ginuerzh 66960e7dd6 fix(redirect): skip pre-sniffing IP bypass check in whitelist mode ...

Domain-only whitelist bypass never matched the bare destination IP, so the
pre-sniffing bypass check (fe394a8) rejected connections before SNI sniffing
could match the sniffed host (gost#899).

- skip the pre-sniffing check when bypass IsWhitelist(); the sniffer applies
  the whitelist against the sniffed host
- restore the post-sniffing bypass check on dstAddr (removed by fe394a8) so
  whitelist mode still rejects non-matching hosts on the sniffingFallback
  path and when sniffing is disabled
- bypassGroup.IsWhitelist() now reports true only for all-whitelist groups
  instead of always false (sole external consumer is the redirect handler)
- rewrite handler tests to drive a real TLS ClientHello through Init()'d
  metadata: whitelisted SNI is forwarded, non-whitelisted SNI gets ErrBypass

2026-08-31 21:45:28 +08:00

..

plugin

fix(plugin): CloseIdleConnections silent no-op when tokenTransport wraps HTTP transport

2026-05-27 20:37:14 +08:00

bypass_test.go

fix(redirect): skip pre-sniffing IP bypass check in whitelist mode

2026-08-31 21:45:28 +08:00

bypass.go

fix(redirect): skip pre-sniffing IP bypass check in whitelist mode

2026-08-31 21:45:28 +08:00