REALITY server: Refine warnings in parsing configuration

[EnleStars]

*.ru, *.ir, *.cn and apple/icloud/microsoft domains are increasingly abused as REALITY targets. The server IP never matches the domain's real IPs, so national DPI systems (GFW in China, TSPU/RKN in Russia, filtering in Iran) detect the mismatch and block such server IPs in bulk within days. Xray now rejects these targets at config load, so a node fails fast instead of silently getting its IP blocked.

[Fangliding]

1 PR使用中文或英文名
2 不要乱硬编码黑名单啊。。。

[EnleStars]

1 PR使用中文或英文名 2 不要乱硬编码黑名单啊。。。

1. Зачем?
   Было заявление, что XTLS работает на Российский рынок.
   Возможно, стоит выучить язык?
2. Это практика. Вы не проживаете в стране и не можете быть компетентны в этом вопросе.

[RPRX]

.ru 后缀的不几乎都是俄罗斯境内的吗，从境外偷境内的网站是要干嘛

[EnleStars]

.ru 后缀的不几乎都是俄罗斯境内的吗，从境外偷境内的网站是要干嘛

В контексте России стало очень популярно использовать именно локальные .ru, преимущественно государственные.
Сейчас это замечено на каждом крупном сервисе. Такое использование буквально выжирает доступные v4 для использования внутри страны, что сопоставимо с осознанным вредительством.

[Avaritia-ZOV]

.ru 后缀的不几乎都是俄罗斯境内的吗，从境外偷境内的网站是要干嘛

In fact, this PR stunt isn’t entirely pointless. In Russia, many people use these domains to bypass whitelists, although they don’t connect to them from the domain owners’ IP addresses. This is followed by a block on the TSPU, which takes effect after a couple of days or so. This practice has been going on for about a month, perhaps two. IP addresses are blocked in batches.

The funny thing is that this doesn’t help them bypass the whitelists, as their IP addresses aren’t among those associated with these domains.

[Fangliding]

它最开始就是被设计为伪造为一些白名单网站 也有后来的IP和域名不匹配问题 这是reality的固有问题 应该鼓励根据不同的网络状况选择不同的dest 而不是无脑硬编码推荐(列如一些面板和脚本在做的事)或者禁止一些域名

[RPRX]

改成在 apple icloud 前面加上 .ru .ir .cn 提示一下吧，顺便加上 microsoft，不然等 REALITY 更新后又有人偷微软了

[needthisforctf]

Being the voice of reason here: Xray is a networking tool, it implements network protocols. It shouldn't be opinionated, not by this much. Sure, when it comes to privacy of the data, you can disable plaintext options, but actually making a SNI blacklist would hamstring both research and testing use of the tool, as well as practical edge cases like bypassing corporate firewalls in the absence of government censorship of a specific type.

In the worst case that this gets implemented, there at least should be an envvar that communicates “I know what I'm doing” and disables the blacklist.

But, as a whole, I think that the endeavour is pointless. Even if Xray core implements the blocklist, script kiddies will just move to singbox or something, Xray is not the only game in town by a long shot.

[RPRX]

我的看法和上面差不多，尤其是 Xray-core 并不只有“境内连到境外”这一个用途，所以这个 PR 我会改成 warning 而不是 error