Update documentation

Signed-off-by: 世界 <i@sekai.icu>
Signed-off-by: unknowndevQwQ <unknowndevQwQ@pm.me>

.github/workflows/debug.yml

@@ -3,6 +3,7 @@ name: Debug build
 on:
   push:
     branches:
+      - main
       - dev
       - dev-next
     paths-ignore:
@@ -11,6 +12,7 @@ on:
       - '!.github/workflows/debug.yml'
   pull_request:
     branches:
+      - main
       - dev
       - dev-next
 

.github/workflows/test.yml

@@ -0,0 +1,34 @@
+name: Test build
+
+on:
+  pull_request:
+    branches:
+      - main
+      - dev
+      - dev-next
+
+jobs:
+  build:
+    name: Debug build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Get latest go version
+        id: version
+        run: |
+          echo ::set-output name=go_version::$(curl -s https://raw.githubusercontent.com/actions/go-versions/main/versions-manifest.json | grep -oE '"version": "[0-9]{1}.[0-9]{1,}(.[0-9]{1,})?"' | head -1 | cut -d':' -f2 | sed 's/ //g; s/"//g')
+      - name: Setup Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ steps.version.outputs.go_version }}
+      - name: Cache go module
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/go/pkg/mod
+          key: go-${{ hashFiles('**/go.sum') }}
+      - name: Run Test
+        run: make test

.gitignore

@@ -4,4 +4,5 @@
 /*.db
 /site/
 /bin/
-/dist/
+/dist/
+/sing-box

.golangci.yml

@@ -7,6 +7,10 @@ linters:
     - staticcheck
     - paralleltest
 
+run:
+  skip-dirs:
+    - transport/cloudflaretls
+
 linters-settings:
 #  gci:
 #    sections:

.goreleaser.yaml

@@ -9,8 +9,9 @@ builds:
     gcflags:
       - all=-trimpath={{.Env.GOPATH}}
     ldflags:
-      - -X github.com/sagernet/sing-box/constant.Commit={{ .ShortCommit }} -s -w -buildid=
+      - -s -w -buildid=
     tags:
+      - with_gvisor
       - with_quic
       - with_wireguard
       - with_clash_api

Dockerfile

@@ -8,9 +8,9 @@ ENV CGO_ENABLED=0
 RUN set -ex \
     && apk add git build-base \
     && export COMMIT=$(git rev-parse --short HEAD) \
-    && go build -v -trimpath -tags 'no_gvisor,with_quic,with_wireguard,with_acme' \
+    && go build -v -trimpath -tags with_quic,with_wireguard,with_acme \
         -o /go/bin/sing-box \
-        -ldflags "-X github.com/sagernet/sing-box/constant.Commit=${COMMIT} -w -s -buildid=" \
+        -ldflags "-s -w -buildid=" \
         ./cmd/sing-box
 FROM alpine AS dist
 LABEL maintainer="nekohasekai <contact-git@sekai.icu>"

Makefile

@@ -1,9 +1,8 @@
 NAME = sing-box
 COMMIT = $(shell git rev-parse --short HEAD)
-TAGS ?= with_quic,with_wireguard,with_clash_api
-PARAMS = -v -trimpath -tags '$(TAGS)' -ldflags \
-		'-X "github.com/sagernet/sing-box/constant.Commit=$(COMMIT)" \
-		-w -s -buildid='
+TAGS ?= with_gvisor,with_quic,with_wireguard,with_clash_api
+TAGS_TEST ?= with_gvisor,with_quic,with_wireguard,with_grpc,with_ech,with_utls,with_shadowsocksr
+PARAMS = -v -trimpath -tags "$(TAGS)" -ldflags "-s -w -buildid="
 MAIN = ./cmd/sing-box
 
 .PHONY: test release
@@ -61,14 +60,19 @@ release_install:
 	go install -v github.com/tcnksm/ghr@latest
 
 test:
-	@go test -v . && \
-	pushd test && \
+	@go test -v ./... && \
+	cd test && \
 	go mod tidy && \
-	go test -v -tags with_quic,with_wireguard,with_grpc . && \
-	popd
+	go test -v -tags "$(TAGS_TEST)" .
+
+test_stdio:
+	@go test -v ./... && \
+	cd test && \
+	go mod tidy && \
+	go test -v -tags "$(TAGS_TEST),force_stdio" .
 
 clean:
-	rm -rf bin dist
+	rm -rf bin dist sing-box
 	rm -f $(shell go env GOPATH)/sing-box
 
 update:

adapter/experimental.go

@@ -4,23 +4,29 @@ import (
 	"context"
 	"net"
 
+	"github.com/sagernet/sing-box/common/urltest"
 	N "github.com/sagernet/sing/common/network"
 )
 
 type ClashServer interface {
 	Service
-	TrafficController
+	Mode() string
+	StoreSelected() bool
+	CacheFile() ClashCacheFile
+	HistoryStorage() *urltest.HistoryStorage
+	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
+	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
+}
+
+type ClashCacheFile interface {
+	LoadSelected(group string) string
+	StoreSelected(group string, selected string) error
 }
 
 type Tracker interface {
 	Leave()
 }
 
-type TrafficController interface {
-	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
-	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
-}
-
 type OutboundGroup interface {
 	Now() string
 	All() []string
@@ -32,3 +38,13 @@ func OutboundTag(detour Outbound) string {
 	}
 	return detour.Tag()
 }
+
+type V2RayServer interface {
+	Service
+	StatsService() V2RayStatsService
+}
+
+type V2RayStatsService interface {
+	RoutedConnection(inbound string, outbound string, conn net.Conn) net.Conn
+	RoutedPacketConnection(inbound string, outbound string, conn N.PacketConn) N.PacketConn
+}

adapter/router.go

@@ -11,7 +11,7 @@ import (
 	"github.com/sagernet/sing/common/control"
 	N "github.com/sagernet/sing/common/network"
 
-	"golang.org/x/net/dns/dnsmessage"
+	mdns "github.com/miekg/dns"
 )
 
 type Router interface {
@@ -27,11 +27,11 @@ type Router interface {
 	GeoIPReader() *geoip.Reader
 	LoadGeosite(code string) (Rule, error)
 
-	Exchange(ctx context.Context, message *dnsmessage.Message) (*dnsmessage.Message, error)
+	Exchange(ctx context.Context, message *mdns.Msg) (*mdns.Msg, error)
 	Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error)
 	LookupDefault(ctx context.Context, domain string) ([]netip.Addr, error)
 
-	InterfaceBindManager() control.BindManager
+	InterfaceFinder() control.InterfaceFinder
 	DefaultInterface() string
 	AutoDetectInterface() bool
 	DefaultMark() int
@@ -39,7 +39,12 @@ type Router interface {
 	InterfaceMonitor() tun.DefaultInterfaceMonitor
 	PackageManager() tun.PackageManager
 	Rules() []Rule
-	SetTrafficController(controller TrafficController)
+
+	ClashServer() ClashServer
+	SetClashServer(server ClashServer)
+
+	V2RayServer() V2RayServer
+	SetV2RayServer(server V2RayServer)
 }
 
 type Rule interface {

adapter/upstream.go

@@ -38,13 +38,25 @@ type myUpstreamHandlerWrapper struct {
 }
 
 func (w *myUpstreamHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
-	w.metadata.Destination = metadata.Destination
-	return w.connectionHandler(ctx, conn, w.metadata)
+	myMetadata := w.metadata
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
+	return w.connectionHandler(ctx, conn, myMetadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
-	w.metadata.Destination = metadata.Destination
-	return w.packetHandler(ctx, conn, w.metadata)
+	myMetadata := w.metadata
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
+	return w.packetHandler(ctx, conn, myMetadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewError(ctx context.Context, err error) {
@@ -78,13 +90,23 @@ func NewUpstreamContextHandler(
 
 func (w *myUpstreamContextHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	myMetadata.Destination = metadata.Destination
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
 	return w.connectionHandler(ctx, conn, *myMetadata)
 }
 
 func (w *myUpstreamContextHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	myMetadata.Destination = metadata.Destination
+	if metadata.Source.IsValid() {
+		myMetadata.Source = metadata.Source
+	}
+	if metadata.Destination.IsValid() {
+		myMetadata.Destination = metadata.Destination
+	}
 	return w.packetHandler(ctx, conn, *myMetadata)
 }
 

box.go

@@ -31,6 +31,7 @@ type Box struct {
 	logger      log.ContextLogger
 	logFile     *os.File
 	clashServer adapter.ClashServer
+	v2rayServer adapter.V2RayServer
 	done        chan struct{}
 }
 
@@ -39,8 +40,14 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 	logOptions := common.PtrValueOrDefault(options.Log)
 
 	var needClashAPI bool
-	if options.Experimental != nil && options.Experimental.ClashAPI != nil && options.Experimental.ClashAPI.ExternalController != "" {
-		needClashAPI = true
+	var needV2RayAPI bool
+	if options.Experimental != nil {
+		if options.Experimental.ClashAPI != nil && options.Experimental.ClashAPI.ExternalController != "" {
+			needClashAPI = true
+		}
+		if options.Experimental.V2RayAPI != nil && options.Experimental.V2RayAPI.Listen != "" {
+			needV2RayAPI = true
+		}
 	}
 
 	var logFactory log.Factory
@@ -149,12 +156,20 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 	}
 
 	var clashServer adapter.ClashServer
+	var v2rayServer adapter.V2RayServer
 	if needClashAPI {
 		clashServer, err = experimental.NewClashServer(router, observableLogFactory, common.PtrValueOrDefault(options.Experimental.ClashAPI))
 		if err != nil {
 			return nil, E.Cause(err, "create clash api server")
 		}
-		router.SetTrafficController(clashServer)
+		router.SetClashServer(clashServer)
+	}
+	if needV2RayAPI {
+		v2rayServer, err = experimental.NewV2RayServer(logFactory.NewLogger("v2ray-api"), common.PtrValueOrDefault(options.Experimental.V2RayAPI))
+		if err != nil {
+			return nil, E.Cause(err, "create v2ray api server")
+		}
+		router.SetV2RayServer(v2rayServer)
 	}
 	return &Box{
 		router:      router,
@@ -162,9 +177,10 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		outbounds:   outbounds,
 		createdAt:   createdAt,
 		logFactory:  logFactory,
-		logger:      logFactory.NewLogger(""),
+		logger:      logFactory.Logger(),
 		logFile:     logFile,
 		clashServer: clashServer,
+		v2rayServer: v2rayServer,
 		done:        make(chan struct{}),
 	}, nil
 }
@@ -223,6 +239,12 @@ func (s *Box) start() error {
 			return E.Cause(err, "start clash api server")
 		}
 	}
+	if s.v2rayServer != nil {
+		err = s.v2rayServer.Start()
+		if err != nil {
+			return E.Cause(err, "start v2ray api server")
+		}
+	}
 	s.logger.Info("sing-box started (", F.Seconds(time.Since(s.createdAt).Seconds()), "s)")
 	return nil
 }
@@ -244,6 +266,11 @@ func (s *Box) Close() error {
 		s.router,
 		s.logFactory,
 		s.clashServer,
+		s.v2rayServer,
 		common.PtrOrNil(s.logFile),
 	)
 }
+
+func (s *Box) Router() adapter.Router {
+	return s.router
+}

cmd/sing-box/cmd_version.go

@@ -3,9 +3,9 @@ package main
 import (
 	"os"
 	"runtime"
+	"runtime/debug"
 
 	C "github.com/sagernet/sing-box/constant"
-	F "github.com/sagernet/sing/common/format"
 
 	"github.com/spf13/cobra"
 )
@@ -25,30 +25,40 @@ func init() {
 }
 
 func printVersion(cmd *cobra.Command, args []string) {
-	var version string
-	if !nameOnly {
-		version = "sing-box "
+	if nameOnly {
+		os.Stdout.WriteString(C.Version + "\n")
+		return
 	}
-	version += F.ToString(C.Version)
-	if C.Commit != "" {
-		version += "." + C.Commit
-	}
-	if !nameOnly {
-		version += " ("
-		version += runtime.Version()
-		version += ", "
-		version += runtime.GOOS
-		version += "/"
-		version += runtime.GOARCH
-		version += ", "
-		version += "CGO "
-		if C.CGO_ENABLED {
-			version += "enabled"
-		} else {
-			version += "disabled"
+	version := "sing-box version " + C.Version + "\n\n"
+	version += "Environment: " + runtime.Version() + " " + runtime.GOOS + "/" + runtime.GOARCH + "\n"
+
+	var tags string
+	var revision string
+
+	debugInfo, loaded := debug.ReadBuildInfo()
+	if loaded {
+		for _, setting := range debugInfo.Settings {
+			switch setting.Key {
+			case "-tags":
+				tags = setting.Value
+			case "vcs.revision":
+				revision = setting.Value
+			}
 		}
-		version += ")"
 	}
-	version += "\n"
+
+	if tags != "" {
+		version += "Tags: " + tags + "\n"
+	}
+	if revision != "" {
+		version += "Revision: " + revision + "\n"
+	}
+
+	if C.CGO_ENABLED {
+		version += "CGO: enabled\n"
+	} else {
+		version += "CGO: disabled\n"
+	}
+
 	os.Stdout.WriteString(version)
 }

cmd/sing-box/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"os"
 
+	_ "github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
 
 	"github.com/spf13/cobra"

common/baderror/baderror.go

@@ -26,7 +26,7 @@ func WrapH2(err error) error {
 	if err == io.ErrUnexpectedEOF {
 		return io.EOF
 	}
-	if Contains(err, "client disconnected", "body closed by handler") {
+	if Contains(err, "client disconnected", "body closed by handler", "response body closed", "; CANCEL") {
 		return net.ErrClosed
 	}
 	return err

common/badtls/badtls.go

@@ -0,0 +1,210 @@
+//go:build go1.19 && !go1.20
+
+package badtls
+
+import (
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/tls"
+	"encoding/binary"
+	"io"
+	"net"
+	"reflect"
+	"sync"
+	"sync/atomic"
+	"unsafe"
+
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/bufio"
+	E "github.com/sagernet/sing/common/exceptions"
+	N "github.com/sagernet/sing/common/network"
+)
+
+type Conn struct {
+	*tls.Conn
+	writer           N.ExtendedWriter
+	activeCall       *int32
+	closeNotifySent  *bool
+	version          *uint16
+	rand             io.Reader
+	halfAccess       *sync.Mutex
+	halfError        *error
+	cipher           cipher.AEAD
+	explicitNonceLen int
+	halfPtr          uintptr
+	halfSeq          []byte
+	halfScratchBuf   []byte
+}
+
+func Create(conn *tls.Conn) (TLSConn, error) {
+	if !handshakeComplete(conn) {
+		return nil, E.New("handshake not finished")
+	}
+	rawConn := reflect.Indirect(reflect.ValueOf(conn))
+	rawActiveCall := rawConn.FieldByName("activeCall")
+	if !rawActiveCall.IsValid() || rawActiveCall.Kind() != reflect.Int32 {
+		return nil, E.New("badtls: invalid active call")
+	}
+	activeCall := (*int32)(unsafe.Pointer(rawActiveCall.UnsafeAddr()))
+	rawHalfConn := rawConn.FieldByName("out")
+	if !rawHalfConn.IsValid() || rawHalfConn.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid half conn")
+	}
+	rawVersion := rawConn.FieldByName("vers")
+	if !rawVersion.IsValid() || rawVersion.Kind() != reflect.Uint16 {
+		return nil, E.New("badtls: invalid version")
+	}
+	version := (*uint16)(unsafe.Pointer(rawVersion.UnsafeAddr()))
+	rawCloseNotifySent := rawConn.FieldByName("closeNotifySent")
+	if !rawCloseNotifySent.IsValid() || rawCloseNotifySent.Kind() != reflect.Bool {
+		return nil, E.New("badtls: invalid notify")
+	}
+	closeNotifySent := (*bool)(unsafe.Pointer(rawCloseNotifySent.UnsafeAddr()))
+	rawConfig := reflect.Indirect(rawConn.FieldByName("config"))
+	if !rawConfig.IsValid() || rawConfig.Kind() != reflect.Struct {
+		return nil, E.New("badtls: bad config")
+	}
+	config := (*tls.Config)(unsafe.Pointer(rawConfig.UnsafeAddr()))
+	randReader := config.Rand
+	if randReader == nil {
+		randReader = rand.Reader
+	}
+	rawHalfMutex := rawHalfConn.FieldByName("Mutex")
+	if !rawHalfMutex.IsValid() || rawHalfMutex.Kind() != reflect.Struct {
+		return nil, E.New("badtls: invalid half mutex")
+	}
+	halfAccess := (*sync.Mutex)(unsafe.Pointer(rawHalfMutex.UnsafeAddr()))
+	rawHalfError := rawHalfConn.FieldByName("err")
+	if !rawHalfError.IsValid() || rawHalfError.Kind() != reflect.Interface {
+		return nil, E.New("badtls: invalid half error")
+	}
+	halfError := (*error)(unsafe.Pointer(rawHalfError.UnsafeAddr()))
+	rawHalfCipherInterface := rawHalfConn.FieldByName("cipher")
+	if !rawHalfCipherInterface.IsValid() || rawHalfCipherInterface.Kind() != reflect.Interface {
+		return nil, E.New("badtls: invalid cipher interface")
+	}
+	rawHalfCipher := rawHalfCipherInterface.Elem()
+	aeadCipher, loaded := valueInterface(rawHalfCipher, false).(cipher.AEAD)
+	if !loaded {
+		return nil, E.New("badtls: invalid AEAD cipher")
+	}
+	var explicitNonceLen int
+	switch cipherName := reflect.Indirect(rawHalfCipher).Type().String(); cipherName {
+	case "tls.prefixNonceAEAD":
+		explicitNonceLen = aeadCipher.NonceSize()
+	case "tls.xorNonceAEAD":
+	default:
+		return nil, E.New("badtls: unknown cipher type: ", cipherName)
+	}
+	rawHalfSeq := rawHalfConn.FieldByName("seq")
+	if !rawHalfSeq.IsValid() || rawHalfSeq.Kind() != reflect.Array {
+		return nil, E.New("badtls: invalid seq")
+	}
+	halfSeq := rawHalfSeq.Bytes()
+	rawHalfScratchBuf := rawHalfConn.FieldByName("scratchBuf")
+	if !rawHalfScratchBuf.IsValid() || rawHalfScratchBuf.Kind() != reflect.Array {
+		return nil, E.New("badtls: invalid scratchBuf")
+	}
+	halfScratchBuf := rawHalfScratchBuf.Bytes()
+	return &Conn{
+		Conn:             conn,
+		writer:           bufio.NewExtendedWriter(conn.NetConn()),
+		activeCall:       activeCall,
+		closeNotifySent:  closeNotifySent,
+		version:          version,
+		halfAccess:       halfAccess,
+		halfError:        halfError,
+		cipher:           aeadCipher,
+		explicitNonceLen: explicitNonceLen,
+		rand:             randReader,
+		halfPtr:          rawHalfConn.UnsafeAddr(),
+		halfSeq:          halfSeq,
+		halfScratchBuf:   halfScratchBuf,
+	}, nil
+}
+
+func (c *Conn) WriteBuffer(buffer *buf.Buffer) error {
+	if buffer.Len() > maxPlaintext {
+		defer buffer.Release()
+		return common.Error(c.Write(buffer.Bytes()))
+	}
+	for {
+		x := atomic.LoadInt32(c.activeCall)
+		if x&1 != 0 {
+			return net.ErrClosed
+		}
+		if atomic.CompareAndSwapInt32(c.activeCall, x, x+2) {
+			break
+		}
+	}
+	defer atomic.AddInt32(c.activeCall, -2)
+	c.halfAccess.Lock()
+	defer c.halfAccess.Unlock()
+	if err := *c.halfError; err != nil {
+		return err
+	}
+	if *c.closeNotifySent {
+		return errShutdown
+	}
+	dataLen := buffer.Len()
+	dataBytes := buffer.Bytes()
+	outBuf := buffer.ExtendHeader(recordHeaderLen + c.explicitNonceLen)
+	outBuf[0] = 23
+	version := *c.version
+	if version == 0 {
+		version = tls.VersionTLS10
+	} else if version == tls.VersionTLS13 {
+		version = tls.VersionTLS12
+	}
+	binary.BigEndian.PutUint16(outBuf[1:], version)
+	var nonce []byte
+	if c.explicitNonceLen > 0 {
+		nonce = outBuf[5 : 5+c.explicitNonceLen]
+		if c.explicitNonceLen < 16 {
+			copy(nonce, c.halfSeq)
+		} else {
+			if _, err := io.ReadFull(c.rand, nonce); err != nil {
+				return err
+			}
+		}
+	}
+	if len(nonce) == 0 {
+		nonce = c.halfSeq
+	}
+	if *c.version == tls.VersionTLS13 {
+		buffer.FreeBytes()[0] = 23
+		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen+1+c.cipher.Overhead()))
+		c.cipher.Seal(outBuf, nonce, outBuf[recordHeaderLen:recordHeaderLen+c.explicitNonceLen+dataLen+1], outBuf[:recordHeaderLen])
+		buffer.Extend(1 + c.cipher.Overhead())
+	} else {
+		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen))
+		additionalData := append(c.halfScratchBuf[:0], c.halfSeq...)
+		additionalData = append(additionalData, outBuf[:recordHeaderLen]...)
+		c.cipher.Seal(outBuf, nonce, dataBytes, additionalData)
+		buffer.Extend(c.cipher.Overhead())
+		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen+c.explicitNonceLen+c.cipher.Overhead()))
+	}
+	incSeq(c.halfPtr)
+	return c.writer.WriteBuffer(buffer)
+}
+
+func (c *Conn) FrontHeadroom() int {
+	return recordHeaderLen + c.explicitNonceLen
+}
+
+func (c *Conn) RearHeadroom() int {
+	return 1 + c.cipher.Overhead()
+}
+
+func (c *Conn) WriterMTU() int {
+	return maxPlaintext
+}
+
+func (c *Conn) Upstream() any {
+	return c.Conn
+}
+
+func (c *Conn) UpstreamWriter() any {
+	return c.NetConn()
+}

common/badtls/badtls_stub.go

@@ -0,0 +1,12 @@
+//go:build !go1.19 || go1.20
+
+package badtls
+
+import (
+	"crypto/tls"
+	"os"
+)
+
+func Create(conn *tls.Conn) (TLSConn, error) {
+	return nil, os.ErrInvalid
+}

common/badtls/conn.go

@@ -0,0 +1,13 @@
+package badtls
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+)
+
+type TLSConn interface {
+	net.Conn
+	HandshakeContext(ctx context.Context) error
+	ConnectionState() tls.ConnectionState
+}

common/badtls/link.go

@@ -0,0 +1,26 @@
+//go:build go1.19 && !go.1.20
+
+package badtls
+
+import (
+	"crypto/tls"
+	"reflect"
+	_ "unsafe"
+)
+
+const (
+	maxPlaintext    = 16384 // maximum plaintext payload length
+	recordHeaderLen = 5     // record header length
+)
+
+//go:linkname errShutdown crypto/tls.errShutdown
+var errShutdown error
+
+//go:linkname handshakeComplete crypto/tls.(*Conn).handshakeComplete
+func handshakeComplete(conn *tls.Conn) bool
+
+//go:linkname incSeq crypto/tls.(*halfConn).incSeq
+func incSeq(conn uintptr)
+
+//go:linkname valueInterface reflect.valueInterface
+func valueInterface(v reflect.Value, safe bool) any

common/dialer/default.go

@@ -15,7 +15,7 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
-	"github.com/database64128/tfo-go"
+	"github.com/database64128/tfo-go/v2"
 )
 
 var warnBindInterfaceOnUnsupportedPlatform = warning.New(
@@ -65,25 +65,23 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	var listener net.ListenConfig
 	if options.BindInterface != "" {
 		warnBindInterfaceOnUnsupportedPlatform.Check()
-		bindFunc := control.BindToInterface(router.InterfaceBindManager(), options.BindInterface)
+		bindFunc := control.BindToInterface(router.InterfaceFinder(), options.BindInterface, -1)
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.AutoDetectInterface() {
-		if C.IsWindows {
-			bindFunc := control.BindToInterfaceIndexFunc(func(network, address string) int {
-				return router.InterfaceMonitor().DefaultInterfaceIndex(M.ParseSocksaddr(address).Addr)
-			})
-			dialer.Control = control.Append(dialer.Control, bindFunc)
-			listener.Control = control.Append(listener.Control, bindFunc)
-		} else {
-			bindFunc := control.BindToInterfaceFunc(router.InterfaceBindManager(), func(network, address string) string {
-				return router.InterfaceMonitor().DefaultInterfaceName(M.ParseSocksaddr(address).Addr)
-			})
-			dialer.Control = control.Append(dialer.Control, bindFunc)
-			listener.Control = control.Append(listener.Control, bindFunc)
-		}
+		const useInterfaceName = C.IsLinux
+		bindFunc := control.BindToInterfaceFunc(router.InterfaceFinder(), func(network string, address string) (interfaceName string, interfaceIndex int) {
+			remoteAddr := M.ParseSocksaddr(address).Addr
+			if C.IsLinux {
+				return router.InterfaceMonitor().DefaultInterfaceName(remoteAddr), -1
+			} else {
+				return "", router.InterfaceMonitor().DefaultInterfaceIndex(remoteAddr)
+			}
+		})
+		dialer.Control = control.Append(dialer.Control, bindFunc)
+		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.DefaultInterface() != "" {
-		bindFunc := control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface())
+		bindFunc := control.BindToInterface(router.InterfaceFinder(), router.DefaultInterface(), -1)
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	}
@@ -112,6 +110,16 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	if options.TCPFastOpen {
 		warnTFOOnUnsupportedPlatform.Check()
 	}
+	var udpFragment bool
+	if options.UDPFragment != nil {
+		udpFragment = *options.UDPFragment
+	} else {
+		udpFragment = options.UDPFragmentDefault
+	}
+	if !udpFragment {
+		dialer.Control = control.Append(dialer.Control, control.DisableUDPFragment())
+		listener.Control = control.Append(listener.Control, control.DisableUDPFragment())
+	}
 	var bindUDPAddr string
 	udpDialer := dialer
 	var bindAddress netip.Addr
@@ -138,7 +146,7 @@ func (d *DefaultDialer) DialContext(ctx context.Context, network string, address
 	case N.NetworkUDP:
 		return d.udpDialer.DialContext(ctx, network, address.String())
 	}
-	return d.dialer.DialContext(ctx, network, address.Unwrap().String())
+	return DialSlowContext(&d.dialer, ctx, network, address)
 }
 
 func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {

common/dialer/tfo.go

@@ -0,0 +1,135 @@
+package dialer
+
+import (
+	"context"
+	"io"
+	"net"
+	"os"
+	"time"
+
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/bufio"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	"github.com/database64128/tfo-go/v2"
+)
+
+type slowOpenConn struct {
+	dialer      *tfo.Dialer
+	ctx         context.Context
+	network     string
+	destination M.Socksaddr
+	conn        net.Conn
+	create      chan struct{}
+	err         error
+}
+
+func DialSlowContext(dialer *tfo.Dialer, ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	if dialer.DisableTFO || N.NetworkName(network) != N.NetworkTCP {
+		return dialer.DialContext(ctx, network, destination.String(), nil)
+	}
+	return &slowOpenConn{
+		dialer:      dialer,
+		ctx:         ctx,
+		network:     network,
+		destination: destination,
+		create:      make(chan struct{}),
+	}, nil
+}
+
+func (c *slowOpenConn) Read(b []byte) (n int, err error) {
+	if c.conn == nil {
+		select {
+		case <-c.create:
+			if c.err != nil {
+				return 0, c.err
+			}
+		case <-c.ctx.Done():
+			return 0, c.ctx.Err()
+		}
+	}
+	return c.conn.Read(b)
+}
+
+func (c *slowOpenConn) Write(b []byte) (n int, err error) {
+	if c.conn == nil {
+		c.conn, err = c.dialer.DialContext(c.ctx, c.network, c.destination.String(), b)
+		c.err = err
+		close(c.create)
+		return
+	}
+	return c.conn.Write(b)
+}
+
+func (c *slowOpenConn) Close() error {
+	return common.Close(c.conn)
+}
+
+func (c *slowOpenConn) LocalAddr() net.Addr {
+	if c.conn == nil {
+		return M.Socksaddr{}
+	}
+	return c.conn.LocalAddr()
+}
+
+func (c *slowOpenConn) RemoteAddr() net.Addr {
+	if c.conn == nil {
+		return M.Socksaddr{}
+	}
+	return c.conn.RemoteAddr()
+}
+
+func (c *slowOpenConn) SetDeadline(t time.Time) error {
+	if c.conn == nil {
+		return os.ErrInvalid
+	}
+	return c.conn.SetDeadline(t)
+}
+
+func (c *slowOpenConn) SetReadDeadline(t time.Time) error {
+	if c.conn == nil {
+		return os.ErrInvalid
+	}
+	return c.conn.SetReadDeadline(t)
+}
+
+func (c *slowOpenConn) SetWriteDeadline(t time.Time) error {
+	if c.conn == nil {
+		return os.ErrInvalid
+	}
+	return c.conn.SetWriteDeadline(t)
+}
+
+func (c *slowOpenConn) Upstream() any {
+	return c.conn
+}
+
+func (c *slowOpenConn) ReaderReplaceable() bool {
+	return c.conn != nil
+}
+
+func (c *slowOpenConn) WriterReplaceable() bool {
+	return c.conn != nil
+}
+
+func (c *slowOpenConn) ReadFrom(r io.Reader) (n int64, err error) {
+	if c.conn != nil {
+		return bufio.Copy(c.conn, r)
+	}
+	return bufio.ReadFrom0(c, r)
+}
+
+func (c *slowOpenConn) WriteTo(w io.Writer) (n int64, err error) {
+	if c.conn == nil {
+		select {
+		case <-c.create:
+			if c.err != nil {
+				return 0, c.err
+			}
+		case <-c.ctx.Done():
+			return 0, c.ctx.Err()
+		}
+	}
+	return bufio.Copy(w, c.conn)
+}

common/json/comment.go

@@ -0,0 +1,128 @@
+package json
+
+import (
+	"bufio"
+	"io"
+)
+
+// kanged from v2ray
+
+type commentFilterState = byte
+
+const (
+	commentFilterStateContent commentFilterState = iota
+	commentFilterStateEscape
+	commentFilterStateDoubleQuote
+	commentFilterStateDoubleQuoteEscape
+	commentFilterStateSingleQuote
+	commentFilterStateSingleQuoteEscape
+	commentFilterStateComment
+	commentFilterStateSlash
+	commentFilterStateMultilineComment
+	commentFilterStateMultilineCommentStar
+)
+
+type CommentFilter struct {
+	br    *bufio.Reader
+	state commentFilterState
+}
+
+func NewCommentFilter(reader io.Reader) io.Reader {
+	return &CommentFilter{br: bufio.NewReader(reader)}
+}
+
+func (v *CommentFilter) Read(b []byte) (int, error) {
+	p := b[:0]
+	for len(p) < len(b)-2 {
+		x, err := v.br.ReadByte()
+		if err != nil {
+			if len(p) == 0 {
+				return 0, err
+			}
+			return len(p), nil
+		}
+		switch v.state {
+		case commentFilterStateContent:
+			switch x {
+			case '"':
+				v.state = commentFilterStateDoubleQuote
+				p = append(p, x)
+			case '\'':
+				v.state = commentFilterStateSingleQuote
+				p = append(p, x)
+			case '\\':
+				v.state = commentFilterStateEscape
+			case '#':
+				v.state = commentFilterStateComment
+			case '/':
+				v.state = commentFilterStateSlash
+			default:
+				p = append(p, x)
+			}
+		case commentFilterStateEscape:
+			p = append(p, '\\', x)
+			v.state = commentFilterStateContent
+		case commentFilterStateDoubleQuote:
+			switch x {
+			case '"':
+				v.state = commentFilterStateContent
+				p = append(p, x)
+			case '\\':
+				v.state = commentFilterStateDoubleQuoteEscape
+			default:
+				p = append(p, x)
+			}
+		case commentFilterStateDoubleQuoteEscape:
+			p = append(p, '\\', x)
+			v.state = commentFilterStateDoubleQuote
+		case commentFilterStateSingleQuote:
+			switch x {
+			case '\'':
+				v.state = commentFilterStateContent
+				p = append(p, x)
+			case '\\':
+				v.state = commentFilterStateSingleQuoteEscape
+			default:
+				p = append(p, x)
+			}
+		case commentFilterStateSingleQuoteEscape:
+			p = append(p, '\\', x)
+			v.state = commentFilterStateSingleQuote
+		case commentFilterStateComment:
+			if x == '\n' {
+				v.state = commentFilterStateContent
+				p = append(p, '\n')
+			}
+		case commentFilterStateSlash:
+			switch x {
+			case '/':
+				v.state = commentFilterStateComment
+			case '*':
+				v.state = commentFilterStateMultilineComment
+			default:
+				p = append(p, '/', x)
+			}
+		case commentFilterStateMultilineComment:
+			switch x {
+			case '*':
+				v.state = commentFilterStateMultilineCommentStar
+			case '\n':
+				p = append(p, '\n')
+			}
+		case commentFilterStateMultilineCommentStar:
+			switch x {
+			case '/':
+				v.state = commentFilterStateContent
+			case '*':
+				// Stay
+			case '\n':
+				p = append(p, '\n')
+			default:
+				v.state = commentFilterStateMultilineComment
+			}
+		default:
+			panic("Unknown state.")
+		}
+	}
+	return len(p), nil
+}

common/mux/client.go

@@ -466,10 +466,7 @@ func (c *ClientPacketAddrConn) ReadPacket(buffer *buf.Buffer) (destination M.Soc
 	if err != nil {
 		return
 	}
-	if buffer.FreeLen() < int(length) {
-		return destination, io.ErrShortBuffer
-	}
-	_, err = io.ReadFull(c.ExtendedConn, buffer.Extend(int(length)))
+	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
 	return
 }
 

common/mux/service.go

@@ -3,7 +3,6 @@ package mux
 import (
 	"context"
 	"encoding/binary"
-	"io"
 	"net"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -15,6 +14,7 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/common/rw"
+	"github.com/sagernet/sing/common/task"
 )
 
 func NewConnection(ctx context.Context, router adapter.Router, errorHandler E.Handler, logger log.ContextLogger, conn net.Conn, metadata adapter.InboundContext) error {
@@ -26,14 +26,21 @@ func NewConnection(ctx context.Context, router adapter.Router, errorHandler E.Ha
 	if err != nil {
 		return err
 	}
-	var stream net.Conn
-	for {
-		stream, err = session.Accept()
-		if err != nil {
-			return err
+	var group task.Group
+	group.Append0(func(ctx context.Context) error {
+		var stream net.Conn
+		for {
+			stream, err = session.Accept()
+			if err != nil {
+				return err
+			}
+			go newConnection(ctx, router, errorHandler, logger, stream, metadata)
 		}
-		go newConnection(ctx, router, errorHandler, logger, stream, metadata)
-	}
+	})
+	group.Cleanup(func() {
+		session.Close()
+	})
+	return group.Run(ctx)
 }
 
 func newConnection(ctx context.Context, router adapter.Router, errorHandler E.Handler, logger log.ContextLogger, stream net.Conn, metadata adapter.InboundContext) {
@@ -158,9 +165,6 @@ func (c *ServerPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksad
 	if err != nil {
 		return
 	}
-	if buffer.FreeLen() < int(length) {
-		return destination, io.ErrShortBuffer
-	}
 	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
 	if err != nil {
 		return
@@ -223,9 +227,6 @@ func (c *ServerPacketAddrConn) ReadPacket(buffer *buf.Buffer) (destination M.Soc
 	if err != nil {
 		return
 	}
-	if buffer.FreeLen() < int(length) {
-		return destination, io.ErrShortBuffer
-	}
 	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
 	if err != nil {
 		return

common/process/searcher.go

@@ -28,11 +28,5 @@ type Info struct {
 }
 
 func FindProcessInfo(searcher Searcher, ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	info, err := findProcessInfo(searcher, ctx, network, source, destination)
-	if err != nil {
-		if source.Addr().Is4In6() {
-			info, err = findProcessInfo(searcher, ctx, network, netip.AddrPortFrom(netip.AddrFrom4(source.Addr().As4()), source.Port()), destination)
-		}
-	}
-	return info, err
+	return findProcessInfo(searcher, ctx, network, source, destination)
 }

common/proxyproto/listener.go

@@ -13,6 +13,7 @@ import (
 
 type Listener struct {
 	net.Listener
+	AcceptNoHeader bool
 }
 
 func (l *Listener) Accept() (net.Conn, error) {
@@ -22,7 +23,7 @@ func (l *Listener) Accept() (net.Conn, error) {
 	}
 	bufReader := std_bufio.NewReader(conn)
 	header, err := proxyproto.Read(bufReader)
-	if err != nil {
+	if err != nil && !(l.AcceptNoHeader && err == proxyproto.ErrNoProxyProtocol) {
 		return nil, err
 	}
 	if bufReader.Buffered() > 0 {
@@ -33,8 +34,11 @@ func (l *Listener) Accept() (net.Conn, error) {
 		}
 		conn = bufio.NewCachedConn(conn, cache)
 	}
-	return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
-		Source:      M.SocksaddrFromNet(header.SourceAddr),
-		Destination: M.SocksaddrFromNet(header.DestinationAddr),
-	}}, nil
+	if header != nil {
+		return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
+			Source:      M.SocksaddrFromNet(header.SourceAddr).Unwrap(),
+			Destination: M.SocksaddrFromNet(header.DestinationAddr).Unwrap(),
+		}}, nil
+	}
+	return conn, nil
 }

common/redir/tproxy_linux.go

@@ -2,14 +2,11 @@ package redir
 
 import (
 	"encoding/binary"
-	"net"
 	"net/netip"
-	"os"
-	"strconv"
 	"syscall"
 
+	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
 	M "github.com/sagernet/sing/common/metadata"
 
 	"golang.org/x/sys/unix"
@@ -32,6 +29,18 @@ func TProxy(fd uintptr, isIPv6 bool) error {
 	return err
 }
 
+func TProxyWriteBack() control.Func {
+	return func(network, address string, conn syscall.RawConn) error {
+		return control.Raw(conn, func(fd uintptr) error {
+			if M.ParseSocksaddr(address).Addr.Is6() {
+				return syscall.SetsockoptInt(int(fd), syscall.SOL_IPV6, unix.IPV6_TRANSPARENT, 1)
+			} else {
+				return syscall.SetsockoptInt(int(fd), syscall.SOL_IP, syscall.IP_TRANSPARENT, 1)
+			}
+		})
+	}
+}
+
 func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	controlMessages, err := unix.ParseSocketControlMessage(oob)
 	if err != nil {
@@ -46,79 +55,3 @@ func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	}
 	return netip.AddrPort{}, E.New("not found")
 }
-
-func DialUDP(lAddr *net.UDPAddr, rAddr *net.UDPAddr) (*net.UDPConn, error) {
-	rSockAddr, err := udpAddrToSockAddr(rAddr)
-	if err != nil {
-		return nil, err
-	}
-
-	lSockAddr, err := udpAddrToSockAddr(lAddr)
-	if err != nil {
-		return nil, err
-	}
-
-	fd, err := syscall.Socket(udpAddrFamily(lAddr, rAddr), syscall.SOCK_DGRAM, 0)
-	if err != nil {
-		return nil, err
-	}
-
-	if err = syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
-		syscall.Close(fd)
-		return nil, err
-	}
-
-	if err = syscall.SetsockoptInt(fd, syscall.SOL_IP, syscall.IP_TRANSPARENT, 1); err != nil {
-		syscall.Close(fd)
-		return nil, err
-	}
-
-	if err = syscall.Bind(fd, lSockAddr); err != nil {
-		syscall.Close(fd)
-		return nil, err
-	}
-
-	if err = syscall.Connect(fd, rSockAddr); err != nil {
-		syscall.Close(fd)
-		return nil, err
-	}
-
-	fdFile := os.NewFile(uintptr(fd), F.ToString("net-udp-dial-", rAddr))
-	defer fdFile.Close()
-
-	c, err := net.FileConn(fdFile)
-	if err != nil {
-		syscall.Close(fd)
-		return nil, err
-	}
-
-	return c.(*net.UDPConn), nil
-}
-
-func udpAddrToSockAddr(addr *net.UDPAddr) (syscall.Sockaddr, error) {
-	switch {
-	case addr.IP.To4() != nil:
-		ip := [4]byte{}
-		copy(ip[:], addr.IP.To4())
-
-		return &syscall.SockaddrInet4{Addr: ip, Port: addr.Port}, nil
-
-	default:
-		ip := [16]byte{}
-		copy(ip[:], addr.IP.To16())
-
-		zoneID, err := strconv.ParseUint(addr.Zone, 10, 32)
-		if err != nil {
-			zoneID = 0
-		}
-
-		return &syscall.SockaddrInet6{Addr: ip, Port: addr.Port, ZoneId: uint32(zoneID)}, nil
-	}
-}
-
-func udpAddrFamily(lAddr, rAddr *net.UDPAddr) int {
-	if (lAddr == nil || lAddr.IP.To4() != nil) && (rAddr == nil || lAddr.IP.To4() != nil) {
-		return syscall.AF_INET
-	}
-	return syscall.AF_INET6
-}

common/redir/tproxy_other.go

@@ -3,19 +3,20 @@
 package redir
 
 import (
-	"net"
 	"net/netip"
 	"os"
+
+	"github.com/sagernet/sing/common/control"
 )
 
 func TProxy(fd uintptr, isIPv6 bool) error {
 	return os.ErrInvalid
 }
 
+func TProxyWriteBack() control.Func {
+	return nil
+}
+
 func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	return netip.AddrPort{}, os.ErrInvalid
 }
-
-func DialUDP(lAddr *net.UDPAddr, rAddr *net.UDPAddr) (*net.UDPConn, error) {
-	return nil, os.ErrInvalid
-}

common/settings/proxy_darwin.go

@@ -20,7 +20,7 @@ type systemProxy struct {
 	isMixed       bool
 }
 
-func (p *systemProxy) update() error {
+func (p *systemProxy) update(event int) error {
 	newInterfaceName := p.monitor.DefaultInterfaceName(netip.IPv4Unspecified())
 	if p.interfaceName == newInterfaceName {
 		return nil
@@ -88,7 +88,7 @@ func SetSystemProxy(router adapter.Router, port uint16, isMixed bool) (func() er
 		port:    port,
 		isMixed: isMixed,
 	}
-	err := proxy.update()
+	err := proxy.update(tun.EventInterfaceUpdate)
 	if err != nil {
 		return nil, err
 	}

common/sniff/dns.go

@@ -11,9 +11,10 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/buf"
+	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/task"
 
-	"golang.org/x/net/dns/dnsmessage"
+	mDNS "github.com/miekg/dns"
 )
 
 func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.InboundContext, error) {
@@ -44,18 +45,13 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 }
 
 func DomainNameQuery(ctx context.Context, packet []byte) (*adapter.InboundContext, error) {
-	var parser dnsmessage.Parser
-	_, err := parser.Start(packet)
+	var msg mDNS.Msg
+	err := msg.Unpack(packet)
 	if err != nil {
 		return nil, err
 	}
-	question, err := parser.Question()
-	if err != nil {
+	if len(msg.Question) == 0 || msg.Question[0].Qclass != mDNS.ClassINET || !M.IsDomainName(msg.Question[0].Name) {
 		return nil, os.ErrInvalid
 	}
-	domain := question.Name.String()
-	if question.Class == dnsmessage.ClassINET && IsDomainName(domain) {
-		return &adapter.InboundContext{Protocol: C.ProtocolDNS /*, Domain: domain*/}, nil
-	}
-	return nil, os.ErrInvalid
+	return &adapter.InboundContext{Protocol: C.ProtocolDNS}, nil
 }

common/sniff/domain.go

@@ -1,6 +0,0 @@
-package sniff
-
-import _ "unsafe" // for linkname
-
-//go:linkname IsDomainName net.isDomainName
-func IsDomainName(domain string) bool

common/tls/acme.go

@@ -1,17 +1,17 @@
 //go:build with_acme
 
-package inbound
+package tls
 
 import (
 	"context"
 	"crypto/tls"
 	"strings"
 
-	"github.com/sagernet/certmagic"
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 
+	"github.com/caddyserver/certmagic"
 	"github.com/mholt/acmez/acme"
 )
 

common/tls/acme_stub.go

@@ -1,6 +1,6 @@
 //go:build !with_acme
 
-package inbound
+package tls
 
 import (
 	"context"

common/tls/client.go

@@ -0,0 +1,75 @@
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/badtls"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+func NewDialerFromOptions(router adapter.Router, dialer N.Dialer, serverAddress string, options option.OutboundTLSOptions) (N.Dialer, error) {
+	config, err := NewClient(router, serverAddress, options)
+	if err != nil {
+		return nil, err
+	}
+	return NewDialer(dialer, config), nil
+}
+
+func NewClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+	if options.ECH != nil && options.ECH.Enabled {
+		return newECHClient(router, serverAddress, options)
+	} else if options.UTLS != nil && options.UTLS.Enabled {
+		return newUTLSClient(router, serverAddress, options)
+	} else {
+		return newStdClient(serverAddress, options)
+	}
+}
+
+func ClientHandshake(ctx context.Context, conn net.Conn, config Config) (Conn, error) {
+	tlsConn := config.Client(conn)
+	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
+	defer cancel()
+	err := tlsConn.HandshakeContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if stdConn, isSTD := tlsConn.(*tls.Conn); isSTD {
+		var badConn badtls.TLSConn
+		badConn, err = badtls.Create(stdConn)
+		if err == nil {
+			return badConn, nil
+		}
+	}
+	return tlsConn, nil
+}
+
+type Dialer struct {
+	dialer N.Dialer
+	config Config
+}
+
+func NewDialer(dialer N.Dialer, config Config) N.Dialer {
+	return &Dialer{dialer, config}
+}
+
+func (d *Dialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	if network != N.NetworkTCP {
+		return nil, os.ErrInvalid
+	}
+	conn, err := d.dialer.DialContext(ctx, network, destination)
+	if err != nil {
+		return nil, err
+	}
+	return ClientHandshake(ctx, conn, d.config)
+}
+
+func (d *Dialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return nil, os.ErrInvalid
+}

common/tls/common.go

@@ -0,0 +1,12 @@
+package tls
+
+const (
+	VersionTLS10 = 0x0301
+	VersionTLS11 = 0x0302
+	VersionTLS12 = 0x0303
+	VersionTLS13 = 0x0304
+
+	// Deprecated: SSLv3 is cryptographically broken, and is no longer
+	// supported by this package. See golang.org/issue/32716.
+	VersionSSL30 = 0x0300
+)

common/tls/config.go

@@ -0,0 +1,49 @@
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/sagernet/sing-box/adapter"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+type (
+	STDConfig = tls.Config
+	STDConn   = tls.Conn
+)
+
+type Config interface {
+	NextProtos() []string
+	SetNextProtos(nextProto []string)
+	Config() (*STDConfig, error)
+	Client(conn net.Conn) Conn
+}
+
+type ServerConfig interface {
+	Config
+	adapter.Service
+	Server(conn net.Conn) Conn
+}
+
+type Conn interface {
+	net.Conn
+	HandshakeContext(ctx context.Context) error
+	ConnectionState() tls.ConnectionState
+}
+
+func ParseTLSVersion(version string) (uint16, error) {
+	switch version {
+	case "1.0":
+		return tls.VersionTLS10, nil
+	case "1.1":
+		return tls.VersionTLS11, nil
+	case "1.2":
+		return tls.VersionTLS12, nil
+	case "1.3":
+		return tls.VersionTLS13, nil
+	default:
+		return 0, E.New("unknown tls version:", version)
+	}
+}

common/tls/ech_client.go

@@ -0,0 +1,207 @@
+//go:build with_ech
+
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"net"
+	"net/netip"
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/option"
+	cftls "github.com/sagernet/sing-box/transport/cloudflaretls"
+	"github.com/sagernet/sing-dns"
+	E "github.com/sagernet/sing/common/exceptions"
+
+	mDNS "github.com/miekg/dns"
+)
+
+type echClientConfig struct {
+	config *cftls.Config
+}
+
+func (e *echClientConfig) NextProtos() []string {
+	return e.config.NextProtos
+}
+
+func (e *echClientConfig) SetNextProtos(nextProto []string) {
+	e.config.NextProtos = nextProto
+}
+
+func (e *echClientConfig) Config() (*STDConfig, error) {
+	return nil, E.New("unsupported usage for ECH")
+}
+
+func (e *echClientConfig) Client(conn net.Conn) Conn {
+	return &echConnWrapper{cftls.Client(conn, e.config)}
+}
+
+type echConnWrapper struct {
+	*cftls.Conn
+}
+
+func (c *echConnWrapper) ConnectionState() tls.ConnectionState {
+	state := c.Conn.ConnectionState()
+	return tls.ConnectionState{
+		Version:                     state.Version,
+		HandshakeComplete:           state.HandshakeComplete,
+		DidResume:                   state.DidResume,
+		CipherSuite:                 state.CipherSuite,
+		NegotiatedProtocol:          state.NegotiatedProtocol,
+		NegotiatedProtocolIsMutual:  state.NegotiatedProtocolIsMutual,
+		ServerName:                  state.ServerName,
+		PeerCertificates:            state.PeerCertificates,
+		VerifiedChains:              state.VerifiedChains,
+		SignedCertificateTimestamps: state.SignedCertificateTimestamps,
+		OCSPResponse:                state.OCSPResponse,
+		TLSUnique:                   state.TLSUnique,
+	}
+}
+
+func newECHClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+	var serverName string
+	if options.ServerName != "" {
+		serverName = options.ServerName
+	} else if serverAddress != "" {
+		if _, err := netip.ParseAddr(serverName); err != nil {
+			serverName = serverAddress
+		}
+	}
+	if serverName == "" && !options.Insecure {
+		return nil, E.New("missing server_name or insecure=true")
+	}
+
+	var tlsConfig cftls.Config
+	if options.DisableSNI {
+		tlsConfig.ServerName = "127.0.0.1"
+	} else {
+		tlsConfig.ServerName = serverName
+	}
+	if options.Insecure {
+		tlsConfig.InsecureSkipVerify = options.Insecure
+	} else if options.DisableSNI {
+		tlsConfig.InsecureSkipVerify = true
+		tlsConfig.VerifyConnection = func(state cftls.ConnectionState) error {
+			verifyOptions := x509.VerifyOptions{
+				DNSName:       serverName,
+				Intermediates: x509.NewCertPool(),
+			}
+			for _, cert := range state.PeerCertificates[1:] {
+				verifyOptions.Intermediates.AddCert(cert)
+			}
+			_, err := state.PeerCertificates[0].Verify(verifyOptions)
+			return err
+		}
+	}
+	if len(options.ALPN) > 0 {
+		tlsConfig.NextProtos = options.ALPN
+	}
+	if options.MinVersion != "" {
+		minVersion, err := ParseTLSVersion(options.MinVersion)
+		if err != nil {
+			return nil, E.Cause(err, "parse min_version")
+		}
+		tlsConfig.MinVersion = minVersion
+	}
+	if options.MaxVersion != "" {
+		maxVersion, err := ParseTLSVersion(options.MaxVersion)
+		if err != nil {
+			return nil, E.Cause(err, "parse max_version")
+		}
+		tlsConfig.MaxVersion = maxVersion
+	}
+	if options.CipherSuites != nil {
+	find:
+		for _, cipherSuite := range options.CipherSuites {
+			for _, tlsCipherSuite := range cftls.CipherSuites() {
+				if cipherSuite == tlsCipherSuite.Name {
+					tlsConfig.CipherSuites = append(tlsConfig.CipherSuites, tlsCipherSuite.ID)
+					continue find
+				}
+			}
+			return nil, E.New("unknown cipher_suite: ", cipherSuite)
+		}
+	}
+	var certificate []byte
+	if options.Certificate != "" {
+		certificate = []byte(options.Certificate)
+	} else if options.CertificatePath != "" {
+		content, err := os.ReadFile(options.CertificatePath)
+		if err != nil {
+			return nil, E.Cause(err, "read certificate")
+		}
+		certificate = content
+	}
+	if len(certificate) > 0 {
+		certPool := x509.NewCertPool()
+		if !certPool.AppendCertsFromPEM(certificate) {
+			return nil, E.New("failed to parse certificate:\n\n", certificate)
+		}
+		tlsConfig.RootCAs = certPool
+	}
+
+	// ECH Config
+
+	tlsConfig.ECHEnabled = true
+	tlsConfig.PQSignatureSchemesEnabled = options.ECH.PQSignatureSchemesEnabled
+	tlsConfig.DynamicRecordSizingDisabled = options.ECH.DynamicRecordSizingDisabled
+	if options.ECH.Config != "" {
+		clientConfigContent, err := base64.StdEncoding.DecodeString(options.ECH.Config)
+		if err != nil {
+			return nil, err
+		}
+		clientConfig, err := cftls.UnmarshalECHConfigs(clientConfigContent)
+		if err != nil {
+			return nil, err
+		}
+		tlsConfig.ClientECHConfigs = clientConfig
+	} else {
+		tlsConfig.GetClientECHConfigs = fetchECHClientConfig(router)
+	}
+	return &echClientConfig{&tlsConfig}, nil
+}
+
+func fetchECHClientConfig(router adapter.Router) func(ctx context.Context, serverName string) ([]cftls.ECHConfig, error) {
+	return func(ctx context.Context, serverName string) ([]cftls.ECHConfig, error) {
+		message := &mDNS.Msg{
+			MsgHdr: mDNS.MsgHdr{
+				RecursionDesired: true,
+			},
+			Question: []mDNS.Question{
+				{
+					Name:   serverName + ".",
+					Qtype:  mDNS.TypeHTTPS,
+					Qclass: mDNS.ClassINET,
+				},
+			},
+		}
+		response, err := router.Exchange(ctx, message)
+		if err != nil {
+			return nil, err
+		}
+		if response.Rcode != mDNS.RcodeSuccess {
+			return nil, dns.RCodeError(response.Rcode)
+		}
+		for _, rr := range response.Answer {
+			switch resource := rr.(type) {
+			case *mDNS.HTTPS:
+				for _, value := range resource.Value {
+					if value.Key().String() == "ech" {
+						echConfig, err := base64.StdEncoding.DecodeString(value.String())
+						if err != nil {
+							return nil, E.Cause(err, "decode ECH config")
+						}
+						return cftls.UnmarshalECHConfigs(echConfig)
+					}
+				}
+			default:
+				return nil, E.New("unknown resource record type: ", resource.Header().Rrtype)
+			}
+		}
+		return nil, E.New("no ECH config found")
+	}
+}

common/tls/ech_stub.go

@@ -0,0 +1,13 @@
+//go:build !with_ech
+
+package tls
+
+import (
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/option"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func newECHClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+	return nil, E.New(`ECH is not included in this build, rebuild with -tags with_ech`)
+}

common/tls/mkcert.go

@@ -0,0 +1,50 @@
+package tls
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+)
+
+func GenerateKeyPair(serverName string) (*tls.Certificate, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, err
+	}
+	serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		return nil, err
+	}
+	template := &x509.Certificate{
+		SerialNumber:          serialNumber,
+		NotBefore:             time.Now().Add(time.Hour * -1),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		Subject: pkix.Name{
+			CommonName: serverName,
+		},
+		DNSNames: []string{serverName},
+	}
+	publicDer, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
+	if err != nil {
+		return nil, err
+	}
+	privateDer, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return nil, err
+	}
+	publicPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: publicDer})
+	privPem := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privateDer})
+	keyPair, err := tls.X509KeyPair(publicPem, privPem)
+	if err != nil {
+		return nil, err
+	}
+	return &keyPair, err
+}

common/tls/server.go

@@ -0,0 +1,34 @@
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/sagernet/sing-box/common/badtls"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+)
+
+func NewServer(ctx context.Context, logger log.Logger, options option.InboundTLSOptions) (ServerConfig, error) {
+	return newSTDServer(ctx, logger, options)
+}
+
+func ServerHandshake(ctx context.Context, conn net.Conn, config ServerConfig) (Conn, error) {
+	tlsConn := config.Server(conn)
+	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
+	defer cancel()
+	err := tlsConn.HandshakeContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if stdConn, isSTD := tlsConn.(*tls.Conn); isSTD {
+		var badConn badtls.TLSConn
+		badConn, err = badtls.Create(stdConn)
+		if err == nil {
+			return badConn, nil
+		}
+	}
+	return tlsConn, nil
+}

common/tls/std_client.go

@@ -1,34 +1,26 @@
-package dialer
+package tls
 
 import (
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"net"
 	"net/netip"
 	"os"
 
-	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
 )
 
-type TLSDialer struct {
-	dialer N.Dialer
+type stdClientConfig struct {
 	config *tls.Config
 }
 
-func TLSConfig(serverAddress string, options option.OutboundTLSOptions) (*tls.Config, error) {
-	if !options.Enabled {
-		return nil, nil
-	}
+func newStdClient(serverAddress string, options option.OutboundTLSOptions) (Config, error) {
 	var serverName string
 	if options.ServerName != "" {
 		serverName = options.ServerName
 	} else if serverAddress != "" {
-		if _, err := netip.ParseAddr(serverName); err == nil {
+		if _, err := netip.ParseAddr(serverName); err != nil {
 			serverName = serverAddress
 		}
 	}
@@ -62,14 +54,14 @@ func TLSConfig(serverAddress string, options option.OutboundTLSOptions) (*tls.Co
 		tlsConfig.NextProtos = options.ALPN
 	}
 	if options.MinVersion != "" {
-		minVersion, err := option.ParseTLSVersion(options.MinVersion)
+		minVersion, err := ParseTLSVersion(options.MinVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse min_version")
 		}
 		tlsConfig.MinVersion = minVersion
 	}
 	if options.MaxVersion != "" {
-		maxVersion, err := option.ParseTLSVersion(options.MaxVersion)
+		maxVersion, err := ParseTLSVersion(options.MaxVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse max_version")
 		}
@@ -104,42 +96,21 @@ func TLSConfig(serverAddress string, options option.OutboundTLSOptions) (*tls.Co
 		}
 		tlsConfig.RootCAs = certPool
 	}
-	return &tlsConfig, nil
+	return &stdClientConfig{&tlsConfig}, nil
 }
 
-func NewTLS(dialer N.Dialer, serverAddress string, options option.OutboundTLSOptions) (N.Dialer, error) {
-	if !options.Enabled {
-		return dialer, nil
-	}
-	tlsConfig, err := TLSConfig(serverAddress, options)
-	if err != nil {
-		return nil, err
-	}
-	return &TLSDialer{
-		dialer: dialer,
-		config: tlsConfig,
-	}, nil
+func (s *stdClientConfig) NextProtos() []string {
+	return s.config.NextProtos
 }
 
-func (d *TLSDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	if network != N.NetworkTCP {
-		return nil, os.ErrInvalid
-	}
-	conn, err := d.dialer.DialContext(ctx, network, destination)
-	if err != nil {
-		return nil, err
-	}
-	return TLSClient(ctx, conn, d.config)
+func (s *stdClientConfig) SetNextProtos(nextProto []string) {
+	s.config.NextProtos = nextProto
 }
 
-func (d *TLSDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	return nil, os.ErrInvalid
+func (s *stdClientConfig) Config() (*STDConfig, error) {
+	return s.config, nil
 }
 
-func TLSClient(ctx context.Context, conn net.Conn, tlsConfig *tls.Config) (*tls.Conn, error) {
-	tlsConn := tls.Client(conn, tlsConfig)
-	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
-	defer cancel()
-	err := tlsConn.HandshakeContext(ctx)
-	return tlsConn, err
+func (s *stdClientConfig) Client(conn net.Conn) Conn {
+	return tls.Client(conn, s.config)
 }

common/tls/std_server.go

@@ -1,8 +1,9 @@
-package inbound
+package tls
 
 import (
 	"context"
 	"crypto/tls"
+	"net"
 	"os"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -14,9 +15,7 @@ import (
 	"github.com/fsnotify/fsnotify"
 )
 
-var _ adapter.Service = (*TLSConfig)(nil)
-
-type TLSConfig struct {
+type STDServerConfig struct {
 	config          *tls.Config
 	logger          log.Logger
 	acmeService     adapter.Service
@@ -27,105 +26,17 @@ type TLSConfig struct {
 	watcher         *fsnotify.Watcher
 }
 
-func (c *TLSConfig) Config() *tls.Config {
-	return c.config
+func (c *STDServerConfig) NextProtos() []string {
+	return c.config.NextProtos
 }
 
-func (c *TLSConfig) Start() error {
-	if c.acmeService != nil {
-		return c.acmeService.Start()
-	} else {
-		if c.certificatePath == "" && c.keyPath == "" {
-			return nil
-		}
-		err := c.startWatcher()
-		if err != nil {
-			c.logger.Warn("create fsnotify watcher: ", err)
-		}
-		return nil
-	}
+func (c *STDServerConfig) SetNextProtos(nextProto []string) {
+	c.config.NextProtos = nextProto
 }
 
-func (c *TLSConfig) startWatcher() error {
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		return err
-	}
-	if c.certificatePath != "" {
-		err = watcher.Add(c.certificatePath)
-		if err != nil {
-			return err
-		}
-	}
-	if c.keyPath != "" {
-		err = watcher.Add(c.keyPath)
-		if err != nil {
-			return err
-		}
-	}
-	c.watcher = watcher
-	go c.loopUpdate()
-	return nil
-}
+var errInsecureUnused = E.New("tls: insecure unused")
 
-func (c *TLSConfig) loopUpdate() {
-	for {
-		select {
-		case event, ok := <-c.watcher.Events:
-			if !ok {
-				return
-			}
-			if event.Op&fsnotify.Write != fsnotify.Write {
-				continue
-			}
-			err := c.reloadKeyPair()
-			if err != nil {
-				c.logger.Error(E.Cause(err, "reload TLS key pair"))
-			}
-		case err, ok := <-c.watcher.Errors:
-			if !ok {
-				return
-			}
-			c.logger.Error(E.Cause(err, "fsnotify error"))
-		}
-	}
-}
-
-func (c *TLSConfig) reloadKeyPair() error {
-	if c.certificatePath != "" {
-		certificate, err := os.ReadFile(c.certificatePath)
-		if err != nil {
-			return E.Cause(err, "reload certificate from ", c.certificatePath)
-		}
-		c.certificate = certificate
-	}
-	if c.keyPath != "" {
-		key, err := os.ReadFile(c.keyPath)
-		if err != nil {
-			return E.Cause(err, "reload key from ", c.keyPath)
-		}
-		c.key = key
-	}
-	keyPair, err := tls.X509KeyPair(c.certificate, c.key)
-	if err != nil {
-		return E.Cause(err, "reload key pair")
-	}
-	c.config.Certificates = []tls.Certificate{keyPair}
-	c.logger.Info("reloaded TLS certificate")
-	return nil
-}
-
-func (c *TLSConfig) Close() error {
-	if c.acmeService != nil {
-		return c.acmeService.Close()
-	}
-	if c.watcher != nil {
-		return c.watcher.Close()
-	}
-	return nil
-}
-
-func NewTLSConfig(ctx context.Context, logger log.Logger, options option.InboundTLSOptions) (*TLSConfig, error) {
+func newSTDServer(ctx context.Context, logger log.Logger, options option.InboundTLSOptions) (ServerConfig, error) {
 	if !options.Enabled {
 		return nil, nil
 	}
@@ -134,9 +45,13 @@ func NewTLSConfig(ctx context.Context, logger log.Logger, options option.Inbound
 	var err error
 	if options.ACME != nil && len(options.ACME.Domain) > 0 {
 		tlsConfig, acmeService, err = startACME(ctx, common.PtrValueOrDefault(options.ACME))
+		//nolint:staticcheck
 		if err != nil {
 			return nil, err
 		}
+		if options.Insecure {
+			return nil, errInsecureUnused
+		}
 	} else {
 		tlsConfig = &tls.Config{}
 	}
@@ -147,14 +62,14 @@ func NewTLSConfig(ctx context.Context, logger log.Logger, options option.Inbound
 		tlsConfig.NextProtos = append(tlsConfig.NextProtos, options.ALPN...)
 	}
 	if options.MinVersion != "" {
-		minVersion, err := option.ParseTLSVersion(options.MinVersion)
+		minVersion, err := ParseTLSVersion(options.MinVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse min_version")
 		}
 		tlsConfig.MinVersion = minVersion
 	}
 	if options.MaxVersion != "" {
-		maxVersion, err := option.ParseTLSVersion(options.MaxVersion)
+		maxVersion, err := ParseTLSVersion(options.MaxVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse max_version")
 		}
@@ -193,19 +108,25 @@ func NewTLSConfig(ctx context.Context, logger log.Logger, options option.Inbound
 			}
 			key = content
 		}
-		if certificate == nil {
-			return nil, E.New("missing certificate")
+		if certificate == nil && key == nil && options.Insecure {
+			tlsConfig.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+				return GenerateKeyPair(info.ServerName)
+			}
+		} else {
+			if certificate == nil {
+				return nil, E.New("missing certificate")
+			} else if key == nil {
+				return nil, E.New("missing key")
+			}
+
+			keyPair, err := tls.X509KeyPair(certificate, key)
+			if err != nil {
+				return nil, E.Cause(err, "parse x509 key pair")
+			}
+			tlsConfig.Certificates = []tls.Certificate{keyPair}
 		}
-		if key == nil {
-			return nil, E.New("missing key")
-		}
-		keyPair, err := tls.X509KeyPair(certificate, key)
-		if err != nil {
-			return nil, E.Cause(err, "parse x509 key pair")
-		}
-		tlsConfig.Certificates = []tls.Certificate{keyPair}
 	}
-	return &TLSConfig{
+	return &STDServerConfig{
 		config:          tlsConfig,
 		logger:          logger,
 		acmeService:     acmeService,
@@ -215,3 +136,109 @@ func NewTLSConfig(ctx context.Context, logger log.Logger, options option.Inbound
 		keyPath:         options.KeyPath,
 	}, nil
 }
+
+func (c *STDServerConfig) Config() (*STDConfig, error) {
+	return c.config, nil
+}
+
+func (c *STDServerConfig) Client(conn net.Conn) Conn {
+	return tls.Client(conn, c.config)
+}
+
+func (c *STDServerConfig) Server(conn net.Conn) Conn {
+	return tls.Server(conn, c.config)
+}
+
+func (c *STDServerConfig) Start() error {
+	if c.acmeService != nil {
+		return c.acmeService.Start()
+	} else {
+		if c.certificatePath == "" && c.keyPath == "" {
+			return nil
+		}
+		err := c.startWatcher()
+		if err != nil {
+			c.logger.Warn("create fsnotify watcher: ", err)
+		}
+		return nil
+	}
+}
+
+func (c *STDServerConfig) startWatcher() error {
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return err
+	}
+	if c.certificatePath != "" {
+		err = watcher.Add(c.certificatePath)
+		if err != nil {
+			return err
+		}
+	}
+	if c.keyPath != "" {
+		err = watcher.Add(c.keyPath)
+		if err != nil {
+			return err
+		}
+	}
+	c.watcher = watcher
+	go c.loopUpdate()
+	return nil
+}
+
+func (c *STDServerConfig) loopUpdate() {
+	for {
+		select {
+		case event, ok := <-c.watcher.Events:
+			if !ok {
+				return
+			}
+			if event.Op&fsnotify.Write != fsnotify.Write {
+				continue
+			}
+			err := c.reloadKeyPair()
+			if err != nil {
+				c.logger.Error(E.Cause(err, "reload TLS key pair"))
+			}
+		case err, ok := <-c.watcher.Errors:
+			if !ok {
+				return
+			}
+			c.logger.Error(E.Cause(err, "fsnotify error"))
+		}
+	}
+}
+
+func (c *STDServerConfig) reloadKeyPair() error {
+	if c.certificatePath != "" {
+		certificate, err := os.ReadFile(c.certificatePath)
+		if err != nil {
+			return E.Cause(err, "reload certificate from ", c.certificatePath)
+		}
+		c.certificate = certificate
+	}
+	if c.keyPath != "" {
+		key, err := os.ReadFile(c.keyPath)
+		if err != nil {
+			return E.Cause(err, "reload key from ", c.keyPath)
+		}
+		c.key = key
+	}
+	keyPair, err := tls.X509KeyPair(c.certificate, c.key)
+	if err != nil {
+		return E.Cause(err, "reload key pair")
+	}
+	c.config.Certificates = []tls.Certificate{keyPair}
+	c.logger.Info("reloaded TLS certificate")
+	return nil
+}
+
+func (c *STDServerConfig) Close() error {
+	if c.acmeService != nil {
+		return c.acmeService.Close()
+	}
+	if c.watcher != nil {
+		return c.watcher.Close()
+	}
+	return nil
+}

common/tls/utls_client.go

@@ -0,0 +1,151 @@
+//go:build with_utls
+
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"net/netip"
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/option"
+	E "github.com/sagernet/sing/common/exceptions"
+
+	utls "github.com/refraction-networking/utls"
+)
+
+type utlsClientConfig struct {
+	config *utls.Config
+	id     utls.ClientHelloID
+}
+
+func (e *utlsClientConfig) NextProtos() []string {
+	return e.config.NextProtos
+}
+
+func (e *utlsClientConfig) SetNextProtos(nextProto []string) {
+	e.config.NextProtos = nextProto
+}
+
+func (e *utlsClientConfig) Config() (*STDConfig, error) {
+	return nil, E.New("unsupported usage for uTLS")
+}
+
+func (e *utlsClientConfig) Client(conn net.Conn) Conn {
+	return &utlsConnWrapper{utls.UClient(conn, e.config, e.id)}
+}
+
+type utlsConnWrapper struct {
+	*utls.UConn
+}
+
+func (c *utlsConnWrapper) HandshakeContext(ctx context.Context) error {
+	return c.Conn.Handshake()
+}
+
+func (c *utlsConnWrapper) ConnectionState() tls.ConnectionState {
+	state := c.Conn.ConnectionState()
+	return tls.ConnectionState{
+		Version:                     state.Version,
+		HandshakeComplete:           state.HandshakeComplete,
+		DidResume:                   state.DidResume,
+		CipherSuite:                 state.CipherSuite,
+		NegotiatedProtocol:          state.NegotiatedProtocol,
+		NegotiatedProtocolIsMutual:  state.NegotiatedProtocolIsMutual,
+		ServerName:                  state.ServerName,
+		PeerCertificates:            state.PeerCertificates,
+		VerifiedChains:              state.VerifiedChains,
+		SignedCertificateTimestamps: state.SignedCertificateTimestamps,
+		OCSPResponse:                state.OCSPResponse,
+		TLSUnique:                   state.TLSUnique,
+	}
+}
+
+func newUTLSClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+	var serverName string
+	if options.ServerName != "" {
+		serverName = options.ServerName
+	} else if serverAddress != "" {
+		if _, err := netip.ParseAddr(serverName); err != nil {
+			serverName = serverAddress
+		}
+	}
+	if serverName == "" && !options.Insecure {
+		return nil, E.New("missing server_name or insecure=true")
+	}
+
+	var tlsConfig utls.Config
+	if options.DisableSNI {
+		tlsConfig.ServerName = "127.0.0.1"
+	} else {
+		tlsConfig.ServerName = serverName
+	}
+	if options.Insecure {
+		tlsConfig.InsecureSkipVerify = options.Insecure
+	} else if options.DisableSNI {
+		return nil, E.New("disable_sni is unsupported in uTLS")
+	}
+	if len(options.ALPN) > 0 {
+		tlsConfig.NextProtos = options.ALPN
+	}
+	if options.MinVersion != "" {
+		minVersion, err := ParseTLSVersion(options.MinVersion)
+		if err != nil {
+			return nil, E.Cause(err, "parse min_version")
+		}
+		tlsConfig.MinVersion = minVersion
+	}
+	if options.MaxVersion != "" {
+		maxVersion, err := ParseTLSVersion(options.MaxVersion)
+		if err != nil {
+			return nil, E.Cause(err, "parse max_version")
+		}
+		tlsConfig.MaxVersion = maxVersion
+	}
+	if options.CipherSuites != nil {
+	find:
+		for _, cipherSuite := range options.CipherSuites {
+			for _, tlsCipherSuite := range tls.CipherSuites() {
+				if cipherSuite == tlsCipherSuite.Name {
+					tlsConfig.CipherSuites = append(tlsConfig.CipherSuites, tlsCipherSuite.ID)
+					continue find
+				}
+			}
+			return nil, E.New("unknown cipher_suite: ", cipherSuite)
+		}
+	}
+	var certificate []byte
+	if options.Certificate != "" {
+		certificate = []byte(options.Certificate)
+	} else if options.CertificatePath != "" {
+		content, err := os.ReadFile(options.CertificatePath)
+		if err != nil {
+			return nil, E.Cause(err, "read certificate")
+		}
+		certificate = content
+	}
+	if len(certificate) > 0 {
+		certPool := x509.NewCertPool()
+		if !certPool.AppendCertsFromPEM(certificate) {
+			return nil, E.New("failed to parse certificate:\n\n", certificate)
+		}
+		tlsConfig.RootCAs = certPool
+	}
+	var id utls.ClientHelloID
+	switch options.UTLS.Fingerprint {
+	case "chrome", "":
+		id = utls.HelloChrome_Auto
+	case "firefox":
+		id = utls.HelloFirefox_Auto
+	case "ios":
+		id = utls.HelloIOS_Auto
+	case "android":
+		id = utls.HelloAndroid_11_OkHttp
+	case "random":
+		id = utls.HelloRandomized
+	}
+	return &utlsClientConfig{&tlsConfig, id}, nil
+}

common/tls/utls_stub.go

@@ -0,0 +1,13 @@
+//go:build !with_utls
+
+package tls
+
+import (
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/option"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func newUTLSClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+	return nil, E.New(`uTLS is not included in this build, rebuild with -tags with_utls`)
+}

constant/err.go

@@ -3,3 +3,5 @@ package constant
 import E "github.com/sagernet/sing/common/exceptions"
 
 var ErrTLSRequired = E.New("TLS required")
+
+var ErrQUICNotIncluded = E.New(`QUIC is not included in this build, rebuild with -tags with_quic`)

constant/proxy.go

@@ -1,26 +1,29 @@
 package constant
 
 const (
-	TypeTun         = "tun"
-	TypeRedirect    = "redirect"
-	TypeTProxy      = "tproxy"
-	TypeDirect      = "direct"
-	TypeBlock       = "block"
-	TypeDNS         = "dns"
-	TypeSocks       = "socks"
-	TypeHTTP        = "http"
-	TypeMixed       = "mixed"
-	TypeShadowsocks = "shadowsocks"
-	TypeVMess       = "vmess"
-	TypeTrojan      = "trojan"
-	TypeNaive       = "naive"
-	TypeWireGuard   = "wireguard"
-	TypeHysteria    = "hysteria"
-	TypeTor         = "tor"
-	TypeSSH         = "ssh"
-	TypeShadowTLS   = "shadowtls"
+	TypeTun          = "tun"
+	TypeRedirect     = "redirect"
+	TypeTProxy       = "tproxy"
+	TypeDirect       = "direct"
+	TypeBlock        = "block"
+	TypeDNS          = "dns"
+	TypeSocks        = "socks"
+	TypeHTTP         = "http"
+	TypeMixed        = "mixed"
+	TypeShadowsocks  = "shadowsocks"
+	TypeVMess        = "vmess"
+	TypeTrojan       = "trojan"
+	TypeNaive        = "naive"
+	TypeWireGuard    = "wireguard"
+	TypeHysteria     = "hysteria"
+	TypeTor          = "tor"
+	TypeSSH          = "ssh"
+	TypeShadowTLS    = "shadowtls"
+	TypeShadowsocksR = "shadowsocksr"
+	TypeVLESS        = "vless"
 )
 
 const (
 	TypeSelector = "selector"
+	TypeURLTest  = "urltest"
 )

constant/quic.go

@@ -1,5 +0,0 @@
-//go:build with_quic
-
-package constant
-
-const QUIC_AVAILABLE = true

constant/quic_stub.go

@@ -1,9 +0,0 @@
-//go:build !with_quic
-
-package constant
-
-import E "github.com/sagernet/sing/common/exceptions"
-
-const QUIC_AVAILABLE = false
-
-var ErrQUICNotIncluded = E.New(`QUIC is not included in this build, rebuild with -tags with_quic`)

constant/timeout.go

@@ -3,10 +3,11 @@ package constant
 import "time"
 
 const (
-	TCPTimeout         = 5 * time.Second
-	ReadPayloadTimeout = 300 * time.Millisecond
-	DNSTimeout         = 10 * time.Second
-	QUICTimeout        = 30 * time.Second
-	STUNTimeout        = 15 * time.Second
-	UDPTimeout         = 5 * time.Minute
+	TCPTimeout             = 5 * time.Second
+	ReadPayloadTimeout     = 300 * time.Millisecond
+	DNSTimeout             = 10 * time.Second
+	QUICTimeout            = 30 * time.Second
+	STUNTimeout            = 15 * time.Second
+	UDPTimeout             = 5 * time.Minute
+	DefaultURLTestInterval = 1 * time.Minute
 )

constant/version.go

@@ -1,6 +1,3 @@
 package constant
 
-var (
-	Version = "1.0.1"
-	Commit  = ""
-)
+var Version = "1.1-beta9"

docs/changelog.md

@@ -1,3 +1,164 @@
+#### 1.1-beta9
+
+* Fix windows route **1**
+* Add [v2ray statistics api](/configuration/experimental#v2ray-api-fields)
+* Add ShadowTLS v2 support **2**
+* Fixes and improvements
+
+**1**:
+
+* Fix DNS leak caused by
+  Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
+* Flush Windows DNS cache when start/close
+
+**2**:
+
+See [ShadowTLS inbound](/configuration/inbound/shadowtls#version) and [ShadowTLS outbound](/configuration/outbound/shadowtls#version)
+
+#### 1.1-beta8
+
+* Fix leaks on close
+* Improve websocket writer
+* Refine tproxy write back
+* Refine 4in6 processing
+* Fix shadowsocks plugins
+* Fix missing source address from transport connection
+* Fix fqdn socks5 outbound connection
+* Fix read source address from grpc-go
+
+#### 1.0.5
+
+* Fix missing source address from transport connection
+* Fix fqdn socks5 outbound connection
+* Fix read source address from grpc-go
+
+#### 1.1-beta7
+
+* Add v2ray mux and XUDP support for VMess inbound
+* Add XUDP support for VMess outbound
+* Disable DF on direct outbound by default
+* Fix bugs in 1.1-beta6
+
+#### 1.1-beta6
+
+* Add [URLTest outbound](/configuration/outbound/urltest)
+* Fix bugs in 1.1-beta5
+
+#### 1.1-beta5
+
+* Print tags in version command
+* Redirect clash hello to external ui
+* Move shadowsocksr implementation to clash
+* Make gVisor optional **1**
+* Refactor to miekg/dns
+* Refactor bind control
+* Fix build on go1.18
+* Fix clash store-selected
+* Fix close grpc conn
+* Fix port rule match logic
+* Fix clash api proxy type
+
+*1*:
+
+The build tag `no_gvisor` is replaced by `with_gvisor`.
+
+The default tun stack is changed to system.
+
+#### 1.0.4
+
+* Fix close grpc conn
+* Fix port rule match logic
+* Fix clash api proxy type
+
+#### 1.1-beta4
+
+* Add internal simple-obfs and v2ray-plugin [Shadowsocks plugins](/configuration/outbound/shadowsocks#plugin)
+* Add [ShadowsocksR outbound](/configuration/outbound/shadowsocksr)
+* Add [VLESS outbound and XUDP](/configuration/outbound/vless)
+* Skip wait for hysteria tcp handshake response
+* Fix socks4 client
+* Fix hysteria inbound
+* Fix concurrent write
+
+#### 1.0.3
+
+* Fix socks4 client
+* Fix hysteria inbound
+* Fix concurrent write
+
+#### 1.1-beta3
+
+* Fix using custom TLS client in http2 client
+* Fix bugs in 1.1-beta2
+
+#### 1.1-beta2
+
+* Add Clash mode and persistence support **1**
+* Add TLS ECH and uTLS support for outbound TLS options **2**
+* Fix socks4 request
+* Fix processing empty dns result
+
+*1*:
+
+Switching modes using the Clash API, and `store-selected` are now supported,
+see [Experimental](/configuration/experimental).
+
+*2*:
+
+ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
+message, see [TLS#ECH](/configuration/shared/tls#ech).
+
+uTLS is a fork of "crypto/tls", which provides ClientHello fingerprinting resistance,
+see [TLS#uTLS](/configuration/shared/tls#utls).
+
+#### 1.0.2
+
+* Fix socks4 request
+* Fix processing empty dns result
+
+#### 1.1-beta1
+
+* Add support for use with android VPNService **1**
+* Add tun support for WireGuard outbound **2**
+* Add system tun stack **3**
+* Add comment filter for config **4**
+* Add option for allow optional proxy protocol header
+* Add half close for smux
+* Set UDP DF by default **5**
+* Set default tun mtu to 9000
+* Update gVisor to 20220905.0
+
+*1*:
+
+In previous versions, Android VPN would not work with tun enabled.
+
+The usage of tun over VPN and VPN over tun is now supported, see [Tun Inbound](/configuration/inbound/tun#auto_route).
+
+*2*:
+
+In previous releases, WireGuard outbound support was backed by the lower performance gVisor virtual interface.
+
+It achieves the same performance as wireguard-go by providing automatic system interface support.
+
+*3*:
+
+It does not depend on gVisor and has better performance in some cases.
+
+It is less compatible and may not be available in some environments.
+
+*4*:
+
+Annotated json configuration files are now supported.
+
+*5*:
+
+UDP fragmentation is now blocked by default.
+
+Including shadowsocks-libev, shadowsocks-rust and quic-go all disable segmentation by default.
+
+See [Dial Fields](/configuration/shared/dial#udp_fragment)
+and [Listen Fields](/configuration/shared/listen#udp_fragment).
+
 #### 1.0.1
 
 * Fix match 4in6 address in ip_cidr

docs/configuration/dns/rule.md

@@ -73,6 +73,7 @@
         "user_id": [
           1000
         ],
+        "clash_mode": "direct",
         "invert": false,
         "outbound": [
           "direct"
@@ -103,8 +104,10 @@
 
     The default rule uses the following matching logic:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
+    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    `other fields`  
+    (`source_port` || `source_port_range`) &&  
+    `other fields`
 
 #### inbound
 
@@ -208,6 +211,10 @@ Match user name.
 
 Match user id.
 
+#### clash_mode
+
+Match Clash mode.
+
 #### invert
 
 Invert match result.

docs/configuration/dns/rule.zh.md

@@ -72,6 +72,7 @@
         "user_id": [
           1000
         ],
+        "clash_mode": "direct",
         "invert": false,
         "outbound": [
           "direct"
@@ -102,8 +103,10 @@
 
     默认规则使用以下匹配逻辑:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
+    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    `other fields`  
+    (`source_port` || `source_port_range`) &&  
+    `other fields`
 
 #### inbound
 
@@ -207,6 +210,10 @@
 
 匹配用户 ID。
 
+#### clash_mode
+
+匹配 Clash 模式。
+
 #### invert
 
 反选匹配结果。

docs/configuration/experimental/index.md

@@ -8,25 +8,43 @@
     "clash_api": {
       "external_controller": "127.0.0.1:9090",
       "external_ui": "folder",
-      "secret": ""
+      "secret": "",
+      "direct_io": false,
+      "default_mode": "rule",
+      "store_selected": false,
+      "cache_file": "cache.db"
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "direct_io": false,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ]
+      }
     }
   }
 }
 ```
 
+!!! note ""
+
+    Traffic statistics and connection management can degrade performance.
+
 ### Clash API Fields
 
 !!! error ""
 
     Clash API is not included by default, see [Installation](/#installation).
 
-!!! note ""
-
-    Traffic statistics and connection management will disable TCP splice in linux and reduce performance, use at your own risk.
-
 #### external_controller
 
-RESTful web API listening address. Disabled if empty.
+RESTful web API listening address. Clash API will be disabled if empty.
 
 #### external_ui
 
@@ -38,4 +56,56 @@ serve it at `http://{{external-controller}}/ui`.
 
 Secret for the RESTful API (optional)
 Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
-ALWAYS set a secret if RESTful API is listening on 0.0.0.0
+ALWAYS set a secret if RESTful API is listening on 0.0.0.0
+
+#### direct_io
+
+Allows lossless relays like splice without real-time traffic reporting.
+
+#### default_mode
+
+Default mode in clash, `rule` will be used if empty.
+
+This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
+
+#### store_selected
+
+!!! note ""
+
+    The tag must be set for target outbounds.
+
+Store selected outbound for the `Selector` outbound in cache file.
+
+#### cache_file
+
+Cache file path, `cache.db` will be used if empty.
+
+### V2Ray API Fields
+
+!!! error ""
+
+    V2Ray API is not included by default, see [Installation](/#installation).
+
+#### listen
+
+gRPC API listening address. V2Ray API will be disabled if empty.
+
+#### stats
+
+Traffic statistics service settings.
+
+#### stats.enabled
+
+Enable statistics service.
+
+#### stats.direct_io
+
+Allows lossless relays like splice without real-time traffic reporting.
+
+#### stats.inbounds
+
+Inbound list to count traffic.
+
+#### stats.outbounds
+
+Outbound list to count traffic.

docs/configuration/experimental/index.zh.md

@@ -8,25 +8,43 @@
     "clash_api": {
       "external_controller": "127.0.0.1:9090",
       "external_ui": "folder",
-      "secret": ""
+      "secret": "",
+      "direct_io": false,
+      "default_mode": "rule",
+      "store_selected": false,
+      "cache_file": "cache.db"
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "direct_io": false,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ]
+      }
     }
   }
 }
 ```
 
+!!! note ""
+
+    流量统计和连接管理会降低性能。
+
 ### Clash API 字段
 
 !!! error ""
 
     默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
 
-!!! note ""
-
-    流量统计和连接管理将禁用 Linux 中的 TCP splice 并降低性能，使用风险自负。
-
 #### external_controller
 
-RESTful web API 监听地址。
+RESTful web API 监听地址。如果为空，则禁用 Clash API。
 
 #### external_ui
 
@@ -36,4 +54,56 @@ RESTful web API 监听地址。
 
 RESTful API 的密钥（可选）
 通过指定 HTTP 标头 `Authorization: Bearer ${secret}` 进行身份验证
-如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
+如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
+
+#### direct_io
+
+允许像 splice 这样的没有实时流量报告的无损中继。
+
+#### default_mode
+
+Clash 中的默认模式，默认使用 `rule`。
+
+此设置没有直接影响，但可以通过 `clash_mode` 规则项在路由和 DNS 规则中使用。
+
+#### store_selected
+
+!!! note ""
+
+    必须为目标出站设置标签。
+
+将 `Selector` 中出站的选定的目标出站存储在缓存文件中。
+
+#### cache_file
+
+缓存文件路径，默认使用`cache.db`。
+
+### V2Ray API 字段
+
+!!! error ""
+
+    默认安装不包含 V2Ray API，参阅 [安装](/zh/#_2)。
+
+#### listen
+
+gRPC API 监听地址。如果为空，则禁用 V2Ray API。
+
+#### stats
+
+流量统计服务设置。
+
+#### stats.enabled
+
+启用统计服务。
+
+#### stats.direct_io
+
+允许像 splice 这样的没有实时流量报告的无损中继。
+
+#### stats.inbounds
+
+统计流量的入站列表。
+
+#### stats.outbounds
+
+统计流量的出站列表。

docs/configuration/inbound/shadowtls.md

@@ -7,6 +7,8 @@
 
   ... // Listen Fields
 
+  "version": 2,
+  "password": "fuck me till the daylight",
   "handshake": {
     "server": "google.com",
     "server_port": 443,
@@ -20,12 +22,25 @@
 
 See [Listen Fields](/configuration/shared/listen) for details.
 
-
 ### Fields
 
+#### version
+
+ShadowTLS protocol version.
+
+| Value         | Protocol Version                                                                        |
+|---------------|-----------------------------------------------------------------------------------------|
+| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
+| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
+
+#### password
+
+Set password.
+
+Only available in the ShadowTLS v2 protocol.
+
 #### handshake
 
 ==Required==
 
-Handshake server address and [dial options](/configuration/shared/dial).
-
+Handshake server address and [Dial options](/configuration/shared/dial).

docs/configuration/inbound/shadowtls.zh.md

@@ -7,6 +7,8 @@
 
   ... // 监听字段
 
+  "version": 2,
+  "password": "fuck me till the daylight",
   "handshake": {
     "server": "google.com",
     "server_port": 443,
@@ -22,6 +24,21 @@
 
 ### 字段
 
+#### version
+
+ShadowTLS 协议版本。
+
+| 值             | 协议版本                                                                                    |
+|---------------|-----------------------------------------------------------------------------------------|
+| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
+| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
+
+#### password
+
+设置密码。
+
+仅在 ShadowTLS v2 协议中可用。
+
 #### handshake
 
 ==必填==

docs/configuration/inbound/tun.md

@@ -8,15 +8,14 @@
 {
   "type": "tun",
   "tag": "tun-in",
-  
   "interface_name": "tun0",
   "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/128",
-  "mtu": 1500,
+  "inet6_address": "fdfe:dcba:9876::1/126",
+  "mtu": 9000,
   "auto_route": true,
   "strict_route": true,
   "endpoint_independent_nat": false,
-  "stack": "gvisor",
+  "stack": "system",
   "include_uid": [
     0
   ],
@@ -39,8 +38,8 @@
   "exclude_package": [
     "com.android.captiveportallogin"
   ],
-
-  ... // Listen Fields
+  ...
+  // Listen Fields
 }
 ```
 
@@ -80,9 +79,15 @@ Set the default route to the Tun.
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
+!!! note "Use with Android VPN"
+
+    By default, VPN takes precedence over tun. To make tun go through VPN, enable `route.override_android_vpn`.
+
 #### strict_route
 
-Enforce strict routing rules in Linux when `auto_route` is enabled:
+*In Linux*:
+
+Enforce strict routing rules when `auto_route` is enabled:
 
 * Let unsupported network unreachable
 * Route all connections to tun
@@ -90,8 +95,16 @@ Enforce strict routing rules in Linux when `auto_route` is enabled:
 It prevents address leaks and makes DNS hijacking work on Android and Linux with systemd-resolved, but your device will
 not be accessible by others.
 
+*In Windows*:
+
+Use segmented `auto_route` routing settings, which may help if you're using a dial-up network.
+
 #### endpoint_independent_nat
 
+!!! info ""
+
+    This item is only available on the gvisor stack, other stacks are endpoint-independent NAT by default.
+
 Enable endpoint-independent NAT.
 
 Performance may degrade slightly, so it is not recommended to enable on when it is not needed.
@@ -104,14 +117,15 @@ UDP NAT expiration time in seconds, default is 300 (5 minutes).
 
 TCP/IP stack.
 
-| Stack            | Upstream                                                              | Status            |
-|------------------|-----------------------------------------------------------------------|-------------------|
-| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | recommended       |
-| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | upstream archived |
+| Stack            | Description                                                                      | Status            |
+|------------------|----------------------------------------------------------------------------------|-------------------|
+| system (default) | Sometimes better performance                                                     | recommended       |
+| gVisor           | Better compatibility, based on [google/gvisor](https://github.com/google/gvisor) | recommended       |
+| LWIP             | Based on [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks)   | upstream archived |
 
 !!! warning ""
 
-    The LWIP stack is not included by default, see [Installation](/#installation).
+    gVisor and LWIP stacks is not included by default, see [Installation](/#installation).
 
 #### include_uid
 

docs/configuration/inbound/tun.zh.md

@@ -11,12 +11,12 @@
 
   "interface_name": "tun0",
   "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/128",
-  "mtu": 1500,
+  "inet6_address": "fdfe:dcba:9876::1/126",
+  "mtu": 9000,
   "auto_route": true,
   "strict_route": true,
   "endpoint_independent_nat": false,
-  "stack": "gvisor",
+  "stack": "system",
   "include_uid": [
     0
   ],
@@ -80,15 +80,25 @@ tun 接口的 IPv6 前缀。
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
+!!! note "与 Android VPN 一起使用"
+
+    VPN 默认优先于 tun。要使 tun 经过 VPN，启用 `route.override_android_vpn`。
+
 #### strict_route
 
-在 Linux 中启用 `auto_route` 时执行严格的路由规则。
+*在 Linux 中*:
+
+启用 `auto_route` 时执行严格的路由规则。
 
 * 让不支持的网络无法到达
 * 将所有连接路由到 tun
 
 它可以防止地址泄漏，并使 DNS 劫持在 Android 和使用 systemd-resolved 的 Linux 上工作，但你的设备将无法其他设备被访问。
 
+*在 Windows 中*:
+
+使用分段的 `auto_route` 路由设置，如果您使用的是拨号网络，这可能会有所帮助。
+
 #### endpoint_independent_nat
 
 启用独立于端点的 NAT。
@@ -103,14 +113,15 @@ UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
 
 TCP/IP 栈。
 
-| 栈                | 上游                                                                    | 状态    |
-|------------------|-----------------------------------------------------------------------|-------|
-| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | 推荐    |
-| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
+| 栈           | 描述                                                                       | 状态    |
+|-------------|--------------------------------------------------------------------------|-------|
+| system （默认） | 有时性能更好                                                                   | 推荐    |
+| gVisor      | 兼容性较好，基于 [google/gvisor](https://github.com/google/gvisor)               | 推荐    |
+| LWIP        | 基于 [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
 
 !!! warning ""
 
-    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 gVisor 和 LWIP 栈，请参阅 [安装](/zh/#_2)。
 
 #### include_uid
 
@@ -140,10 +151,10 @@ TCP/IP 栈。
 
 限制被路由的 Android 用户。
 
-| 常用用户 | ID  |
+| 常用用户 | ID |
 |--|-----|
-| 您 | 0   |
-| 工作资料 | 10  |
+| 您 | 0 |
+| 工作资料 | 10 |
 
 #### include_package
 

docs/configuration/outbound/index.md

@@ -15,21 +15,24 @@
 
 ### Fields
 
-| Type          | Format                       |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `block`       | [Block](./block)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `wireguard`   | [Wireguard](./wireguard)     |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tor`         | [Tor](./tor)                 |
-| `ssh`         | [SSH](./ssh)                 |
-| `dns`         | [DNS](./dns)                 |
-| `selector`    | [Selector](./selector)       |
+| Type           | Format                         |
+|----------------|--------------------------------|
+| `direct`       | [Direct](./direct)             |
+| `block`        | [Block](./block)               |
+| `socks`        | [SOCKS](./socks)               |
+| `http`         | [HTTP](./http)                 |
+| `shadowsocks`  | [Shadowsocks](./shadowsocks)   |
+| `vmess`        | [VMess](./vmess)               |
+| `trojan`       | [Trojan](./trojan)             |
+| `wireguard`    | [Wireguard](./wireguard)       |
+| `hysteria`     | [Hysteria](./hysteria)         |
+| `shadowsocksr` | [ShadowsocksR](./shadowsocksr) |
+| `vless`        | [VLESS](./vless)               |
+| `tor`          | [Tor](./tor)                   |
+| `ssh`          | [SSH](./ssh)                   |
+| `dns`          | [DNS](./dns)                   |
+| `selector`     | [Selector](./selector)         |
+| `urltest`      | [URLTest](./urltest)           |
 
 #### tag
 

docs/configuration/outbound/index.zh.md

@@ -15,21 +15,24 @@
 
 ### 字段
 
-| 类型            | 格式                           |
-|---------------|------------------------------|
-| `direct`      | [Direct](./direct)           |
-| `block`       | [Block](./block)             |
-| `socks`       | [SOCKS](./socks)             |
-| `http`        | [HTTP](./http)               |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) |
-| `vmess`       | [VMess](./vmess)             |
-| `trojan`      | [Trojan](./trojan)           |
-| `wireguard`   | [Wireguard](./wireguard)     |
-| `hysteria`    | [Hysteria](./hysteria)       |
-| `tor`         | [Tor](./tor)                 |
-| `ssh`         | [SSH](./ssh)                 |
-| `dns`         | [DNS](./dns)                 |
-| `selector`    | [Selector](./selector)       |
+| 类型             | 格式                             |
+|----------------|--------------------------------|
+| `direct`       | [Direct](./direct)             |
+| `block`        | [Block](./block)               |
+| `socks`        | [SOCKS](./socks)               |
+| `http`         | [HTTP](./http)                 |
+| `shadowsocks`  | [Shadowsocks](./shadowsocks)   |
+| `vmess`        | [VMess](./vmess)               |
+| `trojan`       | [Trojan](./trojan)             |
+| `wireguard`    | [Wireguard](./wireguard)       |
+| `hysteria`     | [Hysteria](./hysteria)         |
+| `shadowsocksr` | [ShadowsocksR](./shadowsocksr) |
+| `vless`        | [VLESS](./vless)               |
+| `tor`          | [Tor](./tor)                   |
+| `ssh`          | [SSH](./ssh)                   |
+| `dns`          | [DNS](./dns)                   |
+| `selector`     | [Selector](./selector)         |
+| `urltest`      | [URLTest](./urltest)           |
 
 #### tag
 

docs/configuration/outbound/shadowsocks.md

@@ -9,6 +9,8 @@
   "server_port": 1080,
   "method": "2022-blake3-aes-128-gcm",
   "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "plugin": "",
+  "plugin_opts": "",
   "network": "udp",
   "udp_over_tcp": false,
   "multiplex": {},
@@ -65,6 +67,16 @@ Legacy encryption methods:
 
 The shadowsocks password.
 
+#### plugin
+
+Shadowsocks SIP003 plugin, implemented in internal.
+
+Only `obfs-local` and `v2ray-plugin` are supported.
+
+#### plugin_opts
+
+Shadowsocks SIP003 plugin options.
+
 #### network
 
 Enabled network

docs/configuration/outbound/shadowsocks.zh.md

@@ -9,6 +9,8 @@
   "server_port": 1080,
   "method": "2022-blake3-aes-128-gcm",
   "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "plugin": "",
+  "plugin_opts": "",
   "network": "udp",
   "udp_over_tcp": false,
   "multiplex": {},
@@ -65,6 +67,16 @@
 
 Shadowsocks 密码。
 
+#### plugin
+
+Shadowsocks SIP003 插件，由内部实现。
+
+仅支持 `obfs-local` 和 `v2ray-plugin`。
+
+#### plugin_opts
+
+Shadowsocks SIP003 插件参数。
+
 #### network
 
 启用的网络协议

docs/configuration/outbound/shadowsocksr.md

@@ -0,0 +1,106 @@
+### Structure
+
+```json
+{
+  "type": "shadowsocksr",
+  "tag": "ssr-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "aes-128-cfb",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "obfs": "plain",
+  "obfs_param": "",
+  "protocol": "origin",
+  "protocol_param": "",
+  "network": "udp",
+
+  ... // Dial Fields
+}
+```
+
+!!! warning ""
+
+    The ShadowsocksR protocol is obsolete and unmaintained. This outbound is provided for compatibility only.
+
+!!! warning ""
+
+    ShadowsocksR is not included by default, see [Installation](/#installation).
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### method
+
+==Required==
+
+Encryption methods:
+
+* `aes-128-ctr`
+* `aes-192-ctr`
+* `aes-256-ctr`
+* `aes-128-cfb`
+* `aes-192-cfb`
+* `aes-256-cfb`
+* `rc4-md5`
+* `chacha20-ietf`
+* `xchacha20`
+
+#### password
+
+==Required==
+
+The shadowsocks password.
+
+#### obfs
+
+The ShadowsocksR obfuscate.
+
+* plain
+* http_simple
+* http_post
+* random_head
+* tls1.2_ticket_auth
+
+#### obfs_param
+
+The ShadowsocksR obfuscate parameter.
+
+#### protocol
+
+The ShadowsocksR protocol.
+
+* origin
+* verify_sha1
+* auth_sha1_v4
+* auth_aes128_md5
+* auth_aes128_sha1
+* auth_chain_a
+* auth_chain_b
+
+#### protocol_param
+
+The ShadowsocksR protocol parameter.
+
+#### network
+
+Enabled network
+
+One of `tcp` `udp`.
+
+Both is enabled by default.
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowsocksr.zh.md

@@ -0,0 +1,106 @@
+### 结构
+
+```json
+{
+  "type": "shadowsocksr",
+  "tag": "ssr-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "method": "aes-128-cfb",
+  "password": "8JCsPssfgS8tiRwiMlhARg==",
+  "obfs": "plain",
+  "obfs_param": "",
+  "protocol": "origin",
+  "protocol_param": "",
+  "network": "udp",
+
+  ... // 拨号字段
+}
+```
+
+!!! warning ""
+
+    ShadowsocksR 协议已过时且无人维护。 提供此出站仅出于兼容性目的。
+
+!!! warning ""
+
+    默认安装不包含被 ShadowsocksR，参阅 [安装](/zh/#_2)。
+
+### 字段
+
+#### server
+
+==必填==
+
+服务器地址。
+
+#### server_port
+
+==必填==
+
+服务器端口。
+
+#### method
+
+==必填==
+
+加密方法：
+
+* `aes-128-ctr`
+* `aes-192-ctr`
+* `aes-256-ctr`
+* `aes-128-cfb`
+* `aes-192-cfb`
+* `aes-256-cfb`
+* `rc4-md5`
+* `chacha20-ietf`
+* `xchacha20`
+
+#### password
+
+==必填==
+
+Shadowsocks 密码。
+
+#### obfs
+
+ShadowsocksR 混淆。
+
+* plain
+* http_simple
+* http_post
+* random_head
+* tls1.2_ticket_auth
+
+#### obfs_param
+
+ShadowsocksR 混淆参数。
+
+#### protocol
+
+ShadowsocksR 协议。
+
+* origin
+* verify_sha1
+* auth_sha1_v4
+* auth_aes128_md5
+* auth_aes128_sha1
+* auth_chain_a
+* auth_chain_b
+
+#### protocol_param
+
+ShadowsocksR 协议参数。
+
+#### network
+
+启用的网络协议
+
+`tcp` 或 `udp`。
+
+默认所有。
+
+### 拨号字段
+
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/shadowtls.md

@@ -7,6 +7,8 @@
   
   "server": "127.0.0.1",
   "server_port": 1080,
+  "version": 2,
+  "password": "fuck me till the daylight",
   "tls": {},
 
   ... // Dial Fields
@@ -27,6 +29,21 @@ The server address.
 
 The server port.
 
+#### version
+
+ShadowTLS protocol version.
+
+| Value         | Protocol Version                                                                        |
+|---------------|-----------------------------------------------------------------------------------------|
+| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
+| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
+
+#### password
+
+Set password.
+
+Only available in the ShadowTLS v2 protocol.
+
 #### tls
 
 ==Required==

docs/configuration/outbound/shadowtls.zh.md

@@ -7,6 +7,8 @@
   
   "server": "127.0.0.1",
   "server_port": 1080,
+  "version": 2,
+  "password": "fuck me till the daylight",
   "tls": {},
 
   ... // 拨号字段
@@ -27,6 +29,21 @@
 
 服务器端口。
 
+#### version
+
+ShadowTLS 协议版本。
+
+| 值             | 协议版本                                                                                    |
+|---------------|-----------------------------------------------------------------------------------------|
+| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
+| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
+
+#### password
+
+设置密码。
+
+仅在 ShadowTLS v2 协议中可用。
+
 #### tls
 
 ==必填==

docs/configuration/outbound/urltest.md

@@ -0,0 +1,37 @@
+### Structure
+
+```json
+{
+  "type": "urltest",
+  "tag": "auto",
+  
+  "outbounds": [
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "url": "http://www.gstatic.com/generate_204",
+  "interval": "1m",
+  "tolerance": 50
+}
+```
+
+### Fields
+
+#### outbounds
+
+==Required==
+
+List of outbound tags to test.
+
+#### url
+
+The URL to test. `http://www.gstatic.com/generate_204` will be used if empty.
+
+#### interval
+
+The test interval. `1m` will be used if empty.
+
+#### tolerance
+
+The test tolerance in milliseconds. `50` will be used if empty.

docs/configuration/outbound/urltest.zh.md

@@ -0,0 +1,37 @@
+### 结构
+
+```json
+{
+  "type": "urltest",
+  "tag": "auto",
+  
+  "outbounds": [
+    "proxy-a",
+    "proxy-b",
+    "proxy-c"
+  ],
+  "url": "http://www.gstatic.com/generate_204",
+  "interval": "1m",
+  "tolerance": 50
+}
+```
+
+### 字段
+
+#### outbounds
+
+==必填==
+
+用于测试的出站标签列表。
+
+#### url
+
+用于测试的链接。默认使用 `http://www.gstatic.com/generate_204`。
+
+#### interval
+
+测试间隔。 默认使用 `1m`。
+
+#### tolerance
+
+以毫秒为单位的测试容差。 默认使用 `50`。

docs/configuration/outbound/vless.md

@@ -0,0 +1,70 @@
+### Structure
+
+```json
+{
+  "type": "vless",
+  "tag": "vless-out",
+  
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "network": "tcp",
+  "tls": {},
+  "packet_encoding": "",
+  "transport": {},
+
+  ... // Dial Fields
+}
+```
+
+!!! warning ""
+
+    The VLESS protocol is architecturally coupled to v2ray and is unmaintained. This outbound is provided for compatibility purposes only.
+
+### Fields
+
+#### server
+
+==Required==
+
+The server address.
+
+#### server_port
+
+==Required==
+
+The server port.
+
+#### uuid
+
+==Required==
+
+The VLESS user id.
+
+#### network
+
+Enabled network
+
+One of `tcp` `udp`.
+
+Both is enabled by default.
+
+#### tls
+
+TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
+
+#### packet_encoding
+
+| Encoding   | Description           |
+|------------|-----------------------|
+| (none)     | Disabled              |
+| packetaddr | Supported by v2ray 5+ |
+| xudp       | Supported by xray     |
+
+#### transport
+
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
+
+### Dial Fields
+
+See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/vless.zh.md

@@ -0,0 +1,70 @@
+### 结构
+
+```json
+{
+  "type": "vless",
+  "tag": "vless-out",
+
+  "server": "127.0.0.1",
+  "server_port": 1080,
+  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+  "network": "tcp",
+  "tls": {},
+  "packet_encoding": "",
+  "transport": {},
+  
+  ... // 拨号字段
+}
+```
+
+!!! warning ""
+
+    VLESS 协议与 v2ray 架构耦合且无人维护。 提供此出站仅出于兼容性目的。
+
+### 字段
+
+#### server
+
+==必填==
+
+服务器地址。
+
+#### server_port
+
+==必填==
+
+服务器端口。
+
+#### uuid
+
+==必填==
+
+VLESS 用户 ID。
+
+#### network
+
+启用的网络协议。
+
+`tcp` 或 `udp`。
+
+默认所有。
+
+#### tls
+
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
+
+#### packet_encoding
+
+| 编码         | 描述            |
+|------------|---------------|
+| (空)        | 禁用            |
+| packetaddr | 由 v2ray 5+ 支持 |
+| xudp       | 由 xray 支持     |
+
+#### transport
+
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+
+### 拨号字段
+
+参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/vmess.md

@@ -14,7 +14,7 @@
   "authenticated_length": true,
   "network": "tcp",
   "tls": {},
-  "packet_addr": false,
+  "packet_encoding": "",
   "multiplex": {},
   "transport": {},
 
@@ -84,9 +84,13 @@ Both is enabled by default.
 
 TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
-#### packet_addr
+#### packet_encoding
 
-Enable packetaddr support.
+| Encoding   | Description           |
+|------------|-----------------------|
+| (none)     | Disabled              |
+| packetaddr | Supported by v2ray 5+ |
+| xudp       | Supported by xray     |
 
 #### multiplex
 

docs/configuration/outbound/vmess.zh.md

@@ -14,7 +14,7 @@
   "authenticated_length": true,
   "network": "tcp",
   "tls": {},
-  "packet_addr": false,
+  "packet_encoding": "",
   "multiplex": {},
   "transport": {},
 
@@ -84,9 +84,13 @@ VMess 用户 ID。
 
 TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
-#### packet_addr
+#### packet_encoding
 
-启用 packetaddr 支持。
+| 编码         | 描述            |
+|------------|---------------|
+| (空)        | 禁用            |
+| packetaddr | 由 v2ray 5+ 支持 |
+| xudp       | 由 xray 支持     |
 
 #### multiplex
 

docs/configuration/outbound/wireguard.md

@@ -7,8 +7,9 @@
   
   "server": "127.0.0.1",
   "server_port": 1080,
+  "system_interface": false,
+  "interface_name": "wg0",
   "local_address": [
-    "10.0.0.1",
     "10.0.0.2/32"
   ],
   "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
@@ -25,6 +26,10 @@
 
     WireGuard is not included by default, see [Installation](/#installation).
 
+!!! warning ""
+
+    gVisor, which is required by the unprivileged WireGuard is not included by default, see [Installation](/#installation).
+
 ### Fields
 
 #### server
@@ -39,11 +44,23 @@ The server address.
 
 The server port.
 
+#### system_interface
+
+Use system tun support.
+
+Requires privilege and cannot conflict with system interfaces.
+
+Forced if gVisor not included in the build.
+
+#### interface_name
+
+Custom device name when `system_interface` enabled.
+
 #### local_address
 
 ==Required==
 
-List of IP (v4 or v6) addresses (optionally with CIDR masks) to be assigned to the interface.
+List of IP (v4 or v6) address prefixes to be assigned to the interface.
 
 #### private_key
 

docs/configuration/outbound/wireguard.zh.md

@@ -7,8 +7,9 @@
 
   "server": "127.0.0.1",
   "server_port": 1080,
+  "system_interface": false,
+  "interface_name": "wg0",
   "local_address": [
-    "10.0.0.1",
     "10.0.0.2/32"
   ],
   "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
@@ -25,6 +26,10 @@
 
     默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
 
+!!! warning ""
+
+    默认安装不包含被非特权 WireGuard 需要的 gVisor, 参阅 [安装](/zh/#_2)。
+
 ### 字段
 
 #### server
@@ -39,13 +44,25 @@
 
 服务器端口。
 
+#### system_interface
+
+使用系统 tun 支持。
+
+需要特权且不能与系统接口冲突。
+
+如果 gVisor 未包含在构建中，则强制执行。
+
+#### interface_name
+
+启用 `system_interface` 时的自定义设备名称。
+
 #### local_address
 
 ==必填==
 
 接口的 IPv4/IPv6 地址或地址段的列表您。
 
-要分配给接口的 IP（v4 或 v6）地址列表（可以选择带有 CIDR 掩码）。
+要分配给接口的 IP（v4 或 v6）地址段列表。
 
 #### private_key
 

docs/configuration/route/index.md

@@ -10,6 +10,7 @@
     "rules": [],
     "final": "",
     "auto_detect_interface": false,
+    "override_android_vpn": false,
     "default_interface": "en0",
     "default_mark": 233
   }
@@ -34,17 +35,25 @@ Default outbound tag. the first outbound will be used if empty.
 
     Only supported on Linux, Windows and macOS.
 
-Bind outbound connections to the default NIC by default to prevent routing loops under Tun.
+Bind outbound connections to the default NIC by default to prevent routing loops under tun.
 
 Takes no effect if `outbound.bind_interface` is set.
 
+#### override_android_vpn
+
+!!! error ""
+
+    Only supported on Android.
+
+Accept Android VPN as upstream NIC when `auto_detect_interface` enabled.
+
 #### default_interface
 
 !!! error ""
 
     Only supported on Linux, Windows and macOS.
 
-Bind outbound connections to the specified NIC by default to prevent routing loops under Tun.
+Bind outbound connections to the specified NIC by default to prevent routing loops under tun.
 
 Takes no effect if `auto_detect_interface` is set.
 

docs/configuration/route/index.zh.md

@@ -10,6 +10,7 @@
     "rules": [],
     "final": "",
     "auto_detect_interface": false,
+    "override_android_vpn": false,
     "default_interface": "en0",
     "default_mark": 233
   }
@@ -34,17 +35,25 @@
 
     仅支持 Linux、Windows 和 macOS。
 
-默认将出站连接绑定到默认网卡，以防止在 Tun 下出现路由环路。
+默认将出站连接绑定到默认网卡，以防止在 tun 下出现路由环路。
 
 如果设置了 `outbound.bind_interface` 设置，则不生效。
 
+#### override_android_vpn
+
+!!! error ""
+
+    仅支持 Android。
+
+启用 `auto_detect_interface` 时接受 Android VPN 作为上游网卡。
+
 #### default_interface
 
 !!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
-默认将出站连接绑定到指定网卡，以防止在 Tun 下出现路由环路。
+默认将出站连接绑定到指定网卡，以防止在 tun 下出现路由环路。
 
 如果设置了 `auto_detect_interface` 设置，则不生效。
 

docs/configuration/route/rule.md

@@ -80,6 +80,7 @@
         "user_id": [
           1000
         ],
+        "clash_mode": "direct",
         "invert": false,
         "outbound": "direct"
       },
@@ -106,8 +107,10 @@
 
     The default rule uses the following matching logic:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr`) &&  
+    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    `other fields`  
+    (`source_port` || `source_port_range`) &&  
+    `other fields`
 
 #### inbound
 
@@ -219,6 +222,10 @@ Match user name.
 
 Match user id.
 
+#### clash_mode
+
+Match Clash mode.
+
 #### invert
 
 Invert match result.

docs/configuration/route/rule.zh.md

@@ -78,6 +78,7 @@
         "user_id": [
           1000
         ],
+        "clash_mode": "direct",
         "invert": false,
         "outbound": "direct"
       },
@@ -104,8 +105,10 @@
 
     默认规则使用以下匹配逻辑:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr`) &&  
+    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    `other fields`  
+    (`source_port` || `source_port_range`) &&  
+    `other fields`
 
 #### inbound
 
@@ -217,6 +220,10 @@
 
 匹配用户 ID。
 
+#### clash_mode
+
+匹配 Clash 模式。
+
 #### invert
 
 反选匹配结果。

docs/configuration/shared/dial.md

@@ -9,6 +9,7 @@
   "reuse_addr": false,
   "connect_timeout": "5s",
   "tcp_fast_open": false,
+  "udp_fragment": false,
   "domain_strategy": "prefer_ipv6",
   "fallback_delay": "300ms"
 }
@@ -16,9 +17,9 @@
 
 ### Fields
 
-| Field                                                                             | Available Context |
-|-----------------------------------------------------------------------------------|-------------------|
-| `bind_interface` /`bind_address` /`routing_mark` /`reuse_addr` /`connect_timeout` | `detour` not set  |
+| Field                                                                                                               | Available Context |
+|---------------------------------------------------------------------------------------------------------------------|-------------------|
+| `bind_interface` /`bind_address` /`routing_mark` /`reuse_addr` / `tcp_fast_open`/ `udp_fragment` /`connect_timeout` | `detour` not set  |
 
 #### detour
 
@@ -44,6 +45,14 @@ Set netfilter routing mark.
 
 Reuse listener address.
 
+#### tcp_fast_open
+
+Enable TCP Fast Open.
+
+#### udp_fragment
+
+Enable UDP fragmentation.
+
 #### connect_timeout
 
 Connect timeout, in golang's Duration format.

docs/configuration/shared/dial.zh.md

@@ -9,6 +9,7 @@
   "reuse_addr": false,
   "connect_timeout": "5s",
   "tcp_fast_open": false,
+  "udp_fragment": false,
   "domain_strategy": "prefer_ipv6",
   "fallback_delay": "300ms"
 }
@@ -16,6 +17,11 @@
 
 ### 字段
 
+| 字段                                                                                                                  | 可用上下文        |
+|---------------------------------------------------------------------------------------------------------------------|--------------|
+| `bind_interface` /`bind_address` /`routing_mark` /`reuse_addr` / `tcp_fast_open`/ `udp_fragment` /`connect_timeout` | `detour` 未设置 |
+
+
 #### detour
 
 上游出站的标签。
@@ -42,6 +48,14 @@
 
 重用监听地址。
 
+#### tcp_fast_open
+
+启用 TCP Fast Open。
+
+#### udp_fragment
+
+启用 UDP 分段。
+
 #### connect_timeout
 
 连接超时，采用 golang 的 Duration 格式。

docs/configuration/shared/listen.md

@@ -5,24 +5,27 @@
   "listen": "::",
   "listen_port": 5353,
   "tcp_fast_open": false,
+  "udp_fragment": false,
   "sniff": false,
   "sniff_override_destination": false,
   "domain_strategy": "prefer_ipv6",
   "udp_timeout": 300,
   "proxy_protocol": false,
+  "proxy_protocol_accept_no_header": false,
   "detour": "another-in"
 }
 ```
 
 ### Fields
 
-| Field            | Available Context                                                 |
-|------------------|-------------------------------------------------------------------|
-| `listen`         | Needs to listen on TCP or UDP.                                    |
-| `listen_port`    | Needs to listen on TCP or UDP.                                    |
-| `tcp_fast_open`  | Needs to listen on TCP.                                           |
-| `udp_timeout`    | Needs to assemble UDP connections, currently Tun and Shadowsocks. |
-| `proxy_protocol` | Needs to listen on TCP.                                           |
+| Field                             | Available Context                                                 |
+|-----------------------------------|-------------------------------------------------------------------|
+| `listen`                          | Needs to listen on TCP or UDP.                                    |
+| `listen_port`                     | Needs to listen on TCP or UDP.                                    |
+| `tcp_fast_open`                   | Needs to listen on TCP.                                           |
+| `udp_timeout`                     | Needs to assemble UDP connections, currently Tun and Shadowsocks. |
+| `proxy_protocol`                  | Needs to listen on TCP.                                           |
+| `proxy_protocol_accept_no_header` | When `proxy_protocol` enabled                                     |
 
 #### listen
 
@@ -36,7 +39,11 @@ Listen port.
 
 #### tcp_fast_open
 
-Enable tcp fast open for listener.
+Enable TCP Fast Open.
+
+#### udp_fragment
+
+Enable UDP fragmentation.
 
 #### sniff
 
@@ -66,6 +73,10 @@ UDP NAT expiration time in seconds, default is 300 (5 minutes).
 
 Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.
 
+#### proxy_protocol_accept_no_header
+
+Accept connections without Proxy Protocol header.
+
 #### detour
 
 If set, connections will be forwarded to the specified inbound.

docs/configuration/shared/listen.zh.md

@@ -5,21 +5,26 @@
   "listen": "::",
   "listen_port": 5353,
   "tcp_fast_open": false,
+  "udp_fragment": false,
   "sniff": false,
   "sniff_override_destination": false,
   "domain_strategy": "prefer_ipv6",
   "udp_timeout": 300,
+  "proxy_protocol": false,
+  "proxy_protocol_accept_no_header": false,
   "detour": "another-in"
 }
 ```
 
-| 字段               | 可用上下文                               |
-|------------------|-------------------------------------|
-| `listen`         | 需要监听 TCP 或 UDP。                     |
-| `listen_port`    | 需要监听 TCP 或 UDP。                     |
-| `tcp_fast_open`  | 需要监听 TCP。                           |
-| `udp_timeout`    | 需要组装 UDP 连接, 当前为 Tun 和 Shadowsocks。 |
-| `proxy_protocol` | 需要监听 TCP。                           |
+
+| 字段                                | 可用上下文                               |
+|-----------------------------------|-------------------------------------|
+| `listen`                          | 需要监听 TCP 或 UDP。                     |
+| `listen_port`                     | 需要监听 TCP 或 UDP。                     |
+| `tcp_fast_open`                   | 需要监听 TCP。                           |
+| `udp_timeout`                     | 需要组装 UDP 连接, 当前为 Tun 和 Shadowsocks。 |
+| `proxy_protocol`                  | 需要监听 TCP。                           |
+| `proxy_protocol_accept_no_header` | `proxy_protocol` 启用时                |
 
 ### 字段
 
@@ -35,7 +40,11 @@
 
 #### tcp_fast_open
 
-为监听器启用 TCP 快速打开。
+启用 TCP Fast Open。
+
+#### udp_fragment
+
+启用 UDP 分段。
 
 #### sniff
 
@@ -65,6 +74,10 @@ UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
 
 解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。
 
+#### proxy_protocol_accept_no_header
+
+接受没有代理协议标头的连接。
+
 #### detour
 
 如果设置，连接将被转发到指定的入站。

docs/configuration/shared/tls.md

@@ -30,10 +30,6 @@
 }
 ```
 
-!!! warning ""
-
-    ACME is not included by default, see [Installation](/#installation).
-
 ### Outbound
 
 ```json
@@ -47,7 +43,17 @@
   "max_version": "",
   "cipher_suites": [],
   "certificate": "",
-  "certificate_path": ""
+  "certificate_path": "",
+  "ech": {
+    "enabled": false,
+    "pq_signature_schemes_enabled": false,
+    "dynamic_record_sizing_disabled": false,
+    "config": ""
+  },
+  "utls": {
+    "enabled": false,
+    "fingerprint": ""
+  }
 }
 ```
 
@@ -155,8 +161,48 @@ The server private key, in PEM format.
 
 The path to the server private key, in PEM format.
 
+#### ech
+
+==Client only==
+
+!!! warning ""
+
+    ECH is not included by default, see [Installation](/#installation).
+
+ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
+message.
+
+If you don't know how to fill in the other configuration, just set `enabled`.
+
+#### utls
+
+==Client only==
+
+!!! warning ""
+
+    uTLS is not included by default, see [Installation](/#installation).
+
+!!! note ""
+
+    uTLS is poorly maintained and the effect may be unproven, use at your own risk.
+
+uTLS is a fork of "crypto/tls", which provides ClientHello fingerprinting resistance.
+
+Available fingerprint values:
+
+* chrome
+* firefox
+* ios
+* android
+* random
+
+
 ### ACME Fields
 
+!!! warning ""
+
+    ACME is not included by default, see [Installation](/#installation).
+
 #### domain
 
 List of domain.
@@ -205,10 +251,6 @@ listener for the HTTP challenge.
 The alternate port to use for the ACME TLS-ALPN challenge; the system must forward 443 to this port for challenge to
 succeed.
 
-### Reload
-
-For server configuration, certificate and key will be automatically reloaded if modified.
-
 #### external_account
 
 EAB (External Account Binding) contains information necessary to bind or map an ACME account to some other account known
@@ -226,4 +268,8 @@ The key identifier.
 
 #### external_account.mac_key
 
-The MAC key.
+The MAC key.
+
+### Reload
+
+For server configuration, certificate and key will be automatically reloaded if modified.

docs/configuration/shared/tls.zh.md

@@ -30,10 +30,6 @@
 }
 ```
 
-!!! warning ""
-
-    默认安装不包含 ACME，参阅 [安装](/zh/#_2)。
-
 ### 出站
 
 ```json
@@ -47,7 +43,17 @@
   "max_version": "",
   "cipher_suites": [],
   "certificate": "",
-  "certificate_path": ""
+  "certificate_path": "",
+  "ech": {
+    "enabled": false,
+    "pq_signature_schemes_enabled": false,
+    "dynamic_record_sizing_disabled": false,
+    "config": ""
+  },
+  "utls": {
+    "enabled": false,
+    "fingerprint": ""
+  }
 }
 ```
 
@@ -155,8 +161,47 @@ TLS 版本值：
 
 服务器 PEM 私钥路径。
 
+#### ech
+
+==仅客户端==
+
+!!! warning ""
+
+    默认安装不包含 ECH, 参阅 [安装](/zh/#_2)。
+
+ECH (Encrypted Client Hello) 是一个 TLS 扩展，它允许客户端加密其 ClientHello 的第一部分
+信息。
+
+如果您不知道如何填写其他配置，只需设置 `enabled` 即可。
+
+#### utls
+
+==仅客户端==
+
+!!! warning ""
+
+    默认安装不包含 uTLS, 参阅 [安装](/zh/#_2)。
+
+!!! note ""
+
+    uTLS 维护不善且其效果可能未经证实，使用风险自负。
+
+uTLS 是 "crypto/tls" 的一个分支，它提供了 ClientHello 指纹识别阻力。
+
+可用的指纹值：
+
+* chrome
+* firefox
+* ios
+* android
+* random
+
 ### ACME 字段
 
+!!! warning ""
+
+    默认安装不包含 ACME，参阅 [安装](/zh/#_2)。
+
 #### domain
 
 一组域名。
@@ -203,10 +248,6 @@ ACME 数据目录。
 
 用于 ACME TLS-ALPN 质询的备用端口； 系统必须将 443 转发到此端口以使质询成功。
 
-### Reload
-
-对于服务器配置，如果修改，证书和密钥将自动重新加载。
-
 #### external_account
 
 EAB（外部帐户绑定）包含将 ACME 帐户绑定或映射到其他已知帐户所需的信息由 CA。
@@ -222,4 +263,8 @@ EAB（外部帐户绑定）包含将 ACME 帐户绑定或映射到其他已知
 
 #### external_account.mac_key
 
-MAC 密钥。
+MAC 密钥。
+
+### 重载
+
+对于服务器配置，如果修改，证书和密钥将自动重新加载。

docs/contributing/sub-projects.md

@@ -53,17 +53,6 @@ we need to do this.
 
 The library needs to be updated with the upstream.
 
-#### certmagic
-
-Link: [GitHub repository](https://github.com/SagerNet/certmagic)
-
-Fork of `caddyserver/certmagic`
-
-Since upstream uses `miekg/dns` and we use `x/net/dnsmessage`, we need to replace its DNS part with our own
-implementation.
-
-The library needs to be updated with the upstream.
-
 #### smux
 
 Link: [GitHub repository](https://github.com/SagerNet/smux)

docs/features.md

@@ -95,7 +95,9 @@
 | cn                | 17.8M    | 140.3M     |
 | cn (Loyalsoldier) | 74.3M    | 246.7M     |
 
-#### Shadowsocks benchmark
+#### Benchmark
+
+##### Shadowsocks
 
 | /                                  |   none    | aes-128-gcm | 2022-blake3-aes-128-gcm |
 |------------------------------------|:---------:|:-----------:|:-----------------------:|
@@ -103,6 +105,13 @@
 | shadowsocks-rust (v1.15.0-alpha.5) | 10.7 Gbps |      /      |        9.36 Gbps        |
 | sing-box                           | 29.0 Gbps |      /      |        11.8 Gbps        |
 
+##### VMess
+
+| /                  |    TCP    |   HTTP    |  H2 TLS   | WebSocket TLS | gRPC TLS  |
+|--------------------|:---------:|:---------:|:---------:|:-------------:|:---------:|
+| v2ray-core (5.1.0) | 7.86 GBps | 2.86 Gbps | 1.83 Gbps |   2.36 Gbps   | 2.43 Gbps |
+| sing-box           | 7.96 Gbps | 8.09 Gbps | 6.11 Gbps |   8.02 Gbps   | 6.35 Gbps |
+
 #### License
 
 | /          | License                           |

docs/index.md

@@ -27,9 +27,13 @@ go install -v -tags with_clash_api github.com/sagernet/sing-box/cmd/sing-box@lat
 | `with_quic`                        | Build with QUIC support, see [QUIC and HTTP3 dns transports](./configuration/dns/server), [Naive inbound](./configuration/inbound/naive), [Hysteria Inbound](./configuration/inbound/hysteria), [Hysteria Outbound](./configuration/outbound/hysteria) and [V2Ray Transport#QUIC](./configuration/shared/v2ray-transport#quic). |
 | `with_grpc`                        | Build with standard gRPC support, see [V2Ray Transport#gRPC](./configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                      |
 | `with_wireguard`                   | Build with WireGuard support, see [WireGuard outbound](./configuration/outbound/wireguard).                                                                                                                                                                                                                                     |
+| `with_shadowsocksr`                | Build with ShadowsocksR support, see [ShadowsocksR outbound](./configuration/outbound/shadowsocksr).                                                                                                                                                                                                                            |
+| `with_ech`                         | Build with TLS ECH extension support for TLS outbound, see [TLS](./configuration/shared/tls#ech).                                                                                                                                                                                                                               |
+| `with_utls`                        | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](./configuration/shared/tls#utls).                                                                                                                                                                                          |
 | `with_acme`                        | Build with ACME TLS certificate issuer support, see [TLS](./configuration/shared/tls).                                                                                                                                                                                                                                          |
 | `with_clash_api`                   | Build with Clash API support, see [Experimental](./configuration/experimental#clash-api-fields).                                                                                                                                                                                                                                |
-| `no_gvisor`                        | Build without gVisor Tun stack support, see [Tun inbound](./configuration/inbound/tun#stack).                                                                                                                                                                                                                                   |
+| `with_v2ray_api`                   | Build with V2Ray API support, see [Experimental](./configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                                |
+| `with_gvisor`                      | Build with gVisor support, see [Tun inbound](./configuration/inbound/tun#stack) and [WireGuard outbound](./configuration/outbound/wireguard#system_interface).                                                                                                                                                                  |
 | `with_embedded_tor` (CGO required) | Build with embedded Tor support, see [Tor outbound](./configuration/outbound/tor).                                                                                                                                                                                                                                              |
 | `with_lwip` (CGO required)         | Build with LWIP Tun stack support, see [Tun inbound](./configuration/inbound/tun#stack).                                                                                                                                                                                                                                        |
 
@@ -42,10 +46,6 @@ sing-box version
 It is also recommended to use systemd to manage sing-box service,
 see [Linux server installation example](./examples/linux-server-installation).
 
-## Contributors
-
-[![](https://opencollective.com/sagernet/contributors.svg?width=740&button=false)](https://github.com/sagernet/sing-box/graphs/contributors)
-
 ## License
 
 ```

docs/index.zh.md

@@ -27,9 +27,13 @@ go install -v -tags with_clash_api github.com/sagernet/sing-box/cmd/sing-box@lat
 | `with_quic`                  | 启用 QUIC 支持，参阅 [QUIC 和 HTTP3 DNS 传输层](./configuration/dns/server)，[Naive 入站](./configuration/inbound/naive)，[Hysteria 入站](./configuration/inbound/hysteria)，[Hysteria 出站](./configuration/outbound/hysteria) 和 [V2Ray 传输层#QUIC](./configuration/shared/v2ray-transport#quic)。 |
 | `with_grpc`                  | 启用标准 gRPC 支持，参阅 [V2Ray 传输层#gRPC](./configuration/shared/v2ray-transport#grpc)。                                                                                                                                                                                               |
 | `with_wireguard`             | 启用 WireGuard 支持，参阅 [WireGuard 出站](./configuration/outbound/wireguard)。                                                                                                                                                                                                       |
+| `with_shadowsocksr`          | 启用 ShadowsocksR 支持，参阅 [ShadowsocksR 出站](./configuration/outbound/shadowsocksr)。                                                                                                                                                                                              |
+| `with_ech`                   | 启用 TLS ECH 扩展支持，参阅 [TLS](./configuration/shared/tls#ech)。                                                                                                                                                                                                                    |
+| `with_utls`                  | 启用 uTLS 支持，参阅 [实验性](./configuration/experimental#clash-api-fields)。                                                                                                                                                                                                          |
 | `with_acme`                  | 启用 ACME TLS 证书签发支持，参阅 [TLS](./configuration/shared/tls)。                                                                                                                                                                                                                     |
-| `with_clash_api`             | 启用 Clash api 支持，参阅 [实验性](./configuration/experimental#clash-api-fields)。                                                                                                                                                                                                     |
-| `no_gvisor`                  | 禁用 gVisor Tun 栈支持，参阅 [Tun 入站](./configuration/inbound/tun#stack)。                                                                                                                                                                                                            |
+| `with_clash_api`             | 启用 Clash API 支持，参阅 [实验性](./configuration/experimental#clash-api-fields)。                                                                                                                                                                                                     |
+| `with_v2ray_api`             | 启用 V2Rat API 支持，参阅 [实验性](./configuration/experimental#v2ray-api-fields)。                                                                                                                                                                                                     |
+| `with_gvisor`                | 启用 gVisor 支持，参阅 [Tun 入站](./configuration/inbound/tun#stack) 和 [WireGuard 出站](./configuration/outbound/wireguard#system_interface)。                                                                                                                                           |
 | `with_embedded_tor` (需要 CGO) | 启用 嵌入式 Tor 支持，参阅 [Tor 出站](./configuration/outbound/tor)。                                                                                                                                                                                                                     |
 | `with_lwip` (需要 CGO)         | 启用 LWIP Tun 栈支持，参阅 [Tun 入站](./configuration/inbound/tun#stack)。                                                                                                                                                                                                              |
 
@@ -39,13 +43,9 @@ go install -v -tags with_clash_api github.com/sagernet/sing-box/cmd/sing-box@lat
 sing-box version
 ```
 
-同时推荐使用 Systemd 来管理 sing-box 服务器实例。
+同时推荐使用 systemd 来管理 sing-box 服务器实例。
 参阅 [Linux 服务器安装示例](./examples/linux-server-installation)。
 
-## 贡献者
-
-[![](https://opencollective.com/sagernet/contributors.svg?width=740&button=false)](https://github.com/sagernet/sing-box/graphs/contributors)
-
 ## 授权
 
 ```

experimental/clashapi.go

@@ -1,14 +1,24 @@
-//go:build with_clash_api
-
 package experimental
 
 import (
+	"os"
+
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/experimental/clashapi"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 )
 
-func NewClashServer(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error) {
-	return clashapi.NewServer(router, logFactory, options), nil
+type ClashServerConstructor = func(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error)
+
+var clashServerConstructor ClashServerConstructor
+
+func RegisterClashServerConstructor(constructor ClashServerConstructor) {
+	clashServerConstructor = constructor
+}
+
+func NewClashServer(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error) {
+	if clashServerConstructor == nil {
+		return nil, os.ErrInvalid
+	}
+	return clashServerConstructor(router, logFactory, options)
 }

experimental/clashapi/cachefile/cache.go

@@ -0,0 +1,61 @@
+package cachefile
+
+import (
+	"os"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+
+	"go.etcd.io/bbolt"
+)
+
+var bucketSelected = []byte("selected")
+
+var _ adapter.ClashCacheFile = (*CacheFile)(nil)
+
+type CacheFile struct {
+	DB *bbolt.DB
+}
+
+func Open(path string) (*CacheFile, error) {
+	const fileMode = 0o666
+	options := bbolt.Options{Timeout: time.Second}
+	db, err := bbolt.Open(path, fileMode, &options)
+	switch err {
+	case bbolt.ErrInvalid, bbolt.ErrChecksum, bbolt.ErrVersionMismatch:
+		if err = os.Remove(path); err != nil {
+			break
+		}
+		db, err = bbolt.Open(path, 0o666, &options)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &CacheFile{db}, nil
+}
+
+func (c *CacheFile) LoadSelected(group string) string {
+	var selected string
+	c.DB.View(func(t *bbolt.Tx) error {
+		bucket := t.Bucket(bucketSelected)
+		if bucket == nil {
+			return nil
+		}
+		selectedBytes := bucket.Get([]byte(group))
+		if len(selectedBytes) > 0 {
+			selected = string(selectedBytes)
+		}
+		return nil
+	})
+	return selected
+}
+
+func (c *CacheFile) StoreSelected(group, selected string) error {
+	return c.DB.Batch(func(t *bbolt.Tx) error {
+		bucket, err := t.CreateBucketIfNotExists(bucketSelected)
+		if err != nil {
+			return err
+		}
+		return bucket.Put([]byte(group), []byte(selected))
+	})
+}

experimental/clashapi/configs.go

@@ -2,6 +2,7 @@ package clashapi
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/sagernet/sing-box/log"
 
@@ -9,11 +10,11 @@ import (
 	"github.com/go-chi/render"
 )
 
-func configRouter(logFactory log.Factory) http.Handler {
+func configRouter(server *Server, logFactory log.Factory, logger log.Logger) http.Handler {
 	r := chi.NewRouter()
-	r.Get("/", getConfigs(logFactory))
+	r.Get("/", getConfigs(server, logFactory))
 	r.Put("/", updateConfigs)
-	r.Patch("/", patchConfigs)
+	r.Patch("/", patchConfigs(server, logger))
 	return r
 }
 
@@ -31,7 +32,7 @@ type configSchema struct {
 	Tun         map[string]any `json:"tun"`
 }
 
-func getConfigs(logFactory log.Factory) func(w http.ResponseWriter, r *http.Request) {
+func getConfigs(server *Server, logFactory log.Factory) func(w http.ResponseWriter, r *http.Request) {
 	return func(w http.ResponseWriter, r *http.Request) {
 		logLevel := logFactory.Level()
 		if logLevel == log.LevelTrace {
@@ -40,15 +41,31 @@ func getConfigs(logFactory log.Factory) func(w http.ResponseWriter, r *http.Requ
 			logLevel = log.LevelError
 		}
 		render.JSON(w, r, &configSchema{
-			Mode:        "rule",
+			Mode:        server.mode,
 			BindAddress: "*",
 			LogLevel:    log.FormatLevel(logLevel),
 		})
 	}
 }
 
-func patchConfigs(w http.ResponseWriter, r *http.Request) {
-	render.NoContent(w, r)
+func patchConfigs(server *Server, logger log.Logger) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var newConfig configSchema
+		err := render.DecodeJSON(r.Body, &newConfig)
+		if err != nil {
+			render.Status(r, http.StatusBadRequest)
+			render.JSON(w, r, ErrBadRequest)
+			return
+		}
+		if newConfig.Mode != "" {
+			mode := strings.ToLower(newConfig.Mode)
+			if server.mode != mode {
+				server.mode = mode
+				logger.Info("updated mode: ", mode)
+			}
+		}
+		render.NoContent(w, r)
+	}
 }
 
 func updateConfigs(w http.ResponseWriter, r *http.Request) {

experimental/clashapi/connections.go

@@ -8,10 +8,10 @@ import (
 
 	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
+	"github.com/sagernet/websocket"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
-	"github.com/gorilla/websocket"
 )
 
 func connectionRouter(trafficManager *trafficontrol.Manager) http.Handler {

experimental/clashapi/proxies.go

@@ -61,7 +61,6 @@ func findProxyByName(router adapter.Router) func(next http.Handler) http.Handler
 func proxyInfo(server *Server, detour adapter.Outbound) *badjson.JSONObject {
 	var info badjson.JSONObject
 	var clashType string
-	var isGroup bool
 	switch detour.Type() {
 	case C.TypeDirect:
 		clashType = "Direct"
@@ -70,18 +69,31 @@ func proxyInfo(server *Server, detour adapter.Outbound) *badjson.JSONObject {
 	case C.TypeSocks:
 		clashType = "Socks"
 	case C.TypeHTTP:
-		clashType = "Http"
+		clashType = "HTTP"
 	case C.TypeShadowsocks:
 		clashType = "Shadowsocks"
 	case C.TypeVMess:
-		clashType = "Vmess"
+		clashType = "VMess"
 	case C.TypeTrojan:
 		clashType = "Trojan"
+	case C.TypeHysteria:
+		clashType = "Hysteria"
+	case C.TypeWireGuard:
+		clashType = "WireGuard"
+	case C.TypeShadowsocksR:
+		clashType = "ShadowsocksR"
+	case C.TypeVLESS:
+		clashType = "VLESS"
+	case C.TypeTor:
+		clashType = "Tor"
+	case C.TypeSSH:
+		clashType = "SSH"
 	case C.TypeSelector:
 		clashType = "Selector"
-		isGroup = true
+	case C.TypeURLTest:
+		clashType = "URLTest"
 	default:
-		clashType = "Socks"
+		clashType = "Direct"
 	}
 	info.Put("type", clashType)
 	info.Put("name", detour.Tag())
@@ -92,10 +104,9 @@ func proxyInfo(server *Server, detour adapter.Outbound) *badjson.JSONObject {
 	} else {
 		info.Put("history", []*urltest.History{})
 	}
-	if isGroup {
-		selector := detour.(adapter.OutboundGroup)
-		info.Put("now", selector.Now())
-		info.Put("all", selector.All())
+	if group, isGroup := detour.(adapter.OutboundGroup); isGroup {
+		info.Put("now", group.Now())
+		info.Put("all", group.All())
 	}
 	return &info
 }

experimental/clashapi/server.go

@@ -14,6 +14,8 @@ import (
 	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/common/urltest"
 	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/experimental"
+	"github.com/sagernet/sing-box/experimental/clashapi/cachefile"
 	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
@@ -21,13 +23,17 @@ import (
 	E "github.com/sagernet/sing/common/exceptions"
 	F "github.com/sagernet/sing/common/format"
 	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/websocket"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/cors"
 	"github.com/go-chi/render"
-	"github.com/gorilla/websocket"
 )
 
+func init() {
+	experimental.RegisterClashServerConstructor(NewServer)
+}
+
 var _ adapter.ClashServer = (*Server)(nil)
 
 type Server struct {
@@ -37,9 +43,13 @@ type Server struct {
 	trafficManager *trafficontrol.Manager
 	urlTestHistory *urltest.HistoryStorage
 	tcpListener    net.Listener
+	directIO       bool
+	mode           string
+	storeSelected  bool
+	cacheFile      adapter.ClashCacheFile
 }
 
-func NewServer(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) *Server {
+func NewServer(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error) {
 	trafficManager := trafficontrol.NewManager()
 	chiRouter := chi.NewRouter()
 	server := &Server{
@@ -51,6 +61,23 @@ func NewServer(router adapter.Router, logFactory log.ObservableFactory, options
 		},
 		trafficManager: trafficManager,
 		urlTestHistory: urltest.NewHistoryStorage(),
+		directIO:       options.DirectIO,
+		mode:           strings.ToLower(options.DefaultMode),
+	}
+	if server.mode == "" {
+		server.mode = "rule"
+	}
+	if options.StoreSelected {
+		server.storeSelected = true
+		cachePath := os.ExpandEnv(options.CacheFile)
+		if cachePath == "" {
+			cachePath = "cache.db"
+		}
+		cacheFile, err := cachefile.Open(cachePath)
+		if err != nil {
+			return nil, E.Cause(err, "open cache file")
+		}
+		server.cacheFile = cacheFile
 	}
 	cors := cors.New(cors.Options{
 		AllowedOrigins: []string{"*"},
@@ -61,11 +88,11 @@ func NewServer(router adapter.Router, logFactory log.ObservableFactory, options
 	chiRouter.Use(cors.Handler)
 	chiRouter.Group(func(r chi.Router) {
 		r.Use(authentication(options.Secret))
-		r.Get("/", hello)
+		r.Get("/", hello(options.ExternalUI != ""))
 		r.Get("/logs", getLogs(logFactory))
 		r.Get("/traffic", traffic(trafficManager))
 		r.Get("/version", version)
-		r.Mount("/configs", configRouter(logFactory))
+		r.Mount("/configs", configRouter(server, logFactory, server.logger))
 		r.Mount("/proxies", proxyRouter(server, router))
 		r.Mount("/rules", ruleRouter(router))
 		r.Mount("/connections", connectionRouter(trafficManager))
@@ -84,7 +111,7 @@ func NewServer(router adapter.Router, logFactory log.ObservableFactory, options
 			})
 		})
 	}
-	return server
+	return server, nil
 }
 
 func (s *Server) Start() error {
@@ -108,11 +135,28 @@ func (s *Server) Close() error {
 		common.PtrOrNil(s.httpServer),
 		s.tcpListener,
 		s.trafficManager,
+		s.cacheFile,
 	)
 }
 
+func (s *Server) Mode() string {
+	return s.mode
+}
+
+func (s *Server) StoreSelected() bool {
+	return s.storeSelected
+}
+
+func (s *Server) CacheFile() adapter.ClashCacheFile {
+	return s.cacheFile
+}
+
+func (s *Server) HistoryStorage() *urltest.HistoryStorage {
+	return s.urlTestHistory
+}
+
 func (s *Server) RoutedConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, matchedRule adapter.Rule) (net.Conn, adapter.Tracker) {
-	tracker := trafficontrol.NewTCPTracker(conn, s.trafficManager, castMetadata(metadata), s.router, matchedRule)
+	tracker := trafficontrol.NewTCPTracker(conn, s.trafficManager, castMetadata(metadata), s.router, matchedRule, s.directIO)
 	return tracker, tracker
 }
 
@@ -200,8 +244,14 @@ func authentication(serverSecret string) func(next http.Handler) http.Handler {
 	}
 }
 
-func hello(w http.ResponseWriter, r *http.Request) {
-	render.JSON(w, r, render.M{"hello": "clash"})
+func hello(redirect bool) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if redirect {
+			http.Redirect(w, r, "/ui/", http.StatusTemporaryRedirect)
+		} else {
+			render.JSON(w, r, render.M{"hello": "clash"})
+		}
+	}
 }
 
 var upgrader = websocket.Upgrader{

experimental/clashapi/trafficontrol/tracker.go

@@ -6,9 +6,8 @@ import (
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/experimental/trackerconn"
 	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
 	"github.com/gofrs/uuid"
@@ -45,7 +44,7 @@ type trackerInfo struct {
 }
 
 type tcpTracker struct {
-	net.Conn `json:"-"`
+	N.ExtendedConn `json:"-"`
 	*trackerInfo
 	manager *Manager
 }
@@ -54,25 +53,9 @@ func (tt *tcpTracker) ID() string {
 	return tt.UUID.String()
 }
 
-func (tt *tcpTracker) Read(b []byte) (int, error) {
-	n, err := tt.Conn.Read(b)
-	upload := int64(n)
-	tt.manager.PushUploaded(upload)
-	tt.UploadTotal.Add(upload)
-	return n, err
-}
-
-func (tt *tcpTracker) Write(b []byte) (int, error) {
-	n, err := tt.Conn.Write(b)
-	download := int64(n)
-	tt.manager.PushDownloaded(download)
-	tt.DownloadTotal.Add(download)
-	return n, err
-}
-
 func (tt *tcpTracker) Close() error {
 	tt.manager.Leave(tt)
-	return tt.Conn.Close()
+	return tt.ExtendedConn.Close()
 }
 
 func (tt *tcpTracker) Leave() {
@@ -80,10 +63,18 @@ func (tt *tcpTracker) Leave() {
 }
 
 func (tt *tcpTracker) Upstream() any {
-	return tt.Conn
+	return tt.ExtendedConn
 }
 
-func NewTCPTracker(conn net.Conn, manager *Manager, metadata Metadata, router adapter.Router, rule adapter.Rule) *tcpTracker {
+func (tt *tcpTracker) ReaderReplaceable() bool {
+	return true
+}
+
+func (tt *tcpTracker) WriterReplaceable() bool {
+	return true
+}
+
+func NewTCPTracker(conn net.Conn, manager *Manager, metadata Metadata, router adapter.Router, rule adapter.Rule, directIO bool) *tcpTracker {
 	uuid, _ := uuid.NewV4()
 
 	var chain []string
@@ -106,8 +97,17 @@ func NewTCPTracker(conn net.Conn, manager *Manager, metadata Metadata, router ad
 		next = group.Now()
 	}
 
+	upload := atomic.NewInt64(0)
+	download := atomic.NewInt64(0)
+
 	t := &tcpTracker{
-		Conn:    conn,
+		ExtendedConn: trackerconn.NewHook(conn, func(n int64) {
+			upload.Add(n)
+			manager.PushUploaded(n)
+		}, func(n int64) {
+			download.Add(n)
+			manager.PushDownloaded(n)
+		}, directIO),
 		manager: manager,
 		trackerInfo: &trackerInfo{
 			UUID:          uuid,
@@ -115,8 +115,8 @@ func NewTCPTracker(conn net.Conn, manager *Manager, metadata Metadata, router ad
 			Metadata:      metadata,
 			Chain:         common.Reverse(chain),
 			Rule:          "",
-			UploadTotal:   atomic.NewInt64(0),
-			DownloadTotal: atomic.NewInt64(0),
+			UploadTotal:   upload,
+			DownloadTotal: download,
 		},
 	}
 
@@ -140,27 +140,6 @@ func (ut *udpTracker) ID() string {
 	return ut.UUID.String()
 }
 
-func (ut *udpTracker) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
-	destination, err = ut.PacketConn.ReadPacket(buffer)
-	if err == nil {
-		upload := int64(buffer.Len())
-		ut.manager.PushUploaded(upload)
-		ut.UploadTotal.Add(upload)
-	}
-	return
-}
-
-func (ut *udpTracker) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
-	download := int64(buffer.Len())
-	err := ut.PacketConn.WritePacket(buffer, destination)
-	if err != nil {
-		return err
-	}
-	ut.manager.PushDownloaded(download)
-	ut.DownloadTotal.Add(download)
-	return nil
-}
-
 func (ut *udpTracker) Close() error {
 	ut.manager.Leave(ut)
 	return ut.PacketConn.Close()
@@ -174,6 +153,14 @@ func (ut *udpTracker) Upstream() any {
 	return ut.PacketConn
 }
 
+func (ut *udpTracker) ReaderReplaceable() bool {
+	return true
+}
+
+func (ut *udpTracker) WriterReplaceable() bool {
+	return true
+}
+
 func NewUDPTracker(conn N.PacketConn, manager *Manager, metadata Metadata, router adapter.Router, rule adapter.Rule) *udpTracker {
 	uuid, _ := uuid.NewV4()
 
@@ -197,17 +184,26 @@ func NewUDPTracker(conn N.PacketConn, manager *Manager, metadata Metadata, route
 		next = group.Now()
 	}
 
+	upload := atomic.NewInt64(0)
+	download := atomic.NewInt64(0)
+
 	ut := &udpTracker{
-		PacketConn: conn,
-		manager:    manager,
+		PacketConn: trackerconn.NewHookPacket(conn, func(n int64) {
+			upload.Add(n)
+			manager.PushUploaded(n)
+		}, func(n int64) {
+			download.Add(n)
+			manager.PushDownloaded(n)
+		}),
+		manager: manager,
 		trackerInfo: &trackerInfo{
 			UUID:          uuid,
 			Start:         time.Now(),
 			Metadata:      metadata,
 			Chain:         common.Reverse(chain),
 			Rule:          "",
-			UploadTotal:   atomic.NewInt64(0),
-			DownloadTotal: atomic.NewInt64(0),
+			UploadTotal:   upload,
+			DownloadTotal: download,
 		},
 	}
 

experimental/clashapi_stub.go

@@ -1,14 +0,0 @@
-//go:build !with_clash_api
-
-package experimental
-
-import (
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func NewClashServer(router adapter.Router, logFactory log.ObservableFactory, options option.ClashAPIOptions) (adapter.ClashServer, error) {
-	return nil, E.New(`clash api is not included in this build, rebuild with -tags with_clash_api`)
-}

experimental/trackerconn/conn.go

@@ -0,0 +1,160 @@
+package trackerconn
+
+import (
+	"io"
+	"net"
+
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/bufio"
+	N "github.com/sagernet/sing/common/network"
+
+	"go.uber.org/atomic"
+)
+
+func New(conn net.Conn, readCounter *atomic.Int64, writeCounter *atomic.Int64, direct bool) N.ExtendedConn {
+	trackerConn := &Conn{bufio.NewExtendedConn(conn), readCounter, writeCounter}
+	if direct {
+		return (*DirectConn)(trackerConn)
+	} else {
+		return trackerConn
+	}
+}
+
+func NewHook(conn net.Conn, readCounter func(n int64), writeCounter func(n int64), direct bool) N.ExtendedConn {
+	trackerConn := &HookConn{bufio.NewExtendedConn(conn), readCounter, writeCounter}
+	if direct {
+		return (*DirectHookConn)(trackerConn)
+	} else {
+		return trackerConn
+	}
+}
+
+type Conn struct {
+	N.ExtendedConn
+	readCounter  *atomic.Int64
+	writeCounter *atomic.Int64
+}
+
+func (c *Conn) Read(p []byte) (n int, err error) {
+	n, err = c.ExtendedConn.Read(p)
+	c.readCounter.Add(int64(n))
+	return n, err
+}
+
+func (c *Conn) ReadBuffer(buffer *buf.Buffer) error {
+	err := c.ExtendedConn.ReadBuffer(buffer)
+	if err != nil {
+		return err
+	}
+	c.readCounter.Add(int64(buffer.Len()))
+	return nil
+}
+
+func (c *Conn) Write(p []byte) (n int, err error) {
+	n, err = c.ExtendedConn.Write(p)
+	c.writeCounter.Add(int64(n))
+	return n, err
+}
+
+func (c *Conn) WriteBuffer(buffer *buf.Buffer) error {
+	dataLen := int64(buffer.Len())
+	err := c.ExtendedConn.WriteBuffer(buffer)
+	if err != nil {
+		return err
+	}
+	c.writeCounter.Add(dataLen)
+	return nil
+}
+
+func (c *Conn) Upstream() any {
+	return c.ExtendedConn
+}
+
+type HookConn struct {
+	N.ExtendedConn
+	readCounter  func(n int64)
+	writeCounter func(n int64)
+}
+
+func (c *HookConn) Read(p []byte) (n int, err error) {
+	n, err = c.ExtendedConn.Read(p)
+	c.readCounter(int64(n))
+	return n, err
+}
+
+func (c *HookConn) ReadBuffer(buffer *buf.Buffer) error {
+	err := c.ExtendedConn.ReadBuffer(buffer)
+	if err != nil {
+		return err
+	}
+	c.readCounter(int64(buffer.Len()))
+	return nil
+}
+
+func (c *HookConn) Write(p []byte) (n int, err error) {
+	n, err = c.ExtendedConn.Write(p)
+	c.writeCounter(int64(n))
+	return n, err
+}
+
+func (c *HookConn) WriteBuffer(buffer *buf.Buffer) error {
+	dataLen := int64(buffer.Len())
+	err := c.ExtendedConn.WriteBuffer(buffer)
+	if err != nil {
+		return err
+	}
+	c.writeCounter(dataLen)
+	return nil
+}
+
+func (c *HookConn) Upstream() any {
+	return c.ExtendedConn
+}
+
+type DirectConn Conn
+
+func (c *DirectConn) WriteTo(w io.Writer) (n int64, err error) {
+	reader := N.UnwrapReader(c.ExtendedConn)
+	if wt, ok := reader.(io.WriterTo); ok {
+		n, err = wt.WriteTo(w)
+		c.readCounter.Add(n)
+		return
+	} else {
+		return bufio.Copy(w, (*Conn)(c))
+	}
+}
+
+func (c *DirectConn) ReadFrom(r io.Reader) (n int64, err error) {
+	writer := N.UnwrapWriter(c.ExtendedConn)
+	if rt, ok := writer.(io.ReaderFrom); ok {
+		n, err = rt.ReadFrom(r)
+		c.writeCounter.Add(n)
+		return
+	} else {
+		return bufio.Copy((*Conn)(c), r)
+	}
+}
+
+type DirectHookConn HookConn
+
+func (c *DirectHookConn) WriteTo(w io.Writer) (n int64, err error) {
+	reader := N.UnwrapReader(c.ExtendedConn)
+	if wt, ok := reader.(io.WriterTo); ok {
+		n, err = wt.WriteTo(w)
+		c.readCounter(n)
+		return
+	} else {
+		return bufio.Copy(w, (*HookConn)(c))
+	}
+}
+
+func (c *DirectHookConn) ReadFrom(r io.Reader) (n int64, err error) {
+	writer := N.UnwrapWriter(c.ExtendedConn)
+	if rt, ok := writer.(io.ReaderFrom); ok {
+		n, err = rt.ReadFrom(r)
+		c.writeCounter(n)
+		return
+	} else {
+		return bufio.Copy((*HookConn)(c), r)
+	}
+}

experimental/trackerconn/packet_conn.go

@@ -0,0 +1,73 @@
+package trackerconn
+
+import (
+	"github.com/sagernet/sing/common/buf"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	"go.uber.org/atomic"
+)
+
+func NewPacket(conn N.PacketConn, readCounter *atomic.Int64, writeCounter *atomic.Int64) *PacketConn {
+	return &PacketConn{conn, readCounter, writeCounter}
+}
+
+func NewHookPacket(conn N.PacketConn, readCounter func(n int64), writeCounter func(n int64)) *HookPacketConn {
+	return &HookPacketConn{conn, readCounter, writeCounter}
+}
+
+type PacketConn struct {
+	N.PacketConn
+	readCounter  *atomic.Int64
+	writeCounter *atomic.Int64
+}
+
+func (c *PacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	destination, err = c.PacketConn.ReadPacket(buffer)
+	if err == nil {
+		c.readCounter.Add(int64(buffer.Len()))
+	}
+	return
+}
+
+func (c *PacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	dataLen := int64(buffer.Len())
+	err := c.PacketConn.WritePacket(buffer, destination)
+	if err != nil {
+		return err
+	}
+	c.writeCounter.Add(dataLen)
+	return nil
+}
+
+func (c *PacketConn) Upstream() any {
+	return c.PacketConn
+}
+
+type HookPacketConn struct {
+	N.PacketConn
+	readCounter  func(n int64)
+	writeCounter func(n int64)
+}
+
+func (c *HookPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	destination, err = c.PacketConn.ReadPacket(buffer)
+	if err == nil {
+		c.readCounter(int64(buffer.Len()))
+	}
+	return
+}
+
+func (c *HookPacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	dataLen := int64(buffer.Len())
+	err := c.PacketConn.WritePacket(buffer, destination)
+	if err != nil {
+		return err
+	}
+	c.writeCounter(dataLen)
+	return nil
+}
+
+func (c *HookPacketConn) Upstream() any {
+	return c.PacketConn
+}

experimental/v2rayapi.go

@@ -0,0 +1,24 @@
+package experimental
+
+import (
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+)
+
+type V2RayServerConstructor = func(logger log.Logger, options option.V2RayAPIOptions) (adapter.V2RayServer, error)
+
+var v2rayServerConstructor V2RayServerConstructor
+
+func RegisterV2RayServerConstructor(constructor V2RayServerConstructor) {
+	v2rayServerConstructor = constructor
+}
+
+func NewV2RayServer(logger log.Logger, options option.V2RayAPIOptions) (adapter.V2RayServer, error) {
+	if v2rayServerConstructor == nil {
+		return nil, os.ErrInvalid
+	}
+	return v2rayServerConstructor(logger, options)
+}

experimental/v2rayapi/server.go

@@ -0,0 +1,75 @@
+package v2rayapi
+
+import (
+	"errors"
+	"net"
+	"net/http"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/experimental"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func init() {
+	experimental.RegisterV2RayServerConstructor(NewServer)
+}
+
+var _ adapter.V2RayServer = (*Server)(nil)
+
+type Server struct {
+	logger       log.Logger
+	listen       string
+	tcpListener  net.Listener
+	grpcServer   *grpc.Server
+	statsService *StatsService
+}
+
+func NewServer(logger log.Logger, options option.V2RayAPIOptions) (adapter.V2RayServer, error) {
+	grpcServer := grpc.NewServer(grpc.Creds(insecure.NewCredentials()))
+	statsService := NewStatsService(common.PtrValueOrDefault(options.Stats))
+	if statsService != nil {
+		RegisterStatsServiceServer(grpcServer, statsService)
+	}
+	server := &Server{
+		logger:       logger,
+		listen:       options.Listen,
+		grpcServer:   grpcServer,
+		statsService: statsService,
+	}
+	return server, nil
+}
+
+func (s *Server) Start() error {
+	listener, err := net.Listen("tcp", s.listen)
+	if err != nil {
+		return err
+	}
+	s.logger.Info("grpc server started at ", listener.Addr())
+	s.tcpListener = listener
+	go func() {
+		err = s.grpcServer.Serve(listener)
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			s.logger.Error(err)
+		}
+	}()
+	return nil
+}
+
+func (s *Server) Close() error {
+	if s.grpcServer != nil {
+		s.grpcServer.Stop()
+	}
+	return common.Close(
+		common.PtrOrNil(s.grpcServer),
+		s.tcpListener,
+	)
+}
+
+func (s *Server) StatsService() adapter.V2RayStatsService {
+	return s.statsService
+}