Fix ACME HTTP-01 challenge for IPv6 literal addresses

Replace certmagic with a fork that strips brackets from bare IPv6
addresses in the HTTP Host header, fixing HTTP-01 challenge matching
for IPv6 literal address certificates.

Fixes https://github.com/SagerNet/sing-box/issues/3964

.github/CRONET_GO_VERSION

@@ -1 +1 @@
-335e5bef5d88fc4474c9a70b865561f45a67de83
+ea7cd33752aed62603775af3df946c1b83f4b0b3

adapter/dns.go

@@ -3,7 +3,6 @@ package adapter
 import (
 	"context"
 	"net/netip"
-	"time"
 
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
@@ -26,19 +25,18 @@ type DNSRouter interface {
 
 type DNSClient interface {
 	Start()
-	Exchange(ctx context.Context, transport DNSTransport, message *dns.Msg, options DNSQueryOptions, responseChecker func(response *dns.Msg) bool) (*dns.Msg, error)
-	Lookup(ctx context.Context, transport DNSTransport, domain string, options DNSQueryOptions, responseChecker func(response *dns.Msg) bool) ([]netip.Addr, error)
+	Exchange(ctx context.Context, transport DNSTransport, message *dns.Msg, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) (*dns.Msg, error)
+	Lookup(ctx context.Context, transport DNSTransport, domain string, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error)
 	ClearCache()
 }
 
 type DNSQueryOptions struct {
-	Transport              DNSTransport
-	Strategy               C.DomainStrategy
-	LookupStrategy         C.DomainStrategy
-	DisableCache           bool
-	DisableOptimisticCache bool
-	RewriteTTL             *uint32
-	ClientSubnet           netip.Prefix
+	Transport      DNSTransport
+	Strategy       C.DomainStrategy
+	LookupStrategy C.DomainStrategy
+	DisableCache   bool
+	RewriteTTL     *uint32
+	ClientSubnet   netip.Prefix
 }
 
 func DNSQueryOptionsFrom(ctx context.Context, options *option.DomainResolveOptions) (*DNSQueryOptions, error) {
@@ -51,12 +49,11 @@ func DNSQueryOptionsFrom(ctx context.Context, options *option.DomainResolveOptio
 		return nil, E.New("domain resolver not found: " + options.Server)
 	}
 	return &DNSQueryOptions{
-		Transport:              transport,
-		Strategy:               C.DomainStrategy(options.Strategy),
-		DisableCache:           options.DisableCache,
-		DisableOptimisticCache: options.DisableOptimisticCache,
-		RewriteTTL:             options.RewriteTTL,
-		ClientSubnet:           options.ClientSubnet.Build(netip.Prefix{}),
+		Transport:    transport,
+		Strategy:     C.DomainStrategy(options.Strategy),
+		DisableCache: options.DisableCache,
+		RewriteTTL:   options.RewriteTTL,
+		ClientSubnet: options.ClientSubnet.Build(netip.Prefix{}),
 	}, nil
 }
 
@@ -66,13 +63,6 @@ type RDRCStore interface {
 	SaveRDRCAsync(transportName string, qName string, qType uint16, logger logger.Logger)
 }
 
-type DNSCacheStore interface {
-	LoadDNSCache(transportName string, qName string, qType uint16) (rawMessage []byte, expireAt time.Time, loaded bool)
-	SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error
-	SaveDNSCacheAsync(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time, logger logger.Logger)
-	ClearDNSCache() error
-}
-
 type DNSTransport interface {
 	Lifecycle
 	Type() string
@@ -82,6 +72,11 @@ type DNSTransport interface {
 	Exchange(ctx context.Context, message *dns.Msg) (*dns.Msg, error)
 }
 
+type LegacyDNSTransport interface {
+	LegacyStrategy() C.DomainStrategy
+	LegacyClientSubnet() netip.Prefix
+}
+
 type DNSTransportRegistry interface {
 	option.DNSTransportOptionsRegistry
 	CreateDNSTransport(ctx context.Context, logger log.ContextLogger, tag string, transportType string, options any) (DNSTransport, error)

adapter/experimental.go

@@ -47,12 +47,6 @@ type CacheFile interface {
 	StoreRDRC() bool
 	RDRCStore
 
-	StoreDNS() bool
-	DNSCacheStore
-
-	SetDisableExpire(disableExpire bool)
-	SetOptimisticTimeout(timeout time.Duration)
-
 	LoadMode() string
 	StoreMode(mode string) error
 	LoadSelected(group string) string

adapter/inbound.go

@@ -10,8 +10,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	M "github.com/sagernet/sing/common/metadata"
-
-	"github.com/miekg/dns"
 )
 
 type Inbound interface {
@@ -81,16 +79,14 @@ type InboundContext struct {
 	FallbackNetworkType []C.InterfaceType
 	FallbackDelay       time.Duration
 
-	DestinationAddresses                []netip.Addr
-	DNSResponse                         *dns.Msg
-	DestinationAddressMatchFromResponse bool
-	SourceGeoIPCode                     string
-	GeoIPCode                           string
-	ProcessInfo                         *ConnectionOwner
-	SourceMACAddress                    net.HardwareAddr
-	SourceHostname                      string
-	QueryType                           uint16
-	FakeIP                              bool
+	DestinationAddresses []netip.Addr
+	SourceGeoIPCode      string
+	GeoIPCode            string
+	ProcessInfo          *ConnectionOwner
+	SourceMACAddress     net.HardwareAddr
+	SourceHostname       string
+	QueryType            uint16
+	FakeIP               bool
 
 	// rule cache
 
@@ -119,51 +115,6 @@ func (c *InboundContext) ResetRuleMatchCache() {
 	c.DidMatch = false
 }
 
-func (c *InboundContext) DNSResponseAddressesForMatch() []netip.Addr {
-	return DNSResponseAddresses(c.DNSResponse)
-}
-
-func DNSResponseAddresses(response *dns.Msg) []netip.Addr {
-	if response == nil || response.Rcode != dns.RcodeSuccess {
-		return nil
-	}
-	addresses := make([]netip.Addr, 0, len(response.Answer))
-	for _, rawRecord := range response.Answer {
-		switch record := rawRecord.(type) {
-		case *dns.A:
-			addr := M.AddrFromIP(record.A)
-			if addr.IsValid() {
-				addresses = append(addresses, addr)
-			}
-		case *dns.AAAA:
-			addr := M.AddrFromIP(record.AAAA)
-			if addr.IsValid() {
-				addresses = append(addresses, addr)
-			}
-		case *dns.HTTPS:
-			for _, value := range record.SVCB.Value {
-				switch hint := value.(type) {
-				case *dns.SVCBIPv4Hint:
-					for _, ip := range hint.Hint {
-						addr := M.AddrFromIP(ip).Unmap()
-						if addr.IsValid() {
-							addresses = append(addresses, addr)
-						}
-					}
-				case *dns.SVCBIPv6Hint:
-					for _, ip := range hint.Hint {
-						addr := M.AddrFromIP(ip)
-						if addr.IsValid() {
-							addresses = append(addresses, addr)
-						}
-					}
-				}
-			}
-		}
-	}
-	return addresses
-}
-
 type inboundContextKey struct{}
 
 func WithContext(ctx context.Context, inboundContext *InboundContext) context.Context {

adapter/inbound_test.go

@@ -1,45 +0,0 @@
-package adapter
-
-import (
-	"net"
-	"net/netip"
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDNSResponseAddressesUnmapsHTTPSIPv4Hints(t *testing.T) {
-	t.Parallel()
-
-	ipv4Hint := net.ParseIP("1.1.1.1")
-	require.NotNil(t, ipv4Hint)
-
-	response := &dns.Msg{
-		MsgHdr: dns.MsgHdr{
-			Response: true,
-			Rcode:    dns.RcodeSuccess,
-		},
-		Answer: []dns.RR{
-			&dns.HTTPS{
-				SVCB: dns.SVCB{
-					Hdr: dns.RR_Header{
-						Name:   dns.Fqdn("example.com"),
-						Rrtype: dns.TypeHTTPS,
-						Class:  dns.ClassINET,
-						Ttl:    60,
-					},
-					Priority: 1,
-					Target:   ".",
-					Value: []dns.SVCBKeyValue{
-						&dns.SVCBIPv4Hint{Hint: []net.IP{ipv4Hint}},
-					},
-				},
-			},
-		},
-	}
-
-	addresses := DNSResponseAddresses(response)
-	require.Equal(t, []netip.Addr{netip.MustParseAddr("1.1.1.1")}, addresses)
-	require.True(t, addresses[0].Is4())
-}

adapter/router.go

@@ -66,16 +66,10 @@ type RuleSet interface {
 
 type RuleSetUpdateCallback func(it RuleSet)
 
-type DNSRuleSetUpdateValidator interface {
-	ValidateRuleSetMetadataUpdate(tag string, metadata RuleSetMetadata) error
-}
-
-// ip_version is not a headless-rule item, so ContainsIPVersionRule is intentionally absent.
 type RuleSetMetadata struct {
-	ContainsProcessRule      bool
-	ContainsWIFIRule         bool
-	ContainsIPCIDRRule       bool
-	ContainsDNSQueryTypeRule bool
+	ContainsProcessRule bool
+	ContainsWIFIRule    bool
+	ContainsIPCIDRRule  bool
 }
 type HTTPStartContext struct {
 	ctx             context.Context

adapter/rule.go

@@ -2,8 +2,6 @@ package adapter
 
 import (
 	C "github.com/sagernet/sing-box/constant"
-
-	"github.com/miekg/dns"
 )
 
 type HeadlessRule interface {
@@ -20,9 +18,8 @@ type Rule interface {
 
 type DNSRule interface {
 	Rule
-	LegacyPreMatch(metadata *InboundContext) bool
 	WithAddressLimit() bool
-	MatchAddressLimit(metadata *InboundContext, response *dns.Msg) bool
+	MatchAddressLimit(metadata *InboundContext) bool
 }
 
 type RuleAction interface {
@@ -32,7 +29,7 @@ type RuleAction interface {
 
 func IsFinalAction(action RuleAction) bool {
 	switch action.Type() {
-	case C.RuleActionTypeSniff, C.RuleActionTypeResolve, C.RuleActionTypeEvaluate:
+	case C.RuleActionTypeSniff, C.RuleActionTypeResolve:
 		return false
 	default:
 		return true

adapter/tailscale.go

@@ -1,49 +0,0 @@
-package adapter
-
-import "context"
-
-type TailscaleEndpoint interface {
-	SubscribeTailscaleStatus(ctx context.Context, fn func(*TailscaleEndpointStatus)) error
-	StartTailscalePing(ctx context.Context, peerIP string, fn func(*TailscalePingResult)) error
-}
-
-type TailscalePingResult struct {
-	LatencyMs      float64
-	IsDirect       bool
-	Endpoint       string
-	DERPRegionID   int32
-	DERPRegionCode string
-	Error          string
-}
-
-type TailscaleEndpointStatus struct {
-	BackendState   string
-	AuthURL        string
-	NetworkName    string
-	MagicDNSSuffix string
-	Self           *TailscalePeer
-	UserGroups     []*TailscaleUserGroup
-}
-
-type TailscaleUserGroup struct {
-	UserID        int64
-	LoginName     string
-	DisplayName   string
-	ProfilePicURL string
-	Peers         []*TailscalePeer
-}
-
-type TailscalePeer struct {
-	HostName       string
-	DNSName        string
-	OS             string
-	TailscaleIPs   []string
-	Online         bool
-	ExitNode       bool
-	ExitNodeOption bool
-	Active         bool
-	RxBytes        int64
-	TxBytes        int64
-	UserID         int64
-	KeyExpiry      int64
-}

box.go

@@ -20,6 +20,7 @@ import (
 	"github.com/sagernet/sing-box/common/tls"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/dns"
+	"github.com/sagernet/sing-box/dns/transport/local"
 	"github.com/sagernet/sing-box/experimental"
 	"github.com/sagernet/sing-box/experimental/cachefile"
 	"github.com/sagernet/sing-box/log"
@@ -196,12 +197,8 @@ func New(options Options) (*Box, error) {
 	service.MustRegister[adapter.DNSTransportManager](ctx, dnsTransportManager)
 	service.MustRegister[adapter.ServiceManager](ctx, serviceManager)
 	service.MustRegister[adapter.CertificateProviderManager](ctx, certificateProviderManager)
-	dnsRouter, err := dns.NewRouter(ctx, logFactory, dnsOptions)
-	if err != nil {
-		return nil, E.Cause(err, "initialize DNS router")
-	}
+	dnsRouter := dns.NewRouter(ctx, logFactory, dnsOptions)
 	service.MustRegister[adapter.DNSRouter](ctx, dnsRouter)
-	service.MustRegister[adapter.DNSRuleSetUpdateValidator](ctx, dnsRouter)
 	networkManager, err := route.NewNetworkManager(ctx, logFactory.NewLogger("network"), routeOptions, dnsOptions)
 	if err != nil {
 		return nil, E.Cause(err, "initialize network manager")
@@ -360,12 +357,11 @@ func New(options Options) (*Box, error) {
 		)
 	})
 	dnsTransportManager.Initialize(func() (adapter.DNSTransport, error) {
-		return dnsTransportRegistry.CreateDNSTransport(
+		return local.NewTransport(
 			ctx,
 			logFactory.NewLogger("dns/local"),
 			"local",
-			C.DNSTypeLocal,
-			&option.LocalDNSServerOptions{},
+			option.LocalDNSServerOptions{},
 		)
 	})
 	if platformInterface != nil {
@@ -375,7 +371,7 @@ func New(options Options) (*Box, error) {
 		}
 	}
 	if needCacheFile {
-		cacheFile := cachefile.New(ctx, logFactory.NewLogger("cache-file"), common.PtrValueOrDefault(experimentalOptions.CacheFile))
+		cacheFile := cachefile.New(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
 		service.MustRegister[adapter.CacheFile](ctx, cacheFile)
 		internalServices = append(internalServices, cacheFile)
 	}
@@ -490,7 +486,7 @@ func (s *Box) preStart() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.outbound, s.dnsTransport, s.network, s.connection, s.router, s.dnsRouter)
+	err = adapter.Start(s.logger, adapter.StartStateStart, s.outbound, s.dnsTransport, s.dnsRouter, s.network, s.connection, s.router)
 	if err != nil {
 		return err
 	}
@@ -600,10 +596,6 @@ func (s *Box) Outbound() adapter.OutboundManager {
 	return s.outbound
 }
 
-func (s *Box) Endpoint() adapter.EndpointManager {
-	return s.endpoint
-}
-
 func (s *Box) LogFactory() log.Factory {
 	return s.logFactory
 }

cmd/sing-box/cmd_rule_set_compile.go

@@ -82,11 +82,6 @@ func compileRuleSet(sourcePath string) error {
 }
 
 func downgradeRuleSetVersion(version uint8, options option.PlainRuleSet) uint8 {
-	if version == C.RuleSetVersion5 && !rule.HasHeadlessRule(options.Rules, func(rule option.DefaultHeadlessRule) bool {
-		return len(rule.PackageNameRegex) > 0
-	}) {
-		version = C.RuleSetVersion4
-	}
 	if version == C.RuleSetVersion4 && !rule.HasHeadlessRule(options.Rules, func(rule option.DefaultHeadlessRule) bool {
 		return rule.NetworkInterfaceAddress != nil && rule.NetworkInterfaceAddress.Size() > 0 ||
 			len(rule.DefaultInterfaceAddress) > 0

cmd/sing-box/cmd_tools_networkquality.go

@@ -1,121 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/common/networkquality"
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	commandNetworkQualityFlagConfigURL  string
-	commandNetworkQualityFlagSerial     bool
-	commandNetworkQualityFlagMaxRuntime int
-	commandNetworkQualityFlagHTTP3      bool
-)
-
-var commandNetworkQuality = &cobra.Command{
-	Use:   "networkquality",
-	Short: "Run a network quality test",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := runNetworkQuality()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandNetworkQuality.Flags().StringVar(
-		&commandNetworkQualityFlagConfigURL,
-		"config-url", "",
-		"Network quality test config URL (default: Apple mensura)",
-	)
-	commandNetworkQuality.Flags().BoolVar(
-		&commandNetworkQualityFlagSerial,
-		"serial", false,
-		"Run download and upload tests sequentially instead of in parallel",
-	)
-	commandNetworkQuality.Flags().IntVar(
-		&commandNetworkQualityFlagMaxRuntime,
-		"max-runtime", int(networkquality.DefaultMaxRuntime/time.Second),
-		"Network quality maximum runtime in seconds",
-	)
-	commandNetworkQuality.Flags().BoolVar(
-		&commandNetworkQualityFlagHTTP3,
-		"http3", false,
-		"Use HTTP/3 (QUIC) for measurement traffic",
-	)
-	commandTools.AddCommand(commandNetworkQuality)
-}
-
-func runNetworkQuality() error {
-	instance, err := createPreStartedClient()
-	if err != nil {
-		return err
-	}
-	defer instance.Close()
-
-	dialer, err := createDialer(instance, commandToolsFlagOutbound)
-	if err != nil {
-		return err
-	}
-
-	httpClient := networkquality.NewHTTPClient(dialer)
-	defer httpClient.CloseIdleConnections()
-
-	measurementClientFactory, err := networkquality.NewOptionalHTTP3Factory(dialer, commandNetworkQualityFlagHTTP3)
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr, "==== NETWORK QUALITY TEST ====")
-
-	result, err := networkquality.Run(networkquality.Options{
-		ConfigURL:            commandNetworkQualityFlagConfigURL,
-		HTTPClient:           httpClient,
-		NewMeasurementClient: measurementClientFactory,
-		Serial:               commandNetworkQualityFlagSerial,
-		MaxRuntime:           time.Duration(commandNetworkQualityFlagMaxRuntime) * time.Second,
-		Context:              globalCtx,
-		OnProgress: func(p networkquality.Progress) {
-			if !commandNetworkQualityFlagSerial && p.Phase != networkquality.PhaseIdle {
-				fmt.Fprintf(os.Stderr, "\rDownload: %s  RPM: %d  Upload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.DownloadCapacity), p.DownloadRPM,
-					networkquality.FormatBitrate(p.UploadCapacity), p.UploadRPM)
-				return
-			}
-			switch networkquality.Phase(p.Phase) {
-			case networkquality.PhaseIdle:
-				if p.IdleLatencyMs > 0 {
-					fmt.Fprintf(os.Stderr, "\rIdle Latency: %d ms", p.IdleLatencyMs)
-				} else {
-					fmt.Fprint(os.Stderr, "\rMeasuring idle latency...")
-				}
-			case networkquality.PhaseDownload:
-				fmt.Fprintf(os.Stderr, "\rDownload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.DownloadCapacity), p.DownloadRPM)
-			case networkquality.PhaseUpload:
-				fmt.Fprintf(os.Stderr, "\rUpload: %s  RPM: %d",
-					networkquality.FormatBitrate(p.UploadCapacity), p.UploadRPM)
-			}
-		},
-	})
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr)
-	fmt.Fprintln(os.Stderr, strings.Repeat("-", 40))
-	fmt.Fprintf(os.Stderr, "Idle Latency:            %d ms\n", result.IdleLatencyMs)
-	fmt.Fprintf(os.Stderr, "Download Capacity:       %-20s Accuracy: %s\n", networkquality.FormatBitrate(result.DownloadCapacity), result.DownloadCapacityAccuracy)
-	fmt.Fprintf(os.Stderr, "Upload Capacity:         %-20s Accuracy: %s\n", networkquality.FormatBitrate(result.UploadCapacity), result.UploadCapacityAccuracy)
-	fmt.Fprintf(os.Stderr, "Download Responsiveness: %-20s Accuracy: %s\n", fmt.Sprintf("%d RPM", result.DownloadRPM), result.DownloadRPMAccuracy)
-	fmt.Fprintf(os.Stderr, "Upload Responsiveness:   %-20s Accuracy: %s\n", fmt.Sprintf("%d RPM", result.UploadRPM), result.UploadRPMAccuracy)
-	return nil
-}

cmd/sing-box/cmd_tools_stun.go

@@ -1,79 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/sagernet/sing-box/common/stun"
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var commandSTUNFlagServer string
-
-var commandSTUN = &cobra.Command{
-	Use:   "stun",
-	Short: "Run a STUN test",
-	Args:  cobra.NoArgs,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := runSTUN()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandSTUN.Flags().StringVarP(&commandSTUNFlagServer, "server", "s", stun.DefaultServer, "STUN server address")
-	commandTools.AddCommand(commandSTUN)
-}
-
-func runSTUN() error {
-	instance, err := createPreStartedClient()
-	if err != nil {
-		return err
-	}
-	defer instance.Close()
-
-	dialer, err := createDialer(instance, commandToolsFlagOutbound)
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr, "==== STUN TEST ====")
-
-	result, err := stun.Run(stun.Options{
-		Server:  commandSTUNFlagServer,
-		Dialer:  dialer,
-		Context: globalCtx,
-		OnProgress: func(p stun.Progress) {
-			switch p.Phase {
-			case stun.PhaseBinding:
-				if p.ExternalAddr != "" {
-					fmt.Fprintf(os.Stderr, "\rExternal Address: %s (%d ms)", p.ExternalAddr, p.LatencyMs)
-				} else {
-					fmt.Fprint(os.Stderr, "\rSending binding request...")
-				}
-			case stun.PhaseNATMapping:
-				fmt.Fprint(os.Stderr, "\rDetecting NAT mapping behavior...")
-			case stun.PhaseNATFiltering:
-				fmt.Fprint(os.Stderr, "\rDetecting NAT filtering behavior...")
-			}
-		},
-	})
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintln(os.Stderr)
-	fmt.Fprintf(os.Stderr, "External Address: %s\n", result.ExternalAddr)
-	fmt.Fprintf(os.Stderr, "Latency:          %d ms\n", result.LatencyMs)
-	if result.NATTypeSupported {
-		fmt.Fprintf(os.Stderr, "NAT Mapping:      %s\n", result.NATMapping)
-		fmt.Fprintf(os.Stderr, "NAT Filtering:    %s\n", result.NATFiltering)
-	} else {
-		fmt.Fprintln(os.Stderr, "NAT Type Detection: not supported by server")
-	}
-	return nil
-}

common/dialer/default.go

@@ -149,10 +149,7 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 	} else {
 		dialer.Timeout = C.TCPConnectTimeout
 	}
-	if options.DisableTCPKeepAlive {
-		dialer.KeepAlive = -1
-		dialer.KeepAliveConfig.Enable = false
-	} else {
+	if !options.DisableTCPKeepAlive {
 		keepIdle := time.Duration(options.TCPKeepAlive)
 		if keepIdle == 0 {
 			keepIdle = C.TCPKeepAliveInitial

common/dialer/dialer.go

@@ -87,12 +87,11 @@ func NewWithOptions(options Options) (N.Dialer, error) {
 			}
 			server = dialOptions.DomainResolver.Server
 			dnsQueryOptions = adapter.DNSQueryOptions{
-				Transport:              transport,
-				Strategy:               strategy,
-				DisableCache:           dialOptions.DomainResolver.DisableCache,
-				DisableOptimisticCache: dialOptions.DomainResolver.DisableOptimisticCache,
-				RewriteTTL:             dialOptions.DomainResolver.RewriteTTL,
-				ClientSubnet:           dialOptions.DomainResolver.ClientSubnet.Build(netip.Prefix{}),
+				Transport:    transport,
+				Strategy:     strategy,
+				DisableCache: dialOptions.DomainResolver.DisableCache,
+				RewriteTTL:   dialOptions.DomainResolver.RewriteTTL,
+				ClientSubnet: dialOptions.DomainResolver.ClientSubnet.Build(netip.Prefix{}),
 			}
 			resolveFallbackDelay = time.Duration(dialOptions.FallbackDelay)
 		} else if options.DirectResolver {

common/listener/listener_tcp.go

@@ -37,10 +37,7 @@ func (l *Listener) ListenTCP() (net.Listener, error) {
 	if l.listenOptions.ReuseAddr {
 		listenConfig.Control = control.Append(listenConfig.Control, control.ReuseAddr())
 	}
-	if l.listenOptions.DisableTCPKeepAlive {
-		listenConfig.KeepAlive = -1
-		listenConfig.KeepAliveConfig.Enable = false
-	} else {
+	if !l.listenOptions.DisableTCPKeepAlive {
 		keepIdle := time.Duration(l.listenOptions.TCPKeepAlive)
 		if keepIdle == 0 {
 			keepIdle = C.TCPKeepAliveInitial

common/networkquality/http.go

@@ -1,142 +0,0 @@
-package networkquality
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"strings"
-
-	C "github.com/sagernet/sing-box/constant"
-	sBufio "github.com/sagernet/sing/common/bufio"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func FormatBitrate(bps int64) string {
-	switch {
-	case bps >= 1_000_000_000:
-		return fmt.Sprintf("%.1f Gbps", float64(bps)/1_000_000_000)
-	case bps >= 1_000_000:
-		return fmt.Sprintf("%.1f Mbps", float64(bps)/1_000_000)
-	case bps >= 1_000:
-		return fmt.Sprintf("%.1f Kbps", float64(bps)/1_000)
-	default:
-		return fmt.Sprintf("%d bps", bps)
-	}
-}
-
-func NewHTTPClient(dialer N.Dialer) *http.Client {
-	transport := &http.Transport{
-		ForceAttemptHTTP2:   true,
-		TLSHandshakeTimeout: C.TCPTimeout,
-	}
-	if dialer != nil {
-		transport.DialContext = func(ctx context.Context, network string, addr string) (net.Conn, error) {
-			return dialer.DialContext(ctx, network, M.ParseSocksaddr(addr))
-		}
-	}
-	return &http.Client{Transport: transport}
-}
-
-func baseTransportFromClient(client *http.Client) (*http.Transport, error) {
-	if client == nil {
-		return nil, E.New("http client is nil")
-	}
-	if client.Transport == nil {
-		return http.DefaultTransport.(*http.Transport).Clone(), nil
-	}
-	transport, ok := client.Transport.(*http.Transport)
-	if !ok {
-		return nil, E.New("http client transport must be *http.Transport")
-	}
-	return transport.Clone(), nil
-}
-
-func newMeasurementClient(
-	baseClient *http.Client,
-	connectEndpoint string,
-	singleConnection bool,
-	disableKeepAlives bool,
-	readCounters []N.CountFunc,
-	writeCounters []N.CountFunc,
-) (*http.Client, error) {
-	transport, err := baseTransportFromClient(baseClient)
-	if err != nil {
-		return nil, err
-	}
-	transport.DisableCompression = true
-	transport.DisableKeepAlives = disableKeepAlives
-	if singleConnection {
-		transport.MaxConnsPerHost = 1
-		transport.MaxIdleConnsPerHost = 1
-		transport.MaxIdleConns = 1
-	}
-
-	baseDialContext := transport.DialContext
-	if baseDialContext == nil {
-		dialer := &net.Dialer{}
-		baseDialContext = dialer.DialContext
-	}
-	transport.DialContext = func(ctx context.Context, network string, addr string) (net.Conn, error) {
-		dialAddr := addr
-		if connectEndpoint != "" {
-			dialAddr = rewriteDialAddress(addr, connectEndpoint)
-		}
-		conn, dialErr := baseDialContext(ctx, network, dialAddr)
-		if dialErr != nil {
-			return nil, dialErr
-		}
-		if len(readCounters) > 0 || len(writeCounters) > 0 {
-			return sBufio.NewCounterConn(conn, readCounters, writeCounters), nil
-		}
-		return conn, nil
-	}
-
-	return &http.Client{
-		Transport:     transport,
-		CheckRedirect: baseClient.CheckRedirect,
-		Jar:           baseClient.Jar,
-		Timeout:       baseClient.Timeout,
-	}, nil
-}
-
-type MeasurementClientFactory func(
-	connectEndpoint string,
-	singleConnection bool,
-	disableKeepAlives bool,
-	readCounters []N.CountFunc,
-	writeCounters []N.CountFunc,
-) (*http.Client, error)
-
-func defaultMeasurementClientFactory(baseClient *http.Client) MeasurementClientFactory {
-	return func(connectEndpoint string, singleConnection, disableKeepAlives bool, readCounters, writeCounters []N.CountFunc) (*http.Client, error) {
-		return newMeasurementClient(baseClient, connectEndpoint, singleConnection, disableKeepAlives, readCounters, writeCounters)
-	}
-}
-
-func NewOptionalHTTP3Factory(dialer N.Dialer, useHTTP3 bool) (MeasurementClientFactory, error) {
-	if !useHTTP3 {
-		return nil, nil
-	}
-	return NewHTTP3MeasurementClientFactory(dialer)
-}
-
-func rewriteDialAddress(addr string, connectEndpoint string) string {
-	connectEndpoint = strings.TrimSpace(connectEndpoint)
-	host, port, err := net.SplitHostPort(addr)
-	if err != nil {
-		return addr
-	}
-	endpointHost, endpointPort, err := net.SplitHostPort(connectEndpoint)
-	if err == nil {
-		host = endpointHost
-		if endpointPort != "" {
-			port = endpointPort
-		}
-	} else if connectEndpoint != "" {
-		host = connectEndpoint
-	}
-	return net.JoinHostPort(host, port)
-}

common/networkquality/http3.go

@@ -1,55 +0,0 @@
-//go:build with_quic
-
-package networkquality
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-	"net/http"
-
-	"github.com/sagernet/quic-go"
-	"github.com/sagernet/quic-go/http3"
-	sBufio "github.com/sagernet/sing/common/bufio"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func NewHTTP3MeasurementClientFactory(dialer N.Dialer) (MeasurementClientFactory, error) {
-	// singleConnection and disableKeepAlives are not applied:
-	// HTTP/3 multiplexes streams over a single QUIC connection by default.
-	return func(connectEndpoint string, _, _ bool, readCounters, writeCounters []N.CountFunc) (*http.Client, error) {
-		transport := &http3.Transport{
-			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
-				dialAddr := addr
-				if connectEndpoint != "" {
-					dialAddr = rewriteDialAddress(addr, connectEndpoint)
-				}
-				destination := M.ParseSocksaddr(dialAddr)
-				var udpConn net.Conn
-				var dialErr error
-				if dialer != nil {
-					udpConn, dialErr = dialer.DialContext(ctx, N.NetworkUDP, destination)
-				} else {
-					var netDialer net.Dialer
-					udpConn, dialErr = netDialer.DialContext(ctx, N.NetworkUDP, destination.String())
-				}
-				if dialErr != nil {
-					return nil, dialErr
-				}
-				wrappedConn := udpConn
-				if len(readCounters) > 0 || len(writeCounters) > 0 {
-					wrappedConn = sBufio.NewCounterConn(udpConn, readCounters, writeCounters)
-				}
-				packetConn := sBufio.NewUnbindPacketConn(wrappedConn)
-				quicConn, dialErr := quic.DialEarly(ctx, packetConn, udpConn.RemoteAddr(), tlsCfg, cfg)
-				if dialErr != nil {
-					udpConn.Close()
-					return nil, dialErr
-				}
-				return quicConn, nil
-			},
-		}
-		return &http.Client{Transport: transport}, nil
-	}, nil
-}

common/networkquality/http3_stub.go

@@ -1,12 +0,0 @@
-//go:build !with_quic
-
-package networkquality
-
-import (
-	C "github.com/sagernet/sing-box/constant"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func NewHTTP3MeasurementClientFactory(dialer N.Dialer) (MeasurementClientFactory, error) {
-	return nil, C.ErrQUICNotIncluded
-}

common/srs/binary.go

@@ -46,7 +46,6 @@ const (
 	ruleItemNetworkIsConstrained
 	ruleItemNetworkInterfaceAddress
 	ruleItemDefaultInterfaceAddress
-	ruleItemPackageNameRegex
 	ruleItemFinal uint8 = 0xFF
 )
 
@@ -216,8 +215,6 @@ func readDefaultRule(reader varbin.Reader, recover bool) (rule option.DefaultHea
 			rule.ProcessPathRegex, err = readRuleItemString(reader)
 		case ruleItemPackageName:
 			rule.PackageName, err = readRuleItemString(reader)
-		case ruleItemPackageNameRegex:
-			rule.PackageNameRegex, err = readRuleItemString(reader)
 		case ruleItemWIFISSID:
 			rule.WIFISSID, err = readRuleItemString(reader)
 		case ruleItemWIFIBSSID:
@@ -397,15 +394,6 @@ func writeDefaultRule(writer varbin.Writer, rule option.DefaultHeadlessRule, gen
 			return err
 		}
 	}
-	if len(rule.PackageNameRegex) > 0 {
-		if generateVersion < C.RuleSetVersion5 {
-			return E.New("`package_name_regex` rule item is only supported in version 5 or later")
-		}
-		err = writeRuleItemString(writer, ruleItemPackageNameRegex, rule.PackageNameRegex)
-		if err != nil {
-			return err
-		}
-	}
 	if len(rule.NetworkType) > 0 {
 		if generateVersion < C.RuleSetVersion3 {
 			return E.New("`network_type` rule item is only supported in version 3 or later")

common/stun/stun.go

@@ -1,612 +0,0 @@
-package stun
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/binary"
-	"fmt"
-	"net"
-	"net/netip"
-	"time"
-
-	"github.com/sagernet/sing/common/bufio"
-	"github.com/sagernet/sing/common/bufio/deadline"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-const (
-	DefaultServer = "stun.voipgate.com:3478"
-
-	magicCookie = 0x2112A442
-	headerSize  = 20
-
-	bindingRequest         = 0x0001
-	bindingSuccessResponse = 0x0101
-	bindingErrorResponse   = 0x0111
-
-	attrMappedAddress    = 0x0001
-	attrChangeRequest    = 0x0003
-	attrErrorCode        = 0x0009
-	attrXORMappedAddress = 0x0020
-	attrOtherAddress     = 0x802c
-
-	familyIPv4 = 0x01
-	familyIPv6 = 0x02
-
-	changeIP   = 0x04
-	changePort = 0x02
-
-	defaultRTO    = 500 * time.Millisecond
-	minRTO        = 250 * time.Millisecond
-	maxRetransmit = 2
-)
-
-type Phase int32
-
-const (
-	PhaseBinding Phase = iota
-	PhaseNATMapping
-	PhaseNATFiltering
-	PhaseDone
-)
-
-type NATMapping int32
-
-const (
-	NATMappingUnknown NATMapping = iota
-	_                            // reserved
-	NATMappingEndpointIndependent
-	NATMappingAddressDependent
-	NATMappingAddressAndPortDependent
-)
-
-func (m NATMapping) String() string {
-	switch m {
-	case NATMappingEndpointIndependent:
-		return "Endpoint Independent"
-	case NATMappingAddressDependent:
-		return "Address Dependent"
-	case NATMappingAddressAndPortDependent:
-		return "Address and Port Dependent"
-	default:
-		return "Unknown"
-	}
-}
-
-type NATFiltering int32
-
-const (
-	NATFilteringUnknown NATFiltering = iota
-	NATFilteringEndpointIndependent
-	NATFilteringAddressDependent
-	NATFilteringAddressAndPortDependent
-)
-
-func (f NATFiltering) String() string {
-	switch f {
-	case NATFilteringEndpointIndependent:
-		return "Endpoint Independent"
-	case NATFilteringAddressDependent:
-		return "Address Dependent"
-	case NATFilteringAddressAndPortDependent:
-		return "Address and Port Dependent"
-	default:
-		return "Unknown"
-	}
-}
-
-type TransactionID [12]byte
-
-type Options struct {
-	Server     string
-	Dialer     N.Dialer
-	Context    context.Context
-	OnProgress func(Progress)
-}
-
-type Progress struct {
-	Phase        Phase
-	ExternalAddr string
-	LatencyMs    int32
-	NATMapping   NATMapping
-	NATFiltering NATFiltering
-}
-
-type Result struct {
-	ExternalAddr     string
-	LatencyMs        int32
-	NATMapping       NATMapping
-	NATFiltering     NATFiltering
-	NATTypeSupported bool
-}
-
-type parsedResponse struct {
-	xorMappedAddr netip.AddrPort
-	mappedAddr    netip.AddrPort
-	otherAddr     netip.AddrPort
-}
-
-func (r *parsedResponse) externalAddr() (netip.AddrPort, bool) {
-	if r.xorMappedAddr.IsValid() {
-		return r.xorMappedAddr, true
-	}
-	if r.mappedAddr.IsValid() {
-		return r.mappedAddr, true
-	}
-	return netip.AddrPort{}, false
-}
-
-type stunAttribute struct {
-	typ   uint16
-	value []byte
-}
-
-func newTransactionID() TransactionID {
-	var id TransactionID
-	_, _ = rand.Read(id[:])
-	return id
-}
-
-func buildBindingRequest(txID TransactionID, attrs ...stunAttribute) []byte {
-	attrLen := 0
-	for _, attr := range attrs {
-		attrLen += 4 + len(attr.value) + paddingLen(len(attr.value))
-	}
-
-	buf := make([]byte, headerSize+attrLen)
-	binary.BigEndian.PutUint16(buf[0:2], bindingRequest)
-	binary.BigEndian.PutUint16(buf[2:4], uint16(attrLen))
-	binary.BigEndian.PutUint32(buf[4:8], magicCookie)
-	copy(buf[8:20], txID[:])
-
-	offset := headerSize
-	for _, attr := range attrs {
-		binary.BigEndian.PutUint16(buf[offset:offset+2], attr.typ)
-		binary.BigEndian.PutUint16(buf[offset+2:offset+4], uint16(len(attr.value)))
-		copy(buf[offset+4:offset+4+len(attr.value)], attr.value)
-		offset += 4 + len(attr.value) + paddingLen(len(attr.value))
-	}
-
-	return buf
-}
-
-func changeRequestAttr(flags byte) stunAttribute {
-	return stunAttribute{
-		typ:   attrChangeRequest,
-		value: []byte{0, 0, 0, flags},
-	}
-}
-
-func parseResponse(data []byte, expectedTxID TransactionID) (*parsedResponse, error) {
-	if len(data) < headerSize {
-		return nil, E.New("response too short")
-	}
-
-	msgType := binary.BigEndian.Uint16(data[0:2])
-	if msgType&0xC000 != 0 {
-		return nil, E.New("invalid STUN message: top 2 bits not zero")
-	}
-
-	cookie := binary.BigEndian.Uint32(data[4:8])
-	if cookie != magicCookie {
-		return nil, E.New("invalid magic cookie")
-	}
-
-	var txID TransactionID
-	copy(txID[:], data[8:20])
-	if txID != expectedTxID {
-		return nil, E.New("transaction ID mismatch")
-	}
-
-	msgLen := int(binary.BigEndian.Uint16(data[2:4]))
-	if msgLen > len(data)-headerSize {
-		return nil, E.New("message length exceeds data")
-	}
-
-	attrData := data[headerSize : headerSize+msgLen]
-
-	if msgType == bindingErrorResponse {
-		return nil, parseErrorResponse(attrData)
-	}
-	if msgType != bindingSuccessResponse {
-		return nil, E.New("unexpected message type: ", fmt.Sprintf("0x%04x", msgType))
-	}
-
-	resp := &parsedResponse{}
-	offset := 0
-	for offset+4 <= len(attrData) {
-		attrType := binary.BigEndian.Uint16(attrData[offset : offset+2])
-		attrLen := int(binary.BigEndian.Uint16(attrData[offset+2 : offset+4]))
-		if offset+4+attrLen > len(attrData) {
-			break
-		}
-		attrValue := attrData[offset+4 : offset+4+attrLen]
-
-		switch attrType {
-		case attrXORMappedAddress:
-			addr, err := parseXORMappedAddress(attrValue, txID)
-			if err == nil {
-				resp.xorMappedAddr = addr
-			}
-		case attrMappedAddress:
-			addr, err := parseMappedAddress(attrValue)
-			if err == nil {
-				resp.mappedAddr = addr
-			}
-		case attrOtherAddress:
-			addr, err := parseMappedAddress(attrValue)
-			if err == nil {
-				resp.otherAddr = addr
-			}
-		}
-
-		offset += 4 + attrLen + paddingLen(attrLen)
-	}
-
-	return resp, nil
-}
-
-func parseErrorResponse(data []byte) error {
-	offset := 0
-	for offset+4 <= len(data) {
-		attrType := binary.BigEndian.Uint16(data[offset : offset+2])
-		attrLen := int(binary.BigEndian.Uint16(data[offset+2 : offset+4]))
-		if offset+4+attrLen > len(data) {
-			break
-		}
-		if attrType == attrErrorCode && attrLen >= 4 {
-			attrValue := data[offset+4 : offset+4+attrLen]
-			class := int(attrValue[2] & 0x07)
-			number := int(attrValue[3])
-			code := class*100 + number
-			if attrLen > 4 {
-				return E.New("STUN error ", code, ": ", string(attrValue[4:]))
-			}
-			return E.New("STUN error ", code)
-		}
-		offset += 4 + attrLen + paddingLen(attrLen)
-	}
-	return E.New("STUN error response")
-}
-
-func parseXORMappedAddress(data []byte, txID TransactionID) (netip.AddrPort, error) {
-	if len(data) < 4 {
-		return netip.AddrPort{}, E.New("XOR-MAPPED-ADDRESS too short")
-	}
-
-	family := data[1]
-	xPort := binary.BigEndian.Uint16(data[2:4])
-	port := xPort ^ uint16(magicCookie>>16)
-
-	switch family {
-	case familyIPv4:
-		if len(data) < 8 {
-			return netip.AddrPort{}, E.New("XOR-MAPPED-ADDRESS IPv4 too short")
-		}
-		var ip [4]byte
-		binary.BigEndian.PutUint32(ip[:], binary.BigEndian.Uint32(data[4:8])^magicCookie)
-		return netip.AddrPortFrom(netip.AddrFrom4(ip), port), nil
-	case familyIPv6:
-		if len(data) < 20 {
-			return netip.AddrPort{}, E.New("XOR-MAPPED-ADDRESS IPv6 too short")
-		}
-		var ip [16]byte
-		var xorKey [16]byte
-		binary.BigEndian.PutUint32(xorKey[0:4], magicCookie)
-		copy(xorKey[4:16], txID[:])
-		for i := range 16 {
-			ip[i] = data[4+i] ^ xorKey[i]
-		}
-		return netip.AddrPortFrom(netip.AddrFrom16(ip), port), nil
-	default:
-		return netip.AddrPort{}, E.New("unknown address family: ", family)
-	}
-}
-
-func parseMappedAddress(data []byte) (netip.AddrPort, error) {
-	if len(data) < 4 {
-		return netip.AddrPort{}, E.New("MAPPED-ADDRESS too short")
-	}
-
-	family := data[1]
-	port := binary.BigEndian.Uint16(data[2:4])
-
-	switch family {
-	case familyIPv4:
-		if len(data) < 8 {
-			return netip.AddrPort{}, E.New("MAPPED-ADDRESS IPv4 too short")
-		}
-		return netip.AddrPortFrom(
-			netip.AddrFrom4([4]byte{data[4], data[5], data[6], data[7]}), port,
-		), nil
-	case familyIPv6:
-		if len(data) < 20 {
-			return netip.AddrPort{}, E.New("MAPPED-ADDRESS IPv6 too short")
-		}
-		var ip [16]byte
-		copy(ip[:], data[4:20])
-		return netip.AddrPortFrom(netip.AddrFrom16(ip), port), nil
-	default:
-		return netip.AddrPort{}, E.New("unknown address family: ", family)
-	}
-}
-
-func roundTrip(conn net.PacketConn, addr net.Addr, txID TransactionID, attrs []stunAttribute, rto time.Duration) (*parsedResponse, time.Duration, error) {
-	request := buildBindingRequest(txID, attrs...)
-	currentRTO := rto
-	retransmitCount := 0
-
-	sendTime := time.Now()
-	_, err := conn.WriteTo(request, addr)
-	if err != nil {
-		return nil, 0, E.Cause(err, "send STUN request")
-	}
-
-	buf := make([]byte, 1024)
-	for {
-		err = conn.SetReadDeadline(sendTime.Add(currentRTO))
-		if err != nil {
-			return nil, 0, E.Cause(err, "set read deadline")
-		}
-
-		n, _, readErr := conn.ReadFrom(buf)
-		if readErr != nil {
-			if E.IsTimeout(readErr) && retransmitCount < maxRetransmit {
-				retransmitCount++
-				currentRTO *= 2
-				sendTime = time.Now()
-				_, err = conn.WriteTo(request, addr)
-				if err != nil {
-					return nil, 0, E.Cause(err, "retransmit STUN request")
-				}
-				continue
-			}
-			return nil, 0, E.Cause(readErr, "read STUN response")
-		}
-
-		if n < headerSize || buf[0]&0xC0 != 0 ||
-			binary.BigEndian.Uint32(buf[4:8]) != magicCookie {
-			continue
-		}
-		var receivedTxID TransactionID
-		copy(receivedTxID[:], buf[8:20])
-		if receivedTxID != txID {
-			continue
-		}
-
-		latency := time.Since(sendTime)
-
-		resp, parseErr := parseResponse(buf[:n], txID)
-		if parseErr != nil {
-			return nil, 0, parseErr
-		}
-
-		return resp, latency, nil
-	}
-}
-
-func Run(options Options) (*Result, error) {
-	ctx := options.Context
-	if ctx == nil {
-		ctx = context.Background()
-	}
-
-	server := options.Server
-	if server == "" {
-		server = DefaultServer
-	}
-	serverSocksaddr := M.ParseSocksaddr(server)
-	if serverSocksaddr.Port == 0 {
-		serverSocksaddr.Port = 3478
-	}
-
-	reportProgress := options.OnProgress
-	if reportProgress == nil {
-		reportProgress = func(Progress) {}
-	}
-
-	var (
-		packetConn net.PacketConn
-		serverAddr net.Addr
-		err        error
-	)
-
-	if options.Dialer != nil {
-		packetConn, err = options.Dialer.ListenPacket(ctx, serverSocksaddr)
-		if err != nil {
-			return nil, E.Cause(err, "create UDP socket")
-		}
-		serverAddr = serverSocksaddr
-	} else {
-		serverUDPAddr, resolveErr := net.ResolveUDPAddr("udp", serverSocksaddr.String())
-		if resolveErr != nil {
-			return nil, E.Cause(resolveErr, "resolve STUN server")
-		}
-		packetConn, err = net.ListenPacket("udp", "")
-		if err != nil {
-			return nil, E.Cause(err, "create UDP socket")
-		}
-		serverAddr = serverUDPAddr
-	}
-	defer func() {
-		_ = packetConn.Close()
-	}()
-	if deadline.NeedAdditionalReadDeadline(packetConn) {
-		packetConn = deadline.NewPacketConn(bufio.NewPacketConn(packetConn))
-	}
-
-	select {
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	default:
-	}
-
-	rto := defaultRTO
-
-	// Phase 1: Binding
-	reportProgress(Progress{Phase: PhaseBinding})
-
-	txID := newTransactionID()
-	resp, latency, err := roundTrip(packetConn, serverAddr, txID, nil, rto)
-	if err != nil {
-		return nil, E.Cause(err, "binding request")
-	}
-
-	rto = max(minRTO, 3*latency)
-
-	externalAddr, ok := resp.externalAddr()
-	if !ok {
-		return nil, E.New("no mapped address in response")
-	}
-
-	result := &Result{
-		ExternalAddr: externalAddr.String(),
-		LatencyMs:    int32(latency.Milliseconds()),
-	}
-
-	reportProgress(Progress{
-		Phase:        PhaseBinding,
-		ExternalAddr: result.ExternalAddr,
-		LatencyMs:    result.LatencyMs,
-	})
-
-	otherAddr := resp.otherAddr
-	if !otherAddr.IsValid() {
-		result.NATTypeSupported = false
-		reportProgress(Progress{
-			Phase:        PhaseDone,
-			ExternalAddr: result.ExternalAddr,
-			LatencyMs:    result.LatencyMs,
-		})
-		return result, nil
-	}
-	result.NATTypeSupported = true
-
-	select {
-	case <-ctx.Done():
-		return result, nil
-	default:
-	}
-
-	// Phase 2: NAT Mapping Detection (RFC 5780 Section 4.3)
-	reportProgress(Progress{
-		Phase:        PhaseNATMapping,
-		ExternalAddr: result.ExternalAddr,
-		LatencyMs:    result.LatencyMs,
-	})
-
-	result.NATMapping = detectNATMapping(
-		packetConn, serverSocksaddr.Port, externalAddr, otherAddr, rto,
-	)
-
-	reportProgress(Progress{
-		Phase:        PhaseNATMapping,
-		ExternalAddr: result.ExternalAddr,
-		LatencyMs:    result.LatencyMs,
-		NATMapping:   result.NATMapping,
-	})
-
-	select {
-	case <-ctx.Done():
-		return result, nil
-	default:
-	}
-
-	// Phase 3: NAT Filtering Detection (RFC 5780 Section 4.4)
-	reportProgress(Progress{
-		Phase:        PhaseNATFiltering,
-		ExternalAddr: result.ExternalAddr,
-		LatencyMs:    result.LatencyMs,
-		NATMapping:   result.NATMapping,
-	})
-
-	result.NATFiltering = detectNATFiltering(packetConn, serverAddr, rto)
-
-	reportProgress(Progress{
-		Phase:        PhaseDone,
-		ExternalAddr: result.ExternalAddr,
-		LatencyMs:    result.LatencyMs,
-		NATMapping:   result.NATMapping,
-		NATFiltering: result.NATFiltering,
-	})
-
-	return result, nil
-}
-
-func detectNATMapping(
-	conn net.PacketConn,
-	serverPort uint16,
-	externalAddr netip.AddrPort,
-	otherAddr netip.AddrPort,
-	rto time.Duration,
-) NATMapping {
-	// Mapping Test II: Send to other_ip:server_port
-	testIIAddr := net.UDPAddrFromAddrPort(
-		netip.AddrPortFrom(otherAddr.Addr(), serverPort),
-	)
-	txID2 := newTransactionID()
-	resp2, _, err := roundTrip(conn, testIIAddr, txID2, nil, rto)
-	if err != nil {
-		return NATMappingUnknown
-	}
-
-	externalAddr2, ok := resp2.externalAddr()
-	if !ok {
-		return NATMappingUnknown
-	}
-
-	if externalAddr == externalAddr2 {
-		return NATMappingEndpointIndependent
-	}
-
-	// Mapping Test III: Send to other_ip:other_port
-	testIIIAddr := net.UDPAddrFromAddrPort(otherAddr)
-	txID3 := newTransactionID()
-	resp3, _, err := roundTrip(conn, testIIIAddr, txID3, nil, rto)
-	if err != nil {
-		return NATMappingUnknown
-	}
-
-	externalAddr3, ok := resp3.externalAddr()
-	if !ok {
-		return NATMappingUnknown
-	}
-
-	if externalAddr2 == externalAddr3 {
-		return NATMappingAddressDependent
-	}
-	return NATMappingAddressAndPortDependent
-}
-
-func detectNATFiltering(
-	conn net.PacketConn,
-	serverAddr net.Addr,
-	rto time.Duration,
-) NATFiltering {
-	// Filtering Test II: Request response from different IP and port
-	txID := newTransactionID()
-	_, _, err := roundTrip(conn, serverAddr, txID,
-		[]stunAttribute{changeRequestAttr(changeIP | changePort)}, rto)
-	if err == nil {
-		return NATFilteringEndpointIndependent
-	}
-
-	// Filtering Test III: Request response from different port only
-	txID = newTransactionID()
-	_, _, err = roundTrip(conn, serverAddr, txID,
-		[]stunAttribute{changeRequestAttr(changePort)}, rto)
-	if err == nil {
-		return NATFilteringAddressDependent
-	}
-
-	return NATFilteringAddressAndPortDependent
-}
-
-func paddingLen(n int) int {
-	if n%4 == 0 {
-		return 0
-	}
-	return 4 - n%4
-}

common/tls/acme.go

@@ -69,10 +69,21 @@ func startACME(ctx context.Context, logger logger.Logger, options option.Inbound
 		Storage:           storage,
 		Logger:            zapLogger,
 	}
+	profile := options.Profile
+	if profile == "" && acmeServer == certmagic.LetsEncryptProductionCA {
+		for _, domain := range options.Domain {
+			if certmagic.SubjectIsIP(domain) {
+				profile = "shortlived"
+				break
+			}
+		}
+	}
+
 	acmeConfig := certmagic.ACMEIssuer{
 		CA:                      acmeServer,
 		Email:                   options.Email,
 		Agreed:                  true,
+		Profile:                 profile,
 		DisableHTTPChallenge:    options.DisableHTTPChallenge,
 		DisableTLSALPNChallenge: options.DisableTLSALPNChallenge,
 		AltHTTPPort:             int(options.AlternativeHTTPPort),

constant/dns.go

@@ -15,18 +15,19 @@ const (
 )
 
 const (
-	DNSTypeLegacy    = "legacy"
-	DNSTypeUDP       = "udp"
-	DNSTypeTCP       = "tcp"
-	DNSTypeTLS       = "tls"
-	DNSTypeHTTPS     = "https"
-	DNSTypeQUIC      = "quic"
-	DNSTypeHTTP3     = "h3"
-	DNSTypeLocal     = "local"
-	DNSTypeHosts     = "hosts"
-	DNSTypeFakeIP    = "fakeip"
-	DNSTypeDHCP      = "dhcp"
-	DNSTypeTailscale = "tailscale"
+	DNSTypeLegacy      = "legacy"
+	DNSTypeLegacyRcode = "legacy_rcode"
+	DNSTypeUDP         = "udp"
+	DNSTypeTCP         = "tcp"
+	DNSTypeTLS         = "tls"
+	DNSTypeHTTPS       = "https"
+	DNSTypeQUIC        = "quic"
+	DNSTypeHTTP3       = "h3"
+	DNSTypeLocal       = "local"
+	DNSTypeHosts       = "hosts"
+	DNSTypeFakeIP      = "fakeip"
+	DNSTypeDHCP        = "dhcp"
+	DNSTypeTailscale   = "tailscale"
 )
 
 const (

constant/proxy.go

@@ -25,7 +25,6 @@ const (
 	TypeTUIC               = "tuic"
 	TypeHysteria2          = "hysteria2"
 	TypeTailscale          = "tailscale"
-	TypeCloudflared        = "cloudflared"
 	TypeDERP               = "derp"
 	TypeResolved           = "resolved"
 	TypeSSMAPI             = "ssm-api"
@@ -91,8 +90,6 @@ func ProxyDisplayName(proxyType string) string {
 		return "AnyTLS"
 	case TypeTailscale:
 		return "Tailscale"
-	case TypeCloudflared:
-		return "Cloudflared"
 	case TypeSelector:
 		return "Selector"
 	case TypeURLTest:

constant/rule.go

@@ -23,15 +23,12 @@ const (
 	RuleSetVersion2
 	RuleSetVersion3
 	RuleSetVersion4
-	RuleSetVersion5
-	RuleSetVersionCurrent = RuleSetVersion5
+	RuleSetVersionCurrent = RuleSetVersion4
 )
 
 const (
 	RuleActionTypeRoute        = "route"
 	RuleActionTypeRouteOptions = "route-options"
-	RuleActionTypeEvaluate     = "evaluate"
-	RuleActionTypeRespond      = "respond"
 	RuleActionTypeDirect       = "direct"
 	RuleActionTypeBypass       = "bypass"
 	RuleActionTypeReject       = "reject"

daemon/instance.go

@@ -87,17 +87,12 @@ func (s *StartedService) newInstance(profileContent string, overrideOptions *Ove
 			}
 		}
 	}
-	if s.oomKillerEnabled {
+	if s.oomKiller && C.IsIos {
 		if !common.Any(options.Services, func(it option.Service) bool {
 			return it.Type == C.TypeOOMKiller
 		}) {
-			oomOptions := &option.OOMKillerServiceOptions{
-				KillerDisabled:      s.oomKillerDisabled,
-				MemoryLimitOverride: s.oomMemoryLimit,
-			}
 			options.Services = append(options.Services, option.Service{
-				Type:    C.TypeOOMKiller,
-				Options: oomOptions,
+				Type: C.TypeOOMKiller,
 			})
 		}
 	}

daemon/platform.go

@@ -5,6 +5,5 @@ type PlatformHandler interface {
 	ServiceReload() error
 	SystemProxyStatus() (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(enabled bool) error
-	TriggerNativeCrash() error
 	WriteDebugMessage(message string)
 }

daemon/started_service.go

@@ -6,20 +6,14 @@ import (
 	"runtime"
 	"sync"
 	"time"
-	"unsafe"
 
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/dialer"
-	"github.com/sagernet/sing-box/common/networkquality"
-	"github.com/sagernet/sing-box/common/stun"
 	"github.com/sagernet/sing-box/common/urltest"
-	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/experimental/clashapi"
 	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
 	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/protocol/group"
-	"github.com/sagernet/sing-box/service/oomkiller"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/batch"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -30,8 +24,6 @@ import (
 
 	"github.com/gofrs/uuid/v5"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
@@ -40,12 +32,10 @@ var _ StartedServiceServer = (*StartedService)(nil)
 type StartedService struct {
 	ctx context.Context
 	// platform adapter.PlatformInterface
-	handler           PlatformHandler
-	debug             bool
-	logMaxLines       int
-	oomKillerEnabled  bool
-	oomKillerDisabled bool
-	oomMemoryLimit    uint64
+	handler     PlatformHandler
+	debug       bool
+	logMaxLines int
+	oomKiller   bool
 	// workingDirectory string
 	// tempDirectory    string
 	// userID           int
@@ -74,12 +64,10 @@ type StartedService struct {
 type ServiceOptions struct {
 	Context context.Context
 	// Platform           adapter.PlatformInterface
-	Handler           PlatformHandler
-	Debug             bool
-	LogMaxLines       int
-	OOMKillerEnabled  bool
-	OOMKillerDisabled bool
-	OOMMemoryLimit    uint64
+	Handler     PlatformHandler
+	Debug       bool
+	LogMaxLines int
+	OOMKiller   bool
 	// WorkingDirectory   string
 	// TempDirectory      string
 	// UserID             int
@@ -91,12 +79,10 @@ func NewStartedService(options ServiceOptions) *StartedService {
 	s := &StartedService{
 		ctx: options.Context,
 		// platform:                options.Platform,
-		handler:           options.Handler,
-		debug:             options.Debug,
-		logMaxLines:       options.LogMaxLines,
-		oomKillerEnabled:  options.OOMKillerEnabled,
-		oomKillerDisabled: options.OOMKillerDisabled,
-		oomMemoryLimit:    options.OOMMemoryLimit,
+		handler:     options.Handler,
+		debug:       options.Debug,
+		logMaxLines: options.LogMaxLines,
+		oomKiller:   options.OOMKiller,
 		// workingDirectory: options.WorkingDirectory,
 		// tempDirectory:    options.TempDirectory,
 		// userID:           options.UserID,
@@ -696,42 +682,7 @@ func (s *StartedService) SetSystemProxyEnabled(ctx context.Context, request *Set
 	if err != nil {
 		return nil, err
 	}
-	return &emptypb.Empty{}, nil
-}
-
-func (s *StartedService) TriggerDebugCrash(ctx context.Context, request *DebugCrashRequest) (*emptypb.Empty, error) {
-	if !s.debug {
-		return nil, status.Error(codes.PermissionDenied, "debug crash trigger unavailable")
-	}
-	if request == nil {
-		return nil, status.Error(codes.InvalidArgument, "missing debug crash request")
-	}
-	switch request.Type {
-	case DebugCrashRequest_GO:
-		time.AfterFunc(200*time.Millisecond, func() {
-			*(*int)(unsafe.Pointer(uintptr(0))) = 0
-		})
-	case DebugCrashRequest_NATIVE:
-		err := s.handler.TriggerNativeCrash()
-		if err != nil {
-			return nil, err
-		}
-	default:
-		return nil, status.Error(codes.InvalidArgument, "unknown debug crash type")
-	}
-	return &emptypb.Empty{}, nil
-}
-
-func (s *StartedService) TriggerOOMReport(ctx context.Context, _ *emptypb.Empty) (*emptypb.Empty, error) {
-	instance := s.Instance()
-	if instance == nil {
-		return nil, status.Error(codes.FailedPrecondition, "service not started")
-	}
-	reporter := service.FromContext[oomkiller.OOMReporter](instance.ctx)
-	if reporter == nil {
-		return nil, status.Error(codes.Unavailable, "OOM reporter not available")
-	}
-	return &emptypb.Empty{}, reporter.WriteReport(memory.Total())
+	return nil, err
 }
 
 func (s *StartedService) SubscribeConnections(request *SubscribeConnectionsRequest, server grpc.ServerStreamingServer[ConnectionEvents]) error {
@@ -1068,12 +1019,9 @@ func (s *StartedService) GetDeprecatedWarnings(ctx context.Context, empty *empty
 	return &DeprecatedWarnings{
 		Warnings: common.Map(notes, func(it deprecated.Note) *DeprecatedWarning {
 			return &DeprecatedWarning{
-				Message:           it.Message(),
-				Impending:         it.Impending(),
-				MigrationLink:     it.MigrationLink,
-				Description:       it.Description,
-				DeprecatedVersion: it.DeprecatedVersion,
-				ScheduledVersion:  it.ScheduledVersion,
+				Message:       it.Message(),
+				Impending:     it.Impending(),
+				MigrationLink: it.MigrationLink,
 			}
 		}),
 	}, nil
@@ -1085,386 +1033,6 @@ func (s *StartedService) GetStartedAt(ctx context.Context, empty *emptypb.Empty)
 	return &StartedAt{StartedAt: s.startedAt.UnixMilli()}, nil
 }
 
-func (s *StartedService) SubscribeOutbounds(_ *emptypb.Empty, server grpc.ServerStreamingServer[OutboundList]) error {
-	err := s.waitForStarted(server.Context())
-	if err != nil {
-		return err
-	}
-	subscription, done, err := s.urlTestObserver.Subscribe()
-	if err != nil {
-		return err
-	}
-	defer s.urlTestObserver.UnSubscribe(subscription)
-	for {
-		s.serviceAccess.RLock()
-		if s.serviceStatus.Status != ServiceStatus_STARTED {
-			s.serviceAccess.RUnlock()
-			return os.ErrInvalid
-		}
-		boxService := s.instance
-		s.serviceAccess.RUnlock()
-		historyStorage := boxService.urlTestHistoryStorage
-		var list OutboundList
-		for _, ob := range boxService.instance.Outbound().Outbounds() {
-			item := &GroupItem{
-				Tag:  ob.Tag(),
-				Type: ob.Type(),
-			}
-			if history := historyStorage.LoadURLTestHistory(adapter.OutboundTag(ob)); history != nil {
-				item.UrlTestTime = history.Time.Unix()
-				item.UrlTestDelay = int32(history.Delay)
-			}
-			list.Outbounds = append(list.Outbounds, item)
-		}
-		for _, ep := range boxService.instance.Endpoint().Endpoints() {
-			item := &GroupItem{
-				Tag:  ep.Tag(),
-				Type: ep.Type(),
-			}
-			if history := historyStorage.LoadURLTestHistory(adapter.OutboundTag(ep)); history != nil {
-				item.UrlTestTime = history.Time.Unix()
-				item.UrlTestDelay = int32(history.Delay)
-			}
-			list.Outbounds = append(list.Outbounds, item)
-		}
-		err = server.Send(&list)
-		if err != nil {
-			return err
-		}
-		select {
-		case <-subscription:
-		case <-s.ctx.Done():
-			return s.ctx.Err()
-		case <-server.Context().Done():
-			return server.Context().Err()
-		case <-done:
-			return nil
-		}
-	}
-}
-
-func resolveOutbound(instance *Instance, tag string) (adapter.Outbound, error) {
-	if tag == "" {
-		return instance.instance.Outbound().Default(), nil
-	}
-	outbound, loaded := instance.instance.Outbound().Outbound(tag)
-	if !loaded {
-		return nil, E.New("outbound not found: ", tag)
-	}
-	return outbound, nil
-}
-
-func (s *StartedService) StartNetworkQualityTest(
-	request *NetworkQualityTestRequest,
-	server grpc.ServerStreamingServer[NetworkQualityTestProgress],
-) error {
-	err := s.waitForStarted(server.Context())
-	if err != nil {
-		return err
-	}
-	s.serviceAccess.RLock()
-	boxService := s.instance
-	s.serviceAccess.RUnlock()
-
-	outbound, err := resolveOutbound(boxService, request.OutboundTag)
-	if err != nil {
-		return err
-	}
-
-	resolvedDialer := dialer.NewResolveDialer(boxService.ctx, outbound, true, "", adapter.DNSQueryOptions{}, 0)
-	httpClient := networkquality.NewHTTPClient(resolvedDialer)
-	defer httpClient.CloseIdleConnections()
-
-	measurementClientFactory, err := networkquality.NewOptionalHTTP3Factory(resolvedDialer, request.Http3)
-	if err != nil {
-		return err
-	}
-
-	result, nqErr := networkquality.Run(networkquality.Options{
-		ConfigURL:            request.ConfigURL,
-		HTTPClient:           httpClient,
-		NewMeasurementClient: measurementClientFactory,
-		Serial:               request.Serial,
-		MaxRuntime:           time.Duration(request.MaxRuntimeSeconds) * time.Second,
-		Context:              server.Context(),
-		OnProgress: func(p networkquality.Progress) {
-			_ = server.Send(&NetworkQualityTestProgress{
-				Phase:                    int32(p.Phase),
-				DownloadCapacity:         p.DownloadCapacity,
-				UploadCapacity:           p.UploadCapacity,
-				DownloadRPM:              p.DownloadRPM,
-				UploadRPM:                p.UploadRPM,
-				IdleLatencyMs:            p.IdleLatencyMs,
-				ElapsedMs:                p.ElapsedMs,
-				DownloadCapacityAccuracy: int32(p.DownloadCapacityAccuracy),
-				UploadCapacityAccuracy:   int32(p.UploadCapacityAccuracy),
-				DownloadRPMAccuracy:      int32(p.DownloadRPMAccuracy),
-				UploadRPMAccuracy:        int32(p.UploadRPMAccuracy),
-			})
-		},
-	})
-	if nqErr != nil {
-		return server.Send(&NetworkQualityTestProgress{
-			IsFinal: true,
-			Error:   nqErr.Error(),
-		})
-	}
-	return server.Send(&NetworkQualityTestProgress{
-		Phase:                    int32(networkquality.PhaseDone),
-		DownloadCapacity:         result.DownloadCapacity,
-		UploadCapacity:           result.UploadCapacity,
-		DownloadRPM:              result.DownloadRPM,
-		UploadRPM:                result.UploadRPM,
-		IdleLatencyMs:            result.IdleLatencyMs,
-		IsFinal:                  true,
-		DownloadCapacityAccuracy: int32(result.DownloadCapacityAccuracy),
-		UploadCapacityAccuracy:   int32(result.UploadCapacityAccuracy),
-		DownloadRPMAccuracy:      int32(result.DownloadRPMAccuracy),
-		UploadRPMAccuracy:        int32(result.UploadRPMAccuracy),
-	})
-}
-
-func (s *StartedService) StartSTUNTest(
-	request *STUNTestRequest,
-	server grpc.ServerStreamingServer[STUNTestProgress],
-) error {
-	err := s.waitForStarted(server.Context())
-	if err != nil {
-		return err
-	}
-	s.serviceAccess.RLock()
-	boxService := s.instance
-	s.serviceAccess.RUnlock()
-
-	outbound, err := resolveOutbound(boxService, request.OutboundTag)
-	if err != nil {
-		return err
-	}
-
-	resolvedDialer := dialer.NewResolveDialer(boxService.ctx, outbound, true, "", adapter.DNSQueryOptions{}, 0)
-
-	result, stunErr := stun.Run(stun.Options{
-		Server:  request.Server,
-		Dialer:  resolvedDialer,
-		Context: server.Context(),
-		OnProgress: func(p stun.Progress) {
-			_ = server.Send(&STUNTestProgress{
-				Phase:        int32(p.Phase),
-				ExternalAddr: p.ExternalAddr,
-				LatencyMs:    p.LatencyMs,
-				NatMapping:   int32(p.NATMapping),
-				NatFiltering: int32(p.NATFiltering),
-			})
-		},
-	})
-	if stunErr != nil {
-		return server.Send(&STUNTestProgress{
-			IsFinal: true,
-			Error:   stunErr.Error(),
-		})
-	}
-	return server.Send(&STUNTestProgress{
-		Phase:            int32(stun.PhaseDone),
-		ExternalAddr:     result.ExternalAddr,
-		LatencyMs:        result.LatencyMs,
-		NatMapping:       int32(result.NATMapping),
-		NatFiltering:     int32(result.NATFiltering),
-		IsFinal:          true,
-		NatTypeSupported: result.NATTypeSupported,
-	})
-}
-
-func (s *StartedService) SubscribeTailscaleStatus(
-	_ *emptypb.Empty,
-	server grpc.ServerStreamingServer[TailscaleStatusUpdate],
-) error {
-	err := s.waitForStarted(server.Context())
-	if err != nil {
-		return err
-	}
-	s.serviceAccess.RLock()
-	boxService := s.instance
-	s.serviceAccess.RUnlock()
-
-	endpointManager := service.FromContext[adapter.EndpointManager](boxService.ctx)
-	if endpointManager == nil {
-		return status.Error(codes.FailedPrecondition, "endpoint manager not available")
-	}
-
-	type tailscaleEndpoint struct {
-		tag      string
-		provider adapter.TailscaleEndpoint
-	}
-	var endpoints []tailscaleEndpoint
-	for _, endpoint := range endpointManager.Endpoints() {
-		if endpoint.Type() != C.TypeTailscale {
-			continue
-		}
-		provider, loaded := endpoint.(adapter.TailscaleEndpoint)
-		if !loaded {
-			continue
-		}
-		endpoints = append(endpoints, tailscaleEndpoint{
-			tag:      endpoint.Tag(),
-			provider: provider,
-		})
-	}
-	if len(endpoints) == 0 {
-		return status.Error(codes.NotFound, "no Tailscale endpoint found")
-	}
-
-	type taggedStatus struct {
-		tag    string
-		status *adapter.TailscaleEndpointStatus
-	}
-	updates := make(chan taggedStatus, len(endpoints))
-	ctx, cancel := context.WithCancel(server.Context())
-	defer cancel()
-
-	var waitGroup sync.WaitGroup
-	for _, endpoint := range endpoints {
-		waitGroup.Add(1)
-		go func(tag string, provider adapter.TailscaleEndpoint) {
-			defer waitGroup.Done()
-			_ = provider.SubscribeTailscaleStatus(ctx, func(endpointStatus *adapter.TailscaleEndpointStatus) {
-				select {
-				case updates <- taggedStatus{tag: tag, status: endpointStatus}:
-				case <-ctx.Done():
-				}
-			})
-		}(endpoint.tag, endpoint.provider)
-	}
-
-	go func() {
-		waitGroup.Wait()
-		close(updates)
-	}()
-
-	var tags []string
-	statuses := make(map[string]*adapter.TailscaleEndpointStatus, len(endpoints))
-	for update := range updates {
-		if _, exists := statuses[update.tag]; !exists {
-			tags = append(tags, update.tag)
-		}
-		statuses[update.tag] = update.status
-		protoEndpoints := make([]*TailscaleEndpointStatus, 0, len(statuses))
-		for _, tag := range tags {
-			protoEndpoints = append(protoEndpoints, tailscaleEndpointStatusToProto(tag, statuses[tag]))
-		}
-		sendErr := server.Send(&TailscaleStatusUpdate{
-			Endpoints: protoEndpoints,
-		})
-		if sendErr != nil {
-			return sendErr
-		}
-	}
-	return nil
-}
-
-func tailscaleEndpointStatusToProto(tag string, s *adapter.TailscaleEndpointStatus) *TailscaleEndpointStatus {
-	userGroups := make([]*TailscaleUserGroup, len(s.UserGroups))
-	for i, group := range s.UserGroups {
-		peers := make([]*TailscalePeer, len(group.Peers))
-		for j, peer := range group.Peers {
-			peers[j] = tailscalePeerToProto(peer)
-		}
-		userGroups[i] = &TailscaleUserGroup{
-			UserID:        group.UserID,
-			LoginName:     group.LoginName,
-			DisplayName:   group.DisplayName,
-			ProfilePicURL: group.ProfilePicURL,
-			Peers:         peers,
-		}
-	}
-	result := &TailscaleEndpointStatus{
-		EndpointTag:    tag,
-		BackendState:   s.BackendState,
-		AuthURL:        s.AuthURL,
-		NetworkName:    s.NetworkName,
-		MagicDNSSuffix: s.MagicDNSSuffix,
-		UserGroups:     userGroups,
-	}
-	if s.Self != nil {
-		result.Self = tailscalePeerToProto(s.Self)
-	}
-	return result
-}
-
-func tailscalePeerToProto(peer *adapter.TailscalePeer) *TailscalePeer {
-	return &TailscalePeer{
-		HostName:       peer.HostName,
-		DnsName:        peer.DNSName,
-		Os:             peer.OS,
-		TailscaleIPs:   peer.TailscaleIPs,
-		Online:         peer.Online,
-		ExitNode:       peer.ExitNode,
-		ExitNodeOption: peer.ExitNodeOption,
-		Active:         peer.Active,
-		RxBytes:        peer.RxBytes,
-		TxBytes:        peer.TxBytes,
-		KeyExpiry:      peer.KeyExpiry,
-	}
-}
-
-func (s *StartedService) StartTailscalePing(
-	request *TailscalePingRequest,
-	server grpc.ServerStreamingServer[TailscalePingResponse],
-) error {
-	err := s.waitForStarted(server.Context())
-	if err != nil {
-		return err
-	}
-	s.serviceAccess.RLock()
-	boxService := s.instance
-	s.serviceAccess.RUnlock()
-
-	endpointManager := service.FromContext[adapter.EndpointManager](boxService.ctx)
-	if endpointManager == nil {
-		return status.Error(codes.FailedPrecondition, "endpoint manager not available")
-	}
-
-	var provider adapter.TailscaleEndpoint
-	if request.EndpointTag != "" {
-		endpoint, loaded := endpointManager.Get(request.EndpointTag)
-		if !loaded {
-			return status.Error(codes.NotFound, "endpoint not found: "+request.EndpointTag)
-		}
-		if endpoint.Type() != C.TypeTailscale {
-			return status.Error(codes.InvalidArgument, "endpoint is not Tailscale: "+request.EndpointTag)
-		}
-		pingProvider, loaded := endpoint.(adapter.TailscaleEndpoint)
-		if !loaded {
-			return status.Error(codes.FailedPrecondition, "endpoint does not support ping")
-		}
-		provider = pingProvider
-	} else {
-		for _, endpoint := range endpointManager.Endpoints() {
-			if endpoint.Type() != C.TypeTailscale {
-				continue
-			}
-			pingProvider, loaded := endpoint.(adapter.TailscaleEndpoint)
-			if loaded {
-				provider = pingProvider
-				break
-			}
-		}
-		if provider == nil {
-			return status.Error(codes.NotFound, "no Tailscale endpoint found")
-		}
-	}
-
-	return provider.StartTailscalePing(server.Context(), request.PeerIP, func(result *adapter.TailscalePingResult) {
-		_ = server.Send(&TailscalePingResponse{
-			LatencyMs:      result.LatencyMs,
-			IsDirect:       result.IsDirect,
-			Endpoint:       result.Endpoint,
-			DerpRegionID:   result.DERPRegionID,
-			DerpRegionCode: result.DERPRegionCode,
-			Error:          result.Error,
-		})
-	})
-}
-
 func (s *StartedService) mustEmbedUnimplementedStartedServiceServer() {
 }
 

daemon/started_service.proto

@@ -26,20 +26,12 @@ service StartedService {
 
   rpc GetSystemProxyStatus(google.protobuf.Empty) returns(SystemProxyStatus) {}
   rpc SetSystemProxyEnabled(SetSystemProxyEnabledRequest) returns(google.protobuf.Empty) {}
-  rpc TriggerDebugCrash(DebugCrashRequest) returns(google.protobuf.Empty) {}
-  rpc TriggerOOMReport(google.protobuf.Empty) returns(google.protobuf.Empty) {}
 
   rpc SubscribeConnections(SubscribeConnectionsRequest) returns(stream ConnectionEvents) {}
   rpc CloseConnection(CloseConnectionRequest) returns(google.protobuf.Empty) {}
   rpc CloseAllConnections(google.protobuf.Empty) returns(google.protobuf.Empty) {}
   rpc GetDeprecatedWarnings(google.protobuf.Empty) returns(DeprecatedWarnings) {}
   rpc GetStartedAt(google.protobuf.Empty) returns(StartedAt) {}
-
-  rpc SubscribeOutbounds(google.protobuf.Empty) returns (stream OutboundList) {}
-  rpc StartNetworkQualityTest(NetworkQualityTestRequest) returns (stream NetworkQualityTestProgress) {}
-  rpc StartSTUNTest(STUNTestRequest) returns (stream STUNTestProgress) {}
-  rpc SubscribeTailscaleStatus(google.protobuf.Empty) returns (stream TailscaleStatusUpdate) {}
-  rpc StartTailscalePing(TailscalePingRequest) returns (stream TailscalePingResponse) {}
 }
 
 message ServiceStatus {
@@ -149,15 +141,6 @@ message SetSystemProxyEnabledRequest {
   bool enabled = 1;
 }
 
-message DebugCrashRequest {
-  enum Type {
-    GO = 0;
-    NATIVE = 1;
-  }
-
-  Type type = 1;
-}
-
 message SubscribeConnectionsRequest {
   int64 interval = 1;
 }
@@ -227,105 +210,8 @@ message DeprecatedWarning {
   string message = 1;
   bool impending = 2;
   string migrationLink = 3;
-  string description = 4;
-  string deprecatedVersion = 5;
-  string scheduledVersion = 6;
 }
 
 message StartedAt {
   int64 startedAt = 1;
-}
-
-message OutboundList {
-  repeated GroupItem outbounds = 1;
-}
-
-message NetworkQualityTestRequest {
-  string configURL = 1;
-  string outboundTag = 2;
-  bool serial = 3;
-  int32 maxRuntimeSeconds = 4;
-  bool http3 = 5;
-}
-
-message NetworkQualityTestProgress {
-  int32 phase = 1;
-  int64 downloadCapacity = 2;
-  int64 uploadCapacity = 3;
-  int32 downloadRPM = 4;
-  int32 uploadRPM = 5;
-  int32 idleLatencyMs = 6;
-  int64 elapsedMs = 7;
-  bool isFinal = 8;
-  string error = 9;
-  int32 downloadCapacityAccuracy = 10;
-  int32 uploadCapacityAccuracy = 11;
-  int32 downloadRPMAccuracy = 12;
-  int32 uploadRPMAccuracy = 13;
-}
-
-message STUNTestRequest {
-  string server = 1;
-  string outboundTag = 2;
-}
-
-message STUNTestProgress {
-  int32 phase = 1;
-  string externalAddr = 2;
-  int32 latencyMs = 3;
-  int32 natMapping = 4;
-  int32 natFiltering = 5;
-  bool isFinal = 6;
-  string error = 7;
-  bool natTypeSupported = 8;
-}
-
-message TailscaleStatusUpdate {
-  repeated TailscaleEndpointStatus endpoints = 1;
-}
-
-message TailscaleEndpointStatus {
-  string endpointTag = 1;
-  string backendState = 2;
-  string authURL = 3;
-  string networkName = 4;
-  string magicDNSSuffix = 5;
-  TailscalePeer self = 6;
-  repeated TailscaleUserGroup userGroups = 7;
-}
-
-message TailscaleUserGroup {
-  int64 userID = 1;
-  string loginName = 2;
-  string displayName = 3;
-  string profilePicURL = 4;
-  repeated TailscalePeer peers = 5;
-}
-
-message TailscalePeer {
-  string hostName = 1;
-  string dnsName = 2;
-  string os = 3;
-  repeated string tailscaleIPs = 4;
-  bool online = 5;
-  bool exitNode = 6;
-  bool exitNodeOption = 7;
-  bool active = 8;
-  int64 rxBytes = 9;
-  int64 txBytes = 10;
-  int64 keyExpiry = 11;
-}
-
-message TailscalePingRequest {
-  string endpointTag = 1;
-  string peerIP = 2;
-}
-
-message TailscalePingResponse {
-  double latencyMs = 1;
-  bool isDirect = 2;
-  string endpoint = 3;
-  int32 derpRegionID = 4;
-  string derpRegionCode = 5;
-  string error = 6;
-}
+}

daemon/started_service_grpc.pb.go

@@ -15,34 +15,27 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	StartedService_StopService_FullMethodName              = "/daemon.StartedService/StopService"
-	StartedService_ReloadService_FullMethodName            = "/daemon.StartedService/ReloadService"
-	StartedService_SubscribeServiceStatus_FullMethodName   = "/daemon.StartedService/SubscribeServiceStatus"
-	StartedService_SubscribeLog_FullMethodName             = "/daemon.StartedService/SubscribeLog"
-	StartedService_GetDefaultLogLevel_FullMethodName       = "/daemon.StartedService/GetDefaultLogLevel"
-	StartedService_ClearLogs_FullMethodName                = "/daemon.StartedService/ClearLogs"
-	StartedService_SubscribeStatus_FullMethodName          = "/daemon.StartedService/SubscribeStatus"
-	StartedService_SubscribeGroups_FullMethodName          = "/daemon.StartedService/SubscribeGroups"
-	StartedService_GetClashModeStatus_FullMethodName       = "/daemon.StartedService/GetClashModeStatus"
-	StartedService_SubscribeClashMode_FullMethodName       = "/daemon.StartedService/SubscribeClashMode"
-	StartedService_SetClashMode_FullMethodName             = "/daemon.StartedService/SetClashMode"
-	StartedService_URLTest_FullMethodName                  = "/daemon.StartedService/URLTest"
-	StartedService_SelectOutbound_FullMethodName           = "/daemon.StartedService/SelectOutbound"
-	StartedService_SetGroupExpand_FullMethodName           = "/daemon.StartedService/SetGroupExpand"
-	StartedService_GetSystemProxyStatus_FullMethodName     = "/daemon.StartedService/GetSystemProxyStatus"
-	StartedService_SetSystemProxyEnabled_FullMethodName    = "/daemon.StartedService/SetSystemProxyEnabled"
-	StartedService_TriggerDebugCrash_FullMethodName        = "/daemon.StartedService/TriggerDebugCrash"
-	StartedService_TriggerOOMReport_FullMethodName         = "/daemon.StartedService/TriggerOOMReport"
-	StartedService_SubscribeConnections_FullMethodName     = "/daemon.StartedService/SubscribeConnections"
-	StartedService_CloseConnection_FullMethodName          = "/daemon.StartedService/CloseConnection"
-	StartedService_CloseAllConnections_FullMethodName      = "/daemon.StartedService/CloseAllConnections"
-	StartedService_GetDeprecatedWarnings_FullMethodName    = "/daemon.StartedService/GetDeprecatedWarnings"
-	StartedService_GetStartedAt_FullMethodName             = "/daemon.StartedService/GetStartedAt"
-	StartedService_SubscribeOutbounds_FullMethodName       = "/daemon.StartedService/SubscribeOutbounds"
-	StartedService_StartNetworkQualityTest_FullMethodName  = "/daemon.StartedService/StartNetworkQualityTest"
-	StartedService_StartSTUNTest_FullMethodName            = "/daemon.StartedService/StartSTUNTest"
-	StartedService_SubscribeTailscaleStatus_FullMethodName = "/daemon.StartedService/SubscribeTailscaleStatus"
-	StartedService_StartTailscalePing_FullMethodName       = "/daemon.StartedService/StartTailscalePing"
+	StartedService_StopService_FullMethodName            = "/daemon.StartedService/StopService"
+	StartedService_ReloadService_FullMethodName          = "/daemon.StartedService/ReloadService"
+	StartedService_SubscribeServiceStatus_FullMethodName = "/daemon.StartedService/SubscribeServiceStatus"
+	StartedService_SubscribeLog_FullMethodName           = "/daemon.StartedService/SubscribeLog"
+	StartedService_GetDefaultLogLevel_FullMethodName     = "/daemon.StartedService/GetDefaultLogLevel"
+	StartedService_ClearLogs_FullMethodName              = "/daemon.StartedService/ClearLogs"
+	StartedService_SubscribeStatus_FullMethodName        = "/daemon.StartedService/SubscribeStatus"
+	StartedService_SubscribeGroups_FullMethodName        = "/daemon.StartedService/SubscribeGroups"
+	StartedService_GetClashModeStatus_FullMethodName     = "/daemon.StartedService/GetClashModeStatus"
+	StartedService_SubscribeClashMode_FullMethodName     = "/daemon.StartedService/SubscribeClashMode"
+	StartedService_SetClashMode_FullMethodName           = "/daemon.StartedService/SetClashMode"
+	StartedService_URLTest_FullMethodName                = "/daemon.StartedService/URLTest"
+	StartedService_SelectOutbound_FullMethodName         = "/daemon.StartedService/SelectOutbound"
+	StartedService_SetGroupExpand_FullMethodName         = "/daemon.StartedService/SetGroupExpand"
+	StartedService_GetSystemProxyStatus_FullMethodName   = "/daemon.StartedService/GetSystemProxyStatus"
+	StartedService_SetSystemProxyEnabled_FullMethodName  = "/daemon.StartedService/SetSystemProxyEnabled"
+	StartedService_SubscribeConnections_FullMethodName   = "/daemon.StartedService/SubscribeConnections"
+	StartedService_CloseConnection_FullMethodName        = "/daemon.StartedService/CloseConnection"
+	StartedService_CloseAllConnections_FullMethodName    = "/daemon.StartedService/CloseAllConnections"
+	StartedService_GetDeprecatedWarnings_FullMethodName  = "/daemon.StartedService/GetDeprecatedWarnings"
+	StartedService_GetStartedAt_FullMethodName           = "/daemon.StartedService/GetStartedAt"
 )
 
 // StartedServiceClient is the client API for StartedService service.
@@ -65,18 +58,11 @@ type StartedServiceClient interface {
 	SetGroupExpand(ctx context.Context, in *SetGroupExpandRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	GetSystemProxyStatus(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(ctx context.Context, in *SetSystemProxyEnabledRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	TriggerDebugCrash(ctx context.Context, in *DebugCrashRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	TriggerOOMReport(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	SubscribeConnections(ctx context.Context, in *SubscribeConnectionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionEvents], error)
 	CloseConnection(ctx context.Context, in *CloseConnectionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	CloseAllConnections(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	GetDeprecatedWarnings(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*DeprecatedWarnings, error)
 	GetStartedAt(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*StartedAt, error)
-	SubscribeOutbounds(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (grpc.ServerStreamingClient[OutboundList], error)
-	StartNetworkQualityTest(ctx context.Context, in *NetworkQualityTestRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[NetworkQualityTestProgress], error)
-	StartSTUNTest(ctx context.Context, in *STUNTestRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[STUNTestProgress], error)
-	SubscribeTailscaleStatus(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (grpc.ServerStreamingClient[TailscaleStatusUpdate], error)
-	StartTailscalePing(ctx context.Context, in *TailscalePingRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[TailscalePingResponse], error)
 }
 
 type startedServiceClient struct {
@@ -292,26 +278,6 @@ func (c *startedServiceClient) SetSystemProxyEnabled(ctx context.Context, in *Se
 	return out, nil
 }
 
-func (c *startedServiceClient) TriggerDebugCrash(ctx context.Context, in *DebugCrashRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, StartedService_TriggerDebugCrash_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *startedServiceClient) TriggerOOMReport(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, StartedService_TriggerOOMReport_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *startedServiceClient) SubscribeConnections(ctx context.Context, in *SubscribeConnectionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionEvents], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[5], StartedService_SubscribeConnections_FullMethodName, cOpts...)
@@ -371,101 +337,6 @@ func (c *startedServiceClient) GetStartedAt(ctx context.Context, in *emptypb.Emp
 	return out, nil
 }
 
-func (c *startedServiceClient) SubscribeOutbounds(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (grpc.ServerStreamingClient[OutboundList], error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[6], StartedService_SubscribeOutbounds_FullMethodName, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &grpc.GenericClientStream[emptypb.Empty, OutboundList]{ClientStream: stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_SubscribeOutboundsClient = grpc.ServerStreamingClient[OutboundList]
-
-func (c *startedServiceClient) StartNetworkQualityTest(ctx context.Context, in *NetworkQualityTestRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[NetworkQualityTestProgress], error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[7], StartedService_StartNetworkQualityTest_FullMethodName, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &grpc.GenericClientStream[NetworkQualityTestRequest, NetworkQualityTestProgress]{ClientStream: stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartNetworkQualityTestClient = grpc.ServerStreamingClient[NetworkQualityTestProgress]
-
-func (c *startedServiceClient) StartSTUNTest(ctx context.Context, in *STUNTestRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[STUNTestProgress], error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[8], StartedService_StartSTUNTest_FullMethodName, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &grpc.GenericClientStream[STUNTestRequest, STUNTestProgress]{ClientStream: stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartSTUNTestClient = grpc.ServerStreamingClient[STUNTestProgress]
-
-func (c *startedServiceClient) SubscribeTailscaleStatus(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (grpc.ServerStreamingClient[TailscaleStatusUpdate], error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[9], StartedService_SubscribeTailscaleStatus_FullMethodName, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &grpc.GenericClientStream[emptypb.Empty, TailscaleStatusUpdate]{ClientStream: stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_SubscribeTailscaleStatusClient = grpc.ServerStreamingClient[TailscaleStatusUpdate]
-
-func (c *startedServiceClient) StartTailscalePing(ctx context.Context, in *TailscalePingRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[TailscalePingResponse], error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[10], StartedService_StartTailscalePing_FullMethodName, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &grpc.GenericClientStream[TailscalePingRequest, TailscalePingResponse]{ClientStream: stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartTailscalePingClient = grpc.ServerStreamingClient[TailscalePingResponse]
-
 // StartedServiceServer is the server API for StartedService service.
 // All implementations must embed UnimplementedStartedServiceServer
 // for forward compatibility.
@@ -486,18 +357,11 @@ type StartedServiceServer interface {
 	SetGroupExpand(context.Context, *SetGroupExpandRequest) (*emptypb.Empty, error)
 	GetSystemProxyStatus(context.Context, *emptypb.Empty) (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(context.Context, *SetSystemProxyEnabledRequest) (*emptypb.Empty, error)
-	TriggerDebugCrash(context.Context, *DebugCrashRequest) (*emptypb.Empty, error)
-	TriggerOOMReport(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	SubscribeConnections(*SubscribeConnectionsRequest, grpc.ServerStreamingServer[ConnectionEvents]) error
 	CloseConnection(context.Context, *CloseConnectionRequest) (*emptypb.Empty, error)
 	CloseAllConnections(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	GetDeprecatedWarnings(context.Context, *emptypb.Empty) (*DeprecatedWarnings, error)
 	GetStartedAt(context.Context, *emptypb.Empty) (*StartedAt, error)
-	SubscribeOutbounds(*emptypb.Empty, grpc.ServerStreamingServer[OutboundList]) error
-	StartNetworkQualityTest(*NetworkQualityTestRequest, grpc.ServerStreamingServer[NetworkQualityTestProgress]) error
-	StartSTUNTest(*STUNTestRequest, grpc.ServerStreamingServer[STUNTestProgress]) error
-	SubscribeTailscaleStatus(*emptypb.Empty, grpc.ServerStreamingServer[TailscaleStatusUpdate]) error
-	StartTailscalePing(*TailscalePingRequest, grpc.ServerStreamingServer[TailscalePingResponse]) error
 	mustEmbedUnimplementedStartedServiceServer()
 }
 
@@ -572,14 +436,6 @@ func (UnimplementedStartedServiceServer) SetSystemProxyEnabled(context.Context,
 	return nil, status.Error(codes.Unimplemented, "method SetSystemProxyEnabled not implemented")
 }
 
-func (UnimplementedStartedServiceServer) TriggerDebugCrash(context.Context, *DebugCrashRequest) (*emptypb.Empty, error) {
-	return nil, status.Error(codes.Unimplemented, "method TriggerDebugCrash not implemented")
-}
-
-func (UnimplementedStartedServiceServer) TriggerOOMReport(context.Context, *emptypb.Empty) (*emptypb.Empty, error) {
-	return nil, status.Error(codes.Unimplemented, "method TriggerOOMReport not implemented")
-}
-
 func (UnimplementedStartedServiceServer) SubscribeConnections(*SubscribeConnectionsRequest, grpc.ServerStreamingServer[ConnectionEvents]) error {
 	return status.Error(codes.Unimplemented, "method SubscribeConnections not implemented")
 }
@@ -599,26 +455,6 @@ func (UnimplementedStartedServiceServer) GetDeprecatedWarnings(context.Context,
 func (UnimplementedStartedServiceServer) GetStartedAt(context.Context, *emptypb.Empty) (*StartedAt, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetStartedAt not implemented")
 }
-
-func (UnimplementedStartedServiceServer) SubscribeOutbounds(*emptypb.Empty, grpc.ServerStreamingServer[OutboundList]) error {
-	return status.Error(codes.Unimplemented, "method SubscribeOutbounds not implemented")
-}
-
-func (UnimplementedStartedServiceServer) StartNetworkQualityTest(*NetworkQualityTestRequest, grpc.ServerStreamingServer[NetworkQualityTestProgress]) error {
-	return status.Error(codes.Unimplemented, "method StartNetworkQualityTest not implemented")
-}
-
-func (UnimplementedStartedServiceServer) StartSTUNTest(*STUNTestRequest, grpc.ServerStreamingServer[STUNTestProgress]) error {
-	return status.Error(codes.Unimplemented, "method StartSTUNTest not implemented")
-}
-
-func (UnimplementedStartedServiceServer) SubscribeTailscaleStatus(*emptypb.Empty, grpc.ServerStreamingServer[TailscaleStatusUpdate]) error {
-	return status.Error(codes.Unimplemented, "method SubscribeTailscaleStatus not implemented")
-}
-
-func (UnimplementedStartedServiceServer) StartTailscalePing(*TailscalePingRequest, grpc.ServerStreamingServer[TailscalePingResponse]) error {
-	return status.Error(codes.Unimplemented, "method StartTailscalePing not implemented")
-}
 func (UnimplementedStartedServiceServer) mustEmbedUnimplementedStartedServiceServer() {}
 func (UnimplementedStartedServiceServer) testEmbeddedByValue()                        {}
 
@@ -893,42 +729,6 @@ func _StartedService_SetSystemProxyEnabled_Handler(srv interface{}, ctx context.
 	return interceptor(ctx, in, info, handler)
 }
 
-func _StartedService_TriggerDebugCrash_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DebugCrashRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(StartedServiceServer).TriggerDebugCrash(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: StartedService_TriggerDebugCrash_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(StartedServiceServer).TriggerDebugCrash(ctx, req.(*DebugCrashRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _StartedService_TriggerOOMReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(StartedServiceServer).TriggerOOMReport(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: StartedService_TriggerOOMReport_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(StartedServiceServer).TriggerOOMReport(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _StartedService_SubscribeConnections_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(SubscribeConnectionsRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -1012,61 +812,6 @@ func _StartedService_GetStartedAt_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
-func _StartedService_SubscribeOutbounds_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(emptypb.Empty)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(StartedServiceServer).SubscribeOutbounds(m, &grpc.GenericServerStream[emptypb.Empty, OutboundList]{ServerStream: stream})
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_SubscribeOutboundsServer = grpc.ServerStreamingServer[OutboundList]
-
-func _StartedService_StartNetworkQualityTest_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(NetworkQualityTestRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(StartedServiceServer).StartNetworkQualityTest(m, &grpc.GenericServerStream[NetworkQualityTestRequest, NetworkQualityTestProgress]{ServerStream: stream})
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartNetworkQualityTestServer = grpc.ServerStreamingServer[NetworkQualityTestProgress]
-
-func _StartedService_StartSTUNTest_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(STUNTestRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(StartedServiceServer).StartSTUNTest(m, &grpc.GenericServerStream[STUNTestRequest, STUNTestProgress]{ServerStream: stream})
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartSTUNTestServer = grpc.ServerStreamingServer[STUNTestProgress]
-
-func _StartedService_SubscribeTailscaleStatus_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(emptypb.Empty)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(StartedServiceServer).SubscribeTailscaleStatus(m, &grpc.GenericServerStream[emptypb.Empty, TailscaleStatusUpdate]{ServerStream: stream})
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_SubscribeTailscaleStatusServer = grpc.ServerStreamingServer[TailscaleStatusUpdate]
-
-func _StartedService_StartTailscalePing_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(TailscalePingRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(StartedServiceServer).StartTailscalePing(m, &grpc.GenericServerStream[TailscalePingRequest, TailscalePingResponse]{ServerStream: stream})
-}
-
-// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
-type StartedService_StartTailscalePingServer = grpc.ServerStreamingServer[TailscalePingResponse]
-
 // StartedService_ServiceDesc is the grpc.ServiceDesc for StartedService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1118,14 +863,6 @@ var StartedService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "SetSystemProxyEnabled",
 			Handler:    _StartedService_SetSystemProxyEnabled_Handler,
 		},
-		{
-			MethodName: "TriggerDebugCrash",
-			Handler:    _StartedService_TriggerDebugCrash_Handler,
-		},
-		{
-			MethodName: "TriggerOOMReport",
-			Handler:    _StartedService_TriggerOOMReport_Handler,
-		},
 		{
 			MethodName: "CloseConnection",
 			Handler:    _StartedService_CloseConnection_Handler,
@@ -1174,31 +911,6 @@ var StartedService_ServiceDesc = grpc.ServiceDesc{
 			Handler:       _StartedService_SubscribeConnections_Handler,
 			ServerStreams: true,
 		},
-		{
-			StreamName:    "SubscribeOutbounds",
-			Handler:       _StartedService_SubscribeOutbounds_Handler,
-			ServerStreams: true,
-		},
-		{
-			StreamName:    "StartNetworkQualityTest",
-			Handler:       _StartedService_StartNetworkQualityTest_Handler,
-			ServerStreams: true,
-		},
-		{
-			StreamName:    "StartSTUNTest",
-			Handler:       _StartedService_StartSTUNTest_Handler,
-			ServerStreams: true,
-		},
-		{
-			StreamName:    "SubscribeTailscaleStatus",
-			Handler:       _StartedService_SubscribeTailscaleStatus_Handler,
-			ServerStreams: true,
-		},
-		{
-			StreamName:    "StartTailscalePing",
-			Handler:       _StartedService_StartTailscalePing_Handler,
-			ServerStreams: true,
-		},
 	},
 	Metadata: "daemon/started_service.proto",
 }

dns/client.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"net/netip"
+	"strings"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -13,6 +14,7 @@ import (
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/task"
 	"github.com/sagernet/sing/contrab/freelru"
 	"github.com/sagernet/sing/contrab/maphash"
@@ -30,63 +32,59 @@ var (
 var _ adapter.DNSClient = (*Client)(nil)
 
 type Client struct {
-	ctx               context.Context
-	timeout           time.Duration
-	disableCache      bool
-	disableExpire     bool
-	optimisticTimeout time.Duration
-	cacheCapacity     uint32
-	clientSubnet      netip.Prefix
-	rdrc              adapter.RDRCStore
-	initRDRCFunc      func() adapter.RDRCStore
-	dnsCache          adapter.DNSCacheStore
-	initDNSCacheFunc  func() adapter.DNSCacheStore
-	logger            logger.ContextLogger
-	cache             freelru.Cache[dnsCacheKey, *dns.Msg]
-	cacheLock         compatible.Map[dnsCacheKey, chan struct{}]
-	backgroundRefresh compatible.Map[dnsCacheKey, struct{}]
+	timeout            time.Duration
+	disableCache       bool
+	disableExpire      bool
+	independentCache   bool
+	clientSubnet       netip.Prefix
+	rdrc               adapter.RDRCStore
+	initRDRCFunc       func() adapter.RDRCStore
+	logger             logger.ContextLogger
+	cache              freelru.Cache[dns.Question, *dns.Msg]
+	cacheLock          compatible.Map[dns.Question, chan struct{}]
+	transportCache     freelru.Cache[transportCacheKey, *dns.Msg]
+	transportCacheLock compatible.Map[dns.Question, chan struct{}]
 }
 
 type ClientOptions struct {
-	Context           context.Context
-	Timeout           time.Duration
-	DisableCache      bool
-	DisableExpire     bool
-	OptimisticTimeout time.Duration
-	CacheCapacity     uint32
-	ClientSubnet      netip.Prefix
-	RDRC              func() adapter.RDRCStore
-	DNSCache          func() adapter.DNSCacheStore
-	Logger            logger.ContextLogger
+	Timeout          time.Duration
+	DisableCache     bool
+	DisableExpire    bool
+	IndependentCache bool
+	CacheCapacity    uint32
+	ClientSubnet     netip.Prefix
+	RDRC             func() adapter.RDRCStore
+	Logger           logger.ContextLogger
 }
 
 func NewClient(options ClientOptions) *Client {
-	cacheCapacity := options.CacheCapacity
-	if cacheCapacity < 1024 {
-		cacheCapacity = 1024
-	}
 	client := &Client{
-		ctx:               options.Context,
-		timeout:           options.Timeout,
-		disableCache:      options.DisableCache,
-		disableExpire:     options.DisableExpire,
-		optimisticTimeout: options.OptimisticTimeout,
-		cacheCapacity:     cacheCapacity,
-		clientSubnet:      options.ClientSubnet,
-		initRDRCFunc:      options.RDRC,
-		initDNSCacheFunc:  options.DNSCache,
-		logger:            options.Logger,
+		timeout:          options.Timeout,
+		disableCache:     options.DisableCache,
+		disableExpire:    options.DisableExpire,
+		independentCache: options.IndependentCache,
+		clientSubnet:     options.ClientSubnet,
+		initRDRCFunc:     options.RDRC,
+		logger:           options.Logger,
 	}
 	if client.timeout == 0 {
 		client.timeout = C.DNSTimeout
 	}
-	if !client.disableCache && client.initDNSCacheFunc == nil {
-		client.initializeMemoryCache()
+	cacheCapacity := options.CacheCapacity
+	if cacheCapacity < 1024 {
+		cacheCapacity = 1024
+	}
+	if !client.disableCache {
+		if !client.independentCache {
+			client.cache = common.Must1(freelru.NewSharded[dns.Question, *dns.Msg](cacheCapacity, maphash.NewHasher[dns.Question]().Hash32))
+		} else {
+			client.transportCache = common.Must1(freelru.NewSharded[transportCacheKey, *dns.Msg](cacheCapacity, maphash.NewHasher[transportCacheKey]().Hash32))
+		}
 	}
 	return client
 }
 
-type dnsCacheKey struct {
+type transportCacheKey struct {
 	dns.Question
 	transportTag string
 }
@@ -95,19 +93,6 @@ func (c *Client) Start() {
 	if c.initRDRCFunc != nil {
 		c.rdrc = c.initRDRCFunc()
 	}
-	if c.initDNSCacheFunc != nil {
-		c.dnsCache = c.initDNSCacheFunc()
-	}
-	if c.dnsCache == nil {
-		c.initializeMemoryCache()
-	}
-}
-
-func (c *Client) initializeMemoryCache() {
-	if c.disableCache || c.cache != nil {
-		return
-	}
-	c.cache = common.Must1(freelru.NewSharded[dnsCacheKey, *dns.Msg](c.cacheCapacity, maphash.NewHasher[dnsCacheKey]().Hash32))
 }
 
 func extractNegativeTTL(response *dns.Msg) (uint32, bool) {
@@ -124,38 +109,7 @@ func extractNegativeTTL(response *dns.Msg) (uint32, bool) {
 	return 0, false
 }
 
-func computeTimeToLive(response *dns.Msg) uint32 {
-	var timeToLive uint32
-	if len(response.Answer) == 0 {
-		if soaTTL, hasSOA := extractNegativeTTL(response); hasSOA {
-			return soaTTL
-		}
-	}
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			if record.Header().Rrtype == dns.TypeOPT {
-				continue
-			}
-			if timeToLive == 0 || record.Header().Ttl > 0 && record.Header().Ttl < timeToLive {
-				timeToLive = record.Header().Ttl
-			}
-		}
-	}
-	return timeToLive
-}
-
-func normalizeTTL(response *dns.Msg, timeToLive uint32) {
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			if record.Header().Rrtype == dns.TypeOPT {
-				continue
-			}
-			record.Header().Ttl = timeToLive
-		}
-	}
-}
-
-func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, message *dns.Msg, options adapter.DNSQueryOptions, responseChecker func(response *dns.Msg) bool) (*dns.Msg, error) {
+func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, message *dns.Msg, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) (*dns.Msg, error) {
 	if len(message.Question) == 0 {
 		if c.logger != nil {
 			c.logger.WarnContext(ctx, "bad question size: ", len(message.Question))
@@ -169,7 +123,13 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 		}
 		return FixedResponseStatus(message, dns.RcodeSuccess), nil
 	}
-	message = c.prepareExchangeMessage(message, options)
+	clientSubnet := options.ClientSubnet
+	if !clientSubnet.IsValid() {
+		clientSubnet = c.clientSubnet
+	}
+	if clientSubnet.IsValid() {
+		message = SetClientSubnet(message, clientSubnet)
+	}
 
 	isSimpleRequest := len(message.Question) == 1 &&
 		len(message.Ns) == 0 &&
@@ -181,32 +141,40 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 		!options.ClientSubnet.IsValid()
 	disableCache := !isSimpleRequest || c.disableCache || options.DisableCache
 	if !disableCache {
-		cacheKey := dnsCacheKey{Question: question, transportTag: transport.Tag()}
-		cond, loaded := c.cacheLock.LoadOrStore(cacheKey, make(chan struct{}))
-		if loaded {
-			select {
-			case <-cond:
-			case <-ctx.Done():
-				return nil, ctx.Err()
+		if c.cache != nil {
+			cond, loaded := c.cacheLock.LoadOrStore(question, make(chan struct{}))
+			if loaded {
+				select {
+				case <-cond:
+				case <-ctx.Done():
+					return nil, ctx.Err()
+				}
+			} else {
+				defer func() {
+					c.cacheLock.Delete(question)
+					close(cond)
+				}()
+			}
+		} else if c.transportCache != nil {
+			cond, loaded := c.transportCacheLock.LoadOrStore(question, make(chan struct{}))
+			if loaded {
+				select {
+				case <-cond:
+				case <-ctx.Done():
+					return nil, ctx.Err()
+				}
+			} else {
+				defer func() {
+					c.transportCacheLock.Delete(question)
+					close(cond)
+				}()
 			}
-		} else {
-			defer func() {
-				c.cacheLock.Delete(cacheKey)
-				close(cond)
-			}()
 		}
-		response, ttl, isStale := c.loadResponse(question, transport)
+		response, ttl := c.loadResponse(question, transport)
 		if response != nil {
-			if isStale && !options.DisableOptimisticCache {
-				c.backgroundRefreshDNS(transport, question, message.Copy(), options, responseChecker)
-				logOptimisticResponse(c.logger, ctx, response)
-				response.Id = message.Id
-				return response, nil
-			} else if !isStale {
-				logCachedResponse(c.logger, ctx, response, ttl)
-				response.Id = message.Id
-				return response, nil
-			}
+			logCachedResponse(c.logger, ctx, response, ttl)
+			response.Id = message.Id
+			return response, nil
 		}
 	}
 
@@ -222,17 +190,62 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 			return nil, ErrResponseRejectedCached
 		}
 	}
-	response, err := c.exchangeToTransport(ctx, transport, message)
+	ctx, cancel := context.WithTimeout(ctx, c.timeout)
+	response, err := transport.Exchange(ctx, message)
+	cancel()
 	if err != nil {
-		return nil, err
+		var rcodeError RcodeError
+		if errors.As(err, &rcodeError) {
+			response = FixedResponseStatus(message, int(rcodeError))
+		} else {
+			return nil, err
+		}
 	}
+	/*if question.Qtype == dns.TypeA || question.Qtype == dns.TypeAAAA {
+		validResponse := response
+	loop:
+		for {
+			var (
+				addresses  int
+				queryCNAME string
+			)
+			for _, rawRR := range validResponse.Answer {
+				switch rr := rawRR.(type) {
+				case *dns.A:
+					break loop
+				case *dns.AAAA:
+					break loop
+				case *dns.CNAME:
+					queryCNAME = rr.Target
+				}
+			}
+			if queryCNAME == "" {
+				break
+			}
+			exMessage := *message
+			exMessage.Question = []dns.Question{{
+				Name:  queryCNAME,
+				Qtype: question.Qtype,
+			}}
+			validResponse, err = c.Exchange(ctx, transport, &exMessage, options, responseChecker)
+			if err != nil {
+				return nil, err
+			}
+		}
+		if validResponse != response {
+			response.Answer = append(response.Answer, validResponse.Answer...)
+		}
+	}*/
 	disableCache = disableCache || (response.Rcode != dns.RcodeSuccess && response.Rcode != dns.RcodeNameError)
 	if responseChecker != nil {
 		var rejected bool
+		// TODO: add accept_any rule and support to check response instead of addresses
 		if response.Rcode != dns.RcodeSuccess && response.Rcode != dns.RcodeNameError {
 			rejected = true
+		} else if len(response.Answer) == 0 {
+			rejected = !responseChecker(nil)
 		} else {
-			rejected = !responseChecker(response)
+			rejected = !responseChecker(MessageToAddresses(response))
 		}
 		if rejected {
 			if !disableCache && c.rdrc != nil {
@@ -242,7 +255,48 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 			return response, ErrResponseRejected
 		}
 	}
-	timeToLive := applyResponseOptions(question, response, options)
+	if question.Qtype == dns.TypeHTTPS {
+		if options.Strategy == C.DomainStrategyIPv4Only || options.Strategy == C.DomainStrategyIPv6Only {
+			for _, rr := range response.Answer {
+				https, isHTTPS := rr.(*dns.HTTPS)
+				if !isHTTPS {
+					continue
+				}
+				content := https.SVCB
+				content.Value = common.Filter(content.Value, func(it dns.SVCBKeyValue) bool {
+					if options.Strategy == C.DomainStrategyIPv4Only {
+						return it.Key() != dns.SVCB_IPV6HINT
+					} else {
+						return it.Key() != dns.SVCB_IPV4HINT
+					}
+				})
+				https.SVCB = content
+			}
+		}
+	}
+	var timeToLive uint32
+	if len(response.Answer) == 0 {
+		if soaTTL, hasSOA := extractNegativeTTL(response); hasSOA {
+			timeToLive = soaTTL
+		}
+	}
+	if timeToLive == 0 {
+		for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
+			for _, record := range recordList {
+				if timeToLive == 0 || record.Header().Ttl > 0 && record.Header().Ttl < timeToLive {
+					timeToLive = record.Header().Ttl
+				}
+			}
+		}
+	}
+	if options.RewriteTTL != nil {
+		timeToLive = *options.RewriteTTL
+	}
+	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
+		for _, record := range recordList {
+			record.Header().Ttl = timeToLive
+		}
+	}
 	if !disableCache {
 		c.storeCache(transport, question, response, timeToLive)
 	}
@@ -261,7 +315,7 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 	return response, nil
 }
 
-func (c *Client) Lookup(ctx context.Context, transport adapter.DNSTransport, domain string, options adapter.DNSQueryOptions, responseChecker func(response *dns.Msg) bool) ([]netip.Addr, error) {
+func (c *Client) Lookup(ctx context.Context, transport adapter.DNSTransport, domain string, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error) {
 	domain = FqdnToDomain(domain)
 	dnsName := dns.Fqdn(domain)
 	var strategy C.DomainStrategy
@@ -308,12 +362,8 @@ func (c *Client) Lookup(ctx context.Context, transport adapter.DNSTransport, dom
 func (c *Client) ClearCache() {
 	if c.cache != nil {
 		c.cache.Purge()
-	}
-	if c.dnsCache != nil {
-		err := c.dnsCache.ClearDNSCache()
-		if err != nil && c.logger != nil {
-			c.logger.Warn("clear DNS cache: ", err)
-		}
+	} else if c.transportCache != nil {
+		c.transportCache.Purge()
 	}
 }
 
@@ -329,44 +379,46 @@ func (c *Client) storeCache(transport adapter.DNSTransport, question dns.Questio
 	if timeToLive == 0 {
 		return
 	}
-	if c.dnsCache != nil {
-		packed, err := message.Pack()
-		if err == nil {
-			expireAt := time.Now().Add(time.Second * time.Duration(timeToLive))
-			c.dnsCache.SaveDNSCacheAsync(transport.Tag(), question.Name, question.Qtype, packed, expireAt, c.logger)
-		}
-		return
-	}
-	if c.cache == nil {
-		return
-	}
-	key := dnsCacheKey{Question: question, transportTag: transport.Tag()}
 	if c.disableExpire {
-		c.cache.Add(key, message.Copy())
+		if !c.independentCache {
+			c.cache.Add(question, message)
+		} else {
+			c.transportCache.Add(transportCacheKey{
+				Question:     question,
+				transportTag: transport.Tag(),
+			}, message)
+		}
 	} else {
-		c.cache.AddWithLifetime(key, message.Copy(), time.Second*time.Duration(timeToLive))
+		if !c.independentCache {
+			c.cache.AddWithLifetime(question, message, time.Second*time.Duration(timeToLive))
+		} else {
+			c.transportCache.AddWithLifetime(transportCacheKey{
+				Question:     question,
+				transportTag: transport.Tag(),
+			}, message, time.Second*time.Duration(timeToLive))
+		}
 	}
 }
 
-func (c *Client) lookupToExchange(ctx context.Context, transport adapter.DNSTransport, name string, qType uint16, options adapter.DNSQueryOptions, responseChecker func(response *dns.Msg) bool) ([]netip.Addr, error) {
+func (c *Client) lookupToExchange(ctx context.Context, transport adapter.DNSTransport, name string, qType uint16, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error) {
 	question := dns.Question{
 		Name:   name,
 		Qtype:  qType,
 		Qclass: dns.ClassINET,
 	}
+	disableCache := c.disableCache || options.DisableCache
+	if !disableCache {
+		cachedAddresses, err := c.questionCache(question, transport)
+		if err != ErrNotCached {
+			return cachedAddresses, err
+		}
+	}
 	message := dns.Msg{
 		MsgHdr: dns.MsgHdr{
 			RecursionDesired: true,
 		},
 		Question: []dns.Question{question},
 	}
-	disableCache := c.disableCache || options.DisableCache
-	if !disableCache {
-		cachedAddresses, err := c.questionCache(ctx, transport, &message, options, responseChecker)
-		if err != ErrNotCached {
-			return cachedAddresses, err
-		}
-	}
 	response, err := c.Exchange(ctx, transport, &message, options, responseChecker)
 	if err != nil {
 		return nil, err
@@ -377,181 +429,111 @@ func (c *Client) lookupToExchange(ctx context.Context, transport adapter.DNSTran
 	return MessageToAddresses(response), nil
 }
 
-func (c *Client) questionCache(ctx context.Context, transport adapter.DNSTransport, message *dns.Msg, options adapter.DNSQueryOptions, responseChecker func(response *dns.Msg) bool) ([]netip.Addr, error) {
-	question := message.Question[0]
-	response, _, isStale := c.loadResponse(question, transport)
+func (c *Client) questionCache(question dns.Question, transport adapter.DNSTransport) ([]netip.Addr, error) {
+	response, _ := c.loadResponse(question, transport)
 	if response == nil {
 		return nil, ErrNotCached
 	}
-	if isStale {
-		if options.DisableOptimisticCache {
-			return nil, ErrNotCached
-		}
-		c.backgroundRefreshDNS(transport, question, c.prepareExchangeMessage(message.Copy(), options), options, responseChecker)
-		logOptimisticResponse(c.logger, ctx, response)
-	}
 	if response.Rcode != dns.RcodeSuccess {
 		return nil, RcodeError(response.Rcode)
 	}
 	return MessageToAddresses(response), nil
 }
 
-func (c *Client) loadResponse(question dns.Question, transport adapter.DNSTransport) (*dns.Msg, int, bool) {
-	if c.dnsCache != nil {
-		return c.loadPersistentResponse(question, transport)
-	}
-	if c.cache == nil {
-		return nil, 0, false
-	}
-	key := dnsCacheKey{Question: question, transportTag: transport.Tag()}
+func (c *Client) loadResponse(question dns.Question, transport adapter.DNSTransport) (*dns.Msg, int) {
+	var (
+		response *dns.Msg
+		loaded   bool
+	)
 	if c.disableExpire {
-		response, loaded := c.cache.Get(key)
-		if !loaded {
-			return nil, 0, false
-		}
-		return response.Copy(), 0, false
-	}
-	response, expireAt, loaded := c.cache.GetWithLifetimeNoExpire(key)
-	if !loaded {
-		return nil, 0, false
-	}
-	timeNow := time.Now()
-	if timeNow.After(expireAt) {
-		if c.optimisticTimeout > 0 && timeNow.Before(expireAt.Add(c.optimisticTimeout)) {
-			response = response.Copy()
-			normalizeTTL(response, 1)
-			return response, 0, true
-		}
-		c.cache.Remove(key)
-		return nil, 0, false
-	}
-	nowTTL := int(expireAt.Sub(timeNow).Seconds())
-	if nowTTL < 0 {
-		nowTTL = 0
-	}
-	response = response.Copy()
-	normalizeTTL(response, uint32(nowTTL))
-	return response, nowTTL, false
-}
-
-func (c *Client) loadPersistentResponse(question dns.Question, transport adapter.DNSTransport) (*dns.Msg, int, bool) {
-	rawMessage, expireAt, loaded := c.dnsCache.LoadDNSCache(transport.Tag(), question.Name, question.Qtype)
-	if !loaded {
-		return nil, 0, false
-	}
-	response := new(dns.Msg)
-	err := response.Unpack(rawMessage)
-	if err != nil {
-		return nil, 0, false
-	}
-	if c.disableExpire {
-		return response, 0, false
-	}
-	timeNow := time.Now()
-	if timeNow.After(expireAt) {
-		if c.optimisticTimeout > 0 && timeNow.Before(expireAt.Add(c.optimisticTimeout)) {
-			normalizeTTL(response, 1)
-			return response, 0, true
-		}
-		return nil, 0, false
-	}
-	nowTTL := int(expireAt.Sub(timeNow).Seconds())
-	if nowTTL < 0 {
-		nowTTL = 0
-	}
-	normalizeTTL(response, uint32(nowTTL))
-	return response, nowTTL, false
-}
-
-func applyResponseOptions(question dns.Question, response *dns.Msg, options adapter.DNSQueryOptions) uint32 {
-	if question.Qtype == dns.TypeHTTPS && (options.Strategy == C.DomainStrategyIPv4Only || options.Strategy == C.DomainStrategyIPv6Only) {
-		for _, rr := range response.Answer {
-			https, isHTTPS := rr.(*dns.HTTPS)
-			if !isHTTPS {
-				continue
-			}
-			content := https.SVCB
-			content.Value = common.Filter(content.Value, func(it dns.SVCBKeyValue) bool {
-				if options.Strategy == C.DomainStrategyIPv4Only {
-					return it.Key() != dns.SVCB_IPV6HINT
-				}
-				return it.Key() != dns.SVCB_IPV4HINT
+		if !c.independentCache {
+			response, loaded = c.cache.Get(question)
+		} else {
+			response, loaded = c.transportCache.Get(transportCacheKey{
+				Question:     question,
+				transportTag: transport.Tag(),
 			})
-			https.SVCB = content
 		}
-	}
-	timeToLive := computeTimeToLive(response)
-	if options.RewriteTTL != nil {
-		timeToLive = *options.RewriteTTL
-	}
-	normalizeTTL(response, timeToLive)
-	return timeToLive
-}
-
-func (c *Client) backgroundRefreshDNS(transport adapter.DNSTransport, question dns.Question, message *dns.Msg, options adapter.DNSQueryOptions, responseChecker func(response *dns.Msg) bool) {
-	key := dnsCacheKey{Question: question, transportTag: transport.Tag()}
-	_, loaded := c.backgroundRefresh.LoadOrStore(key, struct{}{})
-	if loaded {
-		return
-	}
-	go func() {
-		defer c.backgroundRefresh.Delete(key)
-		ctx := contextWithTransportTag(c.ctx, transport.Tag())
-		response, err := c.exchangeToTransport(ctx, transport, message)
-		if err != nil {
-			if c.logger != nil {
-				c.logger.Debug("optimistic refresh failed for ", FqdnToDomain(question.Name), ": ", err)
-			}
-			return
+		if !loaded {
+			return nil, 0
 		}
-		if responseChecker != nil {
-			var rejected bool
-			if response.Rcode != dns.RcodeSuccess && response.Rcode != dns.RcodeNameError {
-				rejected = true
+		return response.Copy(), 0
+	} else {
+		var expireAt time.Time
+		if !c.independentCache {
+			response, expireAt, loaded = c.cache.GetWithLifetime(question)
+		} else {
+			response, expireAt, loaded = c.transportCache.GetWithLifetime(transportCacheKey{
+				Question:     question,
+				transportTag: transport.Tag(),
+			})
+		}
+		if !loaded {
+			return nil, 0
+		}
+		timeNow := time.Now()
+		if timeNow.After(expireAt) {
+			if !c.independentCache {
+				c.cache.Remove(question)
 			} else {
-				rejected = !responseChecker(response)
+				c.transportCache.Remove(transportCacheKey{
+					Question:     question,
+					transportTag: transport.Tag(),
+				})
 			}
-			if rejected {
-				if c.rdrc != nil {
-					c.rdrc.SaveRDRCAsync(transport.Tag(), question.Name, question.Qtype, c.logger)
-				}
-				return
-			}
-		} else if response.Rcode != dns.RcodeSuccess && response.Rcode != dns.RcodeNameError {
-			return
+			return nil, 0
 		}
-		timeToLive := applyResponseOptions(question, response, options)
-		c.storeCache(transport, question, response, timeToLive)
-	}()
-}
-
-func (c *Client) prepareExchangeMessage(message *dns.Msg, options adapter.DNSQueryOptions) *dns.Msg {
-	clientSubnet := options.ClientSubnet
-	if !clientSubnet.IsValid() {
-		clientSubnet = c.clientSubnet
+		var originTTL int
+		for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
+			for _, record := range recordList {
+				if originTTL == 0 || record.Header().Ttl > 0 && int(record.Header().Ttl) < originTTL {
+					originTTL = int(record.Header().Ttl)
+				}
+			}
+		}
+		nowTTL := int(expireAt.Sub(timeNow).Seconds())
+		if nowTTL < 0 {
+			nowTTL = 0
+		}
+		response = response.Copy()
+		if originTTL > 0 {
+			duration := uint32(originTTL - nowTTL)
+			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
+				for _, record := range recordList {
+					record.Header().Ttl = record.Header().Ttl - duration
+				}
+			}
+		} else {
+			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
+				for _, record := range recordList {
+					record.Header().Ttl = uint32(nowTTL)
+				}
+			}
+		}
+		return response, nowTTL
 	}
-	if clientSubnet.IsValid() {
-		message = SetClientSubnet(message, clientSubnet)
-	}
-	return message
-}
-
-func (c *Client) exchangeToTransport(ctx context.Context, transport adapter.DNSTransport, message *dns.Msg) (*dns.Msg, error) {
-	ctx, cancel := context.WithTimeout(ctx, c.timeout)
-	defer cancel()
-	response, err := transport.Exchange(ctx, message)
-	if err == nil {
-		return response, nil
-	}
-	var rcodeError RcodeError
-	if errors.As(err, &rcodeError) {
-		return FixedResponseStatus(message, int(rcodeError)), nil
-	}
-	return nil, err
 }
 
 func MessageToAddresses(response *dns.Msg) []netip.Addr {
-	return adapter.DNSResponseAddresses(response)
+	if response == nil || response.Rcode != dns.RcodeSuccess {
+		return nil
+	}
+	addresses := make([]netip.Addr, 0, len(response.Answer))
+	for _, rawAnswer := range response.Answer {
+		switch answer := rawAnswer.(type) {
+		case *dns.A:
+			addresses = append(addresses, M.AddrFromIP(answer.A))
+		case *dns.AAAA:
+			addresses = append(addresses, M.AddrFromIP(answer.AAAA))
+		case *dns.HTTPS:
+			for _, value := range answer.SVCB.Value {
+				if value.Key() == dns.SVCB_IPV4HINT || value.Key() == dns.SVCB_IPV6HINT {
+					addresses = append(addresses, common.Map(strings.Split(value.String(), ","), M.ParseAddr)...)
+				}
+			}
+		}
+	}
+	return addresses
 }
 
 func wrapError(err error) error {

dns/client_log.go

@@ -22,19 +22,6 @@ func logCachedResponse(logger logger.ContextLogger, ctx context.Context, respons
 	}
 }
 
-func logOptimisticResponse(logger logger.ContextLogger, ctx context.Context, response *dns.Msg) {
-	if logger == nil || len(response.Question) == 0 {
-		return
-	}
-	domain := FqdnToDomain(response.Question[0].Name)
-	logger.DebugContext(ctx, "optimistic ", domain, " ", dns.RcodeToString[response.Rcode])
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			logger.InfoContext(ctx, "optimistic ", dns.Type(record.Header().Rrtype).String(), " ", FormatQuestion(record.String()))
-		}
-	}
-}
-
 func logExchangedResponse(logger logger.ContextLogger, ctx context.Context, response *dns.Msg, ttl uint32) {
 	if logger == nil || len(response.Question) == 0 {
 		return

dns/rcode.go

@@ -5,11 +5,10 @@ import (
 )
 
 const (
-	RcodeSuccess       RcodeError = mDNS.RcodeSuccess
-	RcodeServerFailure RcodeError = mDNS.RcodeServerFailure
-	RcodeFormatError   RcodeError = mDNS.RcodeFormatError
-	RcodeNameError     RcodeError = mDNS.RcodeNameError
-	RcodeRefused       RcodeError = mDNS.RcodeRefused
+	RcodeSuccess     RcodeError = mDNS.RcodeSuccess
+	RcodeFormatError RcodeError = mDNS.RcodeFormatError
+	RcodeNameError   RcodeError = mDNS.RcodeNameError
+	RcodeRefused     RcodeError = mDNS.RcodeRefused
 )
 
 type RcodeError int

dns/repro_test.go

@@ -1,111 +0,0 @@
-package dns
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json/badoption"
-
-	mDNS "github.com/miekg/dns"
-	"github.com/stretchr/testify/require"
-)
-
-func TestReproLookupWithRulesUsesRequestStrategy(t *testing.T) {
-	t.Parallel()
-
-	defaultTransport := &fakeDNSTransport{tag: "default", transportType: C.DNSTypeUDP}
-	var qTypes []uint16
-	router := newTestRouter(t, nil, &fakeDNSTransportManager{
-		defaultTransport: defaultTransport,
-		transports: map[string]adapter.DNSTransport{
-			"default": defaultTransport,
-		},
-	}, &fakeDNSClient{
-		exchange: func(transport adapter.DNSTransport, message *mDNS.Msg) (*mDNS.Msg, error) {
-			qTypes = append(qTypes, message.Question[0].Qtype)
-			if message.Question[0].Qtype == mDNS.TypeA {
-				return FixedResponse(0, message.Question[0], []netip.Addr{netip.MustParseAddr("2.2.2.2")}, 60), nil
-			}
-			return FixedResponse(0, message.Question[0], []netip.Addr{netip.MustParseAddr("2001:db8::1")}, 60), nil
-		},
-	})
-
-	addresses, err := router.Lookup(context.Background(), "example.com", adapter.DNSQueryOptions{
-		Strategy: C.DomainStrategyIPv4Only,
-	})
-	require.NoError(t, err)
-	require.Equal(t, []uint16{mDNS.TypeA}, qTypes)
-	require.Equal(t, []netip.Addr{netip.MustParseAddr("2.2.2.2")}, addresses)
-}
-
-func TestReproLogicalMatchResponseIPCIDR(t *testing.T) {
-	t.Parallel()
-
-	transportManager := &fakeDNSTransportManager{
-		defaultTransport: &fakeDNSTransport{tag: "default", transportType: C.DNSTypeUDP},
-		transports: map[string]adapter.DNSTransport{
-			"upstream": &fakeDNSTransport{tag: "upstream", transportType: C.DNSTypeUDP},
-			"selected": &fakeDNSTransport{tag: "selected", transportType: C.DNSTypeUDP},
-			"default":  &fakeDNSTransport{tag: "default", transportType: C.DNSTypeUDP},
-		},
-	}
-	client := &fakeDNSClient{
-		exchange: func(transport adapter.DNSTransport, message *mDNS.Msg) (*mDNS.Msg, error) {
-			switch transport.Tag() {
-			case "upstream":
-				return FixedResponse(0, message.Question[0], []netip.Addr{netip.MustParseAddr("1.1.1.1")}, 60), nil
-			case "selected":
-				return FixedResponse(0, message.Question[0], []netip.Addr{netip.MustParseAddr("8.8.8.8")}, 60), nil
-			default:
-				return nil, E.New("unexpected transport")
-			}
-		},
-	}
-	rules := []option.DNSRule{
-		{
-			Type: C.RuleTypeDefault,
-			DefaultOptions: option.DefaultDNSRule{
-				RawDefaultDNSRule: option.RawDefaultDNSRule{
-					Domain: badoption.Listable[string]{"example.com"},
-				},
-				DNSRuleAction: option.DNSRuleAction{
-					Action:       C.RuleActionTypeEvaluate,
-					RouteOptions: option.DNSRouteActionOptions{Server: "upstream"},
-				},
-			},
-		},
-		{
-			Type: C.RuleTypeLogical,
-			LogicalOptions: option.LogicalDNSRule{
-				RawLogicalDNSRule: option.RawLogicalDNSRule{
-					Mode: C.LogicalTypeOr,
-					Rules: []option.DNSRule{{
-						Type: C.RuleTypeDefault,
-						DefaultOptions: option.DefaultDNSRule{
-							RawDefaultDNSRule: option.RawDefaultDNSRule{
-								MatchResponse: true,
-								IPCIDR:        badoption.Listable[string]{"1.1.1.0/24"},
-							},
-						},
-					}},
-				},
-				DNSRuleAction: option.DNSRuleAction{
-					Action:       C.RuleActionTypeRoute,
-					RouteOptions: option.DNSRouteActionOptions{Server: "selected"},
-				},
-			},
-		},
-	}
-	router := newTestRouter(t, rules, transportManager, client)
-
-	response, err := router.Exchange(context.Background(), &mDNS.Msg{
-		Question: []mDNS.Question{fixedQuestion("example.com", mDNS.TypeA)},
-	}, adapter.DNSQueryOptions{})
-	require.NoError(t, err)
-	require.Equal(t, []netip.Addr{netip.MustParseAddr("8.8.8.8")}, MessageToAddresses(response))
-}

dns/transport/local/local_darwin.go

@@ -4,6 +4,8 @@ package local
 
 import (
 	"context"
+	"errors"
+	"net"
 
 	"github.com/sagernet/sing-box/adapter"
 	C "github.com/sagernet/sing-box/constant"
@@ -12,6 +14,7 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/logger"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
@@ -32,8 +35,10 @@ type Transport struct {
 	logger        logger.ContextLogger
 	hosts         *hosts.File
 	dialer        N.Dialer
+	preferGo      bool
 	fallback      bool
 	dhcpTransport dhcpTransport
+	resolver      net.Resolver
 }
 
 type dhcpTransport interface {
@@ -47,12 +52,14 @@ func NewTransport(ctx context.Context, logger log.ContextLogger, tag string, opt
 	if err != nil {
 		return nil, err
 	}
+	transportAdapter := dns.NewTransportAdapterWithLocalOptions(C.DNSTypeLocal, tag, options)
 	return &Transport{
-		TransportAdapter: dns.NewTransportAdapterWithLocalOptions(C.DNSTypeLocal, tag, options),
+		TransportAdapter: transportAdapter,
 		ctx:              ctx,
 		logger:           logger,
 		hosts:            hosts.NewFile(hosts.DefaultPath),
 		dialer:           transportDialer,
+		preferGo:         options.PreferGo,
 	}, nil
 }
 
@@ -90,3 +97,44 @@ func (t *Transport) Reset() {
 		t.dhcpTransport.Reset()
 	}
 }
+
+func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
+	question := message.Question[0]
+	if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA {
+		addresses := t.hosts.Lookup(dns.FqdnToDomain(question.Name))
+		if len(addresses) > 0 {
+			return dns.FixedResponse(message.Id, question, addresses, C.DefaultDNSTTL), nil
+		}
+	}
+	if !t.fallback {
+		return t.exchange(ctx, message, question.Name)
+	}
+	if t.dhcpTransport != nil {
+		dhcpTransports := t.dhcpTransport.Fetch()
+		if len(dhcpTransports) > 0 {
+			return t.dhcpTransport.Exchange0(ctx, message, dhcpTransports)
+		}
+	}
+	if t.preferGo {
+		// Assuming the user knows what they are doing, we still execute the query which will fail.
+		return t.exchange(ctx, message, question.Name)
+	}
+	if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA {
+		var network string
+		if question.Qtype == mDNS.TypeA {
+			network = "ip4"
+		} else {
+			network = "ip6"
+		}
+		addresses, err := t.resolver.LookupNetIP(ctx, network, question.Name)
+		if err != nil {
+			var dnsError *net.DNSError
+			if errors.As(err, &dnsError) && dnsError.IsNotFound {
+				return nil, dns.RcodeRefused
+			}
+			return nil, err
+		}
+		return dns.FixedResponse(message.Id, question, addresses, C.DefaultDNSTTL), nil
+	}
+	return nil, E.New("only A and AAAA queries are supported on Apple platforms when using TUN and DHCP unavailable.")
+}

dns/transport/local/local_darwin_cgo.go

@@ -1,249 +0,0 @@
-//go:build darwin
-
-package local
-
-/*
-#include <stdlib.h>
-#include <dns.h>
-#include <resolv.h>
-
-static void *cgo_dns_open_super() {
-	return (void *)dns_open(NULL);
-}
-
-static void cgo_dns_close(void *opaque) {
-	if (opaque != NULL) dns_free((dns_handle_t)opaque);
-}
-
-static int cgo_dns_search(void *opaque, const char *name, int class, int type,
-	unsigned char *answer, int anslen) {
-	dns_handle_t handle = (dns_handle_t)opaque;
-	struct sockaddr_storage from;
-	uint32_t fromlen = sizeof(from);
-	return dns_search(handle, name, class, type, (char *)answer, anslen, (struct sockaddr *)&from, &fromlen);
-}
-
-static void *cgo_res_init() {
-	res_state state = calloc(1, sizeof(struct __res_state));
-	if (state == NULL) return NULL;
-	if (res_ninit(state) != 0) {
-		free(state);
-		return NULL;
-	}
-	return state;
-}
-
-static void cgo_res_destroy(void *opaque) {
-	res_state state = (res_state)opaque;
-	res_ndestroy(state);
-	free(state);
-}
-
-static int cgo_res_nsearch(void *opaque, const char *dname, int class, int type,
-	unsigned char *answer, int anslen,
-	int timeout_seconds,
-	int *out_h_errno) {
-	res_state state = (res_state)opaque;
-	state->retrans = timeout_seconds;
-	state->retry = 1;
-	int n = res_nsearch(state, dname, class, type, answer, anslen);
-	if (n < 0) {
-		*out_h_errno = state->res_h_errno;
-	}
-	return n;
-}
-*/
-import "C"
-
-import (
-	"context"
-	"errors"
-	"time"
-	"unsafe"
-
-	boxC "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	mDNS "github.com/miekg/dns"
-)
-
-const (
-	darwinResolverHostNotFound = 1
-	darwinResolverTryAgain     = 2
-	darwinResolverNoRecovery   = 3
-	darwinResolverNoData       = 4
-
-	darwinResolverMaxPacketSize = 65535
-)
-
-var errDarwinNeedLargerBuffer = errors.New("darwin resolver response truncated")
-
-func darwinLookupSystemDNS(name string, class, qtype, timeoutSeconds int) (*mDNS.Msg, error) {
-	response, err := darwinSearchWithSystemRouting(name, class, qtype)
-	if err == nil {
-		return response, nil
-	}
-	fallbackResponse, fallbackErr := darwinSearchWithResolv(name, class, qtype, timeoutSeconds)
-	if fallbackErr == nil || fallbackResponse != nil {
-		return fallbackResponse, fallbackErr
-	}
-	return nil, E.Errors(
-		E.Cause(err, "dns_search"),
-		E.Cause(fallbackErr, "res_nsearch"),
-	)
-}
-
-func darwinSearchWithSystemRouting(name string, class, qtype int) (*mDNS.Msg, error) {
-	handle := C.cgo_dns_open_super()
-	if handle == nil {
-		return nil, E.New("dns_open failed")
-	}
-	defer C.cgo_dns_close(handle)
-
-	cName := C.CString(name)
-	defer C.free(unsafe.Pointer(cName))
-
-	bufSize := 1232
-	for {
-		answer := make([]byte, bufSize)
-		n := C.cgo_dns_search(handle, cName, C.int(class), C.int(qtype),
-			(*C.uchar)(unsafe.Pointer(&answer[0])), C.int(len(answer)))
-		if n <= 0 {
-			return nil, E.New("dns_search failed for ", name)
-		}
-		if int(n) > bufSize {
-			bufSize = int(n)
-			continue
-		}
-		return unpackDarwinResolverMessage(answer[:int(n)], "dns_search")
-	}
-}
-
-func darwinSearchWithResolv(name string, class, qtype int, timeoutSeconds int) (*mDNS.Msg, error) {
-	state := C.cgo_res_init()
-	if state == nil {
-		return nil, E.New("res_ninit failed")
-	}
-	defer C.cgo_res_destroy(state)
-
-	cName := C.CString(name)
-	defer C.free(unsafe.Pointer(cName))
-
-	bufSize := 1232
-	for {
-		answer := make([]byte, bufSize)
-		var hErrno C.int
-		n := C.cgo_res_nsearch(state, cName, C.int(class), C.int(qtype),
-			(*C.uchar)(unsafe.Pointer(&answer[0])), C.int(len(answer)),
-			C.int(timeoutSeconds),
-			&hErrno)
-		if n >= 0 {
-			if int(n) > bufSize {
-				bufSize = int(n)
-				continue
-			}
-			return unpackDarwinResolverMessage(answer[:int(n)], "res_nsearch")
-		}
-		response, err := handleDarwinResolvFailure(name, answer, int(hErrno))
-		if err == nil {
-			return response, nil
-		}
-		if errors.Is(err, errDarwinNeedLargerBuffer) && bufSize < darwinResolverMaxPacketSize {
-			bufSize *= 2
-			if bufSize > darwinResolverMaxPacketSize {
-				bufSize = darwinResolverMaxPacketSize
-			}
-			continue
-		}
-		return nil, err
-	}
-}
-
-func unpackDarwinResolverMessage(packet []byte, source string) (*mDNS.Msg, error) {
-	var response mDNS.Msg
-	err := response.Unpack(packet)
-	if err != nil {
-		return nil, E.Cause(err, "unpack ", source, " response")
-	}
-	return &response, nil
-}
-
-func handleDarwinResolvFailure(name string, answer []byte, hErrno int) (*mDNS.Msg, error) {
-	response, err := unpackDarwinResolverMessage(answer, "res_nsearch failure")
-	if err == nil && response.Response {
-		if response.Truncated && len(answer) < darwinResolverMaxPacketSize {
-			return nil, errDarwinNeedLargerBuffer
-		}
-		return response, nil
-	}
-	return nil, darwinResolverHErrno(name, hErrno)
-}
-
-func darwinResolverHErrno(name string, hErrno int) error {
-	switch hErrno {
-	case darwinResolverHostNotFound:
-		return dns.RcodeNameError
-	case darwinResolverTryAgain:
-		return dns.RcodeServerFailure
-	case darwinResolverNoRecovery:
-		return dns.RcodeServerFailure
-	case darwinResolverNoData:
-		return dns.RcodeSuccess
-	default:
-		return E.New("res_nsearch: unknown error ", hErrno, " for ", name)
-	}
-}
-
-func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	question := message.Question[0]
-	if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA {
-		addresses := t.hosts.Lookup(dns.FqdnToDomain(question.Name))
-		if len(addresses) > 0 {
-			return dns.FixedResponse(message.Id, question, addresses, boxC.DefaultDNSTTL), nil
-		}
-	}
-	if t.fallback && t.dhcpTransport != nil {
-		dhcpServers := t.dhcpTransport.Fetch()
-		if len(dhcpServers) > 0 {
-			return t.dhcpTransport.Exchange0(ctx, message, dhcpServers)
-		}
-	}
-	name := question.Name
-	timeoutSeconds := int(boxC.DNSTimeout / time.Second)
-	if deadline, hasDeadline := ctx.Deadline(); hasDeadline {
-		remaining := time.Until(deadline)
-		if remaining <= 0 {
-			return nil, context.DeadlineExceeded
-		}
-		seconds := int(remaining.Seconds())
-		if seconds < 1 {
-			seconds = 1
-		}
-		timeoutSeconds = seconds
-	}
-	type resolvResult struct {
-		response *mDNS.Msg
-		err      error
-	}
-	resultCh := make(chan resolvResult, 1)
-	go func() {
-		response, err := darwinLookupSystemDNS(name, int(question.Qclass), int(question.Qtype), timeoutSeconds)
-		resultCh <- resolvResult{response, err}
-	}()
-	var result resolvResult
-	select {
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	case result = <-resultCh:
-	}
-	if result.err != nil {
-		var rcodeError dns.RcodeError
-		if errors.As(result.err, &rcodeError) {
-			return dns.FixedResponseStatus(message, int(rcodeError)), nil
-		}
-		return nil, result.err
-	}
-	result.response.Id = message.Id
-	return result.response, nil
-}

dns/transport/local/local_shared.go

@@ -1,5 +1,3 @@
-//go:build !darwin
-
 package local
 
 import (

dns/transport_adapter.go

@@ -1,13 +1,21 @@
 package dns
 
 import (
+	"net/netip"
+
+	"github.com/sagernet/sing-box/adapter"
+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 )
 
+var _ adapter.LegacyDNSTransport = (*TransportAdapter)(nil)
+
 type TransportAdapter struct {
 	transportType string
 	transportTag  string
 	dependencies  []string
+	strategy      C.DomainStrategy
+	clientSubnet  netip.Prefix
 }
 
 func NewTransportAdapter(transportType string, transportTag string, dependencies []string) TransportAdapter {
@@ -27,6 +35,8 @@ func NewTransportAdapterWithLocalOptions(transportType string, transportTag stri
 		transportType: transportType,
 		transportTag:  transportTag,
 		dependencies:  dependencies,
+		strategy:      C.DomainStrategy(localOptions.LegacyStrategy),
+		clientSubnet:  localOptions.LegacyClientSubnet,
 	}
 }
 
@@ -35,10 +45,15 @@ func NewTransportAdapterWithRemoteOptions(transportType string, transportTag str
 	if remoteOptions.DomainResolver != nil && remoteOptions.DomainResolver.Server != "" {
 		dependencies = append(dependencies, remoteOptions.DomainResolver.Server)
 	}
+	if remoteOptions.LegacyAddressResolver != "" {
+		dependencies = append(dependencies, remoteOptions.LegacyAddressResolver)
+	}
 	return TransportAdapter{
 		transportType: transportType,
 		transportTag:  transportTag,
 		dependencies:  dependencies,
+		strategy:      C.DomainStrategy(remoteOptions.LegacyStrategy),
+		clientSubnet:  remoteOptions.LegacyClientSubnet,
 	}
 }
 
@@ -53,3 +68,11 @@ func (a *TransportAdapter) Tag() string {
 func (a *TransportAdapter) Dependencies() []string {
 	return a.dependencies
 }
+
+func (a *TransportAdapter) LegacyStrategy() C.DomainStrategy {
+	return a.strategy
+}
+
+func (a *TransportAdapter) LegacyClientSubnet() netip.Prefix {
+	return a.clientSubnet
+}

dns/transport_dialer.go

@@ -2,25 +2,104 @@ package dns
 
 import (
 	"context"
+	"net"
+	"time"
 
+	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/dialer"
+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
+	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/service"
 )
 
 func NewLocalDialer(ctx context.Context, options option.LocalDNSServerOptions) (N.Dialer, error) {
-	return dialer.NewWithOptions(dialer.Options{
-		Context:        ctx,
-		Options:        options.DialerOptions,
-		DirectResolver: true,
-	})
+	if options.LegacyDefaultDialer {
+		return dialer.NewDefaultOutbound(ctx), nil
+	} else {
+		return dialer.NewWithOptions(dialer.Options{
+			Context:         ctx,
+			Options:         options.DialerOptions,
+			DirectResolver:  true,
+			LegacyDNSDialer: options.Legacy,
+		})
+	}
 }
 
 func NewRemoteDialer(ctx context.Context, options option.RemoteDNSServerOptions) (N.Dialer, error) {
-	return dialer.NewWithOptions(dialer.Options{
-		Context:        ctx,
-		Options:        options.DialerOptions,
-		RemoteIsDomain: options.ServerIsDomain(),
-		DirectResolver: true,
-	})
+	if options.LegacyDefaultDialer {
+		transportDialer := dialer.NewDefaultOutbound(ctx)
+		if options.LegacyAddressResolver != "" {
+			transport := service.FromContext[adapter.DNSTransportManager](ctx)
+			resolverTransport, loaded := transport.Transport(options.LegacyAddressResolver)
+			if !loaded {
+				return nil, E.New("address resolver not found: ", options.LegacyAddressResolver)
+			}
+			transportDialer = newTransportDialer(transportDialer, service.FromContext[adapter.DNSRouter](ctx), resolverTransport, C.DomainStrategy(options.LegacyAddressStrategy), time.Duration(options.LegacyAddressFallbackDelay))
+		} else if options.ServerIsDomain() {
+			return nil, E.New("missing address resolver for server: ", options.Server)
+		}
+		return transportDialer, nil
+	} else {
+		return dialer.NewWithOptions(dialer.Options{
+			Context:         ctx,
+			Options:         options.DialerOptions,
+			RemoteIsDomain:  options.ServerIsDomain(),
+			DirectResolver:  true,
+			LegacyDNSDialer: options.Legacy,
+		})
+	}
+}
+
+type legacyTransportDialer struct {
+	dialer        N.Dialer
+	dnsRouter     adapter.DNSRouter
+	transport     adapter.DNSTransport
+	strategy      C.DomainStrategy
+	fallbackDelay time.Duration
+}
+
+func newTransportDialer(dialer N.Dialer, dnsRouter adapter.DNSRouter, transport adapter.DNSTransport, strategy C.DomainStrategy, fallbackDelay time.Duration) *legacyTransportDialer {
+	return &legacyTransportDialer{
+		dialer,
+		dnsRouter,
+		transport,
+		strategy,
+		fallbackDelay,
+	}
+}
+
+func (d *legacyTransportDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	if destination.IsIP() {
+		return d.dialer.DialContext(ctx, network, destination)
+	}
+	addresses, err := d.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{
+		Transport: d.transport,
+		Strategy:  d.strategy,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return N.DialParallel(ctx, d.dialer, network, destination, addresses, d.strategy == C.DomainStrategyPreferIPv6, d.fallbackDelay)
+}
+
+func (d *legacyTransportDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	if destination.IsIP() {
+		return d.dialer.ListenPacket(ctx, destination)
+	}
+	addresses, err := d.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{
+		Transport: d.transport,
+		Strategy:  d.strategy,
+	})
+	if err != nil {
+		return nil, err
+	}
+	conn, _, err := N.ListenSerial(ctx, d.dialer, destination, addresses)
+	return conn, err
+}
+
+func (d *legacyTransportDialer) Upstream() any {
+	return d.dialer
 }

docs/changelog.md

@@ -2,88 +2,6 @@
 icon: material/alert-decagram
 ---
 
-#### 1.14.0-alpha.11
-
-* Add optimistic DNS cache **1**
-* Update NaiveProxy to 147.0.7727.49
-* Fixes and improvements
-
-**1**:
-
-Optimistic DNS cache returns an expired cached response immediately while
-refreshing it in the background, reducing tail latency for repeated
-queries. Enabled via [`optimistic`](/configuration/dns/#optimistic)
-in DNS options, and can be persisted across restarts with the new
-[`store_dns`](/configuration/experimental/cache-file/#store_dns) cache
-file option. A per-query
-[`disable_optimistic_cache`](/configuration/dns/rule_action/#disable_optimistic_cache)
-field is also available on DNS rule actions and the `resolve` route rule
-action.
-
-This deprecates the `independent_cache` DNS option (the DNS cache now
-always keys by transport) and the `store_rdrc` cache file option
-(replaced by `store_dns`); both will be removed in sing-box 1.16.0.
-See [Migration](/migration/#migrate-independent-dns-cache).
-
-#### 1.14.0-alpha.10
-
-* Add `evaluate` DNS rule action and Response Match Fields **1**
-* `ip_version` and `query_type` now also take effect on internal DNS lookups **2**
-* Add `package_name_regex` route, DNS and headless rule item **3**
-* Add cloudflared inbound **4**
-* Fixes and improvements
-
-**1**:
-
-Response Match Fields
-([`response_rcode`](/configuration/dns/rule/#response_rcode),
-[`response_answer`](/configuration/dns/rule/#response_answer),
-[`response_ns`](/configuration/dns/rule/#response_ns),
-and [`response_extra`](/configuration/dns/rule/#response_extra))
-match the evaluated DNS response. They are gated by the new
-[`match_response`](/configuration/dns/rule/#match_response) field and
-populated by a preceding
-[`evaluate`](/configuration/dns/rule_action/#evaluate) DNS rule action;
-the evaluated response can also be returned directly by a
-[`respond`](/configuration/dns/rule_action/#respond) action.
-
-This deprecates the Legacy Address Filter Fields (`ip_cidr`,
-`ip_is_private` without `match_response`) in DNS rules, the Legacy
-`strategy` DNS rule action option, and the Legacy
-`rule_set_ip_cidr_accept_empty` DNS rule item; all three will be removed
-in sing-box 1.16.0.
-See [Migration](/migration/#migrate-address-filter-fields-to-response-matching).
-
-**2**:
-
-`ip_version` and `query_type` in DNS rules, together with `query_type` in
-referenced rule-sets, now take effect on every DNS rule evaluation,
-including matches from internal domain resolutions that do not target a
-specific DNS server (for example a `resolve` route rule action without
-`server` set). In earlier versions they were silently ignored in that
-path. Combining these fields with any of the legacy DNS fields deprecated
-in **1** in the same DNS configuration is no longer supported and is
-rejected at startup.
-See [Migration](/migration/#ip_version-and-query_type-behavior-changes-in-dns-rules).
-
-**3**:
-
-See [Route Rule](/configuration/route/rule/#package_name_regex),
-[DNS Rule](/configuration/dns/rule/#package_name_regex) and
-[Headless Rule](/configuration/rule-set/headless-rule/#package_name_regex).
-
-**4**:
-
-See [Cloudflared](/configuration/inbound/cloudflared/).
-
-#### 1.13.7
-
-* Fixes and improvement
-
-#### 1.13.6
-
-* Fixes and improvements
-
 #### 1.14.0-alpha.8
 
 * Add BBR profile and hop interval randomization for Hysteria2 **1**
@@ -826,7 +744,7 @@ DNS servers are refactored for better performance and scalability.
 
 See [DNS server](/configuration/dns/server/).
 
-For migration, see [Migrate to new DNS server formats](/migration/#migrate-to-new-dns-server-formats).
+For migration, see [Migrate to new DNS server formats](/migration/#migrate-to-new-dns-servers).
 
 Compatibility for old formats will be removed in sing-box 1.14.0.
 
@@ -1296,7 +1214,7 @@ DNS servers are refactored for better performance and scalability.
 
 See [DNS server](/configuration/dns/server/).
 
-For migration, see [Migrate to new DNS server formats](/migration/#migrate-to-new-dns-server-formats).
+For migration, see [Migrate to new DNS server formats](/migration/#migrate-to-new-dns-servers).
 
 Compatibility for old formats will be removed in sing-box 1.14.0.
 
@@ -2132,7 +2050,7 @@ See [Migration](/migration/#process_path-format-update-on-windows).
 The new DNS feature allows you to more precisely bypass Chinese websites via **DNS leaks**. Do not use plain local DNS
 if using this method.
 
-See [Legacy Address Filter Fields](/configuration/dns/rule#legacy-address-filter-fields).
+See [Address Filter Fields](/configuration/dns/rule#address-filter-fields).
 
 [Client example](/manual/proxy/client#traffic-bypass-usage-for-chinese-users) updated.
 
@@ -2146,7 +2064,7 @@ the [Client example](/manual/proxy/client#traffic-bypass-usage-for-chinese-users
 **5**:
 
 The new feature allows you to cache the check results of
-[Legacy Address Filter Fields](/configuration/dns/rule/#legacy-address-filter-fields) until expiration.
+[Address filter DNS rule items](/configuration/dns/rule/#address-filter-fields) until expiration.
 
 **6**:
 
@@ -2327,7 +2245,7 @@ See [TUN](/configuration/inbound/tun) inbound.
 **1**:
 
 The new feature allows you to cache the check results of
-[Legacy Address Filter Fields](/configuration/dns/rule/#legacy-address-filter-fields) until expiration.
+[Address filter DNS rule items](/configuration/dns/rule/#address-filter-fields) until expiration.
 
 #### 1.9.0-alpha.7
 
@@ -2374,7 +2292,7 @@ See [Migration](/migration/#process_path-format-update-on-windows).
 The new DNS feature allows you to more precisely bypass Chinese websites via **DNS leaks**. Do not use plain local DNS
 if using this method.
 
-See [Legacy Address Filter Fields](/configuration/dns/rule#legacy-address-filter-fields).
+See [Address Filter Fields](/configuration/dns/rule#address-filter-fields).
 
 [Client example](/manual/proxy/client#traffic-bypass-usage-for-chinese-users) updated.
 

docs/clients/android/features.md

@@ -42,7 +42,6 @@ SFA provides an unprivileged TUN implementation through Android VpnService.
 | `process_path`        | :material-close: | No permission                     |
 | `process_path_regex`  | :material-close: | No permission                     |
 | `package_name`        | :material-check: | /                                 |
-| `package_name_regex`  | :material-check: | /                                 |
 | `user`                | :material-close: | Use `package_name` instead        |
 | `user_id`             | :material-close: | Use `package_name` instead        |
 | `wifi_ssid`           | :material-check: | Fine location permission required |

docs/clients/apple/features.md

@@ -44,7 +44,6 @@ SFI/SFM/SFT provides an unprivileged TUN implementation through NetworkExtension
 | `process_path`        | :material-close: | No permission         |
 | `process_path_regex`  | :material-close: | No permission         |
 | `package_name`        | :material-close: | /                     |
-| `package_name_regex`  | :material-close: | /                     |
 | `user`                | :material-close: | No permission         |
 | `user_id`             | :material-close: | No permission         |
 | `wifi_ssid`           | :material-alert: | Only supported on iOS |

docs/configuration/dns/fakeip.md

@@ -1,10 +1,10 @@
 ---
-icon: material/note-remove
+icon: material/delete-clock
 ---
 
-!!! failure "Removed in sing-box 1.14.0"
+!!! failure "Deprecated in sing-box 1.12.0"
 
-    Legacy fake-ip configuration is deprecated in sing-box 1.12.0 and removed in sing-box 1.14.0, check [Migration](/migration/#migrate-to-new-dns-server-formats).
+    Legacy fake-ip configuration is deprecated and will be removed in sing-box 1.14.0, check [Migration](/migration/#migrate-to-new-dns-servers).
 
 ### Structure
 
@@ -26,6 +26,6 @@ Enable FakeIP service.
 
 IPv4 address range for FakeIP.
 
-#### inet6_range
+#### inet6_address
 
 IPv6 address range for FakeIP.

docs/configuration/dns/fakeip.zh.md

@@ -1,10 +1,10 @@
 ---
-icon: material/note-remove
+icon: material/delete-clock
 ---
 
-!!! failure "已在 sing-box 1.14.0 移除"
+!!! failure "已在 sing-box 1.12.0 废弃"
 
-    旧的 fake-ip 配置已在 sing-box 1.12.0 废弃且已在 sing-box 1.14.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移到新的-dns-服务器格式)。
+    旧的 fake-ip 配置已废弃且将在 sing-box 1.14.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移到新的-dns-服务器格式)。
 
 ### 结构
 

docs/configuration/dns/index.md

@@ -2,11 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-delete-clock: [independent_cache](#independent_cache)  
-    :material-plus: [optimistic](#optimistic)
-
 !!! quote "Changes in sing-box 1.12.0"
 
     :material-decagram: [servers](#servers)
@@ -30,7 +25,6 @@ icon: material/alert-decagram
     "disable_expire": false,
     "independent_cache": false,
     "cache_capacity": 0,
-    "optimistic": false, // or {}
     "reverse_mapping": false,
     "client_subnet": "",
     "fakeip": {}
@@ -45,7 +39,7 @@ icon: material/alert-decagram
 |----------|---------------------------------|
 | `server` | List of [DNS Server](./server/) |
 | `rules`  | List of [DNS Rule](./rule/)     |
-| `fakeip` | :material-note-remove: [FakeIP](./fakeip/) |
+| `fakeip` | [FakeIP](./fakeip/)             |
 
 #### final
 
@@ -63,20 +57,12 @@ One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
 
 Disable dns cache.
 
-Conflict with `optimistic`.
-
 #### disable_expire
 
 Disable dns cache expire.
 
-Conflict with `optimistic`.
-
 #### independent_cache
 
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    `independent_cache` is deprecated and will be removed in sing-box 1.14.0, check [Migration](/migration/#migrate-independent-dns-cache).
-
 Make each DNS server's cache independent for special purposes. If enabled, will slightly degrade performance.
 
 #### cache_capacity
@@ -87,34 +73,6 @@ LRU cache capacity.
 
 Value less than 1024 will be ignored.
 
-#### optimistic
-
-!!! question "Since sing-box 1.14.0"
-
-Enable optimistic DNS caching. When a cached DNS entry has expired but is still within the timeout window,
-the stale response is returned immediately while a background refresh is triggered.
-
-Conflict with `disable_cache` and `disable_expire`.
-
-Accepts a boolean or an object. When set to `true`, the default timeout of `3d` is used.
-
-```json
-{
-  "enabled": true,
-  "timeout": "3d"
-}
-```
-
-##### enabled
-
-Enable optimistic DNS caching.
-
-##### timeout
-
-The maximum time an expired cache entry can be served optimistically.
-
-`3d` is used by default.
-
 #### reverse_mapping
 
 Stores a reverse mapping of IP addresses after responding to a DNS query in order to provide domain names when routing.
@@ -130,4 +88,4 @@ Append a `edns0-subnet` OPT extra record with the specified IP prefix to every q
 
 If value is an IP address instead of prefix, `/32` or `/128` will be appended automatically.
 
-Can be overridden by `servers.[].client_subnet` or `rules.[].client_subnet`.
+Can be overrides by `servers.[].client_subnet` or `rules.[].client_subnet`.

docs/configuration/dns/index.zh.md

@@ -2,11 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-delete-clock: [independent_cache](#independent_cache)  
-    :material-plus: [optimistic](#optimistic)
-
 !!! quote "sing-box 1.12.0 中的更改"
 
     :material-decagram: [servers](#servers)
@@ -30,7 +25,6 @@ icon: material/alert-decagram
     "disable_expire": false,
     "independent_cache": false,
     "cache_capacity": 0,
-    "optimistic": false, // or {}
     "reverse_mapping": false,
     "client_subnet": "",
     "fakeip": {}
@@ -62,20 +56,12 @@ icon: material/alert-decagram
 
 禁用 DNS 缓存。
 
-与 `optimistic` 冲突。
-
 #### disable_expire
 
 禁用 DNS 缓存过期。
 
-与 `optimistic` 冲突。
-
 #### independent_cache
 
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    `independent_cache` 已在 sing-box 1.14.0 废弃，且将在 sing-box 1.16.0 中被移除，参阅[迁移指南](/zh/migration/#迁移-independent-dns-cache)。
-
 使每个 DNS 服务器的缓存独立，以满足特殊目的。如果启用，将轻微降低性能。
 
 #### cache_capacity
@@ -86,34 +72,6 @@ LRU 缓存容量。
 
 小于 1024 的值将被忽略。
 
-#### optimistic
-
-!!! question "自 sing-box 1.14.0 起"
-
-启用乐观 DNS 缓存。当缓存的 DNS 条目已过期但仍在超时窗口内时，
-立即返回过期的响应，同时在后台触发刷新。
-
-与 `disable_cache` 和 `disable_expire` 冲突。
-
-接受布尔值或对象。当设置为 `true` 时，使用默认超时 `3d`。
-
-```json
-{
-  "enabled": true,
-  "timeout": "3d"
-}
-```
-
-##### enabled
-
-启用乐观 DNS 缓存。
-
-##### timeout
-
-过期缓存条目可被乐观提供的最长时间。
-
-默认使用 `3d`。
-
 #### reverse_mapping
 
 在响应 DNS 查询后存储 IP 地址的反向映射以为路由目的提供域名。
@@ -130,6 +88,6 @@ LRU 缓存容量。
 
 可以被 `servers.[].client_subnet` 或 `rules.[].client_subnet` 覆盖。
 
-#### fakeip :material-note-remove:
+#### fakeip
 
 [FakeIP](./fakeip/) 设置。

docs/configuration/dns/rule.md

@@ -5,16 +5,7 @@ icon: material/alert-decagram
 !!! quote "Changes in sing-box 1.14.0"
 
     :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)  
-    :material-plus: [match_response](#match_response)  
-    :material-delete-clock: [rule_set_ip_cidr_accept_empty](#rule_set_ip_cidr_accept_empty)  
-    :material-plus: [response_rcode](#response_rcode)  
-    :material-plus: [response_answer](#response_answer)  
-    :material-plus: [response_ns](#response_ns)  
-    :material-plus: [response_extra](#response_extra)  
-    :material-plus: [package_name_regex](#package_name_regex)  
-    :material-alert: [ip_version](#ip_version)  
-    :material-alert: [query_type](#query_type)
+    :material-plus: [source_hostname](#source_hostname)
 
 !!! quote "Changes in sing-box 1.13.0"
 
@@ -103,6 +94,12 @@ icon: material/alert-decagram
           "192.168.0.1"
         ],
         "source_ip_is_private": false,
+        "ip_cidr": [
+          "10.0.0.0/24",
+          "192.168.0.1"
+        ],
+        "ip_is_private": false,
+        "ip_accept_any": false,
         "source_port": [
           12345
         ],
@@ -132,9 +129,6 @@ icon: material/alert-decagram
         "package_name": [
           "com.termux"
         ],
-        "package_name_regex": [
-          "^com\\.termux.*"
-        ],
         "user": [
           "sekai"
         ],
@@ -177,17 +171,7 @@ icon: material/alert-decagram
           "geosite-cn"
         ],
         "rule_set_ip_cidr_match_source": false,
-        "match_response": false,
-        "ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
-        ],
-        "ip_is_private": false,
-        "ip_accept_any": false,
-        "response_rcode": "",
-        "response_answer": [],
-        "response_ns": [],
-        "response_extra": [],
+        "rule_set_ip_cidr_accept_empty": false,
         "invert": false,
         "outbound": [
           "direct"
@@ -196,8 +180,7 @@ icon: material/alert-decagram
         "server": "local",
 
         // Deprecated
-
-        "rule_set_ip_cidr_accept_empty": false,
+        
         "rule_set_ipcidr_match_source": false,
         "geosite": [
           "cn"
@@ -245,46 +228,12 @@ Tags of [Inbound](/configuration/inbound/).
 
 #### ip_version
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    This field now also applies when a DNS rule is matched from an internal
-    domain resolution that does not target a specific DNS server, such as a
-    [`resolve`](../../route/rule_action/#resolve) route rule action without a
-    `server` set. In earlier versions, only DNS queries received from a
-    client evaluated this field. See
-    [Migration](/migration/#ip_version-and-query_type-behavior-changes-in-dns-rules)
-    for the full list.
-
-    Setting this field makes the DNS rule incompatible in the same DNS
-    configuration with Legacy Address Filter Fields in DNS rules, the Legacy
-    `strategy` DNS rule action option, and the Legacy
-    `rule_set_ip_cidr_accept_empty` DNS rule item. To combine with
-    address-based filtering, use the [`evaluate`](../rule_action/#evaluate)
-    action and [`match_response`](#match_response).
-
 4 (A DNS query) or 6 (AAAA DNS query).
 
 Not limited if empty.
 
 #### query_type
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    This field now also applies when a DNS rule is matched from an internal
-    domain resolution that does not target a specific DNS server, such as a
-    [`resolve`](../../route/rule_action/#resolve) route rule action without a
-    `server` set. In earlier versions, only DNS queries received from a
-    client evaluated this field. See
-    [Migration](/migration/#ip_version-and-query_type-behavior-changes-in-dns-rules)
-    for the full list.
-
-    Setting this field makes the DNS rule incompatible in the same DNS
-    configuration with Legacy Address Filter Fields in DNS rules, the Legacy
-    `strategy` DNS rule action option, and the Legacy
-    `rule_set_ip_cidr_accept_empty` DNS rule item. To combine with
-    address-based filtering, use the [`evaluate`](../rule_action/#evaluate)
-    action and [`match_response`](#match_response).
-
 DNS query type. Values can be integers or type name strings.
 
 #### network
@@ -387,12 +336,6 @@ Match process path using regular expression.
 
 Match android package name.
 
-#### package_name_regex
-
-!!! question "Since sing-box 1.14.0"
-
-Match android package name using regular expression.
-
 #### user
 
 !!! quote ""
@@ -534,25 +477,6 @@ Make `ip_cidr` rule items in rule-sets match the source IP.
 
 Make `ip_cidr` rule items in rule-sets match the source IP.
 
-#### match_response
-
-!!! question "Since sing-box 1.14.0"
-
-Enable response-based matching. When enabled, this rule matches against the evaluated response
-(set by a preceding [`evaluate`](/configuration/dns/rule_action/#evaluate) action)
-instead of only matching the original query.
-
-The evaluated response can also be returned directly by a later [`respond`](/configuration/dns/rule_action/#respond) action.
-
-Required for Response Match Fields (`response_rcode`, `response_answer`, `response_ns`, `response_extra`).
-Also required for `ip_cidr`, `ip_is_private`, and `ip_accept_any` when used with `evaluate` or Response Match Fields.
-
-#### ip_accept_any
-
-!!! question "Since sing-box 1.12.0"
-
-Match when the DNS query response contains at least one address.
-
 #### invert
 
 Invert match result.
@@ -597,12 +521,7 @@ See [DNS Rule Actions](../rule_action/) for details.
 
     Moved to [DNS Rule Action](../rule_action#route).
 
-### Legacy Address Filter Fields
-
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    Legacy Address Filter Fields are deprecated and will be removed in sing-box 1.16.0,
-    check [Migration](/migration/#migrate-address-filter-fields-to-response-matching).
+### Address Filter Fields
 
 Only takes effect for address requests (A/AAAA/HTTPS). When the query results do not match the address filtering rule items, the current rule will be skipped.
 
@@ -628,61 +547,23 @@ Match GeoIP with query response.
 
 Match IP CIDR with query response.
 
-As a Legacy Address Filter Field, deprecated. Use with `match_response` instead,
-check [Migration](/migration/#migrate-address-filter-fields-to-response-matching).
-
 #### ip_is_private
 
 !!! question "Since sing-box 1.9.0"
 
 Match private IP with query response.
 
-As a Legacy Address Filter Field, deprecated. Use with `match_response` instead,
-check [Migration](/migration/#migrate-address-filter-fields-to-response-matching).
-
 #### rule_set_ip_cidr_accept_empty
 
 !!! question "Since sing-box 1.10.0"
 
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    `rule_set_ip_cidr_accept_empty` is deprecated and will be removed in sing-box 1.16.0,
-    check [Migration](/migration/#migrate-address-filter-fields-to-response-matching).
-
 Make `ip_cidr` rules in rule-sets accept empty query response.
 
-### Response Match Fields
+#### ip_accept_any
 
-!!! question "Since sing-box 1.14.0"
+!!! question "Since sing-box 1.12.0"
 
-Match fields for the evaluated response. Require `match_response` to be set to `true`
-and a preceding rule with [`evaluate`](/configuration/dns/rule_action/#evaluate) action to populate the response.
-
-That evaluated response may also be returned directly by a later [`respond`](/configuration/dns/rule_action/#respond) action.
-
-#### response_rcode
-
-Match DNS response code.
-
-Accepted values are the same as in the [predefined action rcode](/configuration/dns/rule_action/#rcode).
-
-#### response_answer
-
-Match DNS answer records.
-
-Record format is the same as in [predefined action answer](/configuration/dns/rule_action/#answer).
-
-#### response_ns
-
-Match DNS name server records.
-
-Record format is the same as in [predefined action ns](/configuration/dns/rule_action/#ns).
-
-#### response_extra
-
-Match DNS extra records.
-
-Record format is the same as in [predefined action extra](/configuration/dns/rule_action/#extra).
+Match any IP with query response.
 
 ### Logical Fields
 

docs/configuration/dns/rule.zh.md

@@ -5,16 +5,7 @@ icon: material/alert-decagram
 !!! quote "sing-box 1.14.0 中的更改"
 
     :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)  
-    :material-plus: [match_response](#match_response)  
-    :material-delete-clock: [rule_set_ip_cidr_accept_empty](#rule_set_ip_cidr_accept_empty)  
-    :material-plus: [response_rcode](#response_rcode)  
-    :material-plus: [response_answer](#response_answer)  
-    :material-plus: [response_ns](#response_ns)  
-    :material-plus: [response_extra](#response_extra)  
-    :material-plus: [package_name_regex](#package_name_regex)  
-    :material-alert: [ip_version](#ip_version)  
-    :material-alert: [query_type](#query_type)
+    :material-plus: [source_hostname](#source_hostname)
 
 !!! quote "sing-box 1.13.0 中的更改"
 
@@ -103,6 +94,12 @@ icon: material/alert-decagram
           "192.168.0.1"
         ],
         "source_ip_is_private": false,
+        "ip_cidr": [
+          "10.0.0.0/24",
+          "192.168.0.1"
+        ],
+        "ip_is_private": false,
+        "ip_accept_any": false,
         "source_port": [
           12345
         ],
@@ -132,9 +129,6 @@ icon: material/alert-decagram
         "package_name": [
           "com.termux"
         ],
-        "package_name_regex": [
-          "^com\\.termux.*"
-        ],
         "user": [
           "sekai"
         ],
@@ -177,17 +171,7 @@ icon: material/alert-decagram
           "geosite-cn"
         ],
         "rule_set_ip_cidr_match_source": false,
-        "match_response": false,
-        "ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
-        ],
-        "ip_is_private": false,
-        "ip_accept_any": false,
-        "response_rcode": "",
-        "response_answer": [],
-        "response_ns": [],
-        "response_extra": [],
+        "rule_set_ip_cidr_accept_empty": false,
         "invert": false,
         "outbound": [
           "direct"
@@ -196,8 +180,6 @@ icon: material/alert-decagram
         "server": "local",
 
         // 已弃用
-
-        "rule_set_ip_cidr_accept_empty": false,
         "rule_set_ipcidr_match_source": false,
         "geosite": [
           "cn"
@@ -245,38 +227,12 @@ icon: material/alert-decagram
 
 #### ip_version
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    此字段现在也会在 DNS 规则被未指定具体 DNS 服务器的内部域名解析匹配时生效，
-    例如未设置 `server` 的 [`resolve`](../../route/rule_action/#resolve) 路由规则动作。
-    此前只有来自客户端的 DNS 查询才会评估此字段。完整列表参阅
-    [迁移指南](/zh/migration/#dns-规则中的-ip_version-和-query_type-行为更改)。
-
-    在 DNS 规则中设置此字段后，该 DNS 规则在同一 DNS 配置中不能与
-    旧版地址筛选字段 (DNS 规则)、旧版 DNS 规则动作 `strategy` 选项，
-    或旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项共存。如需与
-    基于地址的筛选组合，请使用 [`evaluate`](../rule_action/#evaluate) 动作和
-    [`match_response`](#match_response)。
-
 4 (A DNS 查询) 或 6 (AAAA DNS 查询)。
 
 默认不限制。
 
 #### query_type
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    此字段现在也会在 DNS 规则被未指定具体 DNS 服务器的内部域名解析匹配时生效，
-    例如未设置 `server` 的 [`resolve`](../../route/rule_action/#resolve) 路由规则动作。
-    此前只有来自客户端的 DNS 查询才会评估此字段。完整列表参阅
-    [迁移指南](/zh/migration/#dns-规则中的-ip_version-和-query_type-行为更改)。
-
-    在 DNS 规则中设置此字段后，该 DNS 规则在同一 DNS 配置中不能与
-    旧版地址筛选字段 (DNS 规则)、旧版 DNS 规则动作 `strategy` 选项，
-    或旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项共存。如需与
-    基于地址的筛选组合，请使用 [`evaluate`](../rule_action/#evaluate) 动作和
-    [`match_response`](#match_response)。
-
 DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### network
@@ -379,12 +335,6 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 匹配 Android 应用包名。
 
-#### package_name_regex
-
-!!! question "自 sing-box 1.14.0 起"
-
-使用正则表达式匹配 Android 应用包名。
-
 #### user
 
 !!! quote ""
@@ -526,23 +476,6 @@ Available values: `wifi`, `cellular`, `ethernet` and `other`.
 
 使规则集中的 `ip_cidr` 规则匹配源 IP。
 
-#### match_response
-
-!!! question "自 sing-box 1.14.0 起"
-
-启用响应匹配。启用后，此规则将匹配已评估的响应（由前序 [`evaluate`](/zh/configuration/dns/rule_action/#evaluate) 动作设置），而不仅是匹配原始查询。
-
-该已评估的响应也可以被后续的 [`respond`](/zh/configuration/dns/rule_action/#respond) 动作直接返回。
-
-响应匹配字段（`response_rcode`、`response_answer`、`response_ns`、`response_extra`）需要此选项。
-当与 `evaluate` 或响应匹配字段一起使用时，`ip_cidr`、`ip_is_private` 和 `ip_accept_any` 也需要此选项。
-
-#### ip_accept_any
-
-!!! question "自 sing-box 1.12.0 起"
-
-当 DNS 查询响应包含至少一个地址时匹配。
-
 #### invert
 
 反选匹配结果。
@@ -587,12 +520,7 @@ Available values: `wifi`, `cellular`, `ethernet` and `other`.
 
     已移动到 [DNS 规则动作](../rule_action#route).
 
-### 旧版地址筛选字段
-
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    旧版地址筛选字段已废弃，且将在 sing-box 1.16.0 中被移除，
-    参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
+### 地址筛选字段
 
 仅对地址请求 (A/AAAA/HTTPS) 生效。 当查询结果与地址筛选规则项不匹配时，将跳过当前规则。
 
@@ -619,62 +547,24 @@ Available values: `wifi`, `cellular`, `ethernet` and `other`.
 
 与查询响应匹配 IP CIDR。
 
-作为旧版地址筛选字段已废弃。请改为配合 `match_response` 使用，
-参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
-
 #### ip_is_private
 
 !!! question "自 sing-box 1.9.0 起"
 
 与查询响应匹配非公开 IP。
 
-作为旧版地址筛选字段已废弃。请改为配合 `match_response` 使用，
-参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
+#### ip_accept_any
+
+!!! question "自 sing-box 1.12.0 起"
+
+匹配任意 IP。
 
 #### rule_set_ip_cidr_accept_empty
 
 !!! question "自 sing-box 1.10.0 起"
 
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    `rule_set_ip_cidr_accept_empty` 已废弃且将在 sing-box 1.16.0 中被移除，
-    参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
-
 使规则集中的 `ip_cidr` 规则接受空查询响应。
 
-### 响应匹配字段
-
-!!! question "自 sing-box 1.14.0 起"
-
-已评估的响应的匹配字段。需要将 `match_response` 设为 `true`，
-且需要前序规则使用 [`evaluate`](/zh/configuration/dns/rule_action/#evaluate) 动作来填充响应。
-
-该已评估的响应也可以被后续的 [`respond`](/zh/configuration/dns/rule_action/#respond) 动作直接返回。
-
-#### response_rcode
-
-匹配 DNS 响应码。
-
-接受的值与 [predefined 动作 rcode](/zh/configuration/dns/rule_action/#rcode) 中相同。
-
-#### response_answer
-
-匹配 DNS 应答记录。
-
-记录格式与 [predefined 动作 answer](/zh/configuration/dns/rule_action/#answer) 中相同。
-
-#### response_ns
-
-匹配 DNS 名称服务器记录。
-
-记录格式与 [predefined 动作 ns](/zh/configuration/dns/rule_action/#ns) 中相同。
-
-#### response_extra
-
-匹配 DNS 额外记录。
-
-记录格式与 [predefined 动作 extra](/zh/configuration/dns/rule_action/#extra) 中相同。
-
 ### 逻辑字段
 
 #### type

docs/configuration/dns/rule_action.md

@@ -2,13 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-delete-clock: [strategy](#strategy)  
-    :material-plus: [evaluate](#evaluate)  
-    :material-plus: [respond](#respond)  
-    :material-plus: [disable_optimistic_cache](#disable_optimistic_cache)
-
 !!! quote "Changes in sing-box 1.12.0"
 
     :material-plus: [strategy](#strategy)  
@@ -24,7 +17,6 @@ icon: material/new-box
   "server": "",
   "strategy": "",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }
@@ -42,10 +34,6 @@ Tag of target server.
 
 !!! question "Since sing-box 1.12.0"
 
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    `strategy` is deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0.
-
 Set domain strategy for this query.
 
 One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
@@ -54,12 +42,6 @@ One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
 
 Disable cache and save cache in this query.
 
-#### disable_optimistic_cache
-
-!!! question "Since sing-box 1.14.0"
-
-Disable optimistic DNS caching in this query.
-
 #### rewrite_ttl
 
 Rewrite TTL in DNS responses.
@@ -70,75 +52,7 @@ Append a `edns0-subnet` OPT extra record with the specified IP prefix to every q
 
 If value is an IP address instead of prefix, `/32` or `/128` will be appended automatically.
 
-Will override `dns.client_subnet`.
-
-### evaluate
-
-!!! question "Since sing-box 1.14.0"
-
-```json
-{
-  "action": "evaluate",
-  "server": "",
-  "disable_cache": false,
-  "disable_optimistic_cache": false,
-  "rewrite_ttl": null,
-  "client_subnet": null
-}
-```
-
-`evaluate` sends a DNS query to the specified server and saves the evaluated response for subsequent rules
-to match against using [`match_response`](/configuration/dns/rule/#match_response) and response fields.
-Unlike `route`, it does **not** terminate rule evaluation.
-
-Only allowed on top-level DNS rules (not inside logical sub-rules).
-Rules that use [`match_response`](/configuration/dns/rule/#match_response) or Response Match Fields
-require a preceding top-level rule with `evaluate` action. A rule's own `evaluate` action
-does not satisfy this requirement, because matching happens before the action runs.
-
-#### server
-
-==Required==
-
-Tag of target server.
-
-#### disable_cache
-
-Disable cache and save cache in this query.
-
-#### disable_optimistic_cache
-
-!!! question "Since sing-box 1.14.0"
-
-Disable optimistic DNS caching in this query.
-
-#### rewrite_ttl
-
-Rewrite TTL in DNS responses.
-
-#### client_subnet
-
-Append a `edns0-subnet` OPT extra record with the specified IP prefix to every query by default.
-
-If value is an IP address instead of prefix, `/32` or `/128` will be appended automatically.
-
-Will override `dns.client_subnet`.
-
-### respond
-
-!!! question "Since sing-box 1.14.0"
-
-```json
-{
-  "action": "respond"
-}
-```
-
-`respond` terminates rule evaluation and returns the evaluated response from a preceding [`evaluate`](/configuration/dns/rule_action/#evaluate) action.
-
-This action does not send a new DNS query and has no extra options.
-
-Only allowed after a preceding top-level `evaluate` rule. If the action is reached without an evaluated response at runtime, the request fails with an error instead of falling through to later rules.
+Will overrides `dns.client_subnet`.
 
 ### route-options
 
@@ -146,7 +60,6 @@ Only allowed after a preceding top-level `evaluate` rule. If the action is reach
 {
   "action": "route-options",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }

docs/configuration/dns/rule_action.zh.md

@@ -2,13 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-delete-clock: [strategy](#strategy)  
-    :material-plus: [evaluate](#evaluate)  
-    :material-plus: [respond](#respond)  
-    :material-plus: [disable_optimistic_cache](#disable_optimistic_cache)
-
 !!! quote "sing-box 1.12.0 中的更改"
 
     :material-plus: [strategy](#strategy)  
@@ -24,7 +17,6 @@ icon: material/new-box
   "server": "",
   "strategy": "",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }
@@ -42,10 +34,6 @@ icon: material/new-box
 
 !!! question "自 sing-box 1.12.0 起"
 
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    `strategy` 已在 sing-box 1.14.0 废弃，且将在 sing-box 1.16.0 中被移除。
-
 为此查询设置域名策略。
 
 可选项：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
@@ -54,12 +42,6 @@ icon: material/new-box
 
 在此查询中禁用缓存。
 
-#### disable_optimistic_cache
-
-!!! question "自 sing-box 1.14.0 起"
-
-在此查询中禁用乐观 DNS 缓存。
-
 #### rewrite_ttl
 
 重写 DNS 回应中的 TTL。
@@ -72,79 +54,12 @@ icon: material/new-box
 
 将覆盖 `dns.client_subnet`.
 
-### evaluate
-
-!!! question "自 sing-box 1.14.0 起"
-
-```json
-{
-  "action": "evaluate",
-  "server": "",
-  "disable_cache": false,
-  "disable_optimistic_cache": false,
-  "rewrite_ttl": null,
-  "client_subnet": null
-}
-```
-
-`evaluate` 向指定服务器发送 DNS 查询并保存已评估的响应，供后续规则通过 [`match_response`](/zh/configuration/dns/rule/#match_response) 和响应字段进行匹配。与 `route` 不同，它**不会**终止规则评估。
-
-仅允许在顶层 DNS 规则中使用（不可在逻辑子规则内部使用）。
-使用 [`match_response`](/zh/configuration/dns/rule/#match_response) 或响应匹配字段的规则，
-需要位于更早的顶层 `evaluate` 规则之后。规则自身的 `evaluate` 动作不能满足这个条件，
-因为匹配发生在动作执行之前。
-
-#### server
-
-==必填==
-
-目标 DNS 服务器的标签。
-
-#### disable_cache
-
-在此查询中禁用缓存。
-
-#### disable_optimistic_cache
-
-!!! question "自 sing-box 1.14.0 起"
-
-在此查询中禁用乐观 DNS 缓存。
-
-#### rewrite_ttl
-
-重写 DNS 回应中的 TTL。
-
-#### client_subnet
-
-默认情况下，将带有指定 IP 前缀的 `edns0-subnet` OPT 附加记录附加到每个查询。
-
-如果值是 IP 地址而不是前缀，则会自动附加 `/32` 或 `/128`。
-
-将覆盖 `dns.client_subnet`.
-
-### respond
-
-!!! question "自 sing-box 1.14.0 起"
-
-```json
-{
-  "action": "respond"
-}
-```
-
-`respond` 会终止规则评估，并直接返回前序 [`evaluate`](/zh/configuration/dns/rule_action/#evaluate) 动作保存的已评估的响应。
-
-此动作不会发起新的 DNS 查询，也没有额外选项。
-
-只能用于前面已有顶层 `evaluate` 规则的场景。如果运行时命中该动作时没有已评估的响应，则请求会直接返回错误，而不是继续匹配后续规则。
-
 ### route-options
 
 ```json
 {
   "action": "route-options",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }
@@ -169,7 +84,7 @@ icon: material/new-box
 - `default`: 返回 REFUSED。
 - `drop`: 丢弃请求。
 
-默认使用 `default`。
+默认使用 `defualt`。
 
 #### no_drop
 

docs/configuration/dns/server/hosts.md

@@ -73,55 +73,24 @@ Example:
 
 === "Use hosts if available"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                ...
-              },
-              {
-                "type": "hosts",
-                "tag": "hosts"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "hosts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            ...
+          },
+          {
+            "type": "hosts",
+            "tag": "hosts"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                ...
-              },
-              {
-                "type": "hosts",
-                "tag": "hosts"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "hosts"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "hosts"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```

docs/configuration/dns/server/hosts.zh.md

@@ -73,55 +73,24 @@ hosts 文件路径列表。
 
 === "如果可用则使用 hosts"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                ...
-              },
-              {
-                "type": "hosts",
-                "tag": "hosts"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "hosts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            ...
+          },
+          {
+            "type": "hosts",
+            "tag": "hosts"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                ...
-              },
-              {
-                "type": "hosts",
-                "tag": "hosts"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "hosts"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "hosts"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```

docs/configuration/dns/server/index.md

@@ -29,7 +29,7 @@ The type of the DNS server.
 
 | Type            | Format                    |
 |-----------------|---------------------------|
-| empty (default) | :material-note-remove: [Legacy](./legacy/) |
+| empty (default) | [Legacy](./legacy/)       |
 | `local`         | [Local](./local/)         |
 | `hosts`         | [Hosts](./hosts/)         |
 | `tcp`           | [TCP](./tcp/)             |

docs/configuration/dns/server/index.zh.md

@@ -29,7 +29,7 @@ DNS 服务器的类型。
 
 | 类型              | 格式                        |
 |-----------------|---------------------------|
-| empty (default) | :material-note-remove: [Legacy](./legacy/) |
+| empty (default) | [Legacy](./legacy/)       |
 | `local`         | [Local](./local/)         |
 | `hosts`         | [Hosts](./hosts/)         |
 | `tcp`           | [TCP](./tcp/)             |

docs/configuration/dns/server/legacy.md

@@ -1,10 +1,10 @@
 ---
-icon: material/note-remove
+icon: material/delete-clock
 ---
 
-!!! failure "Removed in sing-box 1.14.0"
+!!! failure "Deprecated in sing-box 1.12.0"
 
-    Legacy DNS servers are deprecated in sing-box 1.12.0 and removed in sing-box 1.14.0, check [Migration](/migration/#migrate-to-new-dns-server-formats).
+    Legacy DNS servers is deprecated and will be removed in sing-box 1.14.0, check [Migration](/migration/#migrate-to-new-dns-servers).
 
 !!! quote "Changes in sing-box 1.9.0"
 
@@ -108,6 +108,6 @@ Append a `edns0-subnet` OPT extra record with the specified IP prefix to every q
 
 If value is an IP address instead of prefix, `/32` or `/128` will be appended automatically.
 
-Can be overridden by `rules.[].client_subnet`.
+Can be overrides by `rules.[].client_subnet`.
 
-Will override `dns.client_subnet`.
+Will overrides `dns.client_subnet`.

docs/configuration/dns/server/legacy.zh.md

@@ -1,10 +1,10 @@
 ---
-icon: material/note-remove
+icon: material/delete-clock
 ---
 
-!!! failure "已在 sing-box 1.14.0 移除"
+!!! failure "Deprecated in sing-box 1.12.0"
 
-    旧的 DNS 服务器配置已在 sing-box 1.12.0 废弃且已在 sing-box 1.14.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移到新的-dns-服务器格式)。
+    旧的 DNS 服务器配置已废弃且将在 sing-box 1.14.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移到新的-dns-服务器格式)。
 
 !!! quote "sing-box 1.9.0 中的更改"
 

docs/configuration/dns/server/resolved.md

@@ -43,62 +43,29 @@ If not enabled, `NXDOMAIN` will be returned for requests that do not match searc
 
 === "Split DNS only"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "resolved",
-                "tag": "resolved",
-                "service": "resolved"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "resolved"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            "type": "local",
+            "tag": "local"
+          },
+          {
+            "type": "resolved",
+            "tag": "resolved",
+            "service": "resolved"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "resolved",
-                "tag": "resolved",
-                "service": "resolved"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "resolved"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "resolved"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```
 
 === "Use as global DNS"
 

docs/configuration/dns/server/resolved.zh.md

@@ -42,62 +42,29 @@ icon: material/new-box
 
 === "仅分割 DNS"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "resolved",
-                "tag": "resolved",
-                "service": "resolved"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "resolved"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            "type": "local",
+            "tag": "local"
+          },
+          {
+            "type": "resolved",
+            "tag": "resolved",
+            "service": "resolved"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "resolved",
-                "tag": "resolved",
-                "service": "resolved"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "resolved"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "resolved"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```
 
 === "用作全局 DNS"
 

docs/configuration/dns/server/tailscale.md

@@ -42,62 +42,29 @@ if not enabled, `NXDOMAIN` will be returned for non-Tailscale domain queries.
 
 === "MagicDNS only"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "tailscale",
-                "tag": "ts",
-                "endpoint": "ts-ep"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "ts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            "type": "local",
+            "tag": "local"
+          },
+          {
+            "type": "tailscale",
+            "tag": "ts",
+            "endpoint": "ts-ep"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "tailscale",
-                "tag": "ts",
-                "endpoint": "ts-ep"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "ts"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "ts"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```
 
 === "Use as global DNS"
 

docs/configuration/dns/server/tailscale.zh.md

@@ -42,62 +42,29 @@ icon: material/new-box
 
 === "仅 MagicDNS"
 
-    === ":material-card-multiple: sing-box 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "tailscale",
-                "tag": "ts",
-                "endpoint": "ts-ep"
-              }
-            ],
-            "rules": [
-              {
-                "action": "evaluate",
-                "server": "ts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
-              }
-            ]
+    ```json
+    {
+      "dns": {
+        "servers": [
+          {
+            "type": "local",
+            "tag": "local"
+          },
+          {
+            "type": "tailscale",
+            "tag": "ts",
+            "endpoint": "ts-ep"
           }
-        }
-        ```
-
-    === ":material-card-remove: sing-box < 1.14.0"
-
-        ```json
-        {
-          "dns": {
-            "servers": [
-              {
-                "type": "local",
-                "tag": "local"
-              },
-              {
-                "type": "tailscale",
-                "tag": "ts",
-                "endpoint": "ts-ep"
-              }
-            ],
-            "rules": [
-              {
-                "ip_accept_any": true,
-                "server": "ts"
-              }
-            ]
+        ],
+        "rules": [
+          {
+            "ip_accept_any": true,
+            "server": "ts"
           }
-        }
-        ```
+        ]
+      }
+    }
+    ```
 
 === "用作全局 DNS"
 

docs/configuration/experimental/cache-file.md

@@ -1,10 +1,5 @@
 !!! question "Since sing-box 1.8.0"
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-delete-clock: [store_rdrc](#store_rdrc)  
-    :material-plus: [store_dns](#store_dns)
-
 !!! quote "Changes in sing-box 1.9.0"
 
     :material-plus: [store_rdrc](#store_rdrc)  
@@ -19,8 +14,7 @@
   "cache_id": "",
   "store_fakeip": false,
   "store_rdrc": false,
-  "rdrc_timeout": "",
-  "store_dns": false
+  "rdrc_timeout": ""
 }
 ```
 
@@ -48,13 +42,9 @@ Store fakeip in the cache file
 
 #### store_rdrc
 
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    `store_rdrc` is deprecated and will be removed in sing-box 1.16.0, check [Migration](/migration/#migrate-store-rdrc).
-
 Store rejected DNS response cache in the cache file
 
-The check results of [Legacy Address Filter Fields](/configuration/dns/rule/#legacy-address-filter-fields)
+The check results of [Address filter DNS rule items](/configuration/dns/rule/#address-filter-fields)
 will be cached until expiration.
 
 #### rdrc_timeout
@@ -62,9 +52,3 @@ will be cached until expiration.
 Timeout of rejected DNS response cache.
 
 `7d` is used by default.
-
-#### store_dns
-
-!!! question "Since sing-box 1.14.0"
-
-Store DNS cache in the cache file.

docs/configuration/experimental/cache-file.zh.md

@@ -1,10 +1,5 @@
 !!! question "自 sing-box 1.8.0 起"
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-delete-clock: [store_rdrc](#store_rdrc)  
-    :material-plus: [store_dns](#store_dns)
-
 !!! quote "sing-box 1.9.0 中的更改"
 
     :material-plus: [store_rdrc](#store_rdrc)  
@@ -19,8 +14,7 @@
   "cache_id": "",
   "store_fakeip": false,
   "store_rdrc": false,
-  "rdrc_timeout": "",
-  "store_dns": false
+  "rdrc_timeout": ""
 }
 ```
 
@@ -46,22 +40,12 @@
 
 #### store_rdrc
 
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    `store_rdrc` 已在 sing-box 1.14.0 废弃，且将在 sing-box 1.16.0 中被移除，参阅[迁移指南](/zh/migration/#迁移-store_rdrc)。
-
 将拒绝的 DNS 响应缓存存储在缓存文件中。
 
-[旧版地址筛选字段](/zh/configuration/dns/rule/#旧版地址筛选字段) 的检查结果将被缓存至过期。
+[地址筛选 DNS 规则项](/zh/configuration/dns/rule/#地址筛选字段) 的检查结果将被缓存至过期。
 
 #### rdrc_timeout
 
 拒绝的 DNS 响应缓存超时。
 
 默认使用 `7d`。
-
-#### store_dns
-
-!!! question "自 sing-box 1.14.0 起"
-
-将 DNS 缓存存储在缓存文件中。

docs/configuration/inbound/cloudflared.md

@@ -1,89 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.14.0"
-
-`cloudflared` inbound runs an embedded Cloudflare Tunnel client and routes all
-incoming tunnel traffic (TCP, UDP, ICMP) through sing-box's routing engine.
-
-### Structure
-
-```json
-{
-  "type": "cloudflared",
-  "tag": "",
-
-  "token": "",
-  "ha_connections": 0,
-  "protocol": "",
-  "post_quantum": false,
-  "edge_ip_version": 0,
-  "datagram_version": "",
-  "grace_period": "",
-  "region": "",
-  "control_dialer": {
-    ... // Dial Fields
-  },
-  "tunnel_dialer": {
-    ... // Dial Fields
-  }
-}
-```
-
-### Fields
-
-#### token
-
-==Required==
-
-Base64-encoded tunnel token from the Cloudflare Zero Trust dashboard
-(`Networks → Tunnels → Install connector`).
-
-#### ha_connections
-
-Number of high-availability connections to the Cloudflare edge.
-
-Capped by the number of discovered edge addresses.
-
-#### protocol
-
-Transport protocol for edge connections.
-
-One of `quic` `http2`.
-
-#### post_quantum
-
-Enable post-quantum key exchange on the control connection.
-
-#### edge_ip_version
-
-IP version used when connecting to the Cloudflare edge.
-
-One of `0` (automatic) `4` `6`.
-
-#### datagram_version
-
-Datagram protocol version used for UDP proxying over QUIC.
-
-One of `v2` `v3`. Only meaningful when `protocol` is `quic`.
-
-#### grace_period
-
-Graceful shutdown window for in-flight edge connections.
-
-#### region
-
-Cloudflare edge region selector.
-
-Conflict with endpoints embedded in `token`.
-
-#### control_dialer
-
-[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
-Cloudflare control plane.
-
-#### tunnel_dialer
-
-[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
-Cloudflare edge data plane.

docs/configuration/inbound/cloudflared.zh.md

@@ -1,89 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "自 sing-box 1.14.0 起"
-
-`cloudflared` 入站运行一个内嵌的 Cloudflare Tunnel 客户端，并将所有传入的隧道流量
-（TCP、UDP、ICMP）通过 sing-box 的路由引擎转发。
-
-### 结构
-
-```json
-{
-  "type": "cloudflared",
-  "tag": "",
-
-  "token": "",
-  "ha_connections": 0,
-  "protocol": "",
-  "post_quantum": false,
-  "edge_ip_version": 0,
-  "datagram_version": "",
-  "grace_period": "",
-  "region": "",
-  "control_dialer": {
-    ... // 拨号字段
-  },
-  "tunnel_dialer": {
-    ... // 拨号字段
-  }
-}
-```
-
-### 字段
-
-#### token
-
-==必填==
-
-来自 Cloudflare Zero Trust 仪表板的 Base64 编码隧道令牌
-（`Networks → Tunnels → Install connector`）。
-
-#### ha_connections
-
-到 Cloudflare edge 的高可用连接数。
-
-上限为已发现的 edge 地址数量。
-
-#### protocol
-
-edge 连接使用的传输协议。
-
-`quic` `http2` 之一。
-
-#### post_quantum
-
-在控制连接上启用后量子密钥交换。
-
-#### edge_ip_version
-
-连接 Cloudflare edge 时使用的 IP 版本。
-
-`0`（自动）`4` `6` 之一。
-
-#### datagram_version
-
-通过 QUIC 进行 UDP 代理时使用的数据报协议版本。
-
-`v2` `v3` 之一。仅在 `protocol` 为 `quic` 时有效。
-
-#### grace_period
-
-正在处理的 edge 连接的优雅关闭窗口。
-
-#### region
-
-Cloudflare edge 区域选择器。
-
-与 `token` 中嵌入的 endpoint 冲突。
-
-#### control_dialer
-
-隧道客户端拨向 Cloudflare 控制面时使用的
-[拨号字段](/zh/configuration/shared/dial/)。
-
-#### tunnel_dialer
-
-隧道客户端拨向 Cloudflare edge 数据面时使用的
-[拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/inbound/index.md

@@ -34,7 +34,6 @@
 | `tun`         | [Tun](./tun/)                 | :material-close: |
 | `redirect`    | [Redirect](./redirect/)       | :material-close: |
 | `tproxy`      | [TProxy](./tproxy/)           | :material-close: |
-| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -34,7 +34,6 @@
 | `tun`         | [Tun](./tun/)                 | :material-close: |
 | `redirect`    | [Redirect](./redirect/)       | :material-close: |
 | `tproxy`      | [TProxy](./tproxy/)           | :material-close: |
-| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
 
 #### tag
 

docs/configuration/route/index.md

@@ -153,7 +153,7 @@ Automatically detected from common DHCP servers (dnsmasq, odhcpd, ISC dhcpd, Kea
 
 See [Dial Fields](/configuration/shared/dial/#domain_resolver) for details.
 
-Can be overridden by `outbound.domain_resolver`.
+Can be overrides by `outbound.domain_resolver`.
 
 #### default_network_strategy
 
@@ -163,7 +163,7 @@ See [Dial Fields](/configuration/shared/dial/#network_strategy) for details.
 
 Takes no effect if `outbound.bind_interface`, `outbound.inet4_bind_address` or `outbound.inet6_bind_address` is set.
 
-Can be overridden by `outbound.network_strategy`.
+Can be overrides by `outbound.network_strategy`.
 
 Conflicts with `default_interface`.
 

docs/configuration/route/rule.md

@@ -5,8 +5,7 @@ icon: material/new-box
 !!! quote "Changes in sing-box 1.14.0"
 
     :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)  
-    :material-plus: [package_name_regex](#package_name_regex)
+    :material-plus: [source_hostname](#source_hostname)
 
 !!! quote "Changes in sing-box 1.13.0"
 
@@ -130,9 +129,6 @@ icon: material/new-box
         "package_name": [
           "com.termux"
         ],
-        "package_name_regex": [
-          "^com\\.termux.*"
-        ],
         "user": [
           "sekai"
         ],
@@ -358,12 +354,6 @@ Match process path using regular expression.
 
 Match android package name.
 
-#### package_name_regex
-
-!!! question "Since sing-box 1.14.0"
-
-Match android package name using regular expression.
-
 #### user
 
 !!! quote ""

docs/configuration/route/rule.zh.md

@@ -5,8 +5,7 @@ icon: material/new-box
 !!! quote "sing-box 1.14.0 中的更改"
 
     :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)  
-    :material-plus: [package_name_regex](#package_name_regex)
+    :material-plus: [source_hostname](#source_hostname)
 
 !!! quote "sing-box 1.13.0 中的更改"
 
@@ -128,9 +127,6 @@ icon: material/new-box
         "package_name": [
           "com.termux"
         ],
-        "package_name_regex": [
-          "^com\\.termux.*"
-        ],
         "user": [
           "sekai"
         ],
@@ -356,12 +352,6 @@ icon: material/new-box
 
 匹配 Android 应用包名。
 
-#### package_name_regex
-
-!!! question "自 sing-box 1.14.0 起"
-
-使用正则表达式匹配 Android 应用包名。
-
 #### user
 
 !!! quote ""

docs/configuration/route/rule_action.md

@@ -7,10 +7,6 @@ icon: material/new-box
     :material-plus: [bypass](#bypass)  
     :material-alert: [reject](#reject)
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [resolve.disable_optimistic_cache](#disable_optimistic_cache)
-
 !!! quote "Changes in sing-box 1.12.0"
 
     :material-plus: [tls_fragment](#tls_fragment)  
@@ -283,7 +279,6 @@ Timeout for sniffing.
   "server": "",
   "strategy": "",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }
@@ -307,12 +302,6 @@ DNS resolution strategy, available values are: `prefer_ipv4`, `prefer_ipv6`, `ip
 
 Disable cache and save cache in this query.
 
-#### disable_optimistic_cache
-
-!!! question "Since sing-box 1.14.0"
-
-Disable optimistic DNS caching in this query.
-
 #### rewrite_ttl
 
 !!! question "Since sing-box 1.12.0"
@@ -327,4 +316,4 @@ Append a `edns0-subnet` OPT extra record with the specified IP prefix to every q
 
 If value is an IP address instead of prefix, `/32` or `/128` will be appended automatically.
 
-Will override `dns.client_subnet`.
+Will overrides `dns.client_subnet`.

docs/configuration/route/rule_action.zh.md

@@ -7,10 +7,6 @@ icon: material/new-box
     :material-plus: [bypass](#bypass)  
     :material-alert: [reject](#reject)
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [resolve.disable_optimistic_cache](#disable_optimistic_cache)
-
 !!! quote "sing-box 1.12.0 中的更改"
 
     :material-plus: [tls_fragment](#tls_fragment)  
@@ -272,7 +268,6 @@ UDP 连接超时时间。
   "server": "",
   "strategy": "",
   "disable_cache": false,
-  "disable_optimistic_cache": false,
   "rewrite_ttl": null,
   "client_subnet": null
 }
@@ -296,12 +291,6 @@ DNS 解析策略，可用值有：`prefer_ipv4`、`prefer_ipv6`、`ipv4_only`、
 
 在此查询中禁用缓存。
 
-#### disable_optimistic_cache
-
-!!! question "自 sing-box 1.14.0 起"
-
-在此查询中禁用乐观 DNS 缓存。
-
 #### rewrite_ttl
 
 !!! question "自 sing-box 1.12.0 起"

docs/configuration/rule-set/headless-rule.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [package_name_regex](#package_name_regex)  
-    :material-alert: [query_type](#query_type)
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [network_interface_address](#network_interface_address)  
@@ -83,9 +78,6 @@ icon: material/new-box
       "package_name": [
         "com.termux"
       ],
-      "package_name_regex": [
-        "^com\\.termux.*"
-      ],
       "network_type": [
         "wifi"
       ],
@@ -133,20 +125,6 @@ icon: material/new-box
 
 #### query_type
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    When a DNS rule references this rule-set, this field now also applies
-    when the DNS rule is matched from an internal domain resolution that
-    does not target a specific DNS server. In earlier versions, only DNS
-    queries received from a client evaluated this field. See
-    [Migration](/migration/#ip_version-and-query_type-behavior-changes-in-dns-rules)
-    for the full list.
-
-    When a DNS rule references a rule-set containing this field, the DNS
-    rule is incompatible in the same DNS configuration with Legacy Address
-    Filter Fields in DNS rules, the Legacy `strategy` DNS rule action
-    option, and the Legacy `rule_set_ip_cidr_accept_empty` DNS rule item.
-
 DNS query type. Values can be integers or type name strings.
 
 #### network
@@ -227,12 +205,6 @@ Match process path using regular expression.
 
 Match android package name.
 
-#### package_name_regex
-
-!!! question "Since sing-box 1.14.0"
-
-Match android package name using regular expression.
-
 #### network_type
 
 !!! question "Since sing-box 1.11.0"

docs/configuration/rule-set/headless-rule.zh.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [package_name_regex](#package_name_regex)  
-    :material-alert: [query_type](#query_type)
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [network_interface_address](#network_interface_address)  
@@ -83,9 +78,6 @@ icon: material/new-box
       "package_name": [
         "com.termux"
       ],
-      "package_name_regex": [
-        "^com\\.termux.*"
-      ],
       "network_type": [
         "wifi"
       ],
@@ -133,17 +125,6 @@ icon: material/new-box
 
 #### query_type
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    当 DNS 规则引用此规则集时，此字段现在也会在 DNS 规则被未指定具体
-    DNS 服务器的内部域名解析匹配时生效。此前只有来自客户端的 DNS 查询
-    才会评估此字段。完整列表参阅
-    [迁移指南](/zh/migration/#dns-规则中的-ip_version-和-query_type-行为更改)。
-
-    当 DNS 规则引用了包含此字段的规则集时，该 DNS 规则在同一 DNS 配置中
-    不能与旧版地址筛选字段 (DNS 规则)、旧版 DNS 规则动作 `strategy` 选项，
-    或旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项共存。
-
 DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### network
@@ -220,12 +201,6 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 匹配 Android 应用包名。
 
-#### package_name_regex
-
-!!! question "自 sing-box 1.14.0 起"
-
-使用正则表达式匹配 Android 应用包名。
-
 #### network_type
 
 !!! question "自 sing-box 1.11.0 起"

docs/configuration/rule-set/source-format.md

@@ -2,10 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: version `5`
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: version `4`
@@ -45,7 +41,6 @@ Version of rule-set.
 * 2: sing-box 1.10.0: Optimized memory usages of `domain_suffix` rules in binary rule-sets.
 * 3: sing-box 1.11.0: Added `network_type`, `network_is_expensive` and `network_is_constrainted` rule items.
 * 4: sing-box 1.13.0: Added `network_interface_address` and `default_interface_address` rule items.
-* 5: sing-box 1.14.0: Added `package_name_regex` rule item.
 
 #### rules
 

docs/configuration/rule-set/source-format.zh.md

@@ -2,10 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: version `5`
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: version `4`
@@ -45,7 +41,6 @@ icon: material/new-box
 * 2: sing-box 1.10.0: 优化了二进制规则集中 `domain_suffix` 规则的内存使用。
 * 3: sing-box 1.11.0: 添加了 `network_type`、 `network_is_expensive` 和 `network_is_constrainted` 规则项。
 * 4: sing-box 1.13.0: 添加了 `network_interface_address` 和 `default_interface_address` 规则项。
-* 5: sing-box 1.14.0: 添加了 `package_name_regex` 规则项。
 
 #### rules
 

docs/configuration/shared/certificate-provider/acme.md

@@ -6,6 +6,7 @@ icon: material/new-box
 
     :material-plus: [account_key](#account_key)  
     :material-plus: [key_type](#key_type)  
+    :material-plus: [profile](#profile)  
     :material-plus: [detour](#detour)
 
 # ACME
@@ -37,6 +38,7 @@ icon: material/new-box
   },
   "dns01_challenge": {},
   "key_type": "",
+  "profile": "",
   "detour": ""
 }
 ```
@@ -141,6 +143,16 @@ The private key type to generate for new certificates.
 | `rsa2048`  | RSA     |
 | `rsa4096`  | RSA     |
 
+#### profile
+
+!!! question "Since sing-box 1.14.0"
+
+The ACME profile name to use for certificate orders.
+
+See [ACME Profiles](https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/) for details.
+
+When using Let's Encrypt with IP address identifiers, the `shortlived` profile is automatically selected if not set.
+
 #### detour
 
 !!! question "Since sing-box 1.14.0"

docs/configuration/shared/certificate-provider/acme.zh.md

@@ -6,6 +6,7 @@ icon: material/new-box
 
     :material-plus: [account_key](#account_key)  
     :material-plus: [key_type](#key_type)  
+    :material-plus: [profile](#profile)  
     :material-plus: [detour](#detour)
 
 # ACME
@@ -37,6 +38,7 @@ icon: material/new-box
   },
   "dns01_challenge": {},
   "key_type": "",
+  "profile": "",
   "detour": ""
 }
 ```
@@ -136,6 +138,16 @@ ACME DNS01 质询字段。如果配置，将禁用其他质询方法。
 | `rsa2048` | RSA     |
 | `rsa4096` | RSA     |
 
+#### profile
+
+!!! question "自 sing-box 1.14.0 起"
+
+用于证书订单的 ACME 配置文件名称。
+
+参阅 [ACME Profiles](https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/)。
+
+当使用 Let's Encrypt 且包含 IP 地址标识符时，如果未设置，将自动选择 `shortlived` 配置文件。
+
 #### detour
 
 !!! question "自 sing-box 1.14.0 起"

docs/deprecated.md

@@ -14,50 +14,14 @@ check [Migration](../migration/#migrate-inline-acme-to-certificate-provider).
 
 Old fields will be removed in sing-box 1.16.0.
 
-#### Legacy `strategy` DNS rule action option
-
-Legacy `strategy` DNS rule action option is deprecated.
-
-Old fields will be removed in sing-box 1.16.0.
-
-#### Legacy `rule_set_ip_cidr_accept_empty` DNS rule item
-
-Legacy `rule_set_ip_cidr_accept_empty` DNS rule item is deprecated,
-check [Migration](../migration/#migrate-address-filter-fields-to-response-matching).
-
-Old fields will be removed in sing-box 1.16.0.
-
-#### `independent_cache` DNS option
-
-`independent_cache` DNS option is deprecated.
-The DNS cache now always keys by transport, making this option unnecessary,
-check [Migration](../migration/#migrate-independent-dns-cache).
-
-Old fields will be removed in sing-box 1.16.0.
-
-#### `store_rdrc` cache file option
-
-`store_rdrc` cache file option is deprecated,
-check [Migration](../migration/#migrate-store-rdrc).
-
-Old fields will be removed in sing-box 1.16.0.
-
-#### Legacy Address Filter Fields in DNS rules
-
-Legacy Address Filter Fields (`ip_cidr`, `ip_is_private` without `match_response`)
-in DNS rules are deprecated,
-check [Migration](../migration/#migrate-address-filter-fields-to-response-matching).
-
-Old behavior will be removed in sing-box 1.16.0.
-
 ## 1.12.0
 
 #### Legacy DNS server formats
 
 DNS servers are refactored,
-check [Migration](../migration/#migrate-to-new-dns-server-formats).
+check [Migration](../migration/#migrate-to-new-dns-servers).
 
-Old formats were removed in sing-box 1.14.0.
+Compatibility for old formats will be removed in sing-box 1.14.0.
 
 #### `outbound` DNS rule item
 

docs/deprecated.zh.md

@@ -14,41 +14,6 @@ TLS 中的内联 ACME 选项（`tls.acme`）已废弃，
 
 旧字段将在 sing-box 1.16.0 中被移除。
 
-#### 旧版 DNS 规则动作 `strategy` 选项
-
-旧版 DNS 规则动作 `strategy` 选项已废弃。
-
-旧字段将在 sing-box 1.16.0 中被移除。
-
-#### 旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项
-
-旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项已废弃，
-参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
-
-旧字段将在 sing-box 1.16.0 中被移除。
-
-#### `independent_cache` DNS 选项
-
-`independent_cache` DNS 选项已废弃。
-DNS 缓存现在始终按传输分离，使此选项不再需要，
-参阅[迁移指南](/zh/migration/#迁移-independent-dns-cache)。
-
-旧字段将在 sing-box 1.16.0 中被移除。
-
-#### `store_rdrc` 缓存文件选项
-
-`store_rdrc` 缓存文件选项已废弃，
-参阅[迁移指南](/zh/migration/#迁移-store_rdrc)。
-
-旧字段将在 sing-box 1.16.0 中被移除。
-
-#### 旧版地址筛选字段 (DNS 规则)
-
-旧版地址筛选字段（不使用 `match_response` 的 `ip_cidr`、`ip_is_private`）已废弃，
-参阅[迁移指南](/zh/migration/#迁移地址筛选字段到响应匹配)。
-
-旧行为将在 sing-box 1.16.0 中被移除。
-
 ## 1.12.0
 
 #### 旧的 DNS 服务器格式
@@ -56,7 +21,7 @@ DNS 缓存现在始终按传输分离，使此选项不再需要，
 DNS 服务器已重构，
 参阅 [迁移指南](/zh/migration/#迁移到新的-dns-服务器格式).
 
-旧格式已在 sing-box 1.14.0 中被移除。
+对旧格式的兼容性将在 sing-box 1.14.0 中被移除。
 
 #### `outbound` DNS 规则项
 

docs/installation/build-from-source.md

@@ -61,7 +61,6 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
 | `with_ccm`                         | :material-check:     | Build with Claude Code Multiplexer service support.                                                                                                                                                                                                                                                                            |
 | `with_ocm`                         | :material-check:     | Build with OpenAI Codex Multiplexer service support.                                                                                                                                                                                                                                                                           |
 | `with_naive_outbound`              | :material-check:     | Build with NaiveProxy outbound support, see [NaiveProxy outbound](/configuration/outbound/naive/).                                                                                                                                                                                                                             |
-| `with_cloudflared`                 | :material-check:     | Build with Cloudflare Tunnel inbound support, see [Cloudflared inbound](/configuration/inbound/cloudflared/).                                                                                                                                                                                                                  |
 | `badlinkname`                      | :material-check:     | Enable `go:linkname` access to internal standard library functions. Required because the Go standard library does not expose many low-level APIs needed by this project, and reimplementing them externally is impractical. Used for kTLS (kernel TLS offload) and raw TLS record manipulation.                                 |
 | `tfogo_checklinkname0`             | :material-check:     | Companion to `badlinkname`. Go 1.23+ enforces `go:linkname` restrictions via the linker; this tag signals the build uses `-checklinkname=0` to bypass that enforcement.                                                                                                                                                       |
 

docs/installation/build-from-source.zh.md

@@ -65,7 +65,6 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
 | `with_ccm`                         | :material-check:  | 构建 Claude Code Multiplexer 服务支持。                                                                                                                                                                                                                                                                                              |
 | `with_ocm`                         | :material-check:  | 构建 OpenAI Codex Multiplexer 服务支持。                                                                                                                                                                                                                                                                                             |
 | `with_naive_outbound`              | :material-check:  | 构建 NaiveProxy 出站支持，参阅 [NaiveProxy 出站](/zh/configuration/outbound/naive/)。                                                                                                                                                                                                                                                         |
-| `with_cloudflared`                 | :material-check:  | 构建 Cloudflare Tunnel 入站支持，参阅 [Cloudflared 入站](/zh/configuration/inbound/cloudflared/)。                                                                                                                                                                                                                                              |
 | `badlinkname`                      | :material-check:  | 启用 `go:linkname` 以访问标准库内部函数。Go 标准库未提供本项目需要的许多底层 API，且在外部重新实现不切实际。用于 kTLS（内核 TLS 卸载）和原始 TLS 记录操作。                                                                                                                                                                                                                           |
 | `tfogo_checklinkname0`             | :material-check:  | `badlinkname` 的伴随标记。Go 1.23+ 链接器强制限制 `go:linkname` 使用；此标记表示构建使用 `-checklinkname=0` 以绕过该限制。                                                                                                                                                                                                                                |
 

docs/migration.md

@@ -79,176 +79,6 @@ See [ACME](/configuration/shared/certificate-provider/acme/) for fields newly ad
     }
     ```
 
-### Migrate address filter fields to response matching
-
-Legacy Address Filter Fields (`ip_cidr`, `ip_is_private` without `match_response`) in DNS rules are deprecated,
-along with the Legacy `rule_set_ip_cidr_accept_empty` DNS rule item.
-
-In sing-box 1.14.0, use the [`evaluate`](/configuration/dns/rule_action/#evaluate) action
-to fetch a DNS response, then match against it explicitly with `match_response`.
-
-!!! info "References"
-
-    [DNS Rule](/configuration/dns/rule/) /
-    [DNS Rule Action](/configuration/dns/rule_action/#evaluate)
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "dns": {
-        "rules": [
-          {
-            "rule_set": "geoip-cn",
-            "action": "route",
-            "server": "local"
-          },
-          {
-            "action": "route",
-            "server": "remote"
-          }
-        ]
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "dns": {
-        "rules": [
-          {
-            "action": "evaluate",
-            "server": "remote"
-          },
-          {
-            "match_response": true,
-            "rule_set": "geoip-cn",
-            "action": "route",
-            "server": "local"
-          },
-          {
-            "action": "route",
-            "server": "remote"
-          }
-        ]
-      }
-    }
-    ```
-
-### Migrate independent DNS cache
-
-The DNS cache now always keys by transport name, making `independent_cache` unnecessary.
-Simply remove the field.
-
-!!! info "References"
-
-    [DNS](/configuration/dns/)
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "dns": {
-        "independent_cache": true
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "dns": {}
-    }
-    ```
-
-### Migrate store_rdrc
-
-`store_rdrc` is deprecated and can be replaced by `store_dns`,
-which persists the full DNS cache to the cache file.
-
-!!! info "References"
-
-    [Cache File](/configuration/experimental/cache-file/)
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "experimental": {
-        "cache_file": {
-          "enabled": true,
-          "store_rdrc": true
-        }
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "experimental": {
-        "cache_file": {
-          "enabled": true,
-          "store_dns": true
-        }
-      }
-    }
-    ```
-
-### ip_version and query_type behavior changes in DNS rules
-
-In sing-box 1.14.0, the behavior of
-[`ip_version`](/configuration/dns/rule/#ip_version) and
-[`query_type`](/configuration/dns/rule/#query_type) in DNS rules, together with
-[`query_type`](/configuration/rule-set/headless-rule/#query_type) in referenced
-rule-sets, changes in two ways.
-
-First, these fields now take effect on every DNS rule evaluation. In earlier
-versions they were evaluated only for DNS queries received from a client
-(for example, from a DNS inbound or intercepted by `tun`), and were silently
-ignored when a DNS rule was matched from an internal domain resolution that
-did not target a specific DNS server. Such internal resolutions include:
-
-- The [`resolve`](/configuration/route/rule_action/#resolve) route rule
-  action without a `server` set.
-- ICMP traffic routed to a domain destination through a `direct` outbound.
-- A [WireGuard](/configuration/endpoint/wireguard/) or
-  [Tailscale](/configuration/endpoint/tailscale/) endpoint used as an
-  outbound, when resolving its own destination address.
-- A [SOCKS4](/configuration/outbound/socks/) outbound, which must resolve
-  the destination locally because the protocol has no in-protocol domain
-  support.
-- The [DERP](/configuration/service/derp/) `bootstrap-dns` endpoint and the
-  [`resolved`](/configuration/service/resolved/) service (when resolving a
-  hostname or an SRV target).
-
-Resolutions that target a specific DNS server — via
-[`domain_resolver`](/configuration/shared/dial/#domain_resolver) on a dial
-field, [`default_domain_resolver`](/configuration/route/#default_domain_resolver)
-in route options, or an explicit `server` on a DNS rule action or the
-`resolve` route rule action — do not go through DNS rule matching and are
-unaffected.
-
-Second, setting `ip_version` or `query_type` in a DNS rule, or referencing a
-rule-set containing `query_type`, is no longer compatible in the same DNS
-configuration with Legacy Address Filter Fields in DNS rules, the Legacy
-`strategy` DNS rule action option, or the Legacy `rule_set_ip_cidr_accept_empty`
-DNS rule item. Such a configuration will be rejected at startup. To combine
-these fields with address-based filtering, migrate to response matching via
-the [`evaluate`](/configuration/dns/rule_action/#evaluate) action and
-[`match_response`](/configuration/dns/rule/#match_response), see
-[Migrate address filter fields to response matching](#migrate-address-filter-fields-to-response-matching).
-
-!!! info "References"
-
-    [DNS Rule](/configuration/dns/rule/) /
-    [Headless Rule](/configuration/rule-set/headless-rule/) /
-    [Route Rule Action](/configuration/route/rule_action/#resolve)
-
 ## 1.12.0
 
 ### Migrate to new DNS server formats

docs/migration.zh.md

@@ -79,167 +79,6 @@ sing-box 1.14.0 新增字段参阅 [ACME](/zh/configuration/shared/certificate-p
     }
     ```
 
-### 迁移地址筛选字段到响应匹配
-
-旧版地址筛选字段（不使用 `match_response` 的 `ip_cidr`、`ip_is_private`）已废弃，
-旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项也已废弃。
-
-在 sing-box 1.14.0 中，请使用 [`evaluate`](/zh/configuration/dns/rule_action/#evaluate) 动作
-获取 DNS 响应，然后通过 `match_response` 显式匹配。
-
-!!! info "参考"
-
-    [DNS 规则](/zh/configuration/dns/rule/) /
-    [DNS 规则动作](/zh/configuration/dns/rule_action/#evaluate)
-
-=== ":material-card-remove: 弃用的"
-
-    ```json
-    {
-      "dns": {
-        "rules": [
-          {
-            "rule_set": "geoip-cn",
-            "action": "route",
-            "server": "local"
-          },
-          {
-            "action": "route",
-            "server": "remote"
-          }
-        ]
-      }
-    }
-    ```
-
-=== ":material-card-multiple: 新的"
-
-    ```json
-    {
-      "dns": {
-        "rules": [
-          {
-            "action": "evaluate",
-            "server": "remote"
-          },
-          {
-            "match_response": true,
-            "rule_set": "geoip-cn",
-            "action": "route",
-            "server": "local"
-          },
-          {
-            "action": "route",
-            "server": "remote"
-          }
-        ]
-      }
-    }
-    ```
-
-### 迁移 independent DNS cache
-
-DNS 缓存现在始终按传输名称分离，使 `independent_cache` 不再需要。
-直接移除该字段即可。
-
-!!! info "参考"
-
-    [DNS](/zh/configuration/dns/)
-
-=== ":material-card-remove: 弃用的"
-
-    ```json
-    {
-      "dns": {
-        "independent_cache": true
-      }
-    }
-    ```
-
-=== ":material-card-multiple: 新的"
-
-    ```json
-    {
-      "dns": {}
-    }
-    ```
-
-### 迁移 store_rdrc
-
-`store_rdrc` 已废弃，且可以被 `store_dns` 替代，
-后者将完整的 DNS 缓存持久化到缓存文件中。
-
-!!! info "参考"
-
-    [缓存文件](/zh/configuration/experimental/cache-file/)
-
-=== ":material-card-remove: 弃用的"
-
-    ```json
-    {
-      "experimental": {
-        "cache_file": {
-          "enabled": true,
-          "store_rdrc": true
-        }
-      }
-    }
-    ```
-
-=== ":material-card-multiple: 新的"
-
-    ```json
-    {
-      "experimental": {
-        "cache_file": {
-          "enabled": true,
-          "store_dns": true
-        }
-      }
-    }
-    ```
-
-### DNS 规则中的 ip_version 和 query_type 行为更改
-
-在 sing-box 1.14.0 中，DNS 规则中的
-[`ip_version`](/zh/configuration/dns/rule/#ip_version) 和
-[`query_type`](/zh/configuration/dns/rule/#query_type)，以及被引用规则集中的
-[`query_type`](/zh/configuration/rule-set/headless-rule/#query_type)，
-行为有两项更改。
-
-其一，这些字段现在对每一次 DNS 规则评估都会生效。此前它们仅对来自客户端的 DNS 查询
-（例如来自 DNS 入站或被 `tun` 截获的查询）生效，当 DNS 规则被未指定具体 DNS 服务器的
-内部域名解析匹配时，会被静默忽略。此类内部解析包括：
-
-- 未设置 `server` 的 [`resolve`](/zh/configuration/route/rule_action/#resolve) 路由规则动作。
-- 通过 `direct` 出站路由到域名目标的 ICMP 流量。
-- 作为出站使用的 [WireGuard](/zh/configuration/endpoint/wireguard/) 或
-  [Tailscale](/zh/configuration/endpoint/tailscale/) 端点在解析自身目标地址时。
-- [SOCKS4](/zh/configuration/outbound/socks/) 出站，因为协议本身不支持域名，
-  必须在本地解析目标。
-- [DERP](/zh/configuration/service/derp/) 的 `bootstrap-dns` 端点，以及
-  [`resolved`](/zh/configuration/service/resolved/) 服务在解析主机名或 SRV 目标时。
-
-通过拨号字段中的
-[`domain_resolver`](/zh/configuration/shared/dial/#domain_resolver)、
-路由选项中的 [`default_domain_resolver`](/zh/configuration/route/#default_domain_resolver)，
-或 DNS 规则动作与 `resolve` 路由规则动作上显式的 `server` 指定具体 DNS 服务器的
-解析，不会经过 DNS 规则匹配，不受此次更改影响。
-
-其二，设置了 `ip_version` 或 `query_type` 的 DNS 规则，或引用了包含 `query_type` 的
-规则集的 DNS 规则，在同一 DNS 配置中不再能与旧版地址筛选字段 (DNS 规则)、旧版
-DNS 规则动作 `strategy` 选项，或旧版 `rule_set_ip_cidr_accept_empty` DNS 规则项共存。
-此类配置将在启动时被拒绝。如需将这些字段与基于地址的筛选组合，请通过
-[`evaluate`](/zh/configuration/dns/rule_action/#evaluate) 动作和
-[`match_response`](/zh/configuration/dns/rule/#match_response) 迁移到响应匹配，
-参阅 [迁移地址筛选字段到响应匹配](#迁移地址筛选字段到响应匹配)。
-
-!!! info "参考"
-
-    [DNS 规则](/zh/configuration/dns/rule/) /
-    [Headless 规则](/zh/configuration/rule-set/headless-rule/) /
-    [路由规则动作](/zh/configuration/route/rule_action/#resolve)
-
 ## 1.12.0
 
 ### 迁移到新的 DNS 服务器格式

experimental/cachefile/cache.go

@@ -12,11 +12,9 @@ import (
 	"github.com/sagernet/bbolt"
 	bboltErrors "github.com/sagernet/bbolt/errors"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
 	"github.com/sagernet/sing/service/filemanager"
 )
 
@@ -32,7 +30,6 @@ var (
 		string(bucketMode),
 		string(bucketRuleSet),
 		string(bucketRDRC),
-		string(bucketDNSCache),
 	}
 
 	cacheIDDefault = []byte("default")
@@ -41,43 +38,30 @@ var (
 var _ adapter.CacheFile = (*CacheFile)(nil)
 
 type CacheFile struct {
-	ctx                context.Context
-	logger             logger.Logger
-	path               string
-	cacheID            []byte
-	storeFakeIP        bool
-	storeRDRC          bool
-	storeDNS           bool
-	disableExpire      bool
-	rdrcTimeout        time.Duration
-	optimisticTimeout  time.Duration
-	DB                 *bbolt.DB
-	resetAccess        sync.Mutex
-	saveMetadataTimer  *time.Timer
-	saveFakeIPAccess   sync.RWMutex
-	saveDomain         map[netip.Addr]string
-	saveAddress4       map[string]netip.Addr
-	saveAddress6       map[string]netip.Addr
-	saveRDRCAccess     sync.RWMutex
-	saveRDRC           map[saveCacheKey]bool
-	saveDNSCacheAccess sync.RWMutex
-	saveDNSCache       map[saveCacheKey]saveDNSCacheEntry
+	ctx               context.Context
+	path              string
+	cacheID           []byte
+	storeFakeIP       bool
+	storeRDRC         bool
+	rdrcTimeout       time.Duration
+	DB                *bbolt.DB
+	resetAccess       sync.Mutex
+	saveMetadataTimer *time.Timer
+	saveFakeIPAccess  sync.RWMutex
+	saveDomain        map[netip.Addr]string
+	saveAddress4      map[string]netip.Addr
+	saveAddress6      map[string]netip.Addr
+	saveRDRCAccess    sync.RWMutex
+	saveRDRC          map[saveRDRCCacheKey]bool
 }
 
-type saveCacheKey struct {
+type saveRDRCCacheKey struct {
 	TransportName string
 	QuestionName  string
 	QType         uint16
 }
 
-type saveDNSCacheEntry struct {
-	rawMessage []byte
-	expireAt   time.Time
-	sequence   uint64
-	saving     bool
-}
-
-func New(ctx context.Context, logger logger.Logger, options option.CacheFileOptions) *CacheFile {
+func New(ctx context.Context, options option.CacheFileOptions) *CacheFile {
 	var path string
 	if options.Path != "" {
 		path = options.Path
@@ -88,9 +72,6 @@ func New(ctx context.Context, logger logger.Logger, options option.CacheFileOpti
 	if options.CacheID != "" {
 		cacheIDBytes = append([]byte{0}, []byte(options.CacheID)...)
 	}
-	if options.StoreRDRC {
-		deprecated.Report(ctx, deprecated.OptionStoreRDRC)
-	}
 	var rdrcTimeout time.Duration
 	if options.StoreRDRC {
 		if options.RDRCTimeout > 0 {
@@ -101,18 +82,15 @@ func New(ctx context.Context, logger logger.Logger, options option.CacheFileOpti
 	}
 	return &CacheFile{
 		ctx:          ctx,
-		logger:       logger,
 		path:         filemanager.BasePath(ctx, path),
 		cacheID:      cacheIDBytes,
 		storeFakeIP:  options.StoreFakeIP,
 		storeRDRC:    options.StoreRDRC,
-		storeDNS:     options.StoreDNS,
 		rdrcTimeout:  rdrcTimeout,
 		saveDomain:   make(map[netip.Addr]string),
 		saveAddress4: make(map[string]netip.Addr),
 		saveAddress6: make(map[string]netip.Addr),
-		saveRDRC:     make(map[saveCacheKey]bool),
-		saveDNSCache: make(map[saveCacheKey]saveDNSCacheEntry),
+		saveRDRC:     make(map[saveRDRCCacheKey]bool),
 	}
 }
 
@@ -124,44 +102,10 @@ func (c *CacheFile) Dependencies() []string {
 	return nil
 }
 
-func (c *CacheFile) SetOptimisticTimeout(timeout time.Duration) {
-	c.optimisticTimeout = timeout
-}
-
-func (c *CacheFile) SetDisableExpire(disableExpire bool) {
-	c.disableExpire = disableExpire
-}
-
 func (c *CacheFile) Start(stage adapter.StartStage) error {
-	switch stage {
-	case adapter.StartStateInitialize:
-		return c.start()
-	case adapter.StartStateStart:
-		c.startCacheCleanup()
+	if stage != adapter.StartStateInitialize {
+		return nil
 	}
-	return nil
-}
-
-func (c *CacheFile) startCacheCleanup() {
-	if c.storeDNS {
-		c.clearRDRC()
-		c.cleanupDNSCache()
-		interval := c.optimisticTimeout / 2
-		if interval <= 0 {
-			interval = time.Hour
-		}
-		go c.loopCacheCleanup(interval, c.cleanupDNSCache)
-	} else if c.storeRDRC {
-		c.cleanupRDRC()
-		interval := c.rdrcTimeout / 2
-		if interval <= 0 {
-			interval = time.Hour
-		}
-		go c.loopCacheCleanup(interval, c.cleanupRDRC)
-	}
-}
-
-func (c *CacheFile) start() error {
 	const fileMode = 0o666
 	options := bbolt.Options{Timeout: time.Second}
 	var (

experimental/cachefile/dns_cache.go

@@ -1,299 +0,0 @@
-package cachefile
-
-import (
-	"encoding/binary"
-	"time"
-
-	"github.com/sagernet/bbolt"
-	"github.com/sagernet/sing/common/buf"
-	"github.com/sagernet/sing/common/logger"
-)
-
-var bucketDNSCache = []byte("dns_cache")
-
-func (c *CacheFile) StoreDNS() bool {
-	return c.storeDNS
-}
-
-func (c *CacheFile) LoadDNSCache(transportName string, qName string, qType uint16) (rawMessage []byte, expireAt time.Time, loaded bool) {
-	c.saveDNSCacheAccess.RLock()
-	entry, cached := c.saveDNSCache[saveCacheKey{transportName, qName, qType}]
-	c.saveDNSCacheAccess.RUnlock()
-	if cached {
-		return entry.rawMessage, entry.expireAt, true
-	}
-	key := buf.Get(2 + len(qName))
-	binary.BigEndian.PutUint16(key, qType)
-	copy(key[2:], qName)
-	defer buf.Put(key)
-	err := c.view(func(tx *bbolt.Tx) error {
-		bucket := c.bucket(tx, bucketDNSCache)
-		if bucket == nil {
-			return nil
-		}
-		bucket = bucket.Bucket([]byte(transportName))
-		if bucket == nil {
-			return nil
-		}
-		content := bucket.Get(key)
-		if len(content) < 8 {
-			return nil
-		}
-		expireAt = time.Unix(int64(binary.BigEndian.Uint64(content[:8])), 0)
-		rawMessage = make([]byte, len(content)-8)
-		copy(rawMessage, content[8:])
-		loaded = true
-		return nil
-	})
-	if err != nil {
-		return nil, time.Time{}, false
-	}
-	return
-}
-
-func (c *CacheFile) SaveDNSCache(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time) error {
-	return c.batch(func(tx *bbolt.Tx) error {
-		bucket, err := c.createBucket(tx, bucketDNSCache)
-		if err != nil {
-			return err
-		}
-		bucket, err = bucket.CreateBucketIfNotExists([]byte(transportName))
-		if err != nil {
-			return err
-		}
-		key := buf.Get(2 + len(qName))
-		binary.BigEndian.PutUint16(key, qType)
-		copy(key[2:], qName)
-		defer buf.Put(key)
-		value := buf.Get(8 + len(rawMessage))
-		defer buf.Put(value)
-		binary.BigEndian.PutUint64(value[:8], uint64(expireAt.Unix()))
-		copy(value[8:], rawMessage)
-		return bucket.Put(key, value)
-	})
-}
-
-func (c *CacheFile) SaveDNSCacheAsync(transportName string, qName string, qType uint16, rawMessage []byte, expireAt time.Time, logger logger.Logger) {
-	saveKey := saveCacheKey{transportName, qName, qType}
-	if !c.queueDNSCacheSave(saveKey, rawMessage, expireAt) {
-		return
-	}
-	go c.flushPendingDNSCache(saveKey, logger)
-}
-
-func (c *CacheFile) queueDNSCacheSave(saveKey saveCacheKey, rawMessage []byte, expireAt time.Time) bool {
-	c.saveDNSCacheAccess.Lock()
-	defer c.saveDNSCacheAccess.Unlock()
-	entry := c.saveDNSCache[saveKey]
-	entry.rawMessage = append([]byte(nil), rawMessage...)
-	entry.expireAt = expireAt
-	entry.sequence++
-	startFlush := !entry.saving
-	entry.saving = true
-	c.saveDNSCache[saveKey] = entry
-	return startFlush
-}
-
-func (c *CacheFile) flushPendingDNSCache(saveKey saveCacheKey, logger logger.Logger) {
-	c.flushPendingDNSCacheWith(saveKey, logger, func(entry saveDNSCacheEntry) error {
-		return c.SaveDNSCache(saveKey.TransportName, saveKey.QuestionName, saveKey.QType, entry.rawMessage, entry.expireAt)
-	})
-}
-
-func (c *CacheFile) flushPendingDNSCacheWith(saveKey saveCacheKey, logger logger.Logger, save func(saveDNSCacheEntry) error) {
-	for {
-		c.saveDNSCacheAccess.RLock()
-		entry, loaded := c.saveDNSCache[saveKey]
-		c.saveDNSCacheAccess.RUnlock()
-		if !loaded {
-			return
-		}
-		err := save(entry)
-		if err != nil {
-			logger.Warn("save DNS cache: ", err)
-		}
-		c.saveDNSCacheAccess.Lock()
-		currentEntry, loaded := c.saveDNSCache[saveKey]
-		if !loaded {
-			c.saveDNSCacheAccess.Unlock()
-			return
-		}
-		if currentEntry.sequence != entry.sequence {
-			c.saveDNSCacheAccess.Unlock()
-			continue
-		}
-		delete(c.saveDNSCache, saveKey)
-		c.saveDNSCacheAccess.Unlock()
-		return
-	}
-}
-
-func (c *CacheFile) ClearDNSCache() error {
-	c.saveDNSCacheAccess.Lock()
-	clear(c.saveDNSCache)
-	c.saveDNSCacheAccess.Unlock()
-	return c.batch(func(tx *bbolt.Tx) error {
-		if c.cacheID == nil {
-			bucket := tx.Bucket(bucketDNSCache)
-			if bucket == nil {
-				return nil
-			}
-			return tx.DeleteBucket(bucketDNSCache)
-		}
-		bucket := tx.Bucket(c.cacheID)
-		if bucket == nil || bucket.Bucket(bucketDNSCache) == nil {
-			return nil
-		}
-		return bucket.DeleteBucket(bucketDNSCache)
-	})
-}
-
-func (c *CacheFile) loopCacheCleanup(interval time.Duration, cleanupFunc func()) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-c.ctx.Done():
-			return
-		case <-ticker.C:
-			cleanupFunc()
-		}
-	}
-}
-
-func (c *CacheFile) cleanupDNSCache() {
-	now := time.Now()
-	err := c.batch(func(tx *bbolt.Tx) error {
-		bucket := c.bucket(tx, bucketDNSCache)
-		if bucket == nil {
-			return nil
-		}
-		var emptyTransports [][]byte
-		err := bucket.ForEachBucket(func(transportName []byte) error {
-			transportBucket := bucket.Bucket(transportName)
-			if transportBucket == nil {
-				return nil
-			}
-			var expiredKeys [][]byte
-			err := transportBucket.ForEach(func(key, value []byte) error {
-				if len(value) < 8 {
-					expiredKeys = append(expiredKeys, append([]byte(nil), key...))
-					return nil
-				}
-				if c.disableExpire {
-					return nil
-				}
-				expireAt := time.Unix(int64(binary.BigEndian.Uint64(value[:8])), 0)
-				if now.After(expireAt.Add(c.optimisticTimeout)) {
-					expiredKeys = append(expiredKeys, append([]byte(nil), key...))
-				}
-				return nil
-			})
-			if err != nil {
-				return err
-			}
-			for _, key := range expiredKeys {
-				err = transportBucket.Delete(key)
-				if err != nil {
-					return err
-				}
-			}
-			first, _ := transportBucket.Cursor().First()
-			if first == nil {
-				emptyTransports = append(emptyTransports, append([]byte(nil), transportName...))
-			}
-			return nil
-		})
-		if err != nil {
-			return err
-		}
-		for _, name := range emptyTransports {
-			err = bucket.DeleteBucket(name)
-			if err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		c.logger.Warn("cleanup DNS cache: ", err)
-	}
-}
-
-func (c *CacheFile) clearRDRC() {
-	c.saveRDRCAccess.Lock()
-	clear(c.saveRDRC)
-	c.saveRDRCAccess.Unlock()
-	err := c.batch(func(tx *bbolt.Tx) error {
-		if c.cacheID == nil {
-			if tx.Bucket(bucketRDRC) == nil {
-				return nil
-			}
-			return tx.DeleteBucket(bucketRDRC)
-		}
-		bucket := tx.Bucket(c.cacheID)
-		if bucket == nil || bucket.Bucket(bucketRDRC) == nil {
-			return nil
-		}
-		return bucket.DeleteBucket(bucketRDRC)
-	})
-	if err != nil {
-		c.logger.Warn("clear RDRC: ", err)
-	}
-}
-
-func (c *CacheFile) cleanupRDRC() {
-	now := time.Now()
-	err := c.batch(func(tx *bbolt.Tx) error {
-		bucket := c.bucket(tx, bucketRDRC)
-		if bucket == nil {
-			return nil
-		}
-		var emptyTransports [][]byte
-		err := bucket.ForEachBucket(func(transportName []byte) error {
-			transportBucket := bucket.Bucket(transportName)
-			if transportBucket == nil {
-				return nil
-			}
-			var expiredKeys [][]byte
-			err := transportBucket.ForEach(func(key, value []byte) error {
-				if len(value) < 8 {
-					expiredKeys = append(expiredKeys, append([]byte(nil), key...))
-					return nil
-				}
-				expiresAt := time.Unix(int64(binary.BigEndian.Uint64(value)), 0)
-				if now.After(expiresAt) {
-					expiredKeys = append(expiredKeys, append([]byte(nil), key...))
-				}
-				return nil
-			})
-			if err != nil {
-				return err
-			}
-			for _, key := range expiredKeys {
-				err = transportBucket.Delete(key)
-				if err != nil {
-					return err
-				}
-			}
-			first, _ := transportBucket.Cursor().First()
-			if first == nil {
-				emptyTransports = append(emptyTransports, append([]byte(nil), transportName...))
-			}
-			return nil
-		})
-		if err != nil {
-			return err
-		}
-		for _, name := range emptyTransports {
-			err = bucket.DeleteBucket(name)
-			if err != nil {
-				return err
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		c.logger.Warn("cleanup RDRC: ", err)
-	}
-}

experimental/cachefile/rdrc.go

@@ -21,7 +21,7 @@ func (c *CacheFile) RDRCTimeout() time.Duration {
 
 func (c *CacheFile) LoadRDRC(transportName string, qName string, qType uint16) (rejected bool) {
 	c.saveRDRCAccess.RLock()
-	rejected, cached := c.saveRDRC[saveCacheKey{transportName, qName, qType}]
+	rejected, cached := c.saveRDRC[saveRDRCCacheKey{transportName, qName, qType}]
 	c.saveRDRCAccess.RUnlock()
 	if cached {
 		return
@@ -93,7 +93,7 @@ func (c *CacheFile) SaveRDRC(transportName string, qName string, qType uint16) e
 }
 
 func (c *CacheFile) SaveRDRCAsync(transportName string, qName string, qType uint16, logger logger.Logger) {
-	saveKey := saveCacheKey{transportName, qName, qType}
+	saveKey := saveRDRCCacheKey{transportName, qName, qType}
 	c.saveRDRCAccess.Lock()
 	c.saveRDRC[saveKey] = true
 	c.saveRDRCAccess.Unlock()

experimental/deprecated/constants.go

@@ -57,6 +57,24 @@ func (n Note) MessageWithLink() string {
 	}
 }
 
+var OptionLegacyDNSTransport = Note{
+	Name:              "legacy-dns-transport",
+	Description:       "legacy DNS servers",
+	DeprecatedVersion: "1.12.0",
+	ScheduledVersion:  "1.14.0",
+	EnvName:           "LEGACY_DNS_SERVERS",
+	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-to-new-dns-server-formats",
+}
+
+var OptionLegacyDNSFakeIPOptions = Note{
+	Name:              "legacy-dns-fakeip-options",
+	Description:       "legacy DNS fakeip options",
+	DeprecatedVersion: "1.12.0",
+	ScheduledVersion:  "1.14.0",
+	EnvName:           "LEGACY_DNS_FAKEIP_OPTIONS",
+	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-to-new-dns-server-formats",
+}
+
 var OptionOutboundDNSRuleItem = Note{
 	Name:              "outbound-dns-rule-item",
 	Description:       "outbound DNS rule item",
@@ -93,59 +111,11 @@ var OptionInlineACME = Note{
 	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-inline-acme-to-certificate-provider",
 }
 
-var OptionRuleSetIPCIDRAcceptEmpty = Note{
-	Name:              "dns-rule-rule-set-ip-cidr-accept-empty",
-	Description:       "Legacy `rule_set_ip_cidr_accept_empty` DNS rule item",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "DNS_RULE_RULE_SET_IP_CIDR_ACCEPT_EMPTY",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-address-filter-fields-to-response-matching",
-}
-
-var OptionLegacyDNSAddressFilter = Note{
-	Name:              "legacy-dns-address-filter",
-	Description:       "Legacy Address Filter Fields in DNS rules",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "LEGACY_DNS_ADDRESS_FILTER",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-address-filter-fields-to-response-matching",
-}
-
-var OptionLegacyDNSRuleStrategy = Note{
-	Name:              "legacy-dns-rule-strategy",
-	Description:       "Legacy `strategy` DNS rule action option",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "LEGACY_DNS_RULE_STRATEGY",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-dns-rule-action-strategy-to-rule-items",
-}
-
-var OptionIndependentDNSCache = Note{
-	Name:              "independent-dns-cache",
-	Description:       "`independent_cache` DNS option",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "INDEPENDENT_DNS_CACHE",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-independent-dns-cache",
-}
-
-var OptionStoreRDRC = Note{
-	Name:              "store-rdrc",
-	Description:       "`store_rdrc` cache file option",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "STORE_RDRC",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-store-rdrc",
-}
-
 var Options = []Note{
+	OptionLegacyDNSTransport,
+	OptionLegacyDNSFakeIPOptions,
 	OptionOutboundDNSRuleItem,
 	OptionMissingDomainResolver,
 	OptionLegacyDomainStrategyOptions,
 	OptionInlineACME,
-	OptionRuleSetIPCIDRAcceptEmpty,
-	OptionLegacyDNSAddressFilter,
-	OptionLegacyDNSRuleStrategy,
-	OptionIndependentDNSCache,
-	OptionStoreRDRC,
 }

experimental/libbox/command.go

@@ -6,5 +6,4 @@ const (
 	CommandGroup
 	CommandClashMode
 	CommandConnections
-	CommandOutbounds
 )

experimental/libbox/command_client.go

@@ -14,10 +14,8 @@ import (
 	E "github.com/sagernet/sing/common/exceptions"
 
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
-	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
@@ -49,7 +47,6 @@ type CommandClientHandler interface {
 	WriteLogs(messageList LogIterator)
 	WriteStatus(message *StatusMessage)
 	WriteGroups(message OutboundGroupIterator)
-	WriteOutbounds(message OutboundGroupItemIterator)
 	InitializeClashMode(modeList StringIterator, currentMode string)
 	UpdateClashMode(newMode string)
 	WriteConnectionEvents(events *ConnectionEvents)
@@ -116,7 +113,7 @@ func dialTarget() (string, func(context.Context, string) (net.Conn, error)) {
 		return "passthrough:///xpc", func(ctx context.Context, _ string) (net.Conn, error) {
 			fileDescriptor, err := sXPCDialer.DialXPC()
 			if err != nil {
-				return nil, E.Cause(err, "dial xpc")
+				return nil, err
 			}
 			return networkConnectionFromFileDescriptor(fileDescriptor)
 		}
@@ -165,7 +162,7 @@ func (c *CommandClient) dialWithRetry(target string, contextDialer func(context.
 			if err != nil {
 				lastError = err
 				if !retryDial {
-					return nil, nil, E.Cause(err, "create command client")
+					return nil, nil, err
 				}
 				time.Sleep(commandClientDialDelay(attempt))
 				continue
@@ -185,7 +182,7 @@ func (c *CommandClient) dialWithRetry(target string, contextDialer func(context.
 	if connection != nil {
 		connection.Close()
 	}
-	return nil, nil, E.Cause(lastError, "probe command server")
+	return nil, nil, lastError
 }
 
 func (c *CommandClient) Connect() error {
@@ -246,8 +243,6 @@ func (c *CommandClient) dispatchCommands() error {
 			go c.handleClashModeStream()
 		case CommandConnections:
 			go c.handleConnectionsStream()
-		case CommandOutbounds:
-			go c.handleOutboundsStream()
 		default:
 			return E.New("unknown command: ", command)
 		}
@@ -282,7 +277,7 @@ func (c *CommandClient) getClientForCall() (daemon.StartedServiceClient, error)
 	target, contextDialer := dialTarget()
 	connection, client, err := c.dialWithRetry(target, contextDialer, true)
 	if err != nil {
-		return nil, E.Cause(err, "get command client")
+		return nil, err
 	}
 	c.grpcConn = connection
 	c.grpcClient = client
@@ -324,19 +319,19 @@ func (c *CommandClient) handleLogStream() {
 	client, ctx := c.getStreamContext()
 	stream, err := client.SubscribeLog(ctx, &emptypb.Empty{})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe log").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 	defaultLogLevel, err := client.GetDefaultLogLevel(ctx, &emptypb.Empty{})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "get default log level").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 	c.handler.SetDefaultLogLevel(int32(defaultLogLevel.Level))
 	for {
 		logMessage, err := stream.Recv()
 		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "log stream recv").Error())
+			c.handler.Disconnected(err.Error())
 			return
 		}
 		if logMessage.Reset_ {
@@ -361,14 +356,14 @@ func (c *CommandClient) handleStatusStream() {
 		Interval: interval,
 	})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe status").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 
 	for {
 		status, err := stream.Recv()
 		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "status stream recv").Error())
+			c.handler.Disconnected(err.Error())
 			return
 		}
 		c.handler.WriteStatus(statusMessageFromGRPC(status))
@@ -380,14 +375,14 @@ func (c *CommandClient) handleGroupStream() {
 
 	stream, err := client.SubscribeGroups(ctx, &emptypb.Empty{})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe groups").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 
 	for {
 		groups, err := stream.Recv()
 		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "groups stream recv").Error())
+			c.handler.Disconnected(err.Error())
 			return
 		}
 		c.handler.WriteGroups(outboundGroupIteratorFromGRPC(groups))
@@ -399,7 +394,7 @@ func (c *CommandClient) handleClashModeStream() {
 
 	modeStatus, err := client.GetClashModeStatus(ctx, &emptypb.Empty{})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "get clash mode status").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 
@@ -407,13 +402,13 @@ func (c *CommandClient) handleClashModeStream() {
 		go func() {
 			c.handler.InitializeClashMode(newIterator(modeStatus.ModeList), modeStatus.CurrentMode)
 			if len(modeStatus.ModeList) == 0 {
-				c.handler.Disconnected(E.Cause(os.ErrInvalid, "empty clash mode list").Error())
+				c.handler.Disconnected(os.ErrInvalid.Error())
 			}
 		}()
 	} else {
 		c.handler.InitializeClashMode(newIterator(modeStatus.ModeList), modeStatus.CurrentMode)
 		if len(modeStatus.ModeList) == 0 {
-			c.handler.Disconnected(E.Cause(os.ErrInvalid, "empty clash mode list").Error())
+			c.handler.Disconnected(os.ErrInvalid.Error())
 			return
 		}
 	}
@@ -424,14 +419,14 @@ func (c *CommandClient) handleClashModeStream() {
 
 	stream, err := client.SubscribeClashMode(ctx, &emptypb.Empty{})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe clash mode").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 
 	for {
 		mode, err := stream.Recv()
 		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "clash mode stream recv").Error())
+			c.handler.Disconnected(err.Error())
 			return
 		}
 		c.handler.UpdateClashMode(mode.Mode)
@@ -446,14 +441,14 @@ func (c *CommandClient) handleConnectionsStream() {
 		Interval: interval,
 	})
 	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe connections").Error())
+		c.handler.Disconnected(err.Error())
 		return
 	}
 
 	for {
 		events, err := stream.Recv()
 		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "connections stream recv").Error())
+			c.handler.Disconnected(err.Error())
 			return
 		}
 		libboxEvents := connectionEventsFromGRPC(events)
@@ -461,25 +456,6 @@ func (c *CommandClient) handleConnectionsStream() {
 	}
 }
 
-func (c *CommandClient) handleOutboundsStream() {
-	client, ctx := c.getStreamContext()
-
-	stream, err := client.SubscribeOutbounds(ctx, &emptypb.Empty{})
-	if err != nil {
-		c.handler.Disconnected(E.Cause(err, "subscribe outbounds").Error())
-		return
-	}
-
-	for {
-		list, err := stream.Recv()
-		if err != nil {
-			c.handler.Disconnected(E.Cause(err, "outbounds stream recv").Error())
-			return
-		}
-		c.handler.WriteOutbounds(outboundGroupItemListFromGRPC(list))
-	}
-}
-
 func (c *CommandClient) SelectOutbound(groupTag string, outboundTag string) error {
 	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
 		return client.SelectOutbound(context.Background(), &daemon.SelectOutboundRequest{
@@ -487,10 +463,7 @@ func (c *CommandClient) SelectOutbound(groupTag string, outboundTag string) erro
 			OutboundTag: outboundTag,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "select outbound")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) URLTest(groupTag string) error {
@@ -499,10 +472,7 @@ func (c *CommandClient) URLTest(groupTag string) error {
 			OutboundTag: groupTag,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "url test")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) SetClashMode(newMode string) error {
@@ -511,10 +481,7 @@ func (c *CommandClient) SetClashMode(newMode string) error {
 			Mode: newMode,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "set clash mode")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) CloseConnection(connId string) error {
@@ -523,57 +490,42 @@ func (c *CommandClient) CloseConnection(connId string) error {
 			Id: connId,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "close connection")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) CloseConnections() error {
 	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
 		return client.CloseAllConnections(context.Background(), &emptypb.Empty{})
 	})
-	if err != nil {
-		return E.Cause(err, "close all connections")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) ServiceReload() error {
 	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
 		return client.ReloadService(context.Background(), &emptypb.Empty{})
 	})
-	if err != nil {
-		return E.Cause(err, "reload service")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) ServiceClose() error {
 	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
 		return client.StopService(context.Background(), &emptypb.Empty{})
 	})
-	if err != nil {
-		return E.Cause(err, "stop service")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) ClearLogs() error {
 	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
 		return client.ClearLogs(context.Background(), &emptypb.Empty{})
 	})
-	if err != nil {
-		return E.Cause(err, "clear logs")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) GetSystemProxyStatus() (*SystemProxyStatus, error) {
 	return callWithResult(c, func(client daemon.StartedServiceClient) (*SystemProxyStatus, error) {
 		status, err := client.GetSystemProxyStatus(context.Background(), &emptypb.Empty{})
 		if err != nil {
-			return nil, E.Cause(err, "get system proxy status")
+			return nil, err
 		}
 		return systemProxyStatusFromGRPC(status), nil
 	})
@@ -585,59 +537,20 @@ func (c *CommandClient) SetSystemProxyEnabled(isEnabled bool) error {
 			Enabled: isEnabled,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "set system proxy enabled")
-	}
-	return nil
-}
-
-func (c *CommandClient) TriggerGoCrash() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerDebugCrash(context.Background(), &daemon.DebugCrashRequest{
-			Type: daemon.DebugCrashRequest_GO,
-		})
-	})
-	if err != nil {
-		return E.Cause(err, "trigger debug crash")
-	}
-	return nil
-}
-
-func (c *CommandClient) TriggerNativeCrash() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerDebugCrash(context.Background(), &daemon.DebugCrashRequest{
-			Type: daemon.DebugCrashRequest_NATIVE,
-		})
-	})
-	if err != nil {
-		return E.Cause(err, "trigger native crash")
-	}
-	return nil
-}
-
-func (c *CommandClient) TriggerOOMReport() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerOOMReport(context.Background(), &emptypb.Empty{})
-	})
-	if err != nil {
-		return E.Cause(err, "trigger oom report")
-	}
-	return nil
+	return err
 }
 
 func (c *CommandClient) GetDeprecatedNotes() (DeprecatedNoteIterator, error) {
 	return callWithResult(c, func(client daemon.StartedServiceClient) (DeprecatedNoteIterator, error) {
 		warnings, err := client.GetDeprecatedWarnings(context.Background(), &emptypb.Empty{})
 		if err != nil {
-			return nil, E.Cause(err, "get deprecated warnings")
+			return nil, err
 		}
 		var notes []*DeprecatedNote
 		for _, warning := range warnings.Warnings {
 			notes = append(notes, &DeprecatedNote{
-				Description:       warning.Description,
-				DeprecatedVersion: warning.DeprecatedVersion,
-				ScheduledVersion:  warning.ScheduledVersion,
-				MigrationLink:     warning.MigrationLink,
+				Description:   warning.Message,
+				MigrationLink: warning.MigrationLink,
 			})
 		}
 		return newIterator(notes), nil
@@ -648,7 +561,7 @@ func (c *CommandClient) GetStartedAt() (int64, error) {
 	return callWithResult(c, func(client daemon.StartedServiceClient) (int64, error) {
 		startedAt, err := client.GetStartedAt(context.Background(), &emptypb.Empty{})
 		if err != nil {
-			return 0, E.Cause(err, "get started at")
+			return 0, err
 		}
 		return startedAt.StartedAt, nil
 	})
@@ -661,147 +574,5 @@ func (c *CommandClient) SetGroupExpand(groupTag string, isExpand bool) error {
 			IsExpand: isExpand,
 		})
 	})
-	if err != nil {
-		return E.Cause(err, "set group expand")
-	}
-	return nil
-}
-
-func (c *CommandClient) StartNetworkQualityTest(configURL string, outboundTag string, serial bool, maxRuntimeSeconds int32, http3 bool, handler NetworkQualityTestHandler) error {
-	client, err := c.getClientForCall()
-	if err != nil {
-		return E.Cause(err, "start network quality test")
-	}
-	if c.standalone {
-		defer c.closeConnection()
-	}
-	stream, err := client.StartNetworkQualityTest(context.Background(), &daemon.NetworkQualityTestRequest{
-		ConfigURL:         configURL,
-		OutboundTag:       outboundTag,
-		Serial:            serial,
-		MaxRuntimeSeconds: maxRuntimeSeconds,
-		Http3:             http3,
-	})
-	if err != nil {
-		return E.Cause(err, "start network quality test")
-	}
-	for {
-		event, recvErr := stream.Recv()
-		if recvErr != nil {
-			recvErr = E.Cause(recvErr, "network quality test recv")
-			handler.OnError(recvErr.Error())
-			return recvErr
-		}
-		if event.IsFinal {
-			if event.Error != "" {
-				handler.OnError(event.Error)
-			} else {
-				handler.OnResult(&NetworkQualityResult{
-					DownloadCapacity:         event.DownloadCapacity,
-					UploadCapacity:           event.UploadCapacity,
-					DownloadRPM:              event.DownloadRPM,
-					UploadRPM:                event.UploadRPM,
-					IdleLatencyMs:            event.IdleLatencyMs,
-					DownloadCapacityAccuracy: event.DownloadCapacityAccuracy,
-					UploadCapacityAccuracy:   event.UploadCapacityAccuracy,
-					DownloadRPMAccuracy:      event.DownloadRPMAccuracy,
-					UploadRPMAccuracy:        event.UploadRPMAccuracy,
-				})
-			}
-			return nil
-		}
-		handler.OnProgress(networkQualityProgressFromGRPC(event))
-	}
-}
-
-func (c *CommandClient) StartSTUNTest(server string, outboundTag string, handler STUNTestHandler) error {
-	client, err := c.getClientForCall()
-	if err != nil {
-		return E.Cause(err, "start stun test")
-	}
-	if c.standalone {
-		defer c.closeConnection()
-	}
-	stream, err := client.StartSTUNTest(context.Background(), &daemon.STUNTestRequest{
-		Server:      server,
-		OutboundTag: outboundTag,
-	})
-	if err != nil {
-		return E.Cause(err, "start stun test")
-	}
-	for {
-		event, recvErr := stream.Recv()
-		if recvErr != nil {
-			recvErr = E.Cause(recvErr, "stun test recv")
-			handler.OnError(recvErr.Error())
-			return recvErr
-		}
-		if event.IsFinal {
-			if event.Error != "" {
-				handler.OnError(event.Error)
-			} else {
-				handler.OnResult(&STUNTestResult{
-					ExternalAddr:     event.ExternalAddr,
-					LatencyMs:        event.LatencyMs,
-					NATMapping:       event.NatMapping,
-					NATFiltering:     event.NatFiltering,
-					NATTypeSupported: event.NatTypeSupported,
-				})
-			}
-			return nil
-		}
-		handler.OnProgress(stunTestProgressFromGRPC(event))
-	}
-}
-
-func (c *CommandClient) SubscribeTailscaleStatus(handler TailscaleStatusHandler) error {
-	client, err := c.getClientForCall()
-	if err != nil {
-		return E.Cause(err, "subscribe tailscale status")
-	}
-	if c.standalone {
-		defer c.closeConnection()
-	}
-	stream, err := client.SubscribeTailscaleStatus(context.Background(), &emptypb.Empty{})
-	if err != nil {
-		return E.Cause(err, "subscribe tailscale status")
-	}
-	for {
-		event, recvErr := stream.Recv()
-		if recvErr != nil {
-			if status.Code(recvErr) == codes.NotFound || status.Code(recvErr) == codes.Unavailable {
-				return nil
-			}
-			recvErr = E.Cause(recvErr, "tailscale status recv")
-			handler.OnError(recvErr.Error())
-			return recvErr
-		}
-		handler.OnStatusUpdate(tailscaleStatusUpdateFromGRPC(event))
-	}
-}
-
-func (c *CommandClient) StartTailscalePing(endpointTag string, peerIP string, handler TailscalePingHandler) error {
-	client, err := c.getClientForCall()
-	if err != nil {
-		return E.Cause(err, "start tailscale ping")
-	}
-	if c.standalone {
-		defer c.closeConnection()
-	}
-	stream, err := client.StartTailscalePing(context.Background(), &daemon.TailscalePingRequest{
-		EndpointTag: endpointTag,
-		PeerIP:      peerIP,
-	})
-	if err != nil {
-		return E.Cause(err, "start tailscale ping")
-	}
-	for {
-		event, recvErr := stream.Recv()
-		if recvErr != nil {
-			recvErr = E.Cause(recvErr, "tailscale ping recv")
-			handler.OnError(recvErr.Error())
-			return recvErr
-		}
-		handler.OnPingResult(tailscalePingResultFromGRPC(event))
-	}
+	return err
 }

experimental/libbox/command_server.go

@@ -39,7 +39,6 @@ type CommandServerHandler interface {
 	ServiceReload() error
 	GetSystemProxyStatus() (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(enabled bool) error
-	TriggerNativeCrash() error
 	WriteDebugMessage(message string)
 }
 
@@ -58,12 +57,10 @@ func NewCommandServer(handler CommandServerHandler, platformInterface PlatformIn
 	server.StartedService = daemon.NewStartedService(daemon.ServiceOptions{
 		Context: ctx,
 		// Platform:         platformWrapper,
-		Handler:           (*platformHandler)(server),
-		Debug:             sDebug,
-		LogMaxLines:       sLogMaxLines,
-		OOMKillerEnabled:  sOOMKillerEnabled,
-		OOMKillerDisabled: sOOMKillerDisabled,
-		OOMMemoryLimit:    uint64(sOOMMemoryLimit),
+		Handler:     (*platformHandler)(server),
+		Debug:       sDebug,
+		LogMaxLines: sLogMaxLines,
+		OOMKiller:   memoryLimitEnabled,
 		// WorkingDirectory: sWorkingPath,
 		// TempDirectory:    sTempPath,
 		// UserID:           sUserID,
@@ -173,16 +170,11 @@ type OverrideOptions struct {
 }
 
 func (s *CommandServer) StartOrReloadService(configContent string, options *OverrideOptions) error {
-	saveConfigSnapshot(configContent)
-	err := s.StartedService.StartOrReloadService(configContent, &daemon.OverrideOptions{
+	return s.StartedService.StartOrReloadService(configContent, &daemon.OverrideOptions{
 		AutoRedirect:   options.AutoRedirect,
 		IncludePackage: iteratorToArray(options.IncludePackage),
 		ExcludePackage: iteratorToArray(options.ExcludePackage),
 	})
-	if err != nil {
-		return E.Cause(err, "start or reload service")
-	}
-	return nil
 }
 
 func (s *CommandServer) CloseService() error {
@@ -267,7 +259,7 @@ func (h *platformHandler) ServiceReload() error {
 func (h *platformHandler) SystemProxyStatus() (*daemon.SystemProxyStatus, error) {
 	status, err := (*CommandServer)(h).handler.GetSystemProxyStatus()
 	if err != nil {
-		return nil, E.Cause(err, "get system proxy status")
+		return nil, err
 	}
 	return &daemon.SystemProxyStatus{
 		Enabled:   status.Enabled,
@@ -279,10 +271,6 @@ func (h *platformHandler) SetSystemProxyEnabled(enabled bool) error {
 	return (*CommandServer)(h).handler.SetSystemProxyEnabled(enabled)
 }
 
-func (h *platformHandler) TriggerNativeCrash() error {
-	return (*CommandServer)(h).handler.TriggerNativeCrash()
-}
-
 func (h *platformHandler) WriteDebugMessage(message string) {
 	(*CommandServer)(h).handler.WriteDebugMessage(message)
 }

experimental/libbox/command_types.go

@@ -339,22 +339,6 @@ func outboundGroupIteratorFromGRPC(groups *daemon.Groups) OutboundGroupIterator
 	return newIterator(libboxGroups)
 }
 
-func outboundGroupItemListFromGRPC(list *daemon.OutboundList) OutboundGroupItemIterator {
-	if list == nil || len(list.Outbounds) == 0 {
-		return newIterator([]*OutboundGroupItem{})
-	}
-	var items []*OutboundGroupItem
-	for _, ob := range list.Outbounds {
-		items = append(items, &OutboundGroupItem{
-			Tag:          ob.Tag,
-			Type:         ob.Type,
-			URLTestTime:  ob.UrlTestTime,
-			URLTestDelay: ob.UrlTestDelay,
-		})
-	}
-	return newIterator(items)
-}
-
 func connectionFromGRPC(conn *daemon.Connection) Connection {
 	var processInfo *ProcessInfo
 	if conn.ProcessInfo != nil {

experimental/libbox/command_types_nq.go

@@ -1,51 +0,0 @@
-package libbox
-
-import "github.com/sagernet/sing-box/daemon"
-
-type NetworkQualityProgress struct {
-	Phase                    int32
-	DownloadCapacity         int64
-	UploadCapacity           int64
-	DownloadRPM              int32
-	UploadRPM                int32
-	IdleLatencyMs            int32
-	ElapsedMs                int64
-	DownloadCapacityAccuracy int32
-	UploadCapacityAccuracy   int32
-	DownloadRPMAccuracy      int32
-	UploadRPMAccuracy        int32
-}
-
-type NetworkQualityResult struct {
-	DownloadCapacity         int64
-	UploadCapacity           int64
-	DownloadRPM              int32
-	UploadRPM                int32
-	IdleLatencyMs            int32
-	DownloadCapacityAccuracy int32
-	UploadCapacityAccuracy   int32
-	DownloadRPMAccuracy      int32
-	UploadRPMAccuracy        int32
-}
-
-type NetworkQualityTestHandler interface {
-	OnProgress(progress *NetworkQualityProgress)
-	OnResult(result *NetworkQualityResult)
-	OnError(message string)
-}
-
-func networkQualityProgressFromGRPC(event *daemon.NetworkQualityTestProgress) *NetworkQualityProgress {
-	return &NetworkQualityProgress{
-		Phase:                    event.Phase,
-		DownloadCapacity:         event.DownloadCapacity,
-		UploadCapacity:           event.UploadCapacity,
-		DownloadRPM:              event.DownloadRPM,
-		UploadRPM:                event.UploadRPM,
-		IdleLatencyMs:            event.IdleLatencyMs,
-		ElapsedMs:                event.ElapsedMs,
-		DownloadCapacityAccuracy: event.DownloadCapacityAccuracy,
-		UploadCapacityAccuracy:   event.UploadCapacityAccuracy,
-		DownloadRPMAccuracy:      event.DownloadRPMAccuracy,
-		UploadRPMAccuracy:        event.UploadRPMAccuracy,
-	}
-}

experimental/libbox/command_types_stun.go

@@ -1,35 +0,0 @@
-package libbox
-
-import "github.com/sagernet/sing-box/daemon"
-
-type STUNTestProgress struct {
-	Phase        int32
-	ExternalAddr string
-	LatencyMs    int32
-	NATMapping   int32
-	NATFiltering int32
-}
-
-type STUNTestResult struct {
-	ExternalAddr     string
-	LatencyMs        int32
-	NATMapping       int32
-	NATFiltering     int32
-	NATTypeSupported bool
-}
-
-type STUNTestHandler interface {
-	OnProgress(progress *STUNTestProgress)
-	OnResult(result *STUNTestResult)
-	OnError(message string)
-}
-
-func stunTestProgressFromGRPC(event *daemon.STUNTestProgress) *STUNTestProgress {
-	return &STUNTestProgress{
-		Phase:        event.Phase,
-		ExternalAddr: event.ExternalAddr,
-		LatencyMs:    event.LatencyMs,
-		NATMapping:   event.NatMapping,
-		NATFiltering: event.NatFiltering,
-	}
-}

experimental/libbox/command_types_tailscale.go

@@ -1,132 +0,0 @@
-package libbox
-
-import "github.com/sagernet/sing-box/daemon"
-
-type TailscaleStatusUpdate struct {
-	endpoints []*TailscaleEndpointStatus
-}
-
-func (u *TailscaleStatusUpdate) Endpoints() TailscaleEndpointStatusIterator {
-	return newIterator(u.endpoints)
-}
-
-type TailscaleEndpointStatusIterator interface {
-	Next() *TailscaleEndpointStatus
-	HasNext() bool
-}
-
-type TailscaleEndpointStatus struct {
-	EndpointTag    string
-	BackendState   string
-	AuthURL        string
-	NetworkName    string
-	MagicDNSSuffix string
-	Self           *TailscalePeer
-	userGroups     []*TailscaleUserGroup
-}
-
-func (s *TailscaleEndpointStatus) UserGroups() TailscaleUserGroupIterator {
-	return newIterator(s.userGroups)
-}
-
-type TailscaleUserGroupIterator interface {
-	Next() *TailscaleUserGroup
-	HasNext() bool
-}
-
-type TailscaleUserGroup struct {
-	UserID        int64
-	LoginName     string
-	DisplayName   string
-	ProfilePicURL string
-	peers         []*TailscalePeer
-}
-
-func (g *TailscaleUserGroup) Peers() TailscalePeerIterator {
-	return newIterator(g.peers)
-}
-
-type TailscalePeerIterator interface {
-	Next() *TailscalePeer
-	HasNext() bool
-}
-
-type TailscalePeer struct {
-	HostName       string
-	DNSName        string
-	OS             string
-	tailscaleIPs   []string
-	Online         bool
-	ExitNode       bool
-	ExitNodeOption bool
-	Active         bool
-	RxBytes        int64
-	TxBytes        int64
-	KeyExpiry      int64
-}
-
-func (p *TailscalePeer) TailscaleIPs() StringIterator {
-	return newIterator(p.tailscaleIPs)
-}
-
-type TailscaleStatusHandler interface {
-	OnStatusUpdate(status *TailscaleStatusUpdate)
-	OnError(message string)
-}
-
-func tailscaleStatusUpdateFromGRPC(update *daemon.TailscaleStatusUpdate) *TailscaleStatusUpdate {
-	endpoints := make([]*TailscaleEndpointStatus, len(update.Endpoints))
-	for i, endpoint := range update.Endpoints {
-		endpoints[i] = tailscaleEndpointStatusFromGRPC(endpoint)
-	}
-	return &TailscaleStatusUpdate{endpoints: endpoints}
-}
-
-func tailscaleEndpointStatusFromGRPC(status *daemon.TailscaleEndpointStatus) *TailscaleEndpointStatus {
-	userGroups := make([]*TailscaleUserGroup, len(status.UserGroups))
-	for i, group := range status.UserGroups {
-		userGroups[i] = tailscaleUserGroupFromGRPC(group)
-	}
-	result := &TailscaleEndpointStatus{
-		EndpointTag:    status.EndpointTag,
-		BackendState:   status.BackendState,
-		AuthURL:        status.AuthURL,
-		NetworkName:    status.NetworkName,
-		MagicDNSSuffix: status.MagicDNSSuffix,
-		userGroups:     userGroups,
-	}
-	if status.Self != nil {
-		result.Self = tailscalePeerFromGRPC(status.Self)
-	}
-	return result
-}
-
-func tailscaleUserGroupFromGRPC(group *daemon.TailscaleUserGroup) *TailscaleUserGroup {
-	peers := make([]*TailscalePeer, len(group.Peers))
-	for i, peer := range group.Peers {
-		peers[i] = tailscalePeerFromGRPC(peer)
-	}
-	return &TailscaleUserGroup{
-		UserID:        group.UserID,
-		LoginName:     group.LoginName,
-		DisplayName:   group.DisplayName,
-		ProfilePicURL: group.ProfilePicURL,
-		peers:         peers,
-	}
-}
-
-func tailscalePeerFromGRPC(peer *daemon.TailscalePeer) *TailscalePeer {
-	return &TailscalePeer{
-		HostName:       peer.HostName,
-		DNSName:        peer.DnsName,
-		OS:             peer.Os,
-		tailscaleIPs:   peer.TailscaleIPs,
-		Online:         peer.Online,
-		ExitNode:       peer.ExitNode,
-		ExitNodeOption: peer.ExitNodeOption,
-		Active:         peer.Active,
-		RxBytes:        peer.RxBytes,
-		TxBytes:        peer.TxBytes,
-		KeyExpiry:      peer.KeyExpiry,
-	}
-}

experimental/libbox/command_types_tailscale_ping.go

@@ -1,28 +0,0 @@
-package libbox
-
-import "github.com/sagernet/sing-box/daemon"
-
-type TailscalePingResult struct {
-	LatencyMs      float64
-	IsDirect       bool
-	Endpoint       string
-	DERPRegionID   int32
-	DERPRegionCode string
-	Error          string
-}
-
-type TailscalePingHandler interface {
-	OnPingResult(result *TailscalePingResult)
-	OnError(message string)
-}
-
-func tailscalePingResultFromGRPC(response *daemon.TailscalePingResponse) *TailscalePingResult {
-	return &TailscalePingResult{
-		LatencyMs:      response.LatencyMs,
-		IsDirect:       response.IsDirect,
-		Endpoint:       response.Endpoint,
-		DERPRegionID:   response.DerpRegionID,
-		DERPRegionCode: response.DerpRegionCode,
-		Error:          response.Error,
-	}
-}

experimental/libbox/config.go

@@ -12,7 +12,6 @@ import (
 	"github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-box/service/oomkiller"
 	tun "github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -23,8 +22,6 @@ import (
 	"github.com/sagernet/sing/service/filemanager"
 )
 
-var sOOMReporter oomkiller.OOMReporter
-
 func baseContext(platformInterface PlatformInterface) context.Context {
 	dnsRegistry := include.DNSTransportRegistry()
 	if platformInterface != nil {
@@ -36,9 +33,6 @@ func baseContext(platformInterface PlatformInterface) context.Context {
 	}
 	ctx := context.Background()
 	ctx = filemanager.WithDefault(ctx, sWorkingPath, sTempPath, sUserID, sGroupID)
-	if sOOMReporter != nil {
-		ctx = service.ContextWith[oomkiller.OOMReporter](ctx, sOOMReporter)
-	}
 	return box.Context(ctx, include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry(), dnsRegistry, include.ServiceRegistry(), include.CertificateProviderRegistry())
 }