v20261107

主要更新

• 客户端启动时预建会话，并改进连接重试、超时和资源管理。
• 修复 smux 建流时过早响应丢失、写入超时后的排队数据以及连接关闭与半关闭问题。
• 改进压缩与 QPP 并发处理、tcpraw 报文和防火墙错误处理，并补充回归测试。

验证

• Windows 和 Linux 竞态检测、静态检查，以及 TCP/QPP 集成测试通过。
• 该版本由 GitHub Actions 从本发布提交重新构建，包含 15 个平台的客户端和服务端。每个归档的 SHA-256 见 SHA256SUMS。

已知限制

• 实验性的独立进程监管尚未接入客户端实际会话。如果底层调用永久阻塞，拨号额度仍可能耗尽。
• Linux 原始套接字和防火墙路径尚未完成真实权限环境下的端到端验证。

合并记录：#29。

v20261101

kcptun v20261101

Based on master commit ecc88d1 (PR #28).

Fixes

• Prevent slow or failed tunnel setup from blocking the client accept loop. Setup is bounded to one pending request per tunnel slot; requests assigned to a busy slot close immediately and applications should retry. Failed setup is retried by later connections.
• Reject overflowing SNMP logging intervals at startup instead of panicking.
• Support the full documented rate-limit range (0–4294967295 bytes/second) on both 32-bit and 64-bit builds.

Downloads

Each platform archive contains the client and server binaries. Linux ARM5/6/7, ARM64, amd64, 386, MIPS/MIPSLE softfloat and Loong64; Windows amd64, 386 and ARM64; macOS amd64 and ARM64; FreeBSD amd64.

Verify downloads using SHA256SUMS. Configuration and protocol defaults are unchanged.

Validation

PR CI passed race-enabled unit tests, static analysis, invalid-configuration tests and TCP EOF/QPP integration tests. Release CI builds all target archives and runs additional verification on Linux amd64. Cross-compilation does not substitute for runtime testing on every target device.

v20261029

KCPTUN v20261029 — runtime safety and configuration fixes

This release packages the audited master changes merged in PR #26. Both the client and server are included in every platform archive.

Fixes

• Client remote address parsing is performed for each dial configuration instead of reusing a process-global cached destination; this prevents a later configuration from using the wrong remote endpoint.
• Validate outbound KCP pacing rate before conversion to uint32. Values above 4294967295 bytes/second are rejected instead of silently wrapping. A negative rate remains normalized to zero for backward compatibility.
• Restrict opt-in Go profiling (--pprof) to 127.0.0.1:6060 rather than all network interfaces to avoid accidental exposure.
• Reject multiple JSON values and trailing invalid content in configuration files instead of silently accepting only the first value.
• Close underlying KCP transports if SMUX session creation fails to avoid leaking network resources.
• Add unit and integration regressions plus a continuous pull-request and master CI workflow (race detector, go vet, invalid configuration tests, TCP half-close and QPP).

Compatibility

The transport protocols, on-wire framing, and vendored dependencies are unchanged. Remote access to profiling now requires an explicitly configured secure tunnel. Positive rate limits larger than 4294967295 are invalid instead of silently wrapping.

Downloads and verification

Release archives kcptun-<os>-<arch>-20261029.tar.gz contain both client_* and server_* executables; Windows binaries have .exe extensions. The build covers 15 targets across Linux, macOS, Windows, and FreeBSD. SHA256SUMS lists the archive checksums.

The Linux/amd64 client and server are executed against integration tests in GitHub Actions. Other targets are cross-compiled and package-verified but not executed on their target operating systems. All release assets are published only after the release build matrix succeeds.

Source: #26

v20261028

KcpTun v20261028 — transport validation and reliability fixes

Fixes

• Stop and close failed KCP listeners instead of repeatedly logging a latched error in a tight loop.
• Validate FEC shard counts before opening sessions, preventing overflow and division-by-zero crashes. Zero-shard FEC disabling remains supported.
• Validate MTU against encryption and FEC overhead before listening, and check SetMtu failures instead of silently retaining the default.
• Return a nonzero process exit status for command-line and startup errors.
• Encrypt a private buffer in QPPPort.Write so caller-owned plaintext buffers can be reused safely.
• Reject out-of-range connection and QPP counts and invalid keepalive settings at startup.
• Docker builds use vendored dependencies, preserving the smux half-close fix.

Compatibility

FEC shard counts must be nonnegative. When FEC is enabled, data and parity shard counts must total at most 256. MTU is limited to 1500 bytes and must leave at least 50 bytes after encryption and FEC overhead (minimum 78 with default AES and FEC). Invalid values now fail at startup.

Downloads and verification

Each platform archive contains client and server binaries. SHA256SUMS contains archive checksums. The release workflow runs race tests, invalid CLI/JSON configuration tests, and loopback half-close regressions on Linux amd64. Other platforms are cross-compiled and packaged without native runtime testing.

v20261018

KcpTun v20261018 — prompt EOF and reliable half-close

Fixes

• Server closewait now defaults to 0, matching the client. Target EOF is forwarded immediately instead of being held for an additional 30 seconds. Explicit positive closewait values retain their existing behavior.
• Keep unread smux data alive after both peers send FIN. Previously, automatic stream cleanup could discard the buffered response or reverse upload. The caller now releases the stream with Close after consuming its data.
• Preserve CloseWrite through the QPP wrapper, so receiving EOF in one direction does not terminate the other direction.
• Abort both pipe directions on a copy error, including TCP reset, instead of leaving the reverse copy blocked or sleeping for closewait.

Upgrade

Upgrade the server on the VPS to remove its old 30-second default. Upgrade both client and server for the half-close fixes. An existing JSON setting such as "closewait": 30 overrides the new default; remove it or set it to 0 on each endpoint.

closewait controls EOF forwarding; it is not a TCP idle timeout. This release does not shorten established TCP idle timeouts. The separate SSR timeout: 120 setting can remain unchanged.

Verification and downloads

Regression tests exercise real loopback KCP tunnels with smux 1 and 2, QPP on and off, complete payload delivery, EOF forwarding, and reverse traffic after half-close. Go tests also cover buffered data after both FINs and TCP reset cleanup. The release workflow runs the full Go test suite with the race detector before publishing.

Each platform archive contains both client and server binaries. SHA256SUMS contains archive checksums. The linux/amd64 binaries are executed in CI; the other targets are cross-compiled and packaged, without runtime testing on those platforms.

v20260924

Changes:

• Change the default smux protocol version from 2 to 1 for both client and server.
• Keep explicit smux v2 selection available with -smuxver 2.
• Add regression coverage and update the documented defaults.

Builds:

• Go 1.24.13
• CGO disabled
• UPX compression not applied

v20251017

refine words

v20250811

v20250811

v20240329

v20240329

v20230720

v20230720