Adds native Hysteria2 and TUIC v5 outbound clients so proxy routes can use either protocol directly for TCP and UDP. Includes pooled QUIC connections with bounded resource use, cancellation-safe TUIC commands, Hysteria2 Salamander obfuscation and port hopping, hardened HTTP/3 authentication, TLS verification, configuration examples, and interoperability coverage in CI.
Add managed Linux TUN and REDIRECT capture with independent DNS interception, protected bootstrap and outbound sockets, best-effort systemd-resolved integration, and retained-ingress reload and recovery. Include configuration documentation, service integration, and kernel coverage.
Support server-key:user-key and longer identity chains for Shadowsocks 2022 AES clients, allowing connections to multi-user servers and identity relays. Add the required identity headers, configuration validation, and usage documentation while preserving existing single-key and legacy configurations. This is client-only support; native SS2022 UDP and server-side multi-user support remain out of scope.
Add a system-only native_cache_secs option for configurable OS/NSS application memoization while preserving the existing 60-second implicit default and uncached explicit system behavior. Disable completed-cache reads and writes for zero windows, reject invalid DNS options, and document freshness and lookup-sharing semantics.
Add URL-scoped health and delay-based upstream selection so new connections can use healthy, transport-compatible proxies without requiring a controller listener. This introduces strict client_group.type configuration in place of strategy, bounded automatic probes with lazy activity tracking and reload fencing, controller reporting, and configuration documentation. It also preserves local failure attribution through outbound HTTP/2 adapters so local resource limits do not incorrectly penalize proxy health.
Share native resolver cache entries across destination ports and coalesce concurrent misses with bounded, cancellation-safe ownership. Preserve ordered address candidates, caller ports, and error details while using a conservative 60-second result-age policy rather than a DNS record TTL. Cover cancellation, expiry, failure, and capacity limits with deterministic tests and document the default behavior and trade-offs.
Add shared file and ACME certificate sources for automatic issuance, renewal, and live TLS/QUIC rotation without interrupting existing connections. Support HTTP-01 and TLS-ALPN-01, durable retry and account state, and CLI/FFI lifecycle handoffs. Extend live rotation to existing file-backed identities and document stricter certificate validation requirements.
Expose runtime proxy selection and connection visibility without restarting Shoes. This adds an opt-in authenticated Clash-compatible TCP/Unix API, persistent selector choices, traffic and connection statistics, delay probes, live logs, and per-flow cancellation, with reload-aware integration across proxy protocols, DNS, and TUN.
Compile routing rules into shared indexes while preserving ordered policy evaluation and DNS decisions. Add typed predicates and bounded local SRS, sing-box JSON, Mihomo YAML/text/MRS, and GeoSite/GeoIP DAT sources through named rule groups or inline masks, with format detection, source caching, pre-activation compilation, and source-aware reloads. Include configuration examples, regression coverage, benchmark tooling, and dependency notices.
Extend opt-in TCP sniffing to use cleartext HTTP/1.0 and HTTP/1.1 Host headers alongside TLS SNI for hostname-based routing. Preserve original destinations, byte replay, sniff limits, Fake DNS precedence, and one route per connection. Add strict parsing, transport and lifecycle coverage, documentation, and an authenticated example with local-address safeguards.
Add opt-in Fake DNS and TLS SNI routing for clients that connect by IP. Restore synthetic destinations across TCP, UDP, and TUN while preserving reply identities; prefer sniffed SNI for hostname rules without rewriting connection targets. Add persistent fake-IP mappings, stable WireGuard server identities through optional names or public keys, upstream-address guards, deadline-aware DNS fallback, configuration documentation, and examples.
Make WireGuard use the same inline client and server protocol syntax as other proxies, replacing named endpoints before release. Add automatic sharing of equivalent clients, encrypted peer chains, explicit server routing policy, and validation that rejects conflicting settings while keeping unused clients inactive. Update examples, configuration documentation, and lifecycle and interoperability coverage.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Add opt-in native VLESS Encryption with X25519 and ML-KEM key chains, authenticated record encryption, bounded session resumption, and native Vision support while preserving legacy TLS/REALITY behavior and outer transports. Include validated configuration, credential generation, examples, interoperability fixtures, and regression coverage.
Add standard HTTP/2 CONNECT to HTTP and mixed listeners and opt-in HTTP proxy clients, allowing concurrent TCP tunnels to share a connection while preserving legacy HTTP/1 and NaiveProxy behavior. Keep the H2 transport independent of NaiveProxy, preserve route isolation and per-stream authentication, require matching TLS ALPN for explicit H2 clients, and handle flow control, cancellation, and graceful shutdown. Include configuration documentation, an example, compatibility regressions, and interoperability coverage for sing-box, Mihomo, and the native Caddy-based Naive server.
Improve XHTTP transfer reliability under slow destinations and resource pressure with bounded packet pipelining, admission before body reads, queue-acceptance acknowledgements, and cancellation-safe session handling. Preserve reusable H1 uploads, correct H2/H3 finalization, add configurable receive windows and download-tail timeouts, validate effective request capacity, and expand Xray/Mihomo interoperability coverage with pinned peers in CI.
Adds Xray-compatible XHTTP/SplitHTTP with packet-up, stream-up, and stream-one modes over HTTP/1.1, HTTP/2, and HTTP/3, including REALITY and existing proxy chains. Bounded buffering, flow-control-aware admission, connection pooling, and inactivity-based timeouts maintain backpressure without imposing a minimum upload rate. Preserves TLS key-exchange and ML-DSA policies, adds configuration examples and interoperability coverage, and vendors an h3 fix to prevent empty DATA frames from truncating streams.
* examples/named_certificates.yaml: update for named pems
* config: update for named pems
* thread_util.rs: allow re-setting
* CONFIG.md: updated for named pem
* main.rs: update for new validation flow
* Cargo.toml: add tempfile for tests
* inline format args for cargo clippy
cfal