podkop-engine 1.14.3-r15

sing-box 1.14.3 для podkop на OpenWrt, ревизия пакета r15. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.3:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.9-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 ja3: test a list that runs past its extension (upstream 07512b109)
• 0039 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0040 urltest: the Clash API's delay test does not wait for nested selections
• 0041 log: format entries for the Clash API only while its logs are read
• 0042 clashapi: a failed listen of the external controller does not fail the start
• 0043 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0044 xhttp: add the client of Xray's XHTTP transport
• 0045 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0046 xhttp: a small default request size for uploads carried in headers or cookies
• 0047 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0048 xhttp: test the backoff against a server that resets every upload
• 0049 xhttp: do not cancel packet-up uploads with their session
• 0050 xhttp: the transport in the option schema
• 0051 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: take the first query to a server off the goroutine that reads client queries
• 0077 dns: use slices.Equal and slices.Contains for the provider's servers
• 0078 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0079 dns/fakeip: tell the loop to stop before the store refuses saves
• 0080 route: log a connection without a fakeip record as a warning that says why
• 0081 route: count the refusals of a loop to the inbound instead of logging each
• 0082 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0083 tls: name the uTLS fingerprints REALITY cannot use
• 0084 tls: do not rebuild the Client Hello after the handshake
• 0085 urltest: check the download URL of the environment at start
• 0086 rule-set: report how the recovered hook ended
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 httpclient: test that what a request's context carries reaches the dialer
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tlsspoof: what the review of the forged ClientHello showed
• 0110 tls: fingerprint fallback, what two reviews and the stands showed
• 0111 urltest: failures across a change of the network, a monitor that sees no route
• 0112 rule-set: one plain line of what the server said
• 0113 vless: warn about a flow over the quic transport too
• 0114 decode-link: what the stand against real servers and two reviews showed
• 0115 clashapi: do not write to the record of a connection while it is listed
• 0116 route: do not leave a packet of a new NAT session behind its DNS handler
• 0117 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0118 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0119 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0120 dns: every message of the provider DNS fallback is a warning
• 0121 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0122 xhttp: the test of oversized upload headers no longer races the server's settings
• 0123 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0124 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0125 domainset: a level of the trie is its keys one after another and a bit a node
• 0126 domainset: the trie a type of its own, filled in place
• 0127 cidrset: CIDR lists of rule sets as ranges of their own
• 0128 sharelink: the scrubbing of messages is exported
• 0129 route: remote rule-sets can be updated on request
• 0130 fakeip: Peek tells the address of a domain without giving it one
• `0...

podkop-engine 1.13.21-r15

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r15. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf974)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets
• 0126 go.mod: sing-vmess of the fork with the Vision buffer fix of upstream
• 0127 xhttp: the test of oversized upload headers no longer races the server's settings
• 0128 common/domainset: build the domain matcher of sing with a fraction of its memory
• 0129 domainset: read rule sets of the source format in one pass, build the trie by radix
• 0130 domainset: a level of the trie is its keys one after another a...

podkop-engine 1.14.2-r14

sing-box 1.14.2 для podkop на OpenWrt, ревизия пакета r14. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.2:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 urltest: the Clash API's delay test does not wait for nested selections
• 0043 log: format entries for the Clash API only while its logs are read
• 0044 clashapi: a failed listen of the external controller does not fail the start
• 0045 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0046 xhttp: add the client of Xray's XHTTP transport
• 0047 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0048 xhttp: a small default request size for uploads carried in headers or cookies
• 0049 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0050 xhttp: test the backoff against a server that resets every upload
• 0051 xhttp: do not cancel packet-up uploads with their session
• 0052 xhttp: the transport in the option schema
• 0053 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0054 xhttp: fixes from the review
• 0055 tools: add decode-link, share links to outbounds
• 0056 tools decode-link: forms of links found in the wild
• 0057 xhttp: an oversized request no longer takes the connection down
• 0058 xhttp: data written before a close is sent
• 0059 xhttp: the backoff holds back connections, not sessions
• 0060 xhttp: a graceful GOAWAY is not a failure of the server
• 0061 xhttp: HTTP/3 takes another connection when one is out of streams
• 0062 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0063 xhttp: no time limit on an upload a watched connection carries
• 0064 xhttp: fixes from the second review
• 0065 tools decode-link: fixes from the review
• 0066 tools decode-link: do not wrap a nil error
• 0067 tools decode-link: one link, and an exit status scripts can tell apart
• 0068 version: list the features of this build
• 0069 xhttp: Close resets the transport instead of ending it
• 0070 v2ray: state and test that Close of a client transport is a reset
• 0071 xhttp: browser versions survive a clock that was never set
• 0072 xhttp: refuse an uplink_http_method that is not a token
• 0073 xhttp: one check of the options, and a download server needs its port
• 0074 dns: test the decisions of the provider DNS fallback
• 0075 dns: count a failure of a server once per event, and only for names the provider resolved
• 0076 dns: forget the state of the provider fallback of every server on a network reset
• 0077 dns: read the provider's servers again after a miss at most once in 30 s
• 0078 dns: take the first query to a server off the goroutine that reads client queries
• 0079 dns: use slices.Equal and slices.Contains for the provider's servers
• 0080 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0081 dns/fakeip: tell the loop to stop before the store refuses saves
• 0082 route: log a connection without a fakeip record as a warning that says why
• 0083 route: count the refusals of a loop to the inbound instead of logging each
• 0084 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0085 tls: name the uTLS fingerprints REALITY cannot use
• 0086 tls: do not rebuild the Client Hello after the handshake
• 0087 urltest: check the download URL of the environment at start
• 0088 rule-set: report how the recovered hook ended
• 0089 rule-set: read and drop the rules of a local set under its lock
• 0090 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0091 rule-set: download as an external connection
• 0092 urltest: keep the test results through a network pause, test again after a busy round
• 0093 urltest: one error for a failed dial, naming the member
• 0094 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0095 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0096 httpclient: test that what a request's context carries reaches the dialer
• 0097 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0098 reality: take the tls spoof options
• 0099 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0100 vless: warn of a flow over a transport it does not work over
• 0101 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0102 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0103 decode-link: options of sing-box by their paths, and what a link may not set
• 0104 decode-link: what the links of Marzban and Remnawave showed
• 0105 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0106 urltest: a dial this host's network refused waits for the network monitor
• 0107 vmess: the security auto is not zero under TLS
• 0108 reality: refuse a short_id longer than it can be
• 0109 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0110 tlsfragment: a server name with an empty label
• 0111 tlsspoof: what the review of the forged ClientHello showed
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.14.2-pdk-r14.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются...

podkop-engine 1.13.21-r14

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r14. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler
• 0119 dns/https: ask a query again when the server closes the connection without a GOAWAY
• 0120 vless: VLESS Encryption of Xray for the outbound, with Vision over it
• 0121 decode-link: pass the encryption of a VLESS link instead of refusing it
• 0122 dns: every message of the provider DNS fallback is a warning
• 0123 sniff: a datagram that is no DNS query goes on to the other packet sniffers
• 0124 go.mod: sing-shadowsocks2 with the input validation of UDP packets
• 0125 go.mod: sing-quic from a fork with the input validation of UDP packets
• 0126 go.mod: sing-vmess of the fork with the Vision buffer fix of upstream

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.13.21-pdk-r14.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Co...

podkop-engine 1.14.2-r13

sing-box 1.14.2 для podkop на OpenWrt, ревизия пакета r13. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.2:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 urltest: the Clash API's delay test does not wait for nested selections
• 0043 log: format entries for the Clash API only while its logs are read
• 0044 clashapi: a failed listen of the external controller does not fail the start
• 0045 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0046 xhttp: add the client of Xray's XHTTP transport
• 0047 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0048 xhttp: a small default request size for uploads carried in headers or cookies
• 0049 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0050 xhttp: test the backoff against a server that resets every upload
• 0051 xhttp: do not cancel packet-up uploads with their session
• 0052 xhttp: the transport in the option schema
• 0053 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0054 xhttp: fixes from the review
• 0055 tools: add decode-link, share links to outbounds
• 0056 tools decode-link: forms of links found in the wild
• 0057 xhttp: an oversized request no longer takes the connection down
• 0058 xhttp: data written before a close is sent
• 0059 xhttp: the backoff holds back connections, not sessions
• 0060 xhttp: a graceful GOAWAY is not a failure of the server
• 0061 xhttp: HTTP/3 takes another connection when one is out of streams
• 0062 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0063 xhttp: no time limit on an upload a watched connection carries
• 0064 xhttp: fixes from the second review
• 0065 tools decode-link: fixes from the review
• 0066 tools decode-link: do not wrap a nil error
• 0067 tools decode-link: one link, and an exit status scripts can tell apart
• 0068 version: list the features of this build
• 0069 xhttp: Close resets the transport instead of ending it
• 0070 v2ray: state and test that Close of a client transport is a reset
• 0071 xhttp: browser versions survive a clock that was never set
• 0072 xhttp: refuse an uplink_http_method that is not a token
• 0073 xhttp: one check of the options, and a download server needs its port
• 0074 dns: test the decisions of the provider DNS fallback
• 0075 dns: count a failure of a server once per event, and only for names the provider resolved
• 0076 dns: forget the state of the provider fallback of every server on a network reset
• 0077 dns: read the provider's servers again after a miss at most once in 30 s
• 0078 dns: take the first query to a server off the goroutine that reads client queries
• 0079 dns: use slices.Equal and slices.Contains for the provider's servers
• 0080 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0081 dns/fakeip: tell the loop to stop before the store refuses saves
• 0082 route: log a connection without a fakeip record as a warning that says why
• 0083 route: count the refusals of a loop to the inbound instead of logging each
• 0084 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0085 tls: name the uTLS fingerprints REALITY cannot use
• 0086 tls: do not rebuild the Client Hello after the handshake
• 0087 urltest: check the download URL of the environment at start
• 0088 rule-set: report how the recovered hook ended
• 0089 rule-set: read and drop the rules of a local set under its lock
• 0090 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0091 rule-set: download as an external connection
• 0092 urltest: keep the test results through a network pause, test again after a busy round
• 0093 urltest: one error for a failed dial, naming the member
• 0094 trafficcontrol: drop the sniffer state and the DNS answers from a tracker's metadata
• 0095 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0096 httpclient: test that what a request's context carries reaches the dialer
• 0097 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0098 reality: take the tls spoof options
• 0099 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0100 vless: warn of a flow over a transport it does not work over
• 0101 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0102 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0103 decode-link: options of sing-box by their paths, and what a link may not set
• 0104 decode-link: what the links of Marzban and Remnawave showed
• 0105 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0106 urltest: a dial this host's network refused waits for the network monitor
• 0107 vmess: the security auto is not zero under TLS
• 0108 reality: refuse a short_id longer than it can be
• 0109 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0110 tlsfragment: a server name with an empty label
• 0111 tlsspoof: what the review of the forged ClientHello showed
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.14.2-pdk-r13.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: `aarch64_...

podkop-engine 1.13.21-r13

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r13. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line
• 0087 rule-set: read and drop the rules of a local set under its lock
• 0088 rule-set: refuse what cannot be a rule-set before reading it, say what came
• 0089 rule-set: download as an external connection
• 0090 urltest: keep the test results through a network pause, test again after a busy round
• 0091 urltest: one error for a failed dial, naming the member
• 0092 clashapi: drop the sniffer state from a tracker's metadata
• 0093 tls: make the uTLS hello of chrome, edge, ios, qq, 360 and android from its specification
• 0094 tls: spoof and spoof_method, the route options tls_spoof and tls_spoof_method (from sing-box 1.14)
• 0095 tlsspoof: send the forged ClientHello the way the connection goes, and nothing else
• 0096 reality: take the tls spoof options
• 0097 tls: go on with another uTLS fingerprint when the ClientHello gets no acknowledgment
• 0098 vless: warn of a flow over a transport it does not work over
• 0099 decode-link: build the outbound to validate it, refuse by a table of reasons
• 0100 decode-link: Shadowsocks, SOCKS, Hysteria 2, TUIC, VMess, HTTP, Hysteria, AnyTLS and NaiveProxy links
• 0101 decode-link: options of sing-box by their paths, and what a link may not set
• 0102 decode-link: what the links of Marzban and Remnawave showed
• 0103 decode-link: what the fuzzer and the comparison with podkop's shell decoder showed
• 0104 urltest: a dial this host's network refused waits for the network monitor
• 0105 vmess: the security auto is not zero under TLS
• 0106 reality: refuse a short_id longer than it can be
• 0107 tlsfragment: do not hold the socket while waiting for an acknowledgment
• 0108 tlsfragment: a server name with an empty label
• 0109 tls: fragment the ClientHello with tls.fragment alone (from sing-box 1.14)
• 0110 tlsspoof: what the review of the forged ClientHello showed
• 0111 route: apply tls_spoof of a bypass action
• 0112 tls: fingerprint fallback, what two reviews and the stands showed
• 0113 urltest: failures across a change of the network, a monitor that sees no route
• 0114 rule-set: one plain line of what the server said
• 0115 vless: warn about a flow over the quic transport too
• 0116 decode-link: what the stand against real servers and two reviews showed
• 0117 clashapi: do not write to the record of a connection while it is listed
• 0118 route: do not leave a packet of a new NAT session behind its DNS handler

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.13.21-pdk-r13.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 `aarch64...

podkop-engine 1.14.2-r12

sing-box 1.14.2 для podkop на OpenWrt, ревизия пакета r12. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.2:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 urltest: the Clash API's delay test does not wait for nested selections
• 0043 log: format entries for the Clash API only while its logs are read
• 0044 clashapi: a failed listen of the external controller does not fail the start
• 0045 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0046 xhttp: add the client of Xray's XHTTP transport
• 0047 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0048 xhttp: a small default request size for uploads carried in headers or cookies
• 0049 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0050 xhttp: test the backoff against a server that resets every upload
• 0051 xhttp: do not cancel packet-up uploads with their session
• 0052 xhttp: the transport in the option schema
• 0053 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0054 xhttp: fixes from the review
• 0055 tools: add decode-link, share links to outbounds
• 0056 tools decode-link: forms of links found in the wild
• 0057 xhttp: an oversized request no longer takes the connection down
• 0058 xhttp: data written before a close is sent
• 0059 xhttp: the backoff holds back connections, not sessions
• 0060 xhttp: a graceful GOAWAY is not a failure of the server
• 0061 xhttp: HTTP/3 takes another connection when one is out of streams
• 0062 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0063 xhttp: no time limit on an upload a watched connection carries
• 0064 xhttp: fixes from the second review
• 0065 tools decode-link: fixes from the review
• 0066 tools decode-link: do not wrap a nil error
• 0067 tools decode-link: one link, and an exit status scripts can tell apart
• 0068 version: list the features of this build
• 0069 xhttp: Close resets the transport instead of ending it
• 0070 v2ray: state and test that Close of a client transport is a reset
• 0071 xhttp: browser versions survive a clock that was never set
• 0072 xhttp: refuse an uplink_http_method that is not a token
• 0073 xhttp: one check of the options, and a download server needs its port
• 0074 dns: test the decisions of the provider DNS fallback
• 0075 dns: count a failure of a server once per event, and only for names the provider resolved
• 0076 dns: forget the state of the provider fallback of every server on a network reset
• 0077 dns: read the provider's servers again after a miss at most once in 30 s
• 0078 dns: take the first query to a server off the goroutine that reads client queries
• 0079 dns: use slices.Equal and slices.Contains for the provider's servers
• 0080 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0081 dns/fakeip: tell the loop to stop before the store refuses saves
• 0082 route: log a connection without a fakeip record as a warning that says why
• 0083 route: count the refusals of a loop to the inbound instead of logging each
• 0084 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0085 tls: name the uTLS fingerprints REALITY cannot use
• 0086 tls: do not rebuild the Client Hello after the handshake
• 0087 urltest: check the download URL of the environment at start
• 0088 rule-set: report how the recovered hook ended

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.14.2-pdk-r12.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 i386_pentium4 loongarch64_generic mipsel_24kc mipsel_74kc riscv64_generic x86_64
• нет: arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a7 arm_cortex-a9 arm_fa526 arm_xscale i386_pentium-mmx mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc_24kf mipsel_mips32 riscv64_riscv64

Причины: mips big-endian и mips64 (cronet для них нет), armv5/armv6 и arm без FPU (cronet собран под ARMv7 с VFP), mipsel_24kc_24kf (плавающая точка в железе, cronet — soft-float), mipsel_mips32 (cronet собран под MIPS32r2), i386_pentium-mmx (нет SSE2), riscv64_riscv64 (sing-box выпускает cronet только для riscv64_generic). На этих архитектурах остальные протоколы podkop-engine-full работают, а выход naive отвечает naive outbound is not included in this build.

Установка (<pkgarch> — opkg print-architecture / apk --print-arch; подробнее — docs/INSTALL.md):

OpenWrt 24.10 и старше (opkg):

wget -O /tmp/pe.ipk https://github.com/FiyeroT/podkop-engine/releases/download/v1.14.2-r12/podkop-engine_1.14.2-r12_openwrt_<pkgarch>.ipk        # podkop-engine-full: podkop-engine-full_1.14.2-r12_openwrt_<pkgarch>.ipk
opkg remove --force-depends sing-box sing-box-tiny 2>/dev/null; opkg install /tmp/pe.ipk

OpenWrt 25.12 и snapshot (apk):

wget -O /tmp/pe.apk https://github.com/FiyeroT/podkop-engine/releases/download/v1.14.2-r12/podkop-engine_1.14.2-r12_openwrt_<pkgarch>.apk        # podkop-engine-full: podkop-engine-full_1.14.2-r12_openwrt_<pkgarch>.apk
apk add --allow-untrusted /tmp/pe.apk

Архитектуры (31 ipk, 31 apk): aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_fa526 arm_xscale i386_pentium-mmx i386_pentium4 loongarch64_generic mips64_mips...

podkop-engine 1.13.21-r12

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r12. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build
• 0067 xhttp: Close resets the transport instead of ending it
• 0068 v2ray: state and test that Close of a client transport is a reset
• 0069 xhttp: browser versions survive a clock that was never set
• 0070 xhttp: refuse an uplink_http_method that is not a token
• 0071 xhttp: one check of the options, and a download server needs its port
• 0072 dns: test the decisions of the provider DNS fallback
• 0073 dns: count a failure of a server once per event, and only for names the provider resolved
• 0074 dns: forget the state of the provider fallback of every server on a network reset
• 0075 dns: read the provider's servers again after a miss at most once in 30 s
• 0076 dns: use slices.Equal and slices.Contains for the provider's servers
• 0077 dns/fakeip: answer new names from memory while the cache file cannot be written
• 0078 dns/fakeip: tell the loop to stop before the store refuses saves
• 0079 route: log a connection without a fakeip record as a warning that says why
• 0080 route: count the refusals of a loop to the inbound instead of logging each
• 0081 sniff: log the stack of a panicking sniffer once a minute, not per connection
• 0082 tls: name the uTLS fingerprints REALITY cannot use
• 0083 tls: do not rebuild the Client Hello after the handshake
• 0084 urltest: check the download URL of the environment at start
• 0085 rule-set: report how the recovered hook ended
• 0086 go.mod: golang.org/x/net v0.57.0, with x/crypto, x/text and x/sys, as the 1.14 line

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.13.21-pdk-r12.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 i386_pentium4 loongarch64_generic mipsel_24kc mipsel_74kc riscv64_generic x86_64
• нет: arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a7 arm_cortex-a9 arm_fa526 arm_xscale i386_pentium-mmx mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc_24kf mipsel_mips32 riscv64_riscv64

Причины: mips big-endian и mips64 (cronet для них нет), armv5/armv6 и arm без FPU (cronet собран под ARMv7 с VFP), mipsel_24kc_24kf (плавающая точка в железе, cronet — soft-float), mipsel_mips32 (cronet собран под MIPS32r2), i386_pentium-mmx (нет SSE2), riscv64_riscv64 (sing-box выпускает cronet только для riscv64_generic). На этих архитектурах остальные протоколы podkop-engine-full работают, а выход naive отвечает naive outbound is not included in this build.

Установка (<pkgarch> — opkg print-architecture / apk --print-arch; подробнее — docs/INSTALL.md):

OpenWrt 24.10 и старше (opkg):

wget -O /tmp/pe.ipk https://github.com/FiyeroT/podkop-engine/releases/download/v1.13.21-r12/podkop-engine_1.13.21-r12_openwrt_<pkgarch>.ipk        # podkop-engine-full: podkop-engine-full_1.13.21-r12_openwrt_<pkgarch>.ipk
opkg remove --force-depends sing-box sing-box-tiny 2>/dev/null; opkg install /tmp/pe.ipk

OpenWrt 25.12 и snapshot (apk):

wget -O /tmp/pe.apk https://github.com/FiyeroT/podkop-engine/releases/download/v1.13.21-r12/podkop-engine_1.13.21-r12_openwrt_<pkgarch>.apk        # podkop-engine-full: podkop-engine-full_1.13.21-r12_openwrt_<pkgarch>.apk
apk add --allow-untrusted /tmp/pe.apk

Архитектуры (31 ipk, 31 apk): aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_fa526 arm_xscale i386_pentium-mmx i386_pentium4 loongarch64_generic mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc mipsel_24kc_24kf mipsel_74kc mipsel_mips32 riscv64_generic riscv64_riscv64 x86_64

Совместимость: как Xr...

podkop-engine 1.14.2-r11

sing-box 1.14.2 для podkop на OpenWrt, ревизия пакета r11. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.14.2:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 include: podkop_slim build tag drops snell and the API service
• 0004 rule-set: start empty when the first download fails, retry, run a hook
• 0005 dns/udp: one socket per query for servers reached without a proxy
• 0006 dns/transport: cap queries in flight on a pipelined TCP/TLS connection
• 0007 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0008 route: answer DNS hijacked from a NAT session from a handler
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: exchange DNS of a NAT session off the reading loop
• 0013 route: a FakeIP address without a record goes by the sniffed domain
• 0014 listener: an output queue of 1024 packets for UDP instead of 64
• 0015 sniff: bound the CRYPTO frames of a QUIC Initial
• 0016 route: refuse a direct dial back to the inbound the connection came in on
• 0017 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0018 sniff: stop the TLS server handshake once the ClientHello is captured
• 0019 dns: retransmit plain UDP queries while no answer has come
• 0020 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0021 urltest: test each member every interval, not every other one
• 0022 urltest: leave a member when its connections fail, not at the next test
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 urltest: the Clash API's delay test does not wait for nested selections
• 0043 log: format entries for the Clash API only while its logs are read
• 0044 clashapi: a failed listen of the external controller does not fail the start
• 0045 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0046 xhttp: add the client of Xray's XHTTP transport
• 0047 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0048 xhttp: a small default request size for uploads carried in headers or cookies
• 0049 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0050 xhttp: test the backoff against a server that resets every upload
• 0051 xhttp: do not cancel packet-up uploads with their session
• 0052 xhttp: the transport in the option schema
• 0053 xhttp: BBR congestion control and the Chrome QUIC profile over HTTP/3, as Xray
• 0054 xhttp: fixes from the review
• 0055 tools: add decode-link, share links to outbounds
• 0056 tools decode-link: forms of links found in the wild
• 0057 xhttp: an oversized request no longer takes the connection down
• 0058 xhttp: data written before a close is sent
• 0059 xhttp: the backoff holds back connections, not sessions
• 0060 xhttp: a graceful GOAWAY is not a failure of the server
• 0061 xhttp: HTTP/3 takes another connection when one is out of streams
• 0062 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0063 xhttp: no time limit on an upload a watched connection carries
• 0064 xhttp: fixes from the second review
• 0065 tools decode-link: fixes from the review
• 0066 tools decode-link: do not wrap a nil error
• 0067 tools decode-link: one link, and an exit status scripts can tell apart
• 0068 version: list the features of this build

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.14.2-pdk-r11.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 i386_pentium4 loongarch64_generic mipsel_24kc mipsel_74kc riscv64_generic x86_64
• нет: arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a7 arm_cortex-a9 arm_fa526 arm_xscale i386_pentium-mmx mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc_24kf mipsel_mips32 riscv64_riscv64

Причины: mips big-endian и mips64 (cronet для них нет), armv5/armv6 и arm без FPU (cronet собран под ARMv7 с VFP), mipsel_24kc_24kf (плавающая точка в железе, cronet — soft-float), mipsel_mips32 (cronet собран под MIPS32r2), i386_pentium-mmx (нет SSE2), riscv64_riscv64 (sing-box выпускает cronet только для riscv64_generic). На этих архитектурах остальные протоколы podkop-engine-full работают, а выход naive отвечает naive outbound is not included in this build.

Установка (<pkgarch> — opkg print-architecture / apk --print-arch; подробнее — docs/INSTALL.md):

OpenWrt 24.10 и старше (opkg):

wget -O /tmp/pe.ipk https://github.com/FiyeroT/podkop-engine/releases/download/v1.14.2-r11/podkop-engine_1.14.2-r11_openwrt_<pkgarch>.ipk        # podkop-engine-full: podkop-engine-full_1.14.2-r11_openwrt_<pkgarch>.ipk
opkg remove --force-depends sing-box sing-box-tiny 2>/dev/null; opkg install /tmp/pe.ipk

OpenWrt 25.12 и snapshot (apk):

wget -O /tmp/pe.apk https://github.com/FiyeroT/podkop-engine/releases/download/v1.14.2-r11/podkop-engine_1.14.2-r11_openwrt_<pkgarch>.apk        # podkop-engine-full: podkop-engine-full_1.14.2-r11_openwrt_<pkgarch>.apk
apk add --allow-untrusted /tmp/pe.apk

Архитектуры (31 ipk, 31 apk): aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_fa526 arm_xscale i386_pentium-mmx i386_pentium4 loongarch64_generic mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc mipsel_24kc_24kf mipsel_74kc mipsel_mips32 riscv64_generic riscv64_riscv64 x86_64

Совместимость: как Xray-клиент 26.9.9 (Xray-сервер 25.5.16+; с 24.x–25.4 — только если сайт-прикрытие не выбирает X25519MLKEM768).

podkop-engine 1.13.21-r11

sing-box 1.13.21 для podkop на OpenWrt, ревизия пакета r11. Неофициальная сборка, не связана с проектом sing-box.

Патчи к v1.13.21:

• 0001 reality: keep X25519MLKEM768 key share, announce client version 26.3.27
• 0002 utls: firefox -> Firefox 148, safari -> Safari 26.3 (as Xray-core)
• 0003 rule-set: start empty when the first download fails, retry, run a hook
• 0004 urltest: re-check when the default interface changes
• 0005 rule-set: close the connection of a failed download
• 0006 dns/udp: one socket per query for servers reached without a proxy
• 0007 dns/tls: drop idle pooled connections before servers close them
• 0008 dns: fall back to the provider's DNS when a server reached through the WAN fails
• 0009 dns: take the provider's DNS from netifd for the output device, ask the fastest
• 0010 utls: keep the randomized fingerprint consistent
• 0011 dns/fakeip: answer from memory, save to the cache file in the background
• 0012 route: a FakeIP address without a record goes by the sniffed domain
• 0013 listener: an output queue of 1024 packets for UDP instead of 64
• 0014 sniff: bound the CRYPTO frames of a QUIC Initial
• 0015 route: refuse a direct dial back to the inbound the connection came in on
• 0016 transport: a failed HTTP/2 dial frees the handshake write, with its error
• 0017 sniff: stop the TLS server handshake once the ClientHello is captured
• 0018 dns: retransmit plain UDP queries while no answer has come
• 0019 rule-set: bound a remote fetch by stalls, start without a list that does not come
• 0020 urltest: test each member every interval, not every other one
• 0021 urltest: leave a member when its connections fail, not at the next test
• 0022 tls: bound the handshake of a TLS dial
• 0023 urltest: download 64 KiB through a member before switching to it
• 0024 include: drop the resolved service and DNS transport
• 0025 dns/https: reset the transport on a timeout only when no later query was answered
• 0026 tls: release the uTLS handshake state after the handshake
• 0027 dns: log failed exchanges once per server, with a count every 10 s
• 0028 urltest: a timeout that also reports itself closed is the member's failure
• 0029 badtls: read a pending alert after data, as crypto/tls does
• 0030 tls: give the connections of the TLS dialer the badtls read waiter
• 0031 readwait: wait for data without a buffer on QUIC streams and gRPC lite
• 0032 box: let the Go memory limit follow the memory the system can still give
• 0033 urltest: test a member out of turn when a connection gets no answer
• 0034 go.mod: take sing-vmess from the podkop-engine fork (v0.2.8-pdk13.1)
• 0035 include: podkop_slim keeps podkop's protocols, podkop_full adds every outbound
• 0036 urltest: take the download test URL from the group's download_url
• 0037 urltest: fallbacks, taken in their order while no outbound answers
• 0038 Backport: fix protocol input validation (upstream 07512b109)
• 0039 Backport: close interrupted connections outside the group lock (upstream d2cf9747d)
• 0040 go.mod: sing-vmess v0.2.8-pdk13.2, with the upstream input validation fix
• 0041 sniff: a panicking sniffer fails its connection, a UDP sniff reads 16 packets
• 0042 log: format entries for the Clash API only while its logs are read
• 0043 clashapi: a failed listen of the external controller does not fail the start
• 0044 rule-set: collect garbage after a load only, log repeated failures sparingly
• 0045 xhttp: add the client of Xray's XHTTP transport
• 0046 xhttp: tests for options, configuration errors, the download leg and HTTP/3; refuse VLESS flow over xhttp
• 0047 xhttp: a small default request size for uploads carried in headers or cookies
• 0048 xhttp: cap the frame size the HTTP/2 client writes, wait for data on a small probe, retire idle pooled connections
• 0049 xhttp: test the backoff against a server that resets every upload
• 0050 xhttp: do not cancel packet-up uploads with their session
• 0051 xhttp: BBR congestion control over HTTP/3, as Xray
• 0052 xhttp: fixes from the review
• 0053 tools: add decode-link, share links to outbounds
• 0054 tools decode-link: forms of links found in the wild
• 0055 xhttp: an oversized request no longer takes the connection down
• 0056 xhttp: data written before a close is sent
• 0057 xhttp: the backoff holds back connections, not sessions
• 0058 xhttp: a graceful GOAWAY is not a failure of the server
• 0059 xhttp: HTTP/3 takes another connection when one is out of streams
• 0060 xhttp: no post interval for a range from zero; tests for rotation and deadlines
• 0061 xhttp: no time limit on an upload a watched connection carries
• 0062 xhttp: fixes from the second review
• 0063 tools decode-link: fixes from the review
• 0064 tools decode-link: do not wrap a nil error
• 0065 tools decode-link: one link, and an exit status scripts can tell apart
• 0066 version: list the features of this build

Теги сборки: with_quic,with_utls,with_clash_api,podkop_slim. Go 1.26.8. sing-box version → 1.13.21-pdk-r11.

Два пакета, ставится один из них:

• podkop-engine — то, что использует podkop: входы tproxy, direct, mixed; выходы direct, socks, shadowsocks, trojan, vless, hysteria2, tuic, selector, urltest. Остальные типы в «Outbound Config» отвергаются с подсказкой поставить podkop-engine-full.
• podkop-engine-full — то же плюс все остальные выходы: http, vmess, snell (1.14), tor (нужен пакет tor), ssh, shadowtls, anytls, hysteria и NaiveProxy (кроме архитектур ниже). Теги — те же плюс podkop_full (и with_naive_outbound,with_musl, где есть NaiveProxy).

NaiveProxy в podkop-engine-full есть не на всех архитектурах. Он работает на cronet (сетевом стеке Chromium), который sing-box выпускает не для всех процессоров; бинарь с NaiveProxy больше на 11 МБ (x86_64) — 17 МБ (mipsel).

• есть: aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 i386_pentium4 loongarch64_generic mipsel_24kc mipsel_74kc riscv64_generic x86_64
• нет: arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a7 arm_cortex-a9 arm_fa526 arm_xscale i386_pentium-mmx mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc_24kf mipsel_mips32 riscv64_riscv64

Причины: mips big-endian и mips64 (cronet для них нет), armv5/armv6 и arm без FPU (cronet собран под ARMv7 с VFP), mipsel_24kc_24kf (плавающая точка в железе, cronet — soft-float), mipsel_mips32 (cronet собран под MIPS32r2), i386_pentium-mmx (нет SSE2), riscv64_riscv64 (sing-box выпускает cronet только для riscv64_generic). На этих архитектурах остальные протоколы podkop-engine-full работают, а выход naive отвечает naive outbound is not included in this build.

Установка (<pkgarch> — opkg print-architecture / apk --print-arch; подробнее — docs/INSTALL.md):

OpenWrt 24.10 и старше (opkg):

wget -O /tmp/pe.ipk https://github.com/FiyeroT/podkop-engine/releases/download/v1.13.21-r11/podkop-engine_1.13.21-r11_openwrt_<pkgarch>.ipk        # podkop-engine-full: podkop-engine-full_1.13.21-r11_openwrt_<pkgarch>.ipk
opkg remove --force-depends sing-box sing-box-tiny 2>/dev/null; opkg install /tmp/pe.ipk

OpenWrt 25.12 и snapshot (apk):

wget -O /tmp/pe.apk https://github.com/FiyeroT/podkop-engine/releases/download/v1.13.21-r11/podkop-engine_1.13.21-r11_openwrt_<pkgarch>.apk        # podkop-engine-full: podkop-engine-full_1.13.21-r11_openwrt_<pkgarch>.apk
apk add --allow-untrusted /tmp/pe.apk

Архитектуры (31 ipk, 31 apk): aarch64_cortex-a53 aarch64_cortex-a72 aarch64_cortex-a76 aarch64_generic arm_arm1176jzf-s_vfp arm_arm926ej-s arm_cortex-a15_neon-vfpv4 arm_cortex-a5_vfpv4 arm_cortex-a7 arm_cortex-a7_neon-vfpv4 arm_cortex-a7_vfpv4 arm_cortex-a8_vfpv3 arm_cortex-a9 arm_cortex-a9_neon arm_cortex-a9_vfpv3-d16 arm_fa526 arm_xscale i386_pentium-mmx i386_pentium4 loongarch64_generic mips64_mips64r2 mips64_octeonplus mips64el_mips64r2 mips_24kc mips_4kec mips_mips32 mipsel_24kc mipsel_24kc_24kf mipsel_74kc mipsel_mips32 riscv64_generic riscv64_riscv64 x86_64

Совместимость: как Xray-клиент 26.9.9 (Xray-сервер 25.5.16+; с 24.x–25.4 — только если сайт-прикрытие не выбирает X25519MLKEM768).