Skip to content

Routing Bug in Xray Core v26.4.17 & v26.4.15 #5993

Description

@farid220

Integrity requirements

  • I have read all the comments in the issue template and ensured that this issue meet the requirements.
  • I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
  • I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
  • I searched issues and did not find any similar issues.
  • The problem can be successfully reproduced in the latest Release

Description

Hi.
First of all thanks for all the great people who contribute to this project.

I want to report a bug. The last new versions of Xray Core (v26.4.15 & v26.4.17) have some sort of (maybe routing?) problem.

This is my setup:

Client ----> (Middle Server)Inbound8443 (VLESS_XHTTP_TLS) ----> (MainServer)CloudFlare (VLESS_XHTTP_TLS) ----> Fragment ----> WireGuard (Main Uplink to Free Internet)
So in order to connect to my MainServer which is behind CF, I first need to connect to a WG connection.

It is a chain proxy. CF's dialer is Fragment and Fragment's dialer is the WG connection.

Everything worked fine until Xray Core v26.4.13. But these last versions have a problem in which I get EOF. But when I skip CF and consecutively the Fragment, and select WG as my OutboundTag it WORKS FINE. But I need to make it go through CF to keep my IP and keep anonymity. As I said everything works fine in v26.4.13 and my connection goes through (CF-->Fragment-->WG) but when I upgrade the core, it starts giving me EOF errors. Checking the access.log shows nothing abnormal; I'm able to connect to my middle server and it shows it is being routed through my CF outbound. I doubled checked not to route my traffic through "blackhole". Interesting thing is it works for a 2-3 seconds when I restart the core and again it keeps giving me EOF.

So this leads to conclusion that something has changed since v26.4.13 that keeps terminating the connection.

I'd be grateful if you could analyze it.

PS:

I was looking at the commit after v26.4.13; Can it be because of this feature??? (Direct/Freedom outbound: Add ipsBlocked (supports IP, CIDR, "geoip:", "ext:") and apply a default safe policy#5947)

I see some IPs:

"0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.88.99.0/24", "192.168.0.0/16", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/3", "::/127", "fc00::/7", "fe80::/10", "ff00::/8",

and my $WG_PRIV_IP is a 10.0.0.0/8 IP. (I don't have the access to the WG server to change the IP)

Reproduction Method

Already Explained.

Client config

Details

{
  "dns": {
    "queryStrategy": "UseIP",
    "servers": [
      {
        "address": "8.8.8.8",
        "skipFallback": false
      }
    ],
    "tag": "dns_out"
  },
  "inbounds": [
    {
      "port": 10808,
      "protocol": "mixed",
      "settings": {
        "auth": "noauth",
        "udp": true,
        "userLevel": 8
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": true
      },
      "tag": "mixed"
    },
    {
      "port": 10809,
      "protocol": "http",
      "settings": {
        "userLevel": 8
      },
      "tag": "http"
    }
  ],
  "log": {
    "loglevel": "warning"
  },
  "outbounds": [
    {
      "protocol": "vless",
      "tag": "proxy",
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "sockopt": {
          "dialerProxy": "fragment",
          "tcpKeepAliveIdle": 100,
          "tcpMptcp": true,
          "penetrate": true
        },
        "tlsSettings": {
          "pinnedPeerCertSha256": "$ServerCertSHA256",
          "alpn": [
            "h3",
            "h2",
            "http/1.1"
          ],
          "fingerprint": "firefox",
          "serverName": "$SNI"
        },
        "xhttpSettings": {
          "headers": {},
          "host": "$SNI",
          "mode": "auto",
          "noSSEHeader": false,
          "path": "/",
          "scMaxBufferedPosts": 30,
          "scMaxEachPostBytes": "1000000",
          "scStreamUpServerSecs": "20-80",
          "seqKey": "",
          "seqPlacement": "",
          "sessionKey": "",
          "sessionPlacement": "",
          "uplinkChunkSize": 0,
          "uplinkDataKey": "",
          "uplinkDataPlacement": "",
          "uplinkHTTPMethod": "",
          "xPaddingBytes": "100-1000",
          "xPaddingHeader": "",
          "xPaddingKey": "",
          "xPaddingMethod": "",
          "xPaddingObfsMode": false,
          "xPaddingPlacement": ""
        }
      },
      "settings": {
        "vnext": [
          {
            "address": "$IP",
            "port": 8443,
            "users": [
              {
                "encryption": "$Encryption",
                "id": "$UUID",
                "level": 8
              }
            ]
          }
        ]
      }
    },
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "noises": [],
        "redirect": ""
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      },
      "tag": "block"
    },
    {
      "tag": "fragment",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "fragment": {
          "packets": "tlshello",
          "length": "4-6",
          "interval": "1-3",
          "maxSplit": "300-400"
        }
      },
      "streamSettings": {
        "sockopt": {
          "tcpKeepAliveIdle": 100,
          "tcpMptcp": true,
          "penetrate": true
        }
      }
    },
    {
      "tag": "noises",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "noises": [
          {
            "type": "rand",
            "packet": "10-20",
            "delay": "10-16",
            "applyTo": "ip"
          }
        ]
      }
    }
  ],
  "policy": {
    "levels": {
      "8": {
        "connIdle": 300,
        "downlinkOnly": 1,
        "handshake": 4,
        "uplinkOnly": 1
      }
    },
    "system": {
      "statsOutboundDownlink": true,
      "statsOutboundUplink": true
    }
  },
  "remarks": "$Remark",
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "domain": [
          "geosite:category-ir"
        ],
        "outboundTag": "direct",
        "type": "field"
      },
      {
        "ip": [
          "geoip:private",
          "geoip:ir"
        ],
        "outboundTag": "direct",
        "type": "field"
      },
      {
        "network": "tcp,udp",
        "outboundTag": "proxy",
        "type": "field"
      }
    ]
  },
  "stats": {}
}

Server config

Details

{
  "api": {
    "services": [
      "HandlerService",
      "LoggerService",
      "StatsService"
    ],
    "tag": "api"
  },
  "burstObservatory": {
    "pingConfig": {
      "connectivity": "http://connectivitycheck.platform.hicloud.com/generate_204",
      "destination": "https://www.google.com/generate_204",
      "interval": "30m",
      "sampling": 2,
      "timeout": "10s"
    },
    "subjectSelector": [
      "cf_xhttp"
    ]
  },
  "dns": null,
  "fakedns": null,
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 62789,
      "protocol": "tunnel",
      "settings": {
        "address": "127.0.0.1"
      },
      "sniffing": null,
      "streamSettings": null,
      "tag": "api"
    },
    {
      "listen": "0.0.0.0",
      "port": 8443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "email": "$Remark",
            "flow": "",
            "id": "$INBOUND_ID"
          }
        ],
        "decryption": "$IN_DEC",
        "encryption": "$IN_ENC",
        "selectedAuth": "X25519, not Post-Quantum"
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "quic",
          "fakedns"
        ],
        "enabled": false,
        "metadataOnly": false,
        "routeOnly": false
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "sockopt": {
          "V6Only": false,
          "acceptProxyProtocol": false,
          "dialerProxy": "cf_xhttp",
          "domainStrategy": "UseIP",
          "interface": "",
          "mark": 0,
          "penetrate": false,
          "tcpFastOpen": true,
          "tcpKeepAliveIdle": 300,
          "tcpKeepAliveInterval": 0,
          "tcpMaxSeg": 1440,
          "tcpMptcp": true,
          "tcpUserTimeout": 10000,
          "tcpWindowClamp": 600,
          "tcpcongestion": "bbr",
          "tproxy": "off"
        },
        "tlsSettings": {
          "alpn": [
            "h3",
            "h2",
            "http/1.1"
          ],
          "certificates": [
            {
              "buildChain": false,
              "certificateFile": "/root/cert/sometestdomain.com/fullchain.pem",
              "keyFile": "/root/cert/sometestdomain.com/privkey.pem",
              "oneTimeLoading": false,
              "usage": "encipherment"
            }
          ],
          "cipherSuites": "",
          "disableSystemRoot": false,
          "echForceQuery": "none",
          "echServerKeys": "",
          "enableSessionResumption": true,
          "maxVersion": "1.3",
          "minVersion": "1.2",
          "rejectUnknownSni": false,
          "serverName": "$SNI"
        },
        "xhttpSettings": {
          "headers": {},
          "host": "$SNI",
          "mode": "auto",
          "noSSEHeader": false,
          "path": "/",
          "scMaxBufferedPosts": 30,
          "scMaxEachPostBytes": "1000000",
          "scStreamUpServerSecs": "20-80",
          "seqKey": "",
          "seqPlacement": "",
          "sessionKey": "",
          "sessionPlacement": "",
          "uplinkChunkSize": 0,
          "uplinkDataKey": "",
          "uplinkDataPlacement": "",
          "uplinkHTTPMethod": "",
          "xPaddingBytes": "100-1000",
          "xPaddingHeader": "",
          "xPaddingKey": "",
          "xPaddingMethod": "",
          "xPaddingObfsMode": false,
          "xPaddingPlacement": ""
        }
      },
      "tag": "inbound-8443"
    }
  ],
  "log": {
    "access": "./access.log",
    "dnsLog": false,
    "error": "./error.log",
    "loglevel": "warning",
    "maskAddress": ""
  },
  "metrics": {
    "listen": "127.0.0.1:11111",
    "tag": "metrics_out"
  },
  "observatory": null,
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "noises": [],
        "redirect": ""
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    },
    {
      "protocol": "wireguard",
      "settings": {
        "address": [
          "$WG_PRIV_IP/32"
        ],
        "domainStrategy": "ForceIP",
        "mtu": 1000,
        "noKernelTun": false,
        "peers": [
          {
            "allowedIPs": [
              "0.0.0.0/0",
              "::/0"
            ],
            "endpoint": "$WG_ENDPOINT",
            "keepAlive": 5,
            "preSharedKey": "$PSK",
            "publicKey": "$WG_PUBKEY"
          }
        ],
        "secretKey": "$WG_PRIVKEY",
        "workers": 2
      },
      "streamSettings": {
        "sockopt": {
          "addressPortStrategy": "none",
          "dialerProxy": "",
          "penetrate": true,
          "tcpFastOpen": true,
          "tcpKeepAliveInterval": 0,
          "tcpMptcp": true
        }
      },
      "tag": "WG"
    },
    {
      "protocol": "freedom",
      "settings": {
        "fragment": {
          "interval": "1-3",
          "length": "10-15",
          "maxSplit": "",
          "packets": "tlshello"
        },
        "noises": [
          {
            "applyTo": "ip",
            "delay": "10-16",
            "packet": "10-20",
            "type": "rand"
          }
        ]
      },
      "streamSettings": {
        "sockopt": {
          "addressPortStrategy": "none",
          "dialerProxy": "WG",
          "penetrate": false,
          "tcpFastOpen": false,
          "tcpKeepAliveInterval": 0,
          "tcpMptcp": false
        }
      },
      "tag": "UP_Fragment"
    },
    {
      "protocol": "vless",
      "settings": {
        "address": "$CF_IP",
        "encryption": "none",
        "flow": "",
        "id": "$CF_UUID",
        "port": 8443
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "sockopt": {
          "addressPortStrategy": "none",
          "dialerProxy": "UP_Fragment",
          "penetrate": false,
          "tcpFastOpen": true,
          "tcpKeepAliveInterval": 0,
          "tcpMptcp": true
        },
        "tlsSettings": {
          "alpn": [
            "h3",
            "h2",
            "http/1.1"
          ],
          "echConfigList": "",
          "fingerprint": "firefox",
          "pinnedPeerCertSha256": "",
          "serverName": "$UP_SNI",
          "verifyPeerCertByName": ""
        },
        "xhttpSettings": {
          "host": "$UP_SNI",
          "mode": "stream-one",
          "noGRPCHeader": false,
          "path": "/",
          "scMinPostsIntervalMs": "30",
          "xmux": {
            "cMaxReuseTimes": 0,
            "hKeepAlivePeriod": 0,
            "hMaxRequestTimes": "600-900",
            "hMaxReusableSecs": "1800-3000",
            "maxConcurrency": "16-32",
            "maxConnections": 0
          }
        }
      },
      "tag": "cf_xhttp"
    }
  ],
  "policy": {
    "levels": {
      "0": {
        "statsUserDownlink": true,
        "statsUserUplink": true
      }
    },
    "system": {
      "statsInboundDownlink": true,
      "statsInboundUplink": true,
      "statsOutboundDownlink": true,
      "statsOutboundUplink": true
    }
  },
  "reverse": null,
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api",
        "type": "field"
      },
      {
        "ip": [
          "geoip:private",
          "ext:geoip_IR.dat:ir"
        ],
        "outboundTag": "blocked",
        "type": "field"
      },
      {
        "domain": [
          "ext:geosite_IR.dat:category-ads-all",
          "ext:geosite_RU.dat:category-ads-all",
          "ext:geosite_IR.dat:malware",
          "ext:geosite_IR.dat:phishing",
          "ext:geosite_IR.dat:cryptominers",
          "ext:geosite_IR.dat:ir",
          "regexp:.*\\.ir$",
          "regexp:.*\\.xn--mgba3a4f16a$"
        ],
        "outboundTag": "blocked",
        "type": "field"
      },
      {
        "outboundTag": "blocked",
        "protocol": [
          "bittorrent"
        ],
        "type": "field"
      },
      {
        "inboundTag": [
          "inbound-8443"
        ],
        "outboundTag": "cf_xhttp",
        "type": "field"
      }
    ]
  },
  "stats": {},
  "transport": null
}

Client log

Not Needed

Server log

Not Needed

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions