Add daemon support

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,6 @@
 name: Bug Report
 description: "Create a report to help us improve."
+labels: [ bug ]
 body:
   - type: checkboxes
     id: terms
@@ -31,7 +32,7 @@ body:
         <details>
 
         ```console
-        $ sing-box version
+        $ sing-box --version
         # Paste output here
         ```
 
@@ -55,7 +56,7 @@ body:
       required: true
 
   - type: textarea
-    id: log
+    id: config
     attributes:
       label: Server and client log file
       value: |-

.github/update_dependencies.sh

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
 PROJECTS=$(dirname "$0")/../..
-go get -x github.com/sagernet/$1@$(git -C $PROJECTS/$1 rev-parse HEAD)
+
+go get -x github.com/sagernet/sing@$(git -C $PROJECTS/sing rev-parse HEAD)
+go get -x github.com/sagernet/sing-dns@$(git -C $PROJECTS/sing-dns rev-parse HEAD)
+go get -x github.com/sagernet/sing-tun@$(git -C $PROJECTS/sing-tun rev-parse HEAD)
+go get -x github.com/sagernet/sing-shadowsocks@$(git -C $PROJECTS/sing-shadowsocks rev-parse HEAD)
+go get -x github.com/sagernet/sing-vmess@$(git -C $PROJECTS/sing-vmess rev-parse HEAD)
 go mod tidy

.github/workflows/debug.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - dev
-      - dev-next
     paths-ignore:
       - '**.md'
       - '.github/**'
@@ -12,7 +11,6 @@ on:
   pull_request:
     branches:
       - dev
-      - dev-next
 
 jobs:
   build:

.github/workflows/docker.yml

@@ -1,43 +0,0 @@
-name: Build Docker Images
-on:
-  push:
-    tags:
-      - v*
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag version you want to build"
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Docker metadata
-        id: metadata
-        uses: docker/metadata-action@v3
-        with:
-          images: ghcr.io/sagernet/sing-box
-      - name: Get tag to build
-        id: tag
-        run: |
-          if [[ -z "${{ github.event.inputs.tag }}" ]]; then
-            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.ref_name }}
-          else
-            echo ::set-output name=tag::ghcr.io/sagernet/sing-box:${{ github.event.inputs.tag }}
-          fi
-      - name: Build and release Docker images
-        uses: docker/build-push-action@v2
-        with:
-          platforms: linux/386,linux/amd64
-          target: dist
-          tags: ${{ steps.tag.outputs.tag }}
-          push: true

.goreleaser.yaml

@@ -13,13 +13,11 @@ builds:
     tags:
       - with_quic
       - with_wireguard
+      - with_acme
       - with_clash_api
     env:
       - CGO_ENABLED=0
     targets:
-      - android_arm64
-      - android_amd64
-      - android_amd64_v3
       - linux_amd64_v1
       - linux_amd64_v3
       - linux_arm64

Dockerfile

@@ -1,23 +0,0 @@
-FROM golang:1.19-alpine AS builder
-LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
-COPY . /go/src/github.com/sagernet/sing-box
-WORKDIR /go/src/github.com/sagernet/sing-box
-ARG GOPROXY=""
-ENV GOPROXY ${GOPROXY}
-ENV CGO_ENABLED=0
-RUN set -ex \
-    && apk add git build-base \
-    && export COMMIT=$(git rev-parse --short HEAD) \
-    && go build -v -trimpath -tags 'no_gvisor,with_quic,with_wireguard,with_acme' \
-        -o /go/bin/sing-box \
-        -ldflags "-X github.com/sagernet/sing-box/constant.Commit=${COMMIT} -w -s -buildid=" \
-        ./cmd/sing-box
-FROM alpine AS dist
-LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
-RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
-RUN set -ex \
-    && apk upgrade \
-    && apk add bash tzdata ca-certificates \
-    && rm -rf /var/cache/apk/*
-COPY --from=builder /go/bin/sing-box /usr/local/bin/sing-box
-ENTRYPOINT ["sing-box"]

Makefile

@@ -1,6 +1,6 @@
 NAME = sing-box
 COMMIT = $(shell git rev-parse --short HEAD)
-TAGS ?= with_quic,with_wireguard,with_clash_api
+TAGS ?= with_quic,with_wireguard,with_clash_api,with_daemon
 PARAMS = -v -trimpath -tags '$(TAGS)' -ldflags \
 		'-X "github.com/sagernet/sing-box/constant.Commit=$(COMMIT)" \
 		-w -s -buildid='
@@ -49,14 +49,7 @@ snapshot:
 	ghr --delete --draft --prerelease -p 1 nightly dist/release
 	rm -r dist
 
-release:
-	goreleaser release --rm-dist --skip-publish
-	mkdir dist/release
-	mv dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/release
-	ghr --delete --draft --prerelease -p 3 $(shell git describe --tags) dist/release
-	rm -r dist
-
-release_install:
+snapshot_install:
 	go install -v github.com/goreleaser/goreleaser@latest
 	go install -v github.com/tcnksm/ghr@latest
 

adapter/inbound.go

@@ -2,13 +2,11 @@ package adapter
 
 import (
 	"context"
-	"net"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/process"
 	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
 )
 
 type Inbound interface {
@@ -17,13 +15,6 @@ type Inbound interface {
 	Tag() string
 }
 
-type InjectableInbound interface {
-	Inbound
-	Network() []string
-	NewConnection(ctx context.Context, conn net.Conn, metadata InboundContext) error
-	NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext) error
-}
-
 type InboundContext struct {
 	Inbound     string
 	InboundType string
@@ -38,8 +29,6 @@ type InboundContext struct {
 
 	// cache
 
-	InboundDetour            string
-	LastInbound              string
 	OriginDestination        M.Socksaddr
 	DomainStrategy           dns.DomainStrategy
 	SniffEnabled             bool

box.go

@@ -138,7 +138,7 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		}
 		outbounds = append(outbounds, out)
 	}
-	err = router.Initialize(inbounds, outbounds, func() adapter.Outbound {
+	err = router.Initialize(outbounds, func() adapter.Outbound {
 		out, oErr := outbound.New(ctx, router, logFactory.NewLogger("outbound/direct"), option.Outbound{Type: "direct", Tag: "default"})
 		common.Must(oErr)
 		outbounds = append(outbounds, out)

cmd/sing-box/cmd_daemon.go

@@ -0,0 +1,272 @@
+//go:build with_daemon
+
+package main
+
+import (
+	"bytes"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+
+	"github.com/sagernet/sing-box/common/json"
+	"github.com/sagernet/sing-box/experimental/daemon"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	F "github.com/sagernet/sing/common/format"
+
+	"github.com/spf13/cobra"
+)
+
+var commandDaemon = &cobra.Command{
+	Use: "daemon",
+}
+
+func init() {
+	commandDaemon.AddCommand(commandDaemonInstall)
+	commandDaemon.AddCommand(commandDaemonUninstall)
+	commandDaemon.AddCommand(commandDaemonStart)
+	commandDaemon.AddCommand(commandDaemonStop)
+	commandDaemon.AddCommand(commandDaemonRestart)
+	commandDaemon.AddCommand(commandDaemonRun)
+	mainCommand.AddCommand(commandDaemon)
+	mainCommand.AddCommand(commandStart)
+	mainCommand.AddCommand(commandStop)
+	mainCommand.AddCommand(commandStatus)
+}
+
+var commandDaemonInstall = &cobra.Command{
+	Use:   "install",
+	Short: "Install daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := installDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonUninstall = &cobra.Command{
+	Use:   "uninstall",
+	Short: "Uninstall daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := uninstallDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonStart = &cobra.Command{
+	Use:   "start",
+	Short: "Start daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := startDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonStop = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := stopDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonRestart = &cobra.Command{
+	Use:   "restart",
+	Short: "Restart daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := restartDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonRun = &cobra.Command{
+	Use:   "run",
+	Short: "Run daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := runDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+func installDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Install()
+}
+
+func uninstallDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Uninstall()
+}
+
+func startDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Start()
+}
+
+func stopDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Stop()
+}
+
+func restartDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Restart()
+}
+
+func runDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Run()
+}
+
+var commandStart = &cobra.Command{
+	Use:   "start",
+	Short: "Start service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := startService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandStop = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := stopService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandStatus = &cobra.Command{
+	Use:   "status",
+	Short: "Check service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := checkService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+func doRequest(method string, path string, params url.Values, body io.ReadCloser) ([]byte, error) {
+	requestURL := url.URL{
+		Scheme: "http",
+		Path:   path,
+		Host:   net.JoinHostPort("127.0.0.1", F.ToString(daemon.DefaultDaemonPort)),
+	}
+	if params != nil {
+		requestURL.RawQuery = params.Encode()
+	}
+	request, err := http.NewRequest(method, requestURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	var content []byte
+	if response.StatusCode != http.StatusNoContent {
+		content, err = io.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent {
+		return nil, E.New(string(content))
+	}
+	return content, nil
+}
+
+func ping() error {
+	response, err := doRequest("GET", "/ping", nil, nil)
+	if err != nil || string(response) != "pong" {
+		return E.New("daemon not running")
+	}
+	return nil
+}
+
+func startService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	configContent, err := os.ReadFile(configPath)
+	if err != nil {
+		return E.Cause(err, "read config")
+	}
+	return common.Error(doRequest("POST", "/run", nil, io.NopCloser(bytes.NewReader(configContent))))
+}
+
+func stopService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	return common.Error(doRequest("GET", "/stop", nil, nil))
+}
+
+func checkService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	response, err := doRequest("GET", "/status", nil, nil)
+	if err != nil {
+		return err
+	}
+	var statusResponse daemon.StatusResponse
+	err = json.Unmarshal(response, &statusResponse)
+	if err != nil {
+		return err
+	}
+	if statusResponse.Running {
+		log.Info("service running")
+	} else {
+		log.Info("service stopped")
+	}
+	return nil
+}

cmd/sing-box/cmd_format.go

@@ -38,7 +38,7 @@ func format() error {
 		return E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = options.UnmarshalJSON(configContent)
+	err = json.Unmarshal(configContent, &options)
 	if err != nil {
 		return E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_run.go

@@ -9,6 +9,7 @@ import (
 	"syscall"
 
 	"github.com/sagernet/sing-box"
+	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -45,7 +46,7 @@ func readConfig() (option.Options, error) {
 		return option.Options{}, E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = options.UnmarshalJSON(configContent)
+	err = json.Unmarshal(configContent, &options)
 	if err != nil {
 		return option.Options{}, E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_version.go

@@ -38,7 +38,7 @@ func printVersion(cmd *cobra.Command, args []string) {
 		version += runtime.Version()
 		version += ", "
 		version += runtime.GOOS
-		version += "/"
+		version += ", "
 		version += runtime.GOARCH
 		version += ", "
 		version += "CGO "

common/baderror/baderror.go

@@ -1,62 +0,0 @@
-package baderror
-
-import (
-	"context"
-	"io"
-	"net"
-	"strings"
-
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func Contains(err error, msgList ...string) bool {
-	for _, msg := range msgList {
-		if strings.Contains(err.Error(), msg) {
-			return true
-		}
-	}
-	return false
-}
-
-func WrapH2(err error) error {
-	if err == nil {
-		return nil
-	}
-	err = E.Unwrap(err)
-	if err == io.ErrUnexpectedEOF {
-		return io.EOF
-	}
-	if Contains(err, "client disconnected", "body closed by handler") {
-		return net.ErrClosed
-	}
-	return err
-}
-
-func WrapGRPC(err error) error {
-	// grpc uses stupid internal error types
-	if err == nil {
-		return nil
-	}
-	if Contains(err, "EOF") {
-		return io.EOF
-	}
-	if Contains(err, "Canceled") {
-		return context.Canceled
-	}
-	if Contains(err,
-		"the client connection is closing",
-		"server closed the stream without sending trailers") {
-		return net.ErrClosed
-	}
-	return err
-}
-
-func WrapQUIC(err error) error {
-	if err == nil {
-		return nil
-	}
-	if Contains(err, "canceled with error code 0") {
-		return net.ErrClosed
-	}
-	return err
-}

common/dialer/bind.go

@@ -0,0 +1,19 @@
+package dialer
+
+import (
+	"syscall"
+
+	"github.com/sagernet/sing/common/control"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+func skipIfPrivate(next control.Func) control.Func {
+	return func(network, address string, conn syscall.RawConn) error {
+		destination := M.ParseSocksaddr(address)
+		if !N.IsPublicAddr(destination.Addr) {
+			return nil
+		}
+		return next(network, address, conn)
+	}
+}

common/dialer/default.go

@@ -11,7 +11,6 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common/control"
-	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
@@ -65,25 +64,25 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	var listener net.ListenConfig
 	if options.BindInterface != "" {
 		warnBindInterfaceOnUnsupportedPlatform.Check()
-		bindFunc := control.BindToInterface(router.InterfaceBindManager(), options.BindInterface)
+		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), options.BindInterface))
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.AutoDetectInterface() {
 		if C.IsWindows {
-			bindFunc := control.BindToInterfaceIndexFunc(func(network, address string) int {
-				return router.InterfaceMonitor().DefaultInterfaceIndex(M.ParseSocksaddr(address).Addr)
-			})
+			bindFunc := skipIfPrivate(control.BindToInterfaceIndexFunc(func() int {
+				return router.InterfaceMonitor().DefaultInterfaceIndex()
+			}))
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		} else {
-			bindFunc := control.BindToInterfaceFunc(router.InterfaceBindManager(), func(network, address string) string {
-				return router.InterfaceMonitor().DefaultInterfaceName(M.ParseSocksaddr(address).Addr)
-			})
+			bindFunc := skipIfPrivate(control.BindToInterfaceFunc(router.InterfaceBindManager(), func() string {
+				return router.InterfaceMonitor().DefaultInterfaceName()
+			}))
 			dialer.Control = control.Append(dialer.Control, bindFunc)
 			listener.Control = control.Append(listener.Control, bindFunc)
 		}
 	} else if router.DefaultInterface() != "" {
-		bindFunc := control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface())
+		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface()))
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	}
@@ -112,16 +111,9 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	if options.TCPFastOpen {
 		warnTFOOnUnsupportedPlatform.Check()
 	}
-	if !options.UDPFragment {
-		dialer.Control = control.Append(dialer.Control, control.DisableUDPFragment())
-		listener.Control = control.Append(listener.Control, control.DisableUDPFragment())
-	}
 	var bindUDPAddr string
 	udpDialer := dialer
-	var bindAddress netip.Addr
-	if options.BindAddress != nil {
-		bindAddress = options.BindAddress.Build()
-	}
+	bindAddress := netip.Addr(options.BindAddress)
 	if bindAddress.IsValid() {
 		dialer.LocalAddr = &net.TCPAddr{
 			IP: bindAddress.AsSlice(),
@@ -135,9 +127,6 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 }
 
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
-	if !address.IsValid() {
-		return nil, E.New("invalid address")
-	}
 	switch N.NetworkName(network) {
 	case N.NetworkUDP:
 		return d.udpDialer.DialContext(ctx, network, address.String())

common/dialer/dialer.go

@@ -10,12 +10,15 @@ import (
 )
 
 func New(router adapter.Router, options option.DialerOptions) N.Dialer {
-	var dialer N.Dialer
 	if options.Detour == "" {
-		dialer = NewDefault(router, options)
+		return NewDefault(router, options)
 	} else {
-		dialer = NewDetour(router, options.Detour)
+		return NewDetour(router, options.Detour)
 	}
+}
+
+func NewOutbound(router adapter.Router, options option.OutboundDialerOptions) N.Dialer {
+	dialer := New(router, options.DialerOptions)
 	domainStrategy := dns.DomainStrategy(options.DomainStrategy)
 	if domainStrategy != dns.DomainStrategyAsIS || options.Detour == "" {
 		dialer = NewResolveDialer(router, dialer, domainStrategy, time.Duration(options.FallbackDelay))

common/dialer/resolve.go

@@ -51,7 +51,7 @@ func (d *ResolveDialer) DialContext(ctx context.Context, network string, destina
 }
 
 func (d *ResolveDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsFqdn() {
+	if !destination.IsFqdn() || destination.Fqdn == "" {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx, metadata := adapter.AppendContext(ctx)

common/json/comment.go

@@ -1,128 +0,0 @@
-package json
-
-import (
-	"bufio"
-	"io"
-)
-
-// kanged from v2ray
-
-type commentFilterState = byte
-
-const (
-	commentFilterStateContent commentFilterState = iota
-	commentFilterStateEscape
-	commentFilterStateDoubleQuote
-	commentFilterStateDoubleQuoteEscape
-	commentFilterStateSingleQuote
-	commentFilterStateSingleQuoteEscape
-	commentFilterStateComment
-	commentFilterStateSlash
-	commentFilterStateMultilineComment
-	commentFilterStateMultilineCommentStar
-)
-
-type CommentFilter struct {
-	br    *bufio.Reader
-	state commentFilterState
-}
-
-func NewCommentFilter(reader io.Reader) io.Reader {
-	return &CommentFilter{br: bufio.NewReader(reader)}
-}
-
-func (v *CommentFilter) Read(b []byte) (int, error) {
-	p := b[:0]
-	for len(p) < len(b)-2 {
-		x, err := v.br.ReadByte()
-		if err != nil {
-			if len(p) == 0 {
-				return 0, err
-			}
-			return len(p), nil
-		}
-		switch v.state {
-		case commentFilterStateContent:
-			switch x {
-			case '"':
-				v.state = commentFilterStateDoubleQuote
-				p = append(p, x)
-			case '\'':
-				v.state = commentFilterStateSingleQuote
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateEscape
-			case '#':
-				v.state = commentFilterStateComment
-			case '/':
-				v.state = commentFilterStateSlash
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateContent
-		case commentFilterStateDoubleQuote:
-			switch x {
-			case '"':
-				v.state = commentFilterStateContent
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateDoubleQuoteEscape
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateDoubleQuoteEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateDoubleQuote
-		case commentFilterStateSingleQuote:
-			switch x {
-			case '\'':
-				v.state = commentFilterStateContent
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateSingleQuoteEscape
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateSingleQuoteEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateSingleQuote
-		case commentFilterStateComment:
-			if x == '\n' {
-				v.state = commentFilterStateContent
-				p = append(p, '\n')
-			}
-		case commentFilterStateSlash:
-			switch x {
-			case '/':
-				v.state = commentFilterStateComment
-			case '*':
-				v.state = commentFilterStateMultilineComment
-			default:
-				p = append(p, '/', x)
-			}
-		case commentFilterStateMultilineComment:
-			switch x {
-			case '*':
-				v.state = commentFilterStateMultilineCommentStar
-			case '\n':
-				p = append(p, '\n')
-			}
-		case commentFilterStateMultilineCommentStar:
-			switch x {
-			case '/':
-				v.state = commentFilterStateContent
-			case '*':
-				// Stay
-			case '\n':
-				p = append(p, '\n')
-			default:
-				v.state = commentFilterStateMultilineComment
-			}
-		default:
-			panic("Unknown state.")
-		}
-	}
-	return len(p), nil
-}

common/process/searcher_android.go

@@ -18,21 +18,21 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *androidSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	_, uid, err := resolveSocketByNetlink(network, source, destination)
+	socket, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid % 100000); loaded {
+	if sharedPackage, loaded := s.packageManager.SharedPackageByID(socket.UID); loaded {
 		return &Info{
-			UserId:      int32(uid),
+			UserId:      int32(socket.UID),
 			PackageName: sharedPackage,
 		}, nil
 	}
-	if packageName, loaded := s.packageManager.PackageByID(uid % 100000); loaded {
+	if packageName, loaded := s.packageManager.PackageByID(socket.UID); loaded {
 		return &Info{
-			UserId:      int32(uid),
+			UserId:      int32(socket.UID),
 			PackageName: packageName,
 		}, nil
 	}
-	return &Info{UserId: int32(uid)}, nil
+	return &Info{UserId: int32(socket.UID)}, nil
 }

common/process/searcher_linux.go

@@ -20,16 +20,16 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *linuxSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	inode, uid, err := resolveSocketByNetlink(network, source, destination)
+	socket, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	processPath, err := resolveProcessNameByProcSearch(inode, uid)
+	processPath, err := resolveProcessNameByProcSearch(socket.INode, socket.UID)
 	if err != nil {
 		s.logger.DebugContext(ctx, "find process path: ", err)
 	}
 	return &Info{
-		UserId:      int32(uid),
+		UserId:      int32(socket.UID),
 		ProcessPath: processPath,
 	}, nil
 }

common/process/searcher_linux_shared.go

@@ -6,7 +6,6 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
-	"net"
 	"net/netip"
 	"os"
 	"path"
@@ -15,9 +14,7 @@ import (
 	"unicode"
 	"unsafe"
 
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/netlink"
 	N "github.com/sagernet/sing/common/network"
 )
 
@@ -37,7 +34,7 @@ const (
 	pathProc                = "/proc"
 )
 
-func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (inode, uid uint32, err error) {
+func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (*netlink.Socket, error) {
 	var family uint8
 	var protocol uint8
 
@@ -47,110 +44,28 @@ func resolveSocketByNetlink(network string, source netip.AddrPort, destination n
 	case N.NetworkUDP:
 		protocol = syscall.IPPROTO_UDP
 	default:
-		return 0, 0, os.ErrInvalid
+		return nil, os.ErrInvalid
 	}
-
 	if source.Addr().Is4() {
 		family = syscall.AF_INET
 	} else {
 		family = syscall.AF_INET6
 	}
-
-	req := packSocketDiagRequest(family, protocol, source)
-
-	socket, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_DGRAM, syscall.NETLINK_INET_DIAG)
+	sockets, err := netlink.SocketGet(family, protocol, source, netip.AddrPortFrom(netip.IPv6Unspecified(), 0))
+	if err == nil {
+		sockets, err = netlink.SocketGet(family, protocol, source, destination)
+	}
 	if err != nil {
-		return 0, 0, E.Cause(err, "dial netlink")
+		return nil, err
 	}
-	defer syscall.Close(socket)
-
-	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_SNDTIMEO, &syscall.Timeval{Usec: 100})
-	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_RCVTIMEO, &syscall.Timeval{Usec: 100})
-
-	err = syscall.Connect(socket, &syscall.SockaddrNetlink{
-		Family: syscall.AF_NETLINK,
-		Pad:    0,
-		Pid:    0,
-		Groups: 0,
-	})
-	if err != nil {
-		return
+	if len(sockets) > 1 {
+		for _, socket := range sockets {
+			if socket.ID.DestinationPort == destination.Port() {
+				return socket, nil
+			}
+		}
 	}
-
-	_, err = syscall.Write(socket, req)
-	if err != nil {
-		return 0, 0, E.Cause(err, "write netlink request")
-	}
-
-	_buffer := buf.StackNew()
-	defer common.KeepAlive(_buffer)
-	buffer := common.Dup(_buffer)
-	defer buffer.Release()
-
-	n, err := syscall.Read(socket, buffer.FreeBytes())
-	if err != nil {
-		return 0, 0, E.Cause(err, "read netlink response")
-	}
-
-	buffer.Truncate(n)
-
-	messages, err := syscall.ParseNetlinkMessage(buffer.Bytes())
-	if err != nil {
-		return 0, 0, E.Cause(err, "parse netlink message")
-	} else if len(messages) == 0 {
-		return 0, 0, E.New("unexcepted netlink response")
-	}
-
-	message := messages[0]
-	if message.Header.Type&syscall.NLMSG_ERROR != 0 {
-		return 0, 0, E.New("netlink message: NLMSG_ERROR")
-	}
-
-	inode, uid = unpackSocketDiagResponse(&messages[0])
-	return
-}
-
-func packSocketDiagRequest(family, protocol byte, source netip.AddrPort) []byte {
-	s := make([]byte, 16)
-	copy(s, source.Addr().AsSlice())
-
-	buf := make([]byte, sizeOfSocketDiagRequest)
-
-	nativeEndian.PutUint32(buf[0:4], sizeOfSocketDiagRequest)
-	nativeEndian.PutUint16(buf[4:6], socketDiagByFamily)
-	nativeEndian.PutUint16(buf[6:8], syscall.NLM_F_REQUEST|syscall.NLM_F_DUMP)
-	nativeEndian.PutUint32(buf[8:12], 0)
-	nativeEndian.PutUint32(buf[12:16], 0)
-
-	buf[16] = family
-	buf[17] = protocol
-	buf[18] = 0
-	buf[19] = 0
-	nativeEndian.PutUint32(buf[20:24], 0xFFFFFFFF)
-
-	binary.BigEndian.PutUint16(buf[24:26], source.Port())
-	binary.BigEndian.PutUint16(buf[26:28], 0)
-
-	copy(buf[28:44], s)
-	copy(buf[44:60], net.IPv6zero)
-
-	nativeEndian.PutUint32(buf[60:64], 0)
-	nativeEndian.PutUint64(buf[64:72], 0xFFFFFFFFFFFFFFFF)
-
-	return buf
-}
-
-func unpackSocketDiagResponse(msg *syscall.NetlinkMessage) (inode, uid uint32) {
-	if len(msg.Data) < 72 {
-		return 0, 0
-	}
-
-	data := msg.Data
-
-	uid = nativeEndian.Uint32(data[64:68])
-	inode = nativeEndian.Uint32(data[68:72])
-
-	return
+	return sockets[0], nil
 }
 
 func resolveProcessNameByProcSearch(inode, uid uint32) (string, error) {

common/proxyproto/listener.go

@@ -13,7 +13,6 @@ import (
 
 type Listener struct {
 	net.Listener
-	AcceptNoHeader bool
 }
 
 func (l *Listener) Accept() (net.Conn, error) {
@@ -23,7 +22,7 @@ func (l *Listener) Accept() (net.Conn, error) {
 	}
 	bufReader := std_bufio.NewReader(conn)
 	header, err := proxyproto.Read(bufReader)
-	if err != nil && !(l.AcceptNoHeader && err == proxyproto.ErrNoProxyProtocol) {
+	if err != nil {
 		return nil, err
 	}
 	if bufReader.Buffered() > 0 {
@@ -34,11 +33,8 @@ func (l *Listener) Accept() (net.Conn, error) {
 		}
 		conn = bufio.NewCachedConn(conn, cache)
 	}
-	if header != nil {
-		return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
-			Source:      M.SocksaddrFromNet(header.SourceAddr),
-			Destination: M.SocksaddrFromNet(header.DestinationAddr),
-		}}, nil
-	}
-	return conn, nil
+	return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
+		Source:      M.SocksaddrFromNet(header.SourceAddr),
+		Destination: M.SocksaddrFromNet(header.DestinationAddr),
+	}}, nil
 }

common/redir/redir_darwin.go

@@ -1,64 +0,0 @@
-package redir
-
-import (
-	"net"
-	"net/netip"
-	"syscall"
-	"unsafe"
-
-	M "github.com/sagernet/sing/common/metadata"
-)
-
-const (
-	PF_OUT      = 0x2
-	DIOCNATLOOK = 0xc0544417
-)
-
-func GetOriginalDestination(conn net.Conn) (destination netip.AddrPort, err error) {
-	fd, err := syscall.Open("/dev/pf", 0, syscall.O_RDONLY)
-	if err != nil {
-		return netip.AddrPort{}, err
-	}
-	defer syscall.Close(fd)
-	nl := struct {
-		saddr, daddr, rsaddr, rdaddr       [16]byte
-		sxport, dxport, rsxport, rdxport   [4]byte
-		af, proto, protoVariant, direction uint8
-	}{
-		af:        syscall.AF_INET,
-		proto:     syscall.IPPROTO_TCP,
-		direction: PF_OUT,
-	}
-	la := conn.LocalAddr().(*net.TCPAddr)
-	ra := conn.RemoteAddr().(*net.TCPAddr)
-	raIP, laIP := ra.IP, la.IP
-	raPort, laPort := ra.Port, la.Port
-	switch {
-	case raIP.To4() != nil:
-		copy(nl.saddr[:net.IPv4len], raIP.To4())
-		copy(nl.daddr[:net.IPv4len], laIP.To4())
-		nl.af = syscall.AF_INET
-	default:
-		copy(nl.saddr[:], raIP.To16())
-		copy(nl.daddr[:], laIP.To16())
-		nl.af = syscall.AF_INET6
-	}
-	nl.sxport[0], nl.sxport[1] = byte(raPort>>8), byte(raPort)
-	nl.dxport[0], nl.dxport[1] = byte(laPort>>8), byte(laPort)
-	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), DIOCNATLOOK, uintptr(unsafe.Pointer(&nl))); errno != 0 {
-		return netip.AddrPort{}, errno
-	}
-
-	var ip net.IP
-	switch nl.af {
-	case syscall.AF_INET:
-		ip = make(net.IP, net.IPv4len)
-		copy(ip, nl.rdaddr[:net.IPv4len])
-	case syscall.AF_INET6:
-		ip = make(net.IP, net.IPv6len)
-		copy(ip, nl.rdaddr[:])
-	}
-	port := uint16(nl.rdxport[0])<<8 | uint16(nl.rdxport[1])
-	destination = netip.AddrPortFrom(M.AddrFromIP(ip), port)
-	return
-}

common/redir/redir_other.go

@@ -1,4 +1,4 @@
-//go:build !linux && !darwin
+//go:build !linux
 
 package redir
 

common/settings/proxy_darwin.go

@@ -1,7 +1,6 @@
 package settings
 
 import (
-	"net/netip"
 	"strings"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -20,8 +19,8 @@ type systemProxy struct {
 	isMixed       bool
 }
 
-func (p *systemProxy) update(event int) error {
-	newInterfaceName := p.monitor.DefaultInterfaceName(netip.IPv4Unspecified())
+func (p *systemProxy) update() error {
+	newInterfaceName := p.monitor.DefaultInterfaceName()
 	if p.interfaceName == newInterfaceName {
 		return nil
 	}
@@ -88,7 +87,7 @@ func SetSystemProxy(router adapter.Router, port uint16, isMixed bool) (func() er
 		port:    port,
 		isMixed: isMixed,
 	}
-	err := proxy.update(tun.EventInterfaceUpdate)
+	err := proxy.update()
 	if err != nil {
 		return nil, err
 	}

common/sniff/dns.go

@@ -22,7 +22,7 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 	if err != nil {
 		return nil, err
 	}
-	if length == 0 {
+	if length > 512 {
 		return nil, os.ErrInvalid
 	}
 	_buffer := buf.StackNewSize(int(length))

constant/proxy.go

@@ -18,7 +18,6 @@ const (
 	TypeHysteria    = "hysteria"
 	TypeTor         = "tor"
 	TypeSSH         = "ssh"
-	TypeShadowTLS   = "shadowtls"
 )
 
 const (

constant/version.go

@@ -1,6 +1,6 @@
 package constant
 
 var (
-	Version = "1.1-beta1"
+	Version = "1.0"
 	Commit  = ""
 )

docs/changelog.md

@@ -1,111 +1,4 @@
-#### 1.1-beta1
-
-* Add support for use with android VPNService **1**
-* Add tun support for WireGuard outbound **2**
-* Add system tun stack **3**
-* Add comment filter for config **4**
-* Add option for allow optional proxy protocol header
-* Add half close for smux
-* Set UDP DF by default **5**
-* Set default tun mtu to 9000
-* Update gVisor to 20220905.0
-
-*1*:
-
-In previous versions, Android VPN would not work with tun enabled.
-
-The usage of tun over VPN and VPN over tun is now supported, see [Tun Inbound](/configuration/inbound/tun#auto_route).
-
-*2*:
-
-In previous releases, WireGuard outbound support was backed by the lower performance gVisor virtual interface.
-
-It achieves the same performance as wireguard-go by providing automatic system interface support.
-
-*3*:
-
-It does not depend on gVisor and has better performance in some cases.
-
-It is less compatible and may not be available in some environments.
-
-*4*:
-
-Annotated json configuration files are now supported.
-
-*5*:
-
-UDP fragmentation is now blocked by default.
-
-Including shadowsocks-libev, shadowsocks-rust and quic-go all disable segmentation by default.
-
-See [Dial Fields](/configuration/shared/dial#udp_fragment)
-and [Listen Fields](/configuration/shared/listen#udp_fragment).
-
-#### 1.0.1
-
-* Fix match 4in6 address in ip_cidr
-* Fix clash api log level format error
-* Fix clash api unknown proxy type
-
-#### 1.0
-
-* Fix wireguard reconnect
-* Fix naive inbound
-* Fix json format error message
-* Fix processing vmess termination signal
-* Fix hysteria stream error
-* Fix listener close when proxyproto failed
-
-#### 1.0-rc1
-
-* Fix write log timestamp
-* Fix write zero
-* Fix dial parallel in direct outbound
-* Fix write trojan udp
-* Fix DNS routing
-* Add attribute support for geosite
-* Update documentation for [Dial Fields](/configuration/shared/dial)
-
-#### 1.0-beta3
-
-* Add [chained inbound](/configuration/shared/listen#detour) support
-* Add process_path rule item
-* Add macOS redirect support
-* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls)
-  and [Examples](/examples/shadowtls)
-* Fix search android package in non-owner users
-* Fix socksaddr type condition
-* Fix smux session status
-* Refactor inbound and outbound documentation
-* Minor fixes
-
-#### 1.0-beta2
-
-* Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
-* Add packetaddr support for [VMess outbound](/configuration/outbound/vmess#packet_addr)
-* Add better performing alternative gRPC implementation
-* Add [docker image](https://github.com/SagerNet/sing-box/pkgs/container/sing-box)
-* Fix sniff override destination
-
-#### 1.0-beta1
-
-* Initial release
-
-##### 2022/08/26
-
-* Fix ipv6 route on linux
-* Fix read DNS message
-
-##### 2022/08/25
-
-* Let vmess use zero instead of auto if TLS enabled
-* Add trojan fallback for ALPN
-* Improve ip_cidr rule
-* Fix format bind_address
-* Fix http proxy with compressed response
-* Fix route connections
-
-##### 2022/08/24
+#### 2022/08/24
 
 * Fix naive padding
 * Fix unix search path
@@ -114,7 +7,7 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Fix early close on windows and catch any
 * Initial zh-CN document translation
 
-##### 2022/08/23
+#### 2022/08/23
 
 * Add [V2Ray Transport](/configuration/shared/v2ray-transport) support for VMess and Trojan
 * Allow plain http request in Naive inbound (It can now be used with nginx)
@@ -123,17 +16,17 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Parse X-Forward-For in HTTP requests
 * Handle SIGHUP signal
 
-##### 2022/08/22
+#### 2022/08/22
 
 * Add strategy setting for each [DNS server](/configuration/dns/server)
 * Add bind address to outbound options
 
-##### 2022/08/21
+#### 2022/08/21
 
 * Add [Tor outbound](/configuration/outbound/tor)
 * Add [SSH outbound](/configuration/outbound/ssh)
 
-##### 2022/08/20
+#### 2022/08/20
 
 * Attempt to unwrap ip-in-fqdn socksaddr
 * Fix read packages in android 12
@@ -143,53 +36,53 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Skip bind connection with private destination to interface
 * Add [Trojan connection fallback](/configuration/inbound/trojan#fallback)
 
-##### 2022/08/19
+#### 2022/08/19
 
 * Add Hysteria [Inbound](/configuration/inbound/hysteria) and [Outbund](/configuration/outbound/hysteria)
 * Add [ACME TLS certificate issuer](/configuration/shared/tls)
 * Allow read config from stdin (-c stdin)
 * Update gVisor to 20220815.0
 
-##### 2022/08/18
+#### 2022/08/18
 
 * Fix find process with lwip stack
 * Fix crash on shadowsocks server
 * Fix crash on darwin tun
 * Fix write log to file
 
-##### 2022/08/17
+#### 2022/08/17
 
 * Improve async dns transports
 
-##### 2022/08/16
+#### 2022/08/16
 
 * Add ip_version (route/dns) rule item
 * Add [WireGuard](/configuration/outbound/wireguard) outbound
 
-##### 2022/08/15
+#### 2022/08/15
 
 * Add uid, android user and package rules support in [Tun](/configuration/inbound/tun) routing.
 
-##### 2022/08/13
+#### 2022/08/13
 
 * Fix dns concurrent write
 
-##### 2022/08/12
+#### 2022/08/12
 
 * Performance improvements
 * Add UoT option for [SOCKS](/configuration/outbound/socks) outbound
 
-##### 2022/08/11
+#### 2022/08/11
 
 * Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks) outbound, UoT support for all inbounds
 
-##### 2022/08/10
+#### 2022/08/10
 
 * Add full-featured [Naive](/configuration/inbound/naive) inbound
 * Fix default dns server option [#9] by iKirby
 
-##### 2022/08/09
+#### 2022/08/09
 
 No changelog before.
 
-[#9]: https://github.com/SagerNet/sing-box/pull/9
+[#9]: https://github.com/SagerNet/sing-box/pull/9

docs/configuration/dns/index.md

@@ -1,5 +1,3 @@
-# DNS
-
 ### Structure
 
 ```json

docs/configuration/dns/rule.md

@@ -38,8 +38,7 @@
           "private"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
+          "10.0.0.0/24"
         ],
         "source_port": [
           12345
@@ -61,9 +60,6 @@
         "process_name": [
           "curl"
         ],
-        "process_path": [
-          "/usr/bin/curl"
-        ],
         "package_name": [
           "com.termux"
         ],
@@ -180,14 +176,6 @@ Match port range.
 
 Match process name.
 
-#### process_path
-
-!!! error ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process path.
-
 #### package_name
 
 Match android package name.

docs/configuration/dns/rule.zh.md

@@ -60,9 +60,6 @@
         "process_name": [
           "curl"
         ],
-        "process_path": [
-          "/usr/bin/curl"
-        ],
         "package_name": [
           "com.termux"
         ],
@@ -179,14 +176,6 @@
 
 匹配进程名称。
 
-#### process_path
-
-!!! error ""
-
-    仅支持 Linux、Windows 和 macOS.
-
-匹配进程路径。
-
 #### package_name
 
 匹配 Android 应用包名。

docs/configuration/dns/server.zh.md

@@ -47,7 +47,7 @@ DNS 服务器的地址。
 
 !!! warning ""
 
-    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#installation)。
 
 !!! info ""
 

docs/configuration/experimental/index.md

@@ -1,5 +1,3 @@
-# Experimental
-
 ### Structure
 
 ```json

docs/configuration/experimental/index.zh.md

@@ -18,7 +18,7 @@
 
 !!! error ""
 
-    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
+    默认安装不包含 Clash API，参阅 [安装](/zh/#installation)。
 
 !!! note ""
 

docs/configuration/inbound/direct.md

@@ -4,22 +4,29 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-in",
-  
-  ... // Listen Fields
+  "inbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "proxy_protocol": false,
 
-  "network": "udp",
-  "override_address": "1.0.0.1",
-  "override_port": 53
+      "network": "udp",
+      "override_address": "1.0.0.1",
+      "override_port": 53
+    }
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Direct Fields
 
 #### network
 
@@ -33,4 +40,50 @@ Override the connection destination address.
 
 #### override_port
 
-Override the connection destination port.
+Override the connection destination port.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/direct.zh.md

@@ -4,22 +4,29 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-in",
+  "inbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-in",
 
-  ... // 监听字段
-
-  "network": "udp",
-  "override_address": "1.0.0.1",
-  "override_port": 53
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp",
+      "proxy_protocol": false,
+      "override_address": "1.0.0.1",
+      "override_port": 53
+    }
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Direct 字段
 
 #### network
 
@@ -35,3 +42,48 @@
 
 覆盖连接目标端口。
 
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/http.md

@@ -2,27 +2,33 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-in",
-  
-  ... // Listen Fields
-  
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "http",
+      "tag": "http-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "tls": {},
+      "set_system_proxy": false
     }
-  ],
-  "tls": {},
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### HTTP Fields
 
 #### tls
 
@@ -41,3 +47,45 @@ No authentication required if empty.
     Only supported on Linux, Android, Windows, and macOS.
 
 Automatically set system proxy configuration when start and clean up when stop.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/http.zh.md

@@ -2,27 +2,33 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "http",
+      "tag": "http-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "tls": {},
+      "set_system_proxy": false
     }
-  ],
-  "tls": {},
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### HTTP 字段
 
 #### tls
 
@@ -32,7 +38,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 HTTP 用户
 
-如果为空则不需要验证。
+默认不需要验证。
 
 #### set_system_proxy
 
@@ -40,4 +46,46 @@ HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
+启动时自动设置系统代理，停止时自动清理。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/hysteria.md

@@ -2,23 +2,31 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-in",
-  
-  ... // Listen Fields
-
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-  "auth": "",
-  "auth_str": "password",
-  "recv_window_conn": 0,
-  "recv_window_client": 0,
-  "max_conn_client": 0,
-  "disable_mtu_discovery": false,
-  "tls": {}
+  "inbounds": [
+    {
+      "type": "hysteria",
+      "tag": "hysteria-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
+      "auth": "",
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window_client": 0,
+      "max_conn_client": 0,
+      "disable_mtu_discovery": false,
+      "tls": {}
+    }
+  ]
 }
 ```
 
@@ -26,11 +34,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Hysteria Fields
 
 #### up, down
 
@@ -97,4 +101,38 @@ Force enabled on for systems other than Linux and Windows (according to upstream
 
 ==Required==
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/hysteria.zh.md

@@ -2,35 +2,39 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-in",
-  
-  ... // 监听字段
-
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-  "auth": "",
-  "auth_str": "password",
-  "recv_window_conn": 0,
-  "recv_window_client": 0,
-  "max_conn_client": 0,
-  "disable_mtu_discovery": false,
-  "tls": {}
+  "inbounds": [
+    {
+      "type": "hysteria",
+      "tag": "hysteria-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
+      "auth": "",
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window_client": 0,
+      "max_conn_client": 0,
+      "disable_mtu_discovery": false,
+      "tls": {}
+    }
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Hysteria 字段
 
 #### up, down
 
@@ -97,4 +101,38 @@ base64 编码的认证密码。
 
 ==必填==
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/index.md

@@ -1,5 +1,3 @@
-# Inbound
-
 ### Structure
 
 ```json
@@ -15,20 +13,20 @@
 
 ### Fields
 
-| Type          | Format                       | Injectable |
-|---------------|------------------------------|------------|
-| `direct`      | [Direct](./direct)           | X          |
-| `mixed`       | [Mixed](./mixed)             | TCP        |
-| `socks`       | [SOCKS](./socks)             | TCP        |
-| `http`        | [HTTP](./http)               | TCP        |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
-| `vmess`       | [VMess](./vmess)             | TCP        |
-| `trojan`      | [Trojan](./trojan)           | TCP        |
-| `naive`       | [Naive](./naive)             | X          |
-| `hysteria`    | [Hysteria](./hysteria)       | X          |
-| `tun`         | [Tun](./tun)                 | X          |
-| `redirect`    | [Redirect](./redirect)       | X          |
-| `tproxy`      | [TProxy](./tproxy)           | X          |
+| Type          | Format                       |
+|---------------|------------------------------|
+| `direct`      | [Direct](./direct)           |
+| `mixed`       | [Mixed](./mixed)             |
+| `socks`       | [SOCKS](./socks)             |
+| `http`        | [HTTP](./http)               |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) |
+| `vmess`       | [VMess](./vmess)             |
+| `trojan`      | [Trojan](./trojan)           |
+| `naive`       | [Naive](./naive)             |
+| `hysteria`    | [Hysteria](./hysteria)       |
+| `tun`         | [Tun](./tun)                 |
+| `redirect`    | [Redirect](./redirect)       |
+| `tproxy`      | [TProxy](./tproxy)           |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -15,20 +15,20 @@
 
 ### 字段
 
-| 类型            | 格式                           | 注入支持 |
-|---------------|------------------------------|------|
-| `direct`      | [Direct](./direct)           | X    |
-| `mixed`       | [Mixed](./mixed)             | TCP  |
-| `socks`       | [SOCKS](./socks)             | TCP  |
-| `http`        | [HTTP](./http)               | TCP  |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
-| `vmess`       | [VMess](./vmess)             | TCP  |
-| `trojan`      | [Trojan](./trojan)           | TCP  |
-| `naive`       | [Naive](./naive)             | X    |
-| `hysteria`    | [Hysteria](./hysteria)       | X    |
-| `tun`         | [Tun](./tun)                 | X    |
-| `redirect`    | [Redirect](./redirect)       | X    |
-| `tproxy`      | [TProxy](./tproxy)           | X    |
+| 类型            | 格式                           |
+|---------------|------------------------------|
+| `direct`      | [Direct](./direct)           |
+| `mixed`       | [Mixed](./mixed)             |
+| `socks`       | [SOCKS](./socks)             |
+| `http`        | [HTTP](./http)               |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) |
+| `vmess`       | [VMess](./vmess)             |
+| `trojan`      | [Trojan](./trojan)           |
+| `naive`       | [Naive](./naive)             |
+| `hysteria`    | [Hysteria](./hysteria)       |
+| `tun`         | [Tun](./tun)                 |
+| `redirect`    | [Redirect](./redirect)       |
+| `tproxy`      | [TProxy](./tproxy)           |
 
 #### tag
 

docs/configuration/inbound/mixed.md

@@ -4,26 +4,32 @@
 
 ```json
 {
-  "type": "mixed",
-  "tag": "mixed-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "mixed",
+      "tag": "mixed-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "set_system_proxy": false
     }
-  ],
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Mixed Fields
 
 #### users
 
@@ -33,6 +39,52 @@ No authentication required if empty.
 
 #### set_system_proxy
 
+!!! error ""
+
+    Only supported on Linux, Android, Windows, and macOS.
+
+Automatically set system proxy configuration when start and clean up when stop.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### set_system_proxy
+
 !!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.

docs/configuration/inbound/mixed.zh.md

@@ -4,32 +4,38 @@
 
 ```json
 {
-  "type": "mixed",
-  "tag": "mixed-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "mixed",
+      "tag": "mixed-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "set_system_proxy": false
     }
-  ],
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Mixed 字段
 
 #### users
 
 SOCKS 和 HTTP 用户
 
-如果为空则不需要验证。
+默认不需要验证。
 
 #### set_system_proxy
 
@@ -37,4 +43,46 @@ SOCKS 和 HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
+启动时自动设置系统代理，停止时自动清理。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/naive.md

@@ -2,19 +2,29 @@
 
 ```json
 {
-  "type": "naive",
-  "tag": "naive-in",
-  "network": "udp",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "sekai",
-      "password": "password"
+      "type": "naive",
+      "tag": "naive-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "network": "udp",
+      "users": [
+        {
+          "username": "sekai",
+          "password": "password"
+        }
+      ],
+      "tls": {}
     }
-  ],
-  "tls": {}
+  ]
 }
 ```
 
@@ -22,11 +32,7 @@
 
     HTTP3 transport is not included by default, see [Installation](/#installation).
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Naive Fields
 
 #### network
 
@@ -42,4 +48,46 @@ Naive users.
 
 #### tls
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/naive.zh.md

@@ -2,31 +2,37 @@
 
 ```json
 {
-  "type": "naive",
-  "tag": "naive-in",
-  "network": "udp",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "sekai",
-      "password": "password"
+      "type": "naive",
+      "tag": "naive-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "network": "udp",
+      "users": [
+        {
+          "username": "sekai",
+          "password": "password"
+        }
+      ],
+      "tls": {}
     }
-  ],
-  "tls": {}
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
+    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#installation)。
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Naive 字段
 
 #### network
 
@@ -42,4 +48,46 @@ Naive 用户。
 
 #### tls
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/redirect.md

@@ -1,18 +1,52 @@
-!!! error ""
-
-    Only supported on Linux and macOS.
-
 ### Structure
 
 ```json
 {
-  "type": "redirect",
-  "tag": "redirect-in",
-
-  ... // Listen Fields
+  "inbounds": [
+    {
+      "type": "redirect",
+      "tag": "redirect-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6"
+    }
+  ]
 }
 ```
 
 ### Listen Fields
 
-See [Listen Fields](/configuration/shared/listen) for details.
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/redirect.zh.md

@@ -1,17 +1,52 @@
-!!! error ""
-
-    仅支持 Linux 和 macOS。
-
 ### 结构
 
 ```json
 {
-  "type": "redirect",
-  "tag": "redirect-in",
-
-  ... // 监听字段
+  "inbounds": [
+    {
+      "type": "redirect",
+      "tag": "redirect-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6"
+    }
+  ]
 }
 ```
+
 ### 监听字段
 
-参阅 [监听字段](/zh/configuration/shared/listen/)。
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/shadowsocks.md

@@ -2,13 +2,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-in",
-
-  ... // Listen Fields
-
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg=="
+  "inbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "network": "udp",
+      "proxy_protocol": false,
+      
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    }
+  ]
 }
 ```
 
@@ -16,12 +28,17 @@
 
 ```json
 {
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "users": [
+        {
+          "name": "sekai",
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
@@ -31,25 +48,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "destinations": [
+  "inbounds": [
     {
-      "name": "test",
-      "server": "example.com",
-      "server_port": 8080,
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "destinations": [
+        {
+          "name": "test",
+          "server": "example.com",
+          "server_port": 8080,
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Shadowsocks Fields
 
 #### network
 

docs/configuration/inbound/shadowsocks.zh.md

@@ -2,13 +2,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-in",
-
-  ... // 监听字段
-
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg=="
+  "inbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "network": "udp",
+      "proxy_protocol": false,
+      
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    }
+  ]
 }
 ```
 
@@ -16,12 +28,17 @@
 
 ```json
 {
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "users": [
+        {
+          "name": "sekai",
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
@@ -31,25 +48,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "destinations": [
+  "inbounds": [
     {
-      "name": "test",
-      "server": "example.com",
-      "server_port": 8080,
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "destinations": [
+        {
+          "name": "test",
+          "server": "example.com",
+          "server_port": 8080,
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### 字段
+### Shadowsocks 字段
 
 #### network
 
@@ -81,4 +98,50 @@ See [Listen Fields](/configuration/shared/listen) for details.
 |---------------|-------------------------------|
 | none          | /                             |
 | 2022 methods  | `openssl rand -base64 <密钥长度>` |
-| other methods | 任意字符串                         |
+| other methods | 任意字符串                         |
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/shadowtls.md

@@ -1,31 +0,0 @@
-### Structure
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-in",
-
-  ... // Listen Fields
-
-  "handshake": {
-    "server": "google.com",
-    "server_port": 443,
-    
-    ... // Dial Fields
-  }
-}
-```
-
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-
-### Fields
-
-#### handshake
-
-==Required==
-
-Handshake server address and [dial options](/configuration/shared/dial).
-

docs/configuration/inbound/shadowtls.zh.md

@@ -1,29 +0,0 @@
-### 结构
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-in",
-
-  ... // 监听字段
-
-  "handshake": {
-    "server": "google.com",
-    "server_port": 443,
-
-    ... // 拨号字段
-  }
-}
-```
-
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
-
-#### handshake
-
-==必填==
-
-握手服务器地址和 [拨号参数](/zh/configuration/shared/dial/)。

docs/configuration/inbound/socks.md

@@ -4,28 +4,76 @@
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "socks",
+      "tag": "socks-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### SOCKS Fields
 
 #### users
 
 SOCKS users.
 
 No authentication required if empty.
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址
+
+#### listen_port
+
+==必填==
+
+监听端口
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/socks.zh.md

@@ -4,28 +4,76 @@
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "socks",
+      "tag": "socks-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ]
     }
   ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### SOCKS 字段
 
 #### users
 
 SOCKS 用户
 
-如果为空则不需要验证。
+默认不需要验证。
+
+### Listen Fields
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/tproxy.md

@@ -1,28 +1,67 @@
-!!! error ""
-
-    Only supported on Linux.
-
 ### Structure
 
 ```json
 {
-  "type": "tproxy",
-  "tag": "tproxy-in",
-
-  ... // Listen Fields
-
-  "network": "udp"
+  "inbounds": [
+    {
+      "type": "tproxy",
+      "tag": "tproxy-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp"
+    }
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### TProxy Fields
 
 #### network
 
 Listen network, one of `tcp` `udp`.
 
 Both if empty.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).

docs/configuration/inbound/tproxy.zh.md

@@ -1,28 +1,67 @@
-!!! error ""
-
-    仅支持 Linux。
-
 ### 结构
 
 ```json
 {
-  "type": "tproxy",
-  "tag": "tproxy-in",
-
-  ... // 监听字段
-
-  "network": "udp"
+  "inbounds": [
+    {
+      "type": "tproxy",
+      "tag": "tproxy-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp"
+    }
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### TProxy 字段
 
 #### network
 
 监听的网络协议，`tcp` `udp` 之一。
 
 默认所有。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

docs/configuration/inbound/trojan.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
+      "type": "trojan",
+      "tag": "trojan-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "password": "8JCsPssfgS8tiRwiMlhARg=="
+        }
+      ],
+      "tls": {},
+      "fallback": {
+        "server": "127.0.0.0.1",
+        "server_port": 8080
+      },
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "fallback": {
-    "server": "127.0.0.1",
-    "server_port": 8080
-  },
-  "fallback_for_alpn": {
-    "http/1.1": {
-      "server": "127.0.0.1",
-      "server_port": 8081
-    }
-  },
-  "transport": {}
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Trojan Fields
 
 #### users
 
@@ -50,14 +50,50 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 
-Fallback server configuration. Disabled if `fallback` and `fallback_for_alpn` are empty.
-
-#### fallback_for_alpn
-
-Fallback server configuration for specified ALPN.
-
-If not empty, TLS fallback requests with ALPN not in this table will be rejected.
+Fallback server configuration. Disabled if empty.
 
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/trojan.zh.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
+      "type": "trojan",
+      "tag": "trojan-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "password": "8JCsPssfgS8tiRwiMlhARg=="
+        }
+      ],
+      "tls": {},
+      "fallback": {
+        "server": "127.0.0.0.1",
+        "server_port": 8080
+      },
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "fallback": {
-    "server": "127.0.0.1",
-    "server_port": 8080
-  },
-  "fallback_for_alpn": {
-    "http/1.1": {
-      "server": "127.0.0.1",
-      "server_port": 8081
-    }
-  },
-  "transport": {}
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Trojan 字段
 
 #### users
 
@@ -50,16 +50,52 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 !!! error ""
 
-    没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
+    没有证据表明 GFW 基于 HTTP 响应检测并阻止木马服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 
-回退服务器配置。如果 `fallback` 和 `fallback_for_alpn` 为空，则禁用回退。
-
-#### fallback_for_alpn
-
-为 ALPN 指定回退服务器配置。
-
-如果不为空，ALPN 不在此列表中的 TLS 回退请求将被拒绝。
+备用服务器配置。默认禁用。
 
 #### transport
 
-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/tun.md

@@ -6,41 +6,47 @@
 
 ```json
 {
-  "type": "tun",
-  "tag": "tun-in",
-  
-  "interface_name": "tun0",
-  "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/128",
-  "mtu": 9000,
-  "auto_route": true,
-  "strict_route": true,
-  "endpoint_independent_nat": false,
-  "stack": "gvisor",
-  "include_uid": [
-    0
-  ],
-  "include_uid_range": [
-    "1000-99999"
-  ],
-  "exclude_uid": [
-    1000
-  ],
-  "exclude_uid_range": [
-    "1000-99999"
-  ],
-  "include_android_user": [
-    0,
-    10
-  ],
-  "include_package": [
-    "com.android.chrome"
-  ],
-  "exclude_package": [
-    "com.android.captiveportallogin"
-  ],
-
-  ... // Listen Fields
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "interface_name": "tun0",
+      "inet4_address": "172.19.0.1/30",
+      "inet6_address": "fdfe:dcba:9876::1/128",
+      "mtu": 1500,
+      "auto_route": true,
+      "endpoint_independent_nat": false,
+      "udp_timeout": 300,
+      "stack": "gvisor",
+      "include_uid": [
+        0
+      ],
+      "include_uid_range": [
+        [
+          "1000-99999"
+        ]
+      ],
+      "exclude_uid": [
+        1000
+      ],
+      "exclude_uid_range": [
+        "1000-99999"
+      ],
+      "include_android_user": [
+        0,
+        10
+      ],
+      "include_package": [
+        "com.android.chrome"
+      ],
+      "exclude_package": [
+        "com.android.captiveportallogin"
+      ],
+      "sniff": true,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv4"
+    }
+  ]
 }
 ```
 
@@ -52,7 +58,7 @@
 
     If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
 
-### Fields
+### Tun Fields
 
 #### interface_name
 
@@ -80,26 +86,8 @@ Set the default route to the Tun.
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
-!!! note "Use with Android VPN"
-
-    By default, VPN takes precedence over tun. To make tun go through VPN, enable `route.override_android_vpn`.
-
-#### strict_route
-
-Enforce strict routing rules in Linux when `auto_route` is enabled:
-
-* Let unsupported network unreachable
-* Route all connections to tun
-
-It prevents address leaks and makes DNS hijacking work on Android and Linux with systemd-resolved, but your device will
-not be accessible by others.
-
 #### endpoint_independent_nat
 
-!!! info ""
-
-    This item is only available on the gvisor stack, other stacks are endpoint-independent NAT by default.
-
 Enable endpoint-independent NAT.
 
 Performance may degrade slightly, so it is not recommended to enable on when it is not needed.
@@ -112,11 +100,10 @@ UDP NAT expiration time in seconds, default is 300 (5 minutes).
 
 TCP/IP stack.
 
-| Stack            | Description                                                                    | Status            |
-|------------------|--------------------------------------------------------------------------------|-------------------|
-| gVisor (default) | Based on [google/gvisor](https://github.com/google/gvisor)                     | recommended       |
- | system           | Less compatibility and sometimes better performance.                           | recommended       |
-| LWIP             | Based on [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | upstream archived |
+| Stack            | Upstream                                                              | Status            |
+|------------------|-----------------------------------------------------------------------|-------------------|
+| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | recommended       |
+| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | upstream archived |
 
 !!! warning ""
 
@@ -165,4 +152,22 @@ Exclude android packages in route.
 
 ### Listen Fields
 
-See [Listen Fields](/configuration/shared/listen) for details.
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/tun.zh.md

@@ -6,41 +6,47 @@
 
 ```json
 {
-  "type": "tun",
-  "tag": "tun-in",
-
-  "interface_name": "tun0",
-  "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/128",
-  "mtu": 9000,
-  "auto_route": true,
-  "strict_route": true,
-  "endpoint_independent_nat": false,
-  "stack": "gvisor",
-  "include_uid": [
-    0
-  ],
-  "include_uid_range": [
-    "1000-99999"
-  ],
-  "exclude_uid": [
-    1000
-  ],
-  "exclude_uid_range": [
-    "1000-99999"
-  ],
-  "include_android_user": [
-    0,
-    10
-  ],
-  "include_package": [
-    "com.android.chrome"
-  ],
-  "exclude_package": [
-    "com.android.captiveportallogin"
-  ],
-
-  ... // 监听字段
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "interface_name": "tun0",
+      "inet4_address": "172.19.0.1/30",
+      "inet6_address": "fdfe:dcba:9876::1/128",
+      "mtu": 1500,
+      "auto_route": true,
+      "endpoint_independent_nat": false,
+      "udp_timeout": 300,
+      "stack": "gvisor",
+      "include_uid": [
+        0
+      ],
+      "include_uid_range": [
+        [
+          "1000-99999"
+        ]
+      ],
+      "exclude_uid": [
+        1000
+      ],
+      "exclude_uid_range": [
+        "1000-99999"
+      ],
+      "include_android_user": [
+        0,
+        10
+      ],
+      "include_package": [
+        "com.android.chrome"
+      ],
+      "exclude_package": [
+        "com.android.captiveportallogin"
+      ],
+      "sniff": true,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv4"
+    }
+  ]
 }
 ```
 
@@ -80,19 +86,6 @@ tun 接口的 IPv6 前缀。
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
-!!! note "与 Android VPN 一起使用"
-
-    VPN 默认优先于 tun。要使 tun 经过 VPN，启用 `route.override_android_vpn`。
-
-#### strict_route
-
-在 Linux 中启用 `auto_route` 时执行严格的路由规则。
-
-* 让不支持的网络无法到达
-* 将所有连接路由到 tun
-
-它可以防止地址泄漏，并使 DNS 劫持在 Android 和使用 systemd-resolved 的 Linux 上工作，但你的设备将无法其他设备被访问。
-
 #### endpoint_independent_nat
 
 启用独立于端点的 NAT。
@@ -107,15 +100,14 @@ UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
 
 TCP/IP 栈。
 
-| 栈                | 描述                                                                       | 状态    |
-|------------------|--------------------------------------------------------------------------|-------|
-| gVisor (default) | 基于 [google/gvisor](https://github.com/google/gvisor)                     | 推荐    |
-| system           | 兼容性较差，有时性能更好。                                                            | 推荐    |
-| LWIP             | 基于 [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
+| 栈                | 上游                                                                    | 状态    |
+|------------------|-----------------------------------------------------------------------|-------|
+| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | 推荐    |
+| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
 
 !!! warning ""
 
-    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#installation)。
 
 #### include_uid
 
@@ -160,4 +152,22 @@ TCP/IP 栈。
 
 ### 监听字段
 
-参阅 [监听字段](/zh/configuration/shared/listen/)。
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/vmess.md

@@ -2,28 +2,34 @@
 
 ```json
 {
-  "type": "vmess",
-  "tag": "vmess-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "alterId": 0
+      "type": "vmess",
+      "tag": "vmess-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+          "alterId": 0
+        }
+      ],
+      "tls": {},
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "transport": {}
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### VMess Fields
 
 #### users
 
@@ -47,3 +53,45 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/vmess.zh.md

@@ -2,28 +2,34 @@
 
 ```json
 {
-  "type": "vmess",
-  "tag": "vmess-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "alterId": 0
+      "type": "vmess",
+      "tag": "vmess-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+          "alterId": 0
+        }
+      ],
+      "tls": {},
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "transport": {}
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### VMess 字段
 
 #### users
 
@@ -47,3 +53,45 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 #### transport
 
 V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/index.md

@@ -8,8 +8,8 @@ sing-box uses JSON for configuration files.
 {
   "log": {},
   "dns": {},
-  "inbounds": [],
-  "outbounds": [],
+  "inbounds": {},
+  "outbounds": {},
   "route": {},
   "experimental": {}
 }

docs/configuration/index.zh.md

@@ -8,8 +8,8 @@ sing-box 使用 JSON 作为配置文件格式。
 {
   "log": {},
   "dns": {},
-  "inbounds": [],
-  "outbounds": [],
+  "inbounds": {},
+  "outbounds": {},
   "route": {},
   "experimental": {}
 }

docs/configuration/log.md

@@ -1,5 +1,3 @@
-# Log
-
 ### Structure
 
 ```json

docs/configuration/log.zh.md

@@ -1,5 +1,3 @@
-# 日志
-
 ### 结构
 
 ```json

docs/configuration/outbound/block.md

@@ -4,8 +4,12 @@
 
 ```json
 {
-  "type": "block",
-  "tag": "block"
+  "outbounds": [
+    {
+      "type": "block",
+      "tag": "block"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/block.zh.md

@@ -4,8 +4,12 @@
 
 ```json
 {
-  "type": "block",
-  "tag": "block"
+  "outbounds": [
+    {
+      "type": "block",
+      "tag": "block"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/direct.md

@@ -4,18 +4,30 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-out",
-  
-  "override_address": "1.0.0.1",
-  "override_port": 53,
-  "proxy_protocol": 0,
-  
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-out",
+      
+      "override_address": "1.0.0.1",
+      "override_port": 53,
+      "proxy_protocol": 0,
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### Direct Fields
 
 #### override_address
 
@@ -33,4 +45,54 @@ Protocol value can be `1` or `2`.
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before connect.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/direct.zh.md

@@ -4,18 +4,30 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-out",
-  
-  "override_address": "1.0.0.1",
-  "override_port": 53,
-  "proxy_protocol": 0,
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-out",
+      
+      "override_address": "1.0.0.1",
+      "override_port": 53,
+      "proxy_protocol": 0,
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### Direct 字段
 
 #### override_address
 
@@ -33,4 +45,51 @@
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，域名将在请求发出之前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/dns.md

@@ -4,8 +4,12 @@
 
 ```json
 {
-  "type": "dns",
-  "tag": "dns-out"
+  "outbounds": [
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/dns.zh.md

@@ -4,8 +4,12 @@
 
 ```json
 {
-  "type": "dns",
-  "tag": "dns-out"
+  "outbounds": [
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/http.md

@@ -4,20 +4,32 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "username": "sekai",
-  "password": "admin",
-  "tls": {},
-  
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "http",
+      "tag": "http-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "username": "sekai",
+      "password": "admin",
+      "tls": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### HTTP Fields
 
 #### server
 
@@ -45,4 +57,54 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/http.zh.md

@@ -4,20 +4,32 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "username": "sekai",
-  "password": "admin",
-  "tls": {},
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "http",
+      "tag": "http-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "username": "sekai",
+      "password": "admin",
+      "tls": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### HTTP 字段
 
 #### server
 
@@ -45,4 +57,51 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/hysteria.md

@@ -2,25 +2,37 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-  "auth": "",
-  "auth_str": "password",
-  "recv_window_conn": 0,
-  "recv_window": 0,
-  "disable_mtu_discovery": false,
-  "network": "tcp",
-  "tls": {},
-  
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "hysteria",
+      "tag": "hysteria-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
+      "auth": "",
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window": 0,
+      "disable_mtu_discovery": false,
+      "network": "tcp",
+      "tls": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
@@ -28,7 +40,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Fields
+### Hysteria Fields
 
 #### server
 
@@ -113,4 +125,54 @@ Both is enabled by default.
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/hysteria.zh.md

@@ -2,33 +2,45 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-  "auth": "",
-  "auth_str": "password",
-  "recv_window_conn": 0,
-  "recv_window": 0,
-  "disable_mtu_discovery": false,
-  "network": "tcp",
-  "tls": {},
-  
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "hysteria",
+      "tag": "hysteria-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
+      "auth": "",
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window": 0,
+      "disable_mtu_discovery": false,
+      "network": "tcp",
+      "tls": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
 
-### 字段
+### Hysteria 字段
 
 #### server
 
@@ -111,4 +123,51 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/index.md

@@ -1,5 +1,3 @@
-# Outbound
-
 ### Structure
 
 ```json

docs/configuration/outbound/selector.md

@@ -2,15 +2,19 @@
 
 ```json
 {
-  "type": "selector",
-  "tag": "select",
-  
   "outbounds": [
-    "proxy-a",
-    "proxy-b",
-    "proxy-c"
-  ],
-  "default": "proxy-c"
+    {
+      "type": "selector",
+      "tag": "select",
+      
+      "outbounds": [
+        "proxy-a",
+        "proxy-b",
+        "proxy-c"
+      ],
+      "default": "proxy-c"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/selector.zh.md

@@ -2,15 +2,19 @@
 
 ```json
 {
-  "type": "selector",
-  "tag": "select",
-
   "outbounds": [
-    "proxy-a",
-    "proxy-b",
-    "proxy-c"
-  ],
-  "default": "proxy-c"
+    {
+      "type": "selector",
+      "tag": "select",
+      
+      "outbounds": [
+        "proxy-a",
+        "proxy-b",
+        "proxy-c"
+      ],
+      "default": "proxy-c"
+    }
+  ]
 }
 ```
 

docs/configuration/outbound/shadowsocks.md

@@ -2,22 +2,34 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "network": "udp",
-  "udp_over_tcp": false,
-  "multiplex": {},
-
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "network": "udp",
+      "udp_over_tcp": false,
+      "multiplex": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### Shadowsocks Fields
 
 #### server
 
@@ -85,4 +97,54 @@ Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/shadowsocks.zh.md

@@ -1,23 +1,35 @@
-### 结构
+### Structure
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "network": "udp",
-  "udp_over_tcp": false,
-  "multiplex": {},
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "network": "udp",
+      "udp_over_tcp": false,
+      "multiplex": {},
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### Shadowsocks 字段
 
 #### server
 
@@ -85,4 +97,51 @@ Shadowsocks 密码。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/shadowtls.md

@@ -1,38 +0,0 @@
-### Structure
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "tls": {},
-
-  ... // Dial Fields
-}
-```
-
-### Fields
-
-#### server
-
-==Required==
-
-The server address.
-
-#### server_port
-
-==Required==
-
-The server port.
-
-#### tls
-
-==Required==
-
-TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
-
-### Dial Fields
-
-See [Dial Fields](/configuration/shared/dial) for details.

docs/configuration/outbound/shadowtls.zh.md

@@ -1,38 +0,0 @@
-### 结构
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "tls": {},
-
-  ... // 拨号字段
-}
-```
-
-### 字段
-
-#### server
-
-==必填==
-
-服务器地址。
-
-#### server_port
-
-==必填==
-
-服务器端口。
-
-#### tls
-
-==必填==
-
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
-
-### 拨号字段
-
-参阅 [拨号字段](/zh/configuration/shared/dial/)。

docs/configuration/outbound/socks.md

@@ -4,22 +4,34 @@
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "version": "5",
-  "username": "sekai",
-  "password": "admin",
-  "network": "udp",
-  "udp_over_tcp": false,
+  "outbounds": [
+    {
+      "type": "socks",
+      "tag": "socks-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "version": "5",
+      "username": "sekai",
+      "password": "admin",
+      "network": "udp",
+      "udp_over_tcp": false,
 
-  ... // Dial Fields
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### SOCKS Fields
 
 #### server
 
@@ -61,4 +73,54 @@ Enable the UDP over TCP protocol.
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/socks.zh.md

@@ -1,25 +1,37 @@
 `socks` 出站是 socks4/socks4a/socks5 客户端
 
-### 结构
+### Structure
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "version": "5",
-  "username": "sekai",
-  "password": "admin",
-  "network": "udp",
-  "udp_over_tcp": false,
+  "outbounds": [
+    {
+      "type": "socks",
+      "tag": "socks-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "version": "5",
+      "username": "sekai",
+      "password": "admin",
+      "network": "udp",
+      "udp_over_tcp": false,
 
-  ... // 拨号字段
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### SOCKS 字段
 
 #### server
 
@@ -61,4 +73,51 @@ SOCKS5 密码。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/ssh.md

@@ -2,24 +2,36 @@
 
 ```json
 {
-  "type": "ssh",
-  "tag": "ssh-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 22,
-  "user": "root",
-  "password": "admin",
-  "private_key": "",
-  "private_key_path": "$HOME/.ssh/id_rsa",
-  "private_key_passphrase": "",
-  "host_key_algorithms": [],
-  "client_version": "SSH-2.0-OpenSSH_7.4p1",
-
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "ssh",
+      "tag": "ssh-out",
+     
+      "server": "127.0.0.1",
+      "server_port": 22,
+      "user": "root",
+      "password": "admin",
+      "private_key": "",
+      "private_key_path": "$HOME/.ssh/id_rsa",
+      "private_key_passphrase": "",
+      "host_key_algorithms": [],
+      "client_version": "SSH-2.0-OpenSSH_7.4p1",
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### SSH Fields
 
 #### server
 
@@ -61,4 +73,54 @@ Client version. Random version will be used if empty.
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/ssh.zh.md

@@ -1,25 +1,37 @@
-### 结构
+### Structure
 
 ```json
 {
-  "type": "ssh",
-  "tag": "ssh-out",
-
-  "server": "127.0.0.1",
-  "server_port": 22,
-  "user": "root",
-  "password": "admin",
-  "private_key": "",
-  "private_key_path": "$HOME/.ssh/id_rsa",
-  "private_key_passphrase": "",
-  "host_key_algorithms": [],
-  "client_version": "SSH-2.0-OpenSSH_7.4p1",
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "ssh",
+      "tag": "ssh-out",
+     
+      "server": "127.0.0.1",
+      "server_port": 22,
+      "user": "root",
+      "password": "admin",
+      "private_key": "",
+      "private_key_path": "$HOME/.ssh/id_rsa",
+      "private_key_passphrase": "",
+      "host_key_algorithms": [],
+      "client_version": "SSH-2.0-OpenSSH_7.4p1",
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### SSH 字段
 
 #### server
 
@@ -61,4 +73,51 @@ SSH 用户, 默认使用 root。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/tor.md

@@ -2,17 +2,29 @@
 
 ```json
 {
-  "type": "tor",
-  "tag": "tor-out",
-  
-  "executable_path": "/usr/bin/tor",
-  "extra_args": [],
-  "data_directory": "$HOME/.cache/tor",
-  "torrc": {
-    "ClientOnly": 1
-  },
-
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "tor",
+      "tag": "tor-out",
+      
+      "executable_path": "/usr/bin/tor",
+      "extra_args": [],
+      "data_directory": "$HOME/.cache/tor",
+      "torrc": {
+        "ClientOnly": 1
+      },
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
@@ -20,7 +32,7 @@
 
     Embedded tor is not included by default, see [Installation](/#installation).
 
-### Fields
+### Tor Fields
 
 #### executable_path
 
@@ -44,8 +56,58 @@ Each start will be very slow if not specified.
 
 Map of torrc options.
 
-See [tor(1)](https://linux.die.net/man/1/tor) for details.
+See [tor(1)](https://linux.die.net/man/1/tor)
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/tor.zh.md

@@ -2,25 +2,37 @@
 
 ```json
 {
-  "type": "tor",
-  "tag": "tor-out",
-
-  "executable_path": "/usr/bin/tor",
-  "extra_args": [],
-  "data_directory": "$HOME/.cache/tor",
-  "torrc": {
-    "ClientOnly": 1
-  },
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "tor",
+      "tag": "tor-out",
+      
+      "executable_path": "/usr/bin/tor",
+      "extra_args": [],
+      "data_directory": "$HOME/.cache/tor",
+      "torrc": {
+        "ClientOnly": 1
+      },
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
 !!! info ""
 
-    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#_2)。
+    默认安装不包含嵌入式 Tor, 参阅 [安装](/zh/#installation)。
 
-### 字段
+### Tor 字段
 
 #### executable_path
 
@@ -48,4 +60,51 @@ torrc 参数表。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/trojan.md

@@ -2,22 +2,34 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-out",
+  "outbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "network": "tcp",
+      "tls": {},
+      "multiplex": {},
+      "transport": {},
 
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "network": "tcp",
-  "tls": {},
-  "multiplex": {},
-  "transport": {},
-
-  ... // Dial Fields
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### Trojan Fields
 
 #### server
 
@@ -59,4 +71,54 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/trojan.zh.md

@@ -2,22 +2,34 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "network": "tcp",
-  "tls": {},
-  "multiplex": {},
-  "transport": {},
+  "outbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "network": "tcp",
+      "tls": {},
+      "multiplex": {},
+      "transport": {},
 
-  ... // 拨号字段
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### Trojan 字段
 
 #### server
 
@@ -59,4 +71,51 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/vmess.md

@@ -2,27 +2,38 @@
 
 ```json
 {
-  "type": "vmess",
-  "tag": "vmess-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-  "security": "auto",
-  "alter_id": 0,
-  "global_padding": false,
-  "authenticated_length": true,
-  "network": "tcp",
-  "tls": {},
-  "packet_addr": false,
-  "multiplex": {},
-  "transport": {},
+  "outbounds": [
+    {
+      "type": "vmess",
+      "tag": "vmess-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "security": "auto",
+      "alter_id": 0,
+      "global_padding": false,
+      "authenticated_length": true,
+      "network": "tcp",
+      "tls": {},
+      "multiplex": {},
+      "transport": {},
 
-  ... // Dial Fields
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### Fields
+### VMess Fields
 
 #### server
 
@@ -84,10 +95,6 @@ Both is enabled by default.
 
 TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
-#### packet_addr
-
-Enable packetaddr support.
-
 #### multiplex
 
 Multiplex configuration, see [Multiplex](/configuration/shared/multiplex).
@@ -98,4 +105,54 @@ V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/vmess.zh.md

@@ -2,27 +2,36 @@
 
 ```json
 {
-  "type": "vmess",
-  "tag": "vmess-out",
-
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-  "security": "auto",
-  "alter_id": 0,
-  "global_padding": false,
-  "authenticated_length": true,
-  "network": "tcp",
-  "tls": {},
-  "packet_addr": false,
-  "multiplex": {},
-  "transport": {},
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "vmess",
+      "tag": "vmess-out",
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+      "security": "auto",
+      "alter_id": 0,
+      "global_padding": false,
+      "authenticated_length": true,
+      "network": "tcp",
+      "tls": {},
+      "multiplex": {},
+      "transport": {},
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
-### 字段
+### VMess 字段
 
 #### server
 
@@ -84,10 +93,6 @@ VMess 用户 ID。
 
 TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。
 
-#### packet_addr
-
-启用 packetaddr 支持。
-
 #### multiplex
 
 多路复用配置, 参阅 [多路复用](/zh/configuration/shared/multiplex)。
@@ -98,4 +103,51 @@ V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-tra
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/outbound/wireguard.md

@@ -2,23 +2,34 @@
 
 ```json
 {
-  "type": "wireguard",
-  "tag": "wireguard-out",
-  
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "system_interface": false,
-  "interface_name": "wg0",
-  "local_address": [
-    "10.0.0.2/32"
-  ],
-  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-  "mtu": 1408,
-  "network": "tcp",
-
-  ... // Dial Fields
+  "outbounds": [
+    {
+      "type": "wireguard",
+      "tag": "wireguard-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "local_address": [
+        "10.0.0.1",
+        "10.0.0.2/32"
+      ],
+      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+      "mtu": 1408,
+      "network": "tcp",
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
@@ -26,7 +37,7 @@
 
     WireGuard is not included by default, see [Installation](/#installation).
 
-### Fields
+### WireGuard Fields
 
 #### server
 
@@ -40,21 +51,11 @@ The server address.
 
 The server port.
 
-#### system_interface
-
-Use system tun support.
-
-Requires privileges and cannot conflict with system interfaces.
-
-#### interface_name
-
-Custom device name when `system_interface` enabled.
-
 #### local_address
 
 ==Required==
 
-List of IP (v4 or v6) address prefixes to be assigned to the interface.
+List of IP (v4 or v6) addresses (optionally with CIDR masks) to be assigned to the interface.
 
 #### private_key
 
@@ -91,4 +92,54 @@ Both is enabled by default.
 
 ### Dial Fields
 
-See [Dial Fields](/configuration/shared/dial) for details.
+#### detour
+
+The tag of the upstream outbound.
+
+Other dial fields will be ignored when enabled.
+
+#### bind_interface
+
+The network interface to bind to.
+
+#### bind_address
+
+The address to bind to.
+
+#### routing_mark
+
+!!! error ""
+
+    Only supported on Linux.
+
+Set netfilter routing mark.
+
+#### reuse_addr
+
+Reuse listener address.
+
+#### connect_timeout
+
+Connect timeout, in golang's Duration format.
+
+A duration string is a possibly signed sequence of
+decimal numbers, each with optional fraction and a unit suffix,
+such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the server domain name will be resolved to IP before connecting.
+
+`dns.strategy` will be used if empty.
+
+#### fallback_delay
+
+The length of time to wait before spawning a RFC 6555 Fast Fallback connection.
+That is, is the amount of time to wait for IPv6 to succeed before assuming
+that IPv6 is misconfigured and falling back to IPv4 if `prefer_ipv4` is set.
+If zero, a default delay of 300ms is used.
+
+Only take effect when `domain_strategy` is `prefer_ipv4` or `prefer_ipv6`.

docs/configuration/outbound/wireguard.zh.md

@@ -2,31 +2,42 @@
 
 ```json
 {
-  "type": "wireguard",
-  "tag": "wireguard-out",
-
-  "server": "127.0.0.1",
-  "server_port": 1080,
-  "system_interface": false,
-  "interface_name": "wg0",
-  "local_address": [
-    "10.0.0.2/32"
-  ],
-  "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
-  "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
-  "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
-  "mtu": 1408,
-  "network": "tcp",
-
-  ... // 拨号字段
+  "outbounds": [
+    {
+      "type": "wireguard",
+      "tag": "wireguard-out",
+      
+      "server": "127.0.0.1",
+      "server_port": 1080,
+      "local_address": [
+        "10.0.0.1",
+        "10.0.0.2/32"
+      ],
+      "private_key": "YNXtAzepDqRv9H52osJVDQnznT5AM11eCK3ESpwSt04=",
+      "peer_public_key": "Z1XXLsKYkYxuiYjJIkRvtIKFepCYHTgON+GwPq7SOV4=",
+      "pre_shared_key": "31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=",
+      "mtu": 1408,
+      "network": "tcp",
+      
+      "detour": "upstream-out",
+      "bind_interface": "en0",
+      "bind_address": "0.0.0.0",
+      "routing_mark": 1234,
+      "reuse_addr": false,
+      "connect_timeout": "5s",
+      "tcp_fast_open": false,
+      "domain_strategy": "prefer_ipv6",
+      "fallback_delay": "300ms"
+    }
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 WireGuard, 参阅 [安装](/zh/#_2)。
+    默认安装不包含 WireGuard, 参阅 [安装](/zh/#installation)。
 
-### 字段
+### WireGuard 字段
 
 #### server
 
@@ -40,23 +51,13 @@
 
 服务器端口。
 
-#### system_interface
-
-使用系统 tun 支持。
-
-需要特权且不能与系统接口冲突。
-
-#### interface_name
-
-启用 `system_interface` 时的自定义设备名称。
-
 #### local_address
 
 ==必填==
 
 接口的 IPv4/IPv6 地址或地址段的列表您。
 
-要分配给接口的 IP（v4 或 v6）地址段列表。
+要分配给接口的 IP（v4 或 v6）地址列表（可以选择带有 CIDR 掩码）。
 
 #### private_key
 
@@ -93,4 +94,51 @@ WireGuard MTU。 默认1408。
 
 ### 拨号字段
 
-参阅 [拨号字段](/zh/configuration/shared/dial/)。
+#### detour
+
+上游出站的标签。
+
+启用时，其他拨号字段将被忽略。
+
+#### bind_interface
+
+要绑定到的网络接口。
+
+#### bind_address
+
+要绑定的地址。
+
+#### routing_mark
+
+!!! error ""
+
+    仅支持 Linux。
+
+设置 netfilter 路由标记。
+
+#### reuse_addr
+
+重用监听地址。
+
+#### connect_timeout
+
+连接超时，采用 golang 的 Duration 格式。
+
+持续时间字符串是一个可能有符号的序列十进制数，每个都有可选的分数和单位后缀， 例如 "300ms"、"-1.5h" 或 "2h45m"。
+有效时间单位为 "ns"、"us"（或 "µs"）、"ms"、"s"、"m"、"h"。
+
+#### domain_strategy
+
+可选值：`prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，服务器域名将在连接前解析为 IP。
+
+默认使用 `dns.strategy`。
+
+#### fallback_delay
+
+在生成 RFC 6555 快速回退连接之前等待的时间长度。
+也就是说，是在假设之前等待 IPv6 成功的时间量如果设置了 "prefer_ipv4"，则 IPv6 配置错误并回退到 IPv4。
+如果为零，则使用 300 毫秒的默认延迟。
+
+仅当 `domain_strategy` 为 `prefer_ipv4` 或 `prefer_ipv6` 时生效。

docs/configuration/route/index.md

@@ -1,5 +1,3 @@
-# Route
-
 ### Structure
 
 ```json
@@ -10,7 +8,6 @@
     "rules": [],
     "final": "",
     "auto_detect_interface": false,
-    "override_android_vpn": false,
     "default_interface": "en0",
     "default_mark": 233
   }
@@ -35,25 +32,17 @@ Default outbound tag. the first outbound will be used if empty.
 
     Only supported on Linux, Windows and macOS.
 
-Bind outbound connections to the default NIC by default to prevent routing loops under tun.
+Bind outbound connections to the default NIC by default to prevent routing loops under Tun.
 
 Takes no effect if `outbound.bind_interface` is set.
 
-#### override_android_vpn
-
-!!! error ""
-
-    Only supported on Android.
-
-Accept Android VPN as upstream NIC when `auto_detect_interface` enabled.
-
 #### default_interface
 
 !!! error ""
 
     Only supported on Linux, Windows and macOS.
 
-Bind outbound connections to the specified NIC by default to prevent routing loops under tun.
+Bind outbound connections to the specified NIC by default to prevent routing loops under Tun.
 
 Takes no effect if `auto_detect_interface` is set.
 

docs/configuration/route/index.zh.md

@@ -10,7 +10,6 @@
     "rules": [],
     "final": "",
     "auto_detect_interface": false,
-    "override_android_vpn": false,
     "default_interface": "en0",
     "default_mark": 233
   }
@@ -35,25 +34,17 @@
 
     仅支持 Linux、Windows 和 macOS。
 
-默认将出站连接绑定到默认网卡，以防止在 tun 下出现路由环路。
+默认将出站连接绑定到默认网卡，以防止在 Tun 下出现路由环路。
 
 如果设置了 `outbound.bind_interface` 设置，则不生效。
 
-#### override_android_vpn
-
-!!! error ""
-
-    仅支持 Android。
-
-启用 `auto_detect_interface` 时接受 Android VPN 作为上游网卡。
-
 #### default_interface
 
 !!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
-默认将出站连接绑定到指定网卡，以防止在 tun 下出现路由环路。
+默认将出站连接绑定到指定网卡，以防止在 Tun 下出现路由环路。
 
 如果设置了 `auto_detect_interface` 设置，则不生效。
 

docs/configuration/route/rule.md

@@ -41,12 +41,10 @@
           "cn"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
+          "10.0.0.0/24"
         ],
         "ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
+          "10.0.0.0/24"
         ],
         "source_port": [
           12345
@@ -68,9 +66,6 @@
         "process_name": [
           "curl"
         ],
-        "process_path": [
-          "/usr/bin/curl"
-        ],
         "package_name": [
           "com.termux"
         ],
@@ -191,14 +186,6 @@ Match port range.
 
 Match process name.
 
-#### process_path
-
-!!! error ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process path.
-
 #### package_name
 
 Match android package name.