wwqgtxx
e40b5962e4
feat: add rate-limit for restls listener
2026-07-20 14:51:26 +08:00
wwqgtxx
05b5334ce0
feat: add handshake-timeout for hysteria2
2026-07-20 10:13:03 +08:00
Lanlan13-14
e26714a181
feat: support TLS rekey fix, data-ciphers negotiation, tls-crypt-v2 for OpenVPN ( #2989 )
2026-07-18 19:18:54 +08:00
anytls
bd749c65bc
feat: sync anytls v0.0.13 ( #2990 )
2026-07-18 10:41:27 +08:00
wwqgtxx
9ae1cc2be2
fix: shadowquic JLS pre-flight fallback handle
2026-07-17 15:52:42 +08:00
wwqgtxx
1eb49e0571
doc: explain the flaws in the official Shadowquic implementation regarding JLS 0-RTT authentication
2026-07-17 08:39:14 +08:00
wwqgtxx
a5167fa4ab
fix: allow JLS fallback before the server flight
...
Decide whether fallback is safe based on bytes actually written instead of JLS authentication status. This allows authenticated preflight failures, including HRR and TLS configuration mismatches, to relay the untouched ClientHello to the camouflage target.
Keep rejecting fallback after a partial or complete server flight, update jls-tls for pre-write alert suppression, and add coverage for both sides of the write boundary.
2026-07-16 23:02:17 +08:00
wwqgtxx
f86bc224dc
fix: align HelloRetryRequest handling with JLS v3
...
JLS v3 does not permit HelloRetryRequest during JLS authentication. Keep the ClientHello random unchanged across HRR and make clients continue as ordinary TLS with certificate verification.
When an authenticated ClientHello would require HRR, fail before writing handshake data and wrap ErrJLSAuthFailed. This allows stream and QUIC callers to forward the untouched handshake to the camouflage fallback instead of accepting a non-standard JLS exchange.
2026-07-16 22:17:24 +08:00
wwqgtxx
423611628c
chore: better UserFromConn implementation
2026-07-16 20:47:52 +08:00
freephilx
0ee584171e
fix: reconnect OpenVPN on server soft reset ( #2978 )
2026-07-16 17:04:33 +08:00
wwqgtxx
9a7e726657
fix: performance regression caused by unnecessary wrapping in stream encryption
2026-07-16 16:27:34 +08:00
wwqgtxx
a70af27451
fix: remove unnecessary quinn-jls compatibility behavior
2026-07-16 10:03:47 +08:00
wwqgtxx
5c1b8bfc31
chore: authenticate JLS ServerHello using its wire encoding
...
JLS authenticates the serialized ServerHello with only the random field zeroed. The previous marshalForJLS implementation reordered extensions to match rustls-jls's internal struct order, even when that order differed from the bytes sent on the wire.
That canonical order is not defined by TLS or the JLS specification and couples this package to a rustls-jls implementation detail. Use the normal marshal output when sending and the original wire bytes when receiving, preserving extension order and leaving the TLS transcript untouched.
This intentionally removes compatibility with rustls-jls clients that re-encode ServerHello extensions before JLS verification.
2026-07-16 09:04:31 +08:00
wwqgtxx
e3c1ea06a4
chore: better handshakeRecorderConn impl
2026-07-16 08:40:18 +08:00
wwqgtxx
e9119858b2
chore: change the brutal negotiation in shadowquic to be asynchronous
2026-07-16 00:02:50 +08:00
AaronChen0
c079b0cc12
fix: panic on full-width IP-SUFFIX rules ( #2975 )
2026-07-15 21:51:32 +08:00
wwqgtxx
b75a776d39
chore: clean up duplicate helpers in tests
2026-07-15 18:29:59 +08:00
wwqgtxx
9ab75434a9
feat: support restls/jls for snell outbound and listener
2026-07-15 18:16:38 +08:00
wwqgtxx
da5a3e52ae
chore: rewrite the internal mutual exclusion logic of the outbound
2026-07-15 17:55:48 +08:00
wwqgtxx
b6ed8e2643
chore: rewrite the internal mutual exclusion logic of the listener
2026-07-15 17:43:18 +08:00
wwqgtxx
8507c1e221
fix: missing override shadow-tls-opts and restls-opts in xhttp download-settings
2026-07-15 17:42:58 +08:00
wwqgtxx
bc5976f4ed
chore: sync internal logic
2026-07-15 16:59:59 +08:00
wwqgtxx
0e7c3c79e3
feat: support restls for anytls outbound and listener
2026-07-15 16:52:21 +08:00
wwqgtxx
769ea6f5b4
feat: support restls for vmess/vless/trojan outbound and listener
2026-07-15 16:49:02 +08:00
wwqgtxx
bc0e5aa835
feat: support shadowtls for anytls outbound and listener
2026-07-15 16:18:37 +08:00
wwqgtxx
c015694bf3
feat: support shadowtls for vmess/vless/trojan outbound and listener
2026-07-15 15:51:35 +08:00
wwqgtxx
8413f50407
chore: skip frequently failed tests on windows go1.20
2026-07-15 10:18:47 +08:00
wwqgtxx
86984831ed
fix: the incorrect tls stack was used in shadowtls tests
2026-07-15 08:54:41 +08:00
wwqgtxx
2b0d8411fa
fix: make shadowtls v2 read deadlines recoverable
2026-07-15 00:31:49 +08:00
wwqgtxx
7a3c37cb33
fix: make shadowtls v3 read deadlines recoverable
2026-07-15 00:31:14 +08:00
wwqgtxx
3f22309b51
chore: respect the incoming context during JLS fallback
2026-07-14 21:51:12 +08:00
wwqgtxx
4d7ef85adb
chore: sync logic to legacy shadowsocks listener
2026-07-14 21:02:36 +08:00
wwqgtxx
44dd834fef
chore: preserve jls in-user for shadowsocks listeners
2026-07-14 17:58:28 +08:00
wwqgtxx
309cfbd613
chore: reimplement shadowtls
2026-07-14 17:22:01 +08:00
wwqgtxx
ba5c45b735
fix: anytls listener config parsing
2026-07-14 12:31:41 +08:00
wwqgtxx
94409eb659
chore: remove redundant writeFull in sudoku
2026-07-14 09:16:29 +08:00
wwqgtxx
1d1b370e4c
chore: remove redundant writeFull in snell v4
2026-07-14 09:16:19 +08:00
wwqgtxx
f23e43e68a
chore: remove redundant writeFull in gost relay
2026-07-14 09:16:19 +08:00
wwqgtxx
95af34af06
chore: remove redundant writeFull in shadowquic
2026-07-14 09:16:19 +08:00
wwqgtxx
bfa9ea1d2b
feat: support brutal for shadowquic (mihomo private extension)
2026-07-14 08:49:22 +08:00
wwqgtxx
3b73922fb9
chore: cleanup shadowquic code
2026-07-14 00:28:24 +08:00
wwqgtxx
cb8cde8da8
fix: missing override jls-opts in xhttp download-settings
2026-07-14 00:28:24 +08:00
wwqgtxx
8fe7f74811
feat: support jls for anytls outbound and listener
2026-07-13 23:50:40 +08:00
wwqgtxx
611a4481fa
feat: support jls for vmess/vless/trojan outbound and listener
2026-07-13 18:49:53 +08:00
wwqgtxx
dc4d4fcb8c
chore: allow jls with utls client-fingerprint
2026-07-13 08:57:32 +08:00
wwqgtxx
2b2bdf6d22
feat: support jls for shadowsocks outbound and listener
2026-07-13 01:31:09 +08:00
wwqgtxx
a35045d9f1
fix: consume CachedConn data in ReadCached
2026-07-13 00:39:52 +08:00
wwqgtxx
aea5ce4142
feat: support shadowquic outbound and listener
2026-07-12 22:28:43 +08:00
wwqgtxx
46f9b78626
chore: export internal OverrideExpr for api user
2026-07-12 19:12:58 +08:00
wwqgtxx
5677fd3808
feat: add name-cert-verify to support separate certificate verification name
2026-07-12 18:12:59 +08:00
wwqgtxx