feat(xray): update xray-core to v26.9.30 and adapt panel

Bump xtls/xray-core to b26a91de4f (v26.9.30) and the three binary pins (DockerInit.sh, release.yml Linux + Windows) in lockstep. No deleted symbols; the sing and sing-shadowsocks indirect deps drop out with the SS2022 rewrite. XDNS finalmask (#6718) replaced its string lists with objects: domains are {name, types, edns0, lenLimit, labelLimit} and client resolvers {type, settings.addr}. The loader no longer parses the old lists, so a single stored xdns mask keeps the whole core from starting. The new leaf package internal/util/maskcompat converts them: "name[:type]" becomes a domain and "name[:type]+udp://addr" a domain plus a udp resolver. A bare name maps to TXT, the type legacy clients queried by default, and each converted domain keeps the 1232-byte EDNS0 the old code always used (without it the server caps answers at 512). It runs from: - the XdnsFinalmaskObjectsFix seeder, over inbound streams, hosts, the xray template, the global sub-JSON mask and cached subscription outbounds; - inbound save (normalizeStreamSettings) and GetXrayConfig, for rows that never went through the seeder; - both link importers, since fm= from an older panel carries the lists. The finalmask form edits the object shape (every key needs a registered field, or the finalmask watch drops it on save) and lifts legacy masks on open. The udp-mask golden fixture moves to the object shape, which TestGoldenStreamFixturesBuildInXray now builds through the core. The wire format changed as well, so pre-upgrade clients need the new core. WireGuard outbound (#6771) dropped settings.domainStrategy and the remoteDNS "local" mode. The endpoint lookup now follows sockopt.domainStrategy and in-tunnel targets the outbound's targetStrategy. The old key is silently ignored, which undid the IPv4-first endpoint lookup the WARP outbound depends on (#5205), and "local" now panics the core at startup because remoteDNS goes through netip.MustParseAddr. The WireguardDomainStrategyFix seeder moves a stored family preference to both keys (a value already set wins) and turns "local" into targetStrategy; the outbound form lifts legacy rows the same way and drops its select, the WARP modal writes the new placement, and the inbound form loses a field the server never read. ValidateOutboundConfig now refuses a non-IP remoteDNS entry, which conf.Build() lets through, on template save and for outbound subscriptions. Noise finalmask items accept type "exp" (#6862), a tag expression. The form offers it for noise items only: header-custom items go through the core's PraseByteSlice, which refuses it. TUN gained autoSystemDnsToGateway (Linux) and autoSystemWfpBlockLeak (Windows). Both pass through the settings schema so a value set in JSON survives the next form save. MASQUE (inbound, outbound, transport) and the XDRIVE transport are new protocols the panel does not offer yet; their new loader refusals only cover configs the panel never generates. The FakeDNS IPv6 pool default, the SS2022 rewrite (same gRPC account; emails are now deduped case-insensitively, as the panel already does), the restored udphop interval default and the rest change no panel-facing config.
2026-10-25 07:15:01 +03:00 · 2026-09-30 17:27:10 +02:00
parent 99047c0a63
commit 62423cacd1
38 changed files with 1487 additions and 165 deletions
@@ -18,6 +18,7 @@ import type { NamePath } from 'antd/es/form/interface';
 import { RandomUtil } from '@/utils';
 import { activateOnKey } from '@/utils/a11y';
 import { OutboundProtocols, UTLS_FINGERPRINT } from '@/schemas/primitives';
+import { upgradeLegacyXdnsMasks, XDNS_LEGACY_EDNS0 } from '@/lib/xray/xdns-mask';

 const UTLS_FINGERPRINT_OPTIONS = Object.values(UTLS_FINGERPRINT).map((value) => ({
  value,
@@ -244,28 +245,34 @@ export default function FinalMaskForm({
 }: FinalMaskFormProps) {
  const base = asPath(name);

-  // Migrate legacy TCP mask shapes once on mount so configs saved before
-  // #6334 (fragment ranges) and #6487 (xmc profiles) render in the list UI.
+  // Migrate legacy mask shapes once on mount so configs saved before #6334 (fragment
+  // ranges), #6487 (xmc profiles) and #6718 (xdns objects) render in the list UI.
  const migratedRef = useRef(false);
  useEffect(() => {
    if (migratedRef.current) return;
    migratedRef.current = true;
    const tcp = form.getFieldValue([...base, 'tcp']);
-    if (!Array.isArray(tcp)) return;
-    let anyChanged = false;
-    const next = tcp.map((mask) => {
-      if (!mask || typeof mask !== 'object') return mask;
-      const m = mask as Record<string, unknown>;
-      if (m.type !== 'fragment' && m.type !== 'xmc') return mask;
-      if (!m.settings || typeof m.settings !== 'object') return mask;
-      const settings = m.settings as Record<string, unknown>;
-      const { next: migrated, changed } =
-        m.type === 'fragment' ? migrateFragmentSettings(settings) : migrateXmcSettings(settings);
-      if (!changed) return mask;
-      anyChanged = true;
-      return { ...m, settings: migrated };
-    });
-    if (anyChanged) form.setFieldValue([...base, 'tcp'], next);
+    if (Array.isArray(tcp)) {
+      let anyChanged = false;
+      const next = tcp.map((mask) => {
+        if (!mask || typeof mask !== 'object') return mask;
+        const m = mask as Record<string, unknown>;
+        if (m.type !== 'fragment' && m.type !== 'xmc') return mask;
+        if (!m.settings || typeof m.settings !== 'object') return mask;
+        const settings = m.settings as Record<string, unknown>;
+        const { next: migrated, changed } =
+          m.type === 'fragment' ? migrateFragmentSettings(settings) : migrateXmcSettings(settings);
+        if (!changed) return mask;
+        anyChanged = true;
+        return { ...m, settings: migrated };
+      });
+      if (anyChanged) form.setFieldValue([...base, 'tcp'], next);
+    }
+    const udp = form.getFieldValue([...base, 'udp']);
+    if (Array.isArray(udp)) {
+      const { next, changed } = upgradeLegacyXdnsMasks(udp);
+      if (changed) form.setFieldValue([...base, 'udp'], next);
+    }
    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, []);

@@ -958,11 +965,7 @@ function UdpMaskItem({
            );
          }
          if (type === 'xdns') {
-            return (
-              <Form.Item label="Domains" name={[fieldName, 'settings', 'domains']}>
-                <Select mode="tags" style={{ width: '100%' }} tokenSeparators={[',']} />
-              </Form.Item>
-            );
+            return <XdnsSettings udpFieldName={fieldName} />;
          }
          if (type === 'xicmp') {
            return (
@@ -1255,6 +1258,113 @@ function UdpHeaderCustom({
  );
 }

+const XDNS_RECORD_TYPE_OPTIONS = [
+  { value: 16, label: 'TXT' },
+  { value: 1, label: 'A' },
+  { value: 28, label: 'AAAA' },
+  { value: 5, label: 'CNAME' },
+];
+
+// Every xdns key needs a registered field: the finalmask watch drops keys without one.
+// Resolvers and extraPoll are read by clients only; a server keeps them for the share link.
+function XdnsSettings({ udpFieldName }: { udpFieldName: number }) {
+  const { t } = useTranslation();
+  return (
+    <>
+      <Form.List name={[udpFieldName, 'settings', 'domains']}>
+        {(domains, { add, remove }) => (
+          <>
+            <Form.Item label="Domains">
+              <Button
+                type="primary"
+                size="small"
+                icon={<PlusOutlined />}
+                aria-label={t('add')}
+                onClick={() => add({ name: '', types: [16], edns0: XDNS_LEGACY_EDNS0 })}
+              />
+            </Form.Item>
+            {domains.map((domain, di) => (
+              <div key={domain.key}>
+                <Divider style={{ margin: 0 }}>
+                  Domain {di + 1}
+                  <DeleteOutlined
+                    className="danger-icon"
+                    role="button"
+                    tabIndex={0}
+                    aria-label={t('remove')}
+                    onClick={() => remove(domain.name)}
+                    onKeyDown={activateOnKey(() => remove(domain.name))}
+                  />
+                </Divider>
+                <Form.Item label="Name" name={[domain.name, 'name']}>
+                  <Input placeholder="t.example.com" />
+                </Form.Item>
+                <Form.Item
+                  label="Record Types"
+                  name={[domain.name, 'types']}
+                  rules={[{ required: true, type: 'array', min: 1 }]}
+                >
+                  <Select mode="multiple" options={XDNS_RECORD_TYPE_OPTIONS} />
+                </Form.Item>
+                <Form.Item label="EDNS0" name={[domain.name, 'edns0']}>
+                  <InputNumber min={512} max={4096} placeholder="off" />
+                </Form.Item>
+                <Form.Item label="Length Limit" name={[domain.name, 'lenLimit']}>
+                  <InputNumber min={0} max={255} placeholder="255" />
+                </Form.Item>
+                <Form.Item label="Label Limit" name={[domain.name, 'labelLimit']}>
+                  <InputNumber min={0} max={63} placeholder="63" />
+                </Form.Item>
+              </div>
+            ))}
+          </>
+        )}
+      </Form.List>
+      <Form.List name={[udpFieldName, 'settings', 'resolvers']}>
+        {(resolvers, { add, remove }) => (
+          <>
+            <Form.Item label="Resolvers (client)">
+              <Button
+                type="primary"
+                size="small"
+                icon={<PlusOutlined />}
+                aria-label={t('add')}
+                onClick={() => add({ type: 'udp', settings: { addr: '' } })}
+              />
+            </Form.Item>
+            {resolvers.map((resolver, ri) => (
+              <Form.Item key={resolver.key} label={`Resolver ${ri + 1}`}>
+                <Space.Compact block>
+                  <Form.Item name={[resolver.name, 'type']} noStyle>
+                    <Select
+                      style={{ width: 80 }}
+                      options={[
+                        { value: 'udp', label: 'UDP' },
+                        { value: 'tcp', label: 'TCP' },
+                      ]}
+                    />
+                  </Form.Item>
+                  <Form.Item name={[resolver.name, 'settings', 'addr']} noStyle>
+                    <Input placeholder="8.8.8.8:53" />
+                  </Form.Item>
+                  <Button
+                    icon={<DeleteOutlined />}
+                    aria-label={t('remove')}
+                    onClick={() => remove(resolver.name)}
+                  />
+                </Space.Compact>
+              </Form.Item>
+            ))}
+          </>
+        )}
+      </Form.List>
+      <Form.Item label="Extra Poll (client)" name={[udpFieldName, 'settings', 'extraPoll']}>
+        <InputNumber min={0} max={3} placeholder="0" />
+      </Form.Item>
+    </>
+  );
+}
+
 function NoiseItems({
  udpFieldName,
  form,
@@ -1352,6 +1462,8 @@ function ItemEditor({
            { value: 'str', label: 'String' },
            { value: 'hex', label: 'Hex' },
            { value: 'base64', label: 'Base64' },
+            // Only the noise mask parses tag expressions (xray-core 26.9.30, #6862).
+            ...(delayMode === 'string' ? [{ value: 'exp', label: 'Expression' }] : []),
          ]}
        />
      </Form.Item>
@@ -1420,7 +1532,7 @@ function ItemEditor({
          }
          return (
            <Form.Item label="Packet" name={[fieldName, 'packet']}>
-              <Input placeholder="binary data" />
+              <Input placeholder={type === 'exp' ? '<b 0d0a0d0a><t><rc 20-40>' : 'binary data'} />
            </Form.Item>
          );
        }}
@@ -18,7 +18,10 @@ import {
 import type { StreamSettings } from '@/schemas/api/inbound';
 import type { Sniffing } from '@/schemas/primitives';
 import type { z } from 'zod';
-import { normalizeStreamSettingsForWire } from '@/lib/xray/stream-wire-normalize';
+import {
+  dropEmptyFinalMask,
+  normalizeStreamSettingsForWire,
+} from '@/lib/xray/stream-wire-normalize';
 import { canEnableSniffing } from '@/lib/xray/protocol-capabilities';
 import { tlsCertUsesFiles } from '@/schemas/protocols/security/tls';
 import { SockoptStreamSettingsSchema } from '@/schemas/protocols/stream/sockopt';
@@ -322,25 +325,7 @@ export function dropLegacyOptionalEmpties(
  if (Array.isArray(fb) && fb.length === 0) delete settings.fallbacks;

  if (stream) {
-    // StreamSettings emits `finalmask` only when at least one transport
-    // mask exists (legacy `hasFinalMask`). Drop the whole block when all
-    // sub-fields are empty; otherwise drop only the empty sub-arrays so
-    // the wire payload doesn't carry a stray `"tcp": []` next to a
-    // populated UDP mask list (and vice versa).
-    const fm = stream.finalmask as
-      | { tcp?: unknown[]; udp?: unknown[]; quicParams?: unknown }
-      | undefined;
-    if (fm && typeof fm === 'object') {
-      const hasTcp = Array.isArray(fm.tcp) && fm.tcp.length > 0;
-      const hasUdp = Array.isArray(fm.udp) && fm.udp.length > 0;
-      const hasQuic = fm.quicParams != null;
-      if (!hasTcp && !hasUdp && !hasQuic) {
-        delete stream.finalmask;
-      } else {
-        if (!hasTcp) delete fm.tcp;
-        if (!hasUdp) delete fm.udp;
-      }
-    }
+    dropEmptyFinalMask(stream);

    // Hysteria's per-client auth lives in settings.clients[*].auth; the
    // streamSettings.hysteriaSettings.auth slot is a holdover from older
@@ -1,7 +1,10 @@
 import { XHttpXmuxSchema } from '@/schemas/protocols/stream/xhttp';
 import { OutboundDomainStrategySchema } from '@/schemas/protocols/outbound';
 import { AmneziaWGOutboundSettingsSchema } from '@/schemas/protocols/outbound';
-import { normalizeStreamSettingsForWire } from '@/lib/xray/stream-wire-normalize';
+import {
+  dropEmptyFinalMask,
+  normalizeStreamSettingsForWire,
+} from '@/lib/xray/stream-wire-normalize';
 import { Wireguard } from '@/utils';
 import type { Sniffing, SniffingDest } from '@/schemas/primitives';
 import type { OutboundDomainStrategy } from '@/schemas/protocols/outbound';
@@ -258,20 +261,50 @@ function wireguardFromWire(raw: Raw): WireguardOutboundFormSettings {
    secretKey,
    pubKey,
    address: addressArr.join(','),
-    domainStrategy: ((): WireguardOutboundFormSettings['domainStrategy'] => {
-      const allowed = ['ForceIP', 'ForceIPv4', 'ForceIPv4v6', 'ForceIPv6', 'ForceIPv6v4'];
-      const s = asString(raw.domainStrategy);
-      return (allowed.includes(s) ? s : '') as WireguardOutboundFormSettings['domainStrategy'];
-    })(),
    reserved: reservedArr.join(','),
-    remoteDNS: asArray(raw.remoteDNS)
-      .map((x) => asString(x))
-      .join(','),
+    remoteDNS: isLegacyLocalRemoteDNS(raw.remoteDNS)
+      ? ''
+      : asArray(raw.remoteDNS)
+          .map((x) => asString(x))
+          .join(','),
    peers,
    noKernelTun: asBool(raw.noKernelTun),
  };
 }

+// remoteDNS ["local"] is a mode xray-core 26.9.30 removed; the core now panics parsing
+// it as an address, so liftLegacyWireguardStrategy carries it over to targetStrategy.
+function isLegacyLocalRemoteDNS(value: unknown): boolean {
+  const list = asArray(value);
+  return list.length === 1 && list[0] === 'local';
+}
+
+const isAsIs = (strategy: OutboundDomainStrategy | '') => strategy === '' || strategy === 'AsIs';
+
+// xray-core 26.9.30 (#6771) ignores wireguard's settings.domainStrategy: sockopt.domainStrategy
+// now picks the endpoint's family, targetStrategy the targets'. Mirrors the Go seeder.
+function liftLegacyWireguardStrategy(
+  settings: Raw,
+  targetStrategy: OutboundDomainStrategy | '',
+  streamSettings: OutboundStreamFormValues | undefined,
+): { targetStrategy: OutboundDomainStrategy | ''; streamSettings?: OutboundStreamFormValues } {
+  const legacy = targetStrategyFromWire(settings.domainStrategy);
+  const family = legacy.startsWith('ForceIP') && legacy !== 'ForceIP' ? legacy : '';
+  const lifted = family || (isLegacyLocalRemoteDNS(settings.remoteDNS) ? 'ForceIP' : '');
+  let stream = streamSettings;
+  const sockopt = asObject((stream as Raw | undefined)?.sockopt);
+  if (family && isAsIs(targetStrategyFromWire(sockopt.domainStrategy))) {
+    stream = {
+      ...(stream ?? {}),
+      sockopt: { ...sockopt, domainStrategy: family },
+    } as OutboundStreamFormValues;
+  }
+  return {
+    targetStrategy: lifted && isAsIs(targetStrategy) ? lifted : targetStrategy,
+    streamSettings: stream,
+  };
+}
+
 function hysteriaFromWire(raw: Raw): HysteriaOutboundFormSettings {
  return {
    address: asString(raw.address),
@@ -604,15 +637,20 @@ export function rawOutboundToFormValues(raw: RawOutboundRow): OutboundFormValues
      typed = { protocol: 'vless', settings: vlessFromWire(settings) };
  }

+  const placed =
+    protocol === 'wireguard'
+      ? liftLegacyWireguardStrategy(settings, targetStrategy, streamSettings)
+      : { targetStrategy, streamSettings };
+
  return {
    ...typed,
    tag,
    sendThrough,
    // The freedom card owns the strategy for freedom, so the shared root field
    // stays empty and cannot disagree with what the card is showing.
-    targetStrategy: protocol === 'freedom' ? '' : targetStrategy,
+    targetStrategy: protocol === 'freedom' ? '' : placed.targetStrategy,
    mux,
-    streamSettings,
+    streamSettings: placed.streamSettings,
  };
 }

@@ -715,7 +753,6 @@ function wireguardToWire(s: WireguardOutboundFormSettings) {
          .map((x) => x.trim())
          .filter(Boolean)
      : [],
-    domainStrategy: s.domainStrategy || undefined,
    reserved: s.reserved
      ? s.reserved
          .split(',')
@@ -912,14 +949,23 @@ export function formValuesToWirePayload(values: OutboundFormValues): WireOutboun
    result.targetStrategy = values.targetStrategy;
  }

-  // streamSettings emission gates on canEnableStream — non-stream protocols
-  // still emit just `sockopt` if that key is present (legacy behavior).
+  // Non-stream protocols emit only `sockopt`; wireguard also keeps `finalmask`, which the
+  // core dials its peer through (the one non-stream protocol the mask editor renders for).
  if (values.streamSettings) {
    if (STREAM_PROTOCOLS.has(values.protocol)) {
      result.streamSettings = stripUiOnlyStreamFields(values.streamSettings);
    } else {
-      const sockopt = (values.streamSettings as { sockopt?: unknown }).sockopt;
-      if (sockopt) result.streamSettings = { sockopt };
+      const { sockopt, finalmask } = values.streamSettings as {
+        sockopt?: unknown;
+        finalmask?: unknown;
+      };
+      const stream: Raw = {};
+      if (sockopt) stream.sockopt = sockopt;
+      if (values.protocol === 'wireguard' && finalmask && typeof finalmask === 'object') {
+        stream.finalmask = { ...(finalmask as Raw) };
+        dropEmptyFinalMask(stream);
+      }
+      if (Object.keys(stream).length > 0) result.streamSettings = stream;
    }
  }

@@ -1,5 +1,7 @@
 import { Base64 } from '@/utils';

+import { upgradeLegacyXdnsMasks } from './xdns-mask';
+
 // Focused share-link parser for the OutboundFormModal's link-import
 // helper. Each parser returns a wire-shape outbound record (the same
 // shape OutboundsTab.tsx stores in templateSettings.outbounds[]) or
@@ -279,6 +281,7 @@ function applyFinalMaskParam(stream: Raw, params: URLSearchParams): void {
      const parsed = JSON.parse(fm) as Record<string, unknown>;
      if (parsed && typeof parsed === 'object') {
        sanitizeFinalMaskQuicParams(parsed);
+        if (Array.isArray(parsed.udp)) parsed.udp = upgradeLegacyXdnsMasks(parsed.udp).next;
        stream.finalmask = parsed;
      }
    } catch {
@@ -323,6 +323,21 @@ export function normalizeSockoptForWire(
  return out;
 }

+// Emit `finalmask` only when a mask exists (legacy `hasFinalMask`), and drop an empty
+// sub-array beside a populated one so the payload carries no stray `"tcp": []`.
+export function dropEmptyFinalMask(stream: Record<string, unknown>): void {
+  const fm = stream.finalmask as { tcp?: unknown[]; udp?: unknown[]; quicParams?: unknown };
+  if (!fm || typeof fm !== 'object') return;
+  const hasTcp = Array.isArray(fm.tcp) && fm.tcp.length > 0;
+  const hasUdp = Array.isArray(fm.udp) && fm.udp.length > 0;
+  if (!hasTcp && !hasUdp && fm.quicParams == null) {
+    delete stream.finalmask;
+    return;
+  }
+  if (!hasTcp) delete fm.tcp;
+  if (!hasUdp) delete fm.udp;
+}
+
 export function normalizeStreamSettingsForWire(
  stream: Record<string, unknown>,
  opts: { side: StreamWireSide },
@@ -0,0 +1,81 @@
+type Raw = Record<string, unknown>;
+
+/** The EDNS0 payload the pre-26.9.30 xdns always negotiated; without it answers cap at 512. */
+export const XDNS_LEGACY_EDNS0 = 1232;
+
+const LEGACY_RECORD_TYPES: Record<string, number> = { '': 16, txt: 16, a: 1, aaaa: 28 };
+
+function legacyDomain(spec: string): Raw | null {
+  let name = spec.trim();
+  let method = '';
+  const colon = name.lastIndexOf(':');
+  if (colon >= 0) {
+    method = name.slice(colon + 1).toLowerCase();
+    name = name.slice(0, colon);
+  }
+  name = name.replace(/^\.+|\.+$/g, '');
+  const type = LEGACY_RECORD_TYPES[method];
+  if (!name || type === undefined) return null;
+  return { name, types: [type], edns0: XDNS_LEGACY_EDNS0 };
+}
+
+// xray-core 26.9.30 (#6718) parses xdns domains/resolvers only as objects. Mirrors
+// internal/util/maskcompat: a bare name becomes TXT, entries the old core refused are dropped.
+export function upgradeLegacyXdnsSettings(settings: Raw): { next: Raw; changed: boolean } {
+  const rawDomains = Array.isArray(settings.domains) ? (settings.domains as unknown[]) : [];
+  const rawResolvers = Array.isArray(settings.resolvers) ? (settings.resolvers as unknown[]) : [];
+  const isLegacy = (v: unknown) => typeof v === 'string';
+  if (!rawDomains.some(isLegacy) && !rawResolvers.some(isLegacy)) {
+    return { next: settings, changed: false };
+  }
+  const domains: unknown[] = [];
+  const listed = new Set<string>();
+  const addDomain = (domain: Raw) => {
+    const key = String(domain.name ?? '').toLowerCase();
+    if (key && listed.has(key)) return;
+    listed.add(key);
+    domains.push(domain);
+  };
+  for (const entry of rawDomains) {
+    if (typeof entry === 'string') {
+      const domain = legacyDomain(entry);
+      if (domain) addDomain(domain);
+    } else if (entry && typeof entry === 'object') {
+      addDomain(entry as Raw);
+    }
+  }
+  const resolvers: unknown[] = [];
+  for (const entry of rawResolvers) {
+    if (typeof entry !== 'string') {
+      resolvers.push(entry);
+      continue;
+    }
+    const sep = entry.indexOf('+udp://');
+    const addr = sep >= 0 ? entry.slice(sep + '+udp://'.length).trim() : '';
+    const domain = sep >= 0 ? legacyDomain(entry.slice(0, sep)) : null;
+    if (!addr || !domain) continue;
+    addDomain(domain);
+    resolvers.push({ type: 'udp', settings: { addr } });
+  }
+  const next: Raw = { ...settings, domains };
+  if (resolvers.length > 0) next.resolvers = resolvers;
+  else delete next.resolvers;
+  return { next, changed: true };
+}
+
+/** Applies upgradeLegacyXdnsSettings to every xdns entry of a finalmask.udp list. */
+export function upgradeLegacyXdnsMasks(udp: unknown[]): { next: unknown[]; changed: boolean } {
+  let changed = false;
+  const next = udp.map((entry) => {
+    const mask = entry as Raw | null;
+    if (!mask || typeof mask !== 'object' || String(mask.type).toLowerCase() !== 'xdns') {
+      return entry;
+    }
+    if (!mask.settings || typeof mask.settings !== 'object') return entry;
+    const upgraded = upgradeLegacyXdnsSettings(mask.settings as Raw);
+    if (!upgraded.changed) return entry;
+    changed = true;
+    return { ...mask, settings: upgraded.next };
+  });
+  return { next, changed };
+}
@@ -1,5 +1,5 @@
 import { useTranslation } from 'react-i18next';
-import { Button, Form, Input, InputNumber, Select, Space, Switch } from 'antd';
+import { Button, Form, Input, InputNumber, Space, Switch } from 'antd';
 import { ReloadOutlined } from '@ant-design/icons';

 import { FormField } from '@/components/form/rhf';
@@ -43,21 +43,6 @@ export default function WireguardFields({ wgPubKey, regenInboundWg }: WireguardF
      >
        <Switch />
      </FormField>
-      <FormField
-        name={['settings', 'domainStrategy']}
-        label={t('pages.xray.wireguard.domainStrategy')}
-      >
-        <Select
-          allowClear
-          options={[
-            { value: 'ForceIP', label: 'ForceIP' },
-            { value: 'ForceIPv4', label: 'ForceIPv4' },
-            { value: 'ForceIPv4v6', label: 'ForceIPv4v6' },
-            { value: 'ForceIPv6', label: 'ForceIPv6' },
-            { value: 'ForceIPv6v4', label: 'ForceIPv6v4' },
-          ]}
-        />
-      </FormField>
    </>
  );
 }
@@ -1,5 +1,5 @@
 import { useTranslation } from 'react-i18next';
-import { Button, Form, Input, InputNumber, Select, Space, Switch } from 'antd';
+import { Button, Form, Input, InputNumber, Space, Switch } from 'antd';
 import { DeleteOutlined, MinusOutlined, PlusOutlined, ReloadOutlined } from '@ant-design/icons';
 import { useFieldArray, useFormContext } from 'react-hook-form';

@@ -7,7 +7,6 @@ import { Wireguard } from '@/utils';
 import { activateOnKey } from '@/utils/a11y';
 import { InputAddon } from '@/components/ui';
 import { FormField } from '@/components/form/rhf';
-import { WireguardDomainStrategy } from '@/schemas/primitives';

 function AllowedIPsList({ peerIndex }: { peerIndex: number }) {
  const { t } = useTranslation();
@@ -75,17 +74,6 @@ export default function WireguardFields() {
      <FormField label={t('pages.inbounds.publicKey')} name={['settings', 'pubKey']}>
        <Input disabled />
      </FormField>
-      <FormField
-        label={t('pages.xray.wireguard.domainStrategy')}
-        name={['settings', 'domainStrategy']}
-      >
-        <Select
-          options={[
-            { value: '', label: `(${t('none')})` },
-            ...WireguardDomainStrategy.map((s) => ({ value: s, label: s })),
-          ]}
-        />
-      </FormField>
      <FormField label="MTU" name={['settings', 'mtu']}>
        <InputNumber min={0} />
      </FormField>
@@ -65,6 +65,34 @@ function reservedFor(clientId?: string): number[] {
  return out;
 }

+export function buildWarpOutbound(
+  data: WarpData | null,
+  config: WarpConfig | null,
+): Record<string, unknown> | null {
+  const cfg = config?.config;
+  if (!cfg?.peers?.length) return null;
+  const peer = cfg.peers[0];
+  return {
+    tag: 'warp',
+    protocol: 'wireguard',
+    // ForceIP may resolve engage.cloudflareclient.com to its AAAA and a half-configured IPv6
+    // host blackholes the handshake silently (#5205); sockopt drives that lookup since 26.9.30.
+    streamSettings: { sockopt: { domainStrategy: 'ForceIPv4v6' } },
+    // Targets inside the tunnel keep the IPv4 preference the removed settings key gave them.
+    targetStrategy: 'ForceIPv4v6',
+    settings: {
+      mtu: 1420,
+      secretKey: data?.private_key,
+      address: addressesFor(cfg.interface?.addresses || {}),
+      reserved: reservedFor(cfg.client_id ?? data?.client_id),
+      peers: [{ publicKey: peer.public_key, endpoint: peer.endpoint?.host }],
+      // Userspace TUN: kernel TUN needs CAP_NET_ADMIN + fwmark routing, fails silently on many
+      // VPS setups, and differs from the connectivity test's path (always noKernelTun=true).
+      noKernelTun: true,
+    },
+  };
+}
+
 export function mergeWarpRotation(
  existing: Record<string, unknown> | undefined,
  data: WarpData | null,
@@ -127,31 +155,8 @@ export default function WarpModal({

  const collectConfig = useCallback(
    (data: WarpData | null, config: WarpConfig | null): Record<string, unknown> | null => {
-      const cfg = config?.config;
-      if (!cfg?.peers?.length) return null;
-      const peer = cfg.peers[0];
-      const outbound: Record<string, unknown> = {
-        tag: 'warp',
-        protocol: 'wireguard',
-        settings: {
-          mtu: 1420,
-          secretKey: data?.private_key,
-          address: addressesFor(cfg.interface?.addresses || {}),
-          reserved: reservedFor(cfg.client_id ?? data?.client_id),
-          // Prefer IPv4 with IPv6 fallback: plain ForceIP may pick the AAAA
-          // record for engage.cloudflareclient.com, and a host with
-          // half-configured IPv6 then blackholes the handshake with no error
-          // logged (#5205).
-          domainStrategy: 'ForceIPv4v6',
-          peers: [{ publicKey: peer.public_key, endpoint: peer.endpoint?.host }],
-          // Userspace TUN: kernel TUN needs CAP_NET_ADMIN + fwmark routing and
-          // fails silently on many VPS setups, and it is a different data path
-          // than the panel's connectivity test (which always probes with
-          // noKernelTun=true), so "test ok" and "traffic flows" can disagree.
-          noKernelTun: true,
-        },
-      };
-      setStagedOutbound(outbound);
+      const outbound = buildWarpOutbound(data, config);
+      if (outbound) setStagedOutbound(outbound);
      return outbound;
    },
    [],
@@ -13,7 +13,6 @@ import {
  FreedomFragmentSchema,
  FreedomNoiseSchema,
  OutboundDomainStrategySchema,
-  WireguardDomainStrategySchema,
 } from '@/schemas/protocols/outbound';

 export const VmessOutboundFormSettingsSchema = z.object({
@@ -105,7 +104,6 @@ export const WireguardOutboundFormSettingsSchema = z.object({
  secretKey: z.string().default(''),
  pubKey: z.string().default(''),
  address: z.string().default(''),
-  domainStrategy: z.union([WireguardDomainStrategySchema, z.literal('')]).default(''),
  reserved: z.string().default(''),
  remoteDNS: z.string().default(''),
  peers: z.array(WireguardOutboundFormPeerSchema).default([]),
@@ -39,14 +39,6 @@ export const MODE_OPTION = Object.freeze({
  STREAM_ONE: 'stream-one',
 });

-export const WireguardDomainStrategy = Object.freeze([
-  'ForceIP',
-  'ForceIPv4',
-  'ForceIPv4v6',
-  'ForceIPv6',
-  'ForceIPv6v4',
-] as const);
-
 export const Address_Port_Strategy = Object.freeze({
  NONE: 'none',
  SRV_PORT_ONLY: 'SrvPortOnly',
@@ -8,5 +8,8 @@ export const TunInboundSettingsSchema = z.object({
  userLevel: z.number().int().min(0).default(0),
  autoSystemRoutingTable: z.array(z.string()).default([]),
  autoOutboundsInterface: z.string().default('auto'),
+  // xray-core 26.9.30: the first acts on Linux, the second ("dns", "misconfigtun") on Windows.
+  autoSystemDnsToGateway: z.boolean().optional(),
+  autoSystemWfpBlockLeak: z.array(z.string()).optional(),
 });
 export type TunInboundSettings = z.infer<typeof TunInboundSettingsSchema>;
@@ -1,14 +1,5 @@
 import { z } from 'zod';

-export const WireguardDomainStrategySchema = z.enum([
-  'ForceIP',
-  'ForceIPv4',
-  'ForceIPv4v6',
-  'ForceIPv6',
-  'ForceIPv6v4',
-]);
-export type WireguardDomainStrategy = z.infer<typeof WireguardDomainStrategySchema>;
-
 // AntD InputNumber emits null (not undefined) when the user clears it, and
 // the form store hands that null straight to safeParse on submit — a bare
 // .optional() would reject it and block the save.
@@ -68,7 +59,6 @@ export const WireguardInboundSettingsSchema = z.object({
  peers: z.array(WireguardInboundPeerSchema).default([]),
  clients: z.array(WireguardClientSchema).default([]),
  noKernelTun: z.boolean().default(false),
-  domainStrategy: WireguardDomainStrategySchema.optional(),
  // Admin-configurable base subnet new clients are auto-allocated from —
  // mirrors AmneziaWG's settings.server.subnetIp/subnetCidr. Optional and
  // left blank by default: an inbound that never sets this keeps the
@@ -1,14 +1,5 @@
 import { z } from 'zod';

-export const WireguardDomainStrategySchema = z.enum([
-  'ForceIP',
-  'ForceIPv4',
-  'ForceIPv4v6',
-  'ForceIPv6',
-  'ForceIPv6v4',
-]);
-export type WireguardDomainStrategy = z.infer<typeof WireguardDomainStrategySchema>;
-
 export const WireguardOutboundPeerSchema = z.object({
  publicKey: z.string().min(1),
  preSharedKey: z.string().optional(),
@@ -22,7 +13,6 @@ export const WireguardOutboundSettingsSchema = z.object({
  mtu: z.number().int().min(1).optional(),
  secretKey: z.string().min(1),
  address: z.array(z.string()).default([]),
-  domainStrategy: WireguardDomainStrategySchema.optional(),
  reserved: z.array(z.number().int()).optional(),
  peers: z.array(WireguardOutboundPeerSchema).min(1),
  noKernelTun: z.boolean().default(false),
@@ -272,11 +272,28 @@ exports[`FinalMaskStreamSettingsSchema fixtures > parses udp-mask byte-stably 1`
    {
      "settings": {
        "domains": [
-          "example.com:txt",
-          "example.org:a",
+          {
+            "edns0": 1232,
+            "name": "example.com",
+            "types": [
+              16,
+            ],
+          },
+          {
+            "edns0": 1232,
+            "name": "example.org",
+            "types": [
+              1,
+            ],
+          },
        ],
        "resolvers": [
-          "example.com:txt+udp://1.1.1.1:53",
+          {
+            "settings": {
+              "addr": "1.1.1.1:53",
+            },
+            "type": "udp",
+          },
        ],
      },
      "type": "xdns",
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { FinalMaskField } from '@/lib/xray/forms/fields';
+
+import { listSelectOptions, renderWithProviders } from './test-utils';
+
+describe('FinalMaskForm item types', () => {
+  // Only the noise mask parses tag expressions; header-custom items go through the
+  // core's PraseByteSlice, which refuses "exp" and fails the whole config load.
+  it('offers the exp type to noise items only', () => {
+    renderWithProviders(
+      <FinalMaskField
+        network="kcp"
+        protocol="vless"
+        value={{
+          tcp: [],
+          udp: [
+            { type: 'noise', settings: { noise: [{ type: 'array', rand: '1-8', delay: '1-2' }] } },
+            { type: 'header-custom', settings: { client: [{ type: 'array', rand: 1 }] } },
+          ],
+        }}
+      />,
+    );
+
+    // An opened dropdown stays in the DOM, so read header-custom's before noise's.
+    expect(listSelectOptions('finalmask_udp_1_settings_client_0_type')).not.toContain('Expression');
+    expect(listSelectOptions('finalmask_udp_0_settings_noise_0_type')).toContain('Expression');
+  });
+});
@@ -48,8 +48,11 @@
    {
      "type": "xdns",
      "settings": {
-        "domains": ["example.com:txt", "example.org:a"],
-        "resolvers": ["example.com:txt+udp://1.1.1.1:53"]
+        "domains": [
+          { "name": "example.com", "types": [16], "edns0": 1232 },
+          { "name": "example.org", "types": [1], "edns0": 1232 }
+        ],
+        "resolvers": [{ "type": "udp", "settings": { "addr": "1.1.1.1:53" } }]
      }
    },
    {
@@ -58,6 +58,26 @@ describe('inboundFromDb', () => {
    expect((inbound.streamSettings as { security?: string })?.security).toBe('tls');
  });

+  // The settings parse strips keys the schema does not list, so a TUN option xray-core
+  // 26.9.30 added and an admin entered as JSON would vanish on the next form save.
+  it('keeps the TUN options xray-core 26.9.30 added', () => {
+    const inbound = inboundFromDb({
+      ...BASE_DB_FIELDS,
+      protocol: 'tun',
+      settings: {
+        name: 'xray0',
+        gateway: ['10.0.0.1/16'],
+        autoSystemDnsToGateway: true,
+        autoSystemWfpBlockLeak: ['dns', 'misconfigtun'],
+      },
+      streamSettings: '',
+    });
+    expect(inbound.settings).toMatchObject({
+      autoSystemDnsToGateway: true,
+      autoSystemWfpBlockLeak: ['dns', 'misconfigtun'],
+    });
+  });
+
  it('returns schema-default settings for missing/empty fields without throwing', () => {
    const raw = {
      ...BASE_DB_FIELDS,
@@ -312,6 +312,74 @@ describe('outbound-form-adapter: round-trip', () => {
    expect((unset.settings as { remoteDNS?: string[] }).remoteDNS).toBeUndefined();
  });

+  // xray-core 26.9.30 ignores wireguard's settings.domainStrategy and panics on remoteDNS
+  // "local"; the endpoint lookup reads sockopt.domainStrategy, in-tunnel targets targetStrategy.
+  it('wireguard lifts the removed domainStrategy and remoteDNS local where the core reads them', () => {
+    const settings = {
+      secretKey: 'YFVmTVCBsLxXJCe4i+jK8PgD3S6vUqfZ4Zl0JVNDfHA=',
+      peers: [{ publicKey: 'pk', endpoint: 'engage.cloudflareclient.com:2408' }],
+    };
+    const warp = formValuesToWirePayload(
+      rawOutboundToFormValues({
+        protocol: 'wireguard',
+        settings: { ...settings, domainStrategy: 'ForceIPv4v6' },
+      }),
+    );
+    expect(warp.targetStrategy).toBe('ForceIPv4v6');
+    expect(warp.streamSettings).toEqual({ sockopt: { domainStrategy: 'ForceIPv4v6' } });
+    expect((warp.settings as Record<string, unknown>).domainStrategy).toBeUndefined();
+
+    const local = formValuesToWirePayload(
+      rawOutboundToFormValues({
+        protocol: 'wireguard',
+        settings: { ...settings, remoteDNS: ['local'] },
+      }),
+    );
+    expect(local.targetStrategy).toBe('ForceIP');
+    expect((local.settings as Record<string, unknown>).remoteDNS).toBeUndefined();
+
+    const admin = formValuesToWirePayload(
+      rawOutboundToFormValues({
+        protocol: 'wireguard',
+        targetStrategy: 'UseIPv6',
+        streamSettings: { sockopt: { domainStrategy: 'UseIPv4' } },
+        settings: { ...settings, domainStrategy: 'ForceIPv6' },
+      }),
+    );
+    expect(admin.targetStrategy).toBe('UseIPv6');
+    expect(admin.streamSettings).toEqual({ sockopt: { domainStrategy: 'UseIPv4' } });
+  });
+
+  // The core dials a wireguard peer through its finalmask (noise "exp" was built for WARP),
+  // so saving through the form must keep the masks next to sockopt instead of dropping them.
+  it('wireguard keeps its finalmask on save and drops an empty one', () => {
+    const settings = {
+      secretKey: 'YFVmTVCBsLxXJCe4i+jK8PgD3S6vUqfZ4Zl0JVNDfHA=',
+      peers: [{ publicKey: 'pk', endpoint: 'engage.cloudflareclient.com:2408' }],
+    };
+    const noise = {
+      type: 'noise',
+      settings: { noise: [{ type: 'exp', packet: '<b 0d0a0d0a><t>', delay: '1-3' }] },
+    };
+    const masked = formValuesToWirePayload(
+      rawOutboundToFormValues({
+        protocol: 'wireguard',
+        settings,
+        streamSettings: { sockopt: { mark: 255 }, finalmask: { tcp: [], udp: [noise] } },
+      }),
+    );
+    expect(masked.streamSettings).toEqual({ sockopt: { mark: 255 }, finalmask: { udp: [noise] } });
+
+    const empty = formValuesToWirePayload(
+      rawOutboundToFormValues({
+        protocol: 'wireguard',
+        settings,
+        streamSettings: { sockopt: { mark: 255 }, finalmask: { tcp: [], udp: [] } },
+      }),
+    );
+    expect(empty.streamSettings).toEqual({ sockopt: { mark: 255 } });
+  });
+
  it('dns rules normalize qType numeric strings, split domains, carry rCode', () => {
    const wire = {
      protocol: 'dns',
@@ -1,12 +1,15 @@
 import { describe, it, expect, vi } from 'vitest';
-import { act, fireEvent } from '@testing-library/react';
+import { act, fireEvent, render } from '@testing-library/react';
+import { QueryClientProvider } from '@tanstack/react-query';

+import { ThemeProvider } from '@/hooks/useTheme';
 import OutboundFormModal from '@/pages/xray/outbounds/OutboundFormModal';
 import {
  renderWithProviders,
  fieldLabels,
  listSelectOptions,
  chooseSelectOption,
+  makeTestQueryClient,
 } from './test-utils';

 function renderModal(outbound: Record<string, unknown> | null = null) {
@@ -149,4 +152,74 @@ describe('OutboundFormModal', () => {
    };
    expect(payload.settings.reverse?.tag).toBe('r1');
  });
+
+  // xray-core 26.9.30 no longer parses xdns's string lists, so the mask editor lifts
+  // them into objects on open rather than saving a config the core would refuse.
+  it('saves a legacy xdns mask in the object shape', async () => {
+    const onConfirm = vi.fn();
+    const queryClient = makeTestQueryClient();
+    const outbound = {
+      protocol: 'vless',
+      tag: 'dns-tunnel',
+      settings: {
+        vnext: [
+          {
+            address: 'example.com',
+            port: 53,
+            users: [{ id: 'c9f0c2d0-0000-4000-8000-000000000000', encryption: 'none' }],
+          },
+        ],
+      },
+      streamSettings: {
+        network: 'kcp',
+        security: 'none',
+        kcpSettings: { mtu: 130, tti: 50 },
+        finalmask: {
+          udp: [{ type: 'xdns', settings: { resolvers: ['t.example.com+udp://8.8.8.8:53'] } }],
+        },
+      },
+    };
+    const tree = (open: boolean) => (
+      <QueryClientProvider client={queryClient}>
+        <ThemeProvider>
+          <OutboundFormModal
+            open={open}
+            outbound={outbound}
+            existingTags={[]}
+            onClose={() => {}}
+            onConfirm={onConfirm}
+          />
+        </ThemeProvider>
+      </QueryClientProvider>
+    );
+    // The panel keeps the modal mounted and flips `open`; mounting it already open lets
+    // the add-mode transport seed replace the edited outbound's kcp stream with tcp.
+    const { rerender } = render(tree(false));
+    rerender(tree(true));
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+
+    const ok = document.querySelector('.ant-modal-footer .ant-btn-primary') as HTMLElement;
+    await act(async () => {
+      fireEvent.click(ok);
+    });
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+
+    expect(onConfirm).toHaveBeenCalledTimes(1);
+    const payload = onConfirm.mock.calls[0][0] as {
+      streamSettings: { finalmask: { udp: Array<{ type: string; settings: unknown }> } };
+    };
+    expect(payload.streamSettings.finalmask.udp).toEqual([
+      {
+        type: 'xdns',
+        settings: {
+          domains: [{ name: 't.example.com', types: [16], edns0: 1232 }],
+          resolvers: [{ type: 'udp', settings: { addr: '8.8.8.8:53' } }],
+        },
+      },
+    ]);
+  });
 });
@@ -224,6 +224,26 @@ describe('parseVlessLink — XHTTP advanced fields', () => {
 });

 describe('parseVlessLink', () => {
+  // A panel older than xray-core 26.9.30 shares xdns in the string lists the core no
+  // longer parses, so an outbound imported verbatim would fail the whole config.
+  it('upgrades a legacy xdns fm= mask to the object shape', () => {
+    const fm = encodeURIComponent(
+      JSON.stringify({
+        udp: [{ type: 'xdns', settings: { resolvers: ['t.example.com+udp://8.8.8.8:53'] } }],
+      }),
+    );
+    const out = parseVlessLink(
+      `vless://11111111-2222-4333-8444-555555555555@srv:53?type=kcp&security=none&fm=${fm}#dns`,
+    );
+    const finalmask = (out!.streamSettings as Record<string, unknown>).finalmask as {
+      udp: Array<{ settings: unknown }>;
+    };
+    expect(finalmask.udp[0].settings).toEqual({
+      domains: [{ name: 't.example.com', types: [16], edns0: 1232 }],
+      resolvers: [{ type: 'udp', settings: { addr: '8.8.8.8:53' } }],
+    });
+  });
+
  it('parses a vless:// link with reality', () => {
    const link =
      'vless://11111111-2222-4333-8444-555555555555@srv.example:443' +
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';

-import { mergeWarpRotation } from '@/pages/xray/overrides/WarpModal';
+import { buildWarpOutbound, mergeWarpRotation } from '@/pages/xray/overrides/WarpModal';

 const clientId = btoa(String.fromCharCode(1, 2, 3));

@@ -110,3 +110,14 @@ describe('mergeWarpRotation', () => {
    ]);
  });
 });
+
+describe('buildWarpOutbound', () => {
+  // xray-core 26.9.30 ignores wireguard's settings.domainStrategy, so the IPv4-first
+  // endpoint lookup #5205 depends on has to travel in sockopt, where the core reads it.
+  it('places the IPv4-first strategy where xray-core reads it', () => {
+    const outbound = buildWarpOutbound({ private_key: 'secret' }, rotatedConfig()) ?? {};
+    expect(outbound.streamSettings).toEqual({ sockopt: { domainStrategy: 'ForceIPv4v6' } });
+    expect(outbound.targetStrategy).toBe('ForceIPv4v6');
+    expect(outbound.settings).not.toHaveProperty('domainStrategy');
+  });
+});