")
+		sb.WriteString(strconv.Itoa(i))
+	}
+	sb.WriteString(`)\.example\.com$`)
+	m, err := newRegexMatcher(sb.String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	rm := m.(*RegexMatcher)
+	if rm.tail == nil && rm.rest == nil {
+		t.Fatal("flat alternation of 20000 names lost its guard")
+	}
+	for _, s := range []string{"name0.example.com", "name19999.example.com", "x.name12345.example.com"} {
+		if !rm.pattern.MatchString(s) || !rm.Match(s) {
+			t.Errorf("%q should match", s)
+		}
+	}
+	for _, s := range []string{"name0.example.org", "name0.example.com.", "name0.example.con", "google.com"} {
+		if rm.pattern.MatchString(s) {
+			t.Fatalf("test bug: %q matches the pattern", s)
+		}
+		if rm.mayMatch(s) {
+			t.Errorf("%q should be rejected by the guard", s)
+		}
+	}
+}
+
+// sampleMatch appends a string that re matches, assertions aside, unless it runs out of
+// budget, which it spends one per call so that nested repeats stay cheap.
+func sampleMatch(sb *strings.Builder, re *syntax.Regexp, rnd *rand.Rand, budget *int) {
+	if *budget <= 0 {
+		return
+	}
+	*budget--
+	switch re.Op {
+	case syntax.OpLiteral:
+		for _, r := range re.Rune {
+			if re.Flags&syntax.FoldCase != 0 {
+				for n := rnd.IntN(4); n > 0; n-- {
+					r = unicode.SimpleFold(r)
+				}
+			}
+			sampleRune(sb, r, rnd)
+		}
+	case syntax.OpCharClass:
+		if len(re.Rune) > 0 {
+			i := rnd.IntN(len(re.Rune)/2) * 2
+			sampleRune(sb, re.Rune[i]+rnd.Int32N(min(re.Rune[i+1]-re.Rune[i]+1, 300)), rnd)
+		}
+	case syntax.OpAnyChar, syntax.OpAnyCharNotNL:
+		sampleRune(sb, []rune{'a', '.', '\n', 0xe9, 0x212a, utf8.RuneError}[rnd.IntN(6)], rnd)
+	case syntax.OpCapture:
+		sampleMatch(sb, re.Sub[0], rnd, budget)
+	case syntax.OpConcat:
+		for _, sub := range re.Sub {
+			sampleMatch(sb, sub, rnd, budget)
+		}
+	case syntax.OpAlternate:
+		sampleMatch(sb, re.Sub[rnd.IntN(len(re.Sub))], rnd, budget)
+	case syntax.OpQuest, syntax.OpStar, syntax.OpPlus, syntax.OpRepeat:
+		lo, hi := 0, 3
+		switch re.Op {
+		case syntax.OpQuest:
+			hi = 1
+		case syntax.OpPlus:
+			lo = 1
+		case syntax.OpRepeat:
+			lo, hi = re.Min, re.Min+3
+			if re.Max >= 0 {
+				hi = min(hi, re.Max)
+			}
+		}
+		for n := lo + rnd.IntN(hi-lo+1); n > 0; n-- {
+			sampleMatch(sb, re.Sub[0], rnd, budget)
+		}
+	}
+}
+
+func sampleRune(sb *strings.Builder, r rune, rnd *rand.Rand) {
+	if r == utf8.RuneError && rnd.IntN(2) == 0 {
+		sb.WriteByte(0x80 | byte(rnd.IntN(0x80))) // regexp matches an invalid byte as U+FFFD
+		return
+	}
+	sb.WriteRune(r)
+}
+
+func FuzzRegexMatcher(f *testing.F) {
+	inputs := []string{
+		"", "x", "yy", "abd", "ccc", "ABC", "abCDef", "abcdef", "abababcc", "a.b", "a\xffb", "a\uFFFDb",
+		"www.91porn.com", "ns1.awsdns-cn-01.top", "r1---sn-2x3abcde.googlevideo.com",
+	}
+	for _, test := range regexLiteralCases {
+		for _, s := range inputs {
+			f.Add(test.pattern, s)
+		}
+	}
+	for _, test := range regexTailCases {
+		for _, s := range append(test.match, test.reject...) {
+			f.Add(test.pattern, s)
+		}
+	}
+	f.Fuzz(func(t *testing.T, pattern, s string) {
+		re, err := regexp.Compile(pattern)
+		if err != nil {
+			return
+		}
+		m, _ := newRegexMatcher(pattern)
+		check := func(s string) {
+			if got, want := m.Match(s), re.MatchString(s); got != want {
+				t.Errorf("pattern %q, input %q: got %v, want %v", pattern, s, got, want)
+			}
+		}
+		check(s)
+		// random inputs seldom match, so also try strings built from the pattern
+		parsed, _ := syntax.Parse(pattern, syntax.Perl)
+		h := fnv.New64a()
+		h.Write([]byte(s))
+		rnd := rand.New(rand.NewPCG(h.Sum64(), 1))
+		for range 8 {
+			var sb strings.Builder
+			budget := 256
+			sampleMatch(&sb, parsed, rnd, &budget)
+			sample := sb.String()
+			check(sample)
+			check(s + sample)
+			if len(sample) > 0 && len(s) > 0 {
+				i := rnd.IntN(len(sample))
+				check(sample[:i] + s[:1] + sample[i+1:])
+			}
+		}
+	})
+}
@@ -46,7 +46,9 @@ func (g *MphValueMatcher) Add(matcher Matcher, value uint32) {
 func (g *MphValueMatcher) Build() error {
 	if g.mph != nil {
 		runtime.GC() // peak mem
-		g.mph.Build()
+		if err := g.mph.Build(); err != nil {
+			return err
+		}
 	}
 	runtime.GC() // peak mem
 	if g.ac != nil {
@@ -58,23 +60,17 @@ func (g *MphValueMatcher) Build() error {

 // Match implements ValueMatcher.Match.
 func (g *MphValueMatcher) Match(input string) []uint32 {
-	result := make([][]uint32, 0, 5)
+	var result []uint32
 	if g.mph != nil {
-		if matches := g.mph.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = g.mph.Match(input) // a new slice, returned without another copy
 	}
 	if g.ac != nil {
-		if matches := g.ac.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = append(result, g.ac.Match(input)...)
 	}
 	if g.regex != nil {
-		if matches := g.regex.Match(input); len(matches) > 0 {
-			result = append(result, matches)
-		}
+		result = append(result, g.regex.Match(input)...)
 	}
-	return CompositeMatches(result)
+	return result
 }

 // MatchAny implements ValueMatcher.MatchAny.
@@ -87,3 +83,62 @@ func (g *MphValueMatcher) MatchAny(input string) bool {
 	}
 	return g.regex != nil && g.regex.MatchAny(input)
 }
+
+func (g *MphValueMatcher) matchAnyHashed(input string, parents []mphSuffix, h, mul uint64) bool {
+	if g.mph != nil && g.mph.matchAnyHashed(input, parents, h, mul) {
+		return true
+	}
+	if g.ac != nil && g.ac.MatchAny(input) {
+		return true
+	}
+	return g.regex != nil && g.regex.MatchAny(input)
+}
+
+// MphValueMatcherCombiner combines several built MphValueMatchers, each bound to one value, and matches an input
+// against them as their MatchAny would, hashing the input once for all of them.
+type MphValueMatcherCombiner struct {
+	matchers []*MphValueMatcher
+	values   []uint32
+}
+
+// Add adds a built matcher that stands for value.
+func (s *MphValueMatcherCombiner) Add(m *MphValueMatcher, value uint32) {
+	s.matchers = append(s.matchers, m)
+	s.values = append(s.values, value)
+}
+
+// Match returns the values of the matchers that match input, in Add order.
+func (s *MphValueMatcherCombiner) Match(input string) []uint32 {
+	if len(s.matchers) == 0 {
+		return nil
+	}
+	var stack [16]mphSuffix
+	mul := mphMultipliers[0]
+	parents, h := mphSuffixes(stack[:0], mul, input)
+	var result []uint32
+	for i, m := range s.matchers {
+		if m.matchAnyHashed(input, parents, h, mul) {
+			result = append(result, s.values[i])
+		}
+	}
+	return result
+}
+
+// MatchAny returns true as soon as one matcher matches input.
+func (s *MphValueMatcherCombiner) MatchAny(input string) bool {
+	switch len(s.matchers) {
+	case 0:
+		return false
+	case 1:
+		return s.matchers[0].MatchAny(input) // nothing to share, and it stops at the first matching suffix
+	}
+	var stack [16]mphSuffix
+	mul := mphMultipliers[0]
+	parents, h := mphSuffixes(stack[:0], mul, input)
+	for _, m := range s.matchers {
+		if m.matchAnyHashed(input, parents, h, mul) {
+			return true
+		}
+	}
+	return false
+}
@@ -1,7 +1,7 @@
 package log // import "github.com/xtls/xray-core/common/log"

 import (
-	"sync"
+	"sync/atomic"

 	"github.com/xtls/xray-core/common/serial"
 )
@@ -29,36 +29,32 @@ func (m *GeneralMessage) String() string {

 // Record writes a message into log stream.
 func Record(msg Message) {
-	logHandler.Handle(msg)
+	if h := logHandler.Load(); h != nil {
+		(*h).Handle(msg)
+	}
 }

-var logHandler syncHandler
+type SeverityLogger interface {
+	Handler
+	Severity() Severity
+}
+
+func GetSeverity() Severity {
+	if h := logHandler.Load(); h != nil {
+		if sh, ok := (*h).(SeverityLogger); ok {
+			return sh.Severity()
+		}
+	}
+	// log everything by default
+	return Severity_Debug
+}
+
+var logHandler atomic.Pointer[Handler]

 // RegisterHandler registers a new handler as current log handler. Previous registered handler will be discarded.
 func RegisterHandler(handler Handler) {
 	if handler == nil {
 		panic("Log handler is nil")
 	}
-	logHandler.Set(handler)
-}
-
-type syncHandler struct {
-	sync.RWMutex
-	Handler
-}
-
-func (h *syncHandler) Handle(msg Message) {
-	h.RLock()
-	defer h.RUnlock()
-
-	if h.Handler != nil {
-		h.Handler.Handle(msg)
-	}
-}
-
-func (h *syncHandler) Set(handler Handler) {
-	h.Lock()
-	defer h.Unlock()
-
-	h.Handler = handler
+	logHandler.Store(&handler)
 }
@@ -68,6 +68,10 @@ func (l *serverityLogger) Handle(msg Message) {
 	}
 }

+func (l *serverityLogger) Severity() Severity {
+	return l.logLevel
+}
+
 func (l *generalLogger) run() {
 	defer l.access.Signal()

@@ -98,7 +102,6 @@ func (l *generalLogger) run() {
 }

 func (l *generalLogger) Handle(msg Message) {
-
 	select {
 	case l.buffer <- msg:
 	default:
@@ -38,7 +38,7 @@ func (m *ClientManager) Dispatch(ctx context.Context, link *transport.Link) erro
 		}
 	}

-	return errors.New("unable to find an available mux client").AtWarning()
+	return errors.New("unable to find an available mux client")
 }

 type WorkerPicker interface {
@@ -117,7 +117,7 @@ func (f *FrameMetadata) Unmarshal(reader io.Reader, readSourceAndLocal bool) err
 		return err
 	}
 	if metaLen > 512 {
-		return errors.New("invalid metalen ", metaLen).AtError()
+		return errors.New("invalid metalen ", metaLen)
 	}

 	b := buf.New()
@@ -351,7 +351,7 @@ func (w *ServerWorker) handleFrame(ctx context.Context, reader *buf.BufferedRead
 		err = w.handleStatusKeep(&meta, reader)
 	default:
 		status := meta.SessionStatus
-		return errors.New("unknown status: ", status).AtError()
+		return errors.New("unknown status: ", status)
 	}

 	if err != nil {
@@ -0,0 +1,350 @@
+//go:build darwin && !ios
+
+package net
+
+import (
+	"bytes"
+	"net"
+	"net/netip"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/xtls/xray-core/common/errors"
+)
+
+const (
+	darwinProcPIDListFDs      = 1
+	darwinProcPIDFDSocketInfo = 3
+	darwinProcFDTypeSocket    = 2
+	darwinProcFDInfoSize      = 8
+	darwinSocketFDInfoSize    = 792
+	darwinSocketFDInfoPSIOff  = 24
+	darwinSocketInfoProtoOff  = darwinSocketFDInfoPSIOff + 156
+	darwinSocketInfoFamilyOff = darwinSocketFDInfoPSIOff + 160
+	darwinSocketInfoKindOff   = darwinSocketFDInfoPSIOff + 232
+	darwinSocketInfoInSockOff = darwinSocketFDInfoPSIOff + 240
+	darwinInSockInfoFPortOff  = darwinSocketInfoInSockOff
+	darwinInSockInfoLPortOff  = darwinSocketInfoInSockOff + 4
+	darwinInSockInfoVFlagOff  = darwinSocketInfoInSockOff + 24
+	darwinInSockInfoFAddrOff  = darwinSocketInfoInSockOff + 32
+	darwinInSockInfoLAddrOff  = darwinSocketInfoInSockOff + 48
+	darwinInSockInfoSize      = 80
+	darwinInSockInfoIPv4      = 0x1
+	darwinInSockInfoIPv6      = 0x2
+	darwinSockInfoIN          = 1
+	darwinSockInfoTCP         = 2
+)
+
+type darwinSocketMatchLevel int
+
+const (
+	darwinSocketNoMatch darwinSocketMatchLevel = iota
+	darwinSocketPortMatch
+	darwinSocketRemoteMatch
+	darwinSocketLocalMatch
+	darwinSocketExactMatch
+)
+
+func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {
+	isLocal, err := IsLocal(net.ParseIP(srcIP))
+	if err != nil {
+		return 0, "", "", errors.New("failed to determine if address is local: ", err)
+	}
+	if !isLocal {
+		return 0, "", "", ErrNotLocal
+	}
+	if network != "tcp" && network != "udp" {
+		panic("Unsupported network type for process lookup.")
+	}
+
+	srcAddr, err := netip.ParseAddr(srcIP)
+	if err != nil {
+		return 0, "", "", errors.New("invalid source IP address: ", srcIP)
+	}
+	srcAddr = srcAddr.Unmap()
+
+	var dstAddr netip.Addr
+	hasDstAddr := false
+	if destIP != "" && destPort != 0 {
+		dstAddr, err = netip.ParseAddr(destIP)
+		if err != nil {
+			return 0, "", "", errors.New("invalid destination IP address: ", destIP)
+		}
+		dstAddr = dstAddr.Unmap()
+		hasDstAddr = true
+	}
+
+	processes, err := unix.SysctlKinfoProcSlice("kern.proc.all")
+	if err != nil {
+		return 0, "", "", errors.New("failed to list processes").Base(err)
+	}
+
+	var bestPID int32
+	bestLevel := darwinSocketNoMatch
+	ambiguousBest := false
+
+	for _, process := range processes {
+		pid := process.Proc.P_pid
+		if pid <= 0 {
+			continue
+		}
+
+		matchLevel, err := darwinProcessSocketMatchLevel(pid, network, srcAddr, srcPort, dstAddr, destPort, hasDstAddr)
+		if err != nil || matchLevel == darwinSocketNoMatch {
+			continue
+		}
+		if matchLevel == darwinSocketExactMatch {
+			bestPID = pid
+			bestLevel = matchLevel
+			ambiguousBest = false
+			break
+		}
+		if matchLevel > bestLevel {
+			bestPID = pid
+			bestLevel = matchLevel
+			ambiguousBest = false
+			continue
+		}
+		if matchLevel == bestLevel {
+			ambiguousBest = true
+		}
+	}
+
+	if bestLevel == darwinSocketNoMatch {
+		return 0, "", "", errors.New("process not found for ", network, " connection from ", srcIP, ":", srcPort, " to ", destIP, ":", destPort)
+	}
+	if ambiguousBest {
+		return 0, "", "", errors.New("ambiguous process match for ", network, " connection from ", srcIP, ":", srcPort, " to ", destIP, ":", destPort)
+	}
+
+	absPath, err := darwinProcessPath(bestPID)
+	if err != nil {
+		return 0, "", "", errors.New("could not get process path for PID ", bestPID, ": ", err)
+	}
+
+	absPath = filepath.ToSlash(absPath)
+	return int(bestPID), filepath.Base(absPath), absPath, nil
+}
+
+func darwinProcessSocketMatchLevel(pid int32, network string, srcAddr netip.Addr, srcPort uint16, dstAddr netip.Addr, dstPort uint16, hasDstAddr bool) (darwinSocketMatchLevel, error) {
+	fds, err := darwinProcessFDs(pid)
+	if err != nil {
+		return darwinSocketNoMatch, err
+	}
+
+	bestLevel := darwinSocketNoMatch
+	info := make([]byte, darwinSocketFDInfoSize)
+	for fd := 0; fd+darwinProcFDInfoSize <= len(fds); fd += darwinProcFDInfoSize {
+		fdNumber := int32(darwinReadNativeUint32(fds[fd : fd+4]))
+		fdType := darwinReadNativeUint32(fds[fd+4 : fd+8])
+		if fdType != darwinProcFDTypeSocket {
+			continue
+		}
+
+		n, err := darwinProcPIDFDInfo(pid, fdNumber, darwinProcPIDFDSocketInfo, info)
+		if err != nil || n < darwinSocketInfoInSockOff+darwinInSockInfoSize {
+			continue
+		}
+		level := darwinSocketInfoMatchLevel(info[:n], network, srcAddr, srcPort, dstAddr, dstPort, hasDstAddr)
+		if level == darwinSocketExactMatch {
+			return level, nil
+		}
+		if level > bestLevel {
+			bestLevel = level
+		}
+	}
+
+	return bestLevel, nil
+}
+
+func darwinProcessFDs(pid int32) ([]byte, error) {
+	n, err := darwinProcPIDInfo(pid, darwinProcPIDListFDs, 0, nil)
+	if err != nil {
+		return nil, err
+	}
+	if n <= 0 {
+		return nil, nil
+	}
+
+	buf := make([]byte, n)
+	n, err = darwinProcPIDInfo(pid, darwinProcPIDListFDs, 0, buf)
+	if err != nil {
+		return nil, err
+	}
+	return buf[:n], nil
+}
+
+func darwinSocketInfoMatchLevel(info []byte, network string, srcAddr netip.Addr, srcPort uint16, dstAddr netip.Addr, dstPort uint16, hasDstAddr bool) darwinSocketMatchLevel {
+	protocol := int(darwinReadNativeUint32(info[darwinSocketInfoProtoOff : darwinSocketInfoProtoOff+4]))
+	family := int(darwinReadNativeUint32(info[darwinSocketInfoFamilyOff : darwinSocketInfoFamilyOff+4]))
+	kind := int(darwinReadNativeUint32(info[darwinSocketInfoKindOff : darwinSocketInfoKindOff+4]))
+
+	switch network {
+	case "tcp":
+		if protocol != unix.IPPROTO_TCP || kind != darwinSockInfoTCP {
+			return darwinSocketNoMatch
+		}
+	case "udp":
+		if protocol != unix.IPPROTO_UDP || kind != darwinSockInfoIN {
+			return darwinSocketNoMatch
+		}
+	default:
+		return darwinSocketNoMatch
+	}
+
+	vflag := info[darwinInSockInfoVFlagOff]
+	if srcAddr.Is4() {
+		// Dual-stack sockets expose IPv4-mapped connections as AF_INET6
+		// while marking the endpoint as IPv4 in ini_vflag.
+		if (family != unix.AF_INET && family != unix.AF_INET6) || vflag&darwinInSockInfoIPv4 == 0 {
+			return darwinSocketNoMatch
+		}
+	} else {
+		if family != unix.AF_INET6 || vflag&darwinInSockInfoIPv6 == 0 {
+			return darwinSocketNoMatch
+		}
+	}
+
+	localPort := int32(darwinReadNativeUint32(info[darwinInSockInfoLPortOff : darwinInSockInfoLPortOff+4]))
+	if !darwinPortMatches(localPort, srcPort) {
+		return darwinSocketNoMatch
+	}
+	localAddrMatches := darwinAddrMatchesOrUnspecified(info[darwinInSockInfoLAddrOff:darwinInSockInfoLAddrOff+16], srcAddr)
+
+	foreignAddrRaw := info[darwinInSockInfoFAddrOff : darwinInSockInfoFAddrOff+16]
+	foreignPort := int32(darwinReadNativeUint32(info[darwinInSockInfoFPortOff : darwinInSockInfoFPortOff+4]))
+
+	if !hasDstAddr {
+		if localAddrMatches {
+			return darwinSocketExactMatch
+		}
+		return darwinSocketNoMatch
+	}
+
+	remoteMatches := darwinPortMatches(foreignPort, dstPort) && darwinAddrMatches(foreignAddrRaw, dstAddr)
+	if network == "udp" && darwinEndpointIsZero(foreignAddrRaw, foreignPort) && localAddrMatches {
+		return darwinSocketExactMatch
+	}
+	switch {
+	case localAddrMatches && remoteMatches:
+		return darwinSocketExactMatch
+	case localAddrMatches:
+		return darwinSocketLocalMatch
+	case remoteMatches:
+		return darwinSocketRemoteMatch
+	default:
+		return darwinSocketPortMatch
+	}
+}
+
+func darwinPortMatches(value int32, port uint16) bool {
+	raw := uint16(value)
+	return raw == port || darwinNtohs(raw) == port
+}
+
+func darwinNtohs(value uint16) uint16 {
+	return value<<8 | value>>8
+}
+
+func darwinAddrMatches(raw []byte, addr netip.Addr) bool {
+	if addr.Is4() {
+		ip := addr.As4()
+		return bytes.Equal(raw[12:16], ip[:])
+	}
+	ip := addr.As16()
+	return bytes.Equal(raw, ip[:])
+}
+
+func darwinAddrMatchesOrUnspecified(raw []byte, addr netip.Addr) bool {
+	if darwinAddrMatches(raw, addr) {
+		return true
+	}
+	if addr.Is4() {
+		return darwinBytesAreZero(raw[12:16])
+	}
+	return darwinBytesAreZero(raw)
+}
+
+func darwinEndpointIsZero(rawAddr []byte, port int32) bool {
+	return uint32(port) == 0 && darwinBytesAreZero(rawAddr)
+}
+
+func darwinBytesAreZero(raw []byte) bool {
+	for _, value := range raw {
+		if value != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func darwinReadNativeUint32(b []byte) uint32 {
+	return *(*uint32)(unsafe.Pointer(&b[0]))
+}
+
+func darwinProcessPath(pid int32) (string, error) {
+	buf := make([]byte, unix.PathMax)
+	n, err := darwinProcPIDPath(pid, buf)
+	if err != nil {
+		return "", err
+	}
+	if n <= 0 {
+		return "", errors.New("empty process path")
+	}
+	return strings.TrimRight(string(buf[:n]), "\x00"), nil
+}
+
+func darwinProcPIDInfo(pid int32, flavor int, arg uint64, buf []byte) (int, error) {
+	var ptr unsafe.Pointer
+	if len(buf) > 0 {
+		ptr = unsafe.Pointer(&buf[0])
+	}
+
+	r0, _, errno := syscall_syscall6(libc_proc_pidinfo_trampoline_addr, uintptr(pid), uintptr(flavor), uintptr(arg), uintptr(ptr), uintptr(len(buf)), 0)
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(r0), nil
+}
+
+func darwinProcPIDFDInfo(pid int32, fd int32, flavor int, buf []byte) (int, error) {
+	var ptr unsafe.Pointer
+	if len(buf) > 0 {
+		ptr = unsafe.Pointer(&buf[0])
+	}
+
+	r0, _, errno := syscall_syscall6(libc_proc_pidfdinfo_trampoline_addr, uintptr(pid), uintptr(fd), uintptr(flavor), uintptr(ptr), uintptr(len(buf)), 0)
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(r0), nil
+}
+
+func darwinProcPIDPath(pid int32, buf []byte) (int, error) {
+	r0, _, errno := syscall_syscall6(libc_proc_pidpath_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)), 0, 0, 0)
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(r0), nil
+}
+
+var libc_proc_pidinfo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_proc_pidinfo proc_pidinfo "/usr/lib/libproc.dylib"
+
+var libc_proc_pidfdinfo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_proc_pidfdinfo proc_pidfdinfo "/usr/lib/libproc.dylib"
+
+var libc_proc_pidpath_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_proc_pidpath proc_pidpath "/usr/lib/libproc.dylib"
+
+// Implemented in the runtime package (runtime/sys_darwin.go).
+func syscall_syscall6(fn, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno)
+
+//go:linkname syscall_syscall6 syscall.syscall6
@@ -0,0 +1,18 @@
+//go:build darwin && !ios
+
+#include "textflag.h"
+
+TEXT libc_proc_pidinfo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_proc_pidinfo(SB)
+GLOBL	·libc_proc_pidinfo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_proc_pidinfo_trampoline_addr(SB)/8, $libc_proc_pidinfo_trampoline<>(SB)
+
+TEXT libc_proc_pidfdinfo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_proc_pidfdinfo(SB)
+GLOBL	·libc_proc_pidfdinfo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_proc_pidfdinfo_trampoline_addr(SB)/8, $libc_proc_pidfdinfo_trampoline<>(SB)
+
+TEXT libc_proc_pidpath_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_proc_pidpath(SB)
+GLOBL	·libc_proc_pidpath_trampoline_addr(SB), RODATA, $8
+DATA	·libc_proc_pidpath_trampoline_addr(SB)/8, $libc_proc_pidpath_trampoline<>(SB)
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`powershell.exe -ExecutionPolicy Bypass -File ".\xray_no_window.ps1"`
				`@@ -0,0 +1 @@`
				`Start-Process -FilePath ".\xray.exe" -ArgumentList "-config .\config.json" -WindowStyle Hidden`
				`@@ -0,0 +1 @@`
				`CreateObject("Wscript.Shell").Run "xray.exe -config config.json",0`