Hysteria: baixar versions anteriors

- Fixed QUIC protocol sniffing for modern browsers and QUIC libraries, whose ClientHello spans multiple packets. Domain-based ACL rules now apply to their QUIC traffic
- sniff.timeout now only applies to TCP
- Upgraded TUN mode to the latest upstream sing-tun (v0.9.6)
- Removed the TUN route.strict option, which no longer had any effect
- Updated Chrome QUIC fingerprint parroting to match Chrome 154
- Fixed the client log reporting ECH as not accepted when Chrome parroting is enabled
- Updated quic-go to v0.63.0

- Added hysteria ech subcommand to generate ECH keys and client configuration
- Fixed plain HTTP transfers through the HTTP proxy being cut off after 10 seconds
- Fixed Linux port-hopping rules incorrectly redirecting outbound UDP traffic, which could break Realms connections and other UDP traffic on the same machine
- Updated quic-go to v0.62.0

- Added a quic.disableStatelessReset server option to turn off the QUIC stateless resets introduced in 2.12.1
- Masquerade proxy mode now supports Unix sockets
- Fixed IPv6 connectivity for mimic

- Added Porkbun, Namecheap and Njalla as ACME DNS providers
- Fixed slow reconnection after the client has been idle or asleep, most noticeable on mobile devices. The server now sends QUIC stateless resets, so a client holding a stale connection reconnects immediately instead of waiting out its idle timeout
- Fixed mimic refusing to start when its optional kernel module is not loaded
- Various dependency updates

- Added mimic integration, which disguises the connection as TCP for networks that restrict UDP (Linux only, requires mimic to be installed separately)
- Improved the accuracy of Chrome QUIC fingerprint parroting
- Fixed a BBR panic on paths with a small MTU, introduced in 2.11.0 by Chrome parroting
- Various dependency updates

- Added Chrome QUIC fingerprint parroting: the client's QUIC handshake now looks like Google Chrome's. Enabled by default, but can be turned off with the quic.disableChromeParrot option
- Modernized the ACME stack (CertMagic, ACMEz and the libdns providers)
- Removed the namedotcom ACME DNS provider, as it has not been updated for the new libdns API
- Updated quic-go to v0.61.0

- Added Encrypted Client Hello support
- Added a bandwidth.disableLossCompensation option for disabling Brutal congestion control's loss compensation mechanism, which can improve stability in some cases
- Various dependency updates and minor bug fixes

- Added Hysteria Realms UPnP/NAT-PMP port mapping support for easier NAT traversal
- Added a Hysteria Realms ipMode option to restrict connections to IPv4 or IPv6 only
- Updated quic-go to v0.60.0
- Fixed + in the authentication credentials being corrupted to a space when parsing hysteria2:// sharing links
- Fixed the HTTP proxy rejecting valid Basic authentication credentials
- Fixed the HTTPS proxy outbound using host:port instead of the hostname as the TLS SNI
- Fixed a data race in the client's HTTP/SOCKS5 listener multiplexer
- Fixed nftables redirect failure when the server binds to a specific IPv6 address
- DNS resolver now limits CNAME chain length to prevent unbounded recursion

No public IP? No problem. Hysteria Realms punches through your NAT to let you host a Hysteria server from home, a cellular network, or even a coffee shop. Clients connect directly, peer-to-peer. No port forwarding, no relay.
- Fixed an issue where the client failed to connect to a server behind symmetric NAT, improving hole punching success rate
- The hysteria cert command now includes sniGuard: disable in its sample server config, so self-signed certs work with Realms out of the box

- Added Hysteria Realms: No public IP? No problem. Punches through your NAT to let you host a Hysteria server from home, a cellular network, or even a coffee shop. Clients connect directly, peer-to-peer. No port forwarding, no relay.

This release contains important security fixes and we strongly encourage everyone to upgrade.
- Fixed a security issue where, when sniff was enabled, an attacker could craft malicious QUIC packets to cause a server OOM crash
- Fixed a compatibility issue with some older versions of nftables when server port hopping was enabled
- Fixed a potential thread safety issue in salamander obfs
- Important: Due to changes in how some QUIC handshake parameters are handled, UDP forwarding will not work when v2.8.2 clients connect to older servers (TCP is unaffected). New servers are fully compatible with both new and old clients. We strongly recommend upgrading both servers and clients.

This release contains important fixes and we strongly encourage everyone to upgrade.
- Fixed an issue where client connections could cause the server to crash when using BBR/Reno as the congestion control algorithm
- Fixed iptables calls potentially failing due to lock contention during server port-range listening
- Added HYSTERIA_FIREWALL_BACKEND environment variable to specify the firewall backend (iptables or nftables) for server port-range listening

- Added configurable congestion control: select between BBR and Reno, with three BBR profiles (standard, conservative, aggressive) for fine-tuning congestion control behavior
- Added server-side UDP port range listening (Linux only): the server can now listen on a port range and automatically set up nftables/iptables redirect rules
- Added random port hopping interval: use minHopInterval/maxHopInterval for a randomized hopping pattern instead of a fixed interval
- Added xForwarded option to masquerade proxy for setting X-Forwarded-For/Host/Proto headers
- Minor BBR fixes and improvements
- Minor port hopping fixes and improvements

- Updated quic-go to v0.59.0, QUIC protocol level improvements
- Speed test now defaults to time-based mode, testing download and upload for 10 seconds each. Use --duration to customize. The previous size-based behavior is still available via --data-size.
- Minor code cleanup

This release contains important fixes and we strongly encourage everyone to upgrade.
- Updated quic-go to v0.57.1
- Fixed a long-standing bug in BBR that caused the connection to send faster than the available bandwidth in some cases
- Minor performance improvements

This release contains important fixes and we strongly encourage everyone to upgrade.
- Fixed a server-side memory leak issue that accumulates with each client connection

This release contains important fixes and we strongly encourage everyone to upgrade.
- Security fix & behavior change: tls.pinSHA256 now matches only the fingerprint of the leaf certificate, instead of any certificate in the chain. This change mitigates MITM risks in cases where insecure=true by preventing 1) user accidentally pinning a CA certificate, which would allow any certificate issued by that CA to be accepted, and 2) attacker constructing a forged certificate chain by combining their own leaf certificate with the user server's certificate.
- Fix tun mode UDP packet AF corruption
- Updated quic-go to v0.54.0

- Added mTLS support for client certificate authentication
- Fixed a memory leak issue in tun mode
- Fixed an issue where DNS resolution failed in tun mode on Linux systems using systemd-resolved
- Fixed a bug in the ACL cache that caused rules with different ports or protocols to be applied to irrelevant connections
- Removed the license-conflicted DoH library and replaced it with an in-house implementation
- Fixed a race condition in UDP session handling

- Updated quic-go to v0.52.0
- ClientHello is now fragmented during TLS handshake, which can bypass some firewalls' SNI filtering.
- The --qr option in client mode is deprecated; use the share subcommand to generate links and QR codes instead.