uvian/xboard-coreXboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解
A next-generation node backend for the cedar2025/Xboard panel.
It takes the modern protocol coverage + kernel integration approach of wyx2685/v2node, and the operations layer (push/machine mode/certificates/dual kernel) of cedar2025/Xboard-Node, with the kernel baseline locked to Xray-core v26.10.31.
Documents: docs/ARCHITECTURE.md (architecture and decision records) · docs/CONTRACT.md (field-by-field contract with the panel, including evidence line numbers) · docs/PANEL-PATCH.md (panel patch: why it was changed, how to install it, how to roll it back) · docs/STATUS.md (implemented / not implemented / how to verify) · docs/PANEL-IMPROVEMENTS.md (longer-term list of panel improvements)
| 维度 | Xboard-Node（dev 2026-04） | v2node（2026-10） | 本项目 |
|---|---|---|---|
| 内核版本 | fork 冻结在 v26.3.27 | v26.9.30 | v26.10.31（含 MPTCP 默认关闭） |
| 设备数/限速 | //go:linkname 劫持未导出注册表 | 复制整个 dispatcher 包到自身模块 | 单补丁 app/usergate（3 处 hunk） |
| 协议面 | vless/vmess/trojan/ss/hysteria2/tuic/anytls（xray+sing-box） | vless/vmess/trojan/ss/hysteria2/tuic/anytls，含 VLESS encryption / mldsa65Seed / xver | xray 侧 vless/vmess/trojan/ss2022 + 完整 REALITY 硬化；anytls/tuic/hysteria2 交 sing-box（零协议补丁） |
| 传输 | ws/grpc/httpupgrade/h2(已删)/xhttp | tcp/ws/grpc/httpupgrade/xhttp | xhttp 优先，h2/quic 编译期拒绝 |
| 推送 | WS handshake 推送 | 仅轮询（ETag + msgpack） | WS 推送 + 轮询回退 |
| 证书 | certmagic + 21 个 libdns provider | lego | certmagic + libdns（沿用 xbn 方案） |
| 机器模式 | 支持（多节点/单进程） | 单进程多 Nodes | 支持 |
Key conclusion: the real divergence between the two projects is not in features, but in "how to insert themselves into xray's data plane".
app/usergate package + 3 hunks in the vendored xray, let xray's own dispatcher handle the data-plane semantics, and have the gate only implement two pure functions, Admit/Limit.cmd/xboard-core/ # 入口（node 模式 / machine 模式 / standalone）
internal/config/ # YAML 配置 + 校验 + 热重载
internal/panel/ # 面板契约：/api/v2/server/*（含 V1 兼容）
internal/kernel/ # 内核抽象（xray / singbox 双实现）
internal/kernel/xray/ # 配置构建（安全默认在此集中收敛）+ 运行时热更新
internal/gate/ # 设备数 + 限速闸门（被 usergate 补丁调用）
internal/sysinfo/ # 面板 status 必填项（cpu/mem/swap/disk，零依赖）
internal/traffic/ # 每用户流量计数与上报
internal/metrics/ # Prometheus 指标 + 健康检查
internal/cert/ # ACME 证书管理（certmagic + libdns）
third_party/xray/ # vendored Xray-core + 补丁序列
panel-patch/ # 面板侧补丁（对 cedar2025/Xboard 的零迁移改动）
docs/ # 架构决策记录、面板改造清单
Dependencies: Go 1.27+ (required by go.mod), git, GNU patch.
make vendor # clone Xray-core v26.10.31 到 third_party/xray
make patches # 打 patches/*.patch（幂等）
make build # -> bin/xboard-core
bash scripts/verify.sh # gofmt + vet + test + build + smoke + vendored 单测 + 补丁幂等
On machines without make (for example, git-bash on Windows), run bash scripts/verify.sh directly; it is equivalent to make verify;
make vendor can be replaced with a single tar pipeline; see the implementation in the Makefile.
Windows note: if
%TEMP%is not writable, go will reportcreating work dir: ... Access is denied; before building, justexport TMP=D:/tmp TEMP=D:/tmp(scripts/verify.shsupports theGO_TMPvariable).
For the current status, see docs/STATUS.md: go build ./..., go test ./..., -smoke,
and the unit tests for the vendored app/usergate and app/dispatcher have all passed.
SetMultipathTCP(false) (CVE-2026-98432), unless the configuration explicitly sets sockopt.tcpMptcp: true.debug.SetGCPercent, it also checks whether GODEBUG contains multipathtcp=0; if missing, it logs a WARN and continues; install.sh writes this by default.allowInsecure is rejected at the build layer and translated into pinnedPeerCertSha256 / verifyPeerCertByName.h2/http/h3/quic transports report an error directly at the build layer (removed upstream) and will not silently downgrade to tcp.shortIds non-empty validation, dest required, maxTimeDiff defaults to 90s, optional mldsa65Seed/xver/limitFallback*.minClientVer is not delivered; if the panel delivers it, a WARN is logged and exposed at /status, to avoid mihomo-family clients being silently downgraded.