Jolymmiles/Xray-core v26.11.1-1424

Xray-core v26.11.1-1424

on GitHub

Highlights

• Upstream v26.10.29 and v26.10.31 (#71). New in this release:
  • XHTTP server h2Params.
  • OPTIONS as an XHTTP uplink method.
  • MPTCP is off by default on listeners.
  • A stricter QUIC and TLS sniffer.
  • Limits on geodata downloads.
  • The XDRIVE slot ring and an S3 backend.
• h2Params works with the fork's h2Flow governor. A receive window set in h2Flow overrides the one from h2Params. With the governor on, its defaults fill only the windows that neither config sets.

Fork fixes

• Splithttp protobuf field numbers (#71). Upstream gave field 30 of the splithttp Config message to h2Params. The fork used field 30 for muxKeepAliveSecs. The fork-owned muxKeepAliveSecs, muxKeepAliveBytes and h2Flow move from 30, 31 and 32 to 100, 101 and 102, so upstream's next fields stay free.
• XHTTP listener leak on a bad h2Params (#71). Upstream parses h2Params after the TCP listener binds, and its error path does not close the listener. The address then stays bound until the process exits. The fork parses h2Params before binding.
• Governed stream limit (#71). A server with the h2Flow governor on now refuses an h2Params.MaxConcurrentStreams above 4096, the number of streams the governor tracks. Before, the server could advertise more streams than that, and the next stream past 4096 would tear the connection down.
• TLS sniffer (#71). The fork's two-value sniffer API now carries upstream's rejection of an empty SNI HostName (XTLS#7292).

Upstream changes

• v26.10.29
  • Config: inbound modules now initialize last (XTLS#7284).
  • XDRIVE: the Google Drive slot ring (XTLS#7217) and an s3 storage backend (XTLS#7231).
  • WebSocket: a normal close frame now reads as io.EOF (XTLS#7236).
  • Darwin: the swapped TCP keepalive idle and interval are fixed (XTLS#7219).
  • DNS outbound: hijacked A/AAAA replies stay within the buffer (XTLS#7225).
  • Geodata: download size, file extension and update frequency are limited (XTLS#7267). The client is HTTPS-only, and a cron interval under one minute is refused.
  • Geodata: the built-in "private" IP ranges now cover more ranges, for example NAT64 64:ff9b::/96 and 6to4 2002::/16 (XTLS#7249).
  • Freedom: a warning to migrate fragment and noises to Finalmask (XTLS#7242).
  • Linux IPv6 process routing (XTLS#7232), the file loader's extension check (XTLS#7255), and xray api adrules (XTLS#7276).
• v26.10.31
  • The default listener disables MPTCP unless sockopt.tcpMptcp is set (XTLS#7291).
  • XHTTP server: h2Params (XTLS#7295), and OPTIONS as uplinkHTTPMethod (XTLS#7290).
  • The QUIC sniffer rejects a ClientHello with gaps in its CRYPTO data (XTLS#7292).
  • The HTTP inbound forwards short 100 Continue responses at once (XTLS#7298).
  • Geodata decompresses gzip while streaming (XTLS#7294).
  • TUN autoSystemWfpBlockLeak accepts tcp/port and udp/port (XTLS#7288).
  • xray api bi takes several balancers (XTLS#7299).
  • Regenerated *.pb.go files (XTLS#7287).

Compatibility notes

• Protobuf configs and API clients. A protobuf config or API client built against the old splithttp field numbers 30, 31 and 32 must be regenerated. Otherwise its keep-alive and h2Flow settings are lost. A nonempty old field 30 now lands in h2Params and fails the listener. JSON configs are unaffected.
• NAT64 hosts. Freedom blocks private destinations by default for VLESS, VMess, Trojan, Hysteria, WireGuard and Shadowsocks inbounds. Since upstream's XTLS#7249, NAT64 64:ff9b::/96 counts as private. On an IPv6-only server behind DNS64/NAT64, IPv4-only destinations are therefore blocked unless finalRules allows them. The fork keeps upstream's behavior here.
• Geodata cron. Geodata refuses cron intervals under one minute and non-HTTPS asset URLs.
• MPTCP. Listeners no longer accept MPTCP unless sockopt.tcpMptcp is set.
• Wire formats. VLESS, Trojan, REALITY, Vision and SMUX wire formats are unchanged.
• Fork deviations. Fork deviations from upstream, and the tests that guard them, are listed in docs/FORK.md. Builds use Go 1.27.3 with -tags http2legacy.

Validation

• Local structural_presence.sh standard passed on candidate 1ae21119, including race, checkptr, process interoperability matrices and version-skew scenarios.
• Pre-release Validation and Tests and Checkings passed on release commit 3b2591c6.
• Earlier validation attempts exposed test port collisions; fixes landed in #72 and #73 before this release.