konduit/konduit-public
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

9 Releases 9 Tags

RSS Feed
  • v0.1.0-beta.8 b160652737
    Compare

    Konduit v0.1.0-beta.8 Pre-Release

    eugen released this 2026-07-16 12:05:37 +00:00 | 4 commits to master since this release

    Beta 8 — SOCKS5 Chaining, Stealth Mode Removed, Throughput Fixes

    What's New

    SOCKS5 chaining (use_proxy / listen_socks)

    Stealth/camouflage mode is gone. In its place, Konduit now exposes plain SOCKS5
    hooks so it can be chained behind a dedicated proxy tool (e.g. Xray, sing-box)
    instead of reimplementing traffic obfuscation itself:

    • use_proxy — dial the server through an upstream SOCKS5 proxy (egress)
    • listen_socks — expose a local SOCKS5 listener after the tunnel is up, so
      other tools can route traffic through the VPN (ingress)

    Both are available as config fields and CLI flags, and are now surfaced in the
    admin-ui device creation form and generated client.toml.

    Download throughput bug fixed

    DL throughput was capped at ~130 Kbit/s in every configuration, independent of
    any TSPU/censorship interference — proven via an SSH-tunneled control test.
    Root cause: the server's TUN read path (Framed + BytesCodec) reused one
    buffer and truncated packets once free space dropped below MTU. Fixed with a
    fresh MTU-sized buffer per read plus an atomic single write. Clean-path DL is
    now 4-5 Mbit/s (was ~130 Kbit/s), 0 retransmits.

    Per-flow connection pinning

    Concurrent flows now spread across the connection pool instead of piling onto
    one connection: each inner flow (5-tuple hash) is pinned to one pooled
    connection for both download (server-side) and upload (client-side), so
    traffic no longer reorders and multiple flows use the pool in parallel.

    Removed

    • stealth config/CLI flag and everything it implied: fake-TLS, uTLS Chrome
      fingerprinting, WebSocket camouflage, HTTP POST tunnel + padding, gRPC-shaped
      traffic, burst shaping, IMAP IDLE camouflage
    • ssh_transport — real-SSH-carried tunnel mode; measured at ~10x below
      baseline throughput with a DL/UL asymmetry that wasn't worth chasing further
    • [stealth] config block — replaced by a plain [connection] block
      (pool_enabled, pool_size, carry_duration)

    Upgrade notes

    Any client.toml/server.toml using [stealth] fields (stealth,
    reconnect_interval, tls_sni, tls_fingerprint, ssh_transport, etc.) must
    be updated to the new [connection] block plus use_proxy/listen_socks as
    needed — the old fields are no longer recognized.

    Downloads