Jolymmiles/Xray-core v26.8.22 on GitHub

Highlights

BitTorrent protocol detection no longer misfires on DNS: a query whose transaction id collides with the uTP header shape was routed to bittorrent rules roughly once per 13000 queries, intermittently breaking name resolution for proxied clients. This release is recommended for every deployment using routing rules on protocol: ["bittorrent"], especially with automatic user enforcement (webhooks/panels).
New end-to-end process gate locks in the torrent detection behavior: a real Xray process must block uTP, DHT, UDP tracker and TCP handshake probes through SOCKS while DNS and plain UDP/TCP controls pass.

BitTorrent uTP sniffing no longer classifies DNS queries (false positive, production-verified). A DNS query with transaction id 0x0100/0x1100/0x2100/0x3100/0x4100 passes the uTP type/version, extension and connection-id checks: the id reads as a valid type/version pair, the query flags 0x0100 read as a non-zero connection id, and no extension chain exists to validate. A production deployment observed 42 DNS flows routed to the bittorrent block outbound within 25 minutes. SniffUTP now explicitly passes over well-formed DNS queries (standard opcode, exactly one question, no answer/authority records, at most one EDNS0 additional record, valid labels, no trailing bytes without EDNS). A real uTP packet matching that shape would need its timestamp fields to read as those exact count values. Regression test TestSniffUTPIgnoresDNSQueries is built from the observed collision shape.
New process-level e2e test (go test -tags integration ./app/dispatcher -run '^TestBitTorrentBlockProcessE2E$'): real Xray + minimal SOCKS5 client; uTP/DHT/tracker datagrams and TCP handshakes must be dropped while DNS, plain UDP and plain TCP pass. Verified red against v26.8.20 (where the torrent probes leak) and green against this tree.

Routing behavior change: DNS queries are never classified as bittorrent. Operators using the bittorrent protocol condition with automatic enforcement should upgrade: previous versions intermittently route unlucky DNS queries (about 1 in 13000) into the bittorrent outbound.
Detection coverage is otherwise unchanged from v26.8.21. Known residual gaps remain by design: MSE/protocol-encrypted TCP peer handshakes and HTTPS tracker traffic are not detectable by content; HTTP(S) trackers are sniffed as ordinary web traffic.

Unit corpus: 111 subtests green across TCP handshakes, uTP (all packet types, SACK and close-reason chains), DHT KRPC, UDP tracker forms, and non-torrent protocols including the DNS collision shapes; go test -race green on changed packages; go vet clean.
Process e2e gate green (torrent probes blocked, controls pass).
Linux/amd64 build gate: CGO_ENABLED=0 GOAMD64=v1 -trimpath with release linker flags; static stripped ELF; sha256 29c69dedb0f9d9db34955593d639588b6d68e3dd7c718bcca8facaff9a2dccc3.