base sagernet and migrate to circleci

.circleci/config.yml

@@ -0,0 +1,216 @@
+# O.M.V. 帝江号 — CircleCI pipeline
+#
+# Transcribed from the original .gitlab-ci.yml. The GitLab job did everything in a
+# single stage; here it is split into a fast, dependency-light gate (`verify-core`,
+# the with_purego / CGO-disabled build that needs no Android NDK) and the heavy
+# `build-android` job (gomobile AAR + Gradle APK). The gate must go green before the
+# expensive Android job starts, so broken patches fail in ~1 minute instead of ~20.
+#
+# Orbs do the undifferentiated heavy lifting:
+#   * circleci/android  — machine executor with a preinstalled JDK 17 + Android SDK.
+#   * circleci/go       — pinned Go toolchain install.
+# Caching (Go modules/build cache, Gradle) and artifact upload use the native
+# CircleCI primitives so the keys can be derived from the *generated* works/core/go.sum.
+
+version: 2.1
+
+orbs:
+  android: circleci/android@2.5.0
+  go: circleci/go@1.11.0
+
+parameters:
+  go-version:
+    type: string
+    default: "1.26.2"
+  # We now base directly on upstream SagerNet/sing-box (works/config), whose
+  # .gitmodules points clients/android at SagerNet's own app. The O.M.V. Android
+  # build must instead use *our* fork (branch dev, `other` flavour, our keystore) —
+  # that submodule override was the whole reason omv-dijiang used to build on a
+  # private sing-box mirror. So we re-point it in CI, right after pulling upstream.
+  android-client-url:
+    type: string
+    default: "https://git.sfclub.cc/icybear/sing-box-for-android.git"
+  android-client-branch:
+    type: string
+    default: "dev"
+
+commands:
+  # bin/update clones the latest `testing` sing-box (see works/config) and bin/apply-ci
+  # materialises works/core = upstream + works/patch/*. Shared by both jobs.
+  sync-upstream:
+    description: Fetch latest testing sing-box and apply the O.M.V. patches
+    steps:
+      - run:
+          name: bin/update + bin/apply-ci
+          command: |
+            git config --global user.name "${GIT_AUTHOR_NAME:-omv-ci}"
+            git config --global user.email "${GIT_AUTHOR_EMAIL:-omv-ci@local}"
+            bin/update
+            bin/apply-ci
+
+  restore-go-cache:
+    description: Restore the Go module + build cache keyed on the generated go.sum
+    steps:
+      - restore_cache:
+          keys:
+            - omv-go-v1-{{ arch }}-{{ checksum "works/core/go.sum" }}
+            - omv-go-v1-{{ arch }}-
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Fast gate: prove works/core compiles without CGO/NDK (with_purego).
+  # This is the build the machine can actually run; the Android AAR needs an NDK.
+  # ---------------------------------------------------------------------------
+  verify-core:
+    docker:
+      - image: golang:<< pipeline.parameters.go-version >>-bookworm
+    resource_class: large
+    working_directory: ~/project
+    environment:
+      CGO_ENABLED: "0"
+      GOFLAGS: "-mod=mod"
+      GOMODCACHE: /go/pkg/mod
+      GOCACHE: /root/.cache/go-build
+      # OTHERS build tags minus with_naive_outbound (needs cgo), plus with_purego.
+      BUILD_TAGS: "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_usbip,badlinkname,tfogo_checklinkname0,with_purego"
+    steps:
+      - checkout
+      - run:
+          name: Install system dependencies
+          command: |
+            apt-get update
+            apt-get install -y --no-install-recommends git rsync patch unzip curl ca-certificates
+      - sync-upstream
+      - restore-go-cache
+      - run:
+          name: Build core + libbox (with_purego, no NDK)
+          working_directory: ~/project/works/core
+          command: |
+            go mod tidy
+            version="$(git describe --tags --always)-${CIRCLE_SHA1:0:8}"
+            echo "building $version"
+            # -checklinkname=0 authorises upstream's //go:linkname pulls (LDFLAGS file).
+            go build -v -tags "$BUILD_TAGS" \
+              -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=$version' -checklinkname=0" \
+              -o /tmp/sing-box ./cmd/sing-box
+            # The AAR wraps experimental/libbox; compile it too so the mobile-facing
+            # code is covered even though we don't cross-compile with gomobile here.
+            go build -v -tags "$BUILD_TAGS" ./experimental/libbox
+      - run:
+          name: Validate O.M.V. sample configs
+          command: |
+            for c in minecraft/server minecraft/client obfhttp/server obfhttp/client; do
+              echo "check config/$c/config.json"
+              /tmp/sing-box check -c "config/$c/config.json"
+            done
+      - save_cache:
+          key: omv-go-v1-{{ arch }}-{{ checksum "works/core/go.sum" }}
+          paths:
+            - /go/pkg/mod
+            - /root/.cache/go-build
+      - store_artifacts:
+          path: /tmp/sing-box
+          destination: sing-box-linux-amd64
+
+  # ---------------------------------------------------------------------------
+  # Full Android build: gomobile AAR (CGO + NDK) then Gradle assembleOtherRelease.
+  # Mirrors the original GitLab job.
+  # ---------------------------------------------------------------------------
+  build-android:
+    executor:
+      name: android/android-machine
+      resource-class: large
+      # `android:default` is CircleCI's rolling Linux+Android machine image (JDK 17,
+      # Android SDK preinstalled). Pin to a dated tag (e.g. 2024.11.1) for reproducibility.
+      tag: default
+    environment:
+      ANDROID_NDK_VERSION: r28
+      GOFLAGS: "-mod=mod"
+      GOMODCACHE: /home/circleci/go/pkg/mod
+      GOCACHE: /home/circleci/.cache/go-build
+      # Placeholder debug-keystore password carried over from the GitLab CI. For real
+      # releases DO NOT commit this — set LOCAL_PROPERTIES in a CircleCI context or
+      # project environment variable (base64 of KEYSTORE_PASS/ALIAS_NAME/ALIAS_PASS).
+      LOCAL_PROPERTIES: "S0VZU1RPUkVfUEFTUz0xMTQ1MTQKQUxJQVNfTkFNRT1hbGlhcwpBTElBU19QQVNTPTExNDUxNAo="
+    steps:
+      - checkout
+      - go/install:
+          version: << pipeline.parameters.go-version >>
+      - run:
+          name: Install extra system dependencies
+          command: sudo apt-get update && sudo apt-get install -y --no-install-recommends rsync patch unzip
+      - run:
+          name: Provision Android SDK + NDK
+          command: bash ./setup-ndk.sh
+      - sync-upstream
+      - run:
+          name: Re-point clients/android at our fork, then init it
+          working_directory: ~/project/works/core
+          command: |
+            # Upstream's gitlink pins a SagerNet android commit our fork doesn't have,
+            # so swap the URL, pin the branch, and use --remote to check out our fork's
+            # branch tip instead of the (unreachable) pinned SHA.
+            git submodule set-url clients/android "<< pipeline.parameters.android-client-url >>"
+            git config -f .gitmodules submodule.clients/android.branch "<< pipeline.parameters.android-client-branch >>"
+            git submodule sync clients/android
+            git submodule update --init --remote --recursive clients/android
+            echo "clients/android now:" && git -C clients/android remote get-url origin && git -C clients/android log --oneline -1
+      - restore-go-cache
+      - restore_cache:
+          keys:
+            - omv-gradle-v1-{{ checksum "works/core/clients/android/gradle/libs.versions.toml" }}
+            - omv-gradle-v1-
+      - run:
+          name: Build libbox AAR (gomobile)
+          working_directory: ~/project/works/core
+          command: |
+            export ANDROID_HOME="$CIRCLE_WORKING_DIRECTORY/Android/Sdk"
+            export ANDROID_SDK_ROOT="$ANDROID_HOME"
+            version="$(git describe --tags --always)-${CIRCLE_SHA1:0:8}"
+            echo "building version $version"
+            make lib_install
+            export PATH="$PATH:$(go env GOPATH)/bin"
+            go mod tidy
+            make lib_android
+      - run:
+          name: Assemble APK (assembleOtherRelease)
+          working_directory: ~/project/works/core
+          command: |
+            export ANDROID_HOME="$CIRCLE_WORKING_DIRECTORY/Android/Sdk"
+            # clients/android is already checked out at our fork's branch tip (see the
+            # "Re-point clients/android" step, which uses `submodule update --remote`).
+            go run -v ./cmd/internal/update_android_version --ci --nightly
+            mkdir -p clients/android/app/libs
+            cp ./*.aar clients/android/app/libs
+            cd clients/android
+            ./gradlew --no-daemon :app:assembleOtherRelease
+      - run:
+          name: Collect artifacts
+          working_directory: ~/project/works/core
+          command: |
+            mkdir -p /tmp/dist
+            cp clients/android/app/build/outputs/apk/other/release/*arm64-v8a.apk /tmp/dist/
+            VERSION_CODE=$(grep VERSION_CODE clients/android/version.properties | cut -d= -f2)
+            VERSION_NAME=$(grep VERSION_NAME clients/android/version.properties | cut -d= -f2)
+            echo "Built versionCode=$VERSION_CODE versionName=$VERSION_NAME"
+      - save_cache:
+          key: omv-go-v1-{{ arch }}-{{ checksum "works/core/go.sum" }}
+          paths:
+            - /home/circleci/go/pkg/mod
+            - /home/circleci/.cache/go-build
+      - save_cache:
+          key: omv-gradle-v1-{{ checksum "works/core/clients/android/gradle/libs.versions.toml" }}
+          paths:
+            - /home/circleci/.gradle/caches
+            - /home/circleci/.gradle/wrapper
+      - store_artifacts:
+          path: /tmp/dist
+          destination: dist
+
+workflows:
+  build:
+    jobs:
+      - verify-core
+      - build-android:
+          requires:
+            - verify-core

works/config

@@ -1,2 +1,12 @@
-REPO_URL=git@git.inker.bot:arknights/sing-box.git
+# OMV upstream configuration (sourced as /bin/sh by bin/update, bin/apply, bin/apply-ci)
-UPSTREAM_BRANCH=dev-next
+#
+# The ultimate upstream of sing-box is SagerNet/sing-box. omv-dijiang tracks its
+# `testing` branch (the rolling development branch, currently v1.14.0-alpha.44+).
+#
+# Previously this pointed at `git@git.inker.bot:arknights/sing-box.git` (branch
+# dev-next), which requires SSH auth and is unreachable from CI, while the
+# git.sfclub.cc/icybear mirror lagged behind on a 1.13.11/1.14 hybrid. Pointing
+# straight at the authoritative testing branch makes `bin/update` fetch the real
+# latest testing over anonymous HTTPS.
+REPO_URL=https://github.com/SagerNet/sing-box.git
+UPSTREAM_BRANCH=testing

works/patch/adapter/inbound.go.patch

@@ -1,26 +1,10 @@
 --- a/adapter/inbound.go
 +++ b/adapter/inbound.go
-@@ -79,14 +79,15 @@
+@@ -85,6 +85,7 @@
- 	FallbackNetworkType []C.InterfaceType
  	FallbackDelay       time.Duration
  
--	DestinationAddresses []netip.Addr
+ 	DestinationAddresses                []netip.Addr
--	SourceGeoIPCode      string
++	IgnoreDestinationAddresses          bool // OMV: match_only, skip pre-resolved destination addresses when dialing
--	GeoIPCode            string
+ 	DNSResponse                         *dns.Msg
--	ProcessInfo          *ConnectionOwner
+ 	DestinationAddressMatchFromResponse bool
--	SourceMACAddress     net.HardwareAddr
+ 	SourceGeoIPCode                     string
--	SourceHostname       string
--	QueryType            uint16
--	FakeIP               bool
-+	DestinationAddresses       []netip.Addr
-+	IgnoreDestinationAddresses bool
-+	SourceGeoIPCode            string
-+	GeoIPCode                  string
-+	ProcessInfo                *ConnectionOwner
-+	SourceMACAddress           net.HardwareAddr
-+	SourceHostname             string
-+	QueryType                  uint16
-+	FakeIP                     bool
- 
- 	// rule cache
- 

works/patch/constant/proxy.go.patch

@@ -1,28 +1,24 @@
 --- a/constant/proxy.go
 +++ b/constant/proxy.go
-@@ -31,6 +31,9 @@
+@@ -40,6 +40,9 @@
- 	TypeCCM          = "ccm"
+ 	TypeHysteriaRealm      = "hysteria-realm"
- 	TypeOCM          = "ocm"
+ 	TypeACME               = "acme"
- 	TypeOOMKiller    = "oom-killer"
+ 	TypeCloudflareOriginCA = "cloudflare-origin-ca"
 +	TypeMySQL              = "mysql"     // OMV
 +	TypeMinecraft          = "minecraft" // OMV
 +	TypeObfHTTP            = "obfhttp"    // OMV
  )
  
  const (
-@@ -88,6 +91,18 @@
+@@ -103,6 +106,14 @@
- 		return "AnyTLS"
- 	case TypeTailscale:
  		return "Tailscale"
-+	// OMV start: register mysql type name
+ 	case TypeCloudflared:
+ 		return "Cloudflared"
++	// OMV start: register omv protocol type names
 +	case TypeMySQL:
 +		return "MySQL"
-+	// OMV end
-+	// OMV start: register minecraft type name
 +	case TypeMinecraft:
 +		return "Minecraft"
-+	// OMV end
-+	// OMV start: register obfhttp type name
 +	case TypeObfHTTP:
 +		return "ObfHTTP"
 +	// OMV end

works/patch/go.mod.patch

@@ -1,6 +1,6 @@
 --- a/go.mod
 +++ b/go.mod
-@@ -11,6 +11,7 @@
+@@ -14,6 +14,7 @@
  	github.com/database64128/tfo-go/v2 v2.3.2
  	github.com/go-chi/chi/v5 v5.2.5
  	github.com/go-chi/render v1.0.3
@@ -8,7 +8,7 @@
  	github.com/godbus/dbus/v5 v5.2.2
  	github.com/gofrs/uuid/v5 v5.4.0
  	github.com/insomniacslk/dhcp v0.0.0-20260220084031-5adc3eb26f91
-@@ -85,6 +86,7 @@
+@@ -102,6 +103,7 @@
  	github.com/go-ole/go-ole v1.3.0 // indirect
  	github.com/gobwas/httphead v0.1.0 // indirect
  	github.com/gobwas/pool v0.2.1 // indirect
@@ -16,9 +16,9 @@
  	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
  	github.com/google/btree v1.1.3 // indirect
  	github.com/google/go-cmp v0.7.0 // indirect
-@@ -100,6 +102,9 @@
+@@ -124,6 +126,9 @@
- 	github.com/mdlayher/socket v0.5.1 // indirect
  	github.com/mitchellh/go-ps v1.0.0 // indirect
+ 	github.com/philhofer/fwd v1.2.0 // indirect
  	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 +	github.com/pingcap/errors v0.11.5-0.20250318082626-8f80e5cb09ec // indirect
 +	github.com/pingcap/log v1.1.1-0.20241212030209-7e3ff8601a2a // indirect
@@ -26,15 +26,15 @@
  	github.com/pires/go-proxyproto v0.8.1 // indirect
  	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
  	github.com/prometheus-community/pro-bing v0.4.0 // indirect
-@@ -136,6 +141,7 @@
+@@ -158,6 +163,7 @@
- 	github.com/sagernet/cronet-go/lib/windows_arm64 v0.0.0-20260413092954-cd09eb3e271b // indirect
+ 	github.com/sagernet/cronet-go/lib/tvos_arm64_simulator v0.0.0-20260712142643-1e5048bd5587 // indirect
- 	github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a // indirect
+ 	github.com/sagernet/cronet-go/lib/windows_amd64 v0.0.0-20260712142643-1e5048bd5587 // indirect
- 	github.com/sagernet/nftables v0.3.0-mod.2 // indirect
+ 	github.com/sagernet/cronet-go/lib/windows_arm64 v0.0.0-20260712142643-1e5048bd5587 // indirect
 +	github.com/shopspring/decimal v1.2.0 // indirect
  	github.com/spf13/pflag v1.0.9 // indirect
  	github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e // indirect
- 	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
+ 	github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 // indirect
-@@ -151,6 +157,7 @@
+@@ -172,6 +178,7 @@
  	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
  	github.com/x448/float16 v0.8.4 // indirect
  	github.com/zeebo/blake3 v0.2.4 // indirect
@@ -42,11 +42,11 @@
  	go.uber.org/multierr v1.11.0 // indirect
  	go.uber.org/zap/exp v0.3.0 // indirect
  	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
-@@ -163,6 +170,7 @@
+@@ -182,6 +189,7 @@
  	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
  	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
  	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 +	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
  	gopkg.in/yaml.v3 v3.0.1 // indirect
  	lukechampine.com/blake3 v1.3.0 // indirect
- )
+ 	zombiezen.com/go/capnproto2 v2.18.2+incompatible // indirect

works/patch/go.sum.patch

@@ -1,14 +1,14 @@
 --- a/go.sum
 +++ b/go.sum
-@@ -14,6 +14,7 @@
+@@ -22,6 +22,7 @@
  github.com/anthropics/anthropic-sdk-go v1.26.0/go.mod h1:qUKmaW+uuPB64iy1l+4kOSvaLqPXnHTTBKH6RVZ7q5Q=
  github.com/anytls/sing-anytls v0.0.11 h1:w8e9Uj1oP3m4zxkyZDewPk0EcQbvVxb7Nn+rapEx4fc=
  github.com/anytls/sing-anytls v0.0.11/go.mod h1:7rjN6IukwysmdusYsrV51Fgu1uW6vsrdd6ctjnEAln8=
 +github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
- github.com/caddyserver/certmagic v0.25.2 h1:D7xcS7ggX/WEY54x0czj7ioTkmDWKIgxtIi2OcQclUc=
+ github.com/caddyserver/certmagic v0.25.3-0.20260421143802-60d9d8b415d6 h1:LYSB6VgWzKtNrcxElw3c97BP40Oc7bizKxA9K1Vi/5k=
- github.com/caddyserver/certmagic v0.25.2/go.mod h1:llW/CvsNmza8S6hmsuggsZeiX+uS27dkqY27wDIuBWg=
+ github.com/caddyserver/certmagic v0.25.3-0.20260421143802-60d9d8b415d6/go.mod h1:llW/CvsNmza8S6hmsuggsZeiX+uS27dkqY27wDIuBWg=
  github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
-@@ -36,6 +37,7 @@
+@@ -48,6 +49,7 @@
  github.com/database64128/tfo-go/v2 v2.3.2 h1:UhZMKiMq3swZGUiETkLBDzQnZBPSAeBMClpJGlnJ5Fw=
  github.com/database64128/tfo-go/v2 v2.3.2/go.mod h1:GC3uB5oa4beGpCUbRb2ZOWP73bJJFmMyAVgQSO7r724=
  github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -16,7 +16,7 @@
  github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
  github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
  github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa h1:h8TfIT1xc8FWbwwpmHn1J5i43Y0uZP97GqasGCzSRJk=
-@@ -68,12 +70,18 @@
+@@ -80,12 +82,18 @@
  github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
  github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
  github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
@@ -35,10 +35,10 @@
  github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
  github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
  github.com/gofrs/uuid/v5 v5.4.0 h1:EfbpCTjqMuGyq5ZJwxqzn3Cbr2d0rUZU7v5ycAk/e/0=
-@@ -110,6 +118,13 @@
+@@ -132,6 +140,13 @@
- github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+ github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
- github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+ github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
- github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+ github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -46,11 +46,11 @@
 +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
  github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
- github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
+@@ -174,8 +189,16 @@
- github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
+ github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
-@@ -144,8 +159,16 @@
- github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
  github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
  github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 +github.com/pingcap/errors v0.11.0/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
@@ -63,20 +63,20 @@
  github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
  github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 +github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+ github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
+ github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
  github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
- github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+@@ -185,6 +208,8 @@
- github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-@@ -153,6 +176,8 @@
  github.com/prometheus-community/pro-bing v0.4.0/go.mod h1:b7wRYZtCcPmt4Sz319BykUU241rWLe1VFXyiyWK/dH4=
  github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
  github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
++github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
++github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
  github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
  github.com/safchain/ethtool v0.3.0 h1:gimQJpsI6sc1yIqP/y8GYgiXn/NjgvpM0RNoWLVVmP0=
  github.com/safchain/ethtool v0.3.0/go.mod h1:SA9BwrgyAqNo7M+uaL6IYbxpm5wk3L7Mm6ocLW+CJUs=
-@@ -260,11 +285,17 @@
+@@ -300,11 +325,17 @@
- github.com/sagernet/wireguard-go v0.0.2-beta.1.0.20260224074747-506b7631853c/go.mod h1:WUxgxUDZoCF2sxVmW+STSxatP02Qn3FcafTiI2BLtE0=
+ github.com/sagernet/wireguard-go v0.0.5-0.20260706153856-2c27bbf4f97f/go.mod h1:hEqi4y5czEg6LYtX2Bpjg+lV0b/J1n+5rA885Z66Mx0=
  github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854 h1:6uUiZcDRnZSAegryaUGwPC/Fj13JSHwiTftrXhMmYOc=
  github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854/go.mod h1:LtfoSK3+NG57tvnVEHgcuBW9ujgE8enPSgzgwStwCAA=
 +github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
@@ -93,7 +93,7 @@
  github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
  github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
  github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-@@ -319,10 +350,19 @@
+@@ -361,10 +392,19 @@
  go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
  go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
  go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
@@ -113,59 +113,34 @@
  go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
  go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
  go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
-@@ -332,6 +372,7 @@
+@@ -383,10 +423,12 @@
- go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
- go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
- go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
-+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
- golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
- golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
- golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-@@ -339,17 +380,22 @@
  golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
  golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
  golang.org/x/image v0.27.0/go.mod h1:xbdrClrAUway1MUTEZDq9mz/UpRwYAkFFNUslZtcB+g=
 +golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
  golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
  golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 +golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
  golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
- golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+@@ -420,9 +462,13 @@
- golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
- golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
- golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
- golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
- golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
- golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
- golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
- golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
- golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
- golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-@@ -361,6 +407,7 @@
- golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
- golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
- golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
- golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
- golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
- golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-@@ -368,8 +415,12 @@
  golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
  golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
  golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 +golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 +golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 +golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+ golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
  golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
  golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+ golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
  golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
  golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
- golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+@@ -441,12 +487,17 @@
-@@ -387,12 +438,17 @@
  google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
  google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
  google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

works/patch/include/registry.go.patch

@@ -1,6 +1,6 @@
 --- a/include/registry.go
 +++ b/include/registry.go
-@@ -23,6 +23,9 @@
+@@ -26,6 +26,9 @@
  	"github.com/sagernet/sing-box/protocol/group"
  	"github.com/sagernet/sing-box/protocol/http"
  	"github.com/sagernet/sing-box/protocol/mixed"
@@ -10,7 +10,7 @@
  	"github.com/sagernet/sing-box/protocol/naive"
  	"github.com/sagernet/sing-box/protocol/redirect"
  	"github.com/sagernet/sing-box/protocol/shadowsocks"
-@@ -62,6 +65,9 @@
+@@ -69,6 +72,9 @@
  	shadowtls.RegisterInbound(registry)
  	vless.RegisterInbound(registry)
  	anytls.RegisterInbound(registry)
@@ -19,8 +19,8 @@
 +	obfhttp.RegisterInbound(registry) // OMV
  
  	registerQUICInbounds(registry)
- 	registerStubForRemovedInbounds(registry)
+ 	registerCloudflaredInbound(registry)
-@@ -90,6 +96,9 @@
+@@ -100,6 +106,9 @@
  	shadowtls.RegisterOutbound(registry)
  	vless.RegisterOutbound(registry)
  	anytls.RegisterOutbound(registry)

works/patch/option/rule_action.go.patch

@@ -1,10 +1,10 @@
 --- a/option/rule_action.go
 +++ b/option/rule_action.go
-@@ -312,6 +312,7 @@
+@@ -334,6 +334,7 @@
- 	DisableCache bool                  `json:"disable_cache,omitempty"`
+ 	DisableOptimisticCache bool                  `json:"disable_optimistic_cache,omitempty"`
  	RewriteTTL             *uint32               `json:"rewrite_ttl,omitempty"`
  	ClientSubnet           *badoption.Prefixable `json:"client_subnet,omitempty"`
-+	MatchOnly    bool                  `json:"match_only,omitempty"`
++	MatchOnly              bool                  `json:"match_only,omitempty"` // OMV: only match the rule, do not use resolved addresses for dialing
  }
  
  type DNSRouteActionPredefined struct {

works/patch/protocol/group/urltest.go.patch

@@ -1,6 +1,6 @@
 --- a/protocol/group/urltest.go
 +++ b/protocol/group/urltest.go
-@@ -39,6 +39,7 @@
+@@ -37,6 +37,7 @@
  	connection                   adapter.ConnectionManager
  	logger                       log.ContextLogger
  	tags                         []string
@@ -8,7 +8,7 @@
  	link                         string
  	interval                     time.Duration
  	tolerance                    uint16
-@@ -61,6 +62,7 @@
+@@ -58,6 +59,7 @@
  		tolerance:                    options.Tolerance,
  		idleTimeout:                  time.Duration(options.IdleTimeout),
  		interruptExternalConnections: options.InterruptExistConnections,
@@ -16,7 +16,7 @@
  	}
  	if len(outbound.tags) == 0 {
  		return nil, E.New("missing tags")
-@@ -77,7 +79,7 @@
+@@ -74,7 +76,7 @@
  		}
  		outbounds = append(outbounds, detour)
  	}
@@ -25,7 +25,7 @@
  	if err != nil {
  		return err
  	}
-@@ -194,6 +196,7 @@
+@@ -175,6 +177,7 @@
  	pauseCallback                *list.Element[pause.Callback]
  	logger                       log.Logger
  	outbounds                    []adapter.Outbound
@@ -33,7 +33,7 @@
  	link                         string
  	interval                     time.Duration
  	tolerance                    uint16
-@@ -211,7 +214,7 @@
+@@ -192,7 +195,7 @@
  	lastActive                   common.TypedValue[time.Time]
  }
  
@@ -42,7 +42,7 @@
  	if interval == 0 {
  		interval = C.DefaultURLTestInterval
  	}
-@@ -221,6 +224,11 @@
+@@ -202,6 +205,11 @@
  	if idleTimeout == 0 {
  		idleTimeout = C.DefaultURLTestIdleTimeout
  	}
@@ -54,7 +54,7 @@
  	if interval > idleTimeout {
  		return nil, E.New("interval must be less or equal than idle_timeout")
  	}
-@@ -237,6 +245,7 @@
+@@ -214,6 +222,7 @@
  		outbound:                     outboundManager,
  		logger:                       logger,
  		outbounds:                    outbounds,
@@ -62,7 +62,7 @@
  		link:                         link,
  		interval:                     interval,
  		tolerance:                    tolerance,
-@@ -392,7 +401,14 @@
+@@ -374,7 +383,14 @@
  				g.logger.Debug("outbound ", tag, " unavailable: ", err)
  				g.history.DeleteURLTestHistory(realTag)
  			} else {

works/patch/protocol/minecraft/inbound.go.patch

@@ -112,7 +112,7 @@
 +	return h.fallbackAddr.IsValid()
 +}
 +
-+func (h *Inbound) NewConnectionEx(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
++func (h *Inbound) NewConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
 +	err := h.handleConnection(ctx, conn, metadata, onClose)
 +	if err != nil && !E.IsClosed(err) {
 +		h.logger.ErrorContext(ctx, E.Cause(err, "process connection from ", metadata.Source))

works/patch/protocol/mysql/inbound.go.patch

@@ -117,7 +117,7 @@
 +	)
 +}
 +
-+func (h *Inbound) NewConnectionEx(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
++func (h *Inbound) NewConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
 +	// Use go-mysql server to perform the MySQL handshake (which negotiates TLS)
 +	mysqlConn, err := h.mysqlServer.NewCustomizedConn(conn, h.identityProvider, &emptyHandler{})
 +	if err != nil {

works/patch/protocol/obfhttp/inbound.go.patch

@@ -163,8 +163,8 @@
 +	)
 +}
 +
-+// NewConnectionEx receives TCP connections from the listener and feeds them to the HTTP server.
++// NewConnection receives TCP connections from the listener and feeds them to the HTTP server.
-+func (h *Inbound) NewConnectionEx(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
++func (h *Inbound) NewConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
 +	if h.tlsConfig != nil {
 +		tlsConn, err := boxTLS.ServerHandshake(ctx, conn, h.tlsConfig)
 +		if err != nil {
@@ -444,7 +444,7 @@
 +	return hex.EncodeToString(b)
 +}
 +
-+// connListener bridges the listener.Listener (which pushes connections via NewConnectionEx)
++// connListener bridges the listener.Listener (which pushes connections via NewConnection)
 +// with http.Server.Serve() (which expects a net.Listener).
 +type connListener struct {
 +	ch   chan net.Conn

works/patch/route/conn.go.patch

@@ -1,6 +1,6 @@
 --- a/route/conn.go
 +++ b/route/conn.go
-@@ -96,7 +96,7 @@
+@@ -98,7 +98,7 @@
  		remoteConn net.Conn
  		err        error
  	)

works/patch/route/route.go.patch

@@ -1,14 +1,6 @@
 --- a/route/route.go
 +++ b/route/route.go
-@@ -372,6 +372,7 @@
+@@ -894,6 +894,7 @@
- 				}
- 			}
- 		} else {
-+			// OMV: some codes about process routing are deleted here for unknown reason, it may break something.
- 			for _, address := range metadata.DestinationAddresses {
- 				if address.Is6() {
- 					newDestination = address
-@@ -796,6 +797,7 @@
  			return err
  		}
  		metadata.DestinationAddresses = addresses

works/patch/route/rule/rule_action.go.patch

@@ -1,18 +1,18 @@
 --- a/route/rule/rule_action.go
 +++ b/route/rule/rule_action.go
-@@ -112,6 +112,7 @@
+@@ -116,6 +116,7 @@
- 			DisableCache: action.ResolveOptions.DisableCache,
+ 			DisableOptimisticCache: action.ResolveOptions.DisableOptimisticCache,
  			RewriteTTL:             action.ResolveOptions.RewriteTTL,
  			ClientSubnet:           action.ResolveOptions.ClientSubnet.Build(netip.Prefix{}),
-+			MatchOnly:    action.ResolveOptions.MatchOnly,
++			MatchOnly:              action.ResolveOptions.MatchOnly, // OMV
  		}, nil
  	default:
  		panic(F.ToString("unknown rule action: ", action.Action))
-@@ -476,6 +477,7 @@
+@@ -552,6 +553,7 @@
- 	DisableCache bool
+ 	DisableOptimisticCache bool
  	RewriteTTL             *uint32
  	ClientSubnet           netip.Prefix
-+	MatchOnly    bool
++	MatchOnly              bool // OMV
  }
  
  func (r *RuleActionResolve) Type() string {

works/rev

@@ -1 +1 @@
-adf0a75e5f7b38f16e67be999eb52a8d7b5e0e63
+5cd932aca2767a599063160e765384da2014677b