up 7.25.2

https://github.com/2dust/v2rayN/commit/5d9718a0bb93fe4bfa6d8a9a8f985e4f16642ba1

.github/dependabot.yml

@@ -6,6 +6,6 @@ updates:
       interval: "daily"
 
   - package-ecosystem: "nuget"
-    directory: "/"
+    directory: "/v2rayN"
     schedule:
       interval: "daily"

.github/workflows/build-windows-x86.yml

@@ -52,7 +52,7 @@ jobs:
           dotnet --list-sdks 2>$null; $LASTEXITCODE=0
 
       - name: Setup .NET 10.0.1xx
-        uses: actions/setup-dotnet@v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.1xx
 

.github/workflows/build.yml

@@ -69,9 +69,9 @@ jobs:
         dotnet --list-sdks 2>$null; $LASTEXITCODE=0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v6.0.0
+      uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '10.0.1xx'
+        dotnet-version: 10.0.1xx
         
     - name: Build v2rayN
       shell: bash
@@ -89,7 +89,7 @@ jobs:
         find ${{ matrix.arch }} -type f -name '*.pdb' -delete
 
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v7.0.1
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ matrix.arch }}
         path: ${{ matrix.arch }}

.github/workflows/test.yml

@@ -1,29 +1,52 @@
 name: Code Test
 
 on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'v2rayN/ServiceLib/**'
+      - 'v2rayN/ServiceLib.UdpTest/**'
+      - 'v2rayN/ServiceLib.Tests/**'
+      - 'v2rayN/Directory.Build.*'
+      - 'v2rayN/Directory.Packages.props'
+      - 'global.json'
+      - '.github/workflows/test.yml'
   pull_request:
     branches:
       - master
     paths:
-      - 'v2rayN/ServiceLib/Services/CoreConfig/**'
+      - 'v2rayN/ServiceLib/**'
-      - 'v2rayN/ServiceLib/Handler/Fmt/**'
+      - 'v2rayN/ServiceLib.UdpTest/**'
+      - 'v2rayN/ServiceLib.Tests/**'
+      - 'v2rayN/Directory.Build.*'
+      - 'v2rayN/Directory.Packages.props'
+      - 'global.json'
       - '.github/workflows/test.yml'
 
+permissions:
+  checks: write
+  pull-requests: write
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
       uses: actions/checkout@v7
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v6.0.0
+      uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '8.0.x'
+        dotnet-version: '10.x'
+        dotnet-quality: 'ga'
 
     - name: Test Code
-      working-directory: ./v2rayN
+      run: dotnet test --project ./v2rayN/ServiceLib.Tests -c Release --results-directory ./TestResults -- --report-trx
-      run: dotnet test ./ServiceLib.Tests
+
+    - name: Comment PR with results
+      if: always()
+      uses: EnricoMi/publish-unit-test-result-action@v2
+      with:
+        files: ./TestResults/*.trx
+        comment_mode: failures

README.md

@@ -50,6 +50,8 @@ Read the Wiki for usage guides and configuration details.
 | Linux | ✅ | - | ✅ | ✅ | ✅ |
 | macOS | ✅ | - | ✅ | - | - |
 
+Minimum OS requirements: [Release files introduction](https://github.com/2dust/v2rayN/wiki/Release-files-introduction) / 最低系统要求：[发布文件介绍](https://github.com/2dust/v2rayN/wiki/Release-files-introduction)
+
 ---
 
 ## GPG Verification / GPG 签名校验

global.json

@@ -0,0 +1,5 @@
+{
+  "test": {
+    "runner": "Microsoft.Testing.Platform"
+  }
+}

package-debian-loong.sh

@@ -13,8 +13,8 @@ PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 OUTPUT_DIR="${HOME}/debbuild"
 DOTNET_TFM="net10.0"
-DOTNET_LOONGARCH_VERSION="10.0.110"
+DOTNET_LOONGARCH_VERSION="10.0.111"
-DOTNET_LOONGARCH_TAG="v10.0.110-loongarch64"
+DOTNET_LOONGARCH_TAG="v10.0.111-loongarch64"
 DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
 DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"

package-debian-riscv.sh

@@ -12,7 +12,7 @@ MIN_KERNEL="5.10"
 PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 OUTPUT_DIR="${HOME}/debbuild"
-DOTNET_RISCV_VERSION="10.0.110"
+DOTNET_RISCV_VERSION="10.0.111"
 DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
 DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"

package-osx.sh

@@ -54,7 +54,7 @@ cat >"$PackagePath/v2rayN.app/Contents/Info.plist" <<-EOF
   <key>NSHighResolutionCapable</key>
   <true/>
   <key>LSMinimumSystemVersion</key>
-  <string>13.7</string>
+  <string>13.6</string>
 </dict>
 </plist>
 EOF

package-rhel-loong.sh

@@ -12,8 +12,8 @@ MIN_KERNEL="6.12"
 PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 RPM_TOPDIR="${HOME}/rpmbuild"
-DOTNET_LOONGARCH_VERSION="10.0.110"
+DOTNET_LOONGARCH_VERSION="10.0.111"
-DOTNET_LOONGARCH_TAG="v10.0.110-loongarch64"
+DOTNET_LOONGARCH_TAG="v10.0.111-loongarch64"
 DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
 DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"

package-rhel-riscv.sh

@@ -12,7 +12,7 @@ MIN_KERNEL="5.10"
 PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 RPM_TOPDIR="${HOME}/rpmbuild"
-DOTNET_RISCV_VERSION="10.0.110"
+DOTNET_RISCV_VERSION="10.0.111"
 DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
 DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"

v2rayN/Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
     <PropertyGroup>
-        <Version>7.24.5</Version>
+        <Version>7.25.2</Version>
     </PropertyGroup>
 
     <PropertyGroup>

v2rayN/Directory.Packages.props

@@ -6,32 +6,30 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="Avalonia.AvaloniaEdit" Version="12.0.0" />
-    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="12.1.0" />
+    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="12.1.2" />
-    <PackageVersion Include="Avalonia.Desktop" Version="12.1.0" />
+    <PackageVersion Include="Avalonia.Desktop" Version="12.1.2" />
     <PackageVersion Include="AvaloniaUI.DiagnosticsSupport" Version="2.2.3" />
-    <PackageVersion Include="AwesomeAssertions" Version="9.5.0" />
     <PackageVersion Include="DialogHost.Avalonia" Version="0.12.3" />
     <PackageVersion Include="IPNetwork2" Version="4.3.0" />
-    <PackageVersion Include="ReactiveUI.Avalonia" Version="12.1.0" />
+    <PackageVersion Include="ReactiveUI.Avalonia" Version="12.1.2" />
-    <PackageVersion Include="CliWrap" Version="3.10.2" />
+    <PackageVersion Include="CliWrap" Version="3.10.5" />
-    <PackageVersion Include="Downloader" Version="5.9.5" />
+    <PackageVersion Include="Downloader" Version="5.9.6" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
     <PackageVersion Include="MaterialDesignThemes" Version="5.3.2" />
     <PackageVersion Include="QRCoder" Version="1.8.0" />
-    <PackageVersion Include="ReactiveUI" Version="24.0.0" />
+    <PackageVersion Include="ReactiveUI" Version="24.2.0" />
-    <PackageVersion Include="ReactiveUI.SourceGenerators" Version="3.1.0" />
+    <PackageVersion Include="ReactiveUI.SourceGenerators" Version="3.2.0" />
-    <PackageVersion Include="ReactiveUI.WPF" Version="24.0.0" />
+    <PackageVersion Include="ReactiveUI.WPF" Version="24.2.0" />
-    <PackageVersion Include="Semi.Avalonia" Version="12.1.0" />
+    <PackageVersion Include="Semi.Avalonia" Version="12.1.0.1" />
     <PackageVersion Include="Semi.Avalonia.AvaloniaEdit" Version="12.0.0" />
-    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="12.1.0" />
+    <PackageVersion Include="Semi.Avalonia.DataGrid" Version="12.1.0.1" />
-    <PackageVersion Include="NLog" Version="6.1.4" />
+    <PackageVersion Include="NLog" Version="6.2.1" />
     <PackageVersion Include="sqlite-net-e" Version="1.11.285" />
-    <PackageVersion Include="Repobot.SQLite.Unofficial" Version="3.53.3.10" />
+    <PackageVersion Include="Repobot.SQLite.Unofficial" Version="3.53.4.1" />
     <PackageVersion Include="TaskScheduler" Version="2.12.2" />
+    <PackageVersion Include="TUnit" Version="1.68.17" />
+    <PackageVersion Include="TUnit.Assertions.Should" Version="1.65.38-beta" />
     <PackageVersion Include="WebDav.Client" Version="2.9.0" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
-    <PackageVersion Include="xunit.v3" Version="3.2.2" />
     <PackageVersion Include="YamlDotNet" Version="18.1.0" />
     <PackageVersion Include="ZXing.Net.Bindings.SkiaSharp" Version="0.16.22" />
     <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />

v2rayN/ServiceLib.Tests/CoreConfig/Context/CoreConfigContextBuilderTests.cs

@@ -1,15 +1,8 @@
-using AwesomeAssertions;
-using ServiceLib.Enums;
-using ServiceLib.Handler.Builder;
-using ServiceLib.Helper;
-using ServiceLib.Models;
-using Xunit;
-
 namespace ServiceLib.Tests.CoreConfig.Context;
 
 public class CoreConfigContextBuilderTests
 {
-    [Fact]
+    [Test]
     public async Task ResolveNodeAsync_DirectCycleDependency_ShouldFailWithCycleError()
     {
         var config = CoreConfigTestFactory.CreateConfig();
@@ -27,13 +20,13 @@ public class CoreConfigContextBuilderTests
 
         var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
 
-        validatorResult.Success.Should().BeFalse();
+        await validatorResult.Success.Should().BeFalse();
-        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        await validatorResult.Errors.Should().Contain(ContainsCycleDependencyMessage);
-        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
-        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
     }
 
-    [Fact]
+    [Test]
     public async Task ResolveNodeAsync_IndirectCycleDependency_ShouldFailWithCycleError()
     {
         var config = CoreConfigTestFactory.CreateConfig();
@@ -53,14 +46,14 @@ public class CoreConfigContextBuilderTests
 
         var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
 
-        validatorResult.Success.Should().BeFalse();
+        await validatorResult.Success.Should().BeFalse();
-        validatorResult.Errors.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        await validatorResult.Errors.Should().Contain(ContainsCycleDependencyMessage);
-        context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupA.IndexId);
-        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
-        context.AllProxiesMap.Should().NotContainKey(groupC.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupC.IndexId);
     }
 
-    [Fact]
+    [Test]
     public async Task ResolveNodeAsync_CycleWithValidBranch_ShouldSkipCycleAndKeepValidChild()
     {
         var config = CoreConfigTestFactory.CreateConfig();
@@ -80,14 +73,14 @@ public class CoreConfigContextBuilderTests
 
         var (_, validatorResult) = await CoreConfigContextBuilder.ResolveNodeAsync(context, groupA, false);
 
-        validatorResult.Success.Should().BeTrue();
+        await validatorResult.Success.Should().BeTrue();
-        validatorResult.Errors.Should().BeEmpty();
+        await validatorResult.Errors.Should().BeEmpty();
-        validatorResult.Warnings.Should().Contain(msg => ContainsCycleDependencyMessage(msg));
+        await validatorResult.Warnings.Should().Contain(ContainsCycleDependencyMessage);
 
-        context.AllProxiesMap.Should().ContainKey(leaf.IndexId);
+        await context.AllProxiesMap.Should().ContainKey(leaf.IndexId);
-        context.AllProxiesMap.Should().ContainKey(groupA.IndexId);
+        await context.AllProxiesMap.Should().ContainKey(groupA.IndexId);
-        context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
+        await context.AllProxiesMap.Should().NotContainKey(groupB.IndexId);
-        groupA.GetProtocolExtra().ChildItems.Should().Be(leaf.IndexId);
+        await groupA.GetProtocolExtra().ChildItems.Should().BeEqualTo(leaf.IndexId);
     }
 
     private static string NewId(string prefix)

v2rayN/ServiceLib.Tests/CoreConfig/CoreConfigTestFactory.cs

@@ -205,7 +205,8 @@ internal static class CoreConfigTestFactory
         return node;
     }
 
-    public static CoreConfigContext CreateContext(Config config, ProfileItem node, ECoreType runCoreType)
+    public static CoreConfigContext CreateContext(Config config, ProfileItem node, ECoreType runCoreType,
+        bool hasGlobalIPv6Address = true)
     {
         return new CoreConfigContext
         {
@@ -226,6 +227,7 @@ internal static class CoreConfigTestFactory
             FullConfigTemplate = null,
             IsTunEnabled = config.TunModeItem.EnableTun,
             ProtectDomainList = [],
+            HasGlobalIPv6Address = hasGlobalIPv6Address,
         };
     }
 
@@ -251,4 +253,12 @@ internal static class CoreConfigTestFactory
         config.TunModeItem.RouteExcludeAddress = ["10.0.0.1/32", "192.168.1.0/24", "fc00::/7"];
         return config;
     }
+
+    public static Config CreateConfigWithTun(ECoreType coreType, bool enableIPv6Address)
+    {
+        var config = CreateConfig(coreType);
+        config.TunModeItem.EnableTun = true;
+        config.TunModeItem.EnableIPv6Address = enableIPv6Address;
+        return config;
+    }
 }

v2rayN/ServiceLib.Tests/CoreConfig/Singbox/CoreConfigSingboxServiceTests.cs

@@ -1,19 +1,9 @@
-using AwesomeAssertions;
-using ServiceLib.Common;
-using ServiceLib.Enums;
-using ServiceLib.Handler.Fmt;
-using ServiceLib.Manager;
-using ServiceLib.Models;
-using ServiceLib.Models.Dto;
-using ServiceLib.Services.CoreConfig;
-using Xunit;
-
 namespace ServiceLib.Tests.CoreConfig.Singbox;
 
 public class CoreConfigSingboxServiceTests
 {
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    public async Task GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -22,17 +12,17 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
-        result.Data.Should().NotBeNull();
+        await result.Data.Should().NotBeNull();
 
         var singboxConfig = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString());
-        singboxConfig.Should().NotBeNull();
+        await singboxConfig.Should().NotBeNull();
-        singboxConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        await singboxConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
-        singboxConfig.inbounds.Should().Contain(i => i.type == nameof(EInboundProtocol.mixed));
+        await singboxConfig.inbounds.Should().Contain(i => i.type == nameof(EInboundProtocol.mixed));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_TunWithLoopbackPreSocks_ShouldKeepMixedInbound()
+    public async Task GenerateClientConfigContent_TunWithLoopbackPreSocks_ShouldKeepMixedInbound()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -46,18 +36,100 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.inbounds.Should().Contain(i =>
+        await cfg.inbounds.Should().Contain(i =>
             i.type == nameof(EInboundProtocol.mixed)
             && i.listen == Global.Loopback
             && i.listen_port == AppManager.Instance.GetLocalPort(EInboundProtocol.socks));
-        cfg.inbounds.Should().Contain(i => i.type == "tun");
+        await cfg.inbounds.Should().Contain(i => i.type == "tun");
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_BindInterface_ShouldUseDialBindInterface()
+    public async Task GenerateClientConfigContent_TunEnabled_ShouldKeepEmbeddedTunRules()
+    {
+        // The embedded tun rules reject local-network noise (NetBIOS/mDNS, multicast).
+        // They are deserialized into List<Rule4Sbox>, so a schema mismatch in the
+        // embedded template makes JsonUtils.Deserialize return null and silently
+        // drops every one of them.
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.TunModeItem.EnableTun = true;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        await cfg.route.rules.Should().Contain(
+            r => r.action == "reject"
+                && r.network != null && r.network.Contains("udp")
+                && r.port != null && r.port.Contains(5353),
+            "the embedded tun rules must reject mDNS/NetBIOS noise");
+        await cfg.route.rules.Should().Contain(
+            r => r.action == "reject"
+                && r.ip_cidr != null && r.ip_cidr.Contains("224.0.0.0/3"),
+            "the embedded tun rules must reject multicast traffic");
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_TunEnabled_ShouldRejectTrafficToTunOwnAddresses()
+    {
+        // Regression test: traffic addressed to the TUN interface's own addresses must
+        // never reach an outbound. auto_route hijacks the default route, so `direct`
+        // writes such a packet straight back into the TUN, which routes it to the
+        // outbound again - an infinite loop that pins a CPU core. Observed in the wild
+        // with WebRTC ICE connectivity checks against the TUN's own fc00::/7 ULA
+        // address, sustaining ~8k packets/s out of the TUN interface.
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.TunModeItem.EnableTun = true;
+        config.TunModeItem.EnableIPv6Address = true;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var tun = cfg.inbounds.First(i => i.type == "tun");
+        //tun.address.Should().NotBeNullOrEmpty();
+        await tun.address.Should().NotBeNull();
+        await tun.address.Should().NotBeEmpty();
+
+        foreach (var address in tun.address!)
+        {
+            var self = IPAddress.Parse(address.Split('/').First());
+            var hostBits = self.AddressFamily == AddressFamily.InterNetworkV6 ? 128 : 32;
+            var expected = $"{self}/{hostBits}";
+            await cfg.route.rules.Should().Contain(
+                r => r.action == "reject" && r.ip_cidr != null && r.ip_cidr.Contains(expected),
+                $"traffic to the TUN's own address '{address}' must be rejected, not routed");
+        }
+
+        // The match has to stay on the addresses themselves. sing-tun derives the TUN's DNS
+        // entry from the address right after the interface's own, and every prefix offered
+        // here leaves room for it, so a prefix match would drop system name lookups too.
+        var dropRule = cfg.route.rules.First(r =>
+            r.action == "reject" && r.method == "drop" && r.ip_cidr?.Count > 0);
+        //dropRule.ip_cidr!.Should().OnlyContain(c =>
+        //    c.EndsWith("/32", StringComparison.Ordinal) || c.EndsWith("/128", StringComparison.Ordinal));
+        await dropRule.ip_cidr.Should().All(c => c.EndsWith("/32", StringComparison.Ordinal) || c.EndsWith("/128", StringComparison.Ordinal));
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_BindInterface_ShouldUseDialBindInterface()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         config.CoreBasicItem.BindInterface = "eth0";
@@ -71,16 +143,16 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
         var proxy = cfg.outbounds.First(o => o.tag == Global.ProxyTag);
 
-        proxy.bind_interface.Should().Be("eth0");
+        await proxy.bind_interface.Should().BeEqualTo("eth0");
-        proxy.detour.Should().BeNullOrEmpty();
+        await proxy.detour.Should().BeNull().Or.BeEmpty();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildSelector()
+    public async Task GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildSelector()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -97,17 +169,17 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        await cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
-        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        await cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDetourChain()
+    public async Task GenerateClientConfigContent_ProxyChain_ShouldBuildDetourChain()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -124,18 +196,18 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
+        await cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "socks");
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o =>
+        await cfg.outbounds.Should().Contain(o =>
             o.tag == Global.ProxyTag &&
             (o.detour ?? string.Empty).StartsWith("chain-proxy-1-", StringComparison.Ordinal));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    public async Task GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -157,18 +229,18 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        await cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
-        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        await cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    public async Task GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -190,25 +262,25 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
+        await cfg.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.type == "selector");
-        cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
+        await cfg.outbounds.Should().Contain(o => o.tag == $"{Global.ProxyTag}-auto" && o.type == "urltest");
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
 
         var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
-        proxyCloneCount.Should().Be(2);
+        await proxyCloneCount.Should().BeEqualTo(2);
 
         var allCloneDetoursPointToGroupBranches = cfg.outbounds
             .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
             .All(o => (o.detour ?? string.Empty).StartsWith("chain-proxy-1-group-", StringComparison.Ordinal));
-        allCloneDetoursPointToGroupBranches.Should().BeTrue();
+        await allCloneDetoursPointToGroupBranches.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    public async Task GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -244,24 +316,24 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
         var hasDirectRule = cfg.route.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("direct.example.com")
             && r.outbound == Global.DirectTag);
-        hasDirectRule.Should().BeTrue();
+        await hasDirectRule.Should().BeTrue();
 
         var hasBlockRule = cfg.route.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("block.example.com")
             && r.action == "reject");
-        hasBlockRule.Should().BeTrue();
+        await hasBlockRule.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    public async Task GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -293,65 +365,21 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
         var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
 
         var hasRouteRule = cfg.route.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("route.example.com")
             && (r.outbound ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
-        hasRouteRule.Should().BeTrue();
+        await hasRouteRule.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyGeoipAndCidrToDirectDnsRule()
+    public async Task GenerateClientConfigContent_BootstrapDNS_ShouldConfigurePureIPResolver()
-    {
-        var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(
-            ECoreType.sing_box,
-            "192.168.0.0/16,geoip:cn");
-        CoreConfigTestFactory.BindAppManagerConfig(config);
-
-        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
-        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
-        {
-            RoutingItem = new RoutingItem
-            {
-                Id = "r-dns-direct-expected",
-                Remarks = "dns-direct-expected",
-                RuleSet = JsonUtils.Serialize(new List<RulesItem>
-                {
-                    new()
-                    {
-                        Enabled = true,
-                        RuleType = ERuleType.DNS,
-                        OutboundTag = Global.DirectTag,
-                        Domain = ["geosite:cn"],
-                    }
-                }),
-                DomainStrategy = Global.AsIs,
-                DomainStrategy4Singbox = string.Empty,
-            }
-        };
-
-        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
-
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
-        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
-
-        var hasExpectedRule = cfg.dns.rules?.Any(r =>
-            r.server == Global.SingboxDirectDNSTag
-            && r.ip_cidr?.Contains("192.168.0.0/16") == true
-            && r.rule_set?.Contains("geosite-cn") == true
-            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
-
-        hasExpectedRule.Should().BeTrue();
-    }
-
-    [Fact]
-    public void GenerateClientConfigContent_BootstrapDNS_ShouldConfigurePureIPResolver()
     {
         var bootstrapDns = "8.8.8.8";
         var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.sing_box, bootstrapDns);
@@ -362,17 +390,17 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
-        config.SimpleDNSItem.BootstrapDNS.Should().Be(bootstrapDns);
+        await config.SimpleDNSItem.BootstrapDNS.Should().BeEqualTo(bootstrapDns);
 
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
-        var bootstrapServer = cfg.dns.servers?.FirstOrDefault(s => s.tag == Global.SingboxLocalDNSTag);
+        var bootstrapServer = cfg.dns?.servers.FirstOrDefault(s => s.tag == Global.SingboxLocalDNSTag);
-        bootstrapServer.Should().NotBeNull();
+        await bootstrapServer.Should().NotBeNull();
-        (bootstrapServer?.server ?? string.Empty).Should().Contain(bootstrapDns);
+        await bootstrapServer!.server.Should().Contain(bootstrapDns);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectFinalDns()
+    public async Task GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectFinalDns()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         config.SimpleDNSItem.DirectDNS = "1.1.1.1";
@@ -405,14 +433,14 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.dns.final.Should().Be(Global.SingboxDirectDNSTag);
+        await cfg.dns.final.Should().BeEqualTo(Global.SingboxDirectDNSTag);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedRule()
+    public async Task GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedRule()
     {
         var config =
             CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.sing_box, "192.168.0.0/16,geoip:cn");
@@ -442,21 +470,21 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
         var hasExpectedRule = cfg.dns.rules?.Any(r =>
             r.server == Global.SingboxDirectDNSTag
             && r.ip_cidr?.Contains("192.168.0.0/16") == true
             && r.rule_set?.Contains("geoip-cn") == true) ?? false;
-        hasExpectedRule.Should().BeFalse();
+        await hasExpectedRule.Should().BeFalse();
     }
 
-    [Theory]
+    [Test]
-    [InlineData("geosite:cn", "geosite-cn")]
+    [Arguments("geosite:cn", "geosite-cn")]
-    [InlineData("geosite:geolocation-cn", "geosite-geolocation-cn")]
+    [Arguments("geosite:geolocation-cn", "geosite-geolocation-cn")]
-    [InlineData("geosite:tld-cn", "geosite-tld-cn")]
+    [Arguments("geosite:tld-cn", "geosite-tld-cn")]
-    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedRule(string domainTag,
+    public async Task GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedRule(string domainTag,
         string expectedRuleSetTag)
     {
         var config =
@@ -472,31 +500,38 @@ public class CoreConfigSingboxServiceTests
                 Remarks = "dns-direct-variant",
                 RuleSet = JsonUtils.Serialize(new List<RulesItem>
                 {
+                    new()
+                    {
+                        Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.ProxyTag, Domain = ["geosite:google"],
+                    },
                     new()
                     {
                         Enabled = true, RuleType = ERuleType.DNS, OutboundTag = Global.DirectTag, Domain = [domainTag],
-                    }
+                    },
                 }),
                 DomainStrategy = Global.AsIs,
                 DomainStrategy4Singbox = string.Empty,
-            }
+            },
         };
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        var hasExpectedRule = cfg.dns.rules?.Any(r =>
+        var hasExpectedRule = (cfg.dns.rules?.Any(r =>
-            r.server == Global.SingboxDirectDNSTag
+                                  r.ip_cidr?.Contains("192.168.0.0/16") == true
-            && r.ip_cidr?.Contains("192.168.0.0/16") == true
+                                  && r.action == "respond"
-            && r.rule_set?.Contains(expectedRuleSetTag) == true
+                                  && r.rule_set?.Contains("geoip-cn") == true) ?? false)
-            && r.rule_set?.Contains("geoip-cn") == true) ?? false;
+                              && (cfg.dns.rules?.Any(r =>
-        hasExpectedRule.Should().BeTrue();
+                                  r.server == Global.SingboxDirectDNSTag
+                                  && r.rule_set?.Contains(expectedRuleSetTag) == true
+                                  && r.action == "evaluate") ?? false);
+        await hasExpectedRule.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_Hosts_ShouldPopulateHostsServerAndDomainResolver()
+    public async Task GenerateClientConfigContent_Hosts_ShouldPopulateHostsServerAndDomainResolver()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
@@ -508,21 +543,21 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
         var hostsServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxHostsDNSTag);
-        hostsServer.Should().NotBeNull();
+        await hostsServer.Should().NotBeNull();
-        hostsServer!.predefined.Should().ContainKey("resolver.example");
+        await hostsServer!.predefined.Should().ContainKey("resolver.example");
-        hostsServer.predefined!["resolver.example"].Should().Contain("1.1.1.1");
+        await hostsServer.predefined!["resolver.example"].Should().Contain("1.1.1.1");
 
         var directServer = cfg.dns.servers.FirstOrDefault(s => s.tag == Global.SingboxDirectDNSTag);
-        directServer.Should().NotBeNull();
+        await directServer.Should().NotBeNull();
-        directServer!.domain_resolver.Should().Be(Global.SingboxHostsDNSTag);
+        await directServer!.domain_resolver.Should().BeEqualTo(Global.SingboxHostsDNSTag);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsAndInjectLocalResolver()
+    public async Task GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsAndInjectLocalResolver()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -551,22 +586,76 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
 
-        cfg.dns.servers.Should().Contain(s => s.tag == "remote" && s.type == "udp" && s.server == "8.8.8.8");
+        await cfg.dns.servers.Should().Contain(s => s.tag == "remote" && s.type == "udp" && s.server == "8.8.8.8");
-        cfg.dns.servers.Should().Contain(s => s.tag == Global.SingboxLocalDNSTag);
+        await cfg.dns.servers.Should().Contain(s => s.tag == Global.SingboxLocalDNSTag);
-        cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Global));
+        await cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Global));
-        cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Direct));
+        await cfg.dns.rules.Should().Contain(r => r.clash_mode == nameof(ERuleMode.Direct));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_Hysteria2Realm_ShouldEmitHttpsServerUrl()
+    [Arguments(true)]
+    [Arguments(false)]
+    public async Task GenerateClientConfigContent_MultiDnsServers_ShouldIncludeAllServers(bool parallelQuery)
+    {
+        var config =
+            CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.SimpleDNSItem.ParallelQuery = parallelQuery;
+        config.SimpleDNSItem.DirectDNS = "1.1.1.1,2.2.2.2";
+        config.SimpleDNSItem.RemoteDNS = "3.3.3.3,4.4.4.4";
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateSocksNode(ECoreType.sing_box, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            RoutingItem = new RoutingItem
+            {
+                Id = "r-dns-direct-variant",
+                Remarks = "dns-direct-variant",
+                RuleSet = JsonUtils.Serialize(new List<RulesItem>
+                {
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.ProxyTag,
+                        Domain = ["geosite:google"],
+                    },
+                    new()
+                    {
+                        Enabled = true,
+                        RuleType = ERuleType.DNS,
+                        OutboundTag = Global.DirectTag,
+                        Domain = ["geosite:cn"],
+                    },
+                }),
+                DomainStrategy = Global.AsIs,
+                DomainStrategy4Singbox = string.Empty,
+            },
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+
+        await cfg.dns.servers.Where(s => s.tag.StartsWith(Global.SingboxDirectDNSTagPrefix)).Should().HaveCount(2);
+        await cfg.dns.servers.Where(s => s.tag.StartsWith(Global.SingboxRemoteDNSTagPrefix)).Should().HaveCount(2);
+        if (parallelQuery)
+        {
+            await cfg.dns.rules.Should().Contain(r => r.race == true);
+        }
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_Hysteria2Realm_ShouldEmitHttpsServerUrl()
     {
         var shareLink =
             "hysteria2+realm://public@realm.hy2.io/my-realm-id?auth=uuid&stun=turn.cloudflare.com%3A3478&sni=cloudflare.com&pinSHA256=xxx#Realm-Test";
         var node = Hysteria2Fmt.ResolveRealm(shareLink, out _);
-        node.Should().NotBeNull();
+        await node.Should().NotBeNull();
         node!.CoreType = ECoreType.sing_box;
 
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
@@ -579,22 +668,22 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
         var proxy = cfg.outbounds.First(o => o.tag == Global.ProxyTag);
 
-        proxy.type.Should().Be("hysteria2");
+        await proxy.type.Should().BeEqualTo("hysteria2");
-        proxy.realm.Should().NotBeNull();
+        await proxy.realm.Should().NotBeNull();
-        proxy.realm!.server_url.Should().StartWith("https://");
+        await proxy.realm!.server_url.Should().StartWith("https://");
-        proxy.realm.server_url.Should().Contain("realm.hy2.io");
+        await proxy.realm.server_url.Should().Contain("realm.hy2.io");
-        proxy.realm.token.Should().Be("public");
+        await proxy.realm.token.Should().BeEqualTo("public");
-        proxy.realm.realm_id.Should().Be("my-realm-id");
+        await proxy.realm.realm_id.Should().BeEqualTo("my-realm-id");
-        proxy.realm.stun_servers.Should().Contain("turn.cloudflare.com:3478");
+        await proxy.realm.stun_servers.Should().Contain("turn.cloudflare.com:3478");
-        proxy.server.Should().BeNull();
+        await proxy.server.Should().BeNull();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_TunSystemStackWithIpv6_ShouldUsePrefixWithPeerAddress()
+    public async Task GenerateClientConfigContent_TunSystemStackWithIpv6_ShouldUsePrefixWithPeerAddress()
     {
         // Regression test for #9820: sing-box fails with "need one more IPv6 address in
         // first prefix for system stack" when the TUN inbound uses a /128 IPv6 prefix.
@@ -612,23 +701,24 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
         var tun = cfg.inbounds.First(i => i.type == "tun");
 
-        tun.address.Should().NotBeNullOrEmpty();
+        await tun.address.Should().NotBeNull();
+        await tun.address.Should().NotBeEmpty();
         foreach (var address in tun.address!)
         {
             var prefixLength = int.Parse(address[(address.LastIndexOf('/') + 1)..]);
             var isIpv6 = address.Contains(':');
-            prefixLength.Should().BeLessThanOrEqualTo(isIpv6 ? 126 : 30,
+            await prefixLength.Should().BeLessThanOrEqualTo(isIpv6 ? 126 : 30,
                 $"'{address}' must leave room for the peer address the system stack derives");
         }
     }
 
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_CustomOutbound_ShouldReplaceWithUserCustomOutboundJson()
+    public async Task GenerateClientConfigContent_CustomOutbound_ShouldReplaceWithUserCustomOutboundJson()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -649,17 +739,17 @@ public class CoreConfigSingboxServiceTests
 
         var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
-        result.Data.Should().NotBeNull();
+        await result.Data.Should().NotBeNull();
 
         var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString());
-        cfg.Should().NotBeNull();
+        await cfg.Should().NotBeNull();
         var proxyOutbound = cfg!.outbounds.FirstOrDefault(o => o.tag == Global.ProxyTag);
-        proxyOutbound.Should().NotBeNull();
+        await proxyOutbound.Should().NotBeNull();
-        proxyOutbound!.type.Should().Be("shadowsocks");
+        await proxyOutbound!.type.Should().BeEqualTo("shadowsocks");
-        proxyOutbound.server.Should().Be("1.2.3.4");
+        await proxyOutbound.server.Should().BeEqualTo("1.2.3.4");
-        proxyOutbound.server_port.Should().Be(8388);
+        await proxyOutbound.server_port.Should().BeEqualTo(8388);
-        proxyOutbound.method.Should().Be("aes-128-gcm");
+        await proxyOutbound.method.Should().BeEqualTo("aes-128-gcm");
-        proxyOutbound.password.Should().Be("custom_password");
+        await proxyOutbound.password.Should().BeEqualTo("custom_password");
     }
 }

v2rayN/ServiceLib.Tests/CoreConfig/V2ray/CoreConfigV2rayServiceTests.cs

@@ -1,16 +1,9 @@
-using AwesomeAssertions;
-using ServiceLib.Common;
-using ServiceLib.Enums;
-using ServiceLib.Models;
-using ServiceLib.Services.CoreConfig;
-using Xunit;
-
 namespace ServiceLib.Tests.CoreConfig.V2ray;
 
 public class CoreConfigV2rayServiceTests
 {
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
+    public async Task GenerateClientConfigContent_ShouldGenerateBasicProxyConfig()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -19,17 +12,17 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
-        result.Data.Should().NotBeNull();
+        await result.Data.Should().NotBeNull();
 
         var v2rayConfig = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString());
-        v2rayConfig.Should().NotBeNull();
+        await v2rayConfig.Should().NotBeNull();
-        v2rayConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.protocol == "vmess");
+        await v2rayConfig!.outbounds.Should().Contain(o => o.tag == Global.ProxyTag && o.protocol == "vmess");
-        v2rayConfig.inbounds.Should().Contain(i => i.protocol == nameof(EInboundProtocol.mixed));
+        await v2rayConfig.inbounds.Should().Contain(i => i.protocol == nameof(EInboundProtocol.mixed));
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_HttpOutbound_ShouldEmitHeadersInSettings()
+    public async Task GenerateClientConfigContent_HttpOutbound_ShouldEmitHeadersInSettings()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -42,27 +35,25 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var outbound = cfg.outbounds.First(o => o.tag == Global.ProxyTag && o.protocol == "http");
 
-        outbound.settings.address?.ToString().Should().Be("proxy.example.com");
+        await outbound.settings.address!.ToString().Should().BeEqualTo("proxy.example.com");
-        outbound.settings.port.Should().Be(8080);
+        await outbound.settings.port.Should().BeEqualTo(8080);
-        outbound.settings.user.Should().Be("user");
+        await outbound.settings.user.Should().BeEqualTo("user");
-        outbound.settings.pass.Should().Be("pass");
+        await outbound.settings.pass.Should().BeEqualTo("pass");
-        outbound.settings.level.Should().Be(1);
+        await outbound.settings.level.Should().BeEqualTo(1);
-        outbound.settings.headers.Should().NotBeNull();
+        await outbound.settings.headers.Should().NotBeNull();
-        var headers = JsonUtils.ParseJson(outbound.settings.headers.ToString());
+        var headers = JsonUtils.ParseJson(outbound.settings.headers!.ToString());
-        headers["User-Agent"]!.GetValue<string>().Should().Be("v2rayN");
+        await headers["User-Agent"]!.GetValue<string>().Should().BeEqualTo("v2rayN");
-        headers["Set-Cookie"]!.AsArray()
+        await headers["Set-Cookie"]!.AsArray()
             .Select(item => item!.GetValue<string>())
-            .Should().Equal("a=1", "b=2");
+            .Should().BeEquivalentTo(["a=1", "b=2"]);
-        outbound.settings.servers.Should().BeNull();
-        outbound.settings.vnext.Should().BeNull();
     }
  
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildBalancer()
+    public async Task GenerateClientConfigContent_PolicyGroup_ShouldExpandChildrenAndBuildBalancer()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -79,17 +70,17 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
-        cfg.routing.balancers.Should().NotBeNull();
+        await cfg.routing.balancers.Should().NotBeNull();
-        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+        await cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ProxyChain_ShouldBuildDialerProxyChain()
+    public async Task GenerateClientConfigContent_ProxyChain_ShouldBuildDialerProxyChain()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -105,21 +96,21 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
         var hasDialerChain = cfg.outbounds.Any(o =>
             o.tag == Global.ProxyTag
             && o.streamSettings is not null
             && o.streamSettings.sockopt is not null
             && (o.streamSettings.sockopt.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-",
                 StringComparison.Ordinal));
-        hasDialerChain.Should().BeTrue();
+        await hasDialerChain.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
+    public async Task GenerateClientConfigContent_PolicyGroupWithProxyChain_ShouldBuildCombinedOutbounds()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -140,18 +131,18 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("proxy-2-", StringComparison.Ordinal));
-        cfg.routing.balancers.Should().NotBeNull();
+        await cfg.routing.balancers.Should().NotBeNull();
-        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+        await cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
+    public async Task GenerateClientConfigContent_ProxyChainWithPolicyGroup_ShouldBuildClonedChainBranches()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -173,27 +164,27 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-1-", StringComparison.Ordinal));
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith("chain-proxy-1-group-2-", StringComparison.Ordinal));
 
         var proxyCloneCount = cfg.outbounds.Count(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal));
-        proxyCloneCount.Should().Be(2);
+        await proxyCloneCount.Should().BeEqualTo(2);
 
         var allCloneDialersPointToGroupBranches = cfg.outbounds
             .Where(o => o.tag.StartsWith("proxy-clone-", StringComparison.Ordinal))
             .All(o => (o.streamSettings?.sockopt?.dialerProxy ?? string.Empty).StartsWith("chain-proxy-1-group-",
                 StringComparison.Ordinal));
-        allCloneDialersPointToGroupBranches.Should().BeTrue();
+        await allCloneDialersPointToGroupBranches.Should().BeTrue();
 
-        cfg.routing.balancers.Should().NotBeNull();
+        await cfg.routing.balancers.Should().NotBeNull();
-        cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
+        await cfg.routing.balancers!.Should().Contain(b => b.tag == Global.ProxyTag + Global.BalancerTagSuffix);
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
+    public async Task GenerateClientConfigContent_RoutingSplit_DirectAndBlock_ShouldApplyRules()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -229,24 +220,24 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
 
         var hasDirectRule = cfg.routing.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("full:direct.example.com")
             && r.outboundTag == Global.DirectTag);
-        hasDirectRule.Should().BeTrue();
+        await hasDirectRule.Should().BeTrue();
 
         var hasBlockRule = cfg.routing.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("full:block.example.com")
             && r.outboundTag == Global.BlockTag);
-        hasBlockRule.Should().BeTrue();
+        await hasBlockRule.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
+    public async Task GenerateClientConfigContent_RoutingSplit_ByRemark_ShouldGenerateTargetOutbound()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -278,20 +269,20 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var expectedPrefix = $"{routeNode.IndexId}-{Global.ProxyTag}-{routeNode.Remarks}";
 
-        cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
+        await cfg.outbounds.Should().Contain(o => o.tag.StartsWith(expectedPrefix, StringComparison.Ordinal));
         var hasRouteRule = cfg.routing.rules.Any(r =>
             r.domain != null
             && r.domain.Contains("full:route.example.com")
             && (r.outboundTag ?? string.Empty).StartsWith(expectedPrefix, StringComparison.Ordinal));
-        hasRouteRule.Should().BeTrue();
+        await hasRouteRule.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyExpectedIPsToDirectDnsServer()
+    public async Task GenerateClientConfigContent_DirectExpectedIPs_ShouldApplyExpectedIPsToDirectDnsServer()
     {
         var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -320,7 +311,7 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
 
@@ -335,11 +326,11 @@ public class CoreConfigV2rayServiceTests
             && s.domains?.Contains("geosite:cn") == true
             && s.expectedIPs?.Contains("192.168.0.0/16") == true
             && s.expectedIPs?.Contains("geoip:cn") == true);
-        hasExpectedServer.Should().BeTrue();
+        await hasExpectedServer.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_BootstrapDNS_ShouldApplyToDnsServerDomains()
+    public async Task GenerateClientConfigContent_BootstrapDNS_ShouldApplyToDnsServerDomains()
     {
         var bootstrapDns = "8.8.8.8";
         var config = CoreConfigTestFactory.CreateConfigWithBootstrapDNS(ECoreType.Xray, bootstrapDns);
@@ -352,7 +343,7 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
 
@@ -366,11 +357,11 @@ public class CoreConfigV2rayServiceTests
             s.address == bootstrapDns
             && s.domains?.Contains("full:dns-direct.example") == true
             && s.domains?.Contains("full:dns-remote.example") == true);
-        hasBootstrapServer.Should().BeTrue();
+        await hasBootstrapServer.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectDnsServers()
+    public async Task GenerateClientConfigContent_DnsFallback_LastRuleDirect_ShouldUseDirectDnsServers()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         config.SimpleDNSItem.DirectDNS = "1.1.1.1";
@@ -403,7 +394,7 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
         var dnsServers = dns.servers
@@ -415,14 +406,14 @@ public class CoreConfigV2rayServiceTests
         var hasDirectFallback = dnsServers.Any(s =>
             (s.tag ?? string.Empty).StartsWith(Global.DirectDnsTag, StringComparison.Ordinal)
             && s.address == "1.1.1.1");
-        hasDirectFallback.Should().BeTrue();
+        await hasDirectFallback.Should().BeTrue();
 
         var hasRemoteFallback = dnsServers.Any(s => s.address == "9.9.9.9");
-        hasRemoteFallback.Should().BeFalse();
+        await hasRemoteFallback.Should().BeFalse();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedIPs()
+    public async Task GenerateClientConfigContent_DirectExpectedIPs_NonMatchingRegion_ShouldNotApplyExpectedIPs()
     {
         var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -451,7 +442,7 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
         var dnsServers = dns.servers
@@ -463,14 +454,14 @@ public class CoreConfigV2rayServiceTests
         var hasExpectedIPs = dnsServers.Any(s =>
             s.expectedIPs?.Contains("192.168.0.0/16") == true
             || s.expectedIPs?.Contains("geoip:cn") == true);
-        hasExpectedIPs.Should().BeFalse();
+        await hasExpectedIPs.Should().BeFalse();
     }
 
-    [Theory]
+    [Test]
-    [InlineData("geosite:cn")]
+    [Arguments("geosite:cn")]
-    [InlineData("geosite:geolocation-cn")]
+    [Arguments("geosite:geolocation-cn")]
-    [InlineData("geosite:tld-cn")]
+    [Arguments("geosite:tld-cn")]
-    public void GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedIPs(string domainTag)
+    public async Task GenerateClientConfigContent_DirectExpectedIPs_RegionVariant_ShouldApplyExpectedIPs(string domainTag)
     {
         var config = CoreConfigTestFactory.CreateConfigWithDirectExpectedIPs(ECoreType.Xray, "192.168.0.0/16,geoip:cn");
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -496,7 +487,7 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
         var dnsServers = dns.servers
@@ -510,11 +501,11 @@ public class CoreConfigV2rayServiceTests
             && s.domains?.Contains(domainTag) == true
             && s.expectedIPs?.Contains("192.168.0.0/16") == true
             && s.expectedIPs?.Contains("geoip:cn") == true);
-        hasExpectedServer.Should().BeTrue();
+        await hasExpectedServer.Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_Hosts_ShouldPopulateDnsHosts()
+    public async Task GenerateClientConfigContent_Hosts_ShouldPopulateDnsHosts()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         config.SimpleDNSItem.Hosts = "resolver.example 1.1.1.1";
@@ -525,17 +516,17 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
 
-        dns.hosts.Should().NotBeNull();
+        await dns.hosts.Should().NotBeNull();
-        dns.hosts!.Should().ContainKey("resolver.example");
+        await dns.hosts!.Should().ContainKey("resolver.example");
-        JsonUtils.Serialize(dns.hosts!["resolver.example"]).Should().Contain("1.1.1.1");
+        await JsonUtils.Serialize(dns.hosts!["resolver.example"]).Should().Contain("1.1.1.1");
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsConfig()
+    public async Task GenerateClientConfigContent_RawDnsEnabled_ShouldUseCustomDnsConfig()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -556,22 +547,114 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var dns = JsonUtils.Deserialize<Dns4Ray>(JsonUtils.Serialize(cfg.dns))!;
 
-        JsonUtils.Serialize(dns.servers).Should().Contain("8.8.8.8");
+        await JsonUtils.Serialize(dns.servers).Should().Contain("8.8.8.8");
-        dns.hosts.Should().NotBeNull();
+        await dns.hosts.Should().NotBeNull();
-        dns.hosts!.Should().ContainKey("raw.example");
+        await dns.hosts!.Should().ContainKey("raw.example");
-        JsonUtils.Serialize(dns.hosts!["raw.example"]).Should().Contain("1.1.1.1");
+        await JsonUtils.Serialize(dns.hosts!["raw.example"]).Should().Contain("1.1.1.1");
 
         var directOutbound = cfg.outbounds.FirstOrDefault(o => o.tag == Global.DirectTag && o.protocol == "freedom");
-        directOutbound.Should().NotBeNull();
+        await directOutbound.Should().NotBeNull();
-        directOutbound!.streamSettings.sockopt!.domainStrategy.Should().Be("UseIPv4");
+        await directOutbound!.streamSettings.sockopt!.domainStrategy.Should().BeEqualTo("UseIPv4");
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_TunRouteExcludeAddress()
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task GenerateClientConfigContent_Tun_ShouldRouteIPv6IntoTunnel(bool enableIPv6Address)
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithTun(ECoreType.Xray, enableIPv6Address);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
+
+        await tunInbound.Should().NotBeNull();
+        await tunInbound!.settings.autoSystemRoutingTable.Should().Contain("0.0.0.0/0");
+        await tunInbound.settings.autoSystemRoutingTable.Should().Contain("::/0");
+
+        // EnableIPv6Address governs the interface address only, never the routing table.
+        await tunInbound.settings.gateway.Should().HaveCount(enableIPv6Address ? 2 : 1);
+    }
+
+    [Test]
+    [Arguments(true)]
+    [Arguments(false)]
+    public async Task GenerateClientConfigContent_Tun_ShouldSkipIPv6RouteWithoutGlobalIPv6(bool enableIPv6Address)
+    {
+        // A host without a global IPv6 address has no IPv6 traffic that could bypass the tunnel,
+        // while ::/0 would pull IPv6 attempts into a tunnel they cannot leave.
+        var config = CoreConfigTestFactory.CreateConfigWithTun(ECoreType.Xray, enableIPv6Address);
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray, hasGlobalIPv6Address: false);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
+
+        await tunInbound.Should().NotBeNull();
+        await tunInbound!.settings.autoSystemRoutingTable.Should().Contain("0.0.0.0/0");
+        var ipv6Routes = tunInbound.settings.autoSystemRoutingTable!.Where(x => x.Contains(':')).ToList();
+        await ipv6Routes.Should().BeEmpty();
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_TunRouteExcludeAddress_ShouldSkipIPv6RangesWithoutGlobalIPv6()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithTunRouteExcludeAddress(ECoreType.Xray);
+        config.TunModeItem.EnableIPv6Address = false;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray, hasGlobalIPv6Address: false);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
+
+        await tunInbound.Should().NotBeNull();
+        await tunInbound!.settings.autoSystemRoutingTable.Should().NotBeEmpty();
+        var ipv6Routes = tunInbound.settings.autoSystemRoutingTable!.Where(x => x.Contains(':')).ToList();
+        await ipv6Routes.Should().BeEmpty();
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_TunRouteExcludeAddress_ShouldIncludeIPv6Ranges()
+    {
+        var config = CoreConfigTestFactory.CreateConfigWithTunRouteExcludeAddress(ECoreType.Xray);
+        config.TunModeItem.EnableIPv6Address = false;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "n-main", "main");
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.Xray);
+
+        var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
+
+        await result.Success.Should().BeTrue();
+        var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
+        var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
+
+        await tunInbound.Should().NotBeNull();
+        await tunInbound!.settings.autoSystemRoutingTable.Should().Contain(x => x.Contains(':'));
+    }
+
+    [Test]
+    public async Task GenerateClientConfigContent_TunRouteExcludeAddress()
     {
         var config = CoreConfigTestFactory.CreateConfigWithTunRouteExcludeAddress(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -581,20 +664,20 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue();
+        await result.Success.Should().BeTrue();
 
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString())!;
         var tunInbound = cfg.inbounds.FirstOrDefault(i => i.protocol == "tun");
 
-        tunInbound.Should().NotBeNull();
+        await tunInbound.Should().NotBeNull();
 
-        tunInbound!.settings.autoSystemRoutingTable.Should().NotContain("0.0.0.0/0");
+        await tunInbound!.settings.autoSystemRoutingTable.Should().NotContain("0.0.0.0/0");
-        tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.0/32");
+        await tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.0/32");
-        tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.2/31");
+        await tunInbound!.settings.autoSystemRoutingTable.Should().Contain("10.0.0.2/31");
     }
 
-    [Fact]
+    [Test]
-    public void GenerateClientConfigContent_CustomOutbound_ShouldReplaceWithUserCustomOutboundJson()
+    public async Task GenerateClientConfigContent_CustomOutbound_ShouldReplaceWithUserCustomOutboundJson()
     {
         var config = CoreConfigTestFactory.CreateConfig(ECoreType.Xray);
         CoreConfigTestFactory.BindAppManagerConfig(config);
@@ -621,14 +704,13 @@ public class CoreConfigV2rayServiceTests
 
         var result = new CoreConfigV2rayService(context).GenerateClientConfigContent();
 
-        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        await result.Success.Should().BeTrue().Because($"ret msg: {result.Msg}");
-        result.Data.Should().NotBeNull();
+        await result.Data.Should().NotBeNull();
 
         var cfg = JsonUtils.Deserialize<V2rayConfig>(result.Data!.ToString());
-        cfg.Should().NotBeNull();
+        await cfg.Should().NotBeNull();
         var proxyOutbound = cfg!.outbounds.FirstOrDefault(o => o.tag == Global.ProxyTag);
-        proxyOutbound.Should().NotBeNull();
+        await proxyOutbound.Should().NotBeNull();
-        proxyOutbound!.protocol.Should().Be("shadowsocks");
+        await proxyOutbound!.protocol.Should().BeEqualTo("shadowsocks");
-        proxyOutbound.settings.servers.Should().NotBeNull();
     }
 }

v2rayN/ServiceLib.Tests/Fmt/FmtHandlerTests.cs

@@ -1,103 +1,354 @@
-using AwesomeAssertions;
-using ServiceLib.Enums;
-using ServiceLib.Handler.Fmt;
-using ServiceLib.Models;
-using Xunit;
-
 namespace ServiceLib.Tests.Fmt;
 
 public class FmtHandlerTests
 {
-    [Fact]
+    /// <summary>
-    public void GetShareUriAndResolveConfig_Vmess_ShouldRoundTripBasicFields()
+    /// One profile factory per protocol that <see cref="FmtHandler.GetShareUri" /> can export.
+    /// The suite below asserts that this map and <see cref="Global.ProtocolShares" /> agree, so a
+    /// newly exportable protocol cannot be added without a round-trip case.
+    /// </summary>
+    private static readonly Dictionary<EConfigType, Func<ProfileItem>> ShareProfileFactories = new()
+    {
+        [EConfigType.VMess] = CreateVmessProfile,
+        [EConfigType.Shadowsocks] = CreateShadowsocksProfile,
+        [EConfigType.SOCKS] = CreateSocksProfile,
+        [EConfigType.VLESS] = CreateVlessProfile,
+        [EConfigType.Trojan] = CreateTrojanProfile,
+        [EConfigType.Hysteria2] = CreateHysteria2Profile,
+        [EConfigType.TUIC] = CreateTuicProfile,
+        [EConfigType.WireGuard] = CreateWireguardProfile,
+        [EConfigType.Anytls] = CreateAnytlsProfile,
+        [EConfigType.Naive] = () => CreateNaiveProfile(false),
+    };
+
+    [Test]
+    public async Task ShareUriSuite_ShouldCoverAndRoundTripEveryExportableProtocol()
+    {
+        var uncovered = string.Join(", ", Global.ProtocolShares.Keys.Except(ShareProfileFactories.Keys));
+        var unexpected = string.Join(", ", ShareProfileFactories.Keys.Except(Global.ProtocolShares.Keys));
+
+        await uncovered.Should().BeEqualTo(string.Empty);
+        await unexpected.Should().BeEqualTo(string.Empty);
+
+        foreach (var (configType, factory) in ShareProfileFactories)
+        {
+            var source = factory();
+
+            var resolved = await ExportThenImport(source);
+
+            await resolved.ConfigType.Should().BeEqualTo(configType);
+            await resolved.Address.Should().BeEqualTo(source.Address);
+            await resolved.Port.Should().BeEqualTo(source.Port);
+        }
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Vmess_ShouldRoundTripBasicFields()
     {
         var source = CreateVmessProfile();
 
-        var resolved = ExportThenImport(source);
+        var resolved = await ExportThenImport(source);
 
-        resolved.ConfigType.Should().Be(EConfigType.VMess);
+        await resolved.ConfigType.Should().BeEqualTo(EConfigType.VMess);
-        resolved.Remarks.Should().Be(source.Remarks);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
-        resolved.Address.Should().Be(source.Address);
+        await resolved.Address.Should().BeEqualTo(source.Address);
-        resolved.Port.Should().Be(source.Port);
+        await resolved.Port.Should().BeEqualTo(source.Port);
-        resolved.Password.Should().Be(source.Password);
+        await resolved.Password.Should().BeEqualTo(source.Password);
-        resolved.GetProtocolExtra().AlterId.Should().Be(source.GetProtocolExtra().AlterId);
+        await resolved.GetProtocolExtra().AlterId.Should().BeEqualTo(source.GetProtocolExtra().AlterId);
     }
 
-    [Fact]
+    [Test]
-    public void GetShareUriAndResolveConfig_Vless_ShouldRoundTripBasicFields()
+    public async Task GetShareUriAndResolveConfig_Vless_ShouldRoundTripBasicFields()
     {
         var source = CreateVlessProfile();
 
-        var resolved = ExportThenImport(source);
+        var resolved = await ExportThenImport(source);
 
-        resolved.ConfigType.Should().Be(EConfigType.VLESS);
+        await resolved.ConfigType.Should().BeEqualTo(EConfigType.VLESS);
-        resolved.Remarks.Should().Be(source.Remarks);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
-        resolved.Address.Should().Be(source.Address);
+        await resolved.Address.Should().BeEqualTo(source.Address);
-        resolved.Port.Should().Be(source.Port);
+        await resolved.Port.Should().BeEqualTo(source.Port);
-        resolved.Password.Should().Be(source.Password);
+        await resolved.Password.Should().BeEqualTo(source.Password);
-        resolved.GetProtocolExtra().VlessEncryption.Should().Be(Global.None);
+        await resolved.GetProtocolExtra().VlessEncryption.Should().BeEqualTo(Global.None);
     }
 
-    [Fact]
+    [Test]
-    public void GetShareUriAndResolveConfig_Shadowsocks_ShouldRoundTripBasicFields()
+    public async Task GetShareUriAndResolveConfig_Shadowsocks_ShouldRoundTripBasicFields()
     {
         var source = CreateShadowsocksProfile();
 
-        var resolved = ExportThenImport(source);
+        var resolved = await ExportThenImport(source);
 
-        resolved.ConfigType.Should().Be(EConfigType.Shadowsocks);
+        await resolved.ConfigType.Should().BeEqualTo(EConfigType.Shadowsocks);
-        resolved.Remarks.Should().Be(source.Remarks);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
-        resolved.Address.Should().Be(source.Address);
+        await resolved.Address.Should().BeEqualTo(source.Address);
-        resolved.Port.Should().Be(source.Port);
+        await resolved.Port.Should().BeEqualTo(source.Port);
-        resolved.Password.Should().Be(source.Password);
+        await resolved.Password.Should().BeEqualTo(source.Password);
-        resolved.GetProtocolExtra().SsMethod.Should().Be(source.GetProtocolExtra().SsMethod);
+        await resolved.GetProtocolExtra().SsMethod.Should().BeEqualTo(source.GetProtocolExtra().SsMethod);
     }
 
-    [Fact]
+    [Test]
-    public void GetShareUriAndResolveConfig_Socks_ShouldRoundTripBasicFields()
+    public async Task GetShareUriAndResolveConfig_Socks_ShouldRoundTripBasicFields()
     {
         var source = CreateSocksProfile();
 
-        var resolved = ExportThenImport(source);
+        var resolved = await ExportThenImport(source);
 
-        resolved.ConfigType.Should().Be(EConfigType.SOCKS);
+        await resolved.ConfigType.Should().BeEqualTo(EConfigType.SOCKS);
-        resolved.Remarks.Should().Be(source.Remarks);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
-        resolved.Address.Should().Be(source.Address);
+        await resolved.Address.Should().BeEqualTo(source.Address);
-        resolved.Port.Should().Be(source.Port);
+        await resolved.Port.Should().BeEqualTo(source.Port);
-        resolved.Username.Should().Be(source.Username);
+        await resolved.Username.Should().BeEqualTo(source.Username);
-        resolved.Password.Should().Be(source.Password);
+        await resolved.Password.Should().BeEqualTo(source.Password);
     }
 
-    [Fact]
+    [Test]
-    public void ResolveConfig_UnsupportedProtocol_ShouldReturnNull()
+    public async Task GetShareUriAndResolveConfig_Trojan_ShouldRoundTripBasicFields()
+    {
+        var source = CreateTrojanProfile();
+
+        var resolved = await ExportThenImport(source);
+
+        await AssertCommonShareFields(source, resolved);
+        await AssertRawTransportFields(source, resolved);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.Sni.Should().BeEqualTo(source.Sni);
+        await resolved.GetProtocolExtra().Flow.Should().BeEqualTo(source.GetProtocolExtra().Flow);
+        await resolved.GetAllowInsecure().Should().BeTrue();
+
+        // Trojan is the one exporter that writes both spellings of the flag.
+        await AssertExportContains(source, "allowInsecure=1", "insecure=1");
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Tuic_ShouldRoundTripUserInfoAndCongestionControl()
+    {
+        var source = CreateTuicProfile();
+
+        var resolved = await ExportThenImport(source);
+
+        await AssertCommonShareFields(source, resolved);
+        await resolved.Username.Should().BeEqualTo(source.Username);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.Sni.Should().BeEqualTo(source.Sni);
+        await resolved.Alpn.Should().BeEqualTo(source.Alpn);
+        await resolved.GetProtocolExtra().CongestionControl.Should()
+            .BeEqualTo(source.GetProtocolExtra().CongestionControl);
+        await resolved.GetAllowInsecure().Should().BeTrue();
+
+        await AssertExportContains(source, "allow_insecure=1");
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Anytls_ShouldRoundTripBasicFields()
+    {
+        var source = CreateAnytlsProfile();
+
+        var resolved = await ExportThenImport(source);
+
+        await AssertCommonShareFields(source, resolved);
+        await AssertRawTransportFields(source, resolved);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.Sni.Should().BeEqualTo(source.Sni);
+        await resolved.Alpn.Should().BeEqualTo(source.Alpn);
+        await resolved.GetAllowInsecure().Should().BeTrue();
+
+        await AssertExportContains(source, "insecure=1");
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Hysteria2_ShouldRoundTripObfsAndNormalizePortRange()
+    {
+        var source = CreateHysteria2Profile();
+
+        var resolved = await ExportThenImport(source);
+        var sourceExtra = source.GetProtocolExtra();
+        var resolvedExtra = resolved.GetProtocolExtra();
+
+        await AssertCommonShareFields(source, resolved);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.Sni.Should().BeEqualTo(source.Sni);
+        await resolved.Alpn.Should().BeEqualTo(source.Alpn);
+        await resolved.EchConfigList.Should().BeEqualTo(source.EchConfigList);
+        await resolved.GetAllowInsecure().Should().BeTrue();
+        await resolvedExtra.SalamanderPass.Should().BeEqualTo(sourceExtra.SalamanderPass);
+
+        // Hysteria2Fmt stores a port range internally as "5000:6000" and emits the URI form.
+        await resolvedExtra.Ports.Should().BeEqualTo("5000-6000");
+
+        await AssertExportContains(source, "insecure=1", "obfs=salamander", "mport=5000-6000");
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Wireguard_ShouldRoundTripKeysAndInterface()
+    {
+        var source = CreateWireguardProfile();
+
+        var resolved = await ExportThenImport(source);
+        var extra = resolved.GetProtocolExtra();
+        var sourceExtra = source.GetProtocolExtra();
+
+        await AssertCommonShareFields(source, resolved);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await extra.WgPublicKey.Should().BeEqualTo(sourceExtra.WgPublicKey);
+        await extra.WgPresharedKey.Should().BeEqualTo(sourceExtra.WgPresharedKey);
+        await extra.WgReserved.Should().BeEqualTo(sourceExtra.WgReserved);
+        await extra.WgInterfaceAddress.Should().BeEqualTo(sourceExtra.WgInterfaceAddress);
+        await extra.WgMtu.Should().BeEqualTo(sourceExtra.WgMtu);
+    }
+
+    [Test]
+    public async Task GetShareUri_Wireguard_ShouldEncodeKeysAndBracketIpv6()
+    {
+        var source = CreateWireguardProfile();
+
+        // Base64 keys carry '/', '+' and '=', and the address is an IPv6 literal: both have to
+        // survive the wire form, which a round trip through the same encoder would not prove.
+        await AssertExportContains(
+            source,
+            Uri.EscapeDataString(source.Password),
+            Uri.EscapeDataString(source.GetProtocolExtra().WgPublicKey ?? string.Empty),
+            "@[2001:db8::40]:51820");
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_Naive_ShouldRoundTripCredentialsOverHttps()
+    {
+        var source = CreateNaiveProfile(false);
+
+        var resolved = await ExportThenImport(source, Global.NaiveHttpsProtocolShare);
+
+        await AssertCommonShareFields(source, resolved);
+        await AssertRawTransportFields(source, resolved);
+        await resolved.Username.Should().BeEqualTo(source.Username);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.GetProtocolExtra().InsecureConcurrency.Should()
+            .BeEqualTo(source.GetProtocolExtra().InsecureConcurrency);
+
+        // NaiveFmt only ever sets this flag on the quic branch, so the https branch leaves it
+        // unset rather than false - assert "is not quic" instead of an explicit false.
+        await (resolved.GetProtocolExtra().NaiveQuic == true).Should().BeFalse();
+    }
+
+    [Test]
+    public async Task GetShareUriAndResolveConfig_NaiveQuic_ShouldRoundTripQuicScheme()
+    {
+        var source = CreateNaiveProfile(true);
+
+        var resolved = await ExportThenImport(source, Global.NaiveQuicProtocolShare);
+
+        await AssertCommonShareFields(source, resolved);
+        await AssertRawTransportFields(source, resolved);
+        await resolved.Username.Should().BeEqualTo(source.Username);
+        await resolved.Password.Should().BeEqualTo(source.Password);
+        await resolved.GetProtocolExtra().InsecureConcurrency.Should()
+            .BeEqualTo(source.GetProtocolExtra().InsecureConcurrency);
+        await resolved.GetProtocolExtra().NaiveQuic.Should().BeTrue();
+    }
+
+    [Test]
+    [Arguments("p:a@ss#% +/=")]
+    [Arguments("пароль 東京")]
+    public async Task GetShareUriAndResolveConfig_Trojan_ShouldRoundTripEncodedCredentials(string password)
+    {
+        var source = CreateTrojanProfile();
+        source.Password = password;
+        source.Remarks = "Trojan — тест 東京 #1";
+
+        var resolved = await ExportThenImport(source);
+
+        await resolved.Password.Should().BeEqualTo(password);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
+    }
+
+    [Test]
+    public async Task ResolveConfig_UnsupportedProtocol_ShouldReturnNull()
     {
         var resolved = FmtHandler.ResolveConfig("not-a-share-uri", out var msg);
 
-        resolved.Should().BeNull();
+        await resolved.Should().BeNull();
-        msg.Should().NotBeNullOrWhiteSpace();
+        await msg.Should().NotBeNull();
+        await msg.Should().NotBeEmpty();
     }
 
-    [Fact]
+    [Test]
-    public void GetShareUri_UnsupportedConfigType_ShouldReturnNull()
+    public async Task GetShareUri_UnsupportedConfigType_ShouldReturnNull()
     {
         var item = new ProfileItem { ConfigType = EConfigType.PolicyGroup, Remarks = "group", };
 
         var uri = FmtHandler.GetShareUri(item);
 
-        uri.Should().BeNull();
+        await uri.Should().BeNull();
     }
 
-    private static ProfileItem ExportThenImport(ProfileItem source)
+    private static async Task AssertCommonShareFields(ProfileItem source, ProfileItem resolved)
+    {
+        await resolved.ConfigType.Should().BeEqualTo(source.ConfigType);
+        await resolved.Remarks.Should().BeEqualTo(source.Remarks);
+        await resolved.Address.Should().BeEqualTo(source.Address);
+        await resolved.Port.Should().BeEqualTo(source.Port);
+    }
+
+    /// <summary>
+    /// Only for protocols whose exporter goes through the shared transport query
+    /// (<c>security</c>, <c>type</c>, <c>headerType</c>). TUIC, Hysteria2 and WireGuard do not.
+    /// </summary>
+    private static async Task AssertRawTransportFields(ProfileItem source, ProfileItem resolved)
+    {
+        await resolved.Network.Should().BeEqualTo(source.Network);
+        await resolved.StreamSecurity.Should().BeEqualTo(source.StreamSecurity);
+        await resolved.GetTransportExtra().RawHeaderType.Should()
+            .BeEqualTo(source.GetTransportExtra().RawHeaderType);
+    }
+
+    /// <summary>
+    /// Asserts on the wire form itself. A round trip cannot catch an exporter and an importer that
+    /// agree on the wrong spelling of a parameter, and the insecure flag is spelled differently by
+    /// every protocol.
+    /// </summary>
+    private static async Task AssertExportContains(ProfileItem source, params string[] expectedFragments)
     {
         var uri = FmtHandler.GetShareUri(source);
 
-        uri.Should().NotBeNullOrWhiteSpace();
+        await uri.Should().NotBeNull();
-        uri!.StartsWith(Global.ProtocolShares[source.ConfigType], StringComparison.OrdinalIgnoreCase).Should()
+
-            .BeTrue();
+        foreach (var fragment in expectedFragments)
+        {
+            await uri!.Contains(fragment, StringComparison.Ordinal).Should()
+                .BeTrue().Because($"uri: {uri}, expected fragment: {fragment}");
+        }
+    }
+
+    private static string ExpectedShareScheme(ProfileItem item)
+    {
+        if (item.ConfigType != EConfigType.Naive)
+        {
+            return Global.ProtocolShares[item.ConfigType];
+        }
+
+        // NaiveFmt never emits the "naive://" prefix that Global.ProtocolShares records for the
+        // type; that entry is only read when importing.
+        return item.GetProtocolExtra().NaiveQuic == true
+            ? Global.NaiveQuicProtocolShare
+            : Global.NaiveHttpsProtocolShare;
+    }
+
+    private static async Task<ProfileItem> ExportThenImport(ProfileItem source)
+    {
+        return await ExportThenImport(source, ExpectedShareScheme(source));
+    }
+
+    private static async Task<ProfileItem> ExportThenImport(ProfileItem source, string expectedPrefix)
+    {
+        var uri = FmtHandler.GetShareUri(source);
+
+        await uri.Should().NotBeNull();
+        await uri.Should().NotBeEmpty();
+        await uri!.StartsWith(expectedPrefix, StringComparison.OrdinalIgnoreCase).Should().BeTrue();
 
         var resolved = FmtHandler.ResolveConfig(uri, out var msg);
 
-        resolved.Should().NotBeNull($"uri: {uri}, msg: {msg}");
+        await resolved.Should().NotBeNull().Because($"uri: {uri}, msg: {msg}");
         return resolved!;
     }
 
@@ -170,4 +421,142 @@ public class FmtHandlerTests
             Password = "pass",
         };
     }
+
+    private static ProfileItem CreateTrojanProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Trojan,
+            Remarks = "trojan demo",
+            Address = "trojan.example",
+            Port = 443,
+            Password = "trojan-pass",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = Global.StreamSecurity,
+            Sni = "sni.trojan.example",
+            AllowInsecure = Global.StringTrue,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { Flow = Global.Flows[1], });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateTuicProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.TUIC,
+            Remarks = "tuic demo",
+            Address = "tuic.example",
+            Port = 8443,
+            // A colon separates the two halves of the TUIC user info, so it cannot appear in the
+            // uuid; a fixed value also keeps a failure reproducible.
+            Username = "01234567-89ab-cdef-0123-456789abcdef",
+            Password = "tuic-pass",
+            Sni = "sni.tuic.example",
+            Alpn = "h3",
+            AllowInsecure = Global.StringTrue,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { CongestionControl = "bbr", });
+
+        return item;
+    }
+
+    private static ProfileItem CreateAnytlsProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Anytls,
+            Remarks = "anytls demo",
+            Address = "anytls.example",
+            Port = 8443,
+            Password = "anytls-pass",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = Global.StreamSecurity,
+            Sni = "sni.anytls.example",
+            Alpn = "h2,http/1.1",
+            AllowInsecure = Global.StringTrue,
+        };
+
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
+
+    private static ProfileItem CreateHysteria2Profile()
+    {
+        // CertSha is deliberately left unset: the importer turns AllowInsecure on by itself when a
+        // pinSHA256 is present, which would mask an exporter that stopped emitting insecure=1.
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Hysteria2,
+            Remarks = "hysteria2 demo",
+            Address = "hy2.example",
+            Port = 8443,
+            Password = "demo-user:demo-pass",
+            Sni = "sni.hy2.example",
+            Alpn = "h3",
+            EchConfigList = "AAj+DQAEAAAAAA==",
+            AllowInsecure = Global.StringTrue,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            SalamanderPass = "salamander-pass",
+            Ports = "5000:6000",
+        });
+
+        return item;
+    }
+
+    private static string CreateWireguardKey(byte value)
+    {
+        return Convert.ToBase64String(Enumerable.Repeat(value, 32).ToArray());
+    }
+
+    private static ProfileItem CreateWireguardProfile()
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.WireGuard,
+            Remarks = "WireGuard — тест 東京 #1",
+            Address = "2001:db8::40",
+            Port = 51820,
+            Password = CreateWireguardKey(0xFE),
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem
+        {
+            WgPublicKey = CreateWireguardKey(0xFD),
+            WgPresharedKey = CreateWireguardKey(0xFC),
+            WgReserved = "1,2,255",
+            WgInterfaceAddress = "10.0.0.2/32,fd00::2/128",
+            WgMtu = 1420,
+        });
+
+        return item;
+    }
+
+    private static ProfileItem CreateNaiveProfile(bool quic)
+    {
+        var item = new ProfileItem
+        {
+            ConfigType = EConfigType.Naive,
+            Remarks = quic ? "naive quic demo" : "naive https demo",
+            Address = "naive.example",
+            Port = 443,
+            Username = "naive-user",
+            Password = "päss:word@/?#&=+ 東京",
+            Network = nameof(ETransport.raw),
+            StreamSecurity = Global.None,
+        };
+
+        item.SetProtocolExtra(new ProtocolExtraItem { NaiveQuic = quic, InsecureConcurrency = 4, });
+        item.SetTransportExtra(new TransportExtraItem { RawHeaderType = Global.None, });
+
+        return item;
+    }
 }

v2rayN/ServiceLib.Tests/Fmt/HyRealmTests.cs

@@ -1,32 +1,27 @@
-using AwesomeAssertions;
-using ServiceLib.Handler.Fmt;
-using ServiceLib.Models.Dto;
-using Xunit;
-
 namespace ServiceLib.Tests.Fmt;
 
 public class HyRealmTests
 {
-    [Fact]
+    [Test]
-    public void TryParse_ShouldParseValidRealm()
+    public async Task TryParse_ShouldParseValidRealm()
     {
         var str = "realm://public@realm.hy2.io/57f9be7c-2810-4f5b-8cb9-260bc84d6c90?stun=example.stun:3478&stun=example2.stun:3478";
         var result = HyRealm.TryParse(str, out var realm);
-        result.Should().BeTrue();
+        await result.Should().BeTrue();
-        realm.Should().NotBeNull();
+        await realm.Should().NotBeNull();
 
-        realm.IsHttp.Should().BeFalse();
+        await realm.IsHttp.Should().BeFalse();
-        realm.Token.Should().Be("public");
+        await realm.Token.Should().BeEqualTo("public");
-        realm.RendezvousHost.Should().Be("realm.hy2.io");
+        await realm.RendezvousHost.Should().BeEqualTo("realm.hy2.io");
-        realm.RendezvousPort.Should().Be(443);
+        await realm.RendezvousPort.Should().BeEqualTo(443);
-        realm.RealmName.Should().Be("57f9be7c-2810-4f5b-8cb9-260bc84d6c90");
+        await realm.RealmName.Should().BeEqualTo("57f9be7c-2810-4f5b-8cb9-260bc84d6c90");
-        realm.StunList.Should().HaveCount(2);
+        await realm.StunList.Should().HaveCount(2);
-        realm.StunList.Should().Contain("example.stun:3478");
+        await realm.StunList.Should().Contain("example.stun:3478");
-        realm.StunList.Should().Contain("example2.stun:3478");
+        await realm.StunList.Should().Contain("example2.stun:3478");
     }
 
-    [Fact]
+    [Test]
-    public void ToUri_ShouldGenerateValidUri()
+    public async Task ToUri_ShouldGenerateValidUri()
     {
         var realm = new HyRealm(
             IsHttp: false,
@@ -37,32 +32,32 @@ public class HyRealmTests
             StunList: ["example.stun:3478", "example2.stun:3478"]
         );
         var uri = realm.ToUri();
-        uri.Should().Contain("realm://public@realm.hy2.io");
+        await uri.Should().Contain("realm://public@realm.hy2.io");
-        uri.Should().Contain("/57f9be7c-2810-4f5b-8cb9-260bc84d6c90");
+        await uri.Should().Contain("/57f9be7c-2810-4f5b-8cb9-260bc84d6c90");
-        uri.Should().Contain("stun=example.stun:3478");
+        await uri.Should().Contain("stun=example.stun:3478");
-        uri.Should().Contain("stun=example2.stun:3478");
+        await uri.Should().Contain("stun=example2.stun:3478");
     }
 
-    [Fact]
+    [Test]
-    public void GetShareUriAndResolveConfig_Hy2Realm_ShouldRoundTripBasicFields()
+    public async Task GetShareUriAndResolveConfig_Hy2Realm_ShouldRoundTripBasicFields()
     {
         var str = "hysteria2+realm://mytoken@rendezvous.example.com/my-cabin-1f3a8c2e9b?auth=your_password&insecure=1&pinSHA256=deadbeef#remark";
         var resolved = Hysteria2Fmt.ResolveRealm(str, out var msg);
-        resolved.Should().NotBeNull();
+        await resolved.Should().NotBeNull();
-        resolved.Password.Should().Be("your_password");
+        await resolved.Password.Should().BeEqualTo("your_password");
         var result = HyRealm.TryParse(resolved.GetProtocolExtra().Hy2RealmUrl, out var realm);
-        result.Should().BeTrue();
+        await result.Should().BeTrue();
-        realm.Should().NotBeNull();
+        await realm.Should().NotBeNull();
-        realm.Token.Should().Be("mytoken");
+        await realm.Token.Should().BeEqualTo("mytoken");
 
         // To uri
         var uri = Hysteria2Fmt.ToUri(resolved);
-        uri.Should().Contain("hysteria2+realm://mytoken@rendezvous.example.com");
+        await uri.Should().Contain("hysteria2+realm://mytoken@rendezvous.example.com");
-        uri.Should().EndWith("#remark");
+        await uri.Should().EndWith("#remark");
     }
 
-    [Fact]
+    [Test]
-    public void ToServerUrl_ShouldIncludeSchemeForSingbox()
+    public async Task ToServerUrl_ShouldIncludeSchemeForSingbox()
     {
         var realm = new HyRealm(
             IsHttp: false,
@@ -73,19 +68,19 @@ public class HyRealmTests
             StunList: ["turn.cloudflare.com:3478"]
         );
 
-        realm.ToServerUrl().Should().Be("https://realm.hy2.io:443");
+        await realm.ToServerUrl().Should().BeEqualTo("https://realm.hy2.io:443");
     }
 
-    [Fact]
+    [Test]
-    public void ResolveRealm_Issue9635_ShouldProduceHttpsServerUrl()
+    public async Task ResolveRealm_Issue9635_ShouldProduceHttpsServerUrl()
     {
         var str = "hysteria2+realm://public@realm.hy2.io/my-realm-id?auth=uuid&stun=turn.cloudflare.com%3A3478&sni=cloudflare.com&pinSHA256=xxx#Realm-Test";
         var resolved = Hysteria2Fmt.ResolveRealm(str, out _);
-        resolved.Should().NotBeNull();
+        await resolved.Should().NotBeNull();
 
-        HyRealm.TryParse(resolved!.GetProtocolExtra().Hy2RealmUrl, out var realm).Should().BeTrue();
+        await HyRealm.TryParse(resolved!.GetProtocolExtra().Hy2RealmUrl, out var realm).Should().BeTrue();
-        realm!.ToServerUrl().Should().StartWith("https://");
+        await realm!.ToServerUrl().Should().StartWith("https://");
-        realm.ToServerUrl().Should().Contain("realm.hy2.io");
+        await realm.ToServerUrl().Should().Contain("realm.hy2.io");
-        realm.StunList.Should().Contain("turn.cloudflare.com:3478");
+        await realm.StunList.Should().Contain("turn.cloudflare.com:3478");
     }
 }

v2rayN/ServiceLib.Tests/Fmt/Hysteria2FmtTests.cs

@@ -0,0 +1,54 @@
+namespace ServiceLib.Tests.Fmt;
+
+public class Hysteria2FmtTests
+{
+    // "The hostname and optional port of the server. If the port is omitted, it defaults to 443."
+    // -- https://v2.hysteria.network/docs/developers/URI-Scheme/
+    // A ':' with no digits after it is an omitted port too, per RFC 3986 'port = *DIGIT'.
+    [Test]
+    [Arguments("hysteria2://password@hy2.example/")]
+    [Arguments("hysteria2://password@hy2.example")]
+    [Arguments("hysteria2://password@hy2.example:/")]
+    [Arguments("hy2://password@hy2.example/?sni=real.example")]
+    public async Task ResolveConfig_WithoutPort_ShouldDefaultTo443(string shareUri)
+    {
+        var resolved = FmtHandler.ResolveConfig(shareUri, out var msg);
+
+        await resolved.Should().NotBeNull().Because($"uri: {shareUri}, msg: {msg}");
+        await resolved!.ConfigType.Should().BeEqualTo(EConfigType.Hysteria2);
+        await resolved.Address.Should().BeEqualTo("hy2.example");
+        await resolved.Port.Should().BeEqualTo(443);
+    }
+
+    [Test]
+    public async Task ResolveConfig_WithoutPort_ShouldProduceAValidProfile()
+    {
+        // Uri.Port is -1 for an unregistered scheme with no port, and ProfileItem.IsValid rejects
+        // any port outside 1..65535 - so the default is what keeps such a link usable at all.
+        var resolved = FmtHandler.ResolveConfig("hysteria2://password@hy2.example/", out _);
+
+        await resolved.Should().NotBeNull();
+        await resolved!.IsValid().Should().BeTrue();
+    }
+
+    [Test]
+    public async Task ResolveConfig_WithExplicitPort_ShouldKeepIt()
+    {
+        var resolved = FmtHandler.ResolveConfig("hysteria2://password@hy2.example:8443/", out _);
+
+        await resolved.Should().NotBeNull();
+        await resolved!.Port.Should().BeEqualTo(8443);
+    }
+
+    [Test]
+    public async Task ResolveConfig_WithExplicitZeroPort_ShouldNotApplyTheDefault()
+    {
+        // Uri.Port is 0 here, not -1: the port is present, it is just not a usable one. Treating
+        // it as "omitted" would silently move the endpoint to :443, so it stays invalid instead.
+        var resolved = FmtHandler.ResolveConfig("hysteria2://password@hy2.example:0/", out _);
+
+        await resolved.Should().NotBeNull();
+        await resolved!.Port.Should().BeEqualTo(0);
+        await resolved.IsValid().Should().BeFalse();
+    }
+}

v2rayN/ServiceLib.Tests/Fmt/InnerFmtTests.cs

@@ -1,15 +1,11 @@
-using AwesomeAssertions;
-using ServiceLib.Enums;
-using ServiceLib.Handler.Fmt;
 using ServiceLib.Tests.CoreConfig;
-using Xunit;
 
 namespace ServiceLib.Tests.Fmt;
 
 public class InnerFmtTests
 {
-    [Fact]
+    [Test]
-    public void ToUriAndResolve_ShouldRoundTripPolicyGroupReferences()
+    public async Task ToUriAndResolve_ShouldRoundTripPolicyGroupReferences()
     {
         var childA = CoreConfigTestFactory.CreateSocksNode(ECoreType.Xray, "child-a", "child-a");
         var childB = CoreConfigTestFactory.CreateVmessNode(ECoreType.Xray, "child-b", "child-b");
@@ -19,19 +15,20 @@ public class InnerFmtTests
 
         var uri = InnerFmt.ToUri([group, childA, childB]);
 
-        uri.Should().NotBeNullOrWhiteSpace();
+        await uri.Should().NotBeNull();
+        await uri.Should().NotBeEmpty();
 
         var resolved = InnerFmt.Resolve(uri!, "sub-123");
 
-        resolved.Should().NotBeNull();
+        await resolved.Should().NotBeNull();
-        resolved.Should().HaveCount(3);
+        await resolved.Should().HaveCount(3);
 
         var resolvedGroup = resolved!.Single(x => x.Remarks == group.Remarks);
         var resolvedChildA = resolved.Single(x => x.Remarks == childA.Remarks);
         var resolvedChildB = resolved.Single(x => x.Remarks == childB.Remarks);
 
-        resolvedGroup.ConfigType.Should().Be(EConfigType.PolicyGroup);
+        await resolvedGroup.ConfigType.Should().BeEqualTo(EConfigType.PolicyGroup);
-        resolvedGroup.GetProtocolExtra().SubChildItems.Should().Be("sub-123");
+        await resolvedGroup.GetProtocolExtra().SubChildItems.Should().BeEqualTo("sub-123");
-        resolvedGroup.GetProtocolExtra().ChildItems.Should().Be($"{resolvedChildA.IndexId},{resolvedChildB.IndexId}");
+        await resolvedGroup.GetProtocolExtra().ChildItems.Should().BeEqualTo($"{resolvedChildA.IndexId},{resolvedChildB.IndexId}");
     }
 }

v2rayN/ServiceLib.Tests/Fmt/ShareUriQueryTests.cs

@@ -0,0 +1,73 @@
+namespace ServiceLib.Tests.Fmt;
+
+public class ShareUriQueryTests
+{
+    [Test]
+    [Arguments("ob%41fs")]
+    [Arguments("66%ff")]
+    [Arguments("100%")]
+    public async Task GetShareUriAndResolveConfig_QueryValueWithPercent_ShouldSurviveTheRoundTrip(string obfsPassword)
+    {
+        var source = new ProfileItem
+        {
+            ConfigType = EConfigType.Hysteria2,
+            Remarks = "percent demo",
+            Address = "hy2.example",
+            Port = 8443,
+            Password = "pw",
+        };
+        source.SetProtocolExtra(new ProtocolExtraItem { SalamanderPass = obfsPassword, });
+
+        var uri = FmtHandler.GetShareUri(source);
+
+        await uri.Should().NotBeNull();
+
+        var resolved = FmtHandler.ResolveConfig(uri!, out var msg);
+
+        await resolved.Should().NotBeNull().Because($"uri: {uri}, msg: {msg}");
+        await resolved!.GetProtocolExtra().SalamanderPass.Should().BeEqualTo(obfsPassword);
+    }
+
+    // RFC 3986 lists '=' among the sub-delimiters a query value may carry, so only the first one
+    // separates the key from the value. Splitting on every '=' discarded the pair outright.
+    [Test]
+    public async Task ResolveConfig_QueryValueWithUnescapedEquals_ShouldNotBeDropped()
+    {
+        const string shareUri = "hysteria2://pw@hy2.example:8443/?ech=AAj+DQAEAAAAAA==&sni=real.example";
+
+        var resolved = FmtHandler.ResolveConfig(shareUri, out var msg);
+
+        await resolved.Should().NotBeNull().Because($"uri: {shareUri}, msg: {msg}");
+        await resolved!.EchConfigList.Should().BeEqualTo("AAj+DQAEAAAAAA==");
+        await resolved.Sni.Should().BeEqualTo("real.example");
+    }
+
+    // Canonical SIP002 percent-encodes the plugin argument, and that is what this client's own
+    // exporter emits. This covers the non-canonical spelling instead: the options are a ';'
+    // separated list of 'key=value' pairs, so left unescaped the value always carries '='.
+    [Test]
+    public async Task ResolveConfig_NonCanonicalSip002PluginWithLiteralEquals_ShouldConfigureObfs()
+    {
+        const string shareUri =
+            "ss://YWVzLTEyOC1nY206cGFzczEyMw==@1.2.3.4:8388/?plugin=obfs-local;obfs=http;obfs-host=example.com#ss";
+
+        var resolved = FmtHandler.ResolveConfig(shareUri, out var msg);
+
+        await resolved.Should().NotBeNull().Because($"uri: {shareUri}, msg: {msg}");
+        await resolved!.ConfigType.Should().BeEqualTo(EConfigType.Shadowsocks);
+        await resolved.GetTransportExtra().Host.Should().BeEqualTo("example.com");
+        await resolved.GetTransportExtra().RawHeaderType.Should().BeEqualTo(Global.RawHeaderHttp);
+    }
+
+    [Test]
+    public async Task ResolveConfig_EscapedQueryValue_ShouldStillDecodeExactlyOnce()
+    {
+        const string shareUri = "hysteria2://pw@hy2.example:8443/?ech=AAj%2BDQAEAAAAAA%3D%3D&obfs=salamander&obfs-password=a%20b";
+
+        var resolved = FmtHandler.ResolveConfig(shareUri, out var msg);
+
+        await resolved.Should().NotBeNull().Because($"uri: {shareUri}, msg: {msg}");
+        await resolved!.EchConfigList.Should().BeEqualTo("AAj+DQAEAAAAAA==");
+        await resolved.GetProtocolExtra().SalamanderPass.Should().BeEqualTo("a b");
+    }
+}

v2rayN/ServiceLib.Tests/Fmt/WireguardFmtTests.cs

@@ -1,13 +1,9 @@
-using AwesomeAssertions;
-using ServiceLib.Handler.Fmt;
-using Xunit;
-
 namespace ServiceLib.Tests.Fmt;
 
 public class WireguardFmtTests
 {
-    [Fact]
+    [Test]
-    public void ResolveConfig_ShouldParsePeersAndIgnoreInlineComments()
+    public async Task ResolveConfig_ShouldParsePeersAndIgnoreInlineComments()
     {
         const string config =
             """
@@ -15,6 +11,7 @@ public class WireguardFmtTests
             PrivateKey = interface-private-key
             Address = 10.0.0.2/32, fd00::2/128 ; inline comment
             MTU = 1420
+            DNS = 2001::db8::53, 1.2.3.4, 2001:db8::54
 
             [Peer]
             PublicKey = peer-public-key
@@ -29,19 +26,20 @@ public class WireguardFmtTests
 
         var resolved = WireguardFmt.ResolveConfig(config);
 
-        resolved.Should().NotBeNull();
+        await resolved.Should().NotBeNull();
-        resolved.Should().HaveCount(2);
+        await resolved.Should().HaveCount(2);
 
         var first = resolved![0];
-        first.Address.Should().Be("2001:db8::1");
+        await first.Address.Should().BeEqualTo("2001:db8::1");
-        first.Port.Should().Be(51820);
+        await first.Port.Should().BeEqualTo(51820);
-        first.Password.Should().Be("interface-private-key");
+        await first.Password.Should().BeEqualTo("interface-private-key");
-        first.GetProtocolExtra().WgReserved.Should().Be("1, 2, 3");
+        await first.GetProtocolExtra().WgReserved.Should().BeEqualTo("1, 2, 3");
-        first.GetProtocolExtra().WgInterfaceAddress.Should().Be("10.0.0.2/32, fd00::2/128");
+        await first.GetProtocolExtra().WgInterfaceAddress.Should().BeEqualTo("10.0.0.2/32, fd00::2/128");
-        first.GetProtocolExtra().WgMtu.Should().Be(1420);
+        await first.GetProtocolExtra().WgMtu.Should().BeEqualTo(1420);
+        await first.GetProtocolExtra().WgDns.Should().BeEqualTo("2001::db8::53, 1.2.3.4, 2001:db8::54");
 
         var second = resolved[1];
-        second.Address.Should().Be("example.com");
+        await second.Address.Should().BeEqualTo("example.com");
-        second.Port.Should().Be(12345);
+        await second.Port.Should().BeEqualTo(12345);
     }
 }

v2rayN/ServiceLib.Tests/Helper/HttpRequestHeadersHelperTests.cs

@@ -0,0 +1,77 @@
+namespace ServiceLib.Tests.Helper;
+
+public class HttpRequestHeadersHelperTests
+{
+    [Test]
+    public async Task TryParse_ShouldAcceptEmptySettingsForExistingSubscriptions()
+    {
+        foreach (var json in new string?[] { null, "", " \r\n ", "{}" })
+        {
+            await HttpRequestHeadersHelper.TryParse(json, out var headers).Should().BeTrue();
+            await headers.Count.Should().BeEqualTo(0);
+        }
+    }
+
+    [Test]
+    public async Task TryParse_ShouldPreserveValuesAndUseCaseInsensitiveNames()
+    {
+        const string json = """
+            {
+              "X-hwid": "my_test_device",
+              "Authorization": "Bearer test:token",
+              "accept": "application/json",
+              "Content-Type": "application/json",
+              "X-Empty": ""
+            }
+            """;
+
+        await HttpRequestHeadersHelper.TryParse(json, out var headers).Should().BeTrue();
+        await headers["x-HWID"].Should().BeEqualTo("my_test_device");
+        await headers["AUTHORIZATION"].Should().BeEqualTo("Bearer test:token");
+        await headers["Accept"].Should().BeEqualTo("application/json");
+        await headers["Content-Type"].Should().BeEqualTo("application/json");
+        await headers["X-Empty"].Should().BeEqualTo("");
+    }
+
+    [Test]
+    [Arguments("not-json")]
+    [Arguments("null")]
+    [Arguments("[]")]
+    [Arguments("{\"X-Test\": 1}")]
+    [Arguments("{\"X-Test\": null}")]
+    [Arguments("{\"X-Test\": [\"one\", \"two\"]}")]
+    [Arguments("{\"X-Test\": \"one\", \"X-Test\": \"two\"}")]
+    [Arguments("{\"Accept\": \"one\", \"accept\": \"two\"}")]
+    [Arguments("{\"Bad Header\": \"value\"}")]
+    [Arguments("{\"Bad:Header\": \"value\"}")]
+    [Arguments("{\"\": \"value\"}")]
+    [Arguments("{\"X-Test\": \"one\\r\\nInjected: two\"}")]
+    [Arguments("{\"X-Test\": \"one\\nInjected: two\"}")]
+    [Arguments("{\"X-Test\": \"one\\u0000two\"}")]
+    public async Task TryParse_ShouldRejectInvalidHeadersWithoutReturningPartialSettings(string json)
+    {
+        await HttpRequestHeadersHelper.TryParse(json, out var headers).Should().BeFalse();
+        await headers.Count.Should().BeEqualTo(0);
+    }
+
+    [Test]
+    public async Task RequestHeaders_ShouldSurviveDatabaseMigrationAndEditing()
+    {
+        using var database = new SQLiteConnection(":memory:", false);
+        database.Execute("CREATE TABLE SubItem (Id TEXT PRIMARY KEY, Remarks TEXT, Url TEXT)");
+        database.Execute("INSERT INTO SubItem (Id, Remarks, Url) VALUES (?, ?, ?)", "existing", "Existing", "https://example.com/sub");
+        database.CreateTable<SubItem>();
+
+        var item = database.Find<SubItem>("existing");
+        await HttpRequestHeadersHelper.TryParse(item.RequestHeaders, out var oldHeaders).Should().BeTrue();
+        await oldHeaders.Count.Should().BeEqualTo(0);
+
+        item.RequestHeaders = "{\"X-hwid\":\"my_device\"}";
+        database.Update(item);
+        await database.Find<SubItem>(item.Id).RequestHeaders.Should().BeEqualTo(item.RequestHeaders);
+
+        item.RequestHeaders = "";
+        database.Update(item);
+        await database.Find<SubItem>(item.Id).RequestHeaders.Should().BeEqualTo("");
+    }
+}

v2rayN/ServiceLib.Tests/Helper/RegexGuardTests.cs

@@ -0,0 +1,36 @@
+namespace ServiceLib.Tests.Helper;
+
+public class RegexGuardTests
+{
+    [Test]
+    public async Task IsRegexMatch_NormalPattern_ShouldMatch()
+    {
+        await Utils.IsRegexMatch("HK-node-01", "HK|香港").Should().BeTrue();
+        await Utils.IsRegexMatch("JP-node-01", "HK|香港").Should().BeFalse();
+    }
+
+    [Test]
+    public async Task IsRegexMatch_EmptyPattern_ShouldPassThrough()
+    {
+        await Utils.IsRegexMatch("anything", "").Should().BeTrue();
+        await Utils.IsRegexMatch("anything", null).Should().BeTrue();
+    }
+
+    [Test]
+    public async Task IsRegexMatch_InvalidPattern_ShouldFailOpen()
+    {
+        await Utils.IsRegexMatch("node-01", "([unclosed").Should().BeTrue();
+    }
+
+    [Test]
+    public async Task IsRegexMatch_EvilPattern_ShouldTimeoutAndFailOpen()
+    {
+        var sw = System.Diagnostics.Stopwatch.StartNew();
+        var result = Utils.IsRegexMatch(new string('a', 30) + "!", "(a+)+$");
+        sw.Stop();
+
+        await result.Should().BeTrue();
+        await (sw.Elapsed < TimeSpan.FromSeconds(30)).Should().BeTrue().Because(
+            $"evil pattern must be cut off by timeout, took {sw.Elapsed}");
+    }
+}

v2rayN/ServiceLib.Tests/Manager/CoreManagerTests.cs

@@ -1,44 +1,39 @@
-using AwesomeAssertions;
-using ServiceLib.Enums;
-using ServiceLib.Manager;
-using Xunit;
-
 namespace ServiceLib.Tests.Manager;
 
 public class CoreManagerTests
 {
-    [Theory]
+    [Test]
-    [InlineData(ECoreType.sing_box)]
+    [Arguments(ECoreType.sing_box)]
-    [InlineData(ECoreType.mihomo)]
+    [Arguments(ECoreType.mihomo)]
-    [InlineData(ECoreType.Xray)]
+    [Arguments(ECoreType.Xray)]
-    public void ShouldRunAsSudo_TunLaunchOnNonWindows_RequiresElevation(ECoreType coreType)
+    public async Task ShouldRunAsSudo_TunLaunchOnNonWindows_RequiresElevation(ECoreType coreType)
     {
-        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeTrue();
+        await CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeTrue();
     }
 
-    [Fact]
+    [Test]
-    public void ShouldRunAsSudo_NonTunLaunch_ShouldNotElevate()
+    public async Task ShouldRunAsSudo_NonTunLaunch_ShouldNotElevate()
     {
         // Regression guard for the macOS TUN failure: the elevation decision must follow
         // the context snapshot that generated the config. A launch whose snapshot has TUN
         // disabled must never elevate, and a launch whose snapshot has TUN enabled must
         // elevate regardless of later changes to the live config.
-        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.sing_box, isNonWindows: true).Should().BeFalse();
+        await CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.sing_box, isNonWindows: true).Should().BeFalse();
-        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.Xray, isNonWindows: true).Should().BeFalse();
+        await CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.Xray, isNonWindows: true).Should().BeFalse();
     }
 
-    [Fact]
+    [Test]
-    public void ShouldRunAsSudo_OnWindows_ShouldNotElevate()
+    public async Task ShouldRunAsSudo_OnWindows_ShouldNotElevate()
     {
-        CoreManager.ShouldRunAsSudo(isTunLaunch: true, ECoreType.sing_box, isNonWindows: false).Should().BeFalse();
+        await CoreManager.ShouldRunAsSudo(isTunLaunch: true, ECoreType.sing_box, isNonWindows: false).Should().BeFalse();
     }
 
-    [Theory]
+    [Test]
-    [InlineData(ECoreType.v2fly)]
+    [Arguments(ECoreType.v2fly)]
-    [InlineData(ECoreType.hysteria)]
+    [Arguments(ECoreType.hysteria)]
-    [InlineData(null)]
+    [Arguments(null)]
-    public void ShouldRunAsSudo_UnsupportedCoreType_ShouldNotElevate(ECoreType? coreType)
+    public async Task ShouldRunAsSudo_UnsupportedCoreType_ShouldNotElevate(ECoreType? coreType)
     {
-        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeFalse();
+        await CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeFalse();
     }
 }

v2rayN/ServiceLib.Tests/ServiceLib.Tests.csproj

@@ -1,23 +1,23 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
-  <PropertyGroup>
+    <PropertyGroup>
-    <OutputType>Exe</OutputType>
+        <OutputType>Exe</OutputType>
-    <IsPackable>false</IsPackable>
+        <IsPackable>false</IsPackable>
-    <IsTestProject>true</IsTestProject>
+        <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
+    </PropertyGroup>
 
-  <ItemGroup>
+    <ItemGroup>
-    <PackageReference Include="AwesomeAssertions" />
+        <PackageReference Include="TUnit" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+        <PackageReference Include="TUnit.Assertions.Should" />
-    <PackageReference Include="xunit.runner.visualstudio">
+    </ItemGroup>
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-    </PackageReference>
-    <PackageReference Include="xunit.v3" />
-  </ItemGroup>
 
-  <ItemGroup>
+    <ItemGroup>
-    <ProjectReference Include="..\ServiceLib\ServiceLib.csproj" />
+        <ProjectReference Include="..\ServiceLib\ServiceLib.csproj" />
-  </ItemGroup>
+    </ItemGroup>
+
+    <ItemGroup>
+        <Using Include="TUnit.Assertions.Should" />
+        <Using Include="TUnit.Assertions.Should.Extensions" />
+    </ItemGroup>
 
 </Project>

v2rayN/ServiceLib.Tests/Services/DownloadServiceHeadersTests.cs

@@ -0,0 +1,159 @@
+namespace ServiceLib.Tests.Services;
+
+public class DownloadServiceHeadersTests
+{
+    [Test]
+    [Arguments(false, false)]
+    [Arguments(false, true)]
+    [Arguments(true, false)]
+    [Arguments(true, true)]
+    public async Task TryDownloadString_ShouldSendCustomHeadersThroughBothDownloaders(bool useProxy, bool failFirstRequest)
+    {
+        await CertPemManager.Instance.Init(new Config { GuiItem = new GUIItem() });
+        await using var server = new SubscriptionHttpServer(failFirstRequest);
+        const string json = """
+            {
+              "accept": "application/json",
+              "user-agent": "CustomSubscriptionClient/1.0",
+              "authorization": "Bearer test-token",
+              "X-hwid": "test-device",
+              "Cookie": "session=test",
+              "Content-Type": "application/json"
+            }
+            """;
+        await HttpRequestHeadersHelper.TryParse(json, out var headers).Should().BeTrue();
+        var service = new DownloadService { AcceptHeader = "*/*", RequestHeaders = headers };
+        var uri = new UriBuilder(useProxy ? "http://subscription.invalid/sub" : server.Url)
+        {
+            UserName = "user",
+            Password = "password"
+        }.Uri;
+        IWebProxy? proxy = useProxy ? new WebProxy(server.Url) : null;
+
+        var content = await service.TryDownloadString(uri.AbsoluteUri, proxy, "OriginalClient/1.0").WaitAsync(TimeSpan.FromSeconds(20));
+
+        await content.Should().BeEqualTo(SubscriptionHttpServer.Body);
+        await (server.Requests.Count >= (failFirstRequest ? 2 : 1)).Should().BeTrue();
+        foreach (var request in server.Requests)
+        {
+            await request["Accept"].Should().BeEqualTo("application/json");
+            await request["User-Agent"].Should().BeEqualTo("CustomSubscriptionClient/1.0");
+            await request["Authorization"].Should().BeEqualTo("Bearer test-token");
+            await request["X-hwid"].Should().BeEqualTo("test-device");
+            await request["Cookie"].Should().BeEqualTo("session=test");
+            await request["Content-Type"].Should().BeEqualTo("application/json");
+        }
+    }
+
+    [Test]
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task TryDownloadString_ShouldKeepDefaultAcceptUserAgentAndBasicAuth(bool failFirstRequest)
+    {
+        await CertPemManager.Instance.Init(new Config { GuiItem = new GUIItem() });
+        await using var server = new SubscriptionHttpServer(failFirstRequest);
+        var service = new DownloadService { AcceptHeader = "*/*" };
+        var uri = new UriBuilder(server.Url) { UserName = "user", Password = "password" }.Uri;
+
+        var content = await service.TryDownloadString(uri.AbsoluteUri, (IWebProxy?)null, "ExistingClient/1.0").WaitAsync(TimeSpan.FromSeconds(20));
+
+        await content.Should().BeEqualTo(SubscriptionHttpServer.Body);
+        foreach (var request in server.Requests)
+        {
+            await request["Accept"].Should().BeEqualTo("*/*");
+            await request["User-Agent"].Should().BeEqualTo("ExistingClient/1.0");
+            await request["Authorization"].Should().BeEqualTo("Basic dXNlcjpwYXNzd29yZA==");
+            await request.ContainsKey("X-hwid").Should().BeFalse();
+        }
+    }
+
+    [Test]
+    public async Task TryDownloadString_ShouldNotShareHeadersWithOtherDownloads()
+    {
+        await CertPemManager.Instance.Init(new Config { GuiItem = new GUIItem() });
+        await using var server = new SubscriptionHttpServer();
+        var subscription = new DownloadService
+        {
+            AcceptHeader = "*/*",
+            RequestHeaders = new Dictionary<string, string> { ["X-hwid"] = "first-device" }
+        };
+        var ordinaryDownload = new DownloadService();
+
+        await (await subscription.TryDownloadString(server.Url, (IWebProxy?)null, "TestClient/1.0")).Should().BeEqualTo(SubscriptionHttpServer.Body);
+        await (await ordinaryDownload.TryDownloadString(server.Url, (IWebProxy?)null, "TestClient/1.0")).Should().BeEqualTo(SubscriptionHttpServer.Body);
+
+        var requests = server.Requests.ToArray();
+        await requests.Length.Should().BeEqualTo(2);
+        await requests[0]["X-hwid"].Should().BeEqualTo("first-device");
+        await requests[1].ContainsKey("X-hwid").Should().BeFalse();
+        await requests[1].ContainsKey("Accept").Should().BeFalse();
+    }
+
+    private sealed class SubscriptionHttpServer : IAsyncDisposable
+    {
+        public const string Body = "subscription-test-content";
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _cancellation = new();
+        private readonly Task _serverTask;
+        private readonly bool _failFirstRequest;
+
+        public string Url { get; }
+        public ConcurrentQueue<Dictionary<string, string>> Requests { get; } = new();
+
+        public SubscriptionHttpServer(bool failFirstRequest = false)
+        {
+            _failFirstRequest = failFirstRequest;
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}/subscription";
+            _serverTask = ServeAsync();
+        }
+
+        private async Task ServeAsync()
+        {
+            var cancellationToken = _cancellation.Token;
+            while (!cancellationToken.IsCancellationRequested)
+            {
+                using var client = await _listener.AcceptTcpClientAsync(cancellationToken);
+                await using var stream = client.GetStream();
+                using var reader = new StreamReader(stream, Encoding.ASCII, leaveOpen: true);
+                var requestLine = await reader.ReadLineAsync(cancellationToken);
+                if (requestLine == null)
+                {
+                    continue;
+                }
+
+                var headers = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+                while (await reader.ReadLineAsync(cancellationToken) is { Length: > 0 } line)
+                {
+                    var separator = line.IndexOf(':');
+                    var name = line.Substring(0, separator);
+                    var value = line.Substring(separator + 1).Trim();
+                    headers[name] = headers.TryGetValue(name, out var previous) ? $"{previous}, {value}" : value;
+                }
+                Requests.Enqueue(headers);
+
+                var status = _failFirstRequest && Requests.Count == 1 ? "503 Service Unavailable" : "200 OK";
+                var body = requestLine.StartsWith("HEAD ") ? "" : Body;
+                var response = $"HTTP/1.1 {status}\r\nContent-Length: {Body.Length}\r\nConnection: close\r\n\r\n{body}";
+                await stream.WriteAsync(Encoding.ASCII.GetBytes(response), cancellationToken);
+            }
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _cancellation.CancelAsync();
+            _listener.Stop();
+            try
+            {
+                await _serverTask;
+            }
+            catch (OperationCanceledException)
+            {
+            }
+            finally
+            {
+                _cancellation.Dispose();
+            }
+        }
+    }
+}

v2rayN/ServiceLib.UdpTest/Socks5UdpChannel.cs

@@ -2,16 +2,21 @@ namespace ServiceLib.UdpTest;
 
 public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposable
 {
+    private bool _initialized;
+    private IPEndPoint _relayEndPoint;
     private TcpClient _tcpClient;
     private UdpClient _udpClient;
-    private IPEndPoint _relayEndPoint;
 
-    private bool _initialized = false;
+    public void Dispose()
+    {
+        _tcpClient?.Dispose();
+        _udpClient?.Dispose();
+    }
 
     /// <summary>
-    /// Send UDP data to a remote endpoint (IP address)
+    ///     Send UDP data to a remote endpoint (IP address)
     /// </summary>
-    public async Task SendAsync(IPEndPoint remote, byte[] data)
+    public async Task SendAsync(IPEndPoint remote, byte[] data, CancellationToken ct = default)
     {
         var addrData = new Socks5AddressData
         {
@@ -19,19 +24,20 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
                 ? Socks5AddressData.AddrTypeIPv4
                 : Socks5AddressData.AddrTypeIPv6,
             Host = remote.Address.ToString(),
-            Port = (ushort)remote.Port
+            Port = (ushort)remote.Port,
         };
         var packet = BuildSocks5UdpPacket(addrData, data);
-        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+        await _udpClient.SendAsync(packet.AsMemory(), _relayEndPoint, ct);
     }
 
     /// <summary>
-    /// Send UDP data to a remote endpoint (domain name or IP address)
+    ///     Send UDP data to a remote endpoint (domain name or IP address)
     /// </summary>
     /// <param name="host">Domain name or IP address</param>
     /// <param name="port">Port number</param>
     /// <param name="data">Data to send</param>
-    public async Task SendAsync(string host, ushort port, byte[] data)
+    /// <param name="ct">Cancellation token</param>
+    public async Task SendAsync(string host, ushort port, byte[] data, CancellationToken ct = default)
     {
         var addrData = new Socks5AddressData();
 
@@ -53,11 +59,12 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
         addrData.Port = port;
 
         var packet = BuildSocks5UdpPacket(addrData, data);
-        await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+        // await _udpClient.SendAsync(packet, packet.Length, _relayEndPoint);
+        await _udpClient.SendAsync(packet.AsMemory(), _relayEndPoint, ct);
     }
 
     /// <summary>
-    /// Receive UDP data from remote endpoint
+    ///     Receive UDP data from remote endpoint
     /// </summary>
     /// <param name="cancellationToken">Cancellation token to cancel the receive operation</param>
     /// <returns>Remote endpoint information and received data</returns>
@@ -69,16 +76,6 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
         return (remote, payload);
     }
 
-    /// <summary>
-    /// Represents a remote endpoint that can be either an IP address or a domain name
-    /// </summary>
-    public class Socks5RemoteEndpoint(string host, ushort port, bool isDomain)
-    {
-        public string Host { get; set; } = host;
-        public ushort Port { get; set; } = port;
-        public bool IsDomain { get; set; } = isDomain;
-    }
-
     private static byte[] BuildSocks5UdpPacket(Socks5AddressData addressData, byte[] data)
     {
         using var ms = new MemoryStream();
@@ -104,6 +101,11 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
             throw new ArgumentException("Invalid SOCKS5 UDP packet: too short");
         }
 
+        if (packet[0] != 0x00 || packet[1] != 0x00)
+        {
+            throw new ArgumentException("Invalid SOCKS5 UDP packet: RSV field must be 0");
+        }
+
         var offset = 0;
 
         // RSV (2 bytes) - Reserved field, skip
@@ -196,83 +198,34 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
         return (remote, data);
     }
 
-    public void Dispose()
+    /// <summary>
+    ///     Represents a remote endpoint that can be either an IP address or a domain name
+    /// </summary>
+    public class Socks5RemoteEndpoint(string host, ushort port, bool isDomain)
     {
-        _tcpClient.Dispose();
+        public string Host { get; set; } = host;
-        _udpClient.Dispose();
+        public ushort Port { get; set; } = port;
+        public bool IsDomain { get; set; } = isDomain;
     }
 
-    #region SOCKS5 Connection Handling
-
-    private const byte Socks5Version = 0x05;
-    private const byte SocksCmdUdpAssociate = 0x03;
-
-    public async Task<bool> EstablishUdpAssociationAsync(CancellationToken cancellationToken)
-    {
-        if (_initialized)
-        {
-            Dispose();
-            _initialized = false;
-        }
-
-        _udpClient = new UdpClient(new IPEndPoint(IPAddress.Any, 0));
-        _tcpClient = new TcpClient();
-        try
-        {
-            await _tcpClient.ConnectAsync(socks5Host, socks5TcpPort, cancellationToken).ConfigureAwait(false);
-        }
-        catch (SocketException)
-        {
-            return false;
-        }
-
-        var tcpControlStream = _tcpClient.GetStream();
-
-        byte[] handshakeRequest = [Socks5Version, 0x01, 0x00];
-        await tcpControlStream.WriteAsync(handshakeRequest, cancellationToken).ConfigureAwait(false);
-        var handshakeResponse = new byte[2];
-        if (await tcpControlStream.ReadAsync(handshakeResponse, cancellationToken).ConfigureAwait(false) < 2 ||
-            handshakeResponse[0] != Socks5Version || handshakeResponse[1] != 0x00)
-        {
-            return false;
-        }
-
-        var clientAddrForSocks = new Socks5AddressData
-        {
-            AddressType = Socks5AddressData.AddrTypeIPv4,
-            Host = "0.0.0.0",
-            Port = 0
-        };
-        using var udpAssociateReqMs = new MemoryStream();
-        udpAssociateReqMs.WriteByte(Socks5Version);
-        udpAssociateReqMs.WriteByte(SocksCmdUdpAssociate);
-        udpAssociateReqMs.WriteByte(0x00);
-        udpAssociateReqMs.Write(clientAddrForSocks.ToBytes());
-        await tcpControlStream.WriteAsync(udpAssociateReqMs.ToArray(), cancellationToken).ConfigureAwait(false);
-
-        var verRepRsv = new byte[3];
-        if (await tcpControlStream.ReadAsync(verRepRsv, cancellationToken).ConfigureAwait(false) < 3 ||
-            verRepRsv[0] != Socks5Version || verRepRsv[1] != 0x00)
-        {
-            return false;
-        }
-
-        var proxyRelaySocksAddr =
-            await Socks5AddressData.ParseAsync(tcpControlStream, cancellationToken).ConfigureAwait(false);
-        if (proxyRelaySocksAddr == null || !IPAddress.TryParse(proxyRelaySocksAddr.Host, out var proxyRelayIp))
-        {
-            return false;
-        }
-
-        _relayEndPoint = new IPEndPoint(proxyRelayIp, proxyRelaySocksAddr.Port);
-        _initialized = true;
-        return true;
-    }
-
-    #endregion SOCKS5 Connection Handling
-
     #region SOCKS5 Address Handling
 
+    private static async Task<bool> TryReadExactlyAsync(
+        Stream stream,
+        Memory<byte> buffer,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            await stream.ReadExactlyAsync(buffer, cancellationToken).ConfigureAwait(false);
+            return true;
+        }
+        catch (EndOfStreamException)
+        {
+            return false;
+        }
+    }
+
     private class Socks5AddressData
     {
         public const byte AddrTypeIPv4 = 0x01;
@@ -343,7 +296,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
             var typeByte = new byte[1];
             try
             {
-                if (await stream.ReadAsync(typeByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                if (!await TryReadExactlyAsync(stream, typeByte, ct).ConfigureAwait(false))
                 {
                     return null;
                 }
@@ -353,7 +306,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
                 {
                     case AddrTypeIPv4:
                         var ipv4Bytes = new byte[4];
-                        if (await stream.ReadAsync(ipv4Bytes.AsMemory(0, 4), ct).ConfigureAwait(false) < 4)
+                        if (!await TryReadExactlyAsync(stream, ipv4Bytes, ct).ConfigureAwait(false))
                         {
                             return null;
                         }
@@ -363,7 +316,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
 
                     case AddrTypeDomain:
                         var lenByte = new byte[1];
-                        if (await stream.ReadAsync(lenByte.AsMemory(0, 1), ct).ConfigureAwait(false) < 1)
+                        if (!await TryReadExactlyAsync(stream, lenByte, ct).ConfigureAwait(false))
                         {
                             return null;
                         }
@@ -375,8 +328,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
                         else
                         {
                             var domainBytes = new byte[lenByte[0]];
-                            if (await stream.ReadAsync(domainBytes.AsMemory(0, domainBytes.Length), ct)
+                            if (!await TryReadExactlyAsync(stream, domainBytes, ct).ConfigureAwait(false))
-                                    .ConfigureAwait(false) < domainBytes.Length)
                             {
                                 return null;
                             }
@@ -388,7 +340,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
 
                     case AddrTypeIPv6:
                         var ipv6Bytes = new byte[16];
-                        if (await stream.ReadAsync(ipv6Bytes.AsMemory(0, 16), ct).ConfigureAwait(false) < 16)
+                        if (!await TryReadExactlyAsync(stream, ipv6Bytes, ct).ConfigureAwait(false))
                         {
                             return null;
                         }
@@ -401,7 +353,7 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
                 }
 
                 var portBytes = new byte[2];
-                if (await stream.ReadAsync(portBytes.AsMemory(0, 2), ct).ConfigureAwait(false) < 2)
+                if (!await TryReadExactlyAsync(stream, portBytes, ct).ConfigureAwait(false))
                 {
                     return null;
                 }
@@ -417,4 +369,73 @@ public class Socks5UdpChannel(string socks5Host, int socks5TcpPort) : IDisposabl
     }
 
     #endregion SOCKS5 Address Handling
+
+    #region SOCKS5 Connection Handling
+
+    private const byte Socks5Version = 0x05;
+    private const byte SocksCmdUdpAssociate = 0x03;
+
+    public async Task<bool> EstablishUdpAssociationAsync(CancellationToken cancellationToken)
+    {
+        if (_initialized)
+        {
+            Dispose();
+            _initialized = false;
+        }
+
+        _udpClient = new UdpClient(new IPEndPoint(IPAddress.Any, 0));
+        _tcpClient = new TcpClient();
+        try
+        {
+            await _tcpClient.ConnectAsync(socks5Host, socks5TcpPort, cancellationToken).ConfigureAwait(false);
+        }
+        catch (SocketException)
+        {
+            return false;
+        }
+
+        var tcpControlStream = _tcpClient.GetStream();
+
+        byte[] handshakeRequest = [Socks5Version, 0x01, 0x00];
+        await tcpControlStream.WriteAsync(handshakeRequest, cancellationToken).ConfigureAwait(false);
+        var handshakeResponse = new byte[2];
+        if (!await TryReadExactlyAsync(tcpControlStream, handshakeResponse, cancellationToken).ConfigureAwait(false) ||
+            handshakeResponse[0] != Socks5Version || handshakeResponse[1] != 0x00)
+        {
+            return false;
+        }
+
+        var clientAddrForSocks = new Socks5AddressData
+        {
+            AddressType = Socks5AddressData.AddrTypeIPv4,
+            Host = "0.0.0.0",
+            Port = 0,
+        };
+        using var udpAssociateReqMs = new MemoryStream();
+        udpAssociateReqMs.WriteByte(Socks5Version);
+        udpAssociateReqMs.WriteByte(SocksCmdUdpAssociate);
+        udpAssociateReqMs.WriteByte(0x00);
+        udpAssociateReqMs.Write(clientAddrForSocks.ToBytes());
+        await tcpControlStream.WriteAsync(udpAssociateReqMs.ToArray(), cancellationToken).ConfigureAwait(false);
+
+        var verRepRsv = new byte[3];
+        if (!await TryReadExactlyAsync(tcpControlStream, verRepRsv, cancellationToken).ConfigureAwait(false) ||
+            verRepRsv[0] != Socks5Version || verRepRsv[1] != 0x00)
+        {
+            return false;
+        }
+
+        var proxyRelaySocksAddr =
+            await Socks5AddressData.ParseAsync(tcpControlStream, cancellationToken).ConfigureAwait(false);
+        if (proxyRelaySocksAddr == null || !IPAddress.TryParse(proxyRelaySocksAddr.Host, out var proxyRelayIp))
+        {
+            return false;
+        }
+
+        _relayEndPoint = new IPEndPoint(proxyRelayIp, proxyRelaySocksAddr.Port);
+        _initialized = true;
+        return true;
+    }
+
+    #endregion SOCKS5 Connection Handling
 }

v2rayN/ServiceLib.UdpTest/Tester/DnsService.cs

@@ -13,7 +13,7 @@ public class DnsService : IUdpTest
         // Question: www.google.com, Type A, Class IN
         0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6F, 0x6F,
         0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
-        0x00, 0x01, 0x00, 0x01
+        0x00, 0x01, 0x00, 0x01,
     ];
 
     public byte[] BuildUdpRequestPacket()

v2rayN/ServiceLib.UdpTest/Tester/McBeService.cs

@@ -17,13 +17,13 @@ public class McBeService : IUdpTest
         0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78,
         // Client GUID (random 16 bytes)
         0x66, 0x0E, 0xAB, 0xBC, 0x61, 0x0D, 0x1F, 0x4E,
-        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE, 0xF5, 0x4B
+        0xA4, 0x40, 0x8C, 0x65, 0xC1, 0xBE, 0xF5, 0x4B,
     ];
 
     private static readonly byte[] McBeMagicBytes =
     [
         0x00, 0xFF, 0xFF, 0x00, 0xFE, 0xFE, 0xFE, 0xFE,
-        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78
+        0xFD, 0xFD, 0xFD, 0xFD, 0x12, 0x34, 0x56, 0x78,
     ];
 
     private static readonly List<string> ValidGameModes =
@@ -31,7 +31,7 @@ public class McBeService : IUdpTest
         "Survival",
         "Creative",
         "Adventure",
-        "Spectator"
+        "Spectator",
     ];
 
     public byte[] BuildUdpRequestPacket()
@@ -61,6 +61,10 @@ public class McBeService : IUdpTest
             return false; // Magic bytes do not match
         }
         var stringLength = (ushort)((mcbeResponseBytes[33] << 8) | mcbeResponseBytes[34]);
+        if (mcbeResponseBytes.Length < 35 + stringLength)
+        {
+            return false; // Not enough data for the string
+        }
         var stringData = Encoding.UTF8.GetString(mcbeResponseBytes.Skip(35).Take(stringLength).ToArray());
         var stringParts = stringData.Split(';');
         // check Game Mode str

v2rayN/ServiceLib.UdpTest/Tester/StunService.cs

@@ -31,10 +31,7 @@ public class StunService : IUdpTest
         if (stunResponseBytes.Length >= 2)
         {
             var messageType = (stunResponseBytes[0] << 8) | stunResponseBytes[1];
-            if (messageType is 0x0101 or 0x0111)
+            return messageType is 0x0101 or 0x0111;
-            {
-                return true;
-            }
         }
 
         return true;

v2rayN/ServiceLib.UdpTest/UdpTestService.cs

@@ -5,7 +5,6 @@ namespace ServiceLib.UdpTest;
 public class UdpTestService
 {
     private const string DefaultUdpTestType = "ntp";
-    private readonly IUdpTest _udpTest;
 
     private static readonly IReadOnlyDictionary<string, Func<IUdpTest>> UdpTestFactories =
         new Dictionary<string, Func<IUdpTest>>(StringComparer.OrdinalIgnoreCase)
@@ -16,6 +15,8 @@ public class UdpTestService
             ["mcbe"] = () => new McBeService(),
         };
 
+    private readonly IUdpTest _udpTest;
+
     private UdpTestService(IUdpTest udpTest)
     {
         _udpTest = udpTest;
@@ -88,24 +89,26 @@ public class UdpTestService
         return (targetServerHost, _udpTest.GetDefaultTargetPort());
     }
 
-    public async Task<TimeSpan> SendUdpRequestAsync(string targetServerHost, int socks5Port, TimeSpan operationTimeout)
+    public async Task<TimeSpan> SendUdpRequestAsync(string targetServerHost, int socks5Port,
+        CancellationToken ct = default)
     {
-        using var cts = new CancellationTokenSource(operationTimeout);
+        using var timeoutCts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
-        var cancellationToken = cts.Token;
+        using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(ct, timeoutCts.Token);
+        var linkedCt = linkedCts.Token;
         var udpRequestPacket = _udpTest.BuildUdpRequestPacket();
         if (udpRequestPacket == null || udpRequestPacket.Length == 0)
         {
             throw new InvalidOperationException("Failed to build UDP request packet.");
         }
         using var channel = new Socks5UdpChannel("127.0.0.1", socks5Port);
-        if (!await channel.EstablishUdpAssociationAsync(cancellationToken).ConfigureAwait(false))
+        if (!await channel.EstablishUdpAssociationAsync(linkedCt).ConfigureAwait(false))
         {
             throw new Exception("Failed to establish UDP association with SOCKS5 proxy.");
         }
 
         var (targetHost, targetPort) = ParseHostAndPort(targetServerHost);
 
-        byte[] udpReceiveResult = null;
+        byte[]? validUdpReceiveResult = null;
 
         // Get minimum round trip time from two attempts
         var roundTripTime = TimeSpan.MaxValue;
@@ -116,11 +119,15 @@ public class UdpTestService
             {
                 var stopwatch = new Stopwatch();
                 stopwatch.Start();
-                await channel.SendAsync(targetHost, targetPort, udpRequestPacket).ConfigureAwait(false);
+                await channel.SendAsync(targetHost, targetPort, udpRequestPacket, linkedCt).ConfigureAwait(false);
-                var (_, receiveResult) = await channel.ReceiveAsync(cancellationToken).ConfigureAwait(false);
+                var (_, receiveResult) = await channel.ReceiveAsync(linkedCt).ConfigureAwait(false);
                 stopwatch.Stop();
 
-                udpReceiveResult = receiveResult;
+                if (!_udpTest.VerifyAndExtractUdpResponse(receiveResult))
+                {
+                    continue;
+                }
+                validUdpReceiveResult = receiveResult;
 
                 var currentRoundTripTime = stopwatch.Elapsed;
                 if (currentRoundTripTime < roundTripTime)
@@ -128,6 +135,10 @@ public class UdpTestService
                     roundTripTime = currentRoundTripTime;
                 }
             }
+            catch (OperationCanceledException) when (timeoutCts.IsCancellationRequested)
+            {
+                throw;
+            }
             catch
             {
                 if (attempt == 1 && roundTripTime == TimeSpan.MaxValue)
@@ -137,18 +148,10 @@ public class UdpTestService
             }
         }
 
-        if ((udpReceiveResult?.Length ?? 0) < 4 + 1 + 4 + 2)
+        if (validUdpReceiveResult != null)
-        {
-            throw new Exception("Received NTP response is too short.");
-        }
-
-        if (udpReceiveResult != null && _udpTest.VerifyAndExtractUdpResponse(udpReceiveResult))
         {
             return roundTripTime;
         }
-        else
+        throw new Exception("Failed to verify and extract UDP response.");
-        {
-            throw new Exception("Failed to verify and extract UDP response.");
-        }
     }
 }

v2rayN/ServiceLib/Base/BulkObservableCollection.cs

@@ -2,7 +2,19 @@ namespace ServiceLib.Base;
 
 public class BulkObservableCollection<T> : ObservableCollection<T>
 {
-    private bool _suppressNotification = false;
+    private bool _suppressNotification;
+
+    public BulkObservableCollection()
+    {
+    }
+
+    public BulkObservableCollection(IEnumerable<T> collection) : base(collection)
+    {
+    }
+
+    public BulkObservableCollection(List<T> list) : base(list)
+    {
+    }
 
     protected override void OnCollectionChanged(NotifyCollectionChangedEventArgs e)
     {
@@ -63,4 +75,27 @@ public class BulkObservableCollection<T> : ObservableCollection<T>
 
         return true;
     }
+
+    public void ReplaceRange(IEnumerable<T>? collection)
+    {
+        _suppressNotification = true;
+        try
+        {
+            Items.Clear();
+            if (collection != null)
+            {
+                foreach (var item in collection)
+                {
+                    Items.Add(item);
+                }
+            }
+        }
+        finally
+        {
+            _suppressNotification = false;
+            OnPropertyChanged(new PropertyChangedEventArgs(nameof(Count)));
+            OnPropertyChanged(new PropertyChangedEventArgs("Item[]"));
+            OnCollectionChanged(new NotifyCollectionChangedEventArgs(NotifyCollectionChangedAction.Reset));
+        }
+    }
 }

v2rayN/ServiceLib/Base/MyReactiveObject.cs

@@ -1,6 +1,8 @@
 namespace ServiceLib.Base;
 
-public class MyReactiveObject : ReactiveObject
+public class MyReactiveObject : ReactiveObject, IActivatableViewModel
 {
     protected static Config? _config;
+
+    public ViewModelActivator Activator { get; } = new();
 }

v2rayN/ServiceLib/Common/Extension.cs

@@ -1,4 +1,5 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
 
 namespace ServiceLib.Common;
 
@@ -134,4 +135,24 @@ public static class Extension
                     .Replace("\r", replacement)
                     .Replace("\n", replacement);
     }
+
+    public static IObservable<TOutput> HandleSafe<TInput, TOutput>(
+        this Interaction<TInput, TOutput> interaction, TInput input,
+        TOutput defaultValue = default!,
+        [CallerMemberName] string memberName = "",
+        [CallerFilePath] string filePath = "",
+        [CallerLineNumber] int lineNumber = 0)
+    {
+        return Signal.Defer(() => interaction.Handle(input))
+            .Catch<TOutput, UnhandledInteractionException<TInput, TOutput>>(ex =>
+            {
+                Logging.SaveLog($"Unhandled interaction exception in {memberName} at {filePath}:{lineNumber}", ex);
+                return Signal.Return(defaultValue);
+            })
+            .Catch<TOutput, Exception>(ex =>
+            {
+                Logging.SaveLog($"Exception occurred while handling interaction in {memberName} at {filePath}:{lineNumber}, input: {input}", ex);
+                return Signal.Return(defaultValue);
+            });
+    }
 }

v2rayN/ServiceLib/Common/Utils.cs

@@ -1,4 +1,3 @@
-using System.Collections.Specialized;
 using System.Security.Principal;
 using CliWrap;
 using CliWrap.Buffered;
@@ -201,7 +200,9 @@ public class Utils
         var parts = query[1..].Split('&', StringSplitOptions.RemoveEmptyEntries);
         foreach (var part in parts)
         {
-            var keyValue = part.Split('=');
+            // Split on the FIRST '=' only: RFC 3986 lists '=' among the sub-delimiters a query
+            // value may carry, so everything after the first one belongs to the value.
+            var keyValue = part.Split('=', 2);
             if (keyValue.Length != 2)
             {
                 continue;
@@ -725,6 +726,40 @@ public class Utils
         return false;
     }
 
+    /// <summary>
+    /// Regex match with a timeout guard. Filter patterns can come from user
+    /// input or subscription content while the tested text (remarks, log
+    /// messages) is attacker-influenced, so an evil pattern like (a+)+$
+    /// would otherwise hang the caller (ReDoS). On timeout or invalid
+    /// pattern, fail open (return true) so no node/message is silently
+    /// dropped; the incident is logged.
+    /// </summary>
+    public static bool IsRegexMatch(string? input, string? pattern, int timeoutSeconds = 2)
+    {
+        if (pattern.IsNullOrEmpty())
+        {
+            return true;
+        }
+        if (input.IsNullOrEmpty())
+        {
+            return false;
+        }
+        try
+        {
+            return Regex.IsMatch(input, pattern, RegexOptions.None, TimeSpan.FromSeconds(timeoutSeconds));
+        }
+        catch (RegexMatchTimeoutException ex)
+        {
+            Logging.SaveLog("IsRegexMatch timeout", ex);
+            return true;
+        }
+        catch (ArgumentException ex)
+        {
+            Logging.SaveLog("IsRegexMatch invalid pattern", ex);
+            return true;
+        }
+    }
+
     #endregion Data Checks
 
     #region Speed Test
@@ -753,11 +788,11 @@ public class Utils
         return false;
     }
 
-    public static int GetFreePort(int defaultPort = 0)
+    public static int GetFreePort(int defaultPort)
     {
         try
         {
-            if (!(defaultPort == 0 || Utils.PortInUse(defaultPort)))
+            if (!PortInUse(defaultPort))
             {
                 return defaultPort;
             }
@@ -814,6 +849,40 @@ public class Utils
             .Any(ni => ni.Name.Equals(inInterfaceName, StringComparison.OrdinalIgnoreCase));
     }
 
+    /// <summary>
+    /// Whether the host holds a globally routable IPv6 address, that is one inside 2000::/3.
+    /// Link-local and unique local addresses are excluded: they never reach the IPv6 internet,
+    /// so a host holding only those has no IPv6 traffic that could bypass the tunnel, and no
+    /// IPv6 path that traffic sent into the tunnel could come back out of.
+    /// </summary>
+    public static bool HasGlobalIPv6Address()
+    {
+        try
+        {
+            return NetworkInterface.GetAllNetworkInterfaces()
+                .Where(ni => ni.OperationalStatus == OperationalStatus.Up
+                             && ni.NetworkInterfaceType != NetworkInterfaceType.Loopback)
+                .SelectMany(ni => ni.GetIPProperties().UnicastAddresses)
+                .Any(ua => IsGlobalUnicastIPv6(ua.Address));
+        }
+        catch
+        {
+            return true;
+        }
+    }
+
+    private static bool IsGlobalUnicastIPv6(IPAddress address)
+    {
+        if (address.AddressFamily != AddressFamily.InterNetworkV6)
+        {
+            return false;
+        }
+
+        // 2000::/3 is the only range currently assigned for global unicast, which leaves out
+        // ::1, fe80::/10, fc00::/7 and ff00::/8 in a single test.
+        return (address.GetAddressBytes()[0] & 0xE0) == 0x20;
+    }
+
     #endregion Speed Test
 
     #region Miscellaneous
@@ -983,12 +1052,12 @@ public class Utils
         return new Dictionary<string, string>();
     }
 
-    public static async Task<string?> GetCliWrapOutput(string filePath, string? arg)
+    public static async Task<string?> GetCliWrapOutput(string filePath, string? arg, CancellationToken cancellationToken = default)
     {
-        return await GetCliWrapOutput(filePath, arg != null ? new List<string>() { arg } : null);
+        return await GetCliWrapOutput(filePath, arg != null ? new List<string>() { arg } : null, cancellationToken);
     }
 
-    public static async Task<string?> GetCliWrapOutput(string filePath, IEnumerable<string>? args)
+    public static async Task<string?> GetCliWrapOutput(string filePath, IEnumerable<string>? args, CancellationToken cancellationToken = default)
     {
         try
         {
@@ -1005,7 +1074,7 @@ public class Utils
                 }
             }
 
-            var result = await cmd.ExecuteBufferedAsync();
+            var result = await cmd.ExecuteBufferedAsync(cancellationToken);
             if (result.IsSuccess)
             {
                 return result.StandardOutput ?? "";

v2rayN/ServiceLib/Enums/ERuleMode.cs

@@ -5,5 +5,4 @@ public enum ERuleMode
     Rule = 0,
     Global = 1,
     Direct = 2,
-    Unchanged = 3
 }

v2rayN/ServiceLib/Events/EventChannel.cs

@@ -5,6 +5,7 @@ public sealed class EventChannel<T>
     private readonly Signal<T> _signal = new();
     private readonly Lock _gate = new();
     private readonly IObservable<T> _observable;
+
     public EventChannel()
     {
         _observable = _signal.Synchronize(_gate);

v2rayN/ServiceLib/Global.cs

@@ -92,16 +92,27 @@ public class Global
     public const string XrayLocalAsset = "XRAY_LOCATION_ASSET";
     public const string XrayLocalCert = "XRAY_LOCATION_CERT";
     public const int SpeedTestPageSize = 1000;
+    public const int SpeedTestConcurrencyCountMin = 10;
     public const string LinuxBash = "/bin/bash";
     public const string StringTrue = "true";
     public const string StringFalse = "false";
     public const int SqliteMaxBatchSize = 10000;
+    public static readonly TimeSpan LocalFetch = TimeSpan.FromSeconds(5);
+    public static readonly TimeSpan DirectFetch = TimeSpan.FromSeconds(10);
+    public static readonly TimeSpan ProxyFetch = TimeSpan.FromSeconds(30);
+    public static readonly TimeSpan DirectDownloadConnect = TimeSpan.FromSeconds(5);
+    public static readonly TimeSpan ProxyDownloadConnect = TimeSpan.FromSeconds(10);
 
-    public const string SingboxDirectDNSTag = "direct_dns";
+    public const string SingboxDirectDNSTagPrefix = "direct-dns-";
-    public const string SingboxRemoteDNSTag = "remote_dns";
+    public const string SingboxRemoteDNSTagPrefix = "remote-dns-";
-    public const string SingboxLocalDNSTag = "local_local";
+    public const string SingboxDirectDNSTag = "direct-dns-1";
-    public const string SingboxHostsDNSTag = "hosts_dns";
+    public const string SingboxRemoteDNSTag = "remote-dns-1";
-    public const string SingboxFakeDNSTag = "fake_dns";
+    public const string SingboxDirectDNSTagTemplate = "direct-dns-{0}";
+    public const string SingboxRemoteDNSTagTemplate = "remote-dns-{0}";
+    public const string SingboxLocalDNSTag = "local-local";
+    public const string SingboxHostsDNSTag = "hosts-dns";
+    public const string SingboxFakeDNSTag = "fake-dns";
+    public const string SingboxSrsDownloadHttpClientTag = "srs-download-http-client";
 
     public const int Hysteria2DefaultHopInt = 30;
     public const string PolicyGroupExcludeKeywords = @"剩余|过期|到期|重置|[Rr]emaining|[Ee]xpir|[Rr]eset";
@@ -484,16 +495,22 @@ public class Global
         "localhost"
     ];
 
+    public static readonly List<LanguageOption> LanguageOptions =
+    [
+        new("zh-Hans", "简体中文"),
+        new("zh-Hant", "繁體中文"),
+        new("en", "English"),
+        new("fa", "فارسی"),
+        new("fr", "Français"),
+        new("ru", "Русский"),
+        new("hu", "Magyar"),
+        new("id", "Bahasa Indonesia"),
+        new("az", "Azərbaycan dili")
+    ];
+
     public static readonly List<string> Languages =
     [
-        "zh-Hans",
+        .. LanguageOptions.Select(t => t.Value)
-        "zh-Hant",
-        "en",
-        "fa",
-        "fr",
-        "ru",
-        "hu",
-        "id"
     ];
 
     public static readonly List<string> Alpns =

v2rayN/ServiceLib/GlobalUsings.cs

@@ -6,10 +6,6 @@ global using System.Diagnostics;
 global using System.Net;
 global using System.Net.NetworkInformation;
 global using System.Net.Sockets;
-global using ReactiveUI.Primitives;
-global using ReactiveUI.Primitives.Concurrency;
-global using ReactiveUI.Primitives.Disposables;
-global using ReactiveUI.Primitives.Signals;
 global using System.Reflection;
 global using System.Runtime.InteropServices;
 global using System.Runtime.Versioning;
@@ -21,6 +17,11 @@ global using System.Text.Json.Nodes;
 global using System.Text.Json.Serialization;
 global using System.Text.RegularExpressions;
 global using ReactiveUI;
+global using ReactiveUI.Primitives;
+global using ReactiveUI.Primitives.Concurrency;
+global using ReactiveUI.Primitives.Disposables;
+global using ReactiveUI.Primitives.Extensions;
+global using ReactiveUI.Primitives.Signals;
 global using ReactiveUI.SourceGenerators;
 global using ServiceLib.Base;
 global using ServiceLib.Common;
@@ -41,5 +42,3 @@ global using ServiceLib.Services;
 global using ServiceLib.Services.CoreConfig;
 global using ServiceLib.Services.Statistics;
 global using SQLite;
-
-

v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs

@@ -1,5 +1,3 @@
-using System.ComponentModel.DataAnnotations;
-
 namespace ServiceLib.Handler.Builder;
 
 public record CoreConfigContextBuilderResult(CoreConfigContext Context, NodeValidatorResult ValidatorResult)
@@ -51,6 +49,7 @@ public class CoreConfigContextBuilder
             RoutingItem = await ConfigHandler.GetDefaultRouting(config),
             IsWindows = Utils.IsWindows(),
             IsMacOS = Utils.IsMacOS(),
+            HasGlobalIPv6Address = Utils.HasGlobalIPv6Address(),
             ProtectCoreTypeList = config.TunModeItem.EnableTun ? [ECoreType.Xray, ECoreType.sing_box] : []
         };
         var validatorResult = NodeValidatorResult.Empty();
@@ -205,7 +204,7 @@ public class CoreConfigContextBuilder
                 Context = preSocksResult.Context with
                 {
                     ProtectDomainList =
-                    [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
+                    [.. nodeContext.ProtectDomainList, .. preSocksResult.Context.ProtectDomainList],
                     ProtectCoreTypeList = protectCoreTypeList,
                 },
             };
@@ -386,7 +385,7 @@ public class CoreConfigContextBuilder
         {
             var echQuerySni = node.Sni;
             if (node.StreamSecurity == Global.StreamSecurity
-                && node.EchConfigList?.Contains("://") == true)
+                && node.EchConfigList.Contains("://"))
             {
                 var idx = node.EchConfigList.IndexOf('+');
                 echQuerySni = idx > 0 ? node.EchConfigList[..idx] : node.Sni;

v2rayN/ServiceLib/Handler/Builder/NodeValidator.cs

@@ -115,10 +115,10 @@ public class NodeValidator
 
         if (item.GetNetwork() is nameof(ETransport.ws)
             && item.EchConfigList.IsNullOrEmpty()
-            && item.GetAlpn()?.FirstOrDefault() == "h3")
+            && item.GetAlpn()?.FirstOrDefault() is "h3" or "h2")
         {
             v.Warning(
-                "WebSocket but ALPN is set to h3, the core may ignore the ALPN setting or cause unexpected issues.");
+                $"WebSocket but ALPN is set to {item.Alpn}, the core may ignore the ALPN setting or cause unexpected issues.");
         }
 
         // TLS & Security
@@ -131,14 +131,6 @@ public class NodeValidator
                 isCertProvided = false;
             }
 
-            // Check for deprecated allowInsecure property when TLS is enabled
-            if (item.GetAllowInsecure()
-                && item.Cert.IsNullOrEmpty()
-                && item.CertSha.IsNullOrEmpty())
-            {
-                v.Warning(ResUI.MsgAllowInsecureDeprecated);
-            }
-
             if ((coreType == ECoreType.Xray
                 && item.GetAllowInsecure()
                 && !isCertProvided
@@ -147,6 +139,10 @@ public class NodeValidator
                     && item.GetAllowInsecure()
                     && !isCertProvided))
             {
+                if (coreType == ECoreType.Xray)
+                {
+                    v.Warning(ResUI.MsgAllowInsecureDeprecated);
+                }
                 v.Warning(ResUI.MsgInsecureConfiguration);
             }
         }

v2rayN/ServiceLib/Handler/ConfigHandler.cs

@@ -115,6 +115,7 @@ public static class ConfigHandler
         config.ConstItem ??= new ConstItem();
 
         config.SimpleDNSItem ??= InitBuiltinSimpleDNS();
+        config.SimpleDNSItem.BlockAAAAQuery ??= false;
         config.SimpleDNSItem.FakeIPRange ??= Global.FakeIPRanges.FirstOrDefault();
         config.SimpleDNSItem.GlobalFakeIp ??= true;
         config.SimpleDNSItem.BootstrapDNS ??= Global.DomainPureIPDNSAddress.FirstOrDefault();
@@ -135,10 +136,7 @@ public static class ConfigHandler
         {
             config.SpeedTestItem.SpeedPingTestUrl = Global.SpeedPingTestUrls.First();
         }
-        if (config.SpeedTestItem.MixedConcurrencyCount < 1)
+        config.SpeedTestItem.MixedConcurrencyCount = Math.Max(config.SpeedTestItem.MixedConcurrencyCount, Global.SpeedTestConcurrencyCountMin);
-        {
-            config.SpeedTestItem.MixedConcurrencyCount = 5;
-        }
         if (config.SpeedTestItem.UdpTestTarget.IsNullOrEmpty())
         {
             config.SpeedTestItem.UdpTestTarget = Global.UdpTestTargets.First();
@@ -470,12 +468,12 @@ public static class ConfigHandler
     /// Supports moving to top, up, down, bottom or specific position
     /// </summary>
     /// <param name="config">Current configuration</param>
-    /// <param name="lstProfile">List of server profiles</param>
+    /// <param name="lstProfile">List of server profile index ids</param>
     /// <param name="index">Index of the server to move</param>
     /// <param name="eMove">Direction to move the server</param>
     /// <param name="pos">Target position when using EMove.Position</param>
     /// <returns>0 if successful, -1 if failed</returns>
-    public static async Task<int> MoveServer(Config config, List<ProfileItem> lstProfile, int index, EMove eMove, int pos = -1)
+    public static async Task<int> MoveServer(Config config, List<string> lstProfile, int index, EMove eMove, int pos = -1)
     {
         var count = lstProfile.Count;
         if (index < 0 || index > lstProfile.Count - 1)
@@ -485,7 +483,7 @@ public static class ConfigHandler
 
         for (var i = 0; i < lstProfile.Count; i++)
         {
-            ProfileExManager.Instance.SetSort(lstProfile[i].IndexId, (i + 1) * 10);
+            ProfileExManager.Instance.SetSort(lstProfile[i], (i + 1) * 10);
         }
 
         var sort = 0;
@@ -497,7 +495,7 @@ public static class ConfigHandler
                     {
                         return 0;
                     }
-                    sort = ProfileExManager.Instance.GetSort(lstProfile.First().IndexId) - 1;
+                    sort = ProfileExManager.Instance.GetSort(lstProfile.First()) - 1;
 
                     break;
                 }
@@ -507,7 +505,7 @@ public static class ConfigHandler
                     {
                         return 0;
                     }
-                    sort = ProfileExManager.Instance.GetSort(lstProfile[index - 1].IndexId) - 1;
+                    sort = ProfileExManager.Instance.GetSort(lstProfile[index - 1]) - 1;
 
                     break;
                 }
@@ -518,7 +516,7 @@ public static class ConfigHandler
                     {
                         return 0;
                     }
-                    sort = ProfileExManager.Instance.GetSort(lstProfile[index + 1].IndexId) + 1;
+                    sort = ProfileExManager.Instance.GetSort(lstProfile[index + 1]) + 1;
 
                     break;
                 }
@@ -528,7 +526,7 @@ public static class ConfigHandler
                     {
                         return 0;
                     }
-                    sort = ProfileExManager.Instance.GetSort(lstProfile[^1].IndexId) + 1;
+                    sort = ProfileExManager.Instance.GetSort(lstProfile[^1]) + 1;
 
                     break;
                 }
@@ -537,7 +535,7 @@ public static class ConfigHandler
                 break;
         }
 
-        ProfileExManager.Instance.SetSort(lstProfile[index].IndexId, sort);
+        ProfileExManager.Instance.SetSort(lstProfile[index], sort);
         return await Task.FromResult(0);
     }
 
@@ -586,7 +584,6 @@ public static class ConfigHandler
         return 0;
     }
 
-
     public static async Task<int> AddCustomOutboundServer(Config config, ProfileItem profileItem, bool blDelete, bool toFile = true)
     {
         var fileName = profileItem.Address;
@@ -922,6 +919,7 @@ public static class ConfigHandler
             WgInterfaceAddress = profileItem.GetProtocolExtra().WgInterfaceAddress?.TrimEx(),
             WgReserved = wgReserved,
             WgMtu = profileItem.GetProtocolExtra().WgMtu is null or <= 0 ? Global.TunMtus.First() : profileItem.GetProtocolExtra().WgMtu,
+            WgDns = profileItem.GetProtocolExtra().WgDns?.TrimEx(),
         });
 
         if (profileItem.Password.IsNullOrEmpty())
@@ -1527,7 +1525,7 @@ public static class ConfigHandler
                     p != null &&
                     p.IsValid() &&
                     (!p.ConfigType.IsComplexType() || p.ConfigType == EConfigType.Outbound) &&
-                    (extraItem.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extraItem.Filter))
+                    Utils.IsRegexMatch(p.Remarks, extraItem.Filter)
                 )
                 .ToList() ?? [];
             if (matchedChildProfiles.Count == 0)
@@ -1666,7 +1664,7 @@ public static class ConfigHandler
             //exist sub items //filter
             if (isSub && subid.IsNotEmpty() && subFilter.IsNotEmpty())
             {
-                if (!Regex.IsMatch(profileItem.Remarks, subFilter))
+                if (!Utils.IsRegexMatch(profileItem.Remarks, subFilter))
                 {
                     continue;
                 }
@@ -1739,21 +1737,27 @@ public static class ConfigHandler
         SubItem? subItem)
     {
         var subRemarks = subItem?.Remarks;
-        // Safe Mode: Only allow full configuration if it's not from a subscription
+        // Prioritize using complete custom parsing, followed by custom outbound parsing.
-        var lstProfiles = V2rayFmt.ResolveToCustomOutbound(strData, subRemarks);
+        var lstProfiles = V2rayFmt.ResolveToCustom(strData, subRemarks);
+        if (lstProfiles.Count == 0)
+        {
+            lstProfiles = SingboxFmt.ResolveToCustom(strData, subRemarks);
+        }
+        if (lstProfiles.Count == 0)
+        {
+            lstProfiles = V2rayFmt.ResolveToCustomOutbound(strData, subRemarks);
+        }
         if (lstProfiles.Count == 0)
         {
             lstProfiles = SingboxFmt.ResolveToCustomOutbound(strData, subRemarks);
         }
-        if (lstProfiles.Count == 0)
+        if (lstProfiles.Count > 0)
         {
-            return -1;
+            var count = await AddBatchCustomServers(config, lstProfiles, subid, isSub);
-        }
+            if (count > 0)
-
+            {
-        var count = await AddCustomOutboundServers(config, lstProfiles, subid, isSub);
+                return count;
-        if (count > 0)
+            }
-        {
-            return count;
         }
 
         if (HtmlPageFmt.IsHtmlPage(strData))
@@ -1786,21 +1790,16 @@ public static class ConfigHandler
         var subRemarks = subItem.Remarks;
         var customCoreType = subItem.CustomCoreType!.Value;
 
-        List<ProfileItem>? lstProfiles = customCoreType switch
+        var lstProfiles = customCoreType switch
         {
             ECoreType.Xray => V2rayFmt.ResolveToCustom(strData, subRemarks),
             ECoreType.sing_box => SingboxFmt.ResolveToCustom(strData, subRemarks),
-            _ => null
+            _ => null,
         };
 
-        if (lstProfiles is not null)
+        if (lstProfiles?.Count > 0)
         {
-            if (lstProfiles.Count == 0)
+            var count = await AddBatchCustomServers(config, lstProfiles, subid, isSub);
-            {
-                return -1;
-            }
-
-            var count = await AddCustomOutboundServers(config, lstProfiles, subid, isSub);
             if (count > 0)
             {
                 return count;
@@ -1810,7 +1809,7 @@ public static class ConfigHandler
         return await SaveCustomRawFileServer(config, strData, subid, isSub, subItem, customCoreType);
     }
 
-    private static async Task<int> AddCustomOutboundServers(
+    private static async Task<int> AddBatchCustomServers(
         Config config,
         List<ProfileItem> lstProfiles,
         string subid,
@@ -1821,9 +1820,20 @@ public static class ConfigHandler
         {
             it.Subid = subid;
             it.IsSub = isSub;
-            if (await AddCustomOutboundServer(config, it, true) == 0)
+
+            if (it.ConfigType == EConfigType.Custom)
             {
-                count++;
+                if (await AddCustomServer(config, it, true) == 0)
+                {
+                    count++;
+                }
+            }
+            else
+            {
+                if (await AddCustomOutboundServer(config, it, true) == 0)
+                {
+                    count++;
+                }
             }
         }
         return count;
@@ -2189,6 +2199,7 @@ public static class ConfigHandler
             item.Enabled = subItem.Enabled;
             item.AutoUpdateInterval = subItem.AutoUpdateInterval;
             item.UserAgent = subItem.UserAgent;
+            item.RequestHeaders = subItem.RequestHeaders;
             item.Sort = subItem.Sort;
             item.Filter = subItem.Filter;
             item.UpdateTime = subItem.UpdateTime;
@@ -2598,7 +2609,7 @@ public static class ConfigHandler
             items = await AppManager.Instance.RoutingItems();
         }
 
-        if (!blImportAdvancedRules && items.Count(u => u.Remarks.StartsWith(ver)) > 0)
+        if (!blImportAdvancedRules && items.Count() > 0) // items.Count(u => u.Remarks.StartsWith(ver)) > 0)
         {
             //migrate
             //TODO Temporary code to be removed later

v2rayN/ServiceLib/Handler/ConnectionHandler.cs

@@ -5,14 +5,14 @@ public static class ConnectionHandler
     private static readonly string _tag = "ConnectionHandler";
 
     /// <summary>
-    /// Runs ping and IP checks and returns a formatted result string.
+    /// Runs ping and IP checks.
     /// </summary>
-    public static async Task<string> RunAvailabilityCheck()
+    public static async Task<AvailabilityCheckResult> RunAvailabilityCheck()
     {
         var time = await GetRealPingTimeInfo();
         var ip = time > 0 ? await GetIPInfo() : Global.None;
 
-        return string.Format(ResUI.TestMeOutput, time, ip);
+        return new AvailabilityCheckResult(time, ip);
     }
 
     /// <summary>
@@ -66,34 +66,41 @@ public static class ConnectionHandler
     /// <summary>
     /// Measures response time by sending HTTP requests through proxy.
     /// </summary>
-    public static async Task<int> GetRealPingTime(IWebProxy? webProxy, int downloadTimeout = 9)
+    public static async Task<int> GetRealPingTime(IWebProxy? webProxy, CancellationToken cancellationToken = default)
     {
         var url = AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl;
         var responseTime = -1;
         try
         {
-            using var cts = new CancellationTokenSource();
+            using var timeoutCts = new CancellationTokenSource();
-            cts.CancelAfter(TimeSpan.FromSeconds(downloadTimeout));
+            timeoutCts.CancelAfter(Global.LocalFetch);
+            using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, timeoutCts.Token);
+            var linkedToken = linkedCts.Token;
             using var client = new HttpClient(new SocketsHttpHandler()
             {
                 Proxy = webProxy,
                 UseProxy = webProxy != null,
-                ConnectTimeout = TimeSpan.FromSeconds(3)
+                ConnectTimeout = Global.LocalFetch,
             });
 
             List<int> oneTime = [];
             for (var i = 0; i < 2; i++)
             {
                 var timer = Stopwatch.StartNew();
-                await client.GetAsync(url, cts.Token).ConfigureAwait(false);
+                await client.GetAsync(url, linkedToken).ConfigureAwait(false);
                 timer.Stop();
                 oneTime.Add((int)timer.Elapsed.TotalMilliseconds);
-                await Task.Delay(100, cts.Token);
+                await Task.Delay(100, linkedToken);
             }
             responseTime = oneTime.Where(x => x > 0).OrderBy(x => x).FirstOrDefault();
         }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
         catch
         {
+            // Ignore
         }
         return responseTime;
     }
@@ -101,7 +108,7 @@ public static class ConnectionHandler
     /// <summary>
     /// Gets IP and country information through specified proxy.
     /// </summary>
-    public static async Task<IpInfoResult?> GetIPInfo(IWebProxy? webProxy)
+    public static async Task<IpInfoResult?> GetIPInfo(IWebProxy? webProxy, CancellationToken cancellationToken = default)
     {
         try
         {
@@ -112,7 +119,7 @@ public static class ConnectionHandler
             }
 
             var downloadHandle = new DownloadService();
-            var result = await downloadHandle.TryDownloadString(url, webProxy, "");
+            var result = await downloadHandle.TryDownloadString(url, webProxy, "", cancellationToken);
             if (result == null)
             {
                 return null;
@@ -129,6 +136,10 @@ public static class ConnectionHandler
 
             return new IpInfoResult(country, ip);
         }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
         catch
         {
             return null;

v2rayN/ServiceLib/Handler/Fmt/BaseFmt.cs

@@ -1,5 +1,3 @@
-using System.Collections.Specialized;
-
 namespace ServiceLib.Handler.Fmt;
 
 public class BaseFmt
@@ -344,8 +342,13 @@ public class BaseFmt
         return query[key] ?? defaultValue;
     }
 
+    /// <summary>
+    /// Values are already unescaped by <see cref="Utils.ParseQueryString" />, so this must not
+    /// unescape them a second time: a value that still holds a valid percent sequence after the
+    /// first pass - an obfuscation password of "ob%41fs", say - would decay into "obAfs".
+    /// </summary>
     protected static string GetQueryDecoded(NameValueCollection query, string key, string defaultValue = "")
     {
-        return Utils.UrlDecode(GetQueryValue(query, key, defaultValue));
+        return GetQueryValue(query, key, defaultValue);
     }
 }

v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs

@@ -1,5 +1,3 @@
-using System.Collections.Specialized;
-
 namespace ServiceLib.Handler.Fmt;
 
 public class Hysteria2Fmt : BaseFmt
@@ -19,7 +17,11 @@ public class Hysteria2Fmt : BaseFmt
         }
 
         item.Address = url.IdnHost;
-        item.Port = url.Port;
+        // The URI scheme makes the port optional and defaults it to 443. Uri.Port answers -1 for
+        // an unregistered scheme carrying no port, which ProfileItem.IsValid then rejects.
+        // Only -1 means "omitted": an explicit ":0" has to stay 0 and be rejected the way it
+        // always was, instead of being quietly redirected to a server the link never named.
+        item.Port = url.Port == -1 ? 443 : url.Port;
         item.Remarks = url.GetComponents(UriComponents.Fragment, UriFormat.Unescaped);
         item.Password = Utils.UrlDecode(url.UserInfo);
 
@@ -168,8 +170,21 @@ public class Hysteria2Fmt : BaseFmt
         }
         if (item.CertSha.IsNullOrEmpty())
         {
-            item.CertSha = GetQueryDecoded(query, "pinSHA256");
+            var pinSHA256 = GetQueryDecoded(query, "pinSHA256");
+            item.CertSha = pinSHA256;
+            if (!pinSHA256.IsNullOrEmpty())
+            {
+                // NOTE:
+                // To accommodate Xray changes,
+                // some providers issue self-signed cert links with `insecure = false` and a certificate fingerprint,
+                // breaking interoperability between Xray, official Hysteria 2 client, and sing-box.
+                // Since this won't compromise the overall security model,
+                // `insecure = true` is automatically set when a fingerprint is detected,
+                // and the value is restored when generating configurations.
+                item.AllowInsecure = Global.StringTrue;
+            }
         }
+        item.EchConfigList = GetQueryDecoded(query, "ech");
         item.SetProtocolExtra(item.GetProtocolExtra() with
         {
             Ports = GetQueryDecoded(query, "mport"),
@@ -212,6 +227,15 @@ public class Hysteria2Fmt : BaseFmt
             var sha = item.CertSha;
             dicQuery.Add("pinSHA256", Utils.UrlEncode(sha));
         }
+        else if (!item.Cert.IsNullOrEmpty()
+            && CertPemManager.GetLeafCertSha256Thumbprint(item.Cert) is { Length: > 0 } thumbprint)
+        {
+            dicQuery.Add("pinSHA256", Utils.UrlEncode(thumbprint));
+        }
+        if (!item.EchConfigList.IsNullOrEmpty())
+        {
+            dicQuery.Add("ech", Utils.UrlEncode(item.EchConfigList));
+        }
         var protocolExtraItem = item.GetProtocolExtra();
         var isGecko = !protocolExtraItem.GeckoMinPacketSize.IsNullOrEmpty() || !protocolExtraItem.GeckoMaxPacketSize.IsNullOrEmpty();
         if (!protocolExtraItem.SalamanderPass.IsNullOrEmpty())

v2rayN/ServiceLib/Handler/Fmt/SingboxFmt.cs

@@ -34,9 +34,9 @@ public class SingboxFmt : BaseFmt
         if (!isOutbound)
         {
             var fullProfile = ResolveFull(jsonObject, subRemarks);
-            profileList.Add(fullProfile);
             if (fullProfile is not null)
             {
+                profileList.Add(fullProfile);
                 return profileList;
             }
         }
@@ -76,6 +76,7 @@ public class SingboxFmt : BaseFmt
         var fileName = WriteAllText(JsonUtils.Serialize(jsonObject));
         var profileItem = new ProfileItem
         {
+            ConfigType = EConfigType.Custom,
             CoreType = ECoreType.sing_box,
             Address = fileName,
             Remarks = subRemarks ?? "singbox_custom",

v2rayN/ServiceLib/Handler/Fmt/V2rayFmt.cs

@@ -34,9 +34,9 @@ public class V2rayFmt : BaseFmt
         if (!isOutbound)
         {
             var fullProfile = ResolveFull(jsonObject, subRemarks);
-            profileList.Add(fullProfile);
             if (fullProfile is not null)
             {
+                profileList.Add(fullProfile);
                 return profileList;
             }
         }
@@ -77,6 +77,7 @@ public class V2rayFmt : BaseFmt
 
         var profileItem = new ProfileItem
         {
+            ConfigType = EConfigType.Custom,
             CoreType = ECoreType.Xray,
             Address = fileName,
             Remarks = jsonObject["remarks"]?.ToString() ?? subRemarks ?? "v2ray_custom",

v2rayN/ServiceLib/Handler/Fmt/WireguardFmt.cs

@@ -24,6 +24,24 @@ public class WireguardFmt : BaseFmt
 
         var query = Utils.ParseQueryString(url.Query);
 
+        var finalmaskDecoded = GetQueryDecoded(query, "fm");
+        if (finalmaskDecoded.IsNotEmpty())
+        {
+            var node = JsonUtils.ParseJson(finalmaskDecoded);
+            item.Finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
+                {
+                    WriteIndented = true,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : finalmaskDecoded;
+        }
+        else
+        {
+            item.Finalmask = string.Empty;
+        }
+
         item.SetProtocolExtra(item.GetProtocolExtra() with
         {
             WgPublicKey = GetQueryDecoded(query, "publickey"),
@@ -31,6 +49,7 @@ public class WireguardFmt : BaseFmt
             WgReserved = GetQueryDecoded(query, "reserved"),
             WgInterfaceAddress = GetQueryDecoded(query, "address"),
             WgMtu = int.TryParse(GetQueryDecoded(query, "mtu"), out var mtuVal) ? mtuVal : null,
+            WgDns = GetQueryDecoded(query, "dns"),
         });
 
         return item;
@@ -71,6 +90,23 @@ public class WireguardFmt : BaseFmt
         {
             dicQuery.Add("mtu", protoExtra.WgMtu.ToString());
         }
+        if (!protoExtra.WgDns.IsNullOrEmpty())
+        {
+            dicQuery.Add("dns", Utils.UrlEncode(protoExtra.WgDns));
+        }
+        if (item.Finalmask.IsNotEmpty())
+        {
+            var node = JsonUtils.ParseJson(item.Finalmask);
+            var finalmask = node != null
+                ? JsonUtils.Serialize(node, new JsonSerializerOptions
+                {
+                    WriteIndented = false,
+                    DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                    Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+                })
+                : item.Finalmask;
+            dicQuery.Add("fm", Utils.UrlEncode(finalmask));
+        }
         return ToUri(EConfigType.WireGuard, item.Address, item.Port, item.Password, dicQuery, remark);
     }
 
@@ -133,6 +169,7 @@ public class WireguardFmt : BaseFmt
 
         var wgMtu = interfaceDic.TryGetValue("MTU", out var mtuStr) && int.TryParse(mtuStr, out var mtuVal) ? mtuVal : 0;
         var wgInterfaceAddress = interfaceDic.TryGetValue("Address", out var interfaceAddress) ? interfaceAddress : string.Empty;
+        var wgDns = interfaceDic.TryGetValue("DNS", out var dns) ? dns : string.Empty;
 
         var index = 0;
         var resultList = new List<ProfileItem>();
@@ -156,6 +193,7 @@ public class WireguardFmt : BaseFmt
                 WgInterfaceAddress = wgInterfaceAddress,
                 WgReserved = (peerDic.TryGetValue("Reserved", out var reserved) ? reserved : string.Empty).NullIfEmpty(),
                 WgMtu = wgMtu > 0 ? wgMtu : null,
+                WgDns = wgDns,
             };
 
             var item = new ProfileItem

v2rayN/ServiceLib/Handler/SubscriptionHandler.cs

@@ -31,7 +31,7 @@ public static class SubscriptionHandler
                 }
 
                 // Create download handler
-                var downloadHandle = CreateDownloadHandler(hashCode, updateFunc);
+                var downloadHandle = CreateDownloadHandler(item, hashCode, updateFunc);
                 await updateFunc?.Invoke(false, $"{hashCode}{ResUI.MsgStartGettingSubscriptions}");
 
                 // Get all subscription content (main subscription + additional subscriptions)
@@ -80,9 +80,18 @@ public static class SubscriptionHandler
         return true;
     }
 
-    private static DownloadService CreateDownloadHandler(string hashCode, Func<bool, string, Task> updateFunc)
+    private static DownloadService CreateDownloadHandler(SubItem item, string hashCode, Func<bool, string, Task> updateFunc)
     {
-        var downloadHandle = new DownloadService();
+        if (!HttpRequestHeadersHelper.TryParse(item.RequestHeaders, out var requestHeaders))
+        {
+            throw new FormatException(ResUI.SubRequestHeadersInvalid);
+        }
+
+        var downloadHandle = new DownloadService
+        {
+            AcceptHeader = "*/*",
+            RequestHeaders = requestHeaders
+        };
         downloadHandle.Error += (sender2, args) =>
         {
             updateFunc?.Invoke(false, $"{hashCode}{args.GetException().Message}");

v2rayN/ServiceLib/Helper/DownloaderHelper.cs

@@ -8,15 +8,14 @@ public class DownloaderHelper
     private static readonly Lazy<DownloaderHelper> _instance = new(() => new());
     public static DownloaderHelper Instance => _instance.Value;
 
-    public async Task<string?> DownloadStringAsync(IWebProxy? webProxy, string url, string? userAgent, int timeout)
+    public async Task<string?> DownloadStringAsync(IWebProxy? webProxy, string url, string? userAgent,
+        IReadOnlyDictionary<string, string>? requestHeaders = null, string? acceptHeader = null, CancellationToken cancellationToken = default)
     {
         if (url.IsNullOrEmpty())
         {
             return null;
         }
 
-        var connectTimeout = Math.Clamp(timeout / 5, 2, 5);
-
         Uri uri = new(url);
         //Authorization Header
         var headers = new WebHeaderCollection();
@@ -28,16 +27,16 @@ public class DownloaderHelper
         var requestConfiguration = new RequestConfiguration()
         {
             Headers = headers,
+            Accept = acceptHeader,
             UserAgent = userAgent,
-            ConnectTimeout = connectTimeout * 1000,
+            ConnectTimeout = GetConnectTimeoutMs(webProxy != null),
             Proxy = webProxy
         };
         var downloadOpt = new DownloadConfiguration()
         {
-            BlockTimeout = timeout * 1000,
             MaxTryAgainOnFailure = 2,
             RequestConfiguration = requestConfiguration,
-            CustomHttpMessageHandlerFactory = () => GetSocketsHttpHandler(requestConfiguration),
+            CustomHttpMessageHandlerFactory = () => HttpRequestHeadersHelper.CreateHandler(GetSocketsHttpHandler(requestConfiguration), requestHeaders),
         };
 
         await using var downloader = new Downloader.DownloadService(downloadOpt);
@@ -49,33 +48,26 @@ public class DownloaderHelper
             }
         };
 
-        using var cts = new CancellationTokenSource();
+        await using var stream = await downloader.DownloadFileTaskAsync(address: url, cancellationToken);
-        cts.CancelAfter(TimeSpan.FromSeconds(timeout));
-
-        await using var stream = await downloader.DownloadFileTaskAsync(address: url, cts.Token);
         using StreamReader reader = new(stream);
 
-        downloadOpt = null;
+        return await reader.ReadToEndAsync(cancellationToken);
-
-        return await reader.ReadToEndAsync(cts.Token);
     }
 
-    public async Task DownloadDataAsync4Speed(IWebProxy webProxy, string url, IProgress<string> progress, int timeout)
+    public async Task DownloadDataAsync4Speed(IWebProxy webProxy, string url, Action<string> onProgress, CancellationToken cancellationToken = default)
     {
         if (url.IsNullOrEmpty())
         {
             throw new ArgumentNullException(nameof(url));
         }
 
-        var connectTimeout = Math.Clamp(timeout / 5, 2, 5);
         var requestConfiguration = new RequestConfiguration()
         {
-            ConnectTimeout = connectTimeout * 1000,
+            ConnectTimeout = GetConnectTimeoutMs(true),
             Proxy = webProxy
         };
         var downloadOpt = new DownloadConfiguration()
         {
-            BlockTimeout = timeout * 1000,
             MaxTryAgainOnFailure = 2,
             RequestConfiguration = requestConfiguration,
             CustomHttpMessageHandlerFactory = () => GetSocketsHttpHandler(requestConfiguration),
@@ -88,112 +80,186 @@ public class DownloaderHelper
 
         downloader.DownloadProgressChanged += (sender, value) =>
         {
-            if (progress != null && value.BytesPerSecondSpeed > 0)
+            if (!(value.BytesPerSecondSpeed > 0))
             {
-                hasValue = true;
+                return;
-                if (value.BytesPerSecondSpeed > maxSpeed)
+            }
-                {
+            hasValue = true;
-                    maxSpeed = value.BytesPerSecondSpeed;
+            if (value.BytesPerSecondSpeed > maxSpeed)
-                }
+            {
+                maxSpeed = value.BytesPerSecondSpeed;
+            }
 
-                var ts = DateTime.Now - lastUpdateTime;
+            var ts = DateTime.Now - lastUpdateTime;
-                if (ts.TotalMilliseconds >= 1000)
+            if (ts.TotalMilliseconds >= 1000)
-                {
+            {
-                    lastUpdateTime = DateTime.Now;
+                lastUpdateTime = DateTime.Now;
-                    var speed = (maxSpeed / 1000 / 1000).ToString("#0.0");
+                var speed = (maxSpeed / 1000 / 1000).ToString("#0.0");
-                    progress.Report(speed);
+                onProgress.Invoke(speed);
-                }
             }
         };
         downloader.DownloadFileCompleted += (sender, value) =>
         {
-            if (progress != null)
+            if (hasValue && maxSpeed > 0)
             {
-                if (hasValue && maxSpeed > 0)
+                var finalSpeed = (maxSpeed / 1000 / 1000).ToString("#0.0");
-                {
+                onProgress.Invoke(finalSpeed);
-                    var finalSpeed = (maxSpeed / 1000 / 1000).ToString("#0.0");
+            }
-                    progress.Report(finalSpeed);
+            else if (value.Error != null)
-                }
+            {
-                else if (value.Error != null)
+                onProgress.Invoke(value.Error?.Message);
-                {
+            }
-                    progress.Report(value.Error?.Message);
+            else
-                }
+            {
-                else
+                onProgress.Invoke("0");
-                {
-                    progress.Report("0");
-                }
             }
         };
-        //progress.Report("......");
+        //progress.Invoke("......");
-        using var cts = new CancellationTokenSource();
+        await using var stream = await downloader.DownloadFileTaskAsync(address: url, cancellationToken);
-        cts.CancelAfter(TimeSpan.FromSeconds(timeout));
-        await using var stream = await downloader.DownloadFileTaskAsync(address: url, cts.Token);
-
-        downloadOpt = null;
     }
 
-    public async Task DownloadFileAsync(IWebProxy? webProxy, string url, string fileName, IProgress<double> progress, int timeout)
+    public async Task DownloadFileAsync(IWebProxy? webProxy, FileDownloadRequest request, Action<FileDownloadState> onProgress, CancellationToken cancellationToken = default)
     {
-        if (url.IsNullOrEmpty())
+        ArgumentNullException.ThrowIfNull(request);
+        if (request.FilePath.IsNullOrEmpty())
         {
-            throw new ArgumentNullException(nameof(url));
+            throw new ArgumentNullException(nameof(request.FilePath));
         }
-        if (fileName.IsNullOrEmpty())
+        if (File.Exists(request.FilePath))
         {
-            throw new ArgumentNullException(nameof(fileName));
+            File.Delete(request.FilePath);
-        }
-        if (File.Exists(fileName))
-        {
-            File.Delete(fileName);
         }
 
-        var connectTimeout = Math.Clamp(timeout / 5, 2, 5);
+        var state = new FileDownloadState
-        var requestConfiguration = new RequestConfiguration()
         {
-            ConnectTimeout = connectTimeout * 1000,
+            Request = request,
-            Proxy = webProxy
+        };
+
+        var requestConfiguration = new RequestConfiguration
+        {
+            ConnectTimeout = GetConnectTimeoutMs(webProxy != null),
+            Proxy = webProxy,
         };
         var downloadOpt = new DownloadConfiguration()
         {
-            BlockTimeout = timeout * 1000,
+            ChunkCount = 100,
-            MaxTryAgainOnFailure = 2,
+            MinimumChunkSize = 8 * 1024 * 1024, // 8 MB
+            MinimumSizeOfChunking = 8 * 1024 * 1024, // 8 MB
+            ParallelDownload = true,
+            ParallelCount = 4,
+
             RequestConfiguration = requestConfiguration,
             CustomHttpMessageHandlerFactory = () => GetSocketsHttpHandler(requestConfiguration),
         };
 
-        var progressPercentage = 0;
-        var hasValue = false;
         await using var downloader = new Downloader.DownloadService(downloadOpt);
-        downloader.DownloadStarted += (sender, value) => progress?.Report(0);
+        downloader.DownloadStarted += (sender, value) =>
+        {
+            state = state with
+            {
+                TotalBytes = value.TotalBytesToReceive,
+            };
+            onProgress.Invoke(state);
+        };
         downloader.DownloadProgressChanged += (sender, value) =>
         {
-            hasValue = true;
+            state = state with
-            var percent = (int)value.ProgressPercentage;//   Convert.ToInt32((totalRead * 1d) / (total * 1d) * 100);
-            if (progressPercentage != percent && percent % 10 == 0)
             {
-                progressPercentage = percent;
+                DownloadedBytes = value.ReceivedBytesSize,
-                progress.Report(percent);
+                TotalBytes = value.TotalBytesToReceive,
-            }
+                SpeedBytesPerSecond = value.BytesPerSecondSpeed,
+            };
+            onProgress.Invoke(state);
         };
         downloader.DownloadFileCompleted += (sender, value) =>
         {
-            if (progress != null)
+            state = state with
             {
-                if (hasValue && value.Error == null)
+                Completed = true,
-                {
+                Error = value.Error,
-                    progress.Report(101);
+            };
-                }
+            onProgress.Invoke(state);
-                else if (value.Error != null)
-                {
-                    throw value.Error;
-                }
-            }
         };
 
-        using var cts = new CancellationTokenSource();
+        await downloader.DownloadFileTaskAsync(request.FileUrl, request.FilePath, cancellationToken);
-        await downloader.DownloadFileTaskAsync(url, fileName, cts.Token);
+    }
 
-        downloadOpt = null;
+    public async Task DownloadSmallFilesAsync(IWebProxy? webProxy, List<FileDownloadRequest> requests, Action<ReadOnlyMemory<FileDownloadState>> onProgress, CancellationToken cancellationToken = default)
+    {
+        if (requests is not { Count: > 0 })
+        {
+            throw new ArgumentNullException(nameof(requests));
+        }
+
+        var states = new FileDownloadState[requests.Count];
+        for (var i = 0; i < requests.Count; i++)
+        {
+            states[i] = new FileDownloadState
+            {
+                Request = requests[i],
+            };
+        }
+        var readOnlyStates = new ReadOnlyMemory<FileDownloadState>(states);
+
+        var requestConfiguration = new RequestConfiguration()
+        {
+            ConnectTimeout = GetConnectTimeoutMs(webProxy != null),
+            Proxy = webProxy,
+
+            KeepAlive = true,
+        };
+        using var socketsHttpHandler = GetSocketsHttpHandler(requestConfiguration);
+
+        var parallelOptions = new ParallelOptions
+        {
+            MaxDegreeOfParallelism = 4,
+            CancellationToken = cancellationToken,
+        };
+
+        await Parallel.ForEachAsync(Enumerable.Range(0, requests.Count), parallelOptions, async (index, parallelCancellationToken) =>
+        {
+            var request = requests[index];
+            var downloadOpt = new DownloadConfiguration()
+            {
+                RequestConfiguration = requestConfiguration,
+                // ReSharper disable once AccessToDisposedClosure
+                CustomHttpMessageHandlerFactory = () => socketsHttpHandler,
+            };
+            await using var downloader = new Downloader.DownloadService(downloadOpt);
+            downloader.DownloadStarted += (sender, value) =>
+            {
+                states[index] = states[index] with
+                {
+                    DownloadedBytes = 0,
+                    TotalBytes = value.TotalBytesToReceive,
+                    SpeedBytesPerSecond = 0,
+                    Completed = false,
+                };
+                onProgress.Invoke(readOnlyStates);
+            };
+            downloader.DownloadProgressChanged += (sender, value) =>
+            {
+                states[index] = states[index] with
+                {
+                    DownloadedBytes = value.ReceivedBytesSize,
+                    TotalBytes = value.TotalBytesToReceive,
+                    SpeedBytesPerSecond = value.BytesPerSecondSpeed,
+                    Completed = false,
+                };
+                onProgress.Invoke(readOnlyStates);
+            };
+            downloader.DownloadFileCompleted += (sender, value) =>
+            {
+                var newState = states[index] with { Completed = true };
+                if (value.Error != null)
+                {
+                    newState = newState with { Error = value.Error };
+                }
+                states[index] = newState;
+                onProgress.Invoke(readOnlyStates);
+            };
+            await downloader.DownloadFileTaskAsync(request.FileUrl, request.FilePath, parallelCancellationToken);
+        });
     }
 
     // https://github.com/bezzad/Downloader/blob/a75a6e431acd6cbba6293f7afdcf676544a09174/src/Downloader/SocketClient.cs#L45
@@ -213,7 +279,7 @@ public class DownloaderHelper
             PooledConnectionIdleTimeout = config.KeepAliveTimeout,
             PooledConnectionLifetime = Timeout.InfiniteTimeSpan,
             EnableMultipleHttp2Connections = true,
-            ConnectTimeout = TimeSpan.FromMilliseconds(config.ConnectTimeout)
+            ConnectTimeout = TimeSpan.FromMilliseconds(config.ConnectTimeout),
         };
 
         // Set up the SslClientAuthenticationOptions for custom certificate validation
@@ -266,4 +332,9 @@ public class DownloaderHelper
 
         return handler;
     }
+
+    private int GetConnectTimeoutMs(bool isProxy)
+    {
+        return (int)(isProxy ? Global.ProxyDownloadConnect : Global.DirectDownloadConnect).TotalMilliseconds;
+    }
 }

v2rayN/ServiceLib/Helper/HttpRequestHeadersHelper.cs

@@ -0,0 +1,88 @@
+namespace ServiceLib.Helper;
+
+public static class HttpRequestHeadersHelper
+{
+    public static bool TryParse(string? json, out Dictionary<string, string> headers)
+    {
+        headers = new(StringComparer.OrdinalIgnoreCase);
+        if (string.IsNullOrWhiteSpace(json))
+        {
+            return true;
+        }
+
+        try
+        {
+            using var document = JsonDocument.Parse(json);
+            if (document.RootElement.ValueKind != JsonValueKind.Object)
+            {
+                return false;
+            }
+
+            var parsed = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            using var request = new HttpRequestMessage { Content = new ByteArrayContent([]) };
+            foreach (var property in document.RootElement.EnumerateObject())
+            {
+                if (property.Value.ValueKind != JsonValueKind.String
+                    || !parsed.TryAdd(property.Name, property.Value.GetString()!)
+                    || !TryAddHeader(request, property.Name, parsed[property.Name]))
+                {
+                    return false;
+                }
+            }
+
+            headers = parsed;
+            return true;
+        }
+        catch (Exception ex) when (ex is JsonException or ArgumentException or FormatException)
+        {
+            return false;
+        }
+    }
+
+    public static HttpMessageHandler CreateHandler(HttpMessageHandler innerHandler, IReadOnlyDictionary<string, string>? headers)
+    {
+        return headers is { Count: > 0 } ? new RequestHeadersHandler(innerHandler, headers) : innerHandler;
+    }
+
+    private static bool TryAddHeader(HttpRequestMessage request, string name, string value)
+    {
+        if (value.Any(c => char.IsControl(c) && c != '\t'))
+        {
+            return false;
+        }
+
+        return request.Headers.TryAddWithoutValidation(name, value)
+            || request.Content!.Headers.TryAddWithoutValidation(name, value);
+    }
+
+    private sealed class RequestHeadersHandler(HttpMessageHandler innerHandler, IReadOnlyDictionary<string, string> headers)
+        : DelegatingHandler(innerHandler)
+    {
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            using var customHeaders = new HttpRequestMessage { Content = new ByteArrayContent([]) };
+            foreach (var header in headers)
+            {
+                if (!TryAddHeader(customHeaders, header.Key, header.Value))
+                {
+                    throw new FormatException(ResUI.SubRequestHeadersInvalid);
+                }
+            }
+
+            // Apply after each downloader's defaults, replacing headers without changing their values.
+            foreach (var header in customHeaders.Headers.NonValidated)
+            {
+                request.Headers.Remove(header.Key);
+                request.Headers.TryAddWithoutValidation(header.Key, header.Value);
+            }
+            foreach (var header in customHeaders.Content.Headers.NonValidated)
+            {
+                request.Content ??= new ByteArrayContent([]);
+                request.Content.Headers.Remove(header.Key);
+                request.Content.Headers.TryAddWithoutValidation(header.Key, header.Value);
+            }
+
+            return base.SendAsync(request, cancellationToken);
+        }
+    }
+}

v2rayN/ServiceLib/Manager/CertPemManager.cs

@@ -28,14 +28,13 @@ public class CertPemManager
     ///     Get certificate in PEM format from a server with CA pinning validation
     /// </summary>
     public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName,
-        List<string>? verifyPeerCertByName = null, int timeout = 4)
+        List<string>? verifyPeerCertByName = null)
     {
         try
         {
             var (domain, _, port, _) = Utils.ParseUrl(target);
 
-            using var cts = new CancellationTokenSource();
+            using var cts = new CancellationTokenSource(Global.LocalFetch);
-            cts.CancelAfter(TimeSpan.FromSeconds(timeout));
 
             using var client = new TcpClient();
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
@@ -63,8 +62,8 @@ public class CertPemManager
         }
         catch (OperationCanceledException)
         {
-            Logging.SaveLog(_tag, new TimeoutException($"Connection timeout after {timeout} seconds"));
+            Logging.SaveLog(_tag, new TimeoutException($"Connection timeout after {Global.LocalFetch.TotalSeconds} seconds"));
-            return (null, $"Connection timeout after {timeout} seconds");
+            return (null, $"Connection timeout after {Global.LocalFetch.TotalSeconds} seconds");
         }
         catch (Exception ex)
         {
@@ -77,15 +76,14 @@ public class CertPemManager
     ///     Get certificate chain in PEM format from a server with CA pinning validation
     /// </summary>
     public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName,
-        List<string>? verifyPeerCertByName = null, int timeout = 4)
+        List<string>? verifyPeerCertByName = null)
     {
         var pemList = new List<string>();
         try
         {
             var (domain, _, port, _) = Utils.ParseUrl(target);
 
-            using var cts = new CancellationTokenSource();
+            using var cts = new CancellationTokenSource(Global.LocalFetch);
-            cts.CancelAfter(TimeSpan.FromSeconds(timeout));
 
             using var client = new TcpClient();
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
@@ -116,8 +114,8 @@ public class CertPemManager
         }
         catch (OperationCanceledException)
         {
-            Logging.SaveLog(_tag, new TimeoutException($"Connection timeout after {timeout} seconds"));
+            Logging.SaveLog(_tag, new TimeoutException($"Connection timeout after {Global.LocalFetch.TotalSeconds} seconds"));
-            return (pemList, $"Connection timeout after {timeout} seconds");
+            return (pemList, $"Connection timeout after {Global.LocalFetch.TotalSeconds} seconds");
         }
         catch (Exception ex)
         {
@@ -281,6 +279,37 @@ public class CertPemManager
         }
     }
 
+    public static string GetLeafCertSha256Thumbprint(string pemCertChain, bool includeColon = false)
+    {
+        var certs = ParsePemChain(pemCertChain);
+        if (certs.Count == 0)
+        {
+            return string.Empty;
+        }
+        foreach (var certStr in certs)
+        {
+            try
+            {
+                var cert = X509Certificate2.CreateFromPem(certStr);
+                var extension = cert.Extensions
+                    .OfType<X509BasicConstraintsExtension>()
+                    .FirstOrDefault();
+                var isCa = extension?.CertificateAuthority == true;
+                if (isCa)
+                {
+                    continue;
+                }
+                var thumbprint = cert.GetCertHashString(HashAlgorithmName.SHA256);
+                return includeColon ? string.Join(":", thumbprint.Chunk(2).Select(c => new string(c))) : thumbprint;
+            }
+            catch
+            {
+                // Ignore
+            }
+        }
+        return string.Empty;
+    }
+
     private static readonly Lazy<X509Certificate2Collection> _chromeRootCerts = new(() =>
     {
         var pemText = EmbedUtils.GetEmbedText(Global.ChromeRootCertFileName);

v2rayN/ServiceLib/Manager/ClashApiManager.cs

@@ -1,113 +1,104 @@
-using static ServiceLib.Models.Dto.ClashProxies;
-
 namespace ServiceLib.Manager;
 
 public sealed class ClashApiManager
 {
+    private const string _tag = "ClashApiManager";
     private static readonly Lazy<ClashApiManager> instance = new(() => new());
     public static ClashApiManager Instance => instance.Value;
 
-    private static readonly string _tag = "ClashApiHandler";
+    private static string ApiUrl => $"{Global.HttpProtocol}{Global.Loopback}:{AppManager.Instance.StatePort2}";
-    private Dictionary<string, ProxiesItem>? _proxies;
-    public Dictionary<string, object> ProfileContent { get; set; }
 
-    public async Task<Tuple<ClashProxies, ClashProviders>?> GetClashProxiesAsync()
+    public async Task<ClashItem?> GetProxies()
     {
         for (var i = 0; i < 3; i++)
         {
-            var url = $"{GetApiUrl()}/proxies";
+            var url = $"{ApiUrl}/proxies";
-            var result = await HttpClientHelper.Instance.TryGetAsync(url);
+            var resultTask = HttpClientHelper.Instance.TryGetAsync(url);
-            var clashProxies = JsonUtils.Deserialize<ClashProxies>(result);
 
-            var url2 = $"{GetApiUrl()}/providers/proxies";
+            var url2 = $"{ApiUrl}/providers/proxies";
-            var result2 = await HttpClientHelper.Instance.TryGetAsync(url2);
+            var result2Task = HttpClientHelper.Instance.TryGetAsync(url2);
+
+            await Task.WhenAll(resultTask, result2Task);
+
+            var result = await resultTask;
+            var result2 = await result2Task;
+            var clashProxies = JsonUtils.Deserialize<ClashProxies>(result);
             var clashProviders = JsonUtils.Deserialize<ClashProviders>(result2);
 
-            if (clashProxies != null || clashProviders != null)
+            if (clashProxies is null && clashProviders is null)
             {
-                _proxies = clashProxies?.proxies;
+                await Task.Delay(2000);
-                return new Tuple<ClashProxies, ClashProviders>(clashProxies, clashProviders);
+                continue;
             }
 
-            await Task.Delay(2000);
+            var item = new ClashItem();
+            if (clashProxies?.proxies is { Count: > 0 } proxies)
+            {
+                item = item with { Proxies = proxies };
+            }
+            if (clashProviders.providers is { Count: > 0 } providers)
+            {
+                foreach (var provider in providers)
+                {
+                    foreach (var proxy in provider.Value.proxies ?? [])
+                    {
+                        if (string.IsNullOrEmpty(proxy.name)
+                            || !item.Proxies.TryAdd(proxy.name, proxy))
+                        {
+                            continue;
+                        }
+                        item.ProviderIndexMap.Add(proxy.name, provider.Key);
+                    }
+                }
+            }
+
+            return item;
         }
 
         return null;
     }
 
-    public void ClashProxiesDelayTest(bool blAll, List<ClashProxyModel> lstProxy, Func<ClashProxyModel?, string, Task> updateFunc)
+    public async Task<int> TestDelay(string name, ClashItem? clashItem)
     {
-        Task.Run(async () =>
+        if (clashItem?.ProviderIndexMap.TryGetValue(name, out var providerName) == true)
         {
-            if (blAll)
+            return await TestProviderProxyDelay(name, providerName);
-            {
+        }
-                if (_proxies == null)
+        return await TestProxyDelay(name);
-                {
-                    await GetClashProxiesAsync();
-                }
-                lstProxy = [];
-                lstProxy.AddRange(from kv in _proxies ?? []
-                                  where !Global.notAllowTestType.Contains(kv.Value.type?.ToLower())
-                                  select new ClashProxyModel()
-                                  {
-                                      Name = kv.Value.name,
-                                      Type = kv.Value.type?.ToLower(),
-                                  });
-            }
-
-            if (lstProxy is not { Count: > 0 })
-            {
-                return;
-            }
-            var urlBase = $"{GetApiUrl()}/proxies";
-            urlBase += @"/{0}/delay?timeout=10000&url=" + AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl;
-
-            var tasks = new List<Task>();
-            foreach (var it in lstProxy)
-            {
-                if (Global.notAllowTestType.Contains(it.Type.ToLower()))
-                {
-                    continue;
-                }
-                var name = it.Name;
-                var url = string.Format(urlBase, name);
-                tasks.Add(Task.Run(async () =>
-                {
-                    var result = await HttpClientHelper.Instance.TryGetAsync(url);
-                    await updateFunc?.Invoke(it, result);
-                }));
-            }
-            await Task.WhenAll(tasks);
-            await Task.Delay(1000);
-            await updateFunc?.Invoke(null, "");
-        });
     }
 
-    public List<ProxiesItem>? GetClashProxyGroups()
+    private async Task<int> TestProxyDelay(string name)
+    {
+        var url = $"{ApiUrl}/proxies/{Utils.UrlEncode(name)}/delay?timeout=10000&url=" +
+                  Utils.UrlEncode(AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl);
+        return await SendTestRequest(url);
+    }
+
+    private async Task<int> TestProviderProxyDelay(string name, string providerName)
+    {
+        var url =
+            $"{ApiUrl}/providers/proxies/{Utils.UrlEncode(providerName)}/{Utils.UrlEncode(name)}/healthcheck?timeout=10000&url=" +
+            Utils.UrlEncode(AppManager.Instance.Config.SpeedTestItem.SpeedPingTestUrl);
+        return await SendTestRequest(url);
+    }
+
+    private async Task<int> SendTestRequest(string url)
+    {
+        var result = await HttpClientHelper.Instance.TryGetAsync(url);
+        var jsonObject = JsonUtils.ParseJson(result) as JsonObject;
+        return jsonObject?["delay"] is { } n && n.GetValueKind() == JsonValueKind.Number &&
+               n.GetValue<JsonElement>().TryGetInt32(out var v)
+            ? v
+            : -1;
+    }
+
+    public async Task SetActiveProxy(string groupName, string nodeName)
     {
         try
         {
-            var fileContent = ProfileContent;
+            var url = $"{ApiUrl}/proxies/{Utils.UrlEncode(groupName)}";
-            if (fileContent is null || fileContent?.ContainsKey("proxy-groups") == false)
-            {
-                return null;
-            }
-            return JsonUtils.Deserialize<List<ProxiesItem>>(JsonUtils.Serialize(fileContent["proxy-groups"]));
-        }
-        catch (Exception ex)
-        {
-            Logging.SaveLog(_tag, ex);
-            return null;
-        }
-    }
-
-    public async Task ClashSetActiveProxy(string name, string nameNode)
-    {
-        try
-        {
-            var url = $"{GetApiUrl()}/proxies/{name}";
             var headers = new Dictionary<string, string>();
-            headers.Add("name", nameNode);
+            headers.Add("name", nodeName);
             await HttpClientHelper.Instance.PutAsync(url, headers);
         }
         catch (Exception ex)
@@ -116,39 +107,67 @@ public sealed class ClashApiManager
         }
     }
 
-    public async Task ClashConfigUpdate(Dictionary<string, string> headers)
+    public async Task UpdateClashMode(string mode)
     {
-        if (_proxies == null)
+        var headers = new Dictionary<string, string>
         {
-            return;
+            { "mode", mode },
-        }
+        };
+        await UpdateConfig(headers);
+    }
 
-        var urlBase = $"{GetApiUrl()}/configs";
+    public async Task UpdateConfig(Dictionary<string, string> headers)
+    {
+        var urlBase = $"{ApiUrl}/configs";
 
         await HttpClientHelper.Instance.PatchAsync(urlBase, headers);
     }
 
-    public async Task ClashConfigReload(string filePath)
+    public async Task<List<string>> GetClashModes()
     {
-        await ClashConnectionClose("");
+        var jsonNode = await GetConfig();
-        try
+        if ((jsonNode?["mode-list"] ?? jsonNode?["modes"]) is not JsonArray { Count: > 0 } modesArray)
         {
-            var url = $"{GetApiUrl()}/configs?force=true";
+            return [];
-            var headers = new Dictionary<string, string>();
-            headers.Add("path", filePath);
-            await HttpClientHelper.Instance.PutAsync(url, headers);
         }
-        catch (Exception ex)
+        var modes = new List<string>();
+        foreach (var mode in modesArray)
         {
-            Logging.SaveLog(_tag, ex);
+            if (mode is JsonValue jsonValue && jsonValue.GetValueKind() == JsonValueKind.String)
+            {
+                modes.Add(jsonValue.GetValue<string>());
+            }
         }
+        return modes;
     }
 
-    public async Task<ClashConnections?> GetClashConnectionsAsync()
+    public async Task<string?> GetClashMode()
+    {
+        var jsonNode = await GetConfig();
+        if (jsonNode["mode"] is not JsonValue jsonValue || jsonValue.GetValueKind() != JsonValueKind.String)
+        {
+            return null;
+        }
+        return jsonValue.GetValue<string>();
+    }
+
+    public async Task<JsonObject> GetConfig()
+    {
+        var url = $"{ApiUrl}/configs";
+        var result = await HttpClientHelper.Instance.TryGetAsync(url);
+        var jsonNode = JsonUtils.ParseJson(result);
+        if (jsonNode is not JsonObject jsonObject)
+        {
+            return new JsonObject();
+        }
+        return jsonObject;
+    }
+
+    public async Task<ClashConnections?> GetConnections()
     {
         try
         {
-            var url = $"{GetApiUrl()}/connections";
+            var url = $"{ApiUrl}/connections";
             var result = await HttpClientHelper.Instance.TryGetAsync(url);
             var clashConnections = JsonUtils.Deserialize<ClashConnections>(result);
 
@@ -162,11 +181,11 @@ public sealed class ClashApiManager
         return null;
     }
 
-    public async Task ClashConnectionClose(string id)
+    public async Task CloseConnection(string id)
     {
         try
         {
-            var url = $"{GetApiUrl()}/connections/{id}";
+            var url = $"{ApiUrl}/connections/{id}";
             await HttpClientHelper.Instance.DeleteAsync(url);
         }
         catch (Exception ex)
@@ -174,9 +193,4 @@ public sealed class ClashApiManager
             Logging.SaveLog(_tag, ex);
         }
     }
-
-    private string GetApiUrl()
-    {
-        return $"{Global.HttpProtocol}{Global.Loopback}:{AppManager.Instance.StatePort2}";
-    }
 }

v2rayN/ServiceLib/Manager/CoreInfoManager.cs

@@ -229,6 +229,7 @@ public sealed class CoreInfoManager
                     DownloadUrlLinuxLoong64 = urlSingbox + "/download/{0}/sing-box-{1}-linux-loong64.tar.gz",
                     DownloadUrlOSX64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-amd64.tar.gz",
                     DownloadUrlOSXArm64 = urlSingbox + "/download/{0}/sing-box-{1}-darwin-arm64.tar.gz",
+                    LockedMaxVersion = new SemanticVersion(1, 14, int.MaxValue),
                     Match = "sing-box",
                     VersionArg = "version",
                 },

v2rayN/ServiceLib/Manager/CoreManager.cs

@@ -216,7 +216,7 @@ public class CoreManager
         await _updateFunc?.Invoke(notify, msg);
     }
 
-    private static async Task WaitForProxyPort(CoreConfigContext? preContext, int timeoutMs = 5000)
+    private static async Task WaitForProxyPort(CoreConfigContext? preContext)
     {
         if (preContext is null)
         {
@@ -227,7 +227,7 @@ public class CoreManager
             return;
         }
 
-        using var rootCts = new CancellationTokenSource(TimeSpan.FromMilliseconds(timeoutMs));
+        using var rootCts = new CancellationTokenSource(Global.LocalFetch);
         var rootToken = rootCts.Token;
 
         var port = preContext.Node.Port;

v2rayN/ServiceLib/Manager/GroupProfileManager.cs

@@ -119,7 +119,7 @@ public class GroupProfileManager
                 p != null &&
                 p.IsValid() &&
                 (!p.ConfigType.IsComplexType() || p.ConfigType == EConfigType.Outbound) &&
-                (extra.Filter.IsNullOrEmpty() || Regex.IsMatch(p.Remarks, extra.Filter))
+                Utils.IsRegexMatch(p.Remarks, extra.Filter)
             )
             .ToList() ?? [];
     }

v2rayN/ServiceLib/Manager/TaskManager.cs

@@ -12,7 +12,11 @@ public class TaskManager
         _config = config;
         _updateFunc = updateFunc;
 
-        Task.Run(ScheduledTasks);
+        _ = Task.Factory.StartNew(
+            ScheduledTasks,
+            CancellationToken.None,
+            TaskCreationOptions.LongRunning,
+            TaskScheduler.Default);
     }
 
     private async Task ScheduledTasks()
@@ -57,8 +61,8 @@ public class TaskManager
                 //Logging.SaveLog("Execute delete expired files");
 
                 FileUtils.DeleteExpiredFiles(Utils.GetBinConfigPath(), DateTime.Now.AddHours(-1), "Test");
-                FileUtils.DeleteExpiredFiles(Utils.GetLogPath(), DateTime.Now.AddMonths(-1));
+                FileUtils.DeleteExpiredFiles(Utils.GetLogPath(), DateTime.Now.AddDays(-7));
-                FileUtils.DeleteExpiredFiles(Utils.GetTempPath(), DateTime.Now.AddMonths(-1));
+                FileUtils.DeleteExpiredFiles(Utils.GetTempPath(), DateTime.Now.AddDays(-7));
 
                 try
                 {
@@ -136,7 +140,7 @@ public class TaskManager
 
         var updateService = new UpdateService(_config, async (success, msg) => await Task.CompletedTask);
 
-        var msgs = await updateService.CheckHasUpdateOnlyAll(_config.CheckUpdateItem.CheckPreReleaseUpdate);
+        var msgs = await updateService.CheckHasUpdateOnlyAll(_config.CheckUpdateItem.CheckPreReleaseUpdate, _config.CheckUpdateItem.UpdateViaProxy);
         foreach (var msg in msgs)
         {
             await _updateFunc?.Invoke(false, msg);

v2rayN/ServiceLib/Models/Configs/ConfigItems.cs

@@ -209,12 +209,11 @@ public class HysteriaItem
 [Serializable]
 public class ClashUIItem
 {
-    public ERuleMode RuleMode { get; set; }
     public bool EnableIPv6 { get; set; }
     public bool EnableMixinContent { get; set; }
     public int ProxiesSorting { get; set; }
     public bool ProxiesAutoRefresh { get; set; }
-    public int ProxiesAutoDelayTestInterval { get; set; } = 10;
+    public int ProxiesRefreshInterval { get; set; } = 2;
     public bool ConnectionsAutoRefresh { get; set; }
     public int ConnectionsRefreshInterval { get; set; } = 2;
     public List<ColumnItem> ConnectionsColumnItem { get; set; }
@@ -244,6 +243,7 @@ public class WebDavItem
 public class CheckUpdateItem
 {
     public bool CheckPreReleaseUpdate { get; set; }
+    public bool UpdateViaProxy { get; set; } = true;
     public List<string>? SelectedCoreTypes { get; set; }
 }
 
@@ -279,6 +279,7 @@ public class SimpleDNSItem
     public bool? GlobalFakeIp { get; set; }
     public string? FakeIPRange { get; set; }
     public bool? BlockBindingQuery { get; set; }
+    public bool? BlockAAAAQuery { get; set; }
     public string? DirectDNS { get; set; }
     public string? RemoteDNS { get; set; }
     public string? BootstrapDNS { get; set; }

v2rayN/ServiceLib/Models/CoreConfigs/CoreConfigContext.cs

@@ -25,6 +25,10 @@ public record CoreConfigContext
     public bool IsWindows { get; init; }
     public bool IsMacOS { get; init; }
 
+    // Defaults to true so that a context built without this flag keeps routing IPv6 into the
+    // tunnel; only a positive detection of the host having no global IPv6 address turns it off.
+    public bool HasGlobalIPv6Address { get; init; } = true;
+
     // Generation Context
     public Dictionary<object, string> CustomOutboundMap { get; init; } = new();
 }

v2rayN/ServiceLib/Models/CoreConfigs/CoreInfo.cs

@@ -16,6 +16,7 @@ public class CoreInfo
     public string? DownloadUrlLinuxLoong64 { get; set; }
     public string? DownloadUrlOSX64 { get; set; }
     public string? DownloadUrlOSXArm64 { get; set; }
+    public SemanticVersion? LockedMaxVersion { get; set; }
     public string? Match { get; set; }
     public string? VersionArg { get; set; }
     public bool AbsolutePath { get; set; }

v2rayN/ServiceLib/Models/CoreConfigs/SingboxConfig.cs

@@ -8,6 +8,7 @@ public class SingboxConfig
     public List<Outbound4Sbox> outbounds { get; set; }
     public List<Endpoints4Sbox>? endpoints { get; set; }
     public Route4Sbox route { get; set; }
+    public List<HttpClient4Sbox>? http_clients { get; set; }
     public Experimental4Sbox? experimental { get; set; }
 }
 
@@ -24,6 +25,7 @@ public class Dns4Sbox
     public List<Server4Sbox> servers { get; set; }
     public List<Rule4Sbox> rules { get; set; }
     public string? final { get; set; }
+    public bool? optimistic { get; set; }
     public string? strategy { get; set; }
     public bool? disable_cache { get; set; }
     public bool? disable_expire { get; set; }
@@ -94,6 +96,11 @@ public class Rule4Sbox
     public bool? rule_set_ip_cidr_match_source { get; set; }
     public bool? rule_set_ip_cidr_accept_empty { get; set; }
     public bool? tls_record_fragment { get; set; }
+    public string? preferred_by { get; set; }
+    public string? match_response { get; set; } // or bool
+    public string? tag { get; set; }
+    public bool? race { get; set; }
+    public bool? speculative { get; set; }
 }
 
 [Serializable]
@@ -108,7 +115,6 @@ public class Inbound4Sbox
     public int? mtu { get; set; }
     public bool? auto_route { get; set; }
     public bool? strict_route { get; set; }
-    public bool? endpoint_independent_nat { get; set; }
     public string? stack { get; set; }
     public List<User4Sbox> users { get; set; }
     public List<string>? route_exclude_address { get; set; }
@@ -318,10 +324,12 @@ public class Ruleset4Sbox
     public string? format { get; set; }
     public string? path { get; set; }
     public string? url { get; set; }
-    public string? download_detour { get; set; }
+    public string? http_client { get; set; }
     public string? update_interval { get; set; }
 }
 
+public class HttpClient4Sbox : BaseServer4Sbox;
+
 public abstract class DialFields4Sbox
 {
     public string? detour { get; set; }

v2rayN/ServiceLib/Models/CoreConfigs/V2rayConfig.cs

@@ -75,8 +75,6 @@ public class Inboundsettings4Ray
 
     public string? address { get; set; }
 
-    public List<UsersItem4Ray>? clients { get; set; }
-
     public string? decryption { get; set; }
 
     public bool? allowTransparent { get; set; }
@@ -96,21 +94,6 @@ public class Inboundsettings4Ray
     public List<string>? dns { get; set; }
 }
 
-public class UsersItem4Ray
-{
-    public string? id { get; set; }
-
-    public int? alterId { get; set; }
-
-    public string? email { get; set; }
-
-    public string? security { get; set; }
-
-    public string? encryption { get; set; }
-
-    public string? flow { get; set; }
-}
-
 public class Sniffing4Ray
 {
     public bool enabled { get; set; }
@@ -137,10 +120,6 @@ public class Outbounds4Ray
 
 public class Outboundsettings4Ray
 {
-    public List<VnextItem4Ray>? vnext { get; set; }
-
-    public List<ServersItem4Ray>? servers { get; set; }
-
     public Response4Ray? response { get; set; }
 
     public int? userLevel { get; set; }
@@ -172,29 +151,18 @@ public class Outboundsettings4Ray
     public int? workers { get; set; }
 
     public int? version { get; set; }
-}
 
-public class WireguardPeer4Ray
+    public List<string>? remoteDNS { get; set; }
-{
-    public string endpoint { get; set; }
-    public string publicKey { get; set; }
-    public string? preSharedKey { get; set; }
-}
 
-public class VnextItem4Ray
+    public string? id { get; set; }
-{
-    public string address { get; set; }
 
-    public int port { get; set; }
+    public int? alterId { get; set; }
 
-    public List<UsersItem4Ray> users { get; set; }
+    public string? security { get; set; }
-}
 
-public class ServersItem4Ray
+    public string? encryption { get; set; }
-{
-    public string email { get; set; }
 
-    public string address { get; set; }
+    public string? flow { get; set; }
 
     public string? method { get; set; }
 
@@ -202,24 +170,14 @@ public class ServersItem4Ray
 
     public string? password { get; set; }
 
-    public int port { get; set; }
-
-    public int? level { get; set; }
-
-    public string flow { get; set; }
-
     public bool? uot { get; set; }
-
-    public List<SocksUsersItem4Ray> users { get; set; }
 }
 
-public class SocksUsersItem4Ray
+public class WireguardPeer4Ray
 {
-    public string user { get; set; }
+    public string endpoint { get; set; }
-
+    public string publicKey { get; set; }
-    public string pass { get; set; }
+    public string? preSharedKey { get; set; }
-
-    public int? level { get; set; }
 }
 
 public class Mux4Ray
@@ -241,6 +199,7 @@ public class Dns4Ray
     public List<object> servers { get; set; }
     public bool? serveStale { get; set; }
     public bool? enableParallelQuery { get; set; }
+    public string? queryStrategy { get; set; }
     public string? tag { get; set; }
 }
 

v2rayN/ServiceLib/Models/Dto/AvailabilityCheckResult.cs

@@ -0,0 +1,6 @@
+namespace ServiceLib.Models.Dto;
+
+public sealed record AvailabilityCheckResult(int Time, string Ip)
+{
+    public string? GetValidIp() => Ip == Global.None ? null : Ip;
+}

v2rayN/ServiceLib/Models/Dto/ClashConnectionModel.cs

@@ -13,4 +13,5 @@ public class ClashConnectionModel
     public double Time { get; set; }
     public string? Elapsed { get; set; }
     public string? Chain { get; set; }
+    public string? ProcessPath { get; set; }
 }

v2rayN/ServiceLib/Models/Dto/ClashConnections.cs

@@ -1,36 +1,37 @@
 namespace ServiceLib.Models.Dto;
 
-public class ClashConnections
+public record ClashConnections
 {
-    public ulong downloadTotal { get; set; }
+    public ulong downloadTotal { get; init; }
-    public ulong uploadTotal { get; set; }
+    public ulong uploadTotal { get; init; }
-    public List<ConnectionItem>? connections { get; set; }
+    public List<ConnectionItem>? connections { get; init; }
 }
 
-public class ConnectionItem
+public record ConnectionItem
 {
-    public string? id { get; set; }
+    public string? id { get; init; }
-    public MetadataItem? metadata { get; set; }
+    public MetadataItem? metadata { get; init; }
-    public ulong upload { get; set; }
+    public ulong upload { get; init; }
-    public ulong download { get; set; }
+    public ulong download { get; init; }
-    public DateTime start { get; set; }
+    public DateTime start { get; init; }
-    public List<string>? chains { get; set; }
+    public List<string>? chains { get; init; }
-    public string? rule { get; set; }
+    public string? rule { get; init; }
-    public string? rulePayload { get; set; }
+    public string? rulePayload { get; init; }
 }
 
-public class MetadataItem
+public record MetadataItem
 {
-    public string? network { get; set; }
+    public string? network { get; init; }
-    public string? type { get; set; }
+    public string? type { get; init; }
-    public string? sourceIP { get; set; }
+    public string? sourceIP { get; init; }
-    public string? destinationIP { get; set; }
+    public string? destinationIP { get; init; }
-    public string? sourcePort { get; set; }
+    public string? sourcePort { get; init; }
-    public string? destinationPort { get; set; }
+    public string? destinationPort { get; init; }
-    public string? host { get; set; }
+    public string? host { get; init; }
-    public string? nsMode { get; set; }
+    public string? nsMode { get; init; }
-    public object? uid { get; set; }
+    public object? uid { get; init; }
-    public string? process { get; set; }
+    public string? process { get; init; }
-    public string? processPath { get; set; }
+    public string? processPath { get; init; }
-    public string? remoteDestination { get; set; }
+    public string? remoteDestination { get; init; }
+    public string? sniffHost { get; init; }
 }

v2rayN/ServiceLib/Models/Dto/ClashItem.cs

@@ -0,0 +1,44 @@
+namespace ServiceLib.Models.Dto;
+
+public record ClashItem
+{
+    public Dictionary<string, ClashProxy> Proxies { get; init; } = [];
+    public Dictionary<string, string> ProviderIndexMap { get; init; } = [];
+
+    public bool IsEmpty() => Proxies.Count == 0;
+}
+
+public record ClashProxy
+{
+    public List<string>? all { get; init; }
+    public List<HistoryItem>? history { get; init; }
+    public string? name { get; init; }
+    public string? type { get; init; }
+    public bool udp { get; init; }
+    public string? now { get; init; }
+    public int delay { get; init; }
+
+    public record HistoryItem
+    {
+        public string? time { get; init; }
+        public int delay { get; init; }
+    }
+}
+
+public record ClashProvider
+{
+    public string? name { get; init; }
+    public List<ClashProxy>? proxies { get; init; }
+    public string? type { get; init; }
+    public string? vehicleType { get; init; }
+}
+
+public record ClashProxies
+{
+    public Dictionary<string, ClashProxy> proxies { get; init; } = [];
+}
+
+public record ClashProviders
+{
+    public Dictionary<string, ClashProvider> providers { get; init; } = [];
+}

v2rayN/ServiceLib/Models/Dto/ClashProviders.cs

@@ -1,16 +0,0 @@
-using static ServiceLib.Models.Dto.ClashProxies;
-
-namespace ServiceLib.Models.Dto;
-
-public class ClashProviders
-{
-    public Dictionary<string, ProvidersItem>? providers { get; set; }
-
-    public class ProvidersItem
-    {
-        public string? name { get; set; }
-        public List<ProxiesItem>? proxies { get; set; }
-        public string? type { get; set; }
-        public string? vehicleType { get; set; }
-    }
-}

v2rayN/ServiceLib/Models/Dto/ClashProxies.cs

@@ -1,23 +0,0 @@
-namespace ServiceLib.Models.Dto;
-
-public class ClashProxies
-{
-    public Dictionary<string, ProxiesItem>? proxies { get; set; }
-
-    public class ProxiesItem
-    {
-        public List<string>? all { get; set; }
-        public List<HistoryItem>? history { get; set; }
-        public string? name { get; set; }
-        public string? type { get; set; }
-        public bool udp { get; set; }
-        public string? now { get; set; }
-        public int delay { get; set; }
-    }
-
-    public class HistoryItem
-    {
-        public string? time { get; set; }
-        public int delay { get; set; }
-    }
-}

v2rayN/ServiceLib/Models/Dto/ClashProxyModel.cs

@@ -3,9 +3,9 @@ namespace ServiceLib.Models.Dto;
 [Serializable]
 public partial class ClashProxyModel : ReactiveObject
 {
-    public string? Name { get; set; }
+    public string Name { get; set; }
 
-    public string? Type { get; set; }
+    public string Type { get; set; }
 
     public string? Now { get; set; }
 

v2rayN/ServiceLib/Models/Dto/FileDownloadState.cs

@@ -0,0 +1,22 @@
+namespace ServiceLib.Models.Dto;
+
+public record FileDownloadState
+{
+    public required FileDownloadRequest Request { get; init; }
+    public long DownloadedBytes { get; init; } = 0;
+    public long TotalBytes { get; init; } = 0;
+    public double SpeedBytesPerSecond { get; init; } = 0;
+    public bool Completed { get; init; } = false;
+
+    public Exception? Error { get; init; }
+    public bool IsFailed => Error != null;
+}
+
+public record FileDownloadRequest
+{
+    public required string FileUrl { get; init; }
+    public required string FilePath { get; init; }
+    public string? DisplayFileName { get; init; }
+
+    public string FileName => DisplayFileName ?? Path.GetFileName(FilePath);
+}

v2rayN/ServiceLib/Models/Dto/LanguageOption.cs

@@ -0,0 +1,3 @@
+namespace ServiceLib.Models.Dto;
+
+public sealed record LanguageOption(string Value, string Display);

v2rayN/ServiceLib/Models/Dto/SemanticVersion.cs

@@ -1,18 +1,20 @@
 namespace ServiceLib.Models.Dto;
 
-public class SemanticVersion
+public class SemanticVersion : IEquatable<SemanticVersion>, IComparable
 {
+    private readonly string? build;
     private readonly int major;
     private readonly int minor;
     private readonly int patch;
-    private readonly string version;
+    private readonly string? prerelease;
+    private readonly string raw;
 
     public SemanticVersion(int major, int minor, int patch)
     {
         this.major = major;
         this.minor = minor;
         this.patch = patch;
-        version = $"{major}.{minor}.{patch}";
+        raw = $"{major}.{minor}.{patch}";
     }
 
     public SemanticVersion(string? version)
@@ -24,26 +26,41 @@ public class SemanticVersion
                 major = 0;
                 minor = 0;
                 patch = 0;
+                raw = $"{major}.{minor}.{patch}";
                 return;
             }
-            this.version = version.RemovePrefix('v');
+            raw = version;
 
-            var parts = this.version.Split('.');
+            var span = version.StartsWith("v", StringComparison.OrdinalIgnoreCase)
-            if (parts.Length == 2)
+                ? version.AsSpan(1)
+                : version.AsSpan();
+            var plusIdx = span.IndexOf('+');
+            var metadataSpan = plusIdx >= 0 ? span[(plusIdx + 1)..] : [];
+            var leftOfPlus = plusIdx >= 0 ? span[..plusIdx] : span;
+            var dashIdx = leftOfPlus.IndexOf('-');
+            var versionSpan = dashIdx >= 0 ? leftOfPlus[..dashIdx] : leftOfPlus;
+            var preReleaseSpan = dashIdx >= 0 ? leftOfPlus[(dashIdx + 1)..] : [];
+
+            build = metadataSpan.Length > 0 ? metadataSpan.ToString() : null;
+            prerelease = preReleaseSpan.Length > 0 ? preReleaseSpan.ToString() : null;
+
+            var parts = versionSpan.ToString().Split('.');
+            switch (parts.Length)
             {
-                major = int.Parse(parts.First());
+                case 2:
-                minor = int.Parse(parts.Last());
+                    major = int.Parse(parts.First());
-                patch = 0;
+                    minor = int.Parse(parts.Last());
-            }
+                    patch = 0;
-            else if (parts.Length is 3 or 4)
+                    break;
-            {
+
-                major = int.Parse(parts[0]);
+                case 3 or 4:
-                minor = int.Parse(parts[1]);
+                    major = int.Parse(parts[0]);
-                patch = int.Parse(parts[2]);
+                    minor = int.Parse(parts[1]);
-            }
+                    patch = int.Parse(parts[2]);
-            else
+                    break;
-            {
+
-                throw new ArgumentException("Invalid version string");
+                default:
+                    throw new ArgumentException("Invalid version string");
             }
         }
         catch
@@ -51,135 +68,186 @@ public class SemanticVersion
             major = 0;
             minor = 0;
             patch = 0;
+            raw = $"{major}.{minor}.{patch}";
+        }
+    }
+
+    public bool Equals(SemanticVersion? other)
+    {
+        if (other is null)
+        {
+            return false;
+        }
+        if (ReferenceEquals(this, other))
+        {
+            return true;
+        }
+        return major == other.major && minor == other.minor && patch == other.patch && prerelease == other.prerelease;
+    }
+
+    public static bool TryParse(string? version, out SemanticVersion? result)
+    {
+        try
+        {
+            result = new SemanticVersion(version);
+            return true;
+        }
+        catch
+        {
+            result = null;
+            return false;
         }
     }
 
     public override bool Equals(object? obj)
     {
-        if (obj is SemanticVersion other)
+        return obj is SemanticVersion other && Equals(other);
-        {
-            return major == other.major && minor == other.minor && patch == other.patch;
-        }
-        else
-        {
-            return false;
-        }
     }
 
     public override int GetHashCode()
     {
-        return major.GetHashCode() ^ minor.GetHashCode() ^ patch.GetHashCode();
+        return HashCode.Combine(major, minor, patch, prerelease);
     }
 
-    /// <summary>
-    /// Use ToVersionString(string? prefix) instead if possible.
-    /// </summary>
-    /// <returns>major.minor.patch</returns>
     public override string ToString()
     {
-        return version;
+        return raw;
     }
 
-    public string ToVersionString(string? prefix = null)
+    public string ToStandardVersionString(string? prefix = null)
     {
-        if (prefix == null)
+        var sb = new StringBuilder();
+        if (!string.IsNullOrEmpty(prefix))
         {
-            return version;
+            sb.Append(prefix);
         }
-        else
+        sb.Append($"{major}.{minor}.{patch}");
+        if (!string.IsNullOrEmpty(prerelease))
         {
-            return $"{prefix}{version}";
+            sb.Append($"-{prerelease}");
         }
+        if (!string.IsNullOrEmpty(build))
+        {
+            sb.Append($"+{build}");
+        }
+        return sb.ToString();
     }
 
-    public static bool operator ==(SemanticVersion v1, SemanticVersion v2)
+    public static bool operator <(SemanticVersion left, SemanticVersion right)
-    { return v1.Equals(v2); }
+    {
+        return left.CompareTo(right) < 0;
+    }
 
-    public static bool operator !=(SemanticVersion v1, SemanticVersion v2)
+    public static bool operator >(SemanticVersion left, SemanticVersion right)
-    { return !v1.Equals(v2); }
+    {
+        return left.CompareTo(right) > 0;
+    }
 
-    public static bool operator >=(SemanticVersion v1, SemanticVersion v2)
+    public static bool operator <=(SemanticVersion left, SemanticVersion right)
-    { return v1.GreaterEquals(v2); }
+    {
+        return left.CompareTo(right) <= 0;
+    }
 
-    public static bool operator <=(SemanticVersion v1, SemanticVersion v2)
+    public static bool operator >=(SemanticVersion left, SemanticVersion right)
-    { return v1.LessEquals(v2); }
+    {
+        return left.CompareTo(right) >= 0;
+    }
 
     #region Private
 
-    private bool GreaterEquals(SemanticVersion other)
+    public int CompareTo(SemanticVersion other)
     {
-        if (major < other.major)
+        if (major != other.major)
         {
-            return false;
+            return major.CompareTo(other.major);
         }
-        else if (major > other.major)
+        if (minor != other.minor)
         {
-            return true;
+            return minor.CompareTo(other.minor);
         }
-        else
+        if (patch != other.patch)
         {
-            if (minor < other.minor)
+            return patch.CompareTo(other.patch);
+        }
+        return ComparePreRelease(prerelease, other.prerelease);
+    }
+
+    public int CompareTo(object? obj)
+    {
+        if (obj is null)
+        {
+            return 1;
+        }
+        if (obj is SemanticVersion other)
+        {
+            return CompareTo(other);
+        }
+        throw new ArgumentException("Object is not a SemanticVersion");
+    }
+
+    private static int ComparePreRelease(string? left, string? right)
+    {
+        if (string.IsNullOrEmpty(left) && string.IsNullOrEmpty(right))
+        {
+            return 0;
+        }
+        if (string.IsNullOrEmpty(left))
+        {
+            return 1;
+        }
+        if (string.IsNullOrEmpty(right))
+        {
+            return -1;
+        }
+
+        var leftSpan = left.AsSpan();
+        var rightSpan = right.AsSpan();
+        using var leftEnum = leftSpan.Split('.').GetEnumerator();
+        using var rightEnum = rightSpan.Split('.').GetEnumerator();
+
+        while (true)
+        {
+            var hasLeft = leftEnum.MoveNext();
+            var hasRight = rightEnum.MoveNext();
+
+            if (!hasLeft && !hasRight)
             {
-                return false;
+                return 0;
             }
-            else if (minor > other.minor)
+            if (!hasLeft)
             {
-                return true;
+                return -1;
             }
-            else
+            if (!hasRight)
             {
-                if (patch < other.patch)
+                return 1;
-                {
+            }
-                    return false;
+
-                }
+            var leftSegment = leftSpan[leftEnum.Current];
-                else if (patch > other.patch)
+            var rightSegment = rightSpan[rightEnum.Current];
-                {
+
-                    return true;
+            var segCmp = CompareSegment(leftSegment, rightSegment);
-                }
+            if (segCmp != 0)
-                else
+            {
-                {
+                return segCmp;
-                    return true;
-                }
             }
         }
     }
 
-    private bool LessEquals(SemanticVersion other)
+    private static int CompareSegment(ReadOnlySpan<char> left, ReadOnlySpan<char> right)
     {
-        if (major < other.major)
+        var leftIsNum = ulong.TryParse(left, out var leftNum);
+        var rightIsNum = ulong.TryParse(right, out var rightNum);
+
+        return (leftIsNum, rightIsNum) switch
         {
-            return true;
+            (true, true) => leftNum.CompareTo(rightNum),
-        }
+
-        else if (major > other.major)
+            (false, true) => 1,
-        {
+            (true, false) => -1,
-            return false;
+
-        }
+            (false, false) => left.SequenceCompareTo(right),
-        else
+        };
-        {
-            if (minor < other.minor)
-            {
-                return true;
-            }
-            else if (minor > other.minor)
-            {
-                return false;
-            }
-            else
-            {
-                if (patch < other.patch)
-                {
-                    return true;
-                }
-                else if (patch > other.patch)
-                {
-                    return false;
-                }
-                else
-                {
-                    return true;
-                }
-            }
-        }
     }
 
     #endregion Private

v2rayN/ServiceLib/Models/Entities/ProtocolExtraItem.cs

@@ -27,6 +27,7 @@ public record ProtocolExtraItem
     public string? WgInterfaceAddress { get; init; }
     public string? WgReserved { get; init; }
     public int? WgMtu { get; init; }
+    public string? WgDns { get; init; }
 
     // hysteria2
     public string? SalamanderPass { get; init; }

v2rayN/ServiceLib/Models/Entities/SubItem.cs

@@ -16,6 +16,8 @@ public class SubItem
 
     public string UserAgent { get; set; } = string.Empty;
 
+    public string? RequestHeaders { get; set; }
+
     public int Sort { get; set; }
 
     public string? Filter { get; set; }

v2rayN/ServiceLib/Resx/ResUI.Designer.cs

@@ -178,7 +178,7 @@ namespace ServiceLib.Resx {
         }
         
         /// <summary>
-        ///   查找类似 Failed to import custom configuration Configuration 的本地化字符串。
+        ///   查找类似 Failed to import configuration 的本地化字符串。
         /// </summary>
         public static string FailedImportedCustomServer {
             get {
@@ -268,7 +268,7 @@ namespace ServiceLib.Resx {
         }
         
         /// <summary>
-        ///   查找类似 Please browse to import Configuration configuration 的本地化字符串。
+        ///   查找类似 Please browse to import configuration 的本地化字符串。
         /// </summary>
         public static string FillServerAddressCustom {
             get {
@@ -555,6 +555,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 HTTP headers (JSON) 的本地化字符串。
+        /// </summary>
+        public static string LvRequestHeaders {
+            get {
+                return ResourceManager.GetString("LvRequestHeaders", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 Type 的本地化字符串。
         /// </summary>
@@ -987,6 +996,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Latency Test 的本地化字符串。
+        /// </summary>
+        public static string menuDelaytest {
+            get {
+                return ResourceManager.GetString("menuDelaytest", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 DNS Settings 的本地化字符串。
         /// </summary>
@@ -1401,15 +1419,6 @@ namespace ServiceLib.Resx {
             }
         }
         
-        /// <summary>
-        ///   查找类似 Latency Test 的本地化字符串。
-        /// </summary>
-        public static string menuProxiesDelaytest {
-            get {
-                return ResourceManager.GetString("menuProxiesDelaytest", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   查找类似 Part Node Latency Test 的本地化字符串。
         /// </summary>
@@ -2634,6 +2643,24 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Invalid HTTP headers. Use a JSON object with unique header names and string values. Header names and values must not contain line breaks. 的本地化字符串。
+        /// </summary>
+        public static string SubRequestHeadersInvalid {
+            get {
+                return ResourceManager.GetString("SubRequestHeadersInvalid", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Optional. Example: {&quot;X-hwid&quot;: &quot;my_device&quot;}. Values override default headers for all URLs in this group, including the subscription conversion service. 的本地化字符串。
+        /// </summary>
+        public static string SubRequestHeadersTips {
+            get {
+                return ResourceManager.GetString("SubRequestHeadersTips", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 For group please leave blank here 的本地化字符串。
         /// </summary>
@@ -2653,7 +2680,7 @@ namespace ServiceLib.Resx {
         }
         
         /// <summary>
-        ///   查找类似 Custom configuration Configuration imported successfully 的本地化字符串。
+        ///   查找类似 Custom configuration imported successfully 的本地化字符串。
         /// </summary>
         public static string SuccessfullyImportedCustomServer {
             get {
@@ -2769,6 +2796,24 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Block AAAA Queries 的本地化字符串。
+        /// </summary>
+        public static string TbBlockAAAAQueries {
+            get {
+                return ResourceManager.GetString("TbBlockAAAAQueries", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Block IPv6 queries when enabled 的本地化字符串。
+        /// </summary>
+        public static string TbBlockAAAAQueriesTips {
+            get {
+                return ResourceManager.GetString("TbBlockAAAAQueriesTips", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 Block SVCB and HTTPS Queries 的本地化字符串。
         /// </summary>
@@ -2779,7 +2824,7 @@ namespace ServiceLib.Resx {
         }
         
         /// <summary>
-        ///   查找类似 Block ECH and HTTP/3 availability checks when enabled 的本地化字符串。
+        ///   查找类似 Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray 的本地化字符串。
         /// </summary>
         public static string TbBlockSVCBHTTPSQueriesTips {
             get {
@@ -2997,6 +3042,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 DNS 的本地化字符串。
+        /// </summary>
+        public static string TbDNS {
+            get {
+                return ResourceManager.GetString("TbDNS", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 DNS Hosts: (&quot;domain1 ip1 ip2&quot; per line) 的本地化字符串。
         /// </summary>
@@ -4248,6 +4302,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Update via proxy 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsEnableUpdateViaProxy {
+            get {
+                return ResourceManager.GetString("TbSettingsEnableUpdateViaProxy", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 Exception 的本地化字符串。
         /// </summary>
@@ -4509,6 +4572,42 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Xray Mux setting 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsMux4Ray {
+            get {
+                return ResourceManager.GetString("TbSettingsMux4Ray", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Xray Mux concurrency 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsMux4RayConcurrency {
+            get {
+                return ResourceManager.GetString("TbSettingsMux4RayConcurrency", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Xray Mux XUDP concurrency 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsMux4RayXudpConcurrency {
+            get {
+                return ResourceManager.GetString("TbSettingsMux4RayXudpConcurrency", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   查找类似 Xray Mux XUDP proxy UDP443 的本地化字符串。
+        /// </summary>
+        public static string TbSettingsMux4RayXudpProxyUDP443 {
+            get {
+                return ResourceManager.GetString("TbSettingsMux4RayXudpProxyUDP443", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 sing-box Mux Protocol 的本地化字符串。
         /// </summary>
@@ -4923,6 +5022,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Process 的本地化字符串。
+        /// </summary>
+        public static string TbSortingProcess {
+            get {
+                return ResourceManager.GetString("TbSortingProcess", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 Time 的本地化字符串。
         /// </summary>
@@ -5031,6 +5139,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Xray Only 的本地化字符串。
+        /// </summary>
+        public static string TbXrayOnly {
+            get {
+                return ResourceManager.GetString("TbXrayOnly", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 The delay: {0} ms, {1} 的本地化字符串。
         /// </summary>

v2rayN/ServiceLib/Resx/ResUI.fa.resx

@@ -693,6 +693,9 @@
   <data name="TbSettingsEnableCheckPreReleaseUpdate" xml:space="preserve">
     <value>به روز رسانی های پیش از انتشار را بررسی شود</value>
   </data>
+  <data name="TbSettingsEnableUpdateViaProxy" xml:space="preserve">
+    <value>به‌روزرسانی از طریق پروکسی</value>
+  </data>
   <data name="TbSettingsException" xml:space="preserve">
     <value>استثنا</value>
   </data>
@@ -1215,7 +1218,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>قانون</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>تست تأخیر</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1456,7 +1459,7 @@
     <value>Custom DNS Enabled, This Page's Settings Invalid</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>Block ECH and HTTP/3 availability checks when enabled</value>
+    <value>Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Please fill in the correct config template</value>

v2rayN/ServiceLib/Resx/ResUI.fr.resx

@@ -1212,7 +1212,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>Règle</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>Test de latence</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1453,7 +1453,7 @@
     <value>DNS personnalisé activé ; la configuration de cette page sera ignorée</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>Une fois activé, bloque les requêtes ECH et de disponibilité HTTP/3</value>
+    <value>Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Veuillez saisir un modèle de configuration valide</value>

v2rayN/ServiceLib/Resx/ResUI.hu.resx

@@ -1215,7 +1215,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>Szabály</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>Késleltetés teszt</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1456,7 +1456,7 @@
     <value>Custom DNS Enabled, This Page's Settings Invalid</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>Block ECH and HTTP/3 availability checks when enabled</value>
+    <value>Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Please fill in the correct config template</value>

v2rayN/ServiceLib/Resx/ResUI.id.resx

@@ -1215,7 +1215,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>Aturan</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>Uji latensi</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1456,7 +1456,7 @@
     <value>DNS kustom diaktifkan, pengaturan halaman ini tidak berlaku</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>Blokir pemeriksaan ketersediaan ECH dan HTTP/3 saat diaktifkan</value>
+    <value>Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Isi template konfigurasi yang benar</value>

v2rayN/ServiceLib/Resx/ResUI.resx

@@ -142,7 +142,7 @@
     <value>Failed to get the default configuration</value>
   </data>
   <data name="FailedImportedCustomServer" xml:space="preserve">
-    <value>Failed to import custom configuration Configuration</value>
+    <value>Failed to import configuration</value>
   </data>
   <data name="FailedReadConfiguration" xml:space="preserve">
     <value>Failed to read configuration file</value>
@@ -283,7 +283,7 @@
     <value>Configuration successful. {0}</value>
   </data>
   <data name="SuccessfullyImportedCustomServer" xml:space="preserve">
-    <value>Custom configuration Configuration imported successfully</value>
+    <value>Custom configuration imported successfully</value>
   </data>
   <data name="SuccessfullyImportedServerViaClipboard" xml:space="preserve">
     <value>{0} Configurations have been imported from clipboard</value>
@@ -385,7 +385,7 @@
     <value>All</value>
   </data>
   <data name="FillServerAddressCustom" xml:space="preserve">
-    <value>Please browse to import Configuration configuration</value>
+    <value>Please browse to import configuration</value>
   </data>
   <data name="Speedtesting" xml:space="preserve">
     <value>Testing...</value>
@@ -693,6 +693,9 @@
   <data name="TbSettingsEnableCheckPreReleaseUpdate" xml:space="preserve">
     <value>Check for pre-release</value>
   </data>
+  <data name="TbSettingsEnableUpdateViaProxy" xml:space="preserve">
+    <value>Update via proxy</value>
+  </data>
   <data name="TbSettingsException" xml:space="preserve">
     <value>Exception</value>
   </data>
@@ -1020,6 +1023,15 @@
   <data name="TbSettingsMux4SboxProtocol" xml:space="preserve">
     <value>sing-box Mux Protocol</value>
   </data>
+  <data name="TbSettingsMux4RayConcurrency" xml:space="preserve">
+    <value>Xray Mux concurrency</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpConcurrency" xml:space="preserve">
+    <value>Xray Mux XUDP concurrency</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpProxyUDP443" xml:space="preserve">
+    <value>Xray Mux XUDP proxy UDP443</value>
+  </data>
   <data name="TbRoutingRuleProcess" xml:space="preserve">
     <value>Process (Linux/Windows)</value>
   </data>
@@ -1221,7 +1233,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>Rule</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>Latency Test</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1462,7 +1474,7 @@
     <value>Custom DNS Enabled, This Page's Settings Invalid</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>Block ECH and HTTP/3 availability checks when enabled</value>
+    <value>Block ECH and HTTP/3 availability checks when enabled. Always enabled in Xray</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Please fill in the correct config template</value>
@@ -1771,7 +1783,7 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
     <value>Only Check</value>
   </data>
   <data name="MsgNotSupport" xml:space="preserve">
-    <value>Not Support</value>
+    <value>Not Supported</value>
   </data>
   <data name="LvTestIpInfo" xml:space="preserve">
     <value>IP Info</value>
@@ -1860,4 +1872,31 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="LvCustomCoreType" xml:space="preserve">
     <value>Custom config core</value>
   </data>
+  <data name="TbXrayOnly" xml:space="preserve">
+    <value>Xray Only</value>
+  </data>
+  <data name="TbBlockAAAAQueries" xml:space="preserve">
+    <value>Block AAAA Queries</value>
+  </data>
+  <data name="TbBlockAAAAQueriesTips" xml:space="preserve">
+    <value>Block IPv6 queries when enabled</value>
+  </data>
+  <data name="TbDNS" xml:space="preserve">
+    <value>DNS</value>
+  </data>
+  <data name="TbSettingsMux4Ray" xml:space="preserve">
+    <value>Xray Mux setting</value>
+  </data>
+  <data name="LvRequestHeaders" xml:space="preserve">
+    <value>HTTP headers (JSON)</value>
+  </data>
+  <data name="SubRequestHeadersTips" xml:space="preserve">
+    <value>Optional. Example: {"X-hwid": "my_device"}. Values override default headers for all URLs in this group, including the subscription conversion service.</value>
+  </data>
+  <data name="SubRequestHeadersInvalid" xml:space="preserve">
+    <value>Invalid HTTP headers. Use a JSON object with unique header names and string values. Header names and values must not contain line breaks.</value>
+  </data>
+  <data name="TbSortingProcess" xml:space="preserve">
+    <value>Process</value>
+  </data>
 </root>

v2rayN/ServiceLib/Resx/ResUI.ru.resx

@@ -268,7 +268,7 @@
     <value>Сначала выберите сервер</value>
   </data>
   <data name="RemoveDuplicateServerResult" xml:space="preserve">
-    <value>Дедупликация конфигураций завершена. Было: {0}, Стало: {1}.</value>
+    <value>Дедупликация конфигураций завершена. Было: {0}, Стало: {1}</value>
   </data>
   <data name="RemoveServer" xml:space="preserve">
     <value>Вы уверены, что хотите удалить сервер?</value>
@@ -693,6 +693,9 @@
   <data name="TbSettingsEnableCheckPreReleaseUpdate" xml:space="preserve">
     <value>Проверить наличие предварительных обновлений</value>
   </data>
+  <data name="TbSettingsEnableUpdateViaProxy" xml:space="preserve">
+    <value>Обновлять через прокси</value>
+  </data>
   <data name="TbSettingsException" xml:space="preserve">
     <value>Исключение</value>
   </data>
@@ -1020,6 +1023,15 @@
   <data name="TbSettingsMux4SboxProtocol" xml:space="preserve">
     <value>Протокол Mux для sing-box</value>
   </data>
+  <data name="TbSettingsMux4RayConcurrency" xml:space="preserve">
+    <value>Лимит дочерних соединений Mux для Xray</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpConcurrency" xml:space="preserve">
+    <value>Лимит дочерних XUDP-соединений Mux для Xray</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpProxyUDP443" xml:space="preserve">
+    <value>Обработка UDP443 (QUIC) в Mux для Xray</value>
+  </data>
   <data name="TbRoutingRuleProcess" xml:space="preserve">
     <value>Процесс (Linux/Windows)</value>
   </data>
@@ -1048,7 +1060,7 @@
     <value>HTTP-заголовки</value>
   </data>
   <data name="TipHttpOutboundHeaders" xml:space="preserve">
-    <value>Пользовательские заголовки исходящего HTTP-запроса. Введите JSON-объект, значения которого — строка или массив строк.</value>
+    <value>Пользовательские заголовки исходящего HTTP-запроса. Введите JSON-объект, значения которого — строка или массив строк</value>
   </data>
   <data name="LvPrevProfile" xml:space="preserve">
     <value>Псевдоним предыдущего прокси</value>
@@ -1120,28 +1132,28 @@
     <value>Длина фрагмента</value>
   </data>
   <data name="TbSettingsFragmentLengthTip" xml:space="preserve">
-    <value>Диапазон размера фрагмента в байтах (например, 50-100). Первое значение не больше второго. Пусто = по умолчанию.</value>
+    <value>Диапазон размера фрагмента в байтах (например, 50-100). Первое значение не больше второго. Пусто = по умолчанию</value>
   </data>
   <data name="TbSettingsFragmentInterval" xml:space="preserve">
     <value>Интервал фрагментации</value>
   </data>
   <data name="TbSettingsFragmentIntervalTip" xml:space="preserve">
-    <value>Задержка между фрагментами в мс (например, 10-20). Диапазон 1-100. Первое значение не больше второго. Пусто = по умолчанию.</value>
+    <value>Задержка между фрагментами в мс (например, 10-20). Диапазон 1-100. Первое значение не больше второго. Пусто = по умолчанию</value>
   </data>
   <data name="TbSettingsFragmentMaxSplit" xml:space="preserve">
     <value>Макс. разделение</value>
   </data>
   <data name="TbSettingsFragmentMaxSplitTip" xml:space="preserve">
-    <value>Максимальное число разделений (0 = без лимита, 0-10000). Только для Xray-core. Пусто = по умолчанию.</value>
+    <value>Максимальное число разделений (0 = без лимита, 0-10000). Только для Xray-core. Пусто = по умолчанию</value>
   </data>
   <data name="TbSettingsFragmentFallbackDelay" xml:space="preserve">
     <value>Резервная задержка</value>
   </data>
   <data name="TbSettingsFragmentFallbackDelayTip" xml:space="preserve">
-    <value>Резервная задержка для TLS-фрагмента. Только для sing-box. Пусто = по умолчанию.</value>
+    <value>Резервная задержка для TLS-фрагмента. Только для sing-box. Пусто = по умолчанию</value>
   </data>
   <data name="FillFragmentParameterError" xml:space="preserve">
-    <value>Неверный формат диапазона. Используйте 'from-to' (например, 50-100).</value>
+    <value>Неверный формат диапазона. Используйте 'from-to' (например, 50-100)</value>
   </data>
   <data name="TbSettingsEnableCacheFile4Sbox" xml:space="preserve">
     <value>Включить файл кэша для sing-box (файлы наборов правил)</value>
@@ -1221,7 +1233,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>Правила</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>Тест задержки</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1351,7 +1363,7 @@
     <value>Пароль sudo системы</value>
   </data>
   <data name="TbSettingsLinuxSudoPasswordTip" xml:space="preserve">
-    <value>Пароль sudo будет проверен в терминале. Если из-за ошибки проверки приложение начнёт работать некорректно, перезапустите его. Пароль не сохраняется — его нужно вводить после каждого перезапуска.</value>
+    <value>Пароль sudo будет проверен в терминале. Если из-за ошибки проверки приложение начнёт работать некорректно, перезапустите его. Пароль не сохраняется — его нужно вводить после каждого перезапуска</value>
   </data>
   <data name="TransportHeaderType5" xml:space="preserve">
     <value>XHTTP-режим</value>
@@ -1411,7 +1423,7 @@
     <value>Можно указать псевдоним из конфигурации, убедитесь, что он существует и уникален</value>
   </data>
   <data name="SudoIncorrectPasswordTip" xml:space="preserve">
-    <value>Неверный пароль, попробуйте ещё раз.</value>
+    <value>Неверный пароль, попробуйте ещё раз</value>
   </data>
   <data name="TbMldsa65Verify" xml:space="preserve">
     <value>Mldsa65Verify</value>
@@ -1462,7 +1474,7 @@
     <value>Включён пользовательский DNS — настройки на этой странице не применяются</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>При включении блокирует проверки доступности ECH и HTTP/3</value>
+    <value>При включении блокирует запросы доступности ECH и HTTP/3. В Xray включено всегда</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>Пожалуйста, заполните корректный шаблон конфигурации</value>
@@ -1492,7 +1504,7 @@
     <value>Добавляет только конфигурацию Outbound и Endpoint. Нажмите, чтобы открыть документ</value>
   </data>
   <data name="TbFullConfigTemplateDesc" xml:space="preserve">
-    <value>Эта функция предназначена для продвинутых пользователей и особых случаев. После включения игнорируются базовые настройки ядра, DNS и маршрутизации. Вы должны самостоятельно корректно задать порт системного прокси, учёт трафика и другие связанные параметры — всё настраивается вручную.</value>
+    <value>Эта функция предназначена для продвинутых пользователей и особых случаев. После включения игнорируются базовые настройки ядра, DNS и маршрутизации. Вы должны самостоятельно корректно задать порт системного прокси, учёт трафика и другие связанные параметры — всё настраивается вручную</value>
   </data>
   <data name="MsgStartParsingSubscription" xml:space="preserve">
     <value>Начинается разбор и обработка содержимого подписки</value>
@@ -1501,7 +1513,7 @@
     <value>Выбрать профиль</value>
   </data>
   <data name="TbFakeIPTips" xml:space="preserve">
-    <value>Applies globally by default, and built-in FakeIP filtering is only built into sing-box.</value>
+    <value>Применяется глобально по умолчанию; встроенная фильтрация FakeIP есть только в sing-box</value>
   </data>
   <data name="PleaseAddAtLeastOneServer" xml:space="preserve">
     <value>Добавьте хотя бы одну конфигурацию</value>
@@ -1588,7 +1600,7 @@
     <value>Привязанный сертификат (заполните любое из полей)
 При указании сертификат будет привязан, а «Пропустить проверку сертификата» отключится.
 
-Получение сертификата может завершиться неудачей при использовании самоподписанного сертификата или при наличии ненадёжного / вредоносного ЦС в системе.</value>
+Получение сертификата может завершиться неудачей при использовании самоподписанного сертификата или при наличии ненадёжного / вредоносного ЦС в системе</value>
   </data>
   <data name="TbFetchCert" xml:space="preserve">
     <value>Получить сертификат</value>
@@ -1642,10 +1654,10 @@
     <value>По умолчанию используется только при разрешении имён в процессе маршрутизации; убедитесь, что удалённый сервер может достичь этого DNS</value>
   </data>
   <data name="TbDirectResolveStrategyTips" xml:space="preserve">
-    <value>Если не задано или «AsIs», используется системный DNS; иначе — встроенный DNS-модуль.</value>
+    <value>Если не задано или «AsIs», используется системный DNS; иначе — встроенный DNS-модуль</value>
   </data>
   <data name="TbRemoteResolveStrategyTips" xml:space="preserve">
-    <value>Если не задано или «AsIs», разрешение DNS выполняется DNS удалённого сервера; иначе — встроенный DNS-модуль.</value>
+    <value>Если не задано или «AsIs», разрешение DNS выполняется DNS удалённого сервера; иначе — встроенный DNS-модуль</value>
   </data>
   <data name="TbHopInt7" xml:space="preserve">
     <value>Интервал смены портов (Port Hopping)</value>
@@ -1660,37 +1672,37 @@
     <value>Правило маршрутизации {0}, исходящий узел {1}, предупреждение: {2}</value>
   </data>
   <data name="MsgRoutingRuleOutboundNodeError" xml:space="preserve">
-    <value>Правило маршрутизации {0}, исходящий узел {1}, ошибка: {2}. Используется только прокси-узел.</value>
+    <value>Правило маршрутизации {0}, исходящий узел {1}, ошибка: {2}. Используется только прокси-узел</value>
   </data>
   <data name="MsgGroupCycleDependency" xml:space="preserve">
-    <value>Группа {0} имеет циклическую зависимость на дочерний узел {1}. Узел пропущен.</value>
+    <value>Группа {0} имеет циклическую зависимость на дочерний узел {1}. Узел пропущен</value>
   </data>
   <data name="MsgGroupChildNodeWarning" xml:space="preserve">
     <value>Группа {0}: предупреждение дочернего узла {1}: {2}</value>
   </data>
   <data name="MsgGroupChildNodeError" xml:space="preserve">
-    <value>Группа {0}: ошибка дочернего узла {1}: {2}. Узел пропущен.</value>
+    <value>Группа {0}: ошибка дочернего узла {1}: {2}. Узел пропущен</value>
   </data>
   <data name="MsgGroupChildGroupNodeWarning" xml:space="preserve">
     <value>Группа {0}: предупреждение дочернего узла группы {1}: {2}</value>
   </data>
   <data name="MsgGroupChildGroupNodeError" xml:space="preserve">
-    <value>Группа {0}: ошибка дочернего узла группы {1}: {2}. Узел пропущен.</value>
+    <value>Группа {0}: ошибка дочернего узла группы {1}: {2}. Узел пропущен</value>
   </data>
   <data name="MsgGroupNoValidChildNode" xml:space="preserve">
-    <value>У группы {0} нет допустимых дочерних узлов.</value>
+    <value>У группы {0} нет допустимых дочерних узлов</value>
   </data>
   <data name="MsgRoutingRuleEmptyOutboundTag" xml:space="preserve">
-    <value>У правила маршрутизации {0} пустой исходящий тег. Используется только прокси-узел.</value>
+    <value>У правила маршрутизации {0} пустой исходящий тег. Используется только прокси-узел</value>
   </data>
   <data name="MsgRoutingRuleOutboundNodeNotFound" xml:space="preserve">
-    <value>Правило маршрутизации {0}, исходящий узел {1} не найден. Используется только прокси-узел.</value>
+    <value>Правило маршрутизации {0}, исходящий узел {1} не найден. Используется только прокси-узел</value>
   </data>
   <data name="MsgSubscriptionPrevProfileNotFound" xml:space="preserve">
-    <value>Предыдущий прокси подписки {0} не найден. Пропущено.</value>
+    <value>Предыдущий прокси подписки {0} не найден. Пропущено</value>
   </data>
   <data name="MsgSubscriptionNextProfileNotFound" xml:space="preserve">
-    <value>Следующий прокси подписки {0} не найден. Пропущено.</value>
+    <value>Следующий прокси подписки {0} не найден. Пропущено</value>
   </data>
   <data name="menuGenGroupServer" xml:space="preserve">
     <value>Сгенерировать группу политик</value>
@@ -1756,7 +1768,7 @@
     <value>Привязать интерфейс</value>
   </data>
   <data name="TbSettingsBindInterfaceTip" xml:space="preserve">
-    <value>Для среды с несколькими сетевыми интерфейсами укажите имя интерфейса для исходящих подключений. На Linux/macOS работает только при включённом TUN.</value>
+    <value>Для среды с несколькими сетевыми интерфейсами укажите имя интерфейса для исходящих подключений. На Linux/macOS работает только при включённом TUN</value>
   </data>
   <data name="TbPreSharedKey" xml:space="preserve">
     <value>Общий ключ (PSK)</value>
@@ -1780,13 +1792,13 @@
     <value>Доступно обновление</value>
   </data>
   <data name="MsgAllowInsecureDeprecated" xml:space="preserve">
-    <value>Предупреждение: 1 августа 2026 г. Xray отключит пропуск проверки сертификата (allowInsecure). Как можно скорее перейдите на привязанный отпечаток сертификата (pinnedPeerCertSha256). После этой даты allowInsecure использовать будет нельзя.</value>
+    <value>Предупреждение: 1 августа 2026 г. Xray отключит пропуск проверки сертификата (allowInsecure). Как можно скорее перейдите на привязанный отпечаток сертификата (pinnedPeerCertSha256). После этой даты allowInsecure использовать будет нельзя</value>
   </data>
   <data name="TbRouteExcludeAddress" xml:space="preserve">
     <value>Адреса, исключаемые из маршрутизации</value>
   </data>
   <data name="TbRouteExcludeAddressTip" xml:space="preserve">
-    <value>Разделяйте запятыми (,).</value>
+    <value>Разделяйте запятыми (,)</value>
   </data>
   <data name="MsgTunRouteExcludeInvalidAddress" xml:space="preserve">
     <value>Недопустимый адрес в списке исключений маршрутизации TUN: {0}</value>
@@ -1798,22 +1810,22 @@
     <value>Включить финальную фрагментацию (Final Fragment)</value>
   </data>
   <data name="TbEnableFinalFragmentTip" xml:space="preserve">
-    <value>Разбивать конец пакетов на более мелкие фрагменты при отправке. Это может влиять на пропускную способность и задержку.</value>
+    <value>Разбивать конец пакетов на более мелкие фрагменты при отправке. Это может влиять на пропускную способность и задержку</value>
   </data>
   <data name="TbEnabletDnsViaProxy" xml:space="preserve">
     <value>DNS через Bridge</value>
   </data>
   <data name="MsgInsecureConfiguration" xml:space="preserve">
-    <value>Обнаружена небезопасная конфигурация: AllowInsecure включён, но сертификат не предоставлен. Это может привести к атаке «человек посередине» (MITM).</value>
+    <value>Обнаружена небезопасная конфигурация: AllowInsecure включён, но сертификат не предоставлен. Это может привести к атаке «человек посередине» (MITM)</value>
   </data>
   <data name="TbHy2RealmUrl" xml:space="preserve">
     <value>Realm URL</value>
   </data>
   <data name="InvalidHy2RealmUrl" xml:space="preserve">
-    <value>Некорректный Realm URL.</value>
+    <value>Некорректный Realm URL</value>
   </data>
   <data name="InvalidHttpOutboundHeaders" xml:space="preserve">
-    <value>Введите корректный JSON заголовков HTTP-запроса.</value>
+    <value>Введите корректный JSON заголовков HTTP-запроса</value>
   </data>
   <data name="TbHy2RealmUrlTip" xml:space="preserve">
     <value>Формат: realm://&lt;token&gt;@&lt;rendezvous-host&gt;[:port]/&lt;realm-name&gt;?stun=&lt;stun-host&gt;[:port]</value>
@@ -1822,12 +1834,69 @@
     <value>Размер пакета Gecko (мин/макс)</value>
   </data>
   <data name="TbLegacyProtectTip" xml:space="preserve">
-    <value>Если включено, используется sing-box TUN; иначе — xray TUN.</value>
+    <value>Если включено, используется sing-box TUN; иначе — xray TUN</value>
   </data>
   <data name="TbRootCertificateProvider" xml:space="preserve">
     <value>Поставщик корневых сертификатов</value>
   </data>
   <data name="TbRootCertificateProviderTip" xml:space="preserve">
-    <value>Применяется только к загрузкам и сетевым запросам графического интерфейса v2rayN. Не влияет на проверку сертификатов ядром.</value>
+    <value>Применяется только к загрузкам и сетевым запросам графического интерфейса v2rayN. Не влияет на проверку сертификатов ядром</value>
+  </data>
+  <data name="TbProxyDialResolveStrategy" xml:space="preserve">
+    <value>Стратегия разрешения DNS при подключении к прокси</value>
+  </data>
+  <data name="TbProxyDialResolveStrategyTip" xml:space="preserve">
+    <value>Не рекомендуется; может вызвать петли маршрутизации</value>
+  </data>
+  <data name="TbEnableHappyEyeballs" xml:space="preserve">
+    <value>Включить Happy Eyeballs</value>
+  </data>
+  <data name="TbEnableHappyEyeballsTip" xml:space="preserve">
+    <value>Требуется стратегия UseIP. При включении одновременно устанавливаются соединения по IPv4 и IPv6 и автоматически выбирается более быстрый доступный путь</value>
+  </data>
+  <data name="TbIpv6Address" xml:space="preserve">
+    <value>Адрес IPv6</value>
+  </data>
+  <data name="TbIpv4Address" xml:space="preserve">
+    <value>Адрес IPv4</value>
+  </data>
+  <data name="menuAddCustomOutboundServer" xml:space="preserve">
+    <value>Добавить пользовательский outbound</value>
+  </data>
+  <data name="MsgCustomOutboundFileNotFound" xml:space="preserve">
+    <value>Файл пользовательского outbound {0} не найден: {1}</value>
+  </data>
+  <data name="TbCustomOutboundTip" xml:space="preserve">
+    <value>Для xray/sing-box поддерживается только один outbound/endpoint</value>
+  </data>
+  <data name="LvCustomCoreType" xml:space="preserve">
+    <value>Ядро пользовательской конфигурации</value>
+  </data>
+  <data name="TbXrayOnly" xml:space="preserve">
+    <value>Только Xray</value>
+  </data>
+  <data name="TbBlockAAAAQueries" xml:space="preserve">
+    <value>Блокировать DNS-запросы AAAA</value>
+  </data>
+  <data name="TbBlockAAAAQueriesTips" xml:space="preserve">
+    <value>При включении блокирует DNS-запросы IPv6</value>
+  </data>
+  <data name="TbDNS" xml:space="preserve">
+    <value>DNS</value>
+  </data>
+  <data name="TbSettingsMux4Ray" xml:space="preserve">
+    <value>Настройки Mux для Xray</value>
+  </data>
+  <data name="LvRequestHeaders" xml:space="preserve">
+    <value>HTTP-заголовки (JSON)</value>
+  </data>
+  <data name="SubRequestHeadersTips" xml:space="preserve">
+    <value>Необязательно. Пример: {"X-hwid": "my_device"}. Заданные значения переопределяют заголовки по умолчанию для всех URL этой группы, включая сервис конвертации подписок</value>
+  </data>
+  <data name="SubRequestHeadersInvalid" xml:space="preserve">
+    <value>Некорректные HTTP-заголовки. Используйте JSON-объект с уникальными именами заголовков и строковыми значениями. Имена и значения заголовков не должны содержать переносов строк</value>
+  </data>
+  <data name="TbSortingProcess" xml:space="preserve">
+    <value>Процесс</value>
   </data>
 </root>

v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx

@@ -693,6 +693,9 @@
   <data name="TbSettingsEnableCheckPreReleaseUpdate" xml:space="preserve">
     <value>检查 Pre-Release</value>
   </data>
+  <data name="TbSettingsEnableUpdateViaProxy" xml:space="preserve">
+    <value>通过代理更新</value>
+  </data>
   <data name="TbSettingsException" xml:space="preserve">
     <value>例外</value>
   </data>
@@ -1218,7 +1221,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>规则</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>延迟测试</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1459,7 +1462,7 @@
     <value>自定义 DNS 已启用，此页面配置将无效</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>开启后将阻止 ECH 和 HTTP/3 可用性查询</value>
+    <value>开启后将阻止 ECH 和 HTTP/3 可用性查询。Xray 固定开启</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
     <value>请填写正确的配置模板</value>
@@ -1861,4 +1864,31 @@
   <data name="LvCustomCoreType" xml:space="preserve">
     <value>自定义配置核心</value>
   </data>
+  <data name="TbXrayOnly" xml:space="preserve">
+    <value>仅 Xray</value>
+  </data>
+  <data name="TbBlockAAAAQueries" xml:space="preserve">
+    <value>阻止 AAAA 查询</value>
+  </data>
+  <data name="TbBlockAAAAQueriesTips" xml:space="preserve">
+    <value>开启后将阻止 IPv6 查询</value>
+  </data>
+  <data name="TbDNS" xml:space="preserve">
+    <value>DNS</value>
+  </data>
+  <data name="TbSettingsMux4Ray" xml:space="preserve">
+    <value>Xray Mux 设置</value>
+  </data>
+  <data name="LvRequestHeaders" xml:space="preserve">
+    <value>HTTP 请求头 (JSON)</value>
+  </data>
+  <data name="SubRequestHeadersTips" xml:space="preserve">
+    <value>可选，示例：{"X-hwid": "my_device"}。自定义值覆盖默认请求头，应用于本组所有订阅地址（包括订阅转换服务）。</value>
+  </data>
+  <data name="SubRequestHeadersInvalid" xml:space="preserve">
+    <value>HTTP 请求头无效。请使用 JSON 对象，键名不能重复，值必须为字符串；请求头名称和值不能包含换行符。</value>
+  </data>
+  <data name="TbSortingProcess" xml:space="preserve">
+    <value>进程</value>
+  </data>
 </root>

v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx

@@ -693,6 +693,9 @@
   <data name="TbSettingsEnableCheckPreReleaseUpdate" xml:space="preserve">
     <value>檢查 Pre-Release</value>
   </data>
+  <data name="TbSettingsEnableUpdateViaProxy" xml:space="preserve">
+    <value>透過代理更新</value>
+  </data>
   <data name="TbSettingsException" xml:space="preserve">
     <value>例外</value>
   </data>
@@ -1017,6 +1020,15 @@
   <data name="TbSettingsMux4SboxProtocol" xml:space="preserve">
     <value>sing-box Mux 多路復用協定</value>
   </data>
+  <data name="TbSettingsMux4RayConcurrency" xml:space="preserve">
+    <value>Xray Mux 並行數</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpConcurrency" xml:space="preserve">
+    <value>Xray Mux XUDP 並行數</value>
+  </data>
+  <data name="TbSettingsMux4RayXudpProxyUDP443" xml:space="preserve">
+    <value>Xray Mux XUDP proxy UDP443</value>
+  </data>
   <data name="TbRoutingRuleProcess" xml:space="preserve">
     <value>行程 (Linux/Windows)</value>
   </data>
@@ -1218,7 +1230,7 @@
   <data name="menuModeRule" xml:space="preserve">
     <value>規則</value>
   </data>
-  <data name="menuProxiesDelaytest" xml:space="preserve">
+  <data name="menuDelaytest" xml:space="preserve">
     <value>延遲測試</value>
   </data>
   <data name="menuProxiesDelaytestPart" xml:space="preserve">
@@ -1417,7 +1429,7 @@
     <value>新增 [Anytls] 節點</value>
   </data>
   <data name="TbRemoteDNS" xml:space="preserve">
-    <value>遠程 DNS</value>
+    <value>遠端 DNS</value>
   </data>
   <data name="TbDomesticDNS" xml:space="preserve">
     <value>直連 DNS</value>
@@ -1429,16 +1441,16 @@
     <value>代理目標解析策略</value>
   </data>
   <data name="TbAddCommonDNSHosts" xml:space="preserve">
-    <value>新增常用 DNS Hosts</value>
+    <value>新增常用 DNS 主機對應</value>
   </data>
   <data name="TbFakeIP" xml:space="preserve">
     <value>FakeIP</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueries" xml:space="preserve">
-    <value>阻止 SVCB 和 HTTPS 查詢</value>
+    <value>封鎖 SVCB 與 HTTPS 查詢</value>
   </data>
   <data name="TbDNSHostsConfig" xml:space="preserve">
-    <value>DNS Hosts：（“網域名稱1 ip1 ip2” 一行一個）</value>
+    <value>DNS 主機對應：（每行一組「網域名稱1 ip1 ip2」）</value>
   </data>
   <data name="ThBasicDNSSettings" xml:space="preserve">
     <value>DNS 基礎設定</value>
@@ -1447,49 +1459,49 @@
     <value>DNS 進階設定</value>
   </data>
   <data name="TbValidateDirectExpectedIPs" xml:space="preserve">
-    <value>校驗相應地區域名 IP</value>
+    <value>驗證區域網域名稱的 IP</value>
   </data>
   <data name="TbValidateDirectExpectedIPsDesc" xml:space="preserve">
-    <value>配置後，會對相應地區域名（如 geosite:cn - geoip:cn）的返回 IP 進行校驗，僅返回期望 IP</value>
+    <value>設定後，系統會驗證區域網域名稱（例如 geosite:cn - geoip:cn）所傳回的 IP，並只傳回預期的 IP。</value>
   </data>
   <data name="TbCustomDNSEnable" xml:space="preserve">
     <value>啟用自訂 DNS</value>
   </data>
   <data name="TbCustomDNSEnabledPageInvalid" xml:space="preserve">
-    <value>自訂 DNS 已啟用，此頁面配置將無效</value>
+    <value>已啟用自訂 DNS，此頁面的設定將不會生效</value>
   </data>
   <data name="TbBlockSVCBHTTPSQueriesTips" xml:space="preserve">
-    <value>開啟後將阻止 ECH 和 HTTP/3 可用性查詢</value>
+    <value>啟用後將封鎖 ECH 與 HTTP/3 可用性查詢。Xray 固定啟用</value>
   </data>
   <data name="FillCorrectConfigTemplateText" xml:space="preserve">
-    <value>請填寫正確的配置範本</value>
+    <value>請填寫正確的設定範本</value>
   </data>
   <data name="menuFullConfigTemplate" xml:space="preserve">
-    <value>完整配置範本設定</value>
+    <value>完整設定範本</value>
   </data>
   <data name="TbFullConfigTemplateEnable" xml:space="preserve">
-    <value>啟用完整配置範本</value>
+    <value>啟用完整設定範本</value>
   </data>
   <data name="TbRayFullConfigTemplate" xml:space="preserve">
-    <value>v2ray 完整配置範本</value>
+    <value>v2ray 完整設定範本</value>
   </data>
   <data name="TbRayFullConfigTemplateDesc" xml:space="preserve">
-    <value>僅添加出站配置，routing.balancers 和 routing.rules.outboundTag，點擊查看文檔</value>
+    <value>僅新增出站設定、routing.balancers 與 routing.rules.outboundTag。點選以查看說明文件</value>
   </data>
   <data name="TbAddProxyProtocolOutboundOnly" xml:space="preserve">
-    <value>不添加非代理協定出站</value>
+    <value>不新增非代理協定出站</value>
   </data>
   <data name="TbSetUpstreamProxyDetour" xml:space="preserve">
-    <value>設定上游代理 tag</value>
+    <value>設定上游代理標籤</value>
   </data>
   <data name="TbSBFullConfigTemplate" xml:space="preserve">
-    <value>sing-box 完整配置範本</value>
+    <value>sing-box 完整設定範本</value>
   </data>
   <data name="TbSBFullConfigTemplateDesc" xml:space="preserve">
-    <value>僅添加出站和端點配置，點擊查看文檔</value>
+    <value>僅新增出站與端點設定。點選以查看說明文件</value>
   </data>
   <data name="TbFullConfigTemplateDesc" xml:space="preserve">
-    <value>此功能供高級用戶和有特殊需求的用戶使用。 啟用此功能後，將忽略 Core 的基礎設定，DNS 設定 ，路由設定。你需要保證系統代理的埠和流量統計等功能的配置正確，一切都由你來設定。</value>
+    <value>此功能適合進階使用者與有特殊需求的使用者。啟用後，Core 基礎設定、DNS 設定與路由設定將被忽略。請確認系統代理連接埠、流量統計及其他相關設定皆正確；所有項目都必須由您自行設定。</value>
   </data>
   <data name="MsgStartParsingSubscription" xml:space="preserve">
     <value>開始解析和處理訂閱內容</value>
@@ -1498,10 +1510,10 @@
     <value>選擇節點</value>
   </data>
   <data name="TbFakeIPTips" xml:space="preserve">
-    <value>默認全局生效，僅在 sing-box 中內置 FakeIP 過濾。</value>
+    <value>預設會套用至全域；內建 FakeIP 過濾僅支援 sing-box。</value>
   </data>
   <data name="PleaseAddAtLeastOneServer" xml:space="preserve">
-    <value>請至少添加一個節點</value>
+    <value>請至少新增一個設定檔</value>
   </data>
   <data name="TbConfigTypePolicyGroup" xml:space="preserve">
     <value>策略組</value>
@@ -1627,7 +1639,7 @@
     <value>提供過期快取（Serve Stale）</value>
   </data>
   <data name="TbParallelQuery" xml:space="preserve">
-    <value>并行查詢</value>
+    <value>並行查詢</value>
   </data>
   <data name="TbDomesticDNSTips" xml:space="preserve">
     <value>預設僅在路由期間進行解析時調用</value>
@@ -1849,4 +1861,43 @@
   <data name="TbIpv4Address" xml:space="preserve">
     <value>Ipv4 位址</value>
   </data>
+  <data name="menuAddCustomOutboundServer" xml:space="preserve">
+    <value>新增自訂出站</value>
+  </data>
+  <data name="MsgCustomOutboundFileNotFound" xml:space="preserve">
+    <value>自訂出站 {0} 的檔案未找到：{1}</value>
+  </data>
+  <data name="TbCustomOutboundTip" xml:space="preserve">
+    <value>僅支援 xray/sing-box 的單一 outbound/endpoint</value>
+  </data>
+  <data name="LvCustomCoreType" xml:space="preserve">
+    <value>自訂設定核心</value>
+  </data>
+  <data name="TbXrayOnly" xml:space="preserve">
+    <value>僅 Xray</value>
+  </data>
+  <data name="TbBlockAAAAQueries" xml:space="preserve">
+    <value>封鎖 AAAA 查詢</value>
+  </data>
+  <data name="TbBlockAAAAQueriesTips" xml:space="preserve">
+    <value>啟用後將封鎖 IPv6 查詢</value>
+  </data>
+  <data name="TbDNS" xml:space="preserve">
+    <value>DNS</value>
+  </data>
+  <data name="TbSettingsMux4Ray" xml:space="preserve">
+    <value>Xray Mux 設定</value>
+  </data>
+  <data name="LvRequestHeaders" xml:space="preserve">
+    <value>HTTP 請求標頭 (JSON)</value>
+  </data>
+  <data name="SubRequestHeadersTips" xml:space="preserve">
+    <value>可選，範例：{"X-hwid": "my_device"}。自訂值會覆寫預設標頭，套用於本組所有訂閱位址（包括訂閱轉換服務）。</value>
+  </data>
+  <data name="SubRequestHeadersInvalid" xml:space="preserve">
+    <value>HTTP 請求標頭無效。請使用 JSON 物件，鍵名不能重複，值必須為字串；標頭名稱和值不能包含換行字元。</value>
+  </data>
+  <data name="TbSortingProcess" xml:space="preserve">
+    <value>行程</value>
+  </data>
 </root>

v2rayN/ServiceLib/Sample/SampleOutbound

@@ -2,28 +2,8 @@
 	"tag": "proxy",
 	"protocol": "vmess",
 	"settings": {
-		"vnext": [
+		"address": "v2ray.cool",
-			{
+		"port": 10086
-				"address": "v2ray.cool",
-				"port": 10086,
-				"users": [
-					{
-						"id": "a3482e88-686a-4a58-8126-99c9df64b7bf",
-						"security": "auto"
-					}
-				]
-			}
-		],
-		"servers": [
-			{
-				"address": "v2ray.cool",
-				"method": "chacha20",
-				"ota": false,
-				"password": "123456",
-				"port": 10086,
-				"level": 1
-			}
-		]
 	},
 	"streamSettings": {
 		"network": "tcp"

v2rayN/ServiceLib/Sample/dns_singbox_normal

@@ -17,15 +17,13 @@
       "rule_set": [
         "geosite-google"
       ],
-      "server": "remote",
+      "server": "remote"
-      "strategy": "prefer_ipv4"
     },
     {
       "rule_set": [
         "geosite-cn"
       ],
-      "server": "local",
+      "server": "local"
-      "strategy": "prefer_ipv4"
     }
   ],
   "final": "remote",

v2rayN/ServiceLib/Sample/tun_singbox_dns

@@ -17,15 +17,13 @@
       "rule_set": [
         "geosite-google"
       ],
-      "server": "remote",
+      "server": "remote"
-      "strategy": "prefer_ipv4"
     },
     {
       "rule_set": [
         "geosite-cn"
       ],
-      "server": "local",
+      "server": "local"
-      "strategy": "prefer_ipv4"
     }
   ],
   "final": "remote",

v2rayN/ServiceLib/ServiceLib.csproj

@@ -62,6 +62,9 @@
 			<DesignTime>True</DesignTime>
 			<AutoGen>True</AutoGen>
 		</Compile>
+		<EmbeddedResource Update="Resx\ResUI.az.resx">
+			<Generator>PublicResXFileCodeGenerator</Generator>
+		</EmbeddedResource>
 		<EmbeddedResource Update="Resx\ResUI.fa.resx">
 			<SubType>Designer</SubType>
 			<Generator>PublicResXFileCodeGenerator</Generator>

v2rayN/ServiceLib/Services/CoreConfig/CoreConfigClashService.cs

@@ -1,3 +1,6 @@
+using YamlDotNet.Core;
+using YamlDotNet.RepresentationModel;
+
 namespace ServiceLib.Services.CoreConfig;
 
 /// <summary>
@@ -91,17 +94,7 @@ public class CoreConfigClashService(Config config, bool isTunEnabled)
             fileContent["ipv6"] = config.ClashUIItem.EnableIPv6;
 
             //mode
-            if (!fileContent.ContainsKey("mode"))
+            fileContent.TryAdd("mode", nameof(ERuleMode.Rule));
-            {
-                fileContent["mode"] = nameof(ERuleMode.Rule).ToLower();
-            }
-            else
-            {
-                if (config.ClashUIItem.RuleMode != ERuleMode.Unchanged)
-                {
-                    fileContent["mode"] = config.ClashUIItem.RuleMode.ToString().ToLower();
-                }
-            }
 
             //enable tun mode
             if (isTunEnabled)
@@ -127,7 +120,27 @@ public class CoreConfigClashService(Config config, bool isTunEnabled)
                 Logging.SaveLog($"{_tag}-Mixin", ex);
             }
 
+            // Mihomo parses plain values such as 815458e4 as floats, so quote REALITY short IDs.
+            var originalRealityShortIds = new List<(Dictionary<object, object> RealityOptions, string ShortId)>();
+            if (fileContent.GetValueOrDefault("proxies") is List<object> proxies)
+            {
+                foreach (var proxy in proxies.OfType<Dictionary<object, object>>())
+                {
+                    if (proxy.GetValueOrDefault("reality-opts") is Dictionary<object, object> realityOptions
+                        && realityOptions.GetValueOrDefault("short-id") is string shortId
+                        && !shortId.StartsWith(tagYamlStr2, StringComparison.Ordinal))
+                    {
+                        originalRealityShortIds.Add((realityOptions, shortId));
+                        realityOptions["short-id"] = new YamlScalarNode(shortId) { Style = ScalarStyle.DoubleQuoted };
+                    }
+                }
+            }
+
             var txtFileNew = YamlUtils.ToYaml(fileContent).Replace(tagYamlStr2, tagYamlStr3);
+            foreach (var (realityOptions, shortId) in originalRealityShortIds)
+            {
+                realityOptions["short-id"] = shortId;
+            }
             await File.WriteAllTextAsync(fileName, txtFileNew);
             //check again
             if (!File.Exists(fileName))
@@ -136,8 +149,6 @@ public class CoreConfigClashService(Config config, bool isTunEnabled)
                 return ret;
             }
 
-            ClashApiManager.Instance.ProfileContent = fileContent;
-
             ret.Msg = string.Format(ResUI.SuccessfulConfiguration, $"{node.GetSummary()}");
             ret.Success = true;
             return ret;

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxConfigTemplateService.cs

@@ -125,7 +125,8 @@ public partial class CoreConfigSingboxService
         fullConfigTemplateNode["outbounds"] = customOutboundsNode;
 
         // Process endpoints
-        if (fullConfigTemplateNode["endpoints"] is JsonArray { Count: > 0 } coreConfigEndpointsNode)
+        var coreConfigEndpointsNode = coreConfigNode?["endpoints"] as JsonArray ?? [];
+        if (coreConfigEndpointsNode is { Count: > 0 })
         {
             var customEndpointsNode = fullConfigTemplateNode["endpoints"] as JsonArray ?? [];
             foreach (var endpoint in coreConfigEndpointsNode)

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxDnsService.cs

@@ -17,36 +17,11 @@ public partial class CoreConfigSingboxService
             GenDnsRules();
 
             _coreConfig.dns ??= new Dns4Sbox();
-            _coreConfig.dns.independent_cache = true;
+            _coreConfig.dns.optimistic = context.SimpleDnsItem.ServeStale == true ? true : null;
 
             // final dns
-            var routing = context.RoutingItem;
+            var useDirectDns = UseDirectDns();
-            var useDirectDns = false;
-            if (routing != null)
-            {
-                var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
-
-                if (rules?.LastOrDefault() is { OutboundTag: Global.DirectTag } lastRule)
-                {
-                    var noDomain = lastRule.Domain == null || lastRule.Domain.Count == 0;
-                    var noProcess = lastRule.Process == null || lastRule.Process.Count == 0;
-                    var isAnyIp = lastRule.Ip == null || lastRule.Ip.Count == 0 || lastRule.Ip.Contains("0.0.0.0/0");
-                    var isAnyPort = string.IsNullOrEmpty(lastRule.Port) || lastRule.Port == "0-65535";
-                    var isAnyNetwork = string.IsNullOrEmpty(lastRule.Network) || lastRule.Network == "tcp,udp";
-                    useDirectDns = noDomain && noProcess && isAnyIp && isAnyPort && isAnyNetwork;
-                }
-            }
             _coreConfig.dns.final = useDirectDns ? Global.SingboxDirectDNSTag : Global.SingboxRemoteDNSTag;
-            var simpleDnsItem = context.SimpleDnsItem;
-            if ((!useDirectDns) && simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
-            {
-                _coreConfig.dns.rules.Add(new()
-                {
-                    server = Global.SingboxFakeDNSTag,
-                    query_type = new List<int> { 1, 28 }, // A and AAAA
-                    rewrite_ttl = 1,
-                });
-            }
         }
         catch (Exception ex)
         {
@@ -59,14 +34,24 @@ public partial class CoreConfigSingboxService
         var simpleDnsItem = context.SimpleDnsItem;
         var finalDns = GenBootstrapDns();
 
-        var directDns = ParseDnsAddress(simpleDnsItem.DirectDNS ?? Global.DomainDirectDNSAddress.First());
+        var directDnsList = ParseDnsAddresses(simpleDnsItem.DirectDNS ?? Global.DomainDirectDNSAddress.First());
-        directDns.tag = Global.SingboxDirectDNSTag;
+        for (var i = 0; i < directDnsList.Count; i++)
-        directDns.domain_resolver = Global.SingboxLocalDNSTag;
+        {
+            var directDns = directDnsList[i];
+            var tag = string.Format(Global.SingboxDirectDNSTagTemplate, i + 1);
+            directDns.tag = tag;
+            directDns.domain_resolver = Global.SingboxLocalDNSTag;
+        }
 
-        var remoteDns = ParseDnsAddress(simpleDnsItem.RemoteDNS ?? Global.DomainRemoteDNSAddress.First());
+        var remoteDnsList = ParseDnsAddresses(simpleDnsItem.RemoteDNS ?? Global.DomainRemoteDNSAddress.First());
-        remoteDns.tag = Global.SingboxRemoteDNSTag;
+        for (var i = 0; i < remoteDnsList.Count; i++)
-        remoteDns.detour = Global.ProxyTag;
+        {
-        remoteDns.domain_resolver = Global.SingboxLocalDNSTag;
+            var remoteDns = remoteDnsList[i];
+            var tag = string.Format(Global.SingboxRemoteDNSTagTemplate, i + 1);
+            remoteDns.tag = tag;
+            remoteDns.detour = Global.ProxyTag;
+            remoteDns.domain_resolver = Global.SingboxLocalDNSTag;
+        }
 
         var hostsDns = new Server4Sbox
         {
@@ -118,26 +103,28 @@ public partial class CoreConfigSingboxService
             {
                 finalDns.domain_resolver = Global.SingboxHostsDNSTag;
             }
-            if (remoteDns.server == host.Key)
+            foreach (var directDns in directDnsList.Where(directDns => directDns.server == host.Key))
-            {
-                remoteDns.domain_resolver = Global.SingboxHostsDNSTag;
-            }
-            if (directDns.server == host.Key)
             {
                 directDns.domain_resolver = Global.SingboxHostsDNSTag;
             }
+            foreach (var remoteDns in remoteDnsList.Where(remoteDns => remoteDns.server == host.Key))
+            {
+                remoteDns.domain_resolver = Global.SingboxHostsDNSTag;
+            }
         }
 
         _coreConfig.dns ??= new Dns4Sbox();
         _coreConfig.dns.servers ??= [];
-        _coreConfig.dns.servers.Add(remoteDns);
+        _coreConfig.dns.servers.AddRange(remoteDnsList);
-        _coreConfig.dns.servers.Add(directDns);
+        _coreConfig.dns.servers.AddRange(directDnsList);
         _coreConfig.dns.servers.Add(hostsDns);
 
         // fake ip
         if (simpleDnsItem.FakeIP == true)
         {
-            var fakeipRange = simpleDnsItem.FakeIPRange.IsNullOrEmpty() ? Global.FakeIPRanges.First() : simpleDnsItem.FakeIPRange;
+            var fakeipRange = simpleDnsItem.FakeIPRange.IsNullOrEmpty()
+                ? Global.FakeIPRanges.First()
+                : simpleDnsItem.FakeIPRange;
             var fakeip = new Server4Sbox
             {
                 tag = Global.SingboxFakeDNSTag,
@@ -164,33 +151,33 @@ public partial class CoreConfigSingboxService
         _coreConfig.dns ??= new Dns4Sbox();
         _coreConfig.dns.rules ??= [];
 
-        _coreConfig.dns.rules.Add(new() { ip_accept_any = true, server = Global.SingboxHostsDNSTag });
+        _coreConfig.dns.rules.Add(new()
+        {
+            preferred_by = Global.SingboxHostsDNSTag,
+            server = Global.SingboxHostsDNSTag,
+        });
 
         if (context.ProtectDomainList.Count > 0)
         {
             _coreConfig.dns.rules.Add(new()
             {
                 server = Global.SingboxDirectDNSTag,
-                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4ProxyDial),
                 domain = context.ProtectDomainList.ToList(),
             });
         }
 
-        _coreConfig.dns.rules.AddRange(new[]
+        _coreConfig.dns.rules.AddRange([
-        {
             new Rule4Sbox
             {
                 server = Global.SingboxRemoteDNSTag,
-                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy),
+                clash_mode = nameof(ERuleMode.Global),
-                clash_mode = nameof(ERuleMode.Global)
             },
             new Rule4Sbox
             {
                 server = Global.SingboxDirectDNSTag,
-                strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom),
+                clash_mode = nameof(ERuleMode.Direct),
-                clash_mode = nameof(ERuleMode.Direct)
+            },
-            }
+        ]);
-        });
 
         foreach (var kvp in Utils.ParseHostsToDictionary(simpleDnsItem.Hosts))
         {
@@ -199,7 +186,7 @@ public partial class CoreConfigSingboxService
             {
                 continue;
             }
-            var rule = new Rule4Sbox()
+            var rule = new Rule4Sbox
             {
                 query_type = [1, 5, 28], // A, CNAME and AAAA
                 action = "predefined",
@@ -262,13 +249,14 @@ public partial class CoreConfigSingboxService
             {
                 query_type = [64, 65],
                 action = "predefined",
-                rcode = "NOERROR"
+                rcode = "NOERROR",
             });
         }
 
         if (simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp != false)
         {
-            var fakeipFilterRule = JsonUtils.Deserialize<Rule4Sbox>(EmbedUtils.GetEmbedText(Global.SingboxFakeIPFilterFileName));
+            var fakeipFilterRule =
+                JsonUtils.Deserialize<Rule4Sbox>(EmbedUtils.GetEmbedText(Global.SingboxFakeIPFilterFileName));
             fakeipFilterRule.invert = true;
             var rule4Fake = new Rule4Sbox
             {
@@ -282,31 +270,45 @@ public partial class CoreConfigSingboxService
                     {
                         query_type = [1, 28], // A and AAAA
                     },
-                    fakeipFilterRule
+                    fakeipFilterRule,
-                ]
+                ],
             };
 
             _coreConfig.dns.rules.Add(rule4Fake);
         }
 
+        if (simpleDnsItem.BlockAAAAQuery == true)
+        {
+            _coreConfig.dns.rules.Add(new()
+            {
+                query_type = [28],
+                action = "predefined",
+                rcode = "NOERROR",
+            });
+        }
+
         var routing = context.RoutingItem;
         if (routing == null)
         {
             return;
         }
 
+        var directDnsList = _coreConfig.dns.servers
+            .Where(s => s.tag?.StartsWith(Global.SingboxDirectDNSTagPrefix) == true).ToList();
+        var remoteDnsList = _coreConfig.dns.servers
+            .Where(s => s.tag?.StartsWith(Global.SingboxRemoteDNSTagPrefix) == true).ToList();
+
         var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
-        var expectedIPCidr = new List<string>();
+        var expectedIPCidr = new HashSet<string>();
-        var expectedIPsRegions = new List<string>();
+        var expectedIPsRegions = new HashSet<string>();
         var regionName = string.Empty;
 
         if (!string.IsNullOrEmpty(simpleDnsItem?.DirectExpectedIPs))
         {
-            var ipItems = simpleDnsItem.DirectExpectedIPs
+            var ipItems = (Utils.String2List(simpleDnsItem.DirectExpectedIPs) ?? [])
-                .Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries)
                 .Select(s => s.Trim())
                 .Where(s => !string.IsNullOrEmpty(s))
-                .ToList();
+                .ToHashSet();
 
             foreach (var ip in ipItems)
             {
@@ -349,35 +351,60 @@ public partial class CoreConfigSingboxService
 
             if (item.OutboundTag == Global.DirectTag)
             {
-                rule.server = Global.SingboxDirectDNSTag;
+                Rule4Sbox? rule4ExpectedIPs = null;
-                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Freedom);
 
                 if (expectedIPsRegions.Count > 0 && rule.geosite?.Count > 0 && !regionName.IsNullOrEmpty())
                 {
-                    var regionGeosite = rule.geosite.Where(g => g.EndsWith($"-{regionName}", StringComparison.OrdinalIgnoreCase)
+                    var regionGeosite = rule.geosite.Where(g =>
-                                                     || g.EndsWith($"@{regionName}", StringComparison.OrdinalIgnoreCase)
+                        g.EndsWith($"-{regionName}", StringComparison.OrdinalIgnoreCase)
-                                                     || g == regionName).ToList();
+                        || g.EndsWith($"@{regionName}", StringComparison.OrdinalIgnoreCase)
+                        || g == regionName).ToList();
                     if (regionGeosite.Count > 0)
                     {
                         rule.geosite.RemoveAll(regionGeosite.Contains);
-                        var rule4ExpectedIPs = JsonUtils.DeepCopy(rule);
+                        rule4ExpectedIPs = JsonUtils.DeepCopy(rule);
                         rule4ExpectedIPs.geosite = regionGeosite;
+                    }
+                }
+
+                if (rule.geosite?.Count > 0 || rule.domain?.Count > 0)
+                {
+                    AddRules(rule, item, directDnsList);
+                }
+
+                if (rule4ExpectedIPs is not null)
+                {
+                    var expectedRuleList = BuildMultiRules(rule4ExpectedIPs, item, directDnsList);
+                    foreach (var expectedRule in
+                             expectedRuleList.Where(expectedRule => expectedRule.action == "respond"))
+                    {
                         if (expectedIPsRegions.Count > 0)
                         {
-                            rule4ExpectedIPs.geoip = expectedIPsRegions;
+                            expectedRule.geoip = expectedIPsRegions.ToList();
                         }
                         if (expectedIPCidr.Count > 0)
                         {
-                            rule4ExpectedIPs.ip_cidr = expectedIPCidr;
+                            expectedRule.ip_cidr = expectedIPCidr.ToList();
                         }
-                        _coreConfig.dns.rules.Add(rule4ExpectedIPs);
                     }
+                    _coreConfig.dns.rules.AddRange(expectedRuleList);
+                    var fallbackRemoteRuleList = BuildMultiRules(rule4ExpectedIPs, item, remoteDnsList);
+                    if (expectedRuleList.LastOrDefault()?.race == true)
+                    {
+                        foreach (var fallbackRemoteRule in fallbackRemoteRuleList.Where(fallbackRemoteRule =>
+                                     fallbackRemoteRule.action == "evaluate"))
+                        {
+                            fallbackRemoteRule.speculative = true;
+                        }
+                    }
+                    _coreConfig.dns.rules.AddRange(fallbackRemoteRuleList);
                 }
             }
             else if (item.OutboundTag == Global.BlockTag)
             {
                 rule.action = "predefined";
                 rule.rcode = "NXDOMAIN";
+                _coreConfig.dns.rules.Add(rule);
             }
             else
             {
@@ -385,15 +412,104 @@ public partial class CoreConfigSingboxService
                 {
                     var rule4Fake = JsonUtils.DeepCopy(rule);
                     rule4Fake.server = Global.SingboxFakeDNSTag;
-                    rule4Fake.query_type = new List<int> { 1, 28 }; // A and AAAA
+                    rule4Fake.query_type = new List<int>
+                    {
+                        1,
+                        28,
+                    }; // A and AAAA
                     rule4Fake.rewrite_ttl = 1;
                     _coreConfig.dns.rules.Add(rule4Fake);
                 }
-                rule.server = Global.SingboxRemoteDNSTag;
+                AddRules(rule, item, remoteDnsList);
-                rule.strategy = Utils.DomainStrategy4Sbox(simpleDnsItem.Strategy4Proxy);
             }
+        }
+        var useDirectDns = UseDirectDns();
+        if ((!useDirectDns) && simpleDnsItem.FakeIP == true && simpleDnsItem.GlobalFakeIp == false)
+        {
+            _coreConfig.dns.rules.Add(new()
+            {
+                server = Global.SingboxFakeDNSTag,
+                query_type =
+                [
+                    1,
+                    28,
+                ], // A and AAAA
+                rewrite_ttl = 1,
+            });
+        }
+        var tempRuleItem = new RulesItem
+        {
+            Id = $"final-{Utils.GetGuid(false)}",
+            Enabled = true,
+        };
+        AddRules(new(), tempRuleItem, useDirectDns ? directDnsList : remoteDnsList);
+        return;
 
-            _coreConfig.dns.rules.Add(rule);
+        static List<Rule4Sbox> BuildParallelRules(Rule4Sbox rule, RulesItem item, List<Server4Sbox> dnsList)
+        {
+            var evaluateRuleList = new List<Rule4Sbox>();
+            var racingMatchingRuleList = new List<Rule4Sbox>();
+            foreach (var dnsServer in dnsList)
+            {
+                var dnsServerTag = dnsServer.tag;
+                var evaluateRule = JsonUtils.DeepCopy(rule);
+                evaluateRule.action = "evaluate";
+                // Maybe rule index is better than id? Not sure, but id is unique, so use id for now.
+                var evaluateTag = $"{dnsServerTag}-{item.Id}";
+                evaluateRule.tag = evaluateTag;
+                evaluateRule.server = dnsServerTag;
+                evaluateRuleList.Add(evaluateRule);
+                var racingMatchingRule = new Rule4Sbox
+                {
+                    match_response = evaluateTag,
+                    race = true,
+                    action = "respond",
+                };
+                racingMatchingRuleList.Add(racingMatchingRule);
+            }
+            return [.. evaluateRuleList, .. racingMatchingRuleList];
+        }
+
+        static List<Rule4Sbox> BuildSerialRules(Rule4Sbox rule, RulesItem item, List<Server4Sbox> dnsList)
+        {
+            var ruleList = new List<Rule4Sbox>();
+            foreach (var dnsServer in dnsList)
+            {
+                var dnsServerTag = dnsServer.tag;
+                var evaluateRule = JsonUtils.DeepCopy(rule);
+                evaluateRule.action = "evaluate";
+                // Maybe rule index is better than id? Not sure, but id is unique, so use id for now.
+                var evaluateTag = $"{dnsServerTag}-{item.Id}";
+                evaluateRule.tag = evaluateTag;
+                evaluateRule.server = dnsServerTag;
+                ruleList.Add(evaluateRule);
+                var racingMatchingRule = new Rule4Sbox
+                {
+                    match_response = evaluateTag,
+                    action = "respond",
+                };
+                ruleList.Add(racingMatchingRule);
+            }
+            return ruleList;
+        }
+
+        List<Rule4Sbox> BuildMultiRules(Rule4Sbox rule, RulesItem item, List<Server4Sbox> dnsList)
+        {
+            return simpleDnsItem.ParallelQuery == true ? BuildParallelRules(rule, item, dnsList) : BuildSerialRules(rule, item, dnsList);
+        }
+
+        void AddRules(Rule4Sbox rule, RulesItem item, List<Server4Sbox> dnsList)
+        {
+            if (dnsList.Count == 1)
+            {
+                rule.server = dnsList.First().tag;
+                _coreConfig.dns.rules.Add(rule);
+            }
+            else
+            {
+                var ruleList = BuildMultiRules(rule, item, dnsList);
+                _coreConfig.dns.rules.AddRange(ruleList);
+            }
         }
     }
 
@@ -422,11 +538,15 @@ public partial class CoreConfigSingboxService
             var strDNS = string.Empty;
             if (context.IsTunEnabled)
             {
-                strDNS = string.IsNullOrEmpty(item?.TunDNS) ? EmbedUtils.GetEmbedText(Global.TunSingboxDNSFileName) : item?.TunDNS;
+                strDNS = string.IsNullOrEmpty(item?.TunDNS)
+                    ? EmbedUtils.GetEmbedText(Global.TunSingboxDNSFileName)
+                    : item?.TunDNS;
             }
             else
             {
-                strDNS = string.IsNullOrEmpty(item?.NormalDNS) ? EmbedUtils.GetEmbedText(Global.DNSSingboxNormalFileName) : item?.NormalDNS;
+                strDNS = string.IsNullOrEmpty(item?.NormalDNS)
+                    ? EmbedUtils.GetEmbedText(Global.DNSSingboxNormalFileName)
+                    : item?.NormalDNS;
             }
 
             var dns4Sbox = JsonUtils.Deserialize<Dns4Sbox>(strDNS);
@@ -454,15 +574,18 @@ public partial class CoreConfigSingboxService
         dns4Sbox.rules.Insert(0, new()
         {
             server = tag,
-            clash_mode = nameof(ERuleMode.Direct)
+            clash_mode = nameof(ERuleMode.Direct),
         });
         dns4Sbox.rules.Insert(0, new()
         {
-            server = dns4Sbox.servers.Where(t => t.detour == Global.ProxyTag).Select(t => t.tag).FirstOrDefault() ?? "remote",
+            server = dns4Sbox.servers.Where(t => t.detour == Global.ProxyTag).Select(t => t.tag).FirstOrDefault() ??
-            clash_mode = nameof(ERuleMode.Global)
+                     "remote",
+            clash_mode = nameof(ERuleMode.Global),
         });
 
-        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress) ? Global.DomainPureIPDNSAddress.FirstOrDefault() : dnsItem?.DomainDNSAddress;
+        var finalDnsAddress = string.IsNullOrEmpty(dnsItem?.DomainDNSAddress)
+            ? Global.DomainPureIPDNSAddress.FirstOrDefault()
+            : dnsItem?.DomainDNSAddress;
 
         var localDnsServer = ParseDnsAddress(finalDnsAddress);
         localDnsServer.tag = tag;
@@ -490,9 +613,21 @@ public partial class CoreConfigSingboxService
         };
     }
 
+    private static List<Server4Sbox> ParseDnsAddresses(string addresses)
+    {
+        var servers = new List<Server4Sbox>();
+        var addressList = Utils.String2List(addresses)?.ToList();
+        if (addressList is not { Count: > 0 })
+        {
+            return servers;
+        }
+        servers.AddRange(addressList.Select(ParseDnsAddress).Where(s => s != null));
+        return servers;
+    }
+
     private static Server4Sbox? ParseDnsAddress(string address)
     {
-        var addressFirst = address?.Split(address.Contains(',') ? ',' : ';').FirstOrDefault()?.Trim();
+        var addressFirst = Utils.String2List(address)?.FirstOrDefault()?.Trim();
         if (string.IsNullOrEmpty(addressFirst))
         {
             return null;
@@ -537,10 +672,33 @@ public partial class CoreConfigSingboxService
         {
             server.server_port = port;
         }
-        if ((server.type == "https" || server.type == "h3") && !string.IsNullOrEmpty(path) && path != "/")
+        if (server.type is "https" or "h3" && !string.IsNullOrEmpty(path) && path != "/")
         {
             server.path = path;
         }
         return server;
     }
+
+    private bool UseDirectDns()
+    {
+        var routing = context.RoutingItem;
+        var useDirectDns = false;
+        if (routing == null)
+        {
+            return useDirectDns;
+        }
+        var rules = JsonUtils.Deserialize<List<RulesItem>>(routing.RuleSet) ?? [];
+
+        if (rules?.LastOrDefault() is not { OutboundTag: Global.DirectTag } lastRule)
+        {
+            return useDirectDns;
+        }
+        var noDomain = lastRule.Domain == null || lastRule.Domain.Count == 0;
+        var noProcess = lastRule.Process == null || lastRule.Process.Count == 0;
+        var isAnyIp = lastRule.Ip == null || lastRule.Ip.Count == 0 || lastRule.Ip.Contains("0.0.0.0/0");
+        var isAnyPort = string.IsNullOrEmpty(lastRule.Port) || lastRule.Port == "0-65535";
+        var isAnyNetwork = string.IsNullOrEmpty(lastRule.Network) || lastRule.Network == "tcp,udp";
+        useDirectDns = noDomain && noProcess && isAnyIp && isAnyPort && isAnyNetwork;
+        return useDirectDns;
+    }
 }

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxInboundService.cs

@@ -21,26 +21,27 @@ public partial class CoreConfigSingboxService
                 };
                 _coreConfig.inbounds.Add(inbound);
 
+                var inboundConf = _config.Inbound.First();
                 inbound.listen_port = listenPort;
 
-                if (_config.Inbound.First().SecondLocalPortEnabled)
+                if (inboundConf.SecondLocalPortEnabled)
                 {
                     var inbound2 = BuildInbound(inbound, EInboundProtocol.socks2, true);
                     _coreConfig.inbounds.Add(inbound2);
                 }
 
-                if (_config.Inbound.First().AllowLANConn)
+                if (inboundConf.AllowLANConn)
                 {
-                    if (_config.Inbound.First().NewPort4LAN)
+                    if (inboundConf.NewPort4LAN)
                     {
                         var inbound3 = BuildInbound(inbound, EInboundProtocol.socks3, true);
                         inbound3.listen = listen;
                         _coreConfig.inbounds.Add(inbound3);
 
                         //auth
-                        if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
+                        if (inboundConf.User.IsNotEmpty() && inboundConf.Pass.IsNotEmpty())
                         {
-                            inbound3.users = new() { new() { username = _config.Inbound.First().User, password = _config.Inbound.First().Pass } };
+                            inbound3.users = new() { new() { username = inboundConf.User, password = inboundConf.Pass } };
                         }
                     }
                     else

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxRoutingService.cs

@@ -48,12 +48,18 @@ public partial class CoreConfigSingboxService
                 // packet straight back into the TUN, which hands it to the outbound again -
                 // an infinite loop that pins a CPU core. Drop instead of rejecting so no
                 // ICMP unreachable is generated back towards the same addresses.
+                //
+                // Match each address on its own, not the prefix it carries. On Linux sing-tun
+                // registers Inet4Address[0].Addr().Next() with systemd-resolved as a "~." DNS
+                // upstream, and every prefix offered here is a /30 or /126, so carrying the
+                // prefix through would cover that resolver address too and drop every system
+                // name lookup along with the loop.
                 var tunAddresses = _coreConfig.inbounds.FirstOrDefault(i => i.type == "tun")?.address;
                 if (tunAddresses?.Count > 0)
                 {
                     _coreConfig.route.rules.Add(new()
                     {
-                        ip_cidr = [.. tunAddresses],
+                        ip_cidr = [.. tunAddresses.Select(ToSingleAddressPrefix)],
                         action = "reject",
                         method = "drop",
                     });
@@ -238,7 +244,7 @@ public partial class CoreConfigSingboxService
             var resolveRule = new Rule4Sbox
             {
                 action = "resolve",
-                strategy = domainStrategy
+                strategy = domainStrategy,
             };
             if (_config.RoutingBasicItem.DomainStrategy == Global.IPOnDemand)
             {
@@ -284,6 +290,14 @@ public partial class CoreConfigSingboxService
         }
     }
 
+    private static string ToSingleAddressPrefix(string address)
+    {
+        var addr = address.Split('/').First();
+        return IPAddress.TryParse(addr, out var ip)
+            ? $"{addr}/{(ip.AddressFamily == AddressFamily.InterNetworkV6 ? 128 : 32)}"
+            : address;
+    }
+
     private List<string> BuildRoutingDirectExe()
     {
         var directExeSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxRulesetService.cs

@@ -79,6 +79,7 @@ public partial class CoreConfigSingboxService
 
         //Add ruleset srs
         _coreConfig.route.rule_set = [];
+        var containRemoteRuleset = false;
         foreach (var item in new HashSet<string>(ruleSets))
         {
             if (item.IsNullOrEmpty())
@@ -94,11 +95,13 @@ public partial class CoreConfigSingboxService
                         type = "local",
                         format = "binary",
                         tag = item,
-                        path = pathSrs
+                        path = pathSrs,
                     };
                 }
                 else
                 {
+                    containRemoteRuleset = true;
+
                     var srsUrl = string.IsNullOrEmpty(_config.ConstItem.SrsSourceUrl)
                         ? Global.SingboxRulesetUrl
                         : _config.ConstItem.SrsSourceUrl;
@@ -109,11 +112,21 @@ public partial class CoreConfigSingboxService
                         format = "binary",
                         tag = item,
                         url = string.Format(srsUrl, item.StartsWith(geosite) ? geosite : geoip, item),
-                        download_detour = Global.ProxyTag
+                        http_client = Global.SingboxSrsDownloadHttpClientTag,
                     };
                 }
             }
             _coreConfig.route.rule_set.Add(customRuleset);
         }
+
+        if (containRemoteRuleset)
+        {
+            _coreConfig.http_clients ??= [];
+            _coreConfig.http_clients.Add(new()
+            {
+                tag = Global.SingboxSrsDownloadHttpClientTag,
+                detour = Global.ProxyTag,
+            });
+        }
     }
 }

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayConfigTemplateService.cs

@@ -282,9 +282,8 @@ public partial class CoreConfigV2rayService
             return false;
         }
 
-        var outboundAddress = outbound.settings?.servers?.FirstOrDefault()?.address
+        var outboundAddress = outbound.settings?.address?.ToString()
-                              ?? outbound.settings?.vnext?.FirstOrDefault()?.address
+                              ?? outbound.settings?.peers?.FirstOrDefault()?.endpoint
-                              ?? outbound.settings?.address?.ToString()
                               ?? string.Empty;
 
         if (outboundAddress.Equals("localhost", StringComparison.OrdinalIgnoreCase))

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayDnsService.cs

@@ -82,6 +82,11 @@ public partial class CoreConfigV2rayService
             dnsItem.serveStale = simpleDnsItem?.ServeStale is true ? true : null;
             dnsItem.enableParallelQuery = simpleDnsItem?.ParallelQuery is true ? true : null;
 
+            if (simpleDnsItem.BlockAAAAQuery == true)
+            {
+                dnsItem.queryStrategy = "UseIPv4";
+            }
+
             // DNS routing
             var directDnsTags = dnsItem.servers
                 .Select(server =>
@@ -154,16 +159,16 @@ public partial class CoreConfigV2rayService
         var directDNSAddress = ParseDnsAddresses(simpleDNSItem?.DirectDNS, Global.DomainDirectDNSAddress.First());
         var remoteDNSAddress = ParseDnsAddresses(simpleDNSItem?.RemoteDNS, Global.DomainRemoteDNSAddress.First());
 
-        var directDomainList = new List<string>();
+        var directDomainList = new HashSet<string>();
-        var directGeositeList = new List<string>();
+        var directGeositeList = new HashSet<string>();
-        var proxyDomainList = new List<string>();
+        var proxyDomainList = new HashSet<string>();
-        var proxyGeositeList = new List<string>();
+        var proxyGeositeList = new HashSet<string>();
-        var expectedDomainList = new List<string>();
+        var expectedDomainList = new HashSet<string>();
-        var expectedIPs = new List<string>();
+        var expectedIPs = new HashSet<string>();
         var regionName = string.Empty;
 
         var bootstrapDNSAddress = ParseDnsAddresses(simpleDNSItem?.BootstrapDNS, Global.DomainPureIPDNSAddress.First());
-        var dnsServerDomains = new List<string>();
+        var dnsServerDomains = new HashSet<string>();
 
         foreach (var dns in directDNSAddress)
         {
@@ -189,15 +194,13 @@ public partial class CoreConfigV2rayService
                 dnsServerDomains.Add($"full:{domain}");
             }
         }
-        dnsServerDomains = dnsServerDomains.Distinct().ToList();
 
         if (!string.IsNullOrEmpty(simpleDNSItem?.DirectExpectedIPs))
         {
-            expectedIPs = simpleDNSItem.DirectExpectedIPs
+            expectedIPs = (Utils.String2List(simpleDNSItem.DirectExpectedIPs) ?? [])
-                .Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries)
                 .Select(s => s.Trim())
                 .Where(s => !string.IsNullOrEmpty(s))
-                .ToList();
+                .ToHashSet();
 
             foreach (var region in from ip in expectedIPs
                                    where ip.StartsWith(Global.GeoIPPrefix, StringComparison.OrdinalIgnoreCase)
@@ -264,15 +267,19 @@ public partial class CoreConfigV2rayService
             }
         }
 
-        if (context.ProtectDomainList.Count > 0)
-        {
-            directDomainList.AddRange(context.ProtectDomainList);
-        }
-
         dnsItem.servers ??= [];
 
         var directDnsTagIndex = 1;
 
+        if (dnsServerDomains.Count > 0)
+        {
+            AddDnsServers(bootstrapDNSAddress, dnsServerDomains);
+        }
+        if (context.ProtectDomainList.Count > 0)
+        {
+            AddDnsServers(directDNSAddress, context.ProtectDomainList, true);
+        }
+
         if (simpleDNSItem.FakeIP == true)
         {
             var fakeIPMatchDomain = new HashSet<string>(proxyDomainList);
@@ -286,7 +293,7 @@ public partial class CoreConfigV2rayService
             if (fakeIPMatchDomain.Count > 0)
             {
                 GenFakeDns();
-                AddDnsServers(["fakedns"], fakeIPMatchDomain.ToList());
+                AddDnsServers(["fakedns"], fakeIPMatchDomain);
             }
         }
 
@@ -295,10 +302,6 @@ public partial class CoreConfigV2rayService
         AddDnsServers(remoteDNSAddress, proxyGeositeList);
         AddDnsServers(directDNSAddress, directGeositeList, true);
         AddDnsServers(directDNSAddress, expectedDomainList, true, expectedIPs);
-        if (dnsServerDomains.Count > 0)
-        {
-            AddDnsServers(bootstrapDNSAddress, dnsServerDomains);
-        }
 
         var useDirectDns = false;
 
@@ -331,7 +334,7 @@ public partial class CoreConfigV2rayService
 
         static List<string> ParseDnsAddresses(string? dnsInput, string defaultAddress)
         {
-            var addresses = dnsInput?.Split(dnsInput.Contains(',') ? ',' : ';')
+            var addresses = (Utils.String2List(dnsInput) ?? [])
                 .Select(addr => addr.Trim())
                 .Where(addr => !string.IsNullOrEmpty(addr))
                 .Select(addr => addr.StartsWith("dhcp", StringComparison.OrdinalIgnoreCase) ? "localhost" : addr)
@@ -340,7 +343,7 @@ public partial class CoreConfigV2rayService
             return addresses.Count > 0 ? addresses : new List<string> { defaultAddress };
         }
 
-        static DnsServer4Ray CreateDnsServer(string dnsAddress, List<string> domains, List<string>? expectedIPs = null)
+        static DnsServer4Ray CreateDnsServer(string dnsAddress, HashSet<string> domains, HashSet<string>? expectedIPs = null)
         {
             var (domain, scheme, port, path) = Utils.ParseUrl(dnsAddress);
             var domainFinal = dnsAddress;
@@ -360,13 +363,13 @@ public partial class CoreConfigV2rayService
                 address = domainFinal,
                 port = portFinal,
                 skipFallback = true,
-                domains = domains.Count > 0 ? domains : null,
+                domains = domains.Count > 0 ? domains.ToList() : null,
-                expectedIPs = expectedIPs?.Count > 0 ? expectedIPs : null
+                expectedIPs = expectedIPs?.Count > 0 ? expectedIPs.ToList() : null
             };
             return dnsServer;
         }
 
-        void AddDnsServers(List<string> dnsAddresses, List<string> domains, bool isDirectDns = false, List<string>? expectedIPs = null)
+        void AddDnsServers(List<string> dnsAddresses, HashSet<string> domains, bool isDirectDns = false, HashSet<string>? expectedIPs = null)
         {
             if (domains.Count <= 0)
             {

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayInboundService.cs

@@ -9,37 +9,38 @@ public partial class CoreConfigV2rayService
             var listen = "0.0.0.0";
             var listenPort = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
             _coreConfig.inbounds = [];
-            var inbound = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks, true);
+            var inboundConf = _config.Inbound.First();
+            var inbound = BuildInbound(inboundConf, EInboundProtocol.socks, true);
             var isUsingLocalMixedPort = _node.Address == Global.Loopback && _node.Port == listenPort;
 
             if (!context.IsTunEnabled || !isUsingLocalMixedPort)
             {
                 _coreConfig.inbounds.Add(inbound);
 
-                if (_config.Inbound.First().SecondLocalPortEnabled)
+                if (inboundConf.SecondLocalPortEnabled)
                 {
-                    var inbound2 = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks2, true);
+                    var inbound2 = BuildInbound(inboundConf, EInboundProtocol.socks2, true);
                     _coreConfig.inbounds.Add(inbound2);
                 }
 
-                if (_config.Inbound.First().AllowLANConn)
+                if (inboundConf.AllowLANConn)
                 {
-                    if (_config.Inbound.First().NewPort4LAN)
+                    if (inboundConf.NewPort4LAN)
                     {
-                        var inbound3 = BuildInbound(_config.Inbound.First(), EInboundProtocol.socks3, true);
+                        var inbound3 = BuildInbound(inboundConf, EInboundProtocol.socks3, true);
                         inbound3.listen = listen;
                         _coreConfig.inbounds.Add(inbound3);
 
                         // auth
-                        if (_config.Inbound.First().User.IsNotEmpty() && _config.Inbound.First().Pass.IsNotEmpty())
+                        if (inboundConf.User.IsNotEmpty() && inboundConf.Pass.IsNotEmpty())
                         {
                             inbound3.settings.auth = "password";
                             inbound3.settings.accounts =
                             [
                                 new()
                                 {
-                                    user = _config.Inbound.First().User,
+                                    user = inboundConf.User,
-                                    pass = _config.Inbound.First().Pass,
+                                    pass = inboundConf.Pass,
                                 },
 
                             ];
@@ -66,12 +67,18 @@ public partial class CoreConfigV2rayService
 
                 var address = _config.TunModeItem.IPv4Address.NullIfEmpty() ?? Global.TunIPv4Address.First();
                 tunInbound.settings.gateway = [address];
-                tunInbound.settings.autoSystemRoutingTable = ["0.0.0.0/0"];
+                // Route both families into the tunnel regardless of EnableIPv6Address. That option only
+                // controls whether the interface gets an IPv6 address; leaving ::/0 out of the routing
+                // table makes IPv6 follow the system default route and bypass the tunnel entirely.
+                // A host without a global IPv6 address is the exception: it has nothing to leak,
+                // and IPv6 sent into the tunnel would have no way back out.
+                tunInbound.settings.autoSystemRoutingTable = context.HasGlobalIPv6Address
+                    ? ["0.0.0.0/0", "::/0"]
+                    : ["0.0.0.0/0"];
                 if (_config.TunModeItem.EnableIPv6Address == true)
                 {
                     var address6 = _config.TunModeItem.IPv6Address.NullIfEmpty() ?? Global.TunIPv6Address.First();
                     tunInbound.settings.gateway.Add(address6);
-                    tunInbound.settings.autoSystemRoutingTable.Add("::/0");
                 }
 
                 var bindInterface = _config.CoreBasicItem.BindInterface?.TrimEx();
@@ -80,6 +87,7 @@ public partial class CoreConfigV2rayService
                     tunInbound.settings.autoOutboundsInterface = bindInterface;
                 }
                 tunInbound.sniffing = inbound.sniffing;
+                // tunInbound.sniffing.routeOnly = inbound.sniffing.routeOnly;
                 tunInbound.sniffing.routeOnly = true;
 
                 if (_config.TunModeItem.RouteExcludeAddress is { Count: > 0 })
@@ -91,7 +99,9 @@ public partial class CoreConfigV2rayService
                         .Where(x => x != null).ToList();
 
                     var includeList = new List<IPNetwork2> { wholeInternet };
-                    var includeListV6 = new List<IPNetwork2> { wholeInternetV6 };
+                    var includeListV6 = context.HasGlobalIPv6Address
+                        ? new List<IPNetwork2> { wholeInternetV6 }
+                        : new List<IPNetwork2>();
 
                     foreach (var exclude in excludeList)
                     {
@@ -117,15 +127,8 @@ public partial class CoreConfigV2rayService
                     includeList = IPNetwork2.Supernet(includeList.ToArray()).ToList();
                     includeListV6 = IPNetwork2.Supernet(includeListV6.ToArray()).ToList();
 
-                    if (_config.TunModeItem.EnableIPv6Address)
+                    tunInbound.settings.autoSystemRoutingTable = includeList.Select(x => x.ToString())
-                    {
+                        .Concat(includeListV6.Select(x => x.ToString())).ToList();
-                        tunInbound.settings.autoSystemRoutingTable = includeList.Select(x => x.ToString())
-                            .Concat(includeListV6.Select(x => x.ToString())).ToList();
-                    }
-                    else
-                    {
-                        tunInbound.settings.autoSystemRoutingTable = includeList.Select(x => x.ToString()).ToList();
-                    }
                 }
 
                 _coreConfig.inbounds.Add(tunInbound);

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayOutboundService.cs

@@ -69,166 +69,88 @@ public partial class CoreConfigV2rayService
         {
             var protocolExtra = _node.GetProtocolExtra();
             var muxEnabled = _node.MuxEnabled ?? false;
+            var outboundSettings = outbound.settings;
             switch (_node.ConfigType)
             {
                 case EConfigType.VMess:
                     {
-                        VnextItem4Ray vnextItem;
+                        outboundSettings.address = _node.Address;
-                        if (outbound.settings.vnext.Count <= 0)
+                        outboundSettings.port = _node.Port;
-                        {
+                        outboundSettings.id = _node.Password;
-                            vnextItem = new VnextItem4Ray();
+                        outboundSettings.alterId = int.TryParse(protocolExtra?.AlterId, out var result) ? result : 0;
-                            outbound.settings.vnext.Add(vnextItem);
+                        outboundSettings.email = Global.UserEMail;
-                        }
-                        else
-                        {
-                            vnextItem = outbound.settings.vnext.First();
-                        }
-                        vnextItem.address = _node.Address;
-                        vnextItem.port = _node.Port;
-
-                        UsersItem4Ray usersItem;
-                        if (vnextItem.users.Count <= 0)
-                        {
-                            usersItem = new UsersItem4Ray();
-                            vnextItem.users.Add(usersItem);
-                        }
-                        else
-                        {
-                            usersItem = vnextItem.users.First();
-                        }
-
-                        usersItem.id = _node.Password;
-                        usersItem.alterId = int.TryParse(protocolExtra?.AlterId, out var result) ? result : 0;
-                        usersItem.email = Global.UserEMail;
                         if (Global.VmessSecurities.Contains(protocolExtra.VmessSecurity))
                         {
-                            usersItem.security = protocolExtra.VmessSecurity;
+                            outboundSettings.security = protocolExtra.VmessSecurity;
                         }
                         else
                         {
-                            usersItem.security = Global.DefaultSecurity;
+                            outboundSettings.security = Global.DefaultSecurity;
                         }
 
                         FillOutboundMux(outbound, muxEnabled, muxEnabled);
-
-                        outbound.settings.servers = null;
                         break;
                     }
                 case EConfigType.Shadowsocks:
                     {
-                        ServersItem4Ray serversItem;
+                        outboundSettings.address = _node.Address;
-                        if (outbound.settings.servers.Count <= 0)
+                        outboundSettings.port = _node.Port;
-                        {
+                        outboundSettings.password = _node.Password;
-                            serversItem = new ServersItem4Ray();
+                        outboundSettings.method = AppManager.Instance.GetShadowsocksSecurities(_node).Contains(protocolExtra.SsMethod)
-                            outbound.settings.servers.Add(serversItem);
-                        }
-                        else
-                        {
-                            serversItem = outbound.settings.servers.First();
-                        }
-                        serversItem.address = _node.Address;
-                        serversItem.port = _node.Port;
-                        serversItem.password = _node.Password;
-                        serversItem.method = AppManager.Instance.GetShadowsocksSecurities(_node).Contains(protocolExtra.SsMethod)
                             ? protocolExtra.SsMethod : "none";
-                        serversItem.uot = protocolExtra.Uot == true ? true : null;
+                        outboundSettings.uot = protocolExtra.Uot == true ? true : null;
 
-                        serversItem.ota = false;
+                        outboundSettings.ota = false;
-                        serversItem.level = 1;
+                        outboundSettings.level = 1;
 
                         FillOutboundMux(outbound);
-
-                        outbound.settings.vnext = null;
                         break;
                     }
                 case EConfigType.SOCKS:
                     {
-                        ServersItem4Ray serversItem;
+                        outboundSettings.address = _node.Address;
-                        if (outbound.settings.servers.Count <= 0)
+                        outboundSettings.port = _node.Port;
-                        {
-                            serversItem = new ServersItem4Ray();
-                            outbound.settings.servers.Add(serversItem);
-                        }
-                        else
-                        {
-                            serversItem = outbound.settings.servers.First();
-                        }
-                        serversItem.address = _node.Address;
-                        serversItem.port = _node.Port;
-                        serversItem.method = null;
-                        serversItem.password = null;
-
                         if (_node.Username.IsNotEmpty()
                             && _node.Password.IsNotEmpty())
                         {
-                            SocksUsersItem4Ray socksUsersItem = new()
+                            outboundSettings.user = _node.Username;
-                            {
+                            outboundSettings.pass = _node.Password;
-                                user = _node.Username ?? "",
+                            outboundSettings.level = 1;
-                                pass = _node.Password,
+                            outboundSettings.email = Global.UserEMail;
-                                level = 1
-                            };
-
-                            serversItem.users = new List<SocksUsersItem4Ray>() { socksUsersItem };
                         }
 
                         FillOutboundMux(outbound);
-
-                        outbound.settings.vnext = null;
                         break;
                     }
                 case EConfigType.HTTP:
                     {
-                        outbound.settings.address = _node.Address;
+                        outboundSettings.address = _node.Address;
-                        outbound.settings.port = _node.Port;
+                        outboundSettings.port = _node.Port;
 
                         if (protocolExtra.HttpHeaders.IsNotEmpty())
                         {
-                            outbound.settings.headers = JsonUtils.ParseJson(protocolExtra.HttpHeaders);
+                            outboundSettings.headers = JsonUtils.ParseJson(protocolExtra.HttpHeaders);
                         }
 
                         if (_node.Username.IsNotEmpty()
                             && _node.Password.IsNotEmpty())
                         {
-                            outbound.settings.user = _node.Username;
+                            outboundSettings.user = _node.Username;
-                            outbound.settings.pass = _node.Password;
+                            outboundSettings.pass = _node.Password;
-                            outbound.settings.level = 1;
+                            outboundSettings.level = 1;
-                            outbound.settings.email = Global.UserEMail;
+                            outboundSettings.email = Global.UserEMail;
                         }
 
                         FillOutboundMux(outbound);
-
-                        outbound.settings.vnext = null;
-                        outbound.settings.servers = null;
                         break;
                     }
                 case EConfigType.VLESS:
                     {
-                        VnextItem4Ray vnextItem;
+                        outboundSettings.address = _node.Address;
-                        if (outbound.settings.vnext?.Count <= 0)
+                        outboundSettings.port = _node.Port;
-                        {
+                        outboundSettings.id = _node.Password;
-                            vnextItem = new VnextItem4Ray();
+                        outboundSettings.email = Global.UserEMail;
-                            outbound.settings.vnext.Add(vnextItem);
+                        outboundSettings.encryption = protocolExtra.VlessEncryption;
-                        }
-                        else
-                        {
-                            vnextItem = outbound.settings.vnext.First();
-                        }
-                        vnextItem.address = _node.Address;
-                        vnextItem.port = _node.Port;
-
-                        UsersItem4Ray usersItem;
-                        if (vnextItem.users.Count <= 0)
-                        {
-                            usersItem = new UsersItem4Ray();
-                            vnextItem.users.Add(usersItem);
-                        }
-                        else
-                        {
-                            usersItem = vnextItem.users.First();
-                        }
-                        usersItem.id = _node.Password;
-                        usersItem.email = Global.UserEMail;
-                        usersItem.encryption = protocolExtra.VlessEncryption;
 
                         if (protocolExtra.Flow.IsNullOrEmpty())
                         {
@@ -236,46 +158,28 @@ public partial class CoreConfigV2rayService
                         }
                         else
                         {
-                            usersItem.flow = protocolExtra.Flow;
+                            outboundSettings.flow = protocolExtra.Flow;
                             FillOutboundMux(outbound, false, muxEnabled);
                         }
-                        outbound.settings.servers = null;
                         break;
                     }
                 case EConfigType.Trojan:
                     {
-                        ServersItem4Ray serversItem;
+                        outboundSettings.address = _node.Address;
-                        if (outbound.settings.servers.Count <= 0)
+                        outboundSettings.port = _node.Port;
-                        {
+                        outboundSettings.password = _node.Password;
-                            serversItem = new ServersItem4Ray();
-                            outbound.settings.servers.Add(serversItem);
-                        }
-                        else
-                        {
-                            serversItem = outbound.settings.servers.First();
-                        }
-                        serversItem.address = _node.Address;
-                        serversItem.port = _node.Port;
-                        serversItem.password = _node.Password;
 
-                        serversItem.ota = false;
+                        outboundSettings.ota = false;
-                        serversItem.level = 1;
+                        outboundSettings.level = 1;
 
                         FillOutboundMux(outbound);
-
-                        outbound.settings.vnext = null;
                         break;
                     }
                 case EConfigType.Hysteria2:
                     {
-                        outbound.settings = new()
+                        outboundSettings.address = _node.Address;
-                        {
+                        outboundSettings.port = _node.Port;
-                            version = 2,
+                        outboundSettings.version = 2;
-                            address = _node.Address,
-                            port = _node.Port,
-                            vnext = null,
-                            servers = null,
-                        };
                         break;
                     }
                 case EConfigType.WireGuard:
@@ -297,11 +201,10 @@ public partial class CoreConfigV2rayService
                             secretKey = _node.Password,
                             reserved = Utils.String2List(protocolExtra.WgReserved)?.Select(s => s.Trim()).Select(int.Parse).ToList(),
                             mtu = protocolExtra.WgMtu > 0 ? protocolExtra.WgMtu : Global.TunMtus.First(),
-                            peers = [peer]
+                            remoteDNS = Utils.String2List(protocolExtra.WgDns)?.Select(s => s.Trim()).ToList(),
+                            peers = [peer],
                         };
                         outbound.settings = setting;
-                        outbound.settings.vnext = null;
-                        outbound.settings.servers = null;
                         break;
                     }
             }
@@ -512,6 +415,7 @@ public partial class CoreConfigV2rayService
                             settings = new MaskSettings4Ray { value = kcpSeed },
                         });
                     }
+                    kcpFinalmask.udp?.Reverse();
                     streamSettings.kcpSettings = kcpSettings;
                     streamSettings.finalmask = kcpFinalmask;
                     break;
@@ -666,6 +570,7 @@ public partial class CoreConfigV2rayService
                         version = 2,
                         auth = _node.Password,
                     };
+                    hy2Finalmask.udp?.Reverse();
                     streamSettings.finalmask = hy2Finalmask;
                     break;