- tlsmimic: wrap QUIC packets in TLS 1.3 record headers
- multi: auto-detect Salamander/TLS-mimic/plain on the same port
- multi: random padding and jitter support for DPI evasion
- reconnect: periodic session recreation via MaxSessionDuration
- client/server: wire tlsmimic/auto/plain obfs types and config
- NEW_FEATURES: translated to English
- Network: Layer 3 IP tunnel over QUIC with TUN interfaces and IP pool
- FileMask: new noise/obfuscation layer masking traffic as encrypted file downloads
- Hysteria outbound: chain Hysteria servers via pluggable outbound
* fix(firewall): 修复 nftables 在绑定特定 IPv6 地址时重定向失效的问题
* fix(firewall): use DNAT for specific IPv6 bind in iptables port redirect
* chore: format fix
---------
Co-authored-by: Toby <tobyxdd@gmail.com>
Adds a new realm "ipMode" config option (v4 | v6 | dual, default dual)
on both client and server that restricts realm connections to a single
IP family end-to-end: the UDP socket is bound to udp4/udp6, STUN only
gathers addresses of that family, and hole punching only tries peer
candidates of that family.
The HTTP proxy server's dispatch method decodes the Proxy-Authorization
Basic credential using base64.URLEncoding, but RFC 7617 specifies that
Basic authentication uses standard Base64 encoding (base64.StdEncoding).
The two encodings differ in their use of +/ vs -_ characters, so any
credential containing 0xff or other bytes that encode to / or + in
standard Base64 will fail to decode with URLEncoding, causing valid
authentication attempts to always be rejected with 407.
Additionally, the "Basic " scheme prefix check was case-sensitive, but
RFC 7235 section 2.1 specifies that auth-scheme is case-insensitive.
Fix both issues by switching to base64.StdEncoding and using
strings.ToLower for the scheme comparison.
OpenSSL 3.x requires Subject Key Identifier, Authority Key Identifier,
and Key Usage (keyCertSign) extensions for CA certificate chain
validation. The test certificate generator was missing these, causing
test failures on systems with OpenSSL 3.x.
Co-authored-by: Vladislav Tatjanin <l27001@altlinux.org>
* feat(wip): hysteria realms
* feat: port prediction for punching symmetric NAT
* feat: add "cert" subcommand for easy self signed cert generation
* refactor: update address scheme from "hysteria2+realm" to just "realm"
* fix: give up on realm register fatal errors
* chore: update formatting (gofumpt)
* perf: realm proxy UDP methods on PunchPacketConn so quic-go and obfs keep DF/PMTU and buffer sizing
* feat: add support for local UDP source port config in realm addresses
* doc: README for realm pkg
* fix(app): invalid priority in output hook when setting redirect with nft
Server startup fails with nftables before v1.0.9, as it doesn't support
dstnat mnemonic in the output hook. Work around this by using the raw
number (-100) as recommended by Florian Westphal [1].
1. https://bugzilla.netfilter.org/show_bug.cgi?id=1694#c1
* chore(app): use "-100" instead of "dstnat" for both chains
---------
Co-authored-by: Toby <tobyxdd@gmail.com>
A malicious actor was capable of intercepting quic traffic between the client
and the server. The attack requires to use certificate pinning with CA-issued certificates.
close: #1355
Since we already have the "share" subcommand, this feature is
unnecessary for the "client" subcommand.
This commit disables printing the share URI after the client starts, but
keeps this behavior for users who specified the `--qr` flag (who may
still rely on it) and shows a deprecation warning.
