Skip to content

v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 15:53
v1.4.0
ee5a5f5

Aether v1.4.0

Aether is a user-space proxy client. It tunnels traffic out of a filtered network and exposes a local SOCKS5 proxy on 127.0.0.1:1819. Point a browser, terminal, or system proxy at that address and your traffic leaves through the tunnel.

What's new in v1.4.0:

  • Security fix: MASQUE connections now verify the Cloudflare edge certificate against pinned SPKI hashes instead of skipping verification entirely. Before this, anyone able to intercept the connection could present a fake certificate and the client would accept it silently. Both the HTTP/3 and HTTP/2 transports are covered.
  • Fixed WireGuard and WARP-in-WARP (gool) reporting "connected" while the tunnel was actually dead. Both now run a continuous health check and reconnect automatically if no real data has come back from the peer for a while, instead of sitting there silently with a socks5 proxy that leads nowhere.
  • Fixed a memory/task leak in WireGuard, MASQUE HTTP/2, and MASQUE HTTP/3: every reconnect used to leave old background tasks running instead of shutting them down, so long-running sessions with frequent drops would slowly pile up idle tasks and memory.
  • gool (WARP-in-WARP) now reconnects automatically like the other two modes. Previously, if the outer tunnel dropped, the whole process just exited.
  • --log-level replaces the old all-or-nothing --verbose. Pick error, warn, info, debug or trace. info stays quiet, debug adds tunnel internals useful for troubleshooting, trace adds full per-packet detail. --verbose still works as a shortcut for debug.
  • Aether now reads the machine's CPU count and RAM at startup and scales scan concurrency, socket buffers, and internal queue sizes accordingly, so it doesn't hog resources on a router or a small board. Override with --perf low|medium|high if you want to force it.
  • New fully static builds for x86_64 and aarch64 musl, on top of the existing armv7 musl build. Covers OpenWrt on x86_64/arm64 boxes and Raspberry Pi 4/5 running a musl userland.

This release includes prebuilt binaries for:

  • Linux x86_64, built on Fedora latest (aether-linux-x86_64.tar.gz)
  • Linux arm64 / aarch64, built on Fedora latest (aether-linux-arm64.tar.gz)
  • Linux armv7 / 32-bit ARM, e.g. Raspberry Pi 2/3 (aether-linux-armv7.tar.gz)
  • Linux armv7 musl / 32-bit ARM, fully static, for OpenWrt routers and other musl-based systems (aether-linux-armv7-musl.tar.gz)
  • Linux x86_64 musl, fully static, for OpenWrt and other musl-based x86_64 systems (aether-linux-x86_64-musl.tar.gz)
  • Linux aarch64 musl, fully static, for OpenWrt arm64 and Raspberry Pi 4/5 (aether-linux-aarch64-musl.tar.gz)
  • macOS arm64 / Apple Silicon (aether-macos-arm64.tar.gz)
  • macOS x86_64 / Intel (aether-macos-x86_64.tar.gz)
  • Windows x86_64 (aether-windows-x86_64.zip)
  • Android / Termux arm64 (aether-android-arm64.tar.gz)
  • Android / Termux armv7 (aether-android-armv7.tar.gz)
  • Android / Termux x86_64 (aether-android-x86_64.tar.gz)

Each archive ships with a matching .sha256 file, and a combined SHA256SUMS.txt lists every checksum.

Quick start (Termux, one-line install):

curl -fsSL https://raw.githubusercontent.com/CluvexStudio/aether/main/aether.sh -o aether.sh && chmod +x aether.sh && ./aether.sh install

Quick start (Windows):

  1. Download aether-windows-x86_64.zip and extract it.
  2. Double-click run-aether.bat. It opens a terminal, runs aether.exe, and stays open afterwards so you can read any errors.

Quick start (other platforms):

  1. Download the archive for your platform and extract it.
  2. Run the binary and answer the prompts, or set the environment variables listed in the guides.
  3. Point your client at socks5h://127.0.0.1:1819 and verify with:
    curl -x socks5h://127.0.0.1:1819 https://www.cloudflare.com/cdn-cgi/trace

Verify a download (Linux/macOS):
sha256sum -c aether-linux-x86_64.tar.gz.sha256

See README.md and the Docs directory for transport selection, obfuscation profiles, the HTTP/2 vs HTTP/3 choice in MASQUE, and the full environment-variable reference.

What's Changed

  • security(tls): add SPKI certificate pinning for MASQUE connections by @MatinSenPai in #55

New Contributors

Full Changelog: v1.3.0...v1.4.0

Contributors

MatinSenPai
Assets 27
Loading