github DanielLavrushin/b4 v1.87.0rc2
on GitHub

pre-release4 hours ago

[1.87.0] - 2026-10-15

  • ADDED: A set can remove ECH keys from DNS answers, so a browser opens sites such as those on Cloudflare where the network drops connections that use ECH - the switch is under DNS & Routing, DNS Redirect, Encrypted ClientHello (ECH) in the set editor, a set that lists cloudflare-ech.com with it on covers every Cloudflare site, and in NFQUEUE mode it also acts on DNS answers that travel over IPv6 while IPv6 support is off. Discovery proposes such a set, which changes no packets, for a site that loads only without ECH.
  • CHANGED: On Keenetic, and on routers with an older kernel where b4 cannot hold DNS queries ahead of the kernel's connection tracking, DNS queries go on to the resolver the device asked, and b4 takes over that resolver's reply for the names a set blocks, pins or sends to its own resolver - that resolver and the servers it asks still see those names, also for a set with an encrypted resolver. System Info shows the row DNS queries copied, not held (NFLOG).
  • FIXED: On Keenetic, a device that asked for a name's IPv4 and IPv6 addresses at once, and the router itself, still often lost the second answer after 1.85.1, while System Info showed DNS queries queued before conntrack (raw) as available or the log suggested kmod-ipt-raw, an OpenWrt package - KeeneticOS runs the raw table, where b4 queued DNS queries from 1.85.1 on, only after the kernel's connection tracking has registered them. #402
  • FIXED: On routers with an older kernel, a device occasionally got only one of the two answers it asked for at once, IPv4 or IPv6, for a name in a set with a DNS redirect - b4 sent both answers at the same moment, and the kernel's connection tracking dropped one of them as a duplicate of the other.
  • FIXED: On routers with iptables and an older kernel, such as Keenetic, connections through a set with SYN Fake Packets on took about a second longer to open, and with the UDP mode Fake & Fragment most of the fakes were lost, often along with the real first QUIC packet - since 1.25.0, b4 put the packets it sends itself through its own queue a second time, and the kernel's connection tracking on such a router dropped some of them.
  • FIXED: A device that sends several DNS lookups from one socket, such as a DNS server on the local network, had its later lookups skip b4 once b4 had answered one of them itself or changed one of its answers, for example by removing the IPv6 addresses - b4's firewall rules marked the device's connection as one of b4's own when b4 sent the device an answer as a packet of its own.
  • FIXED: A set with Domain-only matching on applied only to the start of each connection - the rest of the connection went out without the set's strategy and showed no set on the Traffic page. Where several sets share an address or port, those packets could get another set's strategy instead. A domain-only set that blocks a site or drops its QUIC did not stop Chrome from opening the site over QUIC. b4 picked the set for later packets by address or port, and a domain-only set does not track addresses. #428
  • FIXED: With the UDP action Coalesce QUIC Initial, sites did not open over QUIC in Chrome - b4 put the padding packet in front of every packet of a connection's QUIC handshake, not only the one that carries the site name. The servers left those packets unanswered. Once the set had learned the site's address, this hit the first packet of the handshake too. #427
  • FIXED: Discovery reported a site, such as one on Cloudflare, as loading without b4 while Chrome could not open it - its probes never used ECH, which a browser such as Chrome uses for every site that publishes an ECH key and which some networks block.
  • FIXED: Discovery could propose a packet strategy remembered from an earlier run for a site that only needed its DNS answer corrected - a remembered strategy that also loaded the site won over the DNS fix.
  • FIXED: System Info listed tools such as jq, sha256sum and ipset without a version when they were on the USB drive b4 is installed on - b4 asked a tool for its version only when it sat in a standard system directory such as /usr/bin or /opt/bin.
  • FIXED: A regexp: entry listed in two sets, such as a set and its copy made with Duplicate, worked only in the set higher in the list, so when one of them was limited by Source devices, some devices got the wrong set or none for the names that entry matches - b4 kept each pattern only for the first set that listed it.
  • FIXED: A device added by hand by its IPv6 address, typed in another form such as in capitals or with leading zeros, was not recognised when b4 matched its traffic to a set's domains, so a set that selects it under Source devices skipped it and one with All devices except selected applied to it - b4 looked packets up by the standard form of their address, while it kept the device's address as typed.
  • FIXED: Apps that use TCP Fast Open could not open sites through a set with a strategy - such an app puts the start of its secure connection into the packet that opens the connection. b4 split that packet like ordinary data, and every piece opened the connection again with different numbering. The site kept one of them and could not read the start. #431
  • FIXED: Window Mode sent malformed fake packets on connections that use TCP timestamps, which Linux turns on by default - each fake kept the header length of the original packet but carried only the first part of the header.
  • FIXED: SYN MD5 Signature could send its fake SYN without a usable MD5 option, such as for an app that uses TCP Fast Open - when the real SYN's options left no room, the option was left out. When they ended with an end-of-options marker, it went after that marker, where servers stop reading. A server it reached could take the fake for a real SYN.
  • FIXED: b4 could stop on a malformed TCP packet sent to an address a set covers - the packet's header claimed to be shorter than any TCP header can be. b4 read past the end of the packet while applying the set's strategy.

What's Changed

Full Changelog: v1.87.0rc1...v1.87.0rc2

Check out latest releases or
releases around DanielLavrushin/b4 v1.87.0rc2

Don't miss a new b4 release

NewReleases is sending notifications on new releases.

Get notifications