Zeptun 1.1.3

Custom Android configs and a few hardening fixes.

nativeStart with a custom TOML now runs the device in fd mode without needing
[tun] fd in the config. The UDP relay paths close a socket that could not be
protected instead of using it unprotected, the TCP sequence secret on Windows is
seeded from the system RNG, a retried start after a failed setup no longer leaks,
and zeptun warns when handing DNS to systemd-resolved fails or when
icmp = "forward" sends pings around a SOCKS5 proxy.

The C API version now matches the release again; 1.1.2 still reported 1.1.1.

docker pull ghcr.io/noisemux/zeptun:1.1.3

Zeptun 1.1.2

Strict routing on Windows can let named programs through.

With strict = true and DNS hijack on, the filtering engine blocks port 53 on
every adapter except the tunnel. That stops Windows from asking the network
card's resolvers alongside the tunnel's, but it also cut off a client core that
resolves its direct domains itself. route.allow_app takes executable paths and
gives each one the same permit zeptun gives itself, so that core keeps its
direct DNS while everything else stays on the tunnel.

[route]
strict = true
allow_app = ['C:\Program Files\Example\xray.exe']

docker pull ghcr.io/noisemux/zeptun:1.1.2

Zeptun 1.1.1

The pool stopped handing memory back after the first burst.

1.1.0 decayed its high water mark only inside the trim pass, and the trim pass
only ran when the high water mark had already come down. After a busy period
the two waited on each other and the packet pool kept every page it had touched
for the rest of the process. Both are decided independently now, and the trim
target follows the highest number of buffers actually in use since the previous
sweep, so it releases as soon as the traffic stops and leaves the pool alone
while it is busy.

After 512 concurrent streams, resident memory settles at 4.4 MB instead of
38.7 MB. Throughput is unchanged.

docker pull ghcr.io/noisemux/zeptun:1.1.1

Zeptun 1.1.0

Memory that comes back.

Zeptun held on to every page it ever touched, and each flow was free to queue a
megabyte of its own. Idle packet buffers now go back to the kernel a few seconds
after a burst, and a flow draws its send buffer and receive window from a budget
shared with the others, so memory follows the traffic instead of the connection
count.

What changed

• Idle packet buffers are handed back to the kernel, so resident memory falls after load
• Send buffers and receive windows grow into a per-worker budget shared by every flow
• The receive window no longer grows while a queue is backed up
• A flow waiting for a buffer waits on its own list instead of spinning a core
• A small memory budget buys more buffers rather than bigger ones
• The device keeps its receive ring sized for the machine, not for each worker
• zeptun_memory reports pool usage and how much has gone back to the kernel
• The benchmark reads memory again after every scenario ends

Numbers

From the benchmark workflow on a GitHub-hosted runner, against hev-socks5-tunnel
over the same SOCKS5 server:

	zeptun	hev-socks5-tunnel
idle	840 KB	2221 KB
1000 TCP connections	5.2 MB	78.8 MB
1000 UDP flows	5.7 MB	27.3 MB
upload, 10 streams	23.3 Gbit/s	13.8 Gbit/s
download, 10 streams	20.3 Gbit/s	11.1 Gbit/s

Memory during the bulk scenarios is down by a quarter to a half against 1.0.0,
with the same throughput. Full tables and charts are on the
wiki.

Notes

• tcp_tx_buffer now defaults to 256 KB. Raise it if you run over a long fat path.
• The C API is backward compatible. zeptun_memory is new and ZeptunStats is unchanged.

docker pull ghcr.io/noisemux/zeptun:1.1.0

Zeptun 1.0.0

First stable release.

Zeptun takes the traffic your system routes into a TUN device and sends it through a SOCKS5 proxy or straight out, with the same engine on Linux, Android, Windows, macOS, iOS and FreeBSD.

What's in it

• TCP, UDP and ICMP over SOCKS5 or direct, IPv4 and IPv6
• io_uring or epoll on Linux, kqueue on macOS and BSD, IOCP on Windows
• Segmentation offload in both directions, UDP through the proxy included
• Elastic queues: workers are added under load and live connections move between them without loss
• Automatic routing with exclusions, UID and app rules, strict route and nftables redirect
• Fake-IP DNS, DNS hijacking and systemd-resolved handover
• A C API with TOML or JSON configuration, a JNI bridge for Android and an XCFramework for Apple platforms

Downloads

Static binaries and libraries for 13 Linux architectures, a universal macOS binary, Windows archives for x86_64 and arm64 with Wintun included, FreeBSD, the Android libraries for four ABIs, and the XCFramework. Checksums are in SHA256SUMS.

docker pull ghcr.io/noisemux/zeptun:1.0.0

Notes

• The Android libraries need Android 10 or newer.
• Benchmarks against hev-socks5-tunnel, sing-box and tun2socks are on the wiki.