cleaning up
This commit is contained in:
esefxdz committed
1 parent
c1ec77a075
commit
75cf59f22c
12 files changed
+214
-322
No files matched your search
+77
-35
@@ -5,50 +5,92 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
|
||||
|
||||
---
|
||||
|
||||
## [2.0.7] — Unreleased
|
||||
## [3.0.0] — 2026-08
|
||||
|
||||
### Fixed (audit #13 — 2026-07-31)
|
||||
- **Notification bug** — `SessionTimer.stop()` now cancels the persistent Android notification. Previously it lingered after user-initiated disconnect.
|
||||
- **Concurrent sync guard** — `_syncInProgress` flag in `_syncWithHivemind()` prevents duplicate HTTP requests from overlapping.
|
||||
- **Debug bypass gate** — `AppConfig.enableAdBypass` (in `app_config.example.dart`) replaces `kDebugMode` for the fake AdMob callback. Tree-shaken in release.
|
||||
### Protocol — TCP → XHTTP migration
|
||||
- **Transport changed from TCP to XHTTP** (H2 stream-up with Reality).
|
||||
XTLS-Vision (`xtls-rprx-vision`) removed — it only applies to TCP+TLS/Reality,
|
||||
not XHTTP. XHTTP provides H2 multiplexing, CDN passthrough, and path-based
|
||||
hiding behind `/revolt`.
|
||||
- **`flow` field removed from VLESS client config.** Xray falls back to standard
|
||||
TLS proxying inside the XHTTP tunnel — correct and intentional per official
|
||||
VLESS inbound docs.
|
||||
|
||||
### Changed
|
||||
- **Responsive layout** — main screen uses `LayoutBuilder` with proportional fractions instead of hardcoded pixel positions. Pixel-identical on reference device, scales to any screen.
|
||||
- **Dynamic version** — sidebar footer reads `ReVoltApp.appVersion` from `PackageInfo` instead of hardcoded `v2.0.7`.
|
||||
- **Swarm/log blocked** — nginx explicitly returns 404 for `/api/swarm` and `/api/log`. Monitoring runs locally via `swarm_watch.py` on `127.0.0.1:5000`.
|
||||
### Fixed — critical server bug
|
||||
- **Client hot-reload was broken.** `xray.py` called `xray api adi` (add inbounds,
|
||||
zero arguments) after writing `config.json`. This was a no-op — Xray never
|
||||
learned about new VLESS clients. Every session created since the modular
|
||||
rewrite was silently rejected at the VLESS layer.
|
||||
Fixed: `add_client()` now writes a temp JSON and calls `xray api adu`
|
||||
(add users). `remove_client()` calls `xray api rmu -tag=X email`.
|
||||
Verified against `XTLS/Xray-core` HandlerService source.
|
||||
|
||||
### Server fixes (internal)
|
||||
- `/session/stop` fetches Xray stats BEFORE popping session — prevents race where final byte count is lost
|
||||
- `XrayManager._stats_lock` serializes diagnostic counter (non-atomic `+=` race)
|
||||
- `ManagementLoop._start_lock` prevents TOCTOU on daemon startup
|
||||
- **Manual update checker** — "Check for updates" button in sidebar
|
||||
- Uses GitHub Releases API to find the latest version
|
||||
- Up to date → snackbar "✓ Up to date"
|
||||
- Update available → opens Play Store or GitHub releases page immediately
|
||||
- **Website button** in sidebar → opens `https://getrevolt.app`
|
||||
- **Timer syncing indicator** — shows "Connecting…" / "Syncing…" spinner during handshake
|
||||
### Fixed — client
|
||||
- **Missing XHTTP path in VLESS URL.** Server requires `path: "/revolt"` in
|
||||
`xhttpSettings` but the VLESS URL never included a `path` parameter.
|
||||
Fixed: `hivemind_service.dart` reads `xhttp_path` from `/session/status`,
|
||||
falls back to `AppConfig.vlessPath`.
|
||||
- **`providerBundleIdentifier` mismatch.** Was `com.revoltvpn.app` — must match
|
||||
Android `applicationId` (`com.paladinvpn.app`) for VPN service registration.
|
||||
|
||||
### Changed
|
||||
- Sidebar now has 6 rows: Ad Consent, Privacy Policy, About, Discord, Website, Check for updates
|
||||
- API uses domain with proper TLS validation (traffic blends in with normal HTTPS)
|
||||
- VPN tunnel destination pinned to hardcoded server IP (domain compromise = DoS only)
|
||||
### Fixed — server config
|
||||
- **Reality keypair generated.** Replaced `GENERATE_ME_WITH_xray_x25519`
|
||||
placeholders in both `config.py` and `xray_config_reality.json` with a real
|
||||
X25519 keypair. Private key stays on server; public key sent to clients.
|
||||
- **Throttle policy corrected.** `uplinkOnly`/`downlinkOnly` were set to
|
||||
`187500` — that's 52 hours, not 1.5 Mbps. These fields are **seconds**
|
||||
(idle timeouts), not bandwidth rate limiters (per official Policy docs).
|
||||
Set to defaults (2s / 5s). Real 1.5 Mbps cap requires Linux `tc`.
|
||||
- **Fallback rate limits removed.** Live Reality docs warn fallback limiting
|
||||
*"is itself a fingerprint and is not recommended."* Ports are firewalled
|
||||
so fallback traffic is impossible anyway. Comment added for future reference.
|
||||
|
||||
### Security
|
||||
- 6 new security audits (#8 through #12) covering domain exposure, network transit, server hardening, and pentesting
|
||||
- SNI rotation per session — 5 spoofed sites instead of 1
|
||||
- Outbound abuse ports blocked (SMTP, NetBIOS, SSDP)
|
||||
- Xray `flow: xtls-rprx-vision` properly set server-side
|
||||
|
||||
### Dependencies
|
||||
- `package_info_plus` added
|
||||
### Added
|
||||
- **`xhttp_path` in `/session/status` response.** Server now sends the XHTTP
|
||||
path to clients, same pattern as `reality_pbk`/`reality_sid`/`reality_sni`.
|
||||
`VLESS_XHTTP_PATH` constant in `config.py` is the single source of truth.
|
||||
- **Updated deployment guide** (`SERVER_DEPLOYMENT.md`) — full step-by-step
|
||||
for XHTTP+Reality, verified against live Xray docs at xtls.github.io.
|
||||
- **Updated cheatsheet** (`scraped/VLESS_XRAY_CHEATSHEET.md`) — all sections
|
||||
rewritten for XHTTP. Old TCP/Vision info replaced.
|
||||
|
||||
---
|
||||
|
||||
## [1.0.6] — Previous release
|
||||
## [2.0.7] — 2026-07-31
|
||||
|
||||
- VLESS + Xray Reality tunnel with XTLS-Vision
|
||||
- 60 min session, 4 GB throttle
|
||||
- Support top-up: +30 min +2 GB via rewarded ad
|
||||
### Fixed
|
||||
- **Notification bug** — `SessionTimer.stop()` now cancels the persistent
|
||||
Android notification on user-initiated disconnect.
|
||||
- **Concurrent sync guard** — `_syncInProgress` flag prevents duplicate
|
||||
HTTP requests from overlapping in `_syncWithHivemind()`.
|
||||
- **Debug bypass gate** — `AppConfig.enableAdBypass` replaces `kDebugMode`
|
||||
for fake AdMob callback. Tree-shaken in release builds.
|
||||
|
||||
### Changed
|
||||
- **Responsive layout** — main screen uses `LayoutBuilder` with proportional
|
||||
fractions. Scales to any screen size.
|
||||
- **Dynamic version** — sidebar footer reads from `PackageInfo` instead of
|
||||
hardcoded string.
|
||||
- **Swarm/log blocked** — nginx returns 404 for `/api/swarm` and `/api/log`.
|
||||
Monitoring runs locally via `swarm_watch.py`.
|
||||
|
||||
### Added
|
||||
- **Update checker** in sidebar — polls GitHub Releases API.
|
||||
- **Website button** in sidebar → opens `https://getrevolt.app`.
|
||||
- **Timer syncing indicator** — spinner during handshake.
|
||||
- Dependency: `package_info_plus`.
|
||||
|
||||
### Server
|
||||
- `/session/stop` fetches stats BEFORE popping session (race fix).
|
||||
- `XrayManager._stats_lock` for diagnostic counter thread safety.
|
||||
- `ManagementLoop._start_lock` prevents TOCTOU on daemon startup.
|
||||
|
||||
---
|
||||
|
||||
## [1.0.6] — 2026-06
|
||||
|
||||
- Initial VLESS + Xray Reality tunnel
|
||||
- 60 min session, 4 GB throttle, support top-up
|
||||
- Server health dot, speed display, countdown timer
|
||||
- Persistent Android notification
|
||||
- Glass-morphism dark UI with yellow accent
|
||||
|
||||
Reference in new issue
Block a user