Malformed domain in the inbound request causes a panic

[etidart]

Integrity requirements

• I have read all the comments in the issue template and ensured that this issue meet the requirements.
• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

On latest release, when there is an inbound request (tested only with socks inbound with sniffing enabled, see config) with malformed domain name (tested only with .google.com, see logs), a panic occurs if xray decides to lookup the ip of this malformed domain.

So, if xray needs an ip to match against a rule (tested, provided in the config) or to pass it to the outbound which accepts only ip (not tested) it panics. Else it will just pass this malformed domain to further xray instances and first of them which will try to lookup the ip will panic.

The expected behavior is to reject that malformed request. Ideally, even before trying to get the ip of its domain.

Reproduction Method

1. Run xray with provided config.
2. Run firefox with proxy configuration set to use the socks5 inbound of xray specified in config. Mark "proxy dns when using socks5" there.
3. Try to open https://.google.com using firefox.

Client config

Details

{
  "log": {
    "loglevel": "debug",
    "dnsLog": true
  },
  "inbounds": [
    {
      "tag": "socks",
      "port": 1080,
      "listen": "127.0.0.1",
      "protocol": "socks",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls"
        ],
        "routeOnly": false
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "socks",
      "settings": {
        "servers": [
        {
          "address": "127.0.0.1",
          "port": 10808
        }
      ]
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      }
    }
  ],
  "dns": {
    "hosts": {
      "dns.google": "8.8.8.8",
      "proxy.example.com": "127.0.0.1"
    },
    "servers": [
      "1.1.1.1",
      "8.8.8.8",
      "https://dns.google/dns-query"
    ]
  },
  "routing": {
    "domainStrategy": "IPOnDemand",
    "rules": [
      {
        "type": "field",
        "outboundTag": "block",
        "ip": [
          "geoip:private"
        ]
      },
      {
        "type": "field",
        "port": "0-65535",
        "outboundTag": "proxy"
      }
    ]
  }
}

Server config

not relevant

Client log

Details

Xray 25.12.8 (Xray, Penetrates Everything.) 81f8f39 (go1.25.5 linux/amd64)
A unified platform for anti-censorship.
2026/01/08 18:22:59.241908 [Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
2026/01/08 18:22:59.256042 [Debug] app/log: Logger started
2026/01/08 18:22:59.256057 [Info] app/dns: DNS: created UDP client initialized for 1.1.1.1:53
2026/01/08 18:22:59.256060 [Info] app/dns: DNS: created UDP client initialized for 8.8.8.8:53
2026/01/08 18:22:59.256071 [Info] app/dns: DNS: created DOH client for https://dns.google/dns-query, with h2c false
2026/01/08 18:22:59.256190 [Debug] app/proxyman/inbound: creating stream worker on 127.0.0.1:1080
2026/01/08 18:22:59.256341 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:1080
2026/01/08 18:22:59.256350 [Info] transport/internet/udp: listening UDP on 127.0.0.1:1080
2026/01/08 18:22:59.256421 [Warning] core: Xray 25.12.8 started
/* irrelevant part removed */
2026/01/08 18:23:10.200430 [Info] [771316978] proxy/socks: TCP Connect request to tcp:.google.com:443
2026/01/08 18:23:10.200998 [Info] [771316978] app/dispatcher: sniffed domain: .google.com
2026/01/08 18:23:10.201017 [Debug] app/dns: domain .google.com will use DNS in order: [UDP:1.1.1.1:53 UDP:8.8.8.8:53 DOH//dns.google]
2026/01/08 18:23:10.201020 [Info] app/dns: UDP:1.1.1.1:53 querying DNS for: .google.com.
panic: runtime error: invalid memory address or nil pointer dereference
	runtime/debug.Stack(...)
		runtime/debug/stack.go:26
	golang.org/x/sync/singleflight.newPanicError(...)
		golang.org/x/sync@v0.18.0/singleflight/singleflight.go:44
	golang.org/x/sync/singleflight.(*Group).doCall.func2.1()
		golang.org/x/sync@v0.18.0/singleflight/singleflight.go:193 +0xa5
	panic({0x14c43a0?, 0x2487c00?})
		runtime/panic.go:783 +0x455
	github.com/xtls/xray-core/app/dns.(*ClassicNameServer).sendQuery(0xc000280600, {0x19a0090, 0xc0005d0030}, 0x197dc60?, {0xc000012860, 0xc}, {0x0?, 0x0?, 0x0?})
		github.com/xtls/xray-core/app/dns/nameserver_udp.go:176 +0x389
	github.com/xtls/xray-core/app/dns.doFetch({0x19a0090, 0xc0005d0030}, {0x1995000, 0xc000280600}, {0xc000012860, 0xc}, {0x5?, 0x0?, 0x0?})
		github.com/xtls/xray-core/app/dns/nameserver_cached.go:103 +0x284
	github.com/xtls/xray-core/app/dns.queryIP.fetch.func1()
		github.com/xtls/xray-core/app/dns/nameserver_cached.go:69 +0x46
	golang.org/x/sync/singleflight.(*Group).doCall.func2(0xc00064d17e, 0xc00152e960, 0x2?)
		golang.org/x/sync@v0.18.0/singleflight/singleflight.go:198 +0x55
	golang.org/x/sync/singleflight.(*Group).doCall(0x1501940?, 0xc0003028d0?, {0xc000012870?, 0xe?}, 0xc?)
		golang.org/x/sync@v0.18.0/singleflight/singleflight.go:200 +0x7e
	golang.org/x/sync/singleflight.(*Group).Do(0xc0000e90f8, {0xc000012870, 0xe}, 0xc00064d310)
		golang.org/x/sync@v0.18.0/singleflight/singleflight.go:113 +0x149
	github.com/xtls/xray-core/app/dns.fetch(...)
		github.com/xtls/xray-core/app/dns/nameserver_cached.go:68
	github.com/xtls/xray-core/app/dns.queryIP({0x19a0090, 0xc0005d0030}, {0x1995000, 0xc000280600}, {0xc000012820?, 0xb?}, {0x1?, 0x0?, 0x0?})
		github.com/xtls/xray-core/app/dns/nameserver_cached.go:47 +0x725
	github.com/xtls/xray-core/app/dns.(*ClassicNameServer).QueryIP(0x19a0090?, {0x19a0090?, 0xc0005d0030?}, {0xc000012820?, 0x0?}, {0xc0?, 0x9b?, 0x4e?})
		github.com/xtls/xray-core/app/dns/nameserver_udp.go:183 +0x45
	github.com/xtls/xray-core/app/dns.(*Client).QueryIP(0xc0016c3e60, {0x19a0090?, 0xc000322810?}, {0xc000012820, 0xb}, {0x40?, 0x28?, 0x32?})
		github.com/xtls/xray-core/app/dns/nameserver.go:234 +0x263
	github.com/xtls/xray-core/app/dns.(*DNS).serialQuery(0xc001339e00, {0xc000012820, 0xb}, {0x5?, 0x9f?, 0x4a?})
		github.com/xtls/xray-core/app/dns/dns.go:351 +0x2ae
	github.com/xtls/xray-core/app/dns.(*DNS).LookupIP(0xc001339e00, {0xc000012820, 0xb?}, {0xb0?, 0x67?, 0x63?})
		github.com/xtls/xray-core/app/dns/dns.go:251 +0x514
	github.com/xtls/xray-core/features/routing/dns.(*ResolvableContext).GetTargetIPs(0xc0001f49c0)
		github.com/xtls/xray-core/features/routing/dns/context.go:31 +0x7a
	github.com/xtls/xray-core/app/router.(*IPMatcher).Apply(0xc000511218, {0x19afa88?, 0xc0001f49c0?})
		github.com/xtls/xray-core/app/router/condition.go:117 +0x3c
	github.com/xtls/xray-core/app/router.(*ConditionChan).Apply(0x18?, {0x19afa88, 0xc0001f49c0})
		github.com/xtls/xray-core/app/router/condition.go:32 +0x5c
	github.com/xtls/xray-core/app/router.(*Rule).Apply(...)
		github.com/xtls/xray-core/app/router/config.go:29
	github.com/xtls/xray-core/app/router.(*Router).pickRouteInternal(0xc0000e8ee0, {0x19afc20, 0xc0013b8810})
		github.com/xtls/xray-core/app/router/router.go:195 +0x16b
	github.com/xtls/xray-core/app/router.(*Router).PickRoute(0x19a0090?, {0x19afc20?, 0xc0013b8810?})
		github.com/xtls/xray-core/app/router/router.go:83 +0x25
	github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).routedDispatch(0xc00152f900, {0x19a0090, 0xc0003a69f0}, 0xc0000a6b20, {{0x19a0170, 0xc00004e700}, 0x1bb, 0x2})
		github.com/xtls/xray-core/app/dispatcher/default.go:474 +0x1c8
	github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).DispatchLink(0xc00152f900, {0x19a0090, 0xc0003a69f0}, {{0x19a0170?, 0xc00013eb20?}, 0xe000?, 0x0?}, 0xc0000a6b20)
		github.com/xtls/xray-core/app/dispatcher/default.go:391 +0x825
	github.com/xtls/xray-core/common/mux.(*Server).DispatchLink(0xc00004e820?, {0x19a0090?, 0xc0003a69f0?}, {{0x19a0170?, 0xc00013eb20?}, 0x6ae0?, 0xc0?}, 0xc0000a6b20?)
		github.com/xtls/xray-core/common/mux/server.go:64 +0x107
	github.com/xtls/xray-core/proxy/socks.(*Server).processTCP(0xc000323bf0, {0x19a0090, 0xc0003a6870}, {0x19a82a0, 0xc00007e2a8}, {0x19a2b60, 0xc00004e820}, {0xc000136b3c, 0x1, 0x1})
		github.com/xtls/xray-core/proxy/socks/server.go:163 +0xc29
	github.com/xtls/xray-core/proxy/socks.(*Server).Process(0xc000323bf0, {0x19a0090, 0xc0003a6870}, 0x2, {0x19a82a0, 0xc00007e2a8}, {0x19a2b60, 0xc00004e820})
		github.com/xtls/xray-core/proxy/socks/server.go:96 +0x38f
	github.com/xtls/xray-core/app/proxyman/inbound.(*tcpWorker).callback(0xc000369b80, {0x19a82a0, 0xc00007e2a8})
		github.com/xtls/xray-core/app/proxyman/inbound/worker.go:129 +0xce3
	created by github.com/xtls/xray-core/app/proxyman/inbound.(*tcpWorker).Start.func1 in goroutine 187
		github.com/xtls/xray-core/app/proxyman/inbound/worker.go:143 +0x7a
goroutine 188 [running]:

golang.org/x/sync/singleflight.(*Group).doCall.func1()

golang.org/x/sync@v0.18.0/singleflight/singleflight.go:170 +0x2b2

golang.org/x/sync/singleflight.(*Group).doCall(0x1501940?, 0xc0003028d0?, {0xc000012870?, 0xe?}, 0xc?)

golang.org/x/sync@v0.18.0/singleflight/singleflight.go:205 +0x99

golang.org/x/sync/singleflight.(*Group).Do(0xc0000e90f8, {0xc000012870, 0xe}, 0xc00064d310)

golang.org/x/sync@v0.18.0/singleflight/singleflight.go:113 +0x149

github.com/xtls/xray-core/app/dns.fetch(...)

github.com/xtls/xray-core/app/dns/nameserver_cached.go:68

github.com/xtls/xray-core/app/dns.queryIP({0x19a0090, 0xc0005d0030}, {0x1995000, 0xc000280600}, {0xc000012820?, 0xb?}, {0x1?, 0x0?, 0x0?})

github.com/xtls/xray-core/app/dns/nameserver_cached.go:47 +0x725

github.com/xtls/xray-core/app/dns.(*ClassicNameServer).QueryIP(0x19a0090?, {0x19a0090?, 0xc0005d0030?}, {0xc000012820?, 0x0?}, {0xc0?, 0x9b?, 0x4e?})

github.com/xtls/xray-core/app/dns/nameserver_udp.go:183 +0x45

github.com/xtls/xray-core/app/dns.(*Client).QueryIP(0xc0016c3e60, {0x19a0090?, 0xc000322810?}, {0xc000012820, 0xb}, {0x40?, 0x28?, 0x32?})

github.com/xtls/xray-core/app/dns/nameserver.go:234 +0x263

github.com/xtls/xray-core/app/dns.(*DNS).serialQuery(0xc001339e00, {0xc000012820, 0xb}, {0x5?, 0x9f?, 0x4a?})

github.com/xtls/xray-core/app/dns/dns.go:351 +0x2ae

github.com/xtls/xray-core/app/dns.(*DNS).LookupIP(0xc001339e00, {0xc000012820, 0xb?}, {0xb0?, 0x67?, 0x63?})

github.com/xtls/xray-core/app/dns/dns.go:251 +0x514

github.com/xtls/xray-core/features/routing/dns.(*ResolvableContext).GetTargetIPs(0xc0001f49c0)

github.com/xtls/xray-core/features/routing/dns/context.go:31 +0x7a

github.com/xtls/xray-core/app/router.(*IPMatcher).Apply(0xc000511218, {0x19afa88?, 0xc0001f49c0?})

github.com/xtls/xray-core/app/router/condition.go:117 +0x3c

github.com/xtls/xray-core/app/router.(*ConditionChan).Apply(0x18?, {0x19afa88, 0xc0001f49c0})

github.com/xtls/xray-core/app/router/condition.go:32 +0x5c

github.com/xtls/xray-core/app/router.(*Rule).Apply(...)

github.com/xtls/xray-core/app/router/config.go:29

github.com/xtls/xray-core/app/router.(*Router).pickRouteInternal(0xc0000e8ee0, {0x19afc20, 0xc0013b8810})

github.com/xtls/xray-core/app/router/router.go:195 +0x16b

github.com/xtls/xray-core/app/router.(*Router).PickRoute(0x19a0090?, {0x19afc20?, 0xc0013b8810?})

github.com/xtls/xray-core/app/router/router.go:83 +0x25

github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).routedDispatch(0xc00152f900, {0x19a0090, 0xc0003a69f0}, 0xc0000a6b20, {{0x19a0170, 0xc00004e700}, 0x1bb, 0x2})

github.com/xtls/xray-core/app/dispatcher/default.go:474 +0x1c8

github.com/xtls/xray-core/app/dispatcher.(*DefaultDispatcher).DispatchLink(0xc00152f900, {0x19a0090, 0xc0003a69f0}, {{0x19a0170?, 0xc00013eb20?}, 0xe000?, 0x0?}, 0xc0000a6b20)

github.com/xtls/xray-core/app/dispatcher/default.go:391 +0x825

github.com/xtls/xray-core/common/mux.(*Server).DispatchLink(0xc00004e820?, {0x19a0090?, 0xc0003a69f0?}, {{0x19a0170?, 0xc00013eb20?}, 0x6ae0?, 0xc0?}, 0xc0000a6b20?)

github.com/xtls/xray-core/common/mux/server.go:64 +0x107

github.com/xtls/xray-core/proxy/socks.(*Server).processTCP(0xc000323bf0, {0x19a0090, 0xc0003a6870}, {0x19a82a0, 0xc00007e2a8}, {0x19a2b60, 0xc00004e820}, {0xc000136b3c, 0x1, 0x1})

github.com/xtls/xray-core/proxy/socks/server.go:163 +0xc29

github.com/xtls/xray-core/proxy/socks.(*Server).Process(0xc000323bf0, {0x19a0090, 0xc0003a6870}, 0x2, {0x19a82a0, 0xc00007e2a8}, {0x19a2b60, 0xc00004e820})

github.com/xtls/xray-core/proxy/socks/server.go:96 +0x38f

github.com/xtls/xray-core/app/proxyman/inbound.(*tcpWorker).callback(0xc000369b80, {0x19a82a0, 0xc00007e2a8})

github.com/xtls/xray-core/app/proxyman/inbound/worker.go:129 +0xce3

created by github.com/xtls/xray-core/app/proxyman/inbound.(*tcpWorker).Start.func1 in goroutine 187

github.com/xtls/xray-core/app/proxyman/inbound/worker.go:143 +0x7a

Server log

not relavant

[Fangliding]

尝试 https://github.com/XTLS/Xray-core/actions/runs/20842433886

[etidart]

That patch indeed fixes panic but is it intentional that this malformed request still forwarded to the next xray instance and causes a panic there? This may cause some problems as even if the client instance will have this patch, it is not likely that the server instance will.

Logs:

Details

Xray 25.12.8 (Xray, Penetrates Everything.) ff00118 (go1.25.5 linux/amd64)
A unified platform for anti-censorship.
2026/01/09 11:45:57.069810 [Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
2026/01/09 11:45:57.072103 [Debug] app/log: Logger started
2026/01/09 11:45:57.072115 [Info] app/dns: DNS: created UDP client initialized for 1.1.1.1:53
2026/01/09 11:45:57.072118 [Info] app/dns: DNS: created UDP client initialized for 8.8.8.8:53
2026/01/09 11:45:57.072128 [Info] app/dns: DNS: created DOH client for https://dns.google/dns-query, with h2c false
2026/01/09 11:45:57.072522 [Debug] app/proxyman/inbound: creating stream worker on 127.0.0.1:1080
2026/01/09 11:45:57.072622 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:1080
2026/01/09 11:45:57.072652 [Info] transport/internet/udp: listening UDP on 127.0.0.1:1080
2026/01/09 11:45:57.072904 [Warning] core: Xray 25.12.8 started
2026/01/09 11:46:15.402929 [Info] [2126362598] proxy/socks: TCP Connect request to tcp:.google.com:443
2026/01/09 11:46:15.403663 [Info] [2126362598] app/dispatcher: sniffed domain: .google.com
2026/01/09 11:46:15.403679 [Debug] app/dns: domain .google.com will use DNS in order: [UDP:1.1.1.1:53 UDP:8.8.8.8:53 DOH//dns.google]
2026/01/09 11:46:15.403687 [Info] app/dns: failed to lookup ip for domain .google.com at server UDP:1.1.1.1:53 in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:15.403690 [Info] app/dns: failed to lookup ip for domain .google.com at server UDP:8.8.8.8:53 in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:15.403693 [Info] app/dns: failed to lookup ip for domain .google.com at server DOH//dns.google in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:15.403697 [Info] features/routing/dns: resolve ip for .google.com > app/dns: returning nil for domain .google.com > multierr: app/dns: invalid domain: starts with dot | app/dns: invalid domain: starts with dot | app/dns: invalid domain: starts with dot |
2026/01/09 11:46:15.403703 [Info] [2126362598] app/dispatcher: taking detour [proxy] for [tcp:.google.com:443]
2026/01/09 11:46:15.403707 [Info] [2126362598] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:15.403709 [Debug] [2126362598] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:15.403715 from tcp:127.0.0.1:45722 accepted tcp:.google.com:443 [socks -> proxy]
2026/01/09 11:46:16.410981 [Info] [2309576317] proxy/socks: TCP Connect request to tcp:.google.com:443
2026/01/09 11:46:16.411379 [Info] [2309576317] app/dispatcher: sniffed domain: .google.com
2026/01/09 11:46:16.411389 [Debug] app/dns: domain .google.com will use DNS in order: [UDP:1.1.1.1:53 UDP:8.8.8.8:53 DOH//dns.google]
2026/01/09 11:46:16.411394 [Info] app/dns: failed to lookup ip for domain .google.com at server UDP:1.1.1.1:53 in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:16.411396 [Info] app/dns: failed to lookup ip for domain .google.com at server UDP:8.8.8.8:53 in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:16.411398 [Info] app/dns: failed to lookup ip for domain .google.com at server DOH//dns.google in serial query mode > app/dns: invalid domain: starts with dot
2026/01/09 11:46:16.411403 [Info] features/routing/dns: resolve ip for .google.com > app/dns: returning nil for domain .google.com > multierr: app/dns: invalid domain: starts with dot | app/dns: invalid domain: starts with dot | app/dns: invalid domain: starts with dot |
2026/01/09 11:46:16.411407 [Info] [2309576317] app/dispatcher: taking detour [proxy] for [tcp:.google.com:443]
2026/01/09 11:46:16.411410 [Info] [2309576317] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:16.411412 [Debug] [2309576317] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:16.411418 from tcp:127.0.0.1:45738 accepted tcp:.google.com:443 [socks -> proxy]
2026/01/09 11:46:16.411481 [Info] [2309576317] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:16.411487 [Debug] [2309576317] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:16.511796 [Info] [2309576317] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:16.511807 [Debug] [2309576317] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:16.712289 [Info] [2309576317] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:16.712303 [Debug] [2309576317] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:17.012628 [Info] [2309576317] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:10808
2026/01/09 11:46:17.012641 [Debug] [2309576317] transport/internet: dialing to tcp:127.0.0.1:10808
2026/01/09 11:46:17.413295 [Info] [2309576317] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/socks: failed to find an available destination > common/retry: [dial tcp 127.0.0.1:10808: connect: connection refused] > common/retry: all retry attempts failed
2026/01/09 11:46:46.561836 [Debug] app/log: Logger closing

[Fangliding]

我想尽量保持地址字段是自由的字节内容不加以限制 只要它不要崩溃就好了