Bump version

* Add shadowtls outbound

* Add shadowtls inbound

* Add shadowtls example

* Add shadowtls documentation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,7 +31,7 @@ body:
         <details>
 
         ```console
-        $ sing-box --version
+        $ sing-box version
         # Paste output here
         ```
 

.github/update_dependencies.sh

@@ -1,10 +1,5 @@
 #!/usr/bin/env bash
 
 PROJECTS=$(dirname "$0")/../..
-
-go get -x github.com/sagernet/sing@$(git -C $PROJECTS/sing rev-parse HEAD)
-go get -x github.com/sagernet/sing-dns@$(git -C $PROJECTS/sing-dns rev-parse HEAD)
-go get -x github.com/sagernet/sing-tun@$(git -C $PROJECTS/sing-tun rev-parse HEAD)
-go get -x github.com/sagernet/sing-shadowsocks@$(git -C $PROJECTS/sing-shadowsocks rev-parse HEAD)
-go get -x github.com/sagernet/sing-vmess@$(git -C $PROJECTS/sing-vmess rev-parse HEAD)
+go get -x github.com/sagernet/$1@$(git -C $PROJECTS/$1 rev-parse HEAD)
 go mod tidy

.github/workflows/debug.yml

@@ -3,14 +3,18 @@ name: Debug build
 on:
   push:
     branches:
+      - main
       - dev
+      - dev-next
     paths-ignore:
       - '**.md'
       - '.github/**'
       - '!.github/workflows/debug.yml'
   pull_request:
     branches:
+      - main
       - dev
+      - dev-next
 
 jobs:
   build:

.github/workflows/mkdocs.yml

@@ -2,7 +2,7 @@ name: Generate Documents
 on:
   push:
     branches:
-      - main
+      - dev
     paths:
       - docs/**
       - .github/workflows/mkdocs.yml

.gitignore

@@ -4,4 +4,5 @@
 /*.db
 /site/
 /bin/
-/dist/
+/dist/
+/sing-box

Dockerfile

@@ -7,8 +7,8 @@ ENV GOPROXY ${GOPROXY}
 ENV CGO_ENABLED=0
 RUN set -ex \
     && apk add git build-base \
-    && export COMMIT=$(git rev-parse HEAD) \
-    && go build -v -trimpath -tags 'with_quic,with_acme,with_wireguard,with_clash_api' \
+    && export COMMIT=$(git rev-parse --short HEAD) \
+    && go build -v -trimpath -tags 'no_gvisor,with_quic,with_wireguard,with_acme' \
         -o /go/bin/sing-box \
         -ldflags "-X github.com/sagernet/sing-box/constant.Commit=${COMMIT} -w -s -buildid=" \
         ./cmd/sing-box

adapter/inbound.go

@@ -2,11 +2,13 @@ package adapter
 
 import (
 	"context"
+	"net"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/process"
 	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
 )
 
 type Inbound interface {
@@ -15,6 +17,13 @@ type Inbound interface {
 	Tag() string
 }
 
+type InjectableInbound interface {
+	Inbound
+	Network() []string
+	NewConnection(ctx context.Context, conn net.Conn, metadata InboundContext) error
+	NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext) error
+}
+
 type InboundContext struct {
 	Inbound     string
 	InboundType string
@@ -29,6 +38,8 @@ type InboundContext struct {
 
 	// cache
 
+	InboundDetour            string
+	LastInbound              string
 	OriginDestination        M.Socksaddr
 	DomainStrategy           dns.DomainStrategy
 	SniffEnabled             bool

adapter/upstream.go

@@ -38,13 +38,25 @@ type myUpstreamHandlerWrapper struct {
 }
 
 func (w *myUpstreamHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
-	w.metadata.Destination = metadata.Destination
-	return w.connectionHandler(ctx, conn, w.metadata)
+	myMetadata := w.metadata
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
+	return w.connectionHandler(ctx, conn, myMetadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
-	w.metadata.Destination = metadata.Destination
-	return w.packetHandler(ctx, conn, w.metadata)
+	myMetadata := w.metadata
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
+	return w.packetHandler(ctx, conn, myMetadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewError(ctx context.Context, err error) {
@@ -78,13 +90,23 @@ func NewUpstreamContextHandler(
 
 func (w *myUpstreamContextHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	myMetadata.Destination = metadata.Destination
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
 	return w.connectionHandler(ctx, conn, *myMetadata)
 }
 
 func (w *myUpstreamContextHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	myMetadata.Destination = metadata.Destination
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
 	return w.packetHandler(ctx, conn, *myMetadata)
 }
 

box.go

@@ -138,7 +138,7 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		}
 		outbounds = append(outbounds, out)
 	}
-	err = router.Initialize(outbounds, func() adapter.Outbound {
+	err = router.Initialize(inbounds, outbounds, func() adapter.Outbound {
 		out, oErr := outbound.New(ctx, router, logFactory.NewLogger("outbound/direct"), option.Outbound{Type: "direct", Tag: "default"})
 		common.Must(oErr)
 		outbounds = append(outbounds, out)

cmd/sing-box/cmd_format.go

@@ -38,7 +38,7 @@ func format() error {
 		return E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = json.Unmarshal(configContent, &options)
+	err = options.UnmarshalJSON(configContent)
 	if err != nil {
 		return E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_run.go

@@ -9,7 +9,6 @@ import (
 	"syscall"
 
 	"github.com/sagernet/sing-box"
-	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -46,7 +45,7 @@ func readConfig() (option.Options, error) {
 		return option.Options{}, E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = json.Unmarshal(configContent, &options)
+	err = options.UnmarshalJSON(configContent)
 	if err != nil {
 		return option.Options{}, E.Cause(err, "decode config")
 	}

common/baderror/baderror.go

@@ -0,0 +1,62 @@
+package baderror
+
+import (
+	"context"
+	"io"
+	"net"
+	"strings"
+
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func Contains(err error, msgList ...string) bool {
+	for _, msg := range msgList {
+		if strings.Contains(err.Error(), msg) {
+			return true
+		}
+	}
+	return false
+}
+
+func WrapH2(err error) error {
+	if err == nil {
+		return nil
+	}
+	err = E.Unwrap(err)
+	if err == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	if Contains(err, "client disconnected", "body closed by handler") {
+		return net.ErrClosed
+	}
+	return err
+}
+
+func WrapGRPC(err error) error {
+	// grpc uses stupid internal error types
+	if err == nil {
+		return nil
+	}
+	if Contains(err, "EOF") {
+		return io.EOF
+	}
+	if Contains(err, "Canceled") {
+		return context.Canceled
+	}
+	if Contains(err,
+		"the client connection is closing",
+		"server closed the stream without sending trailers") {
+		return net.ErrClosed
+	}
+	return err
+}
+
+func WrapQUIC(err error) error {
+	if err == nil {
+		return nil
+	}
+	if Contains(err, "canceled with error code 0") {
+		return net.ErrClosed
+	}
+	return err
+}

common/dialer/default.go

@@ -11,6 +11,7 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common/control"
+	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
@@ -130,6 +131,9 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 }
 
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
+	if !address.IsValid() {
+		return nil, E.New("invalid address")
+	}
 	switch N.NetworkName(network) {
 	case N.NetworkUDP:
 		return d.udpDialer.DialContext(ctx, network, address.String())

common/dialer/dialer.go

@@ -10,15 +10,12 @@ import (
 )
 
 func New(router adapter.Router, options option.DialerOptions) N.Dialer {
+	var dialer N.Dialer
 	if options.Detour == "" {
-		return NewDefault(router, options)
+		dialer = NewDefault(router, options)
 	} else {
-		return NewDetour(router, options.Detour)
+		dialer = NewDetour(router, options.Detour)
 	}
-}
-
-func NewOutbound(router adapter.Router, options option.OutboundDialerOptions) N.Dialer {
-	dialer := New(router, options.DialerOptions)
 	domainStrategy := dns.DomainStrategy(options.DomainStrategy)
 	if domainStrategy != dns.DomainStrategyAsIS || options.Detour == "" {
 		dialer = NewResolveDialer(router, dialer, domainStrategy, time.Duration(options.FallbackDelay))

common/dialer/resolve.go

@@ -51,7 +51,7 @@ func (d *ResolveDialer) DialContext(ctx context.Context, network string, destina
 }
 
 func (d *ResolveDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsFqdn() || destination.Fqdn == "" {
+	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx, metadata := adapter.AppendContext(ctx)

common/process/searcher_android.go

@@ -22,13 +22,13 @@ func (s *androidSearcher) FindProcessInfo(ctx context.Context, network string, s
 	if err != nil {
 		return nil, err
 	}
-	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid); loaded {
+	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid % 100000); loaded {
 		return &Info{
 			UserId:      int32(uid),
 			PackageName: sharedPackage,
 		}, nil
 	}
-	if packageName, loaded := s.packageManager.PackageByID(uid); loaded {
+	if packageName, loaded := s.packageManager.PackageByID(uid % 100000); loaded {
 		return &Info{
 			UserId:      int32(uid),
 			PackageName: packageName,

common/redir/redir_darwin.go

@@ -0,0 +1,64 @@
+package redir
+
+import (
+	"net"
+	"net/netip"
+	"syscall"
+	"unsafe"
+
+	M "github.com/sagernet/sing/common/metadata"
+)
+
+const (
+	PF_OUT      = 0x2
+	DIOCNATLOOK = 0xc0544417
+)
+
+func GetOriginalDestination(conn net.Conn) (destination netip.AddrPort, err error) {
+	fd, err := syscall.Open("/dev/pf", 0, syscall.O_RDONLY)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	defer syscall.Close(fd)
+	nl := struct {
+		saddr, daddr, rsaddr, rdaddr       [16]byte
+		sxport, dxport, rsxport, rdxport   [4]byte
+		af, proto, protoVariant, direction uint8
+	}{
+		af:        syscall.AF_INET,
+		proto:     syscall.IPPROTO_TCP,
+		direction: PF_OUT,
+	}
+	la := conn.LocalAddr().(*net.TCPAddr)
+	ra := conn.RemoteAddr().(*net.TCPAddr)
+	raIP, laIP := ra.IP, la.IP
+	raPort, laPort := ra.Port, la.Port
+	switch {
+	case raIP.To4() != nil:
+		copy(nl.saddr[:net.IPv4len], raIP.To4())
+		copy(nl.daddr[:net.IPv4len], laIP.To4())
+		nl.af = syscall.AF_INET
+	default:
+		copy(nl.saddr[:], raIP.To16())
+		copy(nl.daddr[:], laIP.To16())
+		nl.af = syscall.AF_INET6
+	}
+	nl.sxport[0], nl.sxport[1] = byte(raPort>>8), byte(raPort)
+	nl.dxport[0], nl.dxport[1] = byte(laPort>>8), byte(laPort)
+	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), DIOCNATLOOK, uintptr(unsafe.Pointer(&nl))); errno != 0 {
+		return netip.AddrPort{}, errno
+	}
+
+	var ip net.IP
+	switch nl.af {
+	case syscall.AF_INET:
+		ip = make(net.IP, net.IPv4len)
+		copy(ip, nl.rdaddr[:net.IPv4len])
+	case syscall.AF_INET6:
+		ip = make(net.IP, net.IPv6len)
+		copy(ip, nl.rdaddr[:])
+	}
+	port := uint16(nl.rdxport[0])<<8 | uint16(nl.rdxport[1])
+	destination = netip.AddrPortFrom(M.AddrFromIP(ip), port)
+	return
+}

common/redir/redir_other.go

@@ -1,4 +1,4 @@
-//go:build !linux
+//go:build !linux && !darwin
 
 package redir
 

common/sniff/quic.go

@@ -24,8 +24,7 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	if err != nil {
 		return nil, err
 	}
-
-	if typeByte&0x80 == 0 || typeByte&0x40 == 0 {
+	if typeByte&0x40 == 0 {
 		return nil, E.New("bad type byte")
 	}
 	var versionNumber uint32
@@ -145,9 +144,6 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	default:
 		return nil, E.New("bad packet number length")
 	}
-	if packetNumber != 0 {
-		return nil, E.New("bad packet number: ", packetNumber)
-	}
 	extHdrLen := hdrLen + int(packetNumberLength)
 	copy(newPacket[extHdrLen:hdrLen+4], packet[extHdrLen:])
 	data := newPacket[extHdrLen : int(packetLen)+hdrLen]
@@ -172,37 +168,76 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	if err != nil {
 		return nil, err
 	}
+	var frameType byte
+	var frameLen uint64
+	var fragments []struct {
+		offset  uint64
+		length  uint64
+		payload []byte
+	}
 	decryptedReader := bytes.NewReader(decrypted)
-	frameType, err := decryptedReader.ReadByte()
-	if err != nil {
-		return nil, err
-	}
-	for frameType == 0x0 {
-		// skip padding
+	for {
 		frameType, err = decryptedReader.ReadByte()
-		if err != nil {
-			return nil, err
+		if err == io.EOF {
+			break
+		}
+		switch frameType {
+		case 0x0:
+			continue
+		case 0x1:
+			continue
+		case 0x6:
+			var offset uint64
+			offset, err = qtls.ReadUvarint(decryptedReader)
+			if err != nil {
+				return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
+			}
+			var length uint64
+			length, err = qtls.ReadUvarint(decryptedReader)
+			if err != nil {
+				return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
+			}
+			index := len(decrypted) - decryptedReader.Len()
+			fragments = append(fragments, struct {
+				offset  uint64
+				length  uint64
+				payload []byte
+			}{offset, length, decrypted[index : index+int(length)]})
+			frameLen += length
+			_, err = decryptedReader.Seek(int64(length), io.SeekCurrent)
+			if err != nil {
+				return nil, err
+			}
+		default:
+			// ignore unknown frame type
 		}
-	}
-	if frameType != 0x6 {
-		// not crypto frame
-		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, nil
-	}
-	_, err = qtls.ReadUvarint(decryptedReader)
-	if err != nil {
-		return nil, err
-	}
-	_, err = qtls.ReadUvarint(decryptedReader)
-	if err != nil {
-		return nil, err
 	}
 	tlsHdr := make([]byte, 5)
 	tlsHdr[0] = 0x16
 	binary.BigEndian.PutUint16(tlsHdr[1:], uint16(0x0303))
-	binary.BigEndian.PutUint16(tlsHdr[3:], uint16(decryptedReader.Len()))
-	metadata, err := TLSClientHello(ctx, io.MultiReader(bytes.NewReader(tlsHdr), decryptedReader))
+	binary.BigEndian.PutUint16(tlsHdr[3:], uint16(frameLen))
+	var index uint64
+	var length int
+	var readers []io.Reader
+	readers = append(readers, bytes.NewReader(tlsHdr))
+find:
+	for {
+		for _, fragment := range fragments {
+			if fragment.offset == index {
+				readers = append(readers, bytes.NewReader(fragment.payload))
+				index = fragment.offset + fragment.length
+				length++
+				continue find
+			}
+		}
+		if length == len(fragments) {
+			break
+		}
+		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, E.New("bad fragments")
+	}
+	metadata, err := TLSClientHello(ctx, io.MultiReader(readers...))
 	if err != nil {
-		return nil, err
+		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
 	}
 	metadata.Protocol = C.ProtocolQUIC
 	return metadata, nil

common/sniff/quic_test.go

@@ -19,6 +19,15 @@ func TestSniffQUICv1(t *testing.T) {
 	require.Equal(t, metadata.Domain, "cloudflare-quic.com")
 }
 
+func TestSniffQUICFragment(t *testing.T) {
+	t.Parallel()
+	pkt, err := hex.DecodeString("cc00000001082e3d5d1b64040c55000044d0ccea69e773f6631c1d18b04ae9ee75fcfc34ef74fa62533c93534338a86f101a05d70e0697fb483063fa85db1c59ccfbda5c35234931d8524d8aac37eaaad649470a67794cd754b23c98695238b8363452333bc8c4858376b4166e001da2006e35cf98a91e11a56419b2786775284942d0f7163982f7c248867d12dd374957481dbc564013ff785e1916195eef671f725908f761099d992d69231336ba81d9e25fe2fa3a6eff4318a6ccf10176fc841a1b315f7b35c5b292266fc869d76ca533e7d14e86d82db2e22eacd350977e47d2e012d8a5891c5aaf2a0f4c2b2dae897c161e5b68cbb4dee952472bdc1e21504b8f02534ec4366ce3f8bf86efc78e0232778fbd554457567112abdcafcf6d4d8fcf35083c25d9495679614aba21696e338c62b585046cc55ba8c09c844361d889a47c3ea703b4e23545a9ab2c0bb369693a9ddfb5daffa85cf80fdd6ad66738664e5b0a551729b4955cff7255afcb04dee88c2f072c9de7400947a1bd9327ac5d012a33000ada021d4c03d249fb017d6ac9200b2f9436beab8183ddfbe2d8aee31ffb7df9e1cc181c1af80c39a89965d18ed12da8e3ebe2ae1fbe4b348f83ba19e3e3d1c9b22bcf03ab6ad9b30fe180623faa291ebad83bcd71d7b57f2f5e2f3b8e81d24fb70b2f2159239e8f21ffafef2747aba47d97ab4081e603c018b10678cf99cab1fb42156a14486fa435153979d7279fd22cd40af7088bfc7eff41af2f4b3c0c8864d0040d74dff427f7bffdb8c278474ea00311326cf4925471a8cf596cb92119f19e0f789490ba9cb77b98015a987d93e0324cf1a38b55109f00c3e6ddc5180fb107bf468323afec9bb49fd6a86418569789d66cafe3b8253c2aebb3af3782c1c54dd560487d031d28e6a6e23e159581bb1d47efc4da3fe1d169f9ffb0ca9ba61af0a38a92fde5bc5e6ec026e8378a6315a7b95abf1d2da790a391306ce74d0baf8e2ce648ca74c487f2c0a76a28a80cdf5bd34316eb607684fe7e6d9e83824a00e07660d0b90e3cddd61ebf10748263474afa88c300549e64ce2e90560bb1a12dee7e9484f729a8a4ee7c5651adb5194b3b3ae38e501567c7dbf36e7bb37a2c20b74655f47f2d9af18e52e9d4c9c9eee8e63745779b8f0b06f3a09d846ba62eb978ad77c85de1ee2fee3fbb4c2d283c73e1ccba56a4658e48a2665d200f7f9342f8e84c2ba490094a4f94feec89e42d2f654f564c2beb2997bafa1fc2c68ad8e160b63587d49abc31b834878d52acfb05fb73d0e059b206162e3c90b40c4bc08407ffcb3c08431895b691a3fea923f1f3b48db75d3e6b91fd319ffe4d486e0e14bd5c6affc838dee63d9e0b80f169b5e6c02c7321dcb20deb2b8e707b60e345a308d505bbf26a93d8f18b39d62632e9a77cbe48b3b32eb8819d6311a49820d40f5acbf0273c91c36b2269a03e72ee64df3dfb10ddefe73c64ef60870b2b77bd99dea655f5fe791b538a929a14d99f6d69685d72431ea5f0f4b27a044f2f575ab474fcc3857895934de1ca2581798eaef2c17fe5aaf2e6add97fa32997c7026f15c1b1ad0e6043ae506027a7c0242546fdc851cca39a204e56879f2cef838be8ec66e0f2292f8c862e06f810eb9b80c7a467ce6e90155206352c7f82b1173ba3b98d35bb72c259a60db20dd1a43fe6d7aef0265e6eaa5caafd9b64b448ff745a2046acbdb65cf2a5007809808a4828dc99097feedc734c236260c584")
+	require.NoError(t, err)
+	metadata, err := sniff.QUICClientHello(context.Background(), pkt)
+	require.NoError(t, err)
+	require.Equal(t, metadata.Domain, "cloudflare-quic.com")
+}
+
 func FuzzSniffQUIC(f *testing.F) {
 	f.Fuzz(func(t *testing.T, data []byte) {
 		sniff.QUICClientHello(context.Background(), data)

common/sniff/sniff.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"io"
 	"net"
-	"os"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -30,23 +29,25 @@ func PeekStream(ctx context.Context, conn net.Conn, buffer *buf.Buffer, sniffers
 		return nil, err
 	}
 	var metadata *adapter.InboundContext
+	var errors []error
 	for _, sniffer := range sniffers {
 		metadata, err = sniffer(ctx, bytes.NewReader(buffer.Bytes()))
-		if err != nil {
-			continue
+		if metadata != nil {
+			return metadata, nil
 		}
-		return metadata, nil
+		errors = append(errors, err)
 	}
-	return nil, os.ErrInvalid
+	return nil, E.Errors(errors...)
 }
 
 func PeekPacket(ctx context.Context, packet []byte, sniffers ...PacketSniffer) (*adapter.InboundContext, error) {
+	var errors []error
 	for _, sniffer := range sniffers {
-		sniffMetadata, err := sniffer(ctx, packet)
-		if err != nil {
-			continue
+		metadata, err := sniffer(ctx, packet)
+		if metadata != nil {
+			return metadata, nil
 		}
-		return sniffMetadata, nil
+		errors = append(errors, err)
 	}
-	return nil, os.ErrInvalid
+	return nil, E.Errors(errors...)
 }

constant/proxy.go

@@ -18,6 +18,7 @@ const (
 	TypeHysteria    = "hysteria"
 	TypeTor         = "tor"
 	TypeSSH         = "ssh"
+	TypeShadowTLS   = "shadowtls"
 )
 
 const (

constant/version.go

@@ -1,6 +1,6 @@
 package constant
 
 var (
-	Version = "1.0-beta2"
+	Version = "1.0.6"
 	Commit  = ""
 )

docs/changelog.md

@@ -1,3 +1,41 @@
+#### 1.0.1
+
+* Fix match 4in6 address in ip_cidr
+* Fix clash api log level format error
+* Fix clash api unknown proxy type
+
+#### 1.0
+
+* Fix wireguard reconnect
+* Fix naive inbound
+* Fix json format error message
+* Fix processing vmess termination signal
+* Fix hysteria stream error
+* Fix listener close when proxyproto failed
+
+#### 1.0-rc1
+
+* Fix write log timestamp
+* Fix write zero
+* Fix dial parallel in direct outbound
+* Fix write trojan udp
+* Fix DNS routing
+* Add attribute support for geosite
+* Update documentation for [Dial Fields](/configuration/shared/dial)
+
+#### 1.0-beta3
+
+* Add [chained inbound](/configuration/shared/listen#detour) support
+* Add process_path rule item
+* Add macOS redirect support
+* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls)
+  and [Examples](/examples/shadowtls)
+* Fix search android package in non-owner users
+* Fix socksaddr type condition
+* Fix smux session status
+* Refactor inbound and outbound documentation
+* Minor fixes
+
 #### 1.0-beta2
 
 * Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
@@ -111,4 +149,4 @@
 
 No changelog before.
 
-[#9]: https://github.com/SagerNet/sing-box/pull/9
+[#9]: https://github.com/SagerNet/sing-box/pull/9

docs/configuration/dns/rule.md

@@ -61,6 +61,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -177,6 +180,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/dns/rule.zh.md

@@ -60,6 +60,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -176,6 +179,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/inbound/direct.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "proxy_protocol": false,
+  "type": "direct",
+  "tag": "direct-in",
+  
+  ... // Listen Fields
 
-      "network": "udp",
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -40,50 +33,4 @@ Override the connection destination address.
 
 #### override_port
 
-Override the connection destination port.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+Override the connection destination port.

docs/configuration/inbound/direct.zh.md

@@ -4,29 +4,22 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-in",
+  "type": "direct",
+  "tag": "direct-in",
 
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp",
-      "proxy_protocol": false,
-      "override_address": "1.0.0.1",
-      "override_port": 53
-    }
-  ]
+  ... // 监听字段
+
+  "network": "udp",
+  "override_address": "1.0.0.1",
+  "override_port": 53
 }
 ```
 
-### Direct 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -42,48 +35,3 @@
 
 覆盖连接目标端口。
 
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/http.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+  
+  ... // Listen Fields
+  
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### tls
 
@@ -47,45 +41,3 @@ No authentication required if empty.
     Only supported on Linux, Android, Windows, and macOS.
 
 Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/http.zh.md

@@ -2,33 +2,27 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "http",
+  "tag": "http-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "http",
-      "tag": "http-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "tls": {},
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "tls": {},
+  "set_system_proxy": false
 }
 ```
 
-### HTTP 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### tls
 
@@ -38,7 +32,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -46,46 +40,4 @@ HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/hysteria.md

@@ -2,31 +2,23 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // Listen Fields
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
@@ -34,7 +26,11 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### up, down
 
@@ -101,38 +97,4 @@ Force enabled on for systems other than Linux and Windows (according to upstream
 
 ==Required==
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/hysteria.zh.md

@@ -2,31 +2,23 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window_client": 0,
-      "max_conn_client": 0,
-      "disable_mtu_discovery": false,
-      "tls": {}
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-in",
+  
+  ... // 监听字段
+
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window_client": 0,
+  "max_conn_client": 0,
+  "disable_mtu_discovery": false,
+  "tls": {}
 }
 ```
 
@@ -34,7 +26,11 @@
 
     默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### up, down
 
@@ -101,38 +97,4 @@ base64 编码的认证密码。
 
 ==必填==
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/index.md

@@ -15,20 +15,20 @@
 
 ### Fields
 
-| Type          | Format                       |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| Type          | Format                       | Injectable |
+|---------------|------------------------------|------------|
+| `direct`      | [Direct](./direct)           | X          |
+| `mixed`       | [Mixed](./mixed)             | TCP        |
+| `socks`       | [SOCKS](./socks)             | TCP        |
+| `http`        | [HTTP](./http)               | TCP        |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
+| `vmess`       | [VMess](./vmess)             | TCP        |
+| `trojan`      | [Trojan](./trojan)           | TCP        |
+| `naive`       | [Naive](./naive)             | X          |
+| `hysteria`    | [Hysteria](./hysteria)       | X          |
+| `tun`         | [Tun](./tun)                 | X          |
+| `redirect`    | [Redirect](./redirect)       | X          |
+| `tproxy`      | [TProxy](./tproxy)           | X          |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -15,20 +15,20 @@
 
 ### 字段
 
-| 类型            | 格式                           |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `mixed`       | [Mixed](./mixed)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `naive`       | [Naive](./naive)             |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tun`         | [Tun](./tun)                 |
-| `redirect`    | [Redirect](./redirect)       |
-| `tproxy`      | [TProxy](./tproxy)           |
+| 类型            | 格式                           | 注入支持 |
+|---------------|------------------------------|------|
+| `direct`      | [Direct](./direct)           | X    |
+| `mixed`       | [Mixed](./mixed)             | TCP  |
+| `socks`       | [SOCKS](./socks)             | TCP  |
+| `http`        | [HTTP](./http)               | TCP  |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
+| `vmess`       | [VMess](./vmess)             | TCP  |
+| `trojan`      | [Trojan](./trojan)           | TCP  |
+| `naive`       | [Naive](./naive)             | X    |
+| `hysteria`    | [Hysteria](./hysteria)       | X    |
+| `tun`         | [Tun](./tun)                 | X    |
+| `redirect`    | [Redirect](./redirect)       | X    |
+| `tproxy`      | [TProxy](./tproxy)           | X    |
 
 #### tag
 

docs/configuration/inbound/mixed.md

@@ -4,32 +4,26 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -39,52 +33,6 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! error ""
-
-    Only supported on Linux, Android, Windows, and macOS.
-
-Automatically set system proxy configuration when start and clean up when stop.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### set_system_proxy
-
 !!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.

docs/configuration/inbound/mixed.zh.md

@@ -4,38 +4,32 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "mixed",
+  "tag": "mixed-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "mixed",
-      "tag": "mixed-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ],
-      "set_system_proxy": false
+      "username": "admin",
+      "password": "admin"
     }
-  ]
+  ],
+  "set_system_proxy": false
 }
 ```
 
-### Mixed 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 和 HTTP 用户
 
-默认不需要验证。
+如果为空则不需要验证。
 
 #### set_system_proxy
 
@@ -43,46 +37,4 @@ SOCKS 和 HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+启动时自动设置系统代理，停止时自动清理。

docs/configuration/inbound/naive.md

@@ -2,29 +2,19 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
+
+  ... // Listen Fields
+
+  "users": [
     {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
@@ -32,7 +22,11 @@
 
     HTTP3 transport is not included by default, see [Installation](/#installation).
 
-### Naive Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
@@ -48,46 +42,4 @@ Naive users.
 
 #### tls
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).

docs/configuration/inbound/naive.zh.md

@@ -2,29 +2,19 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "naive",
-      "tag": "naive-in",
-      
-      "listen": "::",
-      "listen_port": 443,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "naive",
+  "tag": "naive-in",
+  "network": "udp",
 
-      "network": "udp",
-      "users": [
-        {
-          "username": "sekai",
-          "password": "password"
-        }
-      ],
-      "tls": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "sekai",
+      "password": "password"
     }
-  ]
+  ],
+  "tls": {}
 }
 ```
 
@@ -32,7 +22,11 @@
 
     默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
 
-### Naive 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
@@ -48,46 +42,4 @@ Naive 用户。
 
 #### tls
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

docs/configuration/inbound/redirect.md

@@ -1,52 +1,18 @@
+!!! error ""
+
+    Only supported on Linux and macOS.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // Listen Fields
 }
 ```
 
 ### Listen Fields
 
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/redirect.zh.md

@@ -1,52 +1,17 @@
+!!! error ""
+
+    仅支持 Linux 和 macOS。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "redirect",
-      "tag": "redirect-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6"
-    }
-  ]
+  "type": "redirect",
+  "tag": "redirect-in",
+
+  ... // 监听字段
 }
 ```
-
 ### 监听字段
 
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/shadowsocks.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // Listen Fields
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 

docs/configuration/inbound/shadowsocks.zh.md

@@ -2,25 +2,13 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      "network": "udp",
-      "proxy_protocol": false,
-      
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-in",
+
+  ... // 监听字段
+
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg=="
 }
 ```
 
@@ -28,17 +16,12 @@
 
 ```json
 {
-  "inbounds": [
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "users": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "users": [
-        {
-          "name": "sekai",
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "sekai",
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
@@ -48,25 +31,25 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "shadowsocks",
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "destinations": [
     {
-      "type": "shadowsocks",
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "destinations": [
-        {
-          "name": "test",
-          "server": "example.com",
-          "server_port": 8080,
-          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
-        }
-      ]
+      "name": "test",
+      "server": "example.com",
+      "server_port": 8080,
+      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
     }
   ]
 }
 ```
 
-### Shadowsocks 字段
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### 字段
 
 #### network
 
@@ -98,50 +81,4 @@
 |---------------|-------------------------------|
 | none          | /                             |
 | 2022 methods  | `openssl rand -base64 <密钥长度>` |
-| other methods | 任意字符串                         |
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+| other methods | 任意字符串                         |

docs/configuration/inbound/shadowtls.md

@@ -0,0 +1,31 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // Listen Fields
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+    
+    ... // Dial Fields
+  }
+}
+```
+
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+
+### Fields
+
+#### handshake
+
+==Required==
+
+Handshake server address and [dial options](/configuration/shared/dial).
+

docs/configuration/inbound/shadowtls.zh.md

@@ -0,0 +1,29 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-in",
+
+  ... // 监听字段
+
+  "handshake": {
+    "server": "google.com",
+    "server_port": 443,
+
+    ... // 拨号字段
+  }
+}
+```
+
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
+
+#### handshake
+
+==必填==
+
+握手服务器地址和 [拨号参数](/zh/configuration/shared/dial/)。

docs/configuration/inbound/socks.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // Listen Fields
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
 SOCKS users.
 
 No authentication required if empty.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/socks.zh.md

@@ -4,76 +4,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "socks",
+  "tag": "socks-in",
 
-      "users": [
-        {
-          "username": "admin",
-          "password": "admin"
-        }
-      ]
+  ... // 监听字段
+
+  "users": [
+    {
+      "username": "admin",
+      "password": "admin"
     }
   ]
 }
 ```
 
-### SOCKS 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
 SOCKS 用户
 
-默认不需要验证。
-
-### Listen Fields
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+如果为空则不需要验证。

docs/configuration/inbound/tproxy.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    Only supported on Linux.
+
 ### Structure
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // Listen Fields
+
+  "network": "udp"
 }
 ```
 
-### TProxy Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### network
 
 Listen network, one of `tcp` `udp`.
 
 Both if empty.
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### udp_timeout
-
-UDP NAT expiration time in seconds, default is 300 (5 minutes).

docs/configuration/inbound/tproxy.zh.md

@@ -1,67 +1,28 @@
+!!! error ""
+
+    仅支持 Linux。
+
 ### 结构
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tproxy",
-      "tag": "tproxy-in",
-      
-      "listen": "::",
-      "listen_port": 5353,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "udp_timeout": 300,
-      
-      "network": "udp"
-    }
-  ]
+  "type": "tproxy",
+  "tag": "tproxy-in",
+
+  ... // 监听字段
+
+  "network": "udp"
 }
 ```
 
-### TProxy 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### network
 
 监听的网络协议，`tcp` `udp` 之一。
 
 默认所有。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### udp_timeout
-
-UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

docs/configuration/inbound/trojan.md

@@ -2,43 +2,37 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "trojan",
+  "tag": "trojan-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.1",
-        "server_port": 8080
-      },
-      "fallback_for_alpn": {
-        "http/1.1": {
-          "server": "127.0.0.1",
-          "server_port": 8081
-        }
-      },
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -67,45 +61,3 @@ If not empty, TLS fallback requests with ALPN not in this table will be rejected
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/trojan.zh.md

@@ -2,41 +2,37 @@
 
 ```json
 {
-  "inbounds": [
+  "type": "trojan",
+  "tag": "trojan-in",
+
+  ... // 监听字段
+
+  "users": [
     {
-      "type": "trojan",
-      "tag": "trojan-in",
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
-      "users": [
-        {
-          "name": "sekai",
-          "password": "8JCsPssfgS8tiRwiMlhARg=="
-        }
-      ],
-      "tls": {},
-      "fallback": {
-        "server": "127.0.0.1",
-        "server_port": 8080
-      },
-      "fallback_for_alpn": {
-        "http/1.1": {
-          "server": "127.0.0.1",
-          "server_port": 8081
-        }
-      },
-      "transport": {}
+      "name": "sekai",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
     }
-  ]
+  ],
+  "tls": {},
+  "fallback": {
+    "server": "127.0.0.1",
+    "server_port": 8080
+  },
+  "fallback_for_alpn": {
+    "http/1.1": {
+      "server": "127.0.0.1",
+      "server_port": 8081
+    }
+  },
+  "transport": {}
 }
 ```
 
-### Trojan 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -54,7 +50,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 !!! error ""
 
-    没有证据表明 GFW 基于 HTTP 响应检测并阻止木马服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
+    没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 
 回退服务器配置。如果 `fallback` 和 `fallback_for_alpn` 为空，则禁用回退。
 
@@ -66,46 +62,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 #### transport
 
-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

docs/configuration/inbound/tun.md

@@ -6,48 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "strict_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+  
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // Listen Fields
 }
 ```
 
@@ -59,7 +52,7 @@
 
     If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
 
-### Tun Fields
+### Fields
 
 #### interface_name
 
@@ -163,22 +156,4 @@ Exclude android packages in route.
 
 ### Listen Fields
 
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+See [Listen Fields](/configuration/shared/listen) for details.

docs/configuration/inbound/tun.zh.md

@@ -6,48 +6,41 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "tun",
-      "tag": "tun-in",
-      "interface_name": "tun0",
-      "inet4_address": "172.19.0.1/30",
-      "inet6_address": "fdfe:dcba:9876::1/128",
-      "mtu": 1500,
-      "auto_route": true,
-      "strict_route": true,
-      "endpoint_independent_nat": false,
-      "udp_timeout": 300,
-      "stack": "gvisor",
-      "include_uid": [
-        0
-      ],
-      "include_uid_range": [
-        [
-          "1000-99999"
-        ]
-      ],
-      "exclude_uid": [
-        1000
-      ],
-      "exclude_uid_range": [
-        "1000-99999"
-      ],
-      "include_android_user": [
-        0,
-        10
-      ],
-      "include_package": [
-        "com.android.chrome"
-      ],
-      "exclude_package": [
-        "com.android.captiveportallogin"
-      ],
-      "sniff": true,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv4"
-    }
-  ]
+  "type": "tun",
+  "tag": "tun-in",
+
+  "interface_name": "tun0",
+  "inet4_address": "172.19.0.1/30",
+  "inet6_address": "fdfe:dcba:9876::1/128",
+  "mtu": 1500,
+  "auto_route": true,
+  "strict_route": true,
+  "endpoint_independent_nat": false,
+  "stack": "gvisor",
+  "include_uid": [
+    0
+  ],
+  "include_uid_range": [
+    "1000-99999"
+  ],
+  "exclude_uid": [
+    1000
+  ],
+  "exclude_uid_range": [
+    "1000-99999"
+  ],
+  "include_android_user": [
+    0,
+    10
+  ],
+  "include_package": [
+    "com.android.chrome"
+  ],
+  "exclude_package": [
+    "com.android.captiveportallogin"
+  ],
+
+  ... // 监听字段
 }
 ```
 
@@ -162,22 +155,4 @@ TCP/IP 栈。
 
 ### 监听字段
 
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
+参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/vmess.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // Listen Fields
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess Fields
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen) for details.
+
+### Fields
 
 #### users
 
@@ -53,45 +47,3 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
-
-### Listen Fields
-
-#### listen
-
-==Required==
-
-Listen address.
-
-#### listen_port
-
-==Required==
-
-Listen port.
-
-#### tcp_fast_open
-
-Enable tcp fast open for listener.
-
-#### sniff
-
-Enable sniffing.
-
-See [Protocol Sniff](/configuration/route/sniff/) for details.
-
-#### sniff_override_destination
-
-Override the connection destination address with the sniffed domain.
-
-If the domain name is invalid (like tor), this will not work.
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before routing.
-
-If `sniff_override_destination` is in effect, its value will be taken as a fallback.
-
-#### proxy_protocol
-
-Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/vmess.zh.md

@@ -2,34 +2,28 @@
 
 ```json
 {
-  "inbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-in",
-      
-      "listen": "::",
-      "listen_port": 2080,
-      "tcp_fast_open": false,
-      "sniff": false,
-      "sniff_override_destination": false,
-      "domain_strategy": "prefer_ipv6",
-      "proxy_protocol": false,
+  "type": "vmess",
+  "tag": "vmess-in",
 
-      "users": [
-        {
-          "name": "sekai",
-          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-          "alterId": 0
-        }
-      ],
-      "tls": {},
-      "transport": {}
+  ... // 监听字段
+
+  "users": [
+    {
+      "name": "sekai",
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "alterId": 0
     }
-  ]
+  ],
+  "tls": {},
+  "transport": {}
 }
 ```
 
-### VMess 字段
+### 监听字段
+
+参阅 [监听字段](/zh/configuration/shared/listen/)。
+
+### 字段
 
 #### users
 
@@ -53,45 +47,3 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 #### transport
 
 V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
-
-### 监听字段
-
-#### listen
-
-==必填==
-
-监听地址。
-
-#### listen_port
-
-==必填==
-
-监听端口。
-
-#### tcp_fast_open
-
-为监听器启用 TCP 快速打开。
-
-#### sniff
-
-启用协议探测。
-
-参阅 [协议探测](/zh/configuration/route/sniff/)。
-
-#### sniff_override_destination
-
-用探测出的域名覆盖连接目标地址。
-
-如果域名无效（如 Tor），将不生效。
-
-#### domain_strategy
-
-可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，请求的域名将在路由之前解析为 IP。
-
-如果 `sniff_override_destination` 生效，它的值将作为后备。
-
-#### proxy_protocol
-
-解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/index.md

@@ -8,8 +8,8 @@ sing-box uses JSON for configuration files.
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/index.zh.md

@@ -8,8 +8,8 @@ sing-box 使用 JSON 作为配置文件格式。
 {
   "log": {},
   "dns": {},
-  "inbounds": {},
-  "outbounds": {},
+  "inbounds": [],
+  "outbounds": [],
   "route": {},
   "experimental": {}
 }

docs/configuration/log/index.md

@@ -1,3 +1,5 @@
+# Log
+
 ### Structure
 
 ```json

docs/configuration/log/index.zh.md

@@ -1,3 +1,5 @@
+# 日志
+
 ### 结构
 
 ```json

docs/configuration/outbound/block.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/block.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "block",
-      "tag": "block"
-    }
-  ]
+  "type": "block",
+  "tag": "block"
 }
 ```
 

docs/configuration/outbound/direct.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+  
+  ... // Dial Fields
 }
 ```
 
-### Direct Fields
+### Fields
 
 #### override_address
 
@@ -45,54 +33,4 @@ Protocol value can be `1` or `2`.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the requested domain name will be resolved to IP before connect.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/direct.zh.md

@@ -4,30 +4,18 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out",
-      
-      "override_address": "1.0.0.1",
-      "override_port": 53,
-      "proxy_protocol": 0,
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "direct",
+  "tag": "direct-out",
+  
+  "override_address": "1.0.0.1",
+  "override_port": 53,
+  "proxy_protocol": 0,
+
+  ... // 拨号字段
 }
 ```
 
-### Direct 字段
+### 字段
 
 #### override_address
 
@@ -45,51 +33,4 @@
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，域名将在请求发出之前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/dns.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/dns.zh.md

@@ -4,12 +4,8 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "dns",
-      "tag": "dns-out"
-    }
-  ]
+  "type": "dns",
+  "tag": "dns-out"
 }
 ```
 

docs/configuration/outbound/http.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
-### HTTP Fields
+### Fields
 
 #### server
 
@@ -57,54 +45,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/http.zh.md

@@ -4,32 +4,20 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "http",
-      "tag": "http-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "username": "sekai",
-      "password": "admin",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "http",
+  "tag": "http-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "username": "sekai",
+  "password": "admin",
+  "tls": {},
+
+  ... // 拨号字段
 }
 ```
 
-### HTTP 字段
+### 字段
 
 #### server
 
@@ -57,51 +45,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/hysteria.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // Dial Fields
 }
 ```
 
@@ -40,7 +28,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Hysteria Fields
+### Fields
 
 #### server
 
@@ -125,54 +113,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/hysteria.zh.md

@@ -2,37 +2,25 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "hysteria",
-      "tag": "hysteria-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-
-      "up": "100 Mbps",
-      "up_mbps": 100,
-      "down": "100 Mbps",
-      "down_mbps": 100,
-      "obfs": "fuck me till the daylight",
-      "auth": "",
-      "auth_str": "password",
-      "recv_window_conn": 0,
-      "recv_window": 0,
-      "disable_mtu_discovery": false,
-      "network": "tcp",
-      "tls": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "hysteria",
+  "tag": "hysteria-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "up": "100 Mbps",
+  "up_mbps": 100,
+  "down": "100 Mbps",
+  "down_mbps": 100,
+  "obfs": "fuck me till the daylight",
+  "auth": "",
+  "auth_str": "password",
+  "recv_window_conn": 0,
+  "recv_window": 0,
+  "disable_mtu_discovery": false,
+  "network": "tcp",
+  "tls": {},
+  
+  ... // 拨号字段
 }
 ```
 
@@ -40,7 +28,7 @@
 
     默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-### Hysteria 字段
+### 字段
 
 #### server
 
@@ -123,51 +111,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/selector.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+  
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/selector.zh.md

@@ -2,19 +2,15 @@
 
 ```json
 {
+  "type": "selector",
+  "tag": "select",
+
   "outbounds": [
-    {
-      "type": "selector",
-      "tag": "select",
-      
-      "outbounds": [
-        "proxy-a",
-        "proxy-b",
-        "proxy-c"
-      ],
-      "default": "proxy-c"
-    }
-  ]
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "default": "proxy-c"
 }
 ```
 

docs/configuration/outbound/shadowsocks.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Shadowsocks Fields
+### Fields
 
 #### server
 
@@ -97,54 +85,4 @@ Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowsocks.zh.md

@@ -1,35 +1,23 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "shadowsocks",
-      "tag": "ss-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "method": "2022-blake3-aes-128-gcm",
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "udp",
-      "udp_over_tcp": false,
-      "multiplex": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "shadowsocks",
+  "tag": "ss-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "2022-blake3-aes-128-gcm",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "udp",
+  "udp_over_tcp": false,
+  "multiplex": {},
+
+  ... // 拨号字段
 }
 ```
 
-### Shadowsocks 字段
+### 字段
 
 #### server
 
@@ -97,51 +85,4 @@ Shadowsocks 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/shadowtls.md

@@ -0,0 +1,38 @@
+### Structure
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // Dial Fields
+}
+```
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### tls
+
+==Required==
+
+TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowtls.zh.md

@@ -0,0 +1,38 @@
+### 结构
+
+```json
+{
+  "type": "shadowtls",
+  "tag": "st-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "tls": {},
+
+  ... // 拨号字段
+}
+```
+
+### 字段
+
+#### server
+
+==必填==
+
+服务器地址。
+
+#### server_port
+
+==必填==
+
+服务器端口。
+
+#### tls
+
+==必填==
+
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
+
+### 拨号字段
+
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/socks.md

@@ -4,34 +4,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### SOCKS Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Enable the UDP over TCP protocol.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/socks.zh.md

@@ -1,37 +1,25 @@
 `socks` 出站是 socks4/socks4a/socks5 客户端
 
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "socks",
-      "tag": "socks-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "version": "5",
-      "username": "sekai",
-      "password": "admin",
-      "network": "udp",
-      "udp_over_tcp": false,
+  "type": "socks",
+  "tag": "socks-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "version": "5",
+  "username": "sekai",
+  "password": "admin",
+  "network": "udp",
+  "udp_over_tcp": false,
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### SOCKS 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SOCKS5 密码。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/ssh.md

@@ -2,36 +2,24 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // Dial Fields
 }
 ```
 
-### SSH Fields
+### Fields
 
 #### server
 
@@ -73,54 +61,4 @@ Client version. Random version will be used if empty.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/ssh.zh.md

@@ -1,37 +1,25 @@
-### Structure
+### 结构
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "ssh",
-      "tag": "ssh-out",
-     
-      "server": "127.0.0.1",
-      "server_port": 22,
-      "user": "root",
-      "password": "admin",
-      "private_key": "",
-      "private_key_path": "$HOME/.ssh/id_rsa",
-      "private_key_passphrase": "",
-      "host_key_algorithms": [],
-      "client_version": "SSH-2.0-OpenSSH_7.4p1",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "ssh",
+  "tag": "ssh-out",
+
+  "server": "127.0.0.1",
+  "server_port": 22,
+  "user": "root",
+  "password": "admin",
+  "private_key": "",
+  "private_key_path": "$HOME/.ssh/id_rsa",
+  "private_key_passphrase": "",
+  "host_key_algorithms": [],
+  "client_version": "SSH-2.0-OpenSSH_7.4p1",
+
+  ... // 拨号字段
 }
 ```
 
-### SSH 字段
+### 字段
 
 #### server
 
@@ -73,51 +61,4 @@ SSH 用户, 默认使用 root。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/tor.md

@@ -2,29 +2,17 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+  
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // Dial Fields
 }
 ```
 
@@ -32,7 +20,7 @@
 
     Embedded tor is not included by default, see [Installation](/#installation).
 
-### Tor Fields
+### Fields
 
 #### executable_path
 
@@ -56,58 +44,8 @@ Each start will be very slow if not specified.
 
 Map of torrc options.
 
-See [tor(1)](https://linux.die.net/man/1/tor)
+See [tor(1)](https://linux.die.net/man/1/tor) for details.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/tor.zh.md

@@ -2,29 +2,17 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "tor",
-      "tag": "tor-out",
-      
-      "executable_path": "/usr/bin/tor",
-      "extra_args": [],
-      "data_directory": "$HOME/.cache/tor",
-      "torrc": {
-        "ClientOnly": 1
-      },
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "tor",
+  "tag": "tor-out",
+
+  "executable_path": "/usr/bin/tor",
+  "extra_args": [],
+  "data_directory": "$HOME/.cache/tor",
+  "torrc": {
+    "ClientOnly": 1
+  },
+
+  ... // 拨号字段
 }
 ```
 
@@ -32,7 +20,7 @@
 
     默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#_2)。
 
-### Tor 字段
+### 字段
 
 #### executable_path
 
@@ -60,51 +48,4 @@ torrc 参数表。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/trojan.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
+
+  ... // Dial Fields
 }
 ```
 
-### Trojan Fields
+### Fields
 
 #### server
 
@@ -71,54 +59,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/trojan.zh.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "password": "8JCsPssfgS8tiRwiMlhARg==",
-      "network": "tcp",
-      "tls": {},
-      "multiplex": {},
-      "transport": {},
+  "type": "trojan",
+  "tag": "trojan-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "network": "tcp",
+  "tls": {},
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // 拨号字段
 }
 ```
 
-### Trojan 字段
+### 字段
 
 #### server
 
@@ -71,51 +59,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/vmess.md

@@ -2,39 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "packet_addr": false,
-      "multiplex": {},
-      "transport": {},
+  "type": "vmess",
+  "tag": "vmess-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
 
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  ... // Dial Fields
 }
 ```
 
-### VMess Fields
+### Fields
 
 #### server
 
@@ -110,54 +98,4 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/vmess.zh.md

@@ -2,39 +2,27 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "vmess",
-      "tag": "vmess-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "security": "auto",
-      "alter_id": 0,
-      "global_padding": false,
-      "authenticated_length": true,
-      "network": "tcp",
-      "tls": {},
-      "packet_addr": false,
-      "multiplex": {},
-      "transport": {},
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "vmess",
+  "tag": "vmess-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "security": "auto",
+  "alter_id": 0,
+  "global_padding": false,
+  "authenticated_length": true,
+  "network": "tcp",
+  "tls": {},
+  "packet_addr": false,
+  "multiplex": {},
+  "transport": {},
+
+  ... // 拨号字段
 }
 ```
 
-### VMess 字段
+### 字段
 
 #### server
 
@@ -110,51 +98,4 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/wireguard.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // Dial Fields
 }
 ```
 
@@ -37,7 +25,7 @@
 
     WireGuard is not included by default, see [Installation](/#installation).
 
-### WireGuard Fields
+### Fields
 
 #### server
 
@@ -92,54 +80,4 @@ Both is enabled by default.
 
 ### Dial Fields
 
-#### detour
-
-The tag of the upstream outbound.
-
-Other dial fields will be ignored when enabled.
-
-#### bind_interface
-
-The network interface to bind to.
-
-#### bind_address
-
-The address to bind to.
-
-#### routing_mark
-
-!!! error ""
-
-    Only supported on Linux.
-
-Set netfilter routing mark.
-
-#### reuse_addr
-
-Reuse listener address.
-
-#### connect_timeout
-
-Connect timeout, in golang's Duration format.
-
-A duration string is a possibly signed sequence of
-decimal numbers, each with optional fraction and a unit suffix,
-such as "300ms", "-1.5h" or "2h45m".
-Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-
-#### domain_strategy
-
-One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
-
-If set, the server domain name will be resolved to IP before connecting.
-
-`dns.strategy` will be used if empty.
-
-#### fallback_delay
-
-The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
-That is, is the amount of time to wait for IPv6 to succeed before assuming
-that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
-If zero, a default delay of 300ms is used.
-
-Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/wireguard.zh.md

@@ -2,34 +2,22 @@
 
 ```json
 {
-  "outbounds": [
-    {
-      "type": "wireguard",
-      "tag": "wireguard-out",
-      
-      "server": "127.0.0.1",
-      "server_port": 1080,
-      "local_address": [
-        "10.0.0.1",
-        "10.0.0.2/32"
-      ],
-      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-      "mtu": 1408,
-      "network": "tcp",
-      
-      "detour": "upstream-out",
-      "bind_interface": "en0",
-      "bind_address": "0.0.0.0",
-      "routing_mark": 1234,
-      "reuse_addr": false,
-      "connect_timeout": "5s",
-      "tcp_fast_open": false,
-      "domain_strategy": "prefer_ipv6",
-      "fallback_delay": "300ms"
-    }
-  ]
+  "type": "wireguard",
+  "tag": "wireguard-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "local_address": [
+    "10.0.0.1",
+    "10.0.0.2/32"
+  ],
+  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+  "mtu": 1408,
+  "network": "tcp",
+
+  ... // 拨号字段
 }
 ```
 
@@ -37,7 +25,7 @@
 
     默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
 
-### WireGuard 字段
+### 字段
 
 #### server
 
@@ -94,51 +82,4 @@ WireGuard MTU。 默认1408。
 
 ### 拨号字段
 
-#### detour
-
-上游出站的标签。
-
-启用时，其他拨号字段将被忽略。
-
-#### bind_interface
-
-要绑定到的网络接口。
-
-#### bind_address
-
-要绑定的地址。
-
-#### routing_mark
-
-!!! error ""
-
-    仅支持 Linux。
-
-设置 netfilter 路由标记。
-
-#### reuse_addr
-
-重用监听地址。
-
-#### connect_timeout
-
-连接超时，采用 golang 的 Duration 格式。
-
-持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
-有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
-
-#### domain_strategy
-
-可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
-
-如果设置，服务器域名将在连接前解析为 IP。
-
-默认使用 `dns.strategy`。
-
-#### fallback_delay
-
-在生成 RFC 6555 快速回退连接之前等待的时间长度。
-也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
-如果为零，则使用 300 毫秒的默认延迟。
-
-仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/route/rule.md

@@ -68,6 +68,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -188,6 +191,14 @@ Match port range.
 
 Match process name.
 
+#### process_path
+
+!!! error ""
+
+    Only supported on Linux, Windows, and macOS.
+
+Match process path.
+
 #### package_name
 
 Match android package name.

docs/configuration/route/rule.zh.md

@@ -66,6 +66,9 @@
         "process_name": [
           "curl"
         ],
+        "process_path": [
+          "/usr/bin/curl"
+        ],
         "package_name": [
           "com.termux"
         ],
@@ -186,6 +189,14 @@
 
 匹配进程名称。
 
+#### process_path
+
+!!! error ""
+
+    仅支持 Linux、Windows 和 macOS.
+
+匹配进程路径。
+
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/shared/dial.md

@@ -0,0 +1,74 @@
+### Structure
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### Fields
+
+| Field                                                                             | Available Context |
+|-----------------------------------------------------------------------------------|-------------------|
+| `bind_interface` /`bind_address` /`routing_mark` /`reuse_addr` /`connect_timeout` | `detour` not set  |
+
+#### detour
+
+The tag of the upstream outbound.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before connect.
+
+| Outbound | Effected domains         | Fallback Value                            |
+|----------|--------------------------|-------------------------------------------|
+| `direct` | Domain in request        | Take `inbound.domain_strategy` if not set | 
+| others   | Domain in server address | /                                         |
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for connection to succeed before assuming
+that IPv4/IPv6 is misconfigured and falling back to other type of addresses.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is set.

docs/configuration/shared/dial.zh.md

@@ -0,0 +1,66 @@
+### 结构
+
+```json
+{
+  "detour": "upstream-out",
+  "bind_interface": "en0",
+  "bind_address": "0.0.0.0",
+  "routing_mark": 1234,
+  "reuse_addr": false,
+  "connect_timeout": "5s",
+  "tcp_fast_open": false,
+  "domain_strategy": "prefer_ipv6",
+  "fallback_delay": "300ms"
+}
+```
+
+### 字段
+
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，域名将在请求发出之前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/shared/listen.md

@@ -0,0 +1,73 @@
+### Structure
+
+```json
+{
+  "listen": "::",
+  "listen_port": 5353,
+  "tcp_fast_open": false,
+  "sniff": false,
+  "sniff_override_destination": false,
+  "domain_strategy": "prefer_ipv6",
+  "udp_timeout": 300,
+  "proxy_protocol": false,
+  "detour": "another-in"
+}
+```
+
+### Fields
+
+| Field            | Available Context                                                 |
+|------------------|-------------------------------------------------------------------|
+| `listen`         | Needs to listen on TCP or UDP.                                    |
+| `listen_port`    | Needs to listen on TCP or UDP.                                    |
+| `tcp_fast_open`  | Needs to listen on TCP.                                           |
+| `udp_timeout`    | Needs to assemble UDP connections, currently Tun and Shadowsocks. |
+| `proxy_protocol` | Needs to listen on TCP.                                           |
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
+
+#### detour
+
+If set, connections will be forwarded to the specified inbound.
+
+Requires target inbound support, see [Injectable](/configuration/inbound/#fields).

docs/configuration/shared/listen.zh.md

@@ -0,0 +1,72 @@
+### 结构
+
+```json
+{
+  "listen": "::",
+  "listen_port": 5353,
+  "tcp_fast_open": false,
+  "sniff": false,
+  "sniff_override_destination": false,
+  "domain_strategy": "prefer_ipv6",
+  "udp_timeout": 300,
+  "detour": "another-in"
+}
+```
+
+| 字段               | 可用上下文                               |
+|------------------|-------------------------------------|
+| `listen`         | 需要监听 TCP 或 UDP。                     |
+| `listen_port`    | 需要监听 TCP 或 UDP。                     |
+| `tcp_fast_open`  | 需要监听 TCP。                           |
+| `udp_timeout`    | 需要组装 UDP 连接, 当前为 Tun 和 Shadowsocks。 |
+| `proxy_protocol` | 需要监听 TCP。                           |
+
+### 字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
+
+#### detour
+
+如果设置，连接将被转发到指定的入站。
+
+需要目标入站支持，参阅 [注入支持](/zh/configuration/inbound/#_3)。

docs/examples/shadowtls.md

@@ -0,0 +1,55 @@
+#### Server
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "shadowtls",
+      "listen": "::",
+      "listen_port": 4443,
+      "handshake": {
+        "server": "google.com",
+        "server_port": 443
+      },
+      "detour": "shadowsocks-in"
+    },
+    {
+      "type": "shadowsocks",
+      "tag": "shadowsocks-in",
+      "listen": "127.0.0.1",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    }
+  ]
+}
+```
+
+#### Client
+
+```json
+{
+  "outbounds": [
+    {
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "detour": "shadowtls-out",
+      "multiplex": {
+        "enabled": true,
+        "max_connections": 4,
+        "min_streams": 4
+      }
+    },
+    {
+      "type": "shadowtls",
+      "tag": "shadowtls-out",
+      "server": "127.0.0.1",
+      "server_port": 4443,
+      "tls": {
+        "enabled": true,
+        "server_name": "google.com"
+      }
+    }
+  ]
+}
+```

docs/faq/known-issues.md

@@ -11,7 +11,7 @@ the public internet.
 
 ##### on Linux
 
-`auto-route` cannot automatically hijack DNS requests with `systemd-resoled` enabled, you can switch to NetworkManager.
+`auto-route` cannot automatically hijack DNS requests with `systemd-resolved` enabled, you can switch to NetworkManager.
 
 #### System proxy
 

docs/faq/known-issues.zh.md

@@ -10,7 +10,7 @@
 
 ##### Linux
 
-`auto-route` 无法自动劫持 DNS 请求如果 `systemd-resoled` 开启, 您可以切换到 NetworkManager.
+`auto-route` 无法自动劫持 DNS 请求如果 `systemd-resolved` 开启, 您可以切换到 NetworkManager.
 
 #### 系统代理
 

experimental/clashapi/configs.go

@@ -36,7 +36,7 @@ func getConfigs(logFactory log.Factory) func(w http.ResponseWriter, r *http.Requ
 		logLevel := logFactory.Level()
 		if logLevel == log.LevelTrace {
 			logLevel = log.LevelDebug
-		} else if logLevel > log.LevelError {
+		} else if logLevel < log.LevelError {
 			logLevel = log.LevelError
 		}
 		render.JSON(w, r, &configSchema{

experimental/clashapi/connections.go

@@ -8,10 +8,10 @@ import (
 
 	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
+	"github.com/sagernet/websocket"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
-	"github.com/gorilla/websocket"
 )
 
 func connectionRouter(trafficManager *trafficontrol.Manager) http.Handler {

experimental/clashapi/proxies.go

@@ -70,16 +70,26 @@ func proxyInfo(server *Server, detour adapter.Outbound) *badjson.JSONObject {
 	case C.TypeSocks:
 		clashType = "Socks"
 	case C.TypeHTTP:
-		clashType = "Http"
+		clashType = "HTTP"
 	case C.TypeShadowsocks:
 		clashType = "Shadowsocks"
 	case C.TypeVMess:
-		clashType = "Vmess"
+		clashType = "VMess"
+	case C.TypeTrojan:
+		clashType = "Trojan"
+	case C.TypeHysteria:
+		clashType = "Hysteria"
+	case C.TypeWireGuard:
+		clashType = "WireGuard"
+	case C.TypeTor:
+		clashType = "Tor"
+	case C.TypeSSH:
+		clashType = "SSH"
 	case C.TypeSelector:
 		clashType = "Selector"
 		isGroup = true
 	default:
-		clashType = "Unknown"
+		clashType = "Direct"
 	}
 	info.Put("type", clashType)
 	info.Put("name", detour.Tag())

experimental/clashapi/server.go

@@ -21,11 +21,11 @@ import (
 	E "github.com/sagernet/sing/common/exceptions"
 	F "github.com/sagernet/sing/common/format"
 	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/websocket"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/cors"
 	"github.com/go-chi/render"
-	"github.com/gorilla/websocket"
 )
 
 var _ adapter.ClashServer = (*Server)(nil)

go.mod

@@ -12,7 +12,6 @@ require (
 	github.com/go-chi/cors v1.2.1
 	github.com/go-chi/render v1.0.2
 	github.com/gofrs/uuid v4.2.0+incompatible
-	github.com/gorilla/websocket v1.5.0
 	github.com/hashicorp/yamux v0.1.1
 	github.com/logrusorgru/aurora v2.0.3+incompatible
 	github.com/mholt/acmez v1.0.4
@@ -20,25 +19,28 @@ require (
 	github.com/pires/go-proxyproto v0.6.2
 	github.com/sagernet/certmagic v0.0.0-20220819042630-4a57f8b6853a
 	github.com/sagernet/quic-go v0.0.0-20220818150011-de611ab3e2bb
-	github.com/sagernet/sing v0.0.0-20220826124916-d4ba8fdfac88
+	github.com/sagernet/sing v0.0.0-20220913004915-27ddefbb8921
 	github.com/sagernet/sing-dns v0.0.0-20220822023312-3e086b06d666
 	github.com/sagernet/sing-shadowsocks v0.0.0-20220819002358-7461bb09a8f6
 	github.com/sagernet/sing-tun v0.0.0-20220828031750-185b6c880a83
-	github.com/sagernet/sing-vmess v0.0.0-20220827032426-01665c9c4e31
-	github.com/sagernet/smux v0.0.0-20220812084127-e2d085ee3939
+	github.com/sagernet/sing-vmess v0.0.0-20220913015714-c4ab86d40e12
+	github.com/sagernet/smux v0.0.0-20220831015742-e0f1988e3195
+	github.com/sagernet/websocket v0.0.0-20220913015213-615516348b4e
 	github.com/spf13/cobra v1.5.0
 	github.com/stretchr/testify v1.8.0
 	go.uber.org/atomic v1.10.0
 	go4.org/netipx v0.0.0-20220812043211-3cc044ffd68d
-	golang.org/x/crypto v0.0.0-20220826181053-bd7e27e6170d
+	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
 	golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b
-	golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64
-	golang.zx2c4.com/wireguard v0.0.0-20220703234212-c31a7b1ab478
+	golang.org/x/sys v0.0.0-20220829200755-d48e67d00261
+	golang.zx2c4.com/wireguard v0.0.0-20220829161405-d1d08426b27b
 	google.golang.org/grpc v1.49.0
 	google.golang.org/protobuf v1.28.1
 	gvisor.dev/gvisor v0.0.0-20220819163037-ba6e795b139a
 )
 
+//replace github.com/sagernet/sing => ../sing
+
 require (
 	github.com/ajg/form v1.5.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect