147cc0038c
Reject pure-IP rule-set references without match_response
...
DNS rules referencing rule-sets that contain only ip_cidr predicates
silently stopped matching when legacy DNS mode was disabled, because the
IP-CIDR branch cannot match against an in-flight DNS query. The existing
validation intentionally let every rule_set through on the premise that
mixed sets still work via their non-IP branches, which is only true when
such a branch exists. Track whether a rule-set carries any non-IP-CIDR
predicate and reject pure-IP references the same way bare ip_cidr fields
are already rejected.
2026-04-17 14:06:46 +08:00
6288bb94d5
Fix legacy rule-set download_detour blocked by empty direct check
2026-04-17 14:06:46 +08:00
f2cf356679
Add TLS spoof support
2026-04-17 14:06:46 +08:00
baa5556fc4
Standardize hosts path
2026-04-17 14:06:46 +08:00
4fdfda25d8
Refactor: HTTP clients, unified HTTP2/QUIC options, Apple engines
2026-04-17 14:06:46 +08:00
a6fd0604cc
oom-killer: Record report before reset network
2026-04-16 16:49:01 +08:00
ca63351ec2
Add optimistic DNS cache
2026-04-16 16:49:01 +08:00
d89783ba3d
Fix tailscale error
2026-04-16 16:49:01 +08:00
845e94d7d3
Fix darwin cgo DNS again
2026-04-16 16:49:01 +08:00
bf3454ee5e
Fix stun test
2026-04-16 16:49:01 +08:00
83c67939fa
documentation: Fix missing update for ip_version and query_type
2026-04-16 16:49:01 +08:00
00adb23810
Add cloudflared inbound
2026-04-16 16:48:49 +08:00
34fdc29f18
Fix lint errors
2026-04-16 16:48:23 +08:00
1b5fd56232
platform: Wrap command RPC error returns with E.Cause
2026-04-16 16:48:23 +08:00
49704b49cc
Add package_name_regex route, DNS and headless rule item
2026-04-16 16:48:22 +08:00
539302511a
documentation: Fixes
2026-04-16 16:48:22 +08:00
e80b662da8
Un-deprecate ip_accept_any DNS rule item
2026-04-16 16:48:22 +08:00
c80f4add73
tools: Tailscale status
2026-04-16 16:48:22 +08:00
32a34ef434
Fix darwin local DNS transport
2026-04-16 16:48:21 +08:00
f72c4c1f88
Fix rules lock
2026-04-16 16:48:21 +08:00
90c342e941
Revert "Also enable certificate store by default on Apple platforms"
...
This reverts commit 62cb06c02f
2026-04-16 16:48:21 +08:00
d70bfb9bb6
tools: Tailscale status
2026-04-16 16:48:21 +08:00
47f09c96a9
platform: Fix darwin signal handler
2026-04-16 16:48:20 +08:00
3769ad4296
tools: Network Quality & STUN
2026-04-16 16:48:20 +08:00
fcb43d7cf9
oom-killer: Free memory on pressure notification and use gradual interval backoff
2026-04-16 16:48:20 +08:00
16e81c4c68
Fix deprecated warning double-formatting on localized clients
2026-04-16 16:48:19 +08:00
6912e272ea
platform: Fix set local
2026-04-16 16:48:19 +08:00
c208f4aea4
Add evaluate DNS rule action and related rule items
2026-04-16 16:48:19 +08:00
e4450ec230
Also enable certificate store by default on Apple platforms
...
`SecTrustEvaluateWithError` is serial
2026-04-16 16:48:18 +08:00
d4dacfc480
platform: Add OOM Report & Crash Report
2026-04-16 16:48:08 +08:00
a45639370f
Add BBR profile and hop interval randomization for Hysteria2
2026-04-16 16:46:15 +08:00
986de07d0c
Refactor ACME support to certificate provider
2026-04-16 16:46:15 +08:00
284c4d8494
documentation: Update descriptions for neighbor rules
2026-04-16 16:46:14 +08:00
129396f490
Add macOS support for MAC and hostname rule items
2026-04-16 16:46:14 +08:00
df806c96fb
Add Android support for MAC and hostname rule items
2026-04-16 16:46:14 +08:00
72a039a8f3
Add MAC and hostname rule items
2026-04-16 16:46:13 +08:00
9b155ba467
Fix rdrc cache
2026-04-16 16:45:50 +08:00
7ed5ef6da4
sing: Fix udpnat2 timeout
2026-04-16 16:45:38 +08:00
bb3ad9c694
documentation: Fix typo
2026-04-14 16:00:47 +08:00
d5adb54bc6
Bump version
2026-04-14 14:33:19 +08:00
1cfcea769f
Update Go to 1.25.9
2026-04-14 14:26:59 +08:00
f43fc797d4
Update naiveproxy to v147.0.7727.49-1
2026-04-14 14:24:21 +08:00
8e3176b789
Fix FakeIP returning error for unconfigured address family
...
Return SUCCESS with empty answers instead of an error when the
queried address family has no range configured. Reject configurations
where neither inet4_range nor inet6_range is set.
2026-04-14 14:15:20 +08:00
025b947a24
Bump version
2026-04-10 16:23:45 +08:00
76fa3c2e5e
tun: Fixes
2026-04-10 14:13:06 +08:00
53db1f178c
Fix tailscale crash
2026-04-10 14:09:03 +08:00
55ec8abf17
Fix local DNS server for Android
2026-04-10 14:08:57 +08:00
5a957fd750
Fix EDNS OPT record corruption in DNS cache
...
The TTL computation and assignment loops treat OPT record's Hdr.Ttl
as a regular TTL, but per RFC 6891 it encodes EDNS0 metadata
(ExtRCode|Version|Flags). This corrupts cached responses causing
systemd-resolved to reject them with EDNS version 255.
Also fix pointer aliasing: storeCache() stored raw *dns.Msg pointer
so subsequent mutations by Exchange() corrupted cached data.
- Skip OPT records in all TTL loops (Exchange + loadResponse)
- Use message.Copy() in storeCache() to isolate cache from mutations
2026-04-10 14:08:24 +08:00
7c3d8cf8db
Fix disable tcp keep alive
2026-04-10 13:29:15 +08:00
813b634d08
Bump version
2026-04-06 23:09:11 +08:00
世界