Add daemon support

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,6 @@
 name: Bug Report
 description: "Create a report to help us improve."
+labels: [ bug ]
 body:
   - type: checkboxes
     id: terms
@@ -12,7 +13,7 @@ body:
           required: true
         - label: Yes, I've searched similar issues on GitHub and didn't find any.
           required: true
-        - label: Yes, I've included all information below (version, **FULL** config, **FULL** log, etc).
+        - label: Yes, I've included all information below (version, config, log, etc).
           required: true
 
   - type: textarea
@@ -31,7 +32,7 @@ body:
         <details>
 
         ```console
-        $ sing-box version
+        $ sing-box --version
         # Paste output here
         ```
 
@@ -55,7 +56,7 @@ body:
       required: true
 
   - type: textarea
-    id: log
+    id: config
     attributes:
       label: Server and client log file
       value: |-

.github/update_dependencies.sh

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
 PROJECTS=$(dirname "$0")/../..
-go get -x github.com/sagernet/$1@$(git -C $PROJECTS/$1 rev-parse HEAD)
+
+go get -x github.com/sagernet/sing@$(git -C $PROJECTS/sing rev-parse HEAD)
+go get -x github.com/sagernet/sing-dns@$(git -C $PROJECTS/sing-dns rev-parse HEAD)
+go get -x github.com/sagernet/sing-tun@$(git -C $PROJECTS/sing-tun rev-parse HEAD)
+go get -x github.com/sagernet/sing-shadowsocks@$(git -C $PROJECTS/sing-shadowsocks rev-parse HEAD)
+go get -x github.com/sagernet/sing-vmess@$(git -C $PROJECTS/sing-vmess rev-parse HEAD)
 go mod tidy

.github/workflows/debug.yml

@@ -3,18 +3,14 @@ name: Debug build
 on:
   push:
     branches:
-      - main
       - dev
-      - dev-next
     paths-ignore:
       - '**.md'
       - '.github/**'
       - '!.github/workflows/debug.yml'
   pull_request:
     branches:
-      - main
       - dev
-      - dev-next
 
 jobs:
   build:
@@ -55,27 +51,6 @@ jobs:
       - name: Run Test
         run: |
           go test -v ./...
-  build_go118:
-    name: Debug build (Go 1.18)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.18.7
-      - name: Cache go module
-        uses: actions/cache@v2
-        with:
-          path: |
-            ~/go/pkg/mod
-          key: go118-${{ hashFiles('**/go.sum') }}
-      - name: Run Test
-        run: |
-          go test -v ./...
   cross:
     strategy:
       matrix:
@@ -149,9 +124,6 @@ jobs:
           - name: linux-mips64el
             goos: linux
             goarch: mips64le
-          - name: linux-s390x
-            goos: linux
-            goarch: s390x
           # darwin
           - name: darwin-amd64
             goos: darwin
@@ -216,4 +188,4 @@ jobs:
         uses: actions/upload-artifact@v2
         with:
           name: sing-box-${{ matrix.name }}
-          path: sing-box*
+          path: sing-box*

.github/workflows/docker.yml

@@ -1,48 +0,0 @@
-name: Build Docker Images
-on:
-  push:
-    tags:
-      - v*
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag version you want to build"
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Setup QEMU for Docker Buildx
-        uses: docker/setup-qemu-action@v2
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Docker metadata
-        id: metadata
-        uses: docker/metadata-action@v3
-        with:
-          images: ghcr.io/sagernet/sing-box
-      - name: Get tag to build
-        id: tag
-        run: |
-          echo "latest=ghcr.io/sagernet/sing-box:latest" >> $GITHUB_OUTPUT
-          if [[ -z "${{ github.event.inputs.tag }}" ]]; then
-            echo "versioned=ghcr.io/sagernet/sing-box:${{ github.ref_name }}" >> $GITHUB_OUTPUT
-          else
-            echo "versioned=ghcr.io/sagernet/sing-box:${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
-          fi
-      - name: Build and release Docker images
-        uses: docker/build-push-action@v2
-        with:
-          platforms: linux/386,linux/amd64,linux/arm64,linux/s390x
-          target: dist
-          tags: |
-            ${{ steps.tag.outputs.latest }}
-            ${{ steps.tag.outputs.versioned }}
-          push: true

.gitignore

@@ -4,5 +4,4 @@
 /*.db
 /site/
 /bin/
-/dist/
-/sing-box
+/dist/

.golangci.yml

@@ -7,10 +7,6 @@ linters:
     - staticcheck
     - paralleltest
 
-run:
-  skip-dirs:
-    - transport/cloudflaretls
-
 linters-settings:
 #  gci:
 #    sections:

.goreleaser.yaml

@@ -9,24 +9,19 @@ builds:
     gcflags:
       - all=-trimpath={{.Env.GOPATH}}
     ldflags:
-      - -s -w -buildid=
+      - -X github.com/sagernet/sing-box/constant.Commit={{ .ShortCommit }} -s -w -buildid=
     tags:
-      - with_gvisor
       - with_quic
       - with_wireguard
-      - with_utls
+      - with_acme
       - with_clash_api
     env:
       - CGO_ENABLED=0
     targets:
-      - android_arm64
-      - android_amd64
-      - android_amd64_v3
       - linux_amd64_v1
       - linux_amd64_v3
       - linux_arm64
       - linux_arm_7
-      - linux_s390x
       - windows_amd64_v1
       - windows_amd64_v3
       - windows_386

Dockerfile

@@ -1,22 +0,0 @@
-FROM golang:1.19-alpine AS builder
-LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
-COPY . /go/src/github.com/sagernet/sing-box
-WORKDIR /go/src/github.com/sagernet/sing-box
-ARG GOPROXY=""
-ENV GOPROXY ${GOPROXY}
-ENV CGO_ENABLED=0
-RUN set -ex \
-    && apk add git build-base \
-    && export COMMIT=$(git rev-parse --short HEAD) \
-    && go build -v -trimpath -tags with_quic,with_wireguard,with_acme \
-        -o /go/bin/sing-box \
-        -ldflags "-s -w -buildid=" \
-        ./cmd/sing-box
-FROM alpine AS dist
-LABEL maintainer="nekohasekai <contact-git@sekai.icu>"
-RUN set -ex \
-    && apk upgrade \
-    && apk add bash tzdata ca-certificates \
-    && rm -rf /var/cache/apk/*
-COPY --from=builder /go/bin/sing-box /usr/local/bin/sing-box
-ENTRYPOINT ["sing-box"]

Makefile

@@ -1,8 +1,9 @@
 NAME = sing-box
 COMMIT = $(shell git rev-parse --short HEAD)
-TAGS ?= with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api
-TAGS_TEST ?= with_gvisor,with_quic,with_wireguard,with_grpc,with_ech,with_utls,with_shadowsocksr
-PARAMS = -v -trimpath -tags "$(TAGS)" -ldflags "-s -w -buildid="
+TAGS ?= with_quic,with_wireguard,with_clash_api,with_daemon
+PARAMS = -v -trimpath -tags '$(TAGS)' -ldflags \
+		'-X "github.com/sagernet/sing-box/constant.Commit=$(COMMIT)" \
+		-w -s -buildid='
 MAIN = ./cmd/sing-box
 
 .PHONY: test release
@@ -48,31 +49,19 @@ snapshot:
 	ghr --delete --draft --prerelease -p 1 nightly dist/release
 	rm -r dist
 
-release:
-	goreleaser release --rm-dist --skip-publish
-	mkdir dist/release
-	mv dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/release
-	ghr --delete --draft --prerelease -p 3 $(shell git describe --tags) dist/release
-	rm -r dist
-
-release_install:
+snapshot_install:
 	go install -v github.com/goreleaser/goreleaser@latest
 	go install -v github.com/tcnksm/ghr@latest
 
 test:
-	@go test -v ./... && \
-	cd test && \
+	@go test -v . && \
+	pushd test && \
 	go mod tidy && \
-	go test -v -tags "$(TAGS_TEST)" .
-
-test_stdio:
-	@go test -v ./... && \
-	cd test && \
-	go mod tidy && \
-	go test -v -tags "$(TAGS_TEST),force_stdio" .
+	go test -v -tags with_quic,with_wireguard,with_grpc . && \
+	popd
 
 clean:
-	rm -rf bin dist sing-box
+	rm -rf bin dist
 	rm -f $(shell go env GOPATH)/sing-box
 
 update:

adapter/experimental.go

@@ -4,29 +4,23 @@ import (
 	"context"
 	"net"
 
-	"github.com/sagernet/sing-box/common/urltest"
 	N "github.com/sagernet/sing/common/network"
 )
 
 type ClashServer interface {
 	Service
-	Mode() string
-	StoreSelected() bool
-	CacheFile() ClashCacheFile
-	HistoryStorage() *urltest.HistoryStorage
-	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
-	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
-}
-
-type ClashCacheFile interface {
-	LoadSelected(group string) string
-	StoreSelected(group string, selected string) error
+	TrafficController
 }
 
 type Tracker interface {
 	Leave()
 }
 
+type TrafficController interface {
+	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
+	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
+}
+
 type OutboundGroup interface {
 	Now() string
 	All() []string
@@ -38,13 +32,3 @@ func OutboundTag(detour Outbound) string {
 	}
 	return detour.Tag()
 }
-
-type V2RayServer interface {
-	Service
-	StatsService() V2RayStatsService
-}
-
-type V2RayStatsService interface {
-	RoutedConnection(inbound string, outbound string, conn net.Conn) net.Conn
-	RoutedPacketConnection(inbound string, outbound string, conn N.PacketConn) N.PacketConn
-}

adapter/inbound.go

@@ -2,13 +2,11 @@ package adapter
 
 import (
 	"context"
-	"net"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/process"
-	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
 )
 
 type Inbound interface {
@@ -17,13 +15,6 @@ type Inbound interface {
 	Tag() string
 }
 
-type InjectableInbound interface {
-	Inbound
-	Network() []string
-	NewConnection(ctx context.Context, conn net.Conn, metadata InboundContext) error
-	NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext) error
-}
-
 type InboundContext struct {
 	Inbound     string
 	InboundType string
@@ -38,14 +29,14 @@ type InboundContext struct {
 
 	// cache
 
-	InboundDetour        string
-	LastInbound          string
-	OriginDestination    M.Socksaddr
-	InboundOptions       option.InboundOptions
-	DestinationAddresses []netip.Addr
-	SourceGeoIPCode      string
-	GeoIPCode            string
-	ProcessInfo          *process.Info
+	OriginDestination        M.Socksaddr
+	DomainStrategy           dns.DomainStrategy
+	SniffEnabled             bool
+	SniffOverrideDestination bool
+	DestinationAddresses     []netip.Addr
+	SourceGeoIPCode          string
+	GeoIPCode                string
+	ProcessInfo              *process.Info
 }
 
 type inboundContextKey struct{}

adapter/router.go

@@ -11,7 +11,7 @@ import (
 	"github.com/sagernet/sing/common/control"
 	N "github.com/sagernet/sing/common/network"
 
-	mdns "github.com/miekg/dns"
+	"golang.org/x/net/dns/dnsmessage"
 )
 
 type Router interface {
@@ -27,11 +27,11 @@ type Router interface {
 	GeoIPReader() *geoip.Reader
 	LoadGeosite(code string) (Rule, error)
 
-	Exchange(ctx context.Context, message *mdns.Msg) (*mdns.Msg, error)
+	Exchange(ctx context.Context, message *dnsmessage.Message) (*dnsmessage.Message, error)
 	Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error)
 	LookupDefault(ctx context.Context, domain string) ([]netip.Addr, error)
 
-	InterfaceFinder() control.InterfaceFinder
+	InterfaceBindManager() control.BindManager
 	DefaultInterface() string
 	AutoDetectInterface() bool
 	DefaultMark() int
@@ -39,12 +39,7 @@ type Router interface {
 	InterfaceMonitor() tun.DefaultInterfaceMonitor
 	PackageManager() tun.PackageManager
 	Rules() []Rule
-
-	ClashServer() ClashServer
-	SetClashServer(server ClashServer)
-
-	V2RayServer() V2RayServer
-	SetV2RayServer(server V2RayServer)
+	SetTrafficController(controller TrafficController)
 }
 
 type Rule interface {
@@ -60,7 +55,3 @@ type DNSRule interface {
 	Rule
 	DisableCache() bool
 }
-
-type InterfaceUpdateListener interface {
-	InterfaceUpdated() error
-}

adapter/upstream.go

@@ -38,25 +38,13 @@ type myUpstreamHandlerWrapper struct {
 }
 
 func (w *myUpstreamHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
-	myMetadata := w.metadata
-	if metadata.Source.IsValid() {
-		myMetadata.Source = metadata.Source
-	}
-	if metadata.Destination.IsValid() {
-		myMetadata.Destination = metadata.Destination
-	}
-	return w.connectionHandler(ctx, conn, myMetadata)
+	w.metadata.Destination = metadata.Destination
+	return w.connectionHandler(ctx, conn, w.metadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
-	myMetadata := w.metadata
-	if metadata.Source.IsValid() {
-		myMetadata.Source = metadata.Source
-	}
-	if metadata.Destination.IsValid() {
-		myMetadata.Destination = metadata.Destination
-	}
-	return w.packetHandler(ctx, conn, myMetadata)
+	w.metadata.Destination = metadata.Destination
+	return w.packetHandler(ctx, conn, w.metadata)
 }
 
 func (w *myUpstreamHandlerWrapper) NewError(ctx context.Context, err error) {
@@ -90,23 +78,13 @@ func NewUpstreamContextHandler(
 
 func (w *myUpstreamContextHandlerWrapper) NewConnection(ctx context.Context, conn net.Conn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	if metadata.Source.IsValid() {
-		myMetadata.Source = metadata.Source
-	}
-	if metadata.Destination.IsValid() {
-		myMetadata.Destination = metadata.Destination
-	}
+	myMetadata.Destination = metadata.Destination
 	return w.connectionHandler(ctx, conn, *myMetadata)
 }
 
 func (w *myUpstreamContextHandlerWrapper) NewPacketConnection(ctx context.Context, conn N.PacketConn, metadata M.Metadata) error {
 	myMetadata := ContextFrom(ctx)
-	if metadata.Source.IsValid() {
-		myMetadata.Source = metadata.Source
-	}
-	if metadata.Destination.IsValid() {
-		myMetadata.Destination = metadata.Destination
-	}
+	myMetadata.Destination = metadata.Destination
 	return w.packetHandler(ctx, conn, *myMetadata)
 }
 

box.go

@@ -31,7 +31,6 @@ type Box struct {
 	logger      log.ContextLogger
 	logFile     *os.File
 	clashServer adapter.ClashServer
-	v2rayServer adapter.V2RayServer
 	done        chan struct{}
 }
 
@@ -40,14 +39,8 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 	logOptions := common.PtrValueOrDefault(options.Log)
 
 	var needClashAPI bool
-	var needV2RayAPI bool
-	if options.Experimental != nil {
-		if options.Experimental.ClashAPI != nil && options.Experimental.ClashAPI.ExternalController != "" {
-			needClashAPI = true
-		}
-		if options.Experimental.V2RayAPI != nil && options.Experimental.V2RayAPI.Listen != "" {
-			needV2RayAPI = true
-		}
+	if options.Experimental != nil && options.Experimental.ClashAPI != nil && options.Experimental.ClashAPI.ExternalController != "" {
+		needClashAPI = true
 	}
 
 	var logFactory log.Factory
@@ -97,7 +90,8 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 
 	router, err := route.NewRouter(
 		ctx,
-		logFactory,
+		logFactory.NewLogger("router"),
+		logFactory.NewLogger("dns"),
 		common.PtrValueOrDefault(options.Route),
 		common.PtrValueOrDefault(options.DNS),
 		options.Inbounds,
@@ -144,7 +138,7 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		}
 		outbounds = append(outbounds, out)
 	}
-	err = router.Initialize(inbounds, outbounds, func() adapter.Outbound {
+	err = router.Initialize(outbounds, func() adapter.Outbound {
 		out, oErr := outbound.New(ctx, router, logFactory.NewLogger("outbound/direct"), option.Outbound{Type: "direct", Tag: "default"})
 		common.Must(oErr)
 		outbounds = append(outbounds, out)
@@ -155,20 +149,12 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 	}
 
 	var clashServer adapter.ClashServer
-	var v2rayServer adapter.V2RayServer
 	if needClashAPI {
 		clashServer, err = experimental.NewClashServer(router, observableLogFactory, common.PtrValueOrDefault(options.Experimental.ClashAPI))
 		if err != nil {
 			return nil, E.Cause(err, "create clash api server")
 		}
-		router.SetClashServer(clashServer)
-	}
-	if needV2RayAPI {
-		v2rayServer, err = experimental.NewV2RayServer(logFactory.NewLogger("v2ray-api"), common.PtrValueOrDefault(options.Experimental.V2RayAPI))
-		if err != nil {
-			return nil, E.Cause(err, "create v2ray api server")
-		}
-		router.SetV2RayServer(v2rayServer)
+		router.SetTrafficController(clashServer)
 	}
 	return &Box{
 		router:      router,
@@ -176,10 +162,9 @@ func New(ctx context.Context, options option.Options) (*Box, error) {
 		outbounds:   outbounds,
 		createdAt:   createdAt,
 		logFactory:  logFactory,
-		logger:      logFactory.Logger(),
+		logger:      logFactory.NewLogger(""),
 		logFile:     logFile,
 		clashServer: clashServer,
-		v2rayServer: v2rayServer,
 		done:        make(chan struct{}),
 	}, nil
 }
@@ -238,12 +223,6 @@ func (s *Box) start() error {
 			return E.Cause(err, "start clash api server")
 		}
 	}
-	if s.v2rayServer != nil {
-		err = s.v2rayServer.Start()
-		if err != nil {
-			return E.Cause(err, "start v2ray api server")
-		}
-	}
 	s.logger.Info("sing-box started (", F.Seconds(time.Since(s.createdAt).Seconds()), "s)")
 	return nil
 }
@@ -265,11 +244,6 @@ func (s *Box) Close() error {
 		s.router,
 		s.logFactory,
 		s.clashServer,
-		s.v2rayServer,
 		common.PtrOrNil(s.logFile),
 	)
 }
-
-func (s *Box) Router() adapter.Router {
-	return s.router
-}

cmd/sing-box/cmd_daemon.go

@@ -0,0 +1,272 @@
+//go:build with_daemon
+
+package main
+
+import (
+	"bytes"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+
+	"github.com/sagernet/sing-box/common/json"
+	"github.com/sagernet/sing-box/experimental/daemon"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	F "github.com/sagernet/sing/common/format"
+
+	"github.com/spf13/cobra"
+)
+
+var commandDaemon = &cobra.Command{
+	Use: "daemon",
+}
+
+func init() {
+	commandDaemon.AddCommand(commandDaemonInstall)
+	commandDaemon.AddCommand(commandDaemonUninstall)
+	commandDaemon.AddCommand(commandDaemonStart)
+	commandDaemon.AddCommand(commandDaemonStop)
+	commandDaemon.AddCommand(commandDaemonRestart)
+	commandDaemon.AddCommand(commandDaemonRun)
+	mainCommand.AddCommand(commandDaemon)
+	mainCommand.AddCommand(commandStart)
+	mainCommand.AddCommand(commandStop)
+	mainCommand.AddCommand(commandStatus)
+}
+
+var commandDaemonInstall = &cobra.Command{
+	Use:   "install",
+	Short: "Install daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := installDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonUninstall = &cobra.Command{
+	Use:   "uninstall",
+	Short: "Uninstall daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := uninstallDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonStart = &cobra.Command{
+	Use:   "start",
+	Short: "Start daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := startDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonStop = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := stopDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonRestart = &cobra.Command{
+	Use:   "restart",
+	Short: "Restart daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := restartDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandDaemonRun = &cobra.Command{
+	Use:   "run",
+	Short: "Run daemon",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := runDaemon()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+func installDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Install()
+}
+
+func uninstallDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Uninstall()
+}
+
+func startDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Start()
+}
+
+func stopDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Stop()
+}
+
+func restartDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Restart()
+}
+
+func runDaemon() error {
+	instance, err := daemon.New()
+	if err != nil {
+		return err
+	}
+	return instance.Run()
+}
+
+var commandStart = &cobra.Command{
+	Use:   "start",
+	Short: "Start service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := startService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandStop = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := stopService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+var commandStatus = &cobra.Command{
+	Use:   "status",
+	Short: "Check service",
+	Run: func(cmd *cobra.Command, args []string) {
+		err := checkService()
+		if err != nil {
+			log.Fatal(err)
+		}
+	},
+	Args: cobra.NoArgs,
+}
+
+func doRequest(method string, path string, params url.Values, body io.ReadCloser) ([]byte, error) {
+	requestURL := url.URL{
+		Scheme: "http",
+		Path:   path,
+		Host:   net.JoinHostPort("127.0.0.1", F.ToString(daemon.DefaultDaemonPort)),
+	}
+	if params != nil {
+		requestURL.RawQuery = params.Encode()
+	}
+	request, err := http.NewRequest(method, requestURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	var content []byte
+	if response.StatusCode != http.StatusNoContent {
+		content, err = io.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent {
+		return nil, E.New(string(content))
+	}
+	return content, nil
+}
+
+func ping() error {
+	response, err := doRequest("GET", "/ping", nil, nil)
+	if err != nil || string(response) != "pong" {
+		return E.New("daemon not running")
+	}
+	return nil
+}
+
+func startService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	configContent, err := os.ReadFile(configPath)
+	if err != nil {
+		return E.Cause(err, "read config")
+	}
+	return common.Error(doRequest("POST", "/run", nil, io.NopCloser(bytes.NewReader(configContent))))
+}
+
+func stopService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	return common.Error(doRequest("GET", "/stop", nil, nil))
+}
+
+func checkService() error {
+	if err := ping(); err != nil {
+		return err
+	}
+	response, err := doRequest("GET", "/status", nil, nil)
+	if err != nil {
+		return err
+	}
+	var statusResponse daemon.StatusResponse
+	err = json.Unmarshal(response, &statusResponse)
+	if err != nil {
+		return err
+	}
+	if statusResponse.Running {
+		log.Info("service running")
+	} else {
+		log.Info("service stopped")
+	}
+	return nil
+}

cmd/sing-box/cmd_format.go

@@ -38,7 +38,7 @@ func format() error {
 		return E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = options.UnmarshalJSON(configContent)
+	err = json.Unmarshal(configContent, &options)
 	if err != nil {
 		return E.Cause(err, "decode config")
 	}

cmd/sing-box/cmd_run.go

@@ -9,6 +9,7 @@ import (
 	"syscall"
 
 	"github.com/sagernet/sing-box"
+	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -45,7 +46,7 @@ func readConfig() (option.Options, error) {
 		return option.Options{}, E.Cause(err, "read config")
 	}
 	var options option.Options
-	err = options.UnmarshalJSON(configContent)
+	err = json.Unmarshal(configContent, &options)
 	if err != nil {
 		return option.Options{}, E.Cause(err, "decode config")
 	}
@@ -69,20 +70,6 @@ func create() (*box.Box, context.CancelFunc, error) {
 		cancel()
 		return nil, nil, E.Cause(err, "create service")
 	}
-
-	osSignals := make(chan os.Signal, 1)
-	signal.Notify(osSignals, os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)
-	defer func() {
-		signal.Stop(osSignals)
-		close(osSignals)
-	}()
-
-	go func() {
-		_, loaded := <-osSignals
-		if loaded {
-			cancel()
-		}
-	}()
 	err = instance.Start()
 	if err != nil {
 		cancel()
@@ -94,7 +81,6 @@ func create() (*box.Box, context.CancelFunc, error) {
 func run() error {
 	osSignals := make(chan os.Signal, 1)
 	signal.Notify(osSignals, os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)
-	defer signal.Stop(osSignals)
 	for {
 		instance, cancel, err := create()
 		if err != nil {

cmd/sing-box/cmd_version.go

@@ -3,9 +3,9 @@ package main
 import (
 	"os"
 	"runtime"
-	"runtime/debug"
 
 	C "github.com/sagernet/sing-box/constant"
+	F "github.com/sagernet/sing/common/format"
 
 	"github.com/spf13/cobra"
 )
@@ -25,40 +25,30 @@ func init() {
 }
 
 func printVersion(cmd *cobra.Command, args []string) {
-	if nameOnly {
-		os.Stdout.WriteString(C.Version + "\n")
-		return
+	var version string
+	if !nameOnly {
+		version = "sing-box "
 	}
-	version := "sing-box version " + C.Version + "\n\n"
-	version += "Environment: " + runtime.Version() + " " + runtime.GOOS + "/" + runtime.GOARCH + "\n"
-
-	var tags string
-	var revision string
-
-	debugInfo, loaded := debug.ReadBuildInfo()
-	if loaded {
-		for _, setting := range debugInfo.Settings {
-			switch setting.Key {
-			case "-tags":
-				tags = setting.Value
-			case "vcs.revision":
-				revision = setting.Value
-			}
+	version += F.ToString(C.Version)
+	if C.Commit != "" {
+		version += "." + C.Commit
+	}
+	if !nameOnly {
+		version += " ("
+		version += runtime.Version()
+		version += ", "
+		version += runtime.GOOS
+		version += ", "
+		version += runtime.GOARCH
+		version += ", "
+		version += "CGO "
+		if C.CGO_ENABLED {
+			version += "enabled"
+		} else {
+			version += "disabled"
 		}
+		version += ")"
 	}
-
-	if tags != "" {
-		version += "Tags: " + tags + "\n"
-	}
-	if revision != "" {
-		version += "Revision: " + revision + "\n"
-	}
-
-	if C.CGO_ENABLED {
-		version += "CGO: enabled\n"
-	} else {
-		version += "CGO: disabled\n"
-	}
-
+	version += "\n"
 	os.Stdout.WriteString(version)
 }

cmd/sing-box/main.go

@@ -3,7 +3,6 @@ package main
 import (
 	"os"
 
-	_ "github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
 
 	"github.com/spf13/cobra"

common/baderror/baderror.go

@@ -1,62 +0,0 @@
-package baderror
-
-import (
-	"context"
-	"io"
-	"net"
-	"strings"
-
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func Contains(err error, msgList ...string) bool {
-	for _, msg := range msgList {
-		if strings.Contains(err.Error(), msg) {
-			return true
-		}
-	}
-	return false
-}
-
-func WrapH2(err error) error {
-	if err == nil {
-		return nil
-	}
-	err = E.Unwrap(err)
-	if err == io.ErrUnexpectedEOF {
-		return io.EOF
-	}
-	if Contains(err, "client disconnected", "body closed by handler", "response body closed", "; CANCEL") {
-		return net.ErrClosed
-	}
-	return err
-}
-
-func WrapGRPC(err error) error {
-	// grpc uses stupid internal error types
-	if err == nil {
-		return nil
-	}
-	if Contains(err, "EOF") {
-		return io.EOF
-	}
-	if Contains(err, "Canceled") {
-		return context.Canceled
-	}
-	if Contains(err,
-		"the client connection is closing",
-		"server closed the stream without sending trailers") {
-		return net.ErrClosed
-	}
-	return err
-}
-
-func WrapQUIC(err error) error {
-	if err == nil {
-		return nil
-	}
-	if Contains(err, "canceled with error code 0") {
-		return net.ErrClosed
-	}
-	return err
-}

common/badtls/badtls.go

@@ -1,210 +0,0 @@
-//go:build go1.19 && !go1.20
-
-package badtls
-
-import (
-	"crypto/cipher"
-	"crypto/rand"
-	"crypto/tls"
-	"encoding/binary"
-	"io"
-	"net"
-	"reflect"
-	"sync"
-	"sync/atomic"
-	"unsafe"
-
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	"github.com/sagernet/sing/common/bufio"
-	E "github.com/sagernet/sing/common/exceptions"
-	N "github.com/sagernet/sing/common/network"
-)
-
-type Conn struct {
-	*tls.Conn
-	writer           N.ExtendedWriter
-	activeCall       *int32
-	closeNotifySent  *bool
-	version          *uint16
-	rand             io.Reader
-	halfAccess       *sync.Mutex
-	halfError        *error
-	cipher           cipher.AEAD
-	explicitNonceLen int
-	halfPtr          uintptr
-	halfSeq          []byte
-	halfScratchBuf   []byte
-}
-
-func Create(conn *tls.Conn) (TLSConn, error) {
-	if !handshakeComplete(conn) {
-		return nil, E.New("handshake not finished")
-	}
-	rawConn := reflect.Indirect(reflect.ValueOf(conn))
-	rawActiveCall := rawConn.FieldByName("activeCall")
-	if !rawActiveCall.IsValid() || rawActiveCall.Kind() != reflect.Int32 {
-		return nil, E.New("badtls: invalid active call")
-	}
-	activeCall := (*int32)(unsafe.Pointer(rawActiveCall.UnsafeAddr()))
-	rawHalfConn := rawConn.FieldByName("out")
-	if !rawHalfConn.IsValid() || rawHalfConn.Kind() != reflect.Struct {
-		return nil, E.New("badtls: invalid half conn")
-	}
-	rawVersion := rawConn.FieldByName("vers")
-	if !rawVersion.IsValid() || rawVersion.Kind() != reflect.Uint16 {
-		return nil, E.New("badtls: invalid version")
-	}
-	version := (*uint16)(unsafe.Pointer(rawVersion.UnsafeAddr()))
-	rawCloseNotifySent := rawConn.FieldByName("closeNotifySent")
-	if !rawCloseNotifySent.IsValid() || rawCloseNotifySent.Kind() != reflect.Bool {
-		return nil, E.New("badtls: invalid notify")
-	}
-	closeNotifySent := (*bool)(unsafe.Pointer(rawCloseNotifySent.UnsafeAddr()))
-	rawConfig := reflect.Indirect(rawConn.FieldByName("config"))
-	if !rawConfig.IsValid() || rawConfig.Kind() != reflect.Struct {
-		return nil, E.New("badtls: bad config")
-	}
-	config := (*tls.Config)(unsafe.Pointer(rawConfig.UnsafeAddr()))
-	randReader := config.Rand
-	if randReader == nil {
-		randReader = rand.Reader
-	}
-	rawHalfMutex := rawHalfConn.FieldByName("Mutex")
-	if !rawHalfMutex.IsValid() || rawHalfMutex.Kind() != reflect.Struct {
-		return nil, E.New("badtls: invalid half mutex")
-	}
-	halfAccess := (*sync.Mutex)(unsafe.Pointer(rawHalfMutex.UnsafeAddr()))
-	rawHalfError := rawHalfConn.FieldByName("err")
-	if !rawHalfError.IsValid() || rawHalfError.Kind() != reflect.Interface {
-		return nil, E.New("badtls: invalid half error")
-	}
-	halfError := (*error)(unsafe.Pointer(rawHalfError.UnsafeAddr()))
-	rawHalfCipherInterface := rawHalfConn.FieldByName("cipher")
-	if !rawHalfCipherInterface.IsValid() || rawHalfCipherInterface.Kind() != reflect.Interface {
-		return nil, E.New("badtls: invalid cipher interface")
-	}
-	rawHalfCipher := rawHalfCipherInterface.Elem()
-	aeadCipher, loaded := valueInterface(rawHalfCipher, false).(cipher.AEAD)
-	if !loaded {
-		return nil, E.New("badtls: invalid AEAD cipher")
-	}
-	var explicitNonceLen int
-	switch cipherName := reflect.Indirect(rawHalfCipher).Type().String(); cipherName {
-	case "tls.prefixNonceAEAD":
-		explicitNonceLen = aeadCipher.NonceSize()
-	case "tls.xorNonceAEAD":
-	default:
-		return nil, E.New("badtls: unknown cipher type: ", cipherName)
-	}
-	rawHalfSeq := rawHalfConn.FieldByName("seq")
-	if !rawHalfSeq.IsValid() || rawHalfSeq.Kind() != reflect.Array {
-		return nil, E.New("badtls: invalid seq")
-	}
-	halfSeq := rawHalfSeq.Bytes()
-	rawHalfScratchBuf := rawHalfConn.FieldByName("scratchBuf")
-	if !rawHalfScratchBuf.IsValid() || rawHalfScratchBuf.Kind() != reflect.Array {
-		return nil, E.New("badtls: invalid scratchBuf")
-	}
-	halfScratchBuf := rawHalfScratchBuf.Bytes()
-	return &Conn{
-		Conn:             conn,
-		writer:           bufio.NewExtendedWriter(conn.NetConn()),
-		activeCall:       activeCall,
-		closeNotifySent:  closeNotifySent,
-		version:          version,
-		halfAccess:       halfAccess,
-		halfError:        halfError,
-		cipher:           aeadCipher,
-		explicitNonceLen: explicitNonceLen,
-		rand:             randReader,
-		halfPtr:          rawHalfConn.UnsafeAddr(),
-		halfSeq:          halfSeq,
-		halfScratchBuf:   halfScratchBuf,
-	}, nil
-}
-
-func (c *Conn) WriteBuffer(buffer *buf.Buffer) error {
-	if buffer.Len() > maxPlaintext {
-		defer buffer.Release()
-		return common.Error(c.Write(buffer.Bytes()))
-	}
-	for {
-		x := atomic.LoadInt32(c.activeCall)
-		if x&1 != 0 {
-			return net.ErrClosed
-		}
-		if atomic.CompareAndSwapInt32(c.activeCall, x, x+2) {
-			break
-		}
-	}
-	defer atomic.AddInt32(c.activeCall, -2)
-	c.halfAccess.Lock()
-	defer c.halfAccess.Unlock()
-	if err := *c.halfError; err != nil {
-		return err
-	}
-	if *c.closeNotifySent {
-		return errShutdown
-	}
-	dataLen := buffer.Len()
-	dataBytes := buffer.Bytes()
-	outBuf := buffer.ExtendHeader(recordHeaderLen + c.explicitNonceLen)
-	outBuf[0] = 23
-	version := *c.version
-	if version == 0 {
-		version = tls.VersionTLS10
-	} else if version == tls.VersionTLS13 {
-		version = tls.VersionTLS12
-	}
-	binary.BigEndian.PutUint16(outBuf[1:], version)
-	var nonce []byte
-	if c.explicitNonceLen > 0 {
-		nonce = outBuf[5 : 5+c.explicitNonceLen]
-		if c.explicitNonceLen < 16 {
-			copy(nonce, c.halfSeq)
-		} else {
-			if _, err := io.ReadFull(c.rand, nonce); err != nil {
-				return err
-			}
-		}
-	}
-	if len(nonce) == 0 {
-		nonce = c.halfSeq
-	}
-	if *c.version == tls.VersionTLS13 {
-		buffer.FreeBytes()[0] = 23
-		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen+1+c.cipher.Overhead()))
-		c.cipher.Seal(outBuf, nonce, outBuf[recordHeaderLen:recordHeaderLen+c.explicitNonceLen+dataLen+1], outBuf[:recordHeaderLen])
-		buffer.Extend(1 + c.cipher.Overhead())
-	} else {
-		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen))
-		additionalData := append(c.halfScratchBuf[:0], c.halfSeq...)
-		additionalData = append(additionalData, outBuf[:recordHeaderLen]...)
-		c.cipher.Seal(outBuf, nonce, dataBytes, additionalData)
-		buffer.Extend(c.cipher.Overhead())
-		binary.BigEndian.PutUint16(outBuf[3:], uint16(dataLen+c.explicitNonceLen+c.cipher.Overhead()))
-	}
-	incSeq(c.halfPtr)
-	return c.writer.WriteBuffer(buffer)
-}
-
-func (c *Conn) FrontHeadroom() int {
-	return recordHeaderLen + c.explicitNonceLen
-}
-
-func (c *Conn) RearHeadroom() int {
-	return 1 + c.cipher.Overhead()
-}
-
-func (c *Conn) WriterMTU() int {
-	return maxPlaintext
-}
-
-func (c *Conn) Upstream() any {
-	return c.Conn
-}
-
-func (c *Conn) UpstreamWriter() any {
-	return c.NetConn()
-}

common/badtls/badtls_stub.go

@@ -1,12 +0,0 @@
-//go:build !go1.19 || go1.20
-
-package badtls
-
-import (
-	"crypto/tls"
-	"os"
-)
-
-func Create(conn *tls.Conn) (TLSConn, error) {
-	return nil, os.ErrInvalid
-}

common/badtls/conn.go

@@ -1,13 +0,0 @@
-package badtls
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-)
-
-type TLSConn interface {
-	net.Conn
-	HandshakeContext(ctx context.Context) error
-	ConnectionState() tls.ConnectionState
-}

common/badtls/link.go

@@ -1,26 +0,0 @@
-//go:build go1.19 && !go.1.20
-
-package badtls
-
-import (
-	"crypto/tls"
-	"reflect"
-	_ "unsafe"
-)
-
-const (
-	maxPlaintext    = 16384 // maximum plaintext payload length
-	recordHeaderLen = 5     // record header length
-)
-
-//go:linkname errShutdown crypto/tls.errShutdown
-var errShutdown error
-
-//go:linkname handshakeComplete crypto/tls.(*Conn).handshakeComplete
-func handshakeComplete(conn *tls.Conn) bool
-
-//go:linkname incSeq crypto/tls.(*halfConn).incSeq
-func incSeq(conn uintptr)
-
-//go:linkname valueInterface reflect.valueInterface
-func valueInterface(v reflect.Value, safe bool) any

common/dialer/bind.go

@@ -0,0 +1,19 @@
+package dialer
+
+import (
+	"syscall"
+
+	"github.com/sagernet/sing/common/control"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+func skipIfPrivate(next control.Func) control.Func {
+	return func(network, address string, conn syscall.RawConn) error {
+		destination := M.ParseSocksaddr(address)
+		if !N.IsPublicAddr(destination.Addr) {
+			return nil
+		}
+		return next(network, address, conn)
+	}
+}

common/dialer/default.go

@@ -3,6 +3,7 @@ package dialer
 import (
 	"context"
 	"net"
+	"net/netip"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -10,11 +11,10 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common/control"
-	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
-	"github.com/database64128/tfo-go/v2"
+	"github.com/database64128/tfo-go"
 )
 
 var warnBindInterfaceOnUnsupportedPlatform = warning.New(
@@ -53,13 +53,10 @@ var warnTFOOnUnsupportedPlatform = warning.New(
 )
 
 type DefaultDialer struct {
-	dialer4     tfo.Dialer
-	dialer6     tfo.Dialer
-	udpDialer4  net.Dialer
-	udpDialer6  net.Dialer
+	dialer      tfo.Dialer
+	udpDialer   net.Dialer
 	udpListener net.ListenConfig
-	udpAddr4    string
-	udpAddr6    string
+	bindUDPAddr string
 }
 
 func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDialer {
@@ -67,23 +64,25 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	var listener net.ListenConfig
 	if options.BindInterface != "" {
 		warnBindInterfaceOnUnsupportedPlatform.Check()
-		bindFunc := control.BindToInterface(router.InterfaceFinder(), options.BindInterface, -1)
+		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), options.BindInterface))
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	} else if router.AutoDetectInterface() {
-		const useInterfaceName = C.IsLinux
-		bindFunc := control.BindToInterfaceFunc(router.InterfaceFinder(), func(network string, address string) (interfaceName string, interfaceIndex int) {
-			remoteAddr := M.ParseSocksaddr(address).Addr
-			if C.IsLinux {
-				return router.InterfaceMonitor().DefaultInterfaceName(remoteAddr), -1
-			} else {
-				return "", router.InterfaceMonitor().DefaultInterfaceIndex(remoteAddr)
-			}
-		})
-		dialer.Control = control.Append(dialer.Control, bindFunc)
-		listener.Control = control.Append(listener.Control, bindFunc)
+		if C.IsWindows {
+			bindFunc := skipIfPrivate(control.BindToInterfaceIndexFunc(func() int {
+				return router.InterfaceMonitor().DefaultInterfaceIndex()
+			}))
+			dialer.Control = control.Append(dialer.Control, bindFunc)
+			listener.Control = control.Append(listener.Control, bindFunc)
+		} else {
+			bindFunc := skipIfPrivate(control.BindToInterfaceFunc(router.InterfaceBindManager(), func() string {
+				return router.InterfaceMonitor().DefaultInterfaceName()
+			}))
+			dialer.Control = control.Append(dialer.Control, bindFunc)
+			listener.Control = control.Append(listener.Control, bindFunc)
+		}
 	} else if router.DefaultInterface() != "" {
-		bindFunc := control.BindToInterface(router.InterfaceFinder(), router.DefaultInterface(), -1)
+		bindFunc := skipIfPrivate(control.BindToInterface(router.InterfaceBindManager(), router.DefaultInterface()))
 		dialer.Control = control.Append(dialer.Control, bindFunc)
 		listener.Control = control.Append(listener.Control, bindFunc)
 	}
@@ -112,72 +111,29 @@ func NewDefault(router adapter.Router, options option.DialerOptions) *DefaultDia
 	if options.TCPFastOpen {
 		warnTFOOnUnsupportedPlatform.Check()
 	}
-	var udpFragment bool
-	if options.UDPFragment != nil {
-		udpFragment = *options.UDPFragment
-	} else {
-		udpFragment = options.UDPFragmentDefault
-	}
-	if !udpFragment {
-		dialer.Control = control.Append(dialer.Control, control.DisableUDPFragment())
-		listener.Control = control.Append(listener.Control, control.DisableUDPFragment())
-	}
-	var (
-		dialer4    = dialer
-		udpDialer4 = dialer
-		udpAddr4   string
-	)
-	if options.Inet4BindAddress != nil {
-		bindAddr := options.Inet4BindAddress.Build()
-		dialer4.LocalAddr = &net.TCPAddr{IP: bindAddr.AsSlice()}
-		udpDialer4.LocalAddr = &net.UDPAddr{IP: bindAddr.AsSlice()}
-		udpAddr4 = M.SocksaddrFrom(bindAddr, 0).String()
-	}
-	var (
-		dialer6    = dialer
-		udpDialer6 = dialer
-		udpAddr6   string
-	)
-	if options.Inet6BindAddress != nil {
-		bindAddr := options.Inet6BindAddress.Build()
-		dialer6.LocalAddr = &net.TCPAddr{IP: bindAddr.AsSlice()}
-		udpDialer6.LocalAddr = &net.UDPAddr{IP: bindAddr.AsSlice()}
-		udpAddr6 = M.SocksaddrFrom(bindAddr, 0).String()
-	}
-	return &DefaultDialer{
-		tfo.Dialer{Dialer: dialer4, DisableTFO: !options.TCPFastOpen},
-		tfo.Dialer{Dialer: dialer6, DisableTFO: !options.TCPFastOpen},
-		udpDialer4,
-		udpDialer6,
-		listener,
-		udpAddr4,
-		udpAddr6,
+	var bindUDPAddr string
+	udpDialer := dialer
+	bindAddress := netip.Addr(options.BindAddress)
+	if bindAddress.IsValid() {
+		dialer.LocalAddr = &net.TCPAddr{
+			IP: bindAddress.AsSlice(),
+		}
+		udpDialer.LocalAddr = &net.UDPAddr{
+			IP: bindAddress.AsSlice(),
+		}
+		bindUDPAddr = M.SocksaddrFrom(bindAddress, 0).String()
 	}
+	return &DefaultDialer{tfo.Dialer{Dialer: dialer, DisableTFO: !options.TCPFastOpen}, udpDialer, listener, bindUDPAddr}
 }
 
 func (d *DefaultDialer) DialContext(ctx context.Context, network string, address M.Socksaddr) (net.Conn, error) {
-	if !address.IsValid() {
-		return nil, E.New("invalid address")
-	}
 	switch N.NetworkName(network) {
 	case N.NetworkUDP:
-		if !address.IsIPv6() {
-			return d.udpDialer4.DialContext(ctx, network, address.String())
-		} else {
-			return d.udpDialer6.DialContext(ctx, network, address.String())
-		}
-	}
-	if !address.IsIPv6() {
-		return DialSlowContext(&d.dialer4, ctx, network, address)
-	} else {
-		return DialSlowContext(&d.dialer6, ctx, network, address)
+		return d.udpDialer.DialContext(ctx, network, address.String())
 	}
+	return d.dialer.DialContext(ctx, network, address.Unwrap().String())
 }
 
 func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsIPv6() {
-		return d.udpListener.ListenPacket(ctx, N.NetworkUDP, d.udpAddr4)
-	} else {
-		return d.udpListener.ListenPacket(ctx, N.NetworkUDP, d.udpAddr6)
-	}
+	return d.udpListener.ListenPacket(ctx, N.NetworkUDP, d.bindUDPAddr)
 }

common/dialer/dialer.go

@@ -10,12 +10,15 @@ import (
 )
 
 func New(router adapter.Router, options option.DialerOptions) N.Dialer {
-	var dialer N.Dialer
 	if options.Detour == "" {
-		dialer = NewDefault(router, options)
+		return NewDefault(router, options)
 	} else {
-		dialer = NewDetour(router, options.Detour)
+		return NewDetour(router, options.Detour)
 	}
+}
+
+func NewOutbound(router adapter.Router, options option.OutboundDialerOptions) N.Dialer {
+	dialer := New(router, options.DialerOptions)
 	domainStrategy := dns.DomainStrategy(options.DomainStrategy)
 	if domainStrategy != dns.DomainStrategyAsIS || options.Detour == "" {
 		dialer = NewResolveDialer(router, dialer, domainStrategy, time.Duration(options.FallbackDelay))

common/dialer/resolve.go

@@ -51,7 +51,7 @@ func (d *ResolveDialer) DialContext(ctx context.Context, network string, destina
 }
 
 func (d *ResolveDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if !destination.IsFqdn() {
+	if !destination.IsFqdn() || destination.Fqdn == "" {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
 	ctx, metadata := adapter.AppendContext(ctx)

common/dialer/tfo.go

@@ -1,142 +0,0 @@
-package dialer
-
-import (
-	"context"
-	"io"
-	"net"
-	"os"
-	"time"
-
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/bufio"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-
-	"github.com/database64128/tfo-go/v2"
-)
-
-type slowOpenConn struct {
-	dialer      *tfo.Dialer
-	ctx         context.Context
-	network     string
-	destination M.Socksaddr
-	conn        net.Conn
-	create      chan struct{}
-	err         error
-}
-
-func DialSlowContext(dialer *tfo.Dialer, ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	if dialer.DisableTFO || N.NetworkName(network) != N.NetworkTCP {
-		return dialer.DialContext(ctx, network, destination.String(), nil)
-	}
-	return &slowOpenConn{
-		dialer:      dialer,
-		ctx:         ctx,
-		network:     network,
-		destination: destination,
-		create:      make(chan struct{}),
-	}, nil
-}
-
-func (c *slowOpenConn) Read(b []byte) (n int, err error) {
-	if c.conn == nil {
-		select {
-		case <-c.create:
-			if c.err != nil {
-				return 0, c.err
-			}
-		case <-c.ctx.Done():
-			return 0, c.ctx.Err()
-		}
-	}
-	return c.conn.Read(b)
-}
-
-func (c *slowOpenConn) Write(b []byte) (n int, err error) {
-	if c.conn == nil {
-		c.conn, err = c.dialer.DialContext(c.ctx, c.network, c.destination.String(), b)
-		if err != nil {
-			c.err = E.Cause(err, "dial tcp fast open")
-		}
-		close(c.create)
-		return
-	}
-	return c.conn.Write(b)
-}
-
-func (c *slowOpenConn) Close() error {
-	return common.Close(c.conn)
-}
-
-func (c *slowOpenConn) LocalAddr() net.Addr {
-	if c.conn == nil {
-		return M.Socksaddr{}
-	}
-	return c.conn.LocalAddr()
-}
-
-func (c *slowOpenConn) RemoteAddr() net.Addr {
-	if c.conn == nil {
-		return M.Socksaddr{}
-	}
-	return c.conn.RemoteAddr()
-}
-
-func (c *slowOpenConn) SetDeadline(t time.Time) error {
-	if c.conn == nil {
-		return os.ErrInvalid
-	}
-	return c.conn.SetDeadline(t)
-}
-
-func (c *slowOpenConn) SetReadDeadline(t time.Time) error {
-	if c.conn == nil {
-		return os.ErrInvalid
-	}
-	return c.conn.SetReadDeadline(t)
-}
-
-func (c *slowOpenConn) SetWriteDeadline(t time.Time) error {
-	if c.conn == nil {
-		return os.ErrInvalid
-	}
-	return c.conn.SetWriteDeadline(t)
-}
-
-func (c *slowOpenConn) Upstream() any {
-	return c.conn
-}
-
-func (c *slowOpenConn) ReaderReplaceable() bool {
-	return c.conn != nil
-}
-
-func (c *slowOpenConn) WriterReplaceable() bool {
-	return c.conn != nil
-}
-
-func (c *slowOpenConn) LazyHeadroom() bool {
-	return c.conn == nil
-}
-
-func (c *slowOpenConn) ReadFrom(r io.Reader) (n int64, err error) {
-	if c.conn != nil {
-		return bufio.Copy(c.conn, r)
-	}
-	return bufio.ReadFrom0(c, r)
-}
-
-func (c *slowOpenConn) WriteTo(w io.Writer) (n int64, err error) {
-	if c.conn == nil {
-		select {
-		case <-c.create:
-			if c.err != nil {
-				return 0, c.err
-			}
-		case <-c.ctx.Done():
-			return 0, c.ctx.Err()
-		}
-	}
-	return bufio.Copy(w, c.conn)
-}

common/dialer/tls.go

@@ -1,54 +1,34 @@
-package tls
+package dialer
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"net"
 	"net/netip"
 	"os"
 
+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
 )
 
-type STDClientConfig struct {
+type TLSDialer struct {
+	dialer N.Dialer
 	config *tls.Config
 }
 
-func (s *STDClientConfig) ServerName() string {
-	return s.config.ServerName
-}
-
-func (s *STDClientConfig) SetServerName(serverName string) {
-	s.config.ServerName = serverName
-}
-
-func (s *STDClientConfig) NextProtos() []string {
-	return s.config.NextProtos
-}
-
-func (s *STDClientConfig) SetNextProtos(nextProto []string) {
-	s.config.NextProtos = nextProto
-}
-
-func (s *STDClientConfig) Config() (*STDConfig, error) {
-	return s.config, nil
-}
-
-func (s *STDClientConfig) Client(conn net.Conn) Conn {
-	return tls.Client(conn, s.config)
-}
-
-func (s *STDClientConfig) Clone() Config {
-	return &STDClientConfig{s.config.Clone()}
-}
-
-func NewSTDClient(serverAddress string, options option.OutboundTLSOptions) (Config, error) {
+func TLSConfig(serverAddress string, options option.OutboundTLSOptions) (*tls.Config, error) {
+	if !options.Enabled {
+		return nil, nil
+	}
 	var serverName string
 	if options.ServerName != "" {
 		serverName = options.ServerName
 	} else if serverAddress != "" {
-		if _, err := netip.ParseAddr(serverName); err != nil {
+		if _, err := netip.ParseAddr(serverName); err == nil {
 			serverName = serverAddress
 		}
 	}
@@ -82,14 +62,14 @@ func NewSTDClient(serverAddress string, options option.OutboundTLSOptions) (Conf
 		tlsConfig.NextProtos = options.ALPN
 	}
 	if options.MinVersion != "" {
-		minVersion, err := ParseTLSVersion(options.MinVersion)
+		minVersion, err := option.ParseTLSVersion(options.MinVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse min_version")
 		}
 		tlsConfig.MinVersion = minVersion
 	}
 	if options.MaxVersion != "" {
-		maxVersion, err := ParseTLSVersion(options.MaxVersion)
+		maxVersion, err := option.ParseTLSVersion(options.MaxVersion)
 		if err != nil {
 			return nil, E.Cause(err, "parse max_version")
 		}
@@ -124,5 +104,42 @@ func NewSTDClient(serverAddress string, options option.OutboundTLSOptions) (Conf
 		}
 		tlsConfig.RootCAs = certPool
 	}
-	return &STDClientConfig{&tlsConfig}, nil
+	return &tlsConfig, nil
+}
+
+func NewTLS(dialer N.Dialer, serverAddress string, options option.OutboundTLSOptions) (N.Dialer, error) {
+	if !options.Enabled {
+		return dialer, nil
+	}
+	tlsConfig, err := TLSConfig(serverAddress, options)
+	if err != nil {
+		return nil, err
+	}
+	return &TLSDialer{
+		dialer: dialer,
+		config: tlsConfig,
+	}, nil
+}
+
+func (d *TLSDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	if network != N.NetworkTCP {
+		return nil, os.ErrInvalid
+	}
+	conn, err := d.dialer.DialContext(ctx, network, destination)
+	if err != nil {
+		return nil, err
+	}
+	return TLSClient(ctx, conn, d.config)
+}
+
+func (d *TLSDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return nil, os.ErrInvalid
+}
+
+func TLSClient(ctx context.Context, conn net.Conn, tlsConfig *tls.Config) (*tls.Conn, error) {
+	tlsConn := tls.Client(conn, tlsConfig)
+	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
+	defer cancel()
+	err := tlsConn.HandshakeContext(ctx)
+	return tlsConn, err
 }

common/json/comment.go

@@ -1,128 +0,0 @@
-package json
-
-import (
-	"bufio"
-	"io"
-)
-
-// kanged from v2ray
-
-type commentFilterState = byte
-
-const (
-	commentFilterStateContent commentFilterState = iota
-	commentFilterStateEscape
-	commentFilterStateDoubleQuote
-	commentFilterStateDoubleQuoteEscape
-	commentFilterStateSingleQuote
-	commentFilterStateSingleQuoteEscape
-	commentFilterStateComment
-	commentFilterStateSlash
-	commentFilterStateMultilineComment
-	commentFilterStateMultilineCommentStar
-)
-
-type CommentFilter struct {
-	br    *bufio.Reader
-	state commentFilterState
-}
-
-func NewCommentFilter(reader io.Reader) io.Reader {
-	return &CommentFilter{br: bufio.NewReader(reader)}
-}
-
-func (v *CommentFilter) Read(b []byte) (int, error) {
-	p := b[:0]
-	for len(p) < len(b)-2 {
-		x, err := v.br.ReadByte()
-		if err != nil {
-			if len(p) == 0 {
-				return 0, err
-			}
-			return len(p), nil
-		}
-		switch v.state {
-		case commentFilterStateContent:
-			switch x {
-			case '"':
-				v.state = commentFilterStateDoubleQuote
-				p = append(p, x)
-			case '\'':
-				v.state = commentFilterStateSingleQuote
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateEscape
-			case '#':
-				v.state = commentFilterStateComment
-			case '/':
-				v.state = commentFilterStateSlash
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateContent
-		case commentFilterStateDoubleQuote:
-			switch x {
-			case '"':
-				v.state = commentFilterStateContent
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateDoubleQuoteEscape
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateDoubleQuoteEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateDoubleQuote
-		case commentFilterStateSingleQuote:
-			switch x {
-			case '\'':
-				v.state = commentFilterStateContent
-				p = append(p, x)
-			case '\\':
-				v.state = commentFilterStateSingleQuoteEscape
-			default:
-				p = append(p, x)
-			}
-		case commentFilterStateSingleQuoteEscape:
-			p = append(p, '\\', x)
-			v.state = commentFilterStateSingleQuote
-		case commentFilterStateComment:
-			if x == '\n' {
-				v.state = commentFilterStateContent
-				p = append(p, '\n')
-			}
-		case commentFilterStateSlash:
-			switch x {
-			case '/':
-				v.state = commentFilterStateComment
-			case '*':
-				v.state = commentFilterStateMultilineComment
-			default:
-				p = append(p, '/', x)
-			}
-		case commentFilterStateMultilineComment:
-			switch x {
-			case '*':
-				v.state = commentFilterStateMultilineCommentStar
-			case '\n':
-				p = append(p, '\n')
-			}
-		case commentFilterStateMultilineCommentStar:
-			switch x {
-			case '/':
-				v.state = commentFilterStateContent
-			case '*':
-				// Stay
-			case '\n':
-				p = append(p, '\n')
-			default:
-				v.state = commentFilterStateMultilineComment
-			}
-		default:
-			panic("Unknown state.")
-		}
-	}
-	return len(p), nil
-}

common/mux/client.go

@@ -329,23 +329,6 @@ func (c *ClientPacketConn) Write(b []byte) (n int, err error) {
 	return c.ExtendedConn.Write(b)
 }
 
-func (c *ClientPacketConn) ReadBuffer(buffer *buf.Buffer) (err error) {
-	if !c.responseRead {
-		err = c.readResponse()
-		if err != nil {
-			return
-		}
-		c.responseRead = true
-	}
-	var length uint16
-	err = binary.Read(c.ExtendedConn, binary.BigEndian, &length)
-	if err != nil {
-		return
-	}
-	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
-	return
-}
-
 func (c *ClientPacketConn) WriteBuffer(buffer *buf.Buffer) error {
 	if !c.requestWrite {
 		defer buffer.Release()
@@ -360,11 +343,6 @@ func (c *ClientPacketConn) FrontHeadroom() int {
 	return 2
 }
 
-func (c *ClientPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
-	err = c.ReadBuffer(buffer)
-	return
-}
-
 func (c *ClientPacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
 	return c.WriteBuffer(buffer)
 }
@@ -488,7 +466,10 @@ func (c *ClientPacketAddrConn) ReadPacket(buffer *buf.Buffer) (destination M.Soc
 	if err != nil {
 		return
 	}
-	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
+	if buffer.FreeLen() < int(length) {
+		return destination, io.ErrShortBuffer
+	}
+	_, err = io.ReadFull(c.ExtendedConn, buffer.Extend(int(length)))
 	return
 }
 

common/mux/protocol.go

@@ -43,7 +43,7 @@ func ParseProtocol(name string) (Protocol, error) {
 func (p Protocol) newServer(conn net.Conn) (abstractSession, error) {
 	switch p {
 	case ProtocolSMux:
-		session, err := smux.Server(conn, smuxConfig())
+		session, err := smux.Server(conn, nil)
 		if err != nil {
 			return nil, err
 		}
@@ -58,7 +58,7 @@ func (p Protocol) newServer(conn net.Conn) (abstractSession, error) {
 func (p Protocol) newClient(conn net.Conn) (abstractSession, error) {
 	switch p {
 	case ProtocolSMux:
-		session, err := smux.Client(conn, smuxConfig())
+		session, err := smux.Client(conn, nil)
 		if err != nil {
 			return nil, err
 		}
@@ -70,12 +70,6 @@ func (p Protocol) newClient(conn net.Conn) (abstractSession, error) {
 	}
 }
 
-func smuxConfig() *smux.Config {
-	config := smux.DefaultConfig()
-	config.KeepAliveDisabled = true
-	return config
-}
-
 func yaMuxConfig() *yamux.Config {
 	config := yamux.DefaultConfig()
 	config.LogOutput = io.Discard

common/mux/service.go

@@ -3,6 +3,7 @@ package mux
 import (
 	"context"
 	"encoding/binary"
+	"io"
 	"net"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -14,7 +15,6 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/common/rw"
-	"github.com/sagernet/sing/common/task"
 )
 
 func NewConnection(ctx context.Context, router adapter.Router, errorHandler E.Handler, logger log.ContextLogger, conn net.Conn, metadata adapter.InboundContext) error {
@@ -26,21 +26,14 @@ func NewConnection(ctx context.Context, router adapter.Router, errorHandler E.Ha
 	if err != nil {
 		return err
 	}
-	var group task.Group
-	group.Append0(func(ctx context.Context) error {
-		var stream net.Conn
-		for {
-			stream, err = session.Accept()
-			if err != nil {
-				return err
-			}
-			go newConnection(ctx, router, errorHandler, logger, stream, metadata)
+	var stream net.Conn
+	for {
+		stream, err = session.Accept()
+		if err != nil {
+			return err
 		}
-	})
-	group.Cleanup(func() {
-		session.Close()
-	})
-	return group.Run(ctx)
+		go newConnection(ctx, router, errorHandler, logger, stream, metadata)
+	}
 }
 
 func newConnection(ctx context.Context, router adapter.Router, errorHandler E.Handler, logger log.ContextLogger, stream net.Conn, metadata adapter.InboundContext) {
@@ -165,6 +158,9 @@ func (c *ServerPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksad
 	if err != nil {
 		return
 	}
+	if buffer.FreeLen() < int(length) {
+		return destination, io.ErrShortBuffer
+	}
 	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
 	if err != nil {
 		return
@@ -227,6 +223,9 @@ func (c *ServerPacketAddrConn) ReadPacket(buffer *buf.Buffer) (destination M.Soc
 	if err != nil {
 		return
 	}
+	if buffer.FreeLen() < int(length) {
+		return destination, io.ErrShortBuffer
+	}
 	_, err = buffer.ReadFullFrom(c.ExtendedConn, int(length))
 	if err != nil {
 		return

common/process/searcher.go

@@ -28,5 +28,11 @@ type Info struct {
 }
 
 func FindProcessInfo(searcher Searcher, ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	return findProcessInfo(searcher, ctx, network, source, destination)
+	info, err := findProcessInfo(searcher, ctx, network, source, destination)
+	if err != nil {
+		if source.Addr().Is4In6() {
+			info, err = findProcessInfo(searcher, ctx, network, netip.AddrPortFrom(netip.AddrFrom4(source.Addr().As4()), source.Port()), destination)
+		}
+	}
+	return info, err
 }

common/process/searcher_android.go

@@ -18,21 +18,21 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *androidSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	_, uid, err := resolveSocketByNetlink(network, source, destination)
+	socket, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	if sharedPackage, loaded := s.packageManager.SharedPackageByID(uid % 100000); loaded {
+	if sharedPackage, loaded := s.packageManager.SharedPackageByID(socket.UID); loaded {
 		return &Info{
-			UserId:      int32(uid),
+			UserId:      int32(socket.UID),
 			PackageName: sharedPackage,
 		}, nil
 	}
-	if packageName, loaded := s.packageManager.PackageByID(uid % 100000); loaded {
+	if packageName, loaded := s.packageManager.PackageByID(socket.UID); loaded {
 		return &Info{
-			UserId:      int32(uid),
+			UserId:      int32(socket.UID),
 			PackageName: packageName,
 		}, nil
 	}
-	return &Info{UserId: int32(uid)}, nil
+	return &Info{UserId: int32(socket.UID)}, nil
 }

common/process/searcher_darwin.go

@@ -5,8 +5,6 @@ import (
 	"encoding/binary"
 	"net/netip"
 	"os"
-	"strconv"
-	"strings"
 	"syscall"
 	"unsafe"
 
@@ -31,22 +29,6 @@ func (d *darwinSearcher) FindProcessInfo(ctx context.Context, network string, so
 	return &Info{ProcessPath: processName, UserId: -1}, nil
 }
 
-var structSize = func() int {
-	value, _ := syscall.Sysctl("kern.osrelease")
-	major, _, _ := strings.Cut(value, ".")
-	n, _ := strconv.ParseInt(major, 10, 64)
-	switch true {
-	case n >= 22:
-		return 408
-	default:
-		// from darwin-xnu/bsd/netinet/in_pcblist.c:get_pcblist_n
-		// size/offset are round up (aligned) to 8 bytes in darwin
-		// rup8(sizeof(xinpcb_n)) + rup8(sizeof(xsocket_n)) +
-		// 2 * rup8(sizeof(xsockbuf_n)) + rup8(sizeof(xsockstat_n))
-		return 384
-	}
-}()
-
 func findProcessName(network string, ip netip.Addr, port int) (string, error) {
 	var spath string
 	switch network {
@@ -71,7 +53,7 @@ func findProcessName(network string, ip netip.Addr, port int) (string, error) {
 	// size/offset are round up (aligned) to 8 bytes in darwin
 	// rup8(sizeof(xinpcb_n)) + rup8(sizeof(xsocket_n)) +
 	// 2 * rup8(sizeof(xsockbuf_n)) + rup8(sizeof(xsockstat_n))
-	itemSize := structSize
+	itemSize := 384
 	if network == N.NetworkTCP {
 		// rup8(sizeof(xtcpcb_n))
 		itemSize += 208

common/process/searcher_linux.go

@@ -20,16 +20,16 @@ func NewSearcher(config Config) (Searcher, error) {
 }
 
 func (s *linuxSearcher) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*Info, error) {
-	inode, uid, err := resolveSocketByNetlink(network, source, destination)
+	socket, err := resolveSocketByNetlink(network, source, destination)
 	if err != nil {
 		return nil, err
 	}
-	processPath, err := resolveProcessNameByProcSearch(inode, uid)
+	processPath, err := resolveProcessNameByProcSearch(socket.INode, socket.UID)
 	if err != nil {
 		s.logger.DebugContext(ctx, "find process path: ", err)
 	}
 	return &Info{
-		UserId:      int32(uid),
+		UserId:      int32(socket.UID),
 		ProcessPath: processPath,
 	}, nil
 }

common/process/searcher_linux_shared.go

@@ -6,7 +6,6 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
-	"net"
 	"net/netip"
 	"os"
 	"path"
@@ -15,9 +14,7 @@ import (
 	"unicode"
 	"unsafe"
 
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/netlink"
 	N "github.com/sagernet/sing/common/network"
 )
 
@@ -37,7 +34,7 @@ const (
 	pathProc                = "/proc"
 )
 
-func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (inode, uid uint32, err error) {
+func resolveSocketByNetlink(network string, source netip.AddrPort, destination netip.AddrPort) (*netlink.Socket, error) {
 	var family uint8
 	var protocol uint8
 
@@ -47,110 +44,28 @@ func resolveSocketByNetlink(network string, source netip.AddrPort, destination n
 	case N.NetworkUDP:
 		protocol = syscall.IPPROTO_UDP
 	default:
-		return 0, 0, os.ErrInvalid
+		return nil, os.ErrInvalid
 	}
-
 	if source.Addr().Is4() {
 		family = syscall.AF_INET
 	} else {
 		family = syscall.AF_INET6
 	}
-
-	req := packSocketDiagRequest(family, protocol, source)
-
-	socket, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_DGRAM, syscall.NETLINK_INET_DIAG)
+	sockets, err := netlink.SocketGet(family, protocol, source, netip.AddrPortFrom(netip.IPv6Unspecified(), 0))
+	if err == nil {
+		sockets, err = netlink.SocketGet(family, protocol, source, destination)
+	}
 	if err != nil {
-		return 0, 0, E.Cause(err, "dial netlink")
+		return nil, err
 	}
-	defer syscall.Close(socket)
-
-	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_SNDTIMEO, &syscall.Timeval{Usec: 100})
-	syscall.SetsockoptTimeval(socket, syscall.SOL_SOCKET, syscall.SO_RCVTIMEO, &syscall.Timeval{Usec: 100})
-
-	err = syscall.Connect(socket, &syscall.SockaddrNetlink{
-		Family: syscall.AF_NETLINK,
-		Pad:    0,
-		Pid:    0,
-		Groups: 0,
-	})
-	if err != nil {
-		return
+	if len(sockets) > 1 {
+		for _, socket := range sockets {
+			if socket.ID.DestinationPort == destination.Port() {
+				return socket, nil
+			}
+		}
 	}
-
-	_, err = syscall.Write(socket, req)
-	if err != nil {
-		return 0, 0, E.Cause(err, "write netlink request")
-	}
-
-	_buffer := buf.StackNew()
-	defer common.KeepAlive(_buffer)
-	buffer := common.Dup(_buffer)
-	defer buffer.Release()
-
-	n, err := syscall.Read(socket, buffer.FreeBytes())
-	if err != nil {
-		return 0, 0, E.Cause(err, "read netlink response")
-	}
-
-	buffer.Truncate(n)
-
-	messages, err := syscall.ParseNetlinkMessage(buffer.Bytes())
-	if err != nil {
-		return 0, 0, E.Cause(err, "parse netlink message")
-	} else if len(messages) == 0 {
-		return 0, 0, E.New("unexcepted netlink response")
-	}
-
-	message := messages[0]
-	if message.Header.Type&syscall.NLMSG_ERROR != 0 {
-		return 0, 0, E.New("netlink message: NLMSG_ERROR")
-	}
-
-	inode, uid = unpackSocketDiagResponse(&messages[0])
-	return
-}
-
-func packSocketDiagRequest(family, protocol byte, source netip.AddrPort) []byte {
-	s := make([]byte, 16)
-	copy(s, source.Addr().AsSlice())
-
-	buf := make([]byte, sizeOfSocketDiagRequest)
-
-	nativeEndian.PutUint32(buf[0:4], sizeOfSocketDiagRequest)
-	nativeEndian.PutUint16(buf[4:6], socketDiagByFamily)
-	nativeEndian.PutUint16(buf[6:8], syscall.NLM_F_REQUEST|syscall.NLM_F_DUMP)
-	nativeEndian.PutUint32(buf[8:12], 0)
-	nativeEndian.PutUint32(buf[12:16], 0)
-
-	buf[16] = family
-	buf[17] = protocol
-	buf[18] = 0
-	buf[19] = 0
-	nativeEndian.PutUint32(buf[20:24], 0xFFFFFFFF)
-
-	binary.BigEndian.PutUint16(buf[24:26], source.Port())
-	binary.BigEndian.PutUint16(buf[26:28], 0)
-
-	copy(buf[28:44], s)
-	copy(buf[44:60], net.IPv6zero)
-
-	nativeEndian.PutUint32(buf[60:64], 0)
-	nativeEndian.PutUint64(buf[64:72], 0xFFFFFFFFFFFFFFFF)
-
-	return buf
-}
-
-func unpackSocketDiagResponse(msg *syscall.NetlinkMessage) (inode, uid uint32) {
-	if len(msg.Data) < 72 {
-		return 0, 0
-	}
-
-	data := msg.Data
-
-	uid = nativeEndian.Uint32(data[64:68])
-	inode = nativeEndian.Uint32(data[68:72])
-
-	return
+	return sockets[0], nil
 }
 
 func resolveProcessNameByProcSearch(inode, uid uint32) (string, error) {

common/proxyproto/listener.go

@@ -13,7 +13,6 @@ import (
 
 type Listener struct {
 	net.Listener
-	AcceptNoHeader bool
 }
 
 func (l *Listener) Accept() (net.Conn, error) {
@@ -23,7 +22,7 @@ func (l *Listener) Accept() (net.Conn, error) {
 	}
 	bufReader := std_bufio.NewReader(conn)
 	header, err := proxyproto.Read(bufReader)
-	if err != nil && !(l.AcceptNoHeader && err == proxyproto.ErrNoProxyProtocol) {
+	if err != nil {
 		return nil, err
 	}
 	if bufReader.Buffered() > 0 {
@@ -34,11 +33,8 @@ func (l *Listener) Accept() (net.Conn, error) {
 		}
 		conn = bufio.NewCachedConn(conn, cache)
 	}
-	if header != nil {
-		return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
-			Source:      M.SocksaddrFromNet(header.SourceAddr).Unwrap(),
-			Destination: M.SocksaddrFromNet(header.DestinationAddr).Unwrap(),
-		}}, nil
-	}
-	return conn, nil
+	return &bufio.AddrConn{Conn: conn, Metadata: M.Metadata{
+		Source:      M.SocksaddrFromNet(header.SourceAddr),
+		Destination: M.SocksaddrFromNet(header.DestinationAddr),
+	}}, nil
 }

common/redir/redir_darwin.go

@@ -1,64 +0,0 @@
-package redir
-
-import (
-	"net"
-	"net/netip"
-	"syscall"
-	"unsafe"
-
-	M "github.com/sagernet/sing/common/metadata"
-)
-
-const (
-	PF_OUT      = 0x2
-	DIOCNATLOOK = 0xc0544417
-)
-
-func GetOriginalDestination(conn net.Conn) (destination netip.AddrPort, err error) {
-	fd, err := syscall.Open("/dev/pf", 0, syscall.O_RDONLY)
-	if err != nil {
-		return netip.AddrPort{}, err
-	}
-	defer syscall.Close(fd)
-	nl := struct {
-		saddr, daddr, rsaddr, rdaddr       [16]byte
-		sxport, dxport, rsxport, rdxport   [4]byte
-		af, proto, protoVariant, direction uint8
-	}{
-		af:        syscall.AF_INET,
-		proto:     syscall.IPPROTO_TCP,
-		direction: PF_OUT,
-	}
-	la := conn.LocalAddr().(*net.TCPAddr)
-	ra := conn.RemoteAddr().(*net.TCPAddr)
-	raIP, laIP := ra.IP, la.IP
-	raPort, laPort := ra.Port, la.Port
-	switch {
-	case raIP.To4() != nil:
-		copy(nl.saddr[:net.IPv4len], raIP.To4())
-		copy(nl.daddr[:net.IPv4len], laIP.To4())
-		nl.af = syscall.AF_INET
-	default:
-		copy(nl.saddr[:], raIP.To16())
-		copy(nl.daddr[:], laIP.To16())
-		nl.af = syscall.AF_INET6
-	}
-	nl.sxport[0], nl.sxport[1] = byte(raPort>>8), byte(raPort)
-	nl.dxport[0], nl.dxport[1] = byte(laPort>>8), byte(laPort)
-	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), DIOCNATLOOK, uintptr(unsafe.Pointer(&nl))); errno != 0 {
-		return netip.AddrPort{}, errno
-	}
-
-	var ip net.IP
-	switch nl.af {
-	case syscall.AF_INET:
-		ip = make(net.IP, net.IPv4len)
-		copy(ip, nl.rdaddr[:net.IPv4len])
-	case syscall.AF_INET6:
-		ip = make(net.IP, net.IPv6len)
-		copy(ip, nl.rdaddr[:])
-	}
-	port := uint16(nl.rdxport[0])<<8 | uint16(nl.rdxport[1])
-	destination = netip.AddrPortFrom(M.AddrFromIP(ip), port)
-	return
-}

common/redir/redir_other.go

@@ -1,4 +1,4 @@
-//go:build !linux && !darwin
+//go:build !linux
 
 package redir
 

common/redir/tproxy_linux.go

@@ -2,11 +2,14 @@ package redir
 
 import (
 	"encoding/binary"
+	"net"
 	"net/netip"
+	"os"
+	"strconv"
 	"syscall"
 
-	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
+	F "github.com/sagernet/sing/common/format"
 	M "github.com/sagernet/sing/common/metadata"
 
 	"golang.org/x/sys/unix"
@@ -29,18 +32,6 @@ func TProxy(fd uintptr, isIPv6 bool) error {
 	return err
 }
 
-func TProxyWriteBack() control.Func {
-	return func(network, address string, conn syscall.RawConn) error {
-		return control.Raw(conn, func(fd uintptr) error {
-			if M.ParseSocksaddr(address).Addr.Is6() {
-				return syscall.SetsockoptInt(int(fd), syscall.SOL_IPV6, unix.IPV6_TRANSPARENT, 1)
-			} else {
-				return syscall.SetsockoptInt(int(fd), syscall.SOL_IP, syscall.IP_TRANSPARENT, 1)
-			}
-		})
-	}
-}
-
 func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	controlMessages, err := unix.ParseSocketControlMessage(oob)
 	if err != nil {
@@ -55,3 +46,79 @@ func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	}
 	return netip.AddrPort{}, E.New("not found")
 }
+
+func DialUDP(lAddr *net.UDPAddr, rAddr *net.UDPAddr) (*net.UDPConn, error) {
+	rSockAddr, err := udpAddrToSockAddr(rAddr)
+	if err != nil {
+		return nil, err
+	}
+
+	lSockAddr, err := udpAddrToSockAddr(lAddr)
+	if err != nil {
+		return nil, err
+	}
+
+	fd, err := syscall.Socket(udpAddrFamily(lAddr, rAddr), syscall.SOCK_DGRAM, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+
+	if err = syscall.SetsockoptInt(fd, syscall.SOL_IP, syscall.IP_TRANSPARENT, 1); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+
+	if err = syscall.Bind(fd, lSockAddr); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+
+	if err = syscall.Connect(fd, rSockAddr); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+
+	fdFile := os.NewFile(uintptr(fd), F.ToString("net-udp-dial-", rAddr))
+	defer fdFile.Close()
+
+	c, err := net.FileConn(fdFile)
+	if err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+
+	return c.(*net.UDPConn), nil
+}
+
+func udpAddrToSockAddr(addr *net.UDPAddr) (syscall.Sockaddr, error) {
+	switch {
+	case addr.IP.To4() != nil:
+		ip := [4]byte{}
+		copy(ip[:], addr.IP.To4())
+
+		return &syscall.SockaddrInet4{Addr: ip, Port: addr.Port}, nil
+
+	default:
+		ip := [16]byte{}
+		copy(ip[:], addr.IP.To16())
+
+		zoneID, err := strconv.ParseUint(addr.Zone, 10, 32)
+		if err != nil {
+			zoneID = 0
+		}
+
+		return &syscall.SockaddrInet6{Addr: ip, Port: addr.Port, ZoneId: uint32(zoneID)}, nil
+	}
+}
+
+func udpAddrFamily(lAddr, rAddr *net.UDPAddr) int {
+	if (lAddr == nil || lAddr.IP.To4() != nil) && (rAddr == nil || lAddr.IP.To4() != nil) {
+		return syscall.AF_INET
+	}
+	return syscall.AF_INET6
+}

common/redir/tproxy_other.go

@@ -3,20 +3,19 @@
 package redir
 
 import (
+	"net"
 	"net/netip"
 	"os"
-
-	"github.com/sagernet/sing/common/control"
 )
 
 func TProxy(fd uintptr, isIPv6 bool) error {
 	return os.ErrInvalid
 }
 
-func TProxyWriteBack() control.Func {
-	return nil
-}
-
 func GetOriginalDestinationFromOOB(oob []byte) (netip.AddrPort, error) {
 	return netip.AddrPort{}, os.ErrInvalid
 }
+
+func DialUDP(lAddr *net.UDPAddr, rAddr *net.UDPAddr) (*net.UDPConn, error) {
+	return nil, os.ErrInvalid
+}

common/settings/proxy_darwin.go

@@ -1,7 +1,6 @@
 package settings
 
 import (
-	"net/netip"
 	"strings"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -20,8 +19,8 @@ type systemProxy struct {
 	isMixed       bool
 }
 
-func (p *systemProxy) update(event int) error {
-	newInterfaceName := p.monitor.DefaultInterfaceName(netip.IPv4Unspecified())
+func (p *systemProxy) update() error {
+	newInterfaceName := p.monitor.DefaultInterfaceName()
 	if p.interfaceName == newInterfaceName {
 		return nil
 	}
@@ -88,7 +87,7 @@ func SetSystemProxy(router adapter.Router, port uint16, isMixed bool) (func() er
 		port:    port,
 		isMixed: isMixed,
 	}
-	err := proxy.update(tun.EventInterfaceUpdate)
+	err := proxy.update()
 	if err != nil {
 		return nil, err
 	}

common/sniff/dns.go

@@ -11,10 +11,9 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/buf"
-	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/task"
 
-	mDNS "github.com/miekg/dns"
+	"golang.org/x/net/dns/dnsmessage"
 )
 
 func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.InboundContext, error) {
@@ -23,7 +22,7 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 	if err != nil {
 		return nil, err
 	}
-	if length == 0 {
+	if length > 512 {
 		return nil, os.ErrInvalid
 	}
 	_buffer := buf.StackNewSize(int(length))
@@ -45,13 +44,18 @@ func StreamDomainNameQuery(readCtx context.Context, reader io.Reader) (*adapter.
 }
 
 func DomainNameQuery(ctx context.Context, packet []byte) (*adapter.InboundContext, error) {
-	var msg mDNS.Msg
-	err := msg.Unpack(packet)
+	var parser dnsmessage.Parser
+	_, err := parser.Start(packet)
 	if err != nil {
 		return nil, err
 	}
-	if len(msg.Question) == 0 || msg.Question[0].Qclass != mDNS.ClassINET || !M.IsDomainName(msg.Question[0].Name) {
+	question, err := parser.Question()
+	if err != nil {
 		return nil, os.ErrInvalid
 	}
-	return &adapter.InboundContext{Protocol: C.ProtocolDNS}, nil
+	domain := question.Name.String()
+	if question.Class == dnsmessage.ClassINET && IsDomainName(domain) {
+		return &adapter.InboundContext{Protocol: C.ProtocolDNS /*, Domain: domain*/}, nil
+	}
+	return nil, os.ErrInvalid
 }

common/sniff/domain.go

@@ -0,0 +1,6 @@
+package sniff
+
+import _ "unsafe" // for linkname
+
+//go:linkname IsDomainName net.isDomainName
+func IsDomainName(domain string) bool

common/sniff/quic.go

@@ -24,7 +24,8 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	if err != nil {
 		return nil, err
 	}
-	if typeByte&0x40 == 0 {
+
+	if typeByte&0x80 == 0 || typeByte&0x40 == 0 {
 		return nil, E.New("bad type byte")
 	}
 	var versionNumber uint32
@@ -144,6 +145,9 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	default:
 		return nil, E.New("bad packet number length")
 	}
+	if packetNumber != 0 {
+		return nil, E.New("bad packet number: ", packetNumber)
+	}
 	extHdrLen := hdrLen + int(packetNumberLength)
 	copy(newPacket[extHdrLen:hdrLen+4], packet[extHdrLen:])
 	data := newPacket[extHdrLen : int(packetLen)+hdrLen]
@@ -168,76 +172,37 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 	if err != nil {
 		return nil, err
 	}
-	var frameType byte
-	var frameLen uint64
-	var fragments []struct {
-		offset  uint64
-		length  uint64
-		payload []byte
-	}
 	decryptedReader := bytes.NewReader(decrypted)
-	for {
+	frameType, err := decryptedReader.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	for frameType == 0x0 {
+		// skip padding
 		frameType, err = decryptedReader.ReadByte()
-		if err == io.EOF {
-			break
-		}
-		switch frameType {
-		case 0x0:
-			continue
-		case 0x1:
-			continue
-		case 0x6:
-			var offset uint64
-			offset, err = qtls.ReadUvarint(decryptedReader)
-			if err != nil {
-				return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
-			}
-			var length uint64
-			length, err = qtls.ReadUvarint(decryptedReader)
-			if err != nil {
-				return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
-			}
-			index := len(decrypted) - decryptedReader.Len()
-			fragments = append(fragments, struct {
-				offset  uint64
-				length  uint64
-				payload []byte
-			}{offset, length, decrypted[index : index+int(length)]})
-			frameLen += length
-			_, err = decryptedReader.Seek(int64(length), io.SeekCurrent)
-			if err != nil {
-				return nil, err
-			}
-		default:
-			// ignore unknown frame type
+		if err != nil {
+			return nil, err
 		}
 	}
+	if frameType != 0x6 {
+		// not crypto frame
+		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, nil
+	}
+	_, err = qtls.ReadUvarint(decryptedReader)
+	if err != nil {
+		return nil, err
+	}
+	_, err = qtls.ReadUvarint(decryptedReader)
+	if err != nil {
+		return nil, err
+	}
 	tlsHdr := make([]byte, 5)
 	tlsHdr[0] = 0x16
 	binary.BigEndian.PutUint16(tlsHdr[1:], uint16(0x0303))
-	binary.BigEndian.PutUint16(tlsHdr[3:], uint16(frameLen))
-	var index uint64
-	var length int
-	var readers []io.Reader
-	readers = append(readers, bytes.NewReader(tlsHdr))
-find:
-	for {
-		for _, fragment := range fragments {
-			if fragment.offset == index {
-				readers = append(readers, bytes.NewReader(fragment.payload))
-				index = fragment.offset + fragment.length
-				length++
-				continue find
-			}
-		}
-		if length == len(fragments) {
-			break
-		}
-		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, E.New("bad fragments")
-	}
-	metadata, err := TLSClientHello(ctx, io.MultiReader(readers...))
+	binary.BigEndian.PutUint16(tlsHdr[3:], uint16(decryptedReader.Len()))
+	metadata, err := TLSClientHello(ctx, io.MultiReader(bytes.NewReader(tlsHdr), decryptedReader))
 	if err != nil {
-		return &adapter.InboundContext{Protocol: C.ProtocolQUIC}, err
+		return nil, err
 	}
 	metadata.Protocol = C.ProtocolQUIC
 	return metadata, nil

common/sniff/quic_test.go

@@ -19,15 +19,6 @@ func TestSniffQUICv1(t *testing.T) {
 	require.Equal(t, metadata.Domain, "cloudflare-quic.com")
 }
 
-func TestSniffQUICFragment(t *testing.T) {
-	t.Parallel()
-	pkt, err := hex.DecodeString("cc00000001082e3d5d1b64040c55000044d0ccea69e773f6631c1d18b04ae9ee75fcfc34ef74fa62533c93534338a86f101a05d70e0697fb483063fa85db1c59ccfbda5c35234931d8524d8aac37eaaad649470a67794cd754b23c98695238b8363452333bc8c4858376b4166e001da2006e35cf98a91e11a56419b2786775284942d0f7163982f7c248867d12dd374957481dbc564013ff785e1916195eef671f725908f761099d992d69231336ba81d9e25fe2fa3a6eff4318a6ccf10176fc841a1b315f7b35c5b292266fc869d76ca533e7d14e86d82db2e22eacd350977e47d2e012d8a5891c5aaf2a0f4c2b2dae897c161e5b68cbb4dee952472bdc1e21504b8f02534ec4366ce3f8bf86efc78e0232778fbd554457567112abdcafcf6d4d8fcf35083c25d9495679614aba21696e338c62b585046cc55ba8c09c844361d889a47c3ea703b4e23545a9ab2c0bb369693a9ddfb5daffa85cf80fdd6ad66738664e5b0a551729b4955cff7255afcb04dee88c2f072c9de7400947a1bd9327ac5d012a33000ada021d4c03d249fb017d6ac9200b2f9436beab8183ddfbe2d8aee31ffb7df9e1cc181c1af80c39a89965d18ed12da8e3ebe2ae1fbe4b348f83ba19e3e3d1c9b22bcf03ab6ad9b30fe180623faa291ebad83bcd71d7b57f2f5e2f3b8e81d24fb70b2f2159239e8f21ffafef2747aba47d97ab4081e603c018b10678cf99cab1fb42156a14486fa435153979d7279fd22cd40af7088bfc7eff41af2f4b3c0c8864d0040d74dff427f7bffdb8c278474ea00311326cf4925471a8cf596cb92119f19e0f789490ba9cb77b98015a987d93e0324cf1a38b55109f00c3e6ddc5180fb107bf468323afec9bb49fd6a86418569789d66cafe3b8253c2aebb3af3782c1c54dd560487d031d28e6a6e23e159581bb1d47efc4da3fe1d169f9ffb0ca9ba61af0a38a92fde5bc5e6ec026e8378a6315a7b95abf1d2da790a391306ce74d0baf8e2ce648ca74c487f2c0a76a28a80cdf5bd34316eb607684fe7e6d9e83824a00e07660d0b90e3cddd61ebf10748263474afa88c300549e64ce2e90560bb1a12dee7e9484f729a8a4ee7c5651adb5194b3b3ae38e501567c7dbf36e7bb37a2c20b74655f47f2d9af18e52e9d4c9c9eee8e63745779b8f0b06f3a09d846ba62eb978ad77c85de1ee2fee3fbb4c2d283c73e1ccba56a4658e48a2665d200f7f9342f8e84c2ba490094a4f94feec89e42d2f654f564c2beb2997bafa1fc2c68ad8e160b63587d49abc31b834878d52acfb05fb73d0e059b206162e3c90b40c4bc08407ffcb3c08431895b691a3fea923f1f3b48db75d3e6b91fd319ffe4d486e0e14bd5c6affc838dee63d9e0b80f169b5e6c02c7321dcb20deb2b8e707b60e345a308d505bbf26a93d8f18b39d62632e9a77cbe48b3b32eb8819d6311a49820d40f5acbf0273c91c36b2269a03e72ee64df3dfb10ddefe73c64ef60870b2b77bd99dea655f5fe791b538a929a14d99f6d69685d72431ea5f0f4b27a044f2f575ab474fcc3857895934de1ca2581798eaef2c17fe5aaf2e6add97fa32997c7026f15c1b1ad0e6043ae506027a7c0242546fdc851cca39a204e56879f2cef838be8ec66e0f2292f8c862e06f810eb9b80c7a467ce6e90155206352c7f82b1173ba3b98d35bb72c259a60db20dd1a43fe6d7aef0265e6eaa5caafd9b64b448ff745a2046acbdb65cf2a5007809808a4828dc99097feedc734c236260c584")
-	require.NoError(t, err)
-	metadata, err := sniff.QUICClientHello(context.Background(), pkt)
-	require.NoError(t, err)
-	require.Equal(t, metadata.Domain, "cloudflare-quic.com")
-}
-
 func FuzzSniffQUIC(f *testing.F) {
 	f.Fuzz(func(t *testing.T, data []byte) {
 		sniff.QUICClientHello(context.Background(), data)

common/sniff/sniff.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"io"
 	"net"
+	"os"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -18,11 +19,8 @@ type (
 	PacketSniffer = func(ctx context.Context, packet []byte) (*adapter.InboundContext, error)
 )
 
-func PeekStream(ctx context.Context, conn net.Conn, buffer *buf.Buffer, timeout time.Duration, sniffers ...StreamSniffer) (*adapter.InboundContext, error) {
-	if timeout == 0 {
-		timeout = C.ReadPayloadTimeout
-	}
-	err := conn.SetReadDeadline(time.Now().Add(timeout))
+func PeekStream(ctx context.Context, conn net.Conn, buffer *buf.Buffer, sniffers ...StreamSniffer) (*adapter.InboundContext, error) {
+	err := conn.SetReadDeadline(time.Now().Add(C.ReadPayloadTimeout))
 	if err != nil {
 		return nil, err
 	}
@@ -32,25 +30,23 @@ func PeekStream(ctx context.Context, conn net.Conn, buffer *buf.Buffer, timeout
 		return nil, err
 	}
 	var metadata *adapter.InboundContext
-	var errors []error
 	for _, sniffer := range sniffers {
 		metadata, err = sniffer(ctx, bytes.NewReader(buffer.Bytes()))
-		if metadata != nil {
-			return metadata, nil
+		if err != nil {
+			continue
 		}
-		errors = append(errors, err)
+		return metadata, nil
 	}
-	return nil, E.Errors(errors...)
+	return nil, os.ErrInvalid
 }
 
 func PeekPacket(ctx context.Context, packet []byte, sniffers ...PacketSniffer) (*adapter.InboundContext, error) {
-	var errors []error
 	for _, sniffer := range sniffers {
-		metadata, err := sniffer(ctx, packet)
-		if metadata != nil {
-			return metadata, nil
+		sniffMetadata, err := sniffer(ctx, packet)
+		if err != nil {
+			continue
 		}
-		errors = append(errors, err)
+		return sniffMetadata, nil
 	}
-	return nil, E.Errors(errors...)
+	return nil, os.ErrInvalid
 }

common/tls/client.go

@@ -1,81 +0,0 @@
-package tls
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-	"os"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/badtls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-)
-
-func NewDialerFromOptions(router adapter.Router, dialer N.Dialer, serverAddress string, options option.OutboundTLSOptions) (N.Dialer, error) {
-	if !options.Enabled {
-		return dialer, nil
-	}
-	config, err := NewClient(router, serverAddress, options)
-	if err != nil {
-		return nil, err
-	}
-	return NewDialer(dialer, config), nil
-}
-
-func NewClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
-	if !options.Enabled {
-		return nil, nil
-	}
-	if options.ECH != nil && options.ECH.Enabled {
-		return NewECHClient(router, serverAddress, options)
-	} else if options.UTLS != nil && options.UTLS.Enabled {
-		return NewUTLSClient(router, serverAddress, options)
-	} else {
-		return NewSTDClient(serverAddress, options)
-	}
-}
-
-func ClientHandshake(ctx context.Context, conn net.Conn, config Config) (Conn, error) {
-	tlsConn := config.Client(conn)
-	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
-	defer cancel()
-	err := tlsConn.HandshakeContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if stdConn, isSTD := tlsConn.(*tls.Conn); isSTD {
-		var badConn badtls.TLSConn
-		badConn, err = badtls.Create(stdConn)
-		if err == nil {
-			return badConn, nil
-		}
-	}
-	return tlsConn, nil
-}
-
-type Dialer struct {
-	dialer N.Dialer
-	config Config
-}
-
-func NewDialer(dialer N.Dialer, config Config) N.Dialer {
-	return &Dialer{dialer, config}
-}
-
-func (d *Dialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	if network != N.NetworkTCP {
-		return nil, os.ErrInvalid
-	}
-	conn, err := d.dialer.DialContext(ctx, network, destination)
-	if err != nil {
-		return nil, err
-	}
-	return ClientHandshake(ctx, conn, d.config)
-}
-
-func (d *Dialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	return nil, os.ErrInvalid
-}

common/tls/common.go

@@ -1,12 +0,0 @@
-package tls
-
-const (
-	VersionTLS10 = 0x0301
-	VersionTLS11 = 0x0302
-	VersionTLS12 = 0x0303
-	VersionTLS13 = 0x0304
-
-	// Deprecated: SSLv3 is cryptographically broken, and is no longer
-	// supported by this package. See golang.org/issue/32716.
-	VersionSSL30 = 0x0300
-)

common/tls/config.go

@@ -1,52 +0,0 @@
-package tls
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-
-	"github.com/sagernet/sing-box/adapter"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type (
-	STDConfig = tls.Config
-	STDConn   = tls.Conn
-)
-
-type Config interface {
-	ServerName() string
-	SetServerName(serverName string)
-	NextProtos() []string
-	SetNextProtos(nextProto []string)
-	Config() (*STDConfig, error)
-	Client(conn net.Conn) Conn
-	Clone() Config
-}
-
-type ServerConfig interface {
-	Config
-	adapter.Service
-	Server(conn net.Conn) Conn
-}
-
-type Conn interface {
-	net.Conn
-	HandshakeContext(ctx context.Context) error
-	ConnectionState() tls.ConnectionState
-}
-
-func ParseTLSVersion(version string) (uint16, error) {
-	switch version {
-	case "1.0":
-		return tls.VersionTLS10, nil
-	case "1.1":
-		return tls.VersionTLS11, nil
-	case "1.2":
-		return tls.VersionTLS12, nil
-	case "1.3":
-		return tls.VersionTLS13, nil
-	default:
-		return 0, E.New("unknown tls version:", version)
-	}
-}

common/tls/ech_client.go

@@ -1,221 +0,0 @@
-//go:build with_ech
-
-package tls
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/base64"
-	"net"
-	"net/netip"
-	"os"
-
-	cftls "github.com/sagernet/cloudflare-tls"
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-dns"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	mDNS "github.com/miekg/dns"
-)
-
-type ECHClientConfig struct {
-	config *cftls.Config
-}
-
-func (e *ECHClientConfig) ServerName() string {
-	return e.config.ServerName
-}
-
-func (e *ECHClientConfig) SetServerName(serverName string) {
-	e.config.ServerName = serverName
-}
-
-func (e *ECHClientConfig) NextProtos() []string {
-	return e.config.NextProtos
-}
-
-func (e *ECHClientConfig) SetNextProtos(nextProto []string) {
-	e.config.NextProtos = nextProto
-}
-
-func (e *ECHClientConfig) Config() (*STDConfig, error) {
-	return nil, E.New("unsupported usage for ECH")
-}
-
-func (e *ECHClientConfig) Client(conn net.Conn) Conn {
-	return &echConnWrapper{cftls.Client(conn, e.config)}
-}
-
-func (e *ECHClientConfig) Clone() Config {
-	return &ECHClientConfig{
-		config: e.config.Clone(),
-	}
-}
-
-type echConnWrapper struct {
-	*cftls.Conn
-}
-
-func (c *echConnWrapper) ConnectionState() tls.ConnectionState {
-	state := c.Conn.ConnectionState()
-	return tls.ConnectionState{
-		Version:                     state.Version,
-		HandshakeComplete:           state.HandshakeComplete,
-		DidResume:                   state.DidResume,
-		CipherSuite:                 state.CipherSuite,
-		NegotiatedProtocol:          state.NegotiatedProtocol,
-		NegotiatedProtocolIsMutual:  state.NegotiatedProtocolIsMutual,
-		ServerName:                  state.ServerName,
-		PeerCertificates:            state.PeerCertificates,
-		VerifiedChains:              state.VerifiedChains,
-		SignedCertificateTimestamps: state.SignedCertificateTimestamps,
-		OCSPResponse:                state.OCSPResponse,
-		TLSUnique:                   state.TLSUnique,
-	}
-}
-
-func NewECHClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
-	var serverName string
-	if options.ServerName != "" {
-		serverName = options.ServerName
-	} else if serverAddress != "" {
-		if _, err := netip.ParseAddr(serverName); err != nil {
-			serverName = serverAddress
-		}
-	}
-	if serverName == "" && !options.Insecure {
-		return nil, E.New("missing server_name or insecure=true")
-	}
-
-	var tlsConfig cftls.Config
-	if options.DisableSNI {
-		tlsConfig.ServerName = "127.0.0.1"
-	} else {
-		tlsConfig.ServerName = serverName
-	}
-	if options.Insecure {
-		tlsConfig.InsecureSkipVerify = options.Insecure
-	} else if options.DisableSNI {
-		tlsConfig.InsecureSkipVerify = true
-		tlsConfig.VerifyConnection = func(state cftls.ConnectionState) error {
-			verifyOptions := x509.VerifyOptions{
-				DNSName:       serverName,
-				Intermediates: x509.NewCertPool(),
-			}
-			for _, cert := range state.PeerCertificates[1:] {
-				verifyOptions.Intermediates.AddCert(cert)
-			}
-			_, err := state.PeerCertificates[0].Verify(verifyOptions)
-			return err
-		}
-	}
-	if len(options.ALPN) > 0 {
-		tlsConfig.NextProtos = options.ALPN
-	}
-	if options.MinVersion != "" {
-		minVersion, err := ParseTLSVersion(options.MinVersion)
-		if err != nil {
-			return nil, E.Cause(err, "parse min_version")
-		}
-		tlsConfig.MinVersion = minVersion
-	}
-	if options.MaxVersion != "" {
-		maxVersion, err := ParseTLSVersion(options.MaxVersion)
-		if err != nil {
-			return nil, E.Cause(err, "parse max_version")
-		}
-		tlsConfig.MaxVersion = maxVersion
-	}
-	if options.CipherSuites != nil {
-	find:
-		for _, cipherSuite := range options.CipherSuites {
-			for _, tlsCipherSuite := range cftls.CipherSuites() {
-				if cipherSuite == tlsCipherSuite.Name {
-					tlsConfig.CipherSuites = append(tlsConfig.CipherSuites, tlsCipherSuite.ID)
-					continue find
-				}
-			}
-			return nil, E.New("unknown cipher_suite: ", cipherSuite)
-		}
-	}
-	var certificate []byte
-	if options.Certificate != "" {
-		certificate = []byte(options.Certificate)
-	} else if options.CertificatePath != "" {
-		content, err := os.ReadFile(options.CertificatePath)
-		if err != nil {
-			return nil, E.Cause(err, "read certificate")
-		}
-		certificate = content
-	}
-	if len(certificate) > 0 {
-		certPool := x509.NewCertPool()
-		if !certPool.AppendCertsFromPEM(certificate) {
-			return nil, E.New("failed to parse certificate:\n\n", certificate)
-		}
-		tlsConfig.RootCAs = certPool
-	}
-
-	// ECH Config
-
-	tlsConfig.ECHEnabled = true
-	tlsConfig.PQSignatureSchemesEnabled = options.ECH.PQSignatureSchemesEnabled
-	tlsConfig.DynamicRecordSizingDisabled = options.ECH.DynamicRecordSizingDisabled
-	if options.ECH.Config != "" {
-		clientConfigContent, err := base64.StdEncoding.DecodeString(options.ECH.Config)
-		if err != nil {
-			return nil, err
-		}
-		clientConfig, err := cftls.UnmarshalECHConfigs(clientConfigContent)
-		if err != nil {
-			return nil, err
-		}
-		tlsConfig.ClientECHConfigs = clientConfig
-	} else {
-		tlsConfig.GetClientECHConfigs = fetchECHClientConfig(router)
-	}
-	return &ECHClientConfig{&tlsConfig}, nil
-}
-
-func fetchECHClientConfig(router adapter.Router) func(ctx context.Context, serverName string) ([]cftls.ECHConfig, error) {
-	return func(ctx context.Context, serverName string) ([]cftls.ECHConfig, error) {
-		message := &mDNS.Msg{
-			MsgHdr: mDNS.MsgHdr{
-				RecursionDesired: true,
-			},
-			Question: []mDNS.Question{
-				{
-					Name:   serverName + ".",
-					Qtype:  mDNS.TypeHTTPS,
-					Qclass: mDNS.ClassINET,
-				},
-			},
-		}
-		response, err := router.Exchange(ctx, message)
-		if err != nil {
-			return nil, err
-		}
-		if response.Rcode != mDNS.RcodeSuccess {
-			return nil, dns.RCodeError(response.Rcode)
-		}
-		for _, rr := range response.Answer {
-			switch resource := rr.(type) {
-			case *mDNS.HTTPS:
-				for _, value := range resource.Value {
-					if value.Key().String() == "ech" {
-						echConfig, err := base64.StdEncoding.DecodeString(value.String())
-						if err != nil {
-							return nil, E.Cause(err, "decode ECH config")
-						}
-						return cftls.UnmarshalECHConfigs(echConfig)
-					}
-				}
-			default:
-				return nil, E.New("unknown resource record type: ", resource.Header().Rrtype)
-			}
-		}
-		return nil, E.New("no ECH config found")
-	}
-}

common/tls/ech_stub.go

@@ -1,13 +0,0 @@
-//go:build !with_ech
-
-package tls
-
-import (
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func NewECHClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
-	return nil, E.New(`ECH is not included in this build, rebuild with -tags with_ech`)
-}

common/tls/mkcert.go

@@ -1,50 +0,0 @@
-package tls
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
-	"time"
-)
-
-func GenerateKeyPair(serverName string) (*tls.Certificate, error) {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, err
-	}
-	serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
-	if err != nil {
-		return nil, err
-	}
-	template := &x509.Certificate{
-		SerialNumber:          serialNumber,
-		NotBefore:             time.Now().Add(time.Hour * -1),
-		NotAfter:              time.Now().Add(time.Hour),
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-		Subject: pkix.Name{
-			CommonName: serverName,
-		},
-		DNSNames: []string{serverName},
-	}
-	publicDer, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
-	if err != nil {
-		return nil, err
-	}
-	privateDer, err := x509.MarshalPKCS8PrivateKey(key)
-	if err != nil {
-		return nil, err
-	}
-	publicPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: publicDer})
-	privPem := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privateDer})
-	keyPair, err := tls.X509KeyPair(publicPem, privPem)
-	if err != nil {
-		return nil, err
-	}
-	return &keyPair, err
-}

common/tls/server.go

@@ -1,37 +0,0 @@
-package tls
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-
-	"github.com/sagernet/sing-box/common/badtls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-)
-
-func NewServer(ctx context.Context, logger log.Logger, options option.InboundTLSOptions) (ServerConfig, error) {
-	if !options.Enabled {
-		return nil, nil
-	}
-	return NewSTDServer(ctx, logger, options)
-}
-
-func ServerHandshake(ctx context.Context, conn net.Conn, config ServerConfig) (Conn, error) {
-	tlsConn := config.Server(conn)
-	ctx, cancel := context.WithTimeout(ctx, C.TCPTimeout)
-	defer cancel()
-	err := tlsConn.HandshakeContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if stdConn, isSTD := tlsConn.(*tls.Conn); isSTD {
-		var badConn badtls.TLSConn
-		badConn, err = badtls.Create(stdConn)
-		if err == nil {
-			return badConn, nil
-		}
-	}
-	return tlsConn, nil
-}

common/tls/utls_client.go

@@ -1,171 +0,0 @@
-//go:build with_utls
-
-package tls
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"net"
-	"net/netip"
-	"os"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	utls "github.com/refraction-networking/utls"
-)
-
-type UTLSClientConfig struct {
-	config *utls.Config
-	id     utls.ClientHelloID
-}
-
-func (e *UTLSClientConfig) ServerName() string {
-	return e.config.ServerName
-}
-
-func (e *UTLSClientConfig) SetServerName(serverName string) {
-	e.config.ServerName = serverName
-}
-
-func (e *UTLSClientConfig) NextProtos() []string {
-	return e.config.NextProtos
-}
-
-func (e *UTLSClientConfig) SetNextProtos(nextProto []string) {
-	e.config.NextProtos = nextProto
-}
-
-func (e *UTLSClientConfig) Config() (*STDConfig, error) {
-	return nil, E.New("unsupported usage for uTLS")
-}
-
-func (e *UTLSClientConfig) Client(conn net.Conn) Conn {
-	return &utlsConnWrapper{utls.UClient(conn, e.config.Clone(), e.id)}
-}
-
-type utlsConnWrapper struct {
-	*utls.UConn
-}
-
-func (c *utlsConnWrapper) ConnectionState() tls.ConnectionState {
-	state := c.Conn.ConnectionState()
-	return tls.ConnectionState{
-		Version:                     state.Version,
-		HandshakeComplete:           state.HandshakeComplete,
-		DidResume:                   state.DidResume,
-		CipherSuite:                 state.CipherSuite,
-		NegotiatedProtocol:          state.NegotiatedProtocol,
-		NegotiatedProtocolIsMutual:  state.NegotiatedProtocolIsMutual,
-		ServerName:                  state.ServerName,
-		PeerCertificates:            state.PeerCertificates,
-		VerifiedChains:              state.VerifiedChains,
-		SignedCertificateTimestamps: state.SignedCertificateTimestamps,
-		OCSPResponse:                state.OCSPResponse,
-		TLSUnique:                   state.TLSUnique,
-	}
-}
-
-func (e *UTLSClientConfig) Clone() Config {
-	return &UTLSClientConfig{
-		config: e.config.Clone(),
-		id:     e.id,
-	}
-}
-
-func NewUTLSClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
-	var serverName string
-	if options.ServerName != "" {
-		serverName = options.ServerName
-	} else if serverAddress != "" {
-		if _, err := netip.ParseAddr(serverName); err != nil {
-			serverName = serverAddress
-		}
-	}
-	if serverName == "" && !options.Insecure {
-		return nil, E.New("missing server_name or insecure=true")
-	}
-
-	var tlsConfig utls.Config
-	if options.DisableSNI {
-		tlsConfig.ServerName = "127.0.0.1"
-	} else {
-		tlsConfig.ServerName = serverName
-	}
-	if options.Insecure {
-		tlsConfig.InsecureSkipVerify = options.Insecure
-	} else if options.DisableSNI {
-		return nil, E.New("disable_sni is unsupported in uTLS")
-	}
-	if len(options.ALPN) > 0 {
-		tlsConfig.NextProtos = options.ALPN
-	}
-	if options.MinVersion != "" {
-		minVersion, err := ParseTLSVersion(options.MinVersion)
-		if err != nil {
-			return nil, E.Cause(err, "parse min_version")
-		}
-		tlsConfig.MinVersion = minVersion
-	}
-	if options.MaxVersion != "" {
-		maxVersion, err := ParseTLSVersion(options.MaxVersion)
-		if err != nil {
-			return nil, E.Cause(err, "parse max_version")
-		}
-		tlsConfig.MaxVersion = maxVersion
-	}
-	if options.CipherSuites != nil {
-	find:
-		for _, cipherSuite := range options.CipherSuites {
-			for _, tlsCipherSuite := range tls.CipherSuites() {
-				if cipherSuite == tlsCipherSuite.Name {
-					tlsConfig.CipherSuites = append(tlsConfig.CipherSuites, tlsCipherSuite.ID)
-					continue find
-				}
-			}
-			return nil, E.New("unknown cipher_suite: ", cipherSuite)
-		}
-	}
-	var certificate []byte
-	if options.Certificate != "" {
-		certificate = []byte(options.Certificate)
-	} else if options.CertificatePath != "" {
-		content, err := os.ReadFile(options.CertificatePath)
-		if err != nil {
-			return nil, E.Cause(err, "read certificate")
-		}
-		certificate = content
-	}
-	if len(certificate) > 0 {
-		certPool := x509.NewCertPool()
-		if !certPool.AppendCertsFromPEM(certificate) {
-			return nil, E.New("failed to parse certificate:\n\n", certificate)
-		}
-		tlsConfig.RootCAs = certPool
-	}
-	var id utls.ClientHelloID
-	switch options.UTLS.Fingerprint {
-	case "chrome", "":
-		id = utls.HelloChrome_Auto
-	case "firefox":
-		id = utls.HelloFirefox_Auto
-	case "edge":
-		id = utls.HelloEdge_Auto
-	case "safari":
-		id = utls.HelloSafari_Auto
-	case "360":
-		id = utls.Hello360_Auto
-	case "qq":
-		id = utls.HelloQQ_Auto
-	case "ios":
-		id = utls.HelloIOS_Auto
-	case "android":
-		id = utls.HelloAndroid_11_OkHttp
-	case "random":
-		id = utls.HelloRandomized
-	default:
-		return nil, E.New("unknown uTLS fingerprint: ", options.UTLS.Fingerprint)
-	}
-	return &UTLSClientConfig{&tlsConfig, id}, nil
-}

common/tls/utls_stub.go

@@ -1,13 +0,0 @@
-//go:build !with_utls
-
-package tls
-
-import (
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func NewUTLSClient(router adapter.Router, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
-	return nil, E.New(`uTLS is not included in this build, rebuild with -tags with_utls`)
-}

common/trafficcontrol/manager.go

@@ -0,0 +1,145 @@
+package trafficcontrol
+
+import (
+	"io"
+	"net"
+	"sync"
+	"sync/atomic"
+
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/bufio"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+type Manager[U comparable] struct {
+	access sync.Mutex
+	users  map[U]*Traffic
+}
+
+type Traffic struct {
+	Upload   uint64
+	Download uint64
+}
+
+func NewManager[U comparable]() *Manager[U] {
+	return &Manager[U]{
+		users: make(map[U]*Traffic),
+	}
+}
+
+func (m *Manager[U]) Reset() {
+	m.users = make(map[U]*Traffic)
+}
+
+func (m *Manager[U]) TrackConnection(user U, conn net.Conn) net.Conn {
+	m.access.Lock()
+	defer m.access.Unlock()
+	var traffic *Traffic
+	if t, loaded := m.users[user]; loaded {
+		traffic = t
+	} else {
+		traffic = new(Traffic)
+		m.users[user] = traffic
+	}
+	return &TrackConn{conn, traffic}
+}
+
+func (m *Manager[U]) TrackPacketConnection(user U, conn N.PacketConn) N.PacketConn {
+	m.access.Lock()
+	defer m.access.Unlock()
+	var traffic *Traffic
+	if t, loaded := m.users[user]; loaded {
+		traffic = t
+	} else {
+		traffic = new(Traffic)
+		m.users[user] = traffic
+	}
+	return &TrackPacketConn{conn, traffic}
+}
+
+func (m *Manager[U]) ReadTraffics() map[U]Traffic {
+	m.access.Lock()
+	defer m.access.Unlock()
+
+	trafficMap := make(map[U]Traffic)
+	for user, traffic := range m.users {
+		upload := atomic.SwapUint64(&traffic.Upload, 0)
+		download := atomic.SwapUint64(&traffic.Download, 0)
+		if upload == 0 && download == 0 {
+			continue
+		}
+		trafficMap[user] = Traffic{
+			Upload:   upload,
+			Download: download,
+		}
+	}
+	return trafficMap
+}
+
+type TrackConn struct {
+	net.Conn
+	*Traffic
+}
+
+func (c *TrackConn) Read(p []byte) (n int, err error) {
+	n, err = c.Conn.Read(p)
+	if n > 0 {
+		atomic.AddUint64(&c.Upload, uint64(n))
+	}
+	return
+}
+
+func (c *TrackConn) Write(p []byte) (n int, err error) {
+	n, err = c.Conn.Write(p)
+	if n > 0 {
+		atomic.AddUint64(&c.Download, uint64(n))
+	}
+	return
+}
+
+func (c *TrackConn) WriteTo(w io.Writer) (n int64, err error) {
+	n, err = bufio.Copy(w, c.Conn)
+	if n > 0 {
+		atomic.AddUint64(&c.Upload, uint64(n))
+	}
+	return
+}
+
+func (c *TrackConn) ReadFrom(r io.Reader) (n int64, err error) {
+	n, err = bufio.Copy(c.Conn, r)
+	if n > 0 {
+		atomic.AddUint64(&c.Download, uint64(n))
+	}
+	return
+}
+
+func (c *TrackConn) Upstream() any {
+	return c.Conn
+}
+
+type TrackPacketConn struct {
+	N.PacketConn
+	*Traffic
+}
+
+func (c *TrackPacketConn) ReadPacket(buffer *buf.Buffer) (M.Socksaddr, error) {
+	destination, err := c.PacketConn.ReadPacket(buffer)
+	if err == nil {
+		atomic.AddUint64(&c.Upload, uint64(buffer.Len()))
+	}
+	return destination, err
+}
+
+func (c *TrackPacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	n := buffer.Len()
+	err := c.PacketConn.WritePacket(buffer, destination)
+	if err == nil {
+		atomic.AddUint64(&c.Download, uint64(n))
+	}
+	return err
+}
+
+func (c *TrackPacketConn) Upstream() any {
+	return c.PacketConn
+}

constant/err.go

@@ -3,5 +3,3 @@ package constant
 import E "github.com/sagernet/sing/common/exceptions"
 
 var ErrTLSRequired = E.New("TLS required")
-
-var ErrQUICNotIncluded = E.New(`QUIC is not included in this build, rebuild with -tags with_quic`)

constant/proxy.go

@@ -1,29 +1,25 @@
 package constant
 
 const (
-	TypeTun          = "tun"
-	TypeRedirect     = "redirect"
-	TypeTProxy       = "tproxy"
-	TypeDirect       = "direct"
-	TypeBlock        = "block"
-	TypeDNS          = "dns"
-	TypeSocks        = "socks"
-	TypeHTTP         = "http"
-	TypeMixed        = "mixed"
-	TypeShadowsocks  = "shadowsocks"
-	TypeVMess        = "vmess"
-	TypeTrojan       = "trojan"
-	TypeNaive        = "naive"
-	TypeWireGuard    = "wireguard"
-	TypeHysteria     = "hysteria"
-	TypeTor          = "tor"
-	TypeSSH          = "ssh"
-	TypeShadowTLS    = "shadowtls"
-	TypeShadowsocksR = "shadowsocksr"
-	TypeVLESS        = "vless"
+	TypeTun         = "tun"
+	TypeRedirect    = "redirect"
+	TypeTProxy      = "tproxy"
+	TypeDirect      = "direct"
+	TypeBlock       = "block"
+	TypeDNS         = "dns"
+	TypeSocks       = "socks"
+	TypeHTTP        = "http"
+	TypeMixed       = "mixed"
+	TypeShadowsocks = "shadowsocks"
+	TypeVMess       = "vmess"
+	TypeTrojan      = "trojan"
+	TypeNaive       = "naive"
+	TypeWireGuard   = "wireguard"
+	TypeHysteria    = "hysteria"
+	TypeTor         = "tor"
+	TypeSSH         = "ssh"
 )
 
 const (
 	TypeSelector = "selector"
-	TypeURLTest  = "urltest"
 )

constant/quic.go

@@ -0,0 +1,5 @@
+//go:build with_quic
+
+package constant
+
+const QUIC_AVAILABLE = true

constant/quic_stub.go

@@ -0,0 +1,9 @@
+//go:build !with_quic
+
+package constant
+
+import E "github.com/sagernet/sing/common/exceptions"
+
+const QUIC_AVAILABLE = false
+
+var ErrQUICNotIncluded = E.New(`QUIC is not included in this build, rebuild with -tags with_quic`)

constant/timeout.go

@@ -3,11 +3,10 @@ package constant
 import "time"
 
 const (
-	TCPTimeout             = 5 * time.Second
-	ReadPayloadTimeout     = 300 * time.Millisecond
-	DNSTimeout             = 10 * time.Second
-	QUICTimeout            = 30 * time.Second
-	STUNTimeout            = 15 * time.Second
-	UDPTimeout             = 5 * time.Minute
-	DefaultURLTestInterval = 1 * time.Minute
+	TCPTimeout         = 5 * time.Second
+	ReadPayloadTimeout = 300 * time.Millisecond
+	DNSTimeout         = 10 * time.Second
+	QUICTimeout        = 30 * time.Second
+	STUNTimeout        = 15 * time.Second
+	UDPTimeout         = 5 * time.Minute
 )

constant/version.go

@@ -1,3 +1,6 @@
 package constant
 
-var Version = "1.1-rc1"
+var (
+	Version = "1.0"
+	Commit  = ""
+)

docs/changelog.md

@@ -1,350 +1,4 @@
-#### 1.1-rc1
-
-* Fix TLS config for h2 server
-* Fix crash when input bad method in shadowsocks multi-user inbound
-* Fix listen UDP
-* Fix check invalid packet on macOS
-
-#### 1.1-beta18
-
-* Enhance defense against active probe for shadowtls server **1**
-
-**1**:
-
-The `fallback_after` option has been removed.
-
-#### 1.1-beta17
-
-* Fix shadowtls server **1**
-
-*1*:
-
-Added [fallback_after](/configuration/inbound/shadowtls#fallback_after) option.
-
-#### 1.0.7
-
-* Add support for new x/h2 deadline
-* Fix copy pipe
-* Fix decrypt xplus packet
-* Fix macOS Ventura process name match
-* Fix smux keepalive
-* Fix vmess request buffer
-* Fix h2c transport
-* Fix tor geoip
-* Fix udp connect for mux client
-* Fix default dns transport strategy
-
-#### 1.1-beta16
-
-* Improve shadowtls server
-* Fix default dns transport strategy
-* Update uTLS to v1.2.0
-
-#### 1.1-beta15
-
-* Add support for new x/h2 deadline
-* Fix udp connect for mux client
-* Fix dns buffer
-* Fix quic dns retry
-* Fix create TLS config
-* Fix websocket alpn
-* Fix tor geoip
-
-#### 1.1-beta14
-
-* Add multi-user support for hysteria inbound **1**
-* Add custom tls client support for std grpc
-* Fix smux keep alive
-* Fix vmess request buffer
-* Fix default local DNS server behavior
-* Fix h2c transport
-
-*1*:
-
-The `auth` and `auth_str` fields have been replaced by the `users` field.
-
-#### 1.1-beta13
-
-* Add custom worker count option for WireGuard outbound
-* Split bind_address into ipv4 and ipv6
-* Move WFP manipulation to strict route
-* Fix WireGuard outbound panic when close
-* Fix macOS Ventura process name match
-* Fix QUIC connection migration by @HyNetwork
-* Fix handling QUIC client SNI by @HyNetwork
-
-#### 1.1-beta12
-
-* Fix uTLS config
-* Update quic-go to v0.30.0
-* Update cloudflare-tls to go1.18.7
-
-#### 1.1-beta11
-
-* Add option for custom wireguard reserved bytes
-* Fix shadowtls v2
-* Fix h3 dns transport
-* Fix copy pipe
-* Fix decrypt xplus packet
-* Fix v2ray api
-* Suppress no network error
-* Improve local dns transport
-
-#### 1.1-beta10
-
-* Add [sniff_timeout](/configuration/shared/listen#sniff_timeout) listen option
-* Add [custom route](/configuration/inbound/tun#inet4_route_address) support for tun **1**
-* Fix interface monitor
-* Fix websocket headroom
-* Fix uTLS handshake
-* Fix ssh outbound
-* Fix sniff fragmented quic client hello
-* Fix DF for hysteria
-* Fix naive overflow
-* Check destination before udp connect
-* Update uTLS to v1.1.5
-* Update tfo-go to v2.0.2
-* Update fsnotify to v1.6.0
-* Update grpc to v1.50.1
-
-*1*:
-
-The `strict_route` on windows is removed.
-
-#### 1.0.6
-
-* Fix ssh outbound
-* Fix sniff fragmented quic client hello
-* Fix naive overflow
-* Check destination before udp connect
-
-#### 1.1-beta9
-
-* Fix windows route **1**
-* Add [v2ray statistics api](/configuration/experimental#v2ray-api-fields)
-* Add ShadowTLS v2 support **2**
-* Fixes and improvements
-
-**1**:
-
-* Fix DNS leak caused by
-  Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
-* Flush Windows DNS cache when start/close
-
-**2**:
-
-See [ShadowTLS inbound](/configuration/inbound/shadowtls#version)
-and [ShadowTLS outbound](/configuration/outbound/shadowtls#version)
-
-#### 1.1-beta8
-
-* Fix leaks on close
-* Improve websocket writer
-* Refine tproxy write back
-* Refine 4in6 processing
-* Fix shadowsocks plugins
-* Fix missing source address from transport connection
-* Fix fqdn socks5 outbound connection
-* Fix read source address from grpc-go
-
-#### 1.0.5
-
-* Fix missing source address from transport connection
-* Fix fqdn socks5 outbound connection
-* Fix read source address from grpc-go
-
-#### 1.1-beta7
-
-* Add v2ray mux and XUDP support for VMess inbound
-* Add XUDP support for VMess outbound
-* Disable DF on direct outbound by default
-* Fix bugs in 1.1-beta6
-
-#### 1.1-beta6
-
-* Add [URLTest outbound](/configuration/outbound/urltest)
-* Fix bugs in 1.1-beta5
-
-#### 1.1-beta5
-
-* Print tags in version command
-* Redirect clash hello to external ui
-* Move shadowsocksr implementation to clash
-* Make gVisor optional **1**
-* Refactor to miekg/dns
-* Refactor bind control
-* Fix build on go1.18
-* Fix clash store-selected
-* Fix close grpc conn
-* Fix port rule match logic
-* Fix clash api proxy type
-
-*1*:
-
-The build tag `no_gvisor` is replaced by `with_gvisor`.
-
-The default tun stack is changed to system.
-
-#### 1.0.4
-
-* Fix close grpc conn
-* Fix port rule match logic
-* Fix clash api proxy type
-
-#### 1.1-beta4
-
-* Add internal simple-obfs and v2ray-plugin [Shadowsocks plugins](/configuration/outbound/shadowsocks#plugin)
-* Add [ShadowsocksR outbound](/configuration/outbound/shadowsocksr)
-* Add [VLESS outbound and XUDP](/configuration/outbound/vless)
-* Skip wait for hysteria tcp handshake response
-* Fix socks4 client
-* Fix hysteria inbound
-* Fix concurrent write
-
-#### 1.0.3
-
-* Fix socks4 client
-* Fix hysteria inbound
-* Fix concurrent write
-
-#### 1.1-beta3
-
-* Fix using custom TLS client in http2 client
-* Fix bugs in 1.1-beta2
-
-#### 1.1-beta2
-
-* Add Clash mode and persistence support **1**
-* Add TLS ECH and uTLS support for outbound TLS options **2**
-* Fix socks4 request
-* Fix processing empty dns result
-
-*1*:
-
-Switching modes using the Clash API, and `store-selected` are now supported,
-see [Experimental](/configuration/experimental).
-
-*2*:
-
-ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
-message, see [TLS#ECH](/configuration/shared/tls#ech).
-
-uTLS is a fork of "crypto/tls", which provides ClientHello fingerprinting resistance,
-see [TLS#uTLS](/configuration/shared/tls#utls).
-
-#### 1.0.2
-
-* Fix socks4 request
-* Fix processing empty dns result
-
-#### 1.1-beta1
-
-* Add support for use with android VPNService **1**
-* Add tun support for WireGuard outbound **2**
-* Add system tun stack **3**
-* Add comment filter for config **4**
-* Add option for allow optional proxy protocol header
-* Add half close for smux
-* Set UDP DF by default **5**
-* Set default tun mtu to 9000
-* Update gVisor to 20220905.0
-
-*1*:
-
-In previous versions, Android VPN would not work with tun enabled.
-
-The usage of tun over VPN and VPN over tun is now supported, see [Tun Inbound](/configuration/inbound/tun#auto_route).
-
-*2*:
-
-In previous releases, WireGuard outbound support was backed by the lower performance gVisor virtual interface.
-
-It achieves the same performance as wireguard-go by providing automatic system interface support.
-
-*3*:
-
-It does not depend on gVisor and has better performance in some cases.
-
-It is less compatible and may not be available in some environments.
-
-*4*:
-
-Annotated json configuration files are now supported.
-
-*5*:
-
-UDP fragmentation is now blocked by default.
-
-Including shadowsocks-libev, shadowsocks-rust and quic-go all disable segmentation by default.
-
-See [Dial Fields](/configuration/shared/dial#udp_fragment)
-and [Listen Fields](/configuration/shared/listen#udp_fragment).
-
-#### 1.0.1
-
-* Fix match 4in6 address in ip_cidr
-* Fix clash api log level format error
-* Fix clash api unknown proxy type
-
-#### 1.0
-
-* Fix wireguard reconnect
-* Fix naive inbound
-* Fix json format error message
-* Fix processing vmess termination signal
-* Fix hysteria stream error
-* Fix listener close when proxyproto failed
-
-#### 1.0-rc1
-
-* Fix write log timestamp
-* Fix write zero
-* Fix dial parallel in direct outbound
-* Fix write trojan udp
-* Fix DNS routing
-* Add attribute support for geosite
-* Update documentation for [Dial Fields](/configuration/shared/dial)
-
-#### 1.0-beta3
-
-* Add [chained inbound](/configuration/shared/listen#detour) support
-* Add process_path rule item
-* Add macOS redirect support
-* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls)
-  and [Examples](/examples/shadowtls)
-* Fix search android package in non-owner users
-* Fix socksaddr type condition
-* Fix smux session status
-* Refactor inbound and outbound documentation
-* Minor fixes
-
-#### 1.0-beta2
-
-* Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
-* Add packetaddr support for [VMess outbound](/configuration/outbound/vmess#packet_addr)
-* Add better performing alternative gRPC implementation
-* Add [docker image](https://github.com/SagerNet/sing-box/pkgs/container/sing-box)
-* Fix sniff override destination
-
-#### 1.0-beta1
-
-* Initial release
-
-##### 2022/08/26
-
-* Fix ipv6 route on linux
-* Fix read DNS message
-
-##### 2022/08/25
-
-* Let vmess use zero instead of auto if TLS enabled
-* Add trojan fallback for ALPN
-* Improve ip_cidr rule
-* Fix format bind_address
-* Fix http proxy with compressed response
-* Fix route connections
-
-##### 2022/08/24
+#### 2022/08/24
 
 * Fix naive padding
 * Fix unix search path
@@ -353,7 +7,7 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Fix early close on windows and catch any
 * Initial zh-CN document translation
 
-##### 2022/08/23
+#### 2022/08/23
 
 * Add [V2Ray Transport](/configuration/shared/v2ray-transport) support for VMess and Trojan
 * Allow plain http request in Naive inbound (It can now be used with nginx)
@@ -362,17 +16,17 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Parse X-Forward-For in HTTP requests
 * Handle SIGHUP signal
 
-##### 2022/08/22
+#### 2022/08/22
 
 * Add strategy setting for each [DNS server](/configuration/dns/server)
 * Add bind address to outbound options
 
-##### 2022/08/21
+#### 2022/08/21
 
 * Add [Tor outbound](/configuration/outbound/tor)
 * Add [SSH outbound](/configuration/outbound/ssh)
 
-##### 2022/08/20
+#### 2022/08/20
 
 * Attempt to unwrap ip-in-fqdn socksaddr
 * Fix read packages in android 12
@@ -382,53 +36,53 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Skip bind connection with private destination to interface
 * Add [Trojan connection fallback](/configuration/inbound/trojan#fallback)
 
-##### 2022/08/19
+#### 2022/08/19
 
 * Add Hysteria [Inbound](/configuration/inbound/hysteria) and [Outbund](/configuration/outbound/hysteria)
 * Add [ACME TLS certificate issuer](/configuration/shared/tls)
 * Allow read config from stdin (-c stdin)
 * Update gVisor to 20220815.0
 
-##### 2022/08/18
+#### 2022/08/18
 
 * Fix find process with lwip stack
 * Fix crash on shadowsocks server
 * Fix crash on darwin tun
 * Fix write log to file
 
-##### 2022/08/17
+#### 2022/08/17
 
 * Improve async dns transports
 
-##### 2022/08/16
+#### 2022/08/16
 
 * Add ip_version (route/dns) rule item
 * Add [WireGuard](/configuration/outbound/wireguard) outbound
 
-##### 2022/08/15
+#### 2022/08/15
 
 * Add uid, android user and package rules support in [Tun](/configuration/inbound/tun) routing.
 
-##### 2022/08/13
+#### 2022/08/13
 
 * Fix dns concurrent write
 
-##### 2022/08/12
+#### 2022/08/12
 
 * Performance improvements
 * Add UoT option for [SOCKS](/configuration/outbound/socks) outbound
 
-##### 2022/08/11
+#### 2022/08/11
 
 * Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks) outbound, UoT support for all inbounds
 
-##### 2022/08/10
+#### 2022/08/10
 
 * Add full-featured [Naive](/configuration/inbound/naive) inbound
 * Fix default dns server option [#9] by iKirby
 
-##### 2022/08/09
+#### 2022/08/09
 
 No changelog before.
 
-[#9]: https://github.com/SagerNet/sing-box/pull/9
+[#9]: https://github.com/SagerNet/sing-box/pull/9

docs/configuration/dns/index.md

@@ -1,5 +1,3 @@
-# DNS
-
 ### Structure
 
 ```json

docs/configuration/dns/rule.md

@@ -38,8 +38,7 @@
           "private"
         ],
         "source_ip_cidr": [
-          "10.0.0.0/24",
-          "192.168.0.1"
+          "10.0.0.0/24"
         ],
         "source_port": [
           12345
@@ -61,9 +60,6 @@
         "process_name": [
           "curl"
         ],
-        "process_path": [
-          "/usr/bin/curl"
-        ],
         "package_name": [
           "com.termux"
         ],
@@ -73,7 +69,6 @@
         "user_id": [
           1000
         ],
-        "clash_mode": "direct",
         "invert": false,
         "outbound": [
           "direct"
@@ -104,10 +99,8 @@
 
     The default rule uses the following matching logic:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
-    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    (`source_port` || `source_port_range`) &&  
-    `other fields`
+    `other fields`  
 
 #### inbound
 
@@ -183,14 +176,6 @@ Match port range.
 
 Match process name.
 
-#### process_path
-
-!!! error ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process path.
-
 #### package_name
 
 Match android package name.
@@ -211,10 +196,6 @@ Match user name.
 
 Match user id.
 
-#### clash_mode
-
-Match Clash mode.
-
 #### invert
 
 Invert match result.

docs/configuration/dns/rule.zh.md

@@ -60,9 +60,6 @@
         "process_name": [
           "curl"
         ],
-        "process_path": [
-          "/usr/bin/curl"
-        ],
         "package_name": [
           "com.termux"
         ],
@@ -72,7 +69,6 @@
         "user_id": [
           1000
         ],
-        "clash_mode": "direct",
         "invert": false,
         "outbound": [
           "direct"
@@ -103,10 +99,8 @@
 
     默认规则使用以下匹配逻辑:  
     (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
-    (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr`) &&  
-    (`source_port` || `source_port_range`) &&  
-    `other fields`
+    `other fields`  
 
 #### inbound
 
@@ -182,14 +176,6 @@
 
 匹配进程名称。
 
-#### process_path
-
-!!! error ""
-
-    仅支持 Linux、Windows 和 macOS.
-
-匹配进程路径。
-
 #### package_name
 
 匹配 Android 应用包名。
@@ -210,10 +196,6 @@
 
 匹配用户 ID。
 
-#### clash_mode
-
-匹配 Clash 模式。
-
 #### invert
 
 反选匹配结果。

docs/configuration/dns/server.zh.md

@@ -47,7 +47,7 @@ DNS 服务器的地址。
 
 !!! warning ""
 
-    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 QUIC 和 HTTP3 传输层，请参阅 [安装](/zh/#installation)。
 
 !!! info ""
 

docs/configuration/experimental/index.md

@@ -1,5 +1,3 @@
-# Experimental
-
 ### Structure
 
 ```json
@@ -8,43 +6,25 @@
     "clash_api": {
       "external_controller": "127.0.0.1:9090",
       "external_ui": "folder",
-      "secret": "",
-      "direct_io": false,
-      "default_mode": "rule",
-      "store_selected": false,
-      "cache_file": "cache.db"
-    },
-    "v2ray_api": {
-      "listen": "127.0.0.1:8080",
-      "stats": {
-        "enabled": true,
-        "direct_io": false,
-        "inbounds": [
-          "socks-in"
-        ],
-        "outbounds": [
-          "proxy",
-          "direct"
-        ]
-      }
+      "secret": ""
     }
   }
 }
 ```
 
-!!! note ""
-
-    Traffic statistics and connection management can degrade performance.
-
 ### Clash API Fields
 
 !!! error ""
 
     Clash API is not included by default, see [Installation](/#installation).
 
+!!! note ""
+
+    Traffic statistics and connection management will disable TCP splice in linux and reduce performance, use at your own risk.
+
 #### external_controller
 
-RESTful web API listening address. Clash API will be disabled if empty.
+RESTful web API listening address. Disabled if empty.
 
 #### external_ui
 
@@ -56,56 +36,4 @@ serve it at `http://{{external-controller}}/ui`.
 
 Secret for the RESTful API (optional)
 Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
-ALWAYS set a secret if RESTful API is listening on 0.0.0.0
-
-#### direct_io
-
-Allows lossless relays like splice without real-time traffic reporting.
-
-#### default_mode
-
-Default mode in clash, `rule` will be used if empty.
-
-This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
-
-#### store_selected
-
-!!! note ""
-
-    The tag must be set for target outbounds.
-
-Store selected outbound for the `Selector` outbound in cache file.
-
-#### cache_file
-
-Cache file path, `cache.db` will be used if empty.
-
-### V2Ray API Fields
-
-!!! error ""
-
-    V2Ray API is not included by default, see [Installation](/#installation).
-
-#### listen
-
-gRPC API listening address. V2Ray API will be disabled if empty.
-
-#### stats
-
-Traffic statistics service settings.
-
-#### stats.enabled
-
-Enable statistics service.
-
-#### stats.direct_io
-
-Allows lossless relays like splice without real-time traffic reporting.
-
-#### stats.inbounds
-
-Inbound list to count traffic.
-
-#### stats.outbounds
-
-Outbound list to count traffic.
+ALWAYS set a secret if RESTful API is listening on 0.0.0.0

docs/configuration/experimental/index.zh.md

@@ -8,43 +8,25 @@
     "clash_api": {
       "external_controller": "127.0.0.1:9090",
       "external_ui": "folder",
-      "secret": "",
-      "direct_io": false,
-      "default_mode": "rule",
-      "store_selected": false,
-      "cache_file": "cache.db"
-    },
-    "v2ray_api": {
-      "listen": "127.0.0.1:8080",
-      "stats": {
-        "enabled": true,
-        "direct_io": false,
-        "inbounds": [
-          "socks-in"
-        ],
-        "outbounds": [
-          "proxy",
-          "direct"
-        ]
-      }
+      "secret": ""
     }
   }
 }
 ```
 
-!!! note ""
-
-    流量统计和连接管理会降低性能。
-
 ### Clash API 字段
 
 !!! error ""
 
-    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
+    默认安装不包含 Clash API，参阅 [安装](/zh/#installation)。
+
+!!! note ""
+
+    流量统计和连接管理将禁用 Linux 中的 TCP splice 并降低性能，使用风险自负。
 
 #### external_controller
 
-RESTful web API 监听地址。如果为空，则禁用 Clash API。
+RESTful web API 监听地址。
 
 #### external_ui
 
@@ -54,56 +36,4 @@ RESTful web API 监听地址。如果为空，则禁用 Clash API。
 
 RESTful API 的密钥（可选）
 通过指定 HTTP 标头 `Authorization: Bearer ${secret}` 进行身份验证
-如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
-
-#### direct_io
-
-允许像 splice 这样的没有实时流量报告的无损中继。
-
-#### default_mode
-
-Clash 中的默认模式，默认使用 `rule`。
-
-此设置没有直接影响，但可以通过 `clash_mode` 规则项在路由和 DNS 规则中使用。
-
-#### store_selected
-
-!!! note ""
-
-    必须为目标出站设置标签。
-
-将 `Selector` 中出站的选定的目标出站存储在缓存文件中。
-
-#### cache_file
-
-缓存文件路径，默认使用`cache.db`。
-
-### V2Ray API 字段
-
-!!! error ""
-
-    默认安装不包含 V2Ray API，参阅 [安装](/zh/#_2)。
-
-#### listen
-
-gRPC API 监听地址。如果为空，则禁用 V2Ray API。
-
-#### stats
-
-流量统计服务设置。
-
-#### stats.enabled
-
-启用统计服务。
-
-#### stats.direct_io
-
-允许像 splice 这样的没有实时流量报告的无损中继。
-
-#### stats.inbounds
-
-统计流量的入站列表。
-
-#### stats.outbounds
-
-统计流量的出站列表。
+如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。

docs/configuration/inbound/direct.md

@@ -4,22 +4,29 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-in",
-  
-  ... // Listen Fields
+  "inbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "proxy_protocol": false,
 
-  "network": "udp",
-  "override_address": "1.0.0.1",
-  "override_port": 53
+      "network": "udp",
+      "override_address": "1.0.0.1",
+      "override_port": 53
+    }
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Direct Fields
 
 #### network
 
@@ -33,4 +40,50 @@ Override the connection destination address.
 
 #### override_port
 
-Override the connection destination port.
+Override the connection destination port.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/direct.zh.md

@@ -4,22 +4,29 @@
 
 ```json
 {
-  "type": "direct",
-  "tag": "direct-in",
+  "inbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-in",
 
-  ... // 监听字段
-
-  "network": "udp",
-  "override_address": "1.0.0.1",
-  "override_port": 53
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp",
+      "proxy_protocol": false,
+      "override_address": "1.0.0.1",
+      "override_port": 53
+    }
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Direct 字段
 
 #### network
 
@@ -35,3 +42,48 @@
 
 覆盖连接目标端口。
 
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/http.md

@@ -2,27 +2,33 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-in",
-  
-  ... // Listen Fields
-  
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "http",
+      "tag": "http-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "tls": {},
+      "set_system_proxy": false
     }
-  ],
-  "tls": {},
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### HTTP Fields
 
 #### tls
 
@@ -41,3 +47,45 @@ No authentication required if empty.
     Only supported on Linux, Android, Windows, and macOS.
 
 Automatically set system proxy configuration when start and clean up when stop.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/http.zh.md

@@ -2,27 +2,33 @@
 
 ```json
 {
-  "type": "http",
-  "tag": "http-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "http",
+      "tag": "http-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "tls": {},
+      "set_system_proxy": false
     }
-  ],
-  "tls": {},
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### HTTP 字段
 
 #### tls
 
@@ -32,7 +38,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 HTTP 用户
 
-如果为空则不需要验证。
+默认不需要验证。
 
 #### set_system_proxy
 
@@ -40,4 +46,46 @@ HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
+启动时自动设置系统代理，停止时自动清理。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/hysteria.md

@@ -2,30 +2,31 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-in",
-  
-  ... // Listen Fields
-
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
+      "type": "hysteria",
+      "tag": "hysteria-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
       "auth": "",
-      "auth_str": "password"
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window_client": 0,
+      "max_conn_client": 0,
+      "disable_mtu_discovery": false,
+      "tls": {}
     }
-  ],
-  
-  "recv_window_conn": 0,
-  "recv_window_client": 0,
-  "max_conn_client": 0,
-  "disable_mtu_discovery": false,
-  "tls": {}
+  ]
 }
 ```
 
@@ -33,11 +34,7 @@
 
     QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Hysteria Fields
 
 #### up, down
 
@@ -68,19 +65,11 @@ Supported units (case sensitive, b = bits, B = bytes, 8b=1B):
 
 Obfuscated password.
 
-#### users
-
-Hysteria users
-
-#### users.auth
-
-==Required if `auth_str` is empty==
+#### auth
 
 Authentication password, in base64.
 
-#### users.auth_str
-
-==Required if `auth` is empty==
+#### auth_str
 
 Authentication password.
 
@@ -112,4 +101,38 @@ Force enabled on for systems other than Linux and Windows (according to upstream
 
 ==Required==
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/hysteria.zh.md

@@ -2,42 +2,39 @@
 
 ```json
 {
-  "type": "hysteria",
-  "tag": "hysteria-in",
-  
-  ... // 监听字段
-
-  "up": "100 Mbps",
-  "up_mbps": 100,
-  "down": "100 Mbps",
-  "down_mbps": 100,
-  "obfs": "fuck me till the daylight",
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
+      "type": "hysteria",
+      "tag": "hysteria-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      
+      "up": "100 Mbps",
+      "up_mbps": 100,
+      "down": "100 Mbps",
+      "down_mbps": 100,
+      "obfs": "fuck me till the daylight",
       "auth": "",
-      "auth_str": "password"
+      "auth_str": "password",
+      "recv_window_conn": 0,
+      "recv_window_client": 0,
+      "max_conn_client": 0,
+      "disable_mtu_discovery": false,
+      "tls": {}
     }
-  ],
-
-  "recv_window_conn": 0,
-  "recv_window_client": 0,
-  "max_conn_client": 0,
-  "disable_mtu_discovery": false,
-  "tls": {}
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#_2)。
+    默认安装不包含被 Hysteria 依赖的 QUIC，参阅 [安装](/zh/#installation)。
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Hysteria 字段
 
 #### up, down
 
@@ -68,19 +65,11 @@
 
 混淆密码。
 
-#### users
-
-Hysteria 用户
-
-#### users.auth
-
-==与 auth_str 必填一个==
+#### auth
 
 base64 编码的认证密码。
 
-#### users.auth_str
-
-==与 auth 必填一个==
+#### auth_str
 
 认证密码。
 
@@ -112,4 +101,38 @@ base64 编码的认证密码。
 
 ==必填==
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/index.md

@@ -1,5 +1,3 @@
-# Inbound
-
 ### Structure
 
 ```json
@@ -15,20 +13,20 @@
 
 ### Fields
 
-| Type          | Format                       | Injectable |
-|---------------|------------------------------|------------|
-| `direct`      | [Direct](./direct)           | X          |
-| `mixed`       | [Mixed](./mixed)             | TCP        |
-| `socks`       | [SOCKS](./socks)             | TCP        |
-| `http`        | [HTTP](./http)               | TCP        |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
-| `vmess`       | [VMess](./vmess)             | TCP        |
-| `trojan`      | [Trojan](./trojan)           | TCP        |
-| `naive`       | [Naive](./naive)             | X          |
-| `hysteria`    | [Hysteria](./hysteria)       | X          |
-| `tun`         | [Tun](./tun)                 | X          |
-| `redirect`    | [Redirect](./redirect)       | X          |
-| `tproxy`      | [TProxy](./tproxy)           | X          |
+| Type          | Format                       |
+|---------------|------------------------------|
+| `direct`      | [Direct](./direct)           |
+| `mixed`       | [Mixed](./mixed)             |
+| `socks`       | [SOCKS](./socks)             |
+| `http`        | [HTTP](./http)               |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) |
+| `vmess`       | [VMess](./vmess)             |
+| `trojan`      | [Trojan](./trojan)           |
+| `naive`       | [Naive](./naive)             |
+| `hysteria`    | [Hysteria](./hysteria)       |
+| `tun`         | [Tun](./tun)                 |
+| `redirect`    | [Redirect](./redirect)       |
+| `tproxy`      | [TProxy](./tproxy)           |
 
 #### tag
 

docs/configuration/inbound/index.zh.md

@@ -15,20 +15,20 @@
 
 ### 字段
 
-| 类型            | 格式                           | 注入支持 |
-|---------------|------------------------------|------|
-| `direct`      | [Direct](./direct)           | X    |
-| `mixed`       | [Mixed](./mixed)             | TCP  |
-| `socks`       | [SOCKS](./socks)             | TCP  |
-| `http`        | [HTTP](./http)               | TCP  |
-| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
-| `vmess`       | [VMess](./vmess)             | TCP  |
-| `trojan`      | [Trojan](./trojan)           | TCP  |
-| `naive`       | [Naive](./naive)             | X    |
-| `hysteria`    | [Hysteria](./hysteria)       | X    |
-| `tun`         | [Tun](./tun)                 | X    |
-| `redirect`    | [Redirect](./redirect)       | X    |
-| `tproxy`      | [TProxy](./tproxy)           | X    |
+| 类型            | 格式                           |
+|---------------|------------------------------|
+| `direct`      | [Direct](./direct)           |
+| `mixed`       | [Mixed](./mixed)             |
+| `socks`       | [SOCKS](./socks)             |
+| `http`        | [HTTP](./http)               |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) |
+| `vmess`       | [VMess](./vmess)             |
+| `trojan`      | [Trojan](./trojan)           |
+| `naive`       | [Naive](./naive)             |
+| `hysteria`    | [Hysteria](./hysteria)       |
+| `tun`         | [Tun](./tun)                 |
+| `redirect`    | [Redirect](./redirect)       |
+| `tproxy`      | [TProxy](./tproxy)           |
 
 #### tag
 

docs/configuration/inbound/mixed.md

@@ -4,26 +4,32 @@
 
 ```json
 {
-  "type": "mixed",
-  "tag": "mixed-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "mixed",
+      "tag": "mixed-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "set_system_proxy": false
     }
-  ],
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Mixed Fields
 
 #### users
 
@@ -33,6 +39,52 @@ No authentication required if empty.
 
 #### set_system_proxy
 
+!!! error ""
+
+    Only supported on Linux, Android, Windows, and macOS.
+
+Automatically set system proxy configuration when start and clean up when stop.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### set_system_proxy
+
 !!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.

docs/configuration/inbound/mixed.zh.md

@@ -4,32 +4,38 @@
 
 ```json
 {
-  "type": "mixed",
-  "tag": "mixed-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "mixed",
+      "tag": "mixed-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ],
+      "set_system_proxy": false
     }
-  ],
-  "set_system_proxy": false
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Mixed 字段
 
 #### users
 
 SOCKS 和 HTTP 用户
 
-如果为空则不需要验证。
+默认不需要验证。
 
 #### set_system_proxy
 
@@ -37,4 +43,46 @@ SOCKS 和 HTTP 用户
 
     仅支持 Linux、Android、Windows 和 macOS。
 
-启动时自动设置系统代理，停止时自动清理。
+启动时自动设置系统代理，停止时自动清理。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/naive.md

@@ -2,19 +2,29 @@
 
 ```json
 {
-  "type": "naive",
-  "tag": "naive-in",
-  "network": "udp",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "sekai",
-      "password": "password"
+      "type": "naive",
+      "tag": "naive-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+      
+      "network": "udp",
+      "users": [
+        {
+          "username": "sekai",
+          "password": "password"
+        }
+      ],
+      "tls": {}
     }
-  ],
-  "tls": {}
+  ]
 }
 ```
 
@@ -22,11 +32,7 @@
 
     HTTP3 transport is not included by default, see [Installation](/#installation).
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Naive Fields
 
 #### network
 
@@ -42,4 +48,46 @@ Naive users.
 
 #### tls
 
-TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/naive.zh.md

@@ -2,31 +2,37 @@
 
 ```json
 {
-  "type": "naive",
-  "tag": "naive-in",
-  "network": "udp",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "sekai",
-      "password": "password"
+      "type": "naive",
+      "tag": "naive-in",
+      
+      "listen": "::",
+      "listen_port": 443,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "network": "udp",
+      "users": [
+        {
+          "username": "sekai",
+          "password": "password"
+        }
+      ],
+      "tls": {}
     }
-  ],
-  "tls": {}
+  ]
 }
 ```
 
 !!! warning ""
 
-    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#_2)。
+    默认安装不包含 HTTP3 传输层, 参阅 [安装](/zh/#installation)。
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Naive 字段
 
 #### network
 
@@ -42,4 +48,46 @@ Naive 用户。
 
 #### tls
 
-TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/redirect.md

@@ -1,18 +1,52 @@
-!!! error ""
-
-    Only supported on Linux and macOS.
-
 ### Structure
 
 ```json
 {
-  "type": "redirect",
-  "tag": "redirect-in",
-
-  ... // Listen Fields
+  "inbounds": [
+    {
+      "type": "redirect",
+      "tag": "redirect-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6"
+    }
+  ]
 }
 ```
 
 ### Listen Fields
 
-See [Listen Fields](/configuration/shared/listen) for details.
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/redirect.zh.md

@@ -1,17 +1,52 @@
-!!! error ""
-
-    仅支持 Linux 和 macOS。
-
 ### 结构
 
 ```json
 {
-  "type": "redirect",
-  "tag": "redirect-in",
-
-  ... // 监听字段
+  "inbounds": [
+    {
+      "type": "redirect",
+      "tag": "redirect-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6"
+    }
+  ]
 }
 ```
+
 ### 监听字段
 
-参阅 [监听字段](/zh/configuration/shared/listen/)。
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/shadowsocks.md

@@ -2,13 +2,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-in",
-
-  ... // Listen Fields
-
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg=="
+  "inbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "network": "udp",
+      "proxy_protocol": false,
+      
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    }
+  ]
 }
 ```
 
@@ -16,12 +28,17 @@
 
 ```json
 {
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "users": [
+        {
+          "name": "sekai",
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
@@ -31,25 +48,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "destinations": [
+  "inbounds": [
     {
-      "name": "test",
-      "server": "example.com",
-      "server_port": 8080,
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "destinations": [
+        {
+          "name": "test",
+          "server": "example.com",
+          "server_port": 8080,
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Shadowsocks Fields
 
 #### network
 

docs/configuration/inbound/shadowsocks.zh.md

@@ -2,13 +2,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "tag": "ss-in",
-
-  ... // 监听字段
-
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg=="
+  "inbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      "network": "udp",
+      "proxy_protocol": false,
+      
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    }
+  ]
 }
 ```
 
@@ -16,12 +28,17 @@
 
 ```json
 {
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "users": [
+        {
+          "name": "sekai",
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
@@ -31,25 +48,25 @@
 
 ```json
 {
-  "type": "shadowsocks",
-  "method": "2022-blake3-aes-128-gcm",
-  "password": "8JCsPssfgS8tiRwiMlhARg==",
-  "destinations": [
+  "inbounds": [
     {
-      "name": "test",
-      "server": "example.com",
-      "server_port": 8080,
-      "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+      "type": "shadowsocks",
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg==",
+      "destinations": [
+        {
+          "name": "test",
+          "server": "example.com",
+          "server_port": 8080,
+          "password": "PCD2Z4o12bKUoFa3cC97Hw=="
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### 字段
+### Shadowsocks 字段
 
 #### network
 
@@ -81,4 +98,50 @@ See [Listen Fields](/configuration/shared/listen) for details.
 |---------------|-------------------------------|
 | none          | /                             |
 | 2022 methods  | `openssl rand -base64 <密钥长度>` |
-| other methods | 任意字符串                         |
+| other methods | 任意字符串                         |
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/shadowtls.md

@@ -1,46 +0,0 @@
-### Structure
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-in",
-
-  ... // Listen Fields
-
-  "version": 2,
-  "password": "fuck me till the daylight",
-  "handshake": {
-    "server": "google.com",
-    "server_port": 443,
-    
-    ... // Dial Fields
-  }
-}
-```
-
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
-
-#### version
-
-ShadowTLS protocol version.
-
-| Value         | Protocol Version                                                                        |
-|---------------|-----------------------------------------------------------------------------------------|
-| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
-| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
-
-#### password
-
-Set password.
-
-Only available in the ShadowTLS v2 protocol.
-
-#### handshake
-
-==Required==
-
-Handshake server address and [Dial options](/configuration/shared/dial).

docs/configuration/inbound/shadowtls.zh.md

@@ -1,46 +0,0 @@
-### 结构
-
-```json
-{
-  "type": "shadowtls",
-  "tag": "st-in",
-
-  ... // 监听字段
-
-  "version": 2,
-  "password": "fuck me till the daylight",
-  "handshake": {
-    "server": "google.com",
-    "server_port": 443,
-
-    ... // 拨号字段
-  }
-}
-```
-
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
-
-#### version
-
-ShadowTLS 协议版本。
-
-| 值             | 协议版本                                                                                    |
-|---------------|-----------------------------------------------------------------------------------------|
-| `1` (default) | [ShadowTLS v1](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v1) |
-| `2`           | [ShadowTLS v2](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-en.md#v2) |
-
-#### password
-
-设置密码。
-
-仅在 ShadowTLS v2 协议中可用。
-
-#### handshake
-
-==必填==
-
-握手服务器地址和 [拨号参数](/zh/configuration/shared/dial/)。

docs/configuration/inbound/socks.md

@@ -4,28 +4,76 @@
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "socks",
+      "tag": "socks-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ]
     }
   ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### SOCKS Fields
 
 #### users
 
 SOCKS users.
 
 No authentication required if empty.
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址
+
+#### listen_port
+
+==必填==
+
+监听端口
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/socks.zh.md

@@ -4,28 +4,76 @@
 
 ```json
 {
-  "type": "socks",
-  "tag": "socks-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "username": "admin",
-      "password": "admin"
+      "type": "socks",
+      "tag": "socks-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "username": "admin",
+          "password": "admin"
+        }
+      ]
     }
   ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### SOCKS 字段
 
 #### users
 
 SOCKS 用户
 
-如果为空则不需要验证。
+默认不需要验证。
+
+### Listen Fields
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/tproxy.md

@@ -1,28 +1,67 @@
-!!! error ""
-
-    Only supported on Linux.
-
 ### Structure
 
 ```json
 {
-  "type": "tproxy",
-  "tag": "tproxy-in",
-
-  ... // Listen Fields
-
-  "network": "udp"
+  "inbounds": [
+    {
+      "type": "tproxy",
+      "tag": "tproxy-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp"
+    }
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### TProxy Fields
 
 #### network
 
 Listen network, one of `tcp` `udp`.
 
 Both if empty.
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### udp_timeout
+
+UDP NAT expiration time in seconds, default is 300 (5 minutes).

docs/configuration/inbound/tproxy.zh.md

@@ -1,28 +1,67 @@
-!!! error ""
-
-    仅支持 Linux。
-
 ### 结构
 
 ```json
 {
-  "type": "tproxy",
-  "tag": "tproxy-in",
-
-  ... // 监听字段
-
-  "network": "udp"
+  "inbounds": [
+    {
+      "type": "tproxy",
+      "tag": "tproxy-in",
+      
+      "listen": "::",
+      "listen_port": 5353,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "udp_timeout": 300,
+      
+      "network": "udp"
+    }
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### TProxy 字段
 
 #### network
 
 监听的网络协议，`tcp` `udp` 之一。
 
 默认所有。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### udp_timeout
+
+UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

docs/configuration/inbound/trojan.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
+      "type": "trojan",
+      "tag": "trojan-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "password": "8JCsPssfgS8tiRwiMlhARg=="
+        }
+      ],
+      "tls": {},
+      "fallback": {
+        "server": "127.0.0.0.1",
+        "server_port": 8080
+      },
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "fallback": {
-    "server": "127.0.0.1",
-    "server_port": 8080
-  },
-  "fallback_for_alpn": {
-    "http/1.1": {
-      "server": "127.0.0.1",
-      "server_port": 8081
-    }
-  },
-  "transport": {}
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### Trojan Fields
 
 #### users
 
@@ -50,14 +50,50 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 
-Fallback server configuration. Disabled if `fallback` and `fallback_for_alpn` are empty.
-
-#### fallback_for_alpn
-
-Fallback server configuration for specified ALPN.
-
-If not empty, TLS fallback requests with ALPN not in this table will be rejected.
+Fallback server configuration. Disabled if empty.
 
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.

docs/configuration/inbound/trojan.zh.md

@@ -2,37 +2,37 @@
 
 ```json
 {
-  "type": "trojan",
-  "tag": "trojan-in",
-
-  ... // 监听字段
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "password": "8JCsPssfgS8tiRwiMlhARg=="
+      "type": "trojan",
+      "tag": "trojan-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "password": "8JCsPssfgS8tiRwiMlhARg=="
+        }
+      ],
+      "tls": {},
+      "fallback": {
+        "server": "127.0.0.0.1",
+        "server_port": 8080
+      },
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "fallback": {
-    "server": "127.0.0.1",
-    "server_port": 8080
-  },
-  "fallback_for_alpn": {
-    "http/1.1": {
-      "server": "127.0.0.1",
-      "server_port": 8081
-    }
-  },
-  "transport": {}
+  ]
 }
 ```
 
-### 监听字段
-
-参阅 [监听字段](/zh/configuration/shared/listen/)。
-
-### 字段
+### Trojan 字段
 
 #### users
 
@@ -50,16 +50,52 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 !!! error ""
 
-    没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
+    没有证据表明 GFW 基于 HTTP 响应检测并阻止木马服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 
-回退服务器配置。如果 `fallback` 和 `fallback_for_alpn` 为空，则禁用回退。
-
-#### fallback_for_alpn
-
-为 ALPN 指定回退服务器配置。
-
-如果不为空，ALPN 不在此列表中的 TLS 回退请求将被拒绝。
+备用服务器配置。默认禁用。
 
 #### transport
 
-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
+
+### 监听字段
+
+#### listen
+
+==必填==
+
+监听地址。
+
+#### listen_port
+
+==必填==
+
+监听端口。
+
+#### tcp_fast_open
+
+为监听器启用 TCP 快速打开。
+
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。
+
+#### proxy_protocol
+
+解析连接头中的 [代理协议](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)。

docs/configuration/inbound/tun.md

@@ -6,48 +6,47 @@
 
 ```json
 {
-  "type": "tun",
-  "tag": "tun-in",
-  "interface_name": "tun0",
-  "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/126",
-  "mtu": 9000,
-  "auto_route": true,
-  "strict_route": true,
-  "inet4_route_address": [
-    "0.0.0.0/1",
-    "128.0.0.0/1"
-  ],
-  "inet6_route_address": [
-    "::/1",
-    "8000::/1"
-  ],
-  "endpoint_independent_nat": false,
-  "stack": "system",
-  "include_uid": [
-    0
-  ],
-  "include_uid_range": [
-    "1000-99999"
-  ],
-  "exclude_uid": [
-    1000
-  ],
-  "exclude_uid_range": [
-    "1000-99999"
-  ],
-  "include_android_user": [
-    0,
-    10
-  ],
-  "include_package": [
-    "com.android.chrome"
-  ],
-  "exclude_package": [
-    "com.android.captiveportallogin"
-  ],
-  ...
-  // Listen Fields
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "interface_name": "tun0",
+      "inet4_address": "172.19.0.1/30",
+      "inet6_address": "fdfe:dcba:9876::1/128",
+      "mtu": 1500,
+      "auto_route": true,
+      "endpoint_independent_nat": false,
+      "udp_timeout": 300,
+      "stack": "gvisor",
+      "include_uid": [
+        0
+      ],
+      "include_uid_range": [
+        [
+          "1000-99999"
+        ]
+      ],
+      "exclude_uid": [
+        1000
+      ],
+      "exclude_uid_range": [
+        "1000-99999"
+      ],
+      "include_android_user": [
+        0,
+        10
+      ],
+      "include_package": [
+        "com.android.chrome"
+      ],
+      "exclude_package": [
+        "com.android.captiveportallogin"
+      ],
+      "sniff": true,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv4"
+    }
+  ]
 }
 ```
 
@@ -59,7 +58,7 @@
 
     If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
 
-### Fields
+### Tun Fields
 
 #### interface_name
 
@@ -87,43 +86,8 @@ Set the default route to the Tun.
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
-!!! note "Use with Android VPN"
-
-    By default, VPN takes precedence over tun. To make tun go through VPN, enable `route.override_android_vpn`.
-
-#### strict_route
-
-Enforce strict routing rules when `auto_route` is enabled:
-
-*In Linux*:
-
-* Let unsupported network unreachable
-* Route all connections to tun
-
-It prevents address leaks and makes DNS hijacking work on Android and Linux with systemd-resolved, but your device will
-not be accessible by others.
-
-*In Windows*:
-
-* Add firewall rules to prevent DNS leak caused by
-  Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
-
-It may prevent some applications (such as VirtualBox) from working properly in certain situations.
-
-#### inet4_route_address
-
-Use custom routes instead of default when `auto_route` is enabled.
-
-#### inet6_route_address
-
-Use custom routes instead of default when `auto_route` is enabled.
-
 #### endpoint_independent_nat
 
-!!! info ""
-
-    This item is only available on the gvisor stack, other stacks are endpoint-independent NAT by default.
-
 Enable endpoint-independent NAT.
 
 Performance may degrade slightly, so it is not recommended to enable on when it is not needed.
@@ -136,15 +100,14 @@ UDP NAT expiration time in seconds, default is 300 (5 minutes).
 
 TCP/IP stack.
 
-| Stack            | Description                                                                      | Status            |
-|------------------|----------------------------------------------------------------------------------|-------------------|
-| system (default) | Sometimes better performance                                                     | recommended       |
-| gVisor           | Better compatibility, based on [google/gvisor](https://github.com/google/gvisor) | recommended       |
-| LWIP             | Based on [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks)   | upstream archived |
+| Stack            | Upstream                                                              | Status            |
+|------------------|-----------------------------------------------------------------------|-------------------|
+| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | recommended       |
+| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | upstream archived |
 
 !!! warning ""
 
-    gVisor and LWIP stacks is not included by default, see [Installation](/#installation).
+    The LWIP stack is not included by default, see [Installation](/#installation).
 
 #### include_uid
 
@@ -189,4 +152,22 @@ Exclude android packages in route.
 
 ### Listen Fields
 
-See [Listen Fields](/configuration/shared/listen) for details.
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.

docs/configuration/inbound/tun.zh.md

@@ -6,48 +6,47 @@
 
 ```json
 {
-  "type": "tun",
-  "tag": "tun-in",
-  "interface_name": "tun0",
-  "inet4_address": "172.19.0.1/30",
-  "inet6_address": "fdfe:dcba:9876::1/126",
-  "mtu": 9000,
-  "auto_route": true,
-  "strict_route": true,
-  "inet4_route_address": [
-    "0.0.0.0/1",
-    "128.0.0.0/1"
-  ],
-  "inet6_route_address": [
-    "::/1",
-    "8000::/1"
-  ],
-  "endpoint_independent_nat": false,
-  "stack": "system",
-  "include_uid": [
-    0
-  ],
-  "include_uid_range": [
-    "1000-99999"
-  ],
-  "exclude_uid": [
-    1000
-  ],
-  "exclude_uid_range": [
-    "1000-99999"
-  ],
-  "include_android_user": [
-    0,
-    10
-  ],
-  "include_package": [
-    "com.android.chrome"
-  ],
-  "exclude_package": [
-    "com.android.captiveportallogin"
-  ],
-  ...
-  // 监听字段
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "interface_name": "tun0",
+      "inet4_address": "172.19.0.1/30",
+      "inet6_address": "fdfe:dcba:9876::1/128",
+      "mtu": 1500,
+      "auto_route": true,
+      "endpoint_independent_nat": false,
+      "udp_timeout": 300,
+      "stack": "gvisor",
+      "include_uid": [
+        0
+      ],
+      "include_uid_range": [
+        [
+          "1000-99999"
+        ]
+      ],
+      "exclude_uid": [
+        1000
+      ],
+      "exclude_uid_range": [
+        "1000-99999"
+      ],
+      "include_android_user": [
+        0,
+        10
+      ],
+      "include_package": [
+        "com.android.chrome"
+      ],
+      "exclude_package": [
+        "com.android.captiveportallogin"
+      ],
+      "sniff": true,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv4"
+    }
+  ]
 }
 ```
 
@@ -87,37 +86,6 @@ tun 接口的 IPv6 前缀。
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
-!!! note "与 Android VPN 一起使用"
-
-    VPN 默认优先于 tun。要使 tun 经过 VPN，启用 `route.override_android_vpn`。
-
-#### strict_route
-
-启用 `auto_route` 时执行严格的路由规则。
-
-*在 Linux 中*:
-
-* 让不支持的网络无法到达
-* 将所有连接路由到 tun
-
-它可以防止地址泄漏，并使 DNS 劫持在 Android 和使用 systemd-resolved 的 Linux 上工作，但你的设备将无法其他设备被访问。
-
-*在 Windows 中*:
-
-* 添加防火墙规则以阻止 Windows
-  的 [普通多宿主 DNS 解析行为](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
-  造成的 DNS 泄露
-
-它可能会使某些应用程序（如 VirtualBox）在某些情况下无法正常工作。
-
-#### inet4_route_address
-
-启用 `auto_route` 时使用自定义路由而不是默认路由。
-
-#### inet6_route_address
-
-启用 `auto_route` 时使用自定义路由而不是默认路由。
-
 #### endpoint_independent_nat
 
 启用独立于端点的 NAT。
@@ -132,15 +100,14 @@ UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。
 
 TCP/IP 栈。
 
-| 栈           | 描述                                                                       | 状态    |
-|-------------|--------------------------------------------------------------------------|-------|
-| system （默认） | 有时性能更好                                                                   | 推荐    |
-| gVisor      | 兼容性较好，基于 [google/gvisor](https://github.com/google/gvisor)               | 推荐    |
-| LWIP        | 基于 [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
+| 栈                | 上游                                                                    | 状态    |
+|------------------|-----------------------------------------------------------------------|-------|
+| gVisor (default) | [google/gvisor](https://github.com/google/gvisor)                     | 推荐    |
+| LWIP             | [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |
 
 !!! warning ""
 
-    默认安装不包含 gVisor 和 LWIP 栈，请参阅 [安装](/zh/#_2)。
+    默认安装不包含 LWIP 栈，请参阅 [安装](/zh/#installation)。
 
 #### include_uid
 
@@ -170,10 +137,10 @@ TCP/IP 栈。
 
 限制被路由的 Android 用户。
 
-| 常用用户 | ID |
+| 常用用户 | ID  |
 |--|-----|
-| 您 | 0 |
-| 工作资料 | 10 |
+| 您 | 0   |
+| 工作资料 | 10  |
 
 #### include_package
 
@@ -185,4 +152,22 @@ TCP/IP 栈。
 
 ### 监听字段
 
-参阅 [监听字段](/zh/configuration/shared/listen/)。
+#### sniff
+
+启用协议探测。
+
+参阅 [协议探测](/zh/configuration/route/sniff/)。
+
+#### sniff_override_destination
+
+用探测出的域名覆盖连接目标地址。
+
+如果域名无效（如 Tor），将不生效。
+
+#### domain_strategy
+
+可选值： `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`。
+
+如果设置，请求的域名将在路由之前解析为 IP。
+
+如果 `sniff_override_destination` 生效，它的值将作为后备。

docs/configuration/inbound/vmess.md

@@ -2,28 +2,34 @@
 
 ```json
 {
-  "type": "vmess",
-  "tag": "vmess-in",
-
-  ... // Listen Fields
-
-  "users": [
+  "inbounds": [
     {
-      "name": "sekai",
-      "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
-      "alterId": 0
+      "type": "vmess",
+      "tag": "vmess-in",
+      
+      "listen": "::",
+      "listen_port": 2080,
+      "tcp_fast_open": false,
+      "sniff": false,
+      "sniff_override_destination": false,
+      "domain_strategy": "prefer_ipv6",
+      "proxy_protocol": false,
+
+      "users": [
+        {
+          "name": "sekai",
+          "uuid": "bf000d23-0752-40b4-affe-68f7707a9661",
+          "alterId": 0
+        }
+      ],
+      "tls": {},
+      "transport": {}
     }
-  ],
-  "tls": {},
-  "transport": {}
+  ]
 }
 ```
 
-### Listen Fields
-
-See [Listen Fields](/configuration/shared/listen) for details.
-
-### Fields
+### VMess Fields
 
 #### users
 
@@ -47,3 +53,45 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 #### transport
 
 V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
+
+### Listen Fields
+
+#### listen
+
+==Required==
+
+Listen address.
+
+#### listen_port
+
+==Required==
+
+Listen port.
+
+#### tcp_fast_open
+
+Enable tcp fast open for listener.
+
+#### sniff
+
+Enable sniffing.
+
+See [Protocol Sniff](/configuration/route/sniff/) for details.
+
+#### sniff_override_destination
+
+Override the connection destination address with the sniffed domain.
+
+If the domain name is invalid (like tor), this will not work.
+
+#### domain_strategy
+
+One of `prefer_ipv4` `prefer_ipv6` `ipv4_only` `ipv6_only`.
+
+If set, the requested domain name will be resolved to IP before routing.
+
+If `sniff_override_destination` is in effect, its value will be taken as a fallback.
+
+#### proxy_protocol
+
+Parse [Proxy Protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) in the connection header.