What Is the VLESS Protocol? Implementation Details in the Fanqiang Repository

VLESS (VMess Less) is a lightweight, authentication-free transport protocol that uses a single UUID and optional flow parameter to establish secure proxy connections, eliminating the complex alterId configuration required by traditional VMess.

The VLESS protocol serves as a streamlined alternative within the V2Ray ecosystem, designed to reduce configuration overhead while maintaining high-performance traffic forwarding. In the bannedbook/fanqiang repository, VLESS is implemented through a series of Kotlin and Java option classes that integrate with the SingBox configuration generator and Android proxy manager to build runtime-compatible proxy configurations.

Core Architecture of the VLESS Protocol

The Fanqiang codebase implements VLESS through three primary data structures defined in SingBoxOptions.java. These classes map directly to the protocol's handshake mechanics, which rely on UUID-based identification rather than the multi-ID system used by VMess.

VLESS Inbound Configuration

The VLESSInboundOptions class defines how the server listens for incoming VLESS connections. Located at line 2417 of fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java, this class encapsulates server-side parameters including network listeners, TLS termination, and transport layer settings.

Key fields include:

• listen and listen_port – Bind address and port allocation
• users – List of VLESSUser objects containing authentication credentials
• tls – InboundTLSOptions for certificate management
• transport – V2RayTransportOptions supporting TCP, WebSocket, or QUIC overlays

User Identification and Flow Parameters

Each VLESS user is represented by the VLESSUser class (lines 61-68 in SingBoxOptions.java). Unlike VMess, which requires an alterId parameter for backward compatibility, VLESS relies solely on a UUID for client identification.

The class supports:

• uuid – The 36-character universally unique identifier
• name – Optional human-readable label
• flow – Optional encryption layer specification (e.g., "xtls-rprx-origin")

The flow parameter enables extended encryption modes such as XTLS vision, which reduces encryption overhead during TLS handshakes.

VLESS Outbound Configuration

Client-side connections are managed through VLESSOutboundOptions (lines 71-90 in SingBoxOptions.java). This class mirrors the inbound structure while adding client-specific routing capabilities:

• server and server_port – Target destination coordinates
• network – Transport protocol selection
• multiplex – MultiplexOptions for connection pooling and concurrency control
• tls – OutboundTLSOptions with SNI configuration

Protocol Detection in the Proxy Manager

The Android runtime handles VLESS detection through the RawUpdater.kt file located at fqnews2/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt. At line 290, the parser examines JSON proxy configurations to differentiate VLESS from VMess instances.

When proxy["type"] == "vless" evaluates true, the updater:

1. Sets the internal isVLESS flag to true
2. Disables VMess-specific fields such as alterId and cipher
3. Preserves the uuid and optional flow fields for protocol negotiation

This detection mechanism ensures that legacy VMess parameters do not contaminate VLESS configuration objects during runtime initialization.

Practical Implementation Examples

The following examples demonstrate how to construct VLESS configurations using the Fanqiang source classes.

Building a VLESS Inbound Server

// Initialize inbound listener
SingBoxOptions.VLESSInboundOptions inbound = new SingBoxOptions.VLESSInboundOptions();
inbound.listen = "0.0.0.0";
inbound.listen_port = 443;

// Configure TLS termination
inbound.tls = new SingBoxOptions.InboundTLSOptions();
inbound.tls.enabled = true;
inbound.tls.cert_path = "/etc/ssl/cert.pem";
inbound.tls.key_path = "/etc/ssl/key.pem";

// Define authenticated user
SingBoxOptions.VLESSUser user = new SingBoxOptions.VLESSUser();
user.uuid = "e3d3f2c1-9b2a-4d5e-b8c3-1a2b3c4d5e6f";
user.flow = "xtls-rprx-origin";
inbound.users = Collections.singletonList(user);

// Apply WebSocket transport
SingBoxOptions.V2RayTransportOptions transport = new SingBoxOptions.V2RayTransportOptions();
transport.type = "ws";
transport.path = "/vless-ws";
inbound.transport = transport;

Configuring a VLESS Outbound Client

val outbound = VLESSOutboundOptions().apply {
    server = "proxy.example.com"
    server_port = 443
    uuid = "e3d3f2c1-9b2a-4d5e-b8c3-1a2b3c4d5e6f"
    flow = "xtls-rprx-origin"
    network = "ws"
    
    tls = OutboundTLSOptions().apply {
        enabled = true
        server_name = "proxy.example.com"
    }
    
    multiplex = MultiplexOptions().apply {
        enabled = true
        concurrency = 4
    }
}

Generating VLESS URI Strings

The legacy profile system references the VLESS URI schema through the VLESS_PROTOCOL constant defined in fqnews/core/src/main/java/com/github/shadowsocks/database/Profile.kt at line 123.

val uri = "vless://${user.uuid}@${outbound.server}:${outbound.server_port}" +
          "?encryption=${outbound.flow}&type=${outbound.network}&security=tls"

Summary

• VLESS eliminates the alterId complexity of VMess, using only a UUID and optional flow parameter for authentication and encryption negotiation.
• The implementation resides primarily in SingBoxOptions.java, which defines VLESSInboundOptions, VLESSOutboundOptions, and VLESSUser classes for configuration management.
• Protocol detection occurs in RawUpdater.kt, which sets the isVLESS flag and sanitizes VMess-specific fields when parsing subscription configurations.
• The architecture supports pluggable transports including WebSocket, QUIC, and raw TCP, with optional TLS and XTLS flow layers for enhanced performance.

Frequently Asked Questions

What is the difference between VLESS and VMess protocols?

VLESS removes the alterId security layer required by VMess, relying instead on a single UUID for client identification. This simplification reduces configuration errors and computational overhead while maintaining security through TLS or XTLS encryption layers. According to the Fanqiang source code, VLESS configurations explicitly disable VMess fields like cipher and alterId during parsing in RawUpdater.kt.

How does the VLESS protocol handle user authentication?

VLESS uses UUID-based authentication exclusively. The VLESSUser class stores a 36-character UUID and an optional flow string that specifies extended encryption modes. There is no password or secondary ID system; security depends on the UUID's uniqueness and the transport layer encryption (TLS/XTLS) protecting the connection.

What is the purpose of the flow parameter in VLESS?

The flow parameter specifies additional encryption handling such as "xtls-rprx-origin" or "xtls-rprx-vision". These modes enable XTLS, which reduces double-encryption overhead when proxying TLS traffic by allowing the proxy to snoop and relay TLS handshakes without re-encrypting the payload. In the Fanqiang implementation, this is stored in the flow field of the VLESSUser class.

Where is VLESS configured in the Fanqiang Android application?

VLESS configurations are defined in fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java through the inbound and outbound options classes. Runtime protocol detection and URI generation are handled in RawUpdater.kt and Profile.kt respectively, allowing the app to parse VLESS subscription links and generate compatible SingBox configurations for the V2Ray runtime.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}