科学之家

动态 · 第 5 页

共 207 条动态,当前显示 30 条

动态时间线

按原始发布时间排序

OneXray 作者说明:连接 VPN 时的节点测速可能受当前隧道影响

yiguodev 表示,OneXray 暂时无法可靠地让延迟检测绕过已连接的 VPN,因此结果可能受当前服务器影响;建议先断开 VPN 再测试各节点。相关改进因技术限制暂不列入计划。

作者原文 · 预览

Thanks for the report. OneXray currently cannot reliably bypass the active VPN tunnel for latency checks, so the results may be affected by the selected VPN server.

To measure each node's latency without the active VPN affecting the results, please disconnect the VPN before running the tests.

We are closing this as not planned for now due to this technical limitation.

查看完整动态

OneXray 已修复 FakeDNS 域名恢复,计划随下一版发布

yiguodev 说明,应用管理的 TUN 入站缺少 FakeDNS 域名恢复,单独在 Raw JSON 中添加 FakeDNS 不足以正常工作。修复会为相应配置启用 fakedns 嗅探,并在智能路由与自定义路由中提供默认关闭的 Use FakeDNS 选项;发言时尚未发布。

作者原文 · 预览

Thanks for the detailed report. The App-managed inbound was missing FakeDNS domain recovery, so simply adding a FakeDNS server in Raw JSON was not sufficient.

We have implemented a fix for the next release:

  • Raw JSON configurations using FakeDNS now automatically enable fakedns sniffing on the App-managed tunIn, while preserving the original configuration, user-defined DNS servers, address pools, and additional inbounds.
  • Smart Routing and Custom Routing now provide a Use FakeDNS option, disabled by default. Custom Routing also preserves this setting when importing or sharing configurations.
  • Direct-domain DNS matching remains prioritized, and IPIfNonMatch continues to use real DNS for its IP-based routing pass.

FakeDNS mappings remain session-local, so cached fake IPs may require a fresh DNS lookup after disconnecting or restarting the core.

Closing this as fixed. The changes are not yet in a published release; please retry after updating to the next release and let us know if the problem persists.

查看完整动态

polaris-arch:Polaris 已修复 Windows 打开面板导致卡死的问题

polaris-arch 在 Polaris 议题中说明,Windows 上「打开面板」会在 WebView2 回调线程里同步创建新窗口,导致面板白屏且应用界面无法关闭;提交 f5403cc 改为异步创建窗口并加入检查,已在 Windows 11 上复现旧问题并验证修复,修复会随下个版本发布。

作者原文 · 预览

感谢提供的截图和进程信息,问题已经定位并修复。

原因:在 Windows 上,「打开面板」对应的后端命令是在 WebView2 的回调线程里同步创建新窗口的。这种情况下 WebView2 会一直等待一个无法送达的回调,于是面板窗口白屏,应用的其它界面操作也全部卡住(关闭按钮、托盘「退出」、Alt+F4 都无效),只能结束进程。macOS 和 Linux 不受影响。

修复:提交 f5403cc 改为异步创建窗口,同时加了检查,防止同类写法再次出现。已在 Windows 11 测试机上先用 1.0.0 复现出同样的卡死作为对照,再用修复后的构建验证通过:面板正常加载,面板窗口和主窗口都能正常关闭,连续点击「打开面板」也只会打开一个窗口。

修复会随下一个版本发布,发布后再关闭这个 issue。

查看完整动态

Open-Box 作者说明 FakeIP 缓存隔离与纯 TUN 修复

liandu2024 在回应旧版本故障时说明:v0.1.176 将 FakeIP 地址池改为 198.19.0.0/16 并按地址池隔离缓存,v0.1.191 调整 TUN 接口名称并补充纯 TUN 模式的 input 放行。作者建议旧版用户升级后验证,仍有问题时附版本号和诊断包反馈。

作者原文 · 预览

v0.1.168 / v0.1.169 的问题在后续版本里处理了:FakeIP 地址池改为 198.19.0.0/16 并按地址池隔离缓存(v0.1.176),tun 接口改名、纯 tun 模式补 input 放行(v0.1.191)。你反馈开关 FakeIP 后恢复,和缓存隔离的修复吻合。

升级到最新版本即可(面板「后端设置 → 升级」,或 curl -fsSL https://raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/update.sh | sh)。请升级后验证;如果还有问题,请带上版本号和诊断包另开新 issue,这条先关闭。

查看完整动态

ShellCrash 作者解释 route 模式的 DNS 选择与防泄漏开关

Juewuy 在 ShellCrash 的问题讨论中解释,route 模式下非 cn 域名会使用 proxy-DNS;若域名未匹配规则、需要先解析 IP 再匹配 IP 规则,此时使用的 DNS 由防泄漏开关控制。这是对现有行为的说明,不是新版本发布公告。

作者原文 · 预览

@fuhuafash 非cn域名,route模式,会使用proxy-DNS。
另外还有一种情况是域名无法匹配到规则,就需要查询DNS获得IP再匹配IP规则,此时匹配的DNS由防泄漏开关控制

查看完整动态

ClashFest 作者定位直连组被改写问题,下一构建将修复

Nemu-x 确认,问题来自应用选择节点时改写并保存了上级策略组,使全球直连组错误指向节点选择,并非 GeoData 规则失效。修复计划进入下一构建;当前可手动将全球直连组改回 DIRECT,或删除后重新添加配置。

作者原文 · 预览

Thanks for the log — this is a ClashFest bug, not GeoData. Your rules match fine
("match GeoIP(cn) using 🎯 全球直连"), but the app had force-pointed 🎯 全球直连 at
🚀 节点选择 instead of DIRECT (see the "Patch selector" lines at startup). Picking a
node in one group used to rewrite every parent selector and persist it; fixed in
the next build. Workaround now: open 🎯 全球直连 and select DIRECT (and 🐟 漏网之鱼
to whatever you want), or delete and re-add the profile.

查看完整动态

alireza0:s-ui 切换到 Use Text 会关掉 Mutual TLS 选项的问题已修复

在答复相关报告时表示,复现步骤与关于 Client Authentication 字段的说明让定位变得容易,问题已确认并修复:切换到 'Use Text' 不再关闭 Mutual TLS 选项,分组保持可见、文本字段仍在,之后也可自由切换;清空 Client Authentication 字段也不再让分组折叠。修复将在下一个版本发布。

作者原文 · 预览

Thanks for the detailed report.
The reproduction steps and the note about the Client Authentication field made this easy to pin down.

Confirmed and fixed. Switching to 'Use Text' no longer turns the Mutual TLS option off, the group stays visible with the text fields in place, and the option can be toggled freely afterwards. Clearing the Client Authentication field no longer collapses the group either.

The fix will be in the next release.

查看完整动态

Fangliding 谈 Xray-core 对纯 AI 代码投稿的审查要求

Fangliding 在 Xray-core PR #6755 中表示,一般情况下不接受纯 AI 代码,并质疑该投稿说明能否体现提交者实际阅读过所引用的其他 PR。此条记录该次贡献审查中的公开回应,不将其扩大为禁止所有 AI 辅助开发的政策。

作者原文 · 预览

一般情况下我们不接受纯ai的代码 你的pr message甚至看不出你真的读了里面列出的几个其他pr

查看完整动态

yiguodev:后续仅支持 VMessAEAD / VLESS 分享链接

作者原文 · 预览

Thanks for the report. Due to frequent changes in upstream Xray-core, we will support only VMessAEAD / VLESS share links going forward. Hysteria share-link import is outside this supported scope, and we do not plan to add it.

Please use a subscription that provides VMessAEAD / VLESS share links. We are closing this request as not planned.

查看完整动态

alireza0:s-ui v1.6.1 设置页无法保存是这一版的回归,可先用 API 绕过

在答复设置无法保存的报告时表示这是他在 v1.6.1 引入的回归:面板会记录已执行的一次性数据迁移,并把这些记录与设置放在一起;设置页加载时把找到的内容全部提交,而 v1.6.1 增加了更严格的保存校验,这些记录不是设置项,于是保存被拒绝。该问题影响所有 v1.6.1 安装而不只是升级来的,因为即使无需迁移,这些记录也会在首次启动时写入;配置本身未受损,保存在写入前就被拒绝。修复将在下个版本发布——设置页不再接收非设置项,并已补上测试。在此之前可改用不受影响的 API 修改设置,他给出了修改订阅更新间隔的 curl 示例,并说明一次只发送要改的键即可。

作者原文 · 预览

Thanks for the clear report — the screenshot with the field names made this immediate to find.

Confirmed, and this is my regression in v1.6.1. The panel records which one-off data migrations have already run, and it stores those records alongside your settings. The settings page loads everything it finds there and sends it all back when you save, but v1.6.1 added a stricter check on what may be saved — and those records are not settings, so the save is refused.

It affects every v1.6.1 install, not only upgrades, because those records are written on first start even when there is nothing to migrate. Nothing in your configuration is damaged: the save is refused before anything is written.

Fixed for the next release: the settings page is no longer handed anything that is not a setting. There is a test for it now, so a future migration cannot bring this back.

Until then, you can change settings through the API, which is not affected. For example, to change the subscription update interval:

curl -X POST -H "Token: <Your API Token>" \
  -d "object=settings" -d "action=set" \
  -d 'data={"subUpdates":"6"}' \
  "http://localhost:2095/app/apiv2/save"

Send only the keys you want to change; the rest keep their values. The setting names are listed here:
https://github.com/alireza0/s-ui/wiki/Settings-Reference

查看完整动态

Fangliding 说明 Xray Windows readv 连接关闭问题的触发条件

Fangliding 表示,这一路径需要较大的上行数据进入 readv 模式,发完后上行立即静默,同时远端在相应时机关闭连接;来回的小包、HTTP/2 window update 或心跳会解除锁定,因此他认为很难遇到。

作者原文 · 预览

首先它需要一个相当大的上行行为 少量上行会被xray快速从缓冲区搬走根本不会进readv模式 发完这个大包之后上行链路必须立刻静默
其次remote需要卡这个timing直接关闭连接 不然摸不到这个位置
各种来来回回的小包都会解除锁定 比如h2会产生大量的window update啥的 或者其他心跳行为
所以我说很难遇到

查看完整动态

Fndroid:别给我发这个经典回归的 App 了拜托

作者原文 · 预览

别给我发这个经典回归的 App 了拜托,不认识也不太想认识。🙏

除了图标和名称我没见到哪里有经典。😅

查看完整动态
资料来源(2)

alireza0:s-ui 的 JSON 订阅模板不是 sing-box 配置,路由键放在顶层是设计使然

在答复关于 JSON 订阅模板结构的反馈时表示,该模板不是 sing-box 配置,而是面板用来构建配置的参数对象,因此 rules、rule_set、final、default_domain_resolver 等路由键位于顶层,route 段由面板自行组装;面板表单是按这一扁平结构工作的,若同时接受嵌套 route,表单与保存下来的模板就会不一致。他也不打算在面板里再加一层校验,因为 sing-box check 已经能正确校验且始终与所用 sing-box 版本匹配。他承认文档缺口真实存在,会补上模板结构与支持字段的说明,并表示对方的变通写法本身就是受支持的形式。

作者原文 · 预览

Thanks for the detailed repro and for confirming the workaround.

The JSON subscription template isn't a sing-box config — it's a settings object the panel uses to build one. That's why the routing keys (rules, rule_set, final, default_domain_resolver) go at the top level: the panel assembles the route section itself. The form in the panel is the intended way to edit it, and it works with that flat structure, so accepting a nested route as well would put the form and the saved template out of sync.

For validation: sing-box check already verifies this correctly and always matches your sing-box version, so I'd rather not ship a second, weaker check in the panel.

The documentation gap is real though — I'll document the expected template structure and the supported keys.

Your workaround is the supported form, so nothing more is needed on your side. Thanks again for the clear report.

查看完整动态

引入新的 sing-tun 自有 TCP/IP stack

作者原文(节选) · 预览

sing-box TUN 使用的 gvisor 和 system stack 均没有为了透明代理场景的性能、能效和内存占用优化。
在 sing-box 1.15 新的测试版中,我们重新实现了 TCP/IP stack,避免了不必要的分配和损耗;对直连连接转移到了独立的高性能 Reactor I/O 路径;实现了 Linux tun GSO 和 multi queue 路径,在提高性能的同时能够随核心而扩展(如果您真的转发超过单核心可处理的流量!)。
同时,也实现并改进了我们的曾经的 已知全网最早开源 的「通过 UTUN_OPT_MAX_PENDING_PACKETS 和 recvmsg_x / sendmsg_x 实现 utun 批量首发 」的性能优化(在此时间点前,网络上无法搜索到 UTUN_OPT_MAX_PENDING_PACKETS 在实际代码中的使用)。

查看完整动态

dyhkwong:vcn 不在 Hysteria 2 URI 规范中

作者原文 · 预览

Hysteria 2 URI scheme follows https://v2.hysteria.network/docs/developers/URI-Scheme/. vcn is not in the specification, so non-standard parameters will of course not be added. Adding non-standard parameters support will only pollute the specification and cause interoperability issues.

查看完整动态

madeye:test_event 失败由 macOS 文件描述符上限引起

Thanks for the report. This is caused by macOS's default per-process file descriptor limit rather than a bug in the event loop. `test_event` deliberately opens 256 UDP sockets (to exceed Winsock's 64-descriptor `select()` limit) plus a sender socket and the loop's own kqueue descriptor. A stock macOS Terminal session starts with a soft limit of 256 (`ulimit -n` prints `256`), so `socket()` starts returning -1 near the end of that loop and the unchecked descriptor trips the `bind()` assertion you saw. Running with a higher limit already makes the test pass on 3.3.6: ```sh ulimit -n 1024 ctest --test-dir build -L 'unit|vendor' --output-on-failure ``` (节选)

作者原文 · 预览

Thanks for the report. This is caused by macOS's default per-process file descriptor limit rather than a bug in the event loop.

test_event deliberately opens 256 UDP sockets (to exceed Winsock's 64-descriptor select() limit) plus a sender socket and the loop's own kqueue descriptor. A stock macOS Terminal session starts with a soft limit of 256 (ulimit -n prints 256), so socket() starts returning -1 near the end of that loop and the unchecked descriptor trips the bind() assertion you saw. Running with a higher limit already makes the test pass on 3.3.6:

ulimit -n 1024
ctest --test-dir build -L 'unit|vendor' --output-on-failure

https://github.com/shadowsocks/shadowsocks-c/pull/3060 fixes this properly: CTest now raises the soft limit to 1024 before launching each unit test, test_event raises its own limit when run directly, and a socket() failure is now reported as such instead of as a bind() failure.

查看完整动态

zn0wii:手动点击节点后应自动变成手动模式

作者原文 · 预览

这里的设计其实就是为了 手动点了节点,就应该自动变成手动模式. 要不然就是感觉我都点了某个节点,怎么一会又变了的感觉. 还有就是内核自动以及目前智能模式都不够 智能,当节点大范围出现问题时,自动/智能 切换的效果都不太即时.还需要优化.

查看完整动态

TokenPLS:proxy-providers 文件导入问题已修,下个版本发布

作者原文 · 预览

确认是 bug,已修。原因:从「文件」打开配置只能选一个文件,而配置里的 proxy-providers 是 type: file,导入时要求把引用的文件一起选上,满足不了就失败,而且没有任何提示。

修复后:配置正常导入,缺的 provider 文件在该配置的「资源」页补上;导入失败也会弹提示。下个版本发布。

当前版本绕法:把 provider 文件里的节点直接写进主配置的 proxies 再导入。

查看完整动态

yiguodev:Linux 内核进程校验已在开发分支修复

Thanks for reporting. Fixed on `dev-26.9.2-5` in 32564a2 and 762f775. On Linux, file capabilities can make `/proc/<pid>/exe` unreadable, causing the old process checks to reject a Core that is actually running. Core management now uses exact `OneXrayCore` name matching via `pgrep`/`pkill`, preserves exit notifications, and confirms shutdown before reporting Disconnected. The slow per-process Dart `/proc` scans have also been removed. Verified on Linux ARM64 with the real app: connect/disconnect, reconnect, adoption after app restart, and automatic status updates when Core exits externally. (节选)

作者原文 · 预览

Thanks for reporting. Fixed on dev-26.9.2-5 in 32564a2 and 762f775.

On Linux, file capabilities can make /proc/<pid>/exe unreadable, causing the old process checks to reject a Core that is actually running. Core management now uses exact OneXrayCore name matching via pgrep/pkill, preserves exit notifications, and confirms shutdown before reporting Disconnected. The slow per-process Dart /proc scans have also been removed.

Verified on Linux ARM64 with the real app: connect/disconnect, reconnect, adoption after app restart, and automatic status updates when Core exits externally.

Closing as fixed in the development branch. Please retest with a build containing these commits and reopen if the problem persists.

查看完整动态

dyhkwong:没有支持 finalmask 的计划,KCP 与 Hysteria 2 部分功能除外

作者原文 · 预览

I explicitly made configurations with finalmask fails to import because there is no plan to support the huge mess of finalmask, and a configuration with finalmask enabled is imcompatible with the same configuration without finalmask enabled. Exceptions:

  • For KCP (they moved part of KCP to finalmask).
  • For Hysteria 2 obfuscation and port hopping.
查看完整动态

OneXray 作者说明 TUN DNS 与路由 DNS 的区别

yiguodev 表示,普通路由模式下,通常的 DNS 查询由 Xray 内置 DNS 处理,单独修改 TUN DNS 地址不会改变这些请求所用的解析器,需要修改路由配置里的 DNS 地址。他在这条回复中表示,下一版将允许在智能路由和自定义路由中修改本地/直连 DNS 地址。

作者原文 · 预览

Thank you for the report.

In normal routing mode, typical DNS lookups are handled by Xray's built-in DNS. Changing the TUN DNS address alone therefore does not change the resolver used for those requests; the relevant setting is the DNS address in the routing configuration.

The next release will allow you to customize the local/direct DNS address in both Smart Routing and Custom Routing. Closing this issue with this improvement scheduled for the next release.

查看完整动态

PharosVip 回应 sing-tun 审查:将 ICMP 转发改为有界异步队列

针对 wwqgtxx 提出的阻塞风险与重复加锁问题,PharosVip 表示已将 PrepareConnection 和数据包转发移入有界异步队列,并移除外层 s.icmpMu 锁,后续将继续跨平台测试。这是 mipstack 适配 PR 中的修订进展,尚不代表正式合并或发布。

作者原文 · 预览

As a side note, I don't think the changes in the second commit are entirely sound. The forwardICMP section, in particular, appears to boost performance but introduces greater risk. In reality, the ICMPForwarderHandler should return as quickly as possible and avoid any blocking or long-running operations internally; clearly, PrepareConnection offers no guarantee against blocking.

Furthermore, I don't quite understand the addition of s.icmpMu there; DirectRouteMapping is already thread-safe, so what is the purpose of wrapping it in an external lock?

Thank you for pointing this out. I’ve moved PrepareConnection and packet forwarding to a bounded asynchronous queue.
I’ve also removed s.icmpMu. DirectRouteMapping uses its own synchronization, and the worker handles route cleanup when it exits.
I’ll spend some time conducting additional tests across platforms and share the results.

查看完整动态

wwqgtxx:forwardICMP 的改动存在阻塞风险

作者原文 · 预览

As a side note, I don't think the changes in the second commit are entirely sound. The forwardICMP section, in particular, appears to boost performance but introduces greater risk. In reality, the ICMPForwarderHandler should return as quickly as possible and avoid any blocking or long-running operations internally; clearly, PrepareConnection offers no guarantee against blocking.

Furthermore, I don't quite understand the addition of s.icmpMu there; DirectRouteMapping is already thread-safe, so what is the purpose of wrapping it in an external lock?

查看完整动态