feat: make install

fix
feat(web): visual rule builder with geo, CIDR and wildcard pickers
2026-07-27 11:09:03 +08:00 · 2026-07-27 10:45:47 +08:00 · 2026-07-27 08:48:56 +08:00 · 2026-07-27 08:09:11 +08:00 · 2024-04-07 17:49:33 -07:00 · 2024-04-06 14:42:45 -07:00
145 changed files with 14938 additions and 1079 deletions
@@ -0,0 +1,76 @@
+name: Quality check
+on:
+  push:
+    branches:
+    - "*"
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  static-analysis:
+    name: Static analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+
+      - run: go vet ./...
+
+      - name: staticcheck
+        uses: dominikh/staticcheck-action@v1.3.0
+        with:
+          install-go: false
+
+  web-ui:
+    name: Web UI
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: web/frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: web/frontend
+
+      - name: Build
+        run: npm run build
+        working-directory: web/frontend
+
+      - name: Check that the embedded web/dist is up to date
+        run: |
+          git diff --exit-code -- web/dist ||
+            (echo "::error::web/dist is stale, run 'make web' and commit the result" && exit 1)
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+
+      - run: go test ./...
@@ -1,6 +1,7 @@
+name: Release
 on:
  release:
-    types: [ created ]
+    types: [published]

 permissions:
  contents: write
@@ -12,15 +13,39 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        goos: [ linux ]
-        goarch: [ "386", amd64, arm64 ]
+        goos: [linux]
+        goarch: ["386", amd64, arm64]
+
    steps:
      - uses: actions/checkout@v4
-      - uses: wangyoucao577/go-release-action@v1
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          goos: ${{ matrix.goos }}
-          goarch: ${{ matrix.goarch }}
-          goversion: "https://go.dev/dl/go1.21.6.linux-amd64.tar.gz"
-          binary_name: "OpenGFW"
-          extra_files: LICENSE README.md README.zh.md
+          go-version: "1.22"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/frontend/package-lock.json
+
+      - name: Build web UI
+        run: npm ci && npm run build
+        working-directory: web/frontend
+
+      - name: Build
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: 0
+        run: |
+          mkdir -p build
+          go build -o build/OpenGFW-${GOOS}-${GOARCH} \
+            -ldflags "-s -w -X github.com/apernet/OpenGFW/cmd.appVersion=${GITHUB_REF_NAME} -X github.com/apernet/OpenGFW/cmd.appCommit=${GITHUB_SHA::7}" .
+
+      - name: Upload
+        uses: softprops/action-gh-release@v2
+        with:
+          files: build/*
@@ -205,3 +205,16 @@ $RECYCLE.BIN/
 *.lnk

 # End of https://www.toptal.com/developers/gitignore/api/windows,macos,linux,go,goland+all,visualstudiocode
+
+# Internal tools not ready for public use yet
+tools/flowseq/
+
+### Geo databases downloaded at runtime ###
+geoip.dat
+geosite.dat
+
+### Web UI ###
+# The built UI in web/dist IS committed, since it is embedded into the binary.
+web/frontend/node_modules/
+web/frontend/*.tsbuildinfo
+web/frontend/.vite/
@@ -0,0 +1,76 @@
+GO ?= go
+NPM ?= npm
+
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+COMMIT ?= $(shell git rev-parse --short HEAD 2>/dev/null)
+LDFLAGS := -s -w \
+	-X github.com/apernet/OpenGFW/cmd.appVersion=$(VERSION) \
+	-X github.com/apernet/OpenGFW/cmd.appCommit=$(COMMIT)
+
+FRONTEND := web/frontend
+
+.PHONY: all
+all: web build
+
+## build: build the OpenGFW binary (embeds the web UI in web/dist)
+.PHONY: build
+build:
+	$(GO) build -o OpenGFW -ldflags "$(LDFLAGS)" .
+
+## web: build the web UI into web/dist
+.PHONY: web
+web:
+	cd $(FRONTEND) && $(NPM) install && $(NPM) run build
+
+## web-dev: run the Vite dev server against a local OpenGFW instance
+.PHONY: web-dev
+web-dev:
+	cd $(FRONTEND) && $(NPM) run dev
+
+## devserver: serve the web UI with synthetic data (works on any OS)
+.PHONY: devserver
+devserver:
+	$(GO) run ./web/devserver
+
+.PHONY: test
+test:
+	$(GO) test ./...
+
+.PHONY: vet
+vet:
+	$(GO) vet ./...
+
+.PHONY: clean
+clean:
+	rm -f OpenGFW
+	rm -rf $(FRONTEND)/node_modules
+
+.PHONY: install
+install: build
+	@echo "Installing OpenGFW to /usr/local/bin"
+	@install -m 755 OpenGFW /usr/local/bin/OpenGFW || (echo "install failed: try running as root or use sudo" && exit 1)
+	@echo "Installing systemd unit to /etc/systemd/system/opengfw.service"
+	@printf '%s\n' \
+		'[Unit]' \
+		'Description=OpenGFW' \
+		'After=network.target' \
+		'' \
+		'[Service]' \
+		'ExecStart=/usr/local/bin/OpenGFW -c /etc/opengfw/config.yaml /etc/opengfw/rules.yaml' \
+		'Restart=on-failure' \
+		'User=root' \
+		'Group=root' \
+		'WorkingDirectory=/etc/opengfw' \
+		'' \
+		'[Install]' \
+		'WantedBy=multi-user.target' \
+	> /tmp/opengfw.service || (echo "write failed: try running as root or use sudo" && exit 1)
+
+	@echo "Installing default config to /etc/opengfw/"
+	@mkdir -p /etc/opengfw || (echo "mkdir failed: try running as root or use sudo" && exit 1)
+	@install -m 644 config.yaml /etc/opengfw/config.yaml || (echo "copy config failed: try running as root or use sudo" && exit 1)
+	@install -m 644 rules.yaml /etc/opengfw/rules.yaml || (echo "copy rules failed: try running as root or use sudo" && exit 1)
+	@mv /tmp/opengfw.service /etc/systemd/system/opengfw.service || (echo "move failed: try running as root or use sudo" && exit 1)
+	@echo "Reloading systemd daemon and enabling service"
+	@systemctl daemon-reload || (echo "daemon-reload failed: ensure systemd is available" && exit 1)
+	@systemctl enable --now opengfw.service || (echo "enabling service failed: try running as root or use sudo" && exit 1)
@@ -1,33 +1,60 @@
 # ![OpenGFW](docs/logo.png)

+[![Quality check status](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml/badge.svg)](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml)
 [![License][1]][2]

 [1]: https://img.shields.io/badge/License-MPL_2.0-brightgreen.svg
 [2]: LICENSE

-OpenGFW は、Linux 上の [GFW](https://en.wikipedia.org/wiki/Great_Firewall) の柔軟で使いやすいオープンソース実装であり、多くの点で本物より強力です。これは家庭用ルーターでできるサイバー主権です。
+OpenGFW は、あなた専用の DIY 中国のグレートファイアウォール (https://en.wikipedia.org/wiki/Great_Firewall) です。Linux 上で利用可能な柔軟で使いやすいオープンソースプログラムとして提供されています。なぜ権力者だけが楽しむのでしょうか？権力を人々に与え、検閲を民主化する時が来ました。自宅のルーターにサイバー主権のスリルをもたらし、プロのようにフィルタリングを始めましょう - あなたもビッグブラザーになることができます。
+
+**ドキュメントウェブサイト: https://gfw.dev/**
+
+Telegram グループ: https://t.me/OpGFW

 > [!CAUTION]
-> このプロジェクトはまだ開発の初期段階です。使用は自己責任でお願いします。
-
-> [!NOTE]
-> 私たちはこのプロジェクト、特により多くのプロトコル用のアナライザーの実装を手伝ってくれるコントリビューターを探しています！！！
+> 本プロジェクトはまだ初期開発段階にあります。テスト時のリスクは自己責任でお願いします。私たちは、このプロジェクトを一緒に改善するために貢献者を探しています。

 ## 特徴

 - フル IP/TCP 再アセンブル、各種プロトコルアナライザー
-  - HTTP、TLS、DNS、SSH、SOCKS4/5、その他多数
-  - Shadowsocks の"完全に暗号化されたトラフィック"の検出、
-    など。 (https://gfw.report/publications/usenixsecurity23/data/paper/paper.pdf)
-  - トロイの木馬キラー (https://github.com/XTLS/Trojan-killer) に基づくトロイの木馬 (プロキシプロトコル) 検出
+  - HTTP、TLS、QUIC、DNS、SSH、SOCKS4/5、WireGuard、OpenVPN、その他多数
+  - Shadowsocks、VMess の「完全に暗号化されたトラフィック」の検出など (https://gfw.report/publications/usenixsecurity23/en/)
+  - Trojan プロキシプロトコルの検出
  - [WIP] 機械学習に基づくトラフィック分類
 - IPv4 と IPv6 をフルサポート
 - フローベースのマルチコア負荷分散
 - 接続オフロード
 - [expr](https://github.com/expr-lang/expr) に基づく強力なルールエンジン
+- ルールのホットリロード (`SIGHUP` を送信してリロード)
 - 柔軟なアナライザ＆モディファイアフレームワーク
- 拡張可能な IO 実装(今のところ NFQueue のみ)
- [WIP] ウェブ UI
+- 拡張可能な IO 実装 (今のところ NFQueue のみ)
+- リアルタイムのトラフィックダッシュボードとルールエディタを備えたウェブ UI
+
+## ウェブ UI
+
+OpenGFW にはオプションのウェブダッシュボードが同梱されています。リアルタイムのトラフィック統計、
+アナライザのプロパティを含むイベントフィード、そしてルールを検証してホットリロードできるルールエディタが利用できます。
+スマートフォンでもデスクトップでも使えるレスポンシブ対応です。
+
+ルールは条件のリストとして作成できます。フィールド（SNI、DNS 名、HTTP Host、IP、ポート、検出されたプロトコル）と
+条件（ワイルドカード、CIDR、GeoIP の国、GeoSite カテゴリ、範囲、正規表現）、そして 1 つ以上の値を選ぶだけです。
+もちろん expr 式や YAML を直接編集することもできます。
+
+設定ファイルで有効にします:
+
+```yaml
+web:
+  enabled: true
+  listen: :8080
+  secret: パスワード # 空の場合は起動時にランダム生成されログに出力されます
+  # cert: /path/to/fullchain.pem
+  # key: /path/to/privkey.pem
+```
+
+UI はバイナリに埋め込まれているため、追加のファイルを配置する必要はありません。
+パスワードを知る人はルールを変更できるため、信頼できるネットワークにのみ公開してください。
+開発方法は [web/README.md](web/README.md) を参照してください。

 ## ユースケース

@@ -36,78 +63,4 @@ OpenGFW は、Linux 上の [GFW](https://en.wikipedia.org/wiki/Great_Firewall)
 - マルウェア対策
 - VPN/プロキシサービスの不正利用防止
 - トラフィック分析（ログのみモード）
-
-## 使用方法
-
-### ビルド
-
-```shell
-go build
-```
-
-### 実行
-
-```shell
-export OPENGFW_LOG_LEVEL=debug
-./OpenGFW -c config.yaml rules.yaml
-```
-
-### 設定例
-
-```yaml
-io:
-  queueSize: 1024
-  local: true # FORWARD チェーンで OpenGFW を実行したい場合は false に設定する
-
-workers:
-  count: 4
-  queueSize: 16
-  tcpMaxBufferedPagesTotal: 4096
-  tcpMaxBufferedPagesPerConn: 64
-  udpMaxStreams: 4096
-```
-
-### ルール例
-
-サポートされているすべてのプロトコルと、それぞれのプロトコルがどのようなフィールドを持っているかについてのドキュメントはまだ準備できておりません。
-一旦は、"analyzer "ディレクトリの下にあるコードを直接チェックする必要があります。
-
-式言語の構文については、[Expr 言語定義](https://expr-lang.org/docs/language-definition)を参照してください。
-
-```yaml
- name: block v2ex http
-  action: block
-  expr: string(http?.req?.headers?.host) endsWith "v2ex.com"
-
- name: block v2ex https
-  action: block
-  expr: string(tls?.req?.sni) endsWith "v2ex.com"
-
- name: block shadowsocks
-  action: block
-  expr: fet != nil && fet.yes
-
- name: block trojan
-  action: block
-  expr: trojan != nil && trojan.yes
-
- name: v2ex dns poisoning
-  action: modify
-  modifier:
-    name: dns
-    args:
-      a: "0.0.0.0"
-      aaaa: "::"
-  expr: dns != nil && dns.qr && any(dns.questions, {.name endsWith "v2ex.com"})
-
- name: block google socks
-  action: block
-  expr: string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80
-```
-
-#### サポートされるアクション
-
- `allow`: 接続を許可し、それ以上の処理は行わない。
- `block`: 接続をブロックし。
- `drop`: UDP の場合、ルールのトリガーとなったパケットをドロップし、同じフローに含まれる以降のパケットの処理を継続する。TCP の場合は、`block` と同じ。
- `modify`: UDP の場合、与えられた修飾子を使って、ルールをトリガしたパケットを修正し、同じフロー内の今後のパケットを処理し続ける。TCP の場合は、`allow` と同じ。
+- 独裁的な野心を実現するのを助ける
@@ -1,5 +1,6 @@
 # ![OpenGFW](docs/logo.png)

+[![Quality check status](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml/badge.svg)](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml)
 [![License][1]][2]

 [1]: https://img.shields.io/badge/License-MPL_2.0-brightgreen.svg
@@ -8,30 +9,57 @@
 **[中文文档](README.zh.md)**
 **[日本語ドキュメント](README.ja.md)**

-OpenGFW is a flexible, easy-to-use, open source implementation of [GFW](https://en.wikipedia.org/wiki/Great_Firewall) on
-Linux that's in many ways more powerful than the real thing. It's cyber sovereignty you can have on a home router.
+OpenGFW is your very own DIY Great Firewall of China (https://en.wikipedia.org/wiki/Great_Firewall), available as a flexible, easy-to-use open source program on Linux. Why let the powers that be have all the fun? It's time to give power to the people and democratize censorship. Bring the thrill of cyber-sovereignty right into your home router and start filtering like a pro - you too can play Big Brother.
+
+**Documentation site: https://gfw.dev/**
+
+Telegram group: https://t.me/OpGFW

 > [!CAUTION]
-> This project is still in very early stages of development. Use at your own risk.
-
-> [!NOTE]
-> We are looking for contributors to help us with this project, especially implementing analyzers for more protocols!!!
+> This project is still in very early stages of development. Use at your own risk. We are looking for contributors to help us improve and expand the project.

 ## Features

 - Full IP/TCP reassembly, various protocol analyzers
-  - HTTP, TLS, DNS, SSH, SOCKS4/5, and many more to come
-  - "Fully encrypted traffic" detection for Shadowsocks,
-    etc. (https://gfw.report/publications/usenixsecurity23/data/paper/paper.pdf)
-  - Trojan (proxy protocol) detection based on Trojan-killer (https://github.com/XTLS/Trojan-killer)
+  - HTTP, TLS, QUIC, DNS, SSH, SOCKS4/5, WireGuard, OpenVPN, and many more to come
+  - "Fully encrypted traffic" detection for Shadowsocks, VMess,
+    etc. (https://gfw.report/publications/usenixsecurity23/en/)
+  - Trojan (proxy protocol) detection
  - [WIP] Machine learning based traffic classification
 - Full IPv4 and IPv6 support
 - Flow-based multicore load balancing
 - Connection offloading
 - Powerful rule engine based on [expr](https://github.com/expr-lang/expr)
+- Hot-reloadable rules (send `SIGHUP` to reload)
 - Flexible analyzer & modifier framework
 - Extensible IO implementation (only NFQueue for now)
- [WIP] Web UI
+- Web UI with live traffic dashboard and rule editor
+
+## Web UI
+
+OpenGFW ships with an optional web dashboard: live traffic statistics, a real-time event
+feed with per-stream analyzer properties, and a rule editor that validates and hot reloads
+the ruleset. It works on phones as well as on desktops.
+
+Rules can be written as a list of conditions — pick a field (SNI, DNS name, HTTP host,
+IP, port, detected protocol), an operator (wildcard, CIDR, GeoIP country, GeoSite
+category, range, regex) and one or more values — or as raw expr expressions and YAML.
+Countries and site categories are picked from the geo databases the engine loaded.
+
+Enable it in your config file:
+
+```yaml
+web:
+  enabled: true
+  listen: :8080
+  secret: your-password-here # generated and logged on startup if left empty
+  # cert: /path/to/fullchain.pem
+  # key: /path/to/privkey.pem
+```
+
+The UI is embedded in the binary, so no extra files need to be deployed. Only expose it to
+trusted networks — anyone with the password can change your rules. See
+[web/README.md](web/README.md) for development instructions.

 ## Use cases

@@ -40,80 +68,4 @@ Linux that's in many ways more powerful than the real thing. It's cyber sovereig
 - Malware protection
 - Abuse prevention for VPN/proxy services
 - Traffic analysis (log only mode)
-
-## Usage
-
-### Build
-
-```shell
-go build
-```
-
-### Run
-
-```shell
-export OPENGFW_LOG_LEVEL=debug
-./OpenGFW -c config.yaml rules.yaml
-```
-
-### Example config
-
-```yaml
-io:
-  queueSize: 1024
-  local: true # set to false if you want to run OpenGFW on FORWARD chain
-
-workers:
-  count: 4
-  queueSize: 16
-  tcpMaxBufferedPagesTotal: 4096
-  tcpMaxBufferedPagesPerConn: 64
-  udpMaxStreams: 4096
-```
-
-### Example rules
-
-[Analyzer properties](docs/Analyzers.md)
-
-For syntax of the expression language, please refer
-to [Expr Language Definition](https://expr-lang.org/docs/language-definition).
-
-```yaml
- name: block v2ex http
-  action: block
-  expr: string(http?.req?.headers?.host) endsWith "v2ex.com"
-
- name: block v2ex https
-  action: block
-  expr: string(tls?.req?.sni) endsWith "v2ex.com"
-
- name: block shadowsocks
-  action: block
-  expr: fet != nil && fet.yes
-
- name: block trojan
-  action: block
-  expr: trojan != nil && trojan.yes
-
- name: v2ex dns poisoning
-  action: modify
-  modifier:
-    name: dns
-    args:
-      a: "0.0.0.0"
-      aaaa: "::"
-  expr: dns != nil && dns.qr && any(dns.questions, {.name endsWith "v2ex.com"})
-
- name: block google socks
-  action: block
-  expr: string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80
-```
-
-#### Supported actions
-
- `allow`: Allow the connection, no further processing.
- `block`: Block the connection, no further processing.
- `drop`: For UDP, drop the packet that triggered the rule, continue processing future packets in the same flow. For
-  TCP, same as `block`.
- `modify`: For UDP, modify the packet that triggered the rule using the given modifier, continue processing future
-  packets in the same flow. For TCP, same as `allow`.
+- Help you fulfill your dictatorial ambitions
@@ -1,33 +1,58 @@
 # ![OpenGFW](docs/logo.png)

+[![Quality check status](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml/badge.svg)](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml)
 [![License][1]][2]

 [1]: https://img.shields.io/badge/License-MPL_2.0-brightgreen.svg
 [2]: LICENSE

-OpenGFW 是一个 Linux 上灵活、易用、开源的 [GFW](https://zh.wikipedia.org/wiki/%E9%98%B2%E7%81%AB%E9%95%BF%E5%9F%8E)
-实现，并且在许多方面比真正的 GFW 更强大。可以部署在家用路由器上的网络主权。
+OpenGFW 是一个 Linux 上灵活、易用、开源的 DIY [GFW](https://zh.wikipedia.org/wiki/%E9%98%B2%E7%81%AB%E9%95%BF%E5%9F%8E) 实现，并且在许多方面比真正的 GFW 更强大。为何让那些掌权者独享乐趣？是时候把权力归还给人民，人人有墙建了。立即安装可以部署在家用路由器上的网络主权 - 你也能是老大哥。
+
+**文档网站： https://gfw.dev/**
+
+Telegram 群组： https://t.me/OpGFW

 > [!CAUTION]
-> 本项目仍处于早期开发阶段。测试时自行承担风险。
-
-> [!NOTE]
-> 我们正在寻求贡献者一起完善本项目，尤其是实现更多协议的解析器！
+> 本项目仍处于早期开发阶段。测试时自行承担风险。我们正在寻求贡献者一起完善本项目。

 ## 功能

 - 完整的 IP/TCP 重组，各种协议解析器
-  - HTTP, TLS, DNS, SSH, SOCKS4/5, 更多协议正在开发中
-  - Shadowsocks 等 "全加密流量" 检测 (https://gfw.report/publications/usenixsecurity23/data/paper/paper.pdf)
-  - 基于 Trojan-killer 的 Trojan 检测 (https://github.com/XTLS/Trojan-killer)
+  - HTTP, TLS, QUIC, DNS, SSH, SOCKS4/5, WireGuard, OpenVPN, 更多协议正在开发中
+  - Shadowsocks, VMess 等 "全加密流量" 检测 (https://gfw.report/publications/usenixsecurity23/zh/)
+  - Trojan 协议检测
  - [开发中] 基于机器学习的流量分类
 - 同等支持 IPv4 和 IPv6
 - 基于流的多核负载均衡
 - 连接 offloading
 - 基于 [expr](https://github.com/expr-lang/expr) 的强大规则引擎
+- 规则可以热重载 (发送 `SIGHUP` 信号)
 - 灵活的协议解析和修改框架
 - 可扩展的 IO 实现 (目前只有 NFQueue)
- [开发中] Web UI
+- Web UI，包含实时流量面板与规则编辑器
+
+## Web UI
+
+OpenGFW 内置了一个可选的 Web 控制面板：实时流量统计、带解析器属性的实时事件流，以及可以校验并热加载规则的规则编辑器。
+界面同时适配手机和桌面浏览器。
+
+规则既可以用条件列表来写——选择字段（SNI、DNS 域名、HTTP Host、IP、端口、识别到的协议）、
+条件（通配符、CIDR、GeoIP 国家/地区、GeoSite 分类、端口区间、正则）以及一个或多个值——
+也可以直接编写 expr 表达式或 YAML。国家/地区与站点分类直接从引擎加载的 geo 数据库中选择。
+
+在配置文件中启用：
+
+```yaml
+web:
+  enabled: true
+  listen: :8080
+  secret: 你的密码 # 留空则启动时随机生成并打印到日志
+  # cert: /path/to/fullchain.pem
+  # key: /path/to/privkey.pem
+```
+
+前端已经打包进二进制文件，无需额外部署静态资源。请只在可信网络中开放该端口——拿到密码即可修改你的规则。
+开发说明见 [web/README.md](web/README.md)。

 ## 使用场景

@@ -36,77 +61,4 @@ OpenGFW 是一个 Linux 上灵活、易用、开源的 [GFW](https://zh.wikipedi
 - 恶意软件防护
 - VPN/代理服务滥用防护
 - 流量分析 (纯日志模式)
-
-## 使用
-
-### 构建
-
-```shell
-go build
-```
-
-### 运行
-
-```shell
-export OPENGFW_LOG_LEVEL=debug
-./OpenGFW -c config.yaml rules.yaml
-```
-
-### 样例配置
-
-```yaml
-io:
-  queueSize: 1024
-  local: true # 如果需要在 FORWARD 链上运行 OpenGFW，请设置为 false
-
-workers:
-  count: 4
-  queueSize: 16
-  tcpMaxBufferedPagesTotal: 4096
-  tcpMaxBufferedPagesPerConn: 64
-  udpMaxStreams: 4096
-```
-
-### 样例规则
-
-[解析器属性](docs/Analyzers.md)
-
-规则的语法请参考 [Expr Language Definition](https://expr-lang.org/docs/language-definition)。
-
-```yaml
- name: block v2ex http
-  action: block
-  expr: string(http?.req?.headers?.host) endsWith "v2ex.com"
-
- name: block v2ex https
-  action: block
-  expr: string(tls?.req?.sni) endsWith "v2ex.com"
-
- name: block shadowsocks
-  action: block
-  expr: fet != nil && fet.yes
-
- name: block trojan
-  action: block
-  expr: trojan != nil && trojan.yes
-
- name: v2ex dns poisoning
-  action: modify
-  modifier:
-    name: dns
-    args:
-      a: "0.0.0.0"
-      aaaa: "::"
-  expr: dns != nil && dns.qr && any(dns.questions, {.name endsWith "v2ex.com"})
-
- name: block google socks
-  action: block
-  expr: string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80
-```
-
-#### 支持的 action
-
- `allow`: 放行连接，不再处理后续的包。
- `block`: 阻断连接，不再处理后续的包。
- `drop`: 对于 UDP，丢弃触发规则的包，但继续处理同一流中的后续包。对于 TCP，效果同 `block`。
- `modify`: 对于 UDP，用指定的修改器修改触发规则的包，然后继续处理同一流中的后续包。对于 TCP，效果同 `allow`。
+- 助你实现你的独裁野心
@@ -0,0 +1,224 @@
+package internal
+
+import (
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/utils"
+)
+
+// TLS record types.
+const (
+	RecordTypeHandshake = 0x16
+)
+
+// TLS handshake message types.
+const (
+	TypeClientHello = 0x01
+	TypeServerHello = 0x02
+)
+
+// TLS extension numbers.
+const (
+	extServerName           = 0x0000
+	extALPN                 = 0x0010
+	extSupportedVersions    = 0x002b
+	extEncryptedClientHello = 0xfe0d
+)
+
+func ParseTLSClientHelloMsgData(chBuf *utils.ByteBuffer) analyzer.PropMap {
+	var ok bool
+	m := make(analyzer.PropMap)
+	// Version, random & session ID length combined are within 35 bytes,
+	// so no need for bounds checking
+	m["version"], _ = chBuf.GetUint16(false, true)
+	m["random"], _ = chBuf.Get(32, true)
+	sessionIDLen, _ := chBuf.GetByte(true)
+	m["session"], ok = chBuf.Get(int(sessionIDLen), true)
+	if !ok {
+		// Not enough data for session ID
+		return nil
+	}
+	cipherSuitesLen, ok := chBuf.GetUint16(false, true)
+	if !ok {
+		// Not enough data for cipher suites length
+		return nil
+	}
+	if cipherSuitesLen%2 != 0 {
+		// Cipher suites are 2 bytes each, so must be even
+		return nil
+	}
+	ciphers := make([]uint16, cipherSuitesLen/2)
+	for i := range ciphers {
+		ciphers[i], ok = chBuf.GetUint16(false, true)
+		if !ok {
+			return nil
+		}
+	}
+	m["ciphers"] = ciphers
+	compressionMethodsLen, ok := chBuf.GetByte(true)
+	if !ok {
+		// Not enough data for compression methods length
+		return nil
+	}
+	// Compression methods are 1 byte each, we just put a byte slice here
+	m["compression"], ok = chBuf.Get(int(compressionMethodsLen), true)
+	if !ok {
+		// Not enough data for compression methods
+		return nil
+	}
+	extsLen, ok := chBuf.GetUint16(false, true)
+	if !ok {
+		// No extensions, I guess it's possible?
+		return m
+	}
+	extBuf, ok := chBuf.GetSubBuffer(int(extsLen), true)
+	if !ok {
+		// Not enough data for extensions
+		return nil
+	}
+	for extBuf.Len() > 0 {
+		extType, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension type
+			return nil
+		}
+		extLen, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension length
+			return nil
+		}
+		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
+		if !ok || !parseTLSExtensions(extType, extDataBuf, m) {
+			// Not enough data for extension data, or invalid extension
+			return nil
+		}
+	}
+	return m
+}
+
+func ParseTLSServerHelloMsgData(shBuf *utils.ByteBuffer) analyzer.PropMap {
+	var ok bool
+	m := make(analyzer.PropMap)
+	// Version, random & session ID length combined are within 35 bytes,
+	// so no need for bounds checking
+	m["version"], _ = shBuf.GetUint16(false, true)
+	m["random"], _ = shBuf.Get(32, true)
+	sessionIDLen, _ := shBuf.GetByte(true)
+	m["session"], ok = shBuf.Get(int(sessionIDLen), true)
+	if !ok {
+		// Not enough data for session ID
+		return nil
+	}
+	cipherSuite, ok := shBuf.GetUint16(false, true)
+	if !ok {
+		// Not enough data for cipher suite
+		return nil
+	}
+	m["cipher"] = cipherSuite
+	compressionMethod, ok := shBuf.GetByte(true)
+	if !ok {
+		// Not enough data for compression method
+		return nil
+	}
+	m["compression"] = compressionMethod
+	extsLen, ok := shBuf.GetUint16(false, true)
+	if !ok {
+		// No extensions, I guess it's possible?
+		return m
+	}
+	extBuf, ok := shBuf.GetSubBuffer(int(extsLen), true)
+	if !ok {
+		// Not enough data for extensions
+		return nil
+	}
+	for extBuf.Len() > 0 {
+		extType, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension type
+			return nil
+		}
+		extLen, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension length
+			return nil
+		}
+		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
+		if !ok || !parseTLSExtensions(extType, extDataBuf, m) {
+			// Not enough data for extension data, or invalid extension
+			return nil
+		}
+	}
+	return m
+}
+
+func parseTLSExtensions(extType uint16, extDataBuf *utils.ByteBuffer, m analyzer.PropMap) bool {
+	switch extType {
+	case extServerName:
+		ok := extDataBuf.Skip(2) // Ignore list length, we only care about the first entry for now
+		if !ok {
+			// Not enough data for list length
+			return false
+		}
+		sniType, ok := extDataBuf.GetByte(true)
+		if !ok || sniType != 0 {
+			// Not enough data for SNI type, or not hostname
+			return false
+		}
+		sniLen, ok := extDataBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for SNI length
+			return false
+		}
+		m["sni"], ok = extDataBuf.GetString(int(sniLen), true)
+		if !ok {
+			// Not enough data for SNI
+			return false
+		}
+	case extALPN:
+		ok := extDataBuf.Skip(2) // Ignore list length, as we read until the end
+		if !ok {
+			// Not enough data for list length
+			return false
+		}
+		var alpnList []string
+		for extDataBuf.Len() > 0 {
+			alpnLen, ok := extDataBuf.GetByte(true)
+			if !ok {
+				// Not enough data for ALPN length
+				return false
+			}
+			alpn, ok := extDataBuf.GetString(int(alpnLen), true)
+			if !ok {
+				// Not enough data for ALPN
+				return false
+			}
+			alpnList = append(alpnList, alpn)
+		}
+		m["alpn"] = alpnList
+	case extSupportedVersions:
+		if extDataBuf.Len() == 2 {
+			// Server only selects one version
+			m["supported_versions"], _ = extDataBuf.GetUint16(false, true)
+		} else {
+			// Client sends a list of versions
+			ok := extDataBuf.Skip(1) // Ignore list length, as we read until the end
+			if !ok {
+				// Not enough data for list length
+				return false
+			}
+			var versions []uint16
+			for extDataBuf.Len() > 0 {
+				ver, ok := extDataBuf.GetUint16(false, true)
+				if !ok {
+					// Not enough data for version
+					return false
+				}
+				versions = append(versions, ver)
+			}
+			m["supported_versions"] = versions
+		}
+	case extEncryptedClientHello:
+		// We can't parse ECH for now, just set a flag
+		m["ech"] = true
+	}
+	return true
+}
@@ -143,8 +143,11 @@ func isTLSorHTTP(bytes []byte) bool {
 	if len(bytes) < 3 {
 		return false
 	}
-	if bytes[0] == 0x16 && bytes[1] == 0x03 && bytes[2] <= 0x03 {
-		// TLS handshake for TLS 1.0-1.3
+	// "We observe that the GFW exempts any connection whose first
+	// three bytes match the following regular expression:
+	// [\x16-\x17]\x03[\x00-\x09]" - from the paper in Section 4.3
+	if bytes[0] >= 0x16 && bytes[0] <= 0x17 &&
+		bytes[1] == 0x03 && bytes[2] <= 0x09 {
 		return true
 	}
 	// HTTP request
@@ -0,0 +1,64 @@
+package tcp
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/apernet/OpenGFW/analyzer"
+)
+
+func TestHTTPParsing_Request(t *testing.T) {
+	testCases := map[string]analyzer.PropMap{
+		"GET / HTTP/1.1\r\n": {
+			"method": "GET", "path": "/", "version": "HTTP/1.1",
+		},
+		"POST /hello?a=1&b=2 HTTP/1.0\r\n": {
+			"method": "POST", "path": "/hello?a=1&b=2", "version": "HTTP/1.0",
+		},
+		"PUT /world HTTP/1.1\r\nContent-Length: 4\r\n\r\nbody": {
+			"method": "PUT", "path": "/world", "version": "HTTP/1.1", "headers": analyzer.PropMap{"content-length": "4"},
+		},
+		"DELETE /goodbye HTTP/2.0\r\n": {
+			"method": "DELETE", "path": "/goodbye", "version": "HTTP/2.0",
+		},
+	}
+
+	for tc, want := range testCases {
+		t.Run(strings.Split(tc, " ")[0], func(t *testing.T) {
+			tc, want := tc, want
+			t.Parallel()
+
+			u, _ := newHTTPStream(nil).Feed(false, false, false, 0, []byte(tc))
+			got := u.M.Get("req")
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("\"%s\" parsed = %v, want %v", tc, got, want)
+			}
+		})
+	}
+}
+
+func TestHTTPParsing_Response(t *testing.T) {
+	testCases := map[string]analyzer.PropMap{
+		"HTTP/1.0 200 OK\r\nContent-Length: 4\r\n\r\nbody": {
+			"version": "HTTP/1.0", "status": 200,
+			"headers": analyzer.PropMap{"content-length": "4"},
+		},
+		"HTTP/2.0 204 No Content\r\n\r\n": {
+			"version": "HTTP/2.0", "status": 204,
+		},
+	}
+
+	for tc, want := range testCases {
+		t.Run(strings.Split(tc, " ")[0], func(t *testing.T) {
+			tc, want := tc, want
+			t.Parallel()
+
+			u, _ := newHTTPStream(nil).Feed(true, false, false, 0, []byte(tc))
+			got := u.M.Get("resp")
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("\"%s\" parsed = %v, want %v", tc, got, want)
+			}
+		})
+	}
+}
@@ -208,10 +208,10 @@ func (s *socksStream) parseSocks5ReqMethod() utils.LSMAction {
 		switch method {
 		case Socks5AuthNotRequired:
 			s.authReqMethod = Socks5AuthNotRequired
-			break
+			return utils.LSMActionNext
 		case Socks5AuthPassword:
 			s.authReqMethod = Socks5AuthPassword
-			break
+			return utils.LSMActionNext
 		default:
 			// TODO: more auth method to support
 		}
@@ -2,6 +2,7 @@ package tcp

 import (
 	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/internal"
 	"github.com/apernet/OpenGFW/analyzer/utils"
 )

@@ -43,12 +44,12 @@ type tlsStream struct {
 func newTLSStream(logger analyzer.Logger) *tlsStream {
 	s := &tlsStream{logger: logger, reqBuf: &utils.ByteBuffer{}, respBuf: &utils.ByteBuffer{}}
 	s.reqLSM = utils.NewLinearStateMachine(
-		s.tlsClientHelloSanityCheck,
-		s.parseClientHello,
+		s.tlsClientHelloPreprocess,
+		s.parseClientHelloData,
 	)
 	s.respLSM = utils.NewLinearStateMachine(
-		s.tlsServerHelloSanityCheck,
-		s.parseServerHello,
+		s.tlsServerHelloPreprocess,
+		s.parseServerHelloData,
 	)
 	return s
 }
@@ -88,261 +89,132 @@ func (s *tlsStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyz
 	return update, cancelled || (s.reqDone && s.respDone)
 }

-func (s *tlsStream) tlsClientHelloSanityCheck() utils.LSMAction {
-	data, ok := s.reqBuf.Get(9, true)
+// tlsClientHelloPreprocess validates ClientHello message.
+//
+// During validation, message header and first handshake header may be removed
+// from `s.reqBuf`.
+func (s *tlsStream) tlsClientHelloPreprocess() utils.LSMAction {
+	// headers size: content type (1 byte) + legacy protocol version (2 bytes) +
+	//   + content length (2 bytes) + message type (1 byte) +
+	//   + handshake length (3 bytes)
+	const headersSize = 9
+
+	// minimal data size: protocol version (2 bytes) + random (32 bytes) +
+	//   + session ID (1 byte) + cipher suites (4 bytes) +
+	//   + compression methods (2 bytes) + no extensions
+	const minDataSize = 41
+
+	header, ok := s.reqBuf.Get(headersSize, true)
 	if !ok {
+		// not a full header yet
 		return utils.LSMActionPause
 	}
-	if data[0] != 0x16 || data[5] != 0x01 {
-		// Not a TLS handshake, or not a client hello
+
+	if header[0] != internal.RecordTypeHandshake || header[5] != internal.TypeClientHello {
 		return utils.LSMActionCancel
 	}
-	s.clientHelloLen = int(data[6])<<16 | int(data[7])<<8 | int(data[8])
-	if s.clientHelloLen < 41 {
-		// 2 (Protocol Version) +
-		// 32 (Random) +
-		// 1 (Session ID Length) +
-		// 2 (Cipher Suites Length) +_ws.col.protocol == "TLSv1.3"
-		// 2 (Cipher Suite) +
-		// 1 (Compression Methods Length) +
-		// 1 (Compression Method) +
-		// No extensions
-		// This should be the bare minimum for a client hello
+
+	s.clientHelloLen = int(header[6])<<16 | int(header[7])<<8 | int(header[8])
+	if s.clientHelloLen < minDataSize {
 		return utils.LSMActionCancel
 	}
+
+	// TODO: something is missing. See:
+	//   const messageHeaderSize = 4
+	//   fullMessageLen := int(header[3])<<8 | int(header[4])
+	//   msgNo := fullMessageLen / int(messageHeaderSize+s.serverHelloLen)
+	//   if msgNo != 1 {
+	// 	   // what here?
+	//   }
+	//   if messageNo != int(messageNo) {
+	// 	   // what here?
+	//   }
+
 	return utils.LSMActionNext
 }

-func (s *tlsStream) tlsServerHelloSanityCheck() utils.LSMAction {
-	data, ok := s.respBuf.Get(9, true)
+// tlsServerHelloPreprocess validates ServerHello message.
+//
+// During validation, message header and first handshake header may be removed
+// from `s.reqBuf`.
+func (s *tlsStream) tlsServerHelloPreprocess() utils.LSMAction {
+	// header size: content type (1 byte) + legacy protocol version (2 byte) +
+	//   + content length (2 byte) + message type (1 byte) +
+	//   + handshake length (3 byte)
+	const headersSize = 9
+
+	// minimal data size: server version (2 byte) + random (32 byte) +
+	//	 + session ID (>=1 byte) + cipher suite (2 byte) +
+	//	 + compression method (1 byte) + no extensions
+	const minDataSize = 38
+
+	header, ok := s.respBuf.Get(headersSize, true)
 	if !ok {
+		// not a full header yet
 		return utils.LSMActionPause
 	}
-	if data[0] != 0x16 || data[5] != 0x02 {
-		// Not a TLS handshake, or not a server hello
+
+	if header[0] != internal.RecordTypeHandshake || header[5] != internal.TypeServerHello {
 		return utils.LSMActionCancel
 	}
-	s.serverHelloLen = int(data[6])<<16 | int(data[7])<<8 | int(data[8])
-	if s.serverHelloLen < 38 {
-		// 2 (Protocol Version) +
-		// 32 (Random) +
-		// 1 (Session ID Length) +
-		// 2 (Cipher Suite) +
-		// 1 (Compression Method) +
-		// No extensions
-		// This should be the bare minimum for a server hello
+
+	s.serverHelloLen = int(header[6])<<16 | int(header[7])<<8 | int(header[8])
+	if s.serverHelloLen < minDataSize {
 		return utils.LSMActionCancel
 	}
+
+	// TODO: something is missing. See example:
+	//   const messageHeaderSize = 4
+	//   fullMessageLen := int(header[3])<<8 | int(header[4])
+	//   msgNo := fullMessageLen / int(messageHeaderSize+s.serverHelloLen)
+	//   if msgNo != 1 {
+	// 	   // what here?
+	//   }
+	//   if messageNo != int(messageNo) {
+	// 	   // what here?
+	//   }
+
 	return utils.LSMActionNext
 }

-func (s *tlsStream) parseClientHello() utils.LSMAction {
+// parseClientHelloData converts valid ClientHello message data (without
+// headers) into `analyzer.PropMap`.
+//
+// Parsing error may leave `s.reqBuf` in an unusable state.
+func (s *tlsStream) parseClientHelloData() utils.LSMAction {
 	chBuf, ok := s.reqBuf.GetSubBuffer(s.clientHelloLen, true)
 	if !ok {
 		// Not a full client hello yet
 		return utils.LSMActionPause
 	}
-	s.reqUpdated = true
-	s.reqMap = make(analyzer.PropMap)
-	// Version, random & session ID length combined are within 35 bytes,
-	// so no need for bounds checking
-	s.reqMap["version"], _ = chBuf.GetUint16(false, true)
-	s.reqMap["random"], _ = chBuf.Get(32, true)
-	sessionIDLen, _ := chBuf.GetByte(true)
-	s.reqMap["session"], ok = chBuf.Get(int(sessionIDLen), true)
-	if !ok {
-		// Not enough data for session ID
+	m := internal.ParseTLSClientHelloMsgData(chBuf)
+	if m == nil {
 		return utils.LSMActionCancel
-	}
-	cipherSuitesLen, ok := chBuf.GetUint16(false, true)
-	if !ok {
-		// Not enough data for cipher suites length
-		return utils.LSMActionCancel
-	}
-	if cipherSuitesLen%2 != 0 {
-		// Cipher suites are 2 bytes each, so must be even
-		return utils.LSMActionCancel
-	}
-	ciphers := make([]uint16, cipherSuitesLen/2)
-	for i := range ciphers {
-		ciphers[i], ok = chBuf.GetUint16(false, true)
-		if !ok {
-			return utils.LSMActionCancel
-		}
-	}
-	s.reqMap["ciphers"] = ciphers
-	compressionMethodsLen, ok := chBuf.GetByte(true)
-	if !ok {
-		// Not enough data for compression methods length
-		return utils.LSMActionCancel
-	}
-	// Compression methods are 1 byte each, we just put a byte slice here
-	s.reqMap["compression"], ok = chBuf.Get(int(compressionMethodsLen), true)
-	if !ok {
-		// Not enough data for compression methods
-		return utils.LSMActionCancel
-	}
-	extsLen, ok := chBuf.GetUint16(false, true)
-	if !ok {
-		// No extensions, I guess it's possible?
+	} else {
+		s.reqUpdated = true
+		s.reqMap = m
 		return utils.LSMActionNext
 	}
-	extBuf, ok := chBuf.GetSubBuffer(int(extsLen), true)
-	if !ok {
-		// Not enough data for extensions
-		return utils.LSMActionCancel
-	}
-	for extBuf.Len() > 0 {
-		extType, ok := extBuf.GetUint16(false, true)
-		if !ok {
-			// Not enough data for extension type
-			return utils.LSMActionCancel
-		}
-		extLen, ok := extBuf.GetUint16(false, true)
-		if !ok {
-			// Not enough data for extension length
-			return utils.LSMActionCancel
-		}
-		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
-		if !ok || !s.handleExtensions(extType, extDataBuf, s.reqMap) {
-			// Not enough data for extension data, or invalid extension
-			return utils.LSMActionCancel
-		}
-	}
-	return utils.LSMActionNext
 }

-func (s *tlsStream) parseServerHello() utils.LSMAction {
+// parseServerHelloData converts valid ServerHello message data (without
+// headers) into `analyzer.PropMap`.
+//
+// Parsing error may leave `s.respBuf` in an unusable state.
+func (s *tlsStream) parseServerHelloData() utils.LSMAction {
 	shBuf, ok := s.respBuf.GetSubBuffer(s.serverHelloLen, true)
 	if !ok {
 		// Not a full server hello yet
 		return utils.LSMActionPause
 	}
-	s.respUpdated = true
-	s.respMap = make(analyzer.PropMap)
-	// Version, random & session ID length combined are within 35 bytes,
-	// so no need for bounds checking
-	s.respMap["version"], _ = shBuf.GetUint16(false, true)
-	s.respMap["random"], _ = shBuf.Get(32, true)
-	sessionIDLen, _ := shBuf.GetByte(true)
-	s.respMap["session"], ok = shBuf.Get(int(sessionIDLen), true)
-	if !ok {
-		// Not enough data for session ID
+	m := internal.ParseTLSServerHelloMsgData(shBuf)
+	if m == nil {
 		return utils.LSMActionCancel
-	}
-	cipherSuite, ok := shBuf.GetUint16(false, true)
-	if !ok {
-		// Not enough data for cipher suite
-		return utils.LSMActionCancel
-	}
-	s.respMap["cipher"] = cipherSuite
-	compressionMethod, ok := shBuf.GetByte(true)
-	if !ok {
-		// Not enough data for compression method
-		return utils.LSMActionCancel
-	}
-	s.respMap["compression"] = compressionMethod
-	extsLen, ok := shBuf.GetUint16(false, true)
-	if !ok {
-		// No extensions, I guess it's possible?
+	} else {
+		s.respUpdated = true
+		s.respMap = m
 		return utils.LSMActionNext
 	}
-	extBuf, ok := shBuf.GetSubBuffer(int(extsLen), true)
-	if !ok {
-		// Not enough data for extensions
-		return utils.LSMActionCancel
-	}
-	for extBuf.Len() > 0 {
-		extType, ok := extBuf.GetUint16(false, true)
-		if !ok {
-			// Not enough data for extension type
-			return utils.LSMActionCancel
-		}
-		extLen, ok := extBuf.GetUint16(false, true)
-		if !ok {
-			// Not enough data for extension length
-			return utils.LSMActionCancel
-		}
-		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
-		if !ok || !s.handleExtensions(extType, extDataBuf, s.respMap) {
-			// Not enough data for extension data, or invalid extension
-			return utils.LSMActionCancel
-		}
-	}
-	return utils.LSMActionNext
-}
-
-func (s *tlsStream) handleExtensions(extType uint16, extDataBuf *utils.ByteBuffer, m analyzer.PropMap) bool {
-	switch extType {
-	case 0x0000: // SNI
-		ok := extDataBuf.Skip(2) // Ignore list length, we only care about the first entry for now
-		if !ok {
-			// Not enough data for list length
-			return false
-		}
-		sniType, ok := extDataBuf.GetByte(true)
-		if !ok || sniType != 0 {
-			// Not enough data for SNI type, or not hostname
-			return false
-		}
-		sniLen, ok := extDataBuf.GetUint16(false, true)
-		if !ok {
-			// Not enough data for SNI length
-			return false
-		}
-		m["sni"], ok = extDataBuf.GetString(int(sniLen), true)
-		if !ok {
-			// Not enough data for SNI
-			return false
-		}
-	case 0x0010: // ALPN
-		ok := extDataBuf.Skip(2) // Ignore list length, as we read until the end
-		if !ok {
-			// Not enough data for list length
-			return false
-		}
-		var alpnList []string
-		for extDataBuf.Len() > 0 {
-			alpnLen, ok := extDataBuf.GetByte(true)
-			if !ok {
-				// Not enough data for ALPN length
-				return false
-			}
-			alpn, ok := extDataBuf.GetString(int(alpnLen), true)
-			if !ok {
-				// Not enough data for ALPN
-				return false
-			}
-			alpnList = append(alpnList, alpn)
-		}
-		m["alpn"] = alpnList
-	case 0x002b: // Supported Versions
-		if extDataBuf.Len() == 2 {
-			// Server only selects one version
-			m["supported_versions"], _ = extDataBuf.GetUint16(false, true)
-		} else {
-			// Client sends a list of versions
-			ok := extDataBuf.Skip(1) // Ignore list length, as we read until the end
-			if !ok {
-				// Not enough data for list length
-				return false
-			}
-			var versions []uint16
-			for extDataBuf.Len() > 0 {
-				ver, ok := extDataBuf.GetUint16(false, true)
-				if !ok {
-					// Not enough data for version
-					return false
-				}
-				versions = append(versions, ver)
-			}
-			m["supported_versions"] = versions
-		}
-	case 0xfe0d: // ECH
-		// We can't parse ECH for now, just set a flag
-		m["ech"] = true
-	}
-	return true
 }

 func (s *tlsStream) Close(limited bool) *analyzer.PropUpdate {
@@ -0,0 +1,69 @@
+package tcp
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/apernet/OpenGFW/analyzer"
+)
+
+func TestTlsStreamParsing_ClientHello(t *testing.T) {
+	// example packet taken from <https://tls12.xargs.org/#client-hello/annotated>
+	clientHello := []byte{
+		0x16, 0x03, 0x01, 0x00, 0xa5, 0x01, 0x00, 0x00, 0xa1, 0x03, 0x03, 0x00,
+		0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
+		0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+		0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x00, 0x00, 0x20, 0xcc, 0xa8,
+		0xcc, 0xa9, 0xc0, 0x2f, 0xc0, 0x30, 0xc0, 0x2b, 0xc0, 0x2c, 0xc0, 0x13,
+		0xc0, 0x09, 0xc0, 0x14, 0xc0, 0x0a, 0x00, 0x9c, 0x00, 0x9d, 0x00, 0x2f,
+		0x00, 0x35, 0xc0, 0x12, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x58, 0x00, 0x00,
+		0x00, 0x18, 0x00, 0x16, 0x00, 0x00, 0x13, 0x65, 0x78, 0x61, 0x6d, 0x70,
+		0x6c, 0x65, 0x2e, 0x75, 0x6c, 0x66, 0x68, 0x65, 0x69, 0x6d, 0x2e, 0x6e,
+		0x65, 0x74, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x0a, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00,
+		0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x0d, 0x00, 0x12, 0x00,
+		0x10, 0x04, 0x01, 0x04, 0x03, 0x05, 0x01, 0x05, 0x03, 0x06, 0x01, 0x06,
+		0x03, 0x02, 0x01, 0x02, 0x03, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x12,
+		0x00, 0x00,
+	}
+	want := analyzer.PropMap{
+		"ciphers":     []uint16{52392, 52393, 49199, 49200, 49195, 49196, 49171, 49161, 49172, 49162, 156, 157, 47, 53, 49170, 10},
+		"compression": []uint8{0},
+		"random":      []uint8{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31},
+		"session":     []uint8{},
+		"sni":         "example.ulfheim.net",
+		"version":     uint16(771),
+	}
+
+	s := newTLSStream(nil)
+	u, _ := s.Feed(false, false, false, 0, clientHello)
+	got := u.M.Get("req")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(clientHello), got, want)
+	}
+}
+
+func TestTlsStreamParsing_ServerHello(t *testing.T) {
+	// example packet taken from <https://tls12.xargs.org/#server-hello/annotated>
+	serverHello := []byte{
+		0x16, 0x03, 0x03, 0x00, 0x31, 0x02, 0x00, 0x00, 0x2d, 0x03, 0x03, 0x70,
+		0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c,
+		0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88,
+		0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x00, 0xc0, 0x13, 0x00, 0x00,
+		0x05, 0xff, 0x01, 0x00, 0x01, 0x00,
+	}
+	want := analyzer.PropMap{
+		"cipher":      uint16(49171),
+		"compression": uint8(0),
+		"random":      []uint8{112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143},
+		"session":     []uint8{},
+		"version":     uint16(771),
+	}
+
+	s := newTLSStream(nil)
+	u, _ := s.Feed(true, false, false, 0, serverHello)
+	got := u.M.Get("resp")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(serverHello), got, want)
+	}
+}
@@ -9,22 +9,15 @@ import (
 var _ analyzer.TCPAnalyzer = (*TrojanAnalyzer)(nil)

 // CCS stands for "Change Cipher Spec"
-var trojanCCS = []byte{20, 3, 3, 0, 1, 1}
+var ccsPattern = []byte{20, 3, 3, 0, 1, 1}

-const (
-	trojanUpLB    = 650
-	trojanUpUB    = 1000
-	trojanDownLB1 = 170
-	trojanDownUB1 = 180
-	trojanDownLB2 = 3000
-	trojanDownUB2 = 7500
-)
-
-// TrojanAnalyzer uses a very simple packet length based check to determine
-// if a TLS connection is actually the Trojan proxy protocol.
-// The algorithm is from the following project, with small modifications:
-// https://github.com/XTLS/Trojan-killer
-// Warning: Experimental only. This method is known to have significant false positives and false negatives.
+// TrojanAnalyzer uses length-based heuristics to detect Trojan traffic based on
+// its "TLS-in-TLS" nature. The heuristics are trained using a decision tree with
+// about 20k Trojan samples and 30k non-Trojan samples. The tree is then converted
+// to code using a custom tool and inlined here (isTrojanSeq function).
+// Accuracy: 1% false positive rate, 10% false negative rate.
+// We do NOT recommend directly blocking all positive connections, as this may
+// break legitimate TLS connections.
 type TrojanAnalyzer struct{}

 func (a *TrojanAnalyzer) Name() string {
@@ -32,7 +25,7 @@ func (a *TrojanAnalyzer) Name() string {
 }

 func (a *TrojanAnalyzer) Limit() int {
-	return 16384
+	return 512000
 }

 func (a *TrojanAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
@@ -40,10 +33,12 @@ func (a *TrojanAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) a
 }

 type trojanStream struct {
-	logger    analyzer.Logger
-	active    bool
-	upCount   int
-	downCount int
+	logger   analyzer.Logger
+	first    bool
+	count    bool
+	rev      bool
+	seq      [4]int
+	seqIndex int
 }

 func newTrojanStream(logger analyzer.Logger) *trojanStream {
@@ -57,35 +52,466 @@ func (s *trojanStream) Feed(rev, start, end bool, skip int, data []byte) (u *ana
 	if len(data) == 0 {
 		return nil, false
 	}
-	if !rev && !s.active && len(data) >= 6 && bytes.Equal(data[:6], trojanCCS) {
-		// Client CCS encountered, start counting
-		s.active = true
+
+	if s.first {
+		s.first = false
+		// Stop if it's not a valid TLS connection
+		if !(!rev && len(data) >= 3 && data[0] >= 0x16 && data[0] <= 0x17 &&
+			data[1] == 0x03 && data[2] <= 0x09) {
+			return nil, true
+		}
 	}
-	if s.active {
-		if rev {
-			// Down direction
-			s.downCount += len(data)
+
+	if !rev && !s.count && len(data) >= 6 && bytes.Equal(data[:6], ccsPattern) {
+		// Client Change Cipher Spec encountered, start counting
+		s.count = true
+	}
+
+	if s.count {
+		if rev == s.rev {
+			// Same direction as last time, just update the number
+			s.seq[s.seqIndex] += len(data)
 		} else {
-			// Up direction
-			if s.upCount >= trojanUpLB && s.upCount <= trojanUpUB &&
-				((s.downCount >= trojanDownLB1 && s.downCount <= trojanDownUB1) ||
-					(s.downCount >= trojanDownLB2 && s.downCount <= trojanDownUB2)) {
+			// Different direction, bump the index
+			s.seqIndex += 1
+			if s.seqIndex == 4 {
 				return &analyzer.PropUpdate{
 					Type: analyzer.PropUpdateReplace,
 					M: analyzer.PropMap{
-						"up":   s.upCount,
-						"down": s.downCount,
-						"yes":  true,
+						"seq": s.seq,
+						"yes": isTrojanSeq(s.seq),
 					},
 				}, true
 			}
-			s.upCount += len(data)
+			s.seq[s.seqIndex] += len(data)
+			s.rev = rev
 		}
 	}
-	// Give up when either direction is over the limit
-	return nil, s.upCount > trojanUpUB || s.downCount > trojanDownUB2
+
+	return nil, false
 }

 func (s *trojanStream) Close(limited bool) *analyzer.PropUpdate {
 	return nil
 }
+
+func isTrojanSeq(seq [4]int) bool {
+	length1 := seq[0]
+	length2 := seq[1]
+	length3 := seq[2]
+	length4 := seq[3]
+
+	if length2 <= 2431 {
+		if length2 <= 157 {
+			if length1 <= 156 {
+				if length3 <= 108 {
+					return false
+				} else {
+					return false
+				}
+			} else {
+				if length1 <= 892 {
+					if length3 <= 40 {
+						return false
+					} else {
+						if length3 <= 788 {
+							if length4 <= 185 {
+								if length1 <= 411 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 112 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length3 <= 1346 {
+								if length1 <= 418 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								return false
+							}
+						}
+					}
+				} else {
+					if length2 <= 120 {
+						if length2 <= 63 {
+							return false
+						} else {
+							if length4 <= 653 {
+								return false
+							} else {
+								return false
+							}
+						}
+					} else {
+						return false
+					}
+				}
+			}
+		} else {
+			if length1 <= 206 {
+				if length1 <= 185 {
+					if length1 <= 171 {
+						return false
+					} else {
+						if length4 <= 211 {
+							return false
+						} else {
+							return false
+						}
+					}
+				} else {
+					if length2 <= 251 {
+						return true
+					} else {
+						return false
+					}
+				}
+			} else {
+				if length2 <= 286 {
+					if length1 <= 1123 {
+						if length3 <= 70 {
+							return false
+						} else {
+							if length1 <= 659 {
+								if length3 <= 370 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 272 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						if length4 <= 537 {
+							if length2 <= 276 {
+								if length3 <= 1877 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								return false
+							}
+						} else {
+							if length1 <= 1466 {
+								if length1 <= 1435 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 193 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				} else {
+					if length1 <= 284 {
+						if length1 <= 277 {
+							if length2 <= 726 {
+								return false
+							} else {
+								if length2 <= 768 {
+									return true
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length2 <= 782 {
+								if length4 <= 783 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								return false
+							}
+						}
+					} else {
+						if length2 <= 492 {
+							if length2 <= 396 {
+								if length2 <= 322 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 971 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length2 <= 2128 {
+								if length2 <= 1418 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length3 <= 103 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	} else {
+		if length2 <= 6232 {
+			if length3 <= 85 {
+				if length2 <= 3599 {
+					return false
+				} else {
+					if length1 <= 613 {
+						return false
+					} else {
+						return false
+					}
+				}
+			} else {
+				if length3 <= 220 {
+					if length4 <= 1173 {
+						if length1 <= 874 {
+							if length4 <= 337 {
+								if length4 <= 68 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length1 <= 667 {
+									return true
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length3 <= 108 {
+								if length1 <= 1930 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 5383 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						return false
+					}
+				} else {
+					if length1 <= 664 {
+						if length3 <= 411 {
+							if length3 <= 383 {
+								if length4 <= 346 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 445 {
+									return true
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length2 <= 3708 {
+								if length4 <= 307 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 4656 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					} else {
+						if length1 <= 1055 {
+							if length3 <= 580 {
+								if length1 <= 724 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 678 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length2 <= 5352 {
+								if length3 <= 1586 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 2173 {
+									return true
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		} else {
+			if length2 <= 9408 {
+				if length1 <= 670 {
+					if length4 <= 76 {
+						if length3 <= 175 {
+							return true
+						} else {
+							return true
+						}
+					} else {
+						if length2 <= 9072 {
+							if length3 <= 314 {
+								if length3 <= 179 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 708 {
+									return false
+								} else {
+									return false
+								}
+							}
+						} else {
+							return true
+						}
+					}
+				} else {
+					if length1 <= 795 {
+						if length2 <= 6334 {
+							if length2 <= 6288 {
+								return true
+							} else {
+								return false
+							}
+						} else {
+							if length4 <= 6404 {
+								if length2 <= 8194 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 8924 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						if length3 <= 732 {
+							if length1 <= 1397 {
+								if length3 <= 179 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 1976 {
+									return false
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length1 <= 2840 {
+								if length1 <= 2591 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								return false
+							}
+						}
+					}
+				}
+			} else {
+				if length4 <= 30 {
+					return false
+				} else {
+					if length2 <= 13314 {
+						if length4 <= 1786 {
+							if length2 <= 13018 {
+								if length4 <= 869 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								return true
+							}
+						} else {
+							if length3 <= 775 {
+								return false
+							} else {
+								return false
+							}
+						}
+					} else {
+						if length4 <= 73 {
+							return false
+						} else {
+							if length3 <= 640 {
+								if length3 <= 237 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 43804 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}
@@ -0,0 +1,31 @@
+Author:: Cuong Manh Le <cuong.manhle.vn@gmail.com>
+Copyright:: Copyright (c) 2023, Cuong Manh Le
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * Neither the name of the @organization@ nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL LE MANH CUONG
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1 @@
+The code here is from https://github.com/cuonglm/quicsni with various modifications.
@@ -0,0 +1,105 @@
+package quic
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// The Header represents a QUIC header.
+type Header struct {
+	Type             uint8
+	Version          uint32
+	SrcConnectionID  []byte
+	DestConnectionID []byte
+	Length           int64
+	Token            []byte
+}
+
+// ParseInitialHeader parses the initial packet of a QUIC connection,
+// return the initial header and number of bytes read so far.
+func ParseInitialHeader(data []byte) (*Header, int64, error) {
+	br := bytes.NewReader(data)
+	hdr, err := parseLongHeader(br)
+	if err != nil {
+		return nil, 0, err
+	}
+	n := int64(len(data) - br.Len())
+	return hdr, n, nil
+}
+
+func parseLongHeader(b *bytes.Reader) (*Header, error) {
+	typeByte, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h := &Header{}
+	ver, err := beUint32(b)
+	if err != nil {
+		return nil, err
+	}
+	h.Version = ver
+	if h.Version != 0 && typeByte&0x40 == 0 {
+		return nil, errors.New("not a QUIC packet")
+	}
+	destConnIDLen, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h.DestConnectionID = make([]byte, int(destConnIDLen))
+	if err := readConnectionID(b, h.DestConnectionID); err != nil {
+		return nil, err
+	}
+	srcConnIDLen, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h.SrcConnectionID = make([]byte, int(srcConnIDLen))
+	if err := readConnectionID(b, h.SrcConnectionID); err != nil {
+		return nil, err
+	}
+
+	initialPacketType := byte(0b00)
+	if h.Version == V2 {
+		initialPacketType = 0b01
+	}
+	if (typeByte >> 4 & 0b11) == initialPacketType {
+		tokenLen, err := quicvarint.Read(b)
+		if err != nil {
+			return nil, err
+		}
+		if tokenLen > uint64(b.Len()) {
+			return nil, io.EOF
+		}
+		h.Token = make([]byte, tokenLen)
+		if _, err := io.ReadFull(b, h.Token); err != nil {
+			return nil, err
+		}
+	}
+
+	pl, err := quicvarint.Read(b)
+	if err != nil {
+		return nil, err
+	}
+	h.Length = int64(pl)
+	return h, err
+}
+
+func readConnectionID(r io.Reader, cid []byte) error {
+	_, err := io.ReadFull(r, cid)
+	if err == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	return nil
+}
+
+func beUint32(r io.Reader) (uint32, error) {
+	b := make([]byte, 4)
+	if _, err := io.ReadFull(r, b); err != nil {
+		return 0, err
+	}
+	return binary.BigEndian.Uint32(b), nil
+}
@@ -0,0 +1,193 @@
+package quic
+
+import (
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash"
+
+	"golang.org/x/crypto/chacha20"
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/cryptobyte"
+	"golang.org/x/crypto/hkdf"
+)
+
+// NewProtectionKey creates a new ProtectionKey.
+func NewProtectionKey(suite uint16, secret []byte, v uint32) (*ProtectionKey, error) {
+	return newProtectionKey(suite, secret, v)
+}
+
+// NewInitialProtectionKey is like NewProtectionKey, but the returned protection key
+// is used for encrypt/decrypt Initial Packet only.
+//
+// See: https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-initial-secrets
+func NewInitialProtectionKey(secret []byte, v uint32) (*ProtectionKey, error) {
+	return NewProtectionKey(tls.TLS_AES_128_GCM_SHA256, secret, v)
+}
+
+// NewPacketProtector creates a new PacketProtector.
+func NewPacketProtector(key *ProtectionKey) *PacketProtector {
+	return &PacketProtector{key: key}
+}
+
+// PacketProtector is used for protecting a QUIC packet.
+//
+// See: https://www.rfc-editor.org/rfc/rfc9001.html#name-packet-protection
+type PacketProtector struct {
+	key *ProtectionKey
+}
+
+// UnProtect decrypts a QUIC packet.
+func (pp *PacketProtector) UnProtect(packet []byte, pnOffset, pnMax int64) ([]byte, error) {
+	if isLongHeader(packet[0]) && int64(len(packet)) < pnOffset+4+16 {
+		return nil, errors.New("packet with long header is too small")
+	}
+
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-sample
+	sampleOffset := pnOffset + 4
+	sample := packet[sampleOffset : sampleOffset+16]
+
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-applicati
+	mask := pp.key.headerProtection(sample)
+	if isLongHeader(packet[0]) {
+		// Long header: 4 bits masked
+		packet[0] ^= mask[0] & 0x0f
+	} else {
+		// Short header: 5 bits masked
+		packet[0] ^= mask[0] & 0x1f
+	}
+
+	pnLen := packet[0]&0x3 + 1
+	pn := int64(0)
+	for i := uint8(0); i < pnLen; i++ {
+		packet[pnOffset:][i] ^= mask[1+i]
+		pn = (pn << 8) | int64(packet[pnOffset:][i])
+	}
+	pn = decodePacketNumber(pnMax, pn, pnLen)
+	hdr := packet[:pnOffset+int64(pnLen)]
+	payload := packet[pnOffset:][pnLen:]
+	dec, err := pp.key.aead.Open(payload[:0], pp.key.nonce(pn), payload, hdr)
+	if err != nil {
+		return nil, fmt.Errorf("decryption failed: %w", err)
+	}
+	return dec, nil
+}
+
+// ProtectionKey is the key used to protect a QUIC packet.
+type ProtectionKey struct {
+	aead             cipher.AEAD
+	headerProtection func(sample []byte) (mask []byte)
+	iv               []byte
+}
+
+// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-aead-usage
+//
+// "The 62 bits of the reconstructed QUIC packet number in network byte order are
+// left-padded with zeros to the size of the IV. The exclusive OR of the padded
+// packet number and the IV forms the AEAD nonce."
+func (pk *ProtectionKey) nonce(pn int64) []byte {
+	nonce := make([]byte, len(pk.iv))
+	binary.BigEndian.PutUint64(nonce[len(nonce)-8:], uint64(pn))
+	for i := range pk.iv {
+		nonce[i] ^= pk.iv[i]
+	}
+	return nonce
+}
+
+func newProtectionKey(suite uint16, secret []byte, v uint32) (*ProtectionKey, error) {
+	switch suite {
+	case tls.TLS_AES_128_GCM_SHA256:
+		key := hkdfExpandLabel(crypto.SHA256.New, secret, keyLabel(v), nil, 16)
+		c, err := aes.NewCipher(key)
+		if err != nil {
+			panic(err)
+		}
+		aead, err := cipher.NewGCM(c)
+		if err != nil {
+			panic(err)
+		}
+		iv := hkdfExpandLabel(crypto.SHA256.New, secret, ivLabel(v), nil, aead.NonceSize())
+		hpKey := hkdfExpandLabel(crypto.SHA256.New, secret, headerProtectionLabel(v), nil, 16)
+		hp, err := aes.NewCipher(hpKey)
+		if err != nil {
+			panic(err)
+		}
+		k := &ProtectionKey{}
+		k.aead = aead
+		// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-aes-based-header-protection
+		k.headerProtection = func(sample []byte) []byte {
+			mask := make([]byte, hp.BlockSize())
+			hp.Encrypt(mask, sample)
+			return mask
+		}
+		k.iv = iv
+		return k, nil
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		key := hkdfExpandLabel(crypto.SHA256.New, secret, keyLabel(v), nil, chacha20poly1305.KeySize)
+		aead, err := chacha20poly1305.New(key)
+		if err != nil {
+			return nil, err
+		}
+		iv := hkdfExpandLabel(crypto.SHA256.New, secret, ivLabel(v), nil, aead.NonceSize())
+		hpKey := hkdfExpandLabel(sha256.New, secret, headerProtectionLabel(v), nil, chacha20.KeySize)
+		k := &ProtectionKey{}
+		k.aead = aead
+		// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-chacha20-based-header-prote
+		k.headerProtection = func(sample []byte) []byte {
+			nonce := sample[4:16]
+			c, err := chacha20.NewUnauthenticatedCipher(hpKey, nonce)
+			if err != nil {
+				panic(err)
+			}
+			c.SetCounter(binary.LittleEndian.Uint32(sample[:4]))
+			mask := make([]byte, 5)
+			c.XORKeyStream(mask, mask)
+			return mask
+		}
+		k.iv = iv
+		return k, nil
+	}
+	return nil, errors.New("not supported cipher suite")
+}
+
+// decodePacketNumber decode the packet number after header protection removed.
+//
+// See: https://datatracker.ietf.org/doc/html/draft-ietf-quic-transport-32#section-appendix.a
+func decodePacketNumber(largest, truncated int64, nbits uint8) int64 {
+	expected := largest + 1
+	win := int64(1 << (nbits * 8))
+	hwin := win / 2
+	mask := win - 1
+	candidate := (expected &^ mask) | truncated
+	switch {
+	case candidate <= expected-hwin && candidate < (1<<62)-win:
+		return candidate + win
+	case candidate > expected+hwin && candidate >= win:
+		return candidate - win
+	}
+	return candidate
+}
+
+// Copied from crypto/tls/key_schedule.go.
+func hkdfExpandLabel(hash func() hash.Hash, secret []byte, label string, context []byte, length int) []byte {
+	var hkdfLabel cryptobyte.Builder
+	hkdfLabel.AddUint16(uint16(length))
+	hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
+		b.AddBytes([]byte("tls13 "))
+		b.AddBytes([]byte(label))
+	})
+	hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
+		b.AddBytes(context)
+	})
+	out := make([]byte, length)
+	n, err := hkdf.Expand(hash, secret, hkdfLabel.BytesOrPanic()).Read(out)
+	if err != nil || n != length {
+		panic("quic: HKDF-Expand-Label invocation failed unexpectedly")
+	}
+	return out
+}
@@ -0,0 +1,94 @@
+package quic
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/tls"
+	"encoding/hex"
+	"strings"
+	"testing"
+	"unicode"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+func TestInitialPacketProtector_UnProtect(t *testing.T) {
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-server-initial
+	protect := mustHexDecodeString(`
+			c7ff0000200008f067a5502a4262b500 4075fb12ff07823a5d24534d906ce4c7
+			6782a2167e3479c0f7f6395dc2c91676 302fe6d70bb7cbeb117b4ddb7d173498
+			44fd61dae200b8338e1b932976b61d91 e64a02e9e0ee72e3a6f63aba4ceeeec5
+			be2f24f2d86027572943533846caa13e 6f163fb257473d0eda5047360fd4a47e
+			fd8142fafc0f76
+		`)
+	unProtect := mustHexDecodeString(`
+			02000000000600405a020000560303ee fce7f7b37ba1d1632e96677825ddf739
+			88cfc79825df566dc5430b9a045a1200 130100002e00330024001d00209d3c94
+			0d89690b84d08a60993c144eca684d10 81287c834d5311bcf32bb9da1a002b00
+			020304
+		`)
+
+	connID := mustHexDecodeString(`8394c8f03e515708`)
+
+	packet := append([]byte{}, protect...)
+	hdr, offset, err := ParseInitialHeader(packet)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	initialSecret := hkdf.Extract(crypto.SHA256.New, connID, getSalt(hdr.Version))
+	serverSecret := hkdfExpandLabel(crypto.SHA256.New, initialSecret, "server in", []byte{}, crypto.SHA256.Size())
+	key, err := NewInitialProtectionKey(serverSecret, hdr.Version)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pp := NewPacketProtector(key)
+	got, err := pp.UnProtect(protect, offset, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, unProtect) {
+		t.Error("UnProtect returns wrong result")
+	}
+}
+
+func TestPacketProtectorShortHeader_UnProtect(t *testing.T) {
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-chacha20-poly1305-short-hea
+	protect := mustHexDecodeString(`4cfe4189655e5cd55c41f69080575d7999c25a5bfb`)
+	unProtect := mustHexDecodeString(`01`)
+	hdr := mustHexDecodeString(`4200bff4`)
+
+	secret := mustHexDecodeString(`9ac312a7f877468ebe69422748ad00a1 5443f18203a07d6060f688f30f21632b`)
+	k, err := NewProtectionKey(tls.TLS_CHACHA20_POLY1305_SHA256, secret, V1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pnLen := int(hdr[0]&0x03) + 1
+	offset := len(hdr) - pnLen
+	pp := NewPacketProtector(k)
+	got, err := pp.UnProtect(protect, int64(offset), 654360564)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, unProtect) {
+		t.Error("UnProtect returns wrong result")
+	}
+}
+
+func mustHexDecodeString(s string) []byte {
+	b, err := hex.DecodeString(normalizeHex(s))
+	if err != nil {
+		panic(err)
+	}
+	return b
+}
+
+func normalizeHex(s string) string {
+	return strings.Map(func(c rune) rune {
+		if unicode.IsSpace(c) {
+			return -1
+		}
+		return c
+	}, s)
+}
@@ -0,0 +1,122 @@
+package quic
+
+import (
+	"bytes"
+	"crypto"
+	"errors"
+	"fmt"
+	"io"
+	"sort"
+
+	"github.com/quic-go/quic-go/quicvarint"
+	"golang.org/x/crypto/hkdf"
+)
+
+func ReadCryptoPayload(packet []byte) ([]byte, error) {
+	hdr, offset, err := ParseInitialHeader(packet)
+	if err != nil {
+		return nil, err
+	}
+	// Some sanity checks
+	if hdr.Version != V1 && hdr.Version != V2 {
+		return nil, fmt.Errorf("unsupported version: %x", hdr.Version)
+	}
+	if offset == 0 || hdr.Length == 0 {
+		return nil, errors.New("invalid packet")
+	}
+
+	initialSecret := hkdf.Extract(crypto.SHA256.New, hdr.DestConnectionID, getSalt(hdr.Version))
+	clientSecret := hkdfExpandLabel(crypto.SHA256.New, initialSecret, "client in", []byte{}, crypto.SHA256.Size())
+	key, err := NewInitialProtectionKey(clientSecret, hdr.Version)
+	if err != nil {
+		return nil, fmt.Errorf("NewInitialProtectionKey: %w", err)
+	}
+	pp := NewPacketProtector(key)
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-client-initial
+	//
+	// "The unprotected header includes the connection ID and a 4-byte packet number encoding for a packet number of 2"
+	if int64(len(packet)) < offset+hdr.Length {
+		return nil, fmt.Errorf("packet is too short: %d < %d", len(packet), offset+hdr.Length)
+	}
+	unProtectedPayload, err := pp.UnProtect(packet[:offset+hdr.Length], offset, 2)
+	if err != nil {
+		return nil, err
+	}
+	frs, err := extractCryptoFrames(bytes.NewReader(unProtectedPayload))
+	if err != nil {
+		return nil, err
+	}
+	data := assembleCryptoFrames(frs)
+	if data == nil {
+		return nil, errors.New("unable to assemble crypto frames")
+	}
+	return data, nil
+}
+
+const (
+	paddingFrameType = 0x00
+	pingFrameType    = 0x01
+	cryptoFrameType  = 0x06
+)
+
+type cryptoFrame struct {
+	Offset int64
+	Data   []byte
+}
+
+func extractCryptoFrames(r *bytes.Reader) ([]cryptoFrame, error) {
+	var frames []cryptoFrame
+	for r.Len() > 0 {
+		typ, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		if typ == paddingFrameType || typ == pingFrameType {
+			continue
+		}
+		if typ != cryptoFrameType {
+			return nil, fmt.Errorf("encountered unexpected frame type: %d", typ)
+		}
+		var frame cryptoFrame
+		offset, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		frame.Offset = int64(offset)
+		dataLen, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		frame.Data = make([]byte, dataLen)
+		if _, err := io.ReadFull(r, frame.Data); err != nil {
+			return nil, err
+		}
+		frames = append(frames, frame)
+	}
+	return frames, nil
+}
+
+// assembleCryptoFrames assembles multiple crypto frames into a single slice (if possible).
+// It returns an error if the frames cannot be assembled. This can happen if the frames are not contiguous.
+func assembleCryptoFrames(frames []cryptoFrame) []byte {
+	if len(frames) == 0 {
+		return nil
+	}
+	if len(frames) == 1 {
+		return frames[0].Data
+	}
+	// sort the frames by offset
+	sort.Slice(frames, func(i, j int) bool { return frames[i].Offset < frames[j].Offset })
+	// check if the frames are contiguous
+	for i := 1; i < len(frames); i++ {
+		if frames[i].Offset != frames[i-1].Offset+int64(len(frames[i-1].Data)) {
+			return nil
+		}
+	}
+	// concatenate the frames
+	data := make([]byte, frames[len(frames)-1].Offset+int64(len(frames[len(frames)-1].Data)))
+	for _, frame := range frames {
+		copy(data[frame.Offset:], frame.Data)
+	}
+	return data
+}
@@ -0,0 +1,59 @@
+package quic
+
+const (
+	V1 uint32 = 0x1
+	V2 uint32 = 0x6b3343cf
+
+	hkdfLabelKeyV1 = "quic key"
+	hkdfLabelKeyV2 = "quicv2 key"
+	hkdfLabelIVV1  = "quic iv"
+	hkdfLabelIVV2  = "quicv2 iv"
+	hkdfLabelHPV1  = "quic hp"
+	hkdfLabelHPV2  = "quicv2 hp"
+)
+
+var (
+	quicSaltOld = []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99}
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-initial-secrets
+	quicSaltV1 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	// https://www.ietf.org/archive/id/draft-ietf-quic-v2-10.html#name-initial-salt-2
+	quicSaltV2 = []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9}
+)
+
+// isLongHeader reports whether b is the first byte of a long header packet.
+func isLongHeader(b byte) bool {
+	return b&0x80 > 0
+}
+
+func getSalt(v uint32) []byte {
+	switch v {
+	case V1:
+		return quicSaltV1
+	case V2:
+		return quicSaltV2
+	}
+	return quicSaltOld
+}
+
+func keyLabel(v uint32) string {
+	kl := hkdfLabelKeyV1
+	if v == V2 {
+		kl = hkdfLabelKeyV2
+	}
+	return kl
+}
+
+func ivLabel(v uint32) string {
+	ivl := hkdfLabelIVV1
+	if v == V2 {
+		ivl = hkdfLabelIVV2
+	}
+	return ivl
+}
+
+func headerProtectionLabel(v uint32) string {
+	if v == V2 {
+		return hkdfLabelHPV2
+	}
+	return hkdfLabelHPV1
+}
@@ -0,0 +1,384 @@
+package udp
+
+import (
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/utils"
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*OpenVPNAnalyzer)(nil)
+	_ analyzer.TCPAnalyzer = (*OpenVPNAnalyzer)(nil)
+)
+
+var (
+	_ analyzer.UDPStream = (*openvpnUDPStream)(nil)
+	_ analyzer.TCPStream = (*openvpnTCPStream)(nil)
+)
+
+// Ref paper:
+// https://www.usenix.org/system/files/sec22fall_xue-diwen.pdf
+
+// OpenVPN Opcodes definitions from:
+// https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/ssl_pkt.h
+const (
+	OpenVPNControlHardResetClientV1 = 1
+	OpenVPNControlHardResetServerV1 = 2
+	OpenVPNControlSoftResetV1       = 3
+	OpenVPNControlV1                = 4
+	OpenVPNAckV1                    = 5
+	OpenVPNDataV1                   = 6
+	OpenVPNControlHardResetClientV2 = 7
+	OpenVPNControlHardResetServerV2 = 8
+	OpenVPNDataV2                   = 9
+	OpenVPNControlHardResetClientV3 = 10
+	OpenVPNControlWkcV1             = 11
+)
+
+const (
+	OpenVPNMinPktLen          = 6
+	OpenVPNTCPPktDefaultLimit = 256
+	OpenVPNUDPPktDefaultLimit = 256
+)
+
+type OpenVPNAnalyzer struct{}
+
+func (a *OpenVPNAnalyzer) Name() string {
+	return "openvpn"
+}
+
+func (a *OpenVPNAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *OpenVPNAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return newOpenVPNUDPStream(logger)
+}
+
+func (a *OpenVPNAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newOpenVPNTCPStream(logger)
+}
+
+type openvpnPkt struct {
+	pktLen uint16 // 16 bits, TCP proto only
+	opcode byte   // 5 bits
+	_keyId byte   // 3 bits, not used
+
+	// We don't care about the rest of the packet
+	// payload []byte
+}
+
+type openvpnStream struct {
+	logger analyzer.Logger
+
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+
+	rxPktCnt int
+	txPktCnt int
+	pktLimit int
+
+	reqPktParse  func() (*openvpnPkt, utils.LSMAction)
+	respPktParse func() (*openvpnPkt, utils.LSMAction)
+
+	lastOpcode byte
+}
+
+func (o *openvpnStream) parseCtlHardResetClient() utils.LSMAction {
+	pkt, action := o.reqPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlHardResetClientV1 &&
+		pkt.opcode != OpenVPNControlHardResetClientV2 &&
+		pkt.opcode != OpenVPNControlHardResetClientV3 {
+		return utils.LSMActionCancel
+	}
+	o.lastOpcode = pkt.opcode
+
+	return utils.LSMActionNext
+}
+
+func (o *openvpnStream) parseCtlHardResetServer() utils.LSMAction {
+	if o.lastOpcode != OpenVPNControlHardResetClientV1 &&
+		o.lastOpcode != OpenVPNControlHardResetClientV2 &&
+		o.lastOpcode != OpenVPNControlHardResetClientV3 {
+		return utils.LSMActionCancel
+	}
+
+	pkt, action := o.respPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlHardResetServerV1 &&
+		pkt.opcode != OpenVPNControlHardResetServerV2 {
+		return utils.LSMActionCancel
+	}
+	o.lastOpcode = pkt.opcode
+
+	return utils.LSMActionNext
+}
+
+func (o *openvpnStream) parseReq() utils.LSMAction {
+	pkt, action := o.reqPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlSoftResetV1 &&
+		pkt.opcode != OpenVPNControlV1 &&
+		pkt.opcode != OpenVPNAckV1 &&
+		pkt.opcode != OpenVPNDataV1 &&
+		pkt.opcode != OpenVPNDataV2 &&
+		pkt.opcode != OpenVPNControlWkcV1 {
+		return utils.LSMActionCancel
+	}
+
+	o.txPktCnt += 1
+	o.reqUpdated = true
+
+	return utils.LSMActionPause
+}
+
+func (o *openvpnStream) parseResp() utils.LSMAction {
+	pkt, action := o.respPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlSoftResetV1 &&
+		pkt.opcode != OpenVPNControlV1 &&
+		pkt.opcode != OpenVPNAckV1 &&
+		pkt.opcode != OpenVPNDataV1 &&
+		pkt.opcode != OpenVPNDataV2 &&
+		pkt.opcode != OpenVPNControlWkcV1 {
+		return utils.LSMActionCancel
+	}
+
+	o.rxPktCnt += 1
+	o.respUpdated = true
+
+	return utils.LSMActionPause
+}
+
+type openvpnUDPStream struct {
+	openvpnStream
+	curPkt []byte
+	// We don't introduce `invalidCount` here to decrease the false positive rate
+	// invalidCount int
+}
+
+func newOpenVPNUDPStream(logger analyzer.Logger) *openvpnUDPStream {
+	s := &openvpnUDPStream{
+		openvpnStream: openvpnStream{
+			logger:   logger,
+			pktLimit: OpenVPNUDPPktDefaultLimit,
+		},
+	}
+	s.respPktParse = s.parsePkt
+	s.reqPktParse = s.parsePkt
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetClient,
+		s.parseReq,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetServer,
+		s.parseResp,
+	)
+	return s
+}
+
+func (o *openvpnUDPStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	o.curPkt = data
+	if rev {
+		o.respUpdated = false
+		cancelled, o.respDone = o.respLSM.Run()
+		if o.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.respUpdated = false
+		}
+	} else {
+		o.reqUpdated = false
+		cancelled, o.reqDone = o.reqLSM.Run()
+		if o.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.reqUpdated = false
+		}
+	}
+
+	return update, cancelled || (o.reqDone && o.respDone) || o.rxPktCnt+o.txPktCnt > o.pktLimit
+}
+
+func (o *openvpnUDPStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+// Parse OpenVPN UDP packet.
+func (o *openvpnUDPStream) parsePkt() (p *openvpnPkt, action utils.LSMAction) {
+	if o.curPkt == nil {
+		return nil, utils.LSMActionPause
+	}
+
+	if !OpenVPNCheckForValidOpcode(o.curPkt[0] >> 3) {
+		return nil, utils.LSMActionCancel
+	}
+
+	// Parse packet header
+	p = &openvpnPkt{}
+	p.opcode = o.curPkt[0] >> 3
+	p._keyId = o.curPkt[0] & 0x07
+
+	o.curPkt = nil
+	return p, utils.LSMActionNext
+}
+
+type openvpnTCPStream struct {
+	openvpnStream
+	reqBuf  *utils.ByteBuffer
+	respBuf *utils.ByteBuffer
+}
+
+func newOpenVPNTCPStream(logger analyzer.Logger) *openvpnTCPStream {
+	s := &openvpnTCPStream{
+		openvpnStream: openvpnStream{
+			logger:   logger,
+			pktLimit: OpenVPNTCPPktDefaultLimit,
+		},
+		reqBuf:  &utils.ByteBuffer{},
+		respBuf: &utils.ByteBuffer{},
+	}
+	s.respPktParse = func() (*openvpnPkt, utils.LSMAction) {
+		return s.parsePkt(true)
+	}
+	s.reqPktParse = func() (*openvpnPkt, utils.LSMAction) {
+		return s.parsePkt(false)
+	}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetClient,
+		s.parseReq,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetServer,
+		s.parseResp,
+	)
+	return s
+}
+
+func (o *openvpnTCPStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		o.respBuf.Append(data)
+		o.respUpdated = false
+		cancelled, o.respDone = o.respLSM.Run()
+		if o.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.respUpdated = false
+		}
+	} else {
+		o.reqBuf.Append(data)
+		o.reqUpdated = false
+		cancelled, o.reqDone = o.reqLSM.Run()
+		if o.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.reqUpdated = false
+		}
+	}
+
+	return update, cancelled || (o.reqDone && o.respDone) || o.rxPktCnt+o.txPktCnt > o.pktLimit
+}
+
+func (o *openvpnTCPStream) Close(limited bool) *analyzer.PropUpdate {
+	o.reqBuf.Reset()
+	o.respBuf.Reset()
+	return nil
+}
+
+// Parse OpenVPN TCP packet.
+func (o *openvpnTCPStream) parsePkt(rev bool) (p *openvpnPkt, action utils.LSMAction) {
+	var buffer *utils.ByteBuffer
+	if rev {
+		buffer = o.respBuf
+	} else {
+		buffer = o.reqBuf
+	}
+
+	// Parse packet length
+	pktLen, ok := buffer.GetUint16(false, false)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+
+	if pktLen < OpenVPNMinPktLen {
+		return nil, utils.LSMActionCancel
+	}
+
+	pktOp, ok := buffer.Get(3, false)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+	if !OpenVPNCheckForValidOpcode(pktOp[2] >> 3) {
+		return nil, utils.LSMActionCancel
+	}
+
+	pkt, ok := buffer.Get(int(pktLen)+2, true)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+	pkt = pkt[2:]
+
+	// Parse packet header
+	p = &openvpnPkt{}
+	p.pktLen = pktLen
+	p.opcode = pkt[0] >> 3
+	p._keyId = pkt[0] & 0x07
+
+	return p, utils.LSMActionNext
+}
+
+func OpenVPNCheckForValidOpcode(opcode byte) bool {
+	switch opcode {
+	case OpenVPNControlHardResetClientV1,
+		OpenVPNControlHardResetServerV1,
+		OpenVPNControlSoftResetV1,
+		OpenVPNControlV1,
+		OpenVPNAckV1,
+		OpenVPNDataV1,
+		OpenVPNControlHardResetClientV2,
+		OpenVPNControlHardResetServerV2,
+		OpenVPNDataV2,
+		OpenVPNControlHardResetClientV3,
+		OpenVPNControlWkcV1:
+		return true
+	}
+	return false
+}
@@ -0,0 +1,81 @@
+package udp
+
+import (
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/internal"
+	"github.com/apernet/OpenGFW/analyzer/udp/internal/quic"
+	"github.com/apernet/OpenGFW/analyzer/utils"
+)
+
+const (
+	quicInvalidCountThreshold = 4
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*QUICAnalyzer)(nil)
+	_ analyzer.UDPStream   = (*quicStream)(nil)
+)
+
+type QUICAnalyzer struct{}
+
+func (a *QUICAnalyzer) Name() string {
+	return "quic"
+}
+
+func (a *QUICAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *QUICAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return &quicStream{logger: logger}
+}
+
+type quicStream struct {
+	logger       analyzer.Logger
+	invalidCount int
+}
+
+func (s *quicStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, done bool) {
+	// minimal data size: protocol version (2 bytes) + random (32 bytes) +
+	//   + session ID (1 byte) + cipher suites (4 bytes) +
+	//   + compression methods (2 bytes) + no extensions
+	const minDataSize = 41
+
+	if rev {
+		// We don't support server direction for now
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	pl, err := quic.ReadCryptoPayload(data)
+	if err != nil || len(pl) < 4 { // FIXME: isn't length checked inside quic.ReadCryptoPayload? Also, what about error handling?
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	if pl[0] != internal.TypeClientHello {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	chLen := int(pl[1])<<16 | int(pl[2])<<8 | int(pl[3])
+	if chLen < minDataSize {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	m := internal.ParseTLSClientHelloMsgData(&utils.ByteBuffer{Buf: pl[4:]})
+	if m == nil {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	return &analyzer.PropUpdate{
+		Type: analyzer.PropUpdateMerge,
+		M:    analyzer.PropMap{"req": m},
+	}, true
+}
+
+func (s *quicStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
@@ -0,0 +1,58 @@
+package udp
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/apernet/OpenGFW/analyzer"
+)
+
+func TestQuicStreamParsing_ClientHello(t *testing.T) {
+	// example packet taken from <https://quic.xargs.org/#client-initial-packet/annotated>
+	clientHello := make([]byte, 1200)
+	clientInitial := []byte{
+		0xcd, 0x00, 0x00, 0x00, 0x01, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+		0x06, 0x07, 0x05, 0x63, 0x5f, 0x63, 0x69, 0x64, 0x00, 0x41, 0x03, 0x98,
+		0x1c, 0x36, 0xa7, 0xed, 0x78, 0x71, 0x6b, 0xe9, 0x71, 0x1b, 0xa4, 0x98,
+		0xb7, 0xed, 0x86, 0x84, 0x43, 0xbb, 0x2e, 0x0c, 0x51, 0x4d, 0x4d, 0x84,
+		0x8e, 0xad, 0xcc, 0x7a, 0x00, 0xd2, 0x5c, 0xe9, 0xf9, 0xaf, 0xa4, 0x83,
+		0x97, 0x80, 0x88, 0xde, 0x83, 0x6b, 0xe6, 0x8c, 0x0b, 0x32, 0xa2, 0x45,
+		0x95, 0xd7, 0x81, 0x3e, 0xa5, 0x41, 0x4a, 0x91, 0x99, 0x32, 0x9a, 0x6d,
+		0x9f, 0x7f, 0x76, 0x0d, 0xd8, 0xbb, 0x24, 0x9b, 0xf3, 0xf5, 0x3d, 0x9a,
+		0x77, 0xfb, 0xb7, 0xb3, 0x95, 0xb8, 0xd6, 0x6d, 0x78, 0x79, 0xa5, 0x1f,
+		0xe5, 0x9e, 0xf9, 0x60, 0x1f, 0x79, 0x99, 0x8e, 0xb3, 0x56, 0x8e, 0x1f,
+		0xdc, 0x78, 0x9f, 0x64, 0x0a, 0xca, 0xb3, 0x85, 0x8a, 0x82, 0xef, 0x29,
+		0x30, 0xfa, 0x5c, 0xe1, 0x4b, 0x5b, 0x9e, 0xa0, 0xbd, 0xb2, 0x9f, 0x45,
+		0x72, 0xda, 0x85, 0xaa, 0x3d, 0xef, 0x39, 0xb7, 0xef, 0xaf, 0xff, 0xa0,
+		0x74, 0xb9, 0x26, 0x70, 0x70, 0xd5, 0x0b, 0x5d, 0x07, 0x84, 0x2e, 0x49,
+		0xbb, 0xa3, 0xbc, 0x78, 0x7f, 0xf2, 0x95, 0xd6, 0xae, 0x3b, 0x51, 0x43,
+		0x05, 0xf1, 0x02, 0xaf, 0xe5, 0xa0, 0x47, 0xb3, 0xfb, 0x4c, 0x99, 0xeb,
+		0x92, 0xa2, 0x74, 0xd2, 0x44, 0xd6, 0x04, 0x92, 0xc0, 0xe2, 0xe6, 0xe2,
+		0x12, 0xce, 0xf0, 0xf9, 0xe3, 0xf6, 0x2e, 0xfd, 0x09, 0x55, 0xe7, 0x1c,
+		0x76, 0x8a, 0xa6, 0xbb, 0x3c, 0xd8, 0x0b, 0xbb, 0x37, 0x55, 0xc8, 0xb7,
+		0xeb, 0xee, 0x32, 0x71, 0x2f, 0x40, 0xf2, 0x24, 0x51, 0x19, 0x48, 0x70,
+		0x21, 0xb4, 0xb8, 0x4e, 0x15, 0x65, 0xe3, 0xca, 0x31, 0x96, 0x7a, 0xc8,
+		0x60, 0x4d, 0x40, 0x32, 0x17, 0x0d, 0xec, 0x28, 0x0a, 0xee, 0xfa, 0x09,
+		0x5d, 0x08, 0xb3, 0xb7, 0x24, 0x1e, 0xf6, 0x64, 0x6a, 0x6c, 0x86, 0xe5,
+		0xc6, 0x2c, 0xe0, 0x8b, 0xe0, 0x99,
+	}
+	copy(clientHello, clientInitial)
+
+	want := analyzer.PropMap{
+		"alpn":               []string{"ping/1.0"},
+		"ciphers":            []uint16{4865, 4866, 4867},
+		"compression":        []uint8{0},
+		"random":             []uint8{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31},
+		"session":            []uint8{},
+		"sni":                "example.ulfheim.net",
+		"supported_versions": []uint16{772},
+		"version":            uint16(771),
+	}
+
+	s := quicStream{}
+	u, _ := s.Feed(false, clientHello)
+	got := u.M.Get("req")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(clientHello), got, want)
+	}
+}
@@ -0,0 +1,217 @@
+package udp
+
+import (
+	"container/ring"
+	"encoding/binary"
+	"slices"
+	"sync"
+
+	"github.com/apernet/OpenGFW/analyzer"
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*WireGuardAnalyzer)(nil)
+	_ analyzer.UDPStream   = (*wireGuardUDPStream)(nil)
+)
+
+const (
+	wireguardUDPInvalidCountThreshold = 4
+	wireguardRememberedIndexCount     = 6
+	wireguardPropKeyMessageType       = "message_type"
+)
+
+const (
+	wireguardTypeHandshakeInitiation = 1
+	wireguardTypeHandshakeResponse   = 2
+	wireguardTypeData                = 4
+	wireguardTypeCookieReply         = 3
+)
+
+const (
+	wireguardSizeHandshakeInitiation = 148
+	wireguardSizeHandshakeResponse   = 92
+	wireguardMinSizePacketData       = 32 // 16 bytes header + 16 bytes AEAD overhead
+	wireguardSizePacketCookieReply   = 64
+)
+
+type WireGuardAnalyzer struct{}
+
+func (a *WireGuardAnalyzer) Name() string {
+	return "wireguard"
+}
+
+func (a *WireGuardAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *WireGuardAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return newWireGuardUDPStream(logger)
+}
+
+type wireGuardUDPStream struct {
+	logger                analyzer.Logger
+	invalidCount          int
+	rememberedIndexes     *ring.Ring
+	rememberedIndexesLock sync.RWMutex
+}
+
+func newWireGuardUDPStream(logger analyzer.Logger) *wireGuardUDPStream {
+	return &wireGuardUDPStream{
+		logger:            logger,
+		rememberedIndexes: ring.New(wireguardRememberedIndexCount),
+	}
+}
+
+func (s *wireGuardUDPStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, done bool) {
+	m := s.parseWireGuardPacket(rev, data)
+	if m == nil {
+		s.invalidCount++
+		return nil, s.invalidCount >= wireguardUDPInvalidCountThreshold
+	}
+	s.invalidCount = 0 // Reset invalid count on valid WireGuard packet
+	messageType := m[wireguardPropKeyMessageType].(byte)
+	propUpdateType := analyzer.PropUpdateMerge
+	if messageType == wireguardTypeHandshakeInitiation {
+		propUpdateType = analyzer.PropUpdateReplace
+	}
+	return &analyzer.PropUpdate{
+		Type: propUpdateType,
+		M:    m,
+	}, false
+}
+
+func (s *wireGuardUDPStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacket(rev bool, data []byte) analyzer.PropMap {
+	if len(data) < 4 {
+		return nil
+	}
+	if slices.Max(data[1:4]) != 0 {
+		return nil
+	}
+
+	messageType := data[0]
+	var propKey string
+	var propValue analyzer.PropMap
+	switch messageType {
+	case wireguardTypeHandshakeInitiation:
+		propKey = "handshake_initiation"
+		propValue = s.parseWireGuardHandshakeInitiation(rev, data)
+	case wireguardTypeHandshakeResponse:
+		propKey = "handshake_response"
+		propValue = s.parseWireGuardHandshakeResponse(rev, data)
+	case wireguardTypeData:
+		propKey = "packet_data"
+		propValue = s.parseWireGuardPacketData(rev, data)
+	case wireguardTypeCookieReply:
+		propKey = "packet_cookie_reply"
+		propValue = s.parseWireGuardPacketCookieReply(rev, data)
+	}
+	if propValue == nil {
+		return nil
+	}
+
+	m := make(analyzer.PropMap)
+	m[wireguardPropKeyMessageType] = messageType
+	m[propKey] = propValue
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardHandshakeInitiation(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizeHandshakeInitiation {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	senderIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["sender_index"] = senderIndex
+	s.putSenderIndex(rev, senderIndex)
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardHandshakeResponse(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizeHandshakeResponse {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	senderIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["sender_index"] = senderIndex
+	s.putSenderIndex(rev, senderIndex)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[8:12])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacketData(rev bool, data []byte) analyzer.PropMap {
+	if len(data) < wireguardMinSizePacketData {
+		return nil
+	}
+	if len(data)%16 != 0 {
+		// WireGuard zero padding the packet to make the length a multiple of 16
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	m["counter"] = binary.LittleEndian.Uint64(data[8:16])
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacketCookieReply(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizePacketCookieReply {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	return m
+}
+
+type wireGuardIndex struct {
+	SenderIndex uint32
+	Reverse     bool
+}
+
+func (s *wireGuardUDPStream) putSenderIndex(rev bool, senderIndex uint32) {
+	s.rememberedIndexesLock.Lock()
+	defer s.rememberedIndexesLock.Unlock()
+
+	s.rememberedIndexes.Value = &wireGuardIndex{
+		SenderIndex: senderIndex,
+		Reverse:     rev,
+	}
+	s.rememberedIndexes = s.rememberedIndexes.Prev()
+}
+
+func (s *wireGuardUDPStream) matchReceiverIndex(rev bool, receiverIndex uint32) bool {
+	s.rememberedIndexesLock.RLock()
+	defer s.rememberedIndexesLock.RUnlock()
+
+	var found bool
+	ris := s.rememberedIndexes
+	for it := ris.Next(); it != ris; it = it.Next() {
+		if it.Value == nil {
+			break
+		}
+		wgidx := it.Value.(*wireGuardIndex)
+		if wgidx.Reverse == !rev && wgidx.SenderIndex == receiverIndex {
+			found = true
+			break
+		}
+	}
+	return found
+}
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
-	"strconv"
 	"strings"
+	"syscall"

 	"github.com/apernet/OpenGFW/analyzer"
 	"github.com/apernet/OpenGFW/analyzer/tcp"
@@ -16,6 +16,7 @@ import (
 	"github.com/apernet/OpenGFW/modifier"
 	modUDP "github.com/apernet/OpenGFW/modifier/udp"
 	"github.com/apernet/OpenGFW/ruleset"
+	"github.com/apernet/OpenGFW/web"

 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -36,6 +37,12 @@ const (
 	appLogFormatEnv = "OPENGFW_LOG_FORMAT"
 )

+// Build information, set with -ldflags at build time.
+var (
+	appVersion = "dev"
+	appCommit  = ""
+)
+
 var logger *zap.Logger

 // Flags
@@ -92,6 +99,9 @@ var analyzers = []analyzer.Analyzer{
 	&tcp.TLSAnalyzer{},
 	&tcp.TrojanAnalyzer{},
 	&udp.DNSAnalyzer{},
+	&udp.OpenVPNAnalyzer{},
+	&udp.QUICAnalyzer{},
+	&udp.WireGuardAnalyzer{},
 }

 var modifiers = []modifier.Modifier{
@@ -161,11 +171,16 @@ func initLogger() {
 type cliConfig struct {
 	IO      cliConfigIO      `mapstructure:"io"`
 	Workers cliConfigWorkers `mapstructure:"workers"`
+	Ruleset cliConfigRuleset `mapstructure:"ruleset"`
+	Web     cliConfigWeb     `mapstructure:"web"`
 }

 type cliConfigIO struct {
-	QueueSize uint32 `mapstructure:"queueSize"`
-	Local     bool   `mapstructure:"local"`
+	QueueSize   uint32 `mapstructure:"queueSize"`
+	ReadBuffer  int    `mapstructure:"rcvBuf"`
+	WriteBuffer int    `mapstructure:"sndBuf"`
+	Local       bool   `mapstructure:"local"`
+	RST         bool   `mapstructure:"rst"`
 }

 type cliConfigWorkers struct {
@@ -176,6 +191,19 @@ type cliConfigWorkers struct {
 	UDPMaxStreams              int `mapstructure:"udpMaxStreams"`
 }

+type cliConfigRuleset struct {
+	GeoIp   string `mapstructure:"geoip"`
+	GeoSite string `mapstructure:"geosite"`
+}
+
+type cliConfigWeb struct {
+	Enabled bool   `mapstructure:"enabled"`
+	Listen  string `mapstructure:"listen"`
+	Secret  string `mapstructure:"secret"`
+	Cert    string `mapstructure:"cert"`
+	Key     string `mapstructure:"key"`
+}
+
 func (c *cliConfig) fillLogger(config *engine.Config) error {
 	config.Logger = &engineLogger{}
 	return nil
@@ -183,13 +211,16 @@ func (c *cliConfig) fillLogger(config *engine.Config) error {

 func (c *cliConfig) fillIO(config *engine.Config) error {
 	nfio, err := io.NewNFQueuePacketIO(io.NFQueuePacketIOConfig{
-		QueueSize: c.IO.QueueSize,
-		Local:     c.IO.Local,
+		QueueSize:   c.IO.QueueSize,
+		ReadBuffer:  c.IO.ReadBuffer,
+		WriteBuffer: c.IO.WriteBuffer,
+		Local:       c.IO.Local,
+		RST:         c.IO.RST,
 	})
 	if err != nil {
 		return configError{Field: "io", Err: err}
 	}
-	config.IOs = []io.PacketIO{nfio}
+	config.IO = nfio
 	return nil
 }

@@ -232,19 +263,26 @@ func runMain(cmd *cobra.Command, args []string) {
 	if err != nil {
 		logger.Fatal("failed to parse config", zap.Error(err))
 	}
-	defer func() {
-		// Make sure to close all IOs on exit
-		for _, i := range engineConfig.IOs {
-			_ = i.Close()
-		}
-	}()
+	defer engineConfig.IO.Close() // Make sure to close IO on exit
+
+	// Statistics hub for the web UI
+	if config.Web.Enabled {
+		hub = web.NewHub()
+	}

 	// Ruleset
-	rawRs, err := ruleset.ExprRulesFromYAML(args[0])
+	rsConfig := &ruleset.BuiltinConfig{
+		Logger:               &rulesetLogger{},
+		GeoSiteFilename:      config.Ruleset.GeoSite,
+		GeoIpFilename:        config.Ruleset.GeoIp,
+		ProtectedDialContext: engineConfig.IO.ProtectedDialContext,
+	}
+	rm := newRuleManager(args[0], analyzers, modifiers, rsConfig)
+	rawRules, err := os.ReadFile(args[0])
 	if err != nil {
 		logger.Fatal("failed to load rules", zap.Error(err))
 	}
-	rs, err := ruleset.CompileExprRules(rawRs, analyzers, modifiers)
+	rs, _, err := rm.Compile(string(rawRules))
 	if err != nil {
 		logger.Fatal("failed to compile rules", zap.Error(err))
 	}
@@ -255,15 +293,40 @@ func runMain(cmd *cobra.Command, args []string) {
 	if err != nil {
 		logger.Fatal("failed to initialize engine", zap.Error(err))
 	}
+	rm.SetEngine(en)

+	// Signal handling
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	go func() {
-		sigChan := make(chan os.Signal)
-		signal.Notify(sigChan, os.Interrupt, os.Kill)
-		<-sigChan
+		// Graceful shutdown
+		shutdownChan := make(chan os.Signal, 1)
+		signal.Notify(shutdownChan, os.Interrupt, syscall.SIGTERM)
+		<-shutdownChan
 		logger.Info("shutting down gracefully...")
 		cancelFunc()
 	}()
+	go func() {
+		// Rule reload
+		reloadChan := make(chan os.Signal, 1)
+		signal.Notify(reloadChan, syscall.SIGHUP)
+		for {
+			<-reloadChan
+			logger.Info("reloading rules")
+			if err := rm.Reload(); err != nil {
+				logger.Error("failed to reload rules, using old rules", zap.Error(err))
+			} else {
+				logger.Info("rules reloaded")
+			}
+		}
+	}()
+
+	// Web UI
+	if config.Web.Enabled {
+		if err := startWebServer(ctx, &config, rm); err != nil {
+			logger.Fatal("failed to start web UI", zap.Error(err))
+		}
+	}
+
 	logger.Info("engine started")
 	logger.Info("engine exited", zap.Error(en.Run(ctx)))
 }
@@ -271,14 +334,23 @@ func runMain(cmd *cobra.Command, args []string) {
 type engineLogger struct{}

 func (l *engineLogger) WorkerStart(id int) {
+	if hub != nil {
+		hub.WorkerStarted()
+	}
 	logger.Debug("worker started", zap.Int("id", id))
 }

 func (l *engineLogger) WorkerStop(id int) {
+	if hub != nil {
+		hub.WorkerStopped()
+	}
 	logger.Debug("worker stopped", zap.Int("id", id))
 }

 func (l *engineLogger) TCPStreamNew(workerID int, info ruleset.StreamInfo) {
+	if hub != nil {
+		hub.StreamNew("tcp")
+	}
 	logger.Debug("new TCP stream",
 		zap.Int("workerID", workerID),
 		zap.Int64("id", info.ID),
@@ -287,6 +359,9 @@ func (l *engineLogger) TCPStreamNew(workerID int, info ruleset.StreamInfo) {
 }

 func (l *engineLogger) TCPStreamPropUpdate(info ruleset.StreamInfo, close bool) {
+	if hub != nil {
+		hub.PropUpdate(toWebProps(info.Props))
+	}
 	logger.Debug("TCP stream property update",
 		zap.Int64("id", info.ID),
 		zap.String("src", info.SrcString()),
@@ -296,6 +371,9 @@ func (l *engineLogger) TCPStreamPropUpdate(info ruleset.StreamInfo, close bool)
 }

 func (l *engineLogger) TCPStreamAction(info ruleset.StreamInfo, action ruleset.Action, noMatch bool) {
+	if hub != nil {
+		hub.StreamAction(hubInfo(info), action.String())
+	}
 	logger.Info("TCP stream action",
 		zap.Int64("id", info.ID),
 		zap.String("src", info.SrcString()),
@@ -305,6 +383,9 @@ func (l *engineLogger) TCPStreamAction(info ruleset.StreamInfo, action ruleset.A
 }

 func (l *engineLogger) UDPStreamNew(workerID int, info ruleset.StreamInfo) {
+	if hub != nil {
+		hub.StreamNew("udp")
+	}
 	logger.Debug("new UDP stream",
 		zap.Int("workerID", workerID),
 		zap.Int64("id", info.ID),
@@ -313,6 +394,9 @@ func (l *engineLogger) UDPStreamNew(workerID int, info ruleset.StreamInfo) {
 }

 func (l *engineLogger) UDPStreamPropUpdate(info ruleset.StreamInfo, close bool) {
+	if hub != nil {
+		hub.PropUpdate(toWebProps(info.Props))
+	}
 	logger.Debug("UDP stream property update",
 		zap.Int64("id", info.ID),
 		zap.String("src", info.SrcString()),
@@ -322,6 +406,9 @@ func (l *engineLogger) UDPStreamPropUpdate(info ruleset.StreamInfo, close bool)
 }

 func (l *engineLogger) UDPStreamAction(info ruleset.StreamInfo, action ruleset.Action, noMatch bool) {
+	if hub != nil {
+		hub.StreamAction(hubInfo(info), action.String())
+	}
 	logger.Info("UDP stream action",
 		zap.Int64("id", info.ID),
 		zap.String("src", info.SrcString()),
@@ -330,15 +417,10 @@ func (l *engineLogger) UDPStreamAction(info ruleset.StreamInfo, action ruleset.A
 		zap.Bool("noMatch", noMatch))
 }

-func (l *engineLogger) MatchError(info ruleset.StreamInfo, err error) {
-	logger.Error("match error",
-		zap.Int64("id", info.ID),
-		zap.String("src", info.SrcString()),
-		zap.String("dst", info.DstString()),
-		zap.Error(err))
-}
-
 func (l *engineLogger) ModifyError(info ruleset.StreamInfo, err error) {
+	if hub != nil {
+		hub.Error(hubInfo(info), "", err.Error())
+	}
 	logger.Error("modify error",
 		zap.Int64("id", info.ID),
 		zap.String("src", info.SrcString()),
@@ -367,17 +449,35 @@ func (l *engineLogger) AnalyzerErrorf(streamID int64, name string, format string
 		zap.String("msg", fmt.Sprintf(format, args...)))
 }

+type rulesetLogger struct{}
+
+func (l *rulesetLogger) Log(info ruleset.StreamInfo, name string) {
+	if hub != nil {
+		hub.RuleLog(hubInfo(info), name)
+	}
+	logger.Info("ruleset log",
+		zap.String("name", name),
+		zap.Int64("id", info.ID),
+		zap.String("src", info.SrcString()),
+		zap.String("dst", info.DstString()),
+		zap.Any("props", info.Props))
+}
+
+func (l *rulesetLogger) MatchError(info ruleset.StreamInfo, name string, err error) {
+	if hub != nil {
+		hub.Error(hubInfo(info), name, err.Error())
+	}
+	logger.Error("ruleset match error",
+		zap.String("name", name),
+		zap.Int64("id", info.ID),
+		zap.String("src", info.SrcString()),
+		zap.String("dst", info.DstString()),
+		zap.Error(err))
+}
+
 func envOrDefaultString(key, def string) string {
 	if v := os.Getenv(key); v != "" {
 		return v
 	}
 	return def
 }
-
-func envOrDefaultBool(key string, def bool) bool {
-	if v := os.Getenv(key); v != "" {
-		b, _ := strconv.ParseBool(v)
-		return b
-	}
-	return def
-}
@@ -0,0 +1,320 @@
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/engine"
+	"github.com/apernet/OpenGFW/modifier"
+	"github.com/apernet/OpenGFW/ruleset"
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo"
+	"github.com/apernet/OpenGFW/web"
+
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v3"
+)
+
+// hub is the (optional) statistics collector feeding the web UI. It is nil
+// when the web UI is disabled.
+var hub *web.Hub
+
+// ruleManager owns the rule file and knows how to hot reload the engine.
+// It is shared between the SIGHUP handler and the web UI.
+type ruleManager struct {
+	path      string
+	analyzers []analyzer.Analyzer
+	modifiers []modifier.Modifier
+	rsConfig  *ruleset.BuiltinConfig
+
+	mu     sync.Mutex
+	engine engine.Engine
+}
+
+var _ web.RuleManager = (*ruleManager)(nil)
+
+func newRuleManager(path string, ans []analyzer.Analyzer, mods []modifier.Modifier, rsConfig *ruleset.BuiltinConfig) *ruleManager {
+	return &ruleManager{path: path, analyzers: ans, modifiers: mods, rsConfig: rsConfig}
+}
+
+func (m *ruleManager) SetEngine(en engine.Engine) {
+	m.mu.Lock()
+	m.engine = en
+	m.mu.Unlock()
+}
+
+func (m *ruleManager) Path() string { return m.path }
+
+// Compile parses and compiles a rule file content, without applying it.
+func (m *ruleManager) Compile(raw string) (ruleset.Ruleset, []ruleset.ExprRule, error) {
+	rawRs, err := ruleset.ExprRulesFromYAMLBytes([]byte(raw))
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse rules: %w", err)
+	}
+	rs, err := ruleset.CompileExprRules(rawRs, m.analyzers, m.modifiers, m.rsConfig)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to compile rules: %w", err)
+	}
+	return rs, rawRs, nil
+}
+
+// Reload re-reads the rule file from disk and applies it to the engine.
+func (m *ruleManager) Reload() error {
+	bs, err := os.ReadFile(m.path)
+	if err != nil {
+		return err
+	}
+	rs, _, err := m.Compile(string(bs))
+	if err != nil {
+		return err
+	}
+	return m.update(rs)
+}
+
+func (m *ruleManager) update(rs ruleset.Ruleset) error {
+	m.mu.Lock()
+	en := m.engine
+	m.mu.Unlock()
+	if en == nil {
+		return errors.New("engine is not running")
+	}
+	return en.UpdateRuleset(rs)
+}
+
+func (m *ruleManager) Load() (string, []web.Rule, error) {
+	bs, err := os.ReadFile(m.path)
+	if err != nil {
+		return "", nil, err
+	}
+	rules, err := ruleset.ExprRulesFromYAMLBytes(bs)
+	if err != nil {
+		// The file is still shown as-is so that the user can fix it in the editor.
+		return string(bs), nil, nil
+	}
+	return string(bs), toWebRules(rules), nil
+}
+
+func (m *ruleManager) Validate(raw string) ([]web.Rule, error) {
+	_, rules, err := m.Compile(raw)
+	if err != nil {
+		return nil, err
+	}
+	return toWebRules(rules), nil
+}
+
+func (m *ruleManager) Marshal(rules []web.Rule) (string, error) {
+	out := make([]web.Rule, 0, len(rules))
+	for _, r := range rules {
+		if r.Modifier != nil && r.Modifier.Name == "" {
+			r.Modifier = nil // Leftover from switching a rule away from `modify`
+		}
+		out = append(out, r)
+	}
+	bs, err := yaml.Marshal(out)
+	if err != nil {
+		return "", err
+	}
+	return string(bs), nil
+}
+
+// Apply compiles the given rules, persists them to the rule file and hot
+// reloads the engine. The file is only written once the rules compile.
+func (m *ruleManager) Apply(raw string) ([]web.Rule, error) {
+	rs, rules, err := m.Compile(raw)
+	if err != nil {
+		return nil, err
+	}
+	if err := m.writeFile(raw); err != nil {
+		return nil, fmt.Errorf("failed to write rule file: %w", err)
+	}
+	if err := m.update(rs); err != nil {
+		return nil, fmt.Errorf("failed to update ruleset: %w", err)
+	}
+	return toWebRules(rules), nil
+}
+
+// writeFile replaces the rule file atomically so that a crash in the middle of
+// a save cannot leave a truncated ruleset behind.
+func (m *ruleManager) writeFile(raw string) error {
+	mode := os.FileMode(0o644)
+	if fi, err := os.Stat(m.path); err == nil {
+		mode = fi.Mode().Perm()
+	}
+	dir := filepath.Dir(m.path)
+	tmp, err := os.CreateTemp(dir, ".rules-*.yaml")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer os.Remove(tmpName) // No-op once the rename succeeded
+	if _, err := tmp.WriteString(raw); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	if err := os.Chmod(tmpName, mode); err != nil {
+		return err
+	}
+	return os.Rename(tmpName, m.path)
+}
+
+func toWebRules(rules []ruleset.ExprRule) []web.Rule {
+	out := make([]web.Rule, 0, len(rules))
+	for _, r := range rules {
+		wr := web.Rule{Name: r.Name, Action: r.Action, Log: r.Log, Expr: r.Expr}
+		if r.Modifier.Name != "" {
+			wr.Modifier = &web.RuleModifier{Name: r.Modifier.Name, Args: r.Modifier.Args}
+		}
+		out = append(out, wr)
+	}
+	return out
+}
+
+// startWebServer starts the web UI. It returns nil when the UI is disabled.
+func startWebServer(ctx context.Context, config *cliConfig, rm *ruleManager) error {
+	secret := config.Web.Secret
+	generated := false
+	if secret == "" {
+		secret = web.RandomSecret()
+		generated = true
+	}
+	srv, err := web.NewServer(web.Config{
+		Listen:   config.Web.Listen,
+		Secret:   secret,
+		CertFile: config.Web.Cert,
+		KeyFile:  config.Web.Key,
+		Hub:      hub,
+		Rules:    rm,
+		Meta:     webMeta(),
+		Info:     func() web.Info { return webInfo(config, rm) },
+		Geo:      func() web.GeoData { return webGeoData(config) },
+		Logf: func(format string, args ...interface{}) {
+			logger.Info(fmt.Sprintf(format, args...))
+		},
+	})
+	if err != nil {
+		return configError{Field: "web", Err: err}
+	}
+	scheme := "http"
+	if srv.TLS() {
+		scheme = "https"
+	}
+	fields := []zap.Field{
+		zap.String("listen", srv.Addr()),
+		zap.String("scheme", scheme),
+	}
+	if generated {
+		fields = append(fields, zap.String("password", secret))
+		logger.Warn("web UI password was not set, using a generated one", fields...)
+	} else {
+		logger.Info("web UI started", fields...)
+	}
+	go func() {
+		if err := srv.Run(ctx); err != nil {
+			logger.Error("web UI stopped", zap.Error(err))
+		}
+	}()
+	return nil
+}
+
+func webMeta() web.MetaInfo {
+	meta := web.MetaInfo{
+		Actions:   []string{"allow", "block", "drop", "modify"},
+		Functions: []string{"geoip", "geosite", "cidr", "lookup"},
+	}
+	for _, a := range analyzers {
+		proto := "tcp"
+		if _, ok := a.(analyzer.UDPAnalyzer); ok {
+			proto = "udp"
+		}
+		meta.Analyzers = append(meta.Analyzers, web.AnalyzerInfo{Name: a.Name(), Proto: proto})
+	}
+	for _, m := range modifiers {
+		meta.Modifiers = append(meta.Modifiers, m.Name())
+	}
+	return meta
+}
+
+func webInfo(config *cliConfig, rm *ruleManager) web.Info {
+	hostname, _ := os.Hostname()
+	return web.Info{
+		Version:   appVersion,
+		Commit:    appCommit,
+		Platform:  runtime.GOOS + "/" + runtime.GOARCH,
+		GoVersion: runtime.Version(),
+		Hostname:  hostname,
+		RuleFile:  rm.Path(),
+		Config: web.ConfigDigest{
+			IOQueueSize:   config.IO.QueueSize,
+			IOLocal:       config.IO.Local,
+			IORST:         config.IO.RST,
+			Workers:       config.Workers.Count,
+			WorkerQueue:   config.Workers.QueueSize,
+			UDPMaxStreams: config.Workers.UDPMaxStreams,
+			GeoIP:         config.Ruleset.GeoIp,
+			GeoSite:       config.Ruleset.GeoSite,
+		},
+	}
+}
+
+// webGeoData lists what the configured geo databases contain, so that the rule
+// builder can offer a picker instead of a free text field. Loading the files is
+// expensive, but the web server only calls this on demand and caches the result.
+func webGeoData(config *cliConfig) web.GeoData {
+	matcher := geo.NewGeoMatcher(config.Ruleset.GeoSite, config.Ruleset.GeoIp)
+	var data web.GeoData
+	if entries, err := matcher.ListGeoIP(); err != nil {
+		data.IPError = err.Error()
+	} else {
+		for _, e := range entries {
+			data.IP = append(data.IP, web.GeoEntry{Code: e.Code, Count: e.CIDRs})
+		}
+	}
+	if entries, err := matcher.ListGeoSite(); err != nil {
+		data.SiteError = err.Error()
+	} else {
+		for _, e := range entries {
+			data.Site = append(data.Site, web.GeoEntry{
+				Code:       e.Code,
+				Count:      e.Domains,
+				Attributes: e.Attributes,
+			})
+		}
+	}
+	return data
+}
+
+// hubInfo converts engine stream info into the shape the hub understands.
+func hubInfo(info ruleset.StreamInfo) web.StreamInfo {
+	return web.StreamInfo{
+		ID:      info.ID,
+		Proto:   info.Protocol.String(),
+		SrcIP:   info.SrcIP.String(),
+		SrcPort: info.SrcPort,
+		DstIP:   info.DstIP.String(),
+		DstPort: info.DstPort,
+		Props:   toWebProps(info.Props),
+	}
+}
+
+func toWebProps(props analyzer.CombinedPropMap) web.Props {
+	if len(props) == 0 {
+		return nil
+	}
+	out := make(web.Props, len(props))
+	for name, p := range props {
+		out[name] = p
+	}
+	return out
+}
@@ -0,0 +1,27 @@
+io:
+  queueSize: 1024
+  queueNum: 100 
+  table: opengfw 
+  connMarkAccept: 1001 
+  connMarkDrop: 1002 
+  rcvBuf: 4194304
+  sndBuf: 4194304
+  local: true 
+  rst: false 
+
+workers:
+  count: 4 
+  queueSize: 64
+  tcpMaxBufferedPagesTotal: 65536
+  tcpMaxBufferedPagesPerConn: 16
+  tcpTimeout: 10m 
+  udpMaxStreams: 4096
+
+# 指定的 geoip/geosite 档案路径
+# 如果未设置，将自动从 https://github.com/Loyalsoldier/v2ray-rules-dat 下载
+# ruleset:
+#   geoip: geoip.dat
+#   geosite: geosite.dat
+
+replay:
+  realtime: false
@@ -1,371 +0,0 @@
-# Analyzers
-
-Analyzers are one of the main components of OpenGFW. Their job is to analyze a connection, see if it's a protocol they
-support, and if so, extract information from that connection and provide properties for the rule engine to match against
-user-provided rules. OpenGFW will automatically analyze which analyzers are referenced in the given rules and enable
-only those that are needed.
-
-This document lists the properties provided by each analyzer that can be used by rules.
-
-## DNS (TCP & UDP)
-
-For queries:
-
-```json
-{
-  "dns": {
-    "aa": false,
-    "id": 41953,
-    "opcode": 0,
-    "qr": false,
-    "questions": [
-      {
-        "class": 1,
-        "name": "www.google.com",
-        "type": 1
-      }
-    ],
-    "ra": false,
-    "rcode": 0,
-    "rd": true,
-    "tc": false,
-    "z": 0
-  }
-}
-```
-
-For responses:
-
-```json
-{
-  "dns": {
-    "aa": false,
-    "answers": [
-      {
-        "a": "142.251.32.36",
-        "class": 1,
-        "name": "www.google.com",
-        "ttl": 255,
-        "type": 1
-      }
-    ],
-    "id": 41953,
-    "opcode": 0,
-    "qr": true,
-    "questions": [
-      {
-        "class": 1,
-        "name": "www.google.com",
-        "type": 1
-      }
-    ],
-    "ra": true,
-    "rcode": 0,
-    "rd": true,
-    "tc": false,
-    "z": 0
-  }
-}
-```
-
-Example for blocking DNS queries for `www.google.com`:
-
-```yaml
- name: Block Google DNS
-  action: drop
-  expr: dns != nil && !dns.qr && any(dns.questions, {.name == "www.google.com"})
-```
-
-## FET (Fully Encrypted Traffic)
-
-Check https://www.usenix.org/system/files/usenixsecurity23-wu-mingshi.pdf for more information.
-
-```json
-{
-  "fet": {
-    "ex1": 3.7560976,
-    "ex2": true,
-    "ex3": 0.9512195,
-    "ex4": 39,
-    "ex5": false,
-    "yes": false
-  }
-}
-```
-
-Example for blocking fully encrypted traffic:
-
-```yaml
- name: Block suspicious proxy traffic
-  action: block
-  expr: fet != nil && fet.yes
-```
-
-## HTTP
-
-```json
-{
-  "http": {
-    "req": {
-      "headers": {
-        "accept": "*/*",
-        "host": "ipinfo.io",
-        "user-agent": "curl/7.81.0"
-      },
-      "method": "GET",
-      "path": "/",
-      "version": "HTTP/1.1"
-    },
-    "resp": {
-      "headers": {
-        "access-control-allow-origin": "*",
-        "content-length": "333",
-        "content-type": "application/json; charset=utf-8",
-        "date": "Wed, 24 Jan 2024 05:41:44 GMT",
-        "referrer-policy": "strict-origin-when-cross-origin",
-        "server": "nginx/1.24.0",
-        "strict-transport-security": "max-age=2592000; includeSubDomains",
-        "via": "1.1 google",
-        "x-content-type-options": "nosniff",
-        "x-envoy-upstream-service-time": "2",
-        "x-frame-options": "SAMEORIGIN",
-        "x-xss-protection": "1; mode=block"
-      },
-      "status": 200,
-      "version": "HTTP/1.1"
-    }
-  }
-}
-```
-
-Example for blocking HTTP requests to `ipinfo.io`:
-
-```yaml
- name: Block ipinfo.io HTTP
-  action: block
-  expr: http != nil && http.req != nil && http.req.headers != nil && http.req.headers.host == "ipinfo.io"
-```
-
-## SSH
-
-```json
-{
-  "ssh": {
-    "server": {
-      "comments": "Ubuntu-3ubuntu0.6",
-      "protocol": "2.0",
-      "software": "OpenSSH_8.9p1"
-    },
-    "client": {
-      "comments": "IMHACKER",
-      "protocol": "2.0",
-      "software": "OpenSSH_8.9p1"
-    }
-  }
-}
-```
-
-Example for blocking all SSH connections:
-
-```yaml
- name: Block SSH
-  action: block
-  expr: ssh != nil
-```
-
-## TLS
-
-```json
-{
-  "tls": {
-    "req": {
-      "alpn": [
-        "h2",
-        "http/1.1"
-      ],
-      "ciphers": [
-        4866,
-        4867,
-        4865,
-        49196,
-        49200,
-        159,
-        52393,
-        52392,
-        52394,
-        49195,
-        49199,
-        158,
-        49188,
-        49192,
-        107,
-        49187,
-        49191,
-        103,
-        49162,
-        49172,
-        57,
-        49161,
-        49171,
-        51,
-        157,
-        156,
-        61,
-        60,
-        53,
-        47,
-        255
-      ],
-      "compression": "AA==",
-      "random": "UqfPi+EmtMgusILrKcELvVWwpOdPSM/My09nPXl84dg=",
-      "session": "jCTrpAzHpwrfuYdYx4FEjZwbcQxCuZ52HGIoOcbw1vA=",
-      "sni": "ipinfo.io",
-      "supported_versions": [
-        772,
-        771
-      ],
-      "version": 771,
-      "ech": true
-    },
-    "resp": {
-      "cipher": 4866,
-      "compression": 0,
-      "random": "R/Cy1m9pktuBMZQIHahD8Y83UWPRf8j8luwNQep9yJI=",
-      "session": "jCTrpAzHpwrfuYdYx4FEjZwbcQxCuZ52HGIoOcbw1vA=",
-      "supported_versions": 772,
-      "version": 771
-    }
-  }
-}
-```
-
-Example for blocking TLS connections to `ipinfo.io`:
-
-```yaml
- name: Block ipinfo.io TLS
-  action: block
-  expr: tls != nil && tls.req != nil && tls.req.sni == "ipinfo.io"
-```
-
-## Trojan (proxy protocol)
-
-Check https://github.com/XTLS/Trojan-killer for more information.
-
-```json
-{
-  "trojan": {
-    "down": 4712,
-    "up": 671,
-    "yes": true
-  }
-}
-```
-
-Example for blocking Trojan connections:
-
-```yaml
- name: Block Trojan
-  action: block
-  expr: trojan != nil && trojan.yes
-```
-
-## SOCKS
-
-SOCKS4:
-
-```json5
-{
-  "socks": {
-    "version": 4,
-    "req": {
-      "cmd": 1,
-      "addr_type": 1,     // same as socks5
-      "addr": "1.1.1.1",
-      // for socks4a
-      // "addr_type": 3,
-      // "addr": "google.com",
-      "port": 443,
-      "auth": {
-        "user_id": "user"
-      }
-    },
-    "resp": {
-      "rep": 90,          // 0x5A(90) granted
-      "addr_type": 1,
-      "addr": "1.1.1.1",
-      "port": 443
-    }
-  }
-}
-```
-
-SOCKS5 without auth:
-
-```json5
-{
-  "socks": {
-    "version": 5,
-    "req": {
-      "cmd": 1,         // 0x01: connect, 0x02: bind, 0x03: udp
-      "addr_type": 3,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
-      "addr": "google.com",
-      "port": 80,
-      "auth": {
-        "method": 0     // 0x00: no auth, 0x02: username/password
-      }
-    },
-    "resp": {
-      "rep": 0,         // 0x00: success
-      "addr_type": 1,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
-      "addr": "198.18.1.31",
-      "port": 80,
-      "auth": {
-        "method": 0     // 0x00: no auth, 0x02: username/password
-      }
-    }
-  }
-}
-```
-
-SOCKS5 with auth:
-
-```json5
-{
-  "socks": {
-    "version": 5,
-    "req": {
-      "cmd": 1,         // 0x01: connect, 0x02: bind, 0x03: udp
-      "addr_type": 3,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
-      "addr": "google.com",
-      "port": 80,
-      "auth": {
-        "method": 2,    // 0x00: no auth, 0x02: username/password
-        "username": "user",
-        "password": "pass"
-      }
-    },
-    "resp": {
-      "rep": 0,         // 0x00: success
-      "addr_type": 1,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
-      "addr": "198.18.1.31",
-      "port": 80,
-      "auth": {
-        "method": 2,    // 0x00: no auth, 0x02: username/password
-        "status": 0     // 0x00: success, 0x01: failure
-      }
-    }
-  }
-}
-```
-
-Example for blocking connections to `google.com:80` and user `foobar`:
-
-```yaml
- name: Block SOCKS google.com:80
-  action: block
-  expr: string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80
-
- name: Block SOCKS user foobar
-  action: block
-  expr: socks?.req?.auth?.method == 2 && socks?.req?.auth?.username == "foobar"
-```
@@ -15,7 +15,7 @@ var _ Engine = (*engine)(nil)

 type engine struct {
 	logger  Logger
-	ioList  []io.PacketIO
+	io      io.PacketIO
 	workers []*worker
 }

@@ -42,7 +42,7 @@ func NewEngine(config Config) (Engine, error) {
 	}
 	return &engine{
 		logger:  config.Logger,
-		ioList:  config.IOs,
+		io:      config.IO,
 		workers: workers,
 	}, nil
 }
@@ -58,27 +58,24 @@ func (e *engine) UpdateRuleset(r ruleset.Ruleset) error {

 func (e *engine) Run(ctx context.Context) error {
 	ioCtx, ioCancel := context.WithCancel(ctx)
-	defer ioCancel() // Stop workers & IOs
+	defer ioCancel() // Stop workers & IO

 	// Start workers
 	for _, w := range e.workers {
 		go w.Run(ioCtx)
 	}

-	// Register callbacks
-	errChan := make(chan error, len(e.ioList))
-	for _, i := range e.ioList {
-		ioEntry := i // Make sure dispatch() uses the correct ioEntry
-		err := ioEntry.Register(ioCtx, func(p io.Packet, err error) bool {
-			if err != nil {
-				errChan <- err
-				return false
-			}
-			return e.dispatch(ioEntry, p)
-		})
+	// Register IO callback
+	errChan := make(chan error, 1)
+	err := e.io.Register(ioCtx, func(p io.Packet, err error) bool {
 		if err != nil {
-			return err
+			errChan <- err
+			return false
 		}
+		return e.dispatch(p)
+	})
+	if err != nil {
+		return err
 	}

 	// Block until IO errors or context is cancelled
@@ -91,8 +88,7 @@ func (e *engine) Run(ctx context.Context) error {
 }

 // dispatch dispatches a packet to a worker.
-// This must be safe for concurrent use, as it may be called from multiple IOs.
-func (e *engine) dispatch(ioEntry io.PacketIO, p io.Packet) bool {
+func (e *engine) dispatch(p io.Packet) bool {
 	data := p.Data()
 	ipVersion := data[0] >> 4
 	var layerType gopacket.LayerType
@@ -102,7 +98,7 @@ func (e *engine) dispatch(ioEntry io.PacketIO, p io.Packet) bool {
 		layerType = layers.LayerTypeIPv6
 	} else {
 		// Unsupported network layer
-		_ = ioEntry.SetVerdict(p, io.VerdictAcceptStream, nil)
+		_ = e.io.SetVerdict(p, io.VerdictAcceptStream, nil)
 		return true
 	}
 	// Load balance by stream ID
@@ -112,7 +108,7 @@ func (e *engine) dispatch(ioEntry io.PacketIO, p io.Packet) bool {
 		StreamID: p.StreamID(),
 		Packet:   packet,
 		SetVerdict: func(v io.Verdict, b []byte) error {
-			return ioEntry.SetVerdict(p, v, b)
+			return e.io.SetVerdict(p, v, b)
 		},
 	})
 	return true
@@ -18,7 +18,7 @@ type Engine interface {
 // Config is the configuration for the engine.
 type Config struct {
 	Logger  Logger
-	IOs     []io.PacketIO
+	IO      io.PacketIO
 	Ruleset ruleset.Ruleset

 	Workers                          int // Number of workers. Zero or negative means auto (number of CPU cores).
@@ -41,7 +41,6 @@ type Logger interface {
 	UDPStreamPropUpdate(info ruleset.StreamInfo, close bool)
 	UDPStreamAction(info ruleset.StreamInfo, action ruleset.Action, noMatch bool)

-	MatchError(info ruleset.StreamInfo, err error)
 	ModifyError(info ruleset.StreamInfo, err error)

 	AnalyzerDebugf(streamID int64, name string, format string, args ...interface{})
@@ -60,13 +60,6 @@ func (f *tcpStreamFactory) New(ipFlow, tcpFlow gopacket.Flow, tcp *layers.TCP, a
 	rs := f.Ruleset
 	f.RulesetMutex.RUnlock()
 	ans := analyzersToTCPAnalyzers(rs.Analyzers(info))
-	if len(ans) == 0 {
-		ctx := ac.(*tcpContext)
-		ctx.Verdict = tcpVerdictAcceptStream
-		f.Logger.TCPStreamAction(info, ruleset.ActionAllow, true)
-		// a tcpStream with no activeEntries is a no-op
-		return &tcpStream{}
-	}
 	// Create entries for each analyzer
 	entries := make([]*tcpStreamEntry, 0, len(ans))
 	for _, a := range ans {
@@ -109,6 +102,7 @@ type tcpStream struct {
 	ruleset       ruleset.Ruleset
 	activeEntries []*tcpStreamEntry
 	doneEntries   []*tcpStreamEntry
+	lastVerdict   tcpVerdict
 }

 type tcpStreamEntry struct {
@@ -119,8 +113,16 @@ type tcpStreamEntry struct {
 }

 func (s *tcpStream) Accept(tcp *layers.TCP, ci gopacket.CaptureInfo, dir reassembly.TCPFlowDirection, nextSeq reassembly.Sequence, start *bool, ac reassembly.AssemblerContext) bool {
-	// Only accept packets if we still have active entries
-	return len(s.activeEntries) > 0
+	if len(s.activeEntries) > 0 || s.virgin {
+		// Make sure every stream matches against the ruleset at least once,
+		// even if there are no activeEntries, as the ruleset may have built-in
+		// properties that need to be matched.
+		return true
+	} else {
+		ctx := ac.(*tcpContext)
+		ctx.Verdict = s.lastVerdict
+		return false
+	}
 }

 func (s *tcpStream) ReassembledSG(sg reassembly.ScatterGather, ac reassembly.AssemblerContext) {
@@ -146,13 +148,12 @@ func (s *tcpStream) ReassembledSG(sg reassembly.ScatterGather, ac reassembly.Ass
 		s.virgin = false
 		s.logger.TCPStreamPropUpdate(s.info, false)
 		// Match properties against ruleset
-		result, err := s.ruleset.Match(s.info)
-		if err != nil {
-			s.logger.MatchError(s.info, err)
-		}
+		result := s.ruleset.Match(s.info)
 		action := result.Action
 		if action != ruleset.ActionMaybe && action != ruleset.ActionModify {
-			ctx.Verdict = actionToTCPVerdict(action)
+			verdict := actionToTCPVerdict(action)
+			s.lastVerdict = verdict
+			ctx.Verdict = verdict
 			s.logger.TCPStreamAction(s.info, action, false)
 			// Verdict issued, no need to process any more packets
 			s.closeActiveEntries()
@@ -160,6 +161,7 @@ func (s *tcpStream) ReassembledSG(sg reassembly.ScatterGather, ac reassembly.Ass
 	}
 	if len(s.activeEntries) == 0 && ctx.Verdict == tcpVerdictAccept {
 		// All entries are done but no verdict issued, accept stream
+		s.lastVerdict = tcpVerdictAcceptStream
 		ctx.Verdict = tcpVerdictAcceptStream
 		s.logger.TCPStreamAction(s.info, ruleset.ActionAllow, true)
 	}
@@ -61,12 +61,6 @@ func (f *udpStreamFactory) New(ipFlow, udpFlow gopacket.Flow, udp *layers.UDP, u
 	rs := f.Ruleset
 	f.RulesetMutex.RUnlock()
 	ans := analyzersToUDPAnalyzers(rs.Analyzers(info))
-	if len(ans) == 0 {
-		uc.Verdict = udpVerdictAcceptStream
-		f.Logger.UDPStreamAction(info, ruleset.ActionAllow, true)
-		// a udpStream with no activeEntries is a no-op
-		return &udpStream{}
-	}
 	// Create entries for each analyzer
 	entries := make([]*udpStreamEntry, 0, len(ans))
 	for _, a := range ans {
@@ -167,6 +161,7 @@ type udpStream struct {
 	ruleset       ruleset.Ruleset
 	activeEntries []*udpStreamEntry
 	doneEntries   []*udpStreamEntry
+	lastVerdict   udpVerdict
 }

 type udpStreamEntry struct {
@@ -177,8 +172,15 @@ type udpStreamEntry struct {
 }

 func (s *udpStream) Accept(udp *layers.UDP, rev bool, uc *udpContext) bool {
-	// Only accept packets if we still have active entries
-	return len(s.activeEntries) > 0
+	if len(s.activeEntries) > 0 || s.virgin {
+		// Make sure every stream matches against the ruleset at least once,
+		// even if there are no activeEntries, as the ruleset may have built-in
+		// properties that need to be matched.
+		return true
+	} else {
+		uc.Verdict = s.lastVerdict
+		return false
+	}
 }

 func (s *udpStream) Feed(udp *layers.UDP, rev bool, uc *udpContext) {
@@ -199,10 +201,7 @@ func (s *udpStream) Feed(udp *layers.UDP, rev bool, uc *udpContext) {
 		s.virgin = false
 		s.logger.UDPStreamPropUpdate(s.info, false)
 		// Match properties against ruleset
-		result, err := s.ruleset.Match(s.info)
-		if err != nil {
-			s.logger.MatchError(s.info, err)
-		}
+		result := s.ruleset.Match(s.info)
 		action := result.Action
 		if action == ruleset.ActionModify {
 			// Call the modifier instance
@@ -212,6 +211,7 @@ func (s *udpStream) Feed(udp *layers.UDP, rev bool, uc *udpContext) {
 				s.logger.ModifyError(s.info, errInvalidModifier)
 				action = ruleset.ActionMaybe
 			} else {
+				var err error
 				uc.Packet, err = udpMI.Process(udp.Payload)
 				if err != nil {
 					// Modifier error, fallback to maybe
@@ -221,8 +221,9 @@ func (s *udpStream) Feed(udp *layers.UDP, rev bool, uc *udpContext) {
 			}
 		}
 		if action != ruleset.ActionMaybe {
-			var final bool
-			uc.Verdict, final = actionToUDPVerdict(action)
+			verdict, final := actionToUDPVerdict(action)
+			s.lastVerdict = verdict
+			uc.Verdict = verdict
 			s.logger.UDPStreamAction(s.info, action, false)
 			if final {
 				s.closeActiveEntries()
@@ -231,6 +232,7 @@ func (s *udpStream) Feed(udp *layers.UDP, rev bool, uc *udpContext) {
 	}
 	if len(s.activeEntries) == 0 && uc.Verdict == udpVerdictAccept {
 		// All entries are done but no verdict issued, accept stream
+		s.lastVerdict = udpVerdictAcceptStream
 		uc.Verdict = udpVerdictAcceptStream
 		s.logger.UDPStreamAction(s.info, ruleset.ActionAllow, true)
 	}
@@ -127,7 +127,10 @@ func (w *worker) Run(ctx context.Context) {
 }

 func (w *worker) UpdateRuleset(r ruleset.Ruleset) error {
-	return w.tcpStreamFactory.UpdateRuleset(r)
+	if err := w.tcpStreamFactory.UpdateRuleset(r); err != nil {
+		return err
+	}
+	return w.udpStreamFactory.UpdateRuleset(r)
 }

 func (w *worker) handle(streamID uint32, p gopacket.Packet) (io.Verdict, []byte) {
@@ -1,18 +1,22 @@
 module github.com/apernet/OpenGFW

-go 1.20
+go 1.21

 require (
 	github.com/bwmarrin/snowflake v0.3.0
 	github.com/coreos/go-iptables v0.7.0
-	github.com/expr-lang/expr v1.15.7
+	github.com/expr-lang/expr v1.16.3
 	github.com/florianl/go-nfqueue v1.3.2-0.20231218173729-f2bdeb033acf
-	github.com/google/gopacket v1.1.19
+	github.com/google/gopacket v1.1.20-0.20220810144506-32ee38206866
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/mdlayher/netlink v1.6.0
+	github.com/quic-go/quic-go v0.41.0
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/viper v1.18.2
 	go.uber.org/zap v1.26.0
+	golang.org/x/crypto v0.19.0
+	golang.org/x/sys v0.17.0
+	google.golang.org/protobuf v1.31.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -37,7 +41,6 @@ require (
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
 	golang.org/x/net v0.19.0 // indirect
 	golang.org/x/sync v0.5.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 )
@@ -6,19 +6,29 @@ github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/expr-lang/expr v1.15.7 h1:BK0JcWUkoW6nrbLBo6xCKhz4BvH5DSOOu1Gx5lucyZo=
-github.com/expr-lang/expr v1.15.7/go.mod h1:uCkhfG+x7fcZ5A5sXHKuQ07jGZRl6J0FCAaf2k4PtVQ=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/expr-lang/expr v1.16.3 h1:NLldf786GffptcXNxxJx5dQ+FzeWDKChBDqOOwyK8to=
+github.com/expr-lang/expr v1.16.3/go.mod h1:uCkhfG+x7fcZ5A5sXHKuQ07jGZRl6J0FCAaf2k4PtVQ=
 github.com/florianl/go-nfqueue v1.3.2-0.20231218173729-f2bdeb033acf h1:NqGS3vTHzVENbIfd87cXZwdpO6MB2R1PjHMJLi4Z3ow=
 github.com/florianl/go-nfqueue v1.3.2-0.20231218173729-f2bdeb033acf/go.mod h1:eSnAor2YCfMCVYrVNEhkLGN/r1L+J4uDjc0EUy0tfq4=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
-github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
+github.com/google/gopacket v1.1.20-0.20220810144506-32ee38206866 h1:NaJi58bCZZh0jjPw78EqDZekPEfhlzYE01C5R+zh1tE=
+github.com/google/gopacket v1.1.20-0.20220810144506-32ee38206866/go.mod h1:riddUzxTSBpJXk3qBHtYr4qOhFhT6k/1c0E3qkQjQpA=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -28,7 +38,9 @@ github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLf
 github.com/josharian/native v1.0.0 h1:Ts/E8zCSEsG17dUqv7joXJFybuMLjQfWE04tsBODTxk=
 github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz0=
@@ -37,11 +49,19 @@ github.com/mdlayher/socket v0.1.1 h1:q3uOGirUPfAV2MUoaC7BavjQ154J7+JOkTWyiV+intI
 github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
+github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
+github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
+github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
 github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
 github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/quic-go v0.41.0 h1:aD8MmHfgqTURWNJy48IYFg2OnxwHT3JL7ahGs73lb4k=
+github.com/quic-go/quic-go v0.41.0/go.mod h1:qCkNjqczPEvgsOnxZ0eCD14lv+B2LHlFAB++CNOh9hA=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
@@ -68,13 +88,19 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
+github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
+github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
+go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
 go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -91,14 +117,16 @@ golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -108,11 +136,17 @@ golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -2,6 +2,7 @@ package io

 import (
 	"context"
+	"net"
 )

 type Verdict int
@@ -29,7 +30,6 @@ type Packet interface {

 // PacketCallback is called for each packet received.
 // Return false to "unregister" and stop receiving packets.
-// It must be safe for concurrent use.
 type PacketCallback func(Packet, error) bool

 type PacketIO interface {
@@ -39,6 +39,10 @@ type PacketIO interface {
 	Register(context.Context, PacketCallback) error
 	// SetVerdict sets the verdict for a packet.
 	SetVerdict(Packet, Verdict, []byte) error
+	// ProtectedDialContext is like net.DialContext, but the connection is "protected"
+	// in the sense that the packets sent/received through the connection must bypass
+	// the packet IO and not be processed by the callback.
+	ProtectedDialContext(ctx context.Context, network, address string) (net.Conn, error)
 	// Close closes the packet IO.
 	Close() error
 }
@@ -4,11 +4,17 @@ import (
 	"context"
 	"encoding/binary"
 	"errors"
+	"fmt"
+	"net"
+	"os/exec"
 	"strconv"
+	"strings"
+	"syscall"

 	"github.com/coreos/go-iptables/iptables"
 	"github.com/florianl/go-nfqueue"
 	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
 )

 const (
@@ -18,22 +24,68 @@ const (

 	nfqueueConnMarkAccept = 1001
 	nfqueueConnMarkDrop   = 1002
+
+	nftFamily = "inet"
+	nftTable  = "opengfw"
 )

-var iptRulesForward = []iptRule{
-	{"filter", "FORWARD", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkAccept), "-j", "ACCEPT"}},
-	{"filter", "FORWARD", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkDrop), "-j", "DROP"}},
-	{"filter", "FORWARD", []string{"-j", "NFQUEUE", "--queue-num", strconv.Itoa(nfqueueNum), "--queue-bypass"}},
+func generateNftRules(local, rst bool) (*nftTableSpec, error) {
+	if local && rst {
+		return nil, errors.New("tcp rst is not supported in local mode")
+	}
+	table := &nftTableSpec{
+		Family: nftFamily,
+		Table:  nftTable,
+	}
+	table.Defines = append(table.Defines, fmt.Sprintf("define ACCEPT_CTMARK=%d", nfqueueConnMarkAccept))
+	table.Defines = append(table.Defines, fmt.Sprintf("define DROP_CTMARK=%d", nfqueueConnMarkDrop))
+	table.Defines = append(table.Defines, fmt.Sprintf("define QUEUE_NUM=%d", nfqueueNum))
+	if local {
+		table.Chains = []nftChainSpec{
+			{Chain: "INPUT", Header: "type filter hook input priority filter; policy accept;"},
+			{Chain: "OUTPUT", Header: "type filter hook output priority filter; policy accept;"},
+		}
+	} else {
+		table.Chains = []nftChainSpec{
+			{Chain: "FORWARD", Header: "type filter hook forward priority filter; policy accept;"},
+		}
+	}
+	for i := range table.Chains {
+		c := &table.Chains[i]
+		c.Rules = append(c.Rules, "meta mark $ACCEPT_CTMARK ct mark set $ACCEPT_CTMARK") // Bypass protected connections
+		c.Rules = append(c.Rules, "ct mark $ACCEPT_CTMARK counter accept")
+		if rst {
+			c.Rules = append(c.Rules, "ip protocol tcp ct mark $DROP_CTMARK counter reject with tcp reset")
+		}
+		c.Rules = append(c.Rules, "ct mark $DROP_CTMARK counter drop")
+		c.Rules = append(c.Rules, "counter queue num $QUEUE_NUM bypass")
+	}
+	return table, nil
 }

-var iptRulesLocal = []iptRule{
-	{"filter", "INPUT", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkAccept), "-j", "ACCEPT"}},
-	{"filter", "INPUT", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkDrop), "-j", "DROP"}},
-	{"filter", "INPUT", []string{"-j", "NFQUEUE", "--queue-num", strconv.Itoa(nfqueueNum), "--queue-bypass"}},
+func generateIptRules(local, rst bool) ([]iptRule, error) {
+	if local && rst {
+		return nil, errors.New("tcp rst is not supported in local mode")
+	}
+	var chains []string
+	if local {
+		chains = []string{"INPUT", "OUTPUT"}
+	} else {
+		chains = []string{"FORWARD"}
+	}
+	rules := make([]iptRule, 0, 4*len(chains))
+	for _, chain := range chains {
+		// Bypass protected connections
+		rules = append(rules, iptRule{"filter", chain, []string{"-m", "mark", "--mark", strconv.Itoa(nfqueueConnMarkAccept), "-j", "CONNMARK", "--set-mark", strconv.Itoa(nfqueueConnMarkAccept)}})
+		rules = append(rules, iptRule{"filter", chain, []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkAccept), "-j", "ACCEPT"}})
+		if rst {
+			rules = append(rules, iptRule{"filter", chain, []string{"-p", "tcp", "-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkDrop), "-j", "REJECT", "--reject-with", "tcp-reset"}})
+		}
+		rules = append(rules, iptRule{"filter", chain, []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkDrop), "-j", "DROP"}})
+		rules = append(rules, iptRule{"filter", chain, []string{"-j", "NFQUEUE", "--queue-num", strconv.Itoa(nfqueueNum), "--queue-bypass"}})
+	}

-	{"filter", "OUTPUT", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkAccept), "-j", "ACCEPT"}},
-	{"filter", "OUTPUT", []string{"-m", "connmark", "--mark", strconv.Itoa(nfqueueConnMarkDrop), "-j", "DROP"}},
-	{"filter", "OUTPUT", []string{"-j", "NFQUEUE", "--queue-num", strconv.Itoa(nfqueueNum), "--queue-bypass"}},
+	return rules, nil
 }

 var _ PacketIO = (*nfqueuePacketIO)(nil)
@@ -43,26 +95,40 @@ var errNotNFQueuePacket = errors.New("not an NFQueue packet")
 type nfqueuePacketIO struct {
 	n     *nfqueue.Nfqueue
 	local bool
-	ipt4  *iptables.IPTables
-	ipt6  *iptables.IPTables
+	rst   bool
+	rSet  bool // whether the nftables/iptables rules have been set
+
+	// iptables not nil = use iptables instead of nftables
+	ipt4 *iptables.IPTables
+	ipt6 *iptables.IPTables
+
+	protectedDialer *net.Dialer
 }

 type NFQueuePacketIOConfig struct {
-	QueueSize uint32
-	Local     bool
+	QueueSize   uint32
+	ReadBuffer  int
+	WriteBuffer int
+	Local       bool
+	RST         bool
 }

 func NewNFQueuePacketIO(config NFQueuePacketIOConfig) (PacketIO, error) {
 	if config.QueueSize == 0 {
 		config.QueueSize = nfqueueDefaultQueueSize
 	}
-	ipt4, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
-	if err != nil {
-		return nil, err
-	}
-	ipt6, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
-	if err != nil {
-		return nil, err
+	var ipt4, ipt6 *iptables.IPTables
+	var err error
+	if nftCheck() != nil {
+		// We prefer nftables, but if it's not available, fall back to iptables
+		ipt4, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)
+		if err != nil {
+			return nil, err
+		}
+		ipt6, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)
+		if err != nil {
+			return nil, err
+		}
 	}
 	n, err := nfqueue.Open(&nfqueue.Config{
 		NfQueue:      nfqueueNum,
@@ -74,26 +140,48 @@ func NewNFQueuePacketIO(config NFQueuePacketIOConfig) (PacketIO, error) {
 	if err != nil {
 		return nil, err
 	}
-	io := &nfqueuePacketIO{
+	if config.ReadBuffer > 0 {
+		err = n.Con.SetReadBuffer(config.ReadBuffer)
+		if err != nil {
+			_ = n.Close()
+			return nil, err
+		}
+	}
+	if config.WriteBuffer > 0 {
+		err = n.Con.SetWriteBuffer(config.WriteBuffer)
+		if err != nil {
+			_ = n.Close()
+			return nil, err
+		}
+	}
+	return &nfqueuePacketIO{
 		n:     n,
 		local: config.Local,
+		rst:   config.RST,
 		ipt4:  ipt4,
 		ipt6:  ipt6,
-	}
-	err = io.setupIpt(config.Local, false)
-	if err != nil {
-		_ = n.Close()
-		return nil, err
-	}
-	return io, nil
+		protectedDialer: &net.Dialer{
+			Control: func(network, address string, c syscall.RawConn) error {
+				var err error
+				cErr := c.Control(func(fd uintptr) {
+					err = syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_MARK, nfqueueConnMarkAccept)
+				})
+				if cErr != nil {
+					return cErr
+				}
+				return err
+			},
+		},
+	}, nil
 }

 func (n *nfqueuePacketIO) Register(ctx context.Context, cb PacketCallback) error {
-	return n.n.RegisterWithErrorFunc(ctx,
+	err := n.n.RegisterWithErrorFunc(ctx,
 		func(a nfqueue.Attribute) int {
-			if a.PacketID == nil || a.Ct == nil || a.Payload == nil || len(*a.Payload) < 20 {
-				// Invalid packet, ignore
-				// 20 is the minimum possible size of an IP packet
+			if ok, verdict := n.packetAttributeSanityCheck(a); !ok {
+				if a.PacketID != nil {
+					_ = n.n.SetVerdict(*a.PacketID, verdict)
+				}
 				return 0
 			}
 			p := &nfqueuePacket{
@@ -104,8 +192,48 @@ func (n *nfqueuePacketIO) Register(ctx context.Context, cb PacketCallback) error
 			return okBoolToInt(cb(p, nil))
 		},
 		func(e error) int {
+			if opErr := (*netlink.OpError)(nil); errors.As(e, &opErr) {
+				if errors.Is(opErr.Err, unix.ENOBUFS) {
+					// Kernel buffer temporarily full, ignore
+					return 0
+				}
+			}
 			return okBoolToInt(cb(nil, e))
 		})
+	if err != nil {
+		return err
+	}
+	if !n.rSet {
+		if n.ipt4 != nil {
+			err = n.setupIpt(n.local, n.rst, false)
+		} else {
+			err = n.setupNft(n.local, n.rst, false)
+		}
+		if err != nil {
+			return err
+		}
+		n.rSet = true
+	}
+	return nil
+}
+
+func (n *nfqueuePacketIO) packetAttributeSanityCheck(a nfqueue.Attribute) (ok bool, verdict int) {
+	if a.PacketID == nil {
+		// Re-inject to NFQUEUE is actually not possible in this condition
+		return false, -1
+	}
+	if a.Payload == nil || len(*a.Payload) < 20 {
+		// 20 is the minimum possible size of an IP packet
+		return false, nfqueue.NfDrop
+	}
+	if a.Ct == nil {
+		// Multicast packets may not have a conntrack, but only appear in local mode
+		if n.local {
+			return false, nfqueue.NfAccept
+		}
+		return false, nfqueue.NfDrop
+	}
+	return true, -1
 }

 func (n *nfqueuePacketIO) SetVerdict(p Packet, v Verdict, newPacket []byte) error {
@@ -130,14 +258,46 @@ func (n *nfqueuePacketIO) SetVerdict(p Packet, v Verdict, newPacket []byte) erro
 	}
 }

-func (n *nfqueuePacketIO) setupIpt(local, remove bool) error {
-	var rules []iptRule
-	if local {
-		rules = iptRulesLocal
+func (n *nfqueuePacketIO) ProtectedDialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return n.protectedDialer.DialContext(ctx, network, address)
+}
+
+func (n *nfqueuePacketIO) Close() error {
+	if n.rSet {
+		if n.ipt4 != nil {
+			_ = n.setupIpt(n.local, n.rst, true)
+		} else {
+			_ = n.setupNft(n.local, n.rst, true)
+		}
+		n.rSet = false
+	}
+	return n.n.Close()
+}
+
+func (n *nfqueuePacketIO) setupNft(local, rst, remove bool) error {
+	rules, err := generateNftRules(local, rst)
+	if err != nil {
+		return err
+	}
+	rulesText := rules.String()
+	if remove {
+		err = nftDelete(nftFamily, nftTable)
 	} else {
-		rules = iptRulesForward
+		// Delete first to make sure no leftover rules
+		_ = nftDelete(nftFamily, nftTable)
+		err = nftAdd(rulesText)
+	}
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (n *nfqueuePacketIO) setupIpt(local, rst, remove bool) error {
+	rules, err := generateIptRules(local, rst)
+	if err != nil {
+		return err
 	}
-	var err error
 	if remove {
 		err = iptsBatchDeleteIfExists([]*iptables.IPTables{n.ipt4, n.ipt6}, rules)
 	} else {
@@ -149,12 +309,6 @@ func (n *nfqueuePacketIO) setupIpt(local, remove bool) error {
 	return nil
 }

-func (n *nfqueuePacketIO) Close() error {
-	err := n.setupIpt(n.local, true)
-	_ = n.n.Close()
-	return err
-}
-
 var _ Packet = (*nfqueuePacket)(nil)

 type nfqueuePacket struct {
@@ -179,6 +333,61 @@ func okBoolToInt(ok bool) int {
 	}
 }

+func nftCheck() error {
+	_, err := exec.LookPath("nft")
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func nftAdd(input string) error {
+	cmd := exec.Command("nft", "-f", "-")
+	cmd.Stdin = strings.NewReader(input)
+	return cmd.Run()
+}
+
+func nftDelete(family, table string) error {
+	cmd := exec.Command("nft", "delete", "table", family, table)
+	return cmd.Run()
+}
+
+type nftTableSpec struct {
+	Defines       []string
+	Family, Table string
+	Chains        []nftChainSpec
+}
+
+func (t *nftTableSpec) String() string {
+	chains := make([]string, 0, len(t.Chains))
+	for _, c := range t.Chains {
+		chains = append(chains, c.String())
+	}
+
+	return fmt.Sprintf(`
+%s
+
+table %s %s {
+%s
+}
+`, strings.Join(t.Defines, "\n"), t.Family, t.Table, strings.Join(chains, ""))
+}
+
+type nftChainSpec struct {
+	Chain  string
+	Header string
+	Rules  []string
+}
+
+func (c *nftChainSpec) String() string {
+	return fmt.Sprintf(`
+  chain %s {
+    %s
+    %s
+  }
+`, c.Chain, c.Header, strings.Join(c.Rules, "\n\x20\x20\x20\x20"))
+}
+
 type iptRule struct {
 	Table, Chain string
 	RuleSpec     []string
@@ -0,0 +1,18 @@
+package builtins
+
+import (
+	"net"
+)
+
+func MatchCIDR(ip string, cidr *net.IPNet) bool {
+	ipAddr := net.ParseIP(ip)
+	if ipAddr == nil {
+		return false
+	}
+	return cidr.Contains(ipAddr)
+}
+
+func CompileCIDR(cidr string) (*net.IPNet, error) {
+	_, ipNet, err := net.ParseCIDR(cidr)
+	return ipNet, err
+}
@@ -0,0 +1,128 @@
+package geo
+
+import (
+	"io"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo/v2geo"
+)
+
+const (
+	geoipFilename   = "geoip.dat"
+	geoipURL        = "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat"
+	geositeFilename = "geosite.dat"
+	geositeURL      = "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat"
+
+	geoDefaultUpdateInterval = 7 * 24 * time.Hour // 7 days
+)
+
+var _ GeoLoader = (*V2GeoLoader)(nil)
+
+// V2GeoLoader provides the on-demand GeoIP/MatchGeoSite database
+// loading functionality required by the ACL engine.
+// Empty filenames = automatic download from built-in URLs.
+type V2GeoLoader struct {
+	GeoIPFilename   string
+	GeoSiteFilename string
+	UpdateInterval  time.Duration
+
+	DownloadFunc    func(filename, url string)
+	DownloadErrFunc func(err error)
+
+	geoipMap   map[string]*v2geo.GeoIP
+	geositeMap map[string]*v2geo.GeoSite
+}
+
+func NewDefaultGeoLoader(geoSiteFilename, geoIpFilename string) *V2GeoLoader {
+	return &V2GeoLoader{
+		GeoIPFilename:   geoIpFilename,
+		GeoSiteFilename: geoSiteFilename,
+		DownloadFunc:    func(filename, url string) {},
+		DownloadErrFunc: func(err error) {},
+	}
+}
+
+func (l *V2GeoLoader) shouldDownload(filename string) bool {
+	info, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return true
+	}
+	dt := time.Since(info.ModTime())
+	if l.UpdateInterval == 0 {
+		return dt > geoDefaultUpdateInterval
+	} else {
+		return dt > l.UpdateInterval
+	}
+}
+
+func (l *V2GeoLoader) download(filename, url string) error {
+	l.DownloadFunc(filename, url)
+
+	resp, err := http.Get(url)
+	if err != nil {
+		l.DownloadErrFunc(err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	f, err := os.Create(filename)
+	if err != nil {
+		l.DownloadErrFunc(err)
+		return err
+	}
+	defer f.Close()
+
+	_, err = io.Copy(f, resp.Body)
+	l.DownloadErrFunc(err)
+	return err
+}
+
+func (l *V2GeoLoader) LoadGeoIP() (map[string]*v2geo.GeoIP, error) {
+	if l.geoipMap != nil {
+		return l.geoipMap, nil
+	}
+	autoDL := false
+	filename := l.GeoIPFilename
+	if filename == "" {
+		autoDL = true
+		filename = geoipFilename
+	}
+	if autoDL && l.shouldDownload(filename) {
+		err := l.download(filename, geoipURL)
+		if err != nil {
+			return nil, err
+		}
+	}
+	m, err := v2geo.LoadGeoIP(filename)
+	if err != nil {
+		return nil, err
+	}
+	l.geoipMap = m
+	return m, nil
+}
+
+func (l *V2GeoLoader) LoadGeoSite() (map[string]*v2geo.GeoSite, error) {
+	if l.geositeMap != nil {
+		return l.geositeMap, nil
+	}
+	autoDL := false
+	filename := l.GeoSiteFilename
+	if filename == "" {
+		autoDL = true
+		filename = geositeFilename
+	}
+	if autoDL && l.shouldDownload(filename) {
+		err := l.download(filename, geositeURL)
+		if err != nil {
+			return nil, err
+		}
+	}
+	m, err := v2geo.LoadGeoSite(filename)
+	if err != nil {
+		return nil, err
+	}
+	l.geositeMap = m
+	return m, nil
+}
@@ -0,0 +1,177 @@
+package geo
+
+import (
+	"net"
+	"sort"
+	"strings"
+	"sync"
+)
+
+type GeoMatcher struct {
+	geoLoader       GeoLoader
+	geoSiteMatcher  map[string]hostMatcher
+	siteMatcherLock sync.Mutex
+	geoIpMatcher    map[string]hostMatcher
+	ipMatcherLock   sync.Mutex
+}
+
+func NewGeoMatcher(geoSiteFilename, geoIpFilename string) *GeoMatcher {
+	return &GeoMatcher{
+		geoLoader:      NewDefaultGeoLoader(geoSiteFilename, geoIpFilename),
+		geoSiteMatcher: make(map[string]hostMatcher),
+		geoIpMatcher:   make(map[string]hostMatcher),
+	}
+}
+
+func (g *GeoMatcher) MatchGeoIp(ip, condition string) bool {
+	g.ipMatcherLock.Lock()
+	defer g.ipMatcherLock.Unlock()
+
+	matcher, ok := g.geoIpMatcher[condition]
+	if !ok {
+		// GeoIP matcher
+		condition = strings.ToLower(condition)
+		country := condition
+		if len(country) == 0 {
+			return false
+		}
+		gMap, err := g.geoLoader.LoadGeoIP()
+		if err != nil {
+			return false
+		}
+		list, ok := gMap[country]
+		if !ok || list == nil {
+			return false
+		}
+		matcher, err = newGeoIPMatcher(list)
+		if err != nil {
+			return false
+		}
+		g.geoIpMatcher[condition] = matcher
+	}
+	parseIp := net.ParseIP(ip)
+	if parseIp == nil {
+		return false
+	}
+	ipv4 := parseIp.To4()
+	if ipv4 != nil {
+		return matcher.Match(HostInfo{IPv4: ipv4})
+	}
+	ipv6 := parseIp.To16()
+	if ipv6 != nil {
+		return matcher.Match(HostInfo{IPv6: ipv6})
+	}
+	return false
+}
+
+func (g *GeoMatcher) MatchGeoSite(site, condition string) bool {
+	g.siteMatcherLock.Lock()
+	defer g.siteMatcherLock.Unlock()
+
+	matcher, ok := g.geoSiteMatcher[condition]
+	if !ok {
+		// MatchGeoSite matcher
+		condition = strings.ToLower(condition)
+		name, attrs := parseGeoSiteName(condition)
+		if len(name) == 0 {
+			return false
+		}
+		gMap, err := g.geoLoader.LoadGeoSite()
+		if err != nil {
+			return false
+		}
+		list, ok := gMap[name]
+		if !ok || list == nil {
+			return false
+		}
+		matcher, err = newGeositeMatcher(list, attrs)
+		if err != nil {
+			return false
+		}
+		g.geoSiteMatcher[condition] = matcher
+	}
+	return matcher.Match(HostInfo{Name: site})
+}
+
+func (g *GeoMatcher) LoadGeoSite() error {
+	_, err := g.geoLoader.LoadGeoSite()
+	return err
+}
+
+// GeoIPEntry describes one entry of a GeoIP database.
+type GeoIPEntry struct {
+	// Code is the lowercase key to pass to geoip(), usually a country code.
+	Code string
+	// CIDRs is the number of networks the entry covers.
+	CIDRs int
+}
+
+// GeoSiteEntry describes one entry of a GeoSite database.
+type GeoSiteEntry struct {
+	// Code is the lowercase key to pass to geosite().
+	Code string
+	// Attributes are the suffixes usable as `code@attribute`.
+	Attributes []string
+	// Domains is the number of domain rules the entry covers.
+	Domains int
+}
+
+// ListGeoIP returns every entry of the GeoIP database, sorted by code.
+// It is meant for UIs that let the user pick a country instead of typing one.
+func (g *GeoMatcher) ListGeoIP() ([]GeoIPEntry, error) {
+	gMap, err := g.geoLoader.LoadGeoIP()
+	if err != nil {
+		return nil, err
+	}
+	entries := make([]GeoIPEntry, 0, len(gMap))
+	for code, list := range gMap {
+		entries = append(entries, GeoIPEntry{Code: code, CIDRs: len(list.GetCidr())})
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Code < entries[j].Code })
+	return entries, nil
+}
+
+// ListGeoSite returns every entry of the GeoSite database, sorted by code,
+// including the attributes each entry supports.
+func (g *GeoMatcher) ListGeoSite() ([]GeoSiteEntry, error) {
+	gMap, err := g.geoLoader.LoadGeoSite()
+	if err != nil {
+		return nil, err
+	}
+	entries := make([]GeoSiteEntry, 0, len(gMap))
+	for code, list := range gMap {
+		attrSet := make(map[string]struct{})
+		for _, domain := range list.GetDomain() {
+			for _, attr := range domain.GetAttribute() {
+				attrSet[strings.ToLower(attr.GetKey())] = struct{}{}
+			}
+		}
+		attrs := make([]string, 0, len(attrSet))
+		for attr := range attrSet {
+			attrs = append(attrs, attr)
+		}
+		sort.Strings(attrs)
+		entries = append(entries, GeoSiteEntry{
+			Code:       code,
+			Attributes: attrs,
+			Domains:    len(list.GetDomain()),
+		})
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Code < entries[j].Code })
+	return entries, nil
+}
+
+func (g *GeoMatcher) LoadGeoIP() error {
+	_, err := g.geoLoader.LoadGeoIP()
+	return err
+}
+
+func parseGeoSiteName(s string) (string, []string) {
+	parts := strings.Split(s, "@")
+	base := strings.TrimSpace(parts[0])
+	attrs := parts[1:]
+	for i := range attrs {
+		attrs[i] = strings.TrimSpace(attrs[i])
+	}
+	return base, attrs
+}
@@ -0,0 +1,27 @@
+package geo
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo/v2geo"
+)
+
+type HostInfo struct {
+	Name string
+	IPv4 net.IP
+	IPv6 net.IP
+}
+
+func (h HostInfo) String() string {
+	return fmt.Sprintf("%s|%s|%s", h.Name, h.IPv4, h.IPv6)
+}
+
+type GeoLoader interface {
+	LoadGeoIP() (map[string]*v2geo.GeoIP, error)
+	LoadGeoSite() (map[string]*v2geo.GeoSite, error)
+}
+
+type hostMatcher interface {
+	Match(HostInfo) bool
+}
@@ -0,0 +1,213 @@
+package geo
+
+import (
+	"bytes"
+	"errors"
+	"net"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo/v2geo"
+)
+
+var _ hostMatcher = (*geoipMatcher)(nil)
+
+type geoipMatcher struct {
+	N4      []*net.IPNet // sorted
+	N6      []*net.IPNet // sorted
+	Inverse bool
+}
+
+// matchIP tries to match the given IP address with the corresponding IPNets.
+// Note that this function does NOT handle the Inverse flag.
+func (m *geoipMatcher) matchIP(ip net.IP) bool {
+	var n []*net.IPNet
+	if ip4 := ip.To4(); ip4 != nil {
+		// N4 stores IPv4 addresses in 4-byte form.
+		// Make sure we use it here too, otherwise bytes.Compare will fail.
+		ip = ip4
+		n = m.N4
+	} else {
+		n = m.N6
+	}
+	left, right := 0, len(n)-1
+	for left <= right {
+		mid := (left + right) / 2
+		if n[mid].Contains(ip) {
+			return true
+		} else if bytes.Compare(n[mid].IP, ip) < 0 {
+			left = mid + 1
+		} else {
+			right = mid - 1
+		}
+	}
+	return false
+}
+
+func (m *geoipMatcher) Match(host HostInfo) bool {
+	if host.IPv4 != nil {
+		if m.matchIP(host.IPv4) {
+			return !m.Inverse
+		}
+	}
+	if host.IPv6 != nil {
+		if m.matchIP(host.IPv6) {
+			return !m.Inverse
+		}
+	}
+	return m.Inverse
+}
+
+func newGeoIPMatcher(list *v2geo.GeoIP) (*geoipMatcher, error) {
+	n4 := make([]*net.IPNet, 0)
+	n6 := make([]*net.IPNet, 0)
+	for _, cidr := range list.Cidr {
+		if len(cidr.Ip) == 4 {
+			// IPv4
+			n4 = append(n4, &net.IPNet{
+				IP:   cidr.Ip,
+				Mask: net.CIDRMask(int(cidr.Prefix), 32),
+			})
+		} else if len(cidr.Ip) == 16 {
+			// IPv6
+			n6 = append(n6, &net.IPNet{
+				IP:   cidr.Ip,
+				Mask: net.CIDRMask(int(cidr.Prefix), 128),
+			})
+		} else {
+			return nil, errors.New("invalid IP length")
+		}
+	}
+	// Sort the IPNets, so we can do binary search later.
+	sort.Slice(n4, func(i, j int) bool {
+		return bytes.Compare(n4[i].IP, n4[j].IP) < 0
+	})
+	sort.Slice(n6, func(i, j int) bool {
+		return bytes.Compare(n6[i].IP, n6[j].IP) < 0
+	})
+	return &geoipMatcher{
+		N4:      n4,
+		N6:      n6,
+		Inverse: list.InverseMatch,
+	}, nil
+}
+
+var _ hostMatcher = (*geositeMatcher)(nil)
+
+type geositeDomainType int
+
+const (
+	geositeDomainPlain geositeDomainType = iota
+	geositeDomainRegex
+	geositeDomainRoot
+	geositeDomainFull
+)
+
+type geositeDomain struct {
+	Type  geositeDomainType
+	Value string
+	Regex *regexp.Regexp
+	Attrs map[string]bool
+}
+
+type geositeMatcher struct {
+	Domains []geositeDomain
+	// Attributes are matched using "and" logic - if you have multiple attributes here,
+	// a domain must have all of those attributes to be considered a match.
+	Attrs []string
+}
+
+func (m *geositeMatcher) matchDomain(domain geositeDomain, host HostInfo) bool {
+	// Match attributes first
+	if len(m.Attrs) > 0 {
+		if len(domain.Attrs) == 0 {
+			return false
+		}
+		for _, attr := range m.Attrs {
+			if !domain.Attrs[attr] {
+				return false
+			}
+		}
+	}
+
+	switch domain.Type {
+	case geositeDomainPlain:
+		return strings.Contains(host.Name, domain.Value)
+	case geositeDomainRegex:
+		if domain.Regex != nil {
+			return domain.Regex.MatchString(host.Name)
+		}
+	case geositeDomainFull:
+		return host.Name == domain.Value
+	case geositeDomainRoot:
+		if host.Name == domain.Value {
+			return true
+		}
+		return strings.HasSuffix(host.Name, "."+domain.Value)
+	default:
+		return false
+	}
+	return false
+}
+
+func (m *geositeMatcher) Match(host HostInfo) bool {
+	for _, domain := range m.Domains {
+		if m.matchDomain(domain, host) {
+			return true
+		}
+	}
+	return false
+}
+
+func newGeositeMatcher(list *v2geo.GeoSite, attrs []string) (*geositeMatcher, error) {
+	domains := make([]geositeDomain, len(list.Domain))
+	for i, domain := range list.Domain {
+		switch domain.Type {
+		case v2geo.Domain_Plain:
+			domains[i] = geositeDomain{
+				Type:  geositeDomainPlain,
+				Value: domain.Value,
+				Attrs: domainAttributeToMap(domain.Attribute),
+			}
+		case v2geo.Domain_Regex:
+			regex, err := regexp.Compile(domain.Value)
+			if err != nil {
+				return nil, err
+			}
+			domains[i] = geositeDomain{
+				Type:  geositeDomainRegex,
+				Regex: regex,
+				Attrs: domainAttributeToMap(domain.Attribute),
+			}
+		case v2geo.Domain_Full:
+			domains[i] = geositeDomain{
+				Type:  geositeDomainFull,
+				Value: domain.Value,
+				Attrs: domainAttributeToMap(domain.Attribute),
+			}
+		case v2geo.Domain_RootDomain:
+			domains[i] = geositeDomain{
+				Type:  geositeDomainRoot,
+				Value: domain.Value,
+				Attrs: domainAttributeToMap(domain.Attribute),
+			}
+		default:
+			return nil, errors.New("unsupported domain type")
+		}
+	}
+	return &geositeMatcher{
+		Domains: domains,
+		Attrs:   attrs,
+	}, nil
+}
+
+func domainAttributeToMap(attrs []*v2geo.Domain_Attribute) map[string]bool {
+	m := make(map[string]bool)
+	for _, attr := range attrs {
+		// Supposedly there are also int attributes,
+		// but nobody seems to use them, so we treat everything as boolean for now.
+		m[attr.Key] = true
+	}
+	return m
+}
@@ -0,0 +1,44 @@
+package v2geo
+
+import (
+	"os"
+	"strings"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// LoadGeoIP loads a GeoIP data file and converts it to a map.
+// The keys of the map (country codes) are all normalized to lowercase.
+func LoadGeoIP(filename string) (map[string]*GeoIP, error) {
+	bs, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	var list GeoIPList
+	if err := proto.Unmarshal(bs, &list); err != nil {
+		return nil, err
+	}
+	m := make(map[string]*GeoIP)
+	for _, entry := range list.Entry {
+		m[strings.ToLower(entry.CountryCode)] = entry
+	}
+	return m, nil
+}
+
+// LoadGeoSite loads a GeoSite data file and converts it to a map.
+// The keys of the map (site keys) are all normalized to lowercase.
+func LoadGeoSite(filename string) (map[string]*GeoSite, error) {
+	bs, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	var list GeoSiteList
+	if err := proto.Unmarshal(bs, &list); err != nil {
+		return nil, err
+	}
+	m := make(map[string]*GeoSite)
+	for _, entry := range list.Entry {
+		m[strings.ToLower(entry.CountryCode)] = entry
+	}
+	return m, nil
+}
@@ -0,0 +1,745 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.24.4
+// source: v2geo.proto
+
+package v2geo
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Type of domain value.
+type Domain_Type int32
+
+const (
+	// The value is used as is.
+	Domain_Plain Domain_Type = 0
+	// The value is used as a regular expression.
+	Domain_Regex Domain_Type = 1
+	// The value is a root domain.
+	Domain_RootDomain Domain_Type = 2
+	// The value is a domain.
+	Domain_Full Domain_Type = 3
+)
+
+// Enum value maps for Domain_Type.
+var (
+	Domain_Type_name = map[int32]string{
+		0: "Plain",
+		1: "Regex",
+		2: "RootDomain",
+		3: "Full",
+	}
+	Domain_Type_value = map[string]int32{
+		"Plain":      0,
+		"Regex":      1,
+		"RootDomain": 2,
+		"Full":       3,
+	}
+)
+
+func (x Domain_Type) Enum() *Domain_Type {
+	p := new(Domain_Type)
+	*p = x
+	return p
+}
+
+func (x Domain_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Domain_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_v2geo_proto_enumTypes[0].Descriptor()
+}
+
+func (Domain_Type) Type() protoreflect.EnumType {
+	return &file_v2geo_proto_enumTypes[0]
+}
+
+func (x Domain_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Domain_Type.Descriptor instead.
+func (Domain_Type) EnumDescriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{0, 0}
+}
+
+// Domain for routing decision.
+type Domain struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Domain matching type.
+	Type Domain_Type `protobuf:"varint,1,opt,name=type,proto3,enum=Domain_Type" json:"type,omitempty"`
+	// Domain value.
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	// Attributes of this domain. May be used for filtering.
+	Attribute []*Domain_Attribute `protobuf:"bytes,3,rep,name=attribute,proto3" json:"attribute,omitempty"`
+}
+
+func (x *Domain) Reset() {
+	*x = Domain{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Domain) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Domain) ProtoMessage() {}
+
+func (x *Domain) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Domain.ProtoReflect.Descriptor instead.
+func (*Domain) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Domain) GetType() Domain_Type {
+	if x != nil {
+		return x.Type
+	}
+	return Domain_Plain
+}
+
+func (x *Domain) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+func (x *Domain) GetAttribute() []*Domain_Attribute {
+	if x != nil {
+		return x.Attribute
+	}
+	return nil
+}
+
+// IP for routing decision, in CIDR form.
+type CIDR struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// IP address, should be either 4 or 16 bytes.
+	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	// Number of leading ones in the network mask.
+	Prefix uint32 `protobuf:"varint,2,opt,name=prefix,proto3" json:"prefix,omitempty"`
+}
+
+func (x *CIDR) Reset() {
+	*x = CIDR{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CIDR) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CIDR) ProtoMessage() {}
+
+func (x *CIDR) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CIDR.ProtoReflect.Descriptor instead.
+func (*CIDR) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CIDR) GetIp() []byte {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+func (x *CIDR) GetPrefix() uint32 {
+	if x != nil {
+		return x.Prefix
+	}
+	return 0
+}
+
+type GeoIP struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CountryCode  string  `protobuf:"bytes,1,opt,name=country_code,json=countryCode,proto3" json:"country_code,omitempty"`
+	Cidr         []*CIDR `protobuf:"bytes,2,rep,name=cidr,proto3" json:"cidr,omitempty"`
+	InverseMatch bool    `protobuf:"varint,3,opt,name=inverse_match,json=inverseMatch,proto3" json:"inverse_match,omitempty"`
+	// resource_hash instruct simplified config converter to load domain from geo file.
+	ResourceHash []byte `protobuf:"bytes,4,opt,name=resource_hash,json=resourceHash,proto3" json:"resource_hash,omitempty"`
+	Code         string `protobuf:"bytes,5,opt,name=code,proto3" json:"code,omitempty"`
+}
+
+func (x *GeoIP) Reset() {
+	*x = GeoIP{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GeoIP) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GeoIP) ProtoMessage() {}
+
+func (x *GeoIP) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GeoIP.ProtoReflect.Descriptor instead.
+func (*GeoIP) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GeoIP) GetCountryCode() string {
+	if x != nil {
+		return x.CountryCode
+	}
+	return ""
+}
+
+func (x *GeoIP) GetCidr() []*CIDR {
+	if x != nil {
+		return x.Cidr
+	}
+	return nil
+}
+
+func (x *GeoIP) GetInverseMatch() bool {
+	if x != nil {
+		return x.InverseMatch
+	}
+	return false
+}
+
+func (x *GeoIP) GetResourceHash() []byte {
+	if x != nil {
+		return x.ResourceHash
+	}
+	return nil
+}
+
+func (x *GeoIP) GetCode() string {
+	if x != nil {
+		return x.Code
+	}
+	return ""
+}
+
+type GeoIPList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Entry []*GeoIP `protobuf:"bytes,1,rep,name=entry,proto3" json:"entry,omitempty"`
+}
+
+func (x *GeoIPList) Reset() {
+	*x = GeoIPList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GeoIPList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GeoIPList) ProtoMessage() {}
+
+func (x *GeoIPList) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GeoIPList.ProtoReflect.Descriptor instead.
+func (*GeoIPList) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GeoIPList) GetEntry() []*GeoIP {
+	if x != nil {
+		return x.Entry
+	}
+	return nil
+}
+
+type GeoSite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CountryCode string    `protobuf:"bytes,1,opt,name=country_code,json=countryCode,proto3" json:"country_code,omitempty"`
+	Domain      []*Domain `protobuf:"bytes,2,rep,name=domain,proto3" json:"domain,omitempty"`
+	// resource_hash instruct simplified config converter to load domain from geo file.
+	ResourceHash []byte `protobuf:"bytes,3,opt,name=resource_hash,json=resourceHash,proto3" json:"resource_hash,omitempty"`
+	Code         string `protobuf:"bytes,4,opt,name=code,proto3" json:"code,omitempty"`
+}
+
+func (x *GeoSite) Reset() {
+	*x = GeoSite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GeoSite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GeoSite) ProtoMessage() {}
+
+func (x *GeoSite) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MatchGeoSite.ProtoReflect.Descriptor instead.
+func (*GeoSite) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *GeoSite) GetCountryCode() string {
+	if x != nil {
+		return x.CountryCode
+	}
+	return ""
+}
+
+func (x *GeoSite) GetDomain() []*Domain {
+	if x != nil {
+		return x.Domain
+	}
+	return nil
+}
+
+func (x *GeoSite) GetResourceHash() []byte {
+	if x != nil {
+		return x.ResourceHash
+	}
+	return nil
+}
+
+func (x *GeoSite) GetCode() string {
+	if x != nil {
+		return x.Code
+	}
+	return ""
+}
+
+type GeoSiteList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Entry []*GeoSite `protobuf:"bytes,1,rep,name=entry,proto3" json:"entry,omitempty"`
+}
+
+func (x *GeoSiteList) Reset() {
+	*x = GeoSiteList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GeoSiteList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GeoSiteList) ProtoMessage() {}
+
+func (x *GeoSiteList) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GeoSiteList.ProtoReflect.Descriptor instead.
+func (*GeoSiteList) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *GeoSiteList) GetEntry() []*GeoSite {
+	if x != nil {
+		return x.Entry
+	}
+	return nil
+}
+
+type Domain_Attribute struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Types that are assignable to TypedValue:
+	//
+	//	*Domain_Attribute_BoolValue
+	//	*Domain_Attribute_IntValue
+	TypedValue isDomain_Attribute_TypedValue `protobuf_oneof:"typed_value"`
+}
+
+func (x *Domain_Attribute) Reset() {
+	*x = Domain_Attribute{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v2geo_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Domain_Attribute) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Domain_Attribute) ProtoMessage() {}
+
+func (x *Domain_Attribute) ProtoReflect() protoreflect.Message {
+	mi := &file_v2geo_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Domain_Attribute.ProtoReflect.Descriptor instead.
+func (*Domain_Attribute) Descriptor() ([]byte, []int) {
+	return file_v2geo_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Domain_Attribute) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (m *Domain_Attribute) GetTypedValue() isDomain_Attribute_TypedValue {
+	if m != nil {
+		return m.TypedValue
+	}
+	return nil
+}
+
+func (x *Domain_Attribute) GetBoolValue() bool {
+	if x, ok := x.GetTypedValue().(*Domain_Attribute_BoolValue); ok {
+		return x.BoolValue
+	}
+	return false
+}
+
+func (x *Domain_Attribute) GetIntValue() int64 {
+	if x, ok := x.GetTypedValue().(*Domain_Attribute_IntValue); ok {
+		return x.IntValue
+	}
+	return 0
+}
+
+type isDomain_Attribute_TypedValue interface {
+	isDomain_Attribute_TypedValue()
+}
+
+type Domain_Attribute_BoolValue struct {
+	BoolValue bool `protobuf:"varint,2,opt,name=bool_value,json=boolValue,proto3,oneof"`
+}
+
+type Domain_Attribute_IntValue struct {
+	IntValue int64 `protobuf:"varint,3,opt,name=int_value,json=intValue,proto3,oneof"`
+}
+
+func (*Domain_Attribute_BoolValue) isDomain_Attribute_TypedValue() {}
+
+func (*Domain_Attribute_IntValue) isDomain_Attribute_TypedValue() {}
+
+var File_v2geo_proto protoreflect.FileDescriptor
+
+var file_v2geo_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x76, 0x32, 0x67, 0x65, 0x6f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x97, 0x02,
+	0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x20, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0c, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x2e,
+	0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x2f, 0x0a, 0x09, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x2e, 0x41, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x09, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x1a, 0x6c, 0x0a, 0x09, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x1f, 0x0a, 0x0a, 0x62, 0x6f, 0x6f, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x09, 0x62, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x12, 0x1d, 0x0a, 0x09, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x42, 0x0d, 0x0a, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22,
+	0x36, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x6c, 0x61, 0x69, 0x6e,
+	0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x52, 0x65, 0x67, 0x65, 0x78, 0x10, 0x01, 0x12, 0x0e, 0x0a,
+	0x0a, 0x52, 0x6f, 0x6f, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x10, 0x02, 0x12, 0x08, 0x0a,
+	0x04, 0x46, 0x75, 0x6c, 0x6c, 0x10, 0x03, 0x22, 0x2e, 0x0a, 0x04, 0x43, 0x49, 0x44, 0x52, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x12,
+	0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0xa3, 0x01, 0x0a, 0x05, 0x47, 0x65, 0x6f, 0x49,
+	0x50, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x79,
+	0x43, 0x6f, 0x64, 0x65, 0x12, 0x19, 0x0a, 0x04, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x05, 0x2e, 0x43, 0x49, 0x44, 0x52, 0x52, 0x04, 0x63, 0x69, 0x64, 0x72, 0x12,
+	0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x65, 0x5f, 0x6d, 0x61, 0x74, 0x63, 0x68,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x69, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x65, 0x4d,
+	0x61, 0x74, 0x63, 0x68, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x61, 0x73, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x6f, 0x64,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x22, 0x29, 0x0a,
+	0x09, 0x47, 0x65, 0x6f, 0x49, 0x50, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x05, 0x65, 0x6e,
+	0x74, 0x72, 0x79, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x06, 0x2e, 0x47, 0x65, 0x6f, 0x49,
+	0x50, 0x52, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x22, 0x86, 0x01, 0x0a, 0x07, 0x47, 0x65, 0x6f,
+	0x53, 0x69, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x79, 0x5f,
+	0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x0c, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x61, 0x73, 0x68, 0x12, 0x12, 0x0a,
+	0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x63, 0x6f, 0x64,
+	0x65, 0x22, 0x2d, 0x0a, 0x0b, 0x47, 0x65, 0x6f, 0x53, 0x69, 0x74, 0x65, 0x4c, 0x69, 0x73, 0x74,
+	0x12, 0x1e, 0x0a, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x08, 0x2e, 0x47, 0x65, 0x6f, 0x53, 0x69, 0x74, 0x65, 0x52, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79,
+	0x42, 0x09, 0x5a, 0x07, 0x2e, 0x2f, 0x76, 0x32, 0x67, 0x65, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+}
+
+var (
+	file_v2geo_proto_rawDescOnce sync.Once
+	file_v2geo_proto_rawDescData = file_v2geo_proto_rawDesc
+)
+
+func file_v2geo_proto_rawDescGZIP() []byte {
+	file_v2geo_proto_rawDescOnce.Do(func() {
+		file_v2geo_proto_rawDescData = protoimpl.X.CompressGZIP(file_v2geo_proto_rawDescData)
+	})
+	return file_v2geo_proto_rawDescData
+}
+
+var file_v2geo_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_v2geo_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_v2geo_proto_goTypes = []interface{}{
+	(Domain_Type)(0),         // 0: Domain.Type
+	(*Domain)(nil),           // 1: Domain
+	(*CIDR)(nil),             // 2: CIDR
+	(*GeoIP)(nil),            // 3: GeoIP
+	(*GeoIPList)(nil),        // 4: GeoIPList
+	(*GeoSite)(nil),          // 5: MatchGeoSite
+	(*GeoSiteList)(nil),      // 6: GeoSiteList
+	(*Domain_Attribute)(nil), // 7: Domain.Attribute
+}
+var file_v2geo_proto_depIdxs = []int32{
+	0, // 0: Domain.type:type_name -> Domain.Type
+	7, // 1: Domain.attribute:type_name -> Domain.Attribute
+	2, // 2: GeoIP.cidr:type_name -> CIDR
+	3, // 3: GeoIPList.entry:type_name -> GeoIP
+	1, // 4: MatchGeoSite.domain:type_name -> Domain
+	5, // 5: GeoSiteList.entry:type_name -> MatchGeoSite
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_v2geo_proto_init() }
+func file_v2geo_proto_init() {
+	if File_v2geo_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_v2geo_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Domain); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CIDR); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GeoIP); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GeoIPList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GeoSite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GeoSiteList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_v2geo_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Domain_Attribute); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_v2geo_proto_msgTypes[6].OneofWrappers = []interface{}{
+		(*Domain_Attribute_BoolValue)(nil),
+		(*Domain_Attribute_IntValue)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_v2geo_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_v2geo_proto_goTypes,
+		DependencyIndexes: file_v2geo_proto_depIdxs,
+		EnumInfos:         file_v2geo_proto_enumTypes,
+		MessageInfos:      file_v2geo_proto_msgTypes,
+	}.Build()
+	File_v2geo_proto = out.File
+	file_v2geo_proto_rawDesc = nil
+	file_v2geo_proto_goTypes = nil
+	file_v2geo_proto_depIdxs = nil
+}
@@ -0,0 +1,76 @@
+syntax = "proto3";
+
+option go_package = "./v2geo";
+
+// This file is copied from
+// https://github.com/v2fly/v2ray-core/blob/master/app/router/routercommon/common.proto
+// with some modifications.
+
+// Domain for routing decision.
+message Domain {
+  // Type of domain value.
+  enum Type {
+    // The value is used as is.
+    Plain = 0;
+    // The value is used as a regular expression.
+    Regex = 1;
+    // The value is a root domain.
+    RootDomain = 2;
+    // The value is a domain.
+    Full = 3;
+  }
+
+  // Domain matching type.
+  Type type = 1;
+
+  // Domain value.
+  string value = 2;
+
+  message Attribute {
+    string key = 1;
+
+    oneof typed_value {
+      bool bool_value = 2;
+      int64 int_value = 3;
+    }
+  }
+
+  // Attributes of this domain. May be used for filtering.
+  repeated Attribute attribute = 3;
+}
+
+// IP for routing decision, in CIDR form.
+message CIDR {
+  // IP address, should be either 4 or 16 bytes.
+  bytes ip = 1;
+
+  // Number of leading ones in the network mask.
+  uint32 prefix = 2;
+}
+
+message GeoIP {
+  string country_code = 1;
+  repeated CIDR cidr = 2;
+  bool inverse_match = 3;
+
+  // resource_hash instruct simplified config converter to load domain from geo file.
+  bytes resource_hash = 4;
+  string code = 5;
+}
+
+message GeoIPList {
+  repeated GeoIP entry = 1;
+}
+
+message GeoSite {
+  string country_code = 1;
+  repeated Domain domain = 2;
+
+  // resource_hash instruct simplified config converter to load domain from geo file.
+  bytes resource_hash = 3;
+  string code = 4;
+}
+
+message GeoSiteList {
+  repeated GeoSite entry = 1;
+}
@@ -1,10 +1,15 @@
 package ruleset

 import (
+	"context"
 	"fmt"
+	"net"
 	"os"
 	"reflect"
 	"strings"
+	"time"
+
+	"github.com/expr-lang/expr/builtin"

 	"github.com/expr-lang/expr"
 	"github.com/expr-lang/expr/ast"
@@ -14,12 +19,15 @@ import (

 	"github.com/apernet/OpenGFW/analyzer"
 	"github.com/apernet/OpenGFW/modifier"
+	"github.com/apernet/OpenGFW/ruleset/builtins"
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo"
 )

 // ExprRule is the external representation of an expression rule.
 type ExprRule struct {
 	Name     string        `yaml:"name"`
 	Action   string        `yaml:"action"`
+	Log      bool          `yaml:"log"`
 	Modifier ModifierEntry `yaml:"modifier"`
 	Expr     string        `yaml:"expr"`
 }
@@ -34,91 +42,132 @@ func ExprRulesFromYAML(file string) ([]ExprRule, error) {
 	if err != nil {
 		return nil, err
 	}
+	return ExprRulesFromYAMLBytes(bs)
+}
+
+// ExprRulesFromYAMLBytes parses expression rules from a YAML document in memory.
+func ExprRulesFromYAMLBytes(bs []byte) ([]ExprRule, error) {
 	var rules []ExprRule
-	err = yaml.Unmarshal(bs, &rules)
+	err := yaml.Unmarshal(bs, &rules)
 	return rules, err
 }

 // compiledExprRule is the internal, compiled representation of an expression rule.
 type compiledExprRule struct {
 	Name        string
-	Action      Action
+	Action      *Action // fallthrough if nil
+	Log         bool
 	ModInstance modifier.Instance
 	Program     *vm.Program
-	Analyzers   map[string]struct{}
 }

 var _ Ruleset = (*exprRuleset)(nil)

 type exprRuleset struct {
-	Rules []compiledExprRule
-	Ans   []analyzer.Analyzer
+	Rules  []compiledExprRule
+	Ans    []analyzer.Analyzer
+	Logger Logger
 }

 func (r *exprRuleset) Analyzers(info StreamInfo) []analyzer.Analyzer {
 	return r.Ans
 }

-func (r *exprRuleset) Match(info StreamInfo) (MatchResult, error) {
+func (r *exprRuleset) Match(info StreamInfo) MatchResult {
 	env := streamInfoToExprEnv(info)
 	for _, rule := range r.Rules {
 		v, err := vm.Run(rule.Program, env)
 		if err != nil {
-			return MatchResult{
-				Action: ActionMaybe,
-			}, fmt.Errorf("rule %q failed to run: %w", rule.Name, err)
+			// Log the error and continue to the next rule.
+			r.Logger.MatchError(info, rule.Name, err)
+			continue
 		}
 		if vBool, ok := v.(bool); ok && vBool {
-			return MatchResult{
-				Action:      rule.Action,
-				ModInstance: rule.ModInstance,
-			}, nil
+			if rule.Log {
+				r.Logger.Log(info, rule.Name)
+			}
+			if rule.Action != nil {
+				return MatchResult{
+					Action:      *rule.Action,
+					ModInstance: rule.ModInstance,
+				}
+			}
 		}
 	}
+	// No match
 	return MatchResult{
 		Action: ActionMaybe,
-	}, nil
+	}
 }

 // CompileExprRules compiles a list of expression rules into a ruleset.
 // It returns an error if any of the rules are invalid, or if any of the analyzers
 // used by the rules are unknown (not provided in the analyzer list).
-func CompileExprRules(rules []ExprRule, ans []analyzer.Analyzer, mods []modifier.Modifier) (Ruleset, error) {
+func CompileExprRules(rules []ExprRule, ans []analyzer.Analyzer, mods []modifier.Modifier, config *BuiltinConfig) (Ruleset, error) {
 	var compiledRules []compiledExprRule
 	fullAnMap := analyzersToMap(ans)
 	fullModMap := modifiersToMap(mods)
 	depAnMap := make(map[string]analyzer.Analyzer)
+	funcMap := buildFunctionMap(config)
 	// Compile all rules and build a map of analyzers that are used by the rules.
 	for _, rule := range rules {
-		action, ok := actionStringToAction(rule.Action)
-		if !ok {
-			return nil, fmt.Errorf("rule %q has invalid action %q", rule.Name, rule.Action)
+		if rule.Action == "" && !rule.Log {
+			return nil, fmt.Errorf("rule %q must have at least one of action or log", rule.Name)
 		}
-		visitor := &depVisitor{Analyzers: make(map[string]struct{})}
+		var action *Action
+		if rule.Action != "" {
+			a, ok := actionStringToAction(rule.Action)
+			if !ok {
+				return nil, fmt.Errorf("rule %q has invalid action %q", rule.Name, rule.Action)
+			}
+			action = &a
+		}
+		visitor := &idVisitor{Variables: make(map[string]bool), Identifiers: make(map[string]bool)}
+		patcher := &idPatcher{FuncMap: funcMap}
 		program, err := expr.Compile(rule.Expr,
 			func(c *conf.Config) {
 				c.Strict = false
 				c.Expect = reflect.Bool
-				c.Visitors = append(c.Visitors, visitor)
+				c.Visitors = append(c.Visitors, visitor, patcher)
+				for name, f := range funcMap {
+					c.Functions[name] = &builtin.Function{
+						Name:  name,
+						Func:  f.Func,
+						Types: f.Types,
+					}
+				}
 			},
 		)
 		if err != nil {
 			return nil, fmt.Errorf("rule %q has invalid expression: %w", rule.Name, err)
 		}
-		for name := range visitor.Analyzers {
-			a, ok := fullAnMap[name]
-			if !ok && !isBuiltInAnalyzer(name) {
-				return nil, fmt.Errorf("rule %q uses unknown analyzer %q", rule.Name, name)
+		if patcher.Err != nil {
+			return nil, fmt.Errorf("rule %q failed to patch expression: %w", rule.Name, patcher.Err)
+		}
+		for name := range visitor.Identifiers {
+			// Skip built-in analyzers & user-defined variables
+			if isBuiltInAnalyzer(name) || visitor.Variables[name] {
+				continue
+			}
+			if f, ok := funcMap[name]; ok {
+				// Built-in function, initialize if necessary
+				if f.InitFunc != nil {
+					if err := f.InitFunc(); err != nil {
+						return nil, fmt.Errorf("rule %q failed to initialize function %q: %w", rule.Name, name, err)
+					}
+				}
+			} else if a, ok := fullAnMap[name]; ok {
+				// Analyzer, add to dependency map
+				depAnMap[name] = a
 			}
-			depAnMap[name] = a
 		}
 		cr := compiledExprRule{
-			Name:      rule.Name,
-			Action:    action,
-			Program:   program,
-			Analyzers: visitor.Analyzers,
+			Name:    rule.Name,
+			Action:  action,
+			Log:     rule.Log,
+			Program: program,
 		}
-		if action == ActionModify {
+		if action != nil && *action == ActionModify {
 			mod, ok := fullModMap[rule.Modifier.Name]
 			if !ok {
 				return nil, fmt.Errorf("rule %q uses unknown modifier %q", rule.Name, rule.Modifier.Name)
@@ -137,8 +186,9 @@ func CompileExprRules(rules []ExprRule, ans []analyzer.Analyzer, mods []modifier
 		depAns = append(depAns, a)
 	}
 	return &exprRuleset{
-		Rules: compiledRules,
-		Ans:   depAns,
+		Rules:  compiledRules,
+		Ans:    depAns,
+		Logger: config.Logger,
 	}, nil
 }

@@ -208,12 +258,127 @@ func modifiersToMap(mods []modifier.Modifier) map[string]modifier.Modifier {
 	return modMap
 }

-type depVisitor struct {
-	Analyzers map[string]struct{}
+// idVisitor is a visitor that collects all identifiers in an expression.
+// This is for determining which analyzers are used by the expression.
+type idVisitor struct {
+	Variables   map[string]bool
+	Identifiers map[string]bool
 }

-func (v *depVisitor) Visit(node *ast.Node) {
-	if idNode, ok := (*node).(*ast.IdentifierNode); ok {
-		v.Analyzers[idNode.Value] = struct{}{}
+func (v *idVisitor) Visit(node *ast.Node) {
+	if varNode, ok := (*node).(*ast.VariableDeclaratorNode); ok {
+		v.Variables[varNode.Name] = true
+	} else if idNode, ok := (*node).(*ast.IdentifierNode); ok {
+		v.Identifiers[idNode.Value] = true
+	}
+}
+
+// idPatcher patches the AST during expr compilation, replacing certain values with
+// their internal representations for better runtime performance.
+type idPatcher struct {
+	FuncMap map[string]*Function
+	Err     error
+}
+
+func (p *idPatcher) Visit(node *ast.Node) {
+	switch (*node).(type) {
+	case *ast.CallNode:
+		callNode := (*node).(*ast.CallNode)
+		if callNode.Callee == nil {
+			// Ignore invalid call nodes
+			return
+		}
+		if f, ok := p.FuncMap[callNode.Callee.String()]; ok {
+			if f.PatchFunc != nil {
+				if err := f.PatchFunc(&callNode.Arguments); err != nil {
+					p.Err = err
+					return
+				}
+			}
+		}
+	}
+}
+
+type Function struct {
+	InitFunc  func() error
+	PatchFunc func(args *[]ast.Node) error
+	Func      func(params ...any) (any, error)
+	Types     []reflect.Type
+}
+
+func buildFunctionMap(config *BuiltinConfig) map[string]*Function {
+	geoMatcher := geo.NewGeoMatcher(config.GeoSiteFilename, config.GeoIpFilename)
+	return map[string]*Function{
+		"geoip": {
+			InitFunc:  geoMatcher.LoadGeoIP,
+			PatchFunc: nil,
+			Func: func(params ...any) (any, error) {
+				return geoMatcher.MatchGeoIp(params[0].(string), params[1].(string)), nil
+			},
+			Types: []reflect.Type{reflect.TypeOf(geoMatcher.MatchGeoIp)},
+		},
+		"geosite": {
+			InitFunc:  geoMatcher.LoadGeoSite,
+			PatchFunc: nil,
+			Func: func(params ...any) (any, error) {
+				return geoMatcher.MatchGeoSite(params[0].(string), params[1].(string)), nil
+			},
+			Types: []reflect.Type{reflect.TypeOf(geoMatcher.MatchGeoSite)},
+		},
+		"cidr": {
+			InitFunc: nil,
+			PatchFunc: func(args *[]ast.Node) error {
+				cidrStringNode, ok := (*args)[1].(*ast.StringNode)
+				if !ok {
+					return fmt.Errorf("cidr: invalid argument type")
+				}
+				cidr, err := builtins.CompileCIDR(cidrStringNode.Value)
+				if err != nil {
+					return err
+				}
+				(*args)[1] = &ast.ConstantNode{Value: cidr}
+				return nil
+			},
+			Func: func(params ...any) (any, error) {
+				return builtins.MatchCIDR(params[0].(string), params[1].(*net.IPNet)), nil
+			},
+			Types: []reflect.Type{reflect.TypeOf(builtins.MatchCIDR)},
+		},
+		"lookup": {
+			InitFunc: nil,
+			PatchFunc: func(args *[]ast.Node) error {
+				var serverStr *ast.StringNode
+				if len(*args) > 1 {
+					// Has the optional server argument
+					var ok bool
+					serverStr, ok = (*args)[1].(*ast.StringNode)
+					if !ok {
+						return fmt.Errorf("lookup: invalid argument type")
+					}
+				}
+				r := &net.Resolver{
+					Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+						if serverStr != nil {
+							address = serverStr.Value
+						}
+						return config.ProtectedDialContext(ctx, network, address)
+					},
+				}
+				if len(*args) > 1 {
+					(*args)[1] = &ast.ConstantNode{Value: r}
+				} else {
+					*args = append(*args, &ast.ConstantNode{Value: r})
+				}
+				return nil
+			},
+			Func: func(params ...any) (any, error) {
+				ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+				defer cancel()
+				return params[1].(*net.Resolver).LookupHost(ctx, params[0].(string))
+			},
+			Types: []reflect.Type{
+				reflect.TypeOf((func(string, *net.Resolver) []string)(nil)),
+			},
+		},
 	}
 }
@@ -0,0 +1,76 @@
+package ruleset
+
+import (
+	"context"
+	"net"
+	"strings"
+	"testing"
+
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/tcp"
+	"github.com/apernet/OpenGFW/analyzer/udp"
+	"github.com/apernet/OpenGFW/modifier"
+	modUDP "github.com/apernet/OpenGFW/modifier/udp"
+)
+
+// builderExpressions are the canonical expressions produced by the visual rule
+// builder of the web UI (see web/frontend/src/lib/rule/compile.ts). They are
+// pinned here so that a change to the expression language, the analyzers or the
+// built-in functions cannot silently break the builder.
+var builderExpressions = []string{
+	// Domain or subdomain, single and multiple values
+	`(string(tls?.req?.sni) == "example.com" || string(tls?.req?.sni) endsWith ".example.com")`,
+	`((string(tls?.req?.sni) == "example.com" || string(tls?.req?.sni) endsWith ".example.com") || (string(tls?.req?.sni) == "evil.test" || string(tls?.req?.sni) endsWith ".evil.test")) && proto == "tcp"`,
+	// CIDR and GeoIP, including negation
+	`(cidr(ip.dst, "10.0.0.0/8") || cidr(ip.dst, "fd00::/8")) || !(geoip(ip.dst, "cn") || geoip(ip.dst, "hk"))`,
+	// Port equality and ranges
+	`(port.dst >= 1000 && port.dst <= 2000) && (port.src == 80 || port.src == 443)`,
+	// Wildcards over DNS questions
+	`any(dns?.questions ?? [], {(string(.name) endsWith ".ads.com" || string(.name) startsWith "x.")})`,
+	// GeoSite over DNS questions
+	`any(dns?.questions ?? [], {geosite(string(.name), "category-ads-all")})`,
+	// HTTP fields: negation, regular expressions and header lookups
+	`!(string(http?.req?.headers?.host) contains "tracker") && string(http?.req?.path) matches "^/api/v\\d+/" && string(get(http?.req?.headers, "user-agent")) startsWith "curl"`,
+	// Protocol detection
+	`(ssh != nil || trojan != nil)`,
+	// Wildcard edge cases: "any value" and a star in the middle
+	`string(quic?.req?.sni) != "" && string(tls?.req?.sni) matches "^www\\..*\\.com$" && ip.src == "1.2.3.4" && string(http?.req?.method) == "POST"`,
+}
+
+func TestCompileBuilderExpressions(t *testing.T) {
+	analyzers := []analyzer.Analyzer{
+		&tcp.FETAnalyzer{}, &tcp.HTTPAnalyzer{}, &tcp.SocksAnalyzer{}, &tcp.SSHAnalyzer{},
+		&tcp.TLSAnalyzer{}, &tcp.TrojanAnalyzer{}, &udp.DNSAnalyzer{}, &udp.OpenVPNAnalyzer{},
+		&udp.QUICAnalyzer{}, &udp.WireGuardAnalyzer{},
+	}
+	modifiers := []modifier.Modifier{&modUDP.DNSModifier{}}
+	config := &BuiltinConfig{
+		Logger: nopLogger{},
+		// Point at a file that does not exist: expressions still have to
+		// compile, only loading the database is expected to fail.
+		GeoSiteFilename: "testdata/missing-geosite.dat",
+		GeoIpFilename:   "testdata/missing-geoip.dat",
+		ProtectedDialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, network, address)
+		},
+	}
+
+	for _, expr := range builderExpressions {
+		rules := []ExprRule{{Name: "test", Action: "block", Expr: expr}}
+		_, err := CompileExprRules(rules, analyzers, modifiers, config)
+		if err == nil {
+			continue
+		}
+		// geoip()/geosite() need a database, which this test does not ship.
+		// Reaching the initialization step means the expression itself is fine.
+		if strings.Contains(err.Error(), "failed to initialize function") {
+			continue
+		}
+		t.Errorf("expression failed to compile: %s\n  %v", expr, err)
+	}
+}
+
+type nopLogger struct{}
+
+func (nopLogger) Log(StreamInfo, string)               {}
+func (nopLogger) MatchError(StreamInfo, string, error) {}
@@ -1,6 +1,7 @@
 package ruleset

 import (
+	"context"
 	"net"
 	"strconv"

@@ -90,5 +91,18 @@ type Ruleset interface {
 	Analyzers(StreamInfo) []analyzer.Analyzer
 	// Match matches a stream against the ruleset and returns the result.
 	// It must be safe for concurrent use by multiple workers.
-	Match(StreamInfo) (MatchResult, error)
+	Match(StreamInfo) MatchResult
+}
+
+// Logger is the logging interface for the ruleset.
+type Logger interface {
+	Log(info StreamInfo, name string)
+	MatchError(info StreamInfo, name string, err error)
+}
+
+type BuiltinConfig struct {
+	Logger               Logger
+	GeoSiteFilename      string
+	GeoIpFilename        string
+	ProtectedDialContext func(ctx context.Context, network, address string) (net.Conn, error)
 }
@@ -0,0 +1,135 @@
+# OpenGFW Web UI
+
+A Vue 3 + Tailwind CSS dashboard for OpenGFW, built with [shadcn/ui](https://ui.shadcn.com)
+style components on top of [Reka UI](https://reka-ui.com) primitives. It is embedded into
+the OpenGFW binary and served by the `web` package.
+
+- **Dashboard** — live counters, traffic chart, verdict/protocol split, top hosts,
+  blocked destinations and triggered rules
+- **Events** — real-time feed of verdicts, rule logs and errors with filters and a
+  detail view showing raw analyzer properties
+- **Rules** — a visual condition builder, a raw expression editor and a YAML editor,
+  all validated by the engine itself; saving writes the rule file and hot reloads the
+  running engine
+- **Analyzers** — which analyzers are compiled in and how much traffic each one saw
+- **Settings** — theme (light/dark/system), language (English/中文) and instance info
+
+The layout is responsive: a sidebar on desktop, a bottom tab bar and bottom-sheet
+dialogs on phones.
+
+## Enabling it
+
+```yaml
+# config.yaml
+web:
+  enabled: true
+  listen: :8080
+  secret: your-password-here
+  # cert: /path/to/fullchain.pem
+  # key: /path/to/privkey.pem
+```
+
+If `secret` is empty a random password is generated and printed to the log on startup.
+
+## Rule builder
+
+Rules are still plain expr expressions in the rule file; the builder is only a way to
+write them without memorising the syntax. Conditions are rows of *field + operator +
+values*, joined with AND or OR, each row negatable:
+
+| Field group | Fields                                                          |
+| ----------- | --------------------------------------------------------------- |
+| Connection  | transport protocol, source/destination IP, source/destination port |
+| Domain      | TLS SNI, QUIC SNI, DNS query name                                 |
+| HTTP        | Host, path, method, User-Agent                                    |
+| Protocol    | detected protocol (any analyzer)                                  |
+
+Operators cover the things rules usually need:
+
+| Operator                | Generated expression                                       |
+| ----------------------- | ---------------------------------------------------------- |
+| domain or subdomain of  | `(S == "x.com" \|\| S endsWith ".x.com")`                   |
+| matches wildcard        | `*.x.com` → `endsWith`, `x.*` → `startsWith`, `*ad*` → `contains`, `a.*.c` → `matches` |
+| in CIDR                 | `cidr(ip.dst, "10.0.0.0/8")`, validated as you type         |
+| in GeoIP country        | `geoip(ip.dst, "cn")`, picked from the loaded database      |
+| in GeoSite category     | `geosite(string(.name), "category-ads-all@cn")`             |
+| in range                | `(port.dst >= 1000 && port.dst <= 2000)`                    |
+| is / contains / starts / ends / regex | the matching expr operator                   |
+
+Multiple values in one row are OR-ed together, so one row can hold a whole domain or
+country list. The generated expression is shown live and validated by the engine before
+the rule is accepted.
+
+Opening an existing rule parses its expression back into conditions. Anything the
+builder cannot represent — hand written expressions, functions like `lookup()` — opens
+in the expression editor with a warning instead of being rewritten.
+
+The GeoIP picker lists whatever the configured `geoip.dat` contains: country codes plus,
+with the default Loyalsoldier database, provider groups such as `cloudflare`, `google`
+and `telegram`. Matching by AS number is not something the v2geo data format supports,
+so use those groups or an explicit CIDR list instead.
+
+`web/frontend/src/lib/rule/` holds the whole thing: `fields.ts` (catalog), `compile.ts`
+(builder → expr), `parse.ts` (expr → builder) and `validate.ts`. The canonical
+expressions are pinned in `ruleset/expr_test.go`, which compiles them with the real
+engine.
+
+## Layout
+
+```
+web/
+├── api.go          HTTP handlers (JSON API + SSE)
+├── auth.go         password login, session tokens
+├── hub.go          statistics collection and the live event fan-out
+├── server.go       routes, static file serving, public types
+├── embed.go        //go:embed of dist
+├── devserver/      standalone server with synthetic data (any OS)
+├── dist/           built UI, embedded into the binary (committed)
+└── frontend/       Vue sources
+```
+
+## Development
+
+The engine only builds on Linux, so for UI work there is a standalone server that
+feeds the UI synthetic traffic and an in-memory ruleset:
+
+```bash
+go run ./web/devserver     # http://127.0.0.1:8080, password: opengfw
+```
+
+Then, in another terminal, run Vite with hot reload (it proxies `/api` to `:8080`):
+
+```bash
+cd web/frontend
+npm install
+npm run dev
+```
+
+To produce the embedded build (this is what `make web` runs):
+
+```bash
+cd web/frontend && npm run build   # writes ../dist
+```
+
+`web/dist` is committed so that `go build` works without Node installed. Rebuild it
+whenever you change the frontend.
+
+## API
+
+All endpoints live under `/api/v1` and return JSON. Except for `login`, every request
+must carry `Authorization: Bearer <token>`; `GET` endpoints also accept the session
+cookie set at login, which is what the `EventSource` connection uses. Mutating
+endpoints only accept the bearer token, which makes them immune to CSRF.
+
+| Method     | Path                 | Description                                        |
+| ---------- | -------------------- | -------------------------------------------------- |
+| `POST`     | `/login`             | exchange the password for a session token          |
+| `POST`     | `/logout`            | invalidate the current session                     |
+| `GET`      | `/info`              | version, platform and engine configuration         |
+| `GET`      | `/meta`              | available analyzers, modifiers, actions, functions  |
+| `GET`      | `/geo`               | GeoIP/GeoSite entries for the rule builder pickers |
+| `GET`      | `/metrics`           | counters, time series and top N lists              |
+| `GET`      | `/events?limit=`     | recent events from the ring buffer                 |
+| `GET`      | `/live`              | server-sent events: `event` and `metrics` frames   |
+| `GET/PUT`  | `/rules`             | read / replace the ruleset (`raw` YAML or `rules`) |
+| `POST`     | `/rules/validate`    | compile without applying; also converts YAML ⇄ rules |
@@ -0,0 +1,317 @@
+package web
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+type apiError struct {
+	Error string `json:"error"`
+}
+
+func writeJSON(w http.ResponseWriter, code int, v interface{}) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(v)
+}
+
+func writeError(w http.ResponseWriter, code int, msg string) {
+	writeJSON(w, code, apiError{Error: msg})
+}
+
+func methodAllowed(w http.ResponseWriter, r *http.Request, methods ...string) bool {
+	for _, m := range methods {
+		if r.Method == m {
+			return true
+		}
+	}
+	writeError(w, http.StatusMethodNotAllowed, "method not allowed")
+	return false
+}
+
+func decodeBody(w http.ResponseWriter, r *http.Request, v interface{}) bool {
+	r.Body = http.MaxBytesReader(w, r.Body, 4<<20) // 4 MiB is plenty for a rule file
+	if err := json.NewDecoder(r.Body).Decode(v); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body: "+err.Error())
+		return false
+	}
+	return true
+}
+
+// POST /api/v1/login
+func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodPost) {
+		return
+	}
+	var req struct {
+		Password string `json:"password"`
+	}
+	if !decodeBody(w, r, &req) {
+		return
+	}
+	token, expiry, err := s.auth.login(r.RemoteAddr, req.Password)
+	if err != nil {
+		code := http.StatusUnauthorized
+		if errors.Is(err, errTooManyAttempts) {
+			code = http.StatusTooManyRequests
+		}
+		writeError(w, code, err.Error())
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    token,
+		Path:     "/",
+		Expires:  expiry,
+		HttpOnly: true,
+		Secure:   s.TLS(),
+		SameSite: http.SameSiteLaxMode,
+	})
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"token":     token,
+		"expiresAt": expiry.UnixMilli(),
+	})
+}
+
+// POST /api/v1/logout
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodPost) {
+		return
+	}
+	s.auth.logout(bearerToken(r))
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   s.TLS(),
+		SameSite: http.SameSiteLaxMode,
+	})
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+}
+
+// GET /api/v1/info
+func (s *Server) handleInfo(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	var info Info
+	if s.config.Info != nil {
+		info = s.config.Info()
+	}
+	writeJSON(w, http.StatusOK, info)
+}
+
+// GET /api/v1/meta
+func (s *Server) handleMeta(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	writeJSON(w, http.StatusOK, s.config.Meta)
+}
+
+// GET /api/v1/metrics
+func (s *Server) handleMetrics(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	writeJSON(w, http.StatusOK, s.config.Hub.Metrics())
+}
+
+// GET /api/v1/events?limit=200
+func (s *Server) handleEvents(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	limit := 200
+	if v := r.URL.Query().Get("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"events": s.config.Hub.Events(limit),
+	})
+}
+
+// GET /api/v1/live - server-sent events carrying live events and metrics.
+func (s *Server) handleLive(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		writeError(w, http.StatusInternalServerError, "streaming unsupported")
+		return
+	}
+	h := w.Header()
+	h.Set("Content-Type", "text/event-stream")
+	h.Set("Cache-Control", "no-cache")
+	h.Set("Connection", "keep-alive")
+	h.Set("X-Accel-Buffering", "no")
+	w.WriteHeader(http.StatusOK)
+	flusher.Flush()
+
+	events, unsubscribe := s.config.Hub.Subscribe()
+	defer unsubscribe()
+
+	metricsTicker := time.NewTicker(2 * time.Second)
+	defer metricsTicker.Stop()
+	keepAlive := time.NewTicker(20 * time.Second)
+	defer keepAlive.Stop()
+
+	send := func(event string, v interface{}) bool {
+		data, err := json.Marshal(v)
+		if err != nil {
+			return true
+		}
+		if _, err := fmt.Fprintf(w, "event: %s\ndata: %s\n\n", event, data); err != nil {
+			return false
+		}
+		flusher.Flush()
+		return true
+	}
+
+	if !send("metrics", s.config.Hub.Metrics()) {
+		return
+	}
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+		case ev, ok := <-events:
+			if !ok {
+				return
+			}
+			if !send("event", ev) {
+				return
+			}
+		case <-metricsTicker.C:
+			if !send("metrics", s.config.Hub.Metrics()) {
+				return
+			}
+		case <-keepAlive.C:
+			if _, err := fmt.Fprint(w, ": ping\n\n"); err != nil {
+				return
+			}
+			flusher.Flush()
+		}
+	}
+}
+
+// GET /api/v1/geo - the entries of the configured geo databases.
+func (s *Server) handleGeo(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet) {
+		return
+	}
+	if s.config.Geo == nil {
+		writeJSON(w, http.StatusOK, GeoData{
+			IPError:   "geo databases are unavailable",
+			SiteError: "geo databases are unavailable",
+		})
+		return
+	}
+	s.geoMu.Lock()
+	defer s.geoMu.Unlock()
+	fresh := s.geoCache != nil && time.Since(s.geoLoaded) < geoCacheTTL
+	if !fresh || r.URL.Query().Get("reload") == "1" {
+		data := s.config.Geo()
+		s.geoCache = &data
+		s.geoLoaded = time.Now()
+	}
+	writeJSON(w, http.StatusOK, s.geoCache)
+}
+
+type rulesRequest struct {
+	Raw   string `json:"raw"`
+	Rules []Rule `json:"rules"`
+}
+
+type rulesResponse struct {
+	Path  string `json:"path"`
+	Raw   string `json:"raw"`
+	Rules []Rule `json:"rules"`
+}
+
+// resolveRaw turns a request into rule file content.
+func (s *Server) resolveRaw(req rulesRequest) (string, error) {
+	if req.Rules != nil {
+		return s.config.Rules.Marshal(req.Rules)
+	}
+	return req.Raw, nil
+}
+
+// GET/PUT /api/v1/rules
+func (s *Server) handleRules(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodGet, http.MethodPut) {
+		return
+	}
+	if s.config.Rules == nil {
+		writeError(w, http.StatusNotImplemented, "rule management is unavailable")
+		return
+	}
+	if r.Method == http.MethodGet {
+		raw, rules, err := s.config.Rules.Load()
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, err.Error())
+			return
+		}
+		writeJSON(w, http.StatusOK, rulesResponse{Path: s.config.Rules.Path(), Raw: raw, Rules: rules})
+		return
+	}
+	var req rulesRequest
+	if !decodeBody(w, r, &req) {
+		return
+	}
+	raw, err := s.resolveRaw(req)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	rules, err := s.config.Rules.Apply(raw)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	s.config.Logf("ruleset updated from web UI (%d rules)", len(rules))
+	writeJSON(w, http.StatusOK, rulesResponse{Path: s.config.Rules.Path(), Raw: raw, Rules: rules})
+}
+
+// POST /api/v1/rules/validate
+func (s *Server) handleRulesValidate(w http.ResponseWriter, r *http.Request) {
+	if !methodAllowed(w, r, http.MethodPost) {
+		return
+	}
+	if s.config.Rules == nil {
+		writeError(w, http.StatusNotImplemented, "rule management is unavailable")
+		return
+	}
+	var req rulesRequest
+	if !decodeBody(w, r, &req) {
+		return
+	}
+	raw, err := s.resolveRaw(req)
+	if err != nil {
+		writeJSON(w, http.StatusOK, map[string]interface{}{"valid": false, "error": err.Error()})
+		return
+	}
+	rules, err := s.config.Rules.Validate(raw)
+	if err != nil {
+		writeJSON(w, http.StatusOK, map[string]interface{}{
+			"valid": false,
+			"error": err.Error(),
+			"raw":   raw,
+		})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"valid": true,
+		"rules": rules,
+		"raw":   raw,
+	})
+}
@@ -0,0 +1,152 @@
+package web
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+)
+
+const (
+	sessionCookieName = "opengfw_session"
+	sessionTTL        = 7 * 24 * time.Hour
+	maxLoginFailures  = 8
+	loginBanDuration  = 5 * time.Minute
+)
+
+type authenticator struct {
+	secret string
+
+	mu       sync.Mutex
+	sessions map[string]time.Time // token -> expiry
+	failures map[string]*failureRecord
+}
+
+type failureRecord struct {
+	count int
+	until time.Time
+}
+
+func newAuthenticator(secret string) *authenticator {
+	return &authenticator{
+		secret:   secret,
+		sessions: make(map[string]time.Time),
+		failures: make(map[string]*failureRecord),
+	}
+}
+
+// RandomSecret generates a secret to be used when the user did not set one.
+func RandomSecret() string {
+	b := make([]byte, 12)
+	if _, err := rand.Read(b); err != nil {
+		return "opengfw"
+	}
+	return hex.EncodeToString(b)
+}
+
+func newToken() string {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return ""
+	}
+	return hex.EncodeToString(b)
+}
+
+// login verifies the password and returns a new session token.
+func (a *authenticator) login(remoteAddr, password string) (string, time.Time, error) {
+	ip := hostOnly(remoteAddr)
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	now := time.Now()
+	if rec, ok := a.failures[ip]; ok && rec.count >= maxLoginFailures && now.Before(rec.until) {
+		return "", time.Time{}, errTooManyAttempts
+	}
+	if subtle.ConstantTimeCompare([]byte(password), []byte(a.secret)) != 1 {
+		rec, ok := a.failures[ip]
+		if !ok || now.After(rec.until) {
+			rec = &failureRecord{}
+			a.failures[ip] = rec
+		}
+		rec.count++
+		rec.until = now.Add(loginBanDuration)
+		return "", time.Time{}, errBadCredentials
+	}
+	delete(a.failures, ip)
+	token := newToken()
+	if token == "" {
+		return "", time.Time{}, errInternal
+	}
+	expiry := now.Add(sessionTTL)
+	a.sessions[token] = expiry
+	a.gcLocked(now)
+	return token, expiry, nil
+}
+
+func (a *authenticator) logout(token string) {
+	if token == "" {
+		return
+	}
+	a.mu.Lock()
+	delete(a.sessions, token)
+	a.mu.Unlock()
+}
+
+func (a *authenticator) valid(token string) bool {
+	if token == "" {
+		return false
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	expiry, ok := a.sessions[token]
+	if !ok {
+		return false
+	}
+	if time.Now().After(expiry) {
+		delete(a.sessions, token)
+		return false
+	}
+	return true
+}
+
+func (a *authenticator) gcLocked(now time.Time) {
+	for t, exp := range a.sessions {
+		if now.After(exp) {
+			delete(a.sessions, t)
+		}
+	}
+	for ip, rec := range a.failures {
+		if now.After(rec.until) {
+			delete(a.failures, ip)
+		}
+	}
+}
+
+// bearerToken returns the token carried by the Authorization header, if any.
+func bearerToken(r *http.Request) string {
+	const prefix = "Bearer "
+	h := r.Header.Get("Authorization")
+	if len(h) > len(prefix) && h[:len(prefix)] == prefix {
+		return h[len(prefix):]
+	}
+	return ""
+}
+
+// cookieToken returns the token carried by the session cookie, if any.
+func cookieToken(r *http.Request) string {
+	c, err := r.Cookie(sessionCookieName)
+	if err != nil {
+		return ""
+	}
+	return c.Value
+}
+
+func hostOnly(addr string) string {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	return host
+}
@@ -0,0 +1,287 @@
+// Command devserver runs the OpenGFW web UI against synthetic data.
+//
+// The engine itself only builds on Linux (it needs NFQueue), so this little
+// program exists to let the frontend be developed and reviewed anywhere:
+//
+//	go run ./web/devserver
+//
+// It serves the embedded UI on :8080 with the password "opengfw".
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"math/rand"
+	"net"
+	"os"
+	"os/signal"
+	"runtime"
+	"syscall"
+	"time"
+
+	"github.com/apernet/OpenGFW/analyzer"
+	"github.com/apernet/OpenGFW/analyzer/tcp"
+	"github.com/apernet/OpenGFW/analyzer/udp"
+	"github.com/apernet/OpenGFW/modifier"
+	modUDP "github.com/apernet/OpenGFW/modifier/udp"
+	"github.com/apernet/OpenGFW/ruleset"
+	"github.com/apernet/OpenGFW/ruleset/builtins/geo"
+	"github.com/apernet/OpenGFW/web"
+
+	"gopkg.in/yaml.v3"
+)
+
+const password = "opengfw"
+
+func main() {
+	hub := web.NewHub()
+	rm := &memoryRules{}
+	if err := rm.init(); err != nil {
+		log.Fatal(err)
+	}
+
+	srv, err := web.NewServer(web.Config{
+		Listen: ":8080",
+		Secret: password,
+		Hub:    hub,
+		Rules:  rm,
+		Meta: web.MetaInfo{
+			Analyzers: []web.AnalyzerInfo{
+				{Name: "http", Proto: "tcp"}, {Name: "tls", Proto: "tcp"},
+				{Name: "ssh", Proto: "tcp"}, {Name: "socks", Proto: "tcp"},
+				{Name: "trojan", Proto: "tcp"}, {Name: "fet", Proto: "tcp"},
+				{Name: "dns", Proto: "udp"}, {Name: "quic", Proto: "udp"},
+				{Name: "openvpn", Proto: "udp"}, {Name: "wireguard", Proto: "udp"},
+			},
+			Modifiers: []string{"dns"},
+			Actions:   []string{"allow", "block", "drop", "modify"},
+			Functions: []string{"geoip", "geosite", "cidr", "lookup"},
+		},
+		Info: func() web.Info {
+			host, _ := os.Hostname()
+			return web.Info{
+				Version:   "devserver",
+				Platform:  runtime.GOOS + "/" + runtime.GOARCH,
+				GoVersion: runtime.Version(),
+				Hostname:  host,
+				RuleFile:  "rules.yaml (in memory)",
+				Config: web.ConfigDigest{
+					IOQueueSize: 1024, IORST: true, Workers: 4,
+					WorkerQueue: 64, UDPMaxStreams: 4096,
+					GeoIP: "geoip.dat", GeoSite: "geosite.dat",
+				},
+			}
+		},
+		Geo:  geoData,
+		Logf: log.Printf,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() {
+		ch := make(chan os.Signal, 1)
+		signal.Notify(ch, os.Interrupt, syscall.SIGTERM)
+		<-ch
+		cancel()
+	}()
+
+	for i := 0; i < 4; i++ {
+		hub.WorkerStarted()
+	}
+	go generate(ctx, hub)
+
+	log.Printf("web UI on http://127.0.0.1:8080 (password: %s)", password)
+	if err := srv.Run(ctx); err != nil {
+		log.Fatal(err)
+	}
+}
+
+var (
+	hosts = []string{
+		"www.google.com", "github.com", "cdn.jsdelivr.net", "telegram.org",
+		"ads.example.net", "tracker.evil.test", "api.openai.com", "www.wikipedia.org",
+		"registry.npmjs.org", "malware.bad.test",
+	}
+	ips = []string{"1.1.1.1", "8.8.8.8", "93.184.216.34", "104.16.132.229", "2606:4700::6810:84e5"}
+)
+
+// generate feeds the hub with plausible looking traffic.
+func generate(ctx context.Context, hub *web.Hub) {
+	rng := rand.New(rand.NewSource(42))
+	ticker := time.NewTicker(120 * time.Millisecond)
+	defer ticker.Stop()
+	var id int64
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			for n := rng.Intn(6); n >= 0; n-- {
+				id++
+				udp := rng.Intn(3) == 0
+				proto := "tcp"
+				if udp {
+					proto = "udp"
+				}
+				hub.StreamNew(proto)
+
+				host := hosts[rng.Intn(len(hosts))]
+				props := web.Props{}
+				if udp {
+					props["dns"] = web.PropMap{
+						"qr":        false,
+						"questions": []map[string]interface{}{{"name": host, "type": 1}},
+					}
+				} else {
+					props["tls"] = web.PropMap{"req": map[string]interface{}{
+						"sni": host, "version": 771,
+					}}
+				}
+				hub.PropUpdate(props)
+
+				info := web.StreamInfo{
+					ID:      id,
+					Proto:   proto,
+					SrcIP:   fmt.Sprintf("192.168.1.%d", 2+rng.Intn(60)),
+					SrcPort: uint16(20000 + rng.Intn(40000)),
+					DstIP:   ips[rng.Intn(len(ips))],
+					DstPort: 443,
+					Props:   props,
+				}
+
+				switch {
+				case rng.Intn(10) == 0:
+					hub.RuleLog(info, "log-suspicious")
+					hub.StreamAction(info, "block")
+				case rng.Intn(12) == 0:
+					hub.StreamAction(info, "drop")
+				case rng.Intn(14) == 0:
+					hub.StreamAction(info, "modify")
+				case rng.Intn(30) == 0:
+					hub.Error(info, "geoip-rule", "lookup timeout")
+				default:
+					hub.StreamAction(info, "allow")
+				}
+			}
+		}
+	}
+}
+
+// memoryRules is an in-memory web.RuleManager. Rules are compiled with the real
+// ruleset compiler and the real analyzers, so expression errors show up here
+// exactly like they would in the engine; only the "apply" step is faked.
+type memoryRules struct {
+	raw   string
+	rules []web.Rule
+}
+
+const seedRules = `- name: block-malware
+  action: block
+  log: true
+  expr: 'tls != nil && tls.req != nil && string(tls.req.sni) endsWith ".bad.test"'
+- name: block-ads-dns
+  action: drop
+  expr: 'dns != nil && any(dns.questions, {.name endsWith "ads.example.net"})'
+- name: log-ssh
+  log: true
+  expr: 'ssh != nil'
+`
+
+func (m *memoryRules) init() error {
+	rules, err := parse(seedRules)
+	if err != nil {
+		return err
+	}
+	m.raw, m.rules = seedRules, rules
+	return nil
+}
+
+func (m *memoryRules) Path() string { return "rules.yaml" }
+
+func (m *memoryRules) Load() (string, []web.Rule, error) { return m.raw, m.rules, nil }
+
+func (m *memoryRules) Validate(raw string) ([]web.Rule, error) { return parse(raw) }
+
+func (m *memoryRules) Marshal(rules []web.Rule) (string, error) {
+	bs, err := yaml.Marshal(rules)
+	return string(bs), err
+}
+
+func (m *memoryRules) Apply(raw string) ([]web.Rule, error) {
+	rules, err := parse(raw)
+	if err != nil {
+		return nil, err
+	}
+	m.raw, m.rules = raw, rules
+	return rules, nil
+}
+
+var (
+	analyzers = []analyzer.Analyzer{
+		&tcp.FETAnalyzer{}, &tcp.HTTPAnalyzer{}, &tcp.SocksAnalyzer{}, &tcp.SSHAnalyzer{},
+		&tcp.TLSAnalyzer{}, &tcp.TrojanAnalyzer{}, &udp.DNSAnalyzer{}, &udp.OpenVPNAnalyzer{},
+		&udp.QUICAnalyzer{}, &udp.WireGuardAnalyzer{},
+	}
+	modifiers = []modifier.Modifier{&modUDP.DNSModifier{}}
+)
+
+// parse compiles rules the same way the engine does.
+func parse(raw string) ([]web.Rule, error) {
+	exprRules, err := ruleset.ExprRulesFromYAMLBytes([]byte(raw))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse rules: %w", err)
+	}
+	_, err = ruleset.CompileExprRules(exprRules, analyzers, modifiers, &ruleset.BuiltinConfig{
+		Logger:          nopRulesetLogger{},
+		GeoSiteFilename: os.Getenv("OPENGFW_GEOSITE"),
+		GeoIpFilename:   os.Getenv("OPENGFW_GEOIP"),
+		ProtectedDialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, network, address)
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]web.Rule, 0, len(exprRules))
+	for _, r := range exprRules {
+		wr := web.Rule{Name: r.Name, Action: r.Action, Log: r.Log, Expr: r.Expr}
+		if r.Modifier.Name != "" {
+			wr.Modifier = &web.RuleModifier{Name: r.Modifier.Name, Args: r.Modifier.Args}
+		}
+		out = append(out, wr)
+	}
+	return out, nil
+}
+
+type nopRulesetLogger struct{}
+
+func (nopRulesetLogger) Log(ruleset.StreamInfo, string)               {}
+func (nopRulesetLogger) MatchError(ruleset.StreamInfo, string, error) {}
+
+// geoData lists the geo databases, if they are available in the working
+// directory (or wherever OPENGFW_GEOIP / OPENGFW_GEOSITE point).
+func geoData() web.GeoData {
+	matcher := geo.NewGeoMatcher(os.Getenv("OPENGFW_GEOSITE"), os.Getenv("OPENGFW_GEOIP"))
+	var data web.GeoData
+	if entries, err := matcher.ListGeoIP(); err != nil {
+		data.IPError = err.Error()
+	} else {
+		for _, e := range entries {
+			data.IP = append(data.IP, web.GeoEntry{Code: e.Code, Count: e.CIDRs})
+		}
+	}
+	if entries, err := matcher.ListGeoSite(); err != nil {
+		data.SiteError = err.Error()
+	} else {
+		for _, e := range entries {
+			data.Site = append(data.Site, web.GeoEntry{
+				Code: e.Code, Count: e.Domains, Attributes: e.Attributes,
+			})
+		}
+	}
+	return data
+}
@@ -0,0 +1,11 @@
+import{_ as b}from"./PageHeader.vue_vue_type_script_setup_true_lang-CD1KTXEu.js";import{_ as y}from"./Badge.vue_vue_type_script_setup_true_lang-DSNeqlXx.js";import{c as M,d as B,O as L,$ as j,a as o,p as t,u as e,l as r,F as f,r as p,b as u,w as s,_ as g,m as F,g as v,o as n,h,t as l,k as i,j as N,q}from"./index-DIqASLVQ.js";import{_ as k,a as x,b as z,c as w}from"./CardTitle.vue_vue_type_script_setup_true_lang-DKXrNKGt.js";import{_ as A}from"./Skeleton.vue_vue_type_script_setup_true_lang-B_11D5UP.js";import{c as C}from"./format-B6sc_rZ4.js";/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const D=M("BoxesIcon",[["path",{d:"M2.97 12.92A2 2 0 0 0 2 14.63v3.24a2 2 0 0 0 .97 1.71l3 1.8a2 2 0 0 0 2.06 0L12 19v-5.5l-5-3-4.03 2.42Z",key:"lc1i9w"}],["path",{d:"m7 16.5-4.74-2.85",key:"1o9zyk"}],["path",{d:"m7 16.5 5-3",key:"va8pkn"}],["path",{d:"M7 16.5v5.17",key:"jnp8gn"}],["path",{d:"M12 13.5V19l3.97 2.38a2 2 0 0 0 2.06 0l3-1.8a2 2 0 0 0 .97-1.71v-3.24a2 2 0 0 0-.97-1.71L17 10.5l-5 3Z",key:"8zsnat"}],["path",{d:"m17 16.5-5-3",key:"8arw3v"}],["path",{d:"m17 16.5 4.74-2.85",key:"8rfmw"}],["path",{d:"M17 16.5v5.17",key:"k6z78m"}],["path",{d:"M7.97 4.42A2 2 0 0 0 7 6.13v4.37l5 3 5-3V6.13a2 2 0 0 0-.97-1.71l-3-1.8a2 2 0 0 0-2.06 0l-3 1.8Z",key:"1xygjf"}],["path",{d:"M12 8 7.26 5.15",key:"1vbdud"}],["path",{d:"m12 8 4.74-2.85",key:"3rx089"}],["path",{d:"M12 13.5V8",key:"1io7kd"}]]);/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const I=M("SquareFunctionIcon",[["rect",{width:"18",height:"18",x:"3",y:"3",rx:"2",ry:"2",key:"1m3agn"}],["path",{d:"M9 17c2 0 2.8-1 2.8-2.8V10c0-2 1-3.3 3.2-3",key:"m1af9g"}],["path",{d:"M9 11.2h5.7",key:"3zgcl2"}]]),S={key:0,class:"grid grid-cols-2 gap-3 sm:grid-cols-3 lg:grid-cols-4"},Z={class:"grid grid-cols-2 gap-3 sm:grid-cols-3 lg:grid-cols-4"},E={class:"flex items-center justify-between gap-2"},O={class:"truncate font-mono text-sm font-medium"},T={class:"mt-2 text-xl font-semibold tabular-nums"},G={class:"text-muted-foreground text-xs"},H={class:"mt-3 grid gap-3 md:grid-cols-2"},J={key:0,class:"text-muted-foreground text-xs"},Y=B({__name:"AnalyzersView",setup(K){const{metrics:V}=q(),c=F(null);L(async()=>{try{c.value=await j.meta()}catch{c.value={analyzers:[],modifiers:[],actions:[],functions:[]}}});const _=v(()=>{var m;const d=new Map;for(const a of((m=V.value)==null?void 0:m.analyzers)??[])d.set(a.name,a.count);return d}),$=v(()=>{var d;return[...((d=c.value)==null?void 0:d.analyzers)??[]].sort((m,a)=>(_.value.get(a.name)??0)-(_.value.get(m.name)??0))});return(d,m)=>(n(),o("div",null,[t(b,{title:e(r)("analyzers.title"),description:e(r)("analyzers.subtitle")},null,8,["title","description"]),c.value?(n(),o(f,{key:1},[u("div",Z,[(n(!0),o(f,null,p($.value,a=>(n(),h(e(g),{key:a.name,class:"p-3.5 sm:p-4"},{default:s(()=>[u("div",E,[u("span",O,l(a.name),1),t(e(y),{variant:a.proto==="udp"?"udp":"tcp",class:"uppercase"},{default:s(()=>[i(l(a.proto),1)]),_:2},1032,["variant"])]),u("p",T,l(e(C)(_.value.get(a.name)??0)),1),u("p",G,l(e(r)("analyzers.hits")),1)]),_:2},1024))),128))]),u("div",H,[t(e(g),null,{default:s(()=>[t(e(k),null,{default:s(()=>[t(e(x),{class:"flex items-center gap-2"},{default:s(()=>[t(e(D),{class:"size-4"}),i(" "+l(e(r)("analyzers.modifiers")),1)]),_:1}),t(e(z),null,{default:s(()=>[i(l(e(r)("analyzers.modifiersDesc")),1)]),_:1})]),_:1}),t(e(w),{class:"flex flex-wrap gap-1.5"},{default:s(()=>[(n(!0),o(f,null,p(c.value.modifiers,a=>(n(),h(e(y),{key:a,variant:"secondary",class:"font-mono"},{default:s(()=>[i(l(a),1)]),_:2},1024))),128)),c.value.modifiers.length?N("",!0):(n(),o("span",J,"—"))]),_:1})]),_:1}),t(e(g),null,{default:s(()=>[t(e(k),null,{default:s(()=>[t(e(x),{class:"flex items-center gap-2"},{default:s(()=>[t(e(I),{class:"size-4"}),i(" "+l(e(r)("analyzers.functions")),1)]),_:1}),t(e(z),null,{default:s(()=>[i(l(e(r)("analyzers.functionsDesc")),1)]),_:1})]),_:1}),t(e(w),{class:"flex flex-wrap gap-1.5"},{default:s(()=>[(n(!0),o(f,null,p(c.value.functions,a=>(n(),h(e(y),{key:a,variant:"secondary",class:"font-mono"},{default:s(()=>[i(l(a)+"() ",1)]),_:2},1024))),128))]),_:1})]),_:1})])],64)):(n(),o("div",S,[(n(),o(f,null,p(8,a=>t(e(A),{key:a,class:"h-24"})),64))]))]))}});export{Y as default};
@@ -0,0 +1 @@
+import{d as o,a as n,e as d,u as e,f as s,H as l,o as p,a8 as c}from"./index-DIqASLVQ.js";const b=c("inline-flex items-center justify-center gap-1 rounded-md border px-1.5 py-0.5 text-[11px] font-medium whitespace-nowrap tabular-nums",{variants:{variant:{default:"border-transparent bg-primary text-primary-foreground",secondary:"border-transparent bg-secondary text-secondary-foreground",outline:"text-foreground",muted:"border-transparent bg-muted text-muted-foreground",allow:"border-allow/25 bg-allow/12 text-allow",block:"border-block/25 bg-block/12 text-block",drop:"border-drop/25 bg-drop/12 text-drop",modify:"border-modify/25 bg-modify/12 text-modify",log:"border-log/25 bg-log/12 text-log",tcp:"border-tcp/25 bg-tcp/12 text-tcp",udp:"border-udp/25 bg-udp/12 text-udp"}},defaultVariants:{variant:"default"}}),g=o({__name:"Badge",props:{variant:{},class:{}},setup(t){const r=t;return(a,u)=>(p(),n("span",{class:d(e(s)(e(b)({variant:r.variant}),r.class))},[l(a.$slots,"default")],2))}});export{g as _};
@@ -0,0 +1 @@
+import{d as a,o as n,a as r,e as c,u as o,f as p,H as l}from"./index-DIqASLVQ.js";const u=a({__name:"CardContent",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("div",{class:c(o(p)("px-4 pb-4 sm:px-5 sm:pb-5",e.class))},[l(t.$slots,"default")],2))}}),d=a({__name:"CardDescription",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("p",{class:c(o(p)("text-muted-foreground text-xs sm:text-sm",e.class))},[l(t.$slots,"default")],2))}}),f=a({__name:"CardHeader",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("div",{class:c(o(p)("flex flex-col gap-1 px-4 pt-4 pb-3 sm:px-5 sm:pt-5",e.class))},[l(t.$slots,"default")],2))}}),i=a({__name:"CardTitle",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("h3",{class:c(o(p)("text-sm leading-none font-semibold tracking-tight sm:text-base",e.class))},[l(t.$slots,"default")],2))}});export{f as _,i as a,d as b,u as c};
@@ -0,0 +1 @@
+import{aB as h,aC as x,m as v,g as p,aD as R,al as S,d as g,aj as b,ap as w,aE as y,x as P,aF as k}from"./index-DIqASLVQ.js";function D(e,l){const t=typeof e=="string"&&!l?`${e}Context`:l,o=Symbol(t);return[a=>{const c=h(o,a);if(c||c===null)return c;throw new Error(`Injection \`${o.toString()}\` not found. Component must be used within ${Array.isArray(e)?`one of the following components: ${e.join(", ")}`:`\`${e}\``}`)},a=>(x(o,a),a)]}function _(){let e=document.activeElement;if(e==null)return null;for(;e!=null&&e.shadowRoot!=null&&e.shadowRoot.activeElement!=null;)e=e.shadowRoot.activeElement;return e}const[A]=D("ConfigProvider");function z(e){const l=A({dir:v("ltr")});return p(()=>{var t;return(e==null?void 0:e.value)||((t=l.dir)==null?void 0:t.value)||"ltr"})}function K(e,l="reka"){var n;let t;const o=A({useId:void 0});return o.useId?t=o.useId():t=(n=R)==null?void 0:n(),l?`${l}-${t}`:t}function I(){const e=v(),l=p(()=>{var t,o;return["#text","#comment"].includes((t=e.value)==null?void 0:t.$el.nodeName)?(o=e.value)==null?void 0:o.$el.nextElementSibling:S(e)});return{primitiveElement:e,currentElement:l}}const $="data-reka-collection-item";function q(e={}){const{key:l="",isProvider:t=!1}=e,o=`${l}CollectionProvider`;let n;if(t){const u=v(new Map);n={collectionRef:v(),itemMap:u},x(o,n)}else n=h(o);const C=(u=!1)=>{const r=n.collectionRef.value;if(!r)return[];const f=Array.from(r.querySelectorAll(`[${$}]`)),m=new Map(f.map((i,E)=>[i,E])),d=Array.from(n.itemMap.value.values()).sort((i,E)=>(m.get(i.ref)??-1)-(m.get(E.ref)??-1));return u?d:d.filter(i=>i.ref.dataset.disabled!=="")},a=g({name:"CollectionSlot",inheritAttrs:!1,setup(u,{slots:r,attrs:f}){const{primitiveElement:m,currentElement:s}=I();return P(s,()=>{n.collectionRef.value=s.value}),()=>w(y,{ref:m,...f},r)}}),c=g({name:"CollectionItem",inheritAttrs:!1,props:{value:{validator:()=>!0}},setup(u,{slots:r,attrs:f}){const{primitiveElement:m,currentElement:s}=I();return b(d=>{if(s.value){const i=k(s.value);n.itemMap.value.set(i,{ref:s.value,value:u.value}),d(()=>n.itemMap.value.delete(i))}}),()=>w(y,{...f,[$]:"",ref:m},r)}}),M=p(()=>Array.from(n.itemMap.value.values())),j=p(()=>n.itemMap.value.size);return{getItems:C,reactiveItems:M,itemMapSize:j,CollectionSlot:a,CollectionItem:c}}export{q as a,z as b,D as c,K as d,_ as g,A as i,I as u};
@@ -0,0 +1,6 @@
+import{_ as a}from"./Badge.vue_vue_type_script_setup_true_lang-DSNeqlXx.js";import{c as h,d as x,o,h as m,u as t,w as c,k as i,t as n,g as v,l as d,a as k,b as r,p,j as f}from"./index-DIqASLVQ.js";import{t as b,e as _}from"./format-B6sc_rZ4.js";/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const w=h("ArrowRightIcon",[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"m12 5 7 7-7 7",key:"xquz4c"}]]),y=x({__name:"ActionBadge",props:{event:{}},setup(l){const e=l,u=v(()=>{if(e.event.kind==="error")return"block";if(e.event.kind==="log")return"log";switch(e.event.action){case"allow":return"allow";case"block":return"block";case"drop":return"drop";case"modify":return"modify";default:return"muted"}}),s=v(()=>e.event.kind==="error"?d("action.error"):e.event.kind==="log"?d("action.log"):d(`action.${e.event.action??"maybe"}`));return(g,N)=>(o(),m(t(a),{variant:u.value,class:"uppercase"},{default:c(()=>[i(n(s.value),1)]),_:1},8,["variant"]))}}),B={class:"flex items-center gap-2"},I={class:"text-muted-foreground shrink-0 font-mono text-[11px] tabular-nums"},$={class:"flex min-w-0 flex-1 items-center gap-1.5 font-mono text-xs"},A={class:"text-muted-foreground truncate"},C={class:"truncate"},E=x({__name:"EventItem",props:{event:{}},emits:["select"],setup(l){const e=l;return(u,s)=>(o(),k("button",{type:"button",class:"hover:bg-accent/60 focus-visible:ring-ring/40 flex w-full flex-col gap-1.5 rounded-lg px-2.5 py-2 text-left transition-colors outline-none focus-visible:ring-[3px] sm:flex-row sm:items-center sm:gap-3",onClick:s[0]||(s[0]=g=>u.$emit("select",e.event))},[r("div",B,[r("span",I,n(t(b)(e.event.time)),1),p(y,{event:e.event},null,8,["event"]),p(t(a),{variant:e.event.proto==="udp"?"udp":"tcp",class:"uppercase"},{default:c(()=>[i(n(e.event.proto),1)]),_:1},8,["variant"]),e.event.rule?(o(),m(t(a),{key:0,variant:"outline",class:"max-w-32 truncate sm:hidden"},{default:c(()=>[i(n(e.event.rule),1)]),_:1})):f("",!0)]),r("div",$,[r("span",A,n(t(_)(e.event.srcIP,e.event.srcPort)),1),p(t(w),{class:"text-muted-foreground/60 size-3 shrink-0"}),r("span",C,n(e.event.host||t(_)(e.event.dstIP,e.event.dstPort)),1)]),e.event.rule?(o(),m(t(a),{key:0,variant:"outline",class:"hidden max-w-40 truncate sm:inline-flex"},{default:c(()=>[i(n(e.event.rule),1)]),_:1})):f("",!0)]))}});export{w as A,E as _,y as a};
@@ -0,0 +1 @@
+import{d as c,a as t,b as n,t as i,j as a,H as d,o as s}from"./index-DIqASLVQ.js";const l={class:"mb-4 flex flex-wrap items-end justify-between gap-3 sm:mb-6"},m={class:"min-w-0"},p={class:"text-lg font-semibold tracking-tight sm:text-2xl"},_={key:0,class:"text-muted-foreground mt-0.5 text-xs sm:text-sm"},x={key:0,class:"flex shrink-0 items-center gap-2"},g=c({__name:"PageHeader",props:{title:{},description:{}},setup(r){const e=r;return(o,f)=>(s(),t("div",l,[n("div",m,[n("h1",p,i(e.title),1),e.description?(s(),t("p",_,i(e.description),1)):a("",!0)]),o.$slots.actions?(s(),t("div",x,[d(o.$slots,"actions")])):a("",!0)]))}});export{g as _};
@@ -0,0 +1,16 @@
+import{c as y,d as M,o as u,a as r,e as L,u as t,f as T,O as F,$ as z,p as a,l as e,w as n,_ as f,m as R,k as c,t as o,b as i,F as _,r as p,h as D,i as N,s as $,a9 as E,a0 as q,g as v,aa as H,v as U,ab as A,ac as G}from"./index-DIqASLVQ.js";import{_ as J}from"./PageHeader.vue_vue_type_script_setup_true_lang-CD1KTXEu.js";import{_ as x,a as h,c as b,b as K}from"./CardTitle.vue_vue_type_script_setup_true_lang-DKXrNKGt.js";import{_ as P}from"./Select.vue_vue_type_script_setup_true_lang-CzaVl8rJ.js";import"./Collection-CwtwoTtI.js";/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const W=y("BookOpenIcon",[["path",{d:"M12 7v14",key:"1akyts"}],["path",{d:"M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z",key:"ruj8y"}]]);/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const X=y("LogOutIcon",[["path",{d:"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4",key:"1uf3rs"}],["polyline",{points:"16 17 21 12 16 7",key:"1gabdz"}],["line",{x1:"21",x2:"9",y1:"12",y2:"12",key:"1uyos4"}]]);/**
+ * @license lucide-vue-next v0.469.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */const Y=y("MonitorIcon",[["rect",{width:"20",height:"14",x:"2",y:"3",rx:"2",key:"48i651"}],["line",{x1:"8",x2:"16",y1:"21",y2:"21",key:"1svkeh"}],["line",{x1:"12",x2:"12",y1:"17",y2:"21",key:"vw1qmm"}]]),Z=M({__name:"Separator",props:{class:{},orientation:{default:"horizontal"}},setup(k){const g=k;return(w,S)=>(u(),r("div",{role:"separator",class:L(t(T)("bg-border shrink-0",g.orientation==="vertical"?"h-full w-px":"h-px w-full",g.class))},null,2))}}),ee={class:"max-w-3xl"},te={class:"flex flex-col gap-2"},se={class:"text-sm font-medium"},ae={class:"bg-muted grid grid-cols-3 gap-1 rounded-lg p-1"},le=["onClick"],ne={class:"flex items-center justify-between gap-4"},oe={class:"text-sm font-medium"},ie={class:"flex flex-col"},ue={class:"text-muted-foreground shrink-0"},re={class:"truncate font-mono text-xs sm:text-[13px]"},ce={class:"flex flex-col"},de={class:"text-muted-foreground shrink-0"},ge={class:"truncate font-mono text-xs sm:text-[13px]"},he=M({__name:"SettingsView",setup(k){const g=U(),{theme:w,setTheme:S}=E(),{lang:V,setLang:C}=q(),m=R(null);F(async()=>{try{m.value=await z.info()}catch{}});const B=v(()=>[{value:"light",label:e("settings.themeLight"),icon:A},{value:"dark",label:e("settings.themeDark"),icon:G},{value:"system",label:e("settings.themeSystem"),icon:Y}]),O=[{value:"en",label:"English"},{value:"zh",label:"中文"}],Q=v(()=>{const s=m.value;return s?[{label:e("settings.version"),value:s.commit?`${s.version} (${s.commit})`:s.version},{label:e("settings.platform"),value:s.platform},{label:e("settings.goVersion"),value:s.goVersion},{label:e("settings.hostname"),value:s.hostname},{label:e("settings.ruleFile"),value:s.ruleFile}]:[]}),j=v(()=>{var l;const s=(l=m.value)==null?void 0:l.config;if(!s)return[];const d=[{label:e("settings.workers"),value:s.workers>0?String(s.workers):e("settings.auto")},{label:e("settings.workerQueueSize"),value:s.workerQueueSize>0?String(s.workerQueueSize):e("settings.auto")},{label:e("settings.ioQueueSize"),value:s.ioQueueSize>0?String(s.ioQueueSize):e("settings.auto")},{label:e("settings.ioLocal"),value:s.ioLocal?e("common.enabled"):e("common.disabled")},{label:e("settings.ioRST"),value:s.ioRST?e("common.enabled"):e("common.disabled")},{label:e("settings.udpMaxStreams"),value:s.udpMaxStreams>0?String(s.udpMaxStreams):e("settings.auto")}];return s.geoip&&d.push({label:e("settings.geoip"),value:s.geoip}),s.geosite&&d.push({label:e("settings.geosite"),value:s.geosite}),d});async function I(){H(),await z.logout(),await g.replace({name:"login"})}return(s,d)=>(u(),r("div",ee,[a(J,{title:t(e)("settings.title"),description:t(e)("settings.subtitle")},null,8,["title","description"]),a(t(f),null,{default:n(()=>[a(t(x),null,{default:n(()=>[a(t(h),null,{default:n(()=>[c(o(t(e)("settings.appearance")),1)]),_:1})]),_:1}),a(t(b),{class:"flex flex-col gap-4"},{default:n(()=>[i("div",te,[i("span",se,o(t(e)("settings.theme")),1),i("div",ae,[(u(!0),r(_,null,p(B.value,l=>(u(),r("button",{key:l.value,type:"button",class:L(["flex items-center justify-center gap-1.5 rounded-md px-2 py-1.5 text-xs font-medium transition-colors sm:text-sm",t(w)===l.value?"bg-background text-foreground shadow-sm":"text-muted-foreground hover:text-foreground"]),onClick:me=>t(S)(l.value)},[(u(),D(N(l.icon),{class:"size-3.5"})),c(" "+o(l.label),1)],10,le))),128))])]),i("div",ne,[i("span",oe,o(t(e)("settings.language")),1),a(t(P),{"model-value":t(V),options:O,class:"w-36","aria-label":t(e)("settings.language"),"onUpdate:modelValue":d[0]||(d[0]=l=>t(C)(l))},null,8,["model-value","aria-label"])])]),_:1})]),_:1}),a(t(f),{class:"mt-3"},{default:n(()=>[a(t(x),null,{default:n(()=>[a(t(h),null,{default:n(()=>[c(o(t(e)("settings.instance")),1)]),_:1}),a(t(K),null,{default:n(()=>[c(o(t(e)("settings.engineConfig")),1)]),_:1})]),_:1}),a(t(b),null,{default:n(()=>[i("dl",ie,[(u(!0),r(_,null,p(Q.value,l=>(u(),r("div",{key:l.label,class:"flex items-start justify-between gap-4 py-1.5 text-sm"},[i("dt",ue,o(l.label),1),i("dd",re,o(l.value),1)]))),128))]),a(t(Z),{class:"my-3"}),i("dl",ce,[(u(!0),r(_,null,p(j.value,l=>(u(),r("div",{key:l.label,class:"flex items-start justify-between gap-4 py-1.5 text-sm"},[i("dt",de,o(l.label),1),i("dd",ge,o(l.value),1)]))),128))])]),_:1})]),_:1}),a(t(f),{class:"mt-3"},{default:n(()=>[a(t(x),null,{default:n(()=>[a(t(h),null,{default:n(()=>[c(o(t(e)("settings.session")),1)]),_:1})]),_:1}),a(t(b),{class:"flex flex-wrap gap-2"},{default:n(()=>[a(t($),{variant:"destructive",onClick:I},{default:n(()=>[a(t(X),{class:"size-4"}),c(" "+o(t(e)("settings.logout")),1)]),_:1}),a(t($),{variant:"outline",as:"a",href:"https://gfw.dev/",target:"_blank",rel:"noreferrer"},{default:n(()=>[a(t(W),{class:"size-4"}),c(" "+o(t(e)("settings.docs")),1)]),_:1})]),_:1})]),_:1})]))}});export{he as default};
@@ -0,0 +1 @@
+import{d as a,o as n,a as o,e as t,u as c,f as r}from"./index-DIqASLVQ.js";const u=a({__name:"Skeleton",props:{class:{}},setup(e){const s=e;return(l,m)=>(n(),o("div",{class:t(c(r)("bg-muted animate-pulse rounded-md",s.class))},null,2))}});export{u as _};
@@ -0,0 +1 @@
+function o(t){if(!Number.isFinite(t))return"0";if(t<1e3)return String(t);const e=["k","M","G","T"];let n=t,r=-1;for(;n>=1e3&&r<e.length-1;)n/=1e3,r++;return`${n>=100?Math.round(n):n.toFixed(1).replace(/\.0$/,"")}${e[r]}`}function i(t,e){return e?Math.round(t/e*100):0}function u(t){if(t<60)return`${Math.max(0,Math.floor(t))}s`;const e=Math.floor(t/86400),n=Math.floor(t%86400/3600),r=Math.floor(t%3600/60);return e>0?`${e}d ${n}h`:n>0?`${n}h ${r}m`:`${r}m`}function a(t){return new Date(t).toLocaleTimeString(void 0,{hour12:!1})}function f(t){const e=new Date(t);return`${e.toLocaleDateString()} ${e.toLocaleTimeString(void 0,{hour12:!1})}`}function c(t,e){return t.includes(":")?`[${t}]:${e}`:`${t}:${e}`}export{f as a,o as c,u as d,c as e,i as p,a as t};
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <rect width="32" height="32" rx="8" fill="#18181b" />
+  <path
+    d="M16 5l9 3.5v7.2c0 5.3-3.6 9.9-9 11.3-5.4-1.4-9-6-9-11.3V8.5L16 5z"
+    fill="none"
+    stroke="#a1a1aa"
+    stroke-width="2"
+    stroke-linejoin="round"
+  />
+  <path d="M11 16h10M16 11v10" stroke="#ef4444" stroke-width="2" stroke-linecap="round" />
+</svg>
@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1, viewport-fit=cover, maximum-scale=5"
+    />
+    <meta name="theme-color" content="#09090b" />
+    <meta name="color-scheme" content="light dark" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <title>OpenGFW</title>
+    <script>
+      // Apply the stored theme before first paint to avoid a flash.
+      ;(function () {
+        try {
+          var t = localStorage.getItem('opengfw.theme') || 'system'
+          var dark =
+            t === 'dark' ||
+            (t === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+          document.documentElement.classList.toggle('dark', dark)
+        } catch (e) {}
+      })()
+    </script>
+    <script type="module" crossorigin src="/assets/index-DIqASLVQ.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DDyrZ70V.css">
+  </head>
+  <body>
+    <div id="app"></div>
+  </body>
+</html>
@@ -0,0 +1,10 @@
+package web
+
+import "embed"
+
+// distFS holds the compiled web UI. Run `make web` (or `npm run build` inside
+// web/frontend) to refresh it; the checked-in placeholder simply tells the user
+// that the UI has not been built yet.
+//
+//go:embed all:dist
+var distFS embed.FS
@@ -0,0 +1,32 @@
+<!doctype html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1, viewport-fit=cover, maximum-scale=5"
+    />
+    <meta name="theme-color" content="#09090b" />
+    <meta name="color-scheme" content="light dark" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <title>OpenGFW</title>
+    <script>
+      // Apply the stored theme before first paint to avoid a flash.
+      ;(function () {
+        try {
+          var t = localStorage.getItem('opengfw.theme') || 'system'
+          var dark =
+            t === 'dark' ||
+            (t === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+          document.documentElement.classList.toggle('dark', dark)
+        } catch (e) {}
+      })()
+    </script>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
@@ -0,0 +1,31 @@
+{
+  "name": "opengfw-web",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Web UI for OpenGFW",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc -b && vite build",
+    "preview": "vite preview",
+    "typecheck": "vue-tsc -b --noEmit"
+  },
+  "dependencies": {
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "lucide-vue-next": "^0.469.0",
+    "reka-ui": "^2.5.0",
+    "tailwind-merge": "^3.3.1",
+    "vue": "^3.5.13",
+    "vue-router": "^4.5.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.1.11",
+    "@types/node": "^22.10.5",
+    "@vitejs/plugin-vue": "^5.2.1",
+    "tailwindcss": "^4.1.11",
+    "typescript": "~5.7.3",
+    "vite": "^6.0.7",
+    "vue-tsc": "^2.2.0"
+  }
+}
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <rect width="32" height="32" rx="8" fill="#18181b" />
+  <path
+    d="M16 5l9 3.5v7.2c0 5.3-3.6 9.9-9 11.3-5.4-1.4-9-6-9-11.3V8.5L16 5z"
+    fill="none"
+    stroke="#a1a1aa"
+    stroke-width="2"
+    stroke-linejoin="round"
+  />
+  <path d="M11 16h10M16 11v10" stroke="#ef4444" stroke-width="2" stroke-linecap="round" />
+</svg>
@@ -0,0 +1,10 @@
+<script setup lang="ts">
+import { RouterView } from 'vue-router'
+
+import Toaster from '@/components/Toaster.vue'
+</script>
+
+<template>
+  <RouterView />
+  <Toaster />
+</template>
@@ -0,0 +1,208 @@
+@import 'tailwindcss';
+
+@custom-variant dark (&:is(.dark *));
+
+:root {
+  --radius: 0.65rem;
+
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.141 0.005 285.823);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.141 0.005 285.823);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.141 0.005 285.823);
+  --primary: oklch(0.21 0.006 285.885);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.967 0.001 286.375);
+  --secondary-foreground: oklch(0.21 0.006 285.885);
+  --muted: oklch(0.967 0.001 286.375);
+  --muted-foreground: oklch(0.552 0.016 285.938);
+  --accent: oklch(0.967 0.001 286.375);
+  --accent-foreground: oklch(0.21 0.006 285.885);
+  --destructive: oklch(0.577 0.245 27.325);
+  --destructive-foreground: oklch(0.985 0 0);
+  --border: oklch(0.92 0.004 286.32);
+  --input: oklch(0.92 0.004 286.32);
+  --ring: oklch(0.705 0.015 286.067);
+
+  /* Verdict colors, shared by badges, charts and the live feed. */
+  --allow: oklch(0.63 0.14 155);
+  --block: oklch(0.58 0.22 27);
+  --drop: oklch(0.72 0.16 70);
+  --modify: oklch(0.6 0.16 255);
+  --log: oklch(0.62 0.11 215);
+  --tcp: oklch(0.62 0.15 265);
+  --udp: oklch(0.68 0.13 190);
+}
+
+.dark {
+  --background: oklch(0.141 0.005 285.823);
+  --foreground: oklch(0.985 0 0);
+  --card: oklch(0.19 0.006 285.885);
+  --card-foreground: oklch(0.985 0 0);
+  --popover: oklch(0.21 0.006 285.885);
+  --popover-foreground: oklch(0.985 0 0);
+  --primary: oklch(0.92 0.004 286.32);
+  --primary-foreground: oklch(0.21 0.006 285.885);
+  --secondary: oklch(0.274 0.006 286.033);
+  --secondary-foreground: oklch(0.985 0 0);
+  --muted: oklch(0.274 0.006 286.033);
+  --muted-foreground: oklch(0.705 0.015 286.067);
+  --accent: oklch(0.274 0.006 286.033);
+  --accent-foreground: oklch(0.985 0 0);
+  --destructive: oklch(0.704 0.191 22.216);
+  --destructive-foreground: oklch(0.985 0 0);
+  --border: oklch(1 0 0 / 10%);
+  --input: oklch(1 0 0 / 15%);
+  --ring: oklch(0.552 0.016 285.938);
+
+  --allow: oklch(0.72 0.16 155);
+  --block: oklch(0.68 0.2 22);
+  --drop: oklch(0.79 0.15 75);
+  --modify: oklch(0.7 0.15 255);
+  --log: oklch(0.72 0.11 215);
+  --tcp: oklch(0.7 0.15 265);
+  --udp: oklch(0.76 0.12 190);
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --color-card: var(--card);
+  --color-card-foreground: var(--card-foreground);
+  --color-popover: var(--popover);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: var(--secondary);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: var(--muted);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: var(--accent);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-destructive-foreground: var(--destructive-foreground);
+  --color-border: var(--border);
+  --color-input: var(--input);
+  --color-ring: var(--ring);
+
+  --color-allow: var(--allow);
+  --color-block: var(--block);
+  --color-drop: var(--drop);
+  --color-modify: var(--modify);
+  --color-log: var(--log);
+  --color-tcp: var(--tcp);
+  --color-udp: var(--udp);
+
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
+
+  --font-mono:
+    ui-monospace, SFMono-Regular, 'SF Mono', Menlo, Consolas, 'Liberation Mono', monospace;
+
+  --animate-fade-in: fade-in 0.18s ease-out;
+  --animate-slide-up: slide-up 0.22s cubic-bezier(0.32, 0.72, 0, 1);
+  --animate-slide-in-right: slide-in-right 0.24s cubic-bezier(0.32, 0.72, 0, 1);
+  --animate-slide-in-left: slide-in-left 0.24s cubic-bezier(0.32, 0.72, 0, 1);
+  --animate-pulse-dot: pulse-dot 1.8s ease-in-out infinite;
+}
+
+@keyframes fade-in {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+
+@keyframes slide-up {
+  from {
+    opacity: 0;
+    transform: translateY(8px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+@keyframes slide-in-right {
+  from {
+    transform: translateX(100%);
+  }
+  to {
+    transform: translateX(0);
+  }
+}
+
+@keyframes slide-in-left {
+  from {
+    transform: translateX(-100%);
+  }
+  to {
+    transform: translateX(0);
+  }
+}
+
+@keyframes pulse-dot {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.35;
+  }
+}
+
+@layer base {
+  * {
+    border-color: var(--color-border);
+  }
+
+  html {
+    -webkit-text-size-adjust: 100%;
+    -webkit-tap-highlight-color: transparent;
+  }
+
+  body {
+    background-color: var(--color-background);
+    color: var(--color-foreground);
+    font-family:
+      ui-sans-serif, system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue',
+      'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', sans-serif;
+    font-feature-settings: 'cv02', 'cv03', 'cv04', 'cv11';
+    overscroll-behavior-y: none;
+  }
+
+  ::-webkit-scrollbar {
+    width: 10px;
+    height: 10px;
+  }
+
+  ::-webkit-scrollbar-track {
+    background: transparent;
+  }
+
+  ::-webkit-scrollbar-thumb {
+    background: color-mix(in oklab, var(--color-muted-foreground) 35%, transparent);
+    border: 3px solid transparent;
+    background-clip: content-box;
+    border-radius: 999px;
+  }
+
+  ::-webkit-scrollbar-thumb:hover {
+    background: color-mix(in oklab, var(--color-muted-foreground) 55%, transparent);
+    background-clip: content-box;
+  }
+}
+
+@utility safe-bottom {
+  padding-bottom: max(env(safe-area-inset-bottom), 0px);
+}
+
+@utility safe-top {
+  padding-top: max(env(safe-area-inset-top), 0px);
+}
@@ -0,0 +1,36 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+import { Badge } from '@/components/ui'
+import { t } from '@/i18n'
+import type { LiveEvent } from '@/lib/types'
+
+const props = defineProps<{ event: LiveEvent }>()
+
+const variant = computed(() => {
+  if (props.event.kind === 'error') return 'block'
+  if (props.event.kind === 'log') return 'log'
+  switch (props.event.action) {
+    case 'allow':
+      return 'allow'
+    case 'block':
+      return 'block'
+    case 'drop':
+      return 'drop'
+    case 'modify':
+      return 'modify'
+    default:
+      return 'muted'
+  }
+})
+
+const label = computed(() => {
+  if (props.event.kind === 'error') return t('action.error')
+  if (props.event.kind === 'log') return t('action.log')
+  return t(`action.${props.event.action ?? 'maybe'}`)
+})
+</script>
+
+<template>
+  <Badge :variant="variant" class="uppercase">{{ label }}</Badge>
+</template>
@@ -0,0 +1,117 @@
+<script setup lang="ts">
+import { Activity, LayoutDashboard, ListFilter, Radio, Settings2 } from 'lucide-vue-next'
+import { computed, onMounted, onUnmounted } from 'vue'
+import { RouterLink, RouterView, useRoute } from 'vue-router'
+
+import StatusPill from '@/components/StatusPill.vue'
+import { startLive, stopLive } from '@/composables/useLive'
+import { useTheme } from '@/composables/useTheme'
+import { t } from '@/i18n'
+import { cn } from '@/lib/utils'
+
+const route = useRoute()
+useTheme()
+
+const items = computed(() => [
+  { to: '/', label: t('nav.dashboard'), icon: LayoutDashboard },
+  { to: '/events', label: t('nav.events'), icon: Radio },
+  { to: '/rules', label: t('nav.rules'), icon: ListFilter },
+  { to: '/analyzers', label: t('nav.analyzers'), icon: Activity },
+  { to: '/settings', label: t('nav.settings'), icon: Settings2 },
+])
+
+const title = computed(() => {
+  const item = items.value.find((i) => i.to === route.path)
+  return item?.label ?? t('app.name')
+})
+
+onMounted(startLive)
+onUnmounted(stopLive)
+</script>
+
+<template>
+  <div class="bg-background min-h-dvh">
+    <!-- Desktop sidebar -->
+    <aside
+      class="bg-card/40 fixed inset-y-0 left-0 z-40 hidden w-56 flex-col border-r px-3 py-4 md:flex lg:w-60"
+    >
+      <div class="flex items-center gap-2 px-2 pb-4">
+        <div
+          class="bg-primary text-primary-foreground flex size-8 items-center justify-center rounded-lg font-bold"
+        >
+          G
+        </div>
+        <div class="min-w-0">
+          <p class="truncate text-sm font-semibold">{{ t('app.name') }}</p>
+          <p class="text-muted-foreground truncate text-[11px]">{{ t('app.tagline') }}</p>
+        </div>
+      </div>
+
+      <nav class="flex flex-1 flex-col gap-0.5">
+        <RouterLink
+          v-for="item in items"
+          :key="item.to"
+          :to="item.to"
+          :class="
+            cn(
+              'flex items-center gap-2.5 rounded-lg px-2.5 py-2 text-sm font-medium transition-colors',
+              route.path === item.to
+                ? 'bg-accent text-accent-foreground'
+                : 'text-muted-foreground hover:bg-accent/50 hover:text-foreground',
+            )
+          "
+        >
+          <component :is="item.icon" class="size-4 shrink-0" />
+          {{ item.label }}
+        </RouterLink>
+      </nav>
+
+      <div class="px-2 pt-3">
+        <StatusPill />
+      </div>
+    </aside>
+
+    <div class="flex min-h-dvh flex-col md:pl-56 lg:pl-60">
+      <!-- Mobile top bar -->
+      <header
+        class="bg-background/85 safe-top sticky top-0 z-30 border-b backdrop-blur-md md:hidden"
+      >
+        <div class="flex h-12 items-center justify-between gap-3 px-4">
+          <span class="truncate text-sm font-semibold">{{ title }}</span>
+          <StatusPill />
+        </div>
+      </header>
+
+      <main class="flex-1 px-4 pt-4 pb-24 sm:px-6 sm:pt-6 md:pb-8">
+        <RouterView v-slot="{ Component }">
+          <component :is="Component" class="animate-fade-in" />
+        </RouterView>
+      </main>
+    </div>
+
+    <!-- Mobile bottom navigation -->
+    <nav
+      class="bg-background/90 safe-bottom fixed inset-x-0 bottom-0 z-40 border-t backdrop-blur-md md:hidden"
+    >
+      <div class="grid grid-cols-5">
+        <RouterLink
+          v-for="item in items"
+          :key="item.to"
+          :to="item.to"
+          :class="
+            cn(
+              'flex flex-col items-center gap-0.5 py-2 text-[10px] font-medium transition-colors',
+              route.path === item.to ? 'text-foreground' : 'text-muted-foreground',
+            )
+          "
+        >
+          <component
+            :is="item.icon"
+            :class="cn('size-5', route.path === item.to && 'text-primary')"
+          />
+          <span class="truncate">{{ item.label }}</span>
+        </RouterLink>
+      </div>
+    </nav>
+  </div>
+</template>
@@ -0,0 +1,42 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+import { compact } from '@/lib/format'
+import type { NameCount } from '@/lib/types'
+import { cn } from '@/lib/utils'
+
+const props = withDefaults(
+  defineProps<{ items: NameCount[]; tone?: 'primary' | 'block' | 'allow'; empty?: string }>(),
+  { tone: 'primary' },
+)
+
+const max = computed(() => Math.max(1, ...props.items.map((i) => i.count)))
+
+const bars: Record<string, string> = {
+  primary: 'bg-primary/15',
+  block: 'bg-block/15',
+  allow: 'bg-allow/15',
+}
+</script>
+
+<template>
+  <div v-if="props.items.length" class="flex flex-col gap-1">
+    <div
+      v-for="item in props.items"
+      :key="item.name"
+      class="relative flex items-center justify-between gap-3 overflow-hidden rounded-md px-2 py-1.5"
+    >
+      <div
+        :class="cn('absolute inset-y-0 left-0 rounded-md', bars[props.tone])"
+        :style="{ width: `${Math.max(4, (item.count / max) * 100)}%` }"
+      />
+      <span class="relative truncate font-mono text-xs sm:text-[13px]">{{ item.name }}</span>
+      <span class="text-muted-foreground relative shrink-0 text-xs tabular-nums">{{
+        compact(item.count)
+      }}</span>
+    </div>
+  </div>
+  <p v-else class="text-muted-foreground py-6 text-center text-xs">
+    {{ props.empty ?? '—' }}
+  </p>
+</template>
@@ -0,0 +1,46 @@
+<script setup lang="ts">
+import { ArrowRight } from 'lucide-vue-next'
+
+import ActionBadge from '@/components/ActionBadge.vue'
+import { Badge } from '@/components/ui'
+import { endpoint, time } from '@/lib/format'
+import type { LiveEvent } from '@/lib/types'
+
+const props = defineProps<{ event: LiveEvent }>()
+defineEmits<{ select: [event: LiveEvent] }>()
+</script>
+
+<template>
+  <button
+    type="button"
+    class="hover:bg-accent/60 focus-visible:ring-ring/40 flex w-full flex-col gap-1.5 rounded-lg px-2.5 py-2 text-left transition-colors outline-none focus-visible:ring-[3px] sm:flex-row sm:items-center sm:gap-3"
+    @click="$emit('select', props.event)"
+  >
+    <div class="flex items-center gap-2">
+      <span class="text-muted-foreground shrink-0 font-mono text-[11px] tabular-nums">
+        {{ time(props.event.time) }}
+      </span>
+      <ActionBadge :event="props.event" />
+      <Badge :variant="props.event.proto === 'udp' ? 'udp' : 'tcp'" class="uppercase">
+        {{ props.event.proto }}
+      </Badge>
+      <Badge v-if="props.event.rule" variant="outline" class="max-w-32 truncate sm:hidden">
+        {{ props.event.rule }}
+      </Badge>
+    </div>
+
+    <div class="flex min-w-0 flex-1 items-center gap-1.5 font-mono text-xs">
+      <span class="text-muted-foreground truncate">
+        {{ endpoint(props.event.srcIP, props.event.srcPort) }}
+      </span>
+      <ArrowRight class="text-muted-foreground/60 size-3 shrink-0" />
+      <span class="truncate">
+        {{ props.event.host || endpoint(props.event.dstIP, props.event.dstPort) }}
+      </span>
+    </div>
+
+    <Badge v-if="props.event.rule" variant="outline" class="hidden max-w-40 truncate sm:inline-flex">
+      {{ props.event.rule }}
+    </Badge>
+  </button>
+</template>
@@ -0,0 +1,17 @@
+<script setup lang="ts">
+const props = defineProps<{ title: string; description?: string }>()
+</script>
+
+<template>
+  <div class="mb-4 flex flex-wrap items-end justify-between gap-3 sm:mb-6">
+    <div class="min-w-0">
+      <h1 class="text-lg font-semibold tracking-tight sm:text-2xl">{{ props.title }}</h1>
+      <p v-if="props.description" class="text-muted-foreground mt-0.5 text-xs sm:text-sm">
+        {{ props.description }}
+      </p>
+    </div>
+    <div v-if="$slots.actions" class="flex shrink-0 items-center gap-2">
+      <slot name="actions" />
+    </div>
+  </div>
+</template>
@@ -0,0 +1,49 @@
+<script setup lang="ts">
+import type { Component } from 'vue'
+
+import { Card } from '@/components/ui'
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{
+  label: string
+  value: string
+  hint?: string
+  icon?: Component
+  tone?: 'default' | 'allow' | 'block' | 'drop' | 'modify'
+}>()
+
+const tones: Record<string, string> = {
+  default: 'text-muted-foreground',
+  allow: 'text-allow',
+  block: 'text-block',
+  drop: 'text-drop',
+  modify: 'text-modify',
+}
+</script>
+
+<template>
+  <Card class="p-3.5 sm:p-4">
+    <div class="flex items-start justify-between gap-2">
+      <span class="text-muted-foreground text-xs font-medium sm:text-sm">{{ props.label }}</span>
+      <component
+        :is="props.icon"
+        v-if="props.icon"
+        :class="cn('size-4 shrink-0', tones[props.tone ?? 'default'])"
+      />
+    </div>
+    <div class="mt-1.5 flex items-baseline gap-1.5">
+      <span
+        :class="
+          cn(
+            'text-xl font-semibold tracking-tight tabular-nums sm:text-2xl',
+            props.tone && props.tone !== 'default' ? tones[props.tone] : '',
+          )
+        "
+        >{{ props.value }}</span
+      >
+      <span v-if="props.hint" class="text-muted-foreground truncate text-xs">{{
+        props.hint
+      }}</span>
+    </div>
+  </Card>
+</template>
@@ -0,0 +1,49 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+import { useLive } from '@/composables/useLive'
+import { t } from '@/i18n'
+import { cn } from '@/lib/utils'
+
+const { status } = useLive()
+
+const label = computed(() => {
+  switch (status.value) {
+    case 'open':
+      return t('common.live')
+    case 'connecting':
+      return t('common.connecting')
+    default:
+      return t('common.offline')
+  }
+})
+</script>
+
+<template>
+  <span
+    :class="
+      cn(
+        'inline-flex items-center gap-1.5 rounded-full border px-2 py-0.5 text-[11px] font-medium',
+        status === 'open'
+          ? 'border-allow/30 bg-allow/10 text-allow'
+          : status === 'connecting'
+            ? 'border-drop/30 bg-drop/10 text-drop'
+            : 'border-block/30 bg-block/10 text-block',
+      )
+    "
+  >
+    <span
+      :class="
+        cn(
+          'size-1.5 rounded-full',
+          status === 'open'
+            ? 'bg-allow animate-pulse-dot'
+            : status === 'connecting'
+              ? 'bg-drop animate-pulse-dot'
+              : 'bg-block',
+        )
+      "
+    />
+    {{ label }}
+  </span>
+</template>
@@ -0,0 +1,52 @@
+<script setup lang="ts">
+import { CheckCircle2, TriangleAlert, X } from 'lucide-vue-next'
+
+import { dismiss, useToast } from '@/composables/useToast'
+import { cn } from '@/lib/utils'
+
+const { toasts } = useToast()
+</script>
+
+<template>
+  <div
+    class="pointer-events-none fixed inset-x-0 top-0 z-100 flex flex-col items-center gap-2 p-3 sm:top-auto sm:right-0 sm:bottom-0 sm:left-auto sm:items-end sm:p-4"
+  >
+    <TransitionGroup
+      enter-active-class="transition duration-200 ease-out"
+      enter-from-class="opacity-0 -translate-y-2 sm:translate-y-2"
+      leave-active-class="transition duration-150 ease-in absolute"
+      leave-to-class="opacity-0 scale-95"
+    >
+      <div
+        v-for="item in toasts"
+        :key="item.id"
+        :class="
+          cn(
+            'bg-popover text-popover-foreground pointer-events-auto flex w-full max-w-sm items-start gap-2.5 rounded-lg border p-3 shadow-lg',
+            item.variant === 'error' && 'border-block/40',
+            item.variant === 'success' && 'border-allow/40',
+          )
+        "
+      >
+        <CheckCircle2 v-if="item.variant === 'success'" class="text-allow mt-0.5 size-4 shrink-0" />
+        <TriangleAlert
+          v-else-if="item.variant === 'error'"
+          class="text-block mt-0.5 size-4 shrink-0"
+        />
+        <div class="min-w-0 flex-1">
+          <p class="text-sm font-medium">{{ item.title }}</p>
+          <p v-if="item.description" class="text-muted-foreground mt-0.5 text-xs break-words">
+            {{ item.description }}
+          </p>
+        </div>
+        <button
+          type="button"
+          class="text-muted-foreground hover:text-foreground -m-1 p-1"
+          @click="dismiss(item.id)"
+        >
+          <X class="size-3.5" />
+        </button>
+      </div>
+    </TransitionGroup>
+  </div>
+</template>
@@ -0,0 +1,168 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+
+import { t } from '@/i18n'
+import { compact, time } from '@/lib/format'
+import type { Bucket } from '@/lib/types'
+
+const props = defineProps<{ buckets: Bucket[] }>()
+
+const W = 600
+const H = 160
+const PAD_TOP = 8
+const PAD_BOTTOM = 16
+
+const hover = ref<number | null>(null)
+
+const points = computed(() => props.buckets ?? [])
+const max = computed(() => Math.max(1, ...points.value.map((b) => b.tcp + b.udp)))
+const hasData = computed(() => points.value.some((b) => b.tcp + b.udp + b.blocked > 0))
+
+function x(i: number): number {
+  const n = points.value.length
+  return n <= 1 ? 0 : (i / (n - 1)) * W
+}
+
+function y(value: number): number {
+  const usable = H - PAD_TOP - PAD_BOTTOM
+  return PAD_TOP + usable - (value / max.value) * usable
+}
+
+/** Builds a closed area path for a series of stacked values. */
+function area(values: number[]): string {
+  if (values.length === 0) return ''
+  const top = values.map((v, i) => `${i === 0 ? 'M' : 'L'}${x(i).toFixed(1)},${y(v).toFixed(1)}`)
+  const base = `L${W},${y(0)} L0,${y(0)} Z`
+  return top.join(' ') + ' ' + base
+}
+
+function line(values: number[]): string {
+  return values
+    .map((v, i) => `${i === 0 ? 'M' : 'L'}${x(i).toFixed(1)},${y(v).toFixed(1)}`)
+    .join(' ')
+}
+
+const totalPath = computed(() => area(points.value.map((b) => b.tcp + b.udp)))
+const tcpPath = computed(() => area(points.value.map((b) => b.tcp)))
+const blockedPath = computed(() => line(points.value.map((b) => b.blocked)))
+
+const active = computed(() => (hover.value === null ? null : points.value[hover.value]))
+
+function onMove(event: PointerEvent) {
+  const rect = (event.currentTarget as HTMLElement).getBoundingClientRect()
+  const ratio = (event.clientX - rect.left) / rect.width
+  const index = Math.round(ratio * (points.value.length - 1))
+  hover.value = Math.min(points.value.length - 1, Math.max(0, index))
+}
+
+const legend = computed(() => {
+  const sum = (key: 'tcp' | 'udp' | 'blocked') =>
+    points.value.reduce((acc, b) => acc + b[key], 0)
+  return [
+    { label: t('dashboard.tcp'), color: 'bg-tcp', value: sum('tcp') },
+    { label: t('dashboard.udp'), color: 'bg-udp', value: sum('udp') },
+    { label: t('dashboard.blocked'), color: 'bg-block', value: sum('blocked') },
+  ]
+})
+</script>
+
+<template>
+  <div>
+    <div
+      class="relative touch-pan-y"
+      @pointermove="onMove"
+      @pointerdown="onMove"
+      @pointerleave="hover = null"
+    >
+      <svg
+        :viewBox="`0 0 ${W} ${H}`"
+        preserveAspectRatio="none"
+        class="h-36 w-full sm:h-44"
+        role="img"
+      >
+        <line
+          v-for="frac in [0, 0.5, 1]"
+          :key="frac"
+          :x1="0"
+          :x2="W"
+          :y1="y(max * frac)"
+          :y2="y(max * frac)"
+          class="stroke-border"
+          stroke-width="1"
+          vector-effect="non-scaling-stroke"
+          stroke-dasharray="3 4"
+        />
+
+        <path :d="totalPath" class="fill-udp/25" />
+        <path :d="tcpPath" class="fill-tcp/45" />
+        <path
+          :d="blockedPath"
+          class="stroke-block"
+          fill="none"
+          stroke-width="1.75"
+          stroke-linejoin="round"
+          vector-effect="non-scaling-stroke"
+        />
+
+        <template v-if="hover !== null">
+          <line
+            :x1="x(hover)"
+            :x2="x(hover)"
+            :y1="PAD_TOP"
+            :y2="y(0)"
+            class="stroke-foreground/40"
+            stroke-width="1"
+            vector-effect="non-scaling-stroke"
+          />
+        </template>
+      </svg>
+
+      <div
+        class="text-muted-foreground pointer-events-none absolute top-0 left-0 text-[10px] tabular-nums"
+      >
+        {{ compact(max) }}
+      </div>
+
+      <div
+        v-if="active"
+        class="bg-popover pointer-events-none absolute top-1 z-10 rounded-md border px-2 py-1.5 text-[11px] shadow-md"
+        :style="{
+          left: `${(hover! / Math.max(1, points.length - 1)) * 100}%`,
+          transform:
+            hover! / Math.max(1, points.length - 1) > 0.6
+              ? 'translateX(-105%)'
+              : 'translateX(8px)',
+        }"
+      >
+        <div class="text-muted-foreground mb-0.5">{{ time(active.time) }}</div>
+        <div class="flex items-center gap-2 tabular-nums">
+          <span class="bg-tcp size-2 rounded-full" />{{ t('dashboard.tcp') }}
+          <span class="ml-auto font-medium">{{ active.tcp }}</span>
+        </div>
+        <div class="flex items-center gap-2 tabular-nums">
+          <span class="bg-udp size-2 rounded-full" />{{ t('dashboard.udp') }}
+          <span class="ml-auto font-medium">{{ active.udp }}</span>
+        </div>
+        <div class="flex items-center gap-2 tabular-nums">
+          <span class="bg-block size-2 rounded-full" />{{ t('dashboard.blocked') }}
+          <span class="ml-auto font-medium">{{ active.blocked }}</span>
+        </div>
+      </div>
+
+      <div
+        v-if="!hasData"
+        class="text-muted-foreground absolute inset-0 flex items-center justify-center text-xs"
+      >
+        {{ t('dashboard.noTraffic') }}
+      </div>
+    </div>
+
+    <div class="mt-3 flex flex-wrap items-center gap-x-4 gap-y-1">
+      <div v-for="item in legend" :key="item.label" class="flex items-center gap-1.5 text-xs">
+        <span :class="['size-2 rounded-full', item.color]" />
+        <span class="text-muted-foreground">{{ item.label }}</span>
+        <span class="font-medium tabular-nums">{{ compact(item.value) }}</span>
+      </div>
+    </div>
+  </div>
+</template>
@@ -0,0 +1,236 @@
+<script setup lang="ts">
+import { Trash2 } from 'lucide-vue-next'
+import { computed } from 'vue'
+
+import GeoPicker from '@/components/rule/GeoPicker.vue'
+import { Button, Input, Select, TagsInput } from '@/components/ui'
+import { t } from '@/i18n'
+import { explainWildcard } from '@/lib/rule/compile'
+import {
+  FIELDS,
+  FIELD_MAP,
+  PROTO_VALUES,
+  defaultOperator,
+  operatorsFor,
+  type OperatorId,
+} from '@/lib/rule/fields'
+import type { Condition } from '@/lib/rule/types'
+import { validateValue } from '@/lib/rule/validate'
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{
+  condition: Condition
+  /** Analyzer names offered by the "protocol detected" field. */
+  analyzers: string[]
+  removable: boolean
+}>()
+const emit = defineEmits<{
+  update: [condition: Condition]
+  remove: []
+}>()
+
+const field = computed(() => FIELD_MAP[props.condition.field] ?? FIELDS[0])
+
+/** Field keys contain dots, which the translation lookup uses for nesting. */
+const labelKey = (key: string) => `rules.field.${key.replace(/\./g, '_')}`
+
+const fieldOptions = computed(() =>
+  FIELDS.map((f) => ({
+    value: f.key,
+    label: `${t(`rules.group.${f.group}`)} · ${t(labelKey(f.key))}`,
+  })),
+)
+
+const operatorOptions = computed(() =>
+  operatorsFor(field.value).map((op) => ({ value: op, label: t(`rules.op.${op}`) })),
+)
+
+function patch(changes: Partial<Condition>) {
+  emit('update', { ...props.condition, ...changes })
+}
+
+function changeField(key: string) {
+  const next = FIELD_MAP[key]
+  if (!next) return
+  const keepOperator = operatorsFor(next).includes(props.condition.op)
+  patch({
+    field: key,
+    op: keepOperator ? props.condition.op : defaultOperator(next.type),
+    values: keepOperator && next.type === field.value.type ? props.condition.values : [],
+  })
+}
+
+function changeOperator(op: string) {
+  patch({ op: op as OperatorId, values: [] })
+}
+
+function toggleValue(value: string) {
+  const values = props.condition.values.includes(value)
+      ? props.condition.values.filter((v) => v !== value)
+      : [...props.condition.values, value]
+  patch({ values })
+}
+
+const validator = (value: string) => validateValue(field.value.type, props.condition.op, value)
+
+const placeholder = computed(() => {
+  switch (props.condition.op) {
+    case 'cidr':
+      return '10.0.0.0/8, 2001:db8::/32'
+    case 'wildcard':
+      return '*.example.com'
+    case 'regex':
+      return '^/api/v\\d+/'
+    default:
+      break
+  }
+  switch (field.value.type) {
+    case 'ip':
+      return '1.2.3.4'
+    case 'port':
+      return '443'
+    case 'domain':
+      return 'example.com'
+    default:
+      return t('rules.valuePlaceholder')
+  }
+})
+
+/** Human readable explanation of each wildcard pattern. */
+const wildcardHints = computed(() => {
+  if (props.condition.op !== 'wildcard') return []
+  return props.condition.values
+    .filter(Boolean)
+    .slice(0, 4)
+    .map((value) => {
+      const info = explainWildcard(value)
+      return `${value} → ${t(`rules.wildcard.${info.kind}`, { value: info.value })}`
+    })
+})
+</script>
+
+<template>
+  <div class="bg-muted/40 flex flex-col gap-2 rounded-lg border p-2.5">
+    <div class="flex flex-wrap items-center gap-2">
+      <Select
+        :model-value="props.condition.field"
+        :options="fieldOptions"
+        :aria-label="t('rules.builder.field')"
+        class="h-8 min-w-0 flex-1 basis-45 text-xs sm:basis-56"
+        @update:model-value="changeField"
+      />
+      <Select
+        :model-value="props.condition.op"
+        :options="operatorOptions"
+        :aria-label="t('rules.builder.operator')"
+        class="h-8 min-w-0 flex-1 basis-32 text-xs sm:basis-40 sm:flex-none"
+        @update:model-value="changeOperator"
+      />
+      <button
+        type="button"
+        :class="
+          cn(
+            'h-8 shrink-0 rounded-md border px-2 text-xs font-medium transition-colors',
+            condition.negate
+              ? 'border-block/40 bg-block/10 text-block'
+              : 'text-muted-foreground hover:bg-accent',
+          )
+        "
+        :aria-pressed="props.condition.negate"
+        @click="patch({ negate: !props.condition.negate })"
+      >
+        {{ t('rules.builder.not') }}
+      </button>
+      <Button
+        v-if="props.removable"
+        variant="ghost"
+        size="icon-sm"
+        class="text-muted-foreground hover:text-destructive shrink-0"
+        :aria-label="t('common.delete')"
+        @click="emit('remove')"
+      >
+        <Trash2 class="size-3.5" />
+      </Button>
+    </div>
+
+    <!-- Protocol: fixed choices -->
+    <div v-if="field.type === 'proto'" class="flex flex-wrap gap-1.5">
+      <button
+        v-for="value in PROTO_VALUES"
+        :key="value"
+        type="button"
+        :class="
+          cn(
+            'rounded-md border px-2.5 py-1 font-mono text-xs uppercase transition-colors',
+            props.condition.values.includes(value)
+              ? 'border-primary/40 bg-primary/10 text-foreground'
+              : 'text-muted-foreground hover:bg-accent',
+          )
+        "
+        @click="toggleValue(value)"
+      >
+        {{ value }}
+      </button>
+    </div>
+
+    <!-- Protocol detection: analyzer chips -->
+    <div v-else-if="field.type === 'analyzer'" class="flex flex-wrap gap-1.5">
+      <button
+        v-for="name in props.analyzers"
+        :key="name"
+        type="button"
+        :class="
+          cn(
+            'rounded-md border px-2.5 py-1 font-mono text-xs transition-colors',
+            props.condition.values.includes(name)
+              ? 'border-primary/40 bg-primary/10 text-foreground'
+              : 'text-muted-foreground hover:bg-accent',
+          )
+        "
+        @click="toggleValue(name)"
+      >
+        {{ name }}
+      </button>
+    </div>
+
+    <!-- Port range -->
+    <div v-else-if="condition.op === 'range'" class="flex items-center gap-2">
+      <Input
+        :model-value="props.condition.values[0] ?? ''"
+        inputmode="numeric"
+        placeholder="1024"
+        class="h-8 w-28 text-xs"
+        @update:model-value="patch({ values: [$event, props.condition.values[1] ?? ''] })"
+      />
+      <span class="text-muted-foreground text-xs">–</span>
+      <Input
+        :model-value="props.condition.values[1] ?? ''"
+        inputmode="numeric"
+        placeholder="65535"
+        class="h-8 w-28 text-xs"
+        @update:model-value="patch({ values: [props.condition.values[0] ?? '', $event] })"
+      />
+    </div>
+
+    <!-- GeoIP / GeoSite pickers -->
+      <GeoPicker
+        v-else-if="props.condition.op === 'geoip' || props.condition.op === 'geosite'"
+        :model-value="props.condition.values"
+        :kind="props.condition.op"
+        @update:model-value="patch({ values: $event })"
+      />
+
+    <!-- Everything else: a list of values -->
+    <template v-else>
+        <TagsInput
+          :model-value="props.condition.values"
+          :placeholder="placeholder"
+          :validate="validator"
+          @update:model-value="patch({ values: $event })"
+        />
+      <p v-for="hint in wildcardHints" :key="hint" class="text-muted-foreground font-mono text-[11px]">
+        {{ hint }}
+      </p>
+    </template>
+  </div>
+</template>
@@ -0,0 +1,199 @@
+<script setup lang="ts">
+import { Check, ChevronsUpDown, Search, X } from 'lucide-vue-next'
+import {
+  ComboboxAnchor,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxInput,
+  ComboboxItem,
+  ComboboxPortal,
+  ComboboxRoot,
+  ComboboxTrigger,
+  ComboboxViewport,
+} from 'reka-ui'
+import { computed, ref } from 'vue'
+
+import { TagsInput } from '@/components/ui'
+import { useGeo } from '@/composables/useGeo'
+import { t, useI18n } from '@/i18n'
+import { flagOf, regionName } from '@/lib/geo'
+import { cn } from '@/lib/utils'
+
+/**
+ * Multi-select for geoip() country codes and geosite() categories, backed by
+ * the databases the engine actually loaded. Falls back to a plain chip input
+ * when the databases are not available.
+ */
+const props = defineProps<{ modelValue: string[]; kind: 'geoip' | 'geosite' }>()
+const emit = defineEmits<{ 'update:modelValue': [value: string[]] }>()
+
+const { lang } = useI18n()
+const { geo, error, loading, load } = useGeo()
+const search = ref('')
+
+interface Option {
+  value: string
+  label: string
+  hint: string
+  flag: string
+}
+
+const options = computed<Option[]>(() => {
+  const entries = (props.kind === 'geoip' ? geo.value?.ip : geo.value?.site) ?? []
+  const out: Option[] = []
+  for (const entry of entries) {
+    if (props.kind === 'geoip') {
+      const name = regionName(entry.code, lang.value)
+      out.push({
+        value: entry.code,
+        label: name ?? entry.code,
+        hint: `${entry.code.toUpperCase()} · ${entry.count}`,
+        flag: flagOf(entry.code),
+      })
+    } else {
+      out.push({
+        value: entry.code,
+        label: entry.code,
+        hint: String(entry.count),
+        flag: '',
+      })
+      for (const attr of entry.attributes ?? []) {
+        out.push({
+          value: `${entry.code}@${attr}`,
+          label: `${entry.code}@${attr}`,
+          hint: t('rules.geo.attribute'),
+          flag: '',
+        })
+      }
+    }
+  }
+  return out
+})
+
+const filtered = computed(() => {
+  const q = search.value.trim().toLowerCase()
+  const list = q
+    ? options.value.filter((o) => o.value.includes(q) || o.label.toLowerCase().includes(q))
+    : options.value
+  return list.slice(0, 300)
+})
+
+const unavailable = computed(
+  () => !loading.value && options.value.length === 0,
+)
+
+const errorMessage = computed(() =>
+  props.kind === 'geoip' ? error.value.ip : error.value.site,
+)
+
+function remove(value: string) {
+  emit(
+    'update:modelValue',
+    props.modelValue.filter((v) => v !== value),
+  )
+}
+
+function labelOf(value: string): string {
+  const option = options.value.find((o) => o.value === value)
+  if (option) return `${option.flag} ${option.label}`.trim()
+  return value
+}
+
+void load()
+</script>
+
+<template>
+  <div class="flex flex-col gap-1.5">
+    <template v-if="unavailable">
+      <TagsInput
+        :model-value="props.modelValue"
+        :placeholder="props.kind === 'geoip' ? 'cn, us, private' : 'category-ads-all'"
+        @update:model-value="emit('update:modelValue', $event)"
+      />
+      <p class="text-muted-foreground text-xs">
+        {{ t('rules.geo.unavailable') }}
+        <span v-if="errorMessage" class="font-mono">({{ errorMessage }})</span>
+      </p>
+    </template>
+
+    <template v-else>
+      <div v-if="props.modelValue.length" class="flex flex-wrap gap-1.5">
+        <span
+          v-for="value in props.modelValue"
+          :key="value"
+          class="bg-secondary text-secondary-foreground inline-flex items-center gap-1 rounded-md px-1.5 py-0.5 text-xs"
+        >
+          {{ labelOf(value) }}
+          <button
+            type="button"
+            class="opacity-60 transition-opacity hover:opacity-100"
+            :aria-label="t('common.delete')"
+            @click="remove(value)"
+          >
+            <X class="size-3" />
+          </button>
+        </span>
+      </div>
+
+      <p v-if="loading" class="text-muted-foreground text-xs">{{ t('rules.geo.loading') }}</p>
+
+      <ComboboxRoot
+        :model-value="props.modelValue"
+        multiple
+        ignore-filter
+        :reset-search-term-on-blur="false"
+        @update:model-value="emit('update:modelValue', ($event as unknown as string[]) ?? [])"
+      >
+        <ComboboxAnchor
+          class="border-input bg-background focus-within:border-ring focus-within:ring-ring/40 flex h-9 w-full items-center gap-2 rounded-md border px-3 shadow-xs transition-[color,box-shadow] focus-within:ring-[3px]"
+        >
+          <Search class="text-muted-foreground size-4 shrink-0" />
+          <ComboboxInput
+            v-model="search"
+            :placeholder="
+              props.kind === 'geoip' ? t('rules.geo.searchCountry') : t('rules.geo.searchSite')
+            "
+            class="placeholder:text-muted-foreground w-full bg-transparent text-sm outline-none"
+          />
+          <ComboboxTrigger class="text-muted-foreground shrink-0">
+            <ChevronsUpDown class="size-4" />
+          </ComboboxTrigger>
+        </ComboboxAnchor>
+
+        <ComboboxPortal>
+          <ComboboxContent
+            position="popper"
+            :side-offset="4"
+            class="bg-popover text-popover-foreground animate-fade-in z-50 max-h-72 w-[var(--reka-combobox-trigger-width)] overflow-hidden rounded-md border shadow-md"
+          >
+            <ComboboxViewport class="max-h-72 overflow-y-auto p-1">
+              <ComboboxEmpty class="text-muted-foreground px-2 py-4 text-center text-xs">
+                {{ t('common.empty') }}
+              </ComboboxEmpty>
+              <ComboboxItem
+                v-for="option in filtered"
+                :key="option.value"
+                :value="option.value"
+                :class="
+                  cn(
+                    'data-[highlighted]:bg-accent data-[highlighted]:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-sm py-1.5 pr-8 pl-2 text-sm outline-none select-none',
+                  )
+                "
+              >
+                <span v-if="option.flag" class="shrink-0">{{ option.flag }}</span>
+                <span class="truncate">{{ option.label }}</span>
+                <span class="text-muted-foreground ml-auto shrink-0 text-[11px] tabular-nums">
+                  {{ option.hint }}
+                </span>
+                <Check
+                  v-if="props.modelValue.includes(option.value)"
+                  class="absolute right-2 size-4"
+                />
+              </ComboboxItem>
+            </ComboboxViewport>
+          </ComboboxContent>
+        </ComboboxPortal>
+      </ComboboxRoot>
+    </template>
+  </div>
+</template>
@@ -0,0 +1,96 @@
+<script setup lang="ts">
+import { Plus } from 'lucide-vue-next'
+import { computed } from 'vue'
+
+import ConditionRow from '@/components/rule/ConditionRow.vue'
+import { Button } from '@/components/ui'
+import { t } from '@/i18n'
+import { compileRule } from '@/lib/rule/compile'
+import { newCondition, type Condition, type RuleBuilderState } from '@/lib/rule/types'
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ modelValue: RuleBuilderState; analyzers: string[] }>()
+const emit = defineEmits<{ 'update:modelValue': [value: RuleBuilderState] }>()
+
+const expression = computed(() => compileRule(props.modelValue))
+
+function patch(changes: Partial<RuleBuilderState>) {
+  emit('update:modelValue', { ...props.modelValue, ...changes })
+}
+
+function updateCondition(index: number, condition: Condition) {
+  const conditions = [...props.modelValue.conditions]
+  conditions[index] = condition
+  patch({ conditions })
+}
+
+function removeCondition(index: number) {
+  patch({ conditions: props.modelValue.conditions.filter((_, i) => i !== index) })
+}
+
+function addCondition() {
+  patch({ conditions: [...props.modelValue.conditions, newCondition()] })
+}
+</script>
+
+<template>
+  <div class="flex flex-col gap-3">
+    <div class="flex flex-wrap items-center gap-2 text-sm">
+      <span class="text-muted-foreground">{{ t('rules.builder.match') }}</span>
+      <div class="bg-muted inline-flex rounded-md p-0.5">
+        <button
+          v-for="mode in ['and', 'or'] as const"
+          :key="mode"
+          type="button"
+          :class="
+            cn(
+              'rounded-[5px] px-2.5 py-1 text-xs font-medium transition-colors',
+              props.modelValue.mode === mode
+                ? 'bg-background text-foreground shadow-sm'
+                : 'text-muted-foreground hover:text-foreground',
+            )
+          "
+          @click="patch({ mode })"
+        >
+          {{ t(`rules.builder.${mode}`) }}
+        </button>
+      </div>
+      <span class="text-muted-foreground">{{ t('rules.builder.matchSuffix') }}</span>
+    </div>
+
+    <div class="flex flex-col gap-2">
+      <template v-for="(condition, index) in props.modelValue.conditions" :key="condition.id">
+        <div v-if="index > 0" class="flex items-center gap-2">
+          <span class="bg-border h-px flex-1" />
+          <span class="text-muted-foreground text-[11px] font-medium uppercase">
+            {{ t(`rules.builder.${props.modelValue.mode}`) }}
+          </span>
+          <span class="bg-border h-px flex-1" />
+        </div>
+        <ConditionRow
+          :condition="condition"
+          :analyzers="props.analyzers"
+          :removable="props.modelValue.conditions.length > 1"
+          @update="updateCondition(index, $event)"
+          @remove="removeCondition(index)"
+        />
+      </template>
+    </div>
+
+    <Button variant="outline" size="sm" class="w-full" @click="addCondition">
+      <Plus class="size-3.5" />
+      {{ t('rules.builder.addCondition') }}
+    </Button>
+
+    <div class="flex flex-col gap-1">
+      <span class="text-muted-foreground text-xs font-medium">
+        {{ t('rules.builder.preview') }}
+      </span>
+      <code
+        class="bg-muted/60 text-muted-foreground block rounded-md px-2.5 py-2 font-mono text-[11px] leading-relaxed break-all"
+      >
+        {{ expression || t('rules.builder.empty') }}
+      </code>
+    </div>
+  </div>
+</template>
@@ -0,0 +1,39 @@
+<script lang="ts">
+import { cva, type VariantProps } from 'class-variance-authority'
+
+export const badgeVariants = cva(
+  'inline-flex items-center justify-center gap-1 rounded-md border px-1.5 py-0.5 text-[11px] font-medium whitespace-nowrap tabular-nums',
+  {
+    variants: {
+      variant: {
+        default: 'border-transparent bg-primary text-primary-foreground',
+        secondary: 'border-transparent bg-secondary text-secondary-foreground',
+        outline: 'text-foreground',
+        muted: 'border-transparent bg-muted text-muted-foreground',
+        allow: 'border-allow/25 bg-allow/12 text-allow',
+        block: 'border-block/25 bg-block/12 text-block',
+        drop: 'border-drop/25 bg-drop/12 text-drop',
+        modify: 'border-modify/25 bg-modify/12 text-modify',
+        log: 'border-log/25 bg-log/12 text-log',
+        tcp: 'border-tcp/25 bg-tcp/12 text-tcp',
+        udp: 'border-udp/25 bg-udp/12 text-udp',
+      },
+    },
+    defaultVariants: { variant: 'default' },
+  },
+)
+
+export type BadgeVariants = VariantProps<typeof badgeVariants>
+</script>
+
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ variant?: BadgeVariants['variant']; class?: string }>()
+</script>
+
+<template>
+  <span :class="cn(badgeVariants({ variant: props.variant }), props.class)">
+    <slot />
+  </span>
+</template>
@@ -0,0 +1,61 @@
+<script lang="ts">
+import { cva, type VariantProps } from 'class-variance-authority'
+
+export const buttonVariants = cva(
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-[color,box-shadow,background-color] disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 outline-none focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:border-ring active:scale-[0.98] select-none",
+  {
+    variants: {
+      variant: {
+        default: 'bg-primary text-primary-foreground shadow-xs hover:bg-primary/90',
+        destructive:
+          'bg-destructive text-destructive-foreground shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/30',
+        outline:
+          'border border-input bg-background shadow-xs hover:bg-accent hover:text-accent-foreground',
+        secondary: 'bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80',
+        ghost: 'hover:bg-accent hover:text-accent-foreground',
+        link: 'text-primary underline-offset-4 hover:underline',
+      },
+      size: {
+        default: 'h-9 px-4 py-2 has-[>svg]:px-3',
+        sm: 'h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5 text-[13px]',
+        lg: 'h-10 rounded-md px-6 has-[>svg]:px-4',
+        icon: 'size-9',
+        'icon-sm': 'size-8 rounded-md',
+      },
+    },
+    defaultVariants: {
+      variant: 'default',
+      size: 'default',
+    },
+  },
+)
+
+export type ButtonVariants = VariantProps<typeof buttonVariants>
+</script>
+
+<script setup lang="ts">
+import { Primitive, type PrimitiveProps } from 'reka-ui'
+
+import { cn } from '@/lib/utils'
+
+const props = withDefaults(
+  defineProps<
+    PrimitiveProps & {
+      variant?: ButtonVariants['variant']
+      size?: ButtonVariants['size']
+      class?: string
+    }
+  >(),
+  { as: 'button' },
+)
+</script>
+
+<template>
+  <Primitive
+    :as="props.as"
+    :as-child="props.asChild"
+    :class="cn(buttonVariants({ variant: props.variant, size: props.size }), props.class)"
+  >
+    <slot />
+  </Primitive>
+</template>
@@ -0,0 +1,18 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string }>()
+</script>
+
+<template>
+  <div
+    :class="
+      cn(
+        'bg-card text-card-foreground rounded-xl border shadow-sm transition-colors',
+        props.class,
+      )
+    "
+  >
+    <slot />
+  </div>
+</template>
@@ -0,0 +1,11 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string }>()
+</script>
+
+<template>
+  <div :class="cn('px-4 pb-4 sm:px-5 sm:pb-5', props.class)">
+    <slot />
+  </div>
+</template>
@@ -0,0 +1,11 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string }>()
+</script>
+
+<template>
+  <p :class="cn('text-muted-foreground text-xs sm:text-sm', props.class)">
+    <slot />
+  </p>
+</template>
@@ -0,0 +1,11 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string }>()
+</script>
+
+<template>
+  <div :class="cn('flex flex-col gap-1 px-4 pt-4 pb-3 sm:px-5 sm:pt-5', props.class)">
+    <slot />
+  </div>
+</template>
@@ -0,0 +1,11 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string }>()
+</script>
+
+<template>
+  <h3 :class="cn('text-sm leading-none font-semibold tracking-tight sm:text-base', props.class)">
+    <slot />
+  </h3>
+</template>
@@ -0,0 +1,22 @@
+<script setup lang="ts">
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{ class?: string; modelValue?: string | number }>()
+const emit = defineEmits<{ 'update:modelValue': [value: string] }>()
+</script>
+
+<template>
+  <input
+    :value="props.modelValue"
+    :class="
+      cn(
+        'border-input bg-background flex h-9 w-full min-w-0 rounded-md border px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none sm:text-sm',
+        'placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground',
+        'focus-visible:border-ring focus-visible:ring-ring/40 focus-visible:ring-[3px]',
+        'disabled:cursor-not-allowed disabled:opacity-50',
+        props.class,
+      )
+    "
+    @input="emit('update:modelValue', ($event.target as HTMLInputElement).value)"
+  />
+</template>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
mei	1c9daac28d	feat: make install	2026-07-27 11:09:03 +08:00
mei	a6917146b8	fix	2026-07-27 10:45:47 +08:00
meiandClaude Opus 5	f7ad3aac95	feat(web): visual rule builder with geo, CIDR and wildcard pickers The rule editor no longer requires writing expr by hand. Conditions are rows of field + operator + values joined with AND or OR, each row negatable, and the generated expression is shown live and validated by the engine before a rule is accepted. Raw expression and YAML editing are still available. Fields cover the connection (protocol, source/destination IP and port), domains (TLS SNI, QUIC SNI, DNS query name), HTTP (host, path, method, User-Agent) and protocol detection. Operators cover CIDR membership, GeoIP countries, GeoSite categories, port ranges, wildcards, substrings and regular expressions. Multiple values in a row are OR-ed, so one row holds a whole domain or country list. Wildcards compile to the cheapest expression that matches them: .x.com becomes endsWith, x. startsWith, ad contains, and only a star in the middle falls back to a regular expression. Values are validated as they are typed, including a hint when a star is used with an operator that would match it literally. Country and category pickers are backed by the databases the engine actually loaded, via a new GET /api/v1/geo endpoint (cached, loaded on demand) built on new listing methods in the geo package. Country names and flags come from Intl.DisplayNames, so no name table is shipped. Note that the v2geo format has no AS numbers; the provider groups it does contain (cloudflare, google, telegram, ...) are listed alongside the countries. Opening an existing rule parses its expression back into conditions. Anything the builder cannot represent opens in the expression editor with a warning rather than being rewritten. ruleset/expr_test.go pins the canonical expressions the builder generates and compiles them with the real engine, and the devserver now uses the real ruleset compiler so the same errors show up during frontend work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-27 08:48:56 +08:00
meiandClaude Opus 5	5a7722d1d2	feat: add embedded web UI Adds an optional web dashboard served by OpenGFW itself, enabled with a new `web` section in the config file. Backend (web package, decoupled from engine/io so it builds on any OS): - hub.go collects statistics off the engine logger callbacks: atomic counters, two ring-buffered time series (10s and 1min buckets), top N hosts/blocked destinations/rules/analyzers, and a 512 entry event buffer fanned out to connected clients over SSE. Slow clients drop frames instead of blocking the engine. - api.go exposes /api/v1 for info, meta, metrics, events, the SSE stream and ruleset read/validate/replace. - auth.go implements password login with in-memory session tokens and login rate limiting. Mutating endpoints require the bearer token (the session cookie is only accepted for GET), which makes them CSRF-safe. - cmd/web.go implements the rule manager: rules are compiled before anything is written, the file is replaced atomically and the engine is hot reloaded. The SIGHUP handler now shares that same path. - web/devserver serves the UI with synthetic traffic for frontend work on machines where the engine itself cannot be built. Frontend (web/frontend, Vue 3 + Vite + Tailwind CSS v4 + Reka UI): dashboard, live event feed with analyzer property inspection, visual and YAML rule editors, analyzer overview and settings. Responsive down to phone sizes with a bottom tab bar and bottom-sheet dialogs, plus light/dark themes and English/Chinese translations. The built UI in web/dist is committed and embedded with go:embed so that `go build` works without Node; CI builds the frontend and checks that the committed output is up to date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-27 08:09:11 +08:00
Toby	393c29bd2d	Merge pull request #123 from apernet/wip-lookup Quality check / Tests (push) Successful in 9m48s Details Quality check / Static analysis (push) Failing after 12m37s Details feat: dns lookup function	2024-04-07 17:49:33 -07:00
Toby	9c0893c512	feat: added protected dial support, removed multi-IO support for simplicity	2024-04-06 14:42:45 -07:00
Toby	ae34b4856a	feat: dns lookup function	2024-04-03 20:02:57 -07:00
Toby	d7737e9211	Merge pull request #119 from apernet/update-readme docs: update readme feature list	2024-04-01 21:50:07 -07:00
Toby	dd9ecc3dd7	docs: update readme feature list	2024-04-01 21:49:06 -07:00
Toby	980d59ed2e	Merge pull request #118 from apernet/ci-release ci: rework release workflow	2024-04-01 20:55:22 -07:00
Toby	af14adf313	ci: rework release workflow	2024-04-01 20:54:24 -07:00
Toby	ab28fc238d	Merge pull request #114 from KujouRinka/feat-openvpn feat: add openVPN analyzer	2024-04-01 20:47:30 -07:00
Toby	e535769086	fix: make sure rx_pkt_cnt & tx_pkt_cnt both always exist	2024-03-30 14:30:20 -07:00
Toby	ecd60d0ff1	chore: improve case spelling	2024-03-30 13:29:19 -07:00
Toby	98264d9e27	chore: format	2024-03-30 13:23:46 -07:00
Toby	bb5d4e32ff	Merge pull request #116 from apernet/update-trojan feat: further improve trojan detection	2024-03-29 23:19:36 -07:00
Toby	ca574393d3	feat: further improve trojan detection	2024-03-29 23:02:20 -07:00
KujouRinka	0e2ee36865	refactor: merge openvpn_tcp and openvpn_udp to openvpn	2024-03-30 12:00:17 +08:00
Toby	b02738cde8	Merge pull request #115 from apernet/update-readme docs: move to website	2024-03-29 13:08:14 -07:00
Toby	0735fa831d	docs: move to website	2024-03-29 13:06:29 -07:00
KujouRinka	2232b553b3	chore: fix typo	2024-03-29 21:37:09 +08:00
KujouRinka	b2f6dec909	feat: add openVPN analyzer	2024-03-29 20:29:30 +08:00
Toby	47a3c9875c	Merge pull request #112 from apernet/docs-dep docs: update dependency install command for openwrt	2024-03-24 11:42:10 -07:00
Toby	4e604904af	docs: update dependency install command for openwrt	2024-03-24 11:41:17 -07:00
Toby	bf2988116a	Merge pull request #109 from apernet/wip-io-rst feat: io tcp reset support (forward only)	2024-03-21 18:43:43 -07:00
Haruue	ef1416274d	refactor(io): nft/ipt generator func	2024-03-22 02:04:25 +08:00
Toby	57c818038c	feat: io tcp reset support (forward only)	2024-03-20 19:01:26 -07:00
Toby	6ad7714c9a	Merge pull request #108 from apernet/fix-trojan-doc docs: remove trojan-killer ref	2024-03-20 18:41:45 -07:00
Toby	ff9c4ccf79	docs: remove trojan-killer ref	2024-03-20 18:40:49 -07:00
Toby	e1d9406fdb	Merge pull request #107 from apernet/fix-trojan fix: trojan analyzer heuristics	2024-03-20 18:39:05 -07:00
Toby	b8e5079b8a	fix: trojan analyzer heuristics	2024-03-20 18:37:43 -07:00
Toby	f3b72895ad	Merge pull request #106 from apernet/wip-new-trojan feat: new heuristics for trojan analyzer	2024-03-20 18:11:09 -07:00
Toby	0732dfa7a5	docs: no longer use trojan-killer	2024-03-20 18:10:22 -07:00
Toby	9d96acd8db	feat: new heuristics for trojan analyzer	2024-03-20 18:07:26 -07:00
Toby	d1775184ce	Merge pull request #102 from macie/badge_fix docs: Fix status badge URL	2024-03-14 00:37:37 -07:00
macie	05d56616fc	ci: Add readable name for workflow It is visible on Workflows list inside GH Actions tab.	2024-03-14 08:14:30 +01:00
macie	ede70e1a87	docs: Fix badge URL	2024-03-14 08:06:27 +01:00
Toby	920783bd65	Merge pull request #98 from macie/ci CI/CD: New workflow for testing and static analysis	2024-03-13 19:29:36 -07:00
macie	3a45461c19	test: Remove broken integration test This tests fails when there are no specific binary files, but there is no method to get the files during test. Marking the tests as a skipped will gives us a false sense of security. So it's better to remove it at all.	2024-03-12 12:15:10 +01:00
macie	3022bde81b	fix: Linter errors Fixed: - "ineffective break statement. Did you mean to break out of the outer loop?" (SA4011) - "channels used with os/signal.Notify should be buffered" (SA1017) - "os.Kill cannot be trapped (did you mean syscall.SIGTERM?)" (SA1016) - "func envOrDefaultBool is unused" (U1000) - "should use time.Since instead of time.Now().Sub" (S1012)	2024-03-12 12:14:58 +01:00
macie	d98136bac7	ci: Add quality check Runs tests and linters after each commit.	2024-03-11 22:19:26 +01:00
macie	c0e2483f6c	test: Add basic tests for packet parsing Tests performed on real-like packets secure expected behavior.	2024-03-11 21:25:34 +01:00
macie	3bd02ed46e	refactor: Improve parsing docs Reveal intentions by: - extracting magic numbers into constants - changing function names with >1 responsibilities - documenting non-obvious behaviors.	2024-03-11 20:35:01 +01:00
Toby	4257788f33	Merge pull request #92 from apernet/wip-doc-openwrt-ipt docs: instruction for OpenWrt 22.02 or earlier	2024-03-09 09:23:53 -08:00
Haruue	e77c2fabea	docs: instruction for OpenWrt 22.02 or earlier	2024-03-09 21:42:49 +08:00
Toby	1dce82745d	Merge pull request #85 from apernet/wip-buf feat: netlink rcv/snd buffer config options	2024-02-29 11:23:08 -08:00
Toby	50cc94889f	feat: netlink rcv/snd buffer config options	2024-02-28 17:45:24 -08:00
Toby	5d2d874089	Merge pull request #82 from apernet/update-fet feat: update FET analyzer to better reflect what's described in the paper	2024-02-26 15:28:33 -08:00
Toby	797dce3dc2	feat: update FET analyzer to better reflect what's described in the paper	2024-02-26 15:27:35 -08:00
Toby	420286a46c	Merge pull request #81 from apernet/update-gfwreport chore: update gfw report links	2024-02-26 15:17:33 -08:00
Toby	531a7b0ceb	chore: update gfw report links	2024-02-26 15:17:07 -08:00
Toby	20e0637756	Merge pull request #79 from apernet/update-ci fix: release workflow	2024-02-26 10:50:44 -08:00
Toby	74dcc92fc6	fix: release workflow	2024-02-26 10:49:19 -08:00
Toby	b780ff65a4	Merge pull request #76 from apernet/fix-enobufs fix: engine exit with "netlink receive: recvmsg: no buffer space available" when too many packets hit NFQUEUE	2024-02-26 10:40:08 -08:00
Haruue	8bd34d7798	chore: go mod tidy	2024-02-26 16:48:39 +08:00
Haruue	bed34f94be	fix: engine exit when too many packets hit NFQUEUE	2024-02-26 16:46:50 +08:00
Toby	bc2e21e35d	Merge pull request #75 from apernet/fix-missing-verdict fix: verdict is missing for multicast packets	2024-02-26 00:12:42 -08:00
Haruue	a0b994ce22	fix: verdict is missing for multicast packets	2024-02-26 15:45:07 +08:00
Toby	8b07826de6	Merge pull request #71 from apernet/wip-log feat: logging support in ruleset	2024-02-23 19:51:18 -08:00
Toby	aa6484dfa8	Merge pull request #73 from apernet/wip-readme2 docs: update README	2024-02-23 18:31:30 -08:00
Toby	29adf99dc1	docs: update README	2024-02-23 18:31:16 -08:00
Toby	71c739c18f	Merge pull request #72 from apernet/update-readme chore: better README	2024-02-23 15:43:25 -08:00
Toby	182a6cf878	chore: better README	2024-02-23 15:43:08 -08:00
Toby	ed9e380a57	fix: variable support & update example in doc	2024-02-23 14:37:05 -08:00
Toby	7353a16358	feat: logging support in ruleset	2024-02-23 14:13:35 -08:00
Toby	465373eaf1	Merge pull request #66 from apernet/readme-tg docs: add telegram group link	2024-02-17 22:34:56 -08:00
Toby	f598cb572d	docs: add telegram group link	2024-02-17 22:34:38 -08:00
Toby	54f62ce0bb	Merge pull request #64 from apernet/wip-quic feat: QUIC analyzer	2024-02-17 22:08:59 -08:00
Haruue Icymoon	22bbf0d9c7	fix: typo in test	2024-02-18 12:26:03 +08:00
Toby	7e511e94de	fix merge	2024-02-17 14:39:12 -08:00
Toby	e177837301	Merge branch 'master' into wip-quic	2024-02-17 14:38:19 -08:00
Toby	be672a97ab	Merge pull request #65 from apernet/update-gopkt feat: update gopacket to latest master	2024-02-17 14:34:23 -08:00
Toby	5c77cede3d	feat: update gopacket to latest master	2024-02-17 14:28:57 -08:00
RinkaandToby	ebff4308e4	Add CIDR support for expr (#62 ) * feat: add cidr support for expr * docs: add example for cidr * minor code tweaks --------- Co-authored-by: Toby <tobyxdd@gmail.com>	2024-02-17 14:21:12 -08:00
rootmelo92118andToby	94cfe7b2c1	Add the configuration for the path of geoip and geosite. (#57 ) * Update README.md * Update README.zh.md * Update README.ja.md * minor tweaks --------- Co-authored-by: Toby <tobyxdd@gmail.com>	2024-02-17 14:03:50 -08:00
Toby	ef352450a2	docs: add QUIC	2024-02-17 13:56:33 -08:00
Toby	4ede93ce7b	fix: incorrect "virgin" handling causing rules with only built-in keywords to fail (#61 )	2024-02-16 19:08:19 -08:00
Toby	c1e90960dd	feat: quic analyzer (client side only)	2024-02-11 22:25:37 -08:00
Toby	7a52228ec6	docs: add a section about openwrt (#53 )	2024-02-11 13:12:49 -08:00
Toby	6d33a0d51c	fix: incorrect verdict handling that caused packets to pass through even after they had been blocked (#52 )	2024-02-11 13:05:05 -08:00
Toby	27c9b91a61	feat: nftables support (#50 ) * feat: nftables support * fix: format	2024-02-11 13:04:49 -08:00
TAKAHASHI Shuuji	36bb4b796d	docs: update `README.ja.md` (#49 )	2024-02-05 20:44:56 -08:00
Toby	843f17896c	fix: netlink race condition (#48 )	2024-02-05 19:32:52 -08:00
Toby	6871244809	chore: improve built-in funcs handling (#43 )	2024-02-04 11:17:19 -08:00
Toby	f8f0153664	feat: rules hot reload via SIGHUP (#44 )	2024-02-03 10:55:20 -08:00
HaruueandToby	8d94400855	Add WireGuard analyzer (#41 ) * feat: add WireGuard analyzer * chore(wg): reduce map creating for non wg packets * chore: import format * docs: add wg usage --------- Co-authored-by: Toby <tobyxdd@gmail.com>	2024-01-30 18:05:51 -08:00
RinkaandToby	f07a38bc47	Add GeoIP and GeoSite support for expr (#38 ) * feat: copy something from hysteria/extras/outbounds/acl * feat: add geoip and geosite support for expr * refactor: geo matcher * fix: typo * refactor: geo matcher * feat: expose config options to specify local geoip/geosite db files * refactor: engine.Config should not contains geo * feat: make geosite and geoip lazy downloaded * chore: minor code improvement * docs: add geoip/geosite usage --------- Co-authored-by: Toby <tobyxdd@gmail.com>	2024-01-30 17:30:35 -08:00
				`@@ -0,0 +1 @@`
				`The code here is from https://github.com/cuonglm/quicsni with various modifications.`
				`@@ -0,0 +1 @@`
				import{d as o,a as n,e as d,u as e,f as s,H as l,o as p,a8 as c}from"./index-DIqASLVQ.js";const b=c("inline-flex items-center justify-center gap-1 rounded-md border px-1.5 py-0.5 text-[11px] font-medium whitespace-nowrap tabular-nums",{variants:{variant:{default:"border-transparent bg-primary text-primary-foreground",secondary:"border-transparent bg-secondary text-secondary-foreground",outline:"text-foreground",muted:"border-transparent bg-muted text-muted-foreground",allow:"border-allow/25 bg-allow/12 text-allow",block:"border-block/25 bg-block/12 text-block",drop:"border-drop/25 bg-drop/12 text-drop",modify:"border-modify/25 bg-modify/12 text-modify",log:"border-log/25 bg-log/12 text-log",tcp:"border-tcp/25 bg-tcp/12 text-tcp",udp:"border-udp/25 bg-udp/12 text-udp"}},defaultVariants:{variant:"default"}}),g=o({__name:"Badge",props:{variant:{},class:{}},setup(t){const r=t;return(a,u)=>(p(),n("span",{class:d(e(s)(e(b)({variant:r.variant}),r.class))},[l(a.$slots,"default")],2))}});export{g as _};
				`@@ -0,0 +1 @@`
				import{d as a,o as n,a as r,e as c,u as o,f as p,H as l}from"./index-DIqASLVQ.js";const u=a({__name:"CardContent",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("div",{class:c(o(p)("px-4 pb-4 sm:px-5 sm:pb-5",e.class))},[l(t.$slots,"default")],2))}}),d=a({__name:"CardDescription",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("p",{class:c(o(p)("text-muted-foreground text-xs sm:text-sm",e.class))},[l(t.$slots,"default")],2))}}),f=a({__name:"CardHeader",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("div",{class:c(o(p)("flex flex-col gap-1 px-4 pt-4 pb-3 sm:px-5 sm:pt-5",e.class))},[l(t.$slots,"default")],2))}}),i=a({__name:"CardTitle",props:{class:{}},setup(s){const e=s;return(t,m)=>(n(),r("h3",{class:c(o(p)("text-sm leading-none font-semibold tracking-tight sm:text-base",e.class))},[l(t.$slots,"default")],2))}});export{f as _,i as a,d as b,u as c};
				`@@ -0,0 +1 @@`
				import{aB as h,aC as x,m as v,g as p,aD as R,al as S,d as g,aj as b,ap as w,aE as y,x as P,aF as k}from"./index-DIqASLVQ.js";function D(e,l){const t=typeof e=="string"&&!l?`${e}Context`:l,o=Symbol(t);return[a=>{const c=h(o,a);if(c\|\|c===null)return c;throw new Error(`Injection \`${o.toString()}\` not found. Component must be used within ${Array.isArray(e)?`one of the following components: ${e.join(", ")}`:`\`${e}\``}`)},a=>(x(o,a),a)]}function _(){let e=document.activeElement;if(e==null)return null;for(;e!=null&&e.shadowRoot!=null&&e.shadowRoot.activeElement!=null;)e=e.shadowRoot.activeElement;return e}const[A]=D("ConfigProvider");function z(e){const l=A({dir:v("ltr")});return p(()=>{var t;return(e==null?void 0:e.value)\|\|((t=l.dir)==null?void 0:t.value)\|\|"ltr"})}function K(e,l="reka"){var n;let t;const o=A({useId:void 0});return o.useId?t=o.useId():t=(n=R)==null?void 0:n(),l?`${l}-${t}`:t}function I(){const e=v(),l=p(()=>{var t,o;return["#text","#comment"].includes((t=e.value)==null?void 0:t.$el.nodeName)?(o=e.value)==null?void 0:o.$el.nextElementSibling:S(e)});return{primitiveElement:e,currentElement:l}}const $="data-reka-collection-item";function q(e={}){const{key:l="",isProvider:t=!1}=e,o=`${l}CollectionProvider`;let n;if(t){const u=v(new Map);n={collectionRef:v(),itemMap:u},x(o,n)}else n=h(o);const C=(u=!1)=>{const r=n.collectionRef.value;if(!r)return[];const f=Array.from(r.querySelectorAll(`[${$}]`)),m=new Map(f.map((i,E)=>[i,E])),d=Array.from(n.itemMap.value.values()).sort((i,E)=>(m.get(i.ref)??-1)-(m.get(E.ref)??-1));return u?d:d.filter(i=>i.ref.dataset.disabled!=="")},a=g({name:"CollectionSlot",inheritAttrs:!1,setup(u,{slots:r,attrs:f}){const{primitiveElement:m,currentElement:s}=I();return P(s,()=>{n.collectionRef.value=s.value}),()=>w(y,{ref:m,...f},r)}}),c=g({name:"CollectionItem",inheritAttrs:!1,props:{value:{validator:()=>!0}},setup(u,{slots:r,attrs:f}){const{primitiveElement:m,currentElement:s}=I();return b(d=>{if(s.value){const i=k(s.value);n.itemMap.value.set(i,{ref:s.value,value:u.value}),d(()=>n.itemMap.value.delete(i))}}),()=>w(y,{...f,[$]:"",ref:m},r)}}),M=p(()=>Array.from(n.itemMap.value.values())),j=p(()=>n.itemMap.value.size);return{getItems:C,reactiveItems:M,itemMapSize:j,CollectionSlot:a,CollectionItem:c}}export{q as a,z as b,D as c,K as d,_ as g,A as i,I as u};
				`@@ -0,0 +1 @@`
				import{d as c,a as t,b as n,t as i,j as a,H as d,o as s}from"./index-DIqASLVQ.js";const l={class:"mb-4 flex flex-wrap items-end justify-between gap-3 sm:mb-6"},m={class:"min-w-0"},p={class:"text-lg font-semibold tracking-tight sm:text-2xl"},_={key:0,class:"text-muted-foreground mt-0.5 text-xs sm:text-sm"},x={key:0,class:"flex shrink-0 items-center gap-2"},g=c({__name:"PageHeader",props:{title:{},description:{}},setup(r){const e=r;return(o,f)=>(s(),t("div",l,[n("div",m,[n("h1",p,i(e.title),1),e.description?(s(),t("p",_,i(e.description),1)):a("",!0)]),o.$slots.actions?(s(),t("div",x,[d(o.$slots,"actions")])):a("",!0)]))}});export{g as _};
				`@@ -0,0 +1 @@`
				`import{d as a,o as n,a as o,e as t,u as c,f as r}from"./index-DIqASLVQ.js";const u=a({__name:"Skeleton",props:{class:{}},setup(e){const s=e;return(l,m)=>(n(),o("div",{class:t(c(r)("bg-muted animate-pulse rounded-md",s.class))},null,2))}});export{u as _};`
				`@@ -0,0 +1 @@`
				function o(t){if(!Number.isFinite(t))return"0";if(t<1e3)return String(t);const e=["k","M","G","T"];let n=t,r=-1;for(;n>=1e3&&r<e.length-1;)n/=1e3,r++;return`${n>=100?Math.round(n):n.toFixed(1).replace(/\.0$/,"")}${e[r]}`}function i(t,e){return e?Math.round(t/e*100):0}function u(t){if(t<60)return`${Math.max(0,Math.floor(t))}s`;const e=Math.floor(t/86400),n=Math.floor(t%86400/3600),r=Math.floor(t%3600/60);return e>0?`${e}d ${n}h`:n>0?`${n}h ${r}m`:`${r}m`}function a(t){return new Date(t).toLocaleTimeString(void 0,{hour12:!1})}function f(t){const e=new Date(t);return`${e.toLocaleDateString()} ${e.toLocaleTimeString(void 0,{hour12:!1})}`}function c(t,e){return t.includes(":")?`[${t}]:${e}`:`${t}:${e}`}export{f as a,o as c,u as d,c as e,i as p,a as t};