Skip to content

Finalmask: Add Realm (UDP hole punching in Hysteria v2.9.1)#6137

Merged
RPRX merged 9 commits into
XTLS:mainfrom
LjhAUMEM:realm
May 29, 2026
Merged

Finalmask: Add Realm (UDP hole punching in Hysteria v2.9.1)#6137
RPRX merged 9 commits into
XTLS:mainfrom
LjhAUMEM:realm

Conversation

@LjhAUMEM
Copy link
Copy Markdown
Collaborator

@LjhAUMEM LjhAUMEM commented May 15, 2026 •
edited
Loading

refer to hysteria 2.9.1

现在用的 net.DefaultResolver + http.DefaultClient，建议自建 realm 以及搭配 keepAlivePeriod 食用

"finalmask": {
  "udp": [
    {
      "type": "realm",
      "settings": {
        "url": "",
        "stunServers": [],
        "tlsConfig": {}
      }
    }
  ]
}
{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "hysteria",
      "settings": {
        "version": 2,
        "address": "127.0.0.1",
        "port": 1081
      },
      "streamSettings": {
        "network": "hysteria",
        "hysteriaSettings": {
          "version": 2,
          "auth": "5783a3e7-e373-51cd-8642-c83782b807c5"
        },
        "security": "tls",
        "tlsSettings": {
          "pinnedPeerCertSha256": "f166838b984afe614cba418bf2ace575189d822e94c751428e41bb6a7b6f1465"
        },
        "finalmask": {
          "udp": [
            {
              "type": "realm",
              "settings": {
                "url": "realm://public@realm.hy2.io/57f9be7c-2810-4f5b-8cb9-260bc84d6c90",
                "stunServers": [
                  "stun.nextcloud.com:3478",
                  "global.stun.twilio.com:3478"
                ]
              }
            }
          ],
          "quicParams": {
            "keepAlivePeriod": 10
          }
        }
      }
    }
  ]
}
{
  "log": { "loglevel": "debug" },
  "inbounds": [
    {
      // "listen": "127.0.0.1",
      "port": 54321,
      "protocol": "hysteria",
      "settings": {
        "version": 2,
        "clients": [
          {
            "auth": "5783a3e7-e373-51cd-8642-c83782b807c5"
          }
        ]
      },
      "streamSettings": {
        "network": "hysteria",
        "hysteriaSettings": {
          "version": 2
        },
        "security": "tls",
        "tlsSettings": {
          "alpn": ["h3"],
          "certificates": [
            {
              "certificate": [
                "-----BEGIN CERTIFICATE-----",
                "MIIBnTCCAUKgAwIBAgIRAKKw0E+MG4CqeIxeCZtyfWMwCgYIKoZIzj0EAwIwJjER",
                "MA8GA1UEChMIWHJheSBJbmMxETAPBgNVBAMTCFhyYXkgSW5jMB4XDTI2MDQxMTE0",
                "NDg1OFoXDTI2MDcxMDE1NDg1OFowJjERMA8GA1UEChMIWHJheSBJbmMxETAPBgNV",
                "BAMTCFhyYXkgSW5jMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpRY9GoCoKoKx",
                "bp0xH9OQiHmBhogW7nCRh7TtGvTwfyef6DSqUl26Ql3LxTAqNsK84g6EOO5hXkgN",
                "PYRhOnYRiKNRME8wDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB",
                "MAwGA1UdEwEB/wQCMAAwGgYDVR0RBBMwEYIPd3d3LmV4YW1wbGUuY29tMAoGCCqG",
                "SM49BAMCA0kAMEYCIQC81N1lTIzfSsR6K8W2C3NKaR+iqyjYGo+L2mskYVQAVQIh",
                "APeXowIRcyk1ABfptJZ1DPRcAHpJ8H3antwzwh0okJ/e",
                "-----END CERTIFICATE-----"
              ],
              "key": [
                "-----BEGIN RSA PRIVATE KEY-----",
                "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgaqqaEdlBoohy3xLT",
                "yjdJowGv8zU7NckAO8+fK1x2GqChRANCAASlFj0agKgqgrFunTEf05CIeYGGiBbu",
                "cJGHtO0a9PB/J5/oNKpSXbpCXcvFMCo2wrziDoQ47mFeSA09hGE6dhGI",
                "-----END RSA PRIVATE KEY-----"
              ]
            }
          ]
        },
        "finalmask": {
          "udp": [
            {
              "type": "realm",
              "settings": {
                "url": "realm://public@realm.hy2.io/57f9be7c-2810-4f5b-8cb9-260bc84d6c90",
                "stunServers": [
                  "stun.nextcloud.com:3478",
                  "global.stun.twilio.com:3478"
                ]
              }
            }
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

@Fangliding
Copy link
Copy Markdown
Member

Fangliding commented May 15, 2026

call的依赖似乎有点多了
以及它也许应该作为一个udpmask(?)

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 15, 2026

call的依赖似乎有点多了

go mod 吗，wlynxg/anet 似乎和新版 go 不兼容

以及它也许应该作为一个udpmask(?)

没有多路复打什么洞

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 15, 2026

话说写 port: 0 行为居然不是 pickport 吗

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 17, 2026

没有多路复打什么洞

Mux 也快该修整了，有这种打洞的东西最好还是弄成通用的吧，比如 KCP、WG 也能用上，话说为啥非要 realm

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 17, 2026

Mux 也快该修整了，有这种打洞的东西最好还是弄成通用的吧，比如 KCP、WG 也能用上

没有 mux 对于 realm 服务器是不小的负载，真弄了搞不好给 hy 公共牵线搞掉了，我还是偏向给 quic，后续有谁想基于这个 pr 移到 mask 我也不管了

话说为啥非要 realm

就作为 client 使用来说感觉还是极简的，realm 还没看过

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 22, 2026

Surge 的 Ponte 危，话说我寻思 realm 这名字不是一个隧道软件的吗咋被 Hy2 夺舍了

按 @tobyxdd 的想法也是 UDP 通用的，最好弄成通用的吧，另外它迟早有需要走代理的需求，所以需要 dialerProxy

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 23, 2026

行吧，希望 hy 公共牵线能撑住，等了这么久怎么没别的公共出来

移到 mask 需要点时间，准备再糊个 ech 上去

dialerProxy 现在不支持 b.UDP，对 realm 没啥作用

@LjhAUMEM LjhAUMEM marked this pull request as draft May 24, 2026 07:31
@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 24, 2026

应该 ready 了，安卓那个可能要在 ldflags 加个 -checklinkname=0

@LjhAUMEM LjhAUMEM marked this pull request as ready for review May 24, 2026 09:47
@Fangliding
Copy link
Copy Markdown
Member

Fangliding commented May 24, 2026

为啥这东西要 -checklinkname=0

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 24, 2026

根据报错看的，只引用一个 stun 库带来七八个小库，有个小库使用了 go:linkname

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 24, 2026

https://github.com/wlynxg/anet/blob/5501d401a269290292909e6cc75f105571f97cfa/interface_android.go#L164

https://github.com/wlynxg/anet/blob/5501d401a269290292909e6cc75f105571f97cfa/interface_android.go#L167

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 28, 2026

所以要怎么解决

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 29, 2026

所以要怎么解决

CI release 针对 Android 改 ldflags，不适合在这个 pr 改

类似

https://github.com/apernet/hysteria/blob/c3a806b5cbbb20fe72099529573da26b1a2e9f22/.github/workflows/release.yml#L54

https://github.com/apernet/hysteria/blob/c3a806b5cbbb20fe72099529573da26b1a2e9f22/hyperbole.py#L270-L275

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 29, 2026

CI release 针对 Android 改 ldflags，不适合在这个 pr 改

就在这个 PR 一起改了吧，目前已经有一些平台特定编译参数了，你参考下

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 29, 2026

@LjhAUMEM README 那个 Reproducible Releases 记得也加一条，加到 32-bit MIPS/MIPSLE 上面

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 29, 2026

done

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 29, 2026

你这 CGO_ENABLED=1 确定是 reproducible 的吗，跟 CI 里的指令也不一样啊

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 29, 2026

写在上面了吧

Xray-core/.github/workflows/release.yml

Lines 174 to 184 in 4dcf802

if: matrix.goos == 'android'
run: |
wget -qO android-ndk.zip https://dl.google.com/android/repository/android-ndk-r28b-linux.zip
unzip android-ndk.zip
rm android-ndk.zip
declare -A arches=(
["amd64"]="x86_64-linux-android24-clang"
["arm64"]="aarch64-linux-android24-clang"
)
echo CC="$(realpath android-ndk-*/toolchains/llvm/prebuilt/linux-x86_64/bin)/${arches[${{ matrix.goarch }}]}" >> $GITHUB_ENV
echo CGO_ENABLED=1 >> $GITHUB_ENV

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 29, 2026

那没事了，指定的版本是一样的吧，不过有 CGO 的存在是否还 reproducible 有点难说

@Fangliding
Copy link
Copy Markdown
Member

Fangliding commented May 29, 2026

可以stub掉 安卓支持不要了

@RPRX
Copy link
Copy Markdown
Member

RPRX commented May 29, 2026

主要是 termux/magisk 这些需要 Android 版吧

@Fangliding
Copy link
Copy Markdown
Member

Fangliding commented May 29, 2026

它们用的好像反而是Linux arm

@RPRX RPRX changed the title feat(quicParams): realm client/server Finalmask: Add Realm (UDP hole punching, Hysteria v2.9) May 29, 2026
@RPRX RPRX changed the title Finalmask: Add Realm (UDP hole punching, Hysteria v2.9) Finalmask: Add Realm (UDP hole punching in Hysteria v2.9.1) May 29, 2026
@RPRX RPRX merged commit 3630369 into XTLS:main May 29, 2026
39 checks passed
@MoRanYue
Copy link
Copy Markdown

MoRanYue commented May 29, 2026 •
edited
Loading

（tlsConfig对象是否与tlsSettings相同呢？基本上可指定连接牵线服务器时TLS配置，诸如fingerprint、echConfig、serverName、pinnedPeerCertSha256之类。

不过，应如何决定连接牵线服务器 是否使用HTTPS呢？使用realm://协议代表HTTP，realms://代表HTTPS嘛？）

@tobyxdd
Copy link
Copy Markdown

tobyxdd commented May 29, 2026

（tlsConfig对象是否与tlsSettings相同呢？基本上可指定连接牵线服务器时TLS配置，诸如fingerprint、echConfig、serverName、pinnedPeerCertSha256之类。

不过，应如何决定连接牵线服务器 是否使用HTTPS呢？使用realm://协议代表HTTP，realms://代表HTTPS嘛？）

https://hysteria.network/docs/advanced/Realms/#realm-address

@MoRanYue
Copy link
Copy Markdown

MoRanYue commented May 30, 2026

（奇怪，居然不是realm://与realms://，而是realm+http://和realm://）

@LjhAUMEM
Copy link
Copy Markdown
Collaborator Author

LjhAUMEM commented May 30, 2026

tlsConfig对象是否与tlsSettings相同呢？

相同的，主要是为了蹭 ech，其他字段你也可以试试

RPRX pushed a commit that referenced this pull request May 30, 2026
@LjhAUMEM
Realm finalmask: Fix client punch peers (#6213)
ba53861 
Fixes #6137
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@LjhAUMEM @Fangliding @RPRX @MoRanYue @tobyxdd