CluvexStudio/Aether v2.1.0

on GitHub

Aether v2.1.0

Aether is a user-space proxy client. It tunnels traffic out of a filtered network and exposes a local SOCKS5 proxy on 127.0.0.1:1819. Point a browser, terminal, or system proxy at that address and your traffic leaves through the tunnel.

Psiphon is built in

• Three ways to use it, the same three Tor has. --psiphon carries Psiphon inside the tunnel, --psiphon-reverse dials the tunnel through Psiphon so WARP is reached from a Psiphon exit, and --psiphon-only is plain Psiphon on the usual proxy port. Both appear in the menu when you run aether with no flags.
• Nothing to configure. The credentials and server list are built in, so it connects on a fresh machine. --psiphon-config lays your own settings over them if you have them.
• --psiphon-region DE asks for an exit in a country you name, and the log lists what is on offer.
• --psiphon-mode cdn limits it to fronted meek through a CDN, for networks that block the rest; direct turns fronting off.
• --psiphon-http serves it as an HTTP CONNECT proxy as well, for clients that cannot speak SOCKS5.
• The console client ships in the pt/ folder beside the binary, next to the Tor transports.

Tor reaches its bridges again

• On a network that blocks Tor, bridgedb and onionoo are usually blocked too, so there was no way to fetch a bridge. With --tor the tunnel comes up first and the bridges are now fetched through it, which is what makes Tor work on a network that blocks it outright.
• --tor-relays takes running relays from onionoo and uses them as plain bridges. Bridgedb hands out a handful that are enumerated and blocked early; onionoo lists every running relay, thousands of them, filtered to the ports a restrictive firewall tends to leave open and measured before use.
• --tor-bridge-file reads bridge lines from a file, in the shape torrc uses.
• --tor-http serves Tor as an HTTP CONNECT proxy as well.
• The Tor SOCKS listener answers UDP ASSOCIATE for DNS, carried over TCP through the circuit, so a TUN front end can resolve names through it.

Keeping the exit where you want it

• --exit-loc '!IR,AZ,RU' refuses a tunnel whose exit country is not wanted. It is checked through the finished tunnel before SOCKS5 opens, and again every minute, so a tunnel that moves is dropped and replaced. --exit-loc DE,SE names the only countries to accept. Off unless you pass the flag.
• --stats logs how much has gone up and down and how long the tunnel has been up.

Fixes

• The HTTP/2 scan was slow to find anything. Its data-plane probe was sent once and never repeated, so a single lost packet cost the whole per-probe budget instead of 700ms. The first gateway now turns up in about a second.
• --noize firewall and --noize gfw were advertised but never implemented and fell through to balanced. Since firewall is the default for MASQUE, the default profile did not exist. Both are real now, and the <c> counter tag emits a counter instead of repeating the timestamp.
• --mark never reached the registration calls, which hung for twenty seconds on a router that routes unmarked traffic into a TUN. Registration now takes the route that carries the mark.
• A fourth API fingerprint, TLS 1.3 with a fragmented ClientHello, for networks that block TLS 1.2 outright. Fragmenting now splits inside the server name rather than at a random offset.
• Gool's inner tunnel latched onto the first source port it saw and silently dropped everything from any other, which killed the tunnel when the inner engine rebound.
• Reconnects remember the last eight working gateways instead of one, and a gateway proved on HTTP/3 is no longer reused on HTTP/2, where its port may not answer at all.

Changes

• The crate needs Rust 1.98.

Every archive ships with a matching .sha256 file, and SHA256SUMS.txt lists them all.

See README.md and the Docs directory for install steps, transport selection, obfuscation profiles, and the full environment-variable reference.

Full Changelog: v2.0.0...v2.1.0