chore: update sing-tun

https://github.com/MetaCubeX/mihomo/issues/2334

.github/patch/go1.21.patch

@@ -0,0 +1,182 @@
+Subject: [PATCH] Revert "[release-branch.go1.21] crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
+---
+Index: src/crypto/rand/rand.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand.go b/src/crypto/rand/rand.go
+--- a/src/crypto/rand/rand.go	(revision 8bba868de983dd7bf55fcd121495ba8d6e2734e7)
++++ b/src/crypto/rand/rand.go	(revision 7e6c963d81e14ee394402671d4044b2940c8d2c1)
+@@ -15,7 +15,7 @@
+ // available, /dev/urandom otherwise.
+ // On OpenBSD and macOS, Reader uses getentropy(2).
+ // On other Unix-like systems, Reader reads from /dev/urandom.
+-// On Windows systems, Reader uses the ProcessPrng API.
++// On Windows systems, Reader uses the RtlGenRandom API.
+ // On JS/Wasm, Reader uses the Web Crypto API.
+ // On WASIP1/Wasm, Reader uses random_get from wasi_snapshot_preview1.
+ var Reader io.Reader
+Index: src/crypto/rand/rand_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand_windows.go b/src/crypto/rand/rand_windows.go
+--- a/src/crypto/rand/rand_windows.go	(revision 8bba868de983dd7bf55fcd121495ba8d6e2734e7)
++++ b/src/crypto/rand/rand_windows.go	(revision 7e6c963d81e14ee394402671d4044b2940c8d2c1)
+@@ -15,8 +15,11 @@
+ 
+ type rngReader struct{}
+ 
+-func (r *rngReader) Read(b []byte) (int, error) {
+-	if err := windows.ProcessPrng(b); err != nil {
++func (r *rngReader) Read(b []byte) (n int, err error) {
++	// RtlGenRandom only returns 1<<32-1 bytes at a time. We only read at
++	// most 1<<31-1 bytes at a time so that  this works the same on 32-bit
++	// and 64-bit systems.
++	if err := batched(windows.RtlGenRandom, 1<<31-1)(b); err != nil {
+ 		return 0, err
+ 	}
+ 	return len(b), nil
+Index: src/internal/syscall/windows/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/syscall_windows.go b/src/internal/syscall/windows/syscall_windows.go
+--- a/src/internal/syscall/windows/syscall_windows.go	(revision 8bba868de983dd7bf55fcd121495ba8d6e2734e7)
++++ b/src/internal/syscall/windows/syscall_windows.go	(revision 7e6c963d81e14ee394402671d4044b2940c8d2c1)
+@@ -384,7 +384,7 @@
+ //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
+ //sys	CreateEvent(eventAttrs *SecurityAttributes, manualReset uint32, initialState uint32, name *uint16) (handle syscall.Handle, err error) = kernel32.CreateEventW
+ 
+-//sys	ProcessPrng(buf []byte) (err error) = bcryptprimitives.ProcessPrng
++//sys	RtlGenRandom(buf []byte) (err error) = advapi32.SystemFunction036
+ 
+ //sys	RtlLookupFunctionEntry(pc uintptr, baseAddress *uintptr, table *byte) (ret uintptr) = kernel32.RtlLookupFunctionEntry
+ //sys	RtlVirtualUnwind(handlerType uint32, baseAddress uintptr, pc uintptr, entry uintptr, ctxt uintptr, data *uintptr, frame *uintptr, ctxptrs *byte) (ret uintptr) = kernel32.RtlVirtualUnwind
+Index: src/internal/syscall/windows/zsyscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/zsyscall_windows.go b/src/internal/syscall/windows/zsyscall_windows.go
+--- a/src/internal/syscall/windows/zsyscall_windows.go	(revision 8bba868de983dd7bf55fcd121495ba8d6e2734e7)
++++ b/src/internal/syscall/windows/zsyscall_windows.go	(revision 7e6c963d81e14ee394402671d4044b2940c8d2c1)
+@@ -37,14 +37,13 @@
+ }
+ 
+ var (
+-	modadvapi32         = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
+-	modbcryptprimitives = syscall.NewLazyDLL(sysdll.Add("bcryptprimitives.dll"))
+-	modiphlpapi         = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
+-	modkernel32         = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
+-	modnetapi32         = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
+-	modpsapi            = syscall.NewLazyDLL(sysdll.Add("psapi.dll"))
+-	moduserenv          = syscall.NewLazyDLL(sysdll.Add("userenv.dll"))
+-	modws2_32           = syscall.NewLazyDLL(sysdll.Add("ws2_32.dll"))
++	modadvapi32 = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
++	modiphlpapi = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
++	modkernel32 = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
++	modnetapi32 = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
++	modpsapi    = syscall.NewLazyDLL(sysdll.Add("psapi.dll"))
++	moduserenv  = syscall.NewLazyDLL(sysdll.Add("userenv.dll"))
++	modws2_32   = syscall.NewLazyDLL(sysdll.Add("ws2_32.dll"))
+ 
+ 	procAdjustTokenPrivileges        = modadvapi32.NewProc("AdjustTokenPrivileges")
+ 	procDuplicateTokenEx             = modadvapi32.NewProc("DuplicateTokenEx")
+@@ -53,7 +52,7 @@
+ 	procOpenThreadToken              = modadvapi32.NewProc("OpenThreadToken")
+ 	procRevertToSelf                 = modadvapi32.NewProc("RevertToSelf")
+ 	procSetTokenInformation          = modadvapi32.NewProc("SetTokenInformation")
+-	procProcessPrng                  = modbcryptprimitives.NewProc("ProcessPrng")
++	procSystemFunction036            = modadvapi32.NewProc("SystemFunction036")
+ 	procGetAdaptersAddresses         = modiphlpapi.NewProc("GetAdaptersAddresses")
+ 	procCreateEventW                 = modkernel32.NewProc("CreateEventW")
+ 	procGetACP                       = modkernel32.NewProc("GetACP")
+@@ -149,12 +148,12 @@
+ 	return
+ }
+ 
+-func ProcessPrng(buf []byte) (err error) {
++func RtlGenRandom(buf []byte) (err error) {
+ 	var _p0 *byte
+ 	if len(buf) > 0 {
+ 		_p0 = &buf[0]
+ 	}
+-	r1, _, e1 := syscall.Syscall(procProcessPrng.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
++	r1, _, e1 := syscall.Syscall(procSystemFunction036.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
+ 	if r1 == 0 {
+ 		err = errnoErr(e1)
+ 	}
+Index: src/runtime/os_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/os_windows.go b/src/runtime/os_windows.go
+--- a/src/runtime/os_windows.go	(revision 8bba868de983dd7bf55fcd121495ba8d6e2734e7)
++++ b/src/runtime/os_windows.go	(revision 7e6c963d81e14ee394402671d4044b2940c8d2c1)
+@@ -127,8 +127,15 @@
+ 	_AddVectoredContinueHandler,
+ 	_ stdFunction
+ 
+-	// Use ProcessPrng to generate cryptographically random data.
+-	_ProcessPrng stdFunction
++	// Use RtlGenRandom to generate cryptographically random data.
++	// This approach has been recommended by Microsoft (see issue
++	// 15589 for details).
++	// The RtlGenRandom is not listed in advapi32.dll, instead
++	// RtlGenRandom function can be found by searching for SystemFunction036.
++	// Also some versions of Mingw cannot link to SystemFunction036
++	// when building executable as Cgo. So load SystemFunction036
++	// manually during runtime startup.
++	_RtlGenRandom stdFunction
+ 
+ 	// Load ntdll.dll manually during startup, otherwise Mingw
+ 	// links wrong printf function to cgo executable (see issue
+@@ -145,12 +152,12 @@
+ )
+ 
+ var (
+-	bcryptprimitivesdll = [...]uint16{'b', 'c', 'r', 'y', 'p', 't', 'p', 'r', 'i', 'm', 'i', 't', 'i', 'v', 'e', 's', '.', 'd', 'l', 'l', 0}
+-	kernel32dll         = [...]uint16{'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', 0}
+-	ntdlldll            = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
+-	powrprofdll         = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
+-	winmmdll            = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
+-	ws2_32dll           = [...]uint16{'w', 's', '2', '_', '3', '2', '.', 'd', 'l', 'l', 0}
++	advapi32dll = [...]uint16{'a', 'd', 'v', 'a', 'p', 'i', '3', '2', '.', 'd', 'l', 'l', 0}
++	kernel32dll = [...]uint16{'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', 0}
++	ntdlldll    = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
++	powrprofdll = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
++	winmmdll    = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
++	ws2_32dll   = [...]uint16{'w', 's', '2', '_', '3', '2', '.', 'd', 'l', 'l', 0}
+ )
+ 
+ // Function to be called by windows CreateThread
+@@ -249,11 +256,11 @@
+ 	}
+ 	_AddVectoredContinueHandler = windowsFindfunc(k32, []byte("AddVectoredContinueHandler\000"))
+ 
+-	bcryptPrimitives := windowsLoadSystemLib(bcryptprimitivesdll[:])
+-	if bcryptPrimitives == 0 {
+-		throw("bcryptprimitives.dll not found")
++	a32 := windowsLoadSystemLib(advapi32dll[:])
++	if a32 == 0 {
++		throw("advapi32.dll not found")
+ 	}
+-	_ProcessPrng = windowsFindfunc(bcryptPrimitives, []byte("ProcessPrng\000"))
++	_RtlGenRandom = windowsFindfunc(a32, []byte("SystemFunction036\000"))
+ 
+ 	n32 := windowsLoadSystemLib(ntdlldll[:])
+ 	if n32 == 0 {
+@@ -610,7 +617,7 @@
+ //go:nosplit
+ func getRandomData(r []byte) {
+ 	n := 0
+-	if stdcall2(_ProcessPrng, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
++	if stdcall2(_RtlGenRandom, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
+ 		n = len(r)
+ 	}
+ 	extendRandom(r, n)

.github/patch/go1.22.patch

@@ -0,0 +1,645 @@
+Subject: [PATCH] Revert "runtime: always use LoadLibraryEx to load system libraries"
+Revert "syscall: remove Windows 7 console handle workaround"
+Revert "net: remove sysSocket fallback for Windows 7"
+Revert "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
+---
+Index: src/crypto/rand/rand.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand.go b/src/crypto/rand/rand.go
+--- a/src/crypto/rand/rand.go	(revision cb4eee693c382bea4222f20837e26501d40ed892)
++++ b/src/crypto/rand/rand.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
+@@ -15,7 +15,7 @@
+ // available, /dev/urandom otherwise.
+ // On OpenBSD and macOS, Reader uses getentropy(2).
+ // On other Unix-like systems, Reader reads from /dev/urandom.
+-// On Windows systems, Reader uses the ProcessPrng API.
++// On Windows systems, Reader uses the RtlGenRandom API.
+ // On JS/Wasm, Reader uses the Web Crypto API.
+ // On WASIP1/Wasm, Reader uses random_get from wasi_snapshot_preview1.
+ var Reader io.Reader
+Index: src/crypto/rand/rand_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand_windows.go b/src/crypto/rand/rand_windows.go
+--- a/src/crypto/rand/rand_windows.go	(revision cb4eee693c382bea4222f20837e26501d40ed892)
++++ b/src/crypto/rand/rand_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
+@@ -15,8 +15,11 @@
+ 
+ type rngReader struct{}
+ 
+-func (r *rngReader) Read(b []byte) (int, error) {
+-	if err := windows.ProcessPrng(b); err != nil {
++func (r *rngReader) Read(b []byte) (n int, err error) {
++	// RtlGenRandom only returns 1<<32-1 bytes at a time. We only read at
++	// most 1<<31-1 bytes at a time so that  this works the same on 32-bit
++	// and 64-bit systems.
++	if err := batched(windows.RtlGenRandom, 1<<31-1)(b); err != nil {
+ 		return 0, err
+ 	}
+ 	return len(b), nil
+Index: src/internal/syscall/windows/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/syscall_windows.go b/src/internal/syscall/windows/syscall_windows.go
+--- a/src/internal/syscall/windows/syscall_windows.go	(revision cb4eee693c382bea4222f20837e26501d40ed892)
++++ b/src/internal/syscall/windows/syscall_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
+@@ -384,7 +384,7 @@
+ //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
+ //sys	CreateEvent(eventAttrs *SecurityAttributes, manualReset uint32, initialState uint32, name *uint16) (handle syscall.Handle, err error) = kernel32.CreateEventW
+ 
+-//sys	ProcessPrng(buf []byte) (err error) = bcryptprimitives.ProcessPrng
++//sys	RtlGenRandom(buf []byte) (err error) = advapi32.SystemFunction036
+ 
+ type FILE_ID_BOTH_DIR_INFO struct {
+ 	NextEntryOffset uint32
+Index: src/internal/syscall/windows/zsyscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/zsyscall_windows.go b/src/internal/syscall/windows/zsyscall_windows.go
+--- a/src/internal/syscall/windows/zsyscall_windows.go	(revision cb4eee693c382bea4222f20837e26501d40ed892)
++++ b/src/internal/syscall/windows/zsyscall_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
+@@ -37,14 +37,13 @@
+ }
+ 
+ var (
+-	modadvapi32         = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
+-	modbcryptprimitives = syscall.NewLazyDLL(sysdll.Add("bcryptprimitives.dll"))
+-	modiphlpapi         = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
+-	modkernel32         = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
+-	modnetapi32         = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
+-	modpsapi            = syscall.NewLazyDLL(sysdll.Add("psapi.dll"))
+-	moduserenv          = syscall.NewLazyDLL(sysdll.Add("userenv.dll"))
+-	modws2_32           = syscall.NewLazyDLL(sysdll.Add("ws2_32.dll"))
++	modadvapi32 = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
++	modiphlpapi = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
++	modkernel32 = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
++	modnetapi32 = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
++	modpsapi    = syscall.NewLazyDLL(sysdll.Add("psapi.dll"))
++	moduserenv  = syscall.NewLazyDLL(sysdll.Add("userenv.dll"))
++	modws2_32   = syscall.NewLazyDLL(sysdll.Add("ws2_32.dll"))
+ 
+ 	procAdjustTokenPrivileges             = modadvapi32.NewProc("AdjustTokenPrivileges")
+ 	procDuplicateTokenEx                  = modadvapi32.NewProc("DuplicateTokenEx")
+@@ -56,7 +55,7 @@
+ 	procQueryServiceStatus                = modadvapi32.NewProc("QueryServiceStatus")
+ 	procRevertToSelf                      = modadvapi32.NewProc("RevertToSelf")
+ 	procSetTokenInformation               = modadvapi32.NewProc("SetTokenInformation")
+-	procProcessPrng                       = modbcryptprimitives.NewProc("ProcessPrng")
++	procSystemFunction036                 = modadvapi32.NewProc("SystemFunction036")
+ 	procGetAdaptersAddresses              = modiphlpapi.NewProc("GetAdaptersAddresses")
+ 	procCreateEventW                      = modkernel32.NewProc("CreateEventW")
+ 	procGetACP                            = modkernel32.NewProc("GetACP")
+@@ -180,12 +179,12 @@
+ 	return
+ }
+ 
+-func ProcessPrng(buf []byte) (err error) {
++func RtlGenRandom(buf []byte) (err error) {
+ 	var _p0 *byte
+ 	if len(buf) > 0 {
+ 		_p0 = &buf[0]
+ 	}
+-	r1, _, e1 := syscall.Syscall(procProcessPrng.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
++	r1, _, e1 := syscall.Syscall(procSystemFunction036.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
+ 	if r1 == 0 {
+ 		err = errnoErr(e1)
+ 	}
+Index: src/runtime/os_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/os_windows.go b/src/runtime/os_windows.go
+--- a/src/runtime/os_windows.go	(revision cb4eee693c382bea4222f20837e26501d40ed892)
++++ b/src/runtime/os_windows.go	(revision 83ff9782e024cb328b690cbf0da4e7848a327f4f)
+@@ -40,8 +40,8 @@
+ //go:cgo_import_dynamic runtime._GetSystemInfo GetSystemInfo%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._GetThreadContext GetThreadContext%2 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._SetThreadContext SetThreadContext%2 "kernel32.dll"
+-//go:cgo_import_dynamic runtime._LoadLibraryExW LoadLibraryExW%3 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._LoadLibraryW LoadLibraryW%1 "kernel32.dll"
++//go:cgo_import_dynamic runtime._LoadLibraryA LoadLibraryA%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._PostQueuedCompletionStatus PostQueuedCompletionStatus%4 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceCounter QueryPerformanceCounter%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._RaiseFailFastException RaiseFailFastException%3 "kernel32.dll"
+@@ -74,7 +74,6 @@
+ 	// Following syscalls are available on every Windows PC.
+ 	// All these variables are set by the Windows executable
+ 	// loader before the Go program starts.
+-	_AddVectoredContinueHandler,
+ 	_AddVectoredExceptionHandler,
+ 	_CloseHandle,
+ 	_CreateEventA,
+@@ -98,8 +97,8 @@
+ 	_GetSystemInfo,
+ 	_GetThreadContext,
+ 	_SetThreadContext,
+-	_LoadLibraryExW,
+ 	_LoadLibraryW,
++	_LoadLibraryA,
+ 	_PostQueuedCompletionStatus,
+ 	_QueryPerformanceCounter,
+ 	_RaiseFailFastException,
+@@ -127,8 +126,23 @@
+ 	_WriteFile,
+ 	_ stdFunction
+ 
+-	// Use ProcessPrng to generate cryptographically random data.
+-	_ProcessPrng stdFunction
++	// Following syscalls are only available on some Windows PCs.
++	// We will load syscalls, if available, before using them.
++	_AddDllDirectory,
++	_AddVectoredContinueHandler,
++	_LoadLibraryExA,
++	_LoadLibraryExW,
++	_ stdFunction
++
++	// Use RtlGenRandom to generate cryptographically random data.
++	// This approach has been recommended by Microsoft (see issue
++	// 15589 for details).
++	// The RtlGenRandom is not listed in advapi32.dll, instead
++	// RtlGenRandom function can be found by searching for SystemFunction036.
++	// Also some versions of Mingw cannot link to SystemFunction036
++	// when building executable as Cgo. So load SystemFunction036
++	// manually during runtime startup.
++	_RtlGenRandom stdFunction
+ 
+ 	// Load ntdll.dll manually during startup, otherwise Mingw
+ 	// links wrong printf function to cgo executable (see issue
+@@ -143,14 +157,6 @@
+ 	_ stdFunction
+ )
+ 
+-var (
+-	bcryptprimitivesdll = [...]uint16{'b', 'c', 'r', 'y', 'p', 't', 'p', 'r', 'i', 'm', 'i', 't', 'i', 'v', 'e', 's', '.', 'd', 'l', 'l', 0}
+-	ntdlldll            = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
+-	powrprofdll         = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
+-	winmmdll            = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
+-	ws2_32dll           = [...]uint16{'w', 's', '2', '_', '3', '2', '.', 'd', 'l', 'l', 0}
+-)
+-
+ // Function to be called by windows CreateThread
+ // to start new os thread.
+ func tstart_stdcall(newm *m)
+@@ -239,25 +245,51 @@
+ 	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
+ }
+ 
+-func windowsLoadSystemLib(name []uint16) uintptr {
+-	return stdcall3(_LoadLibraryExW, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++//go:linkname syscall_getSystemDirectory syscall.getSystemDirectory
++func syscall_getSystemDirectory() string {
++	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
++}
++
++func windowsLoadSystemLib(name []byte) uintptr {
++	if useLoadLibraryEx {
++		return stdcall3(_LoadLibraryExA, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		absName := append(sysDirectory[:sysDirectoryLen], name...)
++		return stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&absName[0])))
++	}
+ }
+ 
+ func loadOptionalSyscalls() {
+-	bcryptPrimitives := windowsLoadSystemLib(bcryptprimitivesdll[:])
+-	if bcryptPrimitives == 0 {
+-		throw("bcryptprimitives.dll not found")
++	var kernel32dll = []byte("kernel32.dll\000")
++	k32 := stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&kernel32dll[0])))
++	if k32 == 0 {
++		throw("kernel32.dll not found")
+ 	}
+-	_ProcessPrng = windowsFindfunc(bcryptPrimitives, []byte("ProcessPrng\000"))
++	_AddDllDirectory = windowsFindfunc(k32, []byte("AddDllDirectory\000"))
++	_AddVectoredContinueHandler = windowsFindfunc(k32, []byte("AddVectoredContinueHandler\000"))
++	_LoadLibraryExA = windowsFindfunc(k32, []byte("LoadLibraryExA\000"))
++	_LoadLibraryExW = windowsFindfunc(k32, []byte("LoadLibraryExW\000"))
++	useLoadLibraryEx = (_LoadLibraryExW != nil && _LoadLibraryExA != nil && _AddDllDirectory != nil)
++
++	initSysDirectory()
+ 
+-	n32 := windowsLoadSystemLib(ntdlldll[:])
++	var advapi32dll = []byte("advapi32.dll\000")
++	a32 := windowsLoadSystemLib(advapi32dll)
++	if a32 == 0 {
++		throw("advapi32.dll not found")
++	}
++	_RtlGenRandom = windowsFindfunc(a32, []byte("SystemFunction036\000"))
++
++	var ntdll = []byte("ntdll.dll\000")
++	n32 := windowsLoadSystemLib(ntdll)
+ 	if n32 == 0 {
+ 		throw("ntdll.dll not found")
+ 	}
+ 	_RtlGetCurrentPeb = windowsFindfunc(n32, []byte("RtlGetCurrentPeb\000"))
+ 	_RtlGetNtVersionNumbers = windowsFindfunc(n32, []byte("RtlGetNtVersionNumbers\000"))
+ 
+-	m32 := windowsLoadSystemLib(winmmdll[:])
++	var winmmdll = []byte("winmm.dll\000")
++	m32 := windowsLoadSystemLib(winmmdll)
+ 	if m32 == 0 {
+ 		throw("winmm.dll not found")
+ 	}
+@@ -267,7 +299,8 @@
+ 		throw("timeBegin/EndPeriod not found")
+ 	}
+ 
+-	ws232 := windowsLoadSystemLib(ws2_32dll[:])
++	var ws232dll = []byte("ws2_32.dll\000")
++	ws232 := windowsLoadSystemLib(ws232dll)
+ 	if ws232 == 0 {
+ 		throw("ws2_32.dll not found")
+ 	}
+@@ -286,7 +319,7 @@
+ 		context  uintptr
+ 	}
+ 
+-	powrprof := windowsLoadSystemLib(powrprofdll[:])
++	powrprof := windowsLoadSystemLib([]byte("powrprof.dll\000"))
+ 	if powrprof == 0 {
+ 		return // Running on Windows 7, where we don't need it anyway.
+ 	}
+@@ -360,6 +393,22 @@
+ // in sys_windows_386.s and sys_windows_amd64.s:
+ func getlasterror() uint32
+ 
++// When loading DLLs, we prefer to use LoadLibraryEx with
++// LOAD_LIBRARY_SEARCH_* flags, if available. LoadLibraryEx is not
++// available on old Windows, though, and the LOAD_LIBRARY_SEARCH_*
++// flags are not available on some versions of Windows without a
++// security patch.
++//
++// https://msdn.microsoft.com/en-us/library/ms684179(v=vs.85).aspx says:
++// "Windows 7, Windows Server 2008 R2, Windows Vista, and Windows
++// Server 2008: The LOAD_LIBRARY_SEARCH_* flags are available on
++// systems that have KB2533623 installed. To determine whether the
++// flags are available, use GetProcAddress to get the address of the
++// AddDllDirectory, RemoveDllDirectory, or SetDefaultDllDirectories
++// function. If GetProcAddress succeeds, the LOAD_LIBRARY_SEARCH_*
++// flags can be used with LoadLibraryEx."
++var useLoadLibraryEx bool
++
+ var timeBeginPeriodRetValue uint32
+ 
+ // osRelaxMinNS indicates that sysmon shouldn't osRelax if the next
+@@ -507,7 +556,6 @@
+ 	initHighResTimer()
+ 	timeBeginPeriodRetValue = osRelax(false)
+ 
+-	initSysDirectory()
+ 	initLongPathSupport()
+ 
+ 	ncpu = getproccount()
+@@ -524,7 +572,7 @@
+ //go:nosplit
+ func readRandom(r []byte) int {
+ 	n := 0
+-	if stdcall2(_ProcessPrng, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
++	if stdcall2(_RtlGenRandom, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
+ 		n = len(r)
+ 	}
+ 	return n
+Index: src/net/hook_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/hook_windows.go b/src/net/hook_windows.go
+--- a/src/net/hook_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/net/hook_windows.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -13,6 +13,7 @@
+ 	hostsFilePath = windows.GetSystemDirectory() + "/Drivers/etc/hosts"
+ 
+ 	// Placeholders for socket system calls.
++	socketFunc    func(int, int, int) (syscall.Handle, error)                                                 = syscall.Socket
+ 	wsaSocketFunc func(int32, int32, int32, *syscall.WSAProtocolInfo, uint32, uint32) (syscall.Handle, error) = windows.WSASocket
+ 	connectFunc   func(syscall.Handle, syscall.Sockaddr) error                                                = syscall.Connect
+ 	listenFunc    func(syscall.Handle, int) error                                                             = syscall.Listen
+Index: src/net/internal/socktest/main_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_test.go b/src/net/internal/socktest/main_test.go
+--- a/src/net/internal/socktest/main_test.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/net/internal/socktest/main_test.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !js && !plan9 && !wasip1 && !windows
++//go:build !js && !plan9 && !wasip1
+ 
+ package socktest_test
+ 
+Index: src/net/internal/socktest/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_windows_test.go b/src/net/internal/socktest/main_windows_test.go
+new file mode 100644
+--- /dev/null	(revision ef0606261340e608017860b423ffae5c1ce78239)
++++ b/src/net/internal/socktest/main_windows_test.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -0,0 +1,22 @@
++// Copyright 2015 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++package socktest_test
++
++import "syscall"
++
++var (
++	socketFunc func(int, int, int) (syscall.Handle, error)
++	closeFunc  func(syscall.Handle) error
++)
++
++func installTestHooks() {
++	socketFunc = sw.Socket
++	closeFunc = sw.Closesocket
++}
++
++func uninstallTestHooks() {
++	socketFunc = syscall.Socket
++	closeFunc = syscall.Closesocket
++}
+Index: src/net/internal/socktest/sys_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/sys_windows.go b/src/net/internal/socktest/sys_windows.go
+--- a/src/net/internal/socktest/sys_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/net/internal/socktest/sys_windows.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -9,6 +9,38 @@
+ 	"syscall"
+ )
+ 
++// Socket wraps [syscall.Socket].
++func (sw *Switch) Socket(family, sotype, proto int) (s syscall.Handle, err error) {
++	sw.once.Do(sw.init)
++
++	so := &Status{Cookie: cookie(family, sotype, proto)}
++	sw.fmu.RLock()
++	f, _ := sw.fltab[FilterSocket]
++	sw.fmu.RUnlock()
++
++	af, err := f.apply(so)
++	if err != nil {
++		return syscall.InvalidHandle, err
++	}
++	s, so.Err = syscall.Socket(family, sotype, proto)
++	if err = af.apply(so); err != nil {
++		if so.Err == nil {
++			syscall.Closesocket(s)
++		}
++		return syscall.InvalidHandle, err
++	}
++
++	sw.smu.Lock()
++	defer sw.smu.Unlock()
++	if so.Err != nil {
++		sw.stats.getLocked(so.Cookie).OpenFailed++
++		return syscall.InvalidHandle, so.Err
++	}
++	nso := sw.addLocked(s, family, sotype, proto)
++	sw.stats.getLocked(nso.Cookie).Opened++
++	return s, nil
++}
++
+ // WSASocket wraps [syscall.WSASocket].
+ func (sw *Switch) WSASocket(family, sotype, proto int32, protinfo *syscall.WSAProtocolInfo, group uint32, flags uint32) (s syscall.Handle, err error) {
+ 	sw.once.Do(sw.init)
+Index: src/net/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/main_windows_test.go b/src/net/main_windows_test.go
+--- a/src/net/main_windows_test.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/net/main_windows_test.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -8,6 +8,7 @@
+ 
+ var (
+ 	// Placeholders for saving original socket system calls.
++	origSocket      = socketFunc
+ 	origWSASocket   = wsaSocketFunc
+ 	origClosesocket = poll.CloseFunc
+ 	origConnect     = connectFunc
+@@ -17,6 +18,7 @@
+ )
+ 
+ func installTestHooks() {
++	socketFunc = sw.Socket
+ 	wsaSocketFunc = sw.WSASocket
+ 	poll.CloseFunc = sw.Closesocket
+ 	connectFunc = sw.Connect
+@@ -26,6 +28,7 @@
+ }
+ 
+ func uninstallTestHooks() {
++	socketFunc = origSocket
+ 	wsaSocketFunc = origWSASocket
+ 	poll.CloseFunc = origClosesocket
+ 	connectFunc = origConnect
+Index: src/net/sock_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/sock_windows.go b/src/net/sock_windows.go
+--- a/src/net/sock_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/net/sock_windows.go	(revision ef0606261340e608017860b423ffae5c1ce78239)
+@@ -20,6 +20,21 @@
+ func sysSocket(family, sotype, proto int) (syscall.Handle, error) {
+ 	s, err := wsaSocketFunc(int32(family), int32(sotype), int32(proto),
+ 		nil, 0, windows.WSA_FLAG_OVERLAPPED|windows.WSA_FLAG_NO_HANDLE_INHERIT)
++	if err == nil {
++		return s, nil
++	}
++	// WSA_FLAG_NO_HANDLE_INHERIT flag is not supported on some
++	// old versions of Windows, see
++	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms742212(v=vs.85).aspx
++	// for details. Just use syscall.Socket, if windows.WSASocket failed.
++
++	// See ../syscall/exec_unix.go for description of ForkLock.
++	syscall.ForkLock.RLock()
++	s, err = socketFunc(family, sotype, proto)
++	if err == nil {
++		syscall.CloseOnExec(s)
++	}
++	syscall.ForkLock.RUnlock()
+ 	if err != nil {
+ 		return syscall.InvalidHandle, os.NewSyscallError("socket", err)
+ 	}
+Index: src/syscall/exec_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/exec_windows.go b/src/syscall/exec_windows.go
+--- a/src/syscall/exec_windows.go	(revision 9779155f18b6556a034f7bb79fb7fb2aad1e26a9)
++++ b/src/syscall/exec_windows.go	(revision 7f83badcb925a7e743188041cb6e561fc9b5b642)
+@@ -14,7 +14,6 @@
+ 	"unsafe"
+ )
+ 
+-// ForkLock is not used on Windows.
+ var ForkLock sync.RWMutex
+ 
+ // EscapeArg rewrites command line argument s as prescribed
+@@ -317,6 +316,17 @@
+ 		}
+ 	}
+ 
++	var maj, min, build uint32
++	rtlGetNtVersionNumbers(&maj, &min, &build)
++	isWin7 := maj < 6 || (maj == 6 && min <= 1)
++	// NT kernel handles are divisible by 4, with the bottom 3 bits left as
++	// a tag. The fully set tag correlates with the types of handles we're
++	// concerned about here.  Except, the kernel will interpret some
++	// special handle values, like -1, -2, and so forth, so kernelbase.dll
++	// checks to see that those bottom three bits are checked, but that top
++	// bit is not checked.
++	isLegacyWin7ConsoleHandle := func(handle Handle) bool { return isWin7 && handle&0x10000003 == 3 }
++
+ 	p, _ := GetCurrentProcess()
+ 	parentProcess := p
+ 	if sys.ParentProcess != 0 {
+@@ -325,7 +335,15 @@
+ 	fd := make([]Handle, len(attr.Files))
+ 	for i := range attr.Files {
+ 		if attr.Files[i] > 0 {
+-			err := DuplicateHandle(p, Handle(attr.Files[i]), parentProcess, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
++			destinationProcessHandle := parentProcess
++
++			// On Windows 7, console handles aren't real handles, and can only be duplicated
++			// into the current process, not a parent one, which amounts to the same thing.
++			if parentProcess != p && isLegacyWin7ConsoleHandle(Handle(attr.Files[i])) {
++				destinationProcessHandle = p
++			}
++
++			err := DuplicateHandle(p, Handle(attr.Files[i]), destinationProcessHandle, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
+ 			if err != nil {
+ 				return 0, 0, err
+ 			}
+@@ -356,6 +374,14 @@
+ 
+ 	fd = append(fd, sys.AdditionalInheritedHandles...)
+ 
++	// On Windows 7, console handles aren't real handles, so don't pass them
++	// through to PROC_THREAD_ATTRIBUTE_HANDLE_LIST.
++	for i := range fd {
++		if isLegacyWin7ConsoleHandle(fd[i]) {
++			fd[i] = 0
++		}
++	}
++
+ 	// The presence of a NULL handle in the list is enough to cause PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+ 	// to treat the entire list as empty, so remove NULL handles.
+ 	j := 0
+Index: src/runtime/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/syscall_windows.go b/src/runtime/syscall_windows.go
+--- a/src/runtime/syscall_windows.go	(revision 7f83badcb925a7e743188041cb6e561fc9b5b642)
++++ b/src/runtime/syscall_windows.go	(revision 83ff9782e024cb328b690cbf0da4e7848a327f4f)
+@@ -413,23 +413,36 @@
+ 
+ const _LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
+ 
++// When available, this function will use LoadLibraryEx with the filename
++// parameter and the important SEARCH_SYSTEM32 argument. But on systems that
++// do not have that option, absoluteFilepath should contain a fallback
++// to the full path inside of system32 for use with vanilla LoadLibrary.
++//
+ //go:linkname syscall_loadsystemlibrary syscall.loadsystemlibrary
+ //go:nosplit
+ //go:cgo_unsafe_args
+-func syscall_loadsystemlibrary(filename *uint16) (handle, err uintptr) {
++func syscall_loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle, err uintptr) {
+ 	lockOSThread()
+ 	c := &getg().m.syscall
+-	c.fn = getLoadLibraryEx()
+-	c.n = 3
+-	args := struct {
+-		lpFileName *uint16
+-		hFile      uintptr // always 0
+-		flags      uint32
+-	}{filename, 0, _LOAD_LIBRARY_SEARCH_SYSTEM32}
+-	c.args = uintptr(noescape(unsafe.Pointer(&args)))
++
++	if useLoadLibraryEx {
++		c.fn = getLoadLibraryEx()
++		c.n = 3
++		args := struct {
++			lpFileName *uint16
++			hFile      uintptr // always 0
++			flags      uint32
++		}{filename, 0, _LOAD_LIBRARY_SEARCH_SYSTEM32}
++		c.args = uintptr(noescape(unsafe.Pointer(&args)))
++	} else {
++		c.fn = getLoadLibrary()
++		c.n = 1
++		c.args = uintptr(noescape(unsafe.Pointer(&absoluteFilepath)))
++	}
+ 
+ 	cgocall(asmstdcallAddr, unsafe.Pointer(c))
+ 	KeepAlive(filename)
++	KeepAlive(absoluteFilepath)
+ 	handle = c.r1
+ 	if handle == 0 {
+ 		err = c.err
+Index: src/syscall/dll_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/dll_windows.go b/src/syscall/dll_windows.go
+--- a/src/syscall/dll_windows.go	(revision 7f83badcb925a7e743188041cb6e561fc9b5b642)
++++ b/src/syscall/dll_windows.go	(revision 83ff9782e024cb328b690cbf0da4e7848a327f4f)
+@@ -44,7 +44,7 @@
+ 
+ func SyscallN(trap uintptr, args ...uintptr) (r1, r2 uintptr, err Errno)
+ func loadlibrary(filename *uint16) (handle uintptr, err Errno)
+-func loadsystemlibrary(filename *uint16) (handle uintptr, err Errno)
++func loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle uintptr, err Errno)
+ func getprocaddress(handle uintptr, procname *uint8) (proc uintptr, err Errno)
+ 
+ // A DLL implements access to a single DLL.
+@@ -53,6 +53,9 @@
+ 	Handle Handle
+ }
+ 
++//go:linkname getSystemDirectory
++func getSystemDirectory() string // Implemented in runtime package.
++
+ // LoadDLL loads the named DLL file into memory.
+ //
+ // If name is not an absolute path and is not a known system DLL used by
+@@ -69,7 +72,11 @@
+ 	var h uintptr
+ 	var e Errno
+ 	if sysdll.IsSystemDLL[name] {
+-		h, e = loadsystemlibrary(namep)
++		absoluteFilepathp, err := UTF16PtrFromString(getSystemDirectory() + name)
++		if err != nil {
++			return nil, err
++		}
++		h, e = loadsystemlibrary(namep, absoluteFilepathp)
+ 	} else {
+ 		h, e = loadlibrary(namep)
+ 	}

.github/patch/go1.23.patch

@@ -0,0 +1,643 @@
+Subject: [PATCH] Revert "runtime: always use LoadLibraryEx to load system libraries"
+Revert "syscall: remove Windows 7 console handle workaround"
+Revert "net: remove sysSocket fallback for Windows 7"
+Revert "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
+---
+Index: src/crypto/rand/rand.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand.go b/src/crypto/rand/rand.go
+--- a/src/crypto/rand/rand.go	(revision 6885bad7dd86880be6929c02085e5c7a67ff2887)
++++ b/src/crypto/rand/rand.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
+@@ -16,7 +16,7 @@
+ //   - On macOS and iOS, Reader uses arc4random_buf(3).
+ //   - On OpenBSD and NetBSD, Reader uses getentropy(2).
+ //   - On other Unix-like systems, Reader reads from /dev/urandom.
+-//   - On Windows, Reader uses the ProcessPrng API.
++//   - On Windows systems, Reader uses the RtlGenRandom API.
+ //   - On js/wasm, Reader uses the Web Crypto API.
+ //   - On wasip1/wasm, Reader uses random_get from wasi_snapshot_preview1.
+ var Reader io.Reader
+Index: src/crypto/rand/rand_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand_windows.go b/src/crypto/rand/rand_windows.go
+--- a/src/crypto/rand/rand_windows.go	(revision 6885bad7dd86880be6929c02085e5c7a67ff2887)
++++ b/src/crypto/rand/rand_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
+@@ -15,8 +15,11 @@
+ 
+ type rngReader struct{}
+ 
+-func (r *rngReader) Read(b []byte) (int, error) {
+-	if err := windows.ProcessPrng(b); err != nil {
++func (r *rngReader) Read(b []byte) (n int, err error) {
++	// RtlGenRandom only returns 1<<32-1 bytes at a time. We only read at
++	// most 1<<31-1 bytes at a time so that  this works the same on 32-bit
++	// and 64-bit systems.
++	if err := batched(windows.RtlGenRandom, 1<<31-1)(b); err != nil {
+ 		return 0, err
+ 	}
+ 	return len(b), nil
+Index: src/internal/syscall/windows/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/syscall_windows.go b/src/internal/syscall/windows/syscall_windows.go
+--- a/src/internal/syscall/windows/syscall_windows.go	(revision 6885bad7dd86880be6929c02085e5c7a67ff2887)
++++ b/src/internal/syscall/windows/syscall_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
+@@ -414,7 +414,7 @@
+ //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
+ //sys	CreateEvent(eventAttrs *SecurityAttributes, manualReset uint32, initialState uint32, name *uint16) (handle syscall.Handle, err error) = kernel32.CreateEventW
+ 
+-//sys	ProcessPrng(buf []byte) (err error) = bcryptprimitives.ProcessPrng
++//sys	RtlGenRandom(buf []byte) (err error) = advapi32.SystemFunction036
+ 
+ type FILE_ID_BOTH_DIR_INFO struct {
+ 	NextEntryOffset uint32
+Index: src/internal/syscall/windows/zsyscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/zsyscall_windows.go b/src/internal/syscall/windows/zsyscall_windows.go
+--- a/src/internal/syscall/windows/zsyscall_windows.go	(revision 6885bad7dd86880be6929c02085e5c7a67ff2887)
++++ b/src/internal/syscall/windows/zsyscall_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
+@@ -38,7 +38,6 @@
+ 
+ var (
+ 	modadvapi32         = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
+-	modbcryptprimitives = syscall.NewLazyDLL(sysdll.Add("bcryptprimitives.dll"))
+ 	modiphlpapi         = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
+ 	modkernel32         = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
+ 	modnetapi32         = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
+@@ -57,7 +56,7 @@
+ 	procQueryServiceStatus                = modadvapi32.NewProc("QueryServiceStatus")
+ 	procRevertToSelf                      = modadvapi32.NewProc("RevertToSelf")
+ 	procSetTokenInformation               = modadvapi32.NewProc("SetTokenInformation")
+-	procProcessPrng                       = modbcryptprimitives.NewProc("ProcessPrng")
++	procSystemFunction036                 = modadvapi32.NewProc("SystemFunction036")
+ 	procGetAdaptersAddresses              = modiphlpapi.NewProc("GetAdaptersAddresses")
+ 	procCreateEventW                      = modkernel32.NewProc("CreateEventW")
+ 	procGetACP                            = modkernel32.NewProc("GetACP")
+@@ -183,12 +182,12 @@
+ 	return
+ }
+ 
+-func ProcessPrng(buf []byte) (err error) {
++func RtlGenRandom(buf []byte) (err error) {
+ 	var _p0 *byte
+ 	if len(buf) > 0 {
+ 		_p0 = &buf[0]
+ 	}
+-	r1, _, e1 := syscall.Syscall(procProcessPrng.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
++	r1, _, e1 := syscall.Syscall(procSystemFunction036.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
+ 	if r1 == 0 {
+ 		err = errnoErr(e1)
+ 	}
+Index: src/runtime/os_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/os_windows.go b/src/runtime/os_windows.go
+--- a/src/runtime/os_windows.go	(revision 6885bad7dd86880be6929c02085e5c7a67ff2887)
++++ b/src/runtime/os_windows.go	(revision 69e2eed6dd0f6d815ebf15797761c13f31213dd6)
+@@ -39,8 +39,8 @@
+ //go:cgo_import_dynamic runtime._GetSystemInfo GetSystemInfo%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._GetThreadContext GetThreadContext%2 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._SetThreadContext SetThreadContext%2 "kernel32.dll"
+-//go:cgo_import_dynamic runtime._LoadLibraryExW LoadLibraryExW%3 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._LoadLibraryW LoadLibraryW%1 "kernel32.dll"
++//go:cgo_import_dynamic runtime._LoadLibraryA LoadLibraryA%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._PostQueuedCompletionStatus PostQueuedCompletionStatus%4 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceCounter QueryPerformanceCounter%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceFrequency QueryPerformanceFrequency%1 "kernel32.dll"
+@@ -74,7 +74,6 @@
+ 	// Following syscalls are available on every Windows PC.
+ 	// All these variables are set by the Windows executable
+ 	// loader before the Go program starts.
+-	_AddVectoredContinueHandler,
+ 	_AddVectoredExceptionHandler,
+ 	_CloseHandle,
+ 	_CreateEventA,
+@@ -97,8 +96,8 @@
+ 	_GetSystemInfo,
+ 	_GetThreadContext,
+ 	_SetThreadContext,
+-	_LoadLibraryExW,
+ 	_LoadLibraryW,
++	_LoadLibraryA,
+ 	_PostQueuedCompletionStatus,
+ 	_QueryPerformanceCounter,
+ 	_QueryPerformanceFrequency,
+@@ -127,8 +126,23 @@
+ 	_WriteFile,
+ 	_ stdFunction
+ 
+-	// Use ProcessPrng to generate cryptographically random data.
+-	_ProcessPrng stdFunction
++	// Following syscalls are only available on some Windows PCs.
++	// We will load syscalls, if available, before using them.
++	_AddDllDirectory,
++	_AddVectoredContinueHandler,
++	_LoadLibraryExA,
++	_LoadLibraryExW,
++	_ stdFunction
++
++	// Use RtlGenRandom to generate cryptographically random data.
++	// This approach has been recommended by Microsoft (see issue
++	// 15589 for details).
++	// The RtlGenRandom is not listed in advapi32.dll, instead
++	// RtlGenRandom function can be found by searching for SystemFunction036.
++	// Also some versions of Mingw cannot link to SystemFunction036
++	// when building executable as Cgo. So load SystemFunction036
++	// manually during runtime startup.
++	_RtlGenRandom stdFunction
+ 
+ 	// Load ntdll.dll manually during startup, otherwise Mingw
+ 	// links wrong printf function to cgo executable (see issue
+@@ -145,13 +159,6 @@
+ 	_ stdFunction
+ )
+ 
+-var (
+-	bcryptprimitivesdll = [...]uint16{'b', 'c', 'r', 'y', 'p', 't', 'p', 'r', 'i', 'm', 'i', 't', 'i', 'v', 'e', 's', '.', 'd', 'l', 'l', 0}
+-	ntdlldll            = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
+-	powrprofdll         = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
+-	winmmdll            = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
+-)
+-
+ // Function to be called by windows CreateThread
+ // to start new os thread.
+ func tstart_stdcall(newm *m)
+@@ -244,8 +251,18 @@
+ 	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
+ }
+ 
+-func windowsLoadSystemLib(name []uint16) uintptr {
+-	return stdcall3(_LoadLibraryExW, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++//go:linkname syscall_getSystemDirectory syscall.getSystemDirectory
++func syscall_getSystemDirectory() string {
++	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
++}
++
++func windowsLoadSystemLib(name []byte) uintptr {
++	if useLoadLibraryEx {
++		return stdcall3(_LoadLibraryExA, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		absName := append(sysDirectory[:sysDirectoryLen], name...)
++		return stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&absName[0])))
++	}
+ }
+ 
+ //go:linkname windows_QueryPerformanceCounter internal/syscall/windows.QueryPerformanceCounter
+@@ -263,13 +280,28 @@
+ }
+ 
+ func loadOptionalSyscalls() {
+-	bcryptPrimitives := windowsLoadSystemLib(bcryptprimitivesdll[:])
+-	if bcryptPrimitives == 0 {
+-		throw("bcryptprimitives.dll not found")
++	var kernel32dll = []byte("kernel32.dll\000")
++	k32 := stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&kernel32dll[0])))
++	if k32 == 0 {
++		throw("kernel32.dll not found")
+ 	}
+-	_ProcessPrng = windowsFindfunc(bcryptPrimitives, []byte("ProcessPrng\000"))
++	_AddDllDirectory = windowsFindfunc(k32, []byte("AddDllDirectory\000"))
++	_AddVectoredContinueHandler = windowsFindfunc(k32, []byte("AddVectoredContinueHandler\000"))
++	_LoadLibraryExA = windowsFindfunc(k32, []byte("LoadLibraryExA\000"))
++	_LoadLibraryExW = windowsFindfunc(k32, []byte("LoadLibraryExW\000"))
++	useLoadLibraryEx = (_LoadLibraryExW != nil && _LoadLibraryExA != nil && _AddDllDirectory != nil)
++
++	initSysDirectory()
+ 
+-	n32 := windowsLoadSystemLib(ntdlldll[:])
++	var advapi32dll = []byte("advapi32.dll\000")
++	a32 := windowsLoadSystemLib(advapi32dll)
++	if a32 == 0 {
++		throw("advapi32.dll not found")
++	}
++	_RtlGenRandom = windowsFindfunc(a32, []byte("SystemFunction036\000"))
++
++	var ntdll = []byte("ntdll.dll\000")
++	n32 := windowsLoadSystemLib(ntdll)
+ 	if n32 == 0 {
+ 		throw("ntdll.dll not found")
+ 	}
+@@ -298,7 +330,7 @@
+ 		context  uintptr
+ 	}
+ 
+-	powrprof := windowsLoadSystemLib(powrprofdll[:])
++	powrprof := windowsLoadSystemLib([]byte("powrprof.dll\000"))
+ 	if powrprof == 0 {
+ 		return // Running on Windows 7, where we don't need it anyway.
+ 	}
+@@ -357,6 +389,22 @@
+ // in sys_windows_386.s and sys_windows_amd64.s:
+ func getlasterror() uint32
+ 
++// When loading DLLs, we prefer to use LoadLibraryEx with
++// LOAD_LIBRARY_SEARCH_* flags, if available. LoadLibraryEx is not
++// available on old Windows, though, and the LOAD_LIBRARY_SEARCH_*
++// flags are not available on some versions of Windows without a
++// security patch.
++//
++// https://msdn.microsoft.com/en-us/library/ms684179(v=vs.85).aspx says:
++// "Windows 7, Windows Server 2008 R2, Windows Vista, and Windows
++// Server 2008: The LOAD_LIBRARY_SEARCH_* flags are available on
++// systems that have KB2533623 installed. To determine whether the
++// flags are available, use GetProcAddress to get the address of the
++// AddDllDirectory, RemoveDllDirectory, or SetDefaultDllDirectories
++// function. If GetProcAddress succeeds, the LOAD_LIBRARY_SEARCH_*
++// flags can be used with LoadLibraryEx."
++var useLoadLibraryEx bool
++
+ var timeBeginPeriodRetValue uint32
+ 
+ // osRelaxMinNS indicates that sysmon shouldn't osRelax if the next
+@@ -430,7 +478,8 @@
+ 		// Only load winmm.dll if we need it.
+ 		// This avoids a dependency on winmm.dll for Go programs
+ 		// that run on new Windows versions.
+-		m32 := windowsLoadSystemLib(winmmdll[:])
++		var winmmdll = []byte("winmm.dll\000")
++		m32 := windowsLoadSystemLib(winmmdll)
+ 		if m32 == 0 {
+ 			print("runtime: LoadLibraryExW failed; errno=", getlasterror(), "\n")
+ 			throw("winmm.dll not found")
+@@ -471,6 +520,28 @@
+ 	canUseLongPaths = true
+ }
+ 
++var osVersionInfo struct {
++	majorVersion uint32
++	minorVersion uint32
++	buildNumber  uint32
++}
++
++func initOsVersionInfo() {
++	info := _OSVERSIONINFOW{}
++	info.osVersionInfoSize = uint32(unsafe.Sizeof(info))
++	stdcall1(_RtlGetVersion, uintptr(unsafe.Pointer(&info)))
++	osVersionInfo.majorVersion = info.majorVersion
++	osVersionInfo.minorVersion = info.minorVersion
++	osVersionInfo.buildNumber = info.buildNumber
++}
++
++//go:linkname rtlGetNtVersionNumbers syscall.rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32) {
++	*majorVersion = osVersionInfo.majorVersion
++	*minorVersion = osVersionInfo.minorVersion
++	*buildNumber = osVersionInfo.buildNumber
++}
++
+ func osinit() {
+ 	asmstdcallAddr = unsafe.Pointer(abi.FuncPCABI0(asmstdcall))
+ 
+@@ -483,8 +554,8 @@
+ 	initHighResTimer()
+ 	timeBeginPeriodRetValue = osRelax(false)
+ 
+-	initSysDirectory()
+ 	initLongPathSupport()
++	initOsVersionInfo()
+ 
+ 	ncpu = getproccount()
+ 
+@@ -500,7 +571,7 @@
+ //go:nosplit
+ func readRandom(r []byte) int {
+ 	n := 0
+-	if stdcall2(_ProcessPrng, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
++	if stdcall2(_RtlGenRandom, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
+ 		n = len(r)
+ 	}
+ 	return n
+Index: src/net/hook_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/hook_windows.go b/src/net/hook_windows.go
+--- a/src/net/hook_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/net/hook_windows.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -13,6 +13,7 @@
+ 	hostsFilePath = windows.GetSystemDirectory() + "/Drivers/etc/hosts"
+ 
+ 	// Placeholders for socket system calls.
++	socketFunc    func(int, int, int) (syscall.Handle, error)                                                 = syscall.Socket
+ 	wsaSocketFunc func(int32, int32, int32, *syscall.WSAProtocolInfo, uint32, uint32) (syscall.Handle, error) = windows.WSASocket
+ 	connectFunc   func(syscall.Handle, syscall.Sockaddr) error                                                = syscall.Connect
+ 	listenFunc    func(syscall.Handle, int) error                                                             = syscall.Listen
+Index: src/net/internal/socktest/main_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_test.go b/src/net/internal/socktest/main_test.go
+--- a/src/net/internal/socktest/main_test.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/net/internal/socktest/main_test.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !js && !plan9 && !wasip1 && !windows
++//go:build !js && !plan9 && !wasip1
+ 
+ package socktest_test
+ 
+Index: src/net/internal/socktest/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_windows_test.go b/src/net/internal/socktest/main_windows_test.go
+new file mode 100644
+--- /dev/null	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
++++ b/src/net/internal/socktest/main_windows_test.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -0,0 +1,22 @@
++// Copyright 2015 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++package socktest_test
++
++import "syscall"
++
++var (
++	socketFunc func(int, int, int) (syscall.Handle, error)
++	closeFunc  func(syscall.Handle) error
++)
++
++func installTestHooks() {
++	socketFunc = sw.Socket
++	closeFunc = sw.Closesocket
++}
++
++func uninstallTestHooks() {
++	socketFunc = syscall.Socket
++	closeFunc = syscall.Closesocket
++}
+Index: src/net/internal/socktest/sys_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/sys_windows.go b/src/net/internal/socktest/sys_windows.go
+--- a/src/net/internal/socktest/sys_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/net/internal/socktest/sys_windows.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -9,6 +9,38 @@
+ 	"syscall"
+ )
+ 
++// Socket wraps [syscall.Socket].
++func (sw *Switch) Socket(family, sotype, proto int) (s syscall.Handle, err error) {
++	sw.once.Do(sw.init)
++
++	so := &Status{Cookie: cookie(family, sotype, proto)}
++	sw.fmu.RLock()
++	f, _ := sw.fltab[FilterSocket]
++	sw.fmu.RUnlock()
++
++	af, err := f.apply(so)
++	if err != nil {
++		return syscall.InvalidHandle, err
++	}
++	s, so.Err = syscall.Socket(family, sotype, proto)
++	if err = af.apply(so); err != nil {
++		if so.Err == nil {
++			syscall.Closesocket(s)
++		}
++		return syscall.InvalidHandle, err
++	}
++
++	sw.smu.Lock()
++	defer sw.smu.Unlock()
++	if so.Err != nil {
++		sw.stats.getLocked(so.Cookie).OpenFailed++
++		return syscall.InvalidHandle, so.Err
++	}
++	nso := sw.addLocked(s, family, sotype, proto)
++	sw.stats.getLocked(nso.Cookie).Opened++
++	return s, nil
++}
++
+ // WSASocket wraps [syscall.WSASocket].
+ func (sw *Switch) WSASocket(family, sotype, proto int32, protinfo *syscall.WSAProtocolInfo, group uint32, flags uint32) (s syscall.Handle, err error) {
+ 	sw.once.Do(sw.init)
+Index: src/net/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/main_windows_test.go b/src/net/main_windows_test.go
+--- a/src/net/main_windows_test.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/net/main_windows_test.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -8,6 +8,7 @@
+ 
+ var (
+ 	// Placeholders for saving original socket system calls.
++	origSocket      = socketFunc
+ 	origWSASocket   = wsaSocketFunc
+ 	origClosesocket = poll.CloseFunc
+ 	origConnect     = connectFunc
+@@ -17,6 +18,7 @@
+ )
+ 
+ func installTestHooks() {
++	socketFunc = sw.Socket
+ 	wsaSocketFunc = sw.WSASocket
+ 	poll.CloseFunc = sw.Closesocket
+ 	connectFunc = sw.Connect
+@@ -26,6 +28,7 @@
+ }
+ 
+ func uninstallTestHooks() {
++	socketFunc = origSocket
+ 	wsaSocketFunc = origWSASocket
+ 	poll.CloseFunc = origClosesocket
+ 	connectFunc = origConnect
+Index: src/net/sock_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/sock_windows.go b/src/net/sock_windows.go
+--- a/src/net/sock_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/net/sock_windows.go	(revision 21290de8a4c91408de7c2b5b68757b1e90af49dd)
+@@ -20,6 +20,21 @@
+ func sysSocket(family, sotype, proto int) (syscall.Handle, error) {
+ 	s, err := wsaSocketFunc(int32(family), int32(sotype), int32(proto),
+ 		nil, 0, windows.WSA_FLAG_OVERLAPPED|windows.WSA_FLAG_NO_HANDLE_INHERIT)
++	if err == nil {
++		return s, nil
++	}
++	// WSA_FLAG_NO_HANDLE_INHERIT flag is not supported on some
++	// old versions of Windows, see
++	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms742212(v=vs.85).aspx
++	// for details. Just use syscall.Socket, if windows.WSASocket failed.
++
++	// See ../syscall/exec_unix.go for description of ForkLock.
++	syscall.ForkLock.RLock()
++	s, err = socketFunc(family, sotype, proto)
++	if err == nil {
++		syscall.CloseOnExec(s)
++	}
++	syscall.ForkLock.RUnlock()
+ 	if err != nil {
+ 		return syscall.InvalidHandle, os.NewSyscallError("socket", err)
+ 	}
+Index: src/syscall/exec_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/exec_windows.go b/src/syscall/exec_windows.go
+--- a/src/syscall/exec_windows.go	(revision 9ac42137ef6730e8b7daca016ece831297a1d75b)
++++ b/src/syscall/exec_windows.go	(revision 6a31d3fa8e47ddabc10bd97bff10d9a85f4cfb76)
+@@ -14,7 +14,6 @@
+ 	"unsafe"
+ )
+ 
+-// ForkLock is not used on Windows.
+ var ForkLock sync.RWMutex
+ 
+ // EscapeArg rewrites command line argument s as prescribed
+@@ -254,6 +253,9 @@
+ var zeroProcAttr ProcAttr
+ var zeroSysProcAttr SysProcAttr
+ 
++//go:linkname rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32)
++
+ func StartProcess(argv0 string, argv []string, attr *ProcAttr) (pid int, handle uintptr, err error) {
+ 	if len(argv0) == 0 {
+ 		return 0, 0, EWINDOWS
+@@ -317,6 +319,17 @@
+ 		}
+ 	}
+ 
++	var maj, min, build uint32
++	rtlGetNtVersionNumbers(&maj, &min, &build)
++	isWin7 := maj < 6 || (maj == 6 && min <= 1)
++	// NT kernel handles are divisible by 4, with the bottom 3 bits left as
++	// a tag. The fully set tag correlates with the types of handles we're
++	// concerned about here.  Except, the kernel will interpret some
++	// special handle values, like -1, -2, and so forth, so kernelbase.dll
++	// checks to see that those bottom three bits are checked, but that top
++	// bit is not checked.
++	isLegacyWin7ConsoleHandle := func(handle Handle) bool { return isWin7 && handle&0x10000003 == 3 }
++
+ 	p, _ := GetCurrentProcess()
+ 	parentProcess := p
+ 	if sys.ParentProcess != 0 {
+@@ -325,7 +338,15 @@
+ 	fd := make([]Handle, len(attr.Files))
+ 	for i := range attr.Files {
+ 		if attr.Files[i] > 0 {
+-			err := DuplicateHandle(p, Handle(attr.Files[i]), parentProcess, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
++			destinationProcessHandle := parentProcess
++
++			// On Windows 7, console handles aren't real handles, and can only be duplicated
++			// into the current process, not a parent one, which amounts to the same thing.
++			if parentProcess != p && isLegacyWin7ConsoleHandle(Handle(attr.Files[i])) {
++				destinationProcessHandle = p
++			}
++
++			err := DuplicateHandle(p, Handle(attr.Files[i]), destinationProcessHandle, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
+ 			if err != nil {
+ 				return 0, 0, err
+ 			}
+@@ -356,6 +377,14 @@
+ 
+ 	fd = append(fd, sys.AdditionalInheritedHandles...)
+ 
++	// On Windows 7, console handles aren't real handles, so don't pass them
++	// through to PROC_THREAD_ATTRIBUTE_HANDLE_LIST.
++	for i := range fd {
++		if isLegacyWin7ConsoleHandle(fd[i]) {
++			fd[i] = 0
++		}
++	}
++
+ 	// The presence of a NULL handle in the list is enough to cause PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+ 	// to treat the entire list as empty, so remove NULL handles.
+ 	j := 0
+Index: src/runtime/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/syscall_windows.go b/src/runtime/syscall_windows.go
+--- a/src/runtime/syscall_windows.go	(revision 6a31d3fa8e47ddabc10bd97bff10d9a85f4cfb76)
++++ b/src/runtime/syscall_windows.go	(revision 69e2eed6dd0f6d815ebf15797761c13f31213dd6)
+@@ -413,10 +413,20 @@
+ 
+ const _LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
+ 
++// When available, this function will use LoadLibraryEx with the filename
++// parameter and the important SEARCH_SYSTEM32 argument. But on systems that
++// do not have that option, absoluteFilepath should contain a fallback
++// to the full path inside of system32 for use with vanilla LoadLibrary.
++//
+ //go:linkname syscall_loadsystemlibrary syscall.loadsystemlibrary
+-func syscall_loadsystemlibrary(filename *uint16) (handle, err uintptr) {
+-	handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++func syscall_loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle, err uintptr) {
++	if useLoadLibraryEx {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryW)), uintptr(unsafe.Pointer(absoluteFilepath)))
++	}
+ 	KeepAlive(filename)
++	KeepAlive(absoluteFilepath)
+ 	if handle != 0 {
+ 		err = 0
+ 	}
+Index: src/syscall/dll_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/dll_windows.go b/src/syscall/dll_windows.go
+--- a/src/syscall/dll_windows.go	(revision 6a31d3fa8e47ddabc10bd97bff10d9a85f4cfb76)
++++ b/src/syscall/dll_windows.go	(revision 69e2eed6dd0f6d815ebf15797761c13f31213dd6)
+@@ -44,7 +44,7 @@
+ 
+ func SyscallN(trap uintptr, args ...uintptr) (r1, r2 uintptr, err Errno)
+ func loadlibrary(filename *uint16) (handle uintptr, err Errno)
+-func loadsystemlibrary(filename *uint16) (handle uintptr, err Errno)
++func loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle uintptr, err Errno)
+ func getprocaddress(handle uintptr, procname *uint8) (proc uintptr, err Errno)
+ 
+ // A DLL implements access to a single DLL.
+@@ -53,6 +53,9 @@
+ 	Handle Handle
+ }
+ 
++//go:linkname getSystemDirectory
++func getSystemDirectory() string // Implemented in runtime package.
++
+ // LoadDLL loads the named DLL file into memory.
+ //
+ // If name is not an absolute path and is not a known system DLL used by
+@@ -69,7 +72,11 @@
+ 	var h uintptr
+ 	var e Errno
+ 	if sysdll.IsSystemDLL[name] {
+-		h, e = loadsystemlibrary(namep)
++		absoluteFilepathp, err := UTF16PtrFromString(getSystemDirectory() + name)
++		if err != nil {
++			return nil, err
++		}
++		h, e = loadsystemlibrary(namep, absoluteFilepathp)
+ 	} else {
+ 		h, e = loadlibrary(namep)
+ 	}

.github/patch/go1.24.patch

@@ -0,0 +1,657 @@
+Subject: [PATCH] Revert "runtime: always use LoadLibraryEx to load system libraries"
+Revert "syscall: remove Windows 7 console handle workaround"
+Revert "net: remove sysSocket fallback for Windows 7"
+Revert "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
+---
+Index: src/crypto/internal/sysrand/rand_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/internal/sysrand/rand_windows.go b/src/crypto/internal/sysrand/rand_windows.go
+--- a/src/crypto/internal/sysrand/rand_windows.go	(revision 3901409b5d0fb7c85a3e6730a59943cc93b2835c)
++++ b/src/crypto/internal/sysrand/rand_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
+@@ -7,5 +7,26 @@
+ import "internal/syscall/windows"
+ 
+ func read(b []byte) error {
+-	return windows.ProcessPrng(b)
++	// RtlGenRandom only returns 1<<32-1 bytes at a time. We only read at
++	// most 1<<31-1 bytes at a time so that  this works the same on 32-bit
++	// and 64-bit systems.
++	return batched(windows.RtlGenRandom, 1<<31-1)(b)
++}
++
++// batched returns a function that calls f to populate a []byte by chunking it
++// into subslices of, at most, readMax bytes.
++func batched(f func([]byte) error, readMax int) func([]byte) error {
++	return func(out []byte) error {
++		for len(out) > 0 {
++			read := len(out)
++			if read > readMax {
++				read = readMax
++			}
++			if err := f(out[:read]); err != nil {
++				return err
++			}
++			out = out[read:]
++		}
++		return nil
++	}
+ }
+Index: src/crypto/rand/rand.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand.go b/src/crypto/rand/rand.go
+--- a/src/crypto/rand/rand.go	(revision 3901409b5d0fb7c85a3e6730a59943cc93b2835c)
++++ b/src/crypto/rand/rand.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
+@@ -22,7 +22,7 @@
+ //   - On legacy Linux (< 3.17), Reader opens /dev/urandom on first use.
+ //   - On macOS, iOS, and OpenBSD Reader, uses arc4random_buf(3).
+ //   - On NetBSD, Reader uses the kern.arandom sysctl.
+-//   - On Windows, Reader uses the ProcessPrng API.
++//   - On Windows systems, Reader uses the RtlGenRandom API.
+ //   - On js/wasm, Reader uses the Web Crypto API.
+ //   - On wasip1/wasm, Reader uses random_get.
+ //
+Index: src/internal/syscall/windows/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/syscall_windows.go b/src/internal/syscall/windows/syscall_windows.go
+--- a/src/internal/syscall/windows/syscall_windows.go	(revision 3901409b5d0fb7c85a3e6730a59943cc93b2835c)
++++ b/src/internal/syscall/windows/syscall_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
+@@ -416,7 +416,7 @@
+ //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
+ //sys	CreateEvent(eventAttrs *SecurityAttributes, manualReset uint32, initialState uint32, name *uint16) (handle syscall.Handle, err error) = kernel32.CreateEventW
+ 
+-//sys	ProcessPrng(buf []byte) (err error) = bcryptprimitives.ProcessPrng
++//sys	RtlGenRandom(buf []byte) (err error) = advapi32.SystemFunction036
+ 
+ type FILE_ID_BOTH_DIR_INFO struct {
+ 	NextEntryOffset uint32
+Index: src/internal/syscall/windows/zsyscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/zsyscall_windows.go b/src/internal/syscall/windows/zsyscall_windows.go
+--- a/src/internal/syscall/windows/zsyscall_windows.go	(revision 3901409b5d0fb7c85a3e6730a59943cc93b2835c)
++++ b/src/internal/syscall/windows/zsyscall_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
+@@ -38,7 +38,6 @@
+ 
+ var (
+ 	modadvapi32         = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
+-	modbcryptprimitives = syscall.NewLazyDLL(sysdll.Add("bcryptprimitives.dll"))
+ 	modiphlpapi         = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
+ 	modkernel32         = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
+ 	modnetapi32         = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
+@@ -63,7 +62,7 @@
+ 	procQueryServiceStatus                = modadvapi32.NewProc("QueryServiceStatus")
+ 	procRevertToSelf                      = modadvapi32.NewProc("RevertToSelf")
+ 	procSetTokenInformation               = modadvapi32.NewProc("SetTokenInformation")
+-	procProcessPrng                       = modbcryptprimitives.NewProc("ProcessPrng")
++	procSystemFunction036                 = modadvapi32.NewProc("SystemFunction036")
+ 	procGetAdaptersAddresses              = modiphlpapi.NewProc("GetAdaptersAddresses")
+ 	procCreateEventW                      = modkernel32.NewProc("CreateEventW")
+ 	procGetACP                            = modkernel32.NewProc("GetACP")
+@@ -236,12 +235,12 @@
+ 	return
+ }
+ 
+-func ProcessPrng(buf []byte) (err error) {
++func RtlGenRandom(buf []byte) (err error) {
+ 	var _p0 *byte
+ 	if len(buf) > 0 {
+ 		_p0 = &buf[0]
+ 	}
+-	r1, _, e1 := syscall.Syscall(procProcessPrng.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
++	r1, _, e1 := syscall.Syscall(procSystemFunction036.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
+ 	if r1 == 0 {
+ 		err = errnoErr(e1)
+ 	}
+Index: src/runtime/os_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/os_windows.go b/src/runtime/os_windows.go
+--- a/src/runtime/os_windows.go	(revision 3901409b5d0fb7c85a3e6730a59943cc93b2835c)
++++ b/src/runtime/os_windows.go	(revision ac3e93c061779dfefc0dd13a5b6e6f764a25621e)
+@@ -40,8 +40,8 @@
+ //go:cgo_import_dynamic runtime._GetSystemInfo GetSystemInfo%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._GetThreadContext GetThreadContext%2 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._SetThreadContext SetThreadContext%2 "kernel32.dll"
+-//go:cgo_import_dynamic runtime._LoadLibraryExW LoadLibraryExW%3 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._LoadLibraryW LoadLibraryW%1 "kernel32.dll"
++//go:cgo_import_dynamic runtime._LoadLibraryA LoadLibraryA%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._PostQueuedCompletionStatus PostQueuedCompletionStatus%4 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceCounter QueryPerformanceCounter%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceFrequency QueryPerformanceFrequency%1 "kernel32.dll"
+@@ -75,7 +75,6 @@
+ 	// Following syscalls are available on every Windows PC.
+ 	// All these variables are set by the Windows executable
+ 	// loader before the Go program starts.
+-	_AddVectoredContinueHandler,
+ 	_AddVectoredExceptionHandler,
+ 	_CloseHandle,
+ 	_CreateEventA,
+@@ -98,8 +97,8 @@
+ 	_GetSystemInfo,
+ 	_GetThreadContext,
+ 	_SetThreadContext,
+-	_LoadLibraryExW,
+ 	_LoadLibraryW,
++	_LoadLibraryA,
+ 	_PostQueuedCompletionStatus,
+ 	_QueryPerformanceCounter,
+ 	_QueryPerformanceFrequency,
+@@ -128,8 +127,23 @@
+ 	_WriteFile,
+ 	_ stdFunction
+ 
+-	// Use ProcessPrng to generate cryptographically random data.
+-	_ProcessPrng stdFunction
++	// Following syscalls are only available on some Windows PCs.
++	// We will load syscalls, if available, before using them.
++	_AddDllDirectory,
++	_AddVectoredContinueHandler,
++	_LoadLibraryExA,
++	_LoadLibraryExW,
++	_ stdFunction
++
++	// Use RtlGenRandom to generate cryptographically random data.
++	// This approach has been recommended by Microsoft (see issue
++	// 15589 for details).
++	// The RtlGenRandom is not listed in advapi32.dll, instead
++	// RtlGenRandom function can be found by searching for SystemFunction036.
++	// Also some versions of Mingw cannot link to SystemFunction036
++	// when building executable as Cgo. So load SystemFunction036
++	// manually during runtime startup.
++	_RtlGenRandom stdFunction
+ 
+ 	// Load ntdll.dll manually during startup, otherwise Mingw
+ 	// links wrong printf function to cgo executable (see issue
+@@ -146,13 +160,6 @@
+ 	_ stdFunction
+ )
+ 
+-var (
+-	bcryptprimitivesdll = [...]uint16{'b', 'c', 'r', 'y', 'p', 't', 'p', 'r', 'i', 'm', 'i', 't', 'i', 'v', 'e', 's', '.', 'd', 'l', 'l', 0}
+-	ntdlldll            = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
+-	powrprofdll         = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
+-	winmmdll            = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
+-)
+-
+ // Function to be called by windows CreateThread
+ // to start new os thread.
+ func tstart_stdcall(newm *m)
+@@ -245,8 +252,18 @@
+ 	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
+ }
+ 
+-func windowsLoadSystemLib(name []uint16) uintptr {
+-	return stdcall3(_LoadLibraryExW, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++//go:linkname syscall_getSystemDirectory syscall.getSystemDirectory
++func syscall_getSystemDirectory() string {
++	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
++}
++
++func windowsLoadSystemLib(name []byte) uintptr {
++	if useLoadLibraryEx {
++		return stdcall3(_LoadLibraryExA, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		absName := append(sysDirectory[:sysDirectoryLen], name...)
++		return stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&absName[0])))
++	}
+ }
+ 
+ //go:linkname windows_QueryPerformanceCounter internal/syscall/windows.QueryPerformanceCounter
+@@ -264,13 +281,28 @@
+ }
+ 
+ func loadOptionalSyscalls() {
+-	bcryptPrimitives := windowsLoadSystemLib(bcryptprimitivesdll[:])
+-	if bcryptPrimitives == 0 {
+-		throw("bcryptprimitives.dll not found")
++	var kernel32dll = []byte("kernel32.dll\000")
++	k32 := stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&kernel32dll[0])))
++	if k32 == 0 {
++		throw("kernel32.dll not found")
+ 	}
+-	_ProcessPrng = windowsFindfunc(bcryptPrimitives, []byte("ProcessPrng\000"))
++	_AddDllDirectory = windowsFindfunc(k32, []byte("AddDllDirectory\000"))
++	_AddVectoredContinueHandler = windowsFindfunc(k32, []byte("AddVectoredContinueHandler\000"))
++	_LoadLibraryExA = windowsFindfunc(k32, []byte("LoadLibraryExA\000"))
++	_LoadLibraryExW = windowsFindfunc(k32, []byte("LoadLibraryExW\000"))
++	useLoadLibraryEx = (_LoadLibraryExW != nil && _LoadLibraryExA != nil && _AddDllDirectory != nil)
++
++	initSysDirectory()
+ 
+-	n32 := windowsLoadSystemLib(ntdlldll[:])
++	var advapi32dll = []byte("advapi32.dll\000")
++	a32 := windowsLoadSystemLib(advapi32dll)
++	if a32 == 0 {
++		throw("advapi32.dll not found")
++	}
++	_RtlGenRandom = windowsFindfunc(a32, []byte("SystemFunction036\000"))
++
++	var ntdll = []byte("ntdll.dll\000")
++	n32 := windowsLoadSystemLib(ntdll)
+ 	if n32 == 0 {
+ 		throw("ntdll.dll not found")
+ 	}
+@@ -299,7 +331,7 @@
+ 		context  uintptr
+ 	}
+ 
+-	powrprof := windowsLoadSystemLib(powrprofdll[:])
++	powrprof := windowsLoadSystemLib([]byte("powrprof.dll\000"))
+ 	if powrprof == 0 {
+ 		return // Running on Windows 7, where we don't need it anyway.
+ 	}
+@@ -358,6 +390,22 @@
+ // in sys_windows_386.s and sys_windows_amd64.s:
+ func getlasterror() uint32
+ 
++// When loading DLLs, we prefer to use LoadLibraryEx with
++// LOAD_LIBRARY_SEARCH_* flags, if available. LoadLibraryEx is not
++// available on old Windows, though, and the LOAD_LIBRARY_SEARCH_*
++// flags are not available on some versions of Windows without a
++// security patch.
++//
++// https://msdn.microsoft.com/en-us/library/ms684179(v=vs.85).aspx says:
++// "Windows 7, Windows Server 2008 R2, Windows Vista, and Windows
++// Server 2008: The LOAD_LIBRARY_SEARCH_* flags are available on
++// systems that have KB2533623 installed. To determine whether the
++// flags are available, use GetProcAddress to get the address of the
++// AddDllDirectory, RemoveDllDirectory, or SetDefaultDllDirectories
++// function. If GetProcAddress succeeds, the LOAD_LIBRARY_SEARCH_*
++// flags can be used with LoadLibraryEx."
++var useLoadLibraryEx bool
++
+ var timeBeginPeriodRetValue uint32
+ 
+ // osRelaxMinNS indicates that sysmon shouldn't osRelax if the next
+@@ -431,7 +479,8 @@
+ 		// Only load winmm.dll if we need it.
+ 		// This avoids a dependency on winmm.dll for Go programs
+ 		// that run on new Windows versions.
+-		m32 := windowsLoadSystemLib(winmmdll[:])
++		var winmmdll = []byte("winmm.dll\000")
++		m32 := windowsLoadSystemLib(winmmdll)
+ 		if m32 == 0 {
+ 			print("runtime: LoadLibraryExW failed; errno=", getlasterror(), "\n")
+ 			throw("winmm.dll not found")
+@@ -472,6 +521,28 @@
+ 	canUseLongPaths = true
+ }
+ 
++var osVersionInfo struct {
++	majorVersion uint32
++	minorVersion uint32
++	buildNumber  uint32
++}
++
++func initOsVersionInfo() {
++	info := _OSVERSIONINFOW{}
++	info.osVersionInfoSize = uint32(unsafe.Sizeof(info))
++	stdcall1(_RtlGetVersion, uintptr(unsafe.Pointer(&info)))
++	osVersionInfo.majorVersion = info.majorVersion
++	osVersionInfo.minorVersion = info.minorVersion
++	osVersionInfo.buildNumber = info.buildNumber
++}
++
++//go:linkname rtlGetNtVersionNumbers syscall.rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32) {
++	*majorVersion = osVersionInfo.majorVersion
++	*minorVersion = osVersionInfo.minorVersion
++	*buildNumber = osVersionInfo.buildNumber
++}
++
+ func osinit() {
+ 	asmstdcallAddr = unsafe.Pointer(abi.FuncPCABI0(asmstdcall))
+ 
+@@ -484,8 +555,8 @@
+ 	initHighResTimer()
+ 	timeBeginPeriodRetValue = osRelax(false)
+ 
+-	initSysDirectory()
+ 	initLongPathSupport()
++	initOsVersionInfo()
+ 
+ 	ncpu = getproccount()
+ 
+@@ -501,7 +572,7 @@
+ //go:nosplit
+ func readRandom(r []byte) int {
+ 	n := 0
+-	if stdcall2(_ProcessPrng, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
++	if stdcall2(_RtlGenRandom, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
+ 		n = len(r)
+ 	}
+ 	return n
+Index: src/net/hook_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/hook_windows.go b/src/net/hook_windows.go
+--- a/src/net/hook_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/net/hook_windows.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -13,6 +13,7 @@
+ 	hostsFilePath = windows.GetSystemDirectory() + "/Drivers/etc/hosts"
+ 
+ 	// Placeholders for socket system calls.
++	socketFunc    func(int, int, int) (syscall.Handle, error)                                                 = syscall.Socket
+ 	wsaSocketFunc func(int32, int32, int32, *syscall.WSAProtocolInfo, uint32, uint32) (syscall.Handle, error) = windows.WSASocket
+ 	connectFunc   func(syscall.Handle, syscall.Sockaddr) error                                                = syscall.Connect
+ 	listenFunc    func(syscall.Handle, int) error                                                             = syscall.Listen
+Index: src/net/internal/socktest/main_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_test.go b/src/net/internal/socktest/main_test.go
+--- a/src/net/internal/socktest/main_test.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/net/internal/socktest/main_test.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !js && !plan9 && !wasip1 && !windows
++//go:build !js && !plan9 && !wasip1
+ 
+ package socktest_test
+ 
+Index: src/net/internal/socktest/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_windows_test.go b/src/net/internal/socktest/main_windows_test.go
+new file mode 100644
+--- /dev/null	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
++++ b/src/net/internal/socktest/main_windows_test.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -0,0 +1,22 @@
++// Copyright 2015 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++package socktest_test
++
++import "syscall"
++
++var (
++	socketFunc func(int, int, int) (syscall.Handle, error)
++	closeFunc  func(syscall.Handle) error
++)
++
++func installTestHooks() {
++	socketFunc = sw.Socket
++	closeFunc = sw.Closesocket
++}
++
++func uninstallTestHooks() {
++	socketFunc = syscall.Socket
++	closeFunc = syscall.Closesocket
++}
+Index: src/net/internal/socktest/sys_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/sys_windows.go b/src/net/internal/socktest/sys_windows.go
+--- a/src/net/internal/socktest/sys_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/net/internal/socktest/sys_windows.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -9,6 +9,38 @@
+ 	"syscall"
+ )
+ 
++// Socket wraps [syscall.Socket].
++func (sw *Switch) Socket(family, sotype, proto int) (s syscall.Handle, err error) {
++	sw.once.Do(sw.init)
++
++	so := &Status{Cookie: cookie(family, sotype, proto)}
++	sw.fmu.RLock()
++	f, _ := sw.fltab[FilterSocket]
++	sw.fmu.RUnlock()
++
++	af, err := f.apply(so)
++	if err != nil {
++		return syscall.InvalidHandle, err
++	}
++	s, so.Err = syscall.Socket(family, sotype, proto)
++	if err = af.apply(so); err != nil {
++		if so.Err == nil {
++			syscall.Closesocket(s)
++		}
++		return syscall.InvalidHandle, err
++	}
++
++	sw.smu.Lock()
++	defer sw.smu.Unlock()
++	if so.Err != nil {
++		sw.stats.getLocked(so.Cookie).OpenFailed++
++		return syscall.InvalidHandle, so.Err
++	}
++	nso := sw.addLocked(s, family, sotype, proto)
++	sw.stats.getLocked(nso.Cookie).Opened++
++	return s, nil
++}
++
+ // WSASocket wraps [syscall.WSASocket].
+ func (sw *Switch) WSASocket(family, sotype, proto int32, protinfo *syscall.WSAProtocolInfo, group uint32, flags uint32) (s syscall.Handle, err error) {
+ 	sw.once.Do(sw.init)
+Index: src/net/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/main_windows_test.go b/src/net/main_windows_test.go
+--- a/src/net/main_windows_test.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/net/main_windows_test.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -8,6 +8,7 @@
+ 
+ var (
+ 	// Placeholders for saving original socket system calls.
++	origSocket      = socketFunc
+ 	origWSASocket   = wsaSocketFunc
+ 	origClosesocket = poll.CloseFunc
+ 	origConnect     = connectFunc
+@@ -17,6 +18,7 @@
+ )
+ 
+ func installTestHooks() {
++	socketFunc = sw.Socket
+ 	wsaSocketFunc = sw.WSASocket
+ 	poll.CloseFunc = sw.Closesocket
+ 	connectFunc = sw.Connect
+@@ -26,6 +28,7 @@
+ }
+ 
+ func uninstallTestHooks() {
++	socketFunc = origSocket
+ 	wsaSocketFunc = origWSASocket
+ 	poll.CloseFunc = origClosesocket
+ 	connectFunc = origConnect
+Index: src/net/sock_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/sock_windows.go b/src/net/sock_windows.go
+--- a/src/net/sock_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/net/sock_windows.go	(revision 7b1fd7d39c6be0185fbe1d929578ab372ac5c632)
+@@ -20,6 +20,21 @@
+ func sysSocket(family, sotype, proto int) (syscall.Handle, error) {
+ 	s, err := wsaSocketFunc(int32(family), int32(sotype), int32(proto),
+ 		nil, 0, windows.WSA_FLAG_OVERLAPPED|windows.WSA_FLAG_NO_HANDLE_INHERIT)
++	if err == nil {
++		return s, nil
++	}
++	// WSA_FLAG_NO_HANDLE_INHERIT flag is not supported on some
++	// old versions of Windows, see
++	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms742212(v=vs.85).aspx
++	// for details. Just use syscall.Socket, if windows.WSASocket failed.
++
++	// See ../syscall/exec_unix.go for description of ForkLock.
++	syscall.ForkLock.RLock()
++	s, err = socketFunc(family, sotype, proto)
++	if err == nil {
++		syscall.CloseOnExec(s)
++	}
++	syscall.ForkLock.RUnlock()
+ 	if err != nil {
+ 		return syscall.InvalidHandle, os.NewSyscallError("socket", err)
+ 	}
+Index: src/syscall/exec_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/exec_windows.go b/src/syscall/exec_windows.go
+--- a/src/syscall/exec_windows.go	(revision 2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8)
++++ b/src/syscall/exec_windows.go	(revision 979d6d8bab3823ff572ace26767fd2ce3cf351ae)
+@@ -14,7 +14,6 @@
+ 	"unsafe"
+ )
+ 
+-// ForkLock is not used on Windows.
+ var ForkLock sync.RWMutex
+ 
+ // EscapeArg rewrites command line argument s as prescribed
+@@ -254,6 +253,9 @@
+ var zeroProcAttr ProcAttr
+ var zeroSysProcAttr SysProcAttr
+ 
++//go:linkname rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32)
++
+ func StartProcess(argv0 string, argv []string, attr *ProcAttr) (pid int, handle uintptr, err error) {
+ 	if len(argv0) == 0 {
+ 		return 0, 0, EWINDOWS
+@@ -317,6 +319,17 @@
+ 		}
+ 	}
+ 
++	var maj, min, build uint32
++	rtlGetNtVersionNumbers(&maj, &min, &build)
++	isWin7 := maj < 6 || (maj == 6 && min <= 1)
++	// NT kernel handles are divisible by 4, with the bottom 3 bits left as
++	// a tag. The fully set tag correlates with the types of handles we're
++	// concerned about here.  Except, the kernel will interpret some
++	// special handle values, like -1, -2, and so forth, so kernelbase.dll
++	// checks to see that those bottom three bits are checked, but that top
++	// bit is not checked.
++	isLegacyWin7ConsoleHandle := func(handle Handle) bool { return isWin7 && handle&0x10000003 == 3 }
++
+ 	p, _ := GetCurrentProcess()
+ 	parentProcess := p
+ 	if sys.ParentProcess != 0 {
+@@ -325,7 +338,15 @@
+ 	fd := make([]Handle, len(attr.Files))
+ 	for i := range attr.Files {
+ 		if attr.Files[i] > 0 {
+-			err := DuplicateHandle(p, Handle(attr.Files[i]), parentProcess, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
++			destinationProcessHandle := parentProcess
++
++			// On Windows 7, console handles aren't real handles, and can only be duplicated
++			// into the current process, not a parent one, which amounts to the same thing.
++			if parentProcess != p && isLegacyWin7ConsoleHandle(Handle(attr.Files[i])) {
++				destinationProcessHandle = p
++			}
++
++			err := DuplicateHandle(p, Handle(attr.Files[i]), destinationProcessHandle, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
+ 			if err != nil {
+ 				return 0, 0, err
+ 			}
+@@ -356,6 +377,14 @@
+ 
+ 	fd = append(fd, sys.AdditionalInheritedHandles...)
+ 
++	// On Windows 7, console handles aren't real handles, so don't pass them
++	// through to PROC_THREAD_ATTRIBUTE_HANDLE_LIST.
++	for i := range fd {
++		if isLegacyWin7ConsoleHandle(fd[i]) {
++			fd[i] = 0
++		}
++	}
++
+ 	// The presence of a NULL handle in the list is enough to cause PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+ 	// to treat the entire list as empty, so remove NULL handles.
+ 	j := 0
+Index: src/runtime/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/syscall_windows.go b/src/runtime/syscall_windows.go
+--- a/src/runtime/syscall_windows.go	(revision 979d6d8bab3823ff572ace26767fd2ce3cf351ae)
++++ b/src/runtime/syscall_windows.go	(revision ac3e93c061779dfefc0dd13a5b6e6f764a25621e)
+@@ -413,10 +413,20 @@
+ 
+ const _LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
+ 
++// When available, this function will use LoadLibraryEx with the filename
++// parameter and the important SEARCH_SYSTEM32 argument. But on systems that
++// do not have that option, absoluteFilepath should contain a fallback
++// to the full path inside of system32 for use with vanilla LoadLibrary.
++//
+ //go:linkname syscall_loadsystemlibrary syscall.loadsystemlibrary
+-func syscall_loadsystemlibrary(filename *uint16) (handle, err uintptr) {
+-	handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++func syscall_loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle, err uintptr) {
++	if useLoadLibraryEx {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryW)), uintptr(unsafe.Pointer(absoluteFilepath)))
++	}
+ 	KeepAlive(filename)
++	KeepAlive(absoluteFilepath)
+ 	if handle != 0 {
+ 		err = 0
+ 	}
+Index: src/syscall/dll_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/dll_windows.go b/src/syscall/dll_windows.go
+--- a/src/syscall/dll_windows.go	(revision 979d6d8bab3823ff572ace26767fd2ce3cf351ae)
++++ b/src/syscall/dll_windows.go	(revision ac3e93c061779dfefc0dd13a5b6e6f764a25621e)
+@@ -45,7 +45,7 @@
+ //go:noescape
+ func SyscallN(trap uintptr, args ...uintptr) (r1, r2 uintptr, err Errno)
+ func loadlibrary(filename *uint16) (handle uintptr, err Errno)
+-func loadsystemlibrary(filename *uint16) (handle uintptr, err Errno)
++func loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle uintptr, err Errno)
+ func getprocaddress(handle uintptr, procname *uint8) (proc uintptr, err Errno)
+ 
+ // A DLL implements access to a single DLL.
+@@ -54,6 +54,9 @@
+ 	Handle Handle
+ }
+ 
++//go:linkname getSystemDirectory
++func getSystemDirectory() string // Implemented in runtime package.
++
+ // LoadDLL loads the named DLL file into memory.
+ //
+ // If name is not an absolute path and is not a known system DLL used by
+@@ -70,7 +73,11 @@
+ 	var h uintptr
+ 	var e Errno
+ 	if sysdll.IsSystemDLL[name] {
+-		h, e = loadsystemlibrary(namep)
++		absoluteFilepathp, err := UTF16PtrFromString(getSystemDirectory() + name)
++		if err != nil {
++			return nil, err
++		}
++		h, e = loadsystemlibrary(namep, absoluteFilepathp)
+ 	} else {
+ 		h, e = loadlibrary(namep)
+ 	}

.github/patch/go1.25.patch

@@ -0,0 +1,657 @@
+Subject: [PATCH] Revert "runtime: always use LoadLibraryEx to load system libraries"
+Revert "syscall: remove Windows 7 console handle workaround"
+Revert "net: remove sysSocket fallback for Windows 7"
+Revert "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
+---
+Index: src/crypto/internal/sysrand/rand_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/internal/sysrand/rand_windows.go b/src/crypto/internal/sysrand/rand_windows.go
+--- a/src/crypto/internal/sysrand/rand_windows.go	(revision 6e676ab2b809d46623acb5988248d95d1eb7939c)
++++ b/src/crypto/internal/sysrand/rand_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
+@@ -7,5 +7,26 @@
+ import "internal/syscall/windows"
+ 
+ func read(b []byte) error {
+-	return windows.ProcessPrng(b)
++	// RtlGenRandom only returns 1<<32-1 bytes at a time. We only read at
++	// most 1<<31-1 bytes at a time so that  this works the same on 32-bit
++	// and 64-bit systems.
++	return batched(windows.RtlGenRandom, 1<<31-1)(b)
++}
++
++// batched returns a function that calls f to populate a []byte by chunking it
++// into subslices of, at most, readMax bytes.
++func batched(f func([]byte) error, readMax int) func([]byte) error {
++	return func(out []byte) error {
++		for len(out) > 0 {
++			read := len(out)
++			if read > readMax {
++				read = readMax
++			}
++			if err := f(out[:read]); err != nil {
++				return err
++			}
++			out = out[read:]
++		}
++		return nil
++	}
+ }
+Index: src/crypto/rand/rand.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/crypto/rand/rand.go b/src/crypto/rand/rand.go
+--- a/src/crypto/rand/rand.go	(revision 6e676ab2b809d46623acb5988248d95d1eb7939c)
++++ b/src/crypto/rand/rand.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
+@@ -22,7 +22,7 @@
+ //   - On legacy Linux (< 3.17), Reader opens /dev/urandom on first use.
+ //   - On macOS, iOS, and OpenBSD Reader, uses arc4random_buf(3).
+ //   - On NetBSD, Reader uses the kern.arandom sysctl.
+-//   - On Windows, Reader uses the ProcessPrng API.
++//   - On Windows systems, Reader uses the RtlGenRandom API.
+ //   - On js/wasm, Reader uses the Web Crypto API.
+ //   - On wasip1/wasm, Reader uses random_get.
+ //
+Index: src/internal/syscall/windows/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/syscall_windows.go b/src/internal/syscall/windows/syscall_windows.go
+--- a/src/internal/syscall/windows/syscall_windows.go	(revision 6e676ab2b809d46623acb5988248d95d1eb7939c)
++++ b/src/internal/syscall/windows/syscall_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
+@@ -419,7 +419,7 @@
+ //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
+ //sys	CreateEvent(eventAttrs *SecurityAttributes, manualReset uint32, initialState uint32, name *uint16) (handle syscall.Handle, err error) = kernel32.CreateEventW
+ 
+-//sys	ProcessPrng(buf []byte) (err error) = bcryptprimitives.ProcessPrng
++//sys	RtlGenRandom(buf []byte) (err error) = advapi32.SystemFunction036
+ 
+ type FILE_ID_BOTH_DIR_INFO struct {
+ 	NextEntryOffset uint32
+Index: src/internal/syscall/windows/zsyscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/internal/syscall/windows/zsyscall_windows.go b/src/internal/syscall/windows/zsyscall_windows.go
+--- a/src/internal/syscall/windows/zsyscall_windows.go	(revision 6e676ab2b809d46623acb5988248d95d1eb7939c)
++++ b/src/internal/syscall/windows/zsyscall_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
+@@ -38,7 +38,6 @@
+ 
+ var (
+ 	modadvapi32         = syscall.NewLazyDLL(sysdll.Add("advapi32.dll"))
+-	modbcryptprimitives = syscall.NewLazyDLL(sysdll.Add("bcryptprimitives.dll"))
+ 	modiphlpapi         = syscall.NewLazyDLL(sysdll.Add("iphlpapi.dll"))
+ 	modkernel32         = syscall.NewLazyDLL(sysdll.Add("kernel32.dll"))
+ 	modnetapi32         = syscall.NewLazyDLL(sysdll.Add("netapi32.dll"))
+@@ -63,7 +62,7 @@
+ 	procQueryServiceStatus                = modadvapi32.NewProc("QueryServiceStatus")
+ 	procRevertToSelf                      = modadvapi32.NewProc("RevertToSelf")
+ 	procSetTokenInformation               = modadvapi32.NewProc("SetTokenInformation")
+-	procProcessPrng                       = modbcryptprimitives.NewProc("ProcessPrng")
++	procSystemFunction036                 = modadvapi32.NewProc("SystemFunction036")
+ 	procGetAdaptersAddresses              = modiphlpapi.NewProc("GetAdaptersAddresses")
+ 	procCreateEventW                      = modkernel32.NewProc("CreateEventW")
+ 	procCreateIoCompletionPort            = modkernel32.NewProc("CreateIoCompletionPort")
+@@ -242,12 +241,12 @@
+ 	return
+ }
+ 
+-func ProcessPrng(buf []byte) (err error) {
++func RtlGenRandom(buf []byte) (err error) {
+ 	var _p0 *byte
+ 	if len(buf) > 0 {
+ 		_p0 = &buf[0]
+ 	}
+-	r1, _, e1 := syscall.Syscall(procProcessPrng.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
++	r1, _, e1 := syscall.Syscall(procSystemFunction036.Addr(), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0)
+ 	if r1 == 0 {
+ 		err = errnoErr(e1)
+ 	}
+Index: src/runtime/os_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/os_windows.go b/src/runtime/os_windows.go
+--- a/src/runtime/os_windows.go	(revision 6e676ab2b809d46623acb5988248d95d1eb7939c)
++++ b/src/runtime/os_windows.go	(revision f56f1e23507e646c85243a71bde7b9629b2f970c)
+@@ -39,8 +39,8 @@
+ //go:cgo_import_dynamic runtime._GetSystemInfo GetSystemInfo%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._GetThreadContext GetThreadContext%2 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._SetThreadContext SetThreadContext%2 "kernel32.dll"
+-//go:cgo_import_dynamic runtime._LoadLibraryExW LoadLibraryExW%3 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._LoadLibraryW LoadLibraryW%1 "kernel32.dll"
++//go:cgo_import_dynamic runtime._LoadLibraryA LoadLibraryA%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._PostQueuedCompletionStatus PostQueuedCompletionStatus%4 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceCounter QueryPerformanceCounter%1 "kernel32.dll"
+ //go:cgo_import_dynamic runtime._QueryPerformanceFrequency QueryPerformanceFrequency%1 "kernel32.dll"
+@@ -74,7 +74,6 @@
+ 	// Following syscalls are available on every Windows PC.
+ 	// All these variables are set by the Windows executable
+ 	// loader before the Go program starts.
+-	_AddVectoredContinueHandler,
+ 	_AddVectoredExceptionHandler,
+ 	_CloseHandle,
+ 	_CreateEventA,
+@@ -97,8 +96,8 @@
+ 	_GetSystemInfo,
+ 	_GetThreadContext,
+ 	_SetThreadContext,
+-	_LoadLibraryExW,
+ 	_LoadLibraryW,
++	_LoadLibraryA,
+ 	_PostQueuedCompletionStatus,
+ 	_QueryPerformanceCounter,
+ 	_QueryPerformanceFrequency,
+@@ -127,8 +126,23 @@
+ 	_WriteFile,
+ 	_ stdFunction
+ 
+-	// Use ProcessPrng to generate cryptographically random data.
+-	_ProcessPrng stdFunction
++	// Following syscalls are only available on some Windows PCs.
++	// We will load syscalls, if available, before using them.
++	_AddDllDirectory,
++	_AddVectoredContinueHandler,
++	_LoadLibraryExA,
++	_LoadLibraryExW,
++	_ stdFunction
++
++	// Use RtlGenRandom to generate cryptographically random data.
++	// This approach has been recommended by Microsoft (see issue
++	// 15589 for details).
++	// The RtlGenRandom is not listed in advapi32.dll, instead
++	// RtlGenRandom function can be found by searching for SystemFunction036.
++	// Also some versions of Mingw cannot link to SystemFunction036
++	// when building executable as Cgo. So load SystemFunction036
++	// manually during runtime startup.
++	_RtlGenRandom stdFunction
+ 
+ 	// Load ntdll.dll manually during startup, otherwise Mingw
+ 	// links wrong printf function to cgo executable (see issue
+@@ -145,13 +159,6 @@
+ 	_ stdFunction
+ )
+ 
+-var (
+-	bcryptprimitivesdll = [...]uint16{'b', 'c', 'r', 'y', 'p', 't', 'p', 'r', 'i', 'm', 'i', 't', 'i', 'v', 'e', 's', '.', 'd', 'l', 'l', 0}
+-	ntdlldll            = [...]uint16{'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', 0}
+-	powrprofdll         = [...]uint16{'p', 'o', 'w', 'r', 'p', 'r', 'o', 'f', '.', 'd', 'l', 'l', 0}
+-	winmmdll            = [...]uint16{'w', 'i', 'n', 'm', 'm', '.', 'd', 'l', 'l', 0}
+-)
+-
+ // Function to be called by windows CreateThread
+ // to start new os thread.
+ func tstart_stdcall(newm *m)
+@@ -244,8 +251,18 @@
+ 	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
+ }
+ 
+-func windowsLoadSystemLib(name []uint16) uintptr {
+-	return stdcall3(_LoadLibraryExW, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++//go:linkname syscall_getSystemDirectory syscall.getSystemDirectory
++func syscall_getSystemDirectory() string {
++	return unsafe.String(&sysDirectory[0], sysDirectoryLen)
++}
++
++func windowsLoadSystemLib(name []byte) uintptr {
++	if useLoadLibraryEx {
++		return stdcall3(_LoadLibraryExA, uintptr(unsafe.Pointer(&name[0])), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		absName := append(sysDirectory[:sysDirectoryLen], name...)
++		return stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&absName[0])))
++	}
+ }
+ 
+ //go:linkname windows_QueryPerformanceCounter internal/syscall/windows.QueryPerformanceCounter
+@@ -263,13 +280,28 @@
+ }
+ 
+ func loadOptionalSyscalls() {
+-	bcryptPrimitives := windowsLoadSystemLib(bcryptprimitivesdll[:])
+-	if bcryptPrimitives == 0 {
+-		throw("bcryptprimitives.dll not found")
++	var kernel32dll = []byte("kernel32.dll\000")
++	k32 := stdcall1(_LoadLibraryA, uintptr(unsafe.Pointer(&kernel32dll[0])))
++	if k32 == 0 {
++		throw("kernel32.dll not found")
+ 	}
+-	_ProcessPrng = windowsFindfunc(bcryptPrimitives, []byte("ProcessPrng\000"))
++	_AddDllDirectory = windowsFindfunc(k32, []byte("AddDllDirectory\000"))
++	_AddVectoredContinueHandler = windowsFindfunc(k32, []byte("AddVectoredContinueHandler\000"))
++	_LoadLibraryExA = windowsFindfunc(k32, []byte("LoadLibraryExA\000"))
++	_LoadLibraryExW = windowsFindfunc(k32, []byte("LoadLibraryExW\000"))
++	useLoadLibraryEx = (_LoadLibraryExW != nil && _LoadLibraryExA != nil && _AddDllDirectory != nil)
++
++	initSysDirectory()
+ 
+-	n32 := windowsLoadSystemLib(ntdlldll[:])
++	var advapi32dll = []byte("advapi32.dll\000")
++	a32 := windowsLoadSystemLib(advapi32dll)
++	if a32 == 0 {
++		throw("advapi32.dll not found")
++	}
++	_RtlGenRandom = windowsFindfunc(a32, []byte("SystemFunction036\000"))
++
++	var ntdll = []byte("ntdll.dll\000")
++	n32 := windowsLoadSystemLib(ntdll)
+ 	if n32 == 0 {
+ 		throw("ntdll.dll not found")
+ 	}
+@@ -298,7 +330,7 @@
+ 		context  uintptr
+ 	}
+ 
+-	powrprof := windowsLoadSystemLib(powrprofdll[:])
++	powrprof := windowsLoadSystemLib([]byte("powrprof.dll\000"))
+ 	if powrprof == 0 {
+ 		return // Running on Windows 7, where we don't need it anyway.
+ 	}
+@@ -357,6 +389,22 @@
+ // in sys_windows_386.s and sys_windows_amd64.s:
+ func getlasterror() uint32
+ 
++// When loading DLLs, we prefer to use LoadLibraryEx with
++// LOAD_LIBRARY_SEARCH_* flags, if available. LoadLibraryEx is not
++// available on old Windows, though, and the LOAD_LIBRARY_SEARCH_*
++// flags are not available on some versions of Windows without a
++// security patch.
++//
++// https://msdn.microsoft.com/en-us/library/ms684179(v=vs.85).aspx says:
++// "Windows 7, Windows Server 2008 R2, Windows Vista, and Windows
++// Server 2008: The LOAD_LIBRARY_SEARCH_* flags are available on
++// systems that have KB2533623 installed. To determine whether the
++// flags are available, use GetProcAddress to get the address of the
++// AddDllDirectory, RemoveDllDirectory, or SetDefaultDllDirectories
++// function. If GetProcAddress succeeds, the LOAD_LIBRARY_SEARCH_*
++// flags can be used with LoadLibraryEx."
++var useLoadLibraryEx bool
++
+ var timeBeginPeriodRetValue uint32
+ 
+ // osRelaxMinNS indicates that sysmon shouldn't osRelax if the next
+@@ -430,7 +478,8 @@
+ 		// Only load winmm.dll if we need it.
+ 		// This avoids a dependency on winmm.dll for Go programs
+ 		// that run on new Windows versions.
+-		m32 := windowsLoadSystemLib(winmmdll[:])
++		var winmmdll = []byte("winmm.dll\000")
++		m32 := windowsLoadSystemLib(winmmdll)
+ 		if m32 == 0 {
+ 			print("runtime: LoadLibraryExW failed; errno=", getlasterror(), "\n")
+ 			throw("winmm.dll not found")
+@@ -471,6 +520,28 @@
+ 	canUseLongPaths = true
+ }
+ 
++var osVersionInfo struct {
++	majorVersion uint32
++	minorVersion uint32
++	buildNumber  uint32
++}
++
++func initOsVersionInfo() {
++	info := _OSVERSIONINFOW{}
++	info.osVersionInfoSize = uint32(unsafe.Sizeof(info))
++	stdcall1(_RtlGetVersion, uintptr(unsafe.Pointer(&info)))
++	osVersionInfo.majorVersion = info.majorVersion
++	osVersionInfo.minorVersion = info.minorVersion
++	osVersionInfo.buildNumber = info.buildNumber
++}
++
++//go:linkname rtlGetNtVersionNumbers syscall.rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32) {
++	*majorVersion = osVersionInfo.majorVersion
++	*minorVersion = osVersionInfo.minorVersion
++	*buildNumber = osVersionInfo.buildNumber
++}
++
+ func osinit() {
+ 	asmstdcallAddr = unsafe.Pointer(abi.FuncPCABI0(asmstdcall))
+ 
+@@ -483,8 +554,8 @@
+ 	initHighResTimer()
+ 	timeBeginPeriodRetValue = osRelax(false)
+ 
+-	initSysDirectory()
+ 	initLongPathSupport()
++	initOsVersionInfo()
+ 
+ 	numCPUStartup = getCPUCount()
+ 
+@@ -500,7 +571,7 @@
+ //go:nosplit
+ func readRandom(r []byte) int {
+ 	n := 0
+-	if stdcall2(_ProcessPrng, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
++	if stdcall2(_RtlGenRandom, uintptr(unsafe.Pointer(&r[0])), uintptr(len(r)))&0xff != 0 {
+ 		n = len(r)
+ 	}
+ 	return n
+Index: src/net/hook_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/hook_windows.go b/src/net/hook_windows.go
+--- a/src/net/hook_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/net/hook_windows.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -13,6 +13,7 @@
+ 	hostsFilePath = windows.GetSystemDirectory() + "/Drivers/etc/hosts"
+ 
+ 	// Placeholders for socket system calls.
++	socketFunc    func(int, int, int) (syscall.Handle, error)                                                 = syscall.Socket
+ 	wsaSocketFunc func(int32, int32, int32, *syscall.WSAProtocolInfo, uint32, uint32) (syscall.Handle, error) = windows.WSASocket
+ 	connectFunc   func(syscall.Handle, syscall.Sockaddr) error                                                = syscall.Connect
+ 	listenFunc    func(syscall.Handle, int) error                                                             = syscall.Listen
+Index: src/net/internal/socktest/main_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_test.go b/src/net/internal/socktest/main_test.go
+--- a/src/net/internal/socktest/main_test.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/net/internal/socktest/main_test.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !js && !plan9 && !wasip1 && !windows
++//go:build !js && !plan9 && !wasip1
+ 
+ package socktest_test
+ 
+Index: src/net/internal/socktest/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/main_windows_test.go b/src/net/internal/socktest/main_windows_test.go
+new file mode 100644
+--- /dev/null	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
++++ b/src/net/internal/socktest/main_windows_test.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -0,0 +1,22 @@
++// Copyright 2015 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++package socktest_test
++
++import "syscall"
++
++var (
++	socketFunc func(int, int, int) (syscall.Handle, error)
++	closeFunc  func(syscall.Handle) error
++)
++
++func installTestHooks() {
++	socketFunc = sw.Socket
++	closeFunc = sw.Closesocket
++}
++
++func uninstallTestHooks() {
++	socketFunc = syscall.Socket
++	closeFunc = syscall.Closesocket
++}
+Index: src/net/internal/socktest/sys_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/internal/socktest/sys_windows.go b/src/net/internal/socktest/sys_windows.go
+--- a/src/net/internal/socktest/sys_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/net/internal/socktest/sys_windows.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -9,6 +9,38 @@
+ 	"syscall"
+ )
+ 
++// Socket wraps [syscall.Socket].
++func (sw *Switch) Socket(family, sotype, proto int) (s syscall.Handle, err error) {
++	sw.once.Do(sw.init)
++
++	so := &Status{Cookie: cookie(family, sotype, proto)}
++	sw.fmu.RLock()
++	f, _ := sw.fltab[FilterSocket]
++	sw.fmu.RUnlock()
++
++	af, err := f.apply(so)
++	if err != nil {
++		return syscall.InvalidHandle, err
++	}
++	s, so.Err = syscall.Socket(family, sotype, proto)
++	if err = af.apply(so); err != nil {
++		if so.Err == nil {
++			syscall.Closesocket(s)
++		}
++		return syscall.InvalidHandle, err
++	}
++
++	sw.smu.Lock()
++	defer sw.smu.Unlock()
++	if so.Err != nil {
++		sw.stats.getLocked(so.Cookie).OpenFailed++
++		return syscall.InvalidHandle, so.Err
++	}
++	nso := sw.addLocked(s, family, sotype, proto)
++	sw.stats.getLocked(nso.Cookie).Opened++
++	return s, nil
++}
++
+ // WSASocket wraps [syscall.WSASocket].
+ func (sw *Switch) WSASocket(family, sotype, proto int32, protinfo *syscall.WSAProtocolInfo, group uint32, flags uint32) (s syscall.Handle, err error) {
+ 	sw.once.Do(sw.init)
+Index: src/net/main_windows_test.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/main_windows_test.go b/src/net/main_windows_test.go
+--- a/src/net/main_windows_test.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/net/main_windows_test.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -12,6 +12,7 @@
+ 
+ var (
+ 	// Placeholders for saving original socket system calls.
++	origSocket      = socketFunc
+ 	origWSASocket   = wsaSocketFunc
+ 	origClosesocket = poll.CloseFunc
+ 	origConnect     = connectFunc
+@@ -21,6 +22,7 @@
+ )
+ 
+ func installTestHooks() {
++	socketFunc = sw.Socket
+ 	wsaSocketFunc = sw.WSASocket
+ 	poll.CloseFunc = sw.Closesocket
+ 	connectFunc = sw.Connect
+@@ -30,6 +32,7 @@
+ }
+ 
+ func uninstallTestHooks() {
++	socketFunc = origSocket
+ 	wsaSocketFunc = origWSASocket
+ 	poll.CloseFunc = origClosesocket
+ 	connectFunc = origConnect
+Index: src/net/sock_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/net/sock_windows.go b/src/net/sock_windows.go
+--- a/src/net/sock_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/net/sock_windows.go	(revision 6788c4c6f9fafb56729bad6b660f7ee2272d699f)
+@@ -20,6 +20,21 @@
+ func sysSocket(family, sotype, proto int) (syscall.Handle, error) {
+ 	s, err := wsaSocketFunc(int32(family), int32(sotype), int32(proto),
+ 		nil, 0, windows.WSA_FLAG_OVERLAPPED|windows.WSA_FLAG_NO_HANDLE_INHERIT)
++	if err == nil {
++		return s, nil
++	}
++	// WSA_FLAG_NO_HANDLE_INHERIT flag is not supported on some
++	// old versions of Windows, see
++	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms742212(v=vs.85).aspx
++	// for details. Just use syscall.Socket, if windows.WSASocket failed.
++
++	// See ../syscall/exec_unix.go for description of ForkLock.
++	syscall.ForkLock.RLock()
++	s, err = socketFunc(family, sotype, proto)
++	if err == nil {
++		syscall.CloseOnExec(s)
++	}
++	syscall.ForkLock.RUnlock()
+ 	if err != nil {
+ 		return syscall.InvalidHandle, os.NewSyscallError("socket", err)
+ 	}
+Index: src/syscall/exec_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/exec_windows.go b/src/syscall/exec_windows.go
+--- a/src/syscall/exec_windows.go	(revision 8cb5472d94c34b88733a81091bd328e70ee565a4)
++++ b/src/syscall/exec_windows.go	(revision a5b2168bb836ed9d6601c626f95e56c07923f906)
+@@ -14,7 +14,6 @@
+ 	"unsafe"
+ )
+ 
+-// ForkLock is not used on Windows.
+ var ForkLock sync.RWMutex
+ 
+ // EscapeArg rewrites command line argument s as prescribed
+@@ -254,6 +253,9 @@
+ var zeroProcAttr ProcAttr
+ var zeroSysProcAttr SysProcAttr
+ 
++//go:linkname rtlGetNtVersionNumbers
++func rtlGetNtVersionNumbers(majorVersion *uint32, minorVersion *uint32, buildNumber *uint32)
++
+ func StartProcess(argv0 string, argv []string, attr *ProcAttr) (pid int, handle uintptr, err error) {
+ 	if len(argv0) == 0 {
+ 		return 0, 0, EWINDOWS
+@@ -317,6 +319,17 @@
+ 		}
+ 	}
+ 
++	var maj, min, build uint32
++	rtlGetNtVersionNumbers(&maj, &min, &build)
++	isWin7 := maj < 6 || (maj == 6 && min <= 1)
++	// NT kernel handles are divisible by 4, with the bottom 3 bits left as
++	// a tag. The fully set tag correlates with the types of handles we're
++	// concerned about here.  Except, the kernel will interpret some
++	// special handle values, like -1, -2, and so forth, so kernelbase.dll
++	// checks to see that those bottom three bits are checked, but that top
++	// bit is not checked.
++	isLegacyWin7ConsoleHandle := func(handle Handle) bool { return isWin7 && handle&0x10000003 == 3 }
++
+ 	p, _ := GetCurrentProcess()
+ 	parentProcess := p
+ 	if sys.ParentProcess != 0 {
+@@ -325,7 +338,15 @@
+ 	fd := make([]Handle, len(attr.Files))
+ 	for i := range attr.Files {
+ 		if attr.Files[i] > 0 {
+-			err := DuplicateHandle(p, Handle(attr.Files[i]), parentProcess, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
++			destinationProcessHandle := parentProcess
++
++			// On Windows 7, console handles aren't real handles, and can only be duplicated
++			// into the current process, not a parent one, which amounts to the same thing.
++			if parentProcess != p && isLegacyWin7ConsoleHandle(Handle(attr.Files[i])) {
++				destinationProcessHandle = p
++			}
++
++			err := DuplicateHandle(p, Handle(attr.Files[i]), destinationProcessHandle, &fd[i], 0, true, DUPLICATE_SAME_ACCESS)
+ 			if err != nil {
+ 				return 0, 0, err
+ 			}
+@@ -356,6 +377,14 @@
+ 
+ 	fd = append(fd, sys.AdditionalInheritedHandles...)
+ 
++	// On Windows 7, console handles aren't real handles, so don't pass them
++	// through to PROC_THREAD_ATTRIBUTE_HANDLE_LIST.
++	for i := range fd {
++		if isLegacyWin7ConsoleHandle(fd[i]) {
++			fd[i] = 0
++		}
++	}
++
+ 	// The presence of a NULL handle in the list is enough to cause PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+ 	// to treat the entire list as empty, so remove NULL handles.
+ 	j := 0
+Index: src/runtime/syscall_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/runtime/syscall_windows.go b/src/runtime/syscall_windows.go
+--- a/src/runtime/syscall_windows.go	(revision a5b2168bb836ed9d6601c626f95e56c07923f906)
++++ b/src/runtime/syscall_windows.go	(revision f56f1e23507e646c85243a71bde7b9629b2f970c)
+@@ -413,10 +413,20 @@
+ 
+ const _LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
+ 
++// When available, this function will use LoadLibraryEx with the filename
++// parameter and the important SEARCH_SYSTEM32 argument. But on systems that
++// do not have that option, absoluteFilepath should contain a fallback
++// to the full path inside of system32 for use with vanilla LoadLibrary.
++//
+ //go:linkname syscall_loadsystemlibrary syscall.loadsystemlibrary
+-func syscall_loadsystemlibrary(filename *uint16) (handle, err uintptr) {
+-	handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++func syscall_loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle, err uintptr) {
++	if useLoadLibraryEx {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryExW)), uintptr(unsafe.Pointer(filename)), 0, _LOAD_LIBRARY_SEARCH_SYSTEM32)
++	} else {
++		handle, _, err = syscall_SyscallN(uintptr(unsafe.Pointer(_LoadLibraryW)), uintptr(unsafe.Pointer(absoluteFilepath)))
++	}
+ 	KeepAlive(filename)
++	KeepAlive(absoluteFilepath)
+ 	if handle != 0 {
+ 		err = 0
+ 	}
+Index: src/syscall/dll_windows.go
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/src/syscall/dll_windows.go b/src/syscall/dll_windows.go
+--- a/src/syscall/dll_windows.go	(revision a5b2168bb836ed9d6601c626f95e56c07923f906)
++++ b/src/syscall/dll_windows.go	(revision f56f1e23507e646c85243a71bde7b9629b2f970c)
+@@ -45,7 +45,7 @@
+ //go:noescape
+ func SyscallN(trap uintptr, args ...uintptr) (r1, r2 uintptr, err Errno)
+ func loadlibrary(filename *uint16) (handle uintptr, err Errno)
+-func loadsystemlibrary(filename *uint16) (handle uintptr, err Errno)
++func loadsystemlibrary(filename *uint16, absoluteFilepath *uint16) (handle uintptr, err Errno)
+ func getprocaddress(handle uintptr, procname *uint8) (proc uintptr, err Errno)
+ 
+ // A DLL implements access to a single DLL.
+@@ -54,6 +54,9 @@
+ 	Handle Handle
+ }
+ 
++//go:linkname getSystemDirectory
++func getSystemDirectory() string // Implemented in runtime package.
++
+ // LoadDLL loads the named DLL file into memory.
+ //
+ // If name is not an absolute path and is not a known system DLL used by
+@@ -70,7 +73,11 @@
+ 	var h uintptr
+ 	var e Errno
+ 	if sysdll.IsSystemDLL[name] {
+-		h, e = loadsystemlibrary(namep)
++		absoluteFilepathp, err := UTF16PtrFromString(getSystemDirectory() + name)
++		if err != nil {
++			return nil, err
++		}
++		h, e = loadsystemlibrary(namep, absoluteFilepathp)
+ 	} else {
+ 		h, e = loadlibrary(namep)
+ 	}

.github/workflows/build.yml

@@ -146,17 +146,17 @@ jobs:
           - { goos: linux, goarch: amd64, goamd64: v3, output: amd64-v3-go120, goversion: '1.20' }
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Set up Go
       if: ${{ matrix.jobs.goversion == '' && matrix.jobs.abi != '1' }}
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: '1.25'
 
     - name: Set up Go
       if: ${{ matrix.jobs.goversion != '' && matrix.jobs.abi != '1' }}
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: ${{ matrix.jobs.goversion }}
 
@@ -179,12 +179,8 @@ jobs:
     - name: Revert Golang1.25 commit for Windows7/8
       if: ${{ matrix.jobs.goos == 'windows' && matrix.jobs.goversion == '' }}
       run: |
-        alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
         cd $(go env GOROOT)
-        curl https://github.com/MetaCubeX/go/commit/8cb5472d94c34b88733a81091bd328e70ee565a4.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/6788c4c6f9fafb56729bad6b660f7ee2272d699f.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/a5b2168bb836ed9d6601c626f95e56c07923f906.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/f56f1e23507e646c85243a71bde7b9629b2f970c.diff | patch --verbose -p 1
+        patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go1.25.patch
 
       # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
       # this patch file only works on golang1.24.x
@@ -198,12 +194,8 @@ jobs:
     - name: Revert Golang1.24 commit for Windows7/8
       if: ${{ matrix.jobs.goos == 'windows' && matrix.jobs.goversion == '1.24' }}
       run: |
-        alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
         cd $(go env GOROOT)
-        curl https://github.com/MetaCubeX/go/commit/2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/7b1fd7d39c6be0185fbe1d929578ab372ac5c632.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/979d6d8bab3823ff572ace26767fd2ce3cf351ae.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/ac3e93c061779dfefc0dd13a5b6e6f764a25621e.diff | patch --verbose -p 1
+        patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go1.24.patch
 
       # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
       # this patch file only works on golang1.23.x
@@ -217,12 +209,8 @@ jobs:
     - name: Revert Golang1.23 commit for Windows7/8
       if: ${{ matrix.jobs.goos == 'windows' && matrix.jobs.goversion == '1.23' }}
       run: |
-        alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
         cd $(go env GOROOT)
-        curl https://github.com/MetaCubeX/go/commit/9ac42137ef6730e8b7daca016ece831297a1d75b.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/21290de8a4c91408de7c2b5b68757b1e90af49dd.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/6a31d3fa8e47ddabc10bd97bff10d9a85f4cfb76.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/69e2eed6dd0f6d815ebf15797761c13f31213dd6.diff | patch --verbose -p 1
+        patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go1.23.patch
 
       # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
       # this patch file only works on golang1.22.x
@@ -236,20 +224,15 @@ jobs:
     - name: Revert Golang1.22 commit for Windows7/8
       if: ${{ matrix.jobs.goos == 'windows' && matrix.jobs.goversion == '1.22' }}
       run: |
-        alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
         cd $(go env GOROOT)
-        curl https://github.com/MetaCubeX/go/commit/9779155f18b6556a034f7bb79fb7fb2aad1e26a9.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/ef0606261340e608017860b423ffae5c1ce78239.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/7f83badcb925a7e743188041cb6e561fc9b5b642.diff | patch --verbose -p 1
-        curl https://github.com/MetaCubeX/go/commit/83ff9782e024cb328b690cbf0da4e7848a327f4f.diff | patch --verbose -p 1
+        patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go1.22.patch
 
       # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
     - name: Revert Golang1.21 commit for Windows7/8
       if: ${{ matrix.jobs.goos == 'windows' && matrix.jobs.goversion == '1.21' }}
       run: |
-        alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
         cd $(go env GOROOT)
-        curl https://github.com/golang/go/commit/9e43850a3298a9b8b1162ba0033d4c53f8637571.diff | patch --verbose -R -p 1
+        patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go1.21.patch
 
     - name: Set variables
       run: |
@@ -438,7 +421,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: Meta
           fetch-depth: '0'
@@ -497,7 +480,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

.github/workflows/test.yml

@@ -22,7 +22,7 @@ jobs:
           - 'windows-latest' # amd64 windows
           - 'macos-latest' # arm64 macos
           - 'ubuntu-24.04-arm' # arm64 linux
-          - 'macos-13' # amd64 macos
+          - 'macos-15-intel' # amd64 macos
         go-version:
           - '1.25'
           - '1.24'
@@ -41,96 +41,18 @@ jobs:
       # Fix mingw trying to be smart and converting paths https://github.com/moby/moby/issues/24029#issuecomment-250412919
       MSYS_NO_PATHCONV: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
 
-      # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
-      # this patch file only works on golang1.25.x
-      # that means after golang1.26 release it must be changed
-      # see: https://github.com/MetaCubeX/go/commits/release-branch.go1.25/
-      # revert:
-      # 693def151adff1af707d82d28f55dba81ceb08e1: "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
-      # 7c1157f9544922e96945196b47b95664b1e39108: "net: remove sysSocket fallback for Windows 7"
-      # 48042aa09c2f878c4faa576948b07fe625c4707a: "syscall: remove Windows 7 console handle workaround"
-      # a17d959debdb04cd550016a3501dd09d50cd62e7: "runtime: always use LoadLibraryEx to load system libraries"
-      - name: Revert Golang1.25 commit for Windows7/8
-        if: ${{ runner.os == 'Windows' && matrix.go-version == '1.25' }}
+      - name: Revert Golang commit for Windows7/8
+        if: ${{ runner.os == 'Windows' && matrix.go-version != '1.20' }}
         run: |
-          alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
           cd $(go env GOROOT)
-          curl https://github.com/MetaCubeX/go/commit/8cb5472d94c34b88733a81091bd328e70ee565a4.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/6788c4c6f9fafb56729bad6b660f7ee2272d699f.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/a5b2168bb836ed9d6601c626f95e56c07923f906.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/f56f1e23507e646c85243a71bde7b9629b2f970c.diff | patch --verbose -p 1
-
-      # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
-      # this patch file only works on golang1.24.x
-      # that means after golang1.25 release it must be changed
-      # see: https://github.com/MetaCubeX/go/commits/release-branch.go1.24/
-      # revert:
-      # 693def151adff1af707d82d28f55dba81ceb08e1: "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
-      # 7c1157f9544922e96945196b47b95664b1e39108: "net: remove sysSocket fallback for Windows 7"
-      # 48042aa09c2f878c4faa576948b07fe625c4707a: "syscall: remove Windows 7 console handle workaround"
-      # a17d959debdb04cd550016a3501dd09d50cd62e7: "runtime: always use LoadLibraryEx to load system libraries"
-      - name: Revert Golang1.24 commit for Windows7/8
-        if: ${{ runner.os == 'Windows' && matrix.go-version == '1.24' }}
-        run: |
-          alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
-          cd $(go env GOROOT)
-          curl https://github.com/MetaCubeX/go/commit/2a406dc9f1ea7323d6ca9fccb2fe9ddebb6b1cc8.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/7b1fd7d39c6be0185fbe1d929578ab372ac5c632.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/979d6d8bab3823ff572ace26767fd2ce3cf351ae.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/ac3e93c061779dfefc0dd13a5b6e6f764a25621e.diff | patch --verbose -p 1
-
-        # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
-        # this patch file only works on golang1.23.x
-        # that means after golang1.24 release it must be changed
-        # see: https://github.com/MetaCubeX/go/commits/release-branch.go1.23/
-        # revert:
-        # 693def151adff1af707d82d28f55dba81ceb08e1: "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
-        # 7c1157f9544922e96945196b47b95664b1e39108: "net: remove sysSocket fallback for Windows 7"
-        # 48042aa09c2f878c4faa576948b07fe625c4707a: "syscall: remove Windows 7 console handle workaround"
-        # a17d959debdb04cd550016a3501dd09d50cd62e7: "runtime: always use LoadLibraryEx to load system libraries"
-      - name: Revert Golang1.23 commit for Windows7/8
-        if: ${{ runner.os == 'Windows' && matrix.go-version == '1.23' }}
-        run: |
-          alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
-          cd $(go env GOROOT)
-          curl https://github.com/MetaCubeX/go/commit/9ac42137ef6730e8b7daca016ece831297a1d75b.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/21290de8a4c91408de7c2b5b68757b1e90af49dd.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/6a31d3fa8e47ddabc10bd97bff10d9a85f4cfb76.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/69e2eed6dd0f6d815ebf15797761c13f31213dd6.diff | patch --verbose -p 1
-
-        # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
-        # this patch file only works on golang1.22.x
-        # that means after golang1.23 release it must be changed
-        # see: https://github.com/MetaCubeX/go/commits/release-branch.go1.22/
-        # revert:
-        # 693def151adff1af707d82d28f55dba81ceb08e1: "crypto/rand,runtime: switch RtlGenRandom for ProcessPrng"
-        # 7c1157f9544922e96945196b47b95664b1e39108: "net: remove sysSocket fallback for Windows 7"
-        # 48042aa09c2f878c4faa576948b07fe625c4707a: "syscall: remove Windows 7 console handle workaround"
-        # a17d959debdb04cd550016a3501dd09d50cd62e7: "runtime: always use LoadLibraryEx to load system libraries"
-      - name: Revert Golang1.22 commit for Windows7/8
-        if: ${{ runner.os == 'Windows' && matrix.go-version == '1.22' }}
-        run: |
-          alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
-          cd $(go env GOROOT)
-          curl https://github.com/MetaCubeX/go/commit/9779155f18b6556a034f7bb79fb7fb2aad1e26a9.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/ef0606261340e608017860b423ffae5c1ce78239.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/7f83badcb925a7e743188041cb6e561fc9b5b642.diff | patch --verbose -p 1
-          curl https://github.com/MetaCubeX/go/commit/83ff9782e024cb328b690cbf0da4e7848a327f4f.diff | patch --verbose -p 1
-
-        # modify from https://github.com/restic/restic/issues/4636#issuecomment-1896455557
-      - name: Revert Golang1.21 commit for Windows7/8
-        if: ${{ runner.os == 'Windows' && matrix.go-version == '1.21' }}
-        run: |
-          alias curl='curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}"'
-          cd $(go env GOROOT)
-          curl https://github.com/golang/go/commit/9e43850a3298a9b8b1162ba0033d4c53f8637571.diff | patch --verbose -R -p 1
+          patch --verbose -p 1 < $GITHUB_WORKSPACE/.github/patch/go${{matrix.go-version}}.patch
 
       - name: Test
         run: go test ./... -v -count=1

Dockerfile

@@ -4,9 +4,9 @@ RUN echo "I'm building for $TARGETPLATFORM"
 
 RUN apk add --no-cache gzip && \
     mkdir /mihomo-config && \
-    wget -O /mihomo-config/geoip.metadb https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.metadb && \
-    wget -O /mihomo-config/geosite.dat https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat && \
-    wget -O /mihomo-config/geoip.dat https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat
+    wget -O /mihomo-config/geoip.metadb https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.metadb && \
+    wget -O /mihomo-config/geosite.dat https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat && \
+    wget -O /mihomo-config/geoip.dat https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.dat
 
 COPY docker/file-name.sh /mihomo/file-name.sh
 WORKDIR /mihomo

adapter/adapter.go

@@ -51,26 +51,12 @@ func (p *Proxy) AliveForTestUrl(url string) bool {
 	return p.alive.Load()
 }
 
-// Dial implements C.Proxy
-func (p *Proxy) Dial(metadata *C.Metadata) (C.Conn, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), C.DefaultTCPTimeout)
-	defer cancel()
-	return p.DialContext(ctx, metadata)
-}
-
 // DialContext implements C.ProxyAdapter
 func (p *Proxy) DialContext(ctx context.Context, metadata *C.Metadata) (C.Conn, error) {
 	conn, err := p.ProxyAdapter.DialContext(ctx, metadata)
 	return conn, err
 }
 
-// DialUDP implements C.ProxyAdapter
-func (p *Proxy) DialUDP(metadata *C.Metadata) (C.PacketConn, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), C.DefaultUDPTimeout)
-	defer cancel()
-	return p.ListenPacketContext(ctx, metadata)
-}
-
 // ListenPacketContext implements C.ProxyAdapter
 func (p *Proxy) ListenPacketContext(ctx context.Context, metadata *C.Metadata) (C.PacketConn, error) {
 	pc, err := p.ProxyAdapter.ListenPacketContext(ctx, metadata)

adapter/outbound/base.go

@@ -263,7 +263,9 @@ func NewConn(c net.Conn, a C.ProxyAdapter) C.Conn {
 	if _, ok := c.(syscall.Conn); !ok { // exclusion system conn like *net.TCPConn
 		c = N.NewDeadlineConn(c) // most conn from outbound can't handle readDeadline correctly
 	}
-	return &conn{N.NewExtendedConn(c), []string{a.Name()}, a.Addr()}
+	cc := &conn{N.NewExtendedConn(c), nil, a.Addr()}
+	cc.AppendToChains(a)
+	return cc
 }
 
 type packetConn struct {
@@ -320,7 +322,9 @@ func newPacketConn(pc net.PacketConn, a ProxyAdapter) C.PacketConn {
 	if _, ok := pc.(syscall.Conn); !ok { // exclusion system conn like *net.UDPConn
 		epc = N.NewDeadlineEnhancePacketConn(epc) // most conn from outbound can't handle readDeadline correctly
 	}
-	return &packetConn{epc, []string{a.Name()}, a.Name(), utils.NewUUIDV4().String(), a.Addr(), a.ResolveUDP}
+	cpc := &packetConn{epc, nil, a.Name(), utils.NewUUIDV4().String(), a.Addr(), a.ResolveUDP}
+	cpc.AppendToChains(a)
+	return cpc
 }
 
 type AddRef interface {

adapter/outbound/mieru.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net"
 	"strconv"
-	"strings"
 	"sync"
 
 	CN "github.com/metacubex/mihomo/common/net"
@@ -31,8 +30,8 @@ type MieruOption struct {
 	BasicOption
 	Name          string `proxy:"name"`
 	Server        string `proxy:"server"`
-	Port          string `proxy:"port,omitempty"`
-	PortRange     string `proxy:"port-range,omitempty"` // deprecated
+	Port          int    `proxy:"port,omitempty"`
+	PortRange     string `proxy:"port-range,omitempty"`
 	Transport     string `proxy:"transport"`
 	UDP           bool   `proxy:"udp,omitempty"`
 	UserName      string `proxy:"username"`
@@ -124,19 +123,13 @@ func NewMieru(option MieruOption) (*Mieru, error) {
 	}
 	// Client is started lazily on the first use.
 
-	// Use the first port to construct the address.
 	var addr string
-	var portStr string
-	if option.Port != "" {
-		portStr = option.Port
+	if option.Port != 0 {
+		addr = net.JoinHostPort(option.Server, strconv.Itoa(option.Port))
 	} else {
-		portStr = option.PortRange
+		beginPort, _, _ := beginAndEndPortFromPortRange(option.PortRange)
+		addr = net.JoinHostPort(option.Server, strconv.Itoa(beginPort))
 	}
-	firstPort, err := getFirstPort(portStr)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get first port from port string %q: %w", portStr, err)
-	}
-	addr = net.JoinHostPort(option.Server, strconv.Itoa(firstPort))
 	outbound := &Mieru{
 		Base: &Base{
 			name:   option.Name,
@@ -190,62 +183,54 @@ func buildMieruClientConfig(option MieruOption) (*mieruclient.ClientConfig, erro
 	}
 
 	transportProtocol := mierupb.TransportProtocol_TCP.Enum()
-
-	portBindings := make([]*mierupb.PortBinding, 0)
-	if option.Port != "" {
-		parts := strings.Split(option.Port, ",")
-		for _, part := range parts {
-			part = strings.TrimSpace(part)
-			if strings.Contains(part, "-") {
-				_, _, err := beginAndEndPortFromPortRange(part)
-				if err == nil {
-					portBindings = append(portBindings, &mierupb.PortBinding{
-						PortRange: proto.String(part),
-						Protocol:  transportProtocol,
-					})
-				} else {
-					return nil, err
-				}
-			} else {
-				p, err := strconv.Atoi(part)
-				if err != nil {
-					return nil, fmt.Errorf("invalid port value: %s", part)
-				}
-				portBindings = append(portBindings, &mierupb.PortBinding{
-					Port:     proto.Int32(int32(p)),
-					Protocol: transportProtocol,
-				})
-			}
-		}
-	}
-	if option.PortRange != "" {
-		parts := strings.Split(option.PortRange, ",")
-		for _, part := range parts {
-			part = strings.TrimSpace(part)
-			if _, _, err := beginAndEndPortFromPortRange(part); err == nil {
-				portBindings = append(portBindings, &mierupb.PortBinding{
-					PortRange: proto.String(part),
-					Protocol:  transportProtocol,
-				})
-			}
-		}
-	}
-
 	var server *mierupb.ServerEndpoint
 	if net.ParseIP(option.Server) != nil {
 		// server is an IP address
-		server = &mierupb.ServerEndpoint{
-			IpAddress:    proto.String(option.Server),
-			PortBindings: portBindings,
+		if option.PortRange != "" {
+			server = &mierupb.ServerEndpoint{
+				IpAddress: proto.String(option.Server),
+				PortBindings: []*mierupb.PortBinding{
+					{
+						PortRange: proto.String(option.PortRange),
+						Protocol:  transportProtocol,
+					},
+				},
+			}
+		} else {
+			server = &mierupb.ServerEndpoint{
+				IpAddress: proto.String(option.Server),
+				PortBindings: []*mierupb.PortBinding{
+					{
+						Port:     proto.Int32(int32(option.Port)),
+						Protocol: transportProtocol,
+					},
+				},
+			}
 		}
 	} else {
 		// server is a domain name
-		server = &mierupb.ServerEndpoint{
-			DomainName:   proto.String(option.Server),
-			PortBindings: portBindings,
+		if option.PortRange != "" {
+			server = &mierupb.ServerEndpoint{
+				DomainName: proto.String(option.Server),
+				PortBindings: []*mierupb.PortBinding{
+					{
+						PortRange: proto.String(option.PortRange),
+						Protocol:  transportProtocol,
+					},
+				},
+			}
+		} else {
+			server = &mierupb.ServerEndpoint{
+				DomainName: proto.String(option.Server),
+				PortBindings: []*mierupb.PortBinding{
+					{
+						Port:     proto.Int32(int32(option.Port)),
+						Protocol: transportProtocol,
+					},
+				},
+			}
 		}
 	}
-
 	config := &mieruclient.ClientConfig{
 		Profile: &mierupb.ClientProfile{
 			ProfileName: proto.String(option.Name),
@@ -274,9 +259,31 @@ func validateMieruOption(option MieruOption) error {
 	if option.Server == "" {
 		return fmt.Errorf("server is empty")
 	}
-	if option.Port == "" && option.PortRange == "" {
-		return fmt.Errorf("port must be set")
+	if option.Port == 0 && option.PortRange == "" {
+		return fmt.Errorf("either port or port-range must be set")
 	}
+	if option.Port != 0 && option.PortRange != "" {
+		return fmt.Errorf("port and port-range cannot be set at the same time")
+	}
+	if option.Port != 0 && (option.Port < 1 || option.Port > 65535) {
+		return fmt.Errorf("port must be between 1 and 65535")
+	}
+	if option.PortRange != "" {
+		begin, end, err := beginAndEndPortFromPortRange(option.PortRange)
+		if err != nil {
+			return fmt.Errorf("invalid port-range format")
+		}
+		if begin < 1 || begin > 65535 {
+			return fmt.Errorf("begin port must be between 1 and 65535")
+		}
+		if end < 1 || end > 65535 {
+			return fmt.Errorf("end port must be between 1 and 65535")
+		}
+		if begin > end {
+			return fmt.Errorf("begin port must be less than or equal to end port")
+		}
+	}
+
 	if option.Transport != "TCP" {
 		return fmt.Errorf("transport must be TCP")
 	}
@@ -299,36 +306,8 @@ func validateMieruOption(option MieruOption) error {
 	return nil
 }
 
-func getFirstPort(portStr string) (int, error) {
-	if portStr == "" {
-		return 0, fmt.Errorf("port string is empty")
-	}
-	parts := strings.Split(portStr, ",")
-	firstPart := parts[0]
-
-	if strings.Contains(firstPart, "-") {
-		begin, _, err := beginAndEndPortFromPortRange(firstPart)
-		if err != nil {
-			return 0, err
-		}
-		return begin, nil
-	}
-
-	port, err := strconv.Atoi(firstPart)
-	if err != nil {
-		return 0, fmt.Errorf("invalid port format: %s", firstPart)
-	}
-	return port, nil
-}
-
 func beginAndEndPortFromPortRange(portRange string) (int, int, error) {
 	var begin, end int
 	_, err := fmt.Sscanf(portRange, "%d-%d", &begin, &end)
-	if err != nil {
-		return 0, 0, fmt.Errorf("invalid port range format: %w", err)
-	}
-	if begin > end {
-		return 0, 0, fmt.Errorf("begin port is greater than end port: %s", portRange)
-	}
 	return begin, end, err
 }

adapter/outbound/mieru_test.go

@@ -1,51 +1,22 @@
 package outbound
 
-import (
-	"reflect"
-	"testing"
-
-	mieruclient "github.com/enfein/mieru/v3/apis/client"
-	mierupb "github.com/enfein/mieru/v3/pkg/appctl/appctlpb"
-	"google.golang.org/protobuf/proto"
-)
+import "testing"
 
 func TestNewMieru(t *testing.T) {
-	transportProtocol := mierupb.TransportProtocol_TCP.Enum()
 	testCases := []struct {
 		option       MieruOption
 		wantBaseAddr string
-		wantConfig   *mieruclient.ClientConfig
 	}{
 		{
 			option: MieruOption{
 				Name:      "test",
 				Server:    "1.2.3.4",
-				Port:      "10000",
+				Port:      10000,
 				Transport: "TCP",
 				UserName:  "test",
 				Password:  "test",
 			},
 			wantBaseAddr: "1.2.3.4:10000",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							IpAddress: proto.String("1.2.3.4"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									Port:     proto.Int32(10000),
-									Protocol: transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
 		},
 		{
 			option: MieruOption{
@@ -57,212 +28,28 @@ func TestNewMieru(t *testing.T) {
 				Password:  "test",
 			},
 			wantBaseAddr: "[2001:db8::1]:10001",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							IpAddress: proto.String("2001:db8::1"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									PortRange: proto.String("10001-10002"),
-									Protocol:  transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
 		},
 		{
 			option: MieruOption{
 				Name:      "test",
 				Server:    "example.com",
-				Port:      "10003",
+				Port:      10003,
 				Transport: "TCP",
 				UserName:  "test",
 				Password:  "test",
 			},
 			wantBaseAddr: "example.com:10003",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							DomainName: proto.String("example.com"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									Port:     proto.Int32(10003),
-									Protocol: transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		{
-			option: MieruOption{
-				Name:      "test",
-				Server:    "example.com",
-				Port:      "10004,10005",
-				Transport: "TCP",
-				UserName:  "test",
-				Password:  "test",
-			},
-			wantBaseAddr: "example.com:10004",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							DomainName: proto.String("example.com"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									Port:     proto.Int32(10004),
-									Protocol: transportProtocol,
-								},
-								{
-									Port:     proto.Int32(10005),
-									Protocol: transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		{
-			option: MieruOption{
-				Name:      "test",
-				Server:    "example.com",
-				Port:      "10006-10007,11000",
-				Transport: "TCP",
-				UserName:  "test",
-				Password:  "test",
-			},
-			wantBaseAddr: "example.com:10006",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							DomainName: proto.String("example.com"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									PortRange: proto.String("10006-10007"),
-									Protocol:  transportProtocol,
-								},
-								{
-									Port:     proto.Int32(11000),
-									Protocol: transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		{
-			option: MieruOption{
-				Name:      "test",
-				Server:    "example.com",
-				Port:      "10008",
-				PortRange: "10009-10010",
-				Transport: "TCP",
-				UserName:  "test",
-				Password:  "test",
-			},
-			wantBaseAddr: "example.com:10008",
-			wantConfig: &mieruclient.ClientConfig{
-				Profile: &mierupb.ClientProfile{
-					ProfileName: proto.String("test"),
-					User: &mierupb.User{
-						Name:     proto.String("test"),
-						Password: proto.String("test"),
-					},
-					Servers: []*mierupb.ServerEndpoint{
-						{
-							DomainName: proto.String("example.com"),
-							PortBindings: []*mierupb.PortBinding{
-								{
-									Port:     proto.Int32(10008),
-									Protocol: transportProtocol,
-								},
-								{
-									PortRange: proto.String("10009-10010"),
-									Protocol:  transportProtocol,
-								},
-							},
-						},
-					},
-				},
-			},
 		},
 	}
 
 	for _, testCase := range testCases {
 		mieru, err := NewMieru(testCase.option)
 		if err != nil {
-			t.Fatal(err)
+			t.Error(err)
 		}
-		config, err := mieru.client.Load()
-		if err != nil {
-			t.Fatal(err)
-		}
-		config.Dialer = nil
 		if mieru.addr != testCase.wantBaseAddr {
 			t.Errorf("got addr %q, want %q", mieru.addr, testCase.wantBaseAddr)
 		}
-		if !reflect.DeepEqual(config, testCase.wantConfig) {
-			t.Errorf("got config %+v, want %+v", config, testCase.wantConfig)
-		}
-	}
-}
-
-func TestNewMieruError(t *testing.T) {
-	testCases := []MieruOption{
-		{
-			Name:      "test",
-			Server:    "example.com",
-			Port:      "invalid",
-			PortRange: "invalid",
-			Transport: "TCP",
-			UserName:  "test",
-			Password:  "test",
-		},
-		{
-			Name:      "test",
-			Server:    "example.com",
-			Port:      "",
-			PortRange: "",
-			Transport: "TCP",
-			UserName:  "test",
-			Password:  "test",
-		},
-	}
-
-	for _, option := range testCases {
-		_, err := NewMieru(option)
-		if err == nil {
-			t.Errorf("expected error for option %+v, but got nil", option)
-		}
 	}
 }
 
@@ -276,7 +63,6 @@ func TestBeginAndEndPortFromPortRange(t *testing.T) {
 		{"1-10", 1, 10, false},
 		{"1000-2000", 1000, 2000, false},
 		{"65535-65535", 65535, 65535, false},
-		{"2000-1000", 0, 0, true},
 		{"1", 0, 0, true},
 		{"1-", 0, 0, true},
 		{"-10", 0, 0, true},

adapter/outbound/shadowsocksr.go

@@ -252,13 +252,14 @@ func (spc *ssrPacketConn) WaitReadFrom() (data []byte, put func(), addr net.Addr
 		return nil, nil, nil, errors.New("parse addr error")
 	}
 
-	addr = _addr.UDPAddr()
-	if addr == nil {
+	udpAddr := _addr.UDPAddr()
+	if udpAddr == nil {
 		if put != nil {
 			put()
 		}
 		return nil, nil, nil, errors.New("parse addr error")
 	}
+	addr = udpAddr
 
 	data = data[len(_addr):]
 	return

adapter/outboundgroup/fallback.go

@@ -10,7 +10,7 @@ import (
 	N "github.com/metacubex/mihomo/common/net"
 	"github.com/metacubex/mihomo/common/utils"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 )
 
 type Fallback struct {
@@ -150,7 +150,7 @@ func (f *Fallback) ForceSet(name string) {
 	f.selected = name
 }
 
-func NewFallback(option *GroupCommonOption, providers []provider.ProxyProvider) *Fallback {
+func NewFallback(option *GroupCommonOption, providers []P.ProxyProvider) *Fallback {
 	return &Fallback{
 		GroupBase: NewGroupBase(GroupBaseOption{
 			Name:           option.Name,

adapter/outboundgroup/groupbase.go

@@ -12,8 +12,7 @@ import (
 	"github.com/metacubex/mihomo/common/atomic"
 	"github.com/metacubex/mihomo/common/utils"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/log"
 	"github.com/metacubex/mihomo/tunnel"
 
@@ -26,7 +25,7 @@ type GroupBase struct {
 	filterRegs        []*regexp2.Regexp
 	excludeFilterRegs []*regexp2.Regexp
 	excludeTypeArray  []string
-	providers         []provider.ProxyProvider
+	providers         []P.ProxyProvider
 	failedTestMux     sync.Mutex
 	failedTimes       int
 	failedTime        time.Time
@@ -48,7 +47,7 @@ type GroupBaseOption struct {
 	ExcludeType    string
 	TestTimeout    int
 	MaxFailedTimes int
-	Providers      []provider.ProxyProvider
+	Providers      []P.ProxyProvider
 }
 
 func NewGroupBase(opt GroupBaseOption) *GroupBase {
@@ -125,7 +124,7 @@ func (gb *GroupBase) GetProxies(touch bool) []C.Proxy {
 		}
 	} else {
 		for _, pd := range gb.providers {
-			if pd.VehicleType() == types.Compatible { // compatible provider unneeded filter
+			if pd.VehicleType() == P.Compatible { // compatible provider unneeded filter
 				proxies = append(proxies, pd.Proxies()...)
 				continue
 			}

adapter/outboundgroup/loadbalance.go

@@ -14,7 +14,7 @@ import (
 	N "github.com/metacubex/mihomo/common/net"
 	"github.com/metacubex/mihomo/common/utils"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 
 	"golang.org/x/net/publicsuffix"
 )
@@ -194,7 +194,7 @@ func strategyStickySessions(url string) strategyFn {
 		key := utils.MapHash(getKeyWithSrcAndDst(metadata))
 		length := len(proxies)
 		idx, has := lruCache.Get(key)
-		if !has {
+		if !has || idx >= length {
 			idx = int(jumpHash(key+uint64(time.Now().UnixNano()), int32(length)))
 		}
 
@@ -239,7 +239,7 @@ func (lb *LoadBalance) MarshalJSON() ([]byte, error) {
 	})
 }
 
-func NewLoadBalance(option *GroupCommonOption, providers []provider.ProxyProvider, strategy string) (lb *LoadBalance, err error) {
+func NewLoadBalance(option *GroupCommonOption, providers []P.ProxyProvider, strategy string) (lb *LoadBalance, err error) {
 	var strategyFn strategyFn
 	switch strategy {
 	case "consistent-hashing":

adapter/outboundgroup/parser.go

@@ -11,7 +11,7 @@ import (
 	"github.com/metacubex/mihomo/common/structure"
 	"github.com/metacubex/mihomo/common/utils"
 	C "github.com/metacubex/mihomo/constant"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/log"
 )
 
@@ -48,7 +48,7 @@ type GroupCommonOption struct {
 	RoutingMark int    `group:"routing-mark,omitempty"`
 }
 
-func ParseProxyGroup(config map[string]any, proxyMap map[string]C.Proxy, providersMap map[string]types.ProxyProvider, AllProxies []string, AllProviders []string) (C.ProxyAdapter, error) {
+func ParseProxyGroup(config map[string]any, proxyMap map[string]C.Proxy, providersMap map[string]P.ProxyProvider, AllProxies []string, AllProviders []string) (C.ProxyAdapter, error) {
 	decoder := structure.NewDecoder(structure.Option{TagName: "group", WeaklyTypedInput: true})
 
 	groupOption := &GroupCommonOption{
@@ -71,7 +71,7 @@ func ParseProxyGroup(config map[string]any, proxyMap map[string]C.Proxy, provide
 
 	groupName := groupOption.Name
 
-	providers := []types.ProxyProvider{}
+	providers := []P.ProxyProvider{}
 
 	if groupOption.IncludeAll {
 		groupOption.IncludeAllProviders = true
@@ -169,7 +169,7 @@ func ParseProxyGroup(config map[string]any, proxyMap map[string]C.Proxy, provide
 			return nil, fmt.Errorf("%s: %w", groupName, err)
 		}
 
-		providers = append([]types.ProxyProvider{pd}, providers...)
+		providers = append([]P.ProxyProvider{pd}, providers...)
 		providersMap[groupName] = pd
 	}
 
@@ -206,15 +206,15 @@ func getProxies(mapping map[string]C.Proxy, list []string) ([]C.Proxy, error) {
 	return ps, nil
 }
 
-func getProviders(mapping map[string]types.ProxyProvider, list []string) ([]types.ProxyProvider, error) {
-	var ps []types.ProxyProvider
+func getProviders(mapping map[string]P.ProxyProvider, list []string) ([]P.ProxyProvider, error) {
+	var ps []P.ProxyProvider
 	for _, name := range list {
 		p, ok := mapping[name]
 		if !ok {
 			return nil, fmt.Errorf("'%s' not found", name)
 		}
 
-		if p.VehicleType() == types.Compatible {
+		if p.VehicleType() == P.Compatible {
 			return nil, fmt.Errorf("proxy group %s can't contains in `use`", name)
 		}
 		ps = append(ps, p)
@@ -222,7 +222,7 @@ func getProviders(mapping map[string]types.ProxyProvider, list []string) ([]type
 	return ps, nil
 }
 
-func addTestUrlToProviders(providers []types.ProxyProvider, url string, expectedStatus utils.IntRanges[uint16], filter string, interval uint) {
+func addTestUrlToProviders(providers []P.ProxyProvider, url string, expectedStatus utils.IntRanges[uint16], filter string, interval uint) {
 	if len(providers) == 0 || len(url) == 0 {
 		return
 	}

adapter/outboundgroup/patch_android.go

@@ -4,22 +4,22 @@ package outboundgroup
 
 import (
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 )
 
 type ProxyGroup interface {
 	C.ProxyAdapter
 
-	Providers() []provider.ProxyProvider
+	Providers() []P.ProxyProvider
 	Proxies() []C.Proxy
 	Now() string
 }
 
-func (f *Fallback) Providers() []provider.ProxyProvider {
+func (f *Fallback) Providers() []P.ProxyProvider {
 	return f.providers
 }
 
-func (lb *LoadBalance) Providers() []provider.ProxyProvider {
+func (lb *LoadBalance) Providers() []P.ProxyProvider {
 	return lb.providers
 }
 
@@ -35,7 +35,7 @@ func (lb *LoadBalance) Now() string {
 	return ""
 }
 
-func (r *Relay) Providers() []provider.ProxyProvider {
+func (r *Relay) Providers() []P.ProxyProvider {
 	return r.providers
 }
 
@@ -47,7 +47,7 @@ func (r *Relay) Now() string {
 	return ""
 }
 
-func (s *Selector) Providers() []provider.ProxyProvider {
+func (s *Selector) Providers() []P.ProxyProvider {
 	return s.providers
 }
 
@@ -55,7 +55,7 @@ func (s *Selector) Proxies() []C.Proxy {
 	return s.GetProxies(false)
 }
 
-func (u *URLTest) Providers() []provider.ProxyProvider {
+func (u *URLTest) Providers() []P.ProxyProvider {
 	return u.providers
 }
 

adapter/outboundgroup/relay.go

@@ -8,7 +8,7 @@ import (
 	"github.com/metacubex/mihomo/component/dialer"
 	"github.com/metacubex/mihomo/component/proxydialer"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/log"
 )
 
@@ -149,7 +149,7 @@ func (r *Relay) Addr() string {
 	return proxies[len(proxies)-1].Addr()
 }
 
-func NewRelay(option *GroupCommonOption, providers []provider.ProxyProvider) *Relay {
+func NewRelay(option *GroupCommonOption, providers []P.ProxyProvider) *Relay {
 	log.Warnln("The group [%s] with relay type is deprecated, please using dialer-proxy instead", option.Name)
 	return &Relay{
 		GroupBase: NewGroupBase(GroupBaseOption{

adapter/outboundgroup/selector.go

@@ -6,7 +6,7 @@ import (
 	"errors"
 
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 )
 
 type Selector struct {
@@ -108,7 +108,7 @@ func (s *Selector) selectedProxy(touch bool) C.Proxy {
 	return proxies[0]
 }
 
-func NewSelector(option *GroupCommonOption, providers []provider.ProxyProvider) *Selector {
+func NewSelector(option *GroupCommonOption, providers []P.ProxyProvider) *Selector {
 	return &Selector{
 		GroupBase: NewGroupBase(GroupBaseOption{
 			Name:           option.Name,

adapter/outboundgroup/urltest.go

@@ -11,7 +11,7 @@ import (
 	"github.com/metacubex/mihomo/common/singledo"
 	"github.com/metacubex/mihomo/common/utils"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 )
 
 type urlTestOption func(*URLTest)
@@ -202,7 +202,7 @@ func parseURLTestOption(config map[string]any) []urlTestOption {
 	return opts
 }
 
-func NewURLTest(option *GroupCommonOption, providers []provider.ProxyProvider, options ...urlTestOption) *URLTest {
+func NewURLTest(option *GroupCommonOption, providers []P.ProxyProvider, options ...urlTestOption) *URLTest {
 	urlTest := &URLTest{
 		GroupBase: NewGroupBase(GroupBaseOption{
 			Name:           option.Name,

adapter/parser.go

@@ -49,13 +49,7 @@ func ParseProxy(mapping map[string]any) (C.Proxy, error) {
 		}
 		proxy, err = outbound.NewHttp(*httpOption)
 	case "vmess":
-		vmessOption := &outbound.VmessOption{
-			HTTPOpts: outbound.HTTPOptions{
-				Method: "GET",
-				Path:   []string{"/"},
-			},
-		}
-
+		vmessOption := &outbound.VmessOption{}
 		err = decoder.Decode(mapping, vmessOption)
 		if err != nil {
 			break

adapter/provider/parser.go

@@ -10,7 +10,7 @@ import (
 	"github.com/metacubex/mihomo/common/utils"
 	"github.com/metacubex/mihomo/component/resource"
 	C "github.com/metacubex/mihomo/constant"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 
 	"github.com/dlclark/regexp2"
 )
@@ -73,7 +73,7 @@ type proxyProviderSchema struct {
 	Header      map[string][]string `provider:"header,omitempty"`
 }
 
-func ParseProxyProvider(name string, mapping map[string]any) (types.ProxyProvider, error) {
+func ParseProxyProvider(name string, mapping map[string]any) (P.ProxyProvider, error) {
 	decoder := structure.NewDecoder(structure.Option{TagName: "provider", WeaklyTypedInput: true})
 
 	schema := &proxyProviderSchema{
@@ -104,7 +104,7 @@ func ParseProxyProvider(name string, mapping map[string]any) (types.ProxyProvide
 		return nil, err
 	}
 
-	var vehicle types.Vehicle
+	var vehicle P.Vehicle
 	switch schema.Type {
 	case "file":
 		path := C.Path.Resolve(schema.Path)

adapter/provider/provider.go

@@ -16,7 +16,7 @@ import (
 	"github.com/metacubex/mihomo/component/profile/cachefile"
 	"github.com/metacubex/mihomo/component/resource"
 	C "github.com/metacubex/mihomo/constant"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/tunnel/statistic"
 
 	"github.com/dlclark/regexp2"
@@ -68,8 +68,8 @@ func (bp *baseProvider) HealthCheck() {
 	bp.healthCheck.check()
 }
 
-func (bp *baseProvider) Type() types.ProviderType {
-	return types.Proxy
+func (bp *baseProvider) Type() P.ProviderType {
+	return P.Proxy
 }
 
 func (bp *baseProvider) Proxies() []C.Proxy {
@@ -171,7 +171,7 @@ func (pp *proxySetProvider) Close() error {
 	return pp.Fetcher.Close()
 }
 
-func NewProxySetProvider(name string, interval time.Duration, payload []map[string]any, parser resource.Parser[[]C.Proxy], vehicle types.Vehicle, hc *HealthCheck) (*ProxySetProvider, error) {
+func NewProxySetProvider(name string, interval time.Duration, payload []map[string]any, parser resource.Parser[[]C.Proxy], vehicle P.Vehicle, hc *HealthCheck) (*ProxySetProvider, error) {
 	pd := &proxySetProvider{
 		baseProvider: baseProvider{
 			name:        name,
@@ -238,8 +238,8 @@ func (ip *inlineProvider) MarshalJSON() ([]byte, error) {
 	})
 }
 
-func (ip *inlineProvider) VehicleType() types.VehicleType {
-	return types.Inline
+func (ip *inlineProvider) VehicleType() P.VehicleType {
+	return P.Inline
 }
 
 func (ip *inlineProvider) Update() error {
@@ -303,8 +303,8 @@ func (cp *compatibleProvider) Update() error {
 	return nil
 }
 
-func (cp *compatibleProvider) VehicleType() types.VehicleType {
-	return types.Compatible
+func (cp *compatibleProvider) VehicleType() P.VehicleType {
+	return P.Compatible
 }
 
 func NewCompatibleProvider(name string, proxies []C.Proxy, hc *HealthCheck) (*CompatibleProvider, error) {

common/maphash/comparable_go120.go

@@ -138,3 +138,5 @@ func escape[T any](x T) T {
 // ptrSize is the size of a pointer in bytes - unsafe.Sizeof(uintptr(0)) but as an ideal constant.
 // It is also the size of the machine's native word size (that is, 4 on 32-bit systems, 8 on 64-bit).
 const ptrSize = 4 << (^uintptr(0) >> 63)
+
+const testComparableAllocations = false

common/maphash/comparable_go124.go

@@ -11,3 +11,5 @@ func Comparable[T comparable](seed Seed, v T) uint64 {
 func WriteComparable[T comparable](h *Hash, x T) {
 	maphash.WriteComparable(h, x)
 }
+
+const testComparableAllocations = true

common/maphash/maphash_test.go

@@ -423,7 +423,9 @@ func TestWriteComparableNoncommute(t *testing.T) {
 }
 
 func TestComparableAllocations(t *testing.T) {
-	t.Skip("test broken in old golang version")
+	if !testComparableAllocations {
+		t.Skip("test broken in old golang version")
+	}
 	seed := MakeSeed()
 	x := heapStr(t)
 	allocs := testing.AllocsPerRun(10, func() {

common/net/sing.go

@@ -24,6 +24,8 @@ var WriteBuffer = bufio.WriteBuffer
 type ReadWaitOptions = network.ReadWaitOptions
 
 var NewReadWaitOptions = network.NewReadWaitOptions
+var CalculateFrontHeadroom = network.CalculateFrontHeadroom
+var CalculateRearHeadroom = network.CalculateRearHeadroom
 
 type ReaderWithUpstream = network.ReaderWithUpstream
 type WithUpstreamReader = network.WithUpstreamReader

common/structure/structure.go

@@ -53,6 +53,12 @@ func (d *Decoder) Decode(src map[string]any, dst any) error {
 		key, omitKey, found := strings.Cut(tag, ",")
 		omitempty := found && omitKey == "omitempty"
 
+		// As a special case, if the field tag is "-", the field is always omitted.
+		// Note that a field with name "-" can still be generated using the tag "-,".
+		if key == "-" {
+			continue
+		}
+
 		value, ok := src[key]
 		if !ok {
 			if d.option.KeyReplacer != nil {

common/structure/structure_test.go

@@ -288,3 +288,23 @@ func TestStructure_Null(t *testing.T) {
 	assert.Nil(t, err)
 	assert.Equal(t, s.Opt.Bar, "")
 }
+
+func TestStructure_Ignore(t *testing.T) {
+	rawMap := map[string]any{
+		"-": "newData",
+	}
+
+	s := struct {
+		MustIgnore string `test:"-"`
+	}{MustIgnore: "oldData"}
+
+	err := decoder.Decode(rawMap, &s)
+	assert.Nil(t, err)
+	assert.Equal(t, s.MustIgnore, "oldData")
+
+	// test omitempty
+	delete(rawMap, "-")
+	err = decoder.Decode(rawMap, &s)
+	assert.Nil(t, err)
+	assert.Equal(t, s.MustIgnore, "oldData")
+}

component/fakeip/cachefile.go

@@ -50,6 +50,10 @@ func (c *cachefileStore) FlushFakeIP() error {
 	return c.cache.FlushFakeIP()
 }
 
-func newCachefileStore(cache *cachefile.CacheFile) *cachefileStore {
-	return &cachefileStore{cache.FakeIpStore()}
+func newCachefileStore(cache *cachefile.CacheFile, prefix netip.Prefix) *cachefileStore {
+	if prefix.Addr().Is6() {
+		return &cachefileStore{cache.FakeIpStore6()}
+	} else {
+		return &cachefileStore{cache.FakeIpStore()}
+	}
 }

component/fakeip/pool.go

@@ -7,7 +7,6 @@ import (
 	"sync"
 
 	"github.com/metacubex/mihomo/component/profile/cachefile"
-	C "github.com/metacubex/mihomo/constant"
 
 	"go4.org/netipx"
 )
@@ -36,8 +35,6 @@ type Pool struct {
 	offset  netip.Addr
 	cycle   bool
 	mux     sync.Mutex
-	host    []C.DomainMatcher
-	mode    C.FilterMode
 	ipnet   netip.Prefix
 	store   store
 }
@@ -66,24 +63,6 @@ func (p *Pool) LookBack(ip netip.Addr) (string, bool) {
 	return p.store.GetByIP(ip)
 }
 
-// ShouldSkipped return if domain should be skipped
-func (p *Pool) ShouldSkipped(domain string) bool {
-	should := p.shouldSkipped(domain)
-	if p.mode == C.FilterWhiteList {
-		return !should
-	}
-	return should
-}
-
-func (p *Pool) shouldSkipped(domain string) bool {
-	for _, matcher := range p.host {
-		if matcher.MatchDomain(domain) {
-			return true
-		}
-	}
-	return false
-}
-
 // Exist returns if given ip exists in fake-ip pool
 func (p *Pool) Exist(ip netip.Addr) bool {
 	p.mux.Lock()
@@ -166,8 +145,6 @@ func (p *Pool) restoreState() {
 
 type Options struct {
 	IPNet netip.Prefix
-	Host  []C.DomainMatcher
-	Mode  C.FilterMode
 
 	// Size sets the maximum number of entries in memory
 	// and does not work if Persistence is true
@@ -197,12 +174,10 @@ func New(options Options) (*Pool, error) {
 		last:    last,
 		offset:  first.Prev(),
 		cycle:   false,
-		host:    options.Host,
-		mode:    options.Mode,
 		ipnet:   options.IPNet,
 	}
 	if options.Persistence {
-		pool.store = newCachefileStore(cachefile.Cache())
+		pool.store = newCachefileStore(cachefile.Cache(), options.IPNet)
 	} else {
 		pool.store = newMemoryStore(options.Size)
 	}

component/fakeip/pool_test.go

@@ -8,8 +8,6 @@ import (
 	"time"
 
 	"github.com/metacubex/mihomo/component/profile/cachefile"
-	"github.com/metacubex/mihomo/component/trie"
-	C "github.com/metacubex/mihomo/constant"
 
 	"github.com/metacubex/bbolt"
 	"github.com/stretchr/testify/assert"
@@ -43,7 +41,7 @@ func createCachefileStore(options Options) (*Pool, string, error) {
 		return nil, "", err
 	}
 
-	pool.store = newCachefileStore(&cachefile.CacheFile{DB: db})
+	pool.store = newCachefileStore(&cachefile.CacheFile{DB: db}, options.IPNet)
 	return pool, f.Name(), nil
 }
 
@@ -146,47 +144,6 @@ func TestPool_CycleUsed(t *testing.T) {
 	}
 }
 
-func TestPool_Skip(t *testing.T) {
-	ipnet := netip.MustParsePrefix("192.168.0.1/29")
-	tree := trie.New[struct{}]()
-	assert.NoError(t, tree.Insert("example.com", struct{}{}))
-	assert.False(t, tree.IsEmpty())
-	pools, tempfile, err := createPools(Options{
-		IPNet: ipnet,
-		Size:  10,
-		Host:  []C.DomainMatcher{tree.NewDomainSet()},
-	})
-	assert.Nil(t, err)
-	defer os.Remove(tempfile)
-
-	for _, pool := range pools {
-		assert.True(t, pool.ShouldSkipped("example.com"))
-		assert.False(t, pool.ShouldSkipped("foo.com"))
-		assert.False(t, pool.shouldSkipped("baz.com"))
-	}
-}
-
-func TestPool_SkipWhiteList(t *testing.T) {
-	ipnet := netip.MustParsePrefix("192.168.0.1/29")
-	tree := trie.New[struct{}]()
-	assert.NoError(t, tree.Insert("example.com", struct{}{}))
-	assert.False(t, tree.IsEmpty())
-	pools, tempfile, err := createPools(Options{
-		IPNet: ipnet,
-		Size:  10,
-		Host:  []C.DomainMatcher{tree.NewDomainSet()},
-		Mode:  C.FilterWhiteList,
-	})
-	assert.Nil(t, err)
-	defer os.Remove(tempfile)
-
-	for _, pool := range pools {
-		assert.False(t, pool.ShouldSkipped("example.com"))
-		assert.True(t, pool.ShouldSkipped("foo.com"))
-		assert.True(t, pool.ShouldSkipped("baz.com"))
-	}
-}
-
 func TestPool_MaxCacheSize(t *testing.T) {
 	ipnet := netip.MustParsePrefix("192.168.0.1/24")
 	pool, _ := New(Options{

component/fakeip/skipper.go

@@ -0,0 +1,28 @@
+package fakeip
+
+import (
+	C "github.com/metacubex/mihomo/constant"
+)
+
+type Skipper struct {
+	Host []C.DomainMatcher
+	Mode C.FilterMode
+}
+
+// ShouldSkipped return if domain should be skipped
+func (p *Skipper) ShouldSkipped(domain string) bool {
+	should := p.shouldSkipped(domain)
+	if p.Mode == C.FilterWhiteList {
+		return !should
+	}
+	return should
+}
+
+func (p *Skipper) shouldSkipped(domain string) bool {
+	for _, matcher := range p.Host {
+		if matcher.MatchDomain(domain) {
+			return true
+		}
+	}
+	return false
+}

component/fakeip/skipper_test.go

@@ -0,0 +1,35 @@
+package fakeip
+
+import (
+	"testing"
+
+	"github.com/metacubex/mihomo/component/trie"
+	C "github.com/metacubex/mihomo/constant"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSkipper_BlackList(t *testing.T) {
+	tree := trie.New[struct{}]()
+	assert.NoError(t, tree.Insert("example.com", struct{}{}))
+	assert.False(t, tree.IsEmpty())
+	skipper := &Skipper{
+		Host: []C.DomainMatcher{tree.NewDomainSet()},
+	}
+	assert.True(t, skipper.ShouldSkipped("example.com"))
+	assert.False(t, skipper.ShouldSkipped("foo.com"))
+	assert.False(t, skipper.shouldSkipped("baz.com"))
+}
+
+func TestSkipper_WhiteList(t *testing.T) {
+	tree := trie.New[struct{}]()
+	assert.NoError(t, tree.Insert("example.com", struct{}{}))
+	assert.False(t, tree.IsEmpty())
+	skipper := &Skipper{
+		Host: []C.DomainMatcher{tree.NewDomainSet()},
+		Mode: C.FilterWhiteList,
+	}
+	assert.False(t, skipper.ShouldSkipped("example.com"))
+	assert.True(t, skipper.ShouldSkipped("foo.com"))
+	assert.True(t, skipper.ShouldSkipped("baz.com"))
+}

component/profile/cachefile/cache.go

@@ -19,6 +19,7 @@ var (
 
 	bucketSelected         = []byte("selected")
 	bucketFakeip           = []byte("fakeip")
+	bucketFakeip6          = []byte("fakeip6")
 	bucketETag             = []byte("etag")
 	bucketSubscriptionInfo = []byte("subscriptioninfo")
 )

component/profile/cachefile/fakeip.go

@@ -10,10 +10,15 @@ import (
 
 type FakeIpStore struct {
 	*CacheFile
+	bucketName []byte
 }
 
 func (c *CacheFile) FakeIpStore() *FakeIpStore {
-	return &FakeIpStore{c}
+	return &FakeIpStore{c, bucketFakeip}
+}
+
+func (c *CacheFile) FakeIpStore6() *FakeIpStore {
+	return &FakeIpStore{c, bucketFakeip6}
 }
 
 func (c *FakeIpStore) GetByHost(host string) (ip netip.Addr, exist bool) {
@@ -21,7 +26,7 @@ func (c *FakeIpStore) GetByHost(host string) (ip netip.Addr, exist bool) {
 		return
 	}
 	c.DB.View(func(t *bbolt.Tx) error {
-		if bucket := t.Bucket(bucketFakeip); bucket != nil {
+		if bucket := t.Bucket(c.bucketName); bucket != nil {
 			if v := bucket.Get([]byte(host)); v != nil {
 				ip, exist = netip.AddrFromSlice(v)
 			}
@@ -36,7 +41,7 @@ func (c *FakeIpStore) PutByHost(host string, ip netip.Addr) {
 		return
 	}
 	err := c.DB.Batch(func(t *bbolt.Tx) error {
-		bucket, err := t.CreateBucketIfNotExists(bucketFakeip)
+		bucket, err := t.CreateBucketIfNotExists(c.bucketName)
 		if err != nil {
 			return err
 		}
@@ -52,7 +57,7 @@ func (c *FakeIpStore) GetByIP(ip netip.Addr) (host string, exist bool) {
 		return
 	}
 	c.DB.View(func(t *bbolt.Tx) error {
-		if bucket := t.Bucket(bucketFakeip); bucket != nil {
+		if bucket := t.Bucket(c.bucketName); bucket != nil {
 			if v := bucket.Get(ip.AsSlice()); v != nil {
 				host, exist = string(v), true
 			}
@@ -67,7 +72,7 @@ func (c *FakeIpStore) PutByIP(ip netip.Addr, host string) {
 		return
 	}
 	err := c.DB.Batch(func(t *bbolt.Tx) error {
-		bucket, err := t.CreateBucketIfNotExists(bucketFakeip)
+		bucket, err := t.CreateBucketIfNotExists(c.bucketName)
 		if err != nil {
 			return err
 		}
@@ -85,7 +90,7 @@ func (c *FakeIpStore) DelByIP(ip netip.Addr) {
 
 	addr := ip.AsSlice()
 	err := c.DB.Batch(func(t *bbolt.Tx) error {
-		bucket, err := t.CreateBucketIfNotExists(bucketFakeip)
+		bucket, err := t.CreateBucketIfNotExists(c.bucketName)
 		if err != nil {
 			return err
 		}
@@ -105,11 +110,11 @@ func (c *FakeIpStore) DelByIP(ip netip.Addr) {
 
 func (c *FakeIpStore) FlushFakeIP() error {
 	err := c.DB.Batch(func(t *bbolt.Tx) error {
-		bucket := t.Bucket(bucketFakeip)
+		bucket := t.Bucket(c.bucketName)
 		if bucket == nil {
 			return nil
 		}
-		return t.DeleteBucket(bucketFakeip)
+		return t.DeleteBucket(c.bucketName)
 	})
 	return err
 }

component/resolver/service.go

@@ -6,15 +6,15 @@ import (
 	D "github.com/miekg/dns"
 )
 
-var DefaultLocalServer LocalServer
+var DefaultService Service
 
-type LocalServer interface {
+type Service interface {
 	ServeMsg(ctx context.Context, msg *D.Msg) (*D.Msg, error)
 }
 
 // ServeMsg with a dns.Msg, return resolve dns.Msg
 func ServeMsg(ctx context.Context, msg *D.Msg) (*D.Msg, error) {
-	if server := DefaultLocalServer; server != nil {
+	if server := DefaultService; server != nil {
 		return server.ServeMsg(ctx, msg)
 	}
 

component/resource/fetcher.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/metacubex/mihomo/common/utils"
 	"github.com/metacubex/mihomo/component/slowdown"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/log"
 
 	"github.com/metacubex/fswatch"
@@ -22,7 +22,7 @@ type Fetcher[V any] struct {
 	ctxCancel    context.CancelFunc
 	resourceType string
 	name         string
-	vehicle      types.Vehicle
+	vehicle      P.Vehicle
 	updatedAt    time.Time
 	hash         utils.HashType
 	parser       Parser[V]
@@ -37,11 +37,11 @@ func (f *Fetcher[V]) Name() string {
 	return f.name
 }
 
-func (f *Fetcher[V]) Vehicle() types.Vehicle {
+func (f *Fetcher[V]) Vehicle() P.Vehicle {
 	return f.vehicle
 }
 
-func (f *Fetcher[V]) VehicleType() types.VehicleType {
+func (f *Fetcher[V]) VehicleType() P.VehicleType {
 	return f.vehicle.Type()
 }
 
@@ -88,7 +88,7 @@ func (f *Fetcher[V]) Update() (V, bool, error) {
 		f.backoff.AddAttempt() // add a failed attempt to backoff
 		return lo.Empty[V](), false, err
 	}
-	return f.loadBuf(buf, hash, f.vehicle.Type() != types.File)
+	return f.loadBuf(buf, hash, f.vehicle.Type() != P.File)
 }
 
 func (f *Fetcher[V]) SideUpdate(buf []byte) (V, bool, error) {
@@ -180,7 +180,7 @@ func (f *Fetcher[V]) pullLoop(forceUpdate bool) {
 
 func (f *Fetcher[V]) startPullLoop(forceUpdate bool) (err error) {
 	// pull contents automatically
-	if f.vehicle.Type() == types.File {
+	if f.vehicle.Type() == P.File {
 		f.watcher, err = fswatch.NewWatcher(fswatch.Options{
 			Path:     []string{f.vehicle.Path()},
 			Callback: f.updateCallback,
@@ -218,7 +218,7 @@ func (f *Fetcher[V]) updateWithLog() {
 	return
 }
 
-func NewFetcher[V any](name string, interval time.Duration, vehicle types.Vehicle, parser Parser[V], onUpdate func(V)) *Fetcher[V] {
+func NewFetcher[V any](name string, interval time.Duration, vehicle P.Vehicle, parser Parser[V], onUpdate func(V)) *Fetcher[V] {
 	ctx, cancel := context.WithCancel(context.Background())
 	minBackoff := 10 * time.Second
 	if interval < minBackoff {

component/resource/vehicle.go

@@ -12,7 +12,7 @@ import (
 	"github.com/metacubex/mihomo/common/utils"
 	mihomoHttp "github.com/metacubex/mihomo/component/http"
 	"github.com/metacubex/mihomo/component/profile/cachefile"
-	types "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 )
 
 const (
@@ -50,8 +50,8 @@ type FileVehicle struct {
 	path string
 }
 
-func (f *FileVehicle) Type() types.VehicleType {
-	return types.File
+func (f *FileVehicle) Type() P.VehicleType {
+	return P.File
 }
 
 func (f *FileVehicle) Path() string {
@@ -91,15 +91,15 @@ type HTTPVehicle struct {
 	timeout   time.Duration
 	sizeLimit int64
 	inRead    func(response *http.Response)
-	provider  types.ProxyProvider
+	provider  P.ProxyProvider
 }
 
 func (h *HTTPVehicle) Url() string {
 	return h.url
 }
 
-func (h *HTTPVehicle) Type() types.VehicleType {
-	return types.HTTP
+func (h *HTTPVehicle) Type() P.VehicleType {
+	return P.HTTP
 }
 
 func (h *HTTPVehicle) Path() string {

config/config.go

@@ -20,15 +20,15 @@ import (
 	"github.com/metacubex/mihomo/component/cidr"
 	"github.com/metacubex/mihomo/component/fakeip"
 	"github.com/metacubex/mihomo/component/geodata"
-	P "github.com/metacubex/mihomo/component/process"
+	"github.com/metacubex/mihomo/component/process"
 	"github.com/metacubex/mihomo/component/resolver"
 	"github.com/metacubex/mihomo/component/sniffer"
 	"github.com/metacubex/mihomo/component/trie"
 	C "github.com/metacubex/mihomo/constant"
-	providerTypes "github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	snifferTypes "github.com/metacubex/mihomo/constant/sniffer"
 	"github.com/metacubex/mihomo/dns"
-	L "github.com/metacubex/mihomo/listener"
+	"github.com/metacubex/mihomo/listener"
 	LC "github.com/metacubex/mihomo/listener/config"
 	"github.com/metacubex/mihomo/log"
 	R "github.com/metacubex/mihomo/rules"
@@ -44,27 +44,27 @@ import (
 // General config
 type General struct {
 	Inbound
-	Mode                    T.TunnelMode      `json:"mode"`
-	UnifiedDelay            bool              `json:"unified-delay"`
-	LogLevel                log.LogLevel      `json:"log-level"`
-	IPv6                    bool              `json:"ipv6"`
-	Interface               string            `json:"interface-name"`
-	RoutingMark             int               `json:"routing-mark"`
-	GeoXUrl                 GeoXUrl           `json:"geox-url"`
-	GeoAutoUpdate           bool              `json:"geo-auto-update"`
-	GeoUpdateInterval       int               `json:"geo-update-interval"`
-	GeodataMode             bool              `json:"geodata-mode"`
-	GeodataLoader           string            `json:"geodata-loader"`
-	GeositeMatcher          string            `json:"geosite-matcher"`
-	TCPConcurrent           bool              `json:"tcp-concurrent"`
-	FindProcessMode         P.FindProcessMode `json:"find-process-mode"`
-	Sniffing                bool              `json:"sniffing"`
-	GlobalClientFingerprint string            `json:"global-client-fingerprint"`
-	GlobalUA                string            `json:"global-ua"`
-	ETagSupport             bool              `json:"etag-support"`
-	KeepAliveIdle           int               `json:"keep-alive-idle"`
-	KeepAliveInterval       int               `json:"keep-alive-interval"`
-	DisableKeepAlive        bool              `json:"disable-keep-alive"`
+	Mode                    T.TunnelMode            `json:"mode"`
+	UnifiedDelay            bool                    `json:"unified-delay"`
+	LogLevel                log.LogLevel            `json:"log-level"`
+	IPv6                    bool                    `json:"ipv6"`
+	Interface               string                  `json:"interface-name"`
+	RoutingMark             int                     `json:"routing-mark"`
+	GeoXUrl                 GeoXUrl                 `json:"geox-url"`
+	GeoAutoUpdate           bool                    `json:"geo-auto-update"`
+	GeoUpdateInterval       int                     `json:"geo-update-interval"`
+	GeodataMode             bool                    `json:"geodata-mode"`
+	GeodataLoader           string                  `json:"geodata-loader"`
+	GeositeMatcher          string                  `json:"geosite-matcher"`
+	TCPConcurrent           bool                    `json:"tcp-concurrent"`
+	FindProcessMode         process.FindProcessMode `json:"find-process-mode"`
+	Sniffing                bool                    `json:"sniffing"`
+	GlobalClientFingerprint string                  `json:"global-client-fingerprint"`
+	GlobalUA                string                  `json:"global-ua"`
+	ETagSupport             bool                    `json:"etag-support"`
+	KeepAliveIdle           int                     `json:"keep-alive-idle"`
+	KeepAliveInterval       int                     `json:"keep-alive-interval"`
+	DisableKeepAlive        bool                    `json:"disable-keep-alive"`
 }
 
 // Inbound config
@@ -146,6 +146,7 @@ type DNS struct {
 	PreferH3              bool
 	IPv6                  bool
 	IPv6Timeout           uint
+	UseHosts              bool
 	UseSystemHosts        bool
 	NameServer            []dns.NameServer
 	Fallback              []dns.NameServer
@@ -156,8 +157,11 @@ type DNS struct {
 	DefaultNameserver     []dns.NameServer
 	CacheAlgorithm        string
 	CacheMaxSize          int
-	FakeIPRange           *fakeip.Pool
-	Hosts                 *trie.DomainTrie[resolver.HostValue]
+	FakeIPRange           netip.Prefix
+	FakeIPPool            *fakeip.Pool
+	FakeIPRange6          netip.Prefix
+	FakeIPPool6           *fakeip.Pool
+	FakeIPSkipper         *fakeip.Skipper
 	NameServerPolicy      []dns.Policy
 	ProxyServerNameserver []dns.NameServer
 	DirectNameServer      []dns.NameServer
@@ -195,8 +199,8 @@ type Config struct {
 	Users         []auth.AuthUser
 	Proxies       map[string]C.Proxy
 	Listeners     map[string]C.InboundListener
-	Providers     map[string]providerTypes.ProxyProvider
-	RuleProviders map[string]providerTypes.RuleProvider
+	Providers     map[string]P.ProxyProvider
+	RuleProviders map[string]P.RuleProvider
 	Tunnels       []LC.Tunnel
 	Sniffer       *sniffer.Config
 	TLS           *TLS
@@ -221,6 +225,7 @@ type RawDNS struct {
 	Listen                       string                              `yaml:"listen" json:"listen"`
 	EnhancedMode                 C.DNSMode                           `yaml:"enhanced-mode" json:"enhanced-mode"`
 	FakeIPRange                  string                              `yaml:"fake-ip-range" json:"fake-ip-range"`
+	FakeIPRange6                 string                              `yaml:"fake-ip-range6" json:"fake-ip-range6"`
 	FakeIPFilter                 []string                            `yaml:"fake-ip-filter" json:"fake-ip-filter"`
 	FakeIPFilterMode             C.FilterMode                        `yaml:"fake-ip-filter-mode" json:"fake-ip-filter-mode"`
 	DefaultNameserver            []string                            `yaml:"default-nameserver" json:"default-nameserver"`
@@ -377,51 +382,51 @@ type RawTLS struct {
 }
 
 type RawConfig struct {
-	Port                    int               `yaml:"port" json:"port"`
-	SocksPort               int               `yaml:"socks-port" json:"socks-port"`
-	RedirPort               int               `yaml:"redir-port" json:"redir-port"`
-	TProxyPort              int               `yaml:"tproxy-port" json:"tproxy-port"`
-	MixedPort               int               `yaml:"mixed-port" json:"mixed-port"`
-	ShadowSocksConfig       string            `yaml:"ss-config" json:"ss-config"`
-	VmessConfig             string            `yaml:"vmess-config" json:"vmess-config"`
-	InboundTfo              bool              `yaml:"inbound-tfo" json:"inbound-tfo"`
-	InboundMPTCP            bool              `yaml:"inbound-mptcp" json:"inbound-mptcp"`
-	Authentication          []string          `yaml:"authentication" json:"authentication"`
-	SkipAuthPrefixes        []netip.Prefix    `yaml:"skip-auth-prefixes" json:"skip-auth-prefixes"`
-	LanAllowedIPs           []netip.Prefix    `yaml:"lan-allowed-ips" json:"lan-allowed-ips"`
-	LanDisAllowedIPs        []netip.Prefix    `yaml:"lan-disallowed-ips" json:"lan-disallowed-ips"`
-	AllowLan                bool              `yaml:"allow-lan" json:"allow-lan"`
-	BindAddress             string            `yaml:"bind-address" json:"bind-address"`
-	Mode                    T.TunnelMode      `yaml:"mode" json:"mode"`
-	UnifiedDelay            bool              `yaml:"unified-delay" json:"unified-delay"`
-	LogLevel                log.LogLevel      `yaml:"log-level" json:"log-level"`
-	IPv6                    bool              `yaml:"ipv6" json:"ipv6"`
-	ExternalController      string            `yaml:"external-controller" json:"external-controller"`
-	ExternalControllerPipe  string            `yaml:"external-controller-pipe" json:"external-controller-pipe"`
-	ExternalControllerUnix  string            `yaml:"external-controller-unix" json:"external-controller-unix"`
-	ExternalControllerTLS   string            `yaml:"external-controller-tls" json:"external-controller-tls"`
-	ExternalControllerCors  RawCors           `yaml:"external-controller-cors" json:"external-controller-cors"`
-	ExternalUI              string            `yaml:"external-ui" json:"external-ui"`
-	ExternalUIURL           string            `yaml:"external-ui-url" json:"external-ui-url"`
-	ExternalUIName          string            `yaml:"external-ui-name" json:"external-ui-name"`
-	ExternalDohServer       string            `yaml:"external-doh-server" json:"external-doh-server"`
-	Secret                  string            `yaml:"secret" json:"secret"`
-	Interface               string            `yaml:"interface-name" json:"interface-name"`
-	RoutingMark             int               `yaml:"routing-mark" json:"routing-mark"`
-	Tunnels                 []LC.Tunnel       `yaml:"tunnels" json:"tunnels"`
-	GeoAutoUpdate           bool              `yaml:"geo-auto-update" json:"geo-auto-update"`
-	GeoUpdateInterval       int               `yaml:"geo-update-interval" json:"geo-update-interval"`
-	GeodataMode             bool              `yaml:"geodata-mode" json:"geodata-mode"`
-	GeodataLoader           string            `yaml:"geodata-loader" json:"geodata-loader"`
-	GeositeMatcher          string            `yaml:"geosite-matcher" json:"geosite-matcher"`
-	TCPConcurrent           bool              `yaml:"tcp-concurrent" json:"tcp-concurrent"`
-	FindProcessMode         P.FindProcessMode `yaml:"find-process-mode" json:"find-process-mode"`
-	GlobalClientFingerprint string            `yaml:"global-client-fingerprint" json:"global-client-fingerprint"`
-	GlobalUA                string            `yaml:"global-ua" json:"global-ua"`
-	ETagSupport             bool              `yaml:"etag-support" json:"etag-support"`
-	KeepAliveIdle           int               `yaml:"keep-alive-idle" json:"keep-alive-idle"`
-	KeepAliveInterval       int               `yaml:"keep-alive-interval" json:"keep-alive-interval"`
-	DisableKeepAlive        bool              `yaml:"disable-keep-alive" json:"disable-keep-alive"`
+	Port                    int                     `yaml:"port" json:"port"`
+	SocksPort               int                     `yaml:"socks-port" json:"socks-port"`
+	RedirPort               int                     `yaml:"redir-port" json:"redir-port"`
+	TProxyPort              int                     `yaml:"tproxy-port" json:"tproxy-port"`
+	MixedPort               int                     `yaml:"mixed-port" json:"mixed-port"`
+	ShadowSocksConfig       string                  `yaml:"ss-config" json:"ss-config"`
+	VmessConfig             string                  `yaml:"vmess-config" json:"vmess-config"`
+	InboundTfo              bool                    `yaml:"inbound-tfo" json:"inbound-tfo"`
+	InboundMPTCP            bool                    `yaml:"inbound-mptcp" json:"inbound-mptcp"`
+	Authentication          []string                `yaml:"authentication" json:"authentication"`
+	SkipAuthPrefixes        []netip.Prefix          `yaml:"skip-auth-prefixes" json:"skip-auth-prefixes"`
+	LanAllowedIPs           []netip.Prefix          `yaml:"lan-allowed-ips" json:"lan-allowed-ips"`
+	LanDisAllowedIPs        []netip.Prefix          `yaml:"lan-disallowed-ips" json:"lan-disallowed-ips"`
+	AllowLan                bool                    `yaml:"allow-lan" json:"allow-lan"`
+	BindAddress             string                  `yaml:"bind-address" json:"bind-address"`
+	Mode                    T.TunnelMode            `yaml:"mode" json:"mode"`
+	UnifiedDelay            bool                    `yaml:"unified-delay" json:"unified-delay"`
+	LogLevel                log.LogLevel            `yaml:"log-level" json:"log-level"`
+	IPv6                    bool                    `yaml:"ipv6" json:"ipv6"`
+	ExternalController      string                  `yaml:"external-controller" json:"external-controller"`
+	ExternalControllerPipe  string                  `yaml:"external-controller-pipe" json:"external-controller-pipe"`
+	ExternalControllerUnix  string                  `yaml:"external-controller-unix" json:"external-controller-unix"`
+	ExternalControllerTLS   string                  `yaml:"external-controller-tls" json:"external-controller-tls"`
+	ExternalControllerCors  RawCors                 `yaml:"external-controller-cors" json:"external-controller-cors"`
+	ExternalUI              string                  `yaml:"external-ui" json:"external-ui"`
+	ExternalUIURL           string                  `yaml:"external-ui-url" json:"external-ui-url"`
+	ExternalUIName          string                  `yaml:"external-ui-name" json:"external-ui-name"`
+	ExternalDohServer       string                  `yaml:"external-doh-server" json:"external-doh-server"`
+	Secret                  string                  `yaml:"secret" json:"secret"`
+	Interface               string                  `yaml:"interface-name" json:"interface-name"`
+	RoutingMark             int                     `yaml:"routing-mark" json:"routing-mark"`
+	Tunnels                 []LC.Tunnel             `yaml:"tunnels" json:"tunnels"`
+	GeoAutoUpdate           bool                    `yaml:"geo-auto-update" json:"geo-auto-update"`
+	GeoUpdateInterval       int                     `yaml:"geo-update-interval" json:"geo-update-interval"`
+	GeodataMode             bool                    `yaml:"geodata-mode" json:"geodata-mode"`
+	GeodataLoader           string                  `yaml:"geodata-loader" json:"geodata-loader"`
+	GeositeMatcher          string                  `yaml:"geosite-matcher" json:"geosite-matcher"`
+	TCPConcurrent           bool                    `yaml:"tcp-concurrent" json:"tcp-concurrent"`
+	FindProcessMode         process.FindProcessMode `yaml:"find-process-mode" json:"find-process-mode"`
+	GlobalClientFingerprint string                  `yaml:"global-client-fingerprint" json:"global-client-fingerprint"`
+	GlobalUA                string                  `yaml:"global-ua" json:"global-ua"`
+	ETagSupport             bool                    `yaml:"etag-support" json:"etag-support"`
+	KeepAliveIdle           int                     `yaml:"keep-alive-idle" json:"keep-alive-idle"`
+	KeepAliveInterval       int                     `yaml:"keep-alive-interval" json:"keep-alive-interval"`
+	DisableKeepAlive        bool                    `yaml:"disable-keep-alive" json:"disable-keep-alive"`
 
 	ProxyProvider map[string]map[string]any `yaml:"proxy-providers" json:"proxy-providers"`
 	RuleProvider  map[string]map[string]any `yaml:"rule-providers" json:"rule-providers"`
@@ -474,7 +479,7 @@ func DefaultRawConfig() *RawConfig {
 		Proxy:             []map[string]any{},
 		ProxyGroup:        []map[string]any{},
 		TCPConcurrent:     false,
-		FindProcessMode:   P.FindProcessStrict,
+		FindProcessMode:   process.FindProcessStrict,
 		GlobalUA:          "clash.meta/" + C.Version,
 		ETagSupport:       true,
 		DNS: RawDNS{
@@ -648,11 +653,11 @@ func ParseRawConfig(rawCfg *RawConfig) (*Config, error) {
 	config.Proxies = proxies
 	config.Providers = providers
 
-	listener, err := parseListeners(rawCfg)
+	listeners, err := parseListeners(rawCfg)
 	if err != nil {
 		return nil, err
 	}
-	config.Listeners = listener
+	config.Listeners = listeners
 
 	log.Infoln("Geodata Loader mode: %s", geodata.LoaderName())
 	log.Infoln("Geosite Matcher implementation: %s", geodata.SiteMatcherName())
@@ -680,13 +685,15 @@ func ParseRawConfig(rawCfg *RawConfig) (*Config, error) {
 	}
 	config.Hosts = hosts
 
-	dnsCfg, err := parseDNS(rawCfg, hosts, ruleProviders)
+	parseIPV6(rawCfg) // must before DNS and Tun
+
+	dnsCfg, err := parseDNS(rawCfg, ruleProviders)
 	if err != nil {
 		return nil, err
 	}
 	config.DNS = dnsCfg
 
-	err = parseTun(rawCfg.Tun, config.General)
+	err = parseTun(rawCfg.Tun, dnsCfg, config.General)
 	if err != nil {
 		return nil, err
 	}
@@ -838,9 +845,9 @@ func parseTLS(cfg *RawConfig) (*TLS, error) {
 	}, nil
 }
 
-func parseProxies(cfg *RawConfig) (proxies map[string]C.Proxy, providersMap map[string]providerTypes.ProxyProvider, err error) {
+func parseProxies(cfg *RawConfig) (proxies map[string]C.Proxy, providersMap map[string]P.ProxyProvider, err error) {
 	proxies = make(map[string]C.Proxy)
-	providersMap = make(map[string]providerTypes.ProxyProvider)
+	providersMap = make(map[string]P.ProxyProvider)
 	proxiesConfig := cfg.Proxy
 	groupsConfig := cfg.ProxyGroup
 	providersConfig := cfg.ProxyProvider
@@ -940,7 +947,7 @@ func parseProxies(cfg *RawConfig) (proxies map[string]C.Proxy, providersMap map[
 			&outboundgroup.GroupCommonOption{
 				Name: "GLOBAL",
 			},
-			[]providerTypes.ProxyProvider{pd},
+			[]P.ProxyProvider{pd},
 		)
 		proxies["GLOBAL"] = adapter.NewProxy(global)
 	}
@@ -950,24 +957,25 @@ func parseProxies(cfg *RawConfig) (proxies map[string]C.Proxy, providersMap map[
 func parseListeners(cfg *RawConfig) (listeners map[string]C.InboundListener, err error) {
 	listeners = make(map[string]C.InboundListener)
 	for index, mapping := range cfg.Listeners {
-		listener, err := L.ParseListener(mapping)
+		inboundListener, err := listener.ParseListener(mapping)
 		if err != nil {
 			return nil, fmt.Errorf("proxy %d: %w", index, err)
 		}
 
-		if _, exist := mapping[listener.Name()]; exist {
-			return nil, fmt.Errorf("listener %s is the duplicate name", listener.Name())
+		name := inboundListener.Name()
+		if _, exist := mapping[name]; exist {
+			return nil, fmt.Errorf("listener %s is the duplicate name", name)
 		}
 
-		listeners[listener.Name()] = listener
+		listeners[name] = inboundListener
 
 	}
 	return
 }
 
-func parseRuleProviders(cfg *RawConfig) (ruleProviders map[string]providerTypes.RuleProvider, err error) {
+func parseRuleProviders(cfg *RawConfig) (ruleProviders map[string]P.RuleProvider, err error) {
 	RP.SetTunnel(T.Tunnel)
-	ruleProviders = map[string]providerTypes.RuleProvider{}
+	ruleProviders = map[string]P.RuleProvider{}
 	// parse rule provider
 	for name, mapping := range cfg.RuleProvider {
 		rp, err := RP.ParseRuleProvider(name, mapping, R.ParseRule)
@@ -980,7 +988,7 @@ func parseRuleProviders(cfg *RawConfig) (ruleProviders map[string]providerTypes.
 	return
 }
 
-func parseSubRules(cfg *RawConfig, proxies map[string]C.Proxy, ruleProviders map[string]providerTypes.RuleProvider) (subRules map[string][]C.Rule, err error) {
+func parseSubRules(cfg *RawConfig, proxies map[string]C.Proxy, ruleProviders map[string]P.RuleProvider) (subRules map[string][]C.Rule, err error) {
 	subRules = map[string][]C.Rule{}
 	for name := range cfg.SubRules {
 		subRules[name] = make([]C.Rule, 0)
@@ -1043,7 +1051,7 @@ func verifySubRuleCircularReferences(n string, subRules map[string][]C.Rule, arr
 	return nil
 }
 
-func parseRules(rulesConfig []string, proxies map[string]C.Proxy, ruleProviders map[string]providerTypes.RuleProvider, subRules map[string][]C.Rule, format string) ([]C.Rule, error) {
+func parseRules(rulesConfig []string, proxies map[string]C.Proxy, ruleProviders map[string]P.RuleProvider, subRules map[string][]C.Rule, format string) ([]C.Rule, error) {
 	var rules []C.Rule
 
 	// parse rules
@@ -1266,7 +1274,7 @@ func parsePureDNSServer(server string) string {
 	}
 }
 
-func parseNameServerPolicy(nsPolicy *orderedmap.OrderedMap[string, any], ruleProviders map[string]providerTypes.RuleProvider, respectRules bool, preferH3 bool) ([]dns.Policy, error) {
+func parseNameServerPolicy(nsPolicy *orderedmap.OrderedMap[string, any], ruleProviders map[string]P.RuleProvider, respectRules bool, preferH3 bool) ([]dns.Policy, error) {
 	var policy []dns.Policy
 
 	for pair := nsPolicy.Oldest(); pair != nil; pair = pair.Next() {
@@ -1341,7 +1349,7 @@ func parseNameServerPolicy(nsPolicy *orderedmap.OrderedMap[string, any], rulePro
 	return policy, nil
 }
 
-func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], ruleProviders map[string]providerTypes.RuleProvider) (*DNS, error) {
+func parseDNS(rawCfg *RawConfig, ruleProviders map[string]P.RuleProvider) (*DNS, error) {
 	cfg := rawCfg.DNS
 	if cfg.Enable && len(cfg.NameServer) == 0 {
 		return nil, fmt.Errorf("if DNS configuration is turned on, NameServer cannot be empty")
@@ -1357,6 +1365,7 @@ func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rul
 		PreferH3:       cfg.PreferH3,
 		IPv6Timeout:    cfg.IPv6Timeout,
 		IPv6:           cfg.IPv6,
+		UseHosts:       cfg.UseHosts,
 		UseSystemHosts: cfg.UseSystemHosts,
 		EnhancedMode:   cfg.EnhancedMode,
 		CacheAlgorithm: cfg.CacheAlgorithm,
@@ -1406,13 +1415,27 @@ func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rul
 		}
 	}
 
-	fakeIPRange, err := netip.ParsePrefix(cfg.FakeIPRange)
-	T.SetFakeIPRange(fakeIPRange)
-	if cfg.EnhancedMode == C.DNSFakeIP {
+	if cfg.FakeIPRange != "" {
+		dnsCfg.FakeIPRange, err = netip.ParsePrefix(cfg.FakeIPRange)
 		if err != nil {
 			return nil, err
 		}
+		if !dnsCfg.FakeIPRange.Addr().Is4() {
+			return nil, errors.New("dns.fake-ip-range must be a IPv4 prefix")
+		}
+	}
 
+	if cfg.FakeIPRange6 != "" {
+		dnsCfg.FakeIPRange6, err = netip.ParsePrefix(cfg.FakeIPRange6)
+		if err != nil {
+			return nil, err
+		}
+		if !dnsCfg.FakeIPRange6.Addr().Is6() {
+			return nil, errors.New("dns.fake-ip-range6 must be a IPv6 prefix")
+		}
+	}
+
+	if cfg.EnhancedMode == C.DNSFakeIP {
 		var fakeIPTrie *trie.DomainTrie[struct{}]
 		if len(dnsCfg.Fallback) != 0 {
 			fakeIPTrie = trie.New[struct{}]()
@@ -1430,18 +1453,39 @@ func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rul
 			return nil, err
 		}
 
-		pool, err := fakeip.New(fakeip.Options{
-			IPNet:       fakeIPRange,
-			Size:        1000,
-			Host:        host,
-			Mode:        cfg.FakeIPFilterMode,
-			Persistence: rawCfg.Profile.StoreFakeIP,
-		})
-		if err != nil {
-			return nil, err
+		skipper := &fakeip.Skipper{
+			Host: host,
+			Mode: cfg.FakeIPFilterMode,
+		}
+		dnsCfg.FakeIPSkipper = skipper
+
+		if dnsCfg.FakeIPRange.IsValid() {
+			pool, err := fakeip.New(fakeip.Options{
+				IPNet:       dnsCfg.FakeIPRange,
+				Size:        1000,
+				Persistence: rawCfg.Profile.StoreFakeIP,
+			})
+			if err != nil {
+				return nil, err
+			}
+			dnsCfg.FakeIPPool = pool
 		}
 
-		dnsCfg.FakeIPRange = pool
+		if dnsCfg.FakeIPRange6.IsValid() {
+			pool6, err := fakeip.New(fakeip.Options{
+				IPNet:       dnsCfg.FakeIPRange6,
+				Size:        1000,
+				Persistence: rawCfg.Profile.StoreFakeIP,
+			})
+			if err != nil {
+				return nil, err
+			}
+			dnsCfg.FakeIPPool6 = pool6
+		}
+
+		if dnsCfg.FakeIPPool == nil && dnsCfg.FakeIPPool6 == nil {
+			return nil, errors.New("disallow `fake-ip-range` and `fake-ip-range6` both empty with fake-ip mode")
+		}
 	}
 
 	if len(cfg.Fallback) != 0 {
@@ -1490,10 +1534,6 @@ func parseDNS(rawCfg *RawConfig, hosts *trie.DomainTrie[resolver.HostValue], rul
 		}
 	}
 
-	if cfg.UseHosts {
-		dnsCfg.Hosts = hosts
-	}
-
 	return dnsCfg, nil
 }
 
@@ -1507,17 +1547,20 @@ func parseAuthentication(rawRecords []string) []auth.AuthUser {
 	return users
 }
 
-func parseTun(rawTun RawTun, general *General) error {
-	tunAddressPrefix := T.FakeIPRange()
+func parseIPV6(rawCfg *RawConfig) {
+	if !rawCfg.IPv6 || !verifyIP6() {
+		rawCfg.DNS.FakeIPRange6 = ""
+		rawCfg.Tun.Inet6Address = nil
+	}
+}
+
+func parseTun(rawTun RawTun, dns *DNS, general *General) error {
+	tunAddressPrefix := dns.FakeIPRange
 	if !tunAddressPrefix.IsValid() {
 		tunAddressPrefix = netip.MustParsePrefix("198.18.0.1/16")
 	}
 	tunAddressPrefix = netip.PrefixFrom(tunAddressPrefix.Addr(), 30)
 
-	if !general.IPv6 || !verifyIP6() {
-		rawTun.Inet6Address = nil
-	}
-
 	general.Tun = LC.Tun{
 		Enable:              rawTun.Enable,
 		Device:              rawTun.Device,
@@ -1590,7 +1633,7 @@ func parseTuicServer(rawTuic RawTuicServer, general *General) error {
 	return nil
 }
 
-func parseSniffer(snifferRaw RawSniffer, ruleProviders map[string]providerTypes.RuleProvider) (*sniffer.Config, error) {
+func parseSniffer(snifferRaw RawSniffer, ruleProviders map[string]P.RuleProvider) (*sniffer.Config, error) {
 	snifferConfig := &sniffer.Config{
 		Enable:          snifferRaw.Enable,
 		ForceDnsMapping: snifferRaw.ForceDnsMapping,
@@ -1680,7 +1723,7 @@ func parseSniffer(snifferRaw RawSniffer, ruleProviders map[string]providerTypes.
 	return snifferConfig, nil
 }
 
-func parseIPCIDR(addresses []string, cidrSet *cidr.IpCidrSet, adapterName string, ruleProviders map[string]providerTypes.RuleProvider) (matchers []C.IpMatcher, err error) {
+func parseIPCIDR(addresses []string, cidrSet *cidr.IpCidrSet, adapterName string, ruleProviders map[string]P.RuleProvider) (matchers []C.IpMatcher, err error) {
 	var matcher C.IpMatcher
 	for _, ipcidr := range addresses {
 		ipcidrLower := strings.ToLower(ipcidr)
@@ -1727,7 +1770,7 @@ func parseIPCIDR(addresses []string, cidrSet *cidr.IpCidrSet, adapterName string
 	return
 }
 
-func parseDomain(domains []string, domainTrie *trie.DomainTrie[struct{}], adapterName string, ruleProviders map[string]providerTypes.RuleProvider) (matchers []C.DomainMatcher, err error) {
+func parseDomain(domains []string, domainTrie *trie.DomainTrie[struct{}], adapterName string, ruleProviders map[string]P.RuleProvider) (matchers []C.DomainMatcher, err error) {
 	var matcher C.DomainMatcher
 	for _, domain := range domains {
 		domainLower := strings.ToLower(domain)
@@ -1770,14 +1813,14 @@ func parseDomain(domains []string, domainTrie *trie.DomainTrie[struct{}], adapte
 	return
 }
 
-func parseIPRuleSet(domainSetName string, adapterName string, ruleProviders map[string]providerTypes.RuleProvider) (C.IpMatcher, error) {
+func parseIPRuleSet(domainSetName string, adapterName string, ruleProviders map[string]P.RuleProvider) (C.IpMatcher, error) {
 	if rp, ok := ruleProviders[domainSetName]; !ok {
 		return nil, fmt.Errorf("not found rule-set: %s", domainSetName)
 	} else {
 		switch rp.Behavior() {
-		case providerTypes.Domain:
+		case P.Domain:
 			return nil, fmt.Errorf("rule provider type error, except ipcidr,actual %s", rp.Behavior())
-		case providerTypes.Classical:
+		case P.Classical:
 			log.Warnln("%s provider is %s, only matching it contain ip rule", rp.Name(), rp.Behavior())
 		default:
 		}
@@ -1785,14 +1828,14 @@ func parseIPRuleSet(domainSetName string, adapterName string, ruleProviders map[
 	return RP.NewRuleSet(domainSetName, adapterName, false, true)
 }
 
-func parseDomainRuleSet(domainSetName string, adapterName string, ruleProviders map[string]providerTypes.RuleProvider) (C.DomainMatcher, error) {
+func parseDomainRuleSet(domainSetName string, adapterName string, ruleProviders map[string]P.RuleProvider) (C.DomainMatcher, error) {
 	if rp, ok := ruleProviders[domainSetName]; !ok {
 		return nil, fmt.Errorf("not found rule-set: %s", domainSetName)
 	} else {
 		switch rp.Behavior() {
-		case providerTypes.IPCIDR:
+		case P.IPCIDR:
 			return nil, fmt.Errorf("rule provider type error, except domain,actual %s", rp.Behavior())
-		case providerTypes.Classical:
+		case P.Classical:
 			log.Warnln("%s provider is %s, only matching it contain domain rule", rp.Name(), rp.Behavior())
 		default:
 		}

config/utils.go

@@ -155,6 +155,10 @@ func verifyIP6() bool {
 				}
 			}
 		}
+	} else {
+		// eg: Calling net.InterfaceAddrs() fails on Android SDK 30
+		// https://github.com/golang/go/issues/40569
+		return true // just ignore
 	}
 	return false
 }

constant/adapters.go

@@ -139,8 +139,11 @@ type ProxyAdapter interface {
 	// SupportUOT return UDP over TCP support
 	SupportUOT() bool
 
+	// SupportWithDialer only for deprecated relay group, the new protocol does not need to be implemented.
 	SupportWithDialer() NetWork
+	// DialContextWithDialer only for deprecated relay group, the new protocol does not need to be implemented.
 	DialContextWithDialer(ctx context.Context, dialer Dialer, metadata *Metadata) (Conn, error)
+	// ListenPacketWithDialer only for deprecated relay group, the new protocol does not need to be implemented.
 	ListenPacketWithDialer(ctx context.Context, dialer Dialer, metadata *Metadata) (PacketConn, error)
 
 	// IsL3Protocol return ProxyAdapter working in L3 (tell dns module not pass the domain to avoid loopback)
@@ -178,12 +181,6 @@ type Proxy interface {
 	ExtraDelayHistories() map[string]ProxyState
 	LastDelayForTestUrl(url string) uint16
 	URLTest(ctx context.Context, url string, expectedStatus utils.IntRanges[uint16]) (uint16, error)
-
-	// Deprecated: use DialContext instead.
-	Dial(metadata *Metadata) (Conn, error)
-
-	// Deprecated: use DialPacketConn instead.
-	DialUDP(metadata *Metadata) (PacketConn, error)
 }
 
 // AdapterType is enum of adapter type

constant/metadata.go

@@ -38,6 +38,7 @@ const (
 	TUIC
 	HYSTERIA2
 	ANYTLS
+	MIERU
 	INNER
 )
 
@@ -109,6 +110,8 @@ func (t Type) String() string {
 		return "Hysteria2"
 	case ANYTLS:
 		return "AnyTLS"
+	case MIERU:
+		return "Mieru"
 	case INNER:
 		return "Inner"
 	default:
@@ -149,6 +152,8 @@ func ParseType(t string) (*Type, error) {
 		res = HYSTERIA2
 	case "ANYTLS":
 		res = ANYTLS
+	case "MIERU":
+		res = MIERU
 	case "INNER":
 		res = INNER
 	default:

context/dns.go

@@ -2,10 +2,10 @@ package context
 
 import (
 	"context"
+
 	"github.com/metacubex/mihomo/common/utils"
 
 	"github.com/gofrs/uuid/v5"
-	"github.com/miekg/dns"
 )
 
 const (
@@ -17,17 +17,15 @@ const (
 type DNSContext struct {
 	context.Context
 
-	id  uuid.UUID
-	msg *dns.Msg
-	tp  string
+	id uuid.UUID
+	tp string
 }
 
-func NewDNSContext(ctx context.Context, msg *dns.Msg) *DNSContext {
+func NewDNSContext(ctx context.Context) *DNSContext {
 	return &DNSContext{
 		Context: ctx,
 
-		id:  utils.NewUUIDV4(),
-		msg: msg,
+		id: utils.NewUUIDV4(),
 	}
 }
 

dns/enhancer.go

@@ -9,9 +9,12 @@ import (
 )
 
 type ResolverEnhancer struct {
-	mode     C.DNSMode
-	fakePool *fakeip.Pool
-	mapping  *lru.LruCache[netip.Addr, string]
+	mode          C.DNSMode
+	fakeIPPool    *fakeip.Pool
+	fakeIPPool6   *fakeip.Pool
+	fakeIPSkipper *fakeip.Skipper
+	mapping       *lru.LruCache[netip.Addr, string]
+	useHosts      bool
 }
 
 func (h *ResolverEnhancer) FakeIPEnabled() bool {
@@ -27,10 +30,14 @@ func (h *ResolverEnhancer) IsExistFakeIP(ip netip.Addr) bool {
 		return false
 	}
 
-	if pool := h.fakePool; pool != nil {
+	if pool := h.fakeIPPool; pool != nil {
 		return pool.Exist(ip)
 	}
 
+	if pool6 := h.fakeIPPool6; pool6 != nil {
+		return pool6.Exist(ip)
+	}
+
 	return false
 }
 
@@ -39,10 +46,14 @@ func (h *ResolverEnhancer) IsFakeIP(ip netip.Addr) bool {
 		return false
 	}
 
-	if pool := h.fakePool; pool != nil {
+	if pool := h.fakeIPPool; pool != nil {
 		return pool.IPNet().Contains(ip) && ip != pool.Gateway() && ip != pool.Broadcast()
 	}
 
+	if pool6 := h.fakeIPPool6; pool6 != nil {
+		return pool6.IPNet().Contains(ip) && ip != pool6.Gateway() && ip != pool6.Broadcast()
+	}
+
 	return false
 }
 
@@ -51,20 +62,30 @@ func (h *ResolverEnhancer) IsFakeBroadcastIP(ip netip.Addr) bool {
 		return false
 	}
 
-	if pool := h.fakePool; pool != nil {
+	if pool := h.fakeIPPool; pool != nil {
 		return pool.Broadcast() == ip
 	}
 
+	if pool6 := h.fakeIPPool6; pool6 != nil {
+		return pool6.Broadcast() == ip
+	}
+
 	return false
 }
 
 func (h *ResolverEnhancer) FindHostByIP(ip netip.Addr) (string, bool) {
-	if pool := h.fakePool; pool != nil {
+	if pool := h.fakeIPPool; pool != nil {
 		if host, existed := pool.LookBack(ip); existed {
 			return host, true
 		}
 	}
 
+	if pool6 := h.fakeIPPool6; pool6 != nil {
+		if host, existed := pool6.LookBack(ip); existed {
+			return host, true
+		}
+	}
+
 	if mapping := h.mapping; mapping != nil {
 		if host, existed := h.mapping.Get(ip); existed {
 			return host, true
@@ -81,9 +102,12 @@ func (h *ResolverEnhancer) InsertHostByIP(ip netip.Addr, host string) {
 }
 
 func (h *ResolverEnhancer) FlushFakeIP() error {
-	if pool := h.fakePool; pool != nil {
+	if pool := h.fakeIPPool; pool != nil {
 		return pool.FlushFakeIP()
 	}
+	if pool6 := h.fakeIPPool6; pool6 != nil {
+		return pool6.FlushFakeIP()
+	}
 	return nil
 }
 
@@ -92,29 +116,48 @@ func (h *ResolverEnhancer) PatchFrom(o *ResolverEnhancer) {
 		o.mapping.CloneTo(h.mapping)
 	}
 
-	if h.fakePool != nil && o.fakePool != nil {
-		h.fakePool.CloneFrom(o.fakePool)
+	if h.fakeIPPool != nil && o.fakeIPPool != nil {
+		h.fakeIPPool.CloneFrom(o.fakeIPPool)
+	}
+
+	if h.fakeIPPool6 != nil && o.fakeIPPool6 != nil {
+		h.fakeIPPool6.CloneFrom(o.fakeIPPool6)
 	}
 }
 
 func (h *ResolverEnhancer) StoreFakePoolState() {
-	if h.fakePool != nil {
-		h.fakePool.StoreState()
+	if h.fakeIPPool != nil {
+		h.fakeIPPool.StoreState()
+	}
+
+	if h.fakeIPPool6 != nil {
+		h.fakeIPPool6.StoreState()
 	}
 }
 
-func NewEnhancer(cfg Config) *ResolverEnhancer {
-	var fakePool *fakeip.Pool
-	var mapping *lru.LruCache[netip.Addr, string]
+type EnhancerConfig struct {
+	IPv6          bool
+	EnhancedMode  C.DNSMode
+	FakeIPPool    *fakeip.Pool
+	FakeIPPool6   *fakeip.Pool
+	FakeIPSkipper *fakeip.Skipper
+	UseHosts      bool
+}
+
+func NewEnhancer(cfg EnhancerConfig) *ResolverEnhancer {
+	e := &ResolverEnhancer{
+		mode:     cfg.EnhancedMode,
+		useHosts: cfg.UseHosts,
+	}
 
 	if cfg.EnhancedMode != C.DNSNormal {
-		fakePool = cfg.Pool
-		mapping = lru.New(lru.WithSize[netip.Addr, string](4096))
+		e.fakeIPPool = cfg.FakeIPPool
+		if cfg.IPv6 {
+			e.fakeIPPool6 = cfg.FakeIPPool6
+		}
+		e.fakeIPSkipper = cfg.FakeIPSkipper
+		e.mapping = lru.New(lru.WithSize[netip.Addr, string](4096))
 	}
 
-	return &ResolverEnhancer{
-		mode:     cfg.EnhancedMode,
-		fakePool: fakePool,
-		mapping:  mapping,
-	}
+	return e
 }

dns/local.go

@@ -1,20 +0,0 @@
-package dns
-
-import (
-	"context"
-
-	D "github.com/miekg/dns"
-)
-
-type LocalServer struct {
-	handler handler
-}
-
-// ServeMsg implement resolver.LocalServer ResolveMsg
-func (s *LocalServer) ServeMsg(ctx context.Context, msg *D.Msg) (*D.Msg, error) {
-	return handlerWithContext(ctx, s.handler, msg)
-}
-
-func NewLocalServer(resolver *Resolver, mapper *ResolverEnhancer) *LocalServer {
-	return &LocalServer{handler: NewHandler(resolver, mapper)}
-}

dns/middleware.go

@@ -7,22 +7,22 @@ import (
 
 	"github.com/metacubex/mihomo/common/lru"
 	"github.com/metacubex/mihomo/component/fakeip"
-	R "github.com/metacubex/mihomo/component/resolver"
+	"github.com/metacubex/mihomo/component/resolver"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/context"
+	icontext "github.com/metacubex/mihomo/context"
 	"github.com/metacubex/mihomo/log"
 
 	D "github.com/miekg/dns"
 )
 
 type (
-	handler    func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error)
+	handler    func(ctx *icontext.DNSContext, r *D.Msg) (*D.Msg, error)
 	middleware func(next handler) handler
 )
 
-func withHosts(hosts R.Hosts, mapping *lru.LruCache[netip.Addr, string]) middleware {
+func withHosts(mapping *lru.LruCache[netip.Addr, string]) middleware {
 	return func(next handler) handler {
-		return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
+		return func(ctx *icontext.DNSContext, r *D.Msg) (*D.Msg, error) {
 			q := r.Question[0]
 
 			if !isIPRequest(q) {
@@ -36,7 +36,7 @@ func withHosts(hosts R.Hosts, mapping *lru.LruCache[netip.Addr, string]) middlew
 				rr.Target = domain + "."
 				resp.Answer = append([]D.RR{rr}, resp.Answer...)
 			}
-			record, ok := hosts.Search(host, q.Qtype != D.TypeA && q.Qtype != D.TypeAAAA)
+			record, ok := resolver.DefaultHosts.Search(host, q.Qtype != D.TypeA && q.Qtype != D.TypeAAAA)
 			if !ok {
 				if record != nil && record.IsDomain {
 					// replace request domain
@@ -67,8 +67,7 @@ func withHosts(hosts R.Hosts, mapping *lru.LruCache[netip.Addr, string]) middlew
 					} else if q.Qtype == D.TypeAAAA {
 						rr := &D.AAAA{}
 						rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeAAAA, Class: D.ClassINET, Ttl: 10}
-						ip := ipAddr.As16()
-						rr.AAAA = ip[:]
+						rr.AAAA = ipAddr.AsSlice()
 						msg.Answer = append(msg.Answer, rr)
 						if mapping != nil {
 							mapping.SetWithExpire(ipAddr, host, time.Now().Add(time.Second*10))
@@ -88,7 +87,7 @@ func withHosts(hosts R.Hosts, mapping *lru.LruCache[netip.Addr, string]) middlew
 				return next(ctx, r)
 			}
 
-			ctx.SetType(context.DNSTypeHost)
+			ctx.SetType(icontext.DNSTypeHost)
 			msg.SetRcode(r, D.RcodeSuccess)
 			msg.Authoritative = true
 			msg.RecursionAvailable = true
@@ -99,7 +98,7 @@ func withHosts(hosts R.Hosts, mapping *lru.LruCache[netip.Addr, string]) middlew
 
 func withMapping(mapping *lru.LruCache[netip.Addr, string]) middleware {
 	return func(next handler) handler {
-		return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
+		return func(ctx *icontext.DNSContext, r *D.Msg) (*D.Msg, error) {
 			q := r.Question[0]
 
 			if !isIPRequest(q) {
@@ -147,33 +146,46 @@ func withMapping(mapping *lru.LruCache[netip.Addr, string]) middleware {
 	}
 }
 
-func withFakeIP(fakePool *fakeip.Pool) middleware {
+func withFakeIP(skipper *fakeip.Skipper, fakePool *fakeip.Pool, fakePool6 *fakeip.Pool) middleware {
 	return func(next handler) handler {
-		return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
+		return func(ctx *icontext.DNSContext, r *D.Msg) (*D.Msg, error) {
 			q := r.Question[0]
 
 			host := strings.TrimRight(q.Name, ".")
-			if fakePool.ShouldSkipped(host) {
+			if skipper.ShouldSkipped(host) {
 				return next(ctx, r)
 			}
 
+			var rr D.RR
 			switch q.Qtype {
-			case D.TypeAAAA, D.TypeSVCB, D.TypeHTTPS:
+			case D.TypeA:
+				if fakePool == nil {
+					return handleMsgWithEmptyAnswer(r), nil
+				}
+				ip := fakePool.Lookup(host)
+				rr = &D.A{
+					Hdr: D.RR_Header{Name: q.Name, Rrtype: D.TypeA, Class: D.ClassINET, Ttl: dnsDefaultTTL},
+					A:   ip.AsSlice(),
+				}
+			case D.TypeAAAA:
+				if fakePool6 == nil {
+					return handleMsgWithEmptyAnswer(r), nil
+				}
+				ip := fakePool6.Lookup(host)
+				rr = &D.AAAA{
+					Hdr:  D.RR_Header{Name: q.Name, Rrtype: D.TypeAAAA, Class: D.ClassINET, Ttl: dnsDefaultTTL},
+					AAAA: ip.AsSlice(),
+				}
+			case D.TypeSVCB, D.TypeHTTPS:
 				return handleMsgWithEmptyAnswer(r), nil
-			}
-
-			if q.Qtype != D.TypeA {
+			default:
 				return next(ctx, r)
 			}
 
-			rr := &D.A{}
-			rr.Hdr = D.RR_Header{Name: q.Name, Rrtype: D.TypeA, Class: D.ClassINET, Ttl: dnsDefaultTTL}
-			ip := fakePool.Lookup(host)
-			rr.A = ip.AsSlice()
 			msg := r.Copy()
 			msg.Answer = []D.RR{rr}
 
-			ctx.SetType(context.DNSTypeFakeIP)
+			ctx.SetType(icontext.DNSTypeFakeIP)
 			setMsgTTL(msg, 1)
 			msg.SetRcode(r, D.RcodeSuccess)
 			msg.Authoritative = true
@@ -185,8 +197,8 @@ func withFakeIP(fakePool *fakeip.Pool) middleware {
 }
 
 func withResolver(resolver *Resolver) handler {
-	return func(ctx *context.DNSContext, r *D.Msg) (*D.Msg, error) {
-		ctx.SetType(context.DNSTypeRaw)
+	return func(ctx *icontext.DNSContext, r *D.Msg) (*D.Msg, error) {
+		ctx.SetType(icontext.DNSTypeRaw)
 
 		q := r.Question[0]
 
@@ -218,15 +230,15 @@ func compose(middlewares []middleware, endpoint handler) handler {
 	return h
 }
 
-func NewHandler(resolver *Resolver, mapper *ResolverEnhancer) handler {
-	middlewares := []middleware{}
+func newHandler(resolver *Resolver, mapper *ResolverEnhancer) handler {
+	var middlewares []middleware
 
-	if resolver.hosts != nil {
-		middlewares = append(middlewares, withHosts(R.NewHosts(resolver.hosts), mapper.mapping))
+	if mapper.useHosts {
+		middlewares = append(middlewares, withHosts(mapper.mapping))
 	}
 
 	if mapper.mode == C.DNSFakeIP {
-		middlewares = append(middlewares, withFakeIP(mapper.fakePool))
+		middlewares = append(middlewares, withFakeIP(mapper.fakeIPSkipper, mapper.fakeIPPool, mapper.fakeIPPool6))
 	}
 
 	if mapper.mode != C.DNSNormal {

dns/resolver.go

@@ -9,7 +9,6 @@ import (
 	"github.com/metacubex/mihomo/common/arc"
 	"github.com/metacubex/mihomo/common/lru"
 	"github.com/metacubex/mihomo/common/singleflight"
-	"github.com/metacubex/mihomo/component/fakeip"
 	"github.com/metacubex/mihomo/component/resolver"
 	"github.com/metacubex/mihomo/component/trie"
 	C "github.com/metacubex/mihomo/constant"
@@ -40,7 +39,6 @@ type result struct {
 type Resolver struct {
 	ipv6                  bool
 	ipv6Timeout           time.Duration
-	hosts                 *trie.DomainTrie[resolver.HostValue]
 	main                  []dnsClient
 	fallback              []dnsClient
 	fallbackDomainFilters []C.DomainMatcher
@@ -452,11 +450,8 @@ type Config struct {
 	DirectFollowPolicy   bool
 	IPv6                 bool
 	IPv6Timeout          uint
-	EnhancedMode         C.DNSMode
 	FallbackIPFilter     []C.IpMatcher
 	FallbackDomainFilter []C.DomainMatcher
-	Pool                 *fakeip.Pool
-	Hosts                *trie.DomainTrie[resolver.HostValue]
 	Policy               []Policy
 	CacheAlgorithm       string
 	CacheMaxSize         int
@@ -530,7 +525,6 @@ func NewResolver(config Config) (rs Resolvers) {
 		ipv6:        config.IPv6,
 		main:        cacheTransform(config.Main),
 		cache:       config.newCache(),
-		hosts:       config.Hosts,
 		ipv6Timeout: time.Duration(config.IPv6Timeout) * time.Millisecond,
 	}
 	r.defaultResolver = defaultResolver
@@ -541,7 +535,6 @@ func NewResolver(config Config) (rs Resolvers) {
 			ipv6:        config.IPv6,
 			main:        cacheTransform(config.ProxyServer),
 			cache:       config.newCache(),
-			hosts:       config.Hosts,
 			ipv6Timeout: time.Duration(config.IPv6Timeout) * time.Millisecond,
 		}
 	}
@@ -551,7 +544,6 @@ func NewResolver(config Config) (rs Resolvers) {
 			ipv6:        config.IPv6,
 			main:        cacheTransform(config.DirectServer),
 			cache:       config.newCache(),
-			hosts:       config.Hosts,
 			ipv6Timeout: time.Duration(config.IPv6Timeout) * time.Millisecond,
 		}
 	}

dns/server.go

@@ -1,13 +1,12 @@
 package dns
 
 import (
-	stdContext "context"
-	"errors"
+	"context"
 	"net"
 
 	"github.com/metacubex/mihomo/adapter/inbound"
 	"github.com/metacubex/mihomo/common/sockopt"
-	"github.com/metacubex/mihomo/context"
+	"github.com/metacubex/mihomo/component/resolver"
 	"github.com/metacubex/mihomo/log"
 
 	D "github.com/miekg/dns"
@@ -21,39 +20,32 @@ var (
 )
 
 type Server struct {
-	handler   handler
+	service   resolver.Service
 	tcpServer *D.Server
 	udpServer *D.Server
 }
 
 // ServeDNS implement D.Handler ServeDNS
 func (s *Server) ServeDNS(w D.ResponseWriter, r *D.Msg) {
-	msg, err := handlerWithContext(stdContext.Background(), s.handler, r)
+	msg, err := s.service.ServeMsg(context.Background(), r)
 	if err != nil {
-		D.HandleFailed(w, r)
+		m := new(D.Msg)
+		m.SetRcode(r, D.RcodeServerFailure)
+		// does not matter if this write fails
+		w.WriteMsg(m)
 		return
 	}
 	msg.Compress = true
 	w.WriteMsg(msg)
 }
 
-func handlerWithContext(stdCtx stdContext.Context, handler handler, msg *D.Msg) (*D.Msg, error) {
-	if len(msg.Question) == 0 {
-		return nil, errors.New("at least one question is required")
-	}
-
-	ctx := context.NewDNSContext(stdCtx, msg)
-	return handler(ctx, msg)
+func (s *Server) SetService(service resolver.Service) {
+	s.service = service
 }
 
-func (s *Server) SetHandler(handler handler) {
-	s.handler = handler
-}
-
-func ReCreateServer(addr string, resolver *Resolver, mapper *ResolverEnhancer) {
-	if addr == address && resolver != nil {
-		handler := NewHandler(resolver, mapper)
-		server.SetHandler(handler)
+func ReCreateServer(addr string, service resolver.Service) {
+	if addr == address && service != nil {
+		server.SetService(service)
 		return
 	}
 
@@ -67,10 +59,10 @@ func ReCreateServer(addr string, resolver *Resolver, mapper *ResolverEnhancer) {
 		server.udpServer = nil
 	}
 
-	server.handler = nil
+	server.service = nil
 	address = ""
 
-	if addr == "" {
+	if addr == "" || service == nil {
 		return
 	}
 
@@ -87,8 +79,7 @@ func ReCreateServer(addr string, resolver *Resolver, mapper *ResolverEnhancer) {
 	}
 
 	address = addr
-	handler := NewHandler(resolver, mapper)
-	server = &Server{handler: handler}
+	server = &Server{service: service}
 
 	go func() {
 		p, err := inbound.ListenPacket("udp", addr)

dns/service.go

@@ -0,0 +1,29 @@
+package dns
+
+import (
+	"context"
+	"errors"
+
+	"github.com/metacubex/mihomo/component/resolver"
+	icontext "github.com/metacubex/mihomo/context"
+	D "github.com/miekg/dns"
+)
+
+type Service struct {
+	handler handler
+}
+
+// ServeMsg implement [resolver.Service] ResolveMsg
+func (s *Service) ServeMsg(ctx context.Context, msg *D.Msg) (*D.Msg, error) {
+	if len(msg.Question) == 0 {
+		return nil, errors.New("at least one question is required")
+	}
+
+	return s.handler(icontext.NewDNSContext(ctx), msg)
+}
+
+var _ resolver.Service = (*Service)(nil)
+
+func NewService(resolver *Resolver, mapper *ResolverEnhancer) *Service {
+	return &Service{handler: newHandler(resolver, mapper)}
+}

docs/config.yaml

@@ -261,6 +261,7 @@ dns:
   enhanced-mode: fake-ip # or redir-host
 
   fake-ip-range: 198.18.0.1/16 # fake-ip 池设置
+  # fake-ip-range6: fdfe:dcba:9876::1/64 # fake-ip6 池设置
 
   # 配置不使用 fake-ip 的域名
   fake-ip-filter:
@@ -543,7 +544,7 @@ proxies: # socks5
     plugin: kcptun
     plugin-opts:
       key: it's a secrect # pre-shared secret between client and server
-      crypt: aes # aes, aes-128, aes-192, salsa20, blowfish, twofish, cast5, 3des, tea, xtea, xor, sm4, none, null
+      crypt: aes # aes, aes-128, aes-192, salsa20, blowfish, twofish, cast5, 3des, tea, xtea, xor, none, null
       mode: fast # profiles: fast3, fast2, fast, normal, manual
       conn: 1 # set num of UDP connections to server
       autoexpire: 0 # set auto expiration time(in seconds) for a single UDP connection, 0 to disable
@@ -558,7 +559,7 @@ proxies: # socks5
       acknodelay: false # flush ack immediately when a packet is received
       nodelay: 0
       interval: 50
-      resend: false
+      resend: 0
       sockbuf: 4194304 # per-socket buffer in bytes
       smuxver: 1 # specify smux version, available 1,2
       smuxbuf: 4194304 # the overall de-mux buffer in bytes
@@ -1024,8 +1025,8 @@ proxies: # socks5
   - name: mieru
     type: mieru
     server: 1.2.3.4
-    port: 2999 # 支持使用 ports 格式，例如 2999,3999 或 2999-3010,3950,3995-3999
-    # port-range: 2090-2099 # 已废弃，请使用 port
+    port: 2999
+    # port-range: 2090-2099 #（不可同时填写 port 和 port-range）
     transport: TCP # 只支持 TCP
     udp: true # 支持 UDP over TCP
     username: user
@@ -1370,7 +1371,7 @@ listeners:
     # kcp-tun:
     #   enable: false
     #   key: it's a secrect # pre-shared secret between client and server
-    #   crypt: aes # aes, aes-128, aes-192, salsa20, blowfish, twofish, cast5, 3des, tea, xtea, xor, sm4, none, null
+    #   crypt: aes # aes, aes-128, aes-192, salsa20, blowfish, twofish, cast5, 3des, tea, xtea, xor, none, null
     #   mode: fast # profiles: fast3, fast2, fast, normal, manual
     #   conn: 1 # set num of UDP connections to server
     #   autoexpire: 0 # set auto expiration time(in seconds) for a single UDP connection, 0 to disable
@@ -1385,7 +1386,7 @@ listeners:
     #   acknodelay: false # flush ack immediately when a packet is received
     #   nodelay: 0
     #   interval: 50
-    #   resend: false
+    #   resend: 0
     #   sockbuf: 4194304 # per-socket buffer in bytes
     #   smuxver: 1 # specify smux version, available 1,2
     #   smuxbuf: 4194304 # the overall de-mux buffer in bytes
@@ -1555,6 +1556,15 @@ listeners:
     #   -----END ECH KEYS-----
     # padding-scheme: "" # https://github.com/anytls/anytls-go/blob/main/docs/protocol.md#cmdupdatepaddingscheme
 
+  - name: mieru-in-1
+    type: mieru
+    port: 10818 # 支持使用ports格式，例如200,302 or 200,204,401-429,501-503
+    listen: 0.0.0.0
+    transport: TCP # 支持 TCP 或者 UDP
+    users:
+      username1: password1
+      username2: password2
+
   - name: trojan-in-1
     type: trojan
     port: 10819 # 支持使用ports格式，例如200,302 or 200,204,401-429,501-503

go.mod

@@ -6,39 +6,39 @@ require (
 	github.com/bahlo/generic-list-go v0.2.0
 	github.com/coreos/go-iptables v0.8.0
 	github.com/dlclark/regexp2 v1.11.5
-	github.com/ebitengine/purego v0.9.0
-	github.com/enfein/mieru/v3 v3.20.0
+	github.com/ebitengine/purego v0.9.1
+	github.com/enfein/mieru/v3 v3.22.1
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/render v1.0.3
 	github.com/gobwas/ws v1.4.0
-	github.com/gofrs/uuid/v5 v5.3.2
+	github.com/gofrs/uuid/v5 v5.4.0
 	github.com/golang/snappy v1.0.0
 	github.com/insomniacslk/dhcp v0.0.0-20250109001534-8abf58130905
 	github.com/klauspost/compress v1.17.9 // lastest version compatible with golang1.20
 	github.com/mdlayher/netlink v1.7.2
-	github.com/metacubex/amneziawg-go v0.0.0-20250902133113-a7f637c14281
-	github.com/metacubex/bart v0.24.0
+	github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d
+	github.com/metacubex/bart v0.26.0
 	github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b
 	github.com/metacubex/blake3 v0.1.0
 	github.com/metacubex/chacha v0.1.5
 	github.com/metacubex/fswatch v0.1.1
 	github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759
-	github.com/metacubex/kcp-go v0.0.0-20250923001605-1ba6f691c45b
-	github.com/metacubex/quic-go v0.54.1-0.20250730114134-a1ae705fe295
+	github.com/metacubex/kcp-go v0.0.0-20251105084629-8c93f4bf37be
+	github.com/metacubex/quic-go v0.55.1-0.20251024060151-bd465f127128
 	github.com/metacubex/randv2 v0.2.0
 	github.com/metacubex/restls-client-go v0.1.7
 	github.com/metacubex/sing v0.5.6
 	github.com/metacubex/sing-mux v0.3.4
-	github.com/metacubex/sing-quic v0.0.0-20250909002258-06122df8f231
+	github.com/metacubex/sing-quic v0.0.0-20251004051927-c45ee18473bb
 	github.com/metacubex/sing-shadowsocks v0.2.12
 	github.com/metacubex/sing-shadowsocks2 v0.2.7
 	github.com/metacubex/sing-shadowtls v0.0.0-20250503063515-5d9f966d17a2
-	github.com/metacubex/sing-tun v0.4.8
+	github.com/metacubex/sing-tun v0.4.9
 	github.com/metacubex/sing-vmess v0.2.4
 	github.com/metacubex/sing-wireguard v0.0.0-20250503063753-2dc62acc626f
 	github.com/metacubex/smux v0.0.0-20250922175018-15c9a6a78719
-	github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0
-	github.com/metacubex/utls v1.8.1
+	github.com/metacubex/tfo-go v0.0.0-20251024101424-368b42b59148
+	github.com/metacubex/utls v1.8.3
 	github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f
 	github.com/miekg/dns v1.1.63 // lastest version compatible with golang1.20
 	github.com/mroth/weightedrand/v2 v2.1.0
@@ -46,7 +46,7 @@ require (
 	github.com/oschwald/maxminddb-golang v1.12.0 // lastest version compatible with golang1.20
 	github.com/sagernet/cors v1.2.1
 	github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a
-	github.com/samber/lo v1.51.0
+	github.com/samber/lo v1.52.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.11.1
 	github.com/vmihailenco/msgpack/v5 v5.4.1
@@ -105,7 +105,6 @@ require (
 	github.com/vishvananda/netns v0.0.4 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	gitlab.com/yawning/bsaes.git v0.0.0-20190805113838-0a714cd429ec // indirect
-	go.uber.org/mock v0.4.0 // indirect
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.7.0 // indirect

go.sum

@@ -23,10 +23,10 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/ebitengine/purego v0.9.0 h1:mh0zpKBIXDceC63hpvPuGLiJ8ZAa3DfrFTudmfi8A4k=
-github.com/ebitengine/purego v0.9.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/enfein/mieru/v3 v3.20.0 h1:1ob7pCIVSH5FYFAfYvim8isLW1vBOS4cFOUF9exJS38=
-github.com/enfein/mieru/v3 v3.20.0/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/enfein/mieru/v3 v3.22.1 h1:/XGYYXpEhEJlxosmtbpEJkhtRLHB8IToG7LB8kU2ZDY=
+github.com/enfein/mieru/v3 v3.22.1/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358 h1:kXYqH/sL8dS/FdoFjr12ePjnLPorPo2FsnrHNuXSDyo=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358/go.mod h1:hkIFzoiIPZYxdFOOLyDho59b7SrDfo+w3h+yWdlg45I=
 github.com/ericlagergren/polyval v0.0.0-20220411101811-e25bc10ba391 h1:8j2RH289RJplhA6WfdaPqzg1MjH2K8wX5e0uhAxrw2g=
@@ -55,8 +55,8 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
-github.com/gofrs/uuid/v5 v5.3.2 h1:2jfO8j3XgSwlz/wHqemAEugfnTlikAYHhnqQ8Xh4fE0=
-github.com/gofrs/uuid/v5 v5.3.2/go.mod h1:CDOjlDMVAtN56jqyRUZh58JT31Tiw7/oQyEXZV+9bD8=
+github.com/gofrs/uuid/v5 v5.4.0 h1:EfbpCTjqMuGyq5ZJwxqzn3Cbr2d0rUZU7v5ycAk/e/0=
+github.com/gofrs/uuid/v5 v5.4.0/go.mod h1:CDOjlDMVAtN56jqyRUZh58JT31Tiw7/oQyEXZV+9bD8=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
@@ -90,12 +90,12 @@ github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
 github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
-github.com/metacubex/amneziawg-go v0.0.0-20250902133113-a7f637c14281 h1:09EM0sOLb2kfL0KETGhHujsBLB5iy5U/2yHRHsxf/pI=
-github.com/metacubex/amneziawg-go v0.0.0-20250902133113-a7f637c14281/go.mod h1:MsM/5czONyXMJ3PRr5DbQ4O/BxzAnJWOIcJdLzW6qHY=
+github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d h1:vAJ0ZT4aO803F1uw2roIA9yH7Sxzox34tVVyye1bz6c=
+github.com/metacubex/amneziawg-go v0.0.0-20251104174305-5a0e9f7e361d/go.mod h1:MsM/5czONyXMJ3PRr5DbQ4O/BxzAnJWOIcJdLzW6qHY=
 github.com/metacubex/ascon v0.1.0 h1:6ZWxmXYszT1XXtwkf6nxfFhc/OTtQ9R3Vyj1jN32lGM=
 github.com/metacubex/ascon v0.1.0/go.mod h1:eV5oim4cVPPdEL8/EYaTZ0iIKARH9pnhAK/fcT5Kacc=
-github.com/metacubex/bart v0.24.0 h1:EyNiPeVOlg0joSHTzi5oentI0j5M89utUq/5dd76pWM=
-github.com/metacubex/bart v0.24.0/go.mod h1:DCcyfP4MC+Zy7sLK7XeGuMw+P5K9mIRsYOBgiE8icsI=
+github.com/metacubex/bart v0.26.0 h1:d/bBTvVatfVWGfQbiDpYKI1bXUJgjaabB2KpK1Tnk6w=
+github.com/metacubex/bart v0.26.0/go.mod h1:DCcyfP4MC+Zy7sLK7XeGuMw+P5K9mIRsYOBgiE8icsI=
 github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b h1:j7dadXD8I2KTmMt8jg1JcaP1ANL3JEObJPdANKcSYPY=
 github.com/metacubex/bbolt v0.0.0-20250725135710-010dbbbb7a5b/go.mod h1:+WmP0VJZDkDszvpa83HzfUp6QzARl/IKkMorH4+nODw=
 github.com/metacubex/blake3 v0.1.0 h1:KGnjh/56REO7U+cgZA8dnBhxdP7jByrG7hTP+bu6cqY=
@@ -108,12 +108,12 @@ github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 h1:cjd4biTvO
 github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759/go.mod h1:UHOv2xu+RIgLwpXca7TLrXleEd4oR3sPatW6IF8wU88=
 github.com/metacubex/gvisor v0.0.0-20250919004547-6122b699a301 h1:N5GExQJqYAH3gOCshpp2u/J3CtNYzMctmlb0xK9wtbQ=
 github.com/metacubex/gvisor v0.0.0-20250919004547-6122b699a301/go.mod h1:8LpS0IJW1VmWzUm3ylb0e2SK5QDm5lO/2qwWLZgRpBU=
-github.com/metacubex/kcp-go v0.0.0-20250923001605-1ba6f691c45b h1:z7JLKjugnQ1qvDOAD8yMA5C8AlJY3bG+VrrgRntRlUY=
-github.com/metacubex/kcp-go v0.0.0-20250923001605-1ba6f691c45b/go.mod h1:HIJZW4QMhbBqXuqC1ly6Hn0TEYT2SzRw58ns1yGhXTs=
+github.com/metacubex/kcp-go v0.0.0-20251105084629-8c93f4bf37be h1:Y7SigZIqfv/+RIA/D7R6EbB9p+brPRoGOM6zobSmRIM=
+github.com/metacubex/kcp-go v0.0.0-20251105084629-8c93f4bf37be/go.mod h1:HIJZW4QMhbBqXuqC1ly6Hn0TEYT2SzRw58ns1yGhXTs=
 github.com/metacubex/nftables v0.0.0-20250503052935-30a69ab87793 h1:1Qpuy+sU3DmyX9HwI+CrBT/oLNJngvBorR2RbajJcqo=
 github.com/metacubex/nftables v0.0.0-20250503052935-30a69ab87793/go.mod h1:RjRNb4G52yAgfR+Oe/kp9G4PJJ97Fnj89eY1BFO3YyA=
-github.com/metacubex/quic-go v0.54.1-0.20250730114134-a1ae705fe295 h1:8JVlYuE8uSJAvmyCd4TjvDxs57xjb0WxEoaWafK5+qs=
-github.com/metacubex/quic-go v0.54.1-0.20250730114134-a1ae705fe295/go.mod h1:1lktQFtCD17FZliVypbrDHwbsFSsmz2xz2TRXydvB5c=
+github.com/metacubex/quic-go v0.55.1-0.20251024060151-bd465f127128 h1:I1uvJl206/HbkzEAZpLgGkZgUveOZb+P+6oTUj7dN+o=
+github.com/metacubex/quic-go v0.55.1-0.20251024060151-bd465f127128/go.mod h1:1lktQFtCD17FZliVypbrDHwbsFSsmz2xz2TRXydvB5c=
 github.com/metacubex/randv2 v0.2.0 h1:uP38uBvV2SxYfLj53kuvAjbND4RUDfFJjwr4UigMiLs=
 github.com/metacubex/randv2 v0.2.0/go.mod h1:kFi2SzrQ5WuneuoLLCMkABtiBu6VRrMrWFqSPyj2cxY=
 github.com/metacubex/restls-client-go v0.1.7 h1:eCwiXCTQb5WJu9IlgYvDBA1OgrINv58dEe7hcN5H15k=
@@ -123,26 +123,26 @@ github.com/metacubex/sing v0.5.6 h1:mEPDCadsCj3DB8gn+t/EtposlYuALEkExa/LUguw6/c=
 github.com/metacubex/sing v0.5.6/go.mod h1:ypf0mjwlZm0sKdQSY+yQvmsbWa0hNPtkeqyRMGgoN+w=
 github.com/metacubex/sing-mux v0.3.4 h1:tf4r27CIkzaxq9kBlAXQkgMXq2HPp5Mta60Kb4RCZF0=
 github.com/metacubex/sing-mux v0.3.4/go.mod h1:SEJfAuykNj/ozbPqngEYqyggwSr81+L7Nu09NRD5mh4=
-github.com/metacubex/sing-quic v0.0.0-20250909002258-06122df8f231 h1:dGvo7UahC/gYBQNBoictr14baJzBjAKUAorP63QFFtg=
-github.com/metacubex/sing-quic v0.0.0-20250909002258-06122df8f231/go.mod h1:B60FxaPHjR1SeQB0IiLrgwgvKsaoASfOWdiqhLjmMGA=
+github.com/metacubex/sing-quic v0.0.0-20251004051927-c45ee18473bb h1:gxrJmnxuEAel+kh3V7ntqkHjURif0xKDu76nzr/BF5Y=
+github.com/metacubex/sing-quic v0.0.0-20251004051927-c45ee18473bb/go.mod h1:JK4+PYUKps6pnlicKjsSUAjAcvIUjhorIjdNZGg930M=
 github.com/metacubex/sing-shadowsocks v0.2.12 h1:Wqzo8bYXrK5aWqxu/TjlTnYZzAKtKsaFQBdr6IHFaBE=
 github.com/metacubex/sing-shadowsocks v0.2.12/go.mod h1:2e5EIaw0rxKrm1YTRmiMnDulwbGxH9hAFlrwQLQMQkU=
 github.com/metacubex/sing-shadowsocks2 v0.2.7 h1:hSuuc0YpsfiqYqt1o+fP4m34BQz4e6wVj3PPBVhor3A=
 github.com/metacubex/sing-shadowsocks2 v0.2.7/go.mod h1:vOEbfKC60txi0ca+yUlqEwOGc3Obl6cnSgx9Gf45KjE=
 github.com/metacubex/sing-shadowtls v0.0.0-20250503063515-5d9f966d17a2 h1:gXU+MYPm7Wme3/OAY2FFzVq9d9GxPHOqu5AQfg/ddhI=
 github.com/metacubex/sing-shadowtls v0.0.0-20250503063515-5d9f966d17a2/go.mod h1:mbfboaXauKJNIHJYxQRa+NJs4JU9NZfkA+I33dS2+9E=
-github.com/metacubex/sing-tun v0.4.8 h1:3PyiUKWXYi37yHptXskzL1723O3OUdyt0Aej4XHVikM=
-github.com/metacubex/sing-tun v0.4.8/go.mod h1:L/TjQY5JEGy8nvsuYmy/XgMFMCPiF0+AWSFCYfS6r9w=
+github.com/metacubex/sing-tun v0.4.9 h1:jY0Yyt8nnN3yQRN/jTxgqNCmGi1dsFdxdIi7pQUlVVU=
+github.com/metacubex/sing-tun v0.4.9/go.mod h1:L/TjQY5JEGy8nvsuYmy/XgMFMCPiF0+AWSFCYfS6r9w=
 github.com/metacubex/sing-vmess v0.2.4 h1:Tx6AGgCiEf400E/xyDuYyafsel6sGbR8oF7RkAaus6I=
 github.com/metacubex/sing-vmess v0.2.4/go.mod h1:21R5R1u90uUvBQF0owoooEu96/SAYYD56nDrwm6nFaM=
 github.com/metacubex/sing-wireguard v0.0.0-20250503063753-2dc62acc626f h1:Sr/DYKYofKHKc4GF3qkRGNuj6XA6c0eqPgEDN+VAsYU=
 github.com/metacubex/sing-wireguard v0.0.0-20250503063753-2dc62acc626f/go.mod h1:jpAkVLPnCpGSfNyVmj6Cq4YbuZsFepm/Dc+9BAOcR80=
 github.com/metacubex/smux v0.0.0-20250922175018-15c9a6a78719 h1:T6qCCfolRDAVJKeaPW/mXwNLjnlo65AYN7WS2jrBNaM=
 github.com/metacubex/smux v0.0.0-20250922175018-15c9a6a78719/go.mod h1:4bPD8HWx9jPJ9aE4uadgyN7D1/Wz3KmPy+vale8sKLE=
-github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0 h1:Ui+/2s5Qz0lSnDUBmEL12M5Oi/PzvFxGTNohm8ZcsmE=
-github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0/go.mod h1:l9oLnLoEXyGZ5RVLsh7QCC5XsouTUyKk4F2nLm2DHLw=
-github.com/metacubex/utls v1.8.1 h1:RW8GeCGWAegjV0HW5nw9DoqNoeGAXXeYUP6AysmRvx4=
-github.com/metacubex/utls v1.8.1/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
+github.com/metacubex/tfo-go v0.0.0-20251024101424-368b42b59148 h1:Zd0QqciLIhv9MKbGKTPEgN8WUFsgQGA1WJBy6spEnVU=
+github.com/metacubex/tfo-go v0.0.0-20251024101424-368b42b59148/go.mod h1:l9oLnLoEXyGZ5RVLsh7QCC5XsouTUyKk4F2nLm2DHLw=
+github.com/metacubex/utls v1.8.3 h1:0m/yCxm3SK6kWve2lKiFb1pue1wHitJ8sQQD4Ikqde4=
+github.com/metacubex/utls v1.8.3/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
 github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f h1:FGBPRb1zUabhPhDrlKEjQ9lgIwQ6cHL4x8M9lrERhbk=
 github.com/metacubex/wireguard-go v0.0.0-20250820062549-a6cecdd7f57f/go.mod h1:oPGcV994OGJedmmxrcK9+ni7jUEMGhR+uVQAdaduIP4=
 github.com/metacubex/yamux v0.0.0-20250918083631-dd5f17c0be49 h1:lhlqpYHopuTLx9xQt22kSA9HtnyTDmk5XjjQVCGHe2E=
@@ -175,8 +175,8 @@ github.com/sagernet/cors v1.2.1 h1:Cv5Z8y9YSD6Gm+qSpNrL3LO4lD3eQVvbFYJSG7JCMHQ=
 github.com/sagernet/cors v1.2.1/go.mod h1:O64VyOjjhrkLmQIjF4KGRrJO/5dVXFdpEmCW/eISRAI=
 github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a h1:ObwtHN2VpqE0ZNjr6sGeT00J8uU7JF4cNUdb44/Duis=
 github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
-github.com/samber/lo v1.51.0 h1:kysRYLbHy/MB7kQZf5DSN50JHmMsNEdeY24VzJFu7wI=
-github.com/samber/lo v1.51.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
+github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
+github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/sina-ghaderi/poly1305 v0.0.0-20220724002748-c5926b03988b h1:rXHg9GrUEtWZhEkrykicdND3VPjlVbYiLdX9J7gimS8=
 github.com/sina-ghaderi/poly1305 v0.0.0-20220724002748-c5926b03988b/go.mod h1:X7qrxNQViEaAN9LNZOPl9PfvQtp3V3c7LTo0dvGi0fM=
 github.com/sina-ghaderi/rabaead v0.0.0-20220730151906-ab6e06b96e8c h1:DjKMC30y6yjG3IxDaeAj3PCoRr+IsO+bzyT+Se2m2Hk=
@@ -219,7 +219,6 @@ gitlab.com/yawning/bsaes.git v0.0.0-20190805113838-0a714cd429ec/go.mod h1:BZ1RAo
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
-go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

hub/executor/executor.go

@@ -31,7 +31,7 @@ import (
 	"github.com/metacubex/mihomo/component/updater"
 	"github.com/metacubex/mihomo/config"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/dns"
 	"github.com/metacubex/mihomo/listener"
 	authStore "github.com/metacubex/mihomo/listener/auth"
@@ -39,7 +39,7 @@ import (
 	"github.com/metacubex/mihomo/listener/inner"
 	"github.com/metacubex/mihomo/listener/tproxy"
 	"github.com/metacubex/mihomo/log"
-	"github.com/metacubex/mihomo/ntp"
+	"github.com/metacubex/mihomo/ntp/ntp"
 	"github.com/metacubex/mihomo/tunnel"
 )
 
@@ -240,20 +240,19 @@ func updateDNS(c *config.DNS, generalIPv6 bool) {
 	if !c.Enable {
 		resolver.DefaultResolver = nil
 		resolver.DefaultHostMapper = nil
-		resolver.DefaultLocalServer = nil
+		resolver.DefaultService = nil
 		resolver.ProxyServerHostResolver = nil
 		resolver.DirectHostResolver = nil
-		dns.ReCreateServer("", nil, nil)
+		dns.ReCreateServer("", nil)
 		return
 	}
-	cfg := dns.Config{
+
+	ipv6 := c.IPv6 && generalIPv6
+	r := dns.NewResolver(dns.Config{
 		Main:                 c.NameServer,
 		Fallback:             c.Fallback,
-		IPv6:                 c.IPv6 && generalIPv6,
+		IPv6:                 ipv6,
 		IPv6Timeout:          c.IPv6Timeout,
-		EnhancedMode:         c.EnhancedMode,
-		Pool:                 c.FakeIPRange,
-		Hosts:                c.Hosts,
 		FallbackIPFilter:     c.FallbackIPFilter,
 		FallbackDomainFilter: c.FallbackDomainFilter,
 		Default:              c.DefaultNameserver,
@@ -263,19 +262,26 @@ func updateDNS(c *config.DNS, generalIPv6 bool) {
 		DirectFollowPolicy:   c.DirectFollowPolicy,
 		CacheAlgorithm:       c.CacheAlgorithm,
 		CacheMaxSize:         c.CacheMaxSize,
-	}
-
-	r := dns.NewResolver(cfg)
-	m := dns.NewEnhancer(cfg)
+	})
+	m := dns.NewEnhancer(dns.EnhancerConfig{
+		IPv6:          ipv6,
+		EnhancedMode:  c.EnhancedMode,
+		FakeIPPool:    c.FakeIPPool,
+		FakeIPPool6:   c.FakeIPPool6,
+		FakeIPSkipper: c.FakeIPSkipper,
+		UseHosts:      c.UseHosts,
+	})
 
 	// reuse cache of old host mapper
 	if old := resolver.DefaultHostMapper; old != nil {
 		m.PatchFrom(old.(*dns.ResolverEnhancer))
 	}
 
+	s := dns.NewService(r.Resolver, m)
+
 	resolver.DefaultResolver = r
 	resolver.DefaultHostMapper = m
-	resolver.DefaultLocalServer = dns.NewLocalServer(r.Resolver, m)
+	resolver.DefaultService = s
 	resolver.UseSystemHosts = c.UseSystemHosts
 
 	if r.ProxyResolver.Invalid() {
@@ -290,25 +296,25 @@ func updateDNS(c *config.DNS, generalIPv6 bool) {
 		resolver.DirectHostResolver = r.Resolver
 	}
 
-	dns.ReCreateServer(c.Listen, r.Resolver, m)
+	dns.ReCreateServer(c.Listen, s)
 }
 
 func updateHosts(tree *trie.DomainTrie[resolver.HostValue]) {
 	resolver.DefaultHosts = resolver.NewHosts(tree)
 }
 
-func updateProxies(proxies map[string]C.Proxy, providers map[string]provider.ProxyProvider) {
+func updateProxies(proxies map[string]C.Proxy, providers map[string]P.ProxyProvider) {
 	tunnel.UpdateProxies(proxies, providers)
 }
 
-func updateRules(rules []C.Rule, subRules map[string][]C.Rule, ruleProviders map[string]provider.RuleProvider) {
+func updateRules(rules []C.Rule, subRules map[string][]C.Rule, ruleProviders map[string]P.RuleProvider) {
 	tunnel.UpdateRules(rules, subRules, ruleProviders)
 }
 
-func loadProvider[P provider.Provider](providers map[string]P) {
-	load := func(pv P) {
+func loadProvider[T P.Provider](providers map[string]T) {
+	load := func(pv T) {
 		name := pv.Name()
-		if pv.VehicleType() == provider.Compatible {
+		if pv.VehicleType() == P.Compatible {
 			log.Infoln("Start initial compatible provider %s", name)
 		} else {
 			log.Infoln("Start initial provider %s", name)
@@ -316,11 +322,11 @@ func loadProvider[P provider.Provider](providers map[string]P) {
 
 		if err := pv.Initial(); err != nil {
 			switch pv.Type() {
-			case provider.Proxy:
+			case P.Proxy:
 				{
 					log.Errorln("initial proxy provider %s error: %v", name, err)
 				}
-			case provider.Rule:
+			case P.Rule:
 				{
 					log.Errorln("initial rule provider %s error: %v", name, err)
 				}

hub/route/configs.go

@@ -13,7 +13,7 @@ import (
 	"github.com/metacubex/mihomo/config"
 	C "github.com/metacubex/mihomo/constant"
 	"github.com/metacubex/mihomo/hub/executor"
-	P "github.com/metacubex/mihomo/listener"
+	"github.com/metacubex/mihomo/listener"
 	LC "github.com/metacubex/mihomo/listener/config"
 	"github.com/metacubex/mihomo/log"
 	"github.com/metacubex/mihomo/tunnel"
@@ -306,7 +306,7 @@ func patchConfigs(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if general.AllowLan != nil {
-		P.SetAllowLan(*general.AllowLan)
+		listener.SetAllowLan(*general.AllowLan)
 	}
 
 	if general.SkipAuthPrefixes != nil {
@@ -322,7 +322,7 @@ func patchConfigs(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if general.BindAddress != nil {
-		P.SetBindAddress(*general.BindAddress)
+		listener.SetBindAddress(*general.BindAddress)
 	}
 
 	if general.Sniffing != nil {
@@ -337,17 +337,17 @@ func patchConfigs(w http.ResponseWriter, r *http.Request) {
 		dialer.DefaultInterface.Store(*general.InterfaceName)
 	}
 
-	ports := P.GetPorts()
+	ports := listener.GetPorts()
 
-	P.ReCreateHTTP(pointerOrDefault(general.Port, ports.Port), tunnel.Tunnel)
-	P.ReCreateSocks(pointerOrDefault(general.SocksPort, ports.SocksPort), tunnel.Tunnel)
-	P.ReCreateRedir(pointerOrDefault(general.RedirPort, ports.RedirPort), tunnel.Tunnel)
-	P.ReCreateTProxy(pointerOrDefault(general.TProxyPort, ports.TProxyPort), tunnel.Tunnel)
-	P.ReCreateMixed(pointerOrDefault(general.MixedPort, ports.MixedPort), tunnel.Tunnel)
-	P.ReCreateTun(pointerOrDefaultTun(general.Tun, P.LastTunConf), tunnel.Tunnel)
-	P.ReCreateShadowSocks(pointerOrDefault(general.ShadowSocksConfig, ports.ShadowSocksConfig), tunnel.Tunnel)
-	P.ReCreateVmess(pointerOrDefault(general.VmessConfig, ports.VmessConfig), tunnel.Tunnel)
-	P.ReCreateTuic(pointerOrDefaultTuicServer(general.TuicServer, P.LastTuicConf), tunnel.Tunnel)
+	listener.ReCreateHTTP(pointerOrDefault(general.Port, ports.Port), tunnel.Tunnel)
+	listener.ReCreateSocks(pointerOrDefault(general.SocksPort, ports.SocksPort), tunnel.Tunnel)
+	listener.ReCreateRedir(pointerOrDefault(general.RedirPort, ports.RedirPort), tunnel.Tunnel)
+	listener.ReCreateTProxy(pointerOrDefault(general.TProxyPort, ports.TProxyPort), tunnel.Tunnel)
+	listener.ReCreateMixed(pointerOrDefault(general.MixedPort, ports.MixedPort), tunnel.Tunnel)
+	listener.ReCreateTun(pointerOrDefaultTun(general.Tun, listener.LastTunConf), tunnel.Tunnel)
+	listener.ReCreateShadowSocks(pointerOrDefault(general.ShadowSocksConfig, ports.ShadowSocksConfig), tunnel.Tunnel)
+	listener.ReCreateVmess(pointerOrDefault(general.VmessConfig, ports.VmessConfig), tunnel.Tunnel)
+	listener.ReCreateTuic(pointerOrDefaultTuicServer(general.TuicServer, listener.LastTuicConf), tunnel.Tunnel)
 
 	if general.Mode != nil {
 		tunnel.SetMode(*general.Mode)

hub/route/provider.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	"github.com/metacubex/mihomo/tunnel"
 
 	"github.com/go-chi/chi/v5"
@@ -45,12 +45,12 @@ func getProviders(w http.ResponseWriter, r *http.Request) {
 }
 
 func getProvider(w http.ResponseWriter, r *http.Request) {
-	provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	provider := r.Context().Value(CtxKeyProvider).(P.ProxyProvider)
 	render.JSON(w, r, provider)
 }
 
 func updateProvider(w http.ResponseWriter, r *http.Request) {
-	provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	provider := r.Context().Value(CtxKeyProvider).(P.ProxyProvider)
 	if err := provider.Update(); err != nil {
 		render.Status(r, http.StatusServiceUnavailable)
 		render.JSON(w, r, newError(err.Error()))
@@ -60,7 +60,7 @@ func updateProvider(w http.ResponseWriter, r *http.Request) {
 }
 
 func healthCheckProvider(w http.ResponseWriter, r *http.Request) {
-	provider := r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+	provider := r.Context().Value(CtxKeyProvider).(P.ProxyProvider)
 	provider.HealthCheck()
 	render.NoContent(w, r)
 }
@@ -93,7 +93,7 @@ func findProviderProxyByName(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		var (
 			name = r.Context().Value(CtxKeyProxyName).(string)
-			pd   = r.Context().Value(CtxKeyProvider).(provider.ProxyProvider)
+			pd   = r.Context().Value(CtxKeyProvider).(P.ProxyProvider)
 		)
 		proxy, exist := lo.Find(pd.Proxies(), func(proxy C.Proxy) bool {
 			return proxy.Name() == name
@@ -128,7 +128,7 @@ func getRuleProviders(w http.ResponseWriter, r *http.Request) {
 }
 
 func updateRuleProvider(w http.ResponseWriter, r *http.Request) {
-	provider := r.Context().Value(CtxKeyProvider).(provider.RuleProvider)
+	provider := r.Context().Value(CtxKeyProvider).(P.RuleProvider)
 	if err := provider.Update(); err != nil {
 		render.Status(r, http.StatusServiceUnavailable)
 		render.JSON(w, r, newError(err.Error()))

listener/inbound/mieru.go

@@ -0,0 +1,181 @@
+package inbound
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync"
+
+	"github.com/metacubex/mihomo/adapter/inbound"
+	"github.com/metacubex/mihomo/common/utils"
+	C "github.com/metacubex/mihomo/constant"
+	"github.com/metacubex/mihomo/listener/mieru"
+	"github.com/metacubex/mihomo/log"
+	"google.golang.org/protobuf/proto"
+
+	mieruserver "github.com/enfein/mieru/v3/apis/server"
+	mierupb "github.com/enfein/mieru/v3/pkg/appctl/appctlpb"
+)
+
+type Mieru struct {
+	*Base
+	option *MieruOption
+	server mieruserver.Server
+	mu     sync.Mutex
+}
+
+type MieruOption struct {
+	BaseOption
+	Transport string            `inbound:"transport"`
+	Users     map[string]string `inbound:"users"`
+}
+
+type mieruListenerFactory struct{}
+
+func (mieruListenerFactory) Listen(ctx context.Context, network, address string) (net.Listener, error) {
+	return inbound.ListenContext(ctx, network, address)
+}
+
+func (mieruListenerFactory) ListenPacket(ctx context.Context, network, address string) (net.PacketConn, error) {
+	return inbound.ListenPacketContext(ctx, network, address)
+}
+
+func NewMieru(option *MieruOption) (*Mieru, error) {
+	base, err := NewBase(&option.BaseOption)
+	if err != nil {
+		return nil, err
+	}
+
+	config, err := buildMieruServerConfig(option, base.ports)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build mieru server config: %w", err)
+	}
+	s := mieruserver.NewServer()
+	if err := s.Store(config); err != nil {
+		return nil, fmt.Errorf("failed to store mieru server config: %w", err)
+	}
+	// Server is started lazily when Listen() is called for the first time.
+	return &Mieru{
+		Base:   base,
+		option: option,
+		server: s,
+	}, nil
+}
+
+func (m *Mieru) Config() C.InboundConfig {
+	return m.option
+}
+
+func (m *Mieru) Listen(tunnel C.Tunnel) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if !m.server.IsRunning() {
+		if err := m.server.Start(); err != nil {
+			return fmt.Errorf("failed to start mieru server: %w", err)
+		}
+	}
+
+	additions := m.config.Additions()
+	if len(additions) == 0 {
+		additions = []inbound.Addition{
+			inbound.WithInName("DEFAULT-MIERU"),
+			inbound.WithSpecialRules(""),
+		}
+	}
+
+	go func() {
+		for {
+			c, req, err := m.server.Accept()
+			if err != nil {
+				if !m.server.IsRunning() {
+					break
+				}
+			}
+			go mieru.Handle(c, tunnel, req, additions...)
+		}
+	}()
+	log.Infoln("Mieru[%s] proxy listening at: %s", m.Name(), m.Address())
+	return nil
+}
+
+func (m *Mieru) Close() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.server.IsRunning() {
+		return m.server.Stop()
+	}
+
+	return nil
+}
+
+var _ C.InboundListener = (*Mieru)(nil)
+
+func (o MieruOption) Equal(config C.InboundConfig) bool {
+	return optionToString(o) == optionToString(config)
+}
+
+func buildMieruServerConfig(option *MieruOption, ports utils.IntRanges[uint16]) (*mieruserver.ServerConfig, error) {
+	if err := validateMieruOption(option); err != nil {
+		return nil, fmt.Errorf("failed to validate mieru option: %w", err)
+	}
+	if len(ports) == 0 {
+		return nil, fmt.Errorf("port is not set")
+	}
+
+	var transportProtocol *mierupb.TransportProtocol
+	switch option.Transport {
+	case "TCP":
+		transportProtocol = mierupb.TransportProtocol_TCP.Enum()
+	case "UDP":
+		transportProtocol = mierupb.TransportProtocol_UDP.Enum()
+	}
+	var portBindings []*mierupb.PortBinding
+	for _, portRange := range ports {
+		if portRange.Start() == portRange.End() {
+			portBindings = append(portBindings, &mierupb.PortBinding{
+				Port:     proto.Int32(int32(portRange.Start())),
+				Protocol: transportProtocol,
+			})
+		} else {
+			portBindings = append(portBindings, &mierupb.PortBinding{
+				PortRange: proto.String(fmt.Sprintf("%d-%d", portRange.Start(), portRange.End())),
+				Protocol:  transportProtocol,
+			})
+		}
+	}
+	var users []*mierupb.User
+	for username, password := range option.Users {
+		users = append(users, &mierupb.User{
+			Name:     proto.String(username),
+			Password: proto.String(password),
+		})
+	}
+	return &mieruserver.ServerConfig{
+		Config: &mierupb.ServerConfig{
+			PortBindings: portBindings,
+			Users:        users,
+		},
+		StreamListenerFactory: mieruListenerFactory{},
+		PacketListenerFactory: mieruListenerFactory{},
+	}, nil
+}
+
+func validateMieruOption(option *MieruOption) error {
+	if option.Transport != "TCP" && option.Transport != "UDP" {
+		return fmt.Errorf("transport must be TCP or UDP")
+	}
+	if len(option.Users) == 0 {
+		return fmt.Errorf("users is empty")
+	}
+	for username, password := range option.Users {
+		if username == "" {
+			return fmt.Errorf("username is empty")
+		}
+		if password == "" {
+			return fmt.Errorf("password is empty")
+		}
+	}
+	return nil
+}

listener/inbound/mieru_test.go

@@ -0,0 +1,212 @@
+package inbound_test
+
+import (
+	"net"
+	"net/netip"
+	"strconv"
+	"testing"
+
+	"github.com/metacubex/mihomo/adapter/outbound"
+	"github.com/metacubex/mihomo/listener/inbound"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewMieru(t *testing.T) {
+	type args struct {
+		option *inbound.MieruOption
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{
+			name: "valid with port",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Transport: "TCP",
+					Users:     map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid with port range",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8090-8099",
+					},
+					Transport: "UDP",
+					Users:     map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid mix of port and port-range",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080,8090-8099",
+					},
+					Transport: "TCP",
+					Users:     map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid - no port",
+			args: args{
+				option: &inbound.MieruOption{
+					Transport: "TCP",
+					Users:     map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid - transport",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Transport: "INVALID",
+					Users:     map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid - no transport",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Users: map[string]string{"user": "pass"},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid - no users",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Transport: "TCP",
+					Users:     map[string]string{},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid - empty username",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Transport: "TCP",
+					Users:     map[string]string{"": "pass"},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid - empty password",
+			args: args{
+				option: &inbound.MieruOption{
+					BaseOption: inbound.BaseOption{
+						Port: "8080",
+					},
+					Transport: "TCP",
+					Users:     map[string]string{"user": ""},
+				},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := inbound.NewMieru(tt.args.option)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NewMieru() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if err == nil {
+				got.Close()
+			}
+		})
+	}
+}
+
+func TestInboundMieru(t *testing.T) {
+	t.Run("HANDSHAKE_STANDARD", func(t *testing.T) {
+		testInboundMieruTCP(t, "HANDSHAKE_STANDARD")
+	})
+	t.Run("HANDSHAKE_NO_WAIT", func(t *testing.T) {
+		testInboundMieruTCP(t, "HANDSHAKE_NO_WAIT")
+	})
+}
+
+func testInboundMieruTCP(t *testing.T, handshakeMode string) {
+	t.Parallel()
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if !assert.NoError(t, err) {
+		return
+	}
+	port := l.Addr().(*net.TCPAddr).Port
+	l.Close()
+
+	inboundOptions := inbound.MieruOption{
+		BaseOption: inbound.BaseOption{
+			NameStr: "mieru_inbound",
+			Listen:  "127.0.0.1",
+			Port:    strconv.Itoa(port),
+		},
+		Transport: "TCP",
+		Users:     map[string]string{"test": "password"},
+	}
+	in, err := inbound.NewMieru(&inboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+
+	tunnel := NewHttpTestTunnel()
+	defer tunnel.Close()
+
+	err = in.Listen(tunnel)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer in.Close()
+
+	addrPort, err := netip.ParseAddrPort(in.Address())
+	if !assert.NoError(t, err) {
+		return
+	}
+	outboundOptions := outbound.MieruOption{
+		Name:          "mieru_outbound",
+		Server:        addrPort.Addr().String(),
+		Port:          int(addrPort.Port()),
+		Transport:     "TCP",
+		UserName:      "test",
+		Password:      "password",
+		HandshakeMode: handshakeMode,
+	}
+	out, err := outbound.NewMieru(outboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer out.Close()
+
+	tunnel.DoTest(t, out)
+}

listener/mieru/server.go

@@ -0,0 +1,124 @@
+package mieru
+
+import (
+	"errors"
+	"io"
+	"net"
+	"net/netip"
+
+	"github.com/metacubex/mihomo/adapter/inbound"
+	N "github.com/metacubex/mihomo/common/net"
+	C "github.com/metacubex/mihomo/constant"
+	"github.com/metacubex/mihomo/transport/socks5"
+
+	mierucommon "github.com/enfein/mieru/v3/apis/common"
+	mieruconstant "github.com/enfein/mieru/v3/apis/constant"
+	mierumodel "github.com/enfein/mieru/v3/apis/model"
+)
+
+func Handle(conn net.Conn, tunnel C.Tunnel, request *mierumodel.Request, additions ...inbound.Addition) {
+	// Return a fake response to the client.
+	resp := &mierumodel.Response{
+		Reply: mieruconstant.Socks5ReplySuccess,
+		BindAddr: mierumodel.AddrSpec{
+			IP:   net.IPv4zero,
+			Port: 0,
+		},
+	}
+	if err := resp.WriteToSocks5(conn); err != nil {
+		conn.Close()
+		return
+	}
+
+	// Handle the connection with tunnel.
+	metadata := mieruRequestToMetadata(request)
+	inbound.ApplyAdditions(&metadata, additions...)
+	switch metadata.NetWork {
+	case C.TCP:
+		tunnel.HandleTCPConn(conn, &metadata)
+	case C.UDP:
+		pc := mierucommon.NewPacketOverStreamTunnel(conn)
+		ep := N.NewEnhancePacketConn(pc)
+		for {
+			data, put, addr, err := ep.WaitReadFrom()
+			if err != nil {
+				if put != nil {
+					// Unresolved UDP packet, return buffer to the pool.
+					put()
+				}
+				// mieru returns EOF or ErrUnexpectedEOF when a session is closed.
+				if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) || errors.Is(err, io.ErrClosedPipe) {
+					break
+				}
+				continue
+			}
+			target, payload, err := socks5.DecodeUDPPacket(data)
+			if err != nil {
+				return
+			}
+			packet := &packet{
+				pc:      ep,
+				addr:    addr,
+				payload: payload,
+				put:     put,
+			}
+			tunnel.HandleUDPPacket(inbound.NewPacket(target, packet, C.MIERU, additions...))
+		}
+	}
+}
+
+func mieruRequestToMetadata(request *mierumodel.Request) C.Metadata {
+	m := C.Metadata{
+		DstPort: uint16(request.DstAddr.Port),
+	}
+	switch request.Command {
+	case mieruconstant.Socks5ConnectCmd:
+		m.NetWork = C.TCP
+	case mieruconstant.Socks5UDPAssociateCmd:
+		m.NetWork = C.UDP
+	}
+	if request.DstAddr.FQDN != "" {
+		m.Host = request.DstAddr.FQDN
+	} else if request.DstAddr.IP != nil {
+		m.DstIP, _ = netip.AddrFromSlice(request.DstAddr.IP)
+	}
+	return m
+}
+
+type packet struct {
+	pc      net.PacketConn
+	addr    net.Addr // source (i.e. remote) IP & Port of the packet
+	payload []byte
+	put     func()
+}
+
+var _ C.UDPPacket = (*packet)(nil)
+var _ C.UDPPacketInAddr = (*packet)(nil)
+
+func (c *packet) Data() []byte {
+	return c.payload
+}
+
+func (c *packet) WriteBack(b []byte, addr net.Addr) (n int, err error) {
+	packet, err := socks5.EncodeUDPPacket(socks5.ParseAddrToSocksAddr(addr), b)
+	if err != nil {
+		return
+	}
+	return c.pc.WriteTo(packet, c.addr)
+}
+
+func (c *packet) Drop() {
+	if c.put != nil {
+		c.put()
+		c.put = nil
+	}
+	c.payload = nil
+}
+
+func (c *packet) LocalAddr() net.Addr {
+	return c.addr
+}
+
+func (c *packet) InAddr() net.Addr {
+	return c.pc.LocalAddr()
+}

listener/parse.go

@@ -127,6 +127,13 @@ func ParseListener(mapping map[string]any) (C.InboundListener, error) {
 			return nil, err
 		}
 		listener, err = IN.NewAnyTLS(anytlsOption)
+	case "mieru":
+		mieruOption := &IN.MieruOption{}
+		err = decoder.Decode(mapping, mieruOption)
+		if err != nil {
+			return nil, err
+		}
+		listener, err = IN.NewMieru(mieruOption)
 	default:
 		return nil, fmt.Errorf("unsupport proxy type: %s", proxyType)
 	}

listener/sing_tun/server.go

@@ -18,7 +18,7 @@ import (
 	"github.com/metacubex/mihomo/component/iface"
 	"github.com/metacubex/mihomo/component/resolver"
 	C "github.com/metacubex/mihomo/constant"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	LC "github.com/metacubex/mihomo/listener/config"
 	"github.com/metacubex/mihomo/listener/sing"
 	"github.com/metacubex/mihomo/log"
@@ -133,7 +133,7 @@ func New(options LC.Tun, tunnel C.Tunnel, additions ...inbound.Addition) (l *Lis
 		}
 	}
 	ctx := context.TODO()
-	rpTunnel := tunnel.(provider.Tunnel)
+	rpTunnel := tunnel.(P.Tunnel)
 	if options.GSOMaxSize == 0 {
 		options.GSOMaxSize = 65536
 	}
@@ -504,7 +504,7 @@ func New(options LC.Tun, tunnel C.Tunnel, additions ...inbound.Addition) (l *Lis
 	return
 }
 
-func (l *Listener) ruleUpdateCallback(ruleProvider provider.RuleProvider) {
+func (l *Listener) ruleUpdateCallback(ruleProvider P.RuleProvider) {
 	name := ruleProvider.Name()
 	if slices.Contains(l.options.RouteAddressSet, name) {
 		l.updateRule(ruleProvider, false, true)
@@ -520,7 +520,7 @@ type toIpCidr interface {
 	ToIpCidr() *netipx.IPSet
 }
 
-func (l *Listener) updateRule(ruleProvider provider.RuleProvider, exclude bool, update bool) {
+func (l *Listener) updateRule(ruleProvider P.RuleProvider, exclude bool, update bool) {
 	l.ruleUpdateMutex.Lock()
 	defer l.ruleUpdateMutex.Unlock()
 	name := ruleProvider.Name()

ntp/ntp/service.go

@@ -3,18 +3,18 @@ package ntp
 import (
 	"context"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"github.com/metacubex/mihomo/component/dialer"
 	"github.com/metacubex/mihomo/component/proxydialer"
 	"github.com/metacubex/mihomo/log"
+	mihomoNtp "github.com/metacubex/mihomo/ntp"
 
 	M "github.com/metacubex/sing/common/metadata"
 	"github.com/metacubex/sing/common/ntp"
 )
 
-var globalSrv atomic.Pointer[Service]
+var globalSrv *Service
 var globalMu sync.Mutex
 
 type Service struct {
@@ -23,21 +23,20 @@ type Service struct {
 	ticker         *time.Ticker
 	ctx            context.Context
 	cancel         context.CancelFunc
-	offset         atomic.Int64 // [time.Duration]
 	syncSystemTime bool
 }
 
 func ReCreateNTPService(server string, interval time.Duration, dialerProxy string, syncSystemTime bool) {
 	globalMu.Lock()
 	defer globalMu.Unlock()
-	if service := globalSrv.Swap(nil); service != nil {
-		service.Stop()
+	if globalSrv != nil {
+		globalSrv.Stop()
 	}
 	if server == "" || interval <= 0 {
 		return
 	}
 	ctx, cancel := context.WithCancel(context.Background())
-	service := &Service{
+	globalSrv = &Service{
 		server:         M.ParseSocksaddr(server),
 		dialer:         proxydialer.NewByNameSingDialer(dialerProxy, dialer.NewDialer()),
 		ticker:         time.NewTicker(interval * time.Minute),
@@ -45,8 +44,7 @@ func ReCreateNTPService(server string, interval time.Duration, dialerProxy strin
 		cancel:         cancel,
 		syncSystemTime: syncSystemTime,
 	}
-	service.Start()
-	globalSrv.Store(service)
+	globalSrv.Start()
 }
 
 func (srv *Service) Start() {
@@ -59,10 +57,6 @@ func (srv *Service) Stop() {
 	srv.cancel()
 }
 
-func (srv *Service) Offset() time.Duration {
-	return time.Duration(srv.offset.Load())
-}
-
 func (srv *Service) update() error {
 	var response *ntp.Response
 	var err error
@@ -80,7 +74,7 @@ func (srv *Service) update() error {
 		} else if offset < time.Duration(0) {
 			log.Infoln("System clock is behind NTP time by %s", -offset)
 		}
-		srv.offset.Store(int64(offset))
+		mihomoNtp.SetOffset(offset)
 		if srv.syncSystemTime {
 			timeNow := response.Time
 			syncErr := setSystemTime(timeNow)
@@ -97,7 +91,7 @@ func (srv *Service) update() error {
 }
 
 func (srv *Service) loopUpdate() {
-	defer srv.offset.Store(0)
+	defer mihomoNtp.SetOffset(0)
 	defer srv.ticker.Stop()
 	for {
 		err := srv.update()
@@ -111,13 +105,3 @@ func (srv *Service) loopUpdate() {
 		}
 	}
 }
-
-func Now() time.Time {
-	now := time.Now()
-	if service := globalSrv.Load(); service != nil {
-		if offset := service.Offset(); offset.Abs() > 0 {
-			now = now.Add(offset)
-		}
-	}
-	return now
-}

ntp/time.go

@@ -0,0 +1,28 @@
+// Package ntp provide time.Now
+//
+// DON'T import other package in mihomo to keep minimal internal dependencies
+package ntp
+
+import (
+	"time"
+
+	"sync/atomic"
+)
+
+var _offset atomic.Int64 // [time.Duration]
+
+func SetOffset(offset time.Duration) {
+	_offset.Store(int64(offset))
+}
+
+func GetOffset() time.Duration {
+	return time.Duration(_offset.Load())
+}
+
+func Now() time.Time {
+	now := time.Now()
+	if offset := GetOffset(); offset != 0 {
+		now = now.Add(offset)
+	}
+	return now
+}

rules/provider/mrs_converter.go

@@ -34,7 +34,7 @@ func ConvertToMrs(buf []byte, behavior P.RuleBehavior, format P.RuleFormat, w io
 		}
 
 		var encoder *zstd.Encoder
-		encoder, err = zstd.NewWriter(w, zstd.WithEncoderLevel(zstd.SpeedBestCompression))
+		encoder, err = zstd.NewWriter(w)
 		if err != nil {
 			return err
 		}

transport/hysteria/congestion/brutal.go

@@ -2,6 +2,8 @@ package congestion
 
 import (
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
+
 	"time"
 )
 
@@ -47,11 +49,11 @@ func (b *BrutalSender) SetRTTStatsProvider(rttStats congestion.RTTStatsProvider)
 	b.rttStats = rttStats
 }
 
-func (b *BrutalSender) TimeUntilSend(bytesInFlight congestion.ByteCount) time.Time {
+func (b *BrutalSender) TimeUntilSend(bytesInFlight congestion.ByteCount) monotime.Time {
 	return b.pacer.TimeUntilSend()
 }
 
-func (b *BrutalSender) HasPacingBudget(now time.Time) bool {
+func (b *BrutalSender) HasPacingBudget(now monotime.Time) bool {
 	return b.pacer.Budget(now) >= b.maxDatagramSize
 }
 
@@ -67,13 +69,13 @@ func (b *BrutalSender) GetCongestionWindow() congestion.ByteCount {
 	return congestion.ByteCount(float64(b.bps) * rtt.Seconds() * 1.5 / b.ackRate)
 }
 
-func (b *BrutalSender) OnPacketSent(sentTime time.Time, bytesInFlight congestion.ByteCount,
+func (b *BrutalSender) OnPacketSent(sentTime monotime.Time, bytesInFlight congestion.ByteCount,
 	packetNumber congestion.PacketNumber, bytes congestion.ByteCount, isRetransmittable bool) {
 	b.pacer.SentPacket(sentTime, bytes)
 }
 
 func (b *BrutalSender) OnPacketAcked(number congestion.PacketNumber, ackedBytes congestion.ByteCount,
-	priorInFlight congestion.ByteCount, eventTime time.Time) {
+	priorInFlight congestion.ByteCount, eventTime monotime.Time) {
 	// Stub
 }
 
@@ -82,8 +84,8 @@ func (b *BrutalSender) OnCongestionEvent(number congestion.PacketNumber, lostByt
 	// Stub
 }
 
-func (b *BrutalSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime time.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
-	currentTimestamp := eventTime.Unix()
+func (b *BrutalSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime monotime.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
+	currentTimestamp := int64(eventTime)
 	slot := currentTimestamp % pktInfoSlotCount
 	if b.pktInfoSlots[slot].Timestamp == currentTimestamp {
 		b.pktInfoSlots[slot].LossCount += uint64(len(lostPackets))

transport/hysteria/congestion/pacer.go

@@ -2,6 +2,8 @@ package congestion
 
 import (
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
+
 	"math"
 	"time"
 )
@@ -15,7 +17,7 @@ const (
 type pacer struct {
 	budgetAtLastSent congestion.ByteCount
 	maxDatagramSize  congestion.ByteCount
-	lastSentTime     time.Time
+	lastSentTime     monotime.Time
 	getBandwidth     func() congestion.ByteCount // in bytes/s
 }
 
@@ -28,7 +30,7 @@ func newPacer(getBandwidth func() congestion.ByteCount) *pacer {
 	return p
 }
 
-func (p *pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
+func (p *pacer) SentPacket(sendTime monotime.Time, size congestion.ByteCount) {
 	budget := p.Budget(sendTime)
 	if size > budget {
 		p.budgetAtLastSent = 0
@@ -38,7 +40,7 @@ func (p *pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
 	p.lastSentTime = sendTime
 }
 
-func (p *pacer) Budget(now time.Time) congestion.ByteCount {
+func (p *pacer) Budget(now monotime.Time) congestion.ByteCount {
 	if p.lastSentTime.IsZero() {
 		return p.maxBurstSize()
 	}
@@ -54,10 +56,10 @@ func (p *pacer) maxBurstSize() congestion.ByteCount {
 }
 
 // TimeUntilSend returns when the next packet should be sent.
-// It returns the zero value of time.Time if a packet can be sent immediately.
-func (p *pacer) TimeUntilSend() time.Time {
+// It returns the zero value of monotime.Time if a packet can be sent immediately.
+func (p *pacer) TimeUntilSend() monotime.Time {
 	if p.budgetAtLastSent >= p.maxDatagramSize {
-		return time.Time{}
+		return monotime.Time(0)
 	}
 	return p.lastSentTime.Add(maxDuration(
 		minPacingDelay,

transport/trojan/trojan.go

@@ -183,7 +183,11 @@ func (pc *PacketConn) WaitReadFrom() (data []byte, put func(), addr net.Addr, er
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	addr = destination.UDPAddr()
+	udpAddr := destination.UDPAddr()
+	if udpAddr == nil {
+		return nil, nil, nil, errors.New("parse addr error")
+	}
+	addr = udpAddr
 
 	data = pool.Get(pool.UDPBufferSize)
 	put = func() {

transport/tuic/common/congestion.go

@@ -21,7 +21,6 @@ func SetCongestionController(quicConn *quic.Conn, cc string, cwnd int) {
 	case "cubic":
 		quicConn.SetCongestionControl(
 			congestion.NewCubicSender(
-				congestion.DefaultClock{},
 				congestion.GetInitialPacketSize(quicConn),
 				false,
 			),
@@ -29,7 +28,6 @@ func SetCongestionController(quicConn *quic.Conn, cc string, cwnd int) {
 	case "new_reno":
 		quicConn.SetCongestionControl(
 			congestion.NewCubicSender(
-				congestion.DefaultClock{},
 				congestion.GetInitialPacketSize(quicConn),
 				true,
 			),
@@ -37,7 +35,6 @@ func SetCongestionController(quicConn *quic.Conn, cc string, cwnd int) {
 	case "bbr_meta_v1":
 		quicConn.SetCongestionControl(
 			congestion.NewBBRSender(
-				congestion.DefaultClock{},
 				congestion.GetInitialPacketSize(quicConn),
 				c.ByteCount(cwnd)*congestion.InitialMaxDatagramSize,
 				congestion.DefaultBBRMaxCongestionWindow*congestion.InitialMaxDatagramSize,
@@ -48,7 +45,6 @@ func SetCongestionController(quicConn *quic.Conn, cc string, cwnd int) {
 	case "bbr":
 		quicConn.SetCongestionControl(
 			congestionv2.NewBbrSender(
-				congestionv2.DefaultClock{},
 				congestionv2.GetInitialPacketSize(quicConn),
 				c.ByteCount(cwnd),
 			),

transport/tuic/congestion/bandwidth_sampler.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 var (
@@ -36,7 +37,7 @@ type SendTimeState struct {
 type ConnectionStateOnSentPacket struct {
 	packetNumber congestion.PacketNumber
 	// Time at which the packet is sent.
-	sendTime time.Time
+	sendTime monotime.Time
 	// Size of the packet.
 	size congestion.ByteCount
 	// The value of |totalBytesSentAtLastAckedPacket| at the time the
@@ -44,10 +45,10 @@ type ConnectionStateOnSentPacket struct {
 	totalBytesSentAtLastAckedPacket congestion.ByteCount
 	// The value of |lastAckedPacketSentTime| at the time the packet was
 	// sent.
-	lastAckedPacketSentTime time.Time
+	lastAckedPacketSentTime monotime.Time
 	// The value of |lastAckedPacketAckTime| at the time the packet was
 	// sent.
-	lastAckedPacketAckTime time.Time
+	lastAckedPacketAckTime monotime.Time
 	// Send time states that are returned to the congestion controller when the
 	// packet is acked or lost.
 	sendTimeState SendTimeState
@@ -166,9 +167,9 @@ type BandwidthSampler struct {
 	totalBytesSentAtLastAckedPacket congestion.ByteCount
 	// The time at which the last acknowledged packet was sent. Set to
 	// QuicTime::Zero() if no valid timestamp is available.
-	lastAckedPacketSentTime time.Time
+	lastAckedPacketSentTime monotime.Time
 	// The time at which the most recent packet was acknowledged.
-	lastAckedPacketAckTime time.Time
+	lastAckedPacketAckTime monotime.Time
 	// The most recently sent packet.
 	lastSendPacket congestion.PacketNumber
 	// Indicates whether the bandwidth sampler is currently in an app-limited
@@ -194,7 +195,7 @@ func NewBandwidthSampler() *BandwidthSampler {
 // packets are sent in order. The information about the packet will not be
 // released from the sampler until it the packet is either acknowledged or
 // declared lost.
-func (s *BandwidthSampler) OnPacketSent(sentTime time.Time, lastSentPacket congestion.PacketNumber, sentBytes, bytesInFlight congestion.ByteCount, hasRetransmittableData bool) {
+func (s *BandwidthSampler) OnPacketSent(sentTime monotime.Time, lastSentPacket congestion.PacketNumber, sentBytes, bytesInFlight congestion.ByteCount, hasRetransmittableData bool) {
 	s.lastSendPacket = lastSentPacket
 
 	if !hasRetransmittableData {
@@ -224,7 +225,7 @@ func (s *BandwidthSampler) OnPacketSent(sentTime time.Time, lastSentPacket conge
 // OnPacketAcked Notifies the sampler that the |lastAckedPacket| is acknowledged. Returns a
 // bandwidth sample. If no bandwidth sample is available,
 // QuicBandwidth::Zero() is returned.
-func (s *BandwidthSampler) OnPacketAcked(ackTime time.Time, lastAckedPacket congestion.PacketNumber) *BandwidthSample {
+func (s *BandwidthSampler) OnPacketAcked(ackTime monotime.Time, lastAckedPacket congestion.PacketNumber) *BandwidthSample {
 	sentPacketState := s.connectionStats.Get(lastAckedPacket)
 	if sentPacketState == nil {
 		return NewBandwidthSample()
@@ -238,7 +239,7 @@ func (s *BandwidthSampler) OnPacketAcked(ackTime time.Time, lastAckedPacket cong
 
 // onPacketAckedInner Handles the actual bandwidth calculations, whereas the outer method handles
 // retrieving and removing |sentPacket|.
-func (s *BandwidthSampler) onPacketAckedInner(ackTime time.Time, lastAckedPacket congestion.PacketNumber, sentPacket *ConnectionStateOnSentPacket) *BandwidthSample {
+func (s *BandwidthSampler) onPacketAckedInner(ackTime monotime.Time, lastAckedPacket congestion.PacketNumber, sentPacket *ConnectionStateOnSentPacket) *BandwidthSample {
 	s.totalBytesAcked += sentPacket.size
 
 	s.totalBytesSentAtLastAckedPacket = sentPacket.sendTimeState.totalBytesSent
@@ -336,7 +337,7 @@ type ConnectionStates struct {
 	stats map[congestion.PacketNumber]*ConnectionStateOnSentPacket
 }
 
-func (s *ConnectionStates) Insert(packetNumber congestion.PacketNumber, sentTime time.Time, bytes congestion.ByteCount, sampler *BandwidthSampler) bool {
+func (s *ConnectionStates) Insert(packetNumber congestion.PacketNumber, sentTime monotime.Time, bytes congestion.ByteCount, sampler *BandwidthSampler) bool {
 	if _, ok := s.stats[packetNumber]; ok {
 		return false
 	}
@@ -357,7 +358,7 @@ func (s *ConnectionStates) Remove(packetNumber congestion.PacketNumber) (bool, *
 	return ok, state
 }
 
-func NewConnectionStateOnSentPacket(packetNumber congestion.PacketNumber, sentTime time.Time, bytes congestion.ByteCount, sampler *BandwidthSampler) *ConnectionStateOnSentPacket {
+func NewConnectionStateOnSentPacket(packetNumber congestion.PacketNumber, sentTime monotime.Time, bytes congestion.ByteCount, sampler *BandwidthSampler) *ConnectionStateOnSentPacket {
 	return &ConnectionStateOnSentPacket{
 		packetNumber:                    packetNumber,
 		sendTime:                        sentTime,

transport/tuic/congestion/bbr_sender.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/metacubex/quic-go"
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 	"github.com/metacubex/randv2"
 )
 
@@ -100,7 +101,6 @@ const (
 
 type bbrSender struct {
 	mode          bbrMode
-	clock         Clock
 	rttStats      congestion.RTTStatsProvider
 	bytesInFlight congestion.ByteCount
 	// return total bytes of unacked packets.
@@ -121,13 +121,13 @@ type bbrSender struct {
 	// Tracks the maximum number of bytes acked faster than the sending rate.
 	maxAckHeight *WindowedFilter
 	// The time this aggregation started and the number of bytes acked during it.
-	aggregationEpochStartTime time.Time
+	aggregationEpochStartTime monotime.Time
 	aggregationEpochBytes     congestion.ByteCount
 	// Minimum RTT estimate.  Automatically expires within 10 seconds (and
 	// triggers PROBE_RTT mode) if no new value is sampled during that period.
 	minRtt time.Duration
 	// The time at which the current value of |min_rtt_| was assigned.
-	minRttTimestamp time.Time
+	minRttTimestamp monotime.Time
 	// The maximum allowed number of bytes in flight.
 	congestionWindow congestion.ByteCount
 	// The initial value of the |congestion_window_|.
@@ -160,7 +160,7 @@ type bbrSender struct {
 	// pacing gain cycle.
 	cycleCurrentOffset int
 	// The time at which the last pacing gain cycle was started.
-	lastCycleStart time.Time
+	lastCycleStart monotime.Time
 	// Indicates whether the connection has reached the full bandwidth mode.
 	isAtFullBandwidth bool
 	// Number of rounds during which there was no significant bandwidth increase.
@@ -172,7 +172,7 @@ type bbrSender struct {
 	// Time at which PROBE_RTT has to be exited.  Setting it to zero indicates
 	// that the time is yet unknown as the number of packets in flight has not
 	// reached the required value.
-	exitProbeRttAt time.Time
+	exitProbeRttAt monotime.Time
 	// Indicates whether a round-trip has passed since PROBE_RTT became active.
 	probeRttRoundPassed bool
 	// Indicates whether the most recent bandwidth sample was marked as
@@ -231,14 +231,12 @@ type bbrSender struct {
 }
 
 func NewBBRSender(
-	clock Clock,
 	initialMaxDatagramSize,
 	initialCongestionWindow,
 	initialMaxCongestionWindow congestion.ByteCount,
 ) *bbrSender {
 	b := &bbrSender{
 		mode:                      STARTUP,
-		clock:                     clock,
 		sampler:                   NewBandwidthSampler(),
 		maxBandwidth:              NewWindowedFilter(int64(BandwidthWindowSize), MaxFilter),
 		maxAckHeight:              NewWindowedFilter(int64(BandwidthWindowSize), MaxFilter),
@@ -277,12 +275,12 @@ func (b *bbrSender) GetBytesInFlight() congestion.ByteCount {
 }
 
 // TimeUntilSend returns when the next packet should be sent.
-func (b *bbrSender) TimeUntilSend(bytesInFlight congestion.ByteCount) time.Time {
+func (b *bbrSender) TimeUntilSend(bytesInFlight congestion.ByteCount) monotime.Time {
 	b.bytesInFlight = bytesInFlight
 	return b.pacer.TimeUntilSend()
 }
 
-func (b *bbrSender) HasPacingBudget(now time.Time) bool {
+func (b *bbrSender) HasPacingBudget(now monotime.Time) bool {
 	return b.pacer.Budget(now) >= b.maxDatagramSize
 }
 
@@ -298,7 +296,7 @@ func (b *bbrSender) SetMaxDatagramSize(s congestion.ByteCount) {
 	b.pacer.SetMaxDatagramSize(s)
 }
 
-func (b *bbrSender) OnPacketSent(sentTime time.Time, bytesInFlight congestion.ByteCount, packetNumber congestion.PacketNumber, bytes congestion.ByteCount, isRetransmittable bool) {
+func (b *bbrSender) OnPacketSent(sentTime monotime.Time, bytesInFlight congestion.ByteCount, packetNumber congestion.PacketNumber, bytes congestion.ByteCount, isRetransmittable bool) {
 	b.pacer.SentPacket(sentTime, bytes)
 	b.lastSendPacket = packetNumber
 
@@ -335,7 +333,7 @@ func (b *bbrSender) MaybeExitSlowStart() {
 
 }
 
-func (b *bbrSender) OnPacketAcked(number congestion.PacketNumber, ackedBytes congestion.ByteCount, priorInFlight congestion.ByteCount, eventTime time.Time) {
+func (b *bbrSender) OnPacketAcked(number congestion.PacketNumber, ackedBytes congestion.ByteCount, priorInFlight congestion.ByteCount, eventTime monotime.Time) {
 	// Stub
 }
 
@@ -343,7 +341,7 @@ func (b *bbrSender) OnCongestionEvent(number congestion.PacketNumber, lostBytes
 	// Stub
 }
 
-func (b *bbrSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime time.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
+func (b *bbrSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime monotime.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
 	totalBytesAckedBefore := b.sampler.totalBytesAcked
 	isRoundStart, minRttExpired := false, false
 
@@ -490,7 +488,7 @@ func (b *bbrSender) UpdateRoundTripCounter(lastAckedPacket congestion.PacketNumb
 	return false
 }
 
-func (b *bbrSender) UpdateBandwidthAndMinRtt(now time.Time, ackedPackets []congestion.AckedPacketInfo) bool {
+func (b *bbrSender) UpdateBandwidthAndMinRtt(now monotime.Time, ackedPackets []congestion.AckedPacketInfo) bool {
 	sampleMinRtt := InfiniteRTT
 
 	for _, packet := range ackedPackets {
@@ -610,7 +608,7 @@ func (b *bbrSender) UpdateRecoveryState(hasLosses, isRoundStart bool) {
 	}
 }
 
-func (b *bbrSender) UpdateAckAggregationBytes(ackTime time.Time, ackedBytes congestion.ByteCount) congestion.ByteCount {
+func (b *bbrSender) UpdateAckAggregationBytes(ackTime monotime.Time, ackedBytes congestion.ByteCount) congestion.ByteCount {
 	// Compute how many bytes are expected to be delivered, assuming max bandwidth
 	// is correct.
 	expectedAckedBytes := congestion.ByteCount(b.maxBandwidth.GetBest()) *
@@ -630,7 +628,7 @@ func (b *bbrSender) UpdateAckAggregationBytes(ackTime time.Time, ackedBytes cong
 	return b.aggregationEpochBytes - expectedAckedBytes
 }
 
-func (b *bbrSender) UpdateGainCyclePhase(now time.Time, priorInFlight congestion.ByteCount, hasLosses bool) {
+func (b *bbrSender) UpdateGainCyclePhase(now monotime.Time, priorInFlight congestion.ByteCount, hasLosses bool) {
 	bytesInFlight := b.GetBytesInFlight()
 	// In most cases, the cycle is advanced after an RTT passes.
 	shouldAdvanceGainCycling := now.Sub(b.lastCycleStart) > b.GetMinRtt()
@@ -697,7 +695,7 @@ func (b *bbrSender) CheckIfFullBandwidthReached() {
 	}
 }
 
-func (b *bbrSender) MaybeExitStartupOrDrain(now time.Time) {
+func (b *bbrSender) MaybeExitStartupOrDrain(now monotime.Time) {
 	if b.mode == STARTUP && b.isAtFullBandwidth {
 		b.OnExitStartup(now)
 		b.mode = DRAIN
@@ -709,7 +707,7 @@ func (b *bbrSender) MaybeExitStartupOrDrain(now time.Time) {
 	}
 }
 
-func (b *bbrSender) EnterProbeBandwidthMode(now time.Time) {
+func (b *bbrSender) EnterProbeBandwidthMode(now monotime.Time) {
 	b.mode = PROBE_BW
 	b.congestionWindowGain = b.congestionWindowGainConst
 
@@ -725,7 +723,7 @@ func (b *bbrSender) EnterProbeBandwidthMode(now time.Time) {
 	b.pacingGain = PacingGain[b.cycleCurrentOffset]
 }
 
-func (b *bbrSender) MaybeEnterOrExitProbeRtt(now time.Time, isRoundStart, minRttExpired bool) {
+func (b *bbrSender) MaybeEnterOrExitProbeRtt(now monotime.Time, isRoundStart, minRttExpired bool) {
 	if minRttExpired && !b.exitingQuiescence && b.mode != PROBE_RTT {
 		if b.InSlowStart() {
 			b.OnExitStartup(now)
@@ -734,7 +732,7 @@ func (b *bbrSender) MaybeEnterOrExitProbeRtt(now time.Time, isRoundStart, minRtt
 		b.pacingGain = 1.0
 		// Do not decide on the time to exit PROBE_RTT until the |bytes_in_flight|
 		// is at the target small value.
-		b.exitProbeRttAt = time.Time{}
+		b.exitProbeRttAt = monotime.Time(0)
 	}
 
 	if b.mode == PROBE_RTT {
@@ -773,7 +771,7 @@ func (b *bbrSender) ProbeRttCongestionWindow() congestion.ByteCount {
 	}
 }
 
-func (b *bbrSender) EnterStartupMode(now time.Time) {
+func (b *bbrSender) EnterStartupMode(now monotime.Time) {
 	// if b.rttStats != nil {
 	// TODO: slow start.
 	// }
@@ -782,7 +780,7 @@ func (b *bbrSender) EnterStartupMode(now time.Time) {
 	b.congestionWindowGain = b.highCwndGain
 }
 
-func (b *bbrSender) OnExitStartup(now time.Time) {
+func (b *bbrSender) OnExitStartup(now monotime.Time) {
 	if b.rttStats == nil {
 		return
 	}

transport/tuic/congestion/clock.go

@@ -1,18 +0,0 @@
-package congestion
-
-import "time"
-
-// A Clock returns the current time
-type Clock interface {
-	Now() time.Time
-}
-
-// DefaultClock implements the Clock interface using the Go stdlib clock.
-type DefaultClock struct{}
-
-var _ Clock = DefaultClock{}
-
-// Now gets the current time
-func (DefaultClock) Now() time.Time {
-	return time.Now()
-}

transport/tuic/congestion/cubic.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 // This cubic implementation is based on the one found in Chromiums's QUIC
@@ -36,13 +37,11 @@ const betaLastMax float32 = 0.85
 
 // Cubic implements the cubic algorithm from TCP
 type Cubic struct {
-	clock Clock
-
 	// Number of connections to simulate.
 	numConnections int
 
 	// Time when this cycle started, after last loss event.
-	epoch time.Time
+	epoch monotime.Time
 
 	// Max congestion window used just before last loss event.
 	// Note: to improve fairness to other streams an additional back off is
@@ -66,9 +65,8 @@ type Cubic struct {
 }
 
 // NewCubic returns a new Cubic instance
-func NewCubic(clock Clock) *Cubic {
+func NewCubic() *Cubic {
 	c := &Cubic{
-		clock:          clock,
 		numConnections: defaultNumConnections,
 	}
 	c.Reset()
@@ -77,7 +75,7 @@ func NewCubic(clock Clock) *Cubic {
 
 // Reset is called after a timeout to reset the cubic state
 func (c *Cubic) Reset() {
-	c.epoch = time.Time{}
+	c.epoch = monotime.Time(0)
 	c.lastMaxCongestionWindow = 0
 	c.ackedBytesCount = 0
 	c.estimatedTCPcongestionWindow = 0
@@ -121,7 +119,7 @@ func (c *Cubic) OnApplicationLimited() {
 	// in such a period. This reset effectively freezes congestion window growth
 	// through application-limited periods and allows Cubic growth to continue
 	// when the entire window is being used.
-	c.epoch = time.Time{}
+	c.epoch = monotime.Time(0)
 }
 
 // CongestionWindowAfterPacketLoss computes a new congestion window to use after
@@ -135,7 +133,7 @@ func (c *Cubic) CongestionWindowAfterPacketLoss(currentCongestionWindow congesti
 	} else {
 		c.lastMaxCongestionWindow = currentCongestionWindow
 	}
-	c.epoch = time.Time{} // Reset time.
+	c.epoch = monotime.Time(0) // Reset time.
 	return congestion.ByteCount(float32(currentCongestionWindow) * c.beta())
 }
 
@@ -147,7 +145,7 @@ func (c *Cubic) CongestionWindowAfterAck(
 	ackedBytes congestion.ByteCount,
 	currentCongestionWindow congestion.ByteCount,
 	delayMin time.Duration,
-	eventTime time.Time,
+	eventTime monotime.Time,
 ) congestion.ByteCount {
 	c.ackedBytesCount += ackedBytes
 

transport/tuic/congestion/cubic_sender.go

@@ -2,9 +2,9 @@ package congestion
 
 import (
 	"fmt"
-	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 const (
@@ -23,7 +23,6 @@ type cubicSender struct {
 	rttStats        congestion.RTTStatsProvider
 	cubic           *Cubic
 	pacer           *pacer
-	clock           Clock
 
 	reno bool
 
@@ -61,12 +60,10 @@ var (
 
 // NewCubicSender makes a new cubic sender
 func NewCubicSender(
-	clock Clock,
 	initialMaxDatagramSize congestion.ByteCount,
 	reno bool,
 ) *cubicSender {
 	return newCubicSender(
-		clock,
 		reno,
 		initialMaxDatagramSize,
 		initialCongestionWindow*initialMaxDatagramSize,
@@ -75,7 +72,6 @@ func NewCubicSender(
 }
 
 func newCubicSender(
-	clock Clock,
 	reno bool,
 	initialMaxDatagramSize,
 	initialCongestionWindow,
@@ -89,8 +85,7 @@ func newCubicSender(
 		initialMaxCongestionWindow: initialMaxCongestionWindow,
 		congestionWindow:           initialCongestionWindow,
 		slowStartThreshold:         MaxByteCount,
-		cubic:                      NewCubic(clock),
-		clock:                      clock,
+		cubic:                      NewCubic(),
 		reno:                       reno,
 		maxDatagramSize:            initialMaxDatagramSize,
 	}
@@ -103,11 +98,11 @@ func (c *cubicSender) SetRTTStatsProvider(provider congestion.RTTStatsProvider)
 }
 
 // TimeUntilSend returns when the next packet should be sent.
-func (c *cubicSender) TimeUntilSend(_ congestion.ByteCount) time.Time {
+func (c *cubicSender) TimeUntilSend(_ congestion.ByteCount) monotime.Time {
 	return c.pacer.TimeUntilSend()
 }
 
-func (c *cubicSender) HasPacingBudget(now time.Time) bool {
+func (c *cubicSender) HasPacingBudget(now monotime.Time) bool {
 	return c.pacer.Budget(now) >= c.maxDatagramSize
 }
 
@@ -120,7 +115,7 @@ func (c *cubicSender) minCongestionWindow() congestion.ByteCount {
 }
 
 func (c *cubicSender) OnPacketSent(
-	sentTime time.Time,
+	sentTime monotime.Time,
 	_ congestion.ByteCount,
 	packetNumber congestion.PacketNumber,
 	bytes congestion.ByteCount,
@@ -162,7 +157,7 @@ func (c *cubicSender) OnPacketAcked(
 	ackedPacketNumber congestion.PacketNumber,
 	ackedBytes congestion.ByteCount,
 	priorInFlight congestion.ByteCount,
-	eventTime time.Time,
+	eventTime monotime.Time,
 ) {
 	c.largestAckedPacketNumber = Max(ackedPacketNumber, c.largestAckedPacketNumber)
 	if c.InRecovery() {
@@ -197,7 +192,7 @@ func (c *cubicSender) OnCongestionEvent(packetNumber congestion.PacketNumber, lo
 	c.numAckedPackets = 0
 }
 
-func (b *cubicSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime time.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
+func (b *cubicSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime monotime.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
 	// Stub
 }
 
@@ -207,7 +202,7 @@ func (c *cubicSender) maybeIncreaseCwnd(
 	_ congestion.PacketNumber,
 	ackedBytes congestion.ByteCount,
 	priorInFlight congestion.ByteCount,
-	eventTime time.Time,
+	eventTime monotime.Time,
 ) {
 	// Do not increase the congestion window unless the sender is close to using
 	// the current window.

transport/tuic/congestion/pacer.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 const initialMaxDatagramSize = congestion.ByteCount(1252)
@@ -16,7 +17,7 @@ const maxBurstSizePackets = 10
 type pacer struct {
 	budgetAtLastSent     congestion.ByteCount
 	maxDatagramSize      congestion.ByteCount
-	lastSentTime         time.Time
+	lastSentTime         monotime.Time
 	getAdjustedBandwidth func() uint64 // in bytes/s
 }
 
@@ -37,7 +38,7 @@ func newPacer(getBandwidth func() Bandwidth) *pacer {
 	return p
 }
 
-func (p *pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
+func (p *pacer) SentPacket(sendTime monotime.Time, size congestion.ByteCount) {
 	budget := p.Budget(sendTime)
 	if size > budget {
 		p.budgetAtLastSent = 0
@@ -47,7 +48,7 @@ func (p *pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
 	p.lastSentTime = sendTime
 }
 
-func (p *pacer) Budget(now time.Time) congestion.ByteCount {
+func (p *pacer) Budget(now monotime.Time) congestion.ByteCount {
 	if p.lastSentTime.IsZero() {
 		return p.maxBurstSize()
 	}
@@ -63,10 +64,10 @@ func (p *pacer) maxBurstSize() congestion.ByteCount {
 }
 
 // TimeUntilSend returns when the next packet should be sent.
-// It returns the zero value of time.Time if a packet can be sent immediately.
-func (p *pacer) TimeUntilSend() time.Time {
+// It returns the zero value of monotime.Time if a packet can be sent immediately.
+func (p *pacer) TimeUntilSend() monotime.Time {
 	if p.budgetAtLastSent >= p.maxDatagramSize {
-		return time.Time{}
+		return monotime.Time(0)
 	}
 	return p.lastSentTime.Add(Max(
 		MinPacingDelay,

transport/tuic/congestion_v2/bandwidth_sampler.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 const (
@@ -103,7 +104,7 @@ type maxAckHeightTracker struct {
 	// bandwidth.
 	maxAckHeightFilter *WindowedFilter[extraAckedEvent, roundTripCount]
 	// The time this aggregation started and the number of bytes acked during it.
-	aggregationEpochStartTime time.Time
+	aggregationEpochStartTime monotime.Time
 	aggregationEpochBytes     congestion.ByteCount
 	// The last sent packet number before the current aggregation epoch started.
 	lastSentPacketNumberBeforeEpoch congestion.PacketNumber
@@ -133,7 +134,7 @@ func (m *maxAckHeightTracker) Update(
 	roundTripCount roundTripCount,
 	lastSentPacketNumber congestion.PacketNumber,
 	lastAckedPacketNumber congestion.PacketNumber,
-	ackTime time.Time,
+	ackTime monotime.Time,
 	bytesAcked congestion.ByteCount,
 ) congestion.ByteCount {
 	forceNewEpoch := false
@@ -241,7 +242,7 @@ func (m *maxAckHeightTracker) NumAckAggregationEpochs() uint64 {
 
 // AckPoint represents a point on the ack line.
 type ackPoint struct {
-	ackTime         time.Time
+	ackTime         monotime.Time
 	totalBytesAcked congestion.ByteCount
 }
 
@@ -250,7 +251,7 @@ type recentAckPoints struct {
 	ackPoints [2]ackPoint
 }
 
-func (r *recentAckPoints) Update(ackTime time.Time, totalBytesAcked congestion.ByteCount) {
+func (r *recentAckPoints) Update(ackTime monotime.Time, totalBytesAcked congestion.ByteCount) {
 	if ackTime.Before(r.ackPoints[1].ackTime) {
 		r.ackPoints[1].ackTime = ackTime
 	} else if ackTime.After(r.ackPoints[1].ackTime) {
@@ -284,7 +285,7 @@ func (r *recentAckPoints) LessRecentPoint() *ackPoint {
 // that moment.
 type connectionStateOnSentPacket struct {
 	// Time at which the packet is sent.
-	sentTime time.Time
+	sentTime monotime.Time
 	// Size of the packet.
 	size congestion.ByteCount
 	// The value of |totalBytesSentAtLastAckedPacket| at the time the
@@ -292,10 +293,10 @@ type connectionStateOnSentPacket struct {
 	totalBytesSentAtLastAckedPacket congestion.ByteCount
 	// The value of |lastAckedPacketSentTime| at the time the packet was
 	// sent.
-	lastAckedPacketSentTime time.Time
+	lastAckedPacketSentTime monotime.Time
 	// The value of |lastAckedPacketAckTime| at the time the packet was
 	// sent.
-	lastAckedPacketAckTime time.Time
+	lastAckedPacketAckTime monotime.Time
 	// Send time states that are returned to the congestion controller when the
 	// packet is acked or lost.
 	sendTimeState sendTimeState
@@ -305,7 +306,7 @@ type connectionStateOnSentPacket struct {
 // sampler.
 // |bytes_in_flight| is the bytes in flight right after the packet is sent.
 func newConnectionStateOnSentPacket(
-	sentTime time.Time,
+	sentTime monotime.Time,
 	size congestion.ByteCount,
 	bytesInFlight congestion.ByteCount,
 	sampler *bandwidthSampler,
@@ -456,10 +457,10 @@ type bandwidthSampler struct {
 
 	// The time at which the last acknowledged packet was sent. Set to
 	// QuicTime::Zero() if no valid timestamp is available.
-	lastAckedPacketSentTime time.Time
+	lastAckedPacketSentTime monotime.Time
 
 	// The time at which the most recent packet was acknowledged.
-	lastAckedPacketAckTime time.Time
+	lastAckedPacketAckTime monotime.Time
 
 	// The most recently sent packet.
 	lastSentPacket congestion.PacketNumber
@@ -551,7 +552,7 @@ func (b *bandwidthSampler) IsOverestimateAvoidanceEnabled() bool {
 }
 
 func (b *bandwidthSampler) OnPacketSent(
-	sentTime time.Time,
+	sentTime monotime.Time,
 	packetNumber congestion.PacketNumber,
 	bytes congestion.ByteCount,
 	bytesInFlight congestion.ByteCount,
@@ -595,7 +596,7 @@ func (b *bandwidthSampler) OnPacketSent(
 }
 
 func (b *bandwidthSampler) OnCongestionEvent(
-	ackTime time.Time,
+	ackTime monotime.Time,
 	ackedPackets []congestion.AckedPacketInfo,
 	lostPackets []congestion.LostPacketInfo,
 	maxBandwidth Bandwidth,
@@ -758,7 +759,7 @@ func (b *bandwidthSampler) chooseA0Point(totalBytesAcked congestion.ByteCount, a
 	return true
 }
 
-func (b *bandwidthSampler) onPacketAcknowledged(ackTime time.Time, packetNumber congestion.PacketNumber) bandwidthSample {
+func (b *bandwidthSampler) onPacketAcknowledged(ackTime monotime.Time, packetNumber congestion.PacketNumber) bandwidthSample {
 	sample := newBandwidthSample()
 	b.lastAckedPacket = packetNumber
 	sentPacketPointer := b.connectionStateMap.GetEntry(packetNumber)

transport/tuic/congestion_v2/bbr_sender.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/metacubex/quic-go"
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 
 	"github.com/metacubex/randv2"
 )
@@ -95,7 +96,6 @@ const (
 
 type bbrSender struct {
 	rttStats congestion.RTTStatsProvider
-	clock    Clock
 	pacer    *Pacer
 
 	mode bbrMode
@@ -127,7 +127,7 @@ type bbrSender struct {
 	// triggers PROBE_RTT mode) if no new value is sampled during that period.
 	minRtt time.Duration
 	// The time at which the current value of |min_rtt_| was assigned.
-	minRttTimestamp time.Time
+	minRttTimestamp monotime.Time
 
 	// The maximum allowed number of bytes in flight.
 	congestionWindow congestion.ByteCount
@@ -168,7 +168,7 @@ type bbrSender struct {
 	// pacing gain cycle.
 	cycleCurrentOffset int
 	// The time at which the last pacing gain cycle was started.
-	lastCycleStart time.Time
+	lastCycleStart monotime.Time
 
 	// Indicates whether the connection has reached the full bandwidth mode.
 	isAtFullBandwidth bool
@@ -183,7 +183,7 @@ type bbrSender struct {
 	// Time at which PROBE_RTT has to be exited.  Setting it to zero indicates
 	// that the time is yet unknown as the number of packets in flight has not
 	// reached the required value.
-	exitProbeRttAt time.Time
+	exitProbeRttAt monotime.Time
 	// Indicates whether a round-trip has passed since PROBE_RTT became active.
 	probeRttRoundPassed bool
 
@@ -243,12 +243,10 @@ type bbrSender struct {
 var _ congestion.CongestionControl = &bbrSender{}
 
 func NewBbrSender(
-	clock Clock,
 	initialMaxDatagramSize congestion.ByteCount,
 	initialCongestionWindowPackets congestion.ByteCount,
 ) *bbrSender {
 	return newBbrSender(
-		clock,
 		initialMaxDatagramSize,
 		initialCongestionWindowPackets*initialMaxDatagramSize,
 		congestion.MaxCongestionWindowPackets*initialMaxDatagramSize,
@@ -256,13 +254,11 @@ func NewBbrSender(
 }
 
 func newBbrSender(
-	clock Clock,
 	initialMaxDatagramSize,
 	initialCongestionWindow,
 	initialMaxCongestionWindow congestion.ByteCount,
 ) *bbrSender {
 	b := &bbrSender{
-		clock:                        clock,
 		mode:                         bbrModeStartup,
 		sampler:                      newBandwidthSampler(roundTripCount(bandwidthWindowSize)),
 		lastSentPacket:               invalidPacketNumber,
@@ -296,7 +292,7 @@ func newBbrSender(
 		}
 	*/
 
-	b.enterStartupMode(b.clock.Now())
+	b.enterStartupMode()
 	b.setHighCwndGain(derivedHighCWNDGain)
 
 	return b
@@ -307,18 +303,18 @@ func (b *bbrSender) SetRTTStatsProvider(provider congestion.RTTStatsProvider) {
 }
 
 // TimeUntilSend implements the SendAlgorithm interface.
-func (b *bbrSender) TimeUntilSend(bytesInFlight congestion.ByteCount) time.Time {
+func (b *bbrSender) TimeUntilSend(bytesInFlight congestion.ByteCount) monotime.Time {
 	return b.pacer.TimeUntilSend()
 }
 
 // HasPacingBudget implements the SendAlgorithm interface.
-func (b *bbrSender) HasPacingBudget(now time.Time) bool {
+func (b *bbrSender) HasPacingBudget(now monotime.Time) bool {
 	return b.pacer.Budget(now) >= b.maxDatagramSize
 }
 
 // OnPacketSent implements the SendAlgorithm interface.
 func (b *bbrSender) OnPacketSent(
-	sentTime time.Time,
+	sentTime monotime.Time,
 	bytesInFlight congestion.ByteCount,
 	packetNumber congestion.PacketNumber,
 	bytes congestion.ByteCount,
@@ -349,7 +345,7 @@ func (b *bbrSender) MaybeExitSlowStart() {
 }
 
 // OnPacketAcked implements the SendAlgorithm interface.
-func (b *bbrSender) OnPacketAcked(number congestion.PacketNumber, ackedBytes, priorInFlight congestion.ByteCount, eventTime time.Time) {
+func (b *bbrSender) OnPacketAcked(number congestion.PacketNumber, ackedBytes, priorInFlight congestion.ByteCount, eventTime monotime.Time) {
 	// Do nothing.
 }
 
@@ -403,7 +399,7 @@ func (b *bbrSender) OnCongestionEvent(number congestion.PacketNumber, lostBytes,
 	// Do nothing.
 }
 
-func (b *bbrSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime time.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
+func (b *bbrSender) OnCongestionEventEx(priorInFlight congestion.ByteCount, eventTime monotime.Time, ackedPackets []congestion.AckedPacketInfo, lostPackets []congestion.LostPacketInfo) {
 	totalBytesAckedBefore := b.sampler.TotalBytesAcked()
 	totalBytesLostBefore := b.sampler.TotalBytesLost()
 
@@ -592,7 +588,7 @@ func (b *bbrSender) probeRttCongestionWindow() congestion.ByteCount {
 	return b.minCongestionWindow
 }
 
-func (b *bbrSender) maybeUpdateMinRtt(now time.Time, sampleMinRtt time.Duration) bool {
+func (b *bbrSender) maybeUpdateMinRtt(now monotime.Time, sampleMinRtt time.Duration) bool {
 	// Do not expire min_rtt if none was ever available.
 	minRttExpired := b.minRtt != 0 && now.After(b.minRttTimestamp.Add(minRttExpiry))
 	if minRttExpired || sampleMinRtt < b.minRtt || b.minRtt == 0 {
@@ -604,7 +600,7 @@ func (b *bbrSender) maybeUpdateMinRtt(now time.Time, sampleMinRtt time.Duration)
 }
 
 // Enters the STARTUP mode.
-func (b *bbrSender) enterStartupMode(now time.Time) {
+func (b *bbrSender) enterStartupMode() {
 	b.mode = bbrModeStartup
 	// b.maybeTraceStateChange(logging.CongestionStateStartup)
 	b.pacingGain = b.highGain
@@ -612,7 +608,7 @@ func (b *bbrSender) enterStartupMode(now time.Time) {
 }
 
 // Enters the PROBE_BW mode.
-func (b *bbrSender) enterProbeBandwidthMode(now time.Time) {
+func (b *bbrSender) enterProbeBandwidthMode(now monotime.Time) {
 	b.mode = bbrModeProbeBw
 	// b.maybeTraceStateChange(logging.CongestionStateProbeBw)
 	b.congestionWindowGain = b.congestionWindowGainConstant
@@ -641,7 +637,7 @@ func (b *bbrSender) updateRoundTripCounter(lastAckedPacket congestion.PacketNumb
 }
 
 // Updates the current gain used in PROBE_BW mode.
-func (b *bbrSender) updateGainCyclePhase(now time.Time, priorInFlight congestion.ByteCount, hasLosses bool) {
+func (b *bbrSender) updateGainCyclePhase(now monotime.Time, priorInFlight congestion.ByteCount, hasLosses bool) {
 	// In most cases, the cycle is advanced after an RTT passes.
 	shouldAdvanceGainCycling := now.After(b.lastCycleStart.Add(b.getMinRtt()))
 	// If the pacing gain is above 1.0, the connection is trying to probe the
@@ -713,7 +709,7 @@ func (b *bbrSender) maybeAppLimited(bytesInFlight congestion.ByteCount) {
 
 // Transitions from STARTUP to DRAIN and from DRAIN to PROBE_BW if
 // appropriate.
-func (b *bbrSender) maybeExitStartupOrDrain(now time.Time) {
+func (b *bbrSender) maybeExitStartupOrDrain(now monotime.Time) {
 	if b.mode == bbrModeStartup && b.isAtFullBandwidth {
 		b.mode = bbrModeDrain
 		// b.maybeTraceStateChange(logging.CongestionStateDrain)
@@ -726,14 +722,14 @@ func (b *bbrSender) maybeExitStartupOrDrain(now time.Time) {
 }
 
 // Decides whether to enter or exit PROBE_RTT.
-func (b *bbrSender) maybeEnterOrExitProbeRtt(now time.Time, isRoundStart, minRttExpired bool) {
+func (b *bbrSender) maybeEnterOrExitProbeRtt(now monotime.Time, isRoundStart, minRttExpired bool) {
 	if minRttExpired && !b.exitingQuiescence && b.mode != bbrModeProbeRtt {
 		b.mode = bbrModeProbeRtt
 		// b.maybeTraceStateChange(logging.CongestionStateProbRtt)
 		b.pacingGain = 1.0
 		// Do not decide on the time to exit PROBE_RTT until the |bytes_in_flight|
 		// is at the target small value.
-		b.exitProbeRttAt = time.Time{}
+		b.exitProbeRttAt = monotime.Time(0)
 	}
 
 	if b.mode == bbrModeProbeRtt {
@@ -756,7 +752,7 @@ func (b *bbrSender) maybeEnterOrExitProbeRtt(now time.Time, isRoundStart, minRtt
 			if now.Sub(b.exitProbeRttAt) >= 0 && b.probeRttRoundPassed {
 				b.minRttTimestamp = now
 				if !b.isAtFullBandwidth {
-					b.enterStartupMode(now)
+					b.enterStartupMode()
 				} else {
 					b.enterProbeBandwidthMode(now)
 				}

transport/tuic/congestion_v2/clock.go

@@ -1,18 +0,0 @@
-package congestion
-
-import "time"
-
-// A Clock returns the current time
-type Clock interface {
-	Now() time.Time
-}
-
-// DefaultClock implements the Clock interface using the Go stdlib clock.
-type DefaultClock struct{}
-
-var _ Clock = DefaultClock{}
-
-// Now gets the current time
-func (DefaultClock) Now() time.Time {
-	return time.Now()
-}

transport/tuic/congestion_v2/pacer.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/metacubex/quic-go/congestion"
+	"github.com/metacubex/quic-go/monotime"
 )
 
 const (
@@ -15,7 +16,7 @@ const (
 type Pacer struct {
 	budgetAtLastSent congestion.ByteCount
 	maxDatagramSize  congestion.ByteCount
-	lastSentTime     time.Time
+	lastSentTime     monotime.Time
 	getBandwidth     func() congestion.ByteCount // in bytes/s
 }
 
@@ -28,7 +29,7 @@ func NewPacer(getBandwidth func() congestion.ByteCount) *Pacer {
 	return p
 }
 
-func (p *Pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
+func (p *Pacer) SentPacket(sendTime monotime.Time, size congestion.ByteCount) {
 	budget := p.Budget(sendTime)
 	if size > budget {
 		p.budgetAtLastSent = 0
@@ -38,7 +39,7 @@ func (p *Pacer) SentPacket(sendTime time.Time, size congestion.ByteCount) {
 	p.lastSentTime = sendTime
 }
 
-func (p *Pacer) Budget(now time.Time) congestion.ByteCount {
+func (p *Pacer) Budget(now monotime.Time) congestion.ByteCount {
 	if p.lastSentTime.IsZero() {
 		return p.maxBurstSize()
 	}
@@ -57,10 +58,10 @@ func (p *Pacer) maxBurstSize() congestion.ByteCount {
 }
 
 // TimeUntilSend returns when the next packet should be sent.
-// It returns the zero value of time.Time if a packet can be sent immediately.
-func (p *Pacer) TimeUntilSend() time.Time {
+// It returns the zero value of monotime.Time if a packet can be sent immediately.
+func (p *Pacer) TimeUntilSend() monotime.Time {
 	if p.budgetAtLastSent >= p.maxDatagramSize {
-		return time.Time{}
+		return monotime.Time(0)
 	}
 	return p.lastSentTime.Add(Max(
 		congestion.MinPacingDelay,

transport/vless/vision/conn.go

@@ -242,14 +242,26 @@ func (vc *Conn) WriteBuffer(buffer *buf.Buffer) (err error) {
 }
 
 func (vc *Conn) FrontHeadroom() int {
+	fontHeadroom := PaddingHeaderLen - uuid.Size
 	if vc.readFilterUUID || vc.writeOnceUserUUID != nil {
-		return PaddingHeaderLen
+		fontHeadroom = PaddingHeaderLen
 	}
-	return PaddingHeaderLen - uuid.Size
+	if vc.writeFilterApplicationData { // The writer may be replaced, add the required value for vc.netConn
+		if abs := N.CalculateFrontHeadroom(vc.netConn) - N.CalculateFrontHeadroom(vc.Conn); abs > 0 {
+			fontHeadroom += abs
+		}
+	}
+	return fontHeadroom
 }
 
 func (vc *Conn) RearHeadroom() int {
-	return 500 + 900
+	rearHeadroom := 500 + 900
+	if vc.writeFilterApplicationData { // The writer may be replaced, add the required value for vc.netConn
+		if abs := N.CalculateRearHeadroom(vc.netConn) - N.CalculateRearHeadroom(vc.Conn); abs > 0 {
+			rearHeadroom += abs
+		}
+	}
+	return rearHeadroom
 }
 
 func (vc *Conn) NeedHandshake() bool {

transport/vmess/http.go

@@ -3,7 +3,6 @@ package vmess
 import (
 	"bufio"
 	"bytes"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -55,11 +54,11 @@ func (hc *httpConn) Write(b []byte) (int, error) {
 		return hc.Conn.Write(b)
 	}
 
-	if len(hc.cfg.Path) == 0 {
-		return -1, errors.New("path is empty")
+	path := "/"
+	if len(hc.cfg.Path) > 0 {
+		path = hc.cfg.Path[randv2.IntN(len(hc.cfg.Path))]
 	}
 
-	path := hc.cfg.Path[randv2.IntN(len(hc.cfg.Path))]
 	host := hc.cfg.Host
 	if header := hc.cfg.Headers["Host"]; len(header) != 0 {
 		host = header[randv2.IntN(len(header))]

tunnel/tunnel.go

@@ -17,13 +17,13 @@ import (
 	"github.com/metacubex/mihomo/common/utils"
 	"github.com/metacubex/mihomo/component/loopback"
 	"github.com/metacubex/mihomo/component/nat"
-	P "github.com/metacubex/mihomo/component/process"
+	"github.com/metacubex/mihomo/component/process"
 	"github.com/metacubex/mihomo/component/resolver"
 	"github.com/metacubex/mihomo/component/slowdown"
 	"github.com/metacubex/mihomo/component/sniffer"
 	C "github.com/metacubex/mihomo/constant"
 	"github.com/metacubex/mihomo/constant/features"
-	"github.com/metacubex/mihomo/constant/provider"
+	P "github.com/metacubex/mihomo/constant/provider"
 	icontext "github.com/metacubex/mihomo/context"
 	"github.com/metacubex/mihomo/log"
 	"github.com/metacubex/mihomo/tunnel/statistic"
@@ -43,8 +43,8 @@ var (
 	listeners     = make(map[string]C.InboundListener)
 	subRules      map[string][]C.Rule
 	proxies       = make(map[string]C.Proxy)
-	providers     map[string]provider.ProxyProvider
-	ruleProviders map[string]provider.RuleProvider
+	providers     map[string]P.ProxyProvider
+	ruleProviders map[string]P.RuleProvider
 	configMux     sync.RWMutex
 
 	// for compatibility, lazy init
@@ -59,21 +59,19 @@ var (
 	// default timeout for UDP session
 	udpTimeout = 60 * time.Second
 
-	findProcessMode = atomic.NewInt32Enum(P.FindProcessStrict)
-
-	fakeIPRange netip.Prefix
+	findProcessMode = atomic.NewInt32Enum(process.FindProcessStrict)
 
 	snifferDispatcher *sniffer.Dispatcher
 	sniffingEnable    = false
 
-	ruleUpdateCallback = utils.NewCallback[provider.RuleProvider]()
+	ruleUpdateCallback = utils.NewCallback[P.RuleProvider]()
 )
 
 type tunnel struct{}
 
 var Tunnel = tunnel{}
 var _ C.Tunnel = Tunnel
-var _ provider.Tunnel = Tunnel
+var _ P.Tunnel = Tunnel
 
 func (t tunnel) HandleTCPConn(conn net.Conn, metadata *C.Metadata) {
 	connCtx := icontext.NewConnContext(conn, metadata)
@@ -114,15 +112,15 @@ func (t tunnel) NatTable() C.NatTable {
 	return natTable
 }
 
-func (t tunnel) Providers() map[string]provider.ProxyProvider {
+func (t tunnel) Providers() map[string]P.ProxyProvider {
 	return providers
 }
 
-func (t tunnel) RuleProviders() map[string]provider.RuleProvider {
+func (t tunnel) RuleProviders() map[string]P.RuleProvider {
 	return ruleProviders
 }
 
-func (t tunnel) RuleUpdateCallback() *utils.Callback[provider.RuleProvider] {
+func (t tunnel) RuleUpdateCallback() *utils.Callback[P.RuleProvider] {
 	return ruleUpdateCallback
 }
 
@@ -142,14 +140,6 @@ func Status() TunnelStatus {
 	return status.Load()
 }
 
-func SetFakeIPRange(p netip.Prefix) {
-	fakeIPRange = p
-}
-
-func FakeIPRange() netip.Prefix {
-	return fakeIPRange
-}
-
 func SetSniffing(b bool) {
 	if snifferDispatcher.Enable() {
 		configMux.Lock()
@@ -205,7 +195,7 @@ func Listeners() map[string]C.InboundListener {
 }
 
 // UpdateRules handle update rules
-func UpdateRules(newRules []C.Rule, newSubRule map[string][]C.Rule, rp map[string]provider.RuleProvider) {
+func UpdateRules(newRules []C.Rule, newSubRule map[string][]C.Rule, rp map[string]P.RuleProvider) {
 	configMux.Lock()
 	rules = newRules
 	ruleProviders = rp
@@ -233,17 +223,17 @@ func ProxiesWithProviders() map[string]C.Proxy {
 }
 
 // Providers return all compatible providers
-func Providers() map[string]provider.ProxyProvider {
+func Providers() map[string]P.ProxyProvider {
 	return providers
 }
 
 // RuleProviders return all loaded rule providers
-func RuleProviders() map[string]provider.RuleProvider {
+func RuleProviders() map[string]P.RuleProvider {
 	return ruleProviders
 }
 
 // UpdateProxies handle update proxies
-func UpdateProxies(newProxies map[string]C.Proxy, newProviders map[string]provider.ProxyProvider) {
+func UpdateProxies(newProxies map[string]C.Proxy, newProviders map[string]P.ProxyProvider) {
 	configMux.Lock()
 	proxies = newProxies
 	providers = newProviders
@@ -273,13 +263,13 @@ func SetMode(m TunnelMode) {
 	mode = m
 }
 
-func FindProcessMode() P.FindProcessMode {
+func FindProcessMode() process.FindProcessMode {
 	return findProcessMode.Load()
 }
 
 // SetFindProcessMode replace SetAlwaysFindProcess
 // always find process info if legacyAlways = true or mode.Always() = true, may be increase many memory
-func SetFindProcessMode(mode P.FindProcessMode) {
+func SetFindProcessMode(mode process.FindProcessMode) {
 	findProcessMode.Store(mode)
 }
 
@@ -368,7 +358,7 @@ func resolveMetadata(metadata *C.Metadata) (proxy C.Proxy, rule C.Rule, err erro
 				attemptProcessLookup = false
 				if !features.CMFA {
 					// normal check for process
-					uid, path, err := P.FindProcessName(metadata.NetWork.String(), metadata.SrcIP, int(metadata.SrcPort))
+					uid, path, err := process.FindProcessName(metadata.NetWork.String(), metadata.SrcIP, int(metadata.SrcPort))
 					if err != nil {
 						log.Debugln("[Process] find process error for %s: %v", metadata.String(), err)
 					} else {
@@ -376,13 +366,13 @@ func resolveMetadata(metadata *C.Metadata) (proxy C.Proxy, rule C.Rule, err erro
 						metadata.ProcessPath = path
 						metadata.Uid = uid
 
-						if pkg, err := P.FindPackageName(metadata); err == nil { // for android (not CMFA) package names
+						if pkg, err := process.FindPackageName(metadata); err == nil { // for android (not CMFA) package names
 							metadata.Process = pkg
 						}
 					}
 				} else {
 					// check package names
-					pkg, err := P.FindPackageName(metadata)
+					pkg, err := process.FindPackageName(metadata)
 					if err != nil {
 						log.Debugln("[Process] find process error for %s: %v", metadata.String(), err)
 					} else {
@@ -394,10 +384,10 @@ func resolveMetadata(metadata *C.Metadata) (proxy C.Proxy, rule C.Rule, err erro
 	}
 
 	switch FindProcessMode() {
-	case P.FindProcessAlways:
+	case process.FindProcessAlways:
 		helper.FindProcess()
 		helper.FindProcess = nil
-	case P.FindProcessOff:
+	case process.FindProcessOff:
 		helper.FindProcess = nil
 	}
 
@@ -563,7 +553,7 @@ func handleTCPConn(connCtx C.ConnContext) {
 	dialMetadata := metadata
 	if len(metadata.Host) > 0 {
 		if node, ok := resolver.DefaultHosts.Search(metadata.Host, false); ok {
-			if dstIp, _ := node.RandIP(); !FakeIPRange().Contains(dstIp) {
+			if dstIp, _ := node.RandIP(); !resolver.IsFakeIP(dstIp) {
 				dialMetadata.DstIP = dstIp
 				dialMetadata.DNSMode = C.DNSHosts
 				dialMetadata = dialMetadata.Pure()