podkop-engine 1.14.4-r24

sing-box 1.14.4 для podkop на OpenWrt, ревизия пакета r24. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.4:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.14.4-r21

sing-box 1.14.4 для podkop на OpenWrt, ревизия пакета r21. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.4:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.14.4-r20

sing-box 1.14.4 для podkop на OpenWrt, ревизия пакета r20. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.4:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.14.4-r19

sing-box 1.14.4 для podkop на OpenWrt, ревизия пакета r19. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.4:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.14.4-r18

sing-box 1.14.4 для podkop на OpenWrt, ревизия пакета r18. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.4:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.13.21-r18

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r18. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf974)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets
• 0126 go.mod: sing-vmess of the fork with the Vision buffer fix of upstream
• 0127 xhttp: the test of oversized upload headers no longer races the server's settings
• 0128 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0129 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0130 domainset: a level of the trie is its keys one after another a...

podkop-engine 1.14.3-r17

sing-box 1.14.3 для podkop на OpenWrt, ревизия пакета r17. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.3:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.13.21-r17

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r17. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf974)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets
• 0126 go.mod: sing-vmess of the fork with the Vision buffer fix of upstream
• 0127 xhttp: the test of oversized upload headers no longer races the server's settings
• 0128 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0129 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0130 domainset: a level of the trie is its keys one after another a...

podkop-engine 1.14.3-r16

sing-box 1.14.3 для podkop на OpenWrt, ревизия пакета r16. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.3:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.13.21-r16

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r16. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf974)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets
• 0126 go.mod: sing-vmess of the fork with the Vision buffer fix of upstream
• 0127 xhttp: the test of oversized upload headers no longer races the server's settings
• 0128 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0129 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0130 domainset: a level of the trie is its keys one after another a...