3x-ui

mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-28 04:36:40 +08:00

Files

T

Kirill Rudenko 788b76c544 fix(amneziawg): sniff the relay with routeOnly; scope the v6 egress to IPv6 (#6654 )

* fix(amneziawg): sniff the relay with routeOnly

The embedded AmneziaWG relay sniffed without routeOnly, so a sniffed SNI
replaced the dial target. Telegram's FakeTLS recovery dials
194.221.250.50:443 with SNI www.google.com; the rewrite sent it to real
Google and the client looped on "TLS hash mismatch", stuck on "Connecting".

Sniffing here exists only so domain routing rules can match; routeOnly
keeps that and dials the IP the peer resolved. Fake-pool targets are
still rewritten (the dispatcher ignores routeOnly for fakedns).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(amneziawg): send only IPv6 targets through the peer's v6 egress

The per-peer IPv6 egress rule matched every flow of that peer, but its
freedom outbound binds a v6 sendThrough and cannot dial an IPv4 target, so
IPv4 DNS and any other unsniffed IPv4 traffic of such a peer failed.
Sniffed TLS/HTTP only worked because the sniffed domain replaced the IP;
with routeOnly on the relay that no longer happens.

Limiting the rule to ::/0 keeps the peer's IPv6 identity for IPv6 targets
and lets IPv4 targets take the regular outbound.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Kirill Rudenko <rudenko@npp-energy.ru>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>

2026-09-26 22:04:08 +02:00

amneziawg

fix(amneziawg): bound S1-S3 by the receive buffer, reject overlapping H (#6642 )

2026-09-26 22:02:49 +02:00

amneziawgnet

fix(amneziawg): bound S1-S3 by the receive buffer, reject overlapping H (#6642 )

2026-09-26 22:02:49 +02:00

config

v3.8.5

2026-09-16 02:08:08 +02:00

crypto/nodetoken

fix(nodetoken): make the corrupt-ciphertext test corrupt deterministically (#6520 )