Jolymmiles/Xray-core v26.8.27-0834

Xray-core v26.8.27-0834

on GitHub

Highlights

• REALITY inbounds with sockopt.acceptProxyProtocol no longer crash the accept goroutine. A type assertion in the upstream REALITY handshake (reality.CloseWriteConn) panicked whenever the accepted PROXY protocol connection reached it without an outer provenance carrier; the wrapper now forwards half-close and RawConn to the physical connection.
• Fixed the same interface-conversion panic one layer up for REALITY behind the finalmask Minecraft (xmc) mask, whose server connection did not expose CloseWrite.

Fork fixes

• transport/internet/system_listener.go: forward CloseWrite/SyscallConn through acceptedProxyProtocolConn (pires/go-proxyproto v0.15.0 keeps the underlying connection private). Underlying transports that cannot half-close now degrade fail-soft instead of crashing the server.
• finalmask/xmc: server connections forward half-close; fragment forwarding pinned as well.
• Regression coverage: REALITY capability contract tests for RAW TCP and unix PROXY inbounds, loopback contract tests across fragment/sudoku/custom masks plus conn-level probes for fragment and xmc.

Upstream changes

Merged upstream/main (XTLS/Xray-core) through aa3d6589: TUN inbound Darwin kqueue wait (XTLS#6580), OpenBSD transparent proxy SO_REUSEPORT/IPv6 fixes (XTLS#6624), XHTTP client GetBody() for h2 replay after GOAWAY (XTLS#6632), XHTTP client race/data-race fix (XTLS#6665), Observatory CPU spin fix (XTLS#6669), router API data-race refactor (XTLS#6678), sniffer UTP fix (XTLS#6667).

Compatibility notes

• No wire-protocol changes; VLESS, Trojan, REALITY, Vision, SMUX bytes unchanged.
• Operator-facing: acceptProxyProtocol on RAW+REALITY inbounds is safe again with PROXY-capable fronting (nginx/caddy/haproxy).
• Upstream conflict resolution took upstream naming in splithttp/dialer.go; no behavioral delta.

Validation

• go test ./core ./common/net ./transport/internet/... ./proxy/vless/inbound -count=1 — pass after merge.
• go test -race over transport/internet/..., common/net, core — pass.
• Repository-wide go test ./... -count=1 — pass.
• go vet ./transport/internet/... ./common/net ./proxy/... — clean; protobuf header gate replicated locally — pass.
• Linux/amd64 build: CGO_ENABLED=0 GOAMD64=v1 -trimpath, go1.27.0, sha256 b2c2a1daf92f9a6171df1a6273ba161b7d7c426b133dd28769c47fd798e7688d (local gate copy; official assets come from CI).
• Known limitation recorded honestly: the 36-cell sing-box/Mihomo process matrix could not run on this host — external client checkouts are not present locally; reported as an unmet external environment requirement, not silently skipped.