Fix Vision read

.github/workflows/build.yml

@@ -16,11 +16,6 @@ on:
       - Alpha
       - Beta
       - Meta
-      
-concurrency:
-  group: ${{ github.ref }}-${{ github.workflow }}
-  cancel-in-progress: true
-  
 env:
   REGISTRY: docker.io
 jobs:
@@ -51,26 +46,25 @@ jobs:
               target: "linux-mips-softfloat linux-mips-hardfloat linux-mipsle-softfloat linux-mipsle-hardfloat",
               id: "4",
             }
-          - { type: "WithoutCGO", target: "linux-386 linux-riscv64", id: "5" }
           - {
               type: "WithoutCGO",
               target: "freebsd-386 freebsd-amd64 freebsd-arm64",
-              id: "6",
+              id: "5",
             }
           - {
               type: "WithoutCGO",
               target: "windows-amd64-compatible windows-amd64 windows-386",
-              id: "7",
+              id: "6",
             }
           - {
               type: "WithoutCGO",
               target: "windows-arm64 windows-arm32v7",
-              id: "8",
+              id: "7",
             }
           - {
               type: "WithoutCGO",
               target: "darwin-amd64 darwin-arm64 android-arm64",
-              id: "9",
+              id: "8",
             }
           - { type: "WithCGO", target: "windows/*", id: "1" }
           - { type: "WithCGO", target: "linux/386", id: "2" }
@@ -114,11 +108,10 @@ jobs:
 
       - name: Set ENV
         run: |
-          sudo timedatectl set-timezone "Asia/Shanghai"
           echo "NAME=clash.meta" >> $GITHUB_ENV
           echo "REPO=${{ github.repository }}" >> $GITHUB_ENV
           echo "ShortSHA=$(git rev-parse --short ${{ github.sha }})" >> $GITHUB_ENV
-          echo "BUILDTIME=$(date)" >> $GITHUB_ENV
+          echo "BUILDTIME=$(date -u)" >> $GITHUB_ENV
           echo "BRANCH=$(git rev-parse --abbrev-ref HEAD)" >> $GITHUB_ENV
         shell: bash
 
@@ -200,10 +193,6 @@ jobs:
           ls -la
           cd ..
 
-      - name: Save version
-        run: echo ${VERSION} > bin/version.txt
-        shell: bash
-
       - uses: actions/upload-artifact@v3
         if: ${{  success() }}
         with:
@@ -213,7 +202,7 @@ jobs:
   Upload-Prerelease:
     permissions: write-all
     if: ${{ github.ref_type=='branch' }}
-    needs: [Build]
+    needs: [ Build ]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/download-artifact@v3
@@ -232,11 +221,6 @@ jobs:
           tag: Prerelease-${{ github.ref_name }}
           deleteOnlyFromDrafts: false
 
-      - name: Set Env
-        run: |
-          echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV
-        shell: bash
-
       - name: Tag Repo
         uses: richardsimko/update-tag@v1.0.6
         with:
@@ -244,34 +228,20 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - run: |
-          cat > release.txt << 'EOF'
-          Release created at  ${{ env.BUILDTIME }}
-          Synchronize ${{ github.ref_name }} branch code updates, keeping only the latest version
-          <br>
-          ### release version
-          `default(not specified in file name)`: compiled with GOAMD64=v3
-          `cgo`: support lwip tun stack, compiled with GOAMD64=v1
-          `compatible`: compiled with GOAMD64=v1
-          Check details between different architectural levels [here](https://github.com/golang/go/wiki/MinimumRequirements#amd64).
-          EOF
-
       - name: Upload Prerelease
         uses: softprops/action-gh-release@v1
         if: ${{  success() }}
         with:
           tag: ${{ github.ref_name }}
           tag_name: Prerelease-${{ github.ref_name }}
-          files: |
-            bin/*
+          files: bin/*
           prerelease: true
           generate_release_notes: true
-          body_path: release.txt
 
   Upload-Release:
     permissions: write-all
     if: ${{ github.ref_type=='tag' }}
-    needs: [Build]
+    needs: [ Build ]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/download-artifact@v3
@@ -294,7 +264,7 @@ jobs:
 
   Docker:
     permissions: write-all
-    needs: [Build]
+    needs: [ Build ]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -351,7 +321,5 @@ jobs:
             linux/386
             linux/amd64
             linux/arm64/v8
-            linux/arm/v7
-          #            linux/riscv64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Dockerfile

@@ -1,6 +1,4 @@
 FROM alpine:latest as builder
-ARG TARGETPLATFORM
-RUN echo "I'm building for $TARGETPLATFORM"
 
 RUN apk add --no-cache gzip && \
     mkdir /clash-config && \
@@ -12,7 +10,7 @@ COPY docker/file-name.sh /clash/file-name.sh
 WORKDIR /clash
 COPY bin/ bin/
 RUN FILE_NAME=`sh file-name.sh` && echo $FILE_NAME && \
-    FILE_NAME=`ls bin/ | egrep "$FILE_NAME.*"|awk NR==1` && echo $FILE_NAME && \
+    FILE_NAME=`ls bin/ | egrep "$FILE_NAME.*"|awk NR==1` && \
     mv bin/$FILE_NAME clash.gz && gzip -d clash.gz && echo "$FILE_NAME" > /clash-config/test
 FROM alpine:latest
 LABEL org.opencontainers.image.source="https://github.com/MetaCubeX/Clash.Meta"

Makefile

@@ -101,9 +101,6 @@ linux-mips64:
 linux-mips64le:
 	GOARCH=mips64le GOOS=linux $(GOBUILD) -o $(BINDIR)/$(NAME)-$@
 
-linux-riscv64:
-	GOARCH=riscv64 GOOS=linux $(GOBUILD) -o $(BINDIR)/$(NAME)-$@
-
 android-arm64:
 	GOARCH=arm64 GOOS=android $(GOBUILD) -o $(BINDIR)/$(NAME)-$@
 

adapter/outbound/base.go

@@ -8,9 +8,10 @@ import (
 	"strings"
 
 	N "github.com/Dreamacro/clash/common/net"
-	"github.com/Dreamacro/clash/common/utils"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
+
+	"github.com/gofrs/uuid"
 )
 
 type Base struct {
@@ -34,7 +35,7 @@ func (b *Base) Name() string {
 // Id implements C.ProxyAdapter
 func (b *Base) Id() string {
 	if b.id == "" {
-		id, err := utils.UnsafeUUIDGenerator.NewV6()
+		id, err := uuid.NewV6()
 		if err != nil {
 			b.id = b.name
 		} else {

adapter/outbound/reality.go

@@ -1,35 +0,0 @@
-package outbound
-
-import (
-	"encoding/base64"
-	"encoding/hex"
-	"errors"
-
-	tlsC "github.com/Dreamacro/clash/component/tls"
-
-	"golang.org/x/crypto/curve25519"
-)
-
-type RealityOptions struct {
-	PublicKey string `proxy:"public-key"`
-	ShortID   string `proxy:"short-id"`
-}
-
-func (o RealityOptions) Parse() (*tlsC.RealityConfig, error) {
-	if o.PublicKey != "" {
-		config := new(tlsC.RealityConfig)
-
-		n, err := base64.RawURLEncoding.Decode(config.PublicKey[:], []byte(o.PublicKey))
-		if err != nil || n != curve25519.ScalarSize {
-			return nil, errors.New("invalid REALITY public key")
-		}
-
-		n, err = hex.Decode(config.ShortID[:], []byte(o.ShortID))
-		if err != nil || n > tlsC.RealityMaxShortIDLen {
-			return nil, errors.New("invalid REALITY short ID")
-		}
-
-		return config, nil
-	}
-	return nil, nil
-}

adapter/outbound/reject.go

@@ -6,7 +6,6 @@ import (
 	"net"
 	"time"
 
-	"github.com/Dreamacro/clash/common/buf"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
 )
@@ -17,12 +16,12 @@ type Reject struct {
 
 // DialContext implements C.ProxyAdapter
 func (r *Reject) DialContext(ctx context.Context, metadata *C.Metadata, opts ...dialer.Option) (C.Conn, error) {
-	return NewConn(nopConn{}, r), nil
+	return NewConn(&nopConn{}, r), nil
 }
 
 // ListenPacketContext implements C.ProxyAdapter
 func (r *Reject) ListenPacketContext(ctx context.Context, metadata *C.Metadata, opts ...dialer.Option) (C.PacketConn, error) {
-	return newPacketConn(nopPacketConn{}, r), nil
+	return newPacketConn(&nopPacketConn{}, r), nil
 }
 
 func NewReject() *Reject {
@@ -49,37 +48,30 @@ func NewPass() *Reject {
 
 type nopConn struct{}
 
-func (rw nopConn) Read(b []byte) (int, error) {
+func (rw *nopConn) Read(b []byte) (int, error) {
 	return 0, io.EOF
 }
 
-func (rw nopConn) ReadBuffer(buffer *buf.Buffer) error {
-	return io.EOF
-}
-
-func (rw nopConn) Write(b []byte) (int, error) {
+func (rw *nopConn) Write(b []byte) (int, error) {
+	if len(b) == 0 {
+		return 0, nil
+	}
 	return 0, io.EOF
 }
 
-func (rw nopConn) WriteBuffer(buffer *buf.Buffer) error {
-	return io.EOF
-}
-
-func (rw nopConn) Close() error                     { return nil }
-func (rw nopConn) LocalAddr() net.Addr              { return nil }
-func (rw nopConn) RemoteAddr() net.Addr             { return nil }
-func (rw nopConn) SetDeadline(time.Time) error      { return nil }
-func (rw nopConn) SetReadDeadline(time.Time) error  { return nil }
-func (rw nopConn) SetWriteDeadline(time.Time) error { return nil }
-
-var udpAddrIPv4Unspecified = &net.UDPAddr{IP: net.IPv4zero, Port: 0}
+func (rw *nopConn) Close() error                     { return nil }
+func (rw *nopConn) LocalAddr() net.Addr              { return nil }
+func (rw *nopConn) RemoteAddr() net.Addr             { return nil }
+func (rw *nopConn) SetDeadline(time.Time) error      { return nil }
+func (rw *nopConn) SetReadDeadline(time.Time) error  { return nil }
+func (rw *nopConn) SetWriteDeadline(time.Time) error { return nil }
 
 type nopPacketConn struct{}
 
-func (npc nopPacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) { return len(b), nil }
-func (npc nopPacketConn) ReadFrom(b []byte) (int, net.Addr, error)           { return 0, nil, io.EOF }
-func (npc nopPacketConn) Close() error                                       { return nil }
-func (npc nopPacketConn) LocalAddr() net.Addr                                { return udpAddrIPv4Unspecified }
-func (npc nopPacketConn) SetDeadline(time.Time) error                        { return nil }
-func (npc nopPacketConn) SetReadDeadline(time.Time) error                    { return nil }
-func (npc nopPacketConn) SetWriteDeadline(time.Time) error                   { return nil }
+func (npc *nopPacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) { return len(b), nil }
+func (npc *nopPacketConn) ReadFrom(b []byte) (int, net.Addr, error)           { return 0, nil, io.EOF }
+func (npc *nopPacketConn) Close() error                                       { return nil }
+func (npc *nopPacketConn) LocalAddr() net.Addr                                { return &net.UDPAddr{IP: net.IPv4zero, Port: 0} }
+func (npc *nopPacketConn) SetDeadline(time.Time) error                        { return nil }
+func (npc *nopPacketConn) SetReadDeadline(time.Time) error                    { return nil }
+func (npc *nopPacketConn) SetWriteDeadline(time.Time) error                   { return nil }

adapter/outbound/shadowsocks.go

@@ -6,9 +6,7 @@ import (
 	"fmt"
 	"net"
 	"strconv"
-	"time"
 
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/common/structure"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
@@ -105,17 +103,9 @@ func (ss *ShadowSocks) streamConn(c net.Conn, metadata *C.Metadata) (net.Conn, e
 		}
 	}
 	if metadata.NetWork == C.UDP && ss.option.UDPOverTCP {
-		if N.NeedHandshake(c) {
-			return ss.method.DialEarlyConn(c, M.ParseSocksaddr(uot.UOTMagicAddress+":443")), nil
-		} else {
-			return ss.method.DialConn(c, M.ParseSocksaddr(uot.UOTMagicAddress+":443"))
-		}
-	}
-	if N.NeedHandshake(c) {
-		return ss.method.DialEarlyConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
-	} else {
-		return ss.method.DialConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
+		return ss.method.DialEarlyConn(c, M.ParseSocksaddr(uot.UOTMagicAddress+":443")), nil
 	}
+	return ss.method.DialEarlyConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
 }
 
 // DialContext implements C.ProxyAdapter
@@ -194,7 +184,7 @@ func (ss *ShadowSocks) SupportUOT() bool {
 
 func NewShadowSocks(option ShadowSocksOption) (*ShadowSocks, error) {
 	addr := net.JoinHostPort(option.Server, strconv.Itoa(option.Port))
-	method, err := shadowimpl.FetchMethod(option.Cipher, option.Password, time.Now)
+	method, err := shadowimpl.FetchMethod(option.Cipher, option.Password)
 	if err != nil {
 		return nil, fmt.Errorf("ss %s initialize error: %w", addr, err)
 	}

adapter/outbound/trojan.go

@@ -26,28 +26,25 @@ type Trojan struct {
 	gunTLSConfig *tls.Config
 	gunConfig    *gun.Config
 	transport    *gun.TransportWrap
-
-	realityConfig *tlsC.RealityConfig
 }
 
 type TrojanOption struct {
 	BasicOption
-	Name              string         `proxy:"name"`
-	Server            string         `proxy:"server"`
-	Port              int            `proxy:"port"`
-	Password          string         `proxy:"password"`
-	ALPN              []string       `proxy:"alpn,omitempty"`
-	SNI               string         `proxy:"sni,omitempty"`
-	SkipCertVerify    bool           `proxy:"skip-cert-verify,omitempty"`
-	Fingerprint       string         `proxy:"fingerprint,omitempty"`
-	UDP               bool           `proxy:"udp,omitempty"`
-	Network           string         `proxy:"network,omitempty"`
-	RealityOpts       RealityOptions `proxy:"reality-opts,omitempty"`
-	GrpcOpts          GrpcOptions    `proxy:"grpc-opts,omitempty"`
-	WSOpts            WSOptions      `proxy:"ws-opts,omitempty"`
-	Flow              string         `proxy:"flow,omitempty"`
-	FlowShow          bool           `proxy:"flow-show,omitempty"`
-	ClientFingerprint string         `proxy:"client-fingerprint,omitempty"`
+	Name              string      `proxy:"name"`
+	Server            string      `proxy:"server"`
+	Port              int         `proxy:"port"`
+	Password          string      `proxy:"password"`
+	ALPN              []string    `proxy:"alpn,omitempty"`
+	SNI               string      `proxy:"sni,omitempty"`
+	SkipCertVerify    bool        `proxy:"skip-cert-verify,omitempty"`
+	Fingerprint       string      `proxy:"fingerprint,omitempty"`
+	UDP               bool        `proxy:"udp,omitempty"`
+	Network           string      `proxy:"network,omitempty"`
+	GrpcOpts          GrpcOptions `proxy:"grpc-opts,omitempty"`
+	WSOpts            WSOptions   `proxy:"ws-opts,omitempty"`
+	Flow              string      `proxy:"flow,omitempty"`
+	FlowShow          bool        `proxy:"flow-show,omitempty"`
+	ClientFingerprint string      `proxy:"client-fingerprint,omitempty"`
 }
 
 func (t *Trojan) plainStream(c net.Conn) (net.Conn, error) {
@@ -86,7 +83,7 @@ func (t *Trojan) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error)
 	}
 
 	if t.transport != nil {
-		c, err = gun.StreamGunWithConn(c, t.gunTLSConfig, t.gunConfig, t.realityConfig)
+		c, err = gun.StreamGunWithConn(c, t.gunTLSConfig, t.gunConfig)
 	} else {
 		c, err = t.plainStream(c)
 	}
@@ -262,13 +259,6 @@ func NewTrojan(option TrojanOption) (*Trojan, error) {
 		option:   &option,
 	}
 
-	var err error
-	t.realityConfig, err = option.RealityOpts.Parse()
-	if err != nil {
-		return nil, err
-	}
-	tOption.Reality = t.realityConfig
-
 	if option.Network == "grpc" {
 		dialFn := func(network, addr string) (net.Conn, error) {
 			c, err := dialer.DialContext(context.Background(), "tcp", t.addr, t.Base.DialOptions()...)
@@ -295,7 +285,7 @@ func NewTrojan(option TrojanOption) (*Trojan, error) {
 			}
 		}
 
-		t.transport = gun.NewHTTP2Client(dialFn, tlsConfig, tOption.ClientFingerprint, t.realityConfig)
+		t.transport = gun.NewHTTP2Client(dialFn, tlsConfig, tOption.ClientFingerprint)
 
 		t.gunTLSConfig = tlsConfig
 		t.gunConfig = &gun.Config{

adapter/outbound/vless.go

@@ -17,7 +17,6 @@ import (
 	"github.com/Dreamacro/clash/component/resolver"
 	tlsC "github.com/Dreamacro/clash/component/tls"
 	C "github.com/Dreamacro/clash/constant"
-	"github.com/Dreamacro/clash/log"
 	"github.com/Dreamacro/clash/transport/gun"
 	"github.com/Dreamacro/clash/transport/socks5"
 	"github.com/Dreamacro/clash/transport/vless"
@@ -42,8 +41,6 @@ type Vless struct {
 	gunTLSConfig *tls.Config
 	gunConfig    *gun.Config
 	transport    *gun.TransportWrap
-
-	realityConfig *tlsC.RealityConfig
 }
 
 type VlessOption struct {
@@ -60,7 +57,6 @@ type VlessOption struct {
 	XUDP              bool              `proxy:"xudp,omitempty"`
 	PacketEncoding    string            `proxy:"packet-encoding,omitempty"`
 	Network           string            `proxy:"network,omitempty"`
-	RealityOpts       RealityOptions    `proxy:"reality-opts,omitempty"`
 	HTTPOpts          HTTPOptions       `proxy:"http-opts,omitempty"`
 	HTTP2Opts         HTTP2Options      `proxy:"h2-opts,omitempty"`
 	GrpcOpts          GrpcOptions       `proxy:"grpc-opts,omitempty"`
@@ -82,6 +78,7 @@ func (v *Vless) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 
 	switch v.option.Network {
 	case "ws":
+
 		host, port, _ := net.SplitHostPort(v.addr)
 		wsOpts := &vmess.WebsocketConfig{
 			Host:                host,
@@ -157,7 +154,7 @@ func (v *Vless) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 
 		c, err = vmess.StreamH2Conn(c, h2Opts)
 	case "grpc":
-		c, err = gun.StreamGunWithConn(c, v.gunTLSConfig, v.gunConfig, v.realityConfig)
+		c, err = gun.StreamGunWithConn(c, v.gunTLSConfig, v.gunConfig)
 	default:
 		// default tcp network
 		// handle TLS And XTLS
@@ -193,7 +190,6 @@ func (v *Vless) streamTLSOrXTLSConn(conn net.Conn, isH2 bool) (net.Conn, error)
 			SkipCertVerify:    v.option.SkipCertVerify,
 			FingerPrint:       v.option.Fingerprint,
 			ClientFingerprint: v.option.ClientFingerprint,
-			Reality:           v.realityConfig,
 		}
 
 		if isH2 {
@@ -483,10 +479,7 @@ func NewVless(option VlessOption) (*Vless, error) {
 	if option.Network != "ws" && len(option.Flow) >= 16 {
 		option.Flow = option.Flow[:16]
 		switch option.Flow {
-		case vless.XRV:
-			log.Warnln("To use %s, ensure your server is upgrade to Xray-core v1.8.0+", vless.XRV)
-			fallthrough
-		case vless.XRO, vless.XRD, vless.XRS:
+		case vless.XRO, vless.XRD, vless.XRS, vless.XRV:
 			addons = &vless.Addons{
 				Flow: option.Flow,
 			}
@@ -526,11 +519,6 @@ func NewVless(option VlessOption) (*Vless, error) {
 		option: &option,
 	}
 
-	v.realityConfig, err = v.option.RealityOpts.Parse()
-	if err != nil {
-		return nil, err
-	}
-
 	switch option.Network {
 	case "h2":
 		if len(option.HTTP2Opts.Host) == 0 {
@@ -565,7 +553,8 @@ func NewVless(option VlessOption) (*Vless, error) {
 		v.gunTLSConfig = tlsConfig
 		v.gunConfig = gunConfig
 
-		v.transport = gun.NewHTTP2Client(dialFn, tlsConfig, v.option.ClientFingerprint, v.realityConfig)
+		v.transport = gun.NewHTTP2Client(dialFn, tlsConfig, v.option.ClientFingerprint)
+
 	}
 
 	return v, nil

adapter/outbound/vmess.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 	"sync"
 
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/component/dialer"
 	"github.com/Dreamacro/clash/component/resolver"
 	tlsC "github.com/Dreamacro/clash/component/tls"
@@ -35,35 +34,32 @@ type Vmess struct {
 	gunTLSConfig *tls.Config
 	gunConfig    *gun.Config
 	transport    *gun.TransportWrap
-
-	realityConfig *tlsC.RealityConfig
 }
 
 type VmessOption struct {
 	BasicOption
-	Name                string         `proxy:"name"`
-	Server              string         `proxy:"server"`
-	Port                int            `proxy:"port"`
-	UUID                string         `proxy:"uuid"`
-	AlterID             int            `proxy:"alterId"`
-	Cipher              string         `proxy:"cipher"`
-	UDP                 bool           `proxy:"udp,omitempty"`
-	Network             string         `proxy:"network,omitempty"`
-	TLS                 bool           `proxy:"tls,omitempty"`
-	SkipCertVerify      bool           `proxy:"skip-cert-verify,omitempty"`
-	Fingerprint         string         `proxy:"fingerprint,omitempty"`
-	ServerName          string         `proxy:"servername,omitempty"`
-	RealityOpts         RealityOptions `proxy:"reality-opts,omitempty"`
-	HTTPOpts            HTTPOptions    `proxy:"http-opts,omitempty"`
-	HTTP2Opts           HTTP2Options   `proxy:"h2-opts,omitempty"`
-	GrpcOpts            GrpcOptions    `proxy:"grpc-opts,omitempty"`
-	WSOpts              WSOptions      `proxy:"ws-opts,omitempty"`
-	PacketAddr          bool           `proxy:"packet-addr,omitempty"`
-	XUDP                bool           `proxy:"xudp,omitempty"`
-	PacketEncoding      string         `proxy:"packet-encoding,omitempty"`
-	GlobalPadding       bool           `proxy:"global-padding,omitempty"`
-	AuthenticatedLength bool           `proxy:"authenticated-length,omitempty"`
-	ClientFingerprint   string         `proxy:"client-fingerprint,omitempty"`
+	Name                string       `proxy:"name"`
+	Server              string       `proxy:"server"`
+	Port                int          `proxy:"port"`
+	UUID                string       `proxy:"uuid"`
+	AlterID             int          `proxy:"alterId"`
+	Cipher              string       `proxy:"cipher"`
+	UDP                 bool         `proxy:"udp,omitempty"`
+	Network             string       `proxy:"network,omitempty"`
+	TLS                 bool         `proxy:"tls,omitempty"`
+	SkipCertVerify      bool         `proxy:"skip-cert-verify,omitempty"`
+	Fingerprint         string       `proxy:"fingerprint,omitempty"`
+	ServerName          string       `proxy:"servername,omitempty"`
+	HTTPOpts            HTTPOptions  `proxy:"http-opts,omitempty"`
+	HTTP2Opts           HTTP2Options `proxy:"h2-opts,omitempty"`
+	GrpcOpts            GrpcOptions  `proxy:"grpc-opts,omitempty"`
+	WSOpts              WSOptions    `proxy:"ws-opts,omitempty"`
+	PacketAddr          bool         `proxy:"packet-addr,omitempty"`
+	XUDP                bool         `proxy:"xudp,omitempty"`
+	PacketEncoding      string       `proxy:"packet-encoding,omitempty"`
+	GlobalPadding       bool         `proxy:"global-padding,omitempty"`
+	AuthenticatedLength bool         `proxy:"authenticated-length,omitempty"`
+	ClientFingerprint   string       `proxy:"client-fingerprint,omitempty"`
 }
 
 type HTTPOptions struct {
@@ -98,6 +94,7 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 
 	switch v.option.Network {
 	case "ws":
+
 		host, port, _ := net.SplitHostPort(v.addr)
 		wsOpts := &clashVMess.WebsocketConfig{
 			Host:                host,
@@ -146,12 +143,12 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 				Host:              host,
 				SkipCertVerify:    v.option.SkipCertVerify,
 				ClientFingerprint: v.option.ClientFingerprint,
-				Reality:           v.realityConfig,
 			}
 
 			if v.option.ServerName != "" {
 				tlsOpts.Host = v.option.ServerName
 			}
+
 			c, err = clashVMess.StreamTLSConn(c, tlsOpts)
 			if err != nil {
 				return nil, err
@@ -174,7 +171,6 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 			SkipCertVerify:    v.option.SkipCertVerify,
 			NextProtos:        []string{"h2"},
 			ClientFingerprint: v.option.ClientFingerprint,
-			Reality:           v.realityConfig,
 		}
 
 		if v.option.ServerName != "" {
@@ -193,7 +189,7 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 
 		c, err = clashVMess.StreamH2Conn(c, h2Opts)
 	case "grpc":
-		c, err = gun.StreamGunWithConn(c, v.gunTLSConfig, v.gunConfig, v.realityConfig)
+		c, err = gun.StreamGunWithConn(c, v.gunTLSConfig, v.gunConfig)
 	default:
 		// handle TLS
 		if v.option.TLS {
@@ -202,7 +198,6 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 				Host:              host,
 				SkipCertVerify:    v.option.SkipCertVerify,
 				ClientFingerprint: v.option.ClientFingerprint,
-				Reality:           v.realityConfig,
 			}
 
 			if v.option.ServerName != "" {
@@ -218,24 +213,12 @@ func (v *Vmess) StreamConn(c net.Conn, metadata *C.Metadata) (net.Conn, error) {
 	}
 	if metadata.NetWork == C.UDP {
 		if v.option.XUDP {
-			if N.NeedHandshake(c) {
-				return v.client.DialEarlyXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
-			} else {
-				return v.client.DialXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			}
+			return v.client.DialEarlyXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
 		} else {
-			if N.NeedHandshake(c) {
-				return v.client.DialEarlyPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
-			} else {
-				return v.client.DialPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			}
+			return v.client.DialEarlyPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
 		}
 	} else {
-		if N.NeedHandshake(c) {
-			return v.client.DialEarlyConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
-		} else {
-			return v.client.DialConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-		}
+		return v.client.DialEarlyConn(c, M.ParseSocksaddr(metadata.RemoteAddress())), nil
 	}
 }
 
@@ -306,17 +289,9 @@ func (v *Vmess) ListenPacketContext(ctx context.Context, metadata *C.Metadata, o
 		}(c)
 
 		if v.option.XUDP {
-			if N.NeedHandshake(c) {
-				c = v.client.DialEarlyXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			} else {
-				c, err = v.client.DialXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			}
+			c = v.client.DialEarlyXUDPPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
 		} else {
-			if N.NeedHandshake(c) {
-				c = v.client.DialEarlyPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			} else {
-				c, err = v.client.DialPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
-			}
+			c = v.client.DialEarlyPacketConn(c, M.ParseSocksaddr(metadata.RemoteAddress()))
 		}
 
 		if err != nil {
@@ -455,14 +430,9 @@ func NewVmess(option VmessOption) (*Vmess, error) {
 		v.gunTLSConfig = tlsConfig
 		v.gunConfig = gunConfig
 
-		v.transport = gun.NewHTTP2Client(dialFn, tlsConfig, v.option.ClientFingerprint, v.realityConfig)
-	}
+		v.transport = gun.NewHTTP2Client(dialFn, tlsConfig, v.option.ClientFingerprint)
 
-	v.realityConfig, err = v.option.RealityOpts.Parse()
-	if err != nil {
-		return nil, err
 	}
-
 	return v, nil
 }
 

adapter/outbound/wireguard.go

@@ -34,7 +34,7 @@ type WireGuard struct {
 	bind      *wireguard.ClientBind
 	device    *device.Device
 	tunDevice wireguard.Device
-	dialer    *wgSingDialer
+	dialer    *wgDialer
 	startOnce sync.Once
 	startErr  error
 }
@@ -56,28 +56,16 @@ type WireGuardOption struct {
 	PersistentKeepalive int     `proxy:"persistent-keepalive,omitempty"`
 }
 
-type wgSingDialer struct {
-	dialer dialer.Dialer
+type wgDialer struct {
+	options []dialer.Option
 }
 
-var _ N.Dialer = &wgSingDialer{}
-
-func (d *wgSingDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	return d.dialer.DialContext(ctx, network, destination.String())
+func (d *wgDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	return dialer.DialContext(ctx, network, destination.String(), d.options...)
 }
 
-func (d *wgSingDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	return d.dialer.ListenPacket(ctx, "udp", "", destination.AddrPort())
-}
-
-type wgNetDialer struct {
-	tunDevice wireguard.Device
-}
-
-var _ dialer.NetDialer = &wgNetDialer{}
-
-func (d wgNetDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	return d.tunDevice.DialContext(ctx, network, M.ParseSocksaddr(address).Unwrap())
+func (d *wgDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return dialer.ListenPacket(ctx, dialer.ParseNetwork("udp", destination.Addr), "", d.options...)
 }
 
 func NewWireGuard(option WireGuardOption) (*WireGuard, error) {
@@ -91,7 +79,7 @@ func NewWireGuard(option WireGuardOption) (*WireGuard, error) {
 			rmark:  option.RoutingMark,
 			prefer: C.NewDNSPrefer(option.IPVersion),
 		},
-		dialer: &wgSingDialer{dialer: dialer.NewDialer()},
+		dialer: &wgDialer{},
 	}
 	runtime.SetFinalizer(outbound, closeWireGuard)
 
@@ -211,8 +199,7 @@ func closeWireGuard(w *WireGuard) {
 }
 
 func (w *WireGuard) DialContext(ctx context.Context, metadata *C.Metadata, opts ...dialer.Option) (_ C.Conn, err error) {
-	options := w.Base.DialOptions(opts...)
-	w.dialer.dialer = dialer.NewDialer(options...)
+	w.dialer.options = opts
 	var conn net.Conn
 	w.startOnce.Do(func() {
 		w.startErr = w.tunDevice.Start()
@@ -221,12 +208,15 @@ func (w *WireGuard) DialContext(ctx context.Context, metadata *C.Metadata, opts
 		return nil, w.startErr
 	}
 	if !metadata.Resolved() {
-		options = append(options, dialer.WithResolver(resolver.DefaultResolver))
-		options = append(options, dialer.WithNetDialer(wgNetDialer{tunDevice: w.tunDevice}))
-		conn, err = dialer.NewDialer(options...).DialContext(ctx, "tcp", metadata.RemoteAddress())
+		var addrs []netip.Addr
+		addrs, err = resolver.LookupIP(ctx, metadata.Host)
+		if err != nil {
+			return nil, err
+		}
+		conn, err = N.DialSerial(ctx, w.tunDevice, "tcp", M.ParseSocksaddr(metadata.RemoteAddress()), addrs)
 	} else {
 		port, _ := strconv.Atoi(metadata.DstPort)
-		conn, err = w.tunDevice.DialContext(ctx, "tcp", M.SocksaddrFrom(metadata.DstIP, uint16(port)).Unwrap())
+		conn, err = w.tunDevice.DialContext(ctx, "tcp", M.SocksaddrFrom(metadata.DstIP, uint16(port)))
 	}
 	if err != nil {
 		return nil, err
@@ -238,8 +228,7 @@ func (w *WireGuard) DialContext(ctx context.Context, metadata *C.Metadata, opts
 }
 
 func (w *WireGuard) ListenPacketContext(ctx context.Context, metadata *C.Metadata, opts ...dialer.Option) (_ C.PacketConn, err error) {
-	options := w.Base.DialOptions(opts...)
-	w.dialer.dialer = dialer.NewDialer(options...)
+	w.dialer.options = opts
 	var pc net.PacketConn
 	w.startOnce.Do(func() {
 		w.startErr = w.tunDevice.Start()
@@ -258,7 +247,7 @@ func (w *WireGuard) ListenPacketContext(ctx context.Context, metadata *C.Metadat
 		metadata.DstIP = ip
 	}
 	port, _ := strconv.Atoi(metadata.DstPort)
-	pc, err = w.tunDevice.ListenPacket(ctx, M.SocksaddrFrom(metadata.DstIP, uint16(port)).Unwrap())
+	pc, err = w.tunDevice.ListenPacket(ctx, M.SocksaddrFrom(metadata.DstIP, uint16(port)))
 	if err != nil {
 		return nil, err
 	}

adapter/outboundgroup/fallback.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/Dreamacro/clash/adapter/outbound"
 	"github.com/Dreamacro/clash/common/callback"
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/constant/provider"
@@ -36,17 +35,15 @@ func (f *Fallback) DialContext(ctx context.Context, metadata *C.Metadata, opts .
 		f.onDialFailed(proxy.Type(), err)
 	}
 
-	if N.NeedHandshake(c) {
-		c = &callback.FirstWriteCallBackConn{
-			Conn: c,
-			Callback: func(err error) {
-				if err == nil {
-					f.onDialSuccess()
-				} else {
-					f.onDialFailed(proxy.Type(), err)
-				}
-			},
-		}
+	c = &callback.FirstWriteCallBackConn{
+		Conn: c,
+		Callback: func(err error) {
+			if err == nil {
+				f.onDialSuccess()
+			} else {
+				f.onDialFailed(proxy.Type(), err)
+			}
+		},
 	}
 
 	return c, err

adapter/outboundgroup/loadbalance.go

@@ -6,14 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"sync"
 	"time"
 
 	"github.com/Dreamacro/clash/adapter/outbound"
 	"github.com/Dreamacro/clash/common/cache"
 	"github.com/Dreamacro/clash/common/callback"
 	"github.com/Dreamacro/clash/common/murmur3"
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/constant/provider"
@@ -21,7 +19,7 @@ import (
 	"golang.org/x/net/publicsuffix"
 )
 
-type strategyFn = func(proxies []C.Proxy, metadata *C.Metadata, touch bool) C.Proxy
+type strategyFn = func(proxies []C.Proxy, metadata *C.Metadata) C.Proxy
 
 type LoadBalance struct {
 	*GroupBase
@@ -94,19 +92,16 @@ func (lb *LoadBalance) DialContext(ctx context.Context, metadata *C.Metadata, op
 		lb.onDialFailed(proxy.Type(), err)
 	}
 
-	if N.NeedHandshake(c) {
-		c = &callback.FirstWriteCallBackConn{
-			Conn: c,
-			Callback: func(err error) {
-				if err == nil {
-					lb.onDialSuccess()
-				} else {
-					lb.onDialFailed(proxy.Type(), err)
-				}
-			},
-		}
+	c = &callback.FirstWriteCallBackConn{
+		Conn: c,
+		Callback: func(err error) {
+			if err == nil {
+				lb.onDialSuccess()
+			} else {
+				lb.onDialFailed(proxy.Type(), err)
+			}
+		},
 	}
-
 	return
 }
 
@@ -128,26 +123,22 @@ func (lb *LoadBalance) SupportUDP() bool {
 }
 
 func strategyRoundRobin() strategyFn {
+	flag := true
 	idx := 0
-	idxMutex := sync.Mutex{}
-	return func(proxies []C.Proxy, metadata *C.Metadata, touch bool) C.Proxy {
-		idxMutex.Lock()
-		defer idxMutex.Unlock()
-
-		i := 0
+	return func(proxies []C.Proxy, metadata *C.Metadata) C.Proxy {
 		length := len(proxies)
-
-		if touch {
-			defer func() {
-				idx = (idx + i) % length
-			}()
-		}
-
-		for ; i < length; i++ {
-			id := (idx + i) % length
-			proxy := proxies[id]
+		for i := 0; i < length; i++ {
+			flag = !flag
+			if flag {
+				idx = (idx - 1) % length
+			} else {
+				idx = (idx + 2) % length
+			}
+			if idx < 0 {
+				idx = idx + length
+			}
+			proxy := proxies[idx]
 			if proxy.Alive() {
-				i++
 				return proxy
 			}
 		}
@@ -158,7 +149,7 @@ func strategyRoundRobin() strategyFn {
 
 func strategyConsistentHashing() strategyFn {
 	maxRetry := 5
-	return func(proxies []C.Proxy, metadata *C.Metadata, touch bool) C.Proxy {
+	return func(proxies []C.Proxy, metadata *C.Metadata) C.Proxy {
 		key := uint64(murmur3.Sum32([]byte(getKey(metadata))))
 		buckets := int32(len(proxies))
 		for i := 0; i < maxRetry; i, key = i+1, key+1 {
@@ -186,7 +177,7 @@ func strategyStickySessions() strategyFn {
 	lruCache := cache.New[uint64, int](
 		cache.WithAge[uint64, int](int64(ttl.Seconds())),
 		cache.WithSize[uint64, int](1000))
-	return func(proxies []C.Proxy, metadata *C.Metadata, touch bool) C.Proxy {
+	return func(proxies []C.Proxy, metadata *C.Metadata) C.Proxy {
 		key := uint64(murmur3.Sum32([]byte(getKeyWithSrcAndDst(metadata))))
 		length := len(proxies)
 		idx, has := lruCache.Get(key)
@@ -218,7 +209,7 @@ func strategyStickySessions() strategyFn {
 // Unwrap implements C.ProxyAdapter
 func (lb *LoadBalance) Unwrap(metadata *C.Metadata, touch bool) C.Proxy {
 	proxies := lb.GetProxies(touch)
-	return lb.strategyFn(proxies, metadata, touch)
+	return lb.strategyFn(proxies, metadata)
 }
 
 // MarshalJSON implements C.ProxyAdapter

adapter/outboundgroup/relay.go

@@ -176,7 +176,7 @@ func (r *Relay) proxies(metadata *C.Metadata, touch bool) ([]C.Proxy, []C.Proxy)
 }
 
 func (r *Relay) Addr() string {
-	proxies, _ := r.proxies(nil, false)
+	proxies, _ := r.proxies(nil, true)
 	return proxies[len(proxies)-1].Addr()
 }
 

adapter/outboundgroup/urltest.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/Dreamacro/clash/adapter/outbound"
 	"github.com/Dreamacro/clash/common/callback"
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/common/singledo"
 	"github.com/Dreamacro/clash/component/dialer"
 	C "github.com/Dreamacro/clash/constant"
@@ -44,19 +43,16 @@ func (u *URLTest) DialContext(ctx context.Context, metadata *C.Metadata, opts ..
 		u.onDialFailed(proxy.Type(), err)
 	}
 
-	if N.NeedHandshake(c) {
-		c = &callback.FirstWriteCallBackConn{
-			Conn: c,
-			Callback: func(err error) {
-				if err == nil {
-					u.onDialSuccess()
-				} else {
-					u.onDialFailed(proxy.Type(), err)
-				}
-			},
-		}
+	c = &callback.FirstWriteCallBackConn{
+		Conn: c,
+		Callback: func(err error) {
+			if err == nil {
+				u.onDialSuccess()
+			} else {
+				u.onDialFailed(proxy.Type(), err)
+			}
+		},
 	}
-
 	return c, err
 }
 

adapter/provider/healthcheck.go

@@ -6,10 +6,10 @@ import (
 
 	"github.com/Dreamacro/clash/common/batch"
 	"github.com/Dreamacro/clash/common/singledo"
-	"github.com/Dreamacro/clash/common/utils"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/log"
 
+	"github.com/gofrs/uuid"
 	"go.uber.org/atomic"
 )
 
@@ -77,7 +77,7 @@ func (hc *HealthCheck) touch() {
 func (hc *HealthCheck) check() {
 	_, _, _ = hc.singleDo.Do(func() (struct{}, error) {
 		id := ""
-		if uid, err := utils.UnsafeUUIDGenerator.NewV4(); err == nil {
+		if uid, err := uuid.NewV4(); err == nil {
 			id = uid.String()
 		}
 		log.Debugln("Start New Health Checking {%s}", id)

common/buf/sing.go

@@ -5,15 +5,10 @@ import (
 	"github.com/sagernet/sing/common/buf"
 )
 
-const BufferSize = buf.BufferSize
-
 type Buffer = buf.Buffer
 
-var New = buf.New
 var StackNew = buf.StackNew
 var StackNewSize = buf.StackNewSize
-var With = buf.With
-
 var KeepAlive = common.KeepAlive
 
 //go:norace

common/convert/converter.go

@@ -83,7 +83,7 @@ func ConvertsV2Ray(buf []byte) ([]map[string]any, error) {
 			trojan["port"] = urlTrojan.Port()
 			trojan["password"] = urlTrojan.User.Username()
 			trojan["udp"] = true
-			trojan["skip-cert-verify"], _ = strconv.ParseBool(query.Get("allowInsecure"))
+			trojan["skip-cert-verify"] = false
 
 			sni := query.Get("sni")
 			if sni != "" {

common/convert/util.go

@@ -2,14 +2,12 @@ package convert
 
 import (
 	"encoding/base64"
+	"github.com/metacubex/sing-shadowsocks/shadowimpl"
+	"math/rand"
 	"net/http"
 	"strings"
-	"time"
 
-	"github.com/Dreamacro/clash/common/utils"
-
-	"github.com/metacubex/sing-shadowsocks/shadowimpl"
-	"github.com/zhangyunhao116/fastrand"
+	"github.com/gofrs/uuid"
 )
 
 var hostsSuffix = []string{
@@ -294,7 +292,7 @@ var (
 )
 
 func RandHost() string {
-	id, _ := utils.UnsafeUUIDGenerator.NewV4()
+	id, _ := uuid.NewV4()
 	base := strings.ToLower(base64.RawURLEncoding.EncodeToString(id.Bytes()))
 	base = strings.ReplaceAll(base, "-", "")
 	base = strings.ReplaceAll(base, "_", "")
@@ -303,11 +301,11 @@ func RandHost() string {
 	prefix += string(buf[6:8]) + "-"
 	prefix += string(buf[len(buf)-8:])
 
-	return prefix + hostsSuffix[fastrand.Intn(hostsLen)]
+	return prefix + hostsSuffix[rand.Intn(hostsLen)]
 }
 
 func RandUserAgent() string {
-	return userAgents[fastrand.Intn(uaLen)]
+	return userAgents[rand.Intn(uaLen)]
 }
 
 func SetUserAgent(header http.Header) {
@@ -319,6 +317,6 @@ func SetUserAgent(header http.Header) {
 }
 
 func VerifyMethod(cipher, password string) (err error) {
-	_, err = shadowimpl.FetchMethod(cipher, password, time.Now)
+	_, err = shadowimpl.FetchMethod(cipher, password)
 	return
 }

common/net/bufconn.go

@@ -27,10 +27,6 @@ func (c *BufferedConn) Reader() *bufio.Reader {
 	return c.r
 }
 
-func (c *BufferedConn) ResetPeeked() {
-	c.peeked = false
-}
-
 func (c *BufferedConn) Peeked() bool {
 	return c.peeked
 }

common/net/sing.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"net"
 
-	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/bufio"
 	"github.com/sagernet/sing/common/network"
 )
@@ -17,13 +16,6 @@ type ExtendedConn = network.ExtendedConn
 type ExtendedWriter = network.ExtendedWriter
 type ExtendedReader = network.ExtendedReader
 
-func NeedHandshake(conn any) bool {
-	if earlyConn, isEarlyConn := common.Cast[network.EarlyConn](conn); isEarlyConn && earlyConn.NeedHandshake() {
-		return true
-	}
-	return false
-}
-
 // Relay copies between left and right bidirectionally.
 func Relay(leftConn, rightConn net.Conn) {
 	_ = bufio.CopyConn(context.TODO(), leftConn, rightConn)

common/pool/alloc_test.go

@@ -1,10 +1,10 @@
 package pool
 
 import (
+	"math/rand"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 func TestAllocGet(t *testing.T) {
@@ -43,6 +43,6 @@ func TestAllocPutThenGet(t *testing.T) {
 
 func BenchmarkMSB(b *testing.B) {
 	for i := 0; i < b.N; i++ {
-		msb(fastrand.Int())
+		msb(rand.Int())
 	}
 }

common/utils/must.go

@@ -1,8 +0,0 @@
-package utils
-
-func MustOK[T any](result T, ok bool) T {
-	if ok {
-		return result
-	}
-	panic("operation failed")
-}

common/utils/slice.go

@@ -1,34 +0,0 @@
-package utils
-
-import (
-	"errors"
-	"fmt"
-	"reflect"
-)
-
-func Filter[T comparable](tSlice []T, filter func(t T) bool) []T {
-	result := make([]T, 0)
-	for _, t := range tSlice {
-		if filter(t) {
-			result = append(result, t)
-		}
-	}
-	return result
-}
-
-func ToStringSlice(value any) ([]string, error) {
-	strArr := make([]string, 0)
-	switch reflect.TypeOf(value).Kind() {
-	case reflect.Slice, reflect.Array:
-		origin := reflect.ValueOf(value)
-		for i := 0; i < origin.Len(); i++ {
-			item := fmt.Sprintf("%v", origin.Index(i))
-			strArr = append(strArr, item)
-		}
-	case reflect.String:
-		strArr = append(strArr, fmt.Sprintf("%v", value))
-	default:
-		return nil, errors.New("value format error, must be string or array")
-	}
-	return strArr, nil
-}

common/utils/uuid.go

@@ -2,22 +2,15 @@ package utils
 
 import (
 	"github.com/gofrs/uuid"
-	"github.com/zhangyunhao116/fastrand"
 )
 
-type fastRandReader struct{}
-
-func (r fastRandReader) Read(p []byte) (int, error) {
-	return fastrand.Read(p)
-}
-
-var UnsafeUUIDGenerator = uuid.NewGenWithOptions(uuid.WithRandomReader(fastRandReader{}))
+var uuidNamespace, _ = uuid.FromString("00000000-0000-0000-0000-000000000000")
 
 // UUIDMap https://github.com/XTLS/Xray-core/issues/158#issue-783294090
 func UUIDMap(str string) (uuid.UUID, error) {
 	u, err := uuid.FromString(str)
 	if err != nil {
-		return UnsafeUUIDGenerator.NewV5(uuid.Nil, str), nil
+		return uuid.NewV5(uuidNamespace, str), nil
 	}
 	return u, nil
 }

component/dialer/dialer.go

@@ -2,25 +2,26 @@ package dialer
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/Dreamacro/clash/component/resolver"
+
+	"go.uber.org/atomic"
 )
 
-type dialFunc func(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error)
-
 var (
-	dialMux                      sync.Mutex
-	actualSingleStackDialContext = serialSingleStackDialContext
-	actualDualStackDialContext   = serialDualStackDialContext
-	tcpConcurrent                = false
-	fallbackTimeout              = 300 * time.Millisecond
+	dialMux                    sync.Mutex
+	actualSingleDialContext    = singleDialContext
+	actualDualStackDialContext = dualStackDialContext
+	tcpConcurrent              = false
+	DisableIPv6                = false
+	ErrorInvalidedNetworkStack = errors.New("invalided network stack")
+	ErrorDisableIPv6           = errors.New("IPv6 is disabled, dialer cancel")
 )
 
 func applyOptions(options ...Option) *option {
@@ -53,16 +54,11 @@ func DialContext(ctx context.Context, network, address string, options ...Option
 		network = fmt.Sprintf("%s%d", network, opt.network)
 	}
 
-	ips, port, err := parseAddr(ctx, network, address, opt.resolver)
-	if err != nil {
-		return nil, err
-	}
-
 	switch network {
 	case "tcp4", "tcp6", "udp4", "udp6":
-		return actualSingleStackDialContext(ctx, network, ips, port, opt)
+		return actualSingleDialContext(ctx, network, address, opt)
 	case "tcp", "udp":
-		return actualDualStackDialContext(ctx, network, ips, port, opt)
+		return actualDualStackDialContext(ctx, network, address, opt)
 	default:
 		return nil, ErrorInvalidedNetworkStack
 	}
@@ -89,40 +85,26 @@ func ListenPacket(ctx context.Context, network, address string, options ...Optio
 	return lc.ListenPacket(ctx, network, address)
 }
 
-func SetTcpConcurrent(concurrent bool) {
+func SetDial(concurrent bool) {
 	dialMux.Lock()
-	defer dialMux.Unlock()
 	tcpConcurrent = concurrent
 	if concurrent {
-		actualSingleStackDialContext = concurrentSingleStackDialContext
+		actualSingleDialContext = concurrentSingleDialContext
 		actualDualStackDialContext = concurrentDualStackDialContext
 	} else {
-		actualSingleStackDialContext = serialSingleStackDialContext
-		actualDualStackDialContext = serialDualStackDialContext
+		actualSingleDialContext = singleDialContext
+		actualDualStackDialContext = dualStackDialContext
 	}
+
+	dialMux.Unlock()
 }
 
-func GetTcpConcurrent() bool {
-	dialMux.Lock()
-	defer dialMux.Unlock()
+func GetDial() bool {
 	return tcpConcurrent
 }
 
 func dialContext(ctx context.Context, network string, destination netip.Addr, port string, opt *option) (net.Conn, error) {
-	address := net.JoinHostPort(destination.String(), port)
-
-	netDialer := opt.netDialer
-	switch netDialer.(type) {
-	case nil:
-		netDialer = &net.Dialer{}
-	case *net.Dialer:
-		_netDialer := *netDialer.(*net.Dialer)
-		netDialer = &_netDialer // make a copy
-	default:
-		return netDialer.DialContext(ctx, network, address)
-	}
-
-	dialer := netDialer.(*net.Dialer)
+	dialer := &net.Dialer{}
 	if opt.interfaceName != "" {
 		if err := bindIfaceToDialer(opt.interfaceName, dialer, network, destination); err != nil {
 			return nil, err
@@ -131,213 +113,316 @@ func dialContext(ctx context.Context, network string, destination netip.Addr, po
 	if opt.routingMark != 0 {
 		bindMarkToDialer(opt.routingMark, dialer, network, destination)
 	}
+
+	if DisableIPv6 && destination.Is6() {
+		return nil, ErrorDisableIPv6
+	}
+
+	address := net.JoinHostPort(destination.String(), port)
 	if opt.tfo {
 		return dialTFO(ctx, *dialer, network, address)
 	}
 	return dialer.DialContext(ctx, network, address)
 }
 
-func serialSingleStackDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	return serialDialContext(ctx, network, ips, port, opt)
-}
-
-func serialDualStackDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	return dualStackDialContext(ctx, serialDialContext, network, ips, port, opt)
-}
-
-func concurrentSingleStackDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	return parallelDialContext(ctx, network, ips, port, opt)
-}
-
-func concurrentDualStackDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	if opt.prefer != 4 && opt.prefer != 6 {
-		return parallelDialContext(ctx, network, ips, port, opt)
+func singleDialContext(ctx context.Context, network string, address string, opt *option) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
 	}
-	return dualStackDialContext(ctx, parallelDialContext, network, ips, port, opt)
-}
 
-func dualStackDialContext(ctx context.Context, dialFn dialFunc, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	ipv4s, ipv6s := sortationAddr(ips)
-	preferIPVersion := opt.prefer
-
-	fallbackTicker := time.NewTicker(fallbackTimeout)
-	defer fallbackTicker.Stop()
-	results := make(chan dialResult)
-	returned := make(chan struct{})
-	defer close(returned)
-	racer := func(ips []netip.Addr, isPrimary bool) {
-		result := dialResult{isPrimary: isPrimary}
-		defer func() {
-			select {
-			case results <- result:
-			case <-returned:
-				if result.Conn != nil && result.error == nil {
-					_ = result.Conn.Close()
-				}
-			}
-		}()
-		result.Conn, result.error = dialFn(ctx, network, ips, port, opt)
-	}
-	go racer(ipv4s, preferIPVersion != 6)
-	go racer(ipv6s, preferIPVersion != 4)
-	var fallback dialResult
-	var errs []error
-	for i := 0; i < 2; {
-		select {
-		case <-fallbackTicker.C:
-			if fallback.error == nil && fallback.Conn != nil {
-				return fallback.Conn, nil
-			}
-		case res := <-results:
-			i++
-			if res.error == nil {
-				if res.isPrimary {
-					return res.Conn, nil
-				}
-				fallback = res
-			} else {
-				if res.isPrimary {
-					errs = append([]error{fmt.Errorf("connect failed: %w", res.error)}, errs...)
-				} else {
-					errs = append(errs, fmt.Errorf("connect failed: %w", res.error))
-				}
-			}
+	var ip netip.Addr
+	switch network {
+	case "tcp4", "udp4":
+		if opt.resolver == nil {
+			ip, err = resolver.ResolveIPv4ProxyServerHost(ctx, host)
+		} else {
+			ip, err = resolver.ResolveIPv4WithResolver(ctx, host, opt.resolver)
+		}
+	default:
+		if opt.resolver == nil {
+			ip, err = resolver.ResolveIPv6ProxyServerHost(ctx, host)
+		} else {
+			ip, err = resolver.ResolveIPv6WithResolver(ctx, host, opt.resolver)
 		}
 	}
-	if fallback.error == nil && fallback.Conn != nil {
-		return fallback.Conn, nil
+	if err != nil {
+		err = fmt.Errorf("dns resolve failed:%w", err)
+		return nil, err
 	}
-	return nil, errorsJoin(errs...)
+
+	return dialContext(ctx, network, ip, port, opt)
 }
 
-func parallelDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	if len(ips) == 0 {
-		return nil, ErrorNoIpAddress
+func dualStackDialContext(ctx context.Context, network, address string, opt *option) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
 	}
-	results := make(chan dialResult)
+
 	returned := make(chan struct{})
 	defer close(returned)
-	racer := func(ctx context.Context, ip netip.Addr) {
-		result := dialResult{isPrimary: true, ip: ip}
+
+	type dialResult struct {
+		net.Conn
+		error
+		resolved bool
+		ipv6     bool
+		done     bool
+	}
+	results := make(chan dialResult)
+	var primary, fallback dialResult
+
+	startRacer := func(ctx context.Context, network, host string, r resolver.Resolver, ipv6 bool) {
+		result := dialResult{ipv6: ipv6, done: true}
 		defer func() {
 			select {
 			case results <- result:
 			case <-returned:
-				if result.Conn != nil && result.error == nil {
+				if result.Conn != nil {
 					_ = result.Conn.Close()
 				}
 			}
 		}()
+
+		var ip netip.Addr
+		if ipv6 {
+			if r == nil {
+				ip, result.error = resolver.ResolveIPv6ProxyServerHost(ctx, host)
+			} else {
+				ip, result.error = resolver.ResolveIPv6WithResolver(ctx, host, r)
+			}
+		} else {
+			if r == nil {
+				ip, result.error = resolver.ResolveIPv4ProxyServerHost(ctx, host)
+			} else {
+				ip, result.error = resolver.ResolveIPv4WithResolver(ctx, host, r)
+			}
+		}
+		if result.error != nil {
+			result.error = fmt.Errorf("dns resolve failed:%w", result.error)
+			return
+		}
+		result.resolved = true
+
+		result.Conn, result.error = dialContext(ctx, network, ip, port, opt)
+	}
+
+	go startRacer(ctx, network+"4", host, opt.resolver, false)
+	go startRacer(ctx, network+"6", host, opt.resolver, true)
+
+	count := 2
+	for i := 0; i < count; i++ {
+		select {
+		case res := <-results:
+			if res.error == nil {
+				return res.Conn, nil
+			}
+
+			if !res.ipv6 {
+				primary = res
+			} else {
+				fallback = res
+			}
+
+			if primary.done && fallback.done {
+				if primary.resolved {
+					return nil, primary.error
+				} else if fallback.resolved {
+					return nil, fallback.error
+				} else {
+					return nil, primary.error
+				}
+			}
+		case <-ctx.Done():
+			err = ctx.Err()
+			break
+		}
+	}
+
+	if err == nil {
+		err = fmt.Errorf("dual stack dial failed")
+	} else {
+		err = fmt.Errorf("dual stack dial failed:%w", err)
+	}
+	return nil, err
+}
+
+func concurrentDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
+	returned := make(chan struct{})
+	defer close(returned)
+
+	type dialResult struct {
+		ip netip.Addr
+		net.Conn
+		error
+		isPrimary bool
+		done      bool
+	}
+
+	preferCount := atomic.NewInt32(0)
+	results := make(chan dialResult)
+	tcpRacer := func(ctx context.Context, ip netip.Addr) {
+		result := dialResult{ip: ip, done: true}
+
+		defer func() {
+			select {
+			case results <- result:
+			case <-returned:
+				if result.Conn != nil {
+					_ = result.Conn.Close()
+				}
+			}
+		}()
+		if strings.Contains(network, "tcp") {
+			network = "tcp"
+		} else {
+			network = "udp"
+		}
+
+		if ip.Is6() {
+			network += "6"
+			if opt.prefer != 4 {
+				result.isPrimary = true
+			}
+		}
+
+		if ip.Is4() {
+			network += "4"
+			if opt.prefer != 6 {
+				result.isPrimary = true
+			}
+		}
+
+		if result.isPrimary {
+			preferCount.Add(1)
+		}
+
 		result.Conn, result.error = dialContext(ctx, network, ip, port, opt)
 	}
 
 	for _, ip := range ips {
-		go racer(ctx, ip)
-	}
-	var errs []error
-	for i := 0; i < len(ips); i++ {
-		res := <-results
-		if res.error == nil {
-			return res.Conn, nil
-		}
-		errs = append(errs, res.error)
+		go tcpRacer(ctx, ip)
 	}
 
-	if len(errs) > 0 {
-		return nil, errorsJoin(errs...)
-	}
-	return nil, os.ErrDeadlineExceeded
-}
-
-func serialDialContext(ctx context.Context, network string, ips []netip.Addr, port string, opt *option) (net.Conn, error) {
-	if len(ips) == 0 {
-		return nil, ErrorNoIpAddress
-	}
-	var errs []error
-	for _, ip := range ips {
-		if conn, err := dialContext(ctx, network, ip, port, opt); err == nil {
-			return conn, nil
-		} else {
-			errs = append(errs, err)
+	connCount := len(ips)
+	var fallback dialResult
+	var primaryError error
+	var finalError error
+	for i := 0; i < connCount; i++ {
+		select {
+		case res := <-results:
+			if res.error == nil {
+				if res.isPrimary {
+					return res.Conn, nil
+				} else {
+					if !fallback.done || fallback.error != nil {
+						fallback = res
+					}
+				}
+			} else {
+				if res.isPrimary {
+					primaryError = res.error
+					preferCount.Add(-1)
+					if preferCount.Load() == 0 && fallback.done && fallback.error == nil {
+						return fallback.Conn, nil
+					}
+				}
+			}
+		case <-ctx.Done():
+			if fallback.done && fallback.error == nil {
+				return fallback.Conn, nil
+			}
+			finalError = ctx.Err()
+			break
 		}
 	}
-	return nil, errorsJoin(errs...)
+
+	if fallback.done && fallback.error == nil {
+		return fallback.Conn, nil
+	}
+
+	if primaryError != nil {
+		return nil, primaryError
+	}
+
+	if fallback.error != nil {
+		return nil, fallback.error
+	}
+
+	if finalError == nil {
+		finalError = fmt.Errorf("all ips %v tcp shake hands failed", ips)
+	} else {
+		finalError = fmt.Errorf("concurrent dial failed:%w", finalError)
+	}
+
+	return nil, finalError
 }
 
-type dialResult struct {
-	ip netip.Addr
-	net.Conn
-	error
-	isPrimary bool
-}
-
-func parseAddr(ctx context.Context, network, address string, preferResolver resolver.Resolver) ([]netip.Addr, string, error) {
+func concurrentSingleDialContext(ctx context.Context, network string, address string, opt *option) (net.Conn, error) {
 	host, port, err := net.SplitHostPort(address)
 	if err != nil {
-		return nil, "-1", err
+		return nil, err
 	}
 
 	var ips []netip.Addr
 	switch network {
 	case "tcp4", "udp4":
-		if preferResolver == nil {
+		if opt.resolver == nil {
 			ips, err = resolver.LookupIPv4ProxyServerHost(ctx, host)
 		} else {
-			ips, err = resolver.LookupIPv4WithResolver(ctx, host, preferResolver)
-		}
-	case "tcp6", "udp6":
-		if preferResolver == nil {
-			ips, err = resolver.LookupIPv6ProxyServerHost(ctx, host)
-		} else {
-			ips, err = resolver.LookupIPv6WithResolver(ctx, host, preferResolver)
+			ips, err = resolver.LookupIPv4WithResolver(ctx, host, opt.resolver)
 		}
 	default:
-		if preferResolver == nil {
-			ips, err = resolver.LookupIPProxyServerHost(ctx, host)
+		if opt.resolver == nil {
+			ips, err = resolver.LookupIPv6ProxyServerHost(ctx, host)
 		} else {
-			ips, err = resolver.LookupIPWithResolver(ctx, host, preferResolver)
+			ips, err = resolver.LookupIPv6WithResolver(ctx, host, opt.resolver)
 		}
 	}
+
 	if err != nil {
-		return nil, "-1", fmt.Errorf("dns resolve failed: %w", err)
+		err = fmt.Errorf("dns resolve failed:%w", err)
+		return nil, err
 	}
-	for i, ip := range ips {
-		if ip.Is4In6() {
-			ips[i] = ip.Unmap()
-		}
-	}
-	return ips, port, nil
+
+	return concurrentDialContext(ctx, network, ips, port, opt)
 }
 
-func sortationAddr(ips []netip.Addr) (ipv4s, ipv6s []netip.Addr) {
-	for _, v := range ips {
-		if v.Is4() { // 4in6 parse was in parseAddr
-			ipv4s = append(ipv4s, v)
-		} else {
-			ipv6s = append(ipv6s, v)
-		}
+func concurrentDualStackDialContext(ctx context.Context, network, address string, opt *option) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
 	}
-	return
+
+	var ips []netip.Addr
+	if opt.resolver != nil {
+		ips, err = resolver.LookupIPWithResolver(ctx, host, opt.resolver)
+	} else {
+		ips, err = resolver.LookupIPProxyServerHost(ctx, host)
+	}
+
+	if err != nil {
+		err = fmt.Errorf("dns resolve failed:%w", err)
+		return nil, err
+	}
+
+	return concurrentDialContext(ctx, network, ips, port, opt)
 }
 
 type Dialer struct {
-	opt option
+	Opt option
 }
 
 func (d Dialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	return DialContext(ctx, network, address, WithOption(d.opt))
+	return DialContext(ctx, network, address, WithOption(d.Opt))
 }
 
 func (d Dialer) ListenPacket(ctx context.Context, network, address string, rAddrPort netip.AddrPort) (net.PacketConn, error) {
-	opt := WithOption(d.opt)
-	if rAddrPort.Addr().Unmap().IsLoopback() {
-		// avoid "The requested address is not valid in its context."
-		opt = WithInterface("")
-	}
-	return ListenPacket(ctx, ParseNetwork(network, rAddrPort.Addr()), address, opt)
+	return ListenPacket(ctx, ParseNetwork(network, rAddrPort.Addr()), address, WithOption(d.Opt))
 }
 
 func NewDialer(options ...Option) Dialer {
 	opt := applyOptions(options...)
-	return Dialer{opt: *opt}
+	return Dialer{Opt: *opt}
 }

component/dialer/error.go

@@ -1,18 +0,0 @@
-package dialer
-
-import (
-	"errors"
-
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-var (
-	ErrorNoIpAddress           = errors.New("no ip address")
-	ErrorInvalidedNetworkStack = errors.New("invalided network stack")
-)
-
-func errorsJoin(errs ...error) error {
-	// compatibility with golang<1.20
-	// maybe use errors.Join(errs...) is better after we drop the old version's support
-	return E.Errors(errs...)
-}

component/dialer/options.go

@@ -1,9 +1,6 @@
 package dialer
 
 import (
-	"context"
-	"net"
-
 	"github.com/Dreamacro/clash/component/resolver"
 
 	"go.uber.org/atomic"
@@ -15,10 +12,6 @@ var (
 	DefaultRoutingMark = atomic.NewInt32(0)
 )
 
-type NetDialer interface {
-	DialContext(ctx context.Context, network, address string) (net.Conn, error)
-}
-
 type option struct {
 	interfaceName string
 	addrReuse     bool
@@ -27,7 +20,6 @@ type option struct {
 	prefer        int
 	tfo           bool
 	resolver      resolver.Resolver
-	netDialer     NetDialer
 }
 
 type Option func(opt *option)
@@ -84,12 +76,6 @@ func WithTFO(tfo bool) Option {
 	}
 }
 
-func WithNetDialer(netDialer NetDialer) Option {
-	return func(opt *option) {
-		opt.netDialer = netDialer
-	}
-}
-
 func WithOption(o option) Option {
 	return func(opt *option) {
 		*opt = o

component/dialer/tfo.go

@@ -105,10 +105,6 @@ func (c *tfoConn) Upstream() any {
 	return c.Conn
 }
 
-func (c *tfoConn) NeedHandshake() bool {
-	return c.Conn == nil
-}
-
 func dialTFO(ctx context.Context, netDialer net.Dialer, network, address string) (net.Conn, error) {
 	ctx, cancel := context.WithCancel(ctx)
 	dialer := tfo.Dialer{Dialer: netDialer, DisableTFO: false}

component/resolver/host.go

@@ -1,112 +0,0 @@
-package resolver
-
-import (
-	"errors"
-	"math/rand"
-	"net/netip"
-	"strings"
-
-	"github.com/Dreamacro/clash/common/utils"
-	"github.com/Dreamacro/clash/component/trie"
-)
-
-type Hosts struct {
-	*trie.DomainTrie[HostValue]
-}
-
-func NewHosts(hosts *trie.DomainTrie[HostValue]) Hosts {
-	return Hosts{
-		hosts,
-	}
-}
-
-func (h *Hosts) Search(domain string, isDomain bool) (*HostValue, bool) {
-	value := h.DomainTrie.Search(domain)
-	if value == nil {
-		return nil, false
-	}
-	hostValue := value.Data()
-	for {
-		if isDomain && hostValue.IsDomain {
-			return &hostValue, true
-		} else {
-			if node := h.DomainTrie.Search(hostValue.Domain); node != nil {
-				hostValue = node.Data()
-			} else {
-				break
-			}
-		}
-	}
-	if isDomain == hostValue.IsDomain {
-		return &hostValue, true
-	}
-	return &hostValue, false
-}
-
-type HostValue struct {
-	IsDomain bool
-	IPs      []netip.Addr
-	Domain   string
-}
-
-func NewHostValue(value any) (HostValue, error) {
-	isDomain := true
-	ips := make([]netip.Addr, 0)
-	domain := ""
-	if valueArr, err := utils.ToStringSlice(value); err != nil {
-		return HostValue{}, err
-	} else {
-		if len(valueArr) > 1 {
-			isDomain = false
-			for _, str := range valueArr {
-				if ip, err := netip.ParseAddr(str); err == nil {
-					ips = append(ips, ip)
-				} else {
-					return HostValue{}, err
-				}
-			}
-		} else if len(valueArr) == 1 {
-			host := valueArr[0]
-			if ip, err := netip.ParseAddr(host); err == nil {
-				ips = append(ips, ip)
-				isDomain = false
-			} else {
-				domain = host
-			}
-		}
-	}
-	if isDomain {
-		return NewHostValueByDomain(domain)
-	} else {
-		return NewHostValueByIPs(ips)
-	}
-}
-
-func NewHostValueByIPs(ips []netip.Addr) (HostValue, error) {
-	if len(ips) == 0 {
-		return HostValue{}, errors.New("ip list is empty")
-	}
-	return HostValue{
-		IsDomain: false,
-		IPs:      ips,
-	}, nil
-}
-
-func NewHostValueByDomain(domain string) (HostValue, error) {
-	domain = strings.Trim(domain, ".")
-	item := strings.Split(domain, ".")
-	if len(item) < 2 {
-		return HostValue{}, errors.New("invaild domain")
-	}
-	return HostValue{
-		IsDomain: true,
-		Domain:   domain,
-	}, nil
-}
-
-func (hv HostValue) RandIP() (netip.Addr, error) {
-	if hv.IsDomain {
-		return netip.Addr{}, errors.New("value type is error")
-	}
-	return hv.IPs[rand.Intn(len(hv.IPs)-1)], nil
-}

component/resolver/resolver.go

@@ -4,16 +4,15 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net"
 	"net/netip"
 	"strings"
 	"time"
 
-	"github.com/Dreamacro/clash/common/utils"
 	"github.com/Dreamacro/clash/component/trie"
 
 	"github.com/miekg/dns"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 var (
@@ -28,7 +27,7 @@ var (
 	DisableIPv6 = true
 
 	// DefaultHosts aim to resolve hosts
-	DefaultHosts = NewHosts(trie.New[HostValue]())
+	DefaultHosts = trie.New[netip.Addr]()
 
 	// DefaultDNSTimeout defined the default dns request timeout
 	DefaultDNSTimeout = time.Second * 5
@@ -52,11 +51,9 @@ type Resolver interface {
 
 // LookupIPv4WithResolver same as LookupIPv4, but with a resolver
 func LookupIPv4WithResolver(ctx context.Context, host string, r Resolver) ([]netip.Addr, error) {
-	if node, ok := DefaultHosts.Search(host, false); ok {
-		if addrs := utils.Filter(node.IPs, func(ip netip.Addr) bool {
-			return ip.Is4()
-		}); len(addrs) > 0 {
-			return addrs, nil
+	if node := DefaultHosts.Search(host); node != nil {
+		if ip := node.Data(); ip.Is4() {
+			return []netip.Addr{node.Data()}, nil
 		}
 	}
 
@@ -72,6 +69,10 @@ func LookupIPv4WithResolver(ctx context.Context, host string, r Resolver) ([]net
 		return r.LookupIPv4(ctx, host)
 	}
 
+	if DefaultResolver != nil {
+		return DefaultResolver.LookupIPv4(ctx, host)
+	}
+
 	ipAddrs, err := net.DefaultResolver.LookupNetIP(ctx, "ip4", host)
 	if err != nil {
 		return nil, err
@@ -95,7 +96,7 @@ func ResolveIPv4WithResolver(ctx context.Context, host string, r Resolver) (neti
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 // ResolveIPv4 with a host, return ipv4
@@ -109,11 +110,9 @@ func LookupIPv6WithResolver(ctx context.Context, host string, r Resolver) ([]net
 		return nil, ErrIPv6Disabled
 	}
 
-	if node, ok := DefaultHosts.Search(host, false); ok {
-		if addrs := utils.Filter(node.IPs, func(ip netip.Addr) bool {
-			return ip.Is6()
-		}); len(addrs) > 0 {
-			return addrs, nil
+	if node := DefaultHosts.Search(host); node != nil {
+		if ip := node.Data(); ip.Is6() {
+			return []netip.Addr{ip}, nil
 		}
 	}
 
@@ -127,6 +126,9 @@ func LookupIPv6WithResolver(ctx context.Context, host string, r Resolver) ([]net
 	if r != nil {
 		return r.LookupIPv6(ctx, host)
 	}
+	if DefaultResolver != nil {
+		return DefaultResolver.LookupIPv6(ctx, host)
+	}
 
 	ipAddrs, err := net.DefaultResolver.LookupNetIP(ctx, "ip6", host)
 	if err != nil {
@@ -151,7 +153,7 @@ func ResolveIPv6WithResolver(ctx context.Context, host string, r Resolver) (neti
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 func ResolveIPv6(ctx context.Context, host string) (netip.Addr, error) {
@@ -160,8 +162,8 @@ func ResolveIPv6(ctx context.Context, host string) (netip.Addr, error) {
 
 // LookupIPWithResolver same as LookupIP, but with a resolver
 func LookupIPWithResolver(ctx context.Context, host string, r Resolver) ([]netip.Addr, error) {
-	if node, ok := DefaultHosts.Search(host, false); ok {
-		return node.IPs, nil
+	if node := DefaultHosts.Search(host); node != nil {
+		return []netip.Addr{node.Data()}, nil
 	}
 
 	if r != nil {
@@ -170,7 +172,7 @@ func LookupIPWithResolver(ctx context.Context, host string, r Resolver) ([]netip
 		}
 		return r.LookupIP(ctx, host)
 	} else if DisableIPv6 {
-		return LookupIPv4WithResolver(ctx, host, r)
+		return LookupIPv4(ctx, host)
 	}
 
 	if ip, err := netip.ParseAddr(host); err == nil {
@@ -200,7 +202,7 @@ func ResolveIPWithResolver(ctx context.Context, host string, r Resolver) (netip.
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 // ResolveIP with a host, return ip

component/tls/config.go

@@ -11,30 +11,31 @@ import (
 	"strings"
 	"sync"
 
+	CN "github.com/Dreamacro/clash/common/net"
+
 	xtls "github.com/xtls/go"
 )
 
-var trustCert, _ = x509.SystemCertPool()
+var tlsCertificates = make([]tls.Certificate, 0)
 
 var mutex sync.RWMutex
 var errNotMacth error = errors.New("certificate fingerprints do not match")
 
-func AddCertificate(certificate string) error {
+func AddCertificate(privateKey, certificate string) error {
 	mutex.Lock()
 	defer mutex.Unlock()
-	if certificate == "" {
-		return fmt.Errorf("certificate is empty")
-	}
-	if ok := trustCert.AppendCertsFromPEM([]byte(certificate)); !ok {
-		return fmt.Errorf("add certificate failed")
+	if cert, err := CN.ParseCert(certificate, privateKey); err != nil {
+		return err
+	} else {
+		tlsCertificates = append(tlsCertificates, cert)
 	}
 	return nil
 }
 
-func ResetCertificate() {
-	mutex.Lock()
-	defer mutex.Unlock()
-	trustCert, _ = x509.SystemCertPool()
+func GetCertificates() []tls.Certificate {
+	mutex.RLock()
+	defer mutex.RUnlock()
+	return tlsCertificates
 }
 
 func verifyFingerprint(fingerprint *[32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
@@ -86,10 +87,10 @@ func GetSpecifiedFingerprintTLSConfig(tlsConfig *tls.Config, fingerprint string)
 func GetGlobalTLSConfig(tlsConfig *tls.Config) *tls.Config {
 	if tlsConfig == nil {
 		return &tls.Config{
-			RootCAs: trustCert,
+			Certificates: tlsCertificates,
 		}
 	}
-	tlsConfig.RootCAs = trustCert
+	tlsConfig.Certificates = append(tlsConfig.Certificates, tlsCertificates...)
 	return tlsConfig
 }
 
@@ -106,12 +107,29 @@ func GetSpecifiedFingerprintXTLSConfig(tlsConfig *xtls.Config, fingerprint strin
 }
 
 func GetGlobalXTLSConfig(tlsConfig *xtls.Config) *xtls.Config {
+	xtlsCerts := make([]xtls.Certificate, len(tlsCertificates))
+	for _, cert := range tlsCertificates {
+		tlsSsaList := make([]xtls.SignatureScheme, len(cert.SupportedSignatureAlgorithms))
+		for _, ssa := range cert.SupportedSignatureAlgorithms {
+			tlsSsa := xtls.SignatureScheme(ssa)
+			tlsSsaList = append(tlsSsaList, tlsSsa)
+		}
+		xtlsCert := xtls.Certificate{
+			Certificate:                  cert.Certificate,
+			PrivateKey:                   cert.PrivateKey,
+			OCSPStaple:                   cert.OCSPStaple,
+			SignedCertificateTimestamps:  cert.SignedCertificateTimestamps,
+			Leaf:                         cert.Leaf,
+			SupportedSignatureAlgorithms: tlsSsaList,
+		}
+		xtlsCerts = append(xtlsCerts, xtlsCert)
+	}
 	if tlsConfig == nil {
 		return &xtls.Config{
-			RootCAs: trustCert,
+			Certificates: xtlsCerts,
 		}
 	}
 
-	tlsConfig.RootCAs = trustCert
+	tlsConfig.Certificates = xtlsCerts
 	return tlsConfig
 }

component/tls/reality.go

@@ -1,169 +0,0 @@
-package tls
-
-import (
-	"bytes"
-	"context"
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/ed25519"
-	"crypto/hmac"
-	"crypto/sha256"
-	"crypto/sha512"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/binary"
-	"errors"
-	"net"
-	"net/http"
-	"reflect"
-	"strings"
-	"time"
-	"unsafe"
-
-	"github.com/Dreamacro/clash/common/utils"
-	"github.com/Dreamacro/clash/log"
-
-	utls "github.com/sagernet/utls"
-	"github.com/zhangyunhao116/fastrand"
-	"golang.org/x/crypto/curve25519"
-	"golang.org/x/crypto/hkdf"
-	"golang.org/x/net/http2"
-)
-
-const RealityMaxShortIDLen = 8
-
-type RealityConfig struct {
-	PublicKey [curve25519.ScalarSize]byte
-	ShortID   [RealityMaxShortIDLen]byte
-}
-
-func GetRealityConn(ctx context.Context, conn net.Conn, ClientFingerprint string, tlsConfig *tls.Config, realityConfig *RealityConfig) (net.Conn, error) {
-	if fingerprint, exists := GetFingerprint(ClientFingerprint); exists {
-		verifier := &realityVerifier{
-			serverName: tlsConfig.ServerName,
-		}
-		uConfig := &utls.Config{
-			ServerName:             tlsConfig.ServerName,
-			NextProtos:             tlsConfig.NextProtos,
-			InsecureSkipVerify:     true,
-			SessionTicketsDisabled: true,
-			VerifyPeerCertificate:  verifier.VerifyPeerCertificate,
-		}
-		clientID := utls.ClientHelloID{
-			Client:  fingerprint.Client,
-			Version: fingerprint.Version,
-			Seed:    fingerprint.Seed,
-		}
-		uConn := utls.UClient(conn, uConfig, clientID)
-		verifier.UConn = uConn
-		err := uConn.BuildHandshakeState()
-		if err != nil {
-			return nil, err
-		}
-
-		hello := uConn.HandshakeState.Hello
-		hello.SessionId = make([]byte, 32)
-		copy(hello.Raw[39:], hello.SessionId)
-
-		var nowTime time.Time
-		if uConfig.Time != nil {
-			nowTime = uConfig.Time()
-		} else {
-			nowTime = time.Now()
-		}
-		binary.BigEndian.PutUint64(hello.SessionId, uint64(nowTime.Unix()))
-
-		hello.SessionId[0] = 1
-		hello.SessionId[1] = 7
-		hello.SessionId[2] = 5
-		copy(hello.SessionId[8:], realityConfig.ShortID[:])
-
-		//log.Debugln("REALITY hello.sessionId[:16]: %v", hello.SessionId[:16])
-
-		authKey := uConn.HandshakeState.State13.EcdheParams.SharedKey(realityConfig.PublicKey[:])
-		if authKey == nil {
-			return nil, errors.New("nil auth_key")
-		}
-		verifier.authKey = authKey
-		_, err = hkdf.New(sha256.New, authKey, hello.Random[:20], []byte("REALITY")).Read(authKey)
-		if err != nil {
-			return nil, err
-		}
-		aesBlock, _ := aes.NewCipher(authKey)
-		aesGcmCipher, _ := cipher.NewGCM(aesBlock)
-		aesGcmCipher.Seal(hello.SessionId[:0], hello.Random[20:], hello.SessionId[:16], hello.Raw)
-		copy(hello.Raw[39:], hello.SessionId)
-		//log.Debugln("REALITY hello.sessionId: %v", hello.SessionId)
-		//log.Debugln("REALITY uConn.AuthKey: %v", authKey)
-
-		err = uConn.HandshakeContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		log.Debugln("REALITY Authentication: %v", verifier.verified)
-
-		if !verifier.verified {
-			go realityClientFallback(uConn, uConfig.ServerName, clientID)
-			return nil, errors.New("REALITY authentication failed")
-		}
-
-		return uConn, nil
-	}
-	return nil, errors.New("unknown uTLS fingerprint")
-}
-
-func realityClientFallback(uConn net.Conn, serverName string, fingerprint utls.ClientHelloID) {
-	defer uConn.Close()
-	client := http.Client{
-		Transport: &http2.Transport{
-			DialTLSContext: func(ctx context.Context, network, addr string, config *tls.Config) (net.Conn, error) {
-				return uConn, nil
-			},
-		},
-	}
-	request, _ := http.NewRequest("GET", "https://"+serverName, nil)
-	request.Header.Set("User-Agent", fingerprint.Client)
-	request.AddCookie(&http.Cookie{Name: "padding", Value: strings.Repeat("0", fastrand.Intn(32)+30)})
-	response, err := client.Do(request)
-	if err != nil {
-		return
-	}
-	//_, _ = io.Copy(io.Discard, response.Body)
-	time.Sleep(time.Duration(5 + fastrand.Int63n(10)))
-	response.Body.Close()
-	client.CloseIdleConnections()
-}
-
-type realityVerifier struct {
-	*utls.UConn
-	serverName string
-	authKey    []byte
-	verified   bool
-}
-
-var pOffset = utils.MustOK(reflect.TypeOf((*utls.UConn)(nil)).Elem().FieldByName("peerCertificates")).Offset
-
-func (c *realityVerifier) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
-	//p, _ := reflect.TypeOf(c.Conn).Elem().FieldByName("peerCertificates")
-	certs := *(*[]*x509.Certificate)(unsafe.Pointer(uintptr(unsafe.Pointer(c.Conn)) + pOffset))
-	if pub, ok := certs[0].PublicKey.(ed25519.PublicKey); ok {
-		h := hmac.New(sha512.New, c.authKey)
-		h.Write(pub)
-		if bytes.Equal(h.Sum(nil), certs[0].Signature) {
-			c.verified = true
-			return nil
-		}
-	}
-	opts := x509.VerifyOptions{
-		DNSName:       c.serverName,
-		Intermediates: x509.NewCertPool(),
-	}
-	for _, cert := range certs[1:] {
-		opts.Intermediates.AddCert(cert)
-	}
-	if _, err := certs[0].Verify(opts); err != nil {
-		return err
-	}
-	return nil
-}

component/tls/utls.go

@@ -67,29 +67,13 @@ var Fingerprints = map[string]UClientHelloID{
 	"firefox":    {&utls.HelloFirefox_Auto},
 	"safari":     {&utls.HelloSafari_Auto},
 	"ios":        {&utls.HelloIOS_Auto},
-	"android":    {&utls.HelloAndroid_11_OkHttp},
-	"edge":       {&utls.HelloEdge_Auto},
-	"360":        {&utls.Hello360_Auto},
-	"qq":         {&utls.HelloQQ_Auto},
-	"random":     {nil},
-	"randomized": {nil},
-}
-
-func init() {
-	weights := utls.DefaultWeights
-	weights.TLSVersMax_Set_VersionTLS13 = 1
-	weights.FirstKeyShare_Set_CurveP256 = 0
-	randomized := utls.HelloRandomized
-	randomized.Seed, _ = utls.NewPRNGSeed()
-	randomized.Weights = &weights
-	Fingerprints["randomized"] = UClientHelloID{&randomized}
+	"randomized": {&utls.HelloRandomized},
 }
 
 func copyConfig(c *tls.Config) *utls.Config {
 	return &utls.Config{
 		RootCAs:               c.RootCAs,
 		ServerName:            c.ServerName,
-		NextProtos:            c.NextProtos,
 		InsecureSkipVerify:    c.InsecureSkipVerify,
 		VerifyPeerCertificate: c.VerifyPeerCertificate,
 	}

config/config.go

@@ -9,6 +9,7 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
+	"reflect"
 	"runtime"
 	"strconv"
 	"strings"
@@ -25,7 +26,6 @@ import (
 	"github.com/Dreamacro/clash/component/geodata"
 	"github.com/Dreamacro/clash/component/geodata/router"
 	P "github.com/Dreamacro/clash/component/process"
-	"github.com/Dreamacro/clash/component/resolver"
 	SNIFF "github.com/Dreamacro/clash/component/sniffer"
 	tlsC "github.com/Dreamacro/clash/component/tls"
 	"github.com/Dreamacro/clash/component/trie"
@@ -92,7 +92,6 @@ type DNS struct {
 	Enable                bool             `yaml:"enable"`
 	PreferH3              bool             `yaml:"prefer-h3"`
 	IPv6                  bool             `yaml:"ipv6"`
-	IPv6Timeout           uint             `yaml:"ipv6-timeout"`
 	NameServer            []dns.NameServer `yaml:"nameserver"`
 	Fallback              []dns.NameServer `yaml:"fallback"`
 	FallbackFilter        FallbackFilter   `yaml:"fallback-filter"`
@@ -100,7 +99,7 @@ type DNS struct {
 	EnhancedMode          C.DNSMode        `yaml:"enhanced-mode"`
 	DefaultNameserver     []dns.NameServer `yaml:"default-nameserver"`
 	FakeIPRange           *fakeip.Pool
-	Hosts                 *trie.DomainTrie[resolver.HostValue]
+	Hosts                 *trie.DomainTrie[netip.Addr]
 	NameServerPolicy      map[string][]dns.NameServer
 	ProxyServerNameserver []dns.NameServer
 }
@@ -121,9 +120,13 @@ type Profile struct {
 }
 
 type TLS struct {
-	Certificate     string   `yaml:"certificate"`
-	PrivateKey      string   `yaml:"private-key"`
-	CustomTrustCert []string `yaml:"custom-certifactes"`
+	RawCert         `yaml:",inline"`
+	CustomTrustCert []RawCert `yaml:"custom-certifactes"`
+}
+
+type RawCert struct {
+	Certificate string `yaml:"certificate"`
+	PrivateKey  string `yaml:"private-key"`
 }
 
 // IPTables config
@@ -154,7 +157,7 @@ type Config struct {
 	IPTables      *IPTables
 	DNS           *DNS
 	Experimental  *Experimental
-	Hosts         *trie.DomainTrie[resolver.HostValue]
+	Hosts         *trie.DomainTrie[netip.Addr]
 	Profile       *Profile
 	Rules         []C.Rule
 	SubRules      map[string][]C.Rule
@@ -172,7 +175,6 @@ type RawDNS struct {
 	Enable                bool              `yaml:"enable"`
 	PreferH3              bool              `yaml:"prefer-h3"`
 	IPv6                  bool              `yaml:"ipv6"`
-	IPv6Timeout           uint              `yaml:"ipv6-timeout"`
 	UseHosts              bool              `yaml:"use-hosts"`
 	NameServer            []string          `yaml:"nameserver"`
 	Fallback              []string          `yaml:"fallback"`
@@ -265,7 +267,7 @@ type RawConfig struct {
 	Sniffer       RawSniffer                `yaml:"sniffer"`
 	ProxyProvider map[string]map[string]any `yaml:"proxy-providers"`
 	RuleProvider  map[string]map[string]any `yaml:"rule-providers"`
-	Hosts         map[string]any            `yaml:"hosts"`
+	Hosts         map[string]string         `yaml:"hosts"`
 	DNS           RawDNS                    `yaml:"dns"`
 	Tun           RawTun                    `yaml:"tun"`
 	TuicServer    RawTuicServer             `yaml:"tuic-server"`
@@ -339,7 +341,7 @@ func UnmarshalRawConfig(buf []byte) (*RawConfig, error) {
 		UnifiedDelay:    false,
 		Authentication:  []string{},
 		LogLevel:        log.INFO,
-		Hosts:           map[string]any{},
+		Hosts:           map[string]string{},
 		Rule:            []string{},
 		Proxy:           []map[string]any{},
 		ProxyGroup:      []map[string]any{},
@@ -379,7 +381,6 @@ func UnmarshalRawConfig(buf []byte) (*RawConfig, error) {
 			Enable:       false,
 			IPv6:         false,
 			UseHosts:     true,
-			IPv6Timeout:  100,
 			EnhancedMode: C.DNSMapping,
 			FakeIPRange:  "198.18.0.1/16",
 			FallbackFilter: RawFallbackFilter{
@@ -418,9 +419,9 @@ func UnmarshalRawConfig(buf []byte) (*RawConfig, error) {
 			StoreSelected: true,
 		},
 		GeoXUrl: RawGeoXUrl{
-			Mmdb:    "https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb",
-			GeoIp:   "https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat",
-			GeoSite: "https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat",
+			GeoIp:   "https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat",
+			Mmdb:    "https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb",
+			GeoSite: "https://ghproxy.com/https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geosite.dat",
 		},
 	}
 
@@ -446,7 +447,6 @@ func ParseRawConfig(rawCfg *RawConfig) (*Config, error) {
 	}
 	config.General = general
 
-	dialer.DefaultInterface.Store(config.General.Interface)
 	proxies, providers, err := parseProxies(rawCfg)
 	if err != nil {
 		return nil, err
@@ -827,47 +827,21 @@ func parseRules(rulesConfig []string, proxies map[string]C.Proxy, subRules map[s
 	return rules, nil
 }
 
-func parseHosts(cfg *RawConfig) (*trie.DomainTrie[resolver.HostValue], error) {
-	tree := trie.New[resolver.HostValue]()
+func parseHosts(cfg *RawConfig) (*trie.DomainTrie[netip.Addr], error) {
+	tree := trie.New[netip.Addr]()
 
 	// add default hosts
-	hostValue, _ := resolver.NewHostValueByIPs(
-		[]netip.Addr{netip.AddrFrom4([4]byte{127, 0, 0, 1})})
-	if err := tree.Insert("localhost", hostValue); err != nil {
+	if err := tree.Insert("localhost", netip.AddrFrom4([4]byte{127, 0, 0, 1})); err != nil {
 		log.Errorln("insert localhost to host error: %s", err.Error())
 	}
 
 	if len(cfg.Hosts) != 0 {
-		for domain, anyValue := range cfg.Hosts {
-			if str, ok := anyValue.(string); ok && str == "clash" {
-				if addrs, err := net.InterfaceAddrs(); err != nil {
-					log.Errorln("insert clash to host error: %s", err)
-				} else {
-					ips := make([]netip.Addr, 0)
-					for _, addr := range addrs {
-						if ipnet, ok := addr.(*net.IPNet); ok {
-							if ip, err := netip.ParseAddr(ipnet.IP.String()); err == nil {
-								ips = append(ips, ip)
-							}
-						}
-					}
-					anyValue = ips
-				}
-			}
-			value, err := resolver.NewHostValue(anyValue)
+		for domain, ipStr := range cfg.Hosts {
+			ip, err := netip.ParseAddr(ipStr)
 			if err != nil {
-				return nil, fmt.Errorf("%s is not a valid value", anyValue)
+				return nil, fmt.Errorf("%s is not a valid IP", ipStr)
 			}
-			if value.IsDomain {
-				node := tree.Search(value.Domain)
-				for node != nil && node.Data().IsDomain {
-					if node.Data().Domain == domain {
-						return nil, fmt.Errorf("%s, there is a cycle in domain name mapping", domain)
-					}
-					node = tree.Search(node.Data().Domain)
-				}
-			}
-			_ = tree.Insert(domain, value)
+			_ = tree.Insert(domain, ip)
 		}
 	}
 	tree.Optimize()
@@ -987,12 +961,24 @@ func parseNameServerPolicy(nsPolicy map[string]any, preferH3 bool) (map[string][
 	policy := map[string][]dns.NameServer{}
 
 	for domain, server := range nsPolicy {
+		var (
+			nameservers []dns.NameServer
+			err         error
+		)
 
-		servers, err := utils.ToStringSlice(server)
-		if err != nil {
-			return nil, err
+		switch reflect.TypeOf(server).Kind() {
+		case reflect.Slice, reflect.Array:
+			origin := reflect.ValueOf(server)
+			servers := make([]string, 0)
+			for i := 0; i < origin.Len(); i++ {
+				servers = append(servers, fmt.Sprintf("%v", origin.Index(i)))
+			}
+			nameservers, err = parseNameServer(servers, preferH3)
+		case reflect.String:
+			nameservers, err = parseNameServer([]string{fmt.Sprintf("%v", server)}, preferH3)
+		default:
+			return nil, errors.New("server format error, must be string or array")
 		}
-		nameservers, err := parseNameServer(servers, preferH3)
 		if err != nil {
 			return nil, err
 		}
@@ -1055,7 +1041,7 @@ func parseFallbackGeoSite(countries []string, rules []C.Rule) ([]*router.DomainM
 	return sites, nil
 }
 
-func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rules []C.Rule) (*DNS, error) {
+func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[netip.Addr], rules []C.Rule) (*DNS, error) {
 	cfg := rawCfg.DNS
 	if cfg.Enable && len(cfg.NameServer) == 0 {
 		return nil, fmt.Errorf("if DNS configuration is turned on, NameServer cannot be empty")
@@ -1065,7 +1051,6 @@ func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rul
 		Enable:       cfg.Enable,
 		Listen:       cfg.Listen,
 		PreferH3:     cfg.PreferH3,
-		IPv6Timeout:  cfg.IPv6Timeout,
 		IPv6:         cfg.IPv6,
 		EnhancedMode: cfg.EnhancedMode,
 		FallbackFilter: FallbackFilter{
@@ -1273,10 +1258,8 @@ func parseSniffer(snifferRaw RawSniffer) (*Sniffer, error) {
 			}
 		}
 	} else {
-		if sniffer.Enable {
-			// Deprecated: Use Sniff instead
-			log.Warnln("Deprecated: Use Sniff instead")
-		}
+		// Deprecated: Use Sniff instead
+		log.Warnln("Deprecated: Use Sniff instead")
 		globalPorts, err := parsePortRange(snifferRaw.Ports)
 		if err != nil {
 			return nil, err

context/conn.go

@@ -1,7 +1,6 @@
 package context
 
 import (
-	"github.com/Dreamacro/clash/common/utils"
 	"net"
 
 	N "github.com/Dreamacro/clash/common/net"
@@ -17,7 +16,7 @@ type ConnContext struct {
 }
 
 func NewConnContext(conn net.Conn, metadata *C.Metadata) *ConnContext {
-	id, _ := utils.UnsafeUUIDGenerator.NewV4()
+	id, _ := uuid.NewV4()
 
 	return &ConnContext{
 		id:       id,

context/dns.go

@@ -2,7 +2,6 @@ package context
 
 import (
 	"context"
-	"github.com/Dreamacro/clash/common/utils"
 
 	"github.com/gofrs/uuid"
 	"github.com/miekg/dns"
@@ -23,7 +22,7 @@ type DNSContext struct {
 }
 
 func NewDNSContext(ctx context.Context, msg *dns.Msg) *DNSContext {
-	id, _ := utils.UnsafeUUIDGenerator.NewV4()
+	id, _ := uuid.NewV4()
 	return &DNSContext{
 		Context: ctx,
 

context/packetconn.go

@@ -3,7 +3,6 @@ package context
 import (
 	"net"
 
-	"github.com/Dreamacro/clash/common/utils"
 	C "github.com/Dreamacro/clash/constant"
 
 	"github.com/gofrs/uuid"
@@ -16,7 +15,7 @@ type PacketConnContext struct {
 }
 
 func NewPacketConnContext(metadata *C.Metadata) *PacketConnContext {
-	id, _ := utils.UnsafeUUIDGenerator.NewV4()
+	id, _ := uuid.NewV4()
 	return &PacketConnContext{
 		id:       id,
 		metadata: metadata,

dns/client.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
+	"math/rand"
 	"net"
 	"net/netip"
 	"strings"
@@ -15,7 +16,6 @@ import (
 	"github.com/Dreamacro/clash/component/resolver"
 
 	D "github.com/miekg/dns"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 type client struct {
@@ -68,7 +68,7 @@ func (c *client) ExchangeContext(ctx context.Context, m *D.Msg) (*D.Msg, error)
 		} else if len(ips) == 0 {
 			return nil, fmt.Errorf("%w: %s", resolver.ErrIPNotFound, c.host)
 		}
-		ip = ips[fastrand.Intn(len(ips))]
+		ip = ips[rand.Intn(len(ips))]
 	}
 
 	network := "udp"

dns/middleware.go

@@ -8,7 +8,7 @@ import (
 	"github.com/Dreamacro/clash/common/cache"
 	"github.com/Dreamacro/clash/common/nnip"
 	"github.com/Dreamacro/clash/component/fakeip"
-	R "github.com/Dreamacro/clash/component/resolver"
+	"github.com/Dreamacro/clash/component/trie"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/context"
 	"github.com/Dreamacro/clash/log"
@@ -21,7 +21,7 @@ type (
 	middleware func(next handler) handler
 )
 
-func withHosts(hosts R.Hosts, mapping *cache.LruCache[netip.Addr, string]) middleware {
+func withHosts(hosts *trie.DomainTrie[netip.Addr], mapping *cache.LruCache[netip.Addr, string]) middleware {
 	return func(next handler) handler {
 		return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
 			q := r.Question[0]
@@ -31,68 +31,40 @@ func withHosts(hosts R.Hosts, mapping *cache.LruCache[netip.Addr, string]) middl
 			}
 
 			host := strings.TrimRight(q.Name, ".")
-			handleCName := func(resp *D.Msg, domain string) {
-				rr := &D.CNAME{}
-				rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeCNAME, Class: D.ClassINET, Ttl: 10}
-				rr.Target = domain + "."
-				resp.Answer = append([]D.RR{rr}, resp.Answer...)
-			}
-			record, ok := hosts.Search(host, q.Qtype != D.TypeA && q.Qtype != D.TypeAAAA)
-			if !ok {
-				if record != nil && record.IsDomain {
-					// replace request domain
-					newR := r.Copy()
-					newR.Question[0].Name = record.Domain + "."
-					resp, err := next(ctx, newR)
-					if err == nil {
-						resp.Id = r.Id
-						resp.Question = r.Question
-						handleCName(resp, record.Domain)
-					}
-					return resp, err
-				}
+
+			record := hosts.Search(host)
+			if record == nil {
 				return next(ctx, r)
 			}
 
+			ip := record.Data()
 			msg := r.Copy()
-			handleIPs := func() {
-				for _, ipAddr := range record.IPs {
-					if ipAddr.Is4() && q.Qtype == D.TypeA {
-						rr := &D.A{}
-						rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeA, Class: D.ClassINET, Ttl: 10}
-						rr.A = ipAddr.AsSlice()
-						msg.Answer = append(msg.Answer, rr)
-						if mapping != nil {
-							mapping.SetWithExpire(ipAddr, host, time.Now().Add(time.Second*10))
-						}
-					} else if q.Qtype == D.TypeAAAA {
-						rr := &D.AAAA{}
-						rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeAAAA, Class: D.ClassINET, Ttl: 10}
-						ip := ipAddr.As16()
-						rr.AAAA = ip[:]
-						msg.Answer = append(msg.Answer, rr)
-						if mapping != nil {
-							mapping.SetWithExpire(ipAddr, host, time.Now().Add(time.Second*10))
-						}
-					}
-				}
+
+			if ip.Is4() && q.Qtype == D.TypeA {
+				rr := &D.A{}
+				rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeA, Class: D.ClassINET, Ttl: 10}
+				rr.A = ip.AsSlice()
+
+				msg.Answer = []D.RR{rr}
+			} else if q.Qtype == D.TypeAAAA {
+				rr := &D.AAAA{}
+				rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeAAAA, Class: D.ClassINET, Ttl: 10}
+				ip := ip.As16()
+				rr.AAAA = ip[:]
+				msg.Answer = []D.RR{rr}
+			} else {
+				return next(ctx, r)
 			}
 
-			switch q.Qtype {
-			case D.TypeA:
-				handleIPs()
-			case D.TypeAAAA:
-				handleIPs()
-			case D.TypeCNAME:
-				handleCName(r, record.Domain)
-			default:
-				return next(ctx, r)
+			if mapping != nil {
+				mapping.SetWithExpire(ip, host, time.Now().Add(time.Second*10))
 			}
 
 			ctx.SetType(context.DNSTypeHost)
 			msg.SetRcode(r, D.RcodeSuccess)
 			msg.Authoritative = true
 			msg.RecursionAvailable = true
+
 			return msg, nil
 		}
 	}
@@ -177,7 +149,6 @@ func withFakeIP(fakePool *fakeip.Pool) middleware {
 func withResolver(resolver *Resolver) handler {
 	return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
 		ctx.SetType(context.DNSTypeRaw)
-
 		q := r.Question[0]
 
 		// return a empty AAAA msg when ipv6 disabled
@@ -212,7 +183,7 @@ func NewHandler(resolver *Resolver, mapper *ResolverEnhancer) handler {
 	middlewares := []middleware{}
 
 	if resolver.hosts != nil {
-		middlewares = append(middlewares, withHosts(R.NewHosts(resolver.hosts), mapper.mapping))
+		middlewares = append(middlewares, withHosts(resolver.hosts, mapper.mapping))
 	}
 
 	if mapper.mode == C.DNSFakeIP {

dns/resolver.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net/netip"
 	"strings"
 	"time"
@@ -19,7 +20,6 @@ import (
 	"github.com/Dreamacro/clash/log"
 
 	D "github.com/miekg/dns"
-	"github.com/zhangyunhao116/fastrand"
 	"golang.org/x/sync/singleflight"
 )
 
@@ -42,8 +42,7 @@ type geositePolicyRecord struct {
 
 type Resolver struct {
 	ipv6                  bool
-	ipv6Timeout           time.Duration
-	hosts                 *trie.DomainTrie[resolver.HostValue]
+	hosts                 *trie.DomainTrie[netip.Addr]
 	main                  []dnsClient
 	fallback              []dnsClient
 	fallbackDomainFilters []fallbackDomainFilter
@@ -92,20 +91,14 @@ func (r *Resolver) LookupIP(ctx context.Context, host string) (ips []netip.Addr,
 	}()
 
 	ips, err = r.lookupIP(ctx, host, D.TypeA)
-	var waitIPv6 *time.Timer
-	if r != nil {
-		waitIPv6 = time.NewTimer(r.ipv6Timeout)
-	} else {
-		waitIPv6 = time.NewTimer(100 * time.Millisecond)
-	}
-	defer waitIPv6.Stop()
+
 	select {
 	case ipv6s, open := <-ch:
 		if !open && err != nil {
 			return nil, resolver.ErrIPNotFound
 		}
 		ips = append(ips, ipv6s...)
-	case <-waitIPv6.C:
+	case <-time.After(30 * time.Millisecond):
 		// wait ipv6 result
 	}
 
@@ -120,7 +113,7 @@ func (r *Resolver) ResolveIP(ctx context.Context, host string) (ip netip.Addr, e
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", resolver.ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 // LookupIPv4 request with TypeA
@@ -136,7 +129,7 @@ func (r *Resolver) ResolveIPv4(ctx context.Context, host string) (ip netip.Addr,
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", resolver.ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 // LookupIPv6 request with TypeAAAA
@@ -152,7 +145,7 @@ func (r *Resolver) ResolveIPv6(ctx context.Context, host string) (ip netip.Addr,
 	} else if len(ips) == 0 {
 		return netip.Addr{}, fmt.Errorf("%w: %s", resolver.ErrIPNotFound, host)
 	}
-	return ips[fastrand.Intn(len(ips))], nil
+	return ips[rand.Intn(len(ips))], nil
 }
 
 func (r *Resolver) shouldIPFallback(ip netip.Addr) bool {
@@ -426,27 +419,24 @@ type Config struct {
 	Default        []NameServer
 	ProxyServer    []NameServer
 	IPv6           bool
-	IPv6Timeout    uint
 	EnhancedMode   C.DNSMode
 	FallbackFilter FallbackFilter
 	Pool           *fakeip.Pool
-	Hosts          *trie.DomainTrie[resolver.HostValue]
+	Hosts          *trie.DomainTrie[netip.Addr]
 	Policy         map[string][]NameServer
 }
 
 func NewResolver(config Config) *Resolver {
 	defaultResolver := &Resolver{
-		main:        transform(config.Default, nil),
-		lruCache:    cache.New(cache.WithSize[string, *D.Msg](4096), cache.WithStale[string, *D.Msg](true)),
-		ipv6Timeout: time.Duration(config.IPv6Timeout) * time.Millisecond,
+		main:     transform(config.Default, nil),
+		lruCache: cache.New(cache.WithSize[string, *D.Msg](4096), cache.WithStale[string, *D.Msg](true)),
 	}
 
 	r := &Resolver{
-		ipv6:        config.IPv6,
-		main:        transform(config.Main, defaultResolver),
-		lruCache:    cache.New(cache.WithSize[string, *D.Msg](4096), cache.WithStale[string, *D.Msg](true)),
-		hosts:       config.Hosts,
-		ipv6Timeout: time.Duration(config.IPv6Timeout) * time.Millisecond,
+		ipv6:     config.IPv6,
+		main:     transform(config.Main, defaultResolver),
+		lruCache: cache.New(cache.WithSize[string, *D.Msg](4096), cache.WithStale[string, *D.Msg](true)),
+		hosts:    config.Hosts,
 	}
 
 	if len(config.Fallback) != 0 {
@@ -512,12 +502,11 @@ func NewResolver(config Config) *Resolver {
 
 func NewProxyServerHostResolver(old *Resolver) *Resolver {
 	r := &Resolver{
-		ipv6:        old.ipv6,
-		main:        old.proxyServer,
-		lruCache:    old.lruCache,
-		hosts:       old.hosts,
-		policy:      old.policy,
-		ipv6Timeout: old.ipv6Timeout,
+		ipv6:     old.ipv6,
+		main:     old.proxyServer,
+		lruCache: old.lruCache,
+		hosts:    old.hosts,
+		policy:   old.policy,
 	}
 	return r
 }

dns/util.go

@@ -66,7 +66,7 @@ func setMsgTTL(msg *D.Msg, ttl uint32) {
 }
 
 func isIPRequest(q D.Question) bool {
-	return q.Qclass == D.ClassINET && (q.Qtype == D.TypeA || q.Qtype == D.TypeAAAA || q.Qtype == D.TypeCNAME)
+	return q.Qclass == D.ClassINET && (q.Qtype == D.TypeA || q.Qtype == D.TypeAAAA)
 }
 
 func transform(servers []NameServer, resolver *Resolver) []dnsClient {

docker/file-name.sh

@@ -1,25 +1,26 @@
 #!/bin/sh
 os="clash.meta-linux-"
-case $TARGETPLATFORM in
-    "linux/amd64")
+arch=`uname -m`
+case $arch in 
+    "x86_64")
         arch="amd64-compatible"
         ;;
-    "linux/386")
-        arch="386"
+    "x86")
+        arch="386-cgo"
         ;;
-    "linux/arm64")
+    "aarch64")
         arch="arm64"
         ;;
-    "linux/arm/v7")
+    "armv7l")
         arch="armv7"
         ;;
     "riscv64")
-        arch="riscv64"
+        arch="riscv64-cgo"
         ;;
     *)
         echo "Unknown architecture"
         exit 1
         ;;        
 esac
-file_name="$os$arch-$(cat bin/version.txt)"
+file_name="$os$arch"
 echo $file_name

docs/config.yaml

@@ -7,17 +7,22 @@ mixed-port: 10801 # HTTP(S) 和 SOCKS 代理混合端口
 # tproxy-port: 7893
 
 allow-lan: true # 允许局域网连接
-bind-address: "*" # 绑定 IP 地址，仅作用于 allow-lan 为 true，'*'表示所有地址
+bind-address: "*" # 绑定IP地址，仅作用于 allow-lan 为 true，'*'表示所有地址
 
-#  find-process-mode has 3 values:always, strict, off
+#  find-process-mode has 3 values: always, strict, off
 #  - always, 开启，强制匹配所有进程
-#  - strict, 默认，由 clash 判断是否开启
+#  - strict, 默认，由clash判断是否开启
 #  - off, 不匹配进程，推荐在路由器上使用此模式
 find-process-mode: strict
 
+#  global-client-fingerprint:全局TLS指纹,优先低于proxy内的 client-fingerprint
+#  accepts "chrome","firefox","safari","ios","random","none" options.
+#  Utls is currently support TLS transport in TCP/grpc/WS/HTTP for VLESS/Vmess and trojan.
+global-client-fingerprint: chrome
+
 mode: rule
 
-#自定义 geodata url
+#自定义 geox-url
 geox-url:
   geoip: "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat"
   geosite: "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat"
@@ -27,30 +32,16 @@ log-level: debug # 日志等级 silent/error/warning/info/debug
 
 ipv6: true # 开启 IPv6 总开关，关闭阻断所有 IPv6 链接和屏蔽 DNS 请求 AAAA 记录
 
-tls:
-  certificate: string # 证书 PEM 格式，或者 证书的路径
-  private-key: string # 证书对应的私钥 PEM 格式，或者私钥路径
-  custom-certifactes:
-    - |
-      -----BEGIN CERTIFICATE-----
-      format/pem...
-      -----END CERTIFICATE-----
-
 external-controller: 0.0.0.0:9093 # RESTful API 监听地址
 external-controller-tls: 0.0.0.0:9443 # RESTful API HTTPS 监听地址，需要配置 tls 部分配置文件
-# secret: "123456" # `Authorization:Bearer ${secret}`
+# secret: "123456" # `Authorization: Bearer ${secret}`
 
-# tcp-concurrent: true # TCP 并发连接所有 IP, 将使用最快握手的 TCP
-external-ui: /path/to/ui/folder # 配置 WEB UI 目录，使用 http://{{external-controller}}/ui 访问
+# tcp-concurrent: true # TCP并发连接所有IP, 将使用最快握手的TCP
+external-ui: /path/to/ui/folder # 配置WEB UI目录，使用http://{{external-controller}}/ui 访问
 
 # interface-name: en0 # 设置出口网卡
 
-# 全局 TLS 指纹，优先低于 proxy 内的 client-fingerprint
-# 可选： "chrome","firefox","safari","ios","random","none" options.
-# Utls is currently support TLS transport in TCP/grpc/WS/HTTP for VLESS/Vmess and trojan.
-global-client-fingerprint: chrome
-
-# routing-mark:6666 # 配置 fwmark 仅用于 Linux
+# routing-mark: 6666 # 配置 fwmark 仅用于Linux
 experimental:
 
 # 类似于 /etc/hosts, 仅支持配置单个 IP
@@ -58,15 +49,6 @@ hosts:
 # '*.clash.dev': 127.0.0.1
 # '.dev': 127.0.0.1
 # 'alpha.clash.dev': '::1'
-# test.com: [1.1.1.1, 2.2.2.2]
-# clash.lan: clash # clash 为特别字段，将加入本地所有网卡的地址
-# baidu.com: google.com # 只允许配置一个别名
-
-profile: # 存储 select 选择记录
-  store-selected: false
-  
-  # 持久化 fake-ip
-  store-fake-ip: true
 
 # Tun 配置
 tun:
@@ -93,10 +75,10 @@ tun:
   #- 1000
   # exclude_uid_range: # 排除路由的的用户范围
   # - 1000-99999
-  
+
   # Android 用户和应用规则仅在 Android 下被支持
   # 并且需要 auto_route
-  
+
   # include_android_user: # 限制被路由的 Android 用户
   # - 0
   # - 10
@@ -123,13 +105,15 @@ sniffer:
   # 是否使用嗅探结果作为实际访问，默认 true
   # 全局配置，优先级低于 sniffer.sniff 实际配置
   override-destination: false
-  sniff: # TLS 默认如果不配置 ports 默认嗅探 443
+  sniff:
+    # TLS 默认如果不配置 ports 默认嗅探 443
     TLS:
     #  ports: [443, 8443]
-    
+
     # 默认嗅探 80
-    HTTP: # 需要嗅探的端口
-      
+    HTTP:
+      # 需要嗅探的端口
+
       ports: [80, 8080-8880]
       # 可覆盖 sniffer.override-destination
       override-destination: true
@@ -144,7 +128,7 @@ sniffer:
     - tls
     - http
   # 强制对此域名进行嗅探
-  
+
   # 仅对白名单中的端口进行嗅探，默认为 443，80
   # 已废弃，若 sniffer.sniff 配置则此项无效
   port-whitelist:
@@ -152,8 +136,27 @@ sniffer:
     - "443"
     # - 8000-9999
 
+# shadowsocks,vmess 入口配置（传入流量将和socks,mixed等入口一样按照mode所指定的方式进行匹配处理）
+# ss-config: ss://2022-blake3-aes-256-gcm:vlmpIPSyHH6f4S8WVPdRIHIlzmB+GIRfoH3aNJ/t9Gg=@:23456
+# vmess-config: vmess://1:9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68@:12345
 
-tunnels: # one line config
+# tuic服务器入口（传入流量将和socks,mixed等入口一样按照mode所指定的方式进行匹配处理）
+#tuic-server:
+#  enable: true
+#  listen: 127.0.0.1:10443
+#  token:
+#    - TOKEN
+#  certificate: ./server.crt
+#  private-key: ./server.key
+#  congestion-controller: bbr
+#  max-idle-time: 15000
+#  authentication-timeout: 1000
+#  alpn:
+#    - h3
+#  max-udp-relay-packet-size: 1500
+
+tunnels:
+  # one line config
   - tcp/udp,127.0.0.1:6553,114.114.114.114:53,proxy
   - tcp,127.0.0.1:6666,rds.mysql.com:3306,vpn
   # full yaml config
@@ -162,6 +165,12 @@ tunnels: # one line config
     target: target.com
     proxy: proxy
 
+profile:
+  # 存储select选择记录
+  store-selected: false
+
+  # 持久化fake-ip
+  store-fake-ip: true
 
 # DNS配置
 dns:
@@ -169,7 +178,7 @@ dns:
   prefer-h3: true # 开启 DoH 支持 HTTP/3，将并发尝试
   listen: 0.0.0.0:53 # 开启 DNS 服务器监听
   # ipv6: false # false 将返回 AAAA 的空结果
-  # ipv6-timeout: 300 # 单位：ms，内部双栈并发时，向上游查询 AAAA 时，等待 AAAA 的时间，默认 100ms
+
   # 用于解析 nameserver，fallback 以及其他DNS服务器配置的，DNS 服务域名
   # 只能使用纯 IP 地址，可使用加密 DNS
   default-nameserver:
@@ -178,16 +187,16 @@ dns:
     - tls://1.12.12.12:853
     - tls://223.5.5.5:853
   enhanced-mode: fake-ip # or redir-host
-  
+
   fake-ip-range: 198.18.0.1/16 # fake-ip 池设置
-  
+
   # use-hosts: true # 查询 hosts
-  
+
   # 配置不使用fake-ip的域名
   # fake-ip-filter:
   #   - '*.lan'
   #   - localhost.ptlogin2.qq.com
-  
+
   # DNS主要域名配置
   # 支持 UDP，TCP，DoT，DoH，DoQ
   # 这部分为主要 DNS 配置，影响所有直连，确保使用对大陆解析精准的 DNS
@@ -201,20 +210,20 @@ dns:
     - dhcp://en0 # dns from dhcp
     - quic://dns.adguard.com:784 # DNS over QUIC
     # - '8.8.8.8#en0' # 兼容指定DNS出口网卡
-  
+
   # 当配置 fallback 时，会查询 nameserver 中返回的 IP 是否为 CN，非必要配置
   # 当不是 CN，则使用 fallback 中的 DNS 查询结果
   # 确保配置 fallback 时能够正常查询
   # fallback:
   #   - tcp://1.1.1.1
   #   - 'tcp://1.1.1.1#ProxyGroupName' # 指定 DNS 过代理查询，ProxyGroupName 为策略组名或节点名，过代理配置优先于配置出口网卡，当找不到策略组或节点名则设置为出口网卡
-  
+
   # 专用于节点域名解析的 DNS 服务器，非必要配置项
   # 配置服务器若查询失败将使用 nameserver，非并发查询
   # proxy-server-nameserver:
   # - https://dns.google/dns-query
   # - tls://one.one.one.one
-  
+
   # 配置 fallback 使用条件
   # fallback-filter:
   #   geoip: true # 配置是否使用 geoip
@@ -229,53 +238,14 @@ dns:
   #     - '+.google.com'
   #     - '+.facebook.com'
   #     - '+.youtube.com'
-  
-  # 配置查询域名使用的 DNS 服务器
-  nameserver-policy: #   'www.baidu.com': '114.114.114.114'
-    #   '+.internal.crop.com': '10.0.0.1'
-    "geosite:cn":
-      - https://doh.pub/dns-query
-      - https://dns.alidns.com/dns-query
-    "www.baidu.com": [https://doh.pub/dns-query, https://dns.alidns.com/dns-query]
 
-proxies: # socks5
-  - name: "socks"
-    type: socks5
-    server: server
-    port: 443
-    # username: username
-    # password: password
-    # tls: true
-    # fingerprint: xxxx
-    # skip-cert-verify: true
-    # udp: true
-    # ip-version: ipv6
-  
-  # http
-  - name: "http"
-    type: http
-    server: server
-    port: 443
-    # username: username
-    # password: password
-    # tls: true # https
-    # skip-cert-verify: true
-    # sni: custom.com
-    # fingerprint: xxxx # 同 experimental.fingerprints 使用 sha256 指纹，配置协议独立的指纹，将忽略 experimental.fingerprints
-    # ip-version: dual
-  
-  # Snell
-  # Beware that there's currently no UDP support yet
-  - name: "snell"
-    type: snell
-    server: server
-    port: 44046
-    psk: yourpsk
-    # version: 2
-    # obfs-opts:
-    # mode: http # or tls
-    # host: bing.com
-  
+  # 配置查询域名使用的 DNS 服务器
+  nameserver-policy:
+    #   'www.baidu.com': '114.114.114.114'
+    #   '+.internal.crop.com': '10.0.0.1'
+    "geosite:cn": "https://doh.pub/dns-query"
+    "www.baidu.com": [https://doh.pub/dns-query,https://dns.alidns.com/dns-query]
+proxies:
   # Shadowsocks
   # cipher支持:
   #   aes-128-gcm aes-192-gcm aes-256-gcm
@@ -298,7 +268,6 @@ proxies: # socks5
     # UDP 则为双栈解析，获取结果中的第一个 IPv4
     # ipv6-prefer 同 ipv4-prefer
     # 现有协议都支持此参数，TCP 效果仅在开启 tcp-concurrent 生效
-  
   - name: "ss2"
     type: ss
     server: server
@@ -309,7 +278,7 @@ proxies: # socks5
     plugin-opts:
       mode: tls # or http
       # host: bing.com
-  
+
   - name: "ss3"
     type: ss
     server: server
@@ -319,17 +288,17 @@ proxies: # socks5
     plugin: v2ray-plugin
     plugin-opts:
       mode: websocket # no QUIC now
-    # tls: true # wss
-    # 可使用 openssl x509 -noout -fingerprint -sha256 -inform pem -in yourcert.pem 获取
-    # 配置指纹将实现 SSL Pining 效果
-    # fingerprint: xxxx
-    # skip-cert-verify: true
-    # host: bing.com
-    # path: "/"
-    # mux: true
-    # headers:
-    #   custom: value
-  
+      # tls: true # wss
+      # 可使用 openssl x509 -noout -fingerprint -sha256 -inform pem -in yourcert.pem 获取
+      # 配置指纹将实现 SSL Pining 效果
+      # fingerprint: xxxx
+      # skip-cert-verify: true
+      # host: bing.com
+      # path: "/"
+      # mux: true
+      # headers:
+      #   custom: value
+
   - name: "ss4"
     type: ss
     server: server
@@ -340,8 +309,7 @@ proxies: # socks5
     plugin-opts:
       host: "cloud.tencent.com"
       password: "shadow_tls_password"
-      version: 2 # support 1/2/3
-  
+
   # vmess
   # cipher支持 auto/aes-128-gcm/chacha20-poly1305/none
   - name: "vmess"
@@ -364,7 +332,7 @@ proxies: # socks5
     #     Host: v2ray.com
     #   max-early-data: 2048
     #   early-data-header-name: Sec-WebSocket-Protocol
-  
+
   - name: "vmess-h2"
     type: vmess
     server: server
@@ -380,7 +348,7 @@ proxies: # socks5
         - http.example.com
         - http-alt.example.com
       path: /
-  
+
   - name: "vmess-http"
     type: vmess
     server: server
@@ -391,15 +359,15 @@ proxies: # socks5
     # udp: true
     # network: http
     # http-opts:
-    #   method: "GET"
-    #   path:
-    #     - '/'
-    #     - '/video'
-    #   headers:
-    #     Connection:
-    #       - keep-alive
+    #   # method: "GET"
+    #   # path:
+    #   #   - '/'
+    #   #   - '/video'
+    #   # headers:
+    #   #   Connection:
+    #   #     - keep-alive
     # ip-version: ipv4 # 设置使用 IP 类型偏好，可选：ipv4，ipv6，dual，默认值：dual
-  
+
   - name: vmess-grpc
     server: server
     port: 443
@@ -415,7 +383,100 @@ proxies: # socks5
     grpc-opts:
       grpc-service-name: "example"
     # ip-version: ipv4
-  
+
+  # socks5
+  - name: "socks"
+    type: socks5
+    server: server
+    port: 443
+    # username: username
+    # password: password
+    # tls: true
+    # fingerprint: xxxx
+    # skip-cert-verify: true
+    # udp: true
+    # ip-version: ipv6
+
+  # http
+  - name: "http"
+    type: http
+    server: server
+    port: 443
+    # username: username
+    # password: password
+    # tls: true # https
+    # skip-cert-verify: true
+    # sni: custom.com
+    # fingerprint: xxxx # 同 experimental.fingerprints 使用 sha256 指纹，配置协议独立的指纹，将忽略 experimental.fingerprints
+    # ip-version: dual
+
+  # Snell
+  # Beware that there's currently no UDP support yet
+  - name: "snell"
+    type: snell
+    server: server
+    port: 44046
+    psk: yourpsk
+    # version: 2
+    # obfs-opts:
+    # mode: http # or tls
+    # host: bing.com
+
+  # Trojan
+  - name: "trojan"
+    type: trojan
+    server: server
+    port: 443
+    password: yourpsk
+    # client-fingerprint: random # Available: "chrome","firefox","safari","random","none"
+    # fingerprint: xxxx
+    # udp: true
+    # sni: example.com # aka server name
+    # alpn:
+    #   - h2
+    #   - http/1.1
+    # skip-cert-verify: true
+
+  - name: trojan-grpc
+    server: server
+    port: 443
+    type: trojan
+    password: "example"
+    network: grpc
+    sni: example.com
+    # skip-cert-verify: true
+    # fingerprint: xxxx
+    udp: true
+    grpc-opts:
+      grpc-service-name: "example"
+
+  - name: trojan-ws
+    server: server
+    port: 443
+    type: trojan
+    password: "example"
+    network: ws
+    sni: example.com
+    # skip-cert-verify: true
+    # fingerprint: xxxx
+    udp: true
+    # ws-opts:
+    # path: /path
+    # headers:
+    #   Host: example.com
+
+  - name: "trojan-xtls"
+    type: trojan
+    server: server
+    port: 443
+    password: yourpsk
+    flow: "xtls-rprx-direct" # xtls-rprx-origin xtls-rprx-direct
+    flow-show: true
+    # udp: true
+    # sni: example.com # aka server name
+    # skip-cert-verify: true
+    # fingerprint: xxxx
+
   # vless
   - name: "vless-tcp"
     type: vless
@@ -428,53 +489,7 @@ proxies: # socks5
     # skip-cert-verify: true
     # fingerprint: xxxx
     # client-fingerprint: random # Available: "chrome","firefox","safari","random","none"
-  
-  - name: "vless-vision"
-    type: vless
-    server: server
-    port: 443
-    uuid: uuid
-    network: tcp
-    tls: true
-    udp: true
-    flow: xtls-rprx-vision
-    client-fingerprint: chrome
-    # fingerprint: xxxx
-    # skip-cert-verify: true
-  
-  - name: "vless-reality-vision"
-    type: vless
-    server: server
-    port: 443
-    uuid: uuid
-    network: tcp
-    tls: true
-    udp: true
-    flow: xtls-rprx-vision
-    servername: www.microsoft.com # REALITY servername
-    reality-opts:
-      public-key: xxx
-      short-id: xxx # optional
-    client-fingerprint: chrome # cannot be empty
-  
-  - name: "vless-reality-grpc"
-    type: vless
-    server: server
-    port: 443
-    uuid: uuid
-    network: grpc
-    tls: true
-    udp: true
-    flow:
-    # skip-cert-verify: true
-    client-fingerprint: chrome
-    servername: testingcf.jsdelivr.net
-    grpc-opts:
-      grpc-service-name: "grpc"
-    reality-opts:
-      public-key: CrrQSjAG_YkHLwvM2M-7XkKJilgL5upBKCp0od0tLhE
-      short-id: 10f897e26c4b9478
-  
+
   - name: "vless-ws"
     type: vless
     server: server
@@ -491,62 +506,7 @@ proxies: # socks5
       path: "/"
       headers:
         Host: example.com
-  
-  # Trojan
-  - name: "trojan"
-    type: trojan
-    server: server
-    port: 443
-    password: yourpsk
-    # client-fingerprint: random # Available: "chrome","firefox","safari","random","none"
-    # fingerprint: xxxx
-    # udp: true
-    # sni: example.com # aka server name
-    # alpn:
-    #   - h2
-    #   - http/1.1
-    # skip-cert-verify: true
-  
-  - name: trojan-grpc
-    server: server
-    port: 443
-    type: trojan
-    password: "example"
-    network: grpc
-    sni: example.com
-    # skip-cert-verify: true
-    # fingerprint: xxxx
-    udp: true
-    grpc-opts:
-      grpc-service-name: "example"
-  
-  - name: trojan-ws
-    server: server
-    port: 443
-    type: trojan
-    password: "example"
-    network: ws
-    sni: example.com
-    # skip-cert-verify: true
-    # fingerprint: xxxx
-    udp: true
-    # ws-opts:
-    # path: /path
-    # headers:
-    #   Host: example.com
-  
-  - name: "trojan-xtls"
-    type: trojan
-    server: server
-    port: 443
-    password: yourpsk
-    flow: "xtls-rprx-direct" # xtls-rprx-origin xtls-rprx-direct
-    flow-show: true
-    # udp: true
-    # sni: example.com # aka server name
-    # skip-cert-verify: true
-    # fingerprint: xxxx
-  
+
   #hysteria
   - name: "hysteria"
     type: hysteria
@@ -572,8 +532,7 @@ proxies: # socks5
     # disable_mtu_discovery: false
     # fingerprint: xxxx
     # fast-open: true # 支持 TCP 快速打开，默认为 false
-  
-  # wireguard
+
   - name: "wg"
     type: wireguard
     server: 162.159.192.1
@@ -583,11 +542,7 @@ proxies: # socks5
     private-key: eCtXsJZ27+4PbhDkHnB923tkUn2Gj59wZw5wFA75MnU=
     public-key: Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=
     udp: true
-    reserved: "U4An"
-    # 数组格式也是合法的
-    # reserved: [209,98,59]
-  
-  # tuic
+  #    reserved: 'U4An'
   - name: tuic
     server: www.example.com
     port: 10443
@@ -596,17 +551,16 @@ proxies: # socks5
     # ip: 127.0.0.1 # for overwriting the DNS lookup result of the server address set in option 'server'
     # heartbeat-interval: 10000
     # alpn: [h3]
-    disable-sni: true
+    # disable-sni: true
     reduce-rtt: true
-    request-timeout: 8000
+    # request-timeout: 8000
     udp-relay-mode: native # Available: "native", "quic". Default: "native"
     # congestion-controller: bbr # Available: "cubic", "new_reno", "bbr". Default: "cubic"
     # max-udp-relay-packet-size: 1500
     # fast-open: true
     # skip-cert-verify: true
     # max-open-streams: 20 # default 100, too many open streams may hurt performance
-    # sni: example.com
-  
+
   # ShadowsocksR
   # The supported ciphers (encryption methods): all stream ciphers in ss
   # The supported obfses:
@@ -627,7 +581,8 @@ proxies: # socks5
     # protocol-param: "#"
     # udp: true
 
-proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
+proxy-groups:
+  # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
   # Traffic: clash <-> http <-> vmess <-> ss1 <-> ss2 <-> Internet
   - name: "relay"
     type: relay
@@ -636,7 +591,7 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
       - vmess
       - ss1
       - ss2
-  
+
   # url-test 将按照 url 测试结果使用延迟最低节点
   - name: "auto"
     type: url-test
@@ -648,7 +603,7 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
     # lazy: true
     url: "https://cp.cloudflare.com/generate_204"
     interval: 300
-  
+
   # fallback 将按照 url 测试结果按照节点顺序选择
   - name: "fallback-auto"
     type: fallback
@@ -658,7 +613,7 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
       - vmess1
     url: "https://cp.cloudflare.com/generate_204"
     interval: 300
-  
+
   # load-balance 将按照算法随机选择节点
   - name: "load-balance"
     type: load-balance
@@ -668,8 +623,8 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
       - vmess1
     url: "https://cp.cloudflare.com/generate_204"
     interval: 300
-  # strategy: consistent-hashing # 可选 round-robin 和 sticky-sessions
-  
+    # strategy: consistent-hashing # 可选 round-robin 和 sticky-sessions
+
   # select 用户自行选择节点
   - name: Proxy
     type: select
@@ -679,7 +634,7 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
       - ss2
       - vmess1
       - auto
-  
+
   # 配置指定 interface-name 和 fwmark 的 DIRECT
   - name: en1
     type: select
@@ -687,7 +642,7 @@ proxy-groups: # 代理链，若落地协议支持 UDP over TCP 则可支持 UDP
     routing-mark: 6667
     proxies:
       - DIRECT
-  
+
   - name: UseProvider
     type: select
     filter: "HK|TW" # 正则表达式，过滤 provider1 中节点名包含 HK 或 TW
@@ -734,8 +689,7 @@ rules:
   - DOMAIN-KEYWORD,google,ss1
   - IP-CIDR,1.1.1.1/32,ss1
   - IP-CIDR6,2409::/64,DIRECT
-  # 当满足条件是 TCP 或 UDP 流量时，使用名为 sub-rule-name1 的规则集
-  - SUB-RULE,(OR,((NETWORK,TCP),(NETWORK,UDP))),sub-rule-name1
+  - SUB-RULE,(OR,((NETWORK,TCP),(NETWORK,UDP))),sub-rule-name1 # 当满足条件是 TCP 或 UDP 流量时，使用名为 sub-rule-name1 当规则集
   - SUB-RULE,(AND,((NETWORK,UDP))),sub-rule-name2
 # 定义多个子规则集，规则将以分叉匹配，使用 SUB-RULE 使用
 #                                               google.com(not match)--> baidu.com(match)
@@ -762,6 +716,15 @@ sub-rules:
     - IP-CIDR,8.8.8.8/32,ss1
     - DOMAIN,dns.alidns.com,REJECT
 
+tls:
+  certificate: string # 证书 PEM 格式，或者 证书的路径
+  private-key: string # 证书对应的私钥 PEM 格式，或者私钥路径
+  # 自定义证书验证，将加入 Clash 证书验证中，绝大多数 TLS 相关支持，如：DNS
+  # 可用于自定义证书的验证
+  custom-certificates:
+    - certificate: string # 证书 PEM 格式，或者 证书的路径
+      private-key: string # 证书对应的私钥 PEM 格式，或者私钥路径
+
 # 流量入站
 listeners:
   - name: socks5-in-1
@@ -771,14 +734,14 @@ listeners:
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理
     # udp: false # 默认 true
-  
+
   - name: http-in-1
     type: http
     port: 10809
     listen: 0.0.0.0
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
-  
+
   - name: mixed-in-1
     type: mixed #  HTTP(S) 和 SOCKS 代理混合
     port: 10810
@@ -786,14 +749,14 @@ listeners:
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
     # udp: false # 默认 true
-  
+
   - name: reidr-in-1
     type: redir
     port: 10811
     listen: 0.0.0.0
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
-  
+
   - name: tproxy-in-1
     type: tproxy
     port: 10812
@@ -801,7 +764,7 @@ listeners:
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
     # udp: false # 默认 true
-  
+
   - name: shadowsocks-in-1
     type: shadowsocks
     port: 10813
@@ -810,7 +773,7 @@ listeners:
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
     password: vlmpIPSyHH6f4S8WVPdRIHIlzmB+GIRfoH3aNJ/t9Gg=
     cipher: 2022-blake3-aes-256-gcm
-  
+
   - name: vmess-in-1
     type: vmess
     port: 10814
@@ -821,7 +784,7 @@ listeners:
       - username: 1
         uuid: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68
         alterId: 1
-  
+
   - name: tuic-in-1
     type: tuic
     port: 10815
@@ -838,7 +801,7 @@ listeners:
     #  alpn:
     #    - h3
     #  max-udp-relay-packet-size: 1500
-  
+
   - name: tunnel-in-1
     type: tunnel
     port: 10816
@@ -847,7 +810,7 @@ listeners:
     # proxy: proxy # 如果不为空则直接将该入站流量交由指定proxy处理(当proxy不为空时，这里的proxy名称必须合法，否则会出错)
     network: [tcp, udp]
     target: target.com
-  
+
   - name: tun-in-1
     type: tun
     # rule: sub-rule-name1 # 默认使用 rules，如果未找到 sub-rule 则直接使用 rules
@@ -863,25 +826,25 @@ listeners:
     inet6-address: # 必须手动设置ipv6地址段
       - "fdfe:dcba:9877::1/126"
     # strict_route: true # 将所有连接路由到tun来防止泄漏，但你的设备将无法其他设备被访问
-    #   inet4_route_address: # 启用 auto_route 时使用自定义路由而不是默认路由
-    #     - 0.0.0.0/1
-    #     - 128.0.0.0/1
-    #   inet6_route_address: # 启用 auto_route 时使用自定义路由而不是默认路由
-    #     - "::/1"
-    #     - "8000::/1"
+    #    inet4_route_address: # 启用 auto_route 时使用自定义路由而不是默认路由
+    #      - 0.0.0.0/1
+    #      - 128.0.0.0/1
+    #    inet6_route_address: # 启用 auto_route 时使用自定义路由而不是默认路由
+    #      - "::/1"
+    #      - "8000::/1"
     # endpoint_independent_nat: false # 启用独立于端点的 NAT
     # include_uid: # UID 规则仅在 Linux 下被支持，并且需要 auto_route
     # - 0
     # include_uid_range: # 限制被路由的的用户范围
     # - 1000-99999
     # exclude_uid: # 排除路由的的用户
-    # - 1000
+    #- 1000
     # exclude_uid_range: # 排除路由的的用户范围
     # - 1000-99999
-    
+
     # Android 用户和应用规则仅在 Android 下被支持
     # 并且需要 auto_route
-    
+
     # include_android_user: # 限制被路由的 Android 用户
     # - 0
     # - 10
@@ -889,23 +852,3 @@ listeners:
     # - com.android.chrome
     # exclude_package: # 排除被路由的 Android 应用包名
     # - com.android.captiveportallogin
-
-# 入口配置与 Listener 等价，传入流量将和 socks,mixed 等入口一样按照 mode 所指定的方式进行匹配处理
-# shadowsocks,vmess 入口配置（传入流量将和socks,mixed等入口一样按照mode所指定的方式进行匹配处理）
-# ss-config: ss://2022-blake3-aes-256-gcm:vlmpIPSyHH6f4S8WVPdRIHIlzmB+GIRfoH3aNJ/t9Gg=@:23456
-# vmess-config: vmess://1:9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68@:12345
-
-# tuic服务器入口（传入流量将和socks,mixed等入口一样按照mode所指定的方式进行匹配处理）
-# tuic-server:
-#  enable: true
-#  listen: 127.0.0.1:10443
-#  token:
-#    - TOKEN
-#  certificate: ./server.crt
-#  private-key: ./server.key
-#  congestion-controller: bbr
-#  max-idle-time: 15000
-#  authentication-timeout: 1000
-#  alpn:
-#    - h3
-#  max-udp-relay-packet-size: 1500

go.mod

@@ -19,30 +19,29 @@ require (
 	github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40
 	github.com/mdlayher/netlink v1.7.2-0.20221213171556-9881fafed8c7
 	github.com/metacubex/quic-go v0.32.0
-	github.com/metacubex/sing-shadowsocks v0.1.1-0.20230226153717-4e80da7e6947
-	github.com/metacubex/sing-tun v0.1.1-0.20230304153753-5058534177f3
-	github.com/metacubex/sing-wireguard v0.0.0-20230310035749-f7595fcae5cb
+	github.com/metacubex/sing-shadowsocks v0.1.1-0.20230202072246-e2bef5f088c7
+	github.com/metacubex/sing-tun v0.1.1-0.20230222113101-fbfa2dab826d
+	github.com/metacubex/sing-wireguard v0.0.0-20230213124601-d04406a109b4
 	github.com/miekg/dns v1.1.50
 	github.com/mroth/weightedrand/v2 v2.0.0
 	github.com/oschwald/geoip2-golang v1.8.0
 	github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97
-	github.com/sagernet/sing v0.1.8
-	github.com/sagernet/sing-shadowtls v0.1.0
-	github.com/sagernet/sing-vmess v0.1.3-0.20230307060529-d110e81a50bc
+	github.com/sagernet/sing v0.1.8-0.20230221060643-3401d210384b
+	github.com/sagernet/sing-shadowtls v0.0.0-20230221130515-dac782ca098e
+	github.com/sagernet/sing-vmess v0.1.2
 	github.com/sagernet/tfo-go v0.0.0-20230207095944-549363a7327d
-	github.com/sagernet/utls v0.0.0-20230309024959-6732c2ab36f2
+	github.com/sagernet/utls v0.0.0-20230220130002-c08891932056
 	github.com/sagernet/wireguard-go v0.0.0-20221116151939-c99467f53f2c
 	github.com/samber/lo v1.37.0
 	github.com/sirupsen/logrus v1.9.0
 	github.com/stretchr/testify v1.8.1
 	github.com/xtls/go v0.0.0-20220914232946-0441cf4cf837
-	github.com/zhangyunhao116/fastrand v0.3.0
 	go.etcd.io/bbolt v1.3.6
 	go.uber.org/atomic v1.10.0
 	go.uber.org/automaxprocs v1.5.1
 	golang.org/x/crypto v0.6.0
 	golang.org/x/exp v0.0.0-20221205204356-47842c84f3db
-	golang.org/x/net v0.7.0
+	golang.org/x/net v0.6.0
 	golang.org/x/sync v0.1.0
 	golang.org/x/sys v0.5.0
 	google.golang.org/protobuf v1.28.2-0.20230118093459-a9481185b34d
@@ -64,7 +63,7 @@ require (
 	github.com/klauspost/compress v1.15.15 // indirect
 	github.com/klauspost/cpuid/v2 v2.0.12 // indirect
 	github.com/mdlayher/socket v0.4.0 // indirect
-	github.com/metacubex/gvisor v0.0.0-20230304153416-e2bb9c726005 // indirect
+	github.com/metacubex/gvisor v0.0.0-20230222112937-bdbcd206ec65 // indirect
 	github.com/onsi/ginkgo/v2 v2.2.0 // indirect
 	github.com/oschwald/maxminddb-golang v1.10.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect

go.sum

@@ -87,16 +87,16 @@ github.com/mdlayher/raw v0.0.0-20190606142536-fef19f00fc18/go.mod h1:7EpbotpCmVZ
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
 github.com/mdlayher/socket v0.4.0 h1:280wsy40IC9M9q1uPGcLBwXpcTQDtoGwVt+BNoITxIw=
 github.com/mdlayher/socket v0.4.0/go.mod h1:xxFqz5GRCUN3UEOm9CZqEJsAbe1C8OwSK46NlmWuVoc=
-github.com/metacubex/gvisor v0.0.0-20230304153416-e2bb9c726005 h1:0TEvReK/D6YLszjGj/bdx4d7amQSjQ2X/98r4ZiUbxU=
-github.com/metacubex/gvisor v0.0.0-20230304153416-e2bb9c726005/go.mod h1:wqEuzdImyqD2MCGE8CYRJXbB77oSEJeoSSXXdwKjnsE=
+github.com/metacubex/gvisor v0.0.0-20230222112937-bdbcd206ec65 h1:WUINdCB/UvSX9I+wN+y5xVEisPrXA73rxkoHK5DMyZs=
+github.com/metacubex/gvisor v0.0.0-20230222112937-bdbcd206ec65/go.mod h1:e3lCxh3TozKMWAsYTC7nBVnepAxPL/sNyScUFvmEoec=
 github.com/metacubex/quic-go v0.32.0 h1:dSD8LB4MSeBuD4otd8y1DUZcRdDcEB0Ax5esPOqn2Hw=
 github.com/metacubex/quic-go v0.32.0/go.mod h1:yParIzDYUd/t/pzFlDtZKhnvSqbUu0bPChlKEGmJStA=
-github.com/metacubex/sing-shadowsocks v0.1.1-0.20230226153717-4e80da7e6947 h1:NnjC2+aIiyzzvFlo+C2WzBOJdsp+HAtu18FZomqYhUE=
-github.com/metacubex/sing-shadowsocks v0.1.1-0.20230226153717-4e80da7e6947/go.mod h1:U2gwhxzqgbhKCgn2B4z3t0Cj0LpMWFl/02BGCoG421w=
-github.com/metacubex/sing-tun v0.1.1-0.20230304153753-5058534177f3 h1:oQLThm1a8E7hHmoM9XF2cO0FZPsHVynC4YXW4b3liUI=
-github.com/metacubex/sing-tun v0.1.1-0.20230304153753-5058534177f3/go.mod h1:b/19bRRhwampNPV+1gVDyDsQHmuGDaplxPQkwJh1kj4=
-github.com/metacubex/sing-wireguard v0.0.0-20230310035749-f7595fcae5cb h1:uhvzbtOvyg2c1k1H2EeVPuPvTEjDHCq4+U0AljG40P8=
-github.com/metacubex/sing-wireguard v0.0.0-20230310035749-f7595fcae5cb/go.mod h1:7mPG9qYln+CLKBcDt7Dk4c7b3S53VzEfexMVPe6T6FM=
+github.com/metacubex/sing-shadowsocks v0.1.1-0.20230202072246-e2bef5f088c7 h1:MNCGIpXhxXn9ck5bxfm/cW9Nr2FGQ5cakcGK0yKZcak=
+github.com/metacubex/sing-shadowsocks v0.1.1-0.20230202072246-e2bef5f088c7/go.mod h1:8pBSYDKVxTtqUtGZyEh4ZpFJXwP6wBVVKrs6oQiOwmQ=
+github.com/metacubex/sing-tun v0.1.1-0.20230222113101-fbfa2dab826d h1:oMzkrEoBdwn2/Vyu0n6/LAmvjxqsyFs+f2kqeg7kI8U=
+github.com/metacubex/sing-tun v0.1.1-0.20230222113101-fbfa2dab826d/go.mod h1:WmbtxVPpJulKoQGwfnBMk4KSWzZ68sE/myTrQeN/5GE=
+github.com/metacubex/sing-wireguard v0.0.0-20230213124601-d04406a109b4 h1:d96mCF/LYyC9kULd2xwcXfP0Jd8klrOngmRxuUIZg/8=
+github.com/metacubex/sing-wireguard v0.0.0-20230213124601-d04406a109b4/go.mod h1:p2VpJuxRefgVMxc8cmatMGSFNvYbjMYMsXJOe7qFstw=
 github.com/metacubex/uber-atomic v0.0.0-20230202125923-feb10b770370 h1:UkViS4DCESAUEYgbIEQdD02hyMacFt6Dny+1MOJtNIo=
 github.com/metacubex/uber-atomic v0.0.0-20230202125923-feb10b770370/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
@@ -127,16 +127,16 @@ github.com/sagernet/go-tun2socks v1.16.12-0.20220818015926-16cb67876a61/go.mod h
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97 h1:iL5gZI3uFp0X6EslacyapiRz7LLSJyr4RajF/BhMVyE=
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
 github.com/sagernet/sing v0.0.0-20220817130738-ce854cda8522/go.mod h1:QVsS5L/ZA2Q5UhQwLrn0Trw+msNd/NPGEhBKR/ioWiY=
-github.com/sagernet/sing v0.1.8 h1:6DKo2FkSHn0nUcjO7bAext/ai7y7pCusK/+fScBJ5Jk=
-github.com/sagernet/sing v0.1.8/go.mod h1:jt1w2u7lJQFFSGLiRrRIs5YWmx4kAPfWuOejuDW9qMk=
-github.com/sagernet/sing-shadowtls v0.1.0 h1:05MYce8aR5xfKIn+y7xRFsdKhKt44QZTSEQW+lG5IWQ=
-github.com/sagernet/sing-shadowtls v0.1.0/go.mod h1:Kn1VUIprdkwCgkS6SXYaLmIpKzQbqBIKJBMY+RvBhYc=
-github.com/sagernet/sing-vmess v0.1.3-0.20230307060529-d110e81a50bc h1:vqlYWupvVDRpvv2F+RtECJN+VbuKjLtmQculQvOecls=
-github.com/sagernet/sing-vmess v0.1.3-0.20230307060529-d110e81a50bc/go.mod h1:V14iffGwhZPU2S7wgIiPlLWXygSjAXazYzD1w0ejBl4=
+github.com/sagernet/sing v0.1.8-0.20230221060643-3401d210384b h1:Ji2AfGlc4j9AitobOx4k3BCj7eS5nSxL1cgaL81zvlo=
+github.com/sagernet/sing v0.1.8-0.20230221060643-3401d210384b/go.mod h1:jt1w2u7lJQFFSGLiRrRIs5YWmx4kAPfWuOejuDW9qMk=
+github.com/sagernet/sing-shadowtls v0.0.0-20230221130515-dac782ca098e h1:S1fd0kB9aEU68dd269AQy783sUlFu/2fSh/4YYVJ/Oc=
+github.com/sagernet/sing-shadowtls v0.0.0-20230221130515-dac782ca098e/go.mod h1:Kn1VUIprdkwCgkS6SXYaLmIpKzQbqBIKJBMY+RvBhYc=
+github.com/sagernet/sing-vmess v0.1.2 h1:RbOZNAId2LrCai8epMoQXlf0XTrou0bfcw08hNBg6lM=
+github.com/sagernet/sing-vmess v0.1.2/go.mod h1:9NSj8mZTx1JIY/HF9LaYRppUsVkysIN5tEFpNZujXxY=
 github.com/sagernet/tfo-go v0.0.0-20230207095944-549363a7327d h1:trP/l6ZPWvQ/5Gv99Z7/t/v8iYy06akDMejxW1sznUk=
 github.com/sagernet/tfo-go v0.0.0-20230207095944-549363a7327d/go.mod h1:jk6Ii8Y3En+j2KQDLgdgQGwb3M6y7EL567jFnGYhN9g=
-github.com/sagernet/utls v0.0.0-20230309024959-6732c2ab36f2 h1:kDUqhc9Vsk5HJuhfIATJ8oQwBmpOZJuozQG7Vk88lL4=
-github.com/sagernet/utls v0.0.0-20230309024959-6732c2ab36f2/go.mod h1:JKQMZq/O2qnZjdrt+B57olmfgEmLtY9iiSIEYtWvoSM=
+github.com/sagernet/utls v0.0.0-20230220130002-c08891932056 h1:gDXi/0uYe8dA48UyUI1LM2la5QYN0IvsDvR2H2+kFnA=
+github.com/sagernet/utls v0.0.0-20230220130002-c08891932056/go.mod h1:JKQMZq/O2qnZjdrt+B57olmfgEmLtY9iiSIEYtWvoSM=
 github.com/sagernet/wireguard-go v0.0.0-20221116151939-c99467f53f2c h1:vK2wyt9aWYHHvNLWniwijBu/n4pySypiKRhN32u/JGo=
 github.com/sagernet/wireguard-go v0.0.0-20221116151939-c99467f53f2c/go.mod h1:euOmN6O5kk9dQmgSS8Df4psAl3TCjxOz0NW60EWkSaI=
 github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
@@ -162,8 +162,6 @@ github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1
 github.com/xtls/go v0.0.0-20220914232946-0441cf4cf837 h1:AHhUwwFJGl27E46OpdJHplZkK09m7aETNBNzhT6t15M=
 github.com/xtls/go v0.0.0-20220914232946-0441cf4cf837/go.mod h1:YJTRELIWrGxR1s8xcEBgxcxBfwQfMGjdvNLTjN9XFgY=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/zhangyunhao116/fastrand v0.3.0 h1:7bwe124xcckPulX6fxtr2lFdO2KQqaefdtbk+mqO/Ig=
-github.com/zhangyunhao116/fastrand v0.3.0/go.mod h1:0v5KgHho0VE6HU192HnY15de/oDS8UrbBChIFjIhBtc=
 go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
 go.uber.org/automaxprocs v1.5.1 h1:e1YG66Lrk73dn4qhg8WFSvhF0JuFQF0ERIp4rpuV8Qk=
@@ -192,8 +190,8 @@ golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.6.0 h1:L4ZwwTvKW9gr0ZMS1yrHD9GZhIuVjOBBnaKH+SPQK0Q=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=

hub/executor/executor.go

@@ -128,7 +128,7 @@ func GetGeneral() *config.General {
 		GeodataLoader: G.LoaderName(),
 		Interface:     dialer.DefaultInterface.Load(),
 		Sniffing:      tunnel.IsSniffing(),
-		TCPConcurrent: dialer.GetTcpConcurrent(),
+		TCPConcurrent: dialer.GetDial(),
 	}
 
 	return general
@@ -169,11 +169,9 @@ func updateExperimental(c *config.Config) {
 }
 
 func preUpdateExperimental(c *config.Config) {
-	CTLS.ResetCertificate()
+	CTLS.AddCertificate(c.TLS.PrivateKey, c.TLS.Certificate)
 	for _, c := range c.TLS.CustomTrustCert {
-		if err := CTLS.AddCertificate(c); err != nil {
-			log.Warnln("%s\nadd error: %s", c, err.Error())
-		}
+		CTLS.AddCertificate(c.PrivateKey, c.Certificate)
 	}
 }
 
@@ -190,7 +188,6 @@ func updateDNS(c *config.DNS, generalIPv6 bool) {
 		Main:         c.NameServer,
 		Fallback:     c.Fallback,
 		IPv6:         c.IPv6 && generalIPv6,
-		IPv6Timeout:  c.IPv6Timeout,
 		EnhancedMode: c.EnhancedMode,
 		Pool:         c.FakeIPRange,
 		Hosts:        c.Hosts,
@@ -226,8 +223,8 @@ func updateDNS(c *config.DNS, generalIPv6 bool) {
 	dns.ReCreateServer(c.Listen, r, m)
 }
 
-func updateHosts(tree *trie.DomainTrie[resolver.HostValue]) {
-	resolver.DefaultHosts = resolver.NewHosts(tree)
+func updateHosts(tree *trie.DomainTrie[netip.Addr]) {
+	resolver.DefaultHosts = tree
 }
 
 func updateProxies(proxies map[string]C.Proxy, providers map[string]provider.ProxyProvider) {
@@ -332,10 +329,14 @@ func updateTunnels(tunnels []LC.Tunnel) {
 func updateGeneral(general *config.General) {
 	tunnel.SetMode(general.Mode)
 	tunnel.SetFindProcessMode(general.FindProcessMode)
-	resolver.DisableIPv6 = !general.IPv6
+	dialer.DisableIPv6 = !general.IPv6
+	if !dialer.DisableIPv6 {
+		log.Infoln("Use IPv6")
+	}
+	resolver.DisableIPv6 = dialer.DisableIPv6
 
 	if general.TCPConcurrent {
-		dialer.SetTcpConcurrent(general.TCPConcurrent)
+		dialer.SetDial(general.TCPConcurrent)
 		log.Infoln("Use tcp concurrent")
 	}
 

hub/hub.go

@@ -44,7 +44,7 @@ func Parse(options ...Option) error {
 
 	if cfg.General.ExternalController != "" {
 		go route.Start(cfg.General.ExternalController, cfg.General.ExternalControllerTLS,
-			cfg.General.Secret, cfg.TLS.Certificate, cfg.TLS.PrivateKey, cfg.General.LogLevel == log.DEBUG)
+			cfg.General.Secret, cfg.TLS.Certificate, cfg.TLS.PrivateKey,cfg.General.LogLevel==log.DEBUG)
 	}
 
 	executor.ApplyConfig(cfg, true)

hub/route/configs.go

@@ -228,7 +228,7 @@ func patchConfigs(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if general.TcpConcurrent != nil {
-		dialer.SetTcpConcurrent(*general.TcpConcurrent)
+		dialer.SetDial(*general.TcpConcurrent)
 	}
 
 	if general.InterfaceName != nil {

listener/sing_shadowsocks/server.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net"
 	"strings"
-	"time"
 
 	"github.com/Dreamacro/clash/adapter/inbound"
 	"github.com/Dreamacro/clash/common/sockopt"
@@ -64,7 +63,7 @@ func New(config LC.ShadowsocksServer, tcpIn chan<- C.ConnContext, udpIn chan<- C
 	case common.Contains(shadowaead.List, config.Cipher):
 		sl.service, err = shadowaead.NewService(config.Cipher, nil, config.Password, udpTimeout, h)
 	case common.Contains(shadowaead_2022.List, config.Cipher):
-		sl.service, err = shadowaead_2022.NewServiceWithPassword(config.Cipher, config.Password, udpTimeout, h, time.Now)
+		sl.service, err = shadowaead_2022.NewServiceWithPassword(config.Cipher, config.Password, udpTimeout, h)
 	default:
 		err = fmt.Errorf("shadowsocks: unsupported method: %s", config.Cipher)
 		return embedSS.New(config, tcpIn, udpIn)

listener/sing_tun/server.go

@@ -221,7 +221,7 @@ func New(options LC.Tun, tcpIn chan<- C.ConnContext, udpIn chan<- C.PacketAdapte
 		err = E.Cause(err, "build android rules")
 		return
 	}
-	tunIf, err := tunNew(tunOptions)
+	tunIf, err := tunOpen(tunOptions)
 	if err != nil {
 		err = E.Cause(err, "configure tun interface")
 		return

listener/sing_tun/server_notwindows.go

@@ -6,6 +6,6 @@ import (
 	tun "github.com/metacubex/sing-tun"
 )
 
-func tunNew(options tun.Options) (tun.Tun, error) {
-	return tun.New(options)
+func tunOpen(options tun.Options) (tun.Tun, error) {
+	return tun.Open(options)
 }

listener/sing_tun/server_windows.go

@@ -8,11 +8,11 @@ import (
 	tun "github.com/metacubex/sing-tun"
 )
 
-func tunNew(options tun.Options) (tunIf tun.Tun, err error) {
+func tunOpen(options tun.Options) (tunIf tun.Tun, err error) {
 	maxRetry := 3
 	for i := 0; i < maxRetry; i++ {
 		timeBegin := time.Now()
-		tunIf, err = tun.New(options)
+		tunIf, err = tun.Open(options)
 		if err == nil {
 			return
 		}

transport/gun/gun.go

@@ -20,7 +20,6 @@ import (
 	"github.com/Dreamacro/clash/common/buf"
 	"github.com/Dreamacro/clash/common/pool"
 	tlsC "github.com/Dreamacro/clash/component/tls"
-
 	"go.uber.org/atomic"
 	"golang.org/x/net/http2"
 )
@@ -190,7 +189,7 @@ func (g *Conn) SetDeadline(t time.Time) error {
 	return nil
 }
 
-func NewHTTP2Client(dialFn DialFn, tlsConfig *tls.Config, Fingerprint string, realityConfig *tlsC.RealityConfig) *TransportWrap {
+func NewHTTP2Client(dialFn DialFn, tlsConfig *tls.Config, Fingerprint string) *TransportWrap {
 	wrap := TransportWrap{}
 
 	dialFunc := func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
@@ -202,37 +201,20 @@ func NewHTTP2Client(dialFn DialFn, tlsConfig *tls.Config, Fingerprint string, re
 		wrap.remoteAddr = pconn.RemoteAddr()
 
 		if len(Fingerprint) != 0 {
-			if realityConfig == nil {
-				if fingerprint, exists := tlsC.GetFingerprint(Fingerprint); exists {
-					utlsConn := tlsC.UClient(pconn, cfg, fingerprint)
-					if err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx); err != nil {
-						pconn.Close()
-						return nil, err
-					}
-					state := utlsConn.(*tlsC.UConn).ConnectionState()
-					if p := state.NegotiatedProtocol; p != http2.NextProtoTLS {
-						utlsConn.Close()
-						return nil, fmt.Errorf("http2: unexpected ALPN protocol %s, want %s", p, http2.NextProtoTLS)
-					}
-					return utlsConn, nil
-				}
-			} else {
-				realityConn, err := tlsC.GetRealityConn(ctx, pconn, Fingerprint, cfg, realityConfig)
-				if err != nil {
+			if fingerprint, exists := tlsC.GetFingerprint(Fingerprint); exists {
+				utlsConn := tlsC.UClient(pconn, cfg, fingerprint)
+				if err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx); err != nil {
 					pconn.Close()
 					return nil, err
 				}
-				//state := realityConn.(*utls.UConn).ConnectionState()
-				//if p := state.NegotiatedProtocol; p != http2.NextProtoTLS {
-				//	realityConn.Close()
-				//	return nil, fmt.Errorf("http2: unexpected ALPN protocol %s, want %s", p, http2.NextProtoTLS)
-				//}
-				return realityConn, nil
+				state := utlsConn.(*tlsC.UConn).ConnectionState()
+				if p := state.NegotiatedProtocol; p != http2.NextProtoTLS {
+					utlsConn.Close()
+					return nil, fmt.Errorf("http2: unexpected ALPN protocol %s, want %s", p, http2.NextProtoTLS)
+				}
+				return utlsConn, nil
 			}
 		}
-		if realityConfig != nil {
-			return nil, errors.New("REALITY is based on uTLS, please set a client-fingerprint")
-		}
 
 		conn := tls.Client(pconn, cfg)
 		if err := conn.HandshakeContext(ctx); err != nil {
@@ -292,11 +274,11 @@ func StreamGunWithTransport(transport *TransportWrap, cfg *Config) (net.Conn, er
 	return conn, nil
 }
 
-func StreamGunWithConn(conn net.Conn, tlsConfig *tls.Config, cfg *Config, realityConfig *tlsC.RealityConfig) (net.Conn, error) {
+func StreamGunWithConn(conn net.Conn, tlsConfig *tls.Config, cfg *Config) (net.Conn, error) {
 	dialFn := func(network, addr string) (net.Conn, error) {
 		return conn, nil
 	}
 
-	transport := NewHTTP2Client(dialFn, tlsConfig, cfg.ClientFingerprint, realityConfig)
+	transport := NewHTTP2Client(dialFn, tlsConfig, cfg.ClientFingerprint)
 	return StreamGunWithTransport(transport, cfg)
 }

transport/hysteria/conns/udp/hop.go

@@ -2,6 +2,7 @@ package udp
 
 import (
 	"errors"
+	"math/rand"
 	"net"
 	"strconv"
 	"strings"
@@ -11,8 +12,6 @@ import (
 
 	"github.com/Dreamacro/clash/transport/hysteria/obfs"
 	"github.com/Dreamacro/clash/transport/hysteria/utils"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 const (
@@ -86,7 +85,7 @@ func NewObfsUDPHopClientPacketConn(server string, serverPorts string, hopInterva
 		serverAddrs: serverAddrs,
 		hopInterval: hopInterval,
 		obfs:        obfs,
-		addrIndex:   fastrand.Intn(len(serverAddrs)),
+		addrIndex:   rand.Intn(len(serverAddrs)),
 		recvQueue:   make(chan *udpPacket, packetQueueSize),
 		closeChan:   make(chan struct{}),
 		bufPool: sync.Pool{
@@ -177,7 +176,7 @@ func (c *ObfsUDPHopClientPacketConn) hop(dialer utils.PacketDialer, rAddr net.Ad
 		_ = trySetPacketConnWriteBuffer(c.currentConn, c.writeBufferSize)
 	}
 	go c.recvRoutine(c.currentConn)
-	c.addrIndex = fastrand.Intn(len(c.serverAddrs))
+	c.addrIndex = rand.Intn(len(c.serverAddrs))
 }
 
 func (c *ObfsUDPHopClientPacketConn) ReadFrom(b []byte) (int, net.Addr, error) {

transport/hysteria/conns/wechat/obfs.go

@@ -2,14 +2,12 @@ package wechat
 
 import (
 	"encoding/binary"
+	"github.com/Dreamacro/clash/log"
+	"github.com/Dreamacro/clash/transport/hysteria/obfs"
+	"math/rand"
 	"net"
 	"sync"
 	"time"
-
-	"github.com/Dreamacro/clash/log"
-	"github.com/Dreamacro/clash/transport/hysteria/obfs"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 const udpBufferSize = 65535
@@ -31,7 +29,7 @@ func NewObfsWeChatUDPConn(orig net.PacketConn, obfs obfs.Obfuscator) *ObfsWeChat
 		obfs:     obfs,
 		readBuf:  make([]byte, udpBufferSize),
 		writeBuf: make([]byte, udpBufferSize),
-		sn:       fastrand.Uint32() & 0xFFFF,
+		sn:       rand.Uint32() & 0xFFFF,
 	}
 }
 

transport/hysteria/core/client.go

@@ -6,20 +6,20 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net"
 	"strconv"
 	"sync"
 	"time"
 
+	"github.com/lunixbochs/struc"
+	"github.com/metacubex/quic-go"
+	"github.com/metacubex/quic-go/congestion"
+
 	"github.com/Dreamacro/clash/transport/hysteria/obfs"
 	"github.com/Dreamacro/clash/transport/hysteria/pmtud_fix"
 	"github.com/Dreamacro/clash/transport/hysteria/transport"
 	"github.com/Dreamacro/clash/transport/hysteria/utils"
-
-	"github.com/lunixbochs/struc"
-	"github.com/metacubex/quic-go"
-	"github.com/metacubex/quic-go/congestion"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 var (
@@ -408,7 +408,7 @@ func (c *quicPktConn) WriteTo(p []byte, addr string) error {
 	if err != nil {
 		if errSize, ok := err.(quic.ErrMessageTooLarge); ok {
 			// need to frag
-			msg.MsgID = uint16(fastrand.Intn(0xFFFF)) + 1 // msgID must be > 0 when fragCount > 1
+			msg.MsgID = uint16(rand.Intn(0xFFFF)) + 1 // msgID must be > 0 when fragCount > 1
 			fragMsgs := fragUDPMessage(msg, int(errSize))
 			for _, fragMsg := range fragMsgs {
 				msgBuf.Reset()

transport/hysteria/obfs/xplus.go

@@ -2,8 +2,9 @@ package obfs
 
 import (
 	"crypto/sha256"
-
-	"github.com/zhangyunhao116/fastrand"
+	"math/rand"
+	"sync"
+	"time"
 )
 
 // [salt][obfuscated payload]
@@ -11,12 +12,16 @@ import (
 const saltLen = 16
 
 type XPlusObfuscator struct {
-	Key []byte
+	Key     []byte
+	RandSrc *rand.Rand
+
+	lk sync.Mutex
 }
 
 func NewXPlusObfuscator(key []byte) *XPlusObfuscator {
 	return &XPlusObfuscator{
-		Key: key,
+		Key:     key,
+		RandSrc: rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
 
@@ -35,7 +40,9 @@ func (x *XPlusObfuscator) Deobfuscate(in []byte, out []byte) int {
 }
 
 func (x *XPlusObfuscator) Obfuscate(in []byte, out []byte) int {
-	_, _ = fastrand.Read(out[:saltLen]) // salt
+	x.lk.Lock()
+	_, _ = x.RandSrc.Read(out[:saltLen]) // salt
+	x.lk.Unlock()
 	// Obfuscate the payload
 	key := sha256.Sum256(append(x.Key, out[:saltLen]...))
 	for i, c := range in {

transport/simple-obfs/http.go

@@ -5,12 +5,11 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
+	"math/rand"
 	"net"
 	"net/http"
 
 	"github.com/Dreamacro/clash/common/pool"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 // HTTPObfs is shadowsocks http simple-obfs implementation
@@ -64,9 +63,9 @@ func (ho *HTTPObfs) Read(b []byte) (int, error) {
 func (ho *HTTPObfs) Write(b []byte) (int, error) {
 	if ho.firstRequest {
 		randBytes := make([]byte, 16)
-		fastrand.Read(randBytes)
+		rand.Read(randBytes)
 		req, _ := http.NewRequest("GET", fmt.Sprintf("http://%s/", ho.host), bytes.NewBuffer(b[:]))
-		req.Header.Set("User-Agent", fmt.Sprintf("curl/7.%d.%d", fastrand.Int()%54, fastrand.Int()%2))
+		req.Header.Set("User-Agent", fmt.Sprintf("curl/7.%d.%d", rand.Int()%54, rand.Int()%2))
 		req.Header.Set("Upgrade", "websocket")
 		req.Header.Set("Connection", "Upgrade")
 		req.Host = ho.host

transport/simple-obfs/tls.go

@@ -4,14 +4,17 @@ import (
 	"bytes"
 	"encoding/binary"
 	"io"
+	"math/rand"
 	"net"
 	"time"
 
 	"github.com/Dreamacro/clash/common/pool"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
+func init() {
+	rand.Seed(time.Now().Unix())
+}
+
 const (
 	chunkSize = 1 << 14 // 2 ** 14 == 16 * 1024
 )
@@ -127,8 +130,8 @@ func NewTLSObfs(conn net.Conn, server string) net.Conn {
 func makeClientHelloMsg(data []byte, server string) []byte {
 	random := make([]byte, 28)
 	sessionID := make([]byte, 32)
-	fastrand.Read(random)
-	fastrand.Read(sessionID)
+	rand.Read(random)
+	rand.Read(sessionID)
 
 	buf := &bytes.Buffer{}
 

transport/ssr/obfs/http_simple.go

@@ -4,13 +4,12 @@ import (
 	"bytes"
 	"encoding/hex"
 	"io"
+	"math/rand"
 	"net"
 	"strconv"
 	"strings"
 
 	"github.com/Dreamacro/clash/common/pool"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 func init() {
@@ -82,7 +81,7 @@ func (c *httpConn) Write(b []byte) (int, error) {
 	bLength := len(b)
 	headDataLength := bLength
 	if bLength-headLength > 64 {
-		headDataLength = headLength + fastrand.Intn(65)
+		headDataLength = headLength + rand.Intn(65)
 	}
 	headData := b[:headDataLength]
 	b = b[headDataLength:]
@@ -100,7 +99,7 @@ func (c *httpConn) Write(b []byte) (int, error) {
 		}
 	}
 	hosts := strings.Split(host, ",")
-	host = hosts[fastrand.Intn(len(hosts))]
+	host = hosts[rand.Intn(len(hosts))]
 
 	buf := pool.GetBuffer()
 	defer pool.PutBuffer(buf)
@@ -119,7 +118,7 @@ func (c *httpConn) Write(b []byte) (int, error) {
 		buf.WriteString(body + "\r\n\r\n")
 	} else {
 		buf.WriteString("User-Agent: ")
-		buf.WriteString(userAgent[fastrand.Intn(len(userAgent))])
+		buf.WriteString(userAgent[rand.Intn(len(userAgent))])
 		buf.WriteString("\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.8\r\nAccept-Encoding: gzip, deflate\r\n")
 		if c.post {
 			packBoundary(buf)
@@ -147,7 +146,7 @@ func packBoundary(buf *bytes.Buffer) {
 	buf.WriteString("Content-Type: multipart/form-data; boundary=")
 	set := "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
 	for i := 0; i < 32; i++ {
-		buf.WriteByte(set[fastrand.Intn(62)])
+		buf.WriteByte(set[rand.Intn(62)])
 	}
 	buf.WriteString("\r\n")
 }

transport/ssr/obfs/random_head.go

@@ -3,11 +3,10 @@ package obfs
 import (
 	"encoding/binary"
 	"hash/crc32"
+	"math/rand"
 	"net"
 
 	"github.com/Dreamacro/clash/common/pool"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 func init() {
@@ -54,10 +53,10 @@ func (c *randomHeadConn) Write(b []byte) (int, error) {
 	c.buf = append(c.buf, b...)
 	if !c.hasSentHeader {
 		c.hasSentHeader = true
-		dataLength := fastrand.Intn(96) + 4
+		dataLength := rand.Intn(96) + 4
 		buf := pool.Get(dataLength + 4)
 		defer pool.Put(buf)
-		fastrand.Read(buf[:dataLength])
+		rand.Read(buf[:dataLength])
 		binary.LittleEndian.PutUint32(buf[dataLength:], 0xffffffff-crc32.ChecksumIEEE(buf[:dataLength]))
 		_, err := c.Conn.Write(buf)
 		return len(b), err

transport/ssr/obfs/tls1.2_ticket_auth.go

@@ -4,14 +4,13 @@ import (
 	"bytes"
 	"crypto/hmac"
 	"encoding/binary"
+	"math/rand"
 	"net"
 	"strings"
 	"time"
 
 	"github.com/Dreamacro/clash/common/pool"
 	"github.com/Dreamacro/clash/transport/ssr/tools"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 func init() {
@@ -26,7 +25,7 @@ type tls12Ticket struct {
 
 func newTLS12Ticket(b *Base) Obfs {
 	r := &tls12Ticket{Base: b, authData: &authData{}}
-	fastrand.Read(r.clientID[:])
+	rand.Read(r.clientID[:])
 	return r
 }
 
@@ -91,7 +90,7 @@ func (c *tls12TicketConn) Write(b []byte) (int, error) {
 		buf := pool.GetBuffer()
 		defer pool.PutBuffer(buf)
 		for len(b) > 2048 {
-			size := fastrand.Intn(4096) + 100
+			size := rand.Intn(4096) + 100
 			if len(b) < size {
 				size = len(b)
 			}
@@ -197,7 +196,7 @@ func packSNIData(buf *bytes.Buffer, u string) {
 }
 
 func (c *tls12TicketConn) packTicketBuf(buf *bytes.Buffer, u string) {
-	length := 16 * (fastrand.Intn(17) + 8)
+	length := 16 * (rand.Intn(17) + 8)
 	buf.Write([]byte{0, 0x23})
 	binary.Write(buf, binary.BigEndian, uint16(length))
 	tools.AppendRandBytes(buf, length)
@@ -222,6 +221,6 @@ func (t *tls12Ticket) getHost() string {
 		host = ""
 	}
 	hosts := strings.Split(host, ",")
-	host = hosts[fastrand.Intn(len(hosts))]
+	host = hosts[rand.Intn(len(hosts))]
 	return host
 }

transport/ssr/protocol/auth_aes128_sha1.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"math"
+	"math/rand"
 	"net"
 	"strconv"
 	"strings"
@@ -11,8 +12,6 @@ import (
 	"github.com/Dreamacro/clash/common/pool"
 	"github.com/Dreamacro/clash/log"
 	"github.com/Dreamacro/clash/transport/ssr/tools"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 type (
@@ -65,7 +64,7 @@ func (a *authAES128) initUserData() {
 	}
 	if len(a.userKey) == 0 {
 		a.userKey = a.Key
-		fastrand.Read(a.userID[:])
+		rand.Read(a.userID[:])
 	}
 }
 
@@ -199,7 +198,7 @@ func (a *authAES128) packData(poolBuf *bytes.Buffer, data []byte, fullDataLength
 }
 
 func trapezoidRandom(max int, d float64) int {
-	base := fastrand.Float64()
+	base := rand.Float64()
 	if d-0 > 1e-6 {
 		a := 1 - d
 		base = (math.Sqrt(a*a+4*d*base) - a) / (2 * d)
@@ -220,10 +219,10 @@ func (a *authAES128) getRandDataLengthForPackData(dataLength, fullDataLength int
 		if revLength > -1460 {
 			return trapezoidRandom(revLength+1460, -0.3)
 		}
-		return fastrand.Intn(32)
+		return rand.Intn(32)
 	}
 	if dataLength > 900 {
-		return fastrand.Intn(revLength)
+		return rand.Intn(revLength)
 	}
 	return trapezoidRandom(revLength, -0.3)
 }
@@ -248,7 +247,7 @@ func (a *authAES128) packAuthData(poolBuf *bytes.Buffer, data []byte) {
 	copy(macKey, a.iv)
 	copy(macKey[len(a.iv):], a.Key)
 
-	poolBuf.WriteByte(byte(fastrand.Intn(256)))
+	poolBuf.WriteByte(byte(rand.Intn(256)))
 	poolBuf.Write(a.hmac(macKey, poolBuf.Bytes())[:6])
 	poolBuf.Write(a.userID[:])
 	err := a.authData.putEncryptedData(poolBuf, a.userKey, [2]int{packedAuthDataLength, randDataLength}, a.salt)
@@ -264,9 +263,9 @@ func (a *authAES128) packAuthData(poolBuf *bytes.Buffer, data []byte) {
 
 func (a *authAES128) getRandDataLengthForPackAuthData(size int) int {
 	if size > 400 {
-		return fastrand.Intn(512)
+		return rand.Intn(512)
 	}
-	return fastrand.Intn(1024)
+	return rand.Intn(1024)
 }
 
 func (a *authAES128) packRandData(poolBuf *bytes.Buffer, size int) {

transport/ssr/protocol/auth_sha1_v4.go

@@ -5,12 +5,11 @@ import (
 	"encoding/binary"
 	"hash/adler32"
 	"hash/crc32"
+	"math/rand"
 	"net"
 
 	"github.com/Dreamacro/clash/common/pool"
 	"github.com/Dreamacro/clash/transport/ssr/tools"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 func init() {
@@ -177,7 +176,7 @@ func (a *authSHA1V4) getRandDataLength(size int) int {
 		return 0
 	}
 	if size > 400 {
-		return fastrand.Intn(256)
+		return rand.Intn(256)
 	}
-	return fastrand.Intn(512)
+	return rand.Intn(512)
 }

transport/ssr/protocol/base.go

@@ -6,14 +6,13 @@ import (
 	"crypto/cipher"
 	"encoding/base64"
 	"encoding/binary"
+	"math/rand"
 	"sync"
 	"time"
 
 	"github.com/Dreamacro/clash/common/pool"
 	"github.com/Dreamacro/clash/log"
 	"github.com/Dreamacro/clash/transport/shadowsocks/core"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 type Base struct {
@@ -38,8 +37,8 @@ func (a *authData) next() *authData {
 	a.mutex.Lock()
 	defer a.mutex.Unlock()
 	if a.connectionID > 0xff000000 || a.connectionID == 0 {
-		fastrand.Read(a.clientID[:])
-		a.connectionID = fastrand.Uint32() & 0xffffff
+		rand.Read(a.clientID[:])
+		a.connectionID = rand.Uint32() & 0xffffff
 	}
 	a.connectionID++
 	copy(r.clientID[:], a.clientID[:])

transport/ssr/protocol/protocol.go

@@ -4,9 +4,8 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 var (
@@ -69,7 +68,7 @@ func getHeadSize(b []byte, defaultValue int) int {
 
 func getDataLength(b []byte) int {
 	bLength := len(b)
-	dataLength := getHeadSize(b, 30) + fastrand.Intn(32)
+	dataLength := getHeadSize(b, 30) + rand.Intn(32)
 	if bLength < dataLength {
 		return bLength
 	}

transport/trojan/trojan.go

@@ -19,7 +19,6 @@ import (
 	"github.com/Dreamacro/clash/transport/socks5"
 	"github.com/Dreamacro/clash/transport/vless"
 	"github.com/Dreamacro/clash/transport/vmess"
-
 	xtls "github.com/xtls/go"
 )
 
@@ -55,7 +54,6 @@ type Option struct {
 	Flow              string
 	FlowShow          bool
 	ClientFingerprint string
-	Reality           *tlsC.RealityConfig
 }
 
 type WebsocketOption struct {
@@ -119,24 +117,16 @@ func (t *Trojan) StreamConn(conn net.Conn) (net.Conn, error) {
 		}
 
 		if len(t.option.ClientFingerprint) != 0 {
-			if t.option.Reality == nil {
-				utlsConn, valid := vmess.GetUTLSConn(conn, t.option.ClientFingerprint, tlsConfig)
-				if valid {
-					ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTLSTimeout)
-					defer cancel()
-
-					err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx)
-					return utlsConn, err
-				}
-			} else {
+			utlsConn, valid := vmess.GetUtlsConnWithClientFingerprint(conn, t.option.ClientFingerprint, tlsConfig)
+			if valid {
 				ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTLSTimeout)
 				defer cancel()
-				return tlsC.GetRealityConn(ctx, conn, t.option.ClientFingerprint, tlsConfig, t.option.Reality)
+
+				err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx)
+				return utlsConn, err
+
 			}
 		}
-		if t.option.Reality != nil {
-			return nil, errors.New("REALITY is based on uTLS, please set a client-fingerprint")
-		}
 
 		tlsConn := tls.Client(conn, tlsConfig)
 

transport/tuic/client.go

@@ -6,19 +6,19 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
+	"math/rand"
 	"net"
 	"runtime"
 	"sync"
 	"sync/atomic"
 	"time"
 
+	"github.com/metacubex/quic-go"
+
 	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/common/pool"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/log"
-
-	"github.com/metacubex/quic-go"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 var (
@@ -352,7 +352,7 @@ func (t *clientImpl) ListenPacketWithDialer(ctx context.Context, metadata *C.Met
 	pipe1, pipe2 := net.Pipe()
 	var connId uint32
 	for {
-		connId = fastrand.Uint32()
+		connId = rand.Uint32()
 		_, loaded := t.udpInputMap.LoadOrStore(connId, pipe1)
 		if !loaded {
 			break

transport/tuic/congestion/bbr_sender.go

@@ -5,11 +5,11 @@ package congestion
 import (
 	"fmt"
 	"math"
+	"math/rand"
 	"net"
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 const (
@@ -780,7 +780,7 @@ func (b *bbrSender) EnterProbeBandwidthMode(now time.Time) {
 	// Pick a random offset for the gain cycle out of {0, 2..7} range. 1 is
 	// excluded because in that case increased gain and decreased gain would not
 	// follow each other.
-	b.cycleCurrentOffset = fastrand.Int() % (GainCycleLength - 1)
+	b.cycleCurrentOffset = rand.Int() % (GainCycleLength - 1)
 	if b.cycleCurrentOffset >= 1 {
 		b.cycleCurrentOffset += 1
 	}

transport/tuic/server.go

@@ -11,14 +11,13 @@ import (
 	"sync/atomic"
 	"time"
 
-	N "github.com/Dreamacro/clash/common/net"
-	"github.com/Dreamacro/clash/common/pool"
-	"github.com/Dreamacro/clash/common/utils"
-	C "github.com/Dreamacro/clash/constant"
-	"github.com/Dreamacro/clash/transport/socks5"
-
 	"github.com/gofrs/uuid"
 	"github.com/metacubex/quic-go"
+
+	N "github.com/Dreamacro/clash/common/net"
+	"github.com/Dreamacro/clash/common/pool"
+	C "github.com/Dreamacro/clash/constant"
+	"github.com/Dreamacro/clash/transport/socks5"
 )
 
 type ServerOption struct {
@@ -56,7 +55,7 @@ func (s *Server) Serve() error {
 			return err
 		}
 		SetCongestionController(conn, s.CongestionController)
-		uuid, err := utils.UnsafeUUIDGenerator.NewV4()
+		uuid, err := uuid.NewV4()
 		if err != nil {
 			return err
 		}
@@ -76,7 +75,7 @@ func (s *Server) Close() error {
 
 type serverHandler struct {
 	*Server
-	quicConn quic.EarlyConnection
+	quicConn quic.Connection
 	uuid     uuid.UUID
 
 	authCh   chan struct{}
@@ -87,6 +86,13 @@ type serverHandler struct {
 }
 
 func (s *serverHandler) handle() {
+	time.AfterFunc(s.AuthenticationTimeout, func() {
+		s.authOnce.Do(func() {
+			_ = s.quicConn.CloseWithError(AuthenticationTimeout, "")
+			s.authOk = false
+			close(s.authCh)
+		})
+	})
 	go func() {
 		_ = s.handleUniStream()
 	}()
@@ -96,15 +102,6 @@ func (s *serverHandler) handle() {
 	go func() {
 		_ = s.handleMessage()
 	}()
-
-	<-s.quicConn.HandshakeComplete().Done()
-	time.AfterFunc(s.AuthenticationTimeout, func() {
-		s.authOnce.Do(func() {
-			_ = s.quicConn.CloseWithError(AuthenticationTimeout, "AuthenticationTimeout")
-			s.authOk = false
-			close(s.authCh)
-		})
-	})
 }
 
 func (s *serverHandler) handleMessage() (err error) {
@@ -241,7 +238,7 @@ func (s *serverHandler) handleUniStream() (err error) {
 				}
 				s.authOnce.Do(func() {
 					if !ok {
-						_ = s.quicConn.CloseWithError(AuthenticationFailed, "AuthenticationFailed")
+						_ = s.quicConn.CloseWithError(AuthenticationFailed, "")
 					}
 					s.authOk = ok
 					close(s.authCh)

transport/vless/conn.go

@@ -15,26 +15,29 @@ import (
 
 	"github.com/Dreamacro/clash/common/buf"
 	N "github.com/Dreamacro/clash/common/net"
+
 	tlsC "github.com/Dreamacro/clash/component/tls"
 	"github.com/Dreamacro/clash/log"
-
 	"github.com/gofrs/uuid"
+	buf2 "github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/common/rw"
 	utls "github.com/sagernet/utls"
 	xtls "github.com/xtls/go"
 	"google.golang.org/protobuf/proto"
 )
 
 type Conn struct {
-	N.ExtendedWriter
-	N.ExtendedReader
+	network.ExtendedWriter
+	network.ExtendedReader
 	net.Conn
 	dst      *DstAddr
 	id       *uuid.UUID
 	addons   *Addons
 	received bool
 
+	handshake      chan struct{}
 	handshakeMutex sync.Mutex
-	needHandshake  bool
 	err            error
 
 	tlsConn  net.Conn
@@ -59,7 +62,7 @@ type Conn struct {
 func (vc *Conn) Read(b []byte) (int, error) {
 	if vc.received {
 		if vc.readProcess {
-			buffer := buf.With(b)
+			buffer := buf2.With(b)
 			err := vc.ReadBuffer(buffer)
 			return buffer.Len(), err
 		}
@@ -87,7 +90,7 @@ func (vc *Conn) ReadBuffer(buffer *buf.Buffer) error {
 			return err
 		}
 		if vc.readRemainingPadding > 0 {
-			_, err := io.CopyN(io.Discard, vc.ExtendedReader, int64(vc.readRemainingPadding))
+			err := rw.SkipN(vc.ExtendedReader, vc.readRemainingPadding)
 			if err != nil {
 				return err
 			}
@@ -133,16 +136,15 @@ func (vc *Conn) ReadBuffer(buffer *buf.Buffer) error {
 				vc.readProcess = false
 				return vc.ReadBuffer(buffer)
 			case commandPaddingDirect:
-				needReturn := false
 				if vc.input != nil {
 					_, err := buffer.ReadFrom(vc.input)
 					if err != nil {
 						return err
 					}
 					if vc.input.Len() == 0 {
-						needReturn = true
 						vc.input = nil
-					} else { // buffer is full
+					}
+					if buffer.IsFull() {
 						return nil
 					}
 				}
@@ -151,7 +153,6 @@ func (vc *Conn) ReadBuffer(buffer *buf.Buffer) error {
 					if err != nil {
 						return err
 					}
-					needReturn = true
 					if vc.rawInput.Len() == 0 {
 						vc.rawInput = nil
 					}
@@ -161,9 +162,6 @@ func (vc *Conn) ReadBuffer(buffer *buf.Buffer) error {
 					vc.ExtendedReader = N.NewExtendedReader(vc.Conn)
 					log.Debugln("XTLS Vision direct read start")
 				}
-				if needReturn {
-					return nil
-				}
 			default:
 				err := fmt.Errorf("XTLS Vision read unknown command: %d", vc.readLastCommand)
 				log.Debugln(err.Error())
@@ -181,25 +179,19 @@ func (vc *Conn) ReadBuffer(buffer *buf.Buffer) error {
 }
 
 func (vc *Conn) Write(p []byte) (int, error) {
-	if vc.needHandshake {
-		vc.handshakeMutex.Lock()
-		if vc.needHandshake {
-			vc.needHandshake = false
-			if vc.sendRequest(p) {
-				vc.handshakeMutex.Unlock()
-				if vc.err != nil {
-					return 0, vc.err
-				}
-				return len(p), vc.err
-			}
+	select {
+	case <-vc.handshake:
+	default:
+		if vc.sendRequest(p) {
 			if vc.err != nil {
-				vc.handshakeMutex.Unlock()
 				return 0, vc.err
 			}
+			return len(p), vc.err
+		}
+		if vc.err != nil {
+			return 0, vc.err
 		}
-		vc.handshakeMutex.Unlock()
 	}
-
 	if vc.writeFilterApplicationData {
 		_buffer := buf.StackNew()
 		defer buf.KeepAlive(_buffer)
@@ -216,35 +208,22 @@ func (vc *Conn) Write(p []byte) (int, error) {
 }
 
 func (vc *Conn) WriteBuffer(buffer *buf.Buffer) error {
-	if vc.needHandshake {
-		vc.handshakeMutex.Lock()
-		if vc.needHandshake {
-			vc.needHandshake = false
-			if vc.sendRequest(buffer.Bytes()) {
-				vc.handshakeMutex.Unlock()
-				return vc.err
-			}
-			if vc.err != nil {
-				vc.handshakeMutex.Unlock()
-				return vc.err
-			}
+	select {
+	case <-vc.handshake:
+	default:
+		if vc.sendRequest(buffer.Bytes()) {
+			return vc.err
+		}
+		if vc.err != nil {
+			return vc.err
 		}
-		vc.handshakeMutex.Unlock()
 	}
-
-	if vc.writeFilterApplicationData {
+	if vc.writeFilterApplicationData && vc.isTLS {
 		buffer2 := ReshapeBuffer(buffer)
 		defer buffer2.Release()
 		vc.FilterTLS(buffer.Bytes())
 		command := commandPaddingContinue
-		if !vc.isTLS {
-			command = commandPaddingEnd
-
-			// disable XTLS
-			//vc.readProcess = false
-			vc.writeFilterApplicationData = false
-			vc.packetsToFilter = 0
-		} else if buffer.Len() > 6 && bytes.Equal(buffer.To(3), tlsApplicationDataStart) || vc.packetsToFilter <= 0 {
+		if buffer.Len() > 6 && bytes.Equal(buffer.To(3), tlsApplicationDataStart) || vc.packetsToFilter <= 0 {
 			command = commandPaddingEnd
 			if vc.enableXTLS {
 				command = commandPaddingDirect
@@ -252,7 +231,7 @@ func (vc *Conn) WriteBuffer(buffer *buf.Buffer) error {
 			}
 			vc.writeFilterApplicationData = false
 		}
-		ApplyPadding(buffer, command, nil, vc.isTLS)
+		ApplyPadding(buffer, command, nil)
 		err := vc.ExtendedWriter.WriteBuffer(buffer)
 		if err != nil {
 			return err
@@ -260,10 +239,10 @@ func (vc *Conn) WriteBuffer(buffer *buf.Buffer) error {
 		if vc.writeDirect {
 			vc.ExtendedWriter = N.NewExtendedWriter(vc.Conn)
 			log.Debugln("XTLS Vision direct write start")
-			//time.Sleep(5 * time.Millisecond)
+			//time.Sleep(10 * time.Millisecond)
 		}
 		if buffer2 != nil {
-			if vc.writeDirect || !vc.isTLS {
+			if vc.writeDirect {
 				return vc.ExtendedWriter.WriteBuffer(buffer2)
 			}
 			vc.FilterTLS(buffer2.Bytes())
@@ -276,7 +255,7 @@ func (vc *Conn) WriteBuffer(buffer *buf.Buffer) error {
 				}
 				vc.writeFilterApplicationData = false
 			}
-			ApplyPadding(buffer2, command, nil, vc.isTLS)
+			ApplyPadding(buffer2, command, nil)
 			err = vc.ExtendedWriter.WriteBuffer(buffer2)
 			if vc.writeDirect {
 				vc.ExtendedWriter = N.NewExtendedWriter(vc.Conn)
@@ -293,6 +272,18 @@ func (vc *Conn) WriteBuffer(buffer *buf.Buffer) error {
 }
 
 func (vc *Conn) sendRequest(p []byte) bool {
+	vc.handshakeMutex.Lock()
+	defer vc.handshakeMutex.Unlock()
+
+	select {
+	case <-vc.handshake:
+		// The handshake has been completed before.
+		// So return false to remind the caller.
+		return false
+	default:
+	}
+	defer close(vc.handshake)
+
 	var addonsBytes []byte
 	if vc.addons != nil {
 		addonsBytes, vc.err = proto.Marshal(vc.addons)
@@ -352,19 +343,19 @@ func (vc *Conn) sendRequest(p []byte) bool {
 
 	if isVision && !vc.dst.UDP && !vc.dst.Mux {
 		if len(p) == 0 {
-			WriteWithPadding(buffer, nil, commandPaddingContinue, vc.id, vc.isTLS)
+			vc.packetsToFilter = 0
+			vc.writeFilterApplicationData = false
+			WriteWithPadding(buffer, nil, commandPaddingEnd, vc.id)
 		} else {
 			vc.FilterTLS(p)
-			//if vc.isTLS {
-			WriteWithPadding(buffer, p, commandPaddingContinue, vc.id, vc.isTLS)
-			//} else {
-			//	buf.Must(buf.Error(buffer.Write(p)))
-			//
-			//	// disable XTLS
-			//	vc.readProcess = false
-			//	vc.writeFilterApplicationData = false
-			//	vc.packetsToFilter = 0
-			//}
+			if vc.isTLS {
+				WriteWithPadding(buffer, p, commandPaddingContinue, vc.id)
+			} else {
+				buf.Must(buf.Error(buffer.Write(p)))
+				vc.readProcess = false
+				vc.writeFilterApplicationData = false
+				vc.packetsToFilter = 0
+			}
 		}
 	} else {
 		buf.Must(buf.Error(buffer.Write(p)))
@@ -393,22 +384,22 @@ func (vc *Conn) sendRequest(p []byte) bool {
 }
 
 func (vc *Conn) recvResponse() error {
-	var buffer [1]byte
-	_, vc.err = io.ReadFull(vc.ExtendedReader, buffer[:])
+	var buf [1]byte
+	_, vc.err = io.ReadFull(vc.ExtendedReader, buf[:])
 	if vc.err != nil {
 		return vc.err
 	}
 
-	if buffer[0] != Version {
+	if buf[0] != Version {
 		return errors.New("unexpected response version")
 	}
 
-	_, vc.err = io.ReadFull(vc.ExtendedReader, buffer[:])
+	_, vc.err = io.ReadFull(vc.ExtendedReader, buf[:])
 	if vc.err != nil {
 		return vc.err
 	}
 
-	length := int64(buffer[0])
+	length := int64(buf[0])
 	if length != 0 { // addon data length > 0
 		io.CopyN(io.Discard, vc.ExtendedReader, length) // just discard
 	}
@@ -430,10 +421,6 @@ func (vc *Conn) Upstream() any {
 	return vc.tlsConn
 }
 
-func (vc *Conn) NeedHandshake() bool {
-	return vc.needHandshake
-}
-
 func (vc *Conn) IsXTLSVisionEnabled() bool {
 	return vc.addons != nil && vc.addons.Flow == XRV
 }
@@ -446,7 +433,7 @@ func newConn(conn net.Conn, client *Client, dst *DstAddr) (*Conn, error) {
 		Conn:           conn,
 		id:             client.uuid,
 		dst:            dst,
-		needHandshake:  true,
+		handshake:      make(chan struct{}),
 	}
 
 	if !dst.UDP && client.Addons != nil {
@@ -477,23 +464,19 @@ func newConn(conn net.Conn, client *Client, dst *DstAddr) (*Conn, error) {
 			var p uintptr
 			switch underlying := conn.(type) {
 			case *gotls.Conn:
-				//log.Debugln("type tls")
 				c.Conn = underlying.NetConn()
 				c.tlsConn = underlying
 				t = reflect.TypeOf(underlying).Elem()
 				p = uintptr(unsafe.Pointer(underlying))
 			case *utls.UConn:
-				//log.Debugln("type *utls.UConn")
 				c.Conn = underlying.NetConn()
 				c.tlsConn = underlying
 				t = reflect.TypeOf(underlying.Conn).Elem()
 				p = uintptr(unsafe.Pointer(underlying.Conn))
 			case *tlsC.UConn:
-				//log.Debugln("type *tlsC.UConn")
 				c.Conn = underlying.NetConn()
 				c.tlsConn = underlying.UConn
 				t = reflect.TypeOf(underlying.Conn).Elem()
-				//log.Debugln("t:%v", t)
 				p = uintptr(unsafe.Pointer(underlying.Conn))
 			default:
 				return nil, fmt.Errorf(`failed to use %s, maybe "security" is not "tls" or "utls"`, client.Addons.Flow)
@@ -502,9 +485,9 @@ func newConn(conn net.Conn, client *Client, dst *DstAddr) (*Conn, error) {
 			r, _ := t.FieldByName("rawInput")
 			c.input = (*bytes.Reader)(unsafe.Pointer(p + i.Offset))
 			c.rawInput = (*bytes.Buffer)(unsafe.Pointer(p + r.Offset))
-			//if _, ok := c.Conn.(*net.TCPConn); !ok {
-			//	log.Debugln("XTLS underlying conn is not *net.TCPConn, got %T", c.Conn)
-			//}
+			if _, ok := c.Conn.(*net.TCPConn); !ok {
+				log.Debugln("XTLS underlying conn is not *net.TCPConn, got", reflect.TypeOf(conn).Name())
+			}
 		}
 	}
 

transport/vless/filter.go

@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"encoding/binary"
 
-	"github.com/Dreamacro/clash/log"
+	log "github.com/sirupsen/logrus"
 )
 
 var (
@@ -27,61 +27,50 @@ const (
 	tlsHandshakeTypeServerHello byte = 0x02
 )
 
-func (vc *Conn) FilterTLS(buffer []byte) (index int) {
+func (vc *Conn) FilterTLS(p []byte) (index int) {
 	if vc.packetsToFilter <= 0 {
 		return 0
 	}
-	lenP := len(buffer)
-	vc.packetsToFilter--
-	if index = bytes.Index(buffer, tlsServerHandshakeStart); index != -1 {
-		if lenP >= index+5 {
-			if buffer[0] == 22 && buffer[1] == 3 && buffer[2] == 3 {
-				vc.isTLS = true
-				if buffer[5] == tlsHandshakeTypeServerHello {
-					//log.Debugln("isTLS12orAbove")
-					vc.remainingServerHello = binary.BigEndian.Uint16(buffer[index+3:]) + 5
-					vc.isTLS12orAbove = true
-					if lenP-index >= 79 && vc.remainingServerHello >= 79 {
-						sessionIDLen := int(buffer[index+43])
-						vc.cipher = binary.BigEndian.Uint16(buffer[index+43+sessionIDLen+1:])
-					}
-				}
+	lenP := len(p)
+	vc.packetsToFilter -= 1
+	if index = bytes.Index(p, tlsServerHandshakeStart); index != -1 {
+		if lenP >= index+5 && p[index+5] == tlsHandshakeTypeServerHello {
+			vc.remainingServerHello = binary.BigEndian.Uint16(p[index+3:]) + 5
+			vc.isTLS = true
+			vc.isTLS12orAbove = true
+			if lenP-index >= 79 && vc.remainingServerHello >= 79 {
+				sessionIDLen := int(p[index+43])
+				vc.cipher = binary.BigEndian.Uint16(p[index+43+sessionIDLen+1:])
 			}
 		}
-	} else if index = bytes.Index(buffer, tlsClientHandshakeStart); index != -1 {
-		if lenP >= index+5 && buffer[index+5] == tlsHandshakeTypeClientHello {
+	} else if index = bytes.Index(p, tlsClientHandshakeStart); index != -1 {
+		if lenP >= index+5 && p[index+5] == tlsHandshakeTypeClientHello {
 			vc.isTLS = true
 		}
 	}
 
 	if vc.remainingServerHello > 0 {
-		end := int(vc.remainingServerHello)
-		i := index
-		if i < 0 {
-			i = 0
+		end := vc.remainingServerHello
+		vc.remainingServerHello -= end
+		if end > uint16(lenP) {
+			end = uint16(lenP)
 		}
-		if i+end > lenP {
-			end = lenP
-			vc.remainingServerHello -= uint16(end - i)
-		} else {
-			vc.remainingServerHello -= uint16(end)
-			end += i
-		}
-		if bytes.Contains(buffer[i:end], tls13SupportedVersions) {
+		if bytes.Contains(p[index:end], tls13SupportedVersions) {
 			// TLS 1.3 Client Hello
 			cs, ok := tls13CipherSuiteMap[vc.cipher]
 			if ok && cs != "TLS_AES_128_CCM_8_SHA256" {
 				vc.enableXTLS = true
 			}
-			log.Debugln("XTLS Vision found TLS 1.3, packetLength=%d， CipherSuite=%s", lenP, cs)
+			log.Debugln("XTLS Vision found TLS 1.3, packetLength=", lenP, ", CipherSuite=", cs)
 			vc.packetsToFilter = 0
 			return
-		} else if vc.remainingServerHello <= 0 {
-			log.Debugln("XTLS Vision found TLS 1.2, packetLength=%d", lenP)
+		} else if vc.remainingServerHello < 0 {
+			log.Debugln("XTLS Vision found TLS 1.2, packetLength=", lenP)
 			vc.packetsToFilter = 0
 			return
 		}
-		log.Debugln("XTLS Vision found inconclusive server hello, packetLength=%d, remainingServerHelloBytes=%d", lenP, vc.remainingServerHello)
+		log.Debugln("XTLS Vision found inconclusive server hello, packetLength=", lenP,
+			", remainingServerHelloBytes=", vc.remainingServerHello)
 	}
 	if vc.packetsToFilter <= 0 {
 		log.Debugln("XTLS Vision stop filtering")

transport/vless/vision.go

@@ -3,13 +3,13 @@ package vless
 import (
 	"bytes"
 	"encoding/binary"
-	"sync"
+	"math/rand"
 
 	"github.com/Dreamacro/clash/common/buf"
-	"github.com/Dreamacro/clash/log"
 
+	"github.com/Dreamacro/clash/log"
 	"github.com/gofrs/uuid"
-	"github.com/zhangyunhao116/fastrand"
+	buf2 "github.com/sagernet/sing/common/buf"
 )
 
 const (
@@ -20,47 +20,30 @@ const (
 	commandPaddingDirect   byte = 0x02
 )
 
-var mutex sync.RWMutex
-
-func WriteWithPadding(buffer *buf.Buffer, p []byte, command byte, userUUID *uuid.UUID, paddingTLS bool) {
+func WriteWithPadding(buffer *buf.Buffer, p []byte, command byte, userUUID *uuid.UUID) {
 	contentLen := int32(len(p))
 	var paddingLen int32
-	mutex.Lock()
 	if contentLen < 900 {
-		if paddingTLS {
-			//log.Debugln("long padding")
-			paddingLen = fastrand.Int31n(500) + 900 - contentLen
-		} else {
-			paddingLen = fastrand.Int31n(256)
-		}
+		paddingLen = rand.Int31n(500) + 900 - contentLen
 	}
-	mutex.Unlock()
+
 	if userUUID != nil { // unnecessary, but keep the same with Xray
 		buffer.Write(userUUID.Bytes())
 	}
-
 	buffer.WriteByte(command)
 	binary.BigEndian.PutUint16(buffer.Extend(2), uint16(contentLen))
 	binary.BigEndian.PutUint16(buffer.Extend(2), uint16(paddingLen))
 	buffer.Write(p)
-
 	buffer.Extend(int(paddingLen))
 	log.Debugln("XTLS Vision write padding1: command=%v, payloadLen=%v, paddingLen=%v", command, contentLen, paddingLen)
 }
 
-func ApplyPadding(buffer *buf.Buffer, command byte, userUUID *uuid.UUID, paddingTLS bool) {
+func ApplyPadding(buffer *buf.Buffer, command byte, userUUID *uuid.UUID) {
 	contentLen := int32(buffer.Len())
 	var paddingLen int32
-	mutex.Lock()
 	if contentLen < 900 {
-		if paddingTLS {
-			//log.Debugln("long padding")
-			paddingLen = fastrand.Int31n(500) + 900 - contentLen
-		} else {
-			paddingLen = fastrand.Int31n(256)
-		}
+		paddingLen = rand.Int31n(500) + 900 - contentLen
 	}
-	mutex.Unlock()
 
 	binary.BigEndian.PutUint16(buffer.ExtendHeader(2), uint16(paddingLen))
 	binary.BigEndian.PutUint16(buffer.ExtendHeader(2), uint16(contentLen))
@@ -68,20 +51,19 @@ func ApplyPadding(buffer *buf.Buffer, command byte, userUUID *uuid.UUID, padding
 	if userUUID != nil { // unnecessary, but keep the same with Xray
 		copy(buffer.ExtendHeader(uuid.Size), userUUID.Bytes())
 	}
-
 	buffer.Extend(int(paddingLen))
 	log.Debugln("XTLS Vision write padding2: command=%d, payloadLen=%d, paddingLen=%d", command, contentLen, paddingLen)
 }
 
 func ReshapeBuffer(buffer *buf.Buffer) *buf.Buffer {
-	if buffer.Len() <= buf.BufferSize-paddingHeaderLen {
+	if buffer.Len() <= buf2.BufferSize-paddingHeaderLen {
 		return nil
 	}
 	cutAt := bytes.LastIndex(buffer.Bytes(), tlsApplicationDataStart)
 	if cutAt == -1 {
-		cutAt = buf.BufferSize / 2
+		cutAt = buf2.BufferSize / 2
 	}
-	buffer2 := buf.New()
+	buffer2 := buf2.New()
 	buffer2.Write(buffer.From(cutAt))
 	buffer.Truncate(cutAt)
 	return buffer2

transport/vmess/conn.go

@@ -11,13 +11,17 @@ import (
 	"errors"
 	"hash/fnv"
 	"io"
+	"math/rand"
 	"net"
 	"time"
 
-	"github.com/zhangyunhao116/fastrand"
 	"golang.org/x/crypto/chacha20poly1305"
 )
 
+func init() {
+	rand.Seed(time.Now().UnixNano())
+}
+
 // Conn wrapper a net.Conn with vmess protocol
 type Conn struct {
 	net.Conn
@@ -72,7 +76,7 @@ func (vc *Conn) sendRequest() error {
 	buf.WriteByte(vc.respV)
 	buf.WriteByte(OptionChunkStream)
 
-	p := fastrand.Intn(16)
+	p := rand.Intn(16)
 	// P Sec Reserve Cmd
 	buf.WriteByte(byte(p<<4) | byte(vc.security))
 	buf.WriteByte(0)
@@ -90,7 +94,7 @@ func (vc *Conn) sendRequest() error {
 	// padding
 	if p > 0 {
 		padding := make([]byte, p)
-		fastrand.Read(padding)
+		rand.Read(padding)
 		buf.Write(padding)
 	}
 
@@ -196,7 +200,7 @@ func hashTimestamp(t time.Time) []byte {
 // newConn return a Conn instance
 func newConn(conn net.Conn, id *ID, dst *DstAddr, security Security, isAead bool) (*Conn, error) {
 	randBytes := make([]byte, 33)
-	fastrand.Read(randBytes)
+	rand.Read(randBytes)
 	reqBodyIV := make([]byte, 16)
 	reqBodyKey := make([]byte, 16)
 	copy(reqBodyIV[:], randBytes[:16])

transport/vmess/h2.go

@@ -2,11 +2,11 @@ package vmess
 
 import (
 	"io"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
 
-	"github.com/zhangyunhao116/fastrand"
 	"golang.org/x/net/http2"
 )
 
@@ -26,7 +26,7 @@ type H2Config struct {
 func (hc *h2Conn) establishConn() error {
 	preader, pwriter := io.Pipe()
 
-	host := hc.cfg.Hosts[fastrand.Intn(len(hc.cfg.Hosts))]
+	host := hc.cfg.Hosts[rand.Intn(len(hc.cfg.Hosts))]
 	path := hc.cfg.Path
 	// TODO: connect use VMess Host instead of H2 Host
 	req := http.Request{

transport/vmess/http.go

@@ -4,11 +4,10 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/textproto"
-
-	"github.com/zhangyunhao116/fastrand"
 )
 
 type httpConn struct {
@@ -52,16 +51,16 @@ func (hc *httpConn) Write(b []byte) (int, error) {
 		return hc.Conn.Write(b)
 	}
 
-	path := hc.cfg.Path[fastrand.Intn(len(hc.cfg.Path))]
+	path := hc.cfg.Path[rand.Intn(len(hc.cfg.Path))]
 	host := hc.cfg.Host
 	if header := hc.cfg.Headers["Host"]; len(header) != 0 {
-		host = header[fastrand.Intn(len(header))]
+		host = header[rand.Intn(len(header))]
 	}
 
 	u := fmt.Sprintf("http://%s%s", host, path)
 	req, _ := http.NewRequest("GET", u, bytes.NewBuffer(b))
 	for key, list := range hc.cfg.Headers {
-		req.Header.Set(key, list[fastrand.Intn(len(list))])
+		req.Header.Set(key, list[rand.Intn(len(list))])
 	}
 	req.ContentLength = int64(len(b))
 	if err := req.Write(hc.Conn); err != nil {

transport/vmess/tls.go

@@ -3,7 +3,6 @@ package vmess
 import (
 	"context"
 	"crypto/tls"
-	"errors"
 	"net"
 
 	tlsC "github.com/Dreamacro/clash/component/tls"
@@ -16,7 +15,6 @@ type TLSConfig struct {
 	FingerPrint       string
 	ClientFingerprint string
 	NextProtos        []string
-	Reality           *tlsC.RealityConfig
 }
 
 func StreamTLSConn(conn net.Conn, cfg *TLSConfig) (net.Conn, error) {
@@ -36,25 +34,15 @@ func StreamTLSConn(conn net.Conn, cfg *TLSConfig) (net.Conn, error) {
 	}
 
 	if len(cfg.ClientFingerprint) != 0 {
-		if cfg.Reality == nil {
-			utlsConn, valid := GetUTLSConn(conn, cfg.ClientFingerprint, tlsConfig)
-			if valid {
-				ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTLSTimeout)
-				defer cancel()
-
-				err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx)
-				return utlsConn, err
-			}
-		} else {
+		utlsConn, valid := GetUtlsConnWithClientFingerprint(conn, cfg.ClientFingerprint, tlsConfig)
+		if valid {
 			ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTLSTimeout)
 			defer cancel()
-			return tlsC.GetRealityConn(ctx, conn, cfg.ClientFingerprint, tlsConfig, cfg.Reality)
+
+			err := utlsConn.(*tlsC.UConn).HandshakeContext(ctx)
+			return utlsConn, err
 		}
 	}
-	if cfg.Reality != nil {
-		return nil, errors.New("REALITY is based on uTLS, please set a client-fingerprint")
-	}
-
 	tlsConn := tls.Client(conn, tlsConfig)
 
 	ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTLSTimeout)
@@ -64,7 +52,7 @@ func StreamTLSConn(conn net.Conn, cfg *TLSConfig) (net.Conn, error) {
 	return tlsConn, err
 }
 
-func GetUTLSConn(conn net.Conn, ClientFingerprint string, tlsConfig *tls.Config) (net.Conn, bool) {
+func GetUtlsConnWithClientFingerprint(conn net.Conn, ClientFingerprint string, tlsConfig *tls.Config) (net.Conn, bool) {
 
 	if fingerprint, exists := tlsC.GetFingerprint(ClientFingerprint); exists {
 		utlsConn := tlsC.UClient(conn, tlsConfig, fingerprint)

transport/vmess/vmess.go

@@ -2,13 +2,12 @@ package vmess
 
 import (
 	"fmt"
+	"github.com/Dreamacro/clash/common/utils"
+	"math/rand"
 	"net"
 	"runtime"
 
-	"github.com/Dreamacro/clash/common/utils"
-
 	"github.com/gofrs/uuid"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 // Version of vmess
@@ -78,7 +77,7 @@ type Config struct {
 
 // StreamConn return a Conn with net.Conn and DstAddr
 func (c *Client) StreamConn(conn net.Conn, dst *DstAddr) (net.Conn, error) {
-	r := fastrand.Intn(len(c.user))
+	r := rand.Intn(len(c.user))
 	return newConn(conn, c.user[r], dst, c.security, c.isAead)
 }
 

transport/vmess/websocket.go

@@ -8,7 +8,9 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+
 	"io"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
@@ -20,9 +22,7 @@ import (
 	"github.com/Dreamacro/clash/common/buf"
 	N "github.com/Dreamacro/clash/common/net"
 	tlsC "github.com/Dreamacro/clash/component/tls"
-
 	"github.com/gorilla/websocket"
-	"github.com/zhangyunhao116/fastrand"
 )
 
 type websocketConn struct {
@@ -120,7 +120,7 @@ func (wsc *websocketConn) WriteBuffer(buffer *buf.Buffer) error {
 		binary.BigEndian.PutUint64(header[2:], uint64(dataLen))
 	}
 
-	maskKey := fastrand.Uint32()
+	maskKey := rand.Uint32()
 	binary.LittleEndian.PutUint32(header[1+payloadBitLength:], maskKey)
 	N.MaskWebSocket(maskKey, data)
 
@@ -301,27 +301,15 @@ func (wsedc *websocketWithEarlyDataConn) SetWriteDeadline(t time.Time) error {
 	return wsedc.Conn.SetWriteDeadline(t)
 }
 
-func (wsedc *websocketWithEarlyDataConn) FrontHeadroom() int {
-	return 14
+func (wsedc *websocketWithEarlyDataConn) LazyHeadroom() bool {
+	return wsedc.Conn == nil
 }
 
 func (wsedc *websocketWithEarlyDataConn) Upstream() any {
-	return wsedc.underlay
-}
-
-//func (wsedc *websocketWithEarlyDataConn) LazyHeadroom() bool {
-//	return wsedc.Conn == nil
-//}
-//
-//func (wsedc *websocketWithEarlyDataConn) Upstream() any {
-//	if wsedc.Conn == nil { // ensure return a nil interface not an interface with nil value
-//		return nil
-//	}
-//	return wsedc.Conn
-//}
-
-func (wsedc *websocketWithEarlyDataConn) NeedHandshake() bool {
-	return wsedc.Conn == nil
+	if wsedc.Conn == nil { // ensure return a nil interface not an interface with nil value
+		return nil
+	}
+	return wsedc.Conn
 }
 
 func streamWebsocketWithEarlyDataConn(conn net.Conn, c *WebsocketConfig) (net.Conn, error) {

tunnel/statistic/tracker.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/Dreamacro/clash/common/buf"
 	N "github.com/Dreamacro/clash/common/net"
-	"github.com/Dreamacro/clash/common/utils"
 	C "github.com/Dreamacro/clash/constant"
 
 	"github.com/gofrs/uuid"
@@ -29,7 +28,7 @@ type trackerInfo struct {
 	RulePayload   string        `json:"rulePayload"`
 }
 
-type tcpTracker struct {
+type TCPTracker struct {
 	C.Conn `json:"-"`
 	*trackerInfo
 	manager        *Manager
@@ -37,11 +36,16 @@ type tcpTracker struct {
 	extendedWriter N.ExtendedWriter
 }
 
-func (tt *tcpTracker) ID() string {
+func (tt *TCPTracker) ID() string {
 	return tt.UUID.String()
 }
 
-func (tt *tcpTracker) Read(b []byte) (int, error) {
+func (tt *TCPTracker) AddDownload(n int64) {
+	tt.manager.PushDownloaded(n)
+	tt.DownloadTotal.Add(n)
+}
+
+func (tt *TCPTracker) Read(b []byte) (int, error) {
 	n, err := tt.Conn.Read(b)
 	download := int64(n)
 	tt.manager.PushDownloaded(download)
@@ -49,7 +53,7 @@ func (tt *tcpTracker) Read(b []byte) (int, error) {
 	return n, err
 }
 
-func (tt *tcpTracker) ReadBuffer(buffer *buf.Buffer) (err error) {
+func (tt *TCPTracker) ReadBuffer(buffer *buf.Buffer) (err error) {
 	err = tt.extendedReader.ReadBuffer(buffer)
 	download := int64(buffer.Len())
 	tt.manager.PushDownloaded(download)
@@ -57,7 +61,12 @@ func (tt *tcpTracker) ReadBuffer(buffer *buf.Buffer) (err error) {
 	return
 }
 
-func (tt *tcpTracker) Write(b []byte) (int, error) {
+func (tt *TCPTracker) AddUpload(n int64) {
+	tt.manager.PushUploaded(n)
+	tt.UploadTotal.Add(n)
+}
+
+func (tt *TCPTracker) Write(b []byte) (int, error) {
 	n, err := tt.Conn.Write(b)
 	upload := int64(n)
 	tt.manager.PushUploaded(upload)
@@ -65,7 +74,7 @@ func (tt *tcpTracker) Write(b []byte) (int, error) {
 	return n, err
 }
 
-func (tt *tcpTracker) WriteBuffer(buffer *buf.Buffer) (err error) {
+func (tt *TCPTracker) WriteBuffer(buffer *buf.Buffer) (err error) {
 	upload := int64(buffer.Len())
 	err = tt.extendedWriter.WriteBuffer(buffer)
 	tt.manager.PushUploaded(upload)
@@ -73,17 +82,17 @@ func (tt *tcpTracker) WriteBuffer(buffer *buf.Buffer) (err error) {
 	return
 }
 
-func (tt *tcpTracker) Close() error {
+func (tt *TCPTracker) Close() error {
 	tt.manager.Leave(tt)
 	return tt.Conn.Close()
 }
 
-func (tt *tcpTracker) Upstream() any {
+func (tt *TCPTracker) Upstream() any {
 	return tt.Conn
 }
 
-func NewTCPTracker(conn C.Conn, manager *Manager, metadata *C.Metadata, rule C.Rule, uploadTotal int64, downloadTotal int64) *tcpTracker {
-	uuid, _ := utils.UnsafeUUIDGenerator.NewV4()
+func NewTCPTracker(conn C.Conn, manager *Manager, metadata *C.Metadata, rule C.Rule) *TCPTracker {
+	uuid, _ := uuid.NewV4()
 	if conn != nil {
 		if tcpAddr, ok := conn.RemoteAddr().(*net.TCPAddr); ok {
 			metadata.RemoteDst = tcpAddr.IP.String()
@@ -92,7 +101,7 @@ func NewTCPTracker(conn C.Conn, manager *Manager, metadata *C.Metadata, rule C.R
 		}
 	}
 
-	t := &tcpTracker{
+	t := &TCPTracker{
 		Conn:    conn,
 		manager: manager,
 		trackerInfo: &trackerInfo{
@@ -101,8 +110,8 @@ func NewTCPTracker(conn C.Conn, manager *Manager, metadata *C.Metadata, rule C.R
 			Metadata:      metadata,
 			Chain:         conn.Chains(),
 			Rule:          "",
-			UploadTotal:   atomic.NewInt64(uploadTotal),
-			DownloadTotal: atomic.NewInt64(downloadTotal),
+			UploadTotal:   atomic.NewInt64(0),
+			DownloadTotal: atomic.NewInt64(0),
 		},
 		extendedReader: N.NewExtendedReader(conn),
 		extendedWriter: N.NewExtendedWriter(conn),
@@ -148,8 +157,8 @@ func (ut *udpTracker) Close() error {
 	return ut.PacketConn.Close()
 }
 
-func NewUDPTracker(conn C.PacketConn, manager *Manager, metadata *C.Metadata, rule C.Rule, uploadTotal int64, downloadTotal int64) *udpTracker {
-	uuid, _ := utils.UnsafeUUIDGenerator.NewV4()
+func NewUDPTracker(conn C.PacketConn, manager *Manager, metadata *C.Metadata, rule C.Rule) *udpTracker {
+	uuid, _ := uuid.NewV4()
 	metadata.RemoteDst = conn.RemoteDestination()
 
 	ut := &udpTracker{
@@ -161,8 +170,8 @@ func NewUDPTracker(conn C.PacketConn, manager *Manager, metadata *C.Metadata, ru
 			Metadata:      metadata,
 			Chain:         conn.Chains(),
 			Rule:          "",
-			UploadTotal:   atomic.NewInt64(uploadTotal),
-			DownloadTotal: atomic.NewInt64(downloadTotal),
+			UploadTotal:   atomic.NewInt64(0),
+			DownloadTotal: atomic.NewInt64(0),
 		},
 	}
 

tunnel/tunnel.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/jpillora/backoff"
 
-	N "github.com/Dreamacro/clash/common/net"
 	"github.com/Dreamacro/clash/component/nat"
 	P "github.com/Dreamacro/clash/component/process"
 	"github.com/Dreamacro/clash/component/resolver"
@@ -201,18 +200,13 @@ func preHandleMetadata(metadata *C.Metadata) error {
 			if resolver.FakeIPEnabled() {
 				metadata.DstIP = netip.Addr{}
 				metadata.DNSMode = C.DNSFakeIP
-			} else if node, ok := resolver.DefaultHosts.Search(host, false); ok {
+			} else if node := resolver.DefaultHosts.Search(host); node != nil {
 				// redir-host should lookup the hosts
-				metadata.DstIP, _ = node.RandIP()
-			} else if node != nil && node.IsDomain {
-				metadata.Host = node.Domain
+				metadata.DstIP = node.Data()
 			}
 		} else if resolver.IsFakeIP(metadata.DstIP) {
 			return fmt.Errorf("fake DNS record %s missing", metadata.DstIP)
 		}
-	} else if node, ok := resolver.DefaultHosts.Search(metadata.Host, true); ok {
-		// try use domain mapping
-		metadata.Host = node.Domain
 	}
 
 	return nil
@@ -328,7 +322,7 @@ func handleUDPConn(packet C.PacketAdapter) {
 		}
 		pCtx.InjectPacketConn(rawPc)
 
-		pc := statistic.NewUDPTracker(rawPc, statistic.DefaultManager, metadata, rule, 0, 0)
+		pc := statistic.NewUDPTracker(rawPc, statistic.DefaultManager, metadata, rule)
 
 		switch true {
 		case metadata.SpecialProxy != "":
@@ -373,7 +367,6 @@ func handleTCPConn(connCtx C.ConnContext) {
 	}
 
 	conn := connCtx.Conn()
-	conn.ResetPeeked() // reset before sniffer
 	if sniffer.Dispatcher.Enable() && sniffingEnable {
 		sniffer.Dispatcher.TCPSniff(conn, metadata)
 	}
@@ -397,8 +390,8 @@ func handleTCPConn(connCtx C.ConnContext) {
 
 	dialMetadata := metadata
 	if len(metadata.Host) > 0 {
-		if node, ok := resolver.DefaultHosts.Search(metadata.Host, false); ok {
-			if dstIp, _ := node.RandIP(); !FakeIPRange().Contains(dstIp) {
+		if node := resolver.DefaultHosts.Search(metadata.Host); node != nil {
+			if dstIp := node.Data(); !FakeIPRange().Contains(dstIp) {
 				dialMetadata.DstIP = dstIp
 				dialMetadata.DNSMode = C.DNSHosts
 				dialMetadata = dialMetadata.Pure()
@@ -407,40 +400,25 @@ func handleTCPConn(connCtx C.ConnContext) {
 	}
 
 	var peekBytes []byte
-	var peekLen int
 
 	ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTCPTimeout)
 	defer cancel()
-	remoteConn, err := retry(ctx, func(ctx context.Context) (remoteConn C.Conn, err error) {
-		remoteConn, err = proxy.DialContext(ctx, dialMetadata)
+	remoteConn, err := retry(ctx, func(ctx context.Context) (C.Conn, error) {
+		remoteConn, err := proxy.DialContext(ctx, dialMetadata)
 		if err != nil {
-			return
+			return nil, err
 		}
-
-		if N.NeedHandshake(remoteConn) {
-			defer func() {
-				for _, chain := range remoteConn.Chains() {
-					if chain == "REJECT" {
-						err = nil
-						return
-					}
-				}
-				if err != nil {
-					remoteConn = nil
-				}
-			}()
-			peekMutex.Lock()
-			defer peekMutex.Unlock()
-			peekBytes, _ = conn.Peek(conn.Buffered())
-			_, err = remoteConn.Write(peekBytes)
-			if err != nil {
-				return
-			}
-			if peekLen = len(peekBytes); peekLen > 0 {
-				_, _ = conn.Discard(peekLen)
-			}
+		peekMutex.Lock()
+		defer peekMutex.Unlock()
+		peekBytes, _ = conn.Peek(conn.Buffered())
+		_, err = remoteConn.Write(peekBytes)
+		if err != nil {
+			return nil, err
 		}
-		return
+		if peekLen := len(peekBytes); peekLen > 0 {
+			_, _ = conn.Discard(peekLen)
+		}
+		return remoteConn, err
 	}, func(err error) {
 		if rule == nil {
 			log.Warnln(
@@ -458,7 +436,7 @@ func handleTCPConn(connCtx C.ConnContext) {
 		return
 	}
 
-	remoteConn = statistic.NewTCPTracker(remoteConn, statistic.DefaultManager, metadata, rule, 0, int64(peekLen))
+	remoteConn = statistic.NewTCPTracker(remoteConn, statistic.DefaultManager, metadata, rule)
 	defer func(remoteConn C.Conn) {
 		_ = remoteConn.Close()
 	}(remoteConn)
@@ -484,10 +462,6 @@ func handleTCPConn(connCtx C.ConnContext) {
 		)
 	}
 
-	_ = conn.SetReadDeadline(time.Now()) // stop unfinished peek
-	peekMutex.Lock()
-	defer peekMutex.Unlock()
-	_ = conn.SetReadDeadline(time.Time{}) // reset
 	handleSocket(connCtx, remoteConn)
 }
 
@@ -503,8 +477,8 @@ func match(metadata *C.Metadata) (C.Proxy, C.Rule, error) {
 		processFound bool
 	)
 
-	if node, ok := resolver.DefaultHosts.Search(metadata.Host, false); ok {
-		metadata.DstIP, _ = node.RandIP()
+	if node := resolver.DefaultHosts.Search(metadata.Host); node != nil {
+		metadata.DstIP = node.Data()
 		resolved = true
 	}