Beta2.1

[cmliu]

This pull request adds support for XHTTP obfs padding (obfuscation padding) on the server side, enabling the system to recognize and validate special padding headers and query parameters for enhanced protocol camouflage. It introduces the ability to extract, validate, and generate obfs padding according to the "tokenish" and "queryInHeader" modes, aligning with upstream implementations. The changes also update the protocol configuration and response handling to support these features.

XHTTP obfs padding support:

• Added functions to extract, validate, and generate XHTTP obfs padding from request headers and query parameters, using HPACK Huffman encoding length checks for validation.
• Updated the XHTTP request handler (处理XHTTP请求) to perform obfs padding extraction and validation, rejecting requests with invalid padding.
• Modified response handling to include random obfs padding in response headers for further protocol camouflage.

Protocol configuration and detection:

• Updated the protocol configuration generator (获取传输协议配置) to inject XHTTP obfs padding parameters into the extra field for xhttp nodes, ensuring clients send the correct padding.
• Improved detection logic for XHTTP requests to recognize obfs padding in both headers and query parameters, enhancing compatibility with different client implementations.

Documentation and versioning:

• Updated CHANGELOG to document the addition of XHTTP obfs padding receiver support.
• Bumped version to 2026-08-10 03:09:01.

[Copilot]

Pull request overview

This PR adds server-side support for XHTTP obfs padding by detecting padding markers on incoming requests, validating padding using HPACK Huffman encoded length checks (tokenish), and applying randomized padding to responses. It also updates xhttp node configuration generation to include the required obfs padding parameters in the extra field.

Changes:

• Added XHTTP obfs padding extraction, HPACK Huffman length calculation, validation, and response padding generation in _worker.js.
• Enhanced XHTTP request detection to also recognize padding headers and query parameters.
• Updated protocol configuration generation for xhttp nodes to inject xPaddingObfsMode-related parameters; updated CHANGELOG.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG	Documents the new XHTTP obfs padding receiver support and version entry.
_worker.js	Implements padding extraction/validation/response padding for XHTTP and injects xhttp extra parameters during config generation.

Suppressed comments (2)

_worker.js:4713

• 获取传输协议配置(配置 = {}) 现在无条件调用 获取XHTTPPadding标识(配置.UUID)，这会让该函数在 UUID 缺失/非字符串时直接抛错（与默认参数 {} 的可选性不匹配），并且在非 xhttp 协议下做了不必要的计算。建议仅在 传输协议 === 'xhttp' 且 UUID 合法时生成 padding 标识，并用 encodeURIComponent(JSON.stringify(...)) 生成 extra，避免手写 URL 编码字符串。

function 获取传输协议配置(配置 = {}) {
	const 是gRPC = 配置.传输协议 === 'grpc';
	const { 头: 本机Padding头, 键: 本机Padding键 } = 获取XHTTPPadding标识(配置.UUID);
	return {
		type: 是gRPC ? (配置.gRPC模式 === 'multi' ? 'grpc&mode=multi' : 'grpc&mode=gun') : (配置.传输协议 === 'xhttp' ? `xhttp&mode=stream-one&extra=%7B%22xPaddingObfsMode%22%3Atrue%2C%22xPaddingMethod%22%3A%22tokenish%22%2C%22xPaddingPlacement%22%3A%22queryInHeader%22%2C%22xPaddingHeader%22%3A%22${本机Padding头}%22%2C%22xPaddingKey%22%3A%22${本机Padding键}%22%7D` : 'ws'),
		路径字段名: 是gRPC ? 'serviceName' : 'path',

_worker.js:610

• 生成XHTTPPadding串 使用 Math.random() 生成 padding，会带来可预测性且与文件内其他随机字节生成方式（多处使用 crypto.getRandomValues）不一致。建议改为基于 crypto.getRandomValues 生成随机字节再映射到 base62 字符集。

function 生成XHTTPPadding串(长度) {
	const 字符集长度 = XHTTPBase62字符集.length;
	let 结果 = '';
	for (let i = 0; i < 长度; i++) {
		结果 += XHTTPBase62字符集[Math.floor(Math.random() * 字符集长度)];
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.