mirror of
https://github.com/YuanDevTeam/Vole.git
synced 2026-11-07 00:05:27 +00:00
yiguodev
608a8f255c
* chore: download latest official mihomo for interop tests * test: capture N0 baseline and protocol feasibility probes * docs: record N0 hybrid REALITY fork verification * test: verify N0 controlled Hysteria2 auth and streams Add an isolated Quinn adapter over existing DIRECT and SOCKS5 datagrams, bounded queues, protect rejection probes, and official latest peer fixtures. Record passing auth/TCP checks and the native Hysteria half-close failure separately. N0 remains incomplete; production sources and dependency locks are unchanged. * test: validate N0 native QUIC hopping and XHTTP H3 Keep the probes isolated from production. Verify one-state Hysteria hopping, protected rebind rejection, Xray H3 entry and existing HY2 regressions. Set only the owned Linux peer MTU to avoid Initial-packet EMSGSIZE; retain native half-close failures as separate gates. * fix: align XHTTP shutdown with Mihomo connection close * test: verify N0 supplied-stream transport interfaces Add isolated TLS, ordinary WebSocket and gRPC probes with owned I/O, bounded buffers and cancellation barriers. Match Mihomo close behavior: preserve TLS/WS reads, distinguish clean WS underlay EOF from truncation, and close both gRPC directions. Use separate official SOCKS5 peers to avoid fixture loop detection. Record 12 Debug/Release tests, 42 official Mihomo checks, dependency audits and Apple/Android compile checks. Keep production dependencies, third-party sources and remaining N0 gates unchanged. * fix: upgrade h2 and retain completed responses after reset * chore: use the current OneXray rustls fork origin * chore: adopt published rustls 0.23.45 and official TLS binding * chore: refresh N1 foundation and spike dependencies * feat: validate next-protocol field and combination catalogs * feat: share immutable TLS policies and bounded close semantics * feat: add shared stream transports and decouple XUDP framing * feat: add controlled datagram foundations and N1 acceptance harness * chore: finalize N1 with verified x25519 dependency * chore: publish N1 against the rustls release branch * feat: add bounded Trojan request and datagram codecs * feat: connect Trojan TLS TCP and UDP through the runtime * feat: support Trojan WebSocket and duplex gRPC transports * feat: enable Trojan and complete N2 consumer acceptance * feat(vmess): add bounded AEAD header and body codecs * fix(vmess): align close acceptance with Mihomo transports * feat(vmess): add UDP codecs and isolated peer comparisons * feat(vmess): complete public runtime and N3 acceptance * docs: bind N3 acceptance and refresh validation guidance * feat(vless): complete N4 transports, Vision and UDP support Extract VLESS assembly, add plain/TLS stream transports, HTTPUpgrade, node-owned gRPC pooling, mTLS and classic REALITY, and implement Vision through public TLS record boundaries. Preserve XHTTP and the XUDP default while adding raw and packetaddr. Complete 145 required groups and 39 field rows against isolated latest official peers, with 160 lifecycle/resource rounds, independent coverage and Apple/Android release builds. Preserve the three explicit WS/REALITY layered close comparisons and historical failures in the acceptance report. No third-party or dependency-lock changes. * feat(vless): complete N5 XHTTP and sing-mux support Add H1/H2/H3 request fields, independent download security and pools, bounded packet-up batching, and h2mux/smux/yamux over controlled transports. Keep Mihomo-aligned close and path semantics, node-owned shutdown barriers, and isolated official-peer fixtures including the approved Caddy mTLS gateway. Validate 416 required groups, 57 fields, 112 two-leg security checks, 240 lifecycle/resource cycles, independent coverage, and Apple/Android release builds. Record native-peer gaps and leave N6-N10, devices, CI, and release gates separate. * feat: integrate boring TLS profiles and retire rustls fork * test(tls): freeze selected fingerprint reference baseline * docs(tls): record selected-profile library acceptance * feat(tls): integrate selected client fingerprints and REALITY profiles * feat(tls): complete selected fingerprint CF5 acceptance * feat(hysteria2): complete N6 client support and acceptance Implement Hysteria2 over official Quinn/h3/rustls and shared controlled IO, including TCP/UDP, bandwidth pacing, Salamander, port hopping, upstream snapshots and synchronous Stop. Keep old-path receives active for the full bounded handover window, preserve independent reader wakeups, and require the exact nested TCP evidence assertions. Validate one frozen N6 run: 36 required groups, 20 field rows, native Mihomo/Hysteria peers, H3 regression, 40 lifecycle rounds and Apple/Android production builds. Record independent coverage, artifact hashes and native-peer limitations. * test(tls): record N7 hybrid REALITY prerequisite evidence Preserve the locked classic-only API failure and distinguish the locally accepted boring hybrid extension from pending VCore S03/D16 integration. Record wrapper feasibility and publication boundaries without changing production configuration or dependencies. * feat(vless): support explicitly required hybrid REALITY * feat(crypto): wrap official BLAKE3 binary-context derivation * feat(vless): implement authenticated Encryption wire transport * feat(vless): enable authenticated Encryption across public transports * build(tls): pin the authenticated ShadowTLS ClientHello hook * feat(vless): add authenticated JLS transport security Pin the separately approved boring JLS revision and expose strict main/download credentials under schema 24. Preserve native CertificateVerify and Finished, cancellation, and controlled IO ownership. Accept the JLS field slice with 122 isolated cases, 80 lifecycle/resource cycles, and Apple/Android release libraries; keep broader N7 gates separate. * docs(n7): reconcile current JLS acceptance progress * chore(vless): retire Restls while retaining JLS * feat(vless): complete N7 static ECH and security combinations Add static ECH for VLESS main and XHTTP download legs using existing TLS backends and official Rust HPKE. Keep Invoke v5 and advance the internal schema to revision 27. Accept the narrowed N7 scope with 43 required groups, 11 fields, 301 isolated native cases, 240 lifecycle/resource rounds, and Apple/Android release builds. Record frozen inputs, 470 container cleanups, explicit upstream comparison gaps, and prior failed runs in docs/acceptance/next-protocols/N7.md. * chore(protocols): retire WireGuard scope and foundations * test: complete N9 protocol integration and resource gates * build: add N10 production artifact evidence gates * fix: restore Windows snapshot encoding and fail-closed delivery CI * fix: use native ARM64 LLVM assembly and scoped delivery CI * build: keep delivery lockfile bytes stable across platforms * fix: preserve production guard lifecycle and isolate CI feature checks * build: adopt released boring and registry shadowsocks * ci: use release-oriented workflow names * docs: consolidate contracts and streamline test tooling Merge current protocol and platform contracts, remove milestone reports and obsolete spikes, and share core checks between local development and CI. Preserve all 884 executable case definitions and unique legacy assertions. Validation: core Debug/Release, feature checks, Clippy, netstack, offline script tests, formatting and documentation links passed locally. Container interop smoke attempts failed during official peer downloads; business paths remain NOT RUN. * test: replace milestone names with capability-based validation Rename protocol and fingerprint suites, fixtures, and evidence identifiers by capability. Preserve acceptance cases and golden wire data while documenting reference, wire, and interoperability evidence separately. * fix: address review findings and stabilize core CI Flush accepted gRPC/H2 data through the supplied IO before reset, and wait for pending smux writes before FIN. Sanitize AnyTLS peer failures, reject XHTTP userinfo, and remove stale Android delivery artifacts. Close container log capture even when inventory fails. Keep legacy host suites blocked before resource acquisition. Separate Shadowsocks adapter codec checks from upstream strict server acceptance. Lock the random empty-request zero-padding failure with deterministic negative and positive fixtures, without changing the dependency or production behavior. * test: isolate delivery fixture from Windows home lookup * test: preserve UDP socket semantics during peer teardown The memory peer treated its counterpart closing an mpsc channel as a local UDP BrokenPipe. That could terminate Quinn endpoint IO without waking a pending wait_idle, despite all four datagrams and CONNECTION_CLOSE having arrived. Keep a closed peer link silent and late sends best-effort, add a deterministic fixture regression, and preserve the existing data and shutdown deadlines. Debug/Release, Clippy, and 300 consecutive regression iterations pass. * fix: drain XHTTP uploads before releasing connection drivers * fix: enforce lazy setup deadlines and safe delivery paths Check the original deadline before accepting ready gRPC/H2 headers or sing-mux status, without limiting established reads. Reject symlinks and Windows reparse points in every delivery output path before filesystem mutations. Add deterministic memory and temporary-filesystem regressions. * test: join XHTTP H3 peer tasks during cleanup Quinn retains closed connections for three probe timeouts, so a delayed handshake can legitimately exceed the fixture's two-second wait_idle budget. Own, abort, and join the passive peer tasks after upload and client shutdown instead. Preserve upload integrity and client close bounds, and cover delayed handshakes in both streaming modes.
VCore 文档
本文档只维护当前契约、有效约束和发布边界。历史方案、阶段报告与已取消能力留在 Git 历史，不另建归档副本。行为以当前源码、测试和契约为准，不一致时一起修正。
配置与接口
- 配置协议：严格 YAML、节点、静态 select 组、DNS 与规则。
- Invoke API：请求格式、生命周期、平台回调与内联配置。
- Controller：认证、运行中组选择和 TUN 流量。
- 入站：HTTP 转发/隧道、SOCKS5 TCP/授权 UDP、监听及认证。
- 出站：SOCKS5、AnyTLS、Trojan、VMess AEAD、Hysteria2、SS 2022。
- VLESS：传输、Vision、Encryption、REALITY、JLS、静态 ECH。
- XHTTP 与 sing-mux：双腿、H1/H2/H3、连接池及复用。
- TLS 证书与指纹：证书 pin、ClientHello 模板、身份与缓存。
- REALITY 线协议：认证、密钥与失败边界。
运行与平台
- DNS 与 ICMP、GeoData。
- 资源策略：局部预算、所有权、取消和观测。
- TUN 平台、Windows VPN。
- TLS 依赖与发布：来源、provider、fork 与升级门禁。
- Windows 最小集成示例。
开发与验证
配置字段由 config.yaml 维护；协议文档补充语义与限制，不复制阶段计划。
技术标识符保留原文，说明使用中文。AGENTS.md 只放跨任务约束与读取入口。