Update documentation

* Add shadowtls outbound

* Add shadowtls inbound

* Add shadowtls example

* Add shadowtls documentation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,5 @@
 name: Bug Report
 description: "Create a report to help us improve."
-labels: [ bug ]
 body:
   - type: checkboxes
     id: terms
@@ -32,7 +31,7 @@ body:
         <details>
 
         ```console
-        $ sing-box --version
+        $ sing-box version
         # Paste output here
         ```
 
@@ -56,7 +55,7 @@ body:
       required: true
 
   - type: textarea
-    id: config
+    id: log
     attributes:
       label: Server and client log file
       value: |-

.github/workflows/docker.yml

@@ -0,0 +1,43 @@
+name: Build Docker Images
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag version you want to build"
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@v3
+        with:
+          images: ghcr.io/sagernet/sing-box
+      - name: Get tag to build
+        id: tag
+        run: |
+          if [[ -z "${{ github.event.inputs.tag }}" ]]; then
+            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.ref_name }}
+          else
+            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.event.inputs.tag }}
+          fi
+      - name: Build and release Docker images
+        uses: docker/build-push-action@v2
+        with:
+          platforms: linux/386,linux/amd64
+          target: dist
+          tags: ${{ steps.tag.outputs.tag }}
+          push: true

.github/workflows/mkdocs.yml

@@ -2,7 +2,7 @@ name: Generate Documents
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - docs/**
       - .github/workflows/mkdocs.yml

.goreleaser.yaml

@@ -13,11 +13,13 @@ builds:
     tags:
       - with_quic
       - with_wireguard
-      - with_acme
       - with_clash_api
     env:
       - CGO_ENABLED=0
     targets:
+      - android_arm64
+      - android_amd64
+      - android_amd64_v3
       - linux_amd64_v1
       - linux_amd64_v3
       - linux_arm64

Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.19-alpine AS builder
+LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
+COPY . /go/src/github.com/sagernet/sing-box
+WORKDIR /go/src/github.com/sagernet/sing-box
+ARG GOPROXY=""
+ENV GOPROXY ${GOPROXY}
+ENV CGO_ENABLED=0
+RUN set -ex \
+    && apk add git build-base \
+    && export COMMIT=$(git rev-parse HEAD) \
+    && go build -v -trimpath -tags 'with_quic,with_acme,with_wireguard,with_clash_api' \
+        -o /go/bin/sing-box \
+        -ldflags "-X github.com/sagernet/sing-box/constant.Commit=${COMMIT} -w -s -buildid=" \
+        ./cmd/sing-box
+FROM alpine AS dist
+LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+RUN set -ex \
+    && apk upgrade \
+    && apk add bash tzdata ca-certificates \
+    && rm -rf /var/cache/apk/*
+COPY --from=builder /go/bin/sing-box /usr/local/bin/sing-box
+ENTRYPOINT ["sing-box"]

Makefile

@@ -49,7 +49,14 @@ snapshot:
 	ghr --delete --draft --prerelease -p 1 nightly dist/release
 	rm -r dist
 
-snapshot_install:
+release:
+	goreleaser release --rm-dist --skip-publish
+	mkdir dist/release
+	mv dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/release
+	ghr --delete --draft --prerelease -p 3 $(shell git describe --tags) dist/release
+	rm -r dist
+
+release_install:
 	go install -v github.com/goreleaser/goreleaser@latest
 	go install -v github.com/tcnksm/ghr@latest
 

adapter/inbound.go

@@ -2,11 +2,13 @@ package adapter
 
 import (
 	"context"
+	"net"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/process"
 	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
 )
 
 type Inbound interface {
@@ -15,6 +17,13 @@ type Inbound interface {
 	Tag() string
 }
 
+type InjectableInbound interface {
+	Inbound
+	Network() []string
+	NewConnection(ctx context.Context, conn net.Conn, metadata InboundContext) error
+	NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext) error
+}
+
 type InboundContext struct {
 	Inbound     string
 	InboundType string
@@ -29,6 +38,8 @@ type InboundContext struct {
 
 	// cache
 
+	InboundDetour            string
+	LastInbound              string
 	OriginDestination        M.Socksaddr
 	DomainStrategy           dns.DomainStrategy
 	SniffEnabled             bool

box.go

@@ -138,7 +138,7 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		}
 		outbounds = append(outbounds, out)
 	}
-	err = router.Initialize(outbounds, func() adapter.Outbound {
+	err = router.Initialize(inbounds, outbounds, func() adapter.Outbound {
 		out, oErr := outbound.New(ctx, router, logFactory.NewLogger("outbound/direct"), option.Outbound{Type: "direct", Tag: "default"})
 		common.Must(oErr)
 		outbounds = append(outbounds, out)

cmd/sing-box/cmd_version.go

@@ -38,7 +38,7 @@ func printVersion(cmd *cobra.Command, args []string) {
 		version += runtime.Version()
 		version += ", "
 		version += runtime.GOOS
-		version += ", "
+		version += "/"
 		version += runtime.GOARCH
 		version += ", "
 		version += "CGO "

common/baderror/baderror.go

@@ -0,0 +1,12 @@
+package baderror
+
+import "strings"
+
+func Contains(err error, msgList ...string) bool {
+	for _, msg := range msgList {
+		if strings.Contains(err.Error(), msg) {
+			return true
+		}
+	}
+	return false
+}

common/baderror/grpc.go

@@ -0,0 +1,26 @@
+package baderror
+
+import (
+	"context"
+	"io"
+	"net"
+)
+
+func WrapGRPC(err error) error {
+	// grpc uses stupid internal error types
+	if err == nil {
+		return nil
+	}
+	if Contains(err, "EOF") {
+		return io.EOF
+	}
+	if Contains(err, "Canceled") {
+		return context.Canceled
+	}
+	if Contains(err,
+		"the client connection is closing",
+		"server closed the stream without sending trailers") {
+		return net.ErrClosed
+	}
+	return err
+}

common/baderror/h2.go

@@ -0,0 +1,22 @@
+package baderror
+
+import (
+	"io"
+	"net"
+
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func WrapH2(err error) error {
+	if err == nil {
+		return nil
+	}
+	err = E.Unwrap(err)
+	if err == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	if Contains(err, "client disconnected", "body closed by handler") {
+		return net.ErrClosed
+	}
+	return err
+}

common/dialer/bind.go

@@ -1,19 +0,0 @@
-package dialer
-
-import (
-	"syscall"
-
-	"github.com/sagernet/sing/common/control"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func skipIfPrivate(next control.Func) control.Func {
-	return func(network, address string, conn syscall.RawConn) error {
-		destination := M.ParseSocksaddr(address)
-		if !N.IsPublicAddr(destination.Addr) {
-			return nil
-		}
-		return next(network, address, conn)
-	}
-}

common/dialer/default.go

@@ -11,6 +11,7 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common/control"
+	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
@@ -64,25 +65,25 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	var listener net.ListenConfig
 	if options.BindInterface != "" {
 		warnBindInterfaceOnUnsupportedPlatform.Check()
-		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), options.BindInterface))
+		bindFunc := control.BindToInterface(router.InterfaceBindManager(), options.BindInterface)
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.AutoDetectInterface() {
 		if C.IsWindows {
-			bindFunc := skipIfPrivate(control.BindToInterfaceIndexFunc(func() int {
-				return router.InterfaceMonitor().DefaultInterfaceIndex()
-			}))
+			bindFunc := control.BindToInterfaceIndexFunc(func(network, address string) int {
+				return router.InterfaceMonitor().DefaultInterfaceIndex(M.ParseSocksaddr(address).Addr)
+			})
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		} else {
-			bindFunc := skipIfPrivate(control.BindToInterfaceFunc(router.InterfaceBindManager(), func() string {
-				return router.InterfaceMonitor().DefaultInterfaceName()
-			}))
+			bindFunc := control.BindToInterfaceFunc(router.InterfaceBindManager(), func(network, address string) string {
+				return router.InterfaceMonitor().DefaultInterfaceName(M.ParseSocksaddr(address).Addr)
+			})
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		}
 	} else if router.DefaultInterface() != "" {
-		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface()))
+		bindFunc := control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface())
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	}
@@ -113,7 +114,10 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	}
 	var bindUDPAddr string
 	udpDialer := dialer
-	bindAddress := netip.Addr(options.BindAddress)
+	var bindAddress netip.Addr
+	if options.BindAddress != nil {
+		bindAddress = options.BindAddress.Build()
+	}
 	if bindAddress.IsValid() {
 		dialer.LocalAddr = &net.TCPAddr{
 			IP: bindAddress.AsSlice(),
@@ -127,6 +131,9 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 }
 
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
+	if !address.IsValid() {
+		return nil, E.New("invalid address")
+	}
 	switch N.NetworkName(network) {
 	case N.NetworkUDP:
 		return d.udpDialer.DialContext(ctx, network, address.String())

common/dialer/resolve.go

@@ -51,7 +51,7 @@ func (d *ResolveDialer) DialContext(ctx context.Context, network string, destina
 }
 
 func (d *ResolveDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsFqdn() || destination.Fqdn == "" {
+	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx, metadata := adapter.AppendContext(ctx)

common/process/searcher_android.go

@@ -18,21 +18,21 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *androidSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	socket, err := resolveSocketByNetlink(network, source, destination)
+	_, uid, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	if sharedPackage, loaded := s.packageManager.SharedPackageByID(socket.UID); loaded {
+	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid % 100000); loaded {
 		return &Info{
-			UserId:      int32(socket.UID),
+			UserId:      int32(uid),
 			PackageName: sharedPackage,
 		}, nil
 	}
-	if packageName, loaded := s.packageManager.PackageByID(socket.UID); loaded {
+	if packageName, loaded := s.packageManager.PackageByID(uid % 100000); loaded {
 		return &Info{
-			UserId:      int32(socket.UID),
+			UserId:      int32(uid),
 			PackageName: packageName,
 		}, nil
 	}
-	return &Info{UserId: int32(socket.UID)}, nil
+	return &Info{UserId: int32(uid)}, nil
 }

common/process/searcher_linux.go

@@ -20,16 +20,16 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *linuxSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	socket, err := resolveSocketByNetlink(network, source, destination)
+	inode, uid, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	processPath, err := resolveProcessNameByProcSearch(socket.INode, socket.UID)
+	processPath, err := resolveProcessNameByProcSearch(inode, uid)
 	if err != nil {
 		s.logger.DebugContext(ctx, "find process path: ", err)
 	}
 	return &Info{
-		UserId:      int32(socket.UID),
+		UserId:      int32(uid),
 		ProcessPath: processPath,
 	}, nil
 }

common/process/searcher_linux_shared.go

@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
+	"net"
 	"net/netip"
 	"os"
 	"path"
@@ -14,7 +15,9 @@ import (
 	"unicode"
 	"unsafe"
 
-	"github.com/sagernet/netlink"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/buf"
+	E "github.com/sagernet/sing/common/exceptions"
 	N "github.com/sagernet/sing/common/network"
 )
 
@@ -34,7 +37,7 @@ const (
 	pathProc                = "/proc"
 )
 
-func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (*netlink.Socket, error) {
+func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (inode, uid uint32, err error) {
 	var family uint8
 	var protocol uint8
 
@@ -44,28 +47,110 @@ func resolveSocketByNetlink(network string, source netip.AddrPort, destination n
 	case N.NetworkUDP:
 		protocol = syscall.IPPROTO_UDP
 	default:
-		return nil, os.ErrInvalid
+		return 0, 0, os.ErrInvalid
 	}
+
 	if source.Addr().Is4() {
 		family = syscall.AF_INET
 	} else {
 		family = syscall.AF_INET6
 	}
-	sockets, err := netlink.SocketGet(family, protocol, source, netip.AddrPortFrom(netip.IPv6Unspecified(), 0))
-	if err == nil {
-		sockets, err = netlink.SocketGet(family, protocol, source, destination)
-	}
+
+	req := packSocketDiagRequest(family, protocol, source)
+
+	socket, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_DGRAM, syscall.NETLINK_INET_DIAG)
 	if err != nil {
-		return nil, err
+		return 0, 0, E.Cause(err, "dial netlink")
 	}
-	if len(sockets) > 1 {
-		for _, socket := range sockets {
-			if socket.ID.DestinationPort == destination.Port() {
-				return socket, nil
-			}
-		}
+	defer syscall.Close(socket)
+
+	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_SNDTIMEO, &syscall.Timeval{Usec: 100})
+	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_RCVTIMEO, &syscall.Timeval{Usec: 100})
+
+	err = syscall.Connect(socket, &syscall.SockaddrNetlink{
+		Family: syscall.AF_NETLINK,
+		Pad:    0,
+		Pid:    0,
+		Groups: 0,
+	})
+	if err != nil {
+		return
 	}
-	return sockets[0], nil
+
+	_, err = syscall.Write(socket, req)
+	if err != nil {
+		return 0, 0, E.Cause(err, "write netlink request")
+	}
+
+	_buffer := buf.StackNew()
+	defer common.KeepAlive(_buffer)
+	buffer := common.Dup(_buffer)
+	defer buffer.Release()
+
+	n, err := syscall.Read(socket, buffer.FreeBytes())
+	if err != nil {
+		return 0, 0, E.Cause(err, "read netlink response")
+	}
+
+	buffer.Truncate(n)
+
+	messages, err := syscall.ParseNetlinkMessage(buffer.Bytes())
+	if err != nil {
+		return 0, 0, E.Cause(err, "parse netlink message")
+	} else if len(messages) == 0 {
+		return 0, 0, E.New("unexcepted netlink response")
+	}
+
+	message := messages[0]
+	if message.Header.Type&syscall.NLMSG_ERROR != 0 {
+		return 0, 0, E.New("netlink message: NLMSG_ERROR")
+	}
+
+	inode, uid = unpackSocketDiagResponse(&messages[0])
+	return
+}
+
+func packSocketDiagRequest(family, protocol byte, source netip.AddrPort) []byte {
+	s := make([]byte, 16)
+	copy(s, source.Addr().AsSlice())
+
+	buf := make([]byte, sizeOfSocketDiagRequest)
+
+	nativeEndian.PutUint32(buf[0:4], sizeOfSocketDiagRequest)
+	nativeEndian.PutUint16(buf[4:6], socketDiagByFamily)
+	nativeEndian.PutUint16(buf[6:8], syscall.NLM_F_REQUEST|syscall.NLM_F_DUMP)
+	nativeEndian.PutUint32(buf[8:12], 0)
+	nativeEndian.PutUint32(buf[12:16], 0)
+
+	buf[16] = family
+	buf[17] = protocol
+	buf[18] = 0
+	buf[19] = 0
+	nativeEndian.PutUint32(buf[20:24], 0xFFFFFFFF)
+
+	binary.BigEndian.PutUint16(buf[24:26], source.Port())
+	binary.BigEndian.PutUint16(buf[26:28], 0)
+
+	copy(buf[28:44], s)
+	copy(buf[44:60], net.IPv6zero)
+
+	nativeEndian.PutUint32(buf[60:64], 0)
+	nativeEndian.PutUint64(buf[64:72], 0xFFFFFFFFFFFFFFFF)
+
+	return buf
+}
+
+func unpackSocketDiagResponse(msg *syscall.NetlinkMessage) (inode, uid uint32) {
+	if len(msg.Data) < 72 {
+		return 0, 0
+	}
+
+	data := msg.Data
+
+	uid = nativeEndian.Uint32(data[64:68])
+	inode = nativeEndian.Uint32(data[68:72])
+
+	return
 }
 
 func resolveProcessNameByProcSearch(inode, uid uint32) (string, error) {

common/redir/redir_darwin.go

@@ -0,0 +1,64 @@
+package redir
+
+import (
+	"net"
+	"net/netip"
+	"syscall"
+	"unsafe"
+
+	M "github.com/sagernet/sing/common/metadata"
+)
+
+const (
+	PF_OUT      = 0x2
+	DIOCNATLOOK = 0xc0544417
+)
+
+func GetOriginalDestination(conn net.Conn) (destination netip.AddrPort, err error) {
+	fd, err := syscall.Open("/dev/pf", 0, syscall.O_RDONLY)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	defer syscall.Close(fd)
+	nl := struct {
+		saddr, daddr, rsaddr, rdaddr       [16]byte
+		sxport, dxport, rsxport, rdxport   [4]byte
+		af, proto, protoVariant, direction uint8
+	}{
+		af:        syscall.AF_INET,
+		proto:     syscall.IPPROTO_TCP,
+		direction: PF_OUT,
+	}
+	la := conn.LocalAddr().(*net.TCPAddr)
+	ra := conn.RemoteAddr().(*net.TCPAddr)
+	raIP, laIP := ra.IP, la.IP
+	raPort, laPort := ra.Port, la.Port
+	switch {
+	case raIP.To4() != nil:
+		copy(nl.saddr[:net.IPv4len], raIP.To4())
+		copy(nl.daddr[:net.IPv4len], laIP.To4())
+		nl.af = syscall.AF_INET
+	default:
+		copy(nl.saddr[:], raIP.To16())
+		copy(nl.daddr[:], laIP.To16())
+		nl.af = syscall.AF_INET6
+	}
+	nl.sxport[0], nl.sxport[1] = byte(raPort>>8), byte(raPort)
+	nl.dxport[0], nl.dxport[1] = byte(laPort>>8), byte(laPort)
+	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), DIOCNATLOOK, uintptr(unsafe.Pointer(&nl))); errno != 0 {
+		return netip.AddrPort{}, errno
+	}
+
+	var ip net.IP
+	switch nl.af {
+	case syscall.AF_INET:
+		ip = make(net.IP, net.IPv4len)
+		copy(ip, nl.rdaddr[:net.IPv4len])
+	case syscall.AF_INET6:
+		ip = make(net.IP, net.IPv6len)
+		copy(ip, nl.rdaddr[:])
+	}
+	port := uint16(nl.rdxport[0])<<8 | uint16(nl.rdxport[1])
+	destination = netip.AddrPortFrom(M.AddrFromIP(ip), port)
+	return
+}

common/redir/redir_other.go

@@ -1,4 +1,4 @@
-//go:build !linux
+//go:build !linux && !darwin
 
 package redir
 

common/settings/proxy_darwin.go

@@ -1,6 +1,7 @@
 package settings
 
 import (
+	"net/netip"
 	"strings"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -20,7 +21,7 @@ type systemProxy struct {
 }
 
 func (p *systemProxy) update() error {
-	newInterfaceName := p.monitor.DefaultInterfaceName()
+	newInterfaceName := p.monitor.DefaultInterfaceName(netip.IPv4Unspecified())
 	if p.interfaceName == newInterfaceName {
 		return nil
 	}

common/sniff/dns.go

@@ -22,7 +22,7 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 	if err != nil {
 		return nil, err
 	}
-	if length > 512 {
+	if length == 0 {
 		return nil, os.ErrInvalid
 	}
 	_buffer := buf.StackNewSize(int(length))

constant/proxy.go

@@ -18,6 +18,7 @@ const (
 	TypeHysteria    = "hysteria"
 	TypeTor         = "tor"
 	TypeSSH         = "ssh"
+	TypeShadowTLS   = "shadowtls"
 )
 
 const (

constant/version.go

@@ -1,6 +1,6 @@
 package constant
 
 var (
-	Version = "1.0"
+	Version = "1.0-beta3"
 	Commit  = ""
 )

docs/changelog.md

@@ -1,4 +1,42 @@
-#### 2022/08/24
+#### 1.0-beta3
+
+* Add [chained inbound](/configuration/shared/listen#detour) support
+* Add process_path rule item
+* Add macOS redirect support
+* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls) and [Examples](/examples/shadowtls)
+* Fix search android package in non-owner users
+* Fix socksaddr type condition
+* Fix smux session status
+* Refactor inbound and outbound documentation
+* Minor fixes
+
+#### 1.0-beta2
+
+* Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
+* Add packetaddr support for [VMess outbound](/configuration/outbound/vmess#packet_addr)
+* Add better performing alternative gRPC implementation
+* Add [docker image](https://github.com/SagerNet/sing-box/pkgs/container/sing-box)
+* Fix sniff override destination
+
+#### 1.0-beta1
+
+* Initial release
+
+##### 2022/08/26
+
+* Fix ipv6 route on linux
+* Fix read DNS message
+
+##### 2022/08/25
+
+* Let vmess use zero instead of auto if TLS enabled
+* Add trojan fallback for ALPN
+* Improve ip_cidr rule
+* Fix format bind_address
+* Fix http proxy with compressed response
+* Fix route connections
+
+##### 2022/08/24
 
 * Fix naive padding
 * Fix unix search path
@@ -7,7 +45,7 @@
 * Fix early close on windows and catch any
 * Initial zh-CN document translation
 
-#### 2022/08/23
+##### 2022/08/23
 
 * Add [V2Ray Transport](/configuration/shared/v2ray-transport) support for VMess and Trojan
 * Allow plain http request in Naive inbound (It can now be used with nginx)
@@ -16,17 +54,17 @@
 * Parse X-Forward-For in HTTP requests
 * Handle SIGHUP signal
 
-#### 2022/08/22
+##### 2022/08/22
 
 * Add strategy setting for each [DNS server](/configuration/dns/server)
 * Add bind address to outbound options
 
-#### 2022/08/21
+##### 2022/08/21
 
 * Add [Tor outbound](/configuration/outbound/tor)
 * Add [SSH outbound](/configuration/outbound/ssh)
 
-#### 2022/08/20
+##### 2022/08/20
 
 * Attempt to unwrap ip-in-fqdn socksaddr
 * Fix read packages in android 12
@@ -36,53 +74,53 @@
 * Skip bind connection with private destination to interface
 * Add [Trojan connection fallback](/configuration/inbound/trojan#fallback)
 
-#### 2022/08/19
+##### 2022/08/19
 
 * Add Hysteria [Inbound](/configuration/inbound/hysteria) and [Outbund](/configuration/outbound/hysteria)
 * Add [ACME TLS certificate issuer](/configuration/shared/tls)
 * Allow read config from stdin (-c stdin)
 * Update gVisor to 20220815.0
 
-#### 2022/08/18
+##### 2022/08/18
 
 * Fix find process with lwip stack
 * Fix crash on shadowsocks server
 * Fix crash on darwin tun
 * Fix write log to file
 
-#### 2022/08/17
+##### 2022/08/17
 
 * Improve async dns transports
 
-#### 2022/08/16
+##### 2022/08/16
 
 * Add ip_version (route/dns) rule item
 * Add [WireGuard](/configuration/outbound/wireguard) outbound
 
-#### 2022/08/15
+##### 2022/08/15
 
 * Add uid, android user and package rules support in [Tun](/configuration/inbound/tun) routing.
 
-#### 2022/08/13
+##### 2022/08/13
 
 * Fix dns concurrent write
 
-#### 2022/08/12
+##### 2022/08/12
 
 * Performance improvements
 * Add UoT option for [SOCKS](/configuration/outbound/socks) outbound
 
-#### 2022/08/11
+##### 2022/08/11
 
 * Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks) outbound, UoT support for all inbounds
 
-#### 2022/08/10
+##### 2022/08/10
 
 * Add full-featured [Naive](/configuration/inbound/naive) inbound
 * Fix default dns server option [#9] by iKirby
 
-#### 2022/08/09
+##### 2022/08/09
 
 No changelog before.
 
-[#9]: https://github.com/SagerNet/sing-box/pull/9
+[#9]: https://github.com/SagerNet/sing-box/pull/9

docs/configuration/dns/index.md

@@ -1,3 +1,5 @@
+# DNS
+
 ### Structure
 
 ```json

docs/configuration/dns/rule.md

@@ -38,7 +38,8 @@
           "private"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "source_port": [
           12345
@@ -60,6 +61,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -176,6 +180,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/dns/rule.zh.md

@@ -60,6 +60,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -176,6 +179,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/dns/server.zh.md

@@ -47,7 +47,7 @@ DNS 服务器的地址。
 
 !!! warning ""
 
-    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#installation)。
+    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#_2)。
 
 !!! info ""
 

docs/configuration/experimental/index.md

@@ -1,3 +1,5 @@
+# Experimental
+
 ### Structure
 
 ```json

docs/configuration/experimental/index.zh.md

@@ -18,7 +18,7 @@
 
 !!! error ""
 
-    默认安装不包含 Clash API，参阅 [安装](/zh/#installation)。
+    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
 
 !!! note ""
 

docs/configuration/inbound/direct.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "proxy_protocol": false,
+  "type": "direct",
+  "tag": "direct-in",
+  
+  ... // Listen Fields
 
-      "network": "udp",
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -40,50 +33,4 @@ Override the connection destination address.
 
 #### override_port
 
-Override the connection destination port.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+Override the connection destination port.

docs/configuration/inbound/direct.zh.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
+  "type": "direct",
+  "tag": "direct-in",
 
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp",
-      "proxy_protocol": false,
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  ... // 监听字段
+
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -42,48 +35,3 @@
 
 覆盖连接目标端口。
 
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/http.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+  
+  ... // Listen Fields
+  
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### tls
 
@@ -47,45 +41,3 @@ No authentication required if empty.
     Only supported on Linux, Android, Windows, and macOS.
 
 Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/http.zh.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### tls
 
@@ -38,7 +32,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -46,46 +40,4 @@ HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/hysteria.md

@@ -2,31 +2,23 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // Listen Fields
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
@@ -34,7 +26,11 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### up, down
 
@@ -101,38 +97,4 @@ Force enabled on for systems other than Linux and Windows (according to upstream
 
 ==Required==
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/hysteria.zh.md

@@ -2,39 +2,35 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // 监听字段
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### up, down
 
@@ -101,38 +97,4 @@ base64 编码的认证密码。
 
 ==必填==
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/index.md

@@ -1,3 +1,5 @@
+# Inbound
+
 ### Structure
 
 ```json
@@ -13,20 +15,20 @@
 
 ### Fields
 
-| Type          | Format                       |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| Type          | Format                       | Injectable |
+|---------------|------------------------------|------------|
+| `direct`      | [Direct](./direct)           | X          |
+| `mixed`       | [Mixed](./mixed)             | TCP        |
+| `socks`       | [SOCKS](./socks)             | TCP        |
+| `http`        | [HTTP](./http)               | TCP        |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
+| `vmess`       | [VMess](./vmess)             | TCP        |
+| `trojan`      | [Trojan](./trojan)           | TCP        |
+| `naive`       | [Naive](./naive)             | X          |
+| `hysteria`    | [Hysteria](./hysteria)       | X          |
+| `tun`         | [Tun](./tun)                 | X          |
+| `redirect`    | [Redirect](./redirect)       | X          |
+| `tproxy`      | [TProxy](./tproxy)           | X          |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -15,20 +15,20 @@
 
 ### 字段
 
-| 类型            | 格式                           |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| 类型            | 格式                           | 注入支持 |
+|---------------|------------------------------|------|
+| `direct`      | [Direct](./direct)           | X    |
+| `mixed`       | [Mixed](./mixed)             | TCP  |
+| `socks`       | [SOCKS](./socks)             | TCP  |
+| `http`        | [HTTP](./http)               | TCP  |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
+| `vmess`       | [VMess](./vmess)             | TCP  |
+| `trojan`      | [Trojan](./trojan)           | TCP  |
+| `naive`       | [Naive](./naive)             | X    |
+| `hysteria`    | [Hysteria](./hysteria)       | X    |
+| `tun`         | [Tun](./tun)                 | X    |
+| `redirect`    | [Redirect](./redirect)       | X    |
+| `tproxy`      | [TProxy](./tproxy)           | X    |
 
 #### tag
 

docs/configuration/inbound/mixed.md

@@ -4,32 +4,26 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -39,52 +33,6 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! error ""
-
-    Only supported on Linux, Android, Windows, and macOS.
-
-Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### set_system_proxy
-
 !!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.

docs/configuration/inbound/mixed.zh.md

@@ -4,38 +4,32 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 和 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -43,46 +37,4 @@ SOCKS 和 HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/naive.md

@@ -2,29 +2,19 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
@@ -32,7 +22,11 @@
 
     HTTP3 transport is not included by default, see [Installation](/#installation).
 
-### Naive Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -48,46 +42,4 @@ Naive users.
 
 #### tls
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/naive.zh.md

@@ -2,37 +2,31 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
 
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#installation)。
+    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
 
-### Naive 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -48,46 +42,4 @@ Naive 用户。
 
 #### tls
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/redirect.md

@@ -1,52 +1,18 @@
+!!! error ""
+
+    Only supported on Linux and macOS.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // Listen Fields
 }
 ```
 
 ### Listen Fields
 
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/redirect.zh.md

@@ -1,52 +1,17 @@
+!!! error ""
+
+    仅支持 Linux 和 macOS。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // 监听字段
 }
 ```
-
 ### 监听字段
 
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/shadowsocks.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // Listen Fields
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 

docs/configuration/inbound/shadowsocks.zh.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // 监听字段
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks 字段
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### 字段
 
 #### network
 
@@ -98,50 +81,4 @@
 |---------------|-------------------------------|
 | none          | /                             |
 | 2022 methods  | `openssl rand -base64 <密钥长度>` |
-| other methods | 任意字符串                         |
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+| other methods | 任意字符串                         |

docs/configuration/inbound/shadowtls.md

@@ -0,0 +1,31 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // Listen Fields
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+    
+    ... // Dial Fields
+  }
+}
+```
+
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+
+### Fields
+
+#### handshake
+
+==Required==
+
+Handshake server address and [dial options](/configuration/shared/dial).
+

docs/configuration/inbound/shadowtls.zh.md

@@ -0,0 +1,29 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // 监听字段
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+
+    ... // 拨号字段
+  }
+}
+```
+
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
+
+#### handshake
+
+==必填==
+
+握手服务器地址和 [拨号参数](/zh/configuration/shared/dial/)。

docs/configuration/inbound/socks.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // Listen Fields
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
 SOCKS users.
 
 No authentication required if empty.
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址
-
-#### listen_port
-
-==必填==
-
-监听端口
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/socks.zh.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 用户
 
-默认不需要验证。
-
-### Listen Fields
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+如果为空则不需要验证。

docs/configuration/inbound/tproxy.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    Only supported on Linux.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // Listen Fields
+
+  "network": "udp"
 }
 ```
 
-### TProxy Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
 Listen network, one of `tcp` `udp`.
 
 Both if empty.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).

docs/configuration/inbound/tproxy.zh.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    仅支持 Linux。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // 监听字段
+
+  "network": "udp"
 }
 ```
 
-### TProxy 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
 监听的网络协议，`tcp` `udp` 之一。
 
 默认所有。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

docs/configuration/inbound/trojan.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "trojan",
+  "tag": "trojan-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.0.1",
-        "server_port": 8080
-      },
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -50,50 +50,14 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 
-Fallback server configuration. Disabled if empty.
+Fallback server configuration. Disabled if `fallback` and `fallback_for_alpn` are empty.
+
+#### fallback_for_alpn
+
+Fallback server configuration for specified ALPN.
+
+If not empty, TLS fallback requests with ALPN not in this table will be rejected.
 
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/trojan.zh.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "trojan",
+  "tag": "trojan-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.0.1",
-        "server_port": 8080
-      },
-      "transport": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -50,52 +50,16 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 !!! error ""
 
-    没有证据表明 GFW 基于 HTTP 响应检测并阻止木马服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
+    没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 
-备用服务器配置。默认禁用。
+回退服务器配置。如果 `fallback` 和 `fallback_for_alpn` 为空，则禁用回退。
+
+#### fallback_for_alpn
+
+为 ALPN 指定回退服务器配置。
+
+如果不为空，ALPN 不在此列表中的 TLS 回退请求将被拒绝。
 
 #### transport
 
-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

docs/configuration/inbound/tun.md

@@ -6,47 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+  
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // Listen Fields
 }
 ```
 
@@ -58,7 +52,7 @@
 
     If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
 
-### Tun Fields
+### Fields
 
 #### interface_name
 
@@ -86,6 +80,16 @@ Set the default route to the Tun.
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
+#### strict_route
+
+Enforce strict routing rules in Linux when `auto_route` is enabled:
+
+* Let unsupported network unreachable
+* Route all connections to tun
+
+It prevents address leaks and makes DNS hijacking work on Android and Linux with systemd-resolved, but your device will
+not be accessible by others.
+
 #### endpoint_independent_nat
 
 Enable endpoint-independent NAT.
@@ -152,22 +156,4 @@ Exclude android packages in route.
 
 ### Listen Fields
 
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/tun.zh.md

@@ -6,47 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // 监听字段
 }
 ```
 
@@ -86,6 +80,15 @@ tun 接口的 IPv6 前缀。
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
+#### strict_route
+
+在 Linux 中启用 `auto_route` 时执行严格的路由规则。
+
+* 让不支持的网络无法到达
+* 将所有连接路由到 tun
+
+它可以防止地址泄漏，并使 DNS 劫持在 Android 和使用 systemd-resolved 的 Linux 上工作，但你的设备将无法其他设备被访问。
+
 #### endpoint_independent_nat
 
 启用独立于端点的 NAT。
@@ -107,7 +110,7 @@ TCP/IP 栈。
 
 !!! warning ""
 
-    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#installation)。
+    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#_2)。
 
 #### include_uid
 
@@ -152,22 +155,4 @@ TCP/IP 栈。
 
 ### 监听字段
 
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/vmess.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -53,45 +47,3 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/vmess.zh.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -53,45 +47,3 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 #### transport
 
 V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/index.md

@@ -8,8 +8,8 @@ sing-box uses JSON for configuration files.
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/index.zh.md

@@ -8,8 +8,8 @@ sing-box 使用 JSON 作为配置文件格式。
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/log/index.md

@@ -1,3 +1,5 @@
+# Log
+
 ### Structure
 
 ```json

docs/configuration/log/index.zh.md

@@ -1,3 +1,5 @@
+# 日志
+
 ### 结构
 
 ```json

docs/configuration/outbound/block.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/block.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/direct.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+  
+  ... // Dial Fields
 }
 ```
 
-### Direct Fields
+### Fields
 
 #### override_address
 
@@ -45,54 +33,4 @@ Protocol value can be `1` or `2`.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before connect.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/direct.zh.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+
+  ... // 拨号字段
 }
 ```
 
-### Direct 字段
+### 字段
 
 #### override_address
 
@@ -45,51 +33,4 @@
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，域名将在请求发出之前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/dns.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/dns.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/http.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
-### HTTP Fields
+### Fields
 
 #### server
 
@@ -57,54 +45,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/http.zh.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+
+  ... // 拨号字段
 }
 ```
 
-### HTTP 字段
+### 字段
 
 #### server
 
@@ -57,51 +45,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/hysteria.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
@@ -40,7 +28,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Fields
 
 #### server
 
@@ -125,54 +113,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/hysteria.zh.md

@@ -2,45 +2,33 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // 拨号字段
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 字段
 
 #### server
 
@@ -123,51 +111,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/index.md

@@ -1,3 +1,5 @@
+# Outbound
+
 ### Structure
 
 ```json

docs/configuration/outbound/selector.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+  
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/selector.zh.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/shadowsocks.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Shadowsocks Fields
+### Fields
 
 #### server
 
@@ -97,54 +85,4 @@ Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowsocks.zh.md

@@ -1,35 +1,23 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // 拨号字段
 }
 ```
 
-### Shadowsocks 字段
+### 字段
 
 #### server
 
@@ -97,51 +85,4 @@ Shadowsocks 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/shadowtls.md

@@ -0,0 +1,38 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // Dial Fields
+}
+```
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### tls
+
+==Required==
+
+TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowtls.zh.md

@@ -0,0 +1,38 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // 拨号字段
+}
+```
+
+### 字段
+
+#### server
+
+==必填==
+
+服务器地址。
+
+#### server_port
+
+==必填==
+
+服务器端口。
+
+#### tls
+
+==必填==
+
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
+
+### 拨号字段
+
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/socks.md

@@ -4,34 +4,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### SOCKS Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Enable the UDP over TCP protocol.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/socks.zh.md

@@ -1,37 +1,25 @@
 `socks` 出站是 socks4/socks4a/socks5 客户端
 
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### SOCKS 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SOCKS5 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/ssh.md

@@ -2,36 +2,24 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // Dial Fields
 }
 ```
 
-### SSH Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Client version. Random version will be used if empty.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/ssh.zh.md

@@ -1,37 +1,25 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // 拨号字段
 }
 ```
 
-### SSH 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SSH 用户, 默认使用 root。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/tor.md

@@ -2,29 +2,17 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+  
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // Dial Fields
 }
 ```
 
@@ -32,7 +20,7 @@
 
     Embedded tor is not included by default, see [Installation](/#installation).
 
-### Tor Fields
+### Fields
 
 #### executable_path
 
@@ -56,58 +44,8 @@ Each start will be very slow if not specified.
 
 Map of torrc options.
 
-See [tor(1)](https://linux.die.net/man/1/tor)
+See [tor(1)](https://linux.die.net/man/1/tor) for details.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/tor.zh.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // 拨号字段
 }
 ```
 
 !!! info ""
 
-    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#installation)。
+    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#_2)。
 
-### Tor 字段
+### 字段
 
 #### executable_path
 
@@ -60,51 +48,4 @@ torrc 参数表。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/trojan.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Trojan Fields
+### Fields
 
 #### server
 
@@ -71,54 +59,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/trojan.zh.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### Trojan 字段
+### 字段
 
 #### server
 
@@ -71,51 +59,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/vmess.md

@@ -2,38 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "vmess",
+  "tag": "vmess-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### VMess Fields
+### Fields
 
 #### server
 
@@ -95,6 +84,10 @@ Both is enabled by default.
 
 TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
+#### packet_addr
+
+Enable packetaddr support.
+
 #### multiplex
 
 Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
@@ -105,54 +98,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/vmess.zh.md

@@ -2,36 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "vmess",
+  "tag": "vmess-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
+
+  ... // 拨号字段
 }
 ```
 
-### VMess 字段
+### 字段
 
 #### server
 
@@ -93,6 +84,10 @@ VMess 用户 ID。
 
 TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
+#### packet_addr
+
+启用 packetaddr 支持。
+
 #### multiplex
 
 多路复用配置, 参阅 [多路复用](/zh/configuration/shared/multiplex)。
@@ -103,51 +98,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/wireguard.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // Dial Fields
 }
 ```
 
@@ -37,7 +25,7 @@
 
     WireGuard is not included by default, see [Installation](/#installation).
 
-### WireGuard Fields
+### Fields
 
 #### server
 
@@ -92,54 +80,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/wireguard.zh.md

@@ -2,42 +2,30 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // 拨号字段
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 WireGuard, 参阅 [安装](/zh/#installation)。
+    默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
 
-### WireGuard 字段
+### 字段
 
 #### server
 
@@ -94,51 +82,4 @@ WireGuard MTU。 默认1408。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/route/index.md

@@ -1,3 +1,5 @@
+# Route
+
 ### Structure
 
 ```json

docs/configuration/route/rule.md

@@ -41,10 +41,12 @@
           "cn"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "source_port": [
           12345
@@ -66,6 +68,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -186,6 +191,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/route/rule.zh.md

@@ -66,6 +66,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -186,6 +189,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/shared/dial.md

@@ -0,0 +1,69 @@
+### Structure
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### Fields
+
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before connect.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/shared/dial.zh.md

@@ -0,0 +1,66 @@
+### 结构
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### 字段
+
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，域名将在请求发出之前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/shared/listen.md

@@ -0,0 +1,73 @@
+### Structure
+
+```json
+{
+  "listen": "::",
+  "listen_port": 5353,
+  "tcp_fast_open": false,
+  "sniff": false,
+  "sniff_override_destination": false,
+  "domain_strategy": "prefer_ipv6",
+  "udp_timeout": 300,
+  "proxy_protocol": false,
+  "detour": "another-in"
+}
+```
+
+### Fields
+
+| Field            | Available Context                                                 |
+|------------------|-------------------------------------------------------------------|
+| `listen`         | Needs to listen on TCP or UDP.                                    |
+| `listen_port`    | Needs to listen on TCP or UDP.                                    |
+| `tcp_fast_open`  | Needs to listen on TCP.                                           |
+| `udp_timeout`    | Needs to assemble UDP connections, currently Tun and Shadowsocks. |
+| `proxy_protocol` | Needs to listen on TCP.                                           |
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+
+#### detour
+
+If set, connections will be forwarded to the specified inbound.
+
+Requires target inbound support, see [Injectable](/configuration/inbound/#fields).

docs/configuration/shared/listen.zh.md

@@ -0,0 +1,72 @@
+### 结构
+
+```json
+{
+  "listen": "::",
+  "listen_port": 5353,
+  "tcp_fast_open": false,
+  "sniff": false,
+  "sniff_override_destination": false,
+  "domain_strategy": "prefer_ipv6",
+  "udp_timeout": 300,
+  "detour": "another-in"
+}
+```
+
+| 字段               | 可用上下文                               |
+|------------------|-------------------------------------|
+| `listen`         | 需要监听 TCP 或 UDP。                     |
+| `listen_port`    | 需要监听 TCP 或 UDP。                     |
+| `tcp_fast_open`  | 需要监听 TCP。                           |
+| `udp_timeout`    | 需要组装 UDP 连接, 当前为 Tun 和 Shadowsocks。 |
+| `proxy_protocol` | 需要监听 TCP。                           |
+
+### 字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+
+#### detour
+
+如果设置，连接将被转发到指定的入站。
+
+需要目标入站支持，参阅 [注入支持](/zh/configuration/inbound/#_3)。

docs/configuration/shared/tls.md

@@ -39,6 +39,7 @@
 ```json
 {
   "enabled": true,
+  "disable_sni": false,
   "server_name": "",
   "insecure": false,
   "alpn": [],
@@ -87,14 +88,18 @@ Cipher suite values:
 
 Enable TLS.
 
+#### disable_sni
+
+==Client only==
+
+Do not send server name in ClientHello.
+
 #### server_name
 
 Used to verify the hostname on the returned certificates unless insecure is given.
 
 It is also included in the client's handshake to support virtual hosting unless it is an IP address.
 
-See [Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication).
-
 #### insecure
 
 ==Client only==