up 7.24.3

CoreManager.RunProcess decided sudo elevation from the live mutable
_config.TunModeItem.EnableTun while the launched config was generated
from the immutable CoreConfigContext snapshot. If the TUN state changed
while a reload was in flight, a core whose config contains a TUN
inbound could launch without elevation and die within the 100ms health
check ("Failed to run core"), with no stderr shown.

The elevation decision now follows context.IsTunEnabled /
preContext.IsTunEnabled, so the generated config and the launch mode
always agree. With legacy TUN protect, the sing-box pre-core hosting
TUN is elevated and the main core no longer runs as root needlessly.

v2rayN/Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
     <PropertyGroup>
-        <Version>7.24.2</Version>
+        <Version>7.24.3</Version>
     </PropertyGroup>
 
     <PropertyGroup>

v2rayN/ServiceLib.Tests/CoreConfig/Singbox/CoreConfigSingboxServiceTests.cs

@@ -592,4 +592,38 @@ public class CoreConfigSingboxServiceTests
         proxy.realm.stun_servers.Should().Contain("turn.cloudflare.com:3478");
         proxy.server.Should().BeNull();
     }
+
+    [Fact]
+    public void GenerateClientConfigContent_TunSystemStackWithIpv6_ShouldUsePrefixWithPeerAddress()
+    {
+        // Regression test for #9820: sing-box fails with "need one more IPv6 address in
+        // first prefix for system stack" when the TUN inbound uses a /128 IPv6 prefix.
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.TunModeItem.EnableTun = true;
+        config.TunModeItem.Stack = "system";
+        config.TunModeItem.EnableIPv6Address = true;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var tun = cfg.inbounds.First(i => i.type == "tun");
+
+        tun.address.Should().NotBeNullOrEmpty();
+        foreach (var address in tun.address!)
+        {
+            var prefixLength = int.Parse(address[(address.LastIndexOf('/') + 1)..]);
+            var isIpv6 = address.Contains(':');
+            prefixLength.Should().BeLessThanOrEqualTo(isIpv6 ? 126 : 30,
+                $"'{address}' must leave room for the peer address the system stack derives");
+        }
+    }
+
 }

v2rayN/ServiceLib.Tests/Manager/CoreManagerTests.cs

@@ -0,0 +1,44 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using Xunit;
+
+namespace ServiceLib.Tests.Manager;
+
+public class CoreManagerTests
+{
+    [Theory]
+    [InlineData(ECoreType.sing_box)]
+    [InlineData(ECoreType.mihomo)]
+    [InlineData(ECoreType.Xray)]
+    public void ShouldRunAsSudo_TunLaunchOnNonWindows_RequiresElevation(ECoreType coreType)
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeTrue();
+    }
+
+    [Fact]
+    public void ShouldRunAsSudo_NonTunLaunch_ShouldNotElevate()
+    {
+        // Regression guard for the macOS TUN failure: the elevation decision must follow
+        // the context snapshot that generated the config. A launch whose snapshot has TUN
+        // disabled must never elevate, and a launch whose snapshot has TUN enabled must
+        // elevate regardless of later changes to the live config.
+        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.sing_box, isNonWindows: true).Should().BeFalse();
+        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.Xray, isNonWindows: true).Should().BeFalse();
+    }
+
+    [Fact]
+    public void ShouldRunAsSudo_OnWindows_ShouldNotElevate()
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, ECoreType.sing_box, isNonWindows: false).Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData(ECoreType.v2fly)]
+    [InlineData(ECoreType.hysteria)]
+    [InlineData(null)]
+    public void ShouldRunAsSudo_UnsupportedCoreType_ShouldNotElevate(ECoreType? coreType)
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeFalse();
+    }
+}

v2rayN/ServiceLib/Global.cs

@@ -745,7 +745,7 @@ public class Global
         MozillaRootProvider,
     ];
 
-    public static readonly IReadOnlyList<string> TunIpv4Address =
+    public static readonly IReadOnlyList<string> TunIPv4Address =
     [
         "172.18.0.1/30",
         "172.31.0.1/30",
@@ -757,15 +757,17 @@ public class Global
         "10.0.0.1/30",
     ];
 
-    public static readonly IReadOnlyList<string> TunIpv6Address =
+    // Prefixes must leave room for a peer address (max /126); the sing-box system
+    // stack derives a gateway from the first prefix and rejects single-address prefixes.
+    public static readonly IReadOnlyList<string> TunIPv6Address =
     [
-        "fc00::172:18:0:1/128",
-        "fc00::172:31:0:1/128",
-        "fc00::172:20:0:1/128",
-        "fc00::172:16:0:1/128",
-        "fc00::192:168:100:1/128",
-        "fc00::10:10:14:1/128",
-        "fc00::10:1:0:1/128",
-        "fc00::10:0:0:1/128",
+        "fc00::172:18:0:1/126",
+        "fc00::172:31:0:1/126",
+        "fc00::172:20:0:1/126",
+        "fc00::172:16:0:1/126",
+        "fc00::192:168:100:1/126",
+        "fc00::10:10:14:1/126",
+        "fc00::10:1:0:1/126",
+        "fc00::10:0:0:1/126",
     ];
 }

v2rayN/ServiceLib/Handler/ConfigHandler.cs

@@ -92,7 +92,7 @@ public static class ConfigHandler
             EnableTun = false,
             Mtu = 9000,
             IcmpRouting = Global.TunIcmpRoutingPolicies.First(),
-            EnableLegacyProtect = false,
+            EnableLegacyProtect = true,
         };
         config.GuiItem ??= new();
         if (!Global.RootCertProviders.Contains(config.GuiItem.RootCertProvider))

v2rayN/ServiceLib/Manager/CoreManager.cs

@@ -183,7 +183,7 @@ public class CoreManager
         var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);
 
         var displayLog = node.ConfigType != EConfigType.Custom || node.DisplayLog;
-        var proc = await RunProcess(coreInfo, Global.CoreConfigFileName, displayLog, true);
+        var proc = await RunProcess(coreInfo, Global.CoreConfigFileName, displayLog, true, context.IsTunEnabled);
         if (proc is null)
         {
             return;
@@ -201,7 +201,7 @@ public class CoreManager
             if (result.Success)
             {
                 var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
-                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
+                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true, preContext.IsTunEnabled);
                 if (proc is null)
                 {
                     return;
@@ -289,7 +289,20 @@ public class CoreManager
 
     #region Process
 
-    private async Task<ProcessService?> RunProcess(CoreInfo? coreInfo, string configPath, bool displayLog, bool mayNeedSudo)
+    /// <summary>
+    ///     Decides whether a core launch must be elevated on non-Windows platforms.
+    ///     The TUN state comes from the immutable <see cref="CoreConfigContext" /> snapshot that
+    ///     generated the config, never from the live mutable config: the generated config and the
+    ///     launch mode must always agree, even if TUN is toggled while a reload is in flight.
+    /// </summary>
+    public static bool ShouldRunAsSudo(bool isTunLaunch, ECoreType? coreType, bool isNonWindows)
+    {
+        return isTunLaunch
+            && coreType is ECoreType.sing_box or ECoreType.mihomo or ECoreType.Xray
+            && isNonWindows;
+    }
+
+    private async Task<ProcessService?> RunProcess(CoreInfo? coreInfo, string configPath, bool displayLog, bool mayNeedSudo, bool isTunLaunch = false)
     {
         var fileName = CoreInfoManager.Instance.GetCoreExecFile(coreInfo, out var msg);
         if (fileName.IsNullOrEmpty())
@@ -301,9 +314,7 @@ public class CoreManager
         try
         {
             if (mayNeedSudo
-                && _config.TunModeItem.EnableTun
-                && (coreInfo.CoreType is ECoreType.sing_box or ECoreType.mihomo or ECoreType.Xray)
-                && Utils.IsNonWindows())
+                && ShouldRunAsSudo(isTunLaunch, coreInfo.CoreType, Utils.IsNonWindows()))
             {
                 _linuxSudo = true;
                 await CoreAdminManager.Instance.Init(_config, _updateFunc);

v2rayN/ServiceLib/Models/Configs/ConfigItems.cs

@@ -147,10 +147,10 @@ public class TunModeItem
     public int Mtu { get; set; }
     public bool EnableIPv6Address { get; set; }
     public string IcmpRouting { get; set; }
-    public bool EnableLegacyProtect { get; set; }
+    public bool EnableLegacyProtect { get; set; } = true;
     public List<string>? RouteExcludeAddress { get; set; }
-    public string Ipv4Address { get; set; }
-    public string Ipv6Address { get; set; }
+    public string IPv4Address { get; set; }
+    public string IPv6Address { get; set; }
 }
 
 [Serializable]

v2rayN/ServiceLib/Sample/SampleTunInbound

@@ -1,27 +1,28 @@
 {
-  "tag": "tun",
-  "protocol": "tun",
-  "settings": {
-    "name": "xray_tun",
-    "MTU": 9000,
-    "gateway": [
-      "172.18.0.1/30",
-      "fdfe:dcba:9876::1/126"
-    ],
-    "dns": [
-      "172.18.0.1"
-    ],
-    "autoSystemRoutingTable": [
-      "0.0.0.0/0",
-      "::/0"
-    ],
-    "autoOutboundsInterface": "auto"
-  },
-  "sniffing": {
-    "enabled": true,
-    "destOverride": [
-      "http",
-      "tls"
-    ]
-  }
-}
+    "tag": "tun",
+    "protocol": "tun",
+    "settings": {
+        "name": "xray_tun",
+        "MTU": 9000,
+        "gateway": [
+            "172.18.0.1/30",
+            "fdfe:dcba:9876::1/126"
+        ],
+        "dns": [
+            "1.1.1.1",
+            "8.8.8.8"
+        ],
+        "autoSystemRoutingTable": [
+            "0.0.0.0/0",
+            "::/0"
+        ],
+        "autoOutboundsInterface": "auto"
+    },
+    "sniffing": {
+        "enabled": true,
+        "destOverride": [
+            "http",
+            "tls"
+        ]
+    }
+}

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxInboundService.cs

@@ -68,11 +68,11 @@ public partial class CoreConfigSingboxService
                 tunInbound.strict_route = _config.TunModeItem.StrictRoute;
                 tunInbound.stack = _config.TunModeItem.Stack;
 
-                var address = _config.TunModeItem.Ipv4Address.NullIfEmpty() ?? Global.TunIpv4Address.First();
+                var address = _config.TunModeItem.IPv4Address.NullIfEmpty() ?? Global.TunIPv4Address.First();
                 tunInbound.address = [address];
                 if (_config.TunModeItem.EnableIPv6Address == true)
                 {
-                    var address6 = _config.TunModeItem.Ipv6Address.NullIfEmpty() ?? Global.TunIpv6Address.First();
+                    var address6 = _config.TunModeItem.IPv6Address.NullIfEmpty() ?? Global.TunIPv6Address.First();
                     tunInbound.address.Add(address6);
                 }
                 tunInbound.route_exclude_address = _config.TunModeItem.RouteExcludeAddress;

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayInboundService.cs

@@ -64,14 +64,14 @@ public partial class CoreConfigV2rayService
                 tunInbound.settings.name = context.IsMacOS ? $"utun{new Random().Next(99)}" : "xray_tun";
                 tunInbound.settings.MTU = _config.TunModeItem.Mtu;
 
-                var address = _config.TunModeItem.Ipv4Address.NullIfEmpty() ?? Global.TunIpv4Address.First();
+                var address = _config.TunModeItem.IPv4Address.NullIfEmpty() ?? Global.TunIPv4Address.First();
                 tunInbound.settings.gateway = [address];
                 if (_config.TunModeItem.EnableIPv6Address == true)
                 {
-                    var address6 = _config.TunModeItem.Ipv6Address.NullIfEmpty() ?? Global.TunIpv6Address.First();
+                    var address6 = _config.TunModeItem.IPv6Address.NullIfEmpty() ?? Global.TunIPv6Address.First();
                     tunInbound.settings.gateway.Add(address6);
                 }
-                tunInbound.settings.dns = [address.Split('/').First()];
+
                 tunInbound.settings.autoSystemRoutingTable = ["0.0.0.0/0"];
                 var bindInterface = _config.CoreBasicItem.BindInterface?.TrimEx();
                 if (!bindInterface.IsNullOrEmpty())

v2rayN/ServiceLib/ViewModels/OptionSettingViewModel.cs

@@ -95,8 +95,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
     [Reactive] public string TunIcmpRouting { get; set; }
     [Reactive] public bool TunEnableLegacyProtect { get; set; }
     [Reactive] public string TunRouteExcludeAddress { get; set; }
-    [Reactive] public string TunIpv4Address { get; set; }
-    [Reactive] public string TunIpv6Address { get; set; }
+    [Reactive] public string TunIPv4Address { get; set; }
+    [Reactive] public string TunIPv6Address { get; set; }
 
     #endregion Tun mode
 
@@ -216,8 +216,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
         TunIcmpRouting = _config.TunModeItem.IcmpRouting;
         TunEnableLegacyProtect = _config.TunModeItem.EnableLegacyProtect;
         TunRouteExcludeAddress = Utils.List2String(_config.TunModeItem.RouteExcludeAddress, true);
-        TunIpv4Address = _config.TunModeItem.Ipv4Address;
-        TunIpv6Address = _config.TunModeItem.Ipv6Address;
+        TunIPv4Address = _config.TunModeItem.IPv4Address;
+        TunIPv6Address = _config.TunModeItem.IPv6Address;
 
         #endregion Tun mode
 
@@ -382,8 +382,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
         _config.TunModeItem.IcmpRouting = TunIcmpRouting;
         _config.TunModeItem.EnableLegacyProtect = TunEnableLegacyProtect;
         _config.TunModeItem.RouteExcludeAddress = Utils.String2List(TunRouteExcludeAddress);
-        _config.TunModeItem.Ipv4Address = TunIpv4Address;
-        _config.TunModeItem.Ipv6Address = TunIpv6Address;
+        _config.TunModeItem.IPv4Address = TunIPv4Address;
+        _config.TunModeItem.IPv6Address = TunIPv6Address;
 
         //coreType
         await SaveCoreType();

v2rayN/v2rayN.Desktop/Views/OptionSettingWindow.axaml.cs

@@ -33,8 +33,8 @@ public partial class OptionSettingWindow : WindowBase<OptionSettingViewModel>
         cmbMtu.ItemsSource = Global.TunMtus;
         cmbStack.ItemsSource = Global.TunStacks;
         cmbIcmpRoutingPolicy.ItemsSource = Global.TunIcmpRoutingPolicies;
-        cmbIpv4Address.ItemsSource = Global.TunIpv4Address;
-        cmbIpv6Address.ItemsSource = Global.TunIpv6Address;
+        cmbIpv4Address.ItemsSource = Global.TunIPv4Address;
+        cmbIpv6Address.ItemsSource = Global.TunIPv6Address;
         cmbFragmentPackets.ItemsSource = Global.FragmentPacketsOptions;
 
         cmbCoreType1.ItemsSource = Global.CoreTypes;
@@ -131,8 +131,8 @@ public partial class OptionSettingWindow : WindowBase<OptionSettingViewModel>
             this.Bind(ViewModel, vm => vm.TunIcmpRouting, v => v.cmbIcmpRoutingPolicy.SelectedValue).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunEnableLegacyProtect, v => v.togEnableLegacyProtect.IsChecked).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunRouteExcludeAddress, v => v.txtRouteExcludeAddress.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv4Address, v => v.cmbIpv4Address.SelectedValue).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv6Address, v => v.cmbIpv6Address.SelectedValue).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv4Address, v => v.cmbIpv4Address.SelectedValue).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv6Address, v => v.cmbIpv6Address.SelectedValue).DisposeWith(disposables);
 
             this.Bind(ViewModel, vm => vm.CoreType1, v => v.cmbCoreType1.SelectedValue).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CoreType2, v => v.cmbCoreType2.SelectedValue).DisposeWith(disposables);

v2rayN/v2rayN/Views/OptionSettingWindow.xaml.cs

@@ -29,8 +29,8 @@ public partial class OptionSettingWindow
         cmbMtu.ItemsSource = Global.TunMtus;
         cmbStack.ItemsSource = Global.TunStacks;
         cmbIcmpRoutingPolicy.ItemsSource = Global.TunIcmpRoutingPolicies;
-        cmbIpv4Address.ItemsSource = Global.TunIpv4Address;
-        cmbIpv6Address.ItemsSource = Global.TunIpv6Address;
+        cmbIpv4Address.ItemsSource = Global.TunIPv4Address;
+        cmbIpv6Address.ItemsSource = Global.TunIPv6Address;
         cmbFragmentPackets.ItemsSource = Global.FragmentPacketsOptions;
 
         cmbCoreType1.ItemsSource = Global.CoreTypes;
@@ -126,8 +126,8 @@ public partial class OptionSettingWindow
             this.Bind(ViewModel, vm => vm.TunIcmpRouting, v => v.cmbIcmpRoutingPolicy.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunEnableLegacyProtect, v => v.togEnableLegacyProtect.IsChecked).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunRouteExcludeAddress, v => v.txtRouteExcludeAddress.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv4Address, v => v.cmbIpv4Address.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv6Address, v => v.cmbIpv6Address.Text).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv4Address, v => v.cmbIpv4Address.Text).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv6Address, v => v.cmbIpv6Address.Text).DisposeWith(disposables);
 
             this.Bind(ViewModel, vm => vm.CoreType1, v => v.cmbCoreType1.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CoreType2, v => v.cmbCoreType2.Text).DisposeWith(disposables);