Jolymmiles/Xray-core v26.11.10-1249

Xray-core v26.11.10-1249

on GitHub

Highlights

• Upstream v26.11.9 (#79). Chrome 155 is the new default chrome fingerprint and hellochrome_155 is new. Mux.Cool defaults rise to a concurrency of 128 and a lifetime of 1024 reuses, and the release adds XDRIVE Google Drive optimizations, new TUN autoSystemWfpBlockLeak values, and freedom finalRules logLevel / delay.
• XHTTP h2Flow governor fixes (#74, #75). A governed server no longer loses its per-connection send-window cap after a download ends at its window, and a download that returns to pi no longer steps from an error measured before it left.

Fork fixes

• Connection send-window cap kept after an ended download (#74). When a download ended on the frame that used up its window while the client's side stayed open, as in stream-one, endDown left the stream marked as waiting. The guard then fired for a finished stream: it sent a PING and a WINDOW_UPDATE, and on a client that credits in large steps it set sendWindow = 0, removing the h2Flow.maxConnectionSendWindow bound (4 MiB by default) for the rest of the connection. endDown now clears the waiting mark, so sibling downloads keep the designed capped credit.
• pi restart after leaving pi (#75). pi steps in velocity form (Ki·e + Kp·(e − piPrev)). Outside pi the governor cleared piRTT but kept piPrev, so the first Kp step on return used an error taken under another path. piPrev is now cleared too, and a returning stream starts from an error of zero.
• Mux.Cool MutexWriter keeps interrupts (#79). Upstream wraps every worker's link writer in a MutexWriter that embeds only buf.Writer, so common.Interrupt(link.Writer) did nothing when a worker ended and the client carrier and inbound waited for their own timeouts. The fork's MutexWriter forwards Interrupt and Close without taking the lock; the XUDP response sink writes through it as well.
• uTLS P-256 key share (#79). Upstream now pins refraction-networking/utls a13c59ffe98b, where a Firefox hello still fails with "tls: invalid server key share" when the server picks P-256 (utls#402 / XTLS#416). The fork's fix is rebased onto the new key-exchange code as Jolymmiles/utls 6906384, and go.mod replaces uTLS with it.
• Sniffing timeout (#79). TimeoutWrapperReader reports a timeout as buf.ErrReadTimeout, as upstream XTLS#7327 does. With sniffing on, VMess, Trojan and Shadowsocks no longer end a request whose client stays silent for 100 ms. Vision still pads the header on timeout.
• XDRIVE config copy (#79). paramsForStorage clones its Config instead of copying a protobuf message by value, which go vet (copylocks) rejects in upstream code. XDRIVE keeps the fork's reservation under the pool lock and adds upstream's IsClosed check.

Upstream changes

• v26.11.9
  • uTLS: Chrome 155 is the default fingerprint, and hellochrome_155 is registered (XTLS#7135).
  • REALITY: the in-tree copy takes 4bb46b2afd8b; probe deadlines in record_detect.go, and an empty SNI no longer fails.
  • Mux.Cool: a concurrency of 0-128 becomes 128, and the per-connection reuse budget is 1024, both for maxReuseTimes 0 and for the XUDP pool (was 128).
  • Inbound: a handler that fails to start is closed and removed (XTLS#7223).
  • TUN: autoSystemWfpBlockLeak accepts "all", "allexceptlan", ports, port ranges, "tcp"/"udp", "icmp" and a leading CIDR, and always allows loopback, DHCP and IPv6 neighbor discovery (XTLS#7315). Windows IPv6 setup errors for gateway, dns and autoSystemRoutingTable are logged instead of exiting when IPv6 is disabled (XTLS#7325, XTLS#7332, XTLS#7341).
  • Freedom finalRules: logLevel is added, blockDelay becomes delay (the old name is deprecated), and the default safe policy also applies to MASQUE (XTLS#7329).
  • WireGuard: the endpoint lookup gives up at the connection's deadline (XTLS#7323).
  • UdpHop finalmask: no spurious error logs on closed hop sockets (XTLS#7319).
  • Geodata: .dat.gz is downloaded for XTLS/Xray-rules-dat URLs (XTLS#7334).
  • XDRIVE: Google Drive backend optimizations (XTLS#7340, XTLS#7352) and a retry of "local" Get on Windows sharing violations (XTLS#7316).
  • Dependencies: golang.org/x/net 0.62.0, google.golang.org/grpc 1.85.0, klauspost/cpuid 2.4.2.

Compatibility notes

• Fingerprint. chrome and hellochrome_auto now send a Chrome 155 ClientHello. hellogolang matches Go 1.27, adding signature_algorithms_cert and the P-256/P-384 ML-KEM hybrid groups. Every other fingerprint keeps its extensions, groups and key shares.
• Mux.Cool. Clients that leave concurrency or maxReuseTimes unset now carry more streams per connection and reuse a connection longer. The fork's maxReuseTimes validation and config field 30 are unchanged.
• Freedom. finalRules[].blockDelay still works but logs a deprecation warning; rename it to delay.
• Wire formats. VLESS, Trojan, REALITY server, Vision and SMUX wire bytes are unchanged.
• Fork deviations. Fork deviations from upstream, and the tests that guard them, are listed in docs/FORK.md. Builds use Go 1.27.3 with -tags http2legacy.

Validation

• Local testing/release/structural_presence.sh standard passed on the upstream-sync candidate 36215d63: vformat, vet, unit, race and checkptr over ./..., the VLESS 36/36, SMUX 72/72, H2MUX 72/72 and header-record 12/12 process cells, version skew and presence. The first run hit the known TestDokodemoTCP PickPort EADDRINUSE flake; the rerun was clean.
• Pre-release Validation and Tests and Checkings passed on release commit 297fef3a.