Merge branch 'dev-next' into renovate/configure

.github/renovate.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "commitMessagePrefix": "[dependencies]",
+  "extends": [
+    "config:base",
+    ":disableRateLimiting"
+  ],
+  "baseBranches": ["dev-next"],
+  "enabledManagers": ["github-actions"],
+  "groupName": "github-actions"
+}

release/config/postinstall.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
 
-mkdir "/var/lib/sing-box"
+mkdir -p /var/lib/sing-box

release/config/postremove.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
 
-rm -rf "/var/lib/sing-box"
+rm -rf /var/lib/sing-box

release/config/sing-box.service

@@ -5,8 +5,8 @@ After=network.target nss-lookup.target
 
 [Service]
 WorkingDirectory=/var/lib/sing-box
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
 ExecStart=/usr/bin/sing-box run -c /etc/sing-box/config.json
 Restart=on-failure
 RestartSec=10s

release/config/sing-box@.service

@@ -5,8 +5,8 @@ After=network.target nss-lookup.target
 
 [Service]
 WorkingDirectory=/var/lib/sing-box-%i
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
 ExecStart=/usr/bin/sing-box run -c /etc/sing-box/%i.json
 Restart=on-failure
 RestartSec=10s

release/local/install.sh

@@ -14,6 +14,7 @@ go install -v -trimpath -ldflags "-s -w -buildid=" -tags with_quic,with_wireguar
 popd
 
 sudo cp $(go env GOPATH)/bin/sing-box /usr/local/bin/
+sudo mkdir -p /var/lib/sing-box
 sudo mkdir -p /usr/local/etc/sing-box
 sudo cp $PROJECT/release/config/config.json /usr/local/etc/sing-box/config.json
 sudo cp $DIR/sing-box.service /etc/systemd/system

release/local/install_go.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 set -e -o pipefail
-curl -Lo go.tar.gz https://go.dev/dl/go1.19.3.linux-amd64.tar.gz
+curl -Lo go.tar.gz https://go.dev/dl/go1.20.linux-amd64.tar.gz
 sudo rm -rf /usr/local/go
 sudo tar -C /usr/local -xzf go.tar.gz
 rm go.tar.gz

release/local/sing-box.service

@@ -5,8 +5,8 @@ After=network.target nss-lookup.target
 
 [Service]
 WorkingDirectory=/var/lib/sing-box
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
 ExecStart=/usr/local/bin/sing-box run -c /usr/local/etc/sing-box/config.json
 Restart=on-failure
 RestartSec=10s

release/local/uninstall.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
 sudo systemctl stop sing-box
+sudo rm -rf /var/lib/sing-box
 sudo rm -rf /usr/local/bin/sing-box
 sudo rm -rf /usr/local/etc/sing-box
 sudo rm -rf /etc/systemd/system/sing-box.service

transport/hysteria/protocol.go

@@ -293,6 +293,10 @@ func ParseUDPMessage(packet []byte) (message UDPMessage, err error) {
 	if err != nil {
 		return
 	}
+	if 6+int(hostLen) > len(packet) {
+		err = E.New("invalid host length")
+		return
+	}
 	message.Host = string(packet[6 : 6+hostLen])
 	err = binary.Read(reader, binary.BigEndian, &message.Port)
 	if err != nil {