Multik Sila 1.0.28

What's new

• Google search and some sites no longer fail with "connection reset". Chrome
  looks up addresses on its own (secure DNS) and gets IPv6 ones. With IPv6 turned off
  in the app (the default), the tunnel accepted such a connection and only then cut it,
  so Chrome showed ERR_CONNECTION_RESET instead of switching to IPv4. Now the tunnel
  refuses IPv6 at the very first packet and the browser goes over IPv4 right away.
• One odd server no longer spoils the latency test. Free lists often carry a server
  with a setting sing-box does not accept. It used to stop the whole "full path" test:
  on Windows every server was left without a number, on Android the test quietly fell
  back to a plain handshake. Now that server is skipped (the log says so) and the rest
  are measured.
• Auto mode no longer gets stuck on a server it cannot use. The connection check
  could keep picking a server sing-box had refused, so the app stayed on a dead one.

Which file do I need?

Device	File
Windows 10 / 11	MultikSila-1.0.28-setup.exe
Android — almost any phone	MultikSila-1.0.28-android-arm64-v8a.apk
Android — old 32-bit phones	MultikSila-1.0.28-android-armeabi-v7a.apk
Android emulator	MultikSila-1.0.28-android-x86_64.apk

Already using Multik Sila on Windows? It offers this update on its own.
MultikSila-1.0.28-windows-x64.zip is what it downloads for that — you don't need it.

On Android with 1.0.13 or newer the app offers this update itself; the first time,
Android asks you to allow installing from Multik Sila. On 1.0.12 or older, install this
file by hand once.

Technical details

• IPv6: with the DNS strategy ipv4_only the route already had
  {"ip_version": 6, "action": "reject"}, but after {"action": "sniff"}. sing-box
  decides a reject before the connection exists (pre-match) only up to the first sniff
  rule for TCP, so the TUN finished the handshake and then sent a reset. A logical rule
  ahead of sniff now rejects IPv6 TCP (port 53 and private addresses excepted), and the
  TUN answers the SYN itself. Windows and Android TUN.
• Rejected sing-box outbounds (initialize outbound[N]) are now handled the same way
  by the main core and both latency probes: the server is dropped, its latency cleared,
  the selection moved off it, and the probe restarts without it. Checked with sing-box
  1.14.3: a bad uTLS fingerprint makes the probe exit in about 0.25 s with the outbound's
  index.
• Cores unchanged: Xray 26.10.10 and sing-box 1.14.3.