Release v6.5.0 · zerolabnet/SSClash-Go

SSClash v6.5.0

DNS interception — Block DoT / DoH

Added optional Block DoT (port 853) and Block known DoH (dibdot) when Mihomo DNS interception (upstream or firewall redirect) is enabled.
Added Block DoH (custom list): user https://host/path lines, resolved to IPv4 on save, merged into the same firewall drop set as dibdot.
dibdot list is downloaded at runtime (daily refresh).
Custom DoH URLs in a collapsible “Custom DoH list” section with URL count badge and resolved-IPv4 status panel.
Hot-update of the DoH ipset/nft set when lists change without a full firewall re-apply where possible.
Conntrack flush after DNS intercept repair is more reliable; optional warning if conntrack-tools is missing.

Keenetic — NDMS firewall

SSCLASH_LATE chain at the end of mangle PREROUTING re-enters CLASH after Keenetic NDMS overwrites packet marks.
Validate/repair ensures the late jump exists and stays last; tests extended.
Transparent-proxy loop bypass treats both TPROXY and TunUDP marks consistently.

Web UI — proxy country flags

Embedded Twemoji Mozilla flags-only font (~78 KB).
Shared typography via --font-ui and --font-mono; mono styling for technical Settings fields.
Custom hover tooltip for truncated proxy names and preview dots (native title still shows letter fallbacks like DE on some OSes).

Web UI — Settings

Mihomo kernel — low disk space

Web UI download: chooses stage + rename vs in-place replace from free space; stops Mihomo only when the on-disk binary must be replaced; verifies before swap; cleans stale .mihomo-new.* only (does not remove the live binary).
Install scripts (Keenetic / OpenWrt / Linux): shared install_checked_bin — same staging/replace logic for Mihomo and SSClash; cleans partial .mihomo-new.* / .ssclash-install.*; Mihomo -v check when the source path is executable.

Config / TUN

tun.stack: mips supported in profile transform (pure-Go mipstack) alongside system, gvisor, and mixed.