Repository navigation
fix: honor desktop process exclusions across DNS and local proxies - #27
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 402f4cdbb0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Excluded Windows applications could still reach the local HTTP/SOCKS listener through system-proxy settings, while their DNS answers came from the remote exit. Launcher selection also deleted explicit child rules, and choosing ERROR in the UI stopped INFO diagnostics from reaching disk.
This change makes exclusions consistent across TUN and local proxy ingress:
223.5.5.5, Tencent DNSPod119.29.29.29, AliDNS223.6.6.6, then adapter/custom fallbacks. Saved resolver settings remain intact. Platform-managed mobile/macOS Network Extension DNS retains its separate proxy path.Merged companion PRs (root gitlinks reference the merged commits; their source trees match the verified branches):
Validation on the maintainer's Windows machine:
cargo test --workspace --locked— 280 passed, 8 ignored (including the child-process helper invoked explicitly by its parent regression).cargo clippy -p proxy-crypto -p proxy-core -p proxy-client -p proxy-server -p proxy-tui -p proxy-ffi --all-targets --all-features --no-deps -- -D warningscargo fmt -p proxy-crypto -p proxy-core -p proxy-client -p proxy-server -p proxy-tui -p proxy-ffi -- --checkcargo check -p proxy-client --no-default-features --lockedcargo check -p proxy-ffi --target aarch64-linux-android --lockedwith local NDK.fvm flutter analyze --no-fatal-infosandfvm flutter test --no-pub— 123 passed, 3 platform skips; analysis has 26 pre-existing informational notices.scripts/windows/build.ps1 -Configuration Debug -Offline -VisualStudioPath <VS2022 BuildTools>passed. Verified CipherRelay.exe, fresh http_proxy.dll, wintun.dll, flutter_windows.dll, plugin files and asset data; the application was never launched.Three local review passes checked ownership/self-loop prevention and live updates; DNS fallback/framing/Fake-IP compatibility and cancellation; then UDP boundaries, reply authorization and logging failure paths. Focused regressions also cover IPv6-only localhost, mapped loopback, UDP peer rollback, a full shutdown queue, and simultaneous readable log files during retention. UDP DNS cache pressure evicts expired/oldest entries individually; fallback DNS failures cannot hide the preceding socket error. The isolated HTTP/SOCKS/UDP test fell from about 25 s to 0.43 s after removing Windows ARP probing. The UDP corruption was reproduced before the fix using simulated packets and exercised through a loopback relay afterward.
Before/after host snapshots confirm the active TUN PID/start time, routes, interface addresses, DNS, system proxy and preferences SHA-256 are unchanged. No live match was running, so this does not claim a completed in-game latency validation. Incoming IP fragment reassembly remains outside this change. Previously deleted executable selections cannot be reconstructed automatically; users should reselect those rules once after upgrading.
Native client/server wire protocol and exported FFI layouts are unchanged. README and
docs/client-usage.mddescribe DNS precedence, platform differences, selection behavior and disk log rotation. This PR does not publish a release or overwrite an installed application.Standalone tun2proxy CI now uses the consumer toolchain and a committed dependency lock (including the same libc version as this workspace). Its legacy external-test matrix captures each parameter combination correctly and explicitly skips unavailable credentials/IPv6 routes. Mobile CI is compilation-only; no package is published.