Bump version

* Add shadowtls outbound

* Add shadowtls inbound

* Add shadowtls example

* Add shadowtls documentation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,5 @@
 name: Bug Report
 description: "Create a report to help us improve."
-labels: [ bug ]
 body:
   - type: checkboxes
     id: terms
@@ -32,7 +31,7 @@ body:
         <details>
 
         ```console
-        $ sing-box --version
+        $ sing-box version
         # Paste output here
         ```
 
@@ -56,7 +55,7 @@ body:
       required: true
 
   - type: textarea
-    id: config
+    id: log
     attributes:
       label: Server and client log file
       value: |-

.github/update_dependencies.sh

@@ -1,10 +1,5 @@
 #!/usr/bin/env bash
 
 PROJECTS=$(dirname "$0")/../..
-
-go get -x github.com/sagernet/sing@$(git -C $PROJECTS/sing rev-parse HEAD)
-go get -x github.com/sagernet/sing-dns@$(git -C $PROJECTS/sing-dns rev-parse HEAD)
-go get -x github.com/sagernet/sing-tun@$(git -C $PROJECTS/sing-tun rev-parse HEAD)
-go get -x github.com/sagernet/sing-shadowsocks@$(git -C $PROJECTS/sing-shadowsocks rev-parse HEAD)
-go get -x github.com/sagernet/sing-vmess@$(git -C $PROJECTS/sing-vmess rev-parse HEAD)
+go get -x github.com/sagernet/$1@$(git -C $PROJECTS/$1 rev-parse HEAD)
 go mod tidy

.github/workflows/debug.yml

@@ -3,14 +3,18 @@ name: Debug build
 on:
   push:
     branches:
+      - main
       - dev
+      - dev-next
     paths-ignore:
       - '**.md'
       - '.github/**'
       - '!.github/workflows/debug.yml'
   pull_request:
     branches:
+      - main
       - dev
+      - dev-next
 
 jobs:
   build:

.github/workflows/docker.yml

@@ -0,0 +1,43 @@
+name: Build Docker Images
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag version you want to build"
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@v3
+        with:
+          images: ghcr.io/sagernet/sing-box
+      - name: Get tag to build
+        id: tag
+        run: |
+          if [[ -z "${{ github.event.inputs.tag }}" ]]; then
+            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.ref_name }}
+          else
+            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.event.inputs.tag }}
+          fi
+      - name: Build and release Docker images
+        uses: docker/build-push-action@v2
+        with:
+          platforms: linux/386,linux/amd64
+          target: dist
+          tags: ${{ steps.tag.outputs.tag }}
+          push: true

.goreleaser.yaml

@@ -13,11 +13,13 @@ builds:
     tags:
       - with_quic
       - with_wireguard
-      - with_acme
       - with_clash_api
     env:
       - CGO_ENABLED=0
     targets:
+      - android_arm64
+      - android_amd64
+      - android_amd64_v3
       - linux_amd64_v1
       - linux_amd64_v3
       - linux_arm64

Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.19-alpine AS builder
+LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
+COPY . /go/src/github.com/sagernet/sing-box
+WORKDIR /go/src/github.com/sagernet/sing-box
+ARG GOPROXY=""
+ENV GOPROXY ${GOPROXY}
+ENV CGO_ENABLED=0
+RUN set -ex \
+    && apk add git build-base \
+    && export COMMIT=$(git rev-parse --short HEAD) \
+    && go build -v -trimpath -tags 'no_gvisor,with_quic,with_wireguard,with_acme' \
+        -o /go/bin/sing-box \
+        -ldflags "-X github.com/sagernet/sing-box/constant.Commit=${COMMIT} -w -s -buildid=" \
+        ./cmd/sing-box
+FROM alpine AS dist
+LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+RUN set -ex \
+    && apk upgrade \
+    && apk add bash tzdata ca-certificates \
+    && rm -rf /var/cache/apk/*
+COPY --from=builder /go/bin/sing-box /usr/local/bin/sing-box
+ENTRYPOINT ["sing-box"]

Makefile

@@ -49,7 +49,14 @@ snapshot:
 	ghr --delete --draft --prerelease -p 1 nightly dist/release
 	rm -r dist
 
-snapshot_install:
+release:
+	goreleaser release --rm-dist --skip-publish
+	mkdir dist/release
+	mv dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/release
+	ghr --delete --draft --prerelease -p 3 $(shell git describe --tags) dist/release
+	rm -r dist
+
+release_install:
 	go install -v github.com/goreleaser/goreleaser@latest
 	go install -v github.com/tcnksm/ghr@latest
 

adapter/inbound.go

@@ -2,11 +2,13 @@ package adapter
 
 import (
 	"context"
+	"net"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/process"
 	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
 )
 
 type Inbound interface {
@@ -15,6 +17,13 @@ type Inbound interface {
 	Tag() string
 }
 
+type InjectableInbound interface {
+	Inbound
+	Network() []string
+	NewConnection(ctx context.Context, conn net.Conn, metadata InboundContext) error
+	NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext) error
+}
+
 type InboundContext struct {
 	Inbound     string
 	InboundType string
@@ -29,6 +38,8 @@ type InboundContext struct {
 
 	// cache
 
+	InboundDetour            string
+	LastInbound              string
 	OriginDestination        M.Socksaddr
 	DomainStrategy           dns.DomainStrategy
 	SniffEnabled             bool

box.go

@@ -138,7 +138,7 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		}
 		outbounds = append(outbounds, out)
 	}
-	err = router.Initialize(outbounds, func() adapter.Outbound {
+	err = router.Initialize(inbounds, outbounds, func() adapter.Outbound {
 		out, oErr := outbound.New(ctx, router, logFactory.NewLogger("outbound/direct"), option.Outbound{Type: "direct", Tag: "default"})
 		common.Must(oErr)
 		outbounds = append(outbounds, out)

cmd/sing-box/cmd_format.go

@@ -38,7 +38,7 @@ func format() error {
 		return E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = json.Unmarshal(configContent, &options)
+	err = options.UnmarshalJSON(configContent)
 	if err != nil {
 		return E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_run.go

@@ -9,7 +9,6 @@ import (
 	"syscall"
 
 	"github.com/sagernet/sing-box"
-	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -46,7 +45,7 @@ func readConfig() (option.Options, error) {
 		return option.Options{}, E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = json.Unmarshal(configContent, &options)
+	err = options.UnmarshalJSON(configContent)
 	if err != nil {
 		return option.Options{}, E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_version.go

@@ -38,7 +38,7 @@ func printVersion(cmd *cobra.Command, args []string) {
 		version += runtime.Version()
 		version += ", "
 		version += runtime.GOOS
-		version += ", "
+		version += "/"
 		version += runtime.GOARCH
 		version += ", "
 		version += "CGO "

common/baderror/baderror.go

@@ -0,0 +1,62 @@
+package baderror
+
+import (
+	"context"
+	"io"
+	"net"
+	"strings"
+
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func Contains(err error, msgList ...string) bool {
+	for _, msg := range msgList {
+		if strings.Contains(err.Error(), msg) {
+			return true
+		}
+	}
+	return false
+}
+
+func WrapH2(err error) error {
+	if err == nil {
+		return nil
+	}
+	err = E.Unwrap(err)
+	if err == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	if Contains(err, "client disconnected", "body closed by handler") {
+		return net.ErrClosed
+	}
+	return err
+}
+
+func WrapGRPC(err error) error {
+	// grpc uses stupid internal error types
+	if err == nil {
+		return nil
+	}
+	if Contains(err, "EOF") {
+		return io.EOF
+	}
+	if Contains(err, "Canceled") {
+		return context.Canceled
+	}
+	if Contains(err,
+		"the client connection is closing",
+		"server closed the stream without sending trailers") {
+		return net.ErrClosed
+	}
+	return err
+}
+
+func WrapQUIC(err error) error {
+	if err == nil {
+		return nil
+	}
+	if Contains(err, "canceled with error code 0") {
+		return net.ErrClosed
+	}
+	return err
+}

common/dialer/bind.go

@@ -1,19 +0,0 @@
-package dialer
-
-import (
-	"syscall"
-
-	"github.com/sagernet/sing/common/control"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func skipIfPrivate(next control.Func) control.Func {
-	return func(network, address string, conn syscall.RawConn) error {
-		destination := M.ParseSocksaddr(address)
-		if !N.IsPublicAddr(destination.Addr) {
-			return nil
-		}
-		return next(network, address, conn)
-	}
-}

common/dialer/default.go

@@ -11,6 +11,7 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common/control"
+	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
@@ -64,25 +65,25 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	var listener net.ListenConfig
 	if options.BindInterface != "" {
 		warnBindInterfaceOnUnsupportedPlatform.Check()
-		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), options.BindInterface))
+		bindFunc := control.BindToInterface(router.InterfaceBindManager(), options.BindInterface)
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.AutoDetectInterface() {
 		if C.IsWindows {
-			bindFunc := skipIfPrivate(control.BindToInterfaceIndexFunc(func() int {
-				return router.InterfaceMonitor().DefaultInterfaceIndex()
-			}))
+			bindFunc := control.BindToInterfaceIndexFunc(func(network, address string) int {
+				return router.InterfaceMonitor().DefaultInterfaceIndex(M.ParseSocksaddr(address).Addr)
+			})
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		} else {
-			bindFunc := skipIfPrivate(control.BindToInterfaceFunc(router.InterfaceBindManager(), func() string {
-				return router.InterfaceMonitor().DefaultInterfaceName()
-			}))
+			bindFunc := control.BindToInterfaceFunc(router.InterfaceBindManager(), func(network, address string) string {
+				return router.InterfaceMonitor().DefaultInterfaceName(M.ParseSocksaddr(address).Addr)
+			})
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		}
 	} else if router.DefaultInterface() != "" {
-		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface()))
+		bindFunc := control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface())
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	}
@@ -113,7 +114,10 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	}
 	var bindUDPAddr string
 	udpDialer := dialer
-	bindAddress := netip.Addr(options.BindAddress)
+	var bindAddress netip.Addr
+	if options.BindAddress != nil {
+		bindAddress = options.BindAddress.Build()
+	}
 	if bindAddress.IsValid() {
 		dialer.LocalAddr = &net.TCPAddr{
 			IP: bindAddress.AsSlice(),
@@ -127,6 +131,9 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 }
 
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
+	if !address.IsValid() {
+		return nil, E.New("invalid address")
+	}
 	switch N.NetworkName(network) {
 	case N.NetworkUDP:
 		return d.udpDialer.DialContext(ctx, network, address.String())

common/dialer/dialer.go

@@ -10,15 +10,12 @@ import (
 )
 
 func New(router adapter.Router, options option.DialerOptions) N.Dialer {
+	var dialer N.Dialer
 	if options.Detour == "" {
-		return NewDefault(router, options)
+		dialer = NewDefault(router, options)
 	} else {
-		return NewDetour(router, options.Detour)
+		dialer = NewDetour(router, options.Detour)
 	}
-}
-
-func NewOutbound(router adapter.Router, options option.OutboundDialerOptions) N.Dialer {
-	dialer := New(router, options.DialerOptions)
 	domainStrategy := dns.DomainStrategy(options.DomainStrategy)
 	if domainStrategy != dns.DomainStrategyAsIS || options.Detour == "" {
 		dialer = NewResolveDialer(router, dialer, domainStrategy, time.Duration(options.FallbackDelay))

common/dialer/resolve.go

@@ -51,7 +51,7 @@ func (d *ResolveDialer) DialContext(ctx context.Context, network string, destina
 }
 
 func (d *ResolveDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsFqdn() || destination.Fqdn == "" {
+	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx, metadata := adapter.AppendContext(ctx)

common/process/searcher_android.go

@@ -18,21 +18,21 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *androidSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	socket, err := resolveSocketByNetlink(network, source, destination)
+	_, uid, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	if sharedPackage, loaded := s.packageManager.SharedPackageByID(socket.UID); loaded {
+	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid % 100000); loaded {
 		return &Info{
-			UserId:      int32(socket.UID),
+			UserId:      int32(uid),
 			PackageName: sharedPackage,
 		}, nil
 	}
-	if packageName, loaded := s.packageManager.PackageByID(socket.UID); loaded {
+	if packageName, loaded := s.packageManager.PackageByID(uid % 100000); loaded {
 		return &Info{
-			UserId:      int32(socket.UID),
+			UserId:      int32(uid),
 			PackageName: packageName,
 		}, nil
 	}
-	return &Info{UserId: int32(socket.UID)}, nil
+	return &Info{UserId: int32(uid)}, nil
 }

common/process/searcher_linux.go

@@ -20,16 +20,16 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *linuxSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	socket, err := resolveSocketByNetlink(network, source, destination)
+	inode, uid, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	processPath, err := resolveProcessNameByProcSearch(socket.INode, socket.UID)
+	processPath, err := resolveProcessNameByProcSearch(inode, uid)
 	if err != nil {
 		s.logger.DebugContext(ctx, "find process path: ", err)
 	}
 	return &Info{
-		UserId:      int32(socket.UID),
+		UserId:      int32(uid),
 		ProcessPath: processPath,
 	}, nil
 }

common/process/searcher_linux_shared.go

@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
+	"net"
 	"net/netip"
 	"os"
 	"path"
@@ -14,7 +15,9 @@ import (
 	"unicode"
 	"unsafe"
 
-	"github.com/sagernet/netlink"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/buf"
+	E "github.com/sagernet/sing/common/exceptions"
 	N "github.com/sagernet/sing/common/network"
 )
 
@@ -34,7 +37,7 @@ const (
 	pathProc                = "/proc"
 )
 
-func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (*netlink.Socket, error) {
+func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (inode, uid uint32, err error) {
 	var family uint8
 	var protocol uint8
 
@@ -44,28 +47,110 @@ func resolveSocketByNetlink(network string, source netip.AddrPort, destination n
 	case N.NetworkUDP:
 		protocol = syscall.IPPROTO_UDP
 	default:
-		return nil, os.ErrInvalid
+		return 0, 0, os.ErrInvalid
 	}
+
 	if source.Addr().Is4() {
 		family = syscall.AF_INET
 	} else {
 		family = syscall.AF_INET6
 	}
-	sockets, err := netlink.SocketGet(family, protocol, source, netip.AddrPortFrom(netip.IPv6Unspecified(), 0))
-	if err == nil {
-		sockets, err = netlink.SocketGet(family, protocol, source, destination)
-	}
+
+	req := packSocketDiagRequest(family, protocol, source)
+
+	socket, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_DGRAM, syscall.NETLINK_INET_DIAG)
 	if err != nil {
-		return nil, err
+		return 0, 0, E.Cause(err, "dial netlink")
 	}
-	if len(sockets) > 1 {
-		for _, socket := range sockets {
-			if socket.ID.DestinationPort == destination.Port() {
-				return socket, nil
-			}
-		}
+	defer syscall.Close(socket)
+
+	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_SNDTIMEO, &syscall.Timeval{Usec: 100})
+	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_RCVTIMEO, &syscall.Timeval{Usec: 100})
+
+	err = syscall.Connect(socket, &syscall.SockaddrNetlink{
+		Family: syscall.AF_NETLINK,
+		Pad:    0,
+		Pid:    0,
+		Groups: 0,
+	})
+	if err != nil {
+		return
 	}
-	return sockets[0], nil
+
+	_, err = syscall.Write(socket, req)
+	if err != nil {
+		return 0, 0, E.Cause(err, "write netlink request")
+	}
+
+	_buffer := buf.StackNew()
+	defer common.KeepAlive(_buffer)
+	buffer := common.Dup(_buffer)
+	defer buffer.Release()
+
+	n, err := syscall.Read(socket, buffer.FreeBytes())
+	if err != nil {
+		return 0, 0, E.Cause(err, "read netlink response")
+	}
+
+	buffer.Truncate(n)
+
+	messages, err := syscall.ParseNetlinkMessage(buffer.Bytes())
+	if err != nil {
+		return 0, 0, E.Cause(err, "parse netlink message")
+	} else if len(messages) == 0 {
+		return 0, 0, E.New("unexcepted netlink response")
+	}
+
+	message := messages[0]
+	if message.Header.Type&syscall.NLMSG_ERROR != 0 {
+		return 0, 0, E.New("netlink message: NLMSG_ERROR")
+	}
+
+	inode, uid = unpackSocketDiagResponse(&messages[0])
+	return
+}
+
+func packSocketDiagRequest(family, protocol byte, source netip.AddrPort) []byte {
+	s := make([]byte, 16)
+	copy(s, source.Addr().AsSlice())
+
+	buf := make([]byte, sizeOfSocketDiagRequest)
+
+	nativeEndian.PutUint32(buf[0:4], sizeOfSocketDiagRequest)
+	nativeEndian.PutUint16(buf[4:6], socketDiagByFamily)
+	nativeEndian.PutUint16(buf[6:8], syscall.NLM_F_REQUEST|syscall.NLM_F_DUMP)
+	nativeEndian.PutUint32(buf[8:12], 0)
+	nativeEndian.PutUint32(buf[12:16], 0)
+
+	buf[16] = family
+	buf[17] = protocol
+	buf[18] = 0
+	buf[19] = 0
+	nativeEndian.PutUint32(buf[20:24], 0xFFFFFFFF)
+
+	binary.BigEndian.PutUint16(buf[24:26], source.Port())
+	binary.BigEndian.PutUint16(buf[26:28], 0)
+
+	copy(buf[28:44], s)
+	copy(buf[44:60], net.IPv6zero)
+
+	nativeEndian.PutUint32(buf[60:64], 0)
+	nativeEndian.PutUint64(buf[64:72], 0xFFFFFFFFFFFFFFFF)
+
+	return buf
+}
+
+func unpackSocketDiagResponse(msg *syscall.NetlinkMessage) (inode, uid uint32) {
+	if len(msg.Data) < 72 {
+		return 0, 0
+	}
+
+	data := msg.Data
+
+	uid = nativeEndian.Uint32(data[64:68])
+	inode = nativeEndian.Uint32(data[68:72])
+
+	return
 }
 
 func resolveProcessNameByProcSearch(inode, uid uint32) (string, error) {

common/redir/redir_darwin.go

@@ -0,0 +1,64 @@
+package redir
+
+import (
+	"net"
+	"net/netip"
+	"syscall"
+	"unsafe"
+
+	M "github.com/sagernet/sing/common/metadata"
+)
+
+const (
+	PF_OUT      = 0x2
+	DIOCNATLOOK = 0xc0544417
+)
+
+func GetOriginalDestination(conn net.Conn) (destination netip.AddrPort, err error) {
+	fd, err := syscall.Open("/dev/pf", 0, syscall.O_RDONLY)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	defer syscall.Close(fd)
+	nl := struct {
+		saddr, daddr, rsaddr, rdaddr       [16]byte
+		sxport, dxport, rsxport, rdxport   [4]byte
+		af, proto, protoVariant, direction uint8
+	}{
+		af:        syscall.AF_INET,
+		proto:     syscall.IPPROTO_TCP,
+		direction: PF_OUT,
+	}
+	la := conn.LocalAddr().(*net.TCPAddr)
+	ra := conn.RemoteAddr().(*net.TCPAddr)
+	raIP, laIP := ra.IP, la.IP
+	raPort, laPort := ra.Port, la.Port
+	switch {
+	case raIP.To4() != nil:
+		copy(nl.saddr[:net.IPv4len], raIP.To4())
+		copy(nl.daddr[:net.IPv4len], laIP.To4())
+		nl.af = syscall.AF_INET
+	default:
+		copy(nl.saddr[:], raIP.To16())
+		copy(nl.daddr[:], laIP.To16())
+		nl.af = syscall.AF_INET6
+	}
+	nl.sxport[0], nl.sxport[1] = byte(raPort>>8), byte(raPort)
+	nl.dxport[0], nl.dxport[1] = byte(laPort>>8), byte(laPort)
+	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), DIOCNATLOOK, uintptr(unsafe.Pointer(&nl))); errno != 0 {
+		return netip.AddrPort{}, errno
+	}
+
+	var ip net.IP
+	switch nl.af {
+	case syscall.AF_INET:
+		ip = make(net.IP, net.IPv4len)
+		copy(ip, nl.rdaddr[:net.IPv4len])
+	case syscall.AF_INET6:
+		ip = make(net.IP, net.IPv6len)
+		copy(ip, nl.rdaddr[:])
+	}
+	port := uint16(nl.rdxport[0])<<8 | uint16(nl.rdxport[1])
+	destination = netip.AddrPortFrom(M.AddrFromIP(ip), port)
+	return
+}

common/redir/redir_other.go

@@ -1,4 +1,4 @@
-//go:build !linux
+//go:build !linux && !darwin
 
 package redir
 

common/settings/proxy_darwin.go

@@ -1,6 +1,7 @@
 package settings
 
 import (
+	"net/netip"
 	"strings"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -20,7 +21,7 @@ type systemProxy struct {
 }
 
 func (p *systemProxy) update() error {
-	newInterfaceName := p.monitor.DefaultInterfaceName()
+	newInterfaceName := p.monitor.DefaultInterfaceName(netip.IPv4Unspecified())
 	if p.interfaceName == newInterfaceName {
 		return nil
 	}

common/sniff/dns.go

@@ -22,7 +22,7 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 	if err != nil {
 		return nil, err
 	}
-	if length > 512 {
+	if length == 0 {
 		return nil, os.ErrInvalid
 	}
 	_buffer := buf.StackNewSize(int(length))

constant/proxy.go

@@ -18,6 +18,7 @@ const (
 	TypeHysteria    = "hysteria"
 	TypeTor         = "tor"
 	TypeSSH         = "ssh"
+	TypeShadowTLS   = "shadowtls"
 )
 
 const (

constant/version.go

@@ -1,6 +1,6 @@
 package constant
 
 var (
-	Version = "1.0"
+	Version = "1.0.4"
 	Commit  = ""
 )

docs/changelog.md

@@ -1,4 +1,68 @@
-#### 2022/08/24
+#### 1.0.1
+
+* Fix match 4in6 address in ip_cidr
+* Fix clash api log level format error
+* Fix clash api unknown proxy type
+
+#### 1.0
+
+* Fix wireguard reconnect
+* Fix naive inbound
+* Fix json format error message
+* Fix processing vmess termination signal
+* Fix hysteria stream error
+* Fix listener close when proxyproto failed
+
+#### 1.0-rc1
+
+* Fix write log timestamp
+* Fix write zero
+* Fix dial parallel in direct outbound
+* Fix write trojan udp
+* Fix DNS routing
+* Add attribute support for geosite
+* Update documentation for [Dial Fields](/configuration/shared/dial)
+
+#### 1.0-beta3
+
+* Add [chained inbound](/configuration/shared/listen#detour) support
+* Add process_path rule item
+* Add macOS redirect support
+* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls)
+  and [Examples](/examples/shadowtls)
+* Fix search android package in non-owner users
+* Fix socksaddr type condition
+* Fix smux session status
+* Refactor inbound and outbound documentation
+* Minor fixes
+
+#### 1.0-beta2
+
+* Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
+* Add packetaddr support for [VMess outbound](/configuration/outbound/vmess#packet_addr)
+* Add better performing alternative gRPC implementation
+* Add [docker image](https://github.com/SagerNet/sing-box/pkgs/container/sing-box)
+* Fix sniff override destination
+
+#### 1.0-beta1
+
+* Initial release
+
+##### 2022/08/26
+
+* Fix ipv6 route on linux
+* Fix read DNS message
+
+##### 2022/08/25
+
+* Let vmess use zero instead of auto if TLS enabled
+* Add trojan fallback for ALPN
+* Improve ip_cidr rule
+* Fix format bind_address
+* Fix http proxy with compressed response
+* Fix route connections
+
+##### 2022/08/24
 
 * Fix naive padding
 * Fix unix search path
@@ -7,7 +71,7 @@
 * Fix early close on windows and catch any
 * Initial zh-CN document translation
 
-#### 2022/08/23
+##### 2022/08/23
 
 * Add [V2Ray Transport](/configuration/shared/v2ray-transport) support for VMess and Trojan
 * Allow plain http request in Naive inbound (It can now be used with nginx)
@@ -16,17 +80,17 @@
 * Parse X-Forward-For in HTTP requests
 * Handle SIGHUP signal
 
-#### 2022/08/22
+##### 2022/08/22
 
 * Add strategy setting for each [DNS server](/configuration/dns/server)
 * Add bind address to outbound options
 
-#### 2022/08/21
+##### 2022/08/21
 
 * Add [Tor outbound](/configuration/outbound/tor)
 * Add [SSH outbound](/configuration/outbound/ssh)
 
-#### 2022/08/20
+##### 2022/08/20
 
 * Attempt to unwrap ip-in-fqdn socksaddr
 * Fix read packages in android 12
@@ -36,53 +100,53 @@
 * Skip bind connection with private destination to interface
 * Add [Trojan connection fallback](/configuration/inbound/trojan#fallback)
 
-#### 2022/08/19
+##### 2022/08/19
 
 * Add Hysteria [Inbound](/configuration/inbound/hysteria) and [Outbund](/configuration/outbound/hysteria)
 * Add [ACME TLS certificate issuer](/configuration/shared/tls)
 * Allow read config from stdin (-c stdin)
 * Update gVisor to 20220815.0
 
-#### 2022/08/18
+##### 2022/08/18
 
 * Fix find process with lwip stack
 * Fix crash on shadowsocks server
 * Fix crash on darwin tun
 * Fix write log to file
 
-#### 2022/08/17
+##### 2022/08/17
 
 * Improve async dns transports
 
-#### 2022/08/16
+##### 2022/08/16
 
 * Add ip_version (route/dns) rule item
 * Add [WireGuard](/configuration/outbound/wireguard) outbound
 
-#### 2022/08/15
+##### 2022/08/15
 
 * Add uid, android user and package rules support in [Tun](/configuration/inbound/tun) routing.
 
-#### 2022/08/13
+##### 2022/08/13
 
 * Fix dns concurrent write
 
-#### 2022/08/12
+##### 2022/08/12
 
 * Performance improvements
 * Add UoT option for [SOCKS](/configuration/outbound/socks) outbound
 
-#### 2022/08/11
+##### 2022/08/11
 
 * Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks) outbound, UoT support for all inbounds
 
-#### 2022/08/10
+##### 2022/08/10
 
 * Add full-featured [Naive](/configuration/inbound/naive) inbound
 * Fix default dns server option [#9] by iKirby
 
-#### 2022/08/09
+##### 2022/08/09
 
 No changelog before.
 
-[#9]: https://github.com/SagerNet/sing-box/pull/9
+[#9]: https://github.com/SagerNet/sing-box/pull/9

docs/configuration/dns/index.md

@@ -1,3 +1,5 @@
+# DNS
+
 ### Structure
 
 ```json

docs/configuration/dns/rule.md

@@ -38,7 +38,8 @@
           "private"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "source_port": [
           12345
@@ -60,6 +61,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -176,6 +180,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/dns/rule.zh.md

@@ -60,6 +60,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -176,6 +179,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/dns/server.zh.md

@@ -47,7 +47,7 @@ DNS 服务器的地址。
 
 !!! warning ""
 
-    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#installation)。
+    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#_2)。
 
 !!! info ""
 

docs/configuration/experimental/index.md

@@ -1,3 +1,5 @@
+# Experimental
+
 ### Structure
 
 ```json

docs/configuration/experimental/index.zh.md

@@ -18,7 +18,7 @@
 
 !!! error ""
 
-    默认安装不包含 Clash API，参阅 [安装](/zh/#installation)。
+    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
 
 !!! note ""
 

docs/configuration/inbound/direct.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "proxy_protocol": false,
+  "type": "direct",
+  "tag": "direct-in",
+  
+  ... // Listen Fields
 
-      "network": "udp",
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -40,50 +33,4 @@ Override the connection destination address.
 
 #### override_port
 
-Override the connection destination port.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+Override the connection destination port.

docs/configuration/inbound/direct.zh.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
+  "type": "direct",
+  "tag": "direct-in",
 
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp",
-      "proxy_protocol": false,
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  ... // 监听字段
+
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -42,48 +35,3 @@
 
 覆盖连接目标端口。
 
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/http.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+  
+  ... // Listen Fields
+  
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### tls
 
@@ -47,45 +41,3 @@ No authentication required if empty.
     Only supported on Linux, Android, Windows, and macOS.
 
 Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/http.zh.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### tls
 
@@ -38,7 +32,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -46,46 +40,4 @@ HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/hysteria.md

@@ -2,31 +2,23 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // Listen Fields
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
@@ -34,7 +26,11 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### up, down
 
@@ -101,38 +97,4 @@ Force enabled on for systems other than Linux and Windows (according to upstream
 
 ==Required==
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/hysteria.zh.md

@@ -2,39 +2,35 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // 监听字段
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### up, down
 
@@ -101,38 +97,4 @@ base64 编码的认证密码。
 
 ==必填==
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/index.md

@@ -1,3 +1,5 @@
+# Inbound
+
 ### Structure
 
 ```json
@@ -13,20 +15,20 @@
 
 ### Fields
 
-| Type          | Format                       |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| Type          | Format                       | Injectable |
+|---------------|------------------------------|------------|
+| `direct`      | [Direct](./direct)           | X          |
+| `mixed`       | [Mixed](./mixed)             | TCP        |
+| `socks`       | [SOCKS](./socks)             | TCP        |
+| `http`        | [HTTP](./http)               | TCP        |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
+| `vmess`       | [VMess](./vmess)             | TCP        |
+| `trojan`      | [Trojan](./trojan)           | TCP        |
+| `naive`       | [Naive](./naive)             | X          |
+| `hysteria`    | [Hysteria](./hysteria)       | X          |
+| `tun`         | [Tun](./tun)                 | X          |
+| `redirect`    | [Redirect](./redirect)       | X          |
+| `tproxy`      | [TProxy](./tproxy)           | X          |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -15,20 +15,20 @@
 
 ### 字段
 
-| 类型            | 格式                           |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| 类型            | 格式                           | 注入支持 |
+|---------------|------------------------------|------|
+| `direct`      | [Direct](./direct)           | X    |
+| `mixed`       | [Mixed](./mixed)             | TCP  |
+| `socks`       | [SOCKS](./socks)             | TCP  |
+| `http`        | [HTTP](./http)               | TCP  |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
+| `vmess`       | [VMess](./vmess)             | TCP  |
+| `trojan`      | [Trojan](./trojan)           | TCP  |
+| `naive`       | [Naive](./naive)             | X    |
+| `hysteria`    | [Hysteria](./hysteria)       | X    |
+| `tun`         | [Tun](./tun)                 | X    |
+| `redirect`    | [Redirect](./redirect)       | X    |
+| `tproxy`      | [TProxy](./tproxy)           | X    |
 
 #### tag
 

docs/configuration/inbound/mixed.md

@@ -4,32 +4,26 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -39,52 +33,6 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! error ""
-
-    Only supported on Linux, Android, Windows, and macOS.
-
-Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### set_system_proxy
-
 !!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.

docs/configuration/inbound/mixed.zh.md

@@ -4,38 +4,32 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 和 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -43,46 +37,4 @@ SOCKS 和 HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/naive.md

@@ -2,29 +2,19 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
@@ -32,7 +22,11 @@
 
     HTTP3 transport is not included by default, see [Installation](/#installation).
 
-### Naive Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -48,46 +42,4 @@ Naive users.
 
 #### tls
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/naive.zh.md

@@ -2,37 +2,31 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
 
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#installation)。
+    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
 
-### Naive 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -48,46 +42,4 @@ Naive 用户。
 
 #### tls
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/redirect.md

@@ -1,52 +1,18 @@
+!!! error ""
+
+    Only supported on Linux and macOS.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // Listen Fields
 }
 ```
 
 ### Listen Fields
 
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/redirect.zh.md

@@ -1,52 +1,17 @@
+!!! error ""
+
+    仅支持 Linux 和 macOS。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // 监听字段
 }
 ```
-
 ### 监听字段
 
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/shadowsocks.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // Listen Fields
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 

docs/configuration/inbound/shadowsocks.zh.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // 监听字段
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks 字段
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### 字段
 
 #### network
 
@@ -98,50 +81,4 @@
 |---------------|-------------------------------|
 | none          | /                             |
 | 2022 methods  | `openssl rand -base64 <密钥长度>` |
-| other methods | 任意字符串                         |
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+| other methods | 任意字符串                         |

docs/configuration/inbound/shadowtls.md

@@ -0,0 +1,31 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // Listen Fields
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+    
+    ... // Dial Fields
+  }
+}
+```
+
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+
+### Fields
+
+#### handshake
+
+==Required==
+
+Handshake server address and [dial options](/configuration/shared/dial).
+

docs/configuration/inbound/shadowtls.zh.md

@@ -0,0 +1,29 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // 监听字段
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+
+    ... // 拨号字段
+  }
+}
+```
+
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
+
+#### handshake
+
+==必填==
+
+握手服务器地址和 [拨号参数](/zh/configuration/shared/dial/)。

docs/configuration/inbound/socks.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // Listen Fields
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
 SOCKS users.
 
 No authentication required if empty.
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址
-
-#### listen_port
-
-==必填==
-
-监听端口
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/socks.zh.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 用户
 
-默认不需要验证。
-
-### Listen Fields
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+如果为空则不需要验证。

docs/configuration/inbound/tproxy.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    Only supported on Linux.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // Listen Fields
+
+  "network": "udp"
 }
 ```
 
-### TProxy Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
 Listen network, one of `tcp` `udp`.
 
 Both if empty.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).

docs/configuration/inbound/tproxy.zh.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    仅支持 Linux。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // 监听字段
+
+  "network": "udp"
 }
 ```
 
-### TProxy 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
 监听的网络协议，`tcp` `udp` 之一。
 
 默认所有。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

docs/configuration/inbound/trojan.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "trojan",
+  "tag": "trojan-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.0.1",
-        "server_port": 8080
-      },
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -50,50 +50,14 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 
-Fallback server configuration. Disabled if empty.
+Fallback server configuration. Disabled if `fallback` and `fallback_for_alpn` are empty.
+
+#### fallback_for_alpn
+
+Fallback server configuration for specified ALPN.
+
+If not empty, TLS fallback requests with ALPN not in this table will be rejected.
 
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/trojan.zh.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "trojan",
+  "tag": "trojan-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.0.1",
-        "server_port": 8080
-      },
-      "transport": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -50,52 +50,16 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 !!! error ""
 
-    没有证据表明 GFW 基于 HTTP 响应检测并阻止木马服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
+    没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 
-备用服务器配置。默认禁用。
+回退服务器配置。如果 `fallback` 和 `fallback_for_alpn` 为空，则禁用回退。
+
+#### fallback_for_alpn
+
+为 ALPN 指定回退服务器配置。
+
+如果不为空，ALPN 不在此列表中的 TLS 回退请求将被拒绝。
 
 #### transport
 
-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

docs/configuration/inbound/tun.md

@@ -6,47 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+  
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // Listen Fields
 }
 ```
 
@@ -58,7 +52,7 @@
 
     If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
 
-### Tun Fields
+### Fields
 
 #### interface_name
 
@@ -86,6 +80,16 @@ Set the default route to the Tun.
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
+#### strict_route
+
+Enforce strict routing rules in Linux when `auto_route` is enabled:
+
+* Let unsupported network unreachable
+* Route all connections to tun
+
+It prevents address leaks and makes DNS hijacking work on Android and Linux with systemd-resolved, but your device will
+not be accessible by others.
+
 #### endpoint_independent_nat
 
 Enable endpoint-independent NAT.
@@ -152,22 +156,4 @@ Exclude android packages in route.
 
 ### Listen Fields
 
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/tun.zh.md

@@ -6,47 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // 监听字段
 }
 ```
 
@@ -86,6 +80,15 @@ tun 接口的 IPv6 前缀。
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
+#### strict_route
+
+在 Linux 中启用 `auto_route` 时执行严格的路由规则。
+
+* 让不支持的网络无法到达
+* 将所有连接路由到 tun
+
+它可以防止地址泄漏，并使 DNS 劫持在 Android 和使用 systemd-resolved 的 Linux 上工作，但你的设备将无法其他设备被访问。
+
 #### endpoint_independent_nat
 
 启用独立于端点的 NAT。
@@ -107,7 +110,7 @@ TCP/IP 栈。
 
 !!! warning ""
 
-    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#installation)。
+    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#_2)。
 
 #### include_uid
 
@@ -152,22 +155,4 @@ TCP/IP 栈。
 
 ### 监听字段
 
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/vmess.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -53,45 +47,3 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/vmess.zh.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -53,45 +47,3 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 #### transport
 
 V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/index.md

@@ -8,8 +8,8 @@ sing-box uses JSON for configuration files.
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/index.zh.md

@@ -8,8 +8,8 @@ sing-box 使用 JSON 作为配置文件格式。
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/log/index.md

@@ -1,3 +1,5 @@
+# Log
+
 ### Structure
 
 ```json

docs/configuration/log/index.zh.md

@@ -1,3 +1,5 @@
+# 日志
+
 ### 结构
 
 ```json

docs/configuration/outbound/block.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/block.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/direct.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+  
+  ... // Dial Fields
 }
 ```
 
-### Direct Fields
+### Fields
 
 #### override_address
 
@@ -45,54 +33,4 @@ Protocol value can be `1` or `2`.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before connect.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/direct.zh.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+
+  ... // 拨号字段
 }
 ```
 
-### Direct 字段
+### 字段
 
 #### override_address
 
@@ -45,51 +33,4 @@
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，域名将在请求发出之前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/dns.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/dns.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/http.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
-### HTTP Fields
+### Fields
 
 #### server
 
@@ -57,54 +45,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/http.zh.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+
+  ... // 拨号字段
 }
 ```
 
-### HTTP 字段
+### 字段
 
 #### server
 
@@ -57,51 +45,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/hysteria.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
@@ -40,7 +28,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Fields
 
 #### server
 
@@ -125,54 +113,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/hysteria.zh.md

@@ -2,45 +2,33 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // 拨号字段
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 字段
 
 #### server
 
@@ -123,51 +111,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/index.md

@@ -1,3 +1,5 @@
+# Outbound
+
 ### Structure
 
 ```json

docs/configuration/outbound/selector.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+  
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/selector.zh.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/shadowsocks.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Shadowsocks Fields
+### Fields
 
 #### server
 
@@ -97,54 +85,4 @@ Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowsocks.zh.md

@@ -1,35 +1,23 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // 拨号字段
 }
 ```
 
-### Shadowsocks 字段
+### 字段
 
 #### server
 
@@ -97,51 +85,4 @@ Shadowsocks 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/shadowtls.md

@@ -0,0 +1,38 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // Dial Fields
+}
+```
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### tls
+
+==Required==
+
+TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowtls.zh.md

@@ -0,0 +1,38 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // 拨号字段
+}
+```
+
+### 字段
+
+#### server
+
+==必填==
+
+服务器地址。
+
+#### server_port
+
+==必填==
+
+服务器端口。
+
+#### tls
+
+==必填==
+
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
+
+### 拨号字段
+
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/socks.md

@@ -4,34 +4,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### SOCKS Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Enable the UDP over TCP protocol.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/socks.zh.md

@@ -1,37 +1,25 @@
 `socks` 出站是 socks4/socks4a/socks5 客户端
 
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### SOCKS 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SOCKS5 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/ssh.md

@@ -2,36 +2,24 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // Dial Fields
 }
 ```
 
-### SSH Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Client version. Random version will be used if empty.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/ssh.zh.md

@@ -1,37 +1,25 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // 拨号字段
 }
 ```
 
-### SSH 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SSH 用户, 默认使用 root。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/tor.md

@@ -2,29 +2,17 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+  
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // Dial Fields
 }
 ```
 
@@ -32,7 +20,7 @@
 
     Embedded tor is not included by default, see [Installation](/#installation).
 
-### Tor Fields
+### Fields
 
 #### executable_path
 
@@ -56,58 +44,8 @@ Each start will be very slow if not specified.
 
 Map of torrc options.
 
-See [tor(1)](https://linux.die.net/man/1/tor)
+See [tor(1)](https://linux.die.net/man/1/tor) for details.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/tor.zh.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // 拨号字段
 }
 ```
 
 !!! info ""
 
-    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#installation)。
+    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#_2)。
 
-### Tor 字段
+### 字段
 
 #### executable_path
 
@@ -60,51 +48,4 @@ torrc 参数表。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/trojan.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Trojan Fields
+### Fields
 
 #### server
 
@@ -71,54 +59,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/trojan.zh.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### Trojan 字段
+### 字段
 
 #### server
 
@@ -71,51 +59,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/vmess.md

@@ -2,38 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "vmess",
+  "tag": "vmess-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### VMess Fields
+### Fields
 
 #### server
 
@@ -95,6 +84,10 @@ Both is enabled by default.
 
 TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
+#### packet_addr
+
+Enable packetaddr support.
+
 #### multiplex
 
 Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
@@ -105,54 +98,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/vmess.zh.md

@@ -2,36 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "vmess",
+  "tag": "vmess-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
+
+  ... // 拨号字段
 }
 ```
 
-### VMess 字段
+### 字段
 
 #### server
 
@@ -93,6 +84,10 @@ VMess 用户 ID。
 
 TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
+#### packet_addr
+
+启用 packetaddr 支持。
+
 #### multiplex
 
 多路复用配置, 参阅 [多路复用](/zh/configuration/shared/multiplex)。
@@ -103,51 +98,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/wireguard.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // Dial Fields
 }
 ```
 
@@ -37,7 +25,7 @@
 
     WireGuard is not included by default, see [Installation](/#installation).
 
-### WireGuard Fields
+### Fields
 
 #### server
 
@@ -92,54 +80,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/wireguard.zh.md

@@ -2,42 +2,30 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // 拨号字段
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 WireGuard, 参阅 [安装](/zh/#installation)。
+    默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
 
-### WireGuard 字段
+### 字段
 
 #### server
 
@@ -94,51 +82,4 @@ WireGuard MTU。 默认1408。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/route/index.md

@@ -1,3 +1,5 @@
+# Route
+
 ### Structure
 
 ```json

docs/configuration/route/rule.md

@@ -41,10 +41,12 @@
           "cn"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "ip_cidr": [
-          "10.0.0.0/24"
+          "10.0.0.0/24",
+          "192.168.0.1"
         ],
         "source_port": [
           12345
@@ -66,6 +68,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -186,6 +191,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/route/rule.zh.md

@@ -66,6 +66,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -186,6 +189,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/shared/dial.md

@@ -0,0 +1,74 @@
+### Structure
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### Fields
+
+| Field                                                                             | Available Context |
+|-----------------------------------------------------------------------------------|-------------------|
+| `bind_interface` /`bind_address` /`routing_mark` /`reuse_addr` /`connect_timeout` | `detour` not set  |
+
+#### detour
+
+The tag of the upstream outbound.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before connect.
+
+| Outbound | Effected domains         | Fallback Value                            |
+|----------|--------------------------|-------------------------------------------|
+| `direct` | Domain in request        | Take `inbound.domain_strategy` if not set | 
+| others   | Domain in server address | /                                         |
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for connection to succeed before assuming
+that IPv4/IPv6 is misconfigured and falling back to other type of addresses.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is set.

docs/configuration/shared/dial.zh.md

@@ -0,0 +1,66 @@
+### 结构
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### 字段
+
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，域名将在请求发出之前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/shared/listen.md

@@ -0,0 +1,73 @@
+### Structure
+
+```json
+{
+  "listen": "::",
+  "listen_port": 5353,
+  "tcp_fast_open": false,
+  "sniff": false,
+  "sniff_override_destination": false,
+  "domain_strategy": "prefer_ipv6",
+  "udp_timeout": 300,
+  "proxy_protocol": false,
+  "detour": "another-in"
+}
+```
+
+### Fields
+
+| Field            | Available Context                                                 |
+|------------------|-------------------------------------------------------------------|
+| `listen`         | Needs to listen on TCP or UDP.                                    |
+| `listen_port`    | Needs to listen on TCP or UDP.                                    |
+| `tcp_fast_open`  | Needs to listen on TCP.                                           |
+| `udp_timeout`    | Needs to assemble UDP connections, currently Tun and Shadowsocks. |
+| `proxy_protocol` | Needs to listen on TCP.                                           |
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+
+#### detour
+
+If set, connections will be forwarded to the specified inbound.
+
+Requires target inbound support, see [Injectable](/configuration/inbound/#fields).