v1.9.0 精简代码计划

[RPRX]

简单来讲，就是删删删：

1. MTProto、Socks 4 & 4a、Legacy VMess
2. 对远古配置的兼容代码
3. 很多不必要的 interface、register

尤其是 3，过度抽象，导致代码调用链难以理清、难以维护。 我说这是 v2 架构最失败的设计之一，应该每个研究过代码的人都认同吧。

Xray-core 会在兼容现有配置的前提下，不断精简代码（说不定会删掉一半的代码）、优化性能（TCP 已优化很多，主要剩 UDP）。

[Fangliding]

mux.cool:

[RPRX]

Xray-core 中的 Mux 早已修好。

[EndermanCo]

Although I know that mux.cool has been fixed, but isn't it better to use better and new technology?

[dnomd343]

支持，这些上古玩意几乎没人用，需要用的场景切到旧版本就够了。

相比于追求完整兼容性，更希望看到一个轻量且优雅的Xray内核。

[zxbiao]

不是挺好吗，以某些版本号为分隔线，分隔新旧版本。
需要旧协议的就用旧版本，需要新协议的就用新版本。
可以让代码不那么臃肿

[RPRX]

是挺好的，不过 1 2 基本没人用了，估计没人需要旧版本，有人用的话就建议他迁移，就像 Legacy XTLS 到 XTLS Vision

有一件鲜为人知的事情：VMess Alter ID 为 0 时启用 VMess AEAD 就是我提出的，为了有朝一日能完全删掉 Alter ID

但当时我也说了只能炸一次，后来我发现了一些 VMess AEAD 的小漏洞，对长度的修复要默认启用的话，又得炸

[nursery01]

1. xray變動太快手機app難以跟上進度

2. 電腦可以同時安裝舊版和新版的方式來用不同的版本，但是手機app只能裝一個，並且iPhone上版本退回是麻煩的，所以手機app要同時支援新舊，工作量大而麻煩

手機用戶比電腦多，應該考慮手機上面的問題

[RPRX]

你应该是被上一条回复误导了，我说了：“估计没人需要旧版本”，意思就是并不需要同时装两个，比如 1 的协议都是没人用了的。

[ghost]

是的，上下兼容重要，但干净的代码也特别重要，另外发现一个问题，除了收费版的ios客户端如shadowrocket，其它客户端如v2rayn、clashx会在每一条数据中存在客户端特征如程序的名称（之前utls解决了hello的问题），虽然https模式是加密的(http中清晰可见)，在以后的升级中是否也有必要引入浏览器特征 @RPRX 感恩！！

[nursery01]

你应该是被上一条回复误导了，我说了：“估计没人需要旧版本”，意思就是并不需要同时装两个，比如 1 的协议都是没人用了的。

proxys4a應該是沒人用了，雖然火狐還保留著4a，如果是過舊的刪了就刪了，留著反而會使維護成本變大。次舊的還是有人用的，比如現在還有人在用v2 4.. ，下游手機app提供者還是要考慮新功能和舊版本，下游有一定的工作量，下游累不累這種問題還是要考慮一下，我就擔心下游會不會直接對xray"放手"不管了

[RPRX]

@kerLk ？
@nursery01 ？

[ghost]

大佬！！不知道说的对不对！使用clash系列和v2rayN、v2rayNg会在每一条数据中存在客户端的名称和go的版本号记录，我的理解是utls解决了ClientHello，而我们使用了https对每条数据进行加密，所以存在的程序名称和go版本号就不会存在产生特征？ 但一些收费的客户端就巧妙的使用了与utls类似或一样的信息，从而避免了在每条数据中产生前面所说的特征。这些特征在http方式传输时一目了然。另外更新订阅时产生的也是包含程序名称和客户端go版本的记录。如果不会有影 响那是我多虑了！！如果有，大佬是否可着手解决一下！感谢 @RPRX 所做的贡献！！

[firefoxOnFire]

If possible make it modular compilation. So we can compile with what function we needed most. So we can use this on low end devices like openwrt.

[RPRX]

这个很容易实现，虽然用处不大。其实 v2 架构本来就可以裁剪，只是需要手动裁剪，没做成编译参数。

[firefoxOnFire]

I am really new to this. Can I know can I do this?? I have tried compiling myself. It worked but didn't know how to make it small. And used upx to make it small. But still bigger.

[rurirei]

implements a library to take pkgs you need.

[firefoxOnFire]

implements a library to take pkgs you need.

Do you have any example brother???

[Weltolk]

第3个非常同意, 有些地方过于抽象, 其实代码逻辑原本是很清晰和简洁的

[RPRX]

让我们来看看 bazel 和 v2ctl

[chancat87]

删吧，无用了要了干嘛？而且谁还会用旧的版本？

[arm64v8a]

protobuf 能不能移除

[RPRX]

我也想移除，有个小问题是，API 可能要全改

[yuhan6665]

为什么所有人都不喜欢 proto。。

[lhbdhr]

Legacy VMess是什么意思啊？
希望能考虑 clash-core 的情况， clash for window实在是界面好看又好用。
因为cfw不支持vless，所以一直用的vmess。
因为有caddy前置，trojan感觉有些多余，也一直没用trojan。
希望不要完全删除掉vmess。

[fatalitylive]

clash 也可以用于服务端的，不必担心。

[Zxis233]

切换到clash Meta内核吧，cfw的界面依旧可以使用

[lhbdhr]

切换到clash Meta内核吧，cfw的界面依旧可以使用

cfw支持clash.meta？第一次听说。我目前在尝试 clash-verge，但是有一些bug，客户端还不是很好。界面也没CFW好看。

[RPRX]

Legacy VMess 是已经没人用的、当初有大新闻的 VMess。至于 Clash。。。

[kkksa528]

这个vmess是Legacy不是vmess AEAD，历史遗留产物Legacy VMess 和VMESS AEAD，Legacy真贴切

[simpleandstupid]

支持，可以更激进点上v2.0.0
更好区分新旧版本，毕竟是breaking change

[RPRX]

也没那么 breaking 啦

[LovelyQuantum]

确实，破坏性更新可以直接加大版本号，然后1.x版本也可以继续进行小更新

[RPRX]

时间精力不允许

[swxk521]

vless不使用tls，不能像vmess那样有加密选项，是不是相当与明文传输，不知道vless可不可以增加加密让自主选择？
这样的话，就不需要vmess了

[RPRX]

@swxk521 #1880 (comment)

其实你也可以先把 REALITY 当 VLESS 的加密，链式代理。REALITY 是 TLS 级别的加密，并且不依赖 CA，比常规 TLS 更安全。

[nursery01]

#1880 (comment)

@RPRX 裡面提到的ai寫代碼是用gpt還是github副手

[eldevel]

Hello from Russia! Are there any plans for a tunnel instead of a proxy? Xray is very good, but why are you only working on proxies? As far as I can see, the implementation of the L3 tunnel does not look very complicated. I would like to implement this, but I don't understand if it's relevant for you? Why only proxies?

[RPRX]

Maybe WireGuard over VLESS REALITY?

[eldevel]

I thought of this as a simple solution, but there are several problems:

1. WireGuard has encryption, so it's encryption of already encrypted packets. This is an additional cpu load, and as far as I know, such traffic patterns (multiple encryption) can be detected by neural networks.
2. WireGuard has a high speed due to the fact that it runs at the kernel level (including windows). So running in user mode will be a bit slow.
3. WireGuard is not optimized for tcp transport. For example, in Russia the QUIC protocol is blocked, so we prefer tcp.

[eldevel]

Full tunneling aka vpn requires:

1. On the client, create a tun/tap device for reading IP packets. Not difficult, but platform dependent (wintun for windows, VpnService API for Android, NEPacketTunnelProvider for iOS, /dev/net/tun for linux/unix)
2. Create a tun / tap device on the server (requires assign a separate ip address to each client)
3. Open one or more persistent connections (using one of the many protocols available in xray) + a ping/pong mechanism to monitor that the client is still connected.
4. Read the IP packet and deliver it as is via one of the open connections to the server.
5. Send this ip packet via tun device on the server (and replace src_address)
6. If we received an IP packet on the server, then we identify the client based on its tun ip, check that the client is connected and do the same as in steps 3 and 4, but vice versa.

Routing, shaping, NAT (including port forwarding) are performed by means of the OS kernel. This approach has many advantages and only one disadvantage - we cannot route traffic based on the destination domain.

[eldevel]

The only solution that can be used right now is openvpn without encryption via socks5 proxy (natively supported). The only negative is only one tcp connection, which is a big problem for an ISP with a poorly configured shaper.

[r-sbr90]

The problem I have with reality is that the IP is not hidden, there are about 15 of us using the same IP, but after a working day, the server IP is exposed. Cloudflare, if it was possible to set the IP to Proxy ON, many problems would be solved. No other CDN has this IP range, Cloudflare has around 2 million IPs

[rurirei]

introducing those to remove the deprecated Vmess user-generated-hash (means user alterID) like this: removes the alterID field in common/protocol/header, and a empty protocol.ResponseCommand in proxy/vmess/encoding/command
https://github.com/rurirei/v2ray-core/blob/db4ce682e813e859f1565948f40f30ef10666817/proxy/vmess/encoding/commands.go#L59-L65

[LanYunDev]

支持！😂代码精简也方便后续开发、

[WillGhost]

大佬 那个 shadowsocks 2022入站，visiion出站不通的问题 能否给些提示 我想改改

[RPRX]

https://t.me/projectXtls/74

[qcxiang]

大佬，可以考虑集成xtaci/kcptun这种底层传输方式吗？

[ghost]

功能类似：https://xtls.github.io/config/transports/mkcp.html

不过这年头还有人用 kcp？

[kkksa528]

服务端 interface有allowInsecure参数，在不允许链接有allowInsecure的背景下， 服务端有allowInsecure参数是不是显的多余

[Extreme-Icer]

有没有可能，该软件并未严格区分服务端和客户端呢 allowinsecure这个参数是当它作为客户端用是有效的 当服务端没用，你总不能说去掉它或者咱们严格区分 xx参数不能用于服务端/客户端 这样

[testcaoy7]

Please keep "Reverse Proxy" feature.

[firefoxOnFire]

Please keep "Reverse Proxy" feature.

What is use of reverse proxy?? Can explain a bit??

[testcaoy7]

Please keep "Reverse Proxy" feature.

What is use of reverse proxy?? Can explain a bit??

I'm using it for remote access (i.e. replacing traditional VPN). Actually, I deploied my Raspberry Pi directly in my office and my home broadband does include a public ip. By using "reverse" feature, Xray server installed on the Pi unit can actively connects to Xray client running in my home network which allows me to remotely access resources located in the company LAN.

[firefoxOnFire]

Please keep "Reverse Proxy" feature.

What is use of reverse proxy?? Can explain a bit??

I'm using it for remote access (i.e. replacing traditional VPN). Actually, I deploied my Raspberry Pi directly in my office and my home broadband does include a public ip. By using "reverse" feature, Xray server installed on the Pi unit can actively connects to Xray client running in my home network which allows me to remotely access resources located in the company LAN.

This is great. do you mind sharing config (removing your credentils)?? if possible. Thanks.

[testcaoy7]

Please keep "Reverse Proxy" feature.

What is use of reverse proxy?? Can explain a bit??

I'm using it for remote access (i.e. replacing traditional VPN). Actually, I deploied my Raspberry Pi directly in my office and my home broadband does include a public ip. By using "reverse" feature, Xray server installed on the Pi unit can actively connects to Xray client running in my home network which allows me to remotely access resources located in the company LAN.

This is great. do you mind sharing config (removing your credentils)?? if possible. Thanks.

https://github.com/testcaoy7/xray-remote-access
You are welcome to check.

[firefoxOnFire]

Thanks. I have got the concept.

[Fangliding]

在这提一嘴 core里内置的mtproto因为版本陈旧无人维护加上用处不大早就该删除了。隔壁应该已经枪毙了 xray这边文档已经删了但是还没有人动手移除mtp的代码

[Extreme-Icer]

对于1.9.0精简代码，如果精简掉这些无用的代码还能顺便降低CPU占用也好，免得套warp出站狂吃CPU速度还上不去。主要是似乎xray用不了内核的wg

[lxsq]

可以用，我这有配置的例子。#2240

[KobeArthurScofield]

目前阶段性进展：

已经移除：

• MTProto
• VMess (MD5)
• SOCKS 4/4a（仅保留入站）
• QUIC 传输（已由 SplitHTTP H3 替代）
• DomainSocket 传输方式（由入站监听 socket 替代）
• transport 配置（已彻底移除）
• 数个来自 V2Ray 1.x-3.x 的弃用配置项
• 以及一部分引入后因为上游变动而失效的变更

已经发掘但是尚未移除的古旧弃用功能 （需要 investigation 来保证代码能完全移除，包含可能存在的配置代码、相关函数移除或改动，以及对应的 proto）

• Simple DNS server
• Simple Host mapping
• SOCKS timeout config （不是跟 policy 有关那个）
• 潜藏的可能不属于用来监听的 SOCKS 4/4a 配置代码
• 以及一些 proto 里面彻底没用的数值和参数（可能会导致 breaking）

[kingwilliam]

因我是有用DomainSocket inbound & outbound, 请问 "入站监听 socket" 是什麽? outbound 会用什麽取缔?

[KobeArthurScofield]

@kingwilliam

“入站监听 socket” 即是将你要监听的 Domain Socket 地址写在 inbound 的 listen 处，如果为 abstract socket 需要以 @ 开头，padding abstract socket 需要以 @@ 开头，详见 https://xtls.github.io/config/inbound.html#inboundobject

outbound 目前可能各个协议支持程度不一样，如果确认不支持可以尝试提出 issue，或者知道怎么修改的话欢迎 pr。