Adds an outermost sudoku_mask wrapper so TCP clients and servers can interoperate with Xray FinalMask, including configurable layouts and padding, stacked masks, and XHTTP carriers. Preserves explicit flush ownership and prevents Vision or raw TCP splice from bypassing the mask, with configuration validation and documentation for supported placements and limits. Native UDP/QUIC masking is not included.
REALITY connections fail when the cover target uses a minimal 28-byte EncryptedExtensions record because rustls adds an SNI acknowledgement that no longer fits. Pin the stable-release rustls fork that omits this acknowledgement only for REALITY, update the cover fixtures to use minimal records, and add regression coverage for successful handshakes and rejection of undersized records. Ordinary TLS behavior and strict record-capacity checks remain unchanged.
Add advisory selector/reload performance reports, optional Linux unit/process coverage with changed-line summaries, and bounded rule-parser property tests to make regressions and verification gaps easier to spot. Reports reject invalid measurements and account for timing noise without introducing hard performance gates; existing tests and production behavior remain unchanged.
Catch resource retention across failed setup, cancellation, reloads, and owner destruction with allocation, task, descriptor, and permit regressions, alongside deterministic matcher invariants. Strengthen reload measurements with committed-upstream verification, exact-byte live-session checks, bounded cleanup, and byte-exact provenance, and add the coverage to CI.
Broadens unit and integration coverage of WebSocket framing, ShadowTLS and REALITY ClientHello parsing, VLESS fallback, Hysteria2 and TUIC authentication, DNS, and connection budgets across reloads, and fixes the defects it exposed: WebSocket streams now accept control frames up to RFC 6455's 125-byte limit, no longer report EOF into partly filled read buffers, and flush buffered frames before shutting down; the shared ClientHello parser reassembles hellos split across TLS records, as Go TLS stacks do; and message-stream shutdown after EOF is bounded like the stream relay's. It also builds the binary on the library crate instead of compiling every module twice, removes the unused UdpMessageStream, moves ShadowTLS interop tests to local handshake servers, makes filtered CI test steps fail when they select no tests, consolidates the WebSocket payload-reading code, and documents how to measure coverage along with the remaining gaps, including why WebSocket Close frames stay unanswered.
Replace the bespoke REALITY TLS engine with a pinned rustls fork while retaining Shoes authentication, ML-DSA policy, transparent fallback, and Vision support. Stage and validate target-mirrored handshake flights before sending synthetic bytes, consolidate TLS connection handling, and remove obsolete connection layers and helpers. Outbound handshakes use the native rustls fingerprint; unsupported target layouts fall back transparently, and unclean TLS closure reports UnexpectedEof.
Update Rust dependencies for current fixes, including ML-KEM's removal of secret-dependent table lookups, and refresh the BLAKE3 fork while retaining binary-context key derivation. Allow wildcard GotaTun updates with source-notice validation, replace unmaintained test-only PEM parsing, and update Android and CI tooling with current AGP source-set APIs. Preserve Web PKI protections and required fork patches; defer YAML parser migration.
Prevent TUN startup resets and orphaned connections by deferring inbound TCP publication until handshakes complete, bounding half-open admission, and propagating worker failures while preserving Linux link-down and Apple queue-backpressure recovery. Fix Naive HTTP/2 writes that stall despite available credit and improve transfer diagnostics. Preserve full-payload and clean-EOF Mihomo REALITY coverage with reply-first sequencing, retaining early half-close as an opt-in peer regression. Upgrade Xray test peers to the 26.10.21 security release after upstream withdrew the previous releases.
Expand legacy and encrypted VLESS coverage across peer transports, Vision transitions, session lifecycle, replay isolation, and chained connections, with Xray updated to 26.10.17. Preserve complete XHTTP HTTP/2 responses when peers gracefully stop an unfinished upload while continuing to reject truncated responses and incomplete packet uploads. Isolate the pinned sing-box server TLS 1.2 shutdown limitation in a test-only workaround, retaining an ignored reproducer and a reference to SagerNet/sing-vmess#16 for removal when the peer pin includes the fix.
Add named userspace WireGuard endpoints so Shoes can route inbound and outbound traffic through WireGuard without a kernel interface. Includes TCP/UDP forwarding, proxy-chain transports, reload lifecycle management, configuration validation, documentation, and dependency notices for release artifacts.
Add standard HTTP/2 CONNECT to HTTP and mixed listeners and opt-in HTTP proxy clients, allowing concurrent TCP tunnels to share a connection while preserving legacy HTTP/1 and NaiveProxy behavior. Keep the H2 transport independent of NaiveProxy, preserve route isolation and per-stream authentication, require matching TLS ALPN for explicit H2 clients, and handle flow control, cancellation, and graceful shutdown. Include configuration documentation, an example, compatibility regressions, and interoperability coverage for sing-box, Mihomo, and the native Caddy-based Naive server.
Improve XHTTP transfer reliability under slow destinations and resource pressure with bounded packet pipelining, admission before body reads, queue-acceptance acknowledgements, and cancellation-safe session handling. Preserve reusable H1 uploads, correct H2/H3 finalization, add configurable receive windows and download-tail timeouts, validate effective request capacity, and expand Xray/Mihomo interoperability coverage with pinned peers in CI.
Adds Xray-compatible XHTTP/SplitHTTP with packet-up, stream-up, and stream-one modes over HTTP/1.1, HTTP/2, and HTTP/3, including REALITY and existing proxy chains. Bounded buffering, flow-control-aware admission, connection pooling, and inactivity-based timeouts maintain backpressure without imposing a minimum upload rate. Preserves TLS key-exchange and ML-DSA policies, adds configuration examples and interoperability coverage, and vendors an h3 fix to prevent empty DATA frames from truncating streams.
Replace Debian-dependent REALITY separate-mode tests with an owned local TLS 1.3 template. Add structural handshake and fixture-cleanup coverage, and verify exact small and 200 KiB downloads and patterned uploads through sing-box in the local integration suite. Production REALITY behavior and the remaining external interoperability tests are unchanged.
Add coverage for buffered parsing, UDP fragment budgets, proxy handshakes, DNS fallback, and connection-capacity reuse. Fix dropped empty UDP replies and malformed HTTP CONNECT success-status acceptance, stabilize readiness timeout tests, run process contracts in regular CI, and add a manual kernel TUN workflow.
Reduce userspace copying and packet-processing overhead for sustained Linux traffic with adaptive, bounded TCP splice for plain socket relays and native IPv4 TCP transmit segmentation offload for owned TUN devices. Preserve buffered fallback, half-close and cancellation behavior, retain ordinary IPv6 transmission, and cover relay ordering, pipe-budget exhaustion, offload framing, and startup failure policies.
Prevent malformed traffic and replayed authentication from corrupting proxy sessions, preserve buffered handshake data and protocol compatibility, and report connection failures accurately. Validate replacement configurations before retiring listeners, handle process signals reliably, and make QUIC socket setup and synchronous FFI lifecycle calls safer across platforms.
Close gaps around TUN wakeups, UDP routing, and concurrent traffic with deterministic wake/setup tests, rootless IPv4/IPv6 raw-FD coverage, and opt-in kernel tests for real IPv6 and mixed TCP/UDP progress. Add Linux host-FFI and macOS rootless CI coverage while keeping privileged device tests out of ordinary CI. Wait for Mihomo routing readiness to prevent startup packet loss in AnyTLS tests.
Reduce memory retention during connection churn with shared resource budgets, bounded buffering, and setup/shutdown deadlines. Make task and socket ownership explicit across proxy protocols and TUN, preserve queued data during graceful shutdown, fix UDP routing and startup/reload cleanup, and prevent stopped mobile services from disrupting replacements. Preserve already-decrypted Vision payloads after padding ends.
cfal