更新中加入了对代理模式接管的请求的 pre-matching 处理，REJECT 行为是进行 TCP RST，DROP 行为是将 socket 挂起。

#Mac #Beta

Version 5.8.3-2973

- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.8.3-2974

- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

REJECT-NO-DROP 改进
接到部分用户回报，在用于去广告等用途时，如果 DNS 返回 NXDOMAIN 可能导致应用等待，而返回 127.0.0.1 会使得应用立刻认为请求失败。

出现该区别的原因，是因为应用开发者对于不同错误的处理逻辑不同。然而在 DNS 中返回 127.0.0.1 进行屏蔽，是一项非常不标准的行为，本质是将请求导向了回环网络 lo0，由本地系统产生一个 TCP refused 响应拒绝请求。

1. 如果本地系统上正好监听了访问的端口，会导致对应监听服务收到该请求，产生非预期结果。
2. 如果被屏蔽的应用重试逻辑非常暴力，由于 connect 127.0.0.1 会被系统极快的拒绝，可能导致 CPU 占用 100%。（即手机发热）

为此 Surge 提供了一个全新的解决方案，对于使用 REJECT-NO-DROP 的请求，Surge DNS 将固定返回特殊 IP 地址 198.18.0.244。对于该地址的所有 TCP 请求，将由 Surge VIF 产生 TCP refused，同时当发现往该地址的 TCP SYN 极高时，进行丢包处理以避免引发高 CPU 占用。

这种处理方式既保留了返回 127.0.0.1 的优点，同时消灭了可能导致的副作用。如果在使用 REJECT 时，出现了 app 等待过长的问题，可尝试使用 REJECT-NO-DROP。

Surge Mac Beta build 2975 已实现该功能

#Mac #Beta

Version 5.8.3-2975

- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.100.0 (3347) is ready to test on iOS.

What to Test:

REJECT 规则相关优化，详见频道说明

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.8.3-2977

- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

Surge Mac & iOS Beta 更新日志
- 增加 pre-matching 标记规则的校验，在不支持的规则上配置该标记将直接产生配置错误。(请注意 PROTOCOL 语句不可用，逻辑规则的子规则也会被校验，但是 RULE-SET 的子规则若不支持仅会不生效而不会报错)
- 对 TCP RST 拒绝方式增加了全局防御，当 3 秒内触发 100 次后，将临时暂停以避免应用死循环导致 CPU 异常，同时输出日志
- pre-matching 的请求日志，由每 30 分钟一条，下调至 5 分钟
- [iOS] 为 iOS 18.1 下，Poor Network Quality 无法被从通知中心自动消除的问题加入了一个 workaround

#iOS #TestFlight

Surge 5 5.100.0 (3348) is ready to test on iOS.

What to Test:

- 增加 pre-matching 标记规则的校验，在不支持的规则上配置该标记将直接产生配置错误。(请注意 PROTOCOL 语句不可用，逻辑规则的子规则也会被校验，但是 RULE-SET 的子规则若不支持仅会不生效而不会报错)
- 对 TCP RST 拒绝方式增加了全局防御，当 3 秒内触发 100 次后，将临时暂停以避免应用死循环导致 CPU 异常，同时输出日志
- pre-matching 的请求日志，由每 30 分钟一条，下调至 5 分钟
- 为 iOS 18.1 下，Poor Network Quality 无法被从通知中心自动消除的问题加入了一个 workaround

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.8.3-2978

- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

关于 Pre-matching REJECT 的说明已加入到手册中：https://manual.nssurge.com/policy/reject.html

#Mac #Beta

Version 5.8.3-2979

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.8.3-2980

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.8.3-2981

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.9.0-2984

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.100.0 (3349) is ready to test on iOS.

What to Test:

- URL-REGEX 规则支持 extended-matching 标记
- 修改数据网络的切换提示为通讯技术而非 IP
- 支持在 UI 上配置 pre-matching 标记了
- pre-matching 的实现细节优化
- 其他细节调整

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.9.0-2985

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed

#Mac #Release

Version 5.8.2-2946

- Fix the issue where IPv6 VIF cannot take over requests when the gateway-restricted-to-lan parameter is enabled.
- DNS lookup of use-application-dns.net will return NXDOMAIN, causing Firefox to automatically disable application DNS, (i.e., DoH). Using encrypted DNS directly in the browser will prevent Surge from correctly obtaining the requested domain names.
- Bug fixes and minor improvements.

Official Channel: @SurgeTestFlightFeed

#Mac #Beta

Version 5.9.0-2986

- Added pre-matching feature for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- The URL-REGEX rule now supports extended-matching tags.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
- Allow the use of Ponte policy as an underlying proxy.
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.

Official Channel: @SurgeTestFlightFeed