REALITY practice: Support X25519MLKEM768 for TLS' communication
REALITY 抗量子更新第一弹来袭!升级服务端、客户端至该版本,REALITY target 支持 X25519MLKEM768 时将自动启用
X25519MLKEM768 可有效预防被“现在记录、以后拿量子计算机解密 TLS 流量”,此外 #3813 (comment)
最近有越来越多的网站开始支持 X25519MLKEM768 了,所以服务端一定要及时升级,避免新版客户端连不上
感谢 @yuhan6665 对 REALITY 仓库的维护,以及 @mingyech @BRUHItsABunny 对 uTLS 仓库的维护
有人觉得这次是 breaking,其实不尽然,因为我发得早,现在已经支持 X25519MLKEM768 的就技术前沿像 CF、Google 这样的,它们都没人偷,等一两个月后其它网站陆续开始支持了,大家的服务端早就升级、兼容了,所以我必须让 v25.5.16 成为新的稳定版
Shadowrocket TF 版已支持 XHTTP,大家可以测测,如果有问题请反馈过去
此外从上个版本开始,auto mode 的 XHTTP TLS 默认改为 packet-up,XHTTP REALITY 默认仍为 stream-one
请支持一个 REALITY NFT:https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力,请支持一个 Project X NFT:https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖,并使用 Go 1.24.3 编译,已 tag v1.250516.0,感谢所有贡献者,详见下方 change log
What's Changed
- README.md: Add Remnawave to Web Panels by @iambabyninja in #4498
- API: Fix data race in online ipList by @Fangliding in #4513
- DNS: Ensure order for DNS server match by @Fangliding in #4510
- DNS: Add
allowUnexpectedIPs
for DnsServerObject by @patterniha in #4497 - DNS: Add
tag
for DnsServerObject by @Fangliding in #4515 - DNS: Retry with EDNS0 when response is truncated by @Fangliding in #4516
- DNS: Add
timeoutMs
for DnsServerObject by @patterniha in #4523 - Sockopt: Fix Windows UDP
interface
bind; Allow LinuxcustomSockopt
work for UDP by @Fangliding in #4504 - DNS DoH: Use EDNS0 with 100-300 padding by default (body padding) by @RPRX in 607c2a6
- Env: Add
XRAY_LOCATION_CERT
variable by @patterniha @RPRX in #4536 - DNS: Support returning upstream TTL to clients by @Meo597 in #4526
- DNS: Add
expectedIPs
as an alias ofexpectIPs
by @patterniha in #4551 - HTTP inbound: Directly forward plain HTTP 1xx response header by @Fangliding in #4547
- Chore: Optimize .gitignore by @Pk-web6936 in #4564
- DNS: Use cache for NXDOMAIN (rcode 3 error) by @patterniha in #4560
- Sockopt: Fix Windows Multicast
interface
bind by @xqzr in #4568 - WireGuard: Improve config error handling; Prevent panic in case of errors during server initialization by @IlyaGulya in #4566
- Dialer: Do not use ListenSystemPacket() when dialing UDP by @RPRX in 8284a0e
- Sockopt: Fix Darwin (macOS, iOS...) UDP
interface
bind by @92613hjh in #4530 - Sockopt: Allow listen
v6only
work for Windows & Darwin by @xqzr @RPRX in #4571 - Config: Implement missing MarshalJSON for structs having custom UnmarshalJSON by @ragavpr in #4585
- Sockopt: Use Windows
syscall
by @xqzr in #4581 - Fix issues related to android client by @Cl-He-O in #4616
- Sockopt: Allow
customSockopt
work for Windows & Darwin by @Fangliding in #4576 - README.md: Add Loon to Others by @RPRX in 8212325
- README.md: Rename Clash.Meta to mihomo in Others by @RPRX in 2916b1b
- XHTTP client: Set packet-up as the default
mode
(auto) when using TLS by @RPRX in 0995fa4 - Sockopt: Fix Windows IP_MULTICAST_IF & IPV6_MULTICAST_IF by @xqzr in #4627
- DNS log: Optimize IP address display by @ddatsh in #4630
- uTLS: Add new fingerprints by @yuhan6665 in a608c5a
- QUIC sniffer: Full support for handling multiple initial packets by @j2rong4cn @RPRX @Vigilans @xiaokangwang @dyhkwong in #4642
- buffer.go: Ensure extended part by Extend() & Resize() are all-zero by @RPRX in 2eed70e
- QUIC sniffer: Optimize the code by @j2rong4cn in #4655
- Sockopt: Fix some domainStrategy & dialerProxy bugs by @patterniha in #4661
- DNS: Fix some bugs; Refactors; Optimizations by @patterniha in #4659
- Workflows: Build Android(7+) using NDK; Add Android(7+) amd64 build by @j2rong4cn in #4664
- Chore: Update gVisor to the latest version; Fmt .go files by @Pk-web6936 in #4663
- Improve random IP compatibility: support IPv4, add srcip option, and sync client source IP via sendthrough by @ImAubrey in #4671
- DNS: Extend
hosts
Abilities by @patterniha in #4673 - Workflows: Authenticating the GitHub API call with GitHub token by @yin1999 in #4703
- DNS-Hosts: appending matched-results again by @patterniha @Fangliding in #4702
- Workflows: Ensure Geodat exists by @Meo597 in #4680
- Removing code that was not being executed and should not be executed. by @patterniha in #4721
- REALITY practice: Support X25519MLKEM768 for TLS' communication by @RPRX in 7ddc4a2
- REALITY protocol: Remove ChaCha20-Poly1305 support for REALITY's session id auth by @RPRX in 09d84c4
- Sniffer: Fix potential infinite loop by @patterniha @Fangliding in #4726
- QUIC sniffer: Fix potential slice panic by @Fangliding in #4732
New Contributors
- @Meo597 made their first contribution in #4526
- @Pk-web6936 made their first contribution in #4564
- @IlyaGulya made their first contribution in #4566
- @92613hjh made their first contribution in #4530
- @ragavpr made their first contribution in #4585
- @Cl-He-O made their first contribution in #4616
- @ddatsh made their first contribution in #4630
- @j2rong4cn made their first contribution in #4642
Full Changelog: v25.3.6...v25.5.16