Fix data race between rule-set updates and matching - #4353

Open

solodecode wants to merge 240 commits into

SagerNet:testingfrom

solodecode:agent/fix-ruleset-reload-race

Commits on Aug 12, 2026

Add MAC and hostname rule items
nekohasekai
committed
c74f4b9
Add Android support for MAC and hostname rule items
nekohasekai
committed
55650fb
Add macOS support for MAC and hostname rule items
nekohasekai
committed
f97471e
documentation: Update descriptions for neighbor rules
nekohasekai
committed
50cf90c
Refactor ACME support to certificate provider
nekohasekai
committed
7dfe779
Add BBR profile and hop interval randomization for Hysteria2
nekohasekai
committed
23114fd
platform: Add OOM Report & Crash Report
nekohasekai
committed
759931c
Also enable certificate store by default on Apple platforms
nekohasekai
committed
ae96a54
Add evaluate DNS rule action and related rule items
nekohasekai
committed
d0ee065
platform: Fix set local
nekohasekai
committed
5a44508
Fix deprecated warning double-formatting on localized clients
nekohasekai
committed
1258a3d
oom-killer: Free memory on pressure notification and use gradual interval backoff
nekohasekai
committed
ae97f49
tools: Network Quality & STUN
nekohasekai
committed
eab2d32
platform: Fix darwin signal handler
nekohasekai
committed
c6b7847
tools: Tailscale status
nekohasekai
committed
3868453
Revert "Also enable certificate store by default on Apple platforms"
nekohasekai
committed
88f37d7
Fix rules lock
nekohasekai
committed
aa36d8b
Fix darwin local DNS transport
nekohasekai
committed
733557b
tools: Tailscale status
nekohasekai
committed
152b998
Un-deprecate `ip_accept_any` DNS rule item
nekohasekai
committed
0560761
documentation: Fixes
nekohasekai
committed
8e9f63b
Add `package_name_regex` route, DNS and headless rule item
nekohasekai
committed
da80b88
platform: Wrap command RPC error returns with E.Cause
nekohasekai
committed
95a2358
Fix lint errors
nekohasekai
committed
857a764
Add cloudflared inbound
nekohasekai
committed
47240c4
documentation: Fix missing update for `ip_version` and `query_type`
nekohasekai
committed
8e4ad90
Fix stun test
nekohasekai
committed
e2a7b31
Fix darwin cgo DNS again
nekohasekai
committed
abfde3c
Fix tailscale error
nekohasekai
committed
6149d2e
Add optimistic DNS cache
nekohasekai
committed
3e358d2
oom-killer: Record report before reset network
nekohasekai
committed
faf475a
Refactor: HTTP clients, unified HTTP2/QUIC options, Apple engines
nekohasekai
committed
f81edb5
Standardize hosts path
nekohasekai
committed
16b3072
Add TLS spoof support
nekohasekai
committed
fba43bc
Fix legacy rule-set download_detour blocked by empty direct check
nekohasekai
committed
953c06f
Reject pure-IP rule-set references without match_response
nekohasekai
committed
59150d3
Fix use-after-free of pooled value buffers in bbolt Batch writes
nekohasekai
committed
2bc10fc
Reject IP literal server name with TLS spoof
nekohasekai
committed
7f45557
Fix macOS tlsspoof
nekohasekai
committed
6270529
Scope HTTP/2 fallback and HTTP/3 broken state per authority
nekohasekai
committed
0775c68
Defer implicit default HTTP client fallback to first use
nekohasekai
committed
870faa1
Strip EDNS padding from upstream DNS responses
nekohasekai
committed
aea71e5
Fix Apple TLS metadata capture
nekohasekai
committed
cac5f24
Fix tls-spoof
nekohasekai
committed
bf92a5a
Add search domain support for Tailscale DNS
nekohasekai
committed
f68eed0
Log DNS optimistic background refresh outcomes
nekohasekai
committed
cb70d47
Fix Tailscale search domain response name mismatch
nekohasekai
committed
027585a
Fix goroutine leak in networkquality tool
nekohasekai
committed
5a5b16f
Add ACME profile support for IP address certificates
nekohasekai
committed
39ce21a
platform: Improve oom-killer
nekohasekai
committed
169749f
Fix darwin cgo DNS again
nekohasekai
committed
a6e4a67
Improve UDP batch support
nekohasekai
committed
6b96e48
Add Windows TLS engine
nekohasekai
committed
34ca17d
Preserve comments between formatting
nekohasekai
committed
4617cc8
Improve oom-killer
nekohasekai
committed
24b3729
ssh: Add cipher, MAC, and key exchange configuration
nekohasekai
committed
8343cc9
dns: Add timeout configuration
nekohasekai
committed
feed706
Fix tailscale start dependencies
nekohasekai
committed
f23a3b3
dns: Add neighbor-based hostname resolution to local server
nekohasekai
committed
e7af153
dns: Add preferred_by rule item
nekohasekai
committed
b390c95
dns: Add mDNS server
nekohasekai
committed
869f40a
Allow customizing TUN DNS mode and hijack interface DNS by default
nekohasekai
committed
7af429a
Add more spoof method

macronut
authored and
nekohasekai
committed
6b70d0f
Fix reset network
nekohasekai
committed
2447788
Add hysteria2 realm service and support
nekohasekai
committed
49eb678
Update hysteria2 realm
nekohasekai
committed
1f173e0
Fix TLS server close
nekohasekai
committed
81d8c30
Fix hysteria2 realm server
nekohasekai
committed
a137302
Fix lint errors
nekohasekai
committed
a88de64
oom-killer: Remove log "OOM draft discarded"
nekohasekai
committed
accfa1c
tailscale: Revert dialer deprecation and remove control_http_client
nekohasekai
committed
b7bafa1
tailscale: Fix handle peer DNS query
nekohasekai
committed
adfdfa6
tailscale: Add runtime exit node API
nekohasekai
committed
43ff49c
tailscale: Expose more peer info fields
nekohasekai
committed
aaf0d36
Fix tailscale dns
nekohasekai
committed
cf9d04f
daemon: Add Tailssh
nekohasekai
committed
0e9bc79
hysteria2: Add gecko obfs
nekohasekai
committed
4720d8e
tools: Fix mising cleanup
nekohasekai
committed
3747c52
tailscale: Add tailssh server
nekohasekai
committed
269cf27
tailssh: fix platform SFTP session teardown
nekohasekai
committed
b77f4cf
platform: Add tailscale device name and logout
nekohasekai
committed
c650748
platform: Add shell support for iOS
nekohasekai
committed
cb80834
daemon: Split host operations into ManagedService
nekohasekai
committed
c490cf5
Add sing-box API service
nekohasekai
committed
118b71a
tailscale: Fix auth URL not refreshed after logout
nekohasekai
committed
7e8e480
Fix group status updates broken by API service
nekohasekai
committed
3fbd6c6
release: Fix apple release
nekohasekai
committed
d6559d7
dns: Remove unused files
nekohasekai
committed
f84d59d
Improve remote rule-set update
nekohasekai
committed
e7037d5
Add dashboard support for API service
nekohasekai
committed
1c783ef
Fix remote control when Clash server is unavailable
nekohasekai
committed
bee59c2
Add USB/IP service
nekohasekai
committed
a1d658e
Add USB/IP support for macOS
nekohasekai
committed
553551c
documentation: Add USB/IP server and client
nekohasekai
committed
a36e678
Fix Cloudflared edge discovery ignoring configured resolver
nekohasekai
committed
4658464
Add iOS jailbreak release
nekohasekai
committed
968cab0
certificate: Replace platform bridge with CGO JNI
nekohasekai
committed
833dec1
platform: Fix missing api version check for usb/ip
nekohasekai
committed
7ac42a1
Fix oom draft flood
nekohasekai
committed
ec00732
release: Fix upload ios deb
nekohasekai
committed
39f7e4c
Refactor darwin local DNS to raw mDNSResponder call
nekohasekai
committed
1146426
Write logs to oom report
nekohasekai
committed
f72b1d3
Add age support for report export
nekohasekai
committed
907e907
Improve DHCP DNS server initialize
nekohasekai
committed
882c45e
Fix linux ping
nekohasekai
committed
4ae5963
tls: Fix read wait buffer sizing
nekohasekai
committed
f88acea
dialer: Dial directly when only one interface is available
nekohasekai
committed
72eb86f
Add snell protocol
nekohasekai
committed
fe2ab12
Add L3 forwarding support
nekohasekai
committed
5294582
Fix local DNS transport on darwin
nekohasekai
committed
24eedbe
Imrpove flow tracking & sniff action
nekohasekai
committed
6e386f9
daemon: Release memory to OS on service reload
nekohasekai
committed
efe429e
Add bridge outbound
nekohasekai
committed
7d3d2c8
Improve bridge
nekohasekai
committed
e1597a4
Add windows bridge
nekohasekai
committed
eec9d5b
Improve darwin bridge
nekohasekai
committed
c9415ec
Fix bridge MTU
nekohasekai
committed
788b4fd
Improve windivert syscall
nekohasekai
committed
04daaab
Fix windows bridge forwarding to connected subnets
nekohasekai
committed
974cd30
Fix macOS bridge with includeAllNetworks
nekohasekai
committed
df2b7dc
Fix macOS bridge kernel panic
nekohasekai
committed
b87d35f
Fix process and neighbor rules not matched in pre-match
nekohasekai
committed
0bd1db3
Add hysteria2 realm ip_version and port_mapping options
nekohasekai
committed
df0950e
Add connections to OOM report
nekohasekai
committed
ddcc210
Fix tailscale version
nekohasekai
committed
c4e0ae0
Add netns and unshare support
nekohasekai
committed
08373f7
Fix netns manager
nekohasekai
committed
015df2c
windivert: Verify cached driver against embedded asset before load
nekohasekai
committed
c8ba78a
platform: Export tester and reporter
nekohasekai
committed
d2bbf13
Fix windivert open
nekohasekai
committed
c74fdb3
bridge: Raise accept_ra to 2 when enabling IPv6 forwarding
nekohasekai
committed
7233647
Fix daemon groups
nekohasekai
committed
b0d5bfe
platform: Add boxdd
nekohasekai
committed
64ba5bd
platform: Fix daemon data
nekohasekai
committed
6cce419
platform: Add http proxy support for Windows
nekohasekai
committed
cc78401
documentation: Update icon svg
nekohasekai
committed
aff83a2
Fix nfqueue options
nekohasekai
committed
3db173e
windivert: stabilize Windows driver lifecycle
nekohasekai
committed
56a5fd5
Fix SetGroupExpand race
nekohasekai
committed
cb73716
Fix tun gso check
nekohasekai
committed
a63b1f6
Fix nftables flush
nekohasekai
committed
7f71aa8
Fix windows bridge
nekohasekai
committed
44c4eea
Add windows build
nekohasekai
committed
6bc9be1
boxdd: Fix log format
nekohasekai
committed
fbf3fca
boxxx: Add update API
nekohasekai
committed
77fa186
boxdd: Add custom working directory support
nekohasekai
committed
58ab2c3
tailscale: support Windows SSH user sessions
nekohasekai
committed
2f1725b
Update windows build
nekohasekai
committed
3e62072
boxdd: Add insecure mode
nekohasekai
committed
7ece892
Fix start lifecycle
nekohasekai
committed
ebb8e30
platform: Fix version compare
nekohasekai
committed
7a45936
Fix oomkiller
nekohasekai
committed
721fd1f
Fix iOS brdige
nekohasekai
committed
22400f3
Add multiple tags support to rule-sets
nekohasekai
committed
1790426
boxx: Fix unsafe installation
nekohasekai
committed
b6922f6
refactor: New tun udpnat
nekohasekai
committed
275930f
Refactor endpoint listen
nekohasekai
committed
974c5ae
Update Go to 1.25.12
nekohasekai
committed
09ce72b
Add openvpn and openconnect
nekohasekai
committed
40686b8
Fix bind control for auto redirect
nekohasekai
committed
7048c68
Refactor endpoint in started interface
nekohasekai
committed
440e662
Refactor OpenVPN and OpenConnect endpoints
nekohasekai
committed
f6eeb98
Fix SSO support for anyconnect
nekohasekai
committed
7c8cc6c
Refactor UDP DNS hijack
nekohasekai
committed
0403293
refactor: Async DNS
nekohasekai
committed
05e21a6
Fix DNS route suffix matching
nekohasekai
committed
fdab844
boxdd: Fix linux permission
nekohasekai
committed
298aa31
Improve network reset
nekohasekai
committed
aaaaf48
boxdd: Implement linux http proxy
nekohasekai
committed
56cbb96
desktop: Pin dependencies
nekohasekai
committed
26aced4
Add linux desktop build
nekohasekai
committed
e8fb6a4
openconnect: Fix Fortinet SSO
nekohasekai
committed
48e0084
Fix wg detour
nekohasekai
committed
0f2bab4
boxdd: Fix unsafe permission check
nekohasekai
committed
e531fb7
openvpn: Fix certificate verification compatibility
nekohasekai
committed
7a859f5
Fix security check message
nekohasekai
committed
d5c30c7
Improve OpenVPN & OpenConnect interoperability
nekohasekai
committed
e74b3a7
build: Refactor workflow
nekohasekai
committed
8e523d0
boxdd: Fix windows update
nekohasekai
committed
db6939d
Fix TCP DNS retry
nekohasekai
committed
23cfc30
Update uTLS to v1.8.7

flyzstu
authored and
nekohasekai
committed
0c8afac
Update issue template for new clients
nekohasekai
committed
201ccd4
Add Fortinet hostcheck support
nekohasekai
committed
bc7ddc0
release: Improve release workflow
nekohasekai
committed
ce0ae2e
Fix Tailscale 4via6 subnet routing
nekohasekai
committed
9775083
dns: Cache responses with client subnet
nekohasekai
committed
cd66967
dns: Probe connection reuse support for TCP transports
nekohasekai
committed
49475d4
Fix Fortinet SSO again
nekohasekai
committed
e865198
platform: Fix WIFI state on reload
nekohasekai
committed
d3476d2
route: simplify rule_set matching semantics
nekohasekai
committed
3e1c0b3
dns: Add namespace and parallel support for evaluate
nekohasekai
committed
2020d43
Add JSON schema support
nekohasekai
committed
1bb7099
release: Fix linux sign
nekohasekai
committed
5f6fe5b
Add initial_path option to remote rule-sets
nekohasekai
committed
81755b9
daemon: Improve URLTest
nekohasekai
committed
193f8ff
Fix inconsistent URLTest results
nekohasekai
committed
75e14db
Fix string type
nekohasekai
committed
e191038
Fix openvpn
nekohasekai
committed
ac35674
release: Fix rpm package format for desktop client
nekohasekai
committed
9ff67ed
dns: Fix completed race rule blocked by earlier armed rule
nekohasekai
committed
4672f45
wireguard: Fix system device configures DNS for interface
nekohasekai
committed
58294ae
Fix TLS fragment ACK wait on Windows without TCP estats
nekohasekai
committed
adb2599
Remove client metadata from AnyTLS requests by default
nekohasekai
committed
7516785
Update tailscale to v1.102.1
nekohasekai
committed
c203194
Update quic-go to v0.61.0
nekohasekai
committed
ae60956
Add hysteria2 chrome parrot support
nekohasekai
committed
f8bf426
Update gvisor to 20260727.0
nekohasekai
committed
eab3d61
dns: Fix preferred_by local support for platform local transport

NagaseMinato
authored and
nekohasekai
committed
ea280d9
Fix security check for executables
nekohasekai
committed
5d9d0c5
Use connected sockets for QUIC clients
nekohasekai
committed
bb02b05
Improve UDP packet usage for darwin
nekohasekai
committed
11d74fe
Fix hysteria2 chrome parrot
nekohasekai
committed
90e0e48
Package WinDivert drivers instead of embedding it
nekohasekai
committed
9bcc038
Fix DNS response buffer headroom
nekohasekai
committed
f3a11fa
Fix QUIC connection closed by ENOBUFS
nekohasekai
committed
ded2c0a
Avoid clearing DNS caches during network resets
nekohasekai
committed
290aef0
Update Go to 1.26.5
nekohasekai
committed
74dd6d3
Enable stateless reset for hysteria2 server when obfs disabled
nekohasekai
committed
85eb3d7
daemon: Fix endpoint subscription
nekohasekai
committed
3f8fbed
Fix missing process info in hijacked DNS queries
nekohasekai
committed
339b193
Fix Android process finder
nekohasekai
committed
59ae84d
openconnect: Improve PPP carrier tolerance
nekohasekai
committed
5313f31
Resolve and race all WireGuard addresses on handshake
nekohasekai
committed
383d01d
Refactor local DNS transport
nekohasekai
committed
4a68c79
Partition local DNS caches by interface signature
nekohasekai
committed
a7afc09
Bump version
nekohasekai
committed
7437ed4
Fix search domain handling in DNS transports
nekohasekai
committed
14cca98
daemon: Throttle group and outbound subscription pushes
nekohasekai
committed
3e16ce7
documentation: Rename Root Helper to Helper Service
nekohasekai
committed
ce774aa

Commits on Aug 14, 2026

Fix file descriptor double close when netlink socket bind fails
nekohasekai
committed
f01af83

Commits on Aug 15, 2026

Add Taildrop support
nekohasekai
committed
484684f
Update Go to 1.26.6
nekohasekai
committed
deffcb4
Install Apple provisioning profiles from a variable number of secrets
nekohasekai
committed
1a47451
Bump version
nekohasekai
committed
e98ae31

Commits on Aug 16, 2026

Fix data race between rule-set updates and matching
solodecode
committed
7498672