Bump version

The TTL computation and assignment loops treat OPT record's Hdr.Ttl
as a regular TTL, but per RFC 6891 it encodes EDNS0 metadata
(ExtRCode|Version|Flags). This corrupts cached responses causing
systemd-resolved to reject them with EDNS version 255.

Also fix pointer aliasing: storeCache() stored raw *dns.Msg pointer
so subsequent mutations by Exchange() corrupted cached data.

- Skip OPT records in all TTL loops (Exchange + loadResponse)
- Use message.Copy() in storeCache() to isolate cache from mutations

.github/CRONET_GO_VERSION

@@ -1 +1 @@
-ea7cd33752aed62603775af3df946c1b83f4b0b3
+2fef65f9dba90ddb89a87d00a6eb6165487c10c1

adapter/certificate/adapter.go

@@ -1,21 +0,0 @@
-package certificate
-
-type Adapter struct {
-	providerType string
-	providerTag  string
-}
-
-func NewAdapter(providerType string, providerTag string) Adapter {
-	return Adapter{
-		providerType: providerType,
-		providerTag:  providerTag,
-	}
-}
-
-func (a *Adapter) Type() string {
-	return a.providerType
-}
-
-func (a *Adapter) Tag() string {
-	return a.providerTag
-}

adapter/certificate/manager.go

@@ -1,158 +0,0 @@
-package certificate
-
-import (
-	"context"
-	"os"
-	"sync"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/taskmonitor"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-)
-
-var _ adapter.CertificateProviderManager = (*Manager)(nil)
-
-type Manager struct {
-	logger        log.ContextLogger
-	registry      adapter.CertificateProviderRegistry
-	access        sync.Mutex
-	started       bool
-	stage         adapter.StartStage
-	providers     []adapter.CertificateProviderService
-	providerByTag map[string]adapter.CertificateProviderService
-}
-
-func NewManager(logger log.ContextLogger, registry adapter.CertificateProviderRegistry) *Manager {
-	return &Manager{
-		logger:        logger,
-		registry:      registry,
-		providerByTag: make(map[string]adapter.CertificateProviderService),
-	}
-}
-
-func (m *Manager) Start(stage adapter.StartStage) error {
-	m.access.Lock()
-	if m.started && m.stage >= stage {
-		panic("already started")
-	}
-	m.started = true
-	m.stage = stage
-	providers := m.providers
-	m.access.Unlock()
-	for _, provider := range providers {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		m.logger.Trace(stage, " ", name)
-		startTime := time.Now()
-		err := adapter.LegacyStart(provider, stage)
-		if err != nil {
-			return E.Cause(err, stage, " ", name)
-		}
-		m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
-	return nil
-}
-
-func (m *Manager) Close() error {
-	m.access.Lock()
-	defer m.access.Unlock()
-	if !m.started {
-		return nil
-	}
-	m.started = false
-	providers := m.providers
-	m.providers = nil
-	monitor := taskmonitor.New(m.logger, C.StopTimeout)
-	var err error
-	for _, provider := range providers {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		m.logger.Trace("close ", name)
-		startTime := time.Now()
-		monitor.Start("close ", name)
-		err = E.Append(err, provider.Close(), func(err error) error {
-			return E.Cause(err, "close ", name)
-		})
-		monitor.Finish()
-		m.logger.Trace("close ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-	}
-	return err
-}
-
-func (m *Manager) CertificateProviders() []adapter.CertificateProviderService {
-	m.access.Lock()
-	defer m.access.Unlock()
-	return m.providers
-}
-
-func (m *Manager) Get(tag string) (adapter.CertificateProviderService, bool) {
-	m.access.Lock()
-	provider, found := m.providerByTag[tag]
-	m.access.Unlock()
-	return provider, found
-}
-
-func (m *Manager) Remove(tag string) error {
-	m.access.Lock()
-	provider, found := m.providerByTag[tag]
-	if !found {
-		m.access.Unlock()
-		return os.ErrInvalid
-	}
-	delete(m.providerByTag, tag)
-	index := common.Index(m.providers, func(it adapter.CertificateProviderService) bool {
-		return it == provider
-	})
-	if index == -1 {
-		panic("invalid certificate provider index")
-	}
-	m.providers = append(m.providers[:index], m.providers[index+1:]...)
-	started := m.started
-	m.access.Unlock()
-	if started {
-		return provider.Close()
-	}
-	return nil
-}
-
-func (m *Manager) Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) error {
-	provider, err := m.registry.Create(ctx, logger, tag, providerType, options)
-	if err != nil {
-		return err
-	}
-	m.access.Lock()
-	defer m.access.Unlock()
-	if m.started {
-		name := "certificate-provider/" + provider.Type() + "[" + provider.Tag() + "]"
-		for _, stage := range adapter.ListStartStages {
-			m.logger.Trace(stage, " ", name)
-			startTime := time.Now()
-			err = adapter.LegacyStart(provider, stage)
-			if err != nil {
-				return E.Cause(err, stage, " ", name)
-			}
-			m.logger.Trace(stage, " ", name, " completed (", F.Seconds(time.Since(startTime).Seconds()), "s)")
-		}
-	}
-	if existsProvider, loaded := m.providerByTag[tag]; loaded {
-		if m.started {
-			err = existsProvider.Close()
-			if err != nil {
-				return E.Cause(err, "close certificate-provider/", existsProvider.Type(), "[", existsProvider.Tag(), "]")
-			}
-		}
-		existsIndex := common.Index(m.providers, func(it adapter.CertificateProviderService) bool {
-			return it == existsProvider
-		})
-		if existsIndex == -1 {
-			panic("invalid certificate provider index")
-		}
-		m.providers = append(m.providers[:existsIndex], m.providers[existsIndex+1:]...)
-	}
-	m.providers = append(m.providers, provider)
-	m.providerByTag[tag] = provider
-	return nil
-}

adapter/certificate/registry.go

@@ -1,72 +0,0 @@
-package certificate
-
-import (
-	"context"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type ConstructorFunc[T any] func(ctx context.Context, logger log.ContextLogger, tag string, options T) (adapter.CertificateProviderService, error)
-
-func Register[Options any](registry *Registry, providerType string, constructor ConstructorFunc[Options]) {
-	registry.register(providerType, func() any {
-		return new(Options)
-	}, func(ctx context.Context, logger log.ContextLogger, tag string, rawOptions any) (adapter.CertificateProviderService, error) {
-		var options *Options
-		if rawOptions != nil {
-			options = rawOptions.(*Options)
-		}
-		return constructor(ctx, logger, tag, common.PtrValueOrDefault(options))
-	})
-}
-
-var _ adapter.CertificateProviderRegistry = (*Registry)(nil)
-
-type (
-	optionsConstructorFunc func() any
-	constructorFunc        func(ctx context.Context, logger log.ContextLogger, tag string, options any) (adapter.CertificateProviderService, error)
-)
-
-type Registry struct {
-	access      sync.Mutex
-	optionsType map[string]optionsConstructorFunc
-	constructor map[string]constructorFunc
-}
-
-func NewRegistry() *Registry {
-	return &Registry{
-		optionsType: make(map[string]optionsConstructorFunc),
-		constructor: make(map[string]constructorFunc),
-	}
-}
-
-func (m *Registry) CreateOptions(providerType string) (any, bool) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	optionsConstructor, loaded := m.optionsType[providerType]
-	if !loaded {
-		return nil, false
-	}
-	return optionsConstructor(), true
-}
-
-func (m *Registry) Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) (adapter.CertificateProviderService, error) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	constructor, loaded := m.constructor[providerType]
-	if !loaded {
-		return nil, E.New("certificate provider type not found: " + providerType)
-	}
-	return constructor(ctx, logger, tag, options)
-}
-
-func (m *Registry) register(providerType string, optionsConstructor optionsConstructorFunc, constructor constructorFunc) {
-	m.access.Lock()
-	defer m.access.Unlock()
-	m.optionsType[providerType] = optionsConstructor
-	m.constructor[providerType] = constructor
-}

adapter/certificate_provider.go

@@ -1,38 +0,0 @@
-package adapter
-
-import (
-	"context"
-	"crypto/tls"
-
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-)
-
-type CertificateProvider interface {
-	GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
-}
-
-type ACMECertificateProvider interface {
-	CertificateProvider
-	GetACMENextProtos() []string
-}
-
-type CertificateProviderService interface {
-	Lifecycle
-	Type() string
-	Tag() string
-	CertificateProvider
-}
-
-type CertificateProviderRegistry interface {
-	option.CertificateProviderOptionsRegistry
-	Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) (CertificateProviderService, error)
-}
-
-type CertificateProviderManager interface {
-	Lifecycle
-	CertificateProviders() []CertificateProviderService
-	Get(tag string) (CertificateProviderService, bool)
-	Remove(tag string) error
-	Create(ctx context.Context, logger log.ContextLogger, tag string, providerType string, options any) error
-}

adapter/inbound.go

@@ -2,7 +2,6 @@ package adapter
 
 import (
 	"context"
-	"net"
 	"net/netip"
 	"time"
 
@@ -83,8 +82,6 @@ type InboundContext struct {
 	SourceGeoIPCode      string
 	GeoIPCode            string
 	ProcessInfo          *ConnectionOwner
-	SourceMACAddress     net.HardwareAddr
-	SourceHostname       string
 	QueryType            uint16
 	FakeIP               bool
 

adapter/neighbor.go

@@ -1,23 +0,0 @@
-package adapter
-
-import (
-	"net"
-	"net/netip"
-)
-
-type NeighborEntry struct {
-	Address    netip.Addr
-	MACAddress net.HardwareAddr
-	Hostname   string
-}
-
-type NeighborResolver interface {
-	LookupMAC(address netip.Addr) (net.HardwareAddr, bool)
-	LookupHostname(address netip.Addr) (string, bool)
-	Start() error
-	Close() error
-}
-
-type NeighborUpdateListener interface {
-	UpdateNeighborTable(entries []NeighborEntry)
-}

adapter/platform.go

@@ -36,10 +36,6 @@ type PlatformInterface interface {
 
 	UsePlatformNotification() bool
 	SendNotification(notification *Notification) error
-
-	UsePlatformNeighborResolver() bool
-	StartNeighborMonitor(listener NeighborUpdateListener) error
-	CloseNeighborMonitor(listener NeighborUpdateListener) error
 }
 
 type FindConnectionOwnerRequest struct {

adapter/router.go

@@ -26,8 +26,6 @@ type Router interface {
 	RuleSet(tag string) (RuleSet, bool)
 	Rules() []Rule
 	NeedFindProcess() bool
-	NeedFindNeighbor() bool
-	NeighborResolver() NeighborResolver
 	AppendTracker(tracker ConnectionTracker)
 	ResetNetwork()
 }

box.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
-	boxCertificate "github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/inbound"
 	"github.com/sagernet/sing-box/adapter/outbound"
@@ -20,7 +19,6 @@ import (
 	"github.com/sagernet/sing-box/common/tls"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/dns/transport/local"
 	"github.com/sagernet/sing-box/experimental"
 	"github.com/sagernet/sing-box/experimental/cachefile"
 	"github.com/sagernet/sing-box/log"
@@ -38,21 +36,20 @@ import (
 var _ adapter.SimpleLifecycle = (*Box)(nil)
 
 type Box struct {
-	createdAt           time.Time
-	logFactory          log.Factory
-	logger              log.ContextLogger
-	network             *route.NetworkManager
-	endpoint            *endpoint.Manager
-	inbound             *inbound.Manager
-	outbound            *outbound.Manager
-	service             *boxService.Manager
-	certificateProvider *boxCertificate.Manager
-	dnsTransport        *dns.TransportManager
-	dnsRouter           *dns.Router
-	connection          *route.ConnectionManager
-	router              *route.Router
-	internalService     []adapter.LifecycleService
-	done                chan struct{}
+	createdAt       time.Time
+	logFactory      log.Factory
+	logger          log.ContextLogger
+	network         *route.NetworkManager
+	endpoint        *endpoint.Manager
+	inbound         *inbound.Manager
+	outbound        *outbound.Manager
+	service         *boxService.Manager
+	dnsTransport    *dns.TransportManager
+	dnsRouter       *dns.Router
+	connection      *route.ConnectionManager
+	router          *route.Router
+	internalService []adapter.LifecycleService
+	done            chan struct{}
 }
 
 type Options struct {
@@ -68,7 +65,6 @@ func Context(
 	endpointRegistry adapter.EndpointRegistry,
 	dnsTransportRegistry adapter.DNSTransportRegistry,
 	serviceRegistry adapter.ServiceRegistry,
-	certificateProviderRegistry adapter.CertificateProviderRegistry,
 ) context.Context {
 	if service.FromContext[option.InboundOptionsRegistry](ctx) == nil ||
 		service.FromContext[adapter.InboundRegistry](ctx) == nil {
@@ -93,10 +89,6 @@ func Context(
 		ctx = service.ContextWith[option.ServiceOptionsRegistry](ctx, serviceRegistry)
 		ctx = service.ContextWith[adapter.ServiceRegistry](ctx, serviceRegistry)
 	}
-	if service.FromContext[adapter.CertificateProviderRegistry](ctx) == nil {
-		ctx = service.ContextWith[option.CertificateProviderOptionsRegistry](ctx, certificateProviderRegistry)
-		ctx = service.ContextWith[adapter.CertificateProviderRegistry](ctx, certificateProviderRegistry)
-	}
 	return ctx
 }
 
@@ -113,7 +105,6 @@ func New(options Options) (*Box, error) {
 	outboundRegistry := service.FromContext[adapter.OutboundRegistry](ctx)
 	dnsTransportRegistry := service.FromContext[adapter.DNSTransportRegistry](ctx)
 	serviceRegistry := service.FromContext[adapter.ServiceRegistry](ctx)
-	certificateProviderRegistry := service.FromContext[adapter.CertificateProviderRegistry](ctx)
 
 	if endpointRegistry == nil {
 		return nil, E.New("missing endpoint registry in context")
@@ -130,9 +121,6 @@ func New(options Options) (*Box, error) {
 	if serviceRegistry == nil {
 		return nil, E.New("missing service registry in context")
 	}
-	if certificateProviderRegistry == nil {
-		return nil, E.New("missing certificate provider registry in context")
-	}
 
 	ctx = pause.WithDefaultManager(ctx)
 	experimentalOptions := common.PtrValueOrDefault(options.Experimental)
@@ -190,13 +178,11 @@ func New(options Options) (*Box, error) {
 	outboundManager := outbound.NewManager(logFactory.NewLogger("outbound"), outboundRegistry, endpointManager, routeOptions.Final)
 	dnsTransportManager := dns.NewTransportManager(logFactory.NewLogger("dns/transport"), dnsTransportRegistry, outboundManager, dnsOptions.Final)
 	serviceManager := boxService.NewManager(logFactory.NewLogger("service"), serviceRegistry)
-	certificateProviderManager := boxCertificate.NewManager(logFactory.NewLogger("certificate-provider"), certificateProviderRegistry)
 	service.MustRegister[adapter.EndpointManager](ctx, endpointManager)
 	service.MustRegister[adapter.InboundManager](ctx, inboundManager)
 	service.MustRegister[adapter.OutboundManager](ctx, outboundManager)
 	service.MustRegister[adapter.DNSTransportManager](ctx, dnsTransportManager)
 	service.MustRegister[adapter.ServiceManager](ctx, serviceManager)
-	service.MustRegister[adapter.CertificateProviderManager](ctx, certificateProviderManager)
 	dnsRouter := dns.NewRouter(ctx, logFactory, dnsOptions)
 	service.MustRegister[adapter.DNSRouter](ctx, dnsRouter)
 	networkManager, err := route.NewNetworkManager(ctx, logFactory.NewLogger("network"), routeOptions, dnsOptions)
@@ -285,24 +271,6 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize inbound[", i, "]")
 		}
 	}
-	for i, serviceOptions := range options.Services {
-		var tag string
-		if serviceOptions.Tag != "" {
-			tag = serviceOptions.Tag
-		} else {
-			tag = F.ToString(i)
-		}
-		err = serviceManager.Create(
-			ctx,
-			logFactory.NewLogger(F.ToString("service/", serviceOptions.Type, "[", tag, "]")),
-			tag,
-			serviceOptions.Type,
-			serviceOptions.Options,
-		)
-		if err != nil {
-			return nil, E.Cause(err, "initialize service[", i, "]")
-		}
-	}
 	for i, outboundOptions := range options.Outbounds {
 		var tag string
 		if outboundOptions.Tag != "" {
@@ -329,22 +297,22 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize outbound[", i, "]")
 		}
 	}
-	for i, certificateProviderOptions := range options.CertificateProviders {
+	for i, serviceOptions := range options.Services {
 		var tag string
-		if certificateProviderOptions.Tag != "" {
-			tag = certificateProviderOptions.Tag
+		if serviceOptions.Tag != "" {
+			tag = serviceOptions.Tag
 		} else {
 			tag = F.ToString(i)
 		}
-		err = certificateProviderManager.Create(
+		err = serviceManager.Create(
 			ctx,
-			logFactory.NewLogger(F.ToString("certificate-provider/", certificateProviderOptions.Type, "[", tag, "]")),
+			logFactory.NewLogger(F.ToString("service/", serviceOptions.Type, "[", tag, "]")),
 			tag,
-			certificateProviderOptions.Type,
-			certificateProviderOptions.Options,
+			serviceOptions.Type,
+			serviceOptions.Options,
 		)
 		if err != nil {
-			return nil, E.Cause(err, "initialize certificate provider[", i, "]")
+			return nil, E.Cause(err, "initialize service[", i, "]")
 		}
 	}
 	outboundManager.Initialize(func() (adapter.Outbound, error) {
@@ -357,11 +325,12 @@ func New(options Options) (*Box, error) {
 		)
 	})
 	dnsTransportManager.Initialize(func() (adapter.DNSTransport, error) {
-		return local.NewTransport(
+		return dnsTransportRegistry.CreateDNSTransport(
 			ctx,
 			logFactory.NewLogger("dns/local"),
 			"local",
-			option.LocalDNSServerOptions{},
+			C.DNSTypeLocal,
+			&option.LocalDNSServerOptions{},
 		)
 	})
 	if platformInterface != nil {
@@ -414,21 +383,20 @@ func New(options Options) (*Box, error) {
 		internalServices = append(internalServices, adapter.NewLifecycleService(ntpService, "ntp service"))
 	}
 	return &Box{
-		network:             networkManager,
-		endpoint:            endpointManager,
-		inbound:             inboundManager,
-		outbound:            outboundManager,
-		dnsTransport:        dnsTransportManager,
-		service:             serviceManager,
-		certificateProvider: certificateProviderManager,
-		dnsRouter:           dnsRouter,
-		connection:          connectionManager,
-		router:              router,
-		createdAt:           createdAt,
-		logFactory:          logFactory,
-		logger:              logFactory.Logger(),
-		internalService:     internalServices,
-		done:                make(chan struct{}),
+		network:         networkManager,
+		endpoint:        endpointManager,
+		inbound:         inboundManager,
+		outbound:        outboundManager,
+		dnsTransport:    dnsTransportManager,
+		service:         serviceManager,
+		dnsRouter:       dnsRouter,
+		connection:      connectionManager,
+		router:          router,
+		createdAt:       createdAt,
+		logFactory:      logFactory,
+		logger:          logFactory.Logger(),
+		internalService: internalServices,
+		done:            make(chan struct{}),
 	}, nil
 }
 
@@ -482,7 +450,7 @@ func (s *Box) preStart() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateInitialize, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service, s.certificateProvider)
+	err = adapter.Start(s.logger, adapter.StartStateInitialize, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
@@ -502,19 +470,11 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.endpoint)
+	err = adapter.Start(s.logger, adapter.StartStateStart, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.certificateProvider)
-	if err != nil {
-		return err
-	}
-	err = adapter.Start(s.logger, adapter.StartStateStart, s.inbound, s.service)
-	if err != nil {
-		return err
-	}
-	err = adapter.Start(s.logger, adapter.StartStatePostStart, s.outbound, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.endpoint, s.certificateProvider, s.inbound, s.service)
+	err = adapter.Start(s.logger, adapter.StartStatePostStart, s.outbound, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
@@ -522,7 +482,7 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(s.logger, adapter.StartStateStarted, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.endpoint, s.certificateProvider, s.inbound, s.service)
+	err = adapter.Start(s.logger, adapter.StartStateStarted, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint, s.service)
 	if err != nil {
 		return err
 	}
@@ -546,9 +506,8 @@ func (s *Box) Close() error {
 		service adapter.Lifecycle
 	}{
 		{"service", s.service},
-		{"inbound", s.inbound},
-		{"certificate-provider", s.certificateProvider},
 		{"endpoint", s.endpoint},
+		{"inbound", s.inbound},
 		{"outbound", s.outbound},
 		{"router", s.router},
 		{"connection", s.connection},
@@ -596,6 +555,10 @@ func (s *Box) Outbound() adapter.OutboundManager {
 	return s.outbound
 }
 
+func (s *Box) Endpoint() adapter.EndpointManager {
+	return s.endpoint
+}
+
 func (s *Box) LogFactory() log.Factory {
 	return s.logFactory
 }

common/dialer/default.go

@@ -149,7 +149,10 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 	} else {
 		dialer.Timeout = C.TCPConnectTimeout
 	}
-	if !options.DisableTCPKeepAlive {
+	if options.DisableTCPKeepAlive {
+		dialer.KeepAlive = -1
+		dialer.KeepAliveConfig.Enable = false
+	} else {
 		keepIdle := time.Duration(options.TCPKeepAlive)
 		if keepIdle == 0 {
 			keepIdle = C.TCPKeepAliveInitial

common/listener/listener_tcp.go

@@ -37,7 +37,10 @@ func (l *Listener) ListenTCP() (net.Listener, error) {
 	if l.listenOptions.ReuseAddr {
 		listenConfig.Control = control.Append(listenConfig.Control, control.ReuseAddr())
 	}
-	if !l.listenOptions.DisableTCPKeepAlive {
+	if l.listenOptions.DisableTCPKeepAlive {
+		listenConfig.KeepAlive = -1
+		listenConfig.KeepAliveConfig.Enable = false
+	} else {
 		keepIdle := time.Duration(l.listenOptions.TCPKeepAlive)
 		if keepIdle == 0 {
 			keepIdle = C.TCPKeepAliveInitial

common/tls/acme.go

@@ -38,6 +38,37 @@ func (w *acmeWrapper) Close() error {
 	return nil
 }
 
+type acmeLogWriter struct {
+	logger logger.Logger
+}
+
+func (w *acmeLogWriter) Write(p []byte) (n int, err error) {
+	logLine := strings.ReplaceAll(string(p), "	", ": ")
+	switch {
+	case strings.HasPrefix(logLine, "error: "):
+		w.logger.Error(logLine[7:])
+	case strings.HasPrefix(logLine, "warn: "):
+		w.logger.Warn(logLine[6:])
+	case strings.HasPrefix(logLine, "info: "):
+		w.logger.Info(logLine[6:])
+	case strings.HasPrefix(logLine, "debug: "):
+		w.logger.Debug(logLine[7:])
+	default:
+		w.logger.Debug(logLine)
+	}
+	return len(p), nil
+}
+
+func (w *acmeLogWriter) Sync() error {
+	return nil
+}
+
+func encoderConfig() zapcore.EncoderConfig {
+	config := zap.NewProductionEncoderConfig()
+	config.TimeKey = zapcore.OmitKey
+	return config
+}
+
 func startACME(ctx context.Context, logger logger.Logger, options option.InboundACMEOptions) (*tls.Config, adapter.SimpleLifecycle, error) {
 	var acmeServer string
 	switch options.Provider {
@@ -60,8 +91,8 @@ func startACME(ctx context.Context, logger logger.Logger, options option.Inbound
 		storage = certmagic.Default.Storage
 	}
 	zapLogger := zap.New(zapcore.NewCore(
-		zapcore.NewConsoleEncoder(ACMEEncoderConfig()),
-		&ACMELogWriter{Logger: logger},
+		zapcore.NewConsoleEncoder(encoderConfig()),
+		&acmeLogWriter{logger: logger},
 		zap.DebugLevel,
 	))
 	config := &certmagic.Config{
@@ -127,7 +158,7 @@ func startACME(ctx context.Context, logger logger.Logger, options option.Inbound
 	} else {
 		tlsConfig = &tls.Config{
 			GetCertificate: config.GetCertificate,
-			NextProtos:     []string{C.ACMETLS1Protocol},
+			NextProtos:     []string{ACMETLS1Protocol},
 		}
 	}
 	return tlsConfig, &acmeWrapper{ctx: ctx, cfg: config, cache: cache, domain: options.Domain}, nil

common/tls/acme_contstant.go

@@ -1,3 +1,3 @@
-package constant
+package tls
 
 const ACMETLS1Protocol = "acme-tls/1"

common/tls/acme_logger.go

@@ -1,41 +0,0 @@
-package tls
-
-import (
-	"strings"
-
-	"github.com/sagernet/sing/common/logger"
-
-	"go.uber.org/zap"
-	"go.uber.org/zap/zapcore"
-)
-
-type ACMELogWriter struct {
-	Logger logger.Logger
-}
-
-func (w *ACMELogWriter) Write(p []byte) (n int, err error) {
-	logLine := strings.ReplaceAll(string(p), "	", ": ")
-	switch {
-	case strings.HasPrefix(logLine, "error: "):
-		w.Logger.Error(logLine[7:])
-	case strings.HasPrefix(logLine, "warn: "):
-		w.Logger.Warn(logLine[6:])
-	case strings.HasPrefix(logLine, "info: "):
-		w.Logger.Info(logLine[6:])
-	case strings.HasPrefix(logLine, "debug: "):
-		w.Logger.Debug(logLine[7:])
-	default:
-		w.Logger.Debug(logLine)
-	}
-	return len(p), nil
-}
-
-func (w *ACMELogWriter) Sync() error {
-	return nil
-}
-
-func ACMEEncoderConfig() zapcore.EncoderConfig {
-	config := zap.NewProductionEncoderConfig()
-	config.TimeKey = zapcore.OmitKey
-	return config
-}

common/tls/reality_server.go

@@ -32,10 +32,6 @@ type RealityServerConfig struct {
 func NewRealityServer(ctx context.Context, logger log.ContextLogger, options option.InboundTLSOptions) (ServerConfig, error) {
 	var tlsConfig utls.RealityConfig
 
-	if options.CertificateProvider != nil {
-		return nil, E.New("certificate_provider is unavailable in reality")
-	}
-	//nolint:staticcheck
 	if options.ACME != nil && len(options.ACME.Domain) > 0 {
 		return nil, E.New("acme is unavailable in reality")
 	}

common/tls/std_server.go

@@ -13,87 +13,19 @@ import (
 	"github.com/sagernet/fswatch"
 	"github.com/sagernet/sing-box/adapter"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/ntp"
-	"github.com/sagernet/sing/service"
 )
 
 var errInsecureUnused = E.New("tls: insecure unused")
 
-type managedCertificateProvider interface {
-	adapter.CertificateProvider
-	adapter.SimpleLifecycle
-}
-
-type sharedCertificateProvider struct {
-	tag      string
-	manager  adapter.CertificateProviderManager
-	provider adapter.CertificateProviderService
-}
-
-func (p *sharedCertificateProvider) Start() error {
-	provider, found := p.manager.Get(p.tag)
-	if !found {
-		return E.New("certificate provider not found: ", p.tag)
-	}
-	p.provider = provider
-	return nil
-}
-
-func (p *sharedCertificateProvider) Close() error {
-	return nil
-}
-
-func (p *sharedCertificateProvider) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	return p.provider.GetCertificate(hello)
-}
-
-func (p *sharedCertificateProvider) GetACMENextProtos() []string {
-	return getACMENextProtos(p.provider)
-}
-
-type inlineCertificateProvider struct {
-	provider adapter.CertificateProviderService
-}
-
-func (p *inlineCertificateProvider) Start() error {
-	for _, stage := range adapter.ListStartStages {
-		err := adapter.LegacyStart(p.provider, stage)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (p *inlineCertificateProvider) Close() error {
-	return p.provider.Close()
-}
-
-func (p *inlineCertificateProvider) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	return p.provider.GetCertificate(hello)
-}
-
-func (p *inlineCertificateProvider) GetACMENextProtos() []string {
-	return getACMENextProtos(p.provider)
-}
-
-func getACMENextProtos(provider adapter.CertificateProvider) []string {
-	if acmeProvider, isACME := provider.(adapter.ACMECertificateProvider); isACME {
-		return acmeProvider.GetACMENextProtos()
-	}
-	return nil
-}
-
 type STDServerConfig struct {
 	access                sync.RWMutex
 	config                *tls.Config
 	logger                log.Logger
-	certificateProvider   managedCertificateProvider
 	acmeService           adapter.SimpleLifecycle
 	certificate           []byte
 	key                   []byte
@@ -121,17 +53,18 @@ func (c *STDServerConfig) SetServerName(serverName string) {
 func (c *STDServerConfig) NextProtos() []string {
 	c.access.RLock()
 	defer c.access.RUnlock()
-	if c.hasACMEALPN() && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == C.ACMETLS1Protocol {
+	if c.acmeService != nil && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == ACMETLS1Protocol {
 		return c.config.NextProtos[1:]
+	} else {
+		return c.config.NextProtos
 	}
-	return c.config.NextProtos
 }
 
 func (c *STDServerConfig) SetNextProtos(nextProto []string) {
 	c.access.Lock()
 	defer c.access.Unlock()
 	config := c.config.Clone()
-	if c.hasACMEALPN() && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == C.ACMETLS1Protocol {
+	if c.acmeService != nil && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == ACMETLS1Protocol {
 		config.NextProtos = append(c.config.NextProtos[:1], nextProto...)
 	} else {
 		config.NextProtos = nextProto
@@ -139,18 +72,6 @@ func (c *STDServerConfig) SetNextProtos(nextProto []string) {
 	c.config = config
 }
 
-func (c *STDServerConfig) hasACMEALPN() bool {
-	if c.acmeService != nil {
-		return true
-	}
-	if c.certificateProvider != nil {
-		if acmeProvider, isACME := c.certificateProvider.(adapter.ACMECertificateProvider); isACME {
-			return len(acmeProvider.GetACMENextProtos()) > 0
-		}
-	}
-	return false
-}
-
 func (c *STDServerConfig) STDConfig() (*STDConfig, error) {
 	return c.config, nil
 }
@@ -170,39 +91,15 @@ func (c *STDServerConfig) Clone() Config {
 }
 
 func (c *STDServerConfig) Start() error {
-	if c.certificateProvider != nil {
-		err := c.certificateProvider.Start()
-		if err != nil {
-			return err
-		}
-		if acmeProvider, isACME := c.certificateProvider.(adapter.ACMECertificateProvider); isACME {
-			nextProtos := acmeProvider.GetACMENextProtos()
-			if len(nextProtos) > 0 {
-				c.access.Lock()
-				config := c.config.Clone()
-				mergedNextProtos := append([]string{}, nextProtos...)
-				for _, nextProto := range config.NextProtos {
-					if !common.Contains(mergedNextProtos, nextProto) {
-						mergedNextProtos = append(mergedNextProtos, nextProto)
-					}
-				}
-				config.NextProtos = mergedNextProtos
-				c.config = config
-				c.access.Unlock()
-			}
-		}
-	}
 	if c.acmeService != nil {
-		err := c.acmeService.Start()
+		return c.acmeService.Start()
+	} else {
+		err := c.startWatcher()
 		if err != nil {
-			return err
+			c.logger.Warn("create fsnotify watcher: ", err)
 		}
+		return nil
 	}
-	err := c.startWatcher()
-	if err != nil {
-		c.logger.Warn("create fsnotify watcher: ", err)
-	}
-	return nil
 }
 
 func (c *STDServerConfig) startWatcher() error {
@@ -306,34 +203,23 @@ func (c *STDServerConfig) certificateUpdated(path string) error {
 }
 
 func (c *STDServerConfig) Close() error {
-	return common.Close(c.certificateProvider, c.acmeService, c.watcher)
+	if c.acmeService != nil {
+		return c.acmeService.Close()
+	}
+	if c.watcher != nil {
+		return c.watcher.Close()
+	}
+	return nil
 }
 
 func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.InboundTLSOptions) (ServerConfig, error) {
 	if !options.Enabled {
 		return nil, nil
 	}
-	//nolint:staticcheck
-	if options.CertificateProvider != nil && options.ACME != nil {
-		return nil, E.New("certificate_provider and acme are mutually exclusive")
-	}
 	var tlsConfig *tls.Config
-	var certificateProvider managedCertificateProvider
 	var acmeService adapter.SimpleLifecycle
 	var err error
-	if options.CertificateProvider != nil {
-		certificateProvider, err = newCertificateProvider(ctx, logger, options.CertificateProvider)
-		if err != nil {
-			return nil, err
-		}
-		tlsConfig = &tls.Config{
-			GetCertificate: certificateProvider.GetCertificate,
-		}
-		if options.Insecure {
-			return nil, errInsecureUnused
-		}
-	} else if options.ACME != nil && len(options.ACME.Domain) > 0 { //nolint:staticcheck
-		deprecated.Report(ctx, deprecated.OptionInlineACME)
+	if options.ACME != nil && len(options.ACME.Domain) > 0 {
 		//nolint:staticcheck
 		tlsConfig, acmeService, err = startACME(ctx, logger, common.PtrValueOrDefault(options.ACME))
 		if err != nil {
@@ -386,7 +272,7 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
 		certificate []byte
 		key         []byte
 	)
-	if certificateProvider == nil && acmeService == nil {
+	if acmeService == nil {
 		if len(options.Certificate) > 0 {
 			certificate = []byte(strings.Join(options.Certificate, "\n"))
 		} else if options.CertificatePath != "" {
@@ -474,7 +360,6 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
 	serverConfig := &STDServerConfig{
 		config:                tlsConfig,
 		logger:                logger,
-		certificateProvider:   certificateProvider,
 		acmeService:           acmeService,
 		certificate:           certificate,
 		key:                   key,
@@ -484,8 +369,8 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
 		echKeyPath:            echKeyPath,
 	}
 	serverConfig.config.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) {
-		serverConfig.access.RLock()
-		defer serverConfig.access.RUnlock()
+		serverConfig.access.Lock()
+		defer serverConfig.access.Unlock()
 		return serverConfig.config, nil
 	}
 	var config ServerConfig = serverConfig
@@ -502,27 +387,3 @@ func NewSTDServer(ctx context.Context, logger log.ContextLogger, options option.
 	}
 	return config, nil
 }
-
-func newCertificateProvider(ctx context.Context, logger log.ContextLogger, options *option.CertificateProviderOptions) (managedCertificateProvider, error) {
-	if options.IsShared() {
-		manager := service.FromContext[adapter.CertificateProviderManager](ctx)
-		if manager == nil {
-			return nil, E.New("missing certificate provider manager in context")
-		}
-		return &sharedCertificateProvider{
-			tag:     options.Tag,
-			manager: manager,
-		}, nil
-	}
-	registry := service.FromContext[adapter.CertificateProviderRegistry](ctx)
-	if registry == nil {
-		return nil, E.New("missing certificate provider registry in context")
-	}
-	provider, err := registry.Create(ctx, logger, "", options.Type, options.Options)
-	if err != nil {
-		return nil, E.Cause(err, "create inline certificate provider")
-	}
-	return &inlineCertificateProvider{
-		provider: provider,
-	}, nil
-}

constant/proxy.go

@@ -1,38 +1,36 @@
 package constant
 
 const (
-	TypeTun                = "tun"
-	TypeRedirect           = "redirect"
-	TypeTProxy             = "tproxy"
-	TypeDirect             = "direct"
-	TypeBlock              = "block"
-	TypeDNS                = "dns"
-	TypeSOCKS              = "socks"
-	TypeHTTP               = "http"
-	TypeMixed              = "mixed"
-	TypeShadowsocks        = "shadowsocks"
-	TypeVMess              = "vmess"
-	TypeTrojan             = "trojan"
-	TypeNaive              = "naive"
-	TypeWireGuard          = "wireguard"
-	TypeHysteria           = "hysteria"
-	TypeTor                = "tor"
-	TypeSSH                = "ssh"
-	TypeShadowTLS          = "shadowtls"
-	TypeAnyTLS             = "anytls"
-	TypeShadowsocksR       = "shadowsocksr"
-	TypeVLESS              = "vless"
-	TypeTUIC               = "tuic"
-	TypeHysteria2          = "hysteria2"
-	TypeTailscale          = "tailscale"
-	TypeDERP               = "derp"
-	TypeResolved           = "resolved"
-	TypeSSMAPI             = "ssm-api"
-	TypeCCM                = "ccm"
-	TypeOCM                = "ocm"
-	TypeOOMKiller          = "oom-killer"
-	TypeACME               = "acme"
-	TypeCloudflareOriginCA = "cloudflare-origin-ca"
+	TypeTun          = "tun"
+	TypeRedirect     = "redirect"
+	TypeTProxy       = "tproxy"
+	TypeDirect       = "direct"
+	TypeBlock        = "block"
+	TypeDNS          = "dns"
+	TypeSOCKS        = "socks"
+	TypeHTTP         = "http"
+	TypeMixed        = "mixed"
+	TypeShadowsocks  = "shadowsocks"
+	TypeVMess        = "vmess"
+	TypeTrojan       = "trojan"
+	TypeNaive        = "naive"
+	TypeWireGuard    = "wireguard"
+	TypeHysteria     = "hysteria"
+	TypeTor          = "tor"
+	TypeSSH          = "ssh"
+	TypeShadowTLS    = "shadowtls"
+	TypeAnyTLS       = "anytls"
+	TypeShadowsocksR = "shadowsocksr"
+	TypeVLESS        = "vless"
+	TypeTUIC         = "tuic"
+	TypeHysteria2    = "hysteria2"
+	TypeTailscale    = "tailscale"
+	TypeDERP         = "derp"
+	TypeResolved     = "resolved"
+	TypeSSMAPI       = "ssm-api"
+	TypeCCM          = "ccm"
+	TypeOCM          = "ocm"
+	TypeOOMKiller    = "oom-killer"
 )
 
 const (

daemon/instance.go

@@ -87,17 +87,12 @@ func (s *StartedService) newInstance(profileContent string, overrideOptions *Ove
 			}
 		}
 	}
-	if s.oomKillerEnabled {
+	if s.oomKiller && C.IsIos {
 		if !common.Any(options.Services, func(it option.Service) bool {
 			return it.Type == C.TypeOOMKiller
 		}) {
-			oomOptions := &option.OOMKillerServiceOptions{
-				KillerDisabled:      s.oomKillerDisabled,
-				MemoryLimitOverride: s.oomMemoryLimit,
-			}
 			options.Services = append(options.Services, option.Service{
-				Type:    C.TypeOOMKiller,
-				Options: oomOptions,
+				Type: C.TypeOOMKiller,
 			})
 		}
 	}

daemon/platform.go

@@ -5,6 +5,5 @@ type PlatformHandler interface {
 	ServiceReload() error
 	SystemProxyStatus() (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(enabled bool) error
-	TriggerNativeCrash() error
 	WriteDebugMessage(message string)
 }

daemon/started_service.go

@@ -14,7 +14,6 @@ import (
 	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/protocol/group"
-	"github.com/sagernet/sing-box/service/oomkiller"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/batch"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -25,8 +24,6 @@ import (
 
 	"github.com/gofrs/uuid/v5"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
@@ -35,12 +32,10 @@ var _ StartedServiceServer = (*StartedService)(nil)
 type StartedService struct {
 	ctx context.Context
 	// platform adapter.PlatformInterface
-	handler           PlatformHandler
-	debug             bool
-	logMaxLines       int
-	oomKillerEnabled  bool
-	oomKillerDisabled bool
-	oomMemoryLimit    uint64
+	handler     PlatformHandler
+	debug       bool
+	logMaxLines int
+	oomKiller   bool
 	// workingDirectory string
 	// tempDirectory    string
 	// userID           int
@@ -69,12 +64,10 @@ type StartedService struct {
 type ServiceOptions struct {
 	Context context.Context
 	// Platform           adapter.PlatformInterface
-	Handler           PlatformHandler
-	Debug             bool
-	LogMaxLines       int
-	OOMKillerEnabled  bool
-	OOMKillerDisabled bool
-	OOMMemoryLimit    uint64
+	Handler     PlatformHandler
+	Debug       bool
+	LogMaxLines int
+	OOMKiller   bool
 	// WorkingDirectory   string
 	// TempDirectory      string
 	// UserID             int
@@ -86,12 +79,10 @@ func NewStartedService(options ServiceOptions) *StartedService {
 	s := &StartedService{
 		ctx: options.Context,
 		// platform:                options.Platform,
-		handler:           options.Handler,
-		debug:             options.Debug,
-		logMaxLines:       options.LogMaxLines,
-		oomKillerEnabled:  options.OOMKillerEnabled,
-		oomKillerDisabled: options.OOMKillerDisabled,
-		oomMemoryLimit:    options.OOMMemoryLimit,
+		handler:     options.Handler,
+		debug:       options.Debug,
+		logMaxLines: options.LogMaxLines,
+		oomKiller:   options.OOMKiller,
 		// workingDirectory: options.WorkingDirectory,
 		// tempDirectory:    options.TempDirectory,
 		// userID:           options.UserID,
@@ -694,41 +685,6 @@ func (s *StartedService) SetSystemProxyEnabled(ctx context.Context, request *Set
 	return nil, err
 }
 
-func (s *StartedService) TriggerDebugCrash(ctx context.Context, request *DebugCrashRequest) (*emptypb.Empty, error) {
-	if !s.debug {
-		return nil, status.Error(codes.PermissionDenied, "debug crash trigger unavailable")
-	}
-	if request == nil {
-		return nil, status.Error(codes.InvalidArgument, "missing debug crash request")
-	}
-	switch request.Type {
-	case DebugCrashRequest_GO:
-		time.AfterFunc(200*time.Millisecond, func() {
-			panic("debug go crash")
-		})
-	case DebugCrashRequest_NATIVE:
-		err := s.handler.TriggerNativeCrash()
-		if err != nil {
-			return nil, err
-		}
-	default:
-		return nil, status.Error(codes.InvalidArgument, "unknown debug crash type")
-	}
-	return &emptypb.Empty{}, nil
-}
-
-func (s *StartedService) TriggerOOMReport(ctx context.Context, _ *emptypb.Empty) (*emptypb.Empty, error) {
-	instance := s.Instance()
-	if instance == nil {
-		return nil, status.Error(codes.FailedPrecondition, "service not started")
-	}
-	reporter := service.FromContext[oomkiller.OOMReporter](instance.ctx)
-	if reporter == nil {
-		return nil, status.Error(codes.Unavailable, "OOM reporter not available")
-	}
-	return &emptypb.Empty{}, reporter.WriteReport(memory.Total())
-}
-
 func (s *StartedService) SubscribeConnections(request *SubscribeConnectionsRequest, server grpc.ServerStreamingServer[ConnectionEvents]) error {
 	err := s.waitForStarted(server.Context())
 	if err != nil {

daemon/started_service.pb.go

@@ -182,52 +182,6 @@ func (ServiceStatus_Type) EnumDescriptor() ([]byte, []int) {
 	return file_daemon_started_service_proto_rawDescGZIP(), []int{0, 0}
 }
 
-type DebugCrashRequest_Type int32
-
-const (
-	DebugCrashRequest_GO     DebugCrashRequest_Type = 0
-	DebugCrashRequest_NATIVE DebugCrashRequest_Type = 1
-)
-
-// Enum value maps for DebugCrashRequest_Type.
-var (
-	DebugCrashRequest_Type_name = map[int32]string{
-		0: "GO",
-		1: "NATIVE",
-	}
-	DebugCrashRequest_Type_value = map[string]int32{
-		"GO":     0,
-		"NATIVE": 1,
-	}
-)
-
-func (x DebugCrashRequest_Type) Enum() *DebugCrashRequest_Type {
-	p := new(DebugCrashRequest_Type)
-	*p = x
-	return p
-}
-
-func (x DebugCrashRequest_Type) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (DebugCrashRequest_Type) Descriptor() protoreflect.EnumDescriptor {
-	return file_daemon_started_service_proto_enumTypes[3].Descriptor()
-}
-
-func (DebugCrashRequest_Type) Type() protoreflect.EnumType {
-	return &file_daemon_started_service_proto_enumTypes[3]
-}
-
-func (x DebugCrashRequest_Type) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use DebugCrashRequest_Type.Descriptor instead.
-func (DebugCrashRequest_Type) EnumDescriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{16, 0}
-}
-
 type ServiceStatus struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Status        ServiceStatus_Type     `protobuf:"varint,1,opt,name=status,proto3,enum=daemon.ServiceStatus_Type" json:"status,omitempty"`
@@ -1108,50 +1062,6 @@ func (x *SetSystemProxyEnabledRequest) GetEnabled() bool {
 	return false
 }
 
-type DebugCrashRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Type          DebugCrashRequest_Type `protobuf:"varint,1,opt,name=type,proto3,enum=daemon.DebugCrashRequest_Type" json:"type,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *DebugCrashRequest) Reset() {
-	*x = DebugCrashRequest{}
-	mi := &file_daemon_started_service_proto_msgTypes[16]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *DebugCrashRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DebugCrashRequest) ProtoMessage() {}
-
-func (x *DebugCrashRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[16]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DebugCrashRequest.ProtoReflect.Descriptor instead.
-func (*DebugCrashRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{16}
-}
-
-func (x *DebugCrashRequest) GetType() DebugCrashRequest_Type {
-	if x != nil {
-		return x.Type
-	}
-	return DebugCrashRequest_GO
-}
-
 type SubscribeConnectionsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Interval      int64                  `protobuf:"varint,1,opt,name=interval,proto3" json:"interval,omitempty"`
@@ -1161,7 +1071,7 @@ type SubscribeConnectionsRequest struct {
 
 func (x *SubscribeConnectionsRequest) Reset() {
 	*x = SubscribeConnectionsRequest{}
-	mi := &file_daemon_started_service_proto_msgTypes[17]
+	mi := &file_daemon_started_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1173,7 +1083,7 @@ func (x *SubscribeConnectionsRequest) String() string {
 func (*SubscribeConnectionsRequest) ProtoMessage() {}
 
 func (x *SubscribeConnectionsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[17]
+	mi := &file_daemon_started_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1186,7 +1096,7 @@ func (x *SubscribeConnectionsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubscribeConnectionsRequest.ProtoReflect.Descriptor instead.
 func (*SubscribeConnectionsRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{17}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *SubscribeConnectionsRequest) GetInterval() int64 {
@@ -1210,7 +1120,7 @@ type ConnectionEvent struct {
 
 func (x *ConnectionEvent) Reset() {
 	*x = ConnectionEvent{}
-	mi := &file_daemon_started_service_proto_msgTypes[18]
+	mi := &file_daemon_started_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1222,7 +1132,7 @@ func (x *ConnectionEvent) String() string {
 func (*ConnectionEvent) ProtoMessage() {}
 
 func (x *ConnectionEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[18]
+	mi := &file_daemon_started_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1235,7 +1145,7 @@ func (x *ConnectionEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConnectionEvent.ProtoReflect.Descriptor instead.
 func (*ConnectionEvent) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{18}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *ConnectionEvent) GetType() ConnectionEventType {
@@ -1290,7 +1200,7 @@ type ConnectionEvents struct {
 
 func (x *ConnectionEvents) Reset() {
 	*x = ConnectionEvents{}
-	mi := &file_daemon_started_service_proto_msgTypes[19]
+	mi := &file_daemon_started_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1302,7 +1212,7 @@ func (x *ConnectionEvents) String() string {
 func (*ConnectionEvents) ProtoMessage() {}
 
 func (x *ConnectionEvents) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[19]
+	mi := &file_daemon_started_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1315,7 +1225,7 @@ func (x *ConnectionEvents) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConnectionEvents.ProtoReflect.Descriptor instead.
 func (*ConnectionEvents) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{19}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ConnectionEvents) GetEvents() []*ConnectionEvent {
@@ -1362,7 +1272,7 @@ type Connection struct {
 
 func (x *Connection) Reset() {
 	*x = Connection{}
-	mi := &file_daemon_started_service_proto_msgTypes[20]
+	mi := &file_daemon_started_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1374,7 +1284,7 @@ func (x *Connection) String() string {
 func (*Connection) ProtoMessage() {}
 
 func (x *Connection) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[20]
+	mi := &file_daemon_started_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1387,7 +1297,7 @@ func (x *Connection) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Connection.ProtoReflect.Descriptor instead.
 func (*Connection) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{20}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *Connection) GetId() string {
@@ -1557,7 +1467,7 @@ type ProcessInfo struct {
 
 func (x *ProcessInfo) Reset() {
 	*x = ProcessInfo{}
-	mi := &file_daemon_started_service_proto_msgTypes[21]
+	mi := &file_daemon_started_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1569,7 +1479,7 @@ func (x *ProcessInfo) String() string {
 func (*ProcessInfo) ProtoMessage() {}
 
 func (x *ProcessInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[21]
+	mi := &file_daemon_started_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1582,7 +1492,7 @@ func (x *ProcessInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProcessInfo.ProtoReflect.Descriptor instead.
 func (*ProcessInfo) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{21}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ProcessInfo) GetProcessId() uint32 {
@@ -1629,7 +1539,7 @@ type CloseConnectionRequest struct {
 
 func (x *CloseConnectionRequest) Reset() {
 	*x = CloseConnectionRequest{}
-	mi := &file_daemon_started_service_proto_msgTypes[22]
+	mi := &file_daemon_started_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1641,7 +1551,7 @@ func (x *CloseConnectionRequest) String() string {
 func (*CloseConnectionRequest) ProtoMessage() {}
 
 func (x *CloseConnectionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[22]
+	mi := &file_daemon_started_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1654,7 +1564,7 @@ func (x *CloseConnectionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloseConnectionRequest.ProtoReflect.Descriptor instead.
 func (*CloseConnectionRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{22}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *CloseConnectionRequest) GetId() string {
@@ -1673,7 +1583,7 @@ type DeprecatedWarnings struct {
 
 func (x *DeprecatedWarnings) Reset() {
 	*x = DeprecatedWarnings{}
-	mi := &file_daemon_started_service_proto_msgTypes[23]
+	mi := &file_daemon_started_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1685,7 +1595,7 @@ func (x *DeprecatedWarnings) String() string {
 func (*DeprecatedWarnings) ProtoMessage() {}
 
 func (x *DeprecatedWarnings) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[23]
+	mi := &file_daemon_started_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1698,7 +1608,7 @@ func (x *DeprecatedWarnings) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeprecatedWarnings.ProtoReflect.Descriptor instead.
 func (*DeprecatedWarnings) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{23}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *DeprecatedWarnings) GetWarnings() []*DeprecatedWarning {
@@ -1719,7 +1629,7 @@ type DeprecatedWarning struct {
 
 func (x *DeprecatedWarning) Reset() {
 	*x = DeprecatedWarning{}
-	mi := &file_daemon_started_service_proto_msgTypes[24]
+	mi := &file_daemon_started_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1731,7 +1641,7 @@ func (x *DeprecatedWarning) String() string {
 func (*DeprecatedWarning) ProtoMessage() {}
 
 func (x *DeprecatedWarning) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[24]
+	mi := &file_daemon_started_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1744,7 +1654,7 @@ func (x *DeprecatedWarning) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeprecatedWarning.ProtoReflect.Descriptor instead.
 func (*DeprecatedWarning) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{24}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *DeprecatedWarning) GetMessage() string {
@@ -1777,7 +1687,7 @@ type StartedAt struct {
 
 func (x *StartedAt) Reset() {
 	*x = StartedAt{}
-	mi := &file_daemon_started_service_proto_msgTypes[25]
+	mi := &file_daemon_started_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1789,7 +1699,7 @@ func (x *StartedAt) String() string {
 func (*StartedAt) ProtoMessage() {}
 
 func (x *StartedAt) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[25]
+	mi := &file_daemon_started_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1802,7 +1712,7 @@ func (x *StartedAt) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartedAt.ProtoReflect.Descriptor instead.
 func (*StartedAt) Descriptor() ([]byte, []int) {
-	return file_daemon_started_service_proto_rawDescGZIP(), []int{25}
+	return file_daemon_started_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *StartedAt) GetStartedAt() int64 {
@@ -1822,7 +1732,7 @@ type Log_Message struct {
 
 func (x *Log_Message) Reset() {
 	*x = Log_Message{}
-	mi := &file_daemon_started_service_proto_msgTypes[26]
+	mi := &file_daemon_started_service_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1834,7 +1744,7 @@ func (x *Log_Message) String() string {
 func (*Log_Message) ProtoMessage() {}
 
 func (x *Log_Message) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_started_service_proto_msgTypes[26]
+	mi := &file_daemon_started_service_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1935,13 +1845,7 @@ const file_daemon_started_service_proto_rawDesc = "" +
 	"\tavailable\x18\x01 \x01(\bR\tavailable\x12\x18\n" +
 	"\aenabled\x18\x02 \x01(\bR\aenabled\"8\n" +
 	"\x1cSetSystemProxyEnabledRequest\x12\x18\n" +
-	"\aenabled\x18\x01 \x01(\bR\aenabled\"c\n" +
-	"\x11DebugCrashRequest\x122\n" +
-	"\x04type\x18\x01 \x01(\x0e2\x1e.daemon.DebugCrashRequest.TypeR\x04type\"\x1a\n" +
-	"\x04Type\x12\x06\n" +
-	"\x02GO\x10\x00\x12\n" +
-	"\n" +
-	"\x06NATIVE\x10\x01\"9\n" +
+	"\aenabled\x18\x01 \x01(\bR\aenabled\"9\n" +
 	"\x1bSubscribeConnectionsRequest\x12\x1a\n" +
 	"\binterval\x18\x01 \x01(\x03R\binterval\"\xea\x01\n" +
 	"\x0fConnectionEvent\x12/\n" +
@@ -2008,7 +1912,7 @@ const file_daemon_started_service_proto_rawDesc = "" +
 	"\x13ConnectionEventType\x12\x18\n" +
 	"\x14CONNECTION_EVENT_NEW\x10\x00\x12\x1b\n" +
 	"\x17CONNECTION_EVENT_UPDATE\x10\x01\x12\x1b\n" +
-	"\x17CONNECTION_EVENT_CLOSED\x10\x022\xf5\f\n" +
+	"\x17CONNECTION_EVENT_CLOSED\x10\x022\xe5\v\n" +
 	"\x0eStartedService\x12=\n" +
 	"\vStopService\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\x12?\n" +
 	"\rReloadService\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\x12K\n" +
@@ -2025,9 +1929,7 @@ const file_daemon_started_service_proto_rawDesc = "" +
 	"\x0eSelectOutbound\x12\x1d.daemon.SelectOutboundRequest\x1a\x16.google.protobuf.Empty\"\x00\x12I\n" +
 	"\x0eSetGroupExpand\x12\x1d.daemon.SetGroupExpandRequest\x1a\x16.google.protobuf.Empty\"\x00\x12K\n" +
 	"\x14GetSystemProxyStatus\x12\x16.google.protobuf.Empty\x1a\x19.daemon.SystemProxyStatus\"\x00\x12W\n" +
-	"\x15SetSystemProxyEnabled\x12$.daemon.SetSystemProxyEnabledRequest\x1a\x16.google.protobuf.Empty\"\x00\x12H\n" +
-	"\x11TriggerDebugCrash\x12\x19.daemon.DebugCrashRequest\x1a\x16.google.protobuf.Empty\"\x00\x12D\n" +
-	"\x10TriggerOOMReport\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\"\x00\x12Y\n" +
+	"\x15SetSystemProxyEnabled\x12$.daemon.SetSystemProxyEnabledRequest\x1a\x16.google.protobuf.Empty\"\x00\x12Y\n" +
 	"\x14SubscribeConnections\x12#.daemon.SubscribeConnectionsRequest\x1a\x18.daemon.ConnectionEvents\"\x000\x01\x12K\n" +
 	"\x0fCloseConnection\x12\x1e.daemon.CloseConnectionRequest\x1a\x16.google.protobuf.Empty\"\x00\x12G\n" +
 	"\x13CloseAllConnections\x12\x16.google.protobuf.Empty\x1a\x16.google.protobuf.Empty\"\x00\x12M\n" +
@@ -2047,108 +1949,101 @@ func file_daemon_started_service_proto_rawDescGZIP() []byte {
 }
 
 var (
-	file_daemon_started_service_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-	file_daemon_started_service_proto_msgTypes  = make([]protoimpl.MessageInfo, 27)
+	file_daemon_started_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+	file_daemon_started_service_proto_msgTypes  = make([]protoimpl.MessageInfo, 26)
 	file_daemon_started_service_proto_goTypes   = []any{
 		(LogLevel)(0),                        // 0: daemon.LogLevel
 		(ConnectionEventType)(0),             // 1: daemon.ConnectionEventType
 		(ServiceStatus_Type)(0),              // 2: daemon.ServiceStatus.Type
-		(DebugCrashRequest_Type)(0),          // 3: daemon.DebugCrashRequest.Type
-		(*ServiceStatus)(nil),                // 4: daemon.ServiceStatus
-		(*ReloadServiceRequest)(nil),         // 5: daemon.ReloadServiceRequest
-		(*SubscribeStatusRequest)(nil),       // 6: daemon.SubscribeStatusRequest
-		(*Log)(nil),                          // 7: daemon.Log
-		(*DefaultLogLevel)(nil),              // 8: daemon.DefaultLogLevel
-		(*Status)(nil),                       // 9: daemon.Status
-		(*Groups)(nil),                       // 10: daemon.Groups
-		(*Group)(nil),                        // 11: daemon.Group
-		(*GroupItem)(nil),                    // 12: daemon.GroupItem
-		(*URLTestRequest)(nil),               // 13: daemon.URLTestRequest
-		(*SelectOutboundRequest)(nil),        // 14: daemon.SelectOutboundRequest
-		(*SetGroupExpandRequest)(nil),        // 15: daemon.SetGroupExpandRequest
-		(*ClashMode)(nil),                    // 16: daemon.ClashMode
-		(*ClashModeStatus)(nil),              // 17: daemon.ClashModeStatus
-		(*SystemProxyStatus)(nil),            // 18: daemon.SystemProxyStatus
-		(*SetSystemProxyEnabledRequest)(nil), // 19: daemon.SetSystemProxyEnabledRequest
-		(*DebugCrashRequest)(nil),            // 20: daemon.DebugCrashRequest
-		(*SubscribeConnectionsRequest)(nil),  // 21: daemon.SubscribeConnectionsRequest
-		(*ConnectionEvent)(nil),              // 22: daemon.ConnectionEvent
-		(*ConnectionEvents)(nil),             // 23: daemon.ConnectionEvents
-		(*Connection)(nil),                   // 24: daemon.Connection
-		(*ProcessInfo)(nil),                  // 25: daemon.ProcessInfo
-		(*CloseConnectionRequest)(nil),       // 26: daemon.CloseConnectionRequest
-		(*DeprecatedWarnings)(nil),           // 27: daemon.DeprecatedWarnings
-		(*DeprecatedWarning)(nil),            // 28: daemon.DeprecatedWarning
-		(*StartedAt)(nil),                    // 29: daemon.StartedAt
-		(*Log_Message)(nil),                  // 30: daemon.Log.Message
-		(*emptypb.Empty)(nil),                // 31: google.protobuf.Empty
+		(*ServiceStatus)(nil),                // 3: daemon.ServiceStatus
+		(*ReloadServiceRequest)(nil),         // 4: daemon.ReloadServiceRequest
+		(*SubscribeStatusRequest)(nil),       // 5: daemon.SubscribeStatusRequest
+		(*Log)(nil),                          // 6: daemon.Log
+		(*DefaultLogLevel)(nil),              // 7: daemon.DefaultLogLevel
+		(*Status)(nil),                       // 8: daemon.Status
+		(*Groups)(nil),                       // 9: daemon.Groups
+		(*Group)(nil),                        // 10: daemon.Group
+		(*GroupItem)(nil),                    // 11: daemon.GroupItem
+		(*URLTestRequest)(nil),               // 12: daemon.URLTestRequest
+		(*SelectOutboundRequest)(nil),        // 13: daemon.SelectOutboundRequest
+		(*SetGroupExpandRequest)(nil),        // 14: daemon.SetGroupExpandRequest
+		(*ClashMode)(nil),                    // 15: daemon.ClashMode
+		(*ClashModeStatus)(nil),              // 16: daemon.ClashModeStatus
+		(*SystemProxyStatus)(nil),            // 17: daemon.SystemProxyStatus
+		(*SetSystemProxyEnabledRequest)(nil), // 18: daemon.SetSystemProxyEnabledRequest
+		(*SubscribeConnectionsRequest)(nil),  // 19: daemon.SubscribeConnectionsRequest
+		(*ConnectionEvent)(nil),              // 20: daemon.ConnectionEvent
+		(*ConnectionEvents)(nil),             // 21: daemon.ConnectionEvents
+		(*Connection)(nil),                   // 22: daemon.Connection
+		(*ProcessInfo)(nil),                  // 23: daemon.ProcessInfo
+		(*CloseConnectionRequest)(nil),       // 24: daemon.CloseConnectionRequest
+		(*DeprecatedWarnings)(nil),           // 25: daemon.DeprecatedWarnings
+		(*DeprecatedWarning)(nil),            // 26: daemon.DeprecatedWarning
+		(*StartedAt)(nil),                    // 27: daemon.StartedAt
+		(*Log_Message)(nil),                  // 28: daemon.Log.Message
+		(*emptypb.Empty)(nil),                // 29: google.protobuf.Empty
 	}
 )
 
 var file_daemon_started_service_proto_depIdxs = []int32{
 	2,  // 0: daemon.ServiceStatus.status:type_name -> daemon.ServiceStatus.Type
-	30, // 1: daemon.Log.messages:type_name -> daemon.Log.Message
+	28, // 1: daemon.Log.messages:type_name -> daemon.Log.Message
 	0,  // 2: daemon.DefaultLogLevel.level:type_name -> daemon.LogLevel
-	11, // 3: daemon.Groups.group:type_name -> daemon.Group
-	12, // 4: daemon.Group.items:type_name -> daemon.GroupItem
-	3,  // 5: daemon.DebugCrashRequest.type:type_name -> daemon.DebugCrashRequest.Type
-	1,  // 6: daemon.ConnectionEvent.type:type_name -> daemon.ConnectionEventType
-	24, // 7: daemon.ConnectionEvent.connection:type_name -> daemon.Connection
-	22, // 8: daemon.ConnectionEvents.events:type_name -> daemon.ConnectionEvent
-	25, // 9: daemon.Connection.processInfo:type_name -> daemon.ProcessInfo
-	28, // 10: daemon.DeprecatedWarnings.warnings:type_name -> daemon.DeprecatedWarning
-	0,  // 11: daemon.Log.Message.level:type_name -> daemon.LogLevel
-	31, // 12: daemon.StartedService.StopService:input_type -> google.protobuf.Empty
-	31, // 13: daemon.StartedService.ReloadService:input_type -> google.protobuf.Empty
-	31, // 14: daemon.StartedService.SubscribeServiceStatus:input_type -> google.protobuf.Empty
-	31, // 15: daemon.StartedService.SubscribeLog:input_type -> google.protobuf.Empty
-	31, // 16: daemon.StartedService.GetDefaultLogLevel:input_type -> google.protobuf.Empty
-	31, // 17: daemon.StartedService.ClearLogs:input_type -> google.protobuf.Empty
-	6,  // 18: daemon.StartedService.SubscribeStatus:input_type -> daemon.SubscribeStatusRequest
-	31, // 19: daemon.StartedService.SubscribeGroups:input_type -> google.protobuf.Empty
-	31, // 20: daemon.StartedService.GetClashModeStatus:input_type -> google.protobuf.Empty
-	31, // 21: daemon.StartedService.SubscribeClashMode:input_type -> google.protobuf.Empty
-	16, // 22: daemon.StartedService.SetClashMode:input_type -> daemon.ClashMode
-	13, // 23: daemon.StartedService.URLTest:input_type -> daemon.URLTestRequest
-	14, // 24: daemon.StartedService.SelectOutbound:input_type -> daemon.SelectOutboundRequest
-	15, // 25: daemon.StartedService.SetGroupExpand:input_type -> daemon.SetGroupExpandRequest
-	31, // 26: daemon.StartedService.GetSystemProxyStatus:input_type -> google.protobuf.Empty
-	19, // 27: daemon.StartedService.SetSystemProxyEnabled:input_type -> daemon.SetSystemProxyEnabledRequest
-	20, // 28: daemon.StartedService.TriggerDebugCrash:input_type -> daemon.DebugCrashRequest
-	31, // 29: daemon.StartedService.TriggerOOMReport:input_type -> google.protobuf.Empty
-	21, // 30: daemon.StartedService.SubscribeConnections:input_type -> daemon.SubscribeConnectionsRequest
-	26, // 31: daemon.StartedService.CloseConnection:input_type -> daemon.CloseConnectionRequest
-	31, // 32: daemon.StartedService.CloseAllConnections:input_type -> google.protobuf.Empty
-	31, // 33: daemon.StartedService.GetDeprecatedWarnings:input_type -> google.protobuf.Empty
-	31, // 34: daemon.StartedService.GetStartedAt:input_type -> google.protobuf.Empty
-	31, // 35: daemon.StartedService.StopService:output_type -> google.protobuf.Empty
-	31, // 36: daemon.StartedService.ReloadService:output_type -> google.protobuf.Empty
-	4,  // 37: daemon.StartedService.SubscribeServiceStatus:output_type -> daemon.ServiceStatus
-	7,  // 38: daemon.StartedService.SubscribeLog:output_type -> daemon.Log
-	8,  // 39: daemon.StartedService.GetDefaultLogLevel:output_type -> daemon.DefaultLogLevel
-	31, // 40: daemon.StartedService.ClearLogs:output_type -> google.protobuf.Empty
-	9,  // 41: daemon.StartedService.SubscribeStatus:output_type -> daemon.Status
-	10, // 42: daemon.StartedService.SubscribeGroups:output_type -> daemon.Groups
-	17, // 43: daemon.StartedService.GetClashModeStatus:output_type -> daemon.ClashModeStatus
-	16, // 44: daemon.StartedService.SubscribeClashMode:output_type -> daemon.ClashMode
-	31, // 45: daemon.StartedService.SetClashMode:output_type -> google.protobuf.Empty
-	31, // 46: daemon.StartedService.URLTest:output_type -> google.protobuf.Empty
-	31, // 47: daemon.StartedService.SelectOutbound:output_type -> google.protobuf.Empty
-	31, // 48: daemon.StartedService.SetGroupExpand:output_type -> google.protobuf.Empty
-	18, // 49: daemon.StartedService.GetSystemProxyStatus:output_type -> daemon.SystemProxyStatus
-	31, // 50: daemon.StartedService.SetSystemProxyEnabled:output_type -> google.protobuf.Empty
-	31, // 51: daemon.StartedService.TriggerDebugCrash:output_type -> google.protobuf.Empty
-	31, // 52: daemon.StartedService.TriggerOOMReport:output_type -> google.protobuf.Empty
-	23, // 53: daemon.StartedService.SubscribeConnections:output_type -> daemon.ConnectionEvents
-	31, // 54: daemon.StartedService.CloseConnection:output_type -> google.protobuf.Empty
-	31, // 55: daemon.StartedService.CloseAllConnections:output_type -> google.protobuf.Empty
-	27, // 56: daemon.StartedService.GetDeprecatedWarnings:output_type -> daemon.DeprecatedWarnings
-	29, // 57: daemon.StartedService.GetStartedAt:output_type -> daemon.StartedAt
-	35, // [35:58] is the sub-list for method output_type
-	12, // [12:35] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	10, // 3: daemon.Groups.group:type_name -> daemon.Group
+	11, // 4: daemon.Group.items:type_name -> daemon.GroupItem
+	1,  // 5: daemon.ConnectionEvent.type:type_name -> daemon.ConnectionEventType
+	22, // 6: daemon.ConnectionEvent.connection:type_name -> daemon.Connection
+	20, // 7: daemon.ConnectionEvents.events:type_name -> daemon.ConnectionEvent
+	23, // 8: daemon.Connection.processInfo:type_name -> daemon.ProcessInfo
+	26, // 9: daemon.DeprecatedWarnings.warnings:type_name -> daemon.DeprecatedWarning
+	0,  // 10: daemon.Log.Message.level:type_name -> daemon.LogLevel
+	29, // 11: daemon.StartedService.StopService:input_type -> google.protobuf.Empty
+	29, // 12: daemon.StartedService.ReloadService:input_type -> google.protobuf.Empty
+	29, // 13: daemon.StartedService.SubscribeServiceStatus:input_type -> google.protobuf.Empty
+	29, // 14: daemon.StartedService.SubscribeLog:input_type -> google.protobuf.Empty
+	29, // 15: daemon.StartedService.GetDefaultLogLevel:input_type -> google.protobuf.Empty
+	29, // 16: daemon.StartedService.ClearLogs:input_type -> google.protobuf.Empty
+	5,  // 17: daemon.StartedService.SubscribeStatus:input_type -> daemon.SubscribeStatusRequest
+	29, // 18: daemon.StartedService.SubscribeGroups:input_type -> google.protobuf.Empty
+	29, // 19: daemon.StartedService.GetClashModeStatus:input_type -> google.protobuf.Empty
+	29, // 20: daemon.StartedService.SubscribeClashMode:input_type -> google.protobuf.Empty
+	15, // 21: daemon.StartedService.SetClashMode:input_type -> daemon.ClashMode
+	12, // 22: daemon.StartedService.URLTest:input_type -> daemon.URLTestRequest
+	13, // 23: daemon.StartedService.SelectOutbound:input_type -> daemon.SelectOutboundRequest
+	14, // 24: daemon.StartedService.SetGroupExpand:input_type -> daemon.SetGroupExpandRequest
+	29, // 25: daemon.StartedService.GetSystemProxyStatus:input_type -> google.protobuf.Empty
+	18, // 26: daemon.StartedService.SetSystemProxyEnabled:input_type -> daemon.SetSystemProxyEnabledRequest
+	19, // 27: daemon.StartedService.SubscribeConnections:input_type -> daemon.SubscribeConnectionsRequest
+	24, // 28: daemon.StartedService.CloseConnection:input_type -> daemon.CloseConnectionRequest
+	29, // 29: daemon.StartedService.CloseAllConnections:input_type -> google.protobuf.Empty
+	29, // 30: daemon.StartedService.GetDeprecatedWarnings:input_type -> google.protobuf.Empty
+	29, // 31: daemon.StartedService.GetStartedAt:input_type -> google.protobuf.Empty
+	29, // 32: daemon.StartedService.StopService:output_type -> google.protobuf.Empty
+	29, // 33: daemon.StartedService.ReloadService:output_type -> google.protobuf.Empty
+	3,  // 34: daemon.StartedService.SubscribeServiceStatus:output_type -> daemon.ServiceStatus
+	6,  // 35: daemon.StartedService.SubscribeLog:output_type -> daemon.Log
+	7,  // 36: daemon.StartedService.GetDefaultLogLevel:output_type -> daemon.DefaultLogLevel
+	29, // 37: daemon.StartedService.ClearLogs:output_type -> google.protobuf.Empty
+	8,  // 38: daemon.StartedService.SubscribeStatus:output_type -> daemon.Status
+	9,  // 39: daemon.StartedService.SubscribeGroups:output_type -> daemon.Groups
+	16, // 40: daemon.StartedService.GetClashModeStatus:output_type -> daemon.ClashModeStatus
+	15, // 41: daemon.StartedService.SubscribeClashMode:output_type -> daemon.ClashMode
+	29, // 42: daemon.StartedService.SetClashMode:output_type -> google.protobuf.Empty
+	29, // 43: daemon.StartedService.URLTest:output_type -> google.protobuf.Empty
+	29, // 44: daemon.StartedService.SelectOutbound:output_type -> google.protobuf.Empty
+	29, // 45: daemon.StartedService.SetGroupExpand:output_type -> google.protobuf.Empty
+	17, // 46: daemon.StartedService.GetSystemProxyStatus:output_type -> daemon.SystemProxyStatus
+	29, // 47: daemon.StartedService.SetSystemProxyEnabled:output_type -> google.protobuf.Empty
+	21, // 48: daemon.StartedService.SubscribeConnections:output_type -> daemon.ConnectionEvents
+	29, // 49: daemon.StartedService.CloseConnection:output_type -> google.protobuf.Empty
+	29, // 50: daemon.StartedService.CloseAllConnections:output_type -> google.protobuf.Empty
+	25, // 51: daemon.StartedService.GetDeprecatedWarnings:output_type -> daemon.DeprecatedWarnings
+	27, // 52: daemon.StartedService.GetStartedAt:output_type -> daemon.StartedAt
+	32, // [32:53] is the sub-list for method output_type
+	11, // [11:32] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
 }
 
 func init() { file_daemon_started_service_proto_init() }
@@ -2161,8 +2056,8 @@ func file_daemon_started_service_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_started_service_proto_rawDesc), len(file_daemon_started_service_proto_rawDesc)),
-			NumEnums:      4,
-			NumMessages:   27,
+			NumEnums:      3,
+			NumMessages:   26,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

daemon/started_service.proto

@@ -26,8 +26,6 @@ service StartedService {
 
   rpc GetSystemProxyStatus(google.protobuf.Empty) returns(SystemProxyStatus) {}
   rpc SetSystemProxyEnabled(SetSystemProxyEnabledRequest) returns(google.protobuf.Empty) {}
-  rpc TriggerDebugCrash(DebugCrashRequest) returns(google.protobuf.Empty) {}
-  rpc TriggerOOMReport(google.protobuf.Empty) returns(google.protobuf.Empty) {}
 
   rpc SubscribeConnections(SubscribeConnectionsRequest) returns(stream ConnectionEvents) {}
   rpc CloseConnection(CloseConnectionRequest) returns(google.protobuf.Empty) {}
@@ -143,15 +141,6 @@ message SetSystemProxyEnabledRequest {
   bool enabled = 1;
 }
 
-message DebugCrashRequest {
-  enum Type {
-    GO = 0;
-    NATIVE = 1;
-  }
-
-  Type type = 1;
-}
-
 message SubscribeConnectionsRequest {
   int64 interval = 1;
 }
@@ -225,4 +214,4 @@ message DeprecatedWarning {
 
 message StartedAt {
   int64 startedAt = 1;
-}
+}

daemon/started_service_grpc.pb.go

@@ -31,8 +31,6 @@ const (
 	StartedService_SetGroupExpand_FullMethodName         = "/daemon.StartedService/SetGroupExpand"
 	StartedService_GetSystemProxyStatus_FullMethodName   = "/daemon.StartedService/GetSystemProxyStatus"
 	StartedService_SetSystemProxyEnabled_FullMethodName  = "/daemon.StartedService/SetSystemProxyEnabled"
-	StartedService_TriggerDebugCrash_FullMethodName      = "/daemon.StartedService/TriggerDebugCrash"
-	StartedService_TriggerOOMReport_FullMethodName       = "/daemon.StartedService/TriggerOOMReport"
 	StartedService_SubscribeConnections_FullMethodName   = "/daemon.StartedService/SubscribeConnections"
 	StartedService_CloseConnection_FullMethodName        = "/daemon.StartedService/CloseConnection"
 	StartedService_CloseAllConnections_FullMethodName    = "/daemon.StartedService/CloseAllConnections"
@@ -60,8 +58,6 @@ type StartedServiceClient interface {
 	SetGroupExpand(ctx context.Context, in *SetGroupExpandRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	GetSystemProxyStatus(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(ctx context.Context, in *SetSystemProxyEnabledRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	TriggerDebugCrash(ctx context.Context, in *DebugCrashRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
-	TriggerOOMReport(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	SubscribeConnections(ctx context.Context, in *SubscribeConnectionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionEvents], error)
 	CloseConnection(ctx context.Context, in *CloseConnectionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	CloseAllConnections(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -282,26 +278,6 @@ func (c *startedServiceClient) SetSystemProxyEnabled(ctx context.Context, in *Se
 	return out, nil
 }
 
-func (c *startedServiceClient) TriggerDebugCrash(ctx context.Context, in *DebugCrashRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, StartedService_TriggerDebugCrash_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *startedServiceClient) TriggerOOMReport(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, StartedService_TriggerOOMReport_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *startedServiceClient) SubscribeConnections(ctx context.Context, in *SubscribeConnectionsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionEvents], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &StartedService_ServiceDesc.Streams[5], StartedService_SubscribeConnections_FullMethodName, cOpts...)
@@ -381,8 +357,6 @@ type StartedServiceServer interface {
 	SetGroupExpand(context.Context, *SetGroupExpandRequest) (*emptypb.Empty, error)
 	GetSystemProxyStatus(context.Context, *emptypb.Empty) (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(context.Context, *SetSystemProxyEnabledRequest) (*emptypb.Empty, error)
-	TriggerDebugCrash(context.Context, *DebugCrashRequest) (*emptypb.Empty, error)
-	TriggerOOMReport(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
 	SubscribeConnections(*SubscribeConnectionsRequest, grpc.ServerStreamingServer[ConnectionEvents]) error
 	CloseConnection(context.Context, *CloseConnectionRequest) (*emptypb.Empty, error)
 	CloseAllConnections(context.Context, *emptypb.Empty) (*emptypb.Empty, error)
@@ -462,14 +436,6 @@ func (UnimplementedStartedServiceServer) SetSystemProxyEnabled(context.Context,
 	return nil, status.Error(codes.Unimplemented, "method SetSystemProxyEnabled not implemented")
 }
 
-func (UnimplementedStartedServiceServer) TriggerDebugCrash(context.Context, *DebugCrashRequest) (*emptypb.Empty, error) {
-	return nil, status.Error(codes.Unimplemented, "method TriggerDebugCrash not implemented")
-}
-
-func (UnimplementedStartedServiceServer) TriggerOOMReport(context.Context, *emptypb.Empty) (*emptypb.Empty, error) {
-	return nil, status.Error(codes.Unimplemented, "method TriggerOOMReport not implemented")
-}
-
 func (UnimplementedStartedServiceServer) SubscribeConnections(*SubscribeConnectionsRequest, grpc.ServerStreamingServer[ConnectionEvents]) error {
 	return status.Error(codes.Unimplemented, "method SubscribeConnections not implemented")
 }
@@ -763,42 +729,6 @@ func _StartedService_SetSystemProxyEnabled_Handler(srv interface{}, ctx context.
 	return interceptor(ctx, in, info, handler)
 }
 
-func _StartedService_TriggerDebugCrash_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DebugCrashRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(StartedServiceServer).TriggerDebugCrash(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: StartedService_TriggerDebugCrash_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(StartedServiceServer).TriggerDebugCrash(ctx, req.(*DebugCrashRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _StartedService_TriggerOOMReport_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(StartedServiceServer).TriggerOOMReport(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: StartedService_TriggerOOMReport_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(StartedServiceServer).TriggerOOMReport(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _StartedService_SubscribeConnections_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(SubscribeConnectionsRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -933,14 +863,6 @@ var StartedService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "SetSystemProxyEnabled",
 			Handler:    _StartedService_SetSystemProxyEnabled_Handler,
 		},
-		{
-			MethodName: "TriggerDebugCrash",
-			Handler:    _StartedService_TriggerDebugCrash_Handler,
-		},
-		{
-			MethodName: "TriggerOOMReport",
-			Handler:    _StartedService_TriggerOOMReport_Handler,
-		},
 		{
 			MethodName: "CloseConnection",
 			Handler:    _StartedService_CloseConnection_Handler,

dns/client.go

@@ -283,6 +283,9 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 	if timeToLive == 0 {
 		for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
 			for _, record := range recordList {
+				if record.Header().Rrtype == dns.TypeOPT {
+					continue
+				}
 				if timeToLive == 0 || record.Header().Ttl > 0 && record.Header().Ttl < timeToLive {
 					timeToLive = record.Header().Ttl
 				}
@@ -294,6 +297,9 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
 	}
 	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
 		for _, record := range recordList {
+			if record.Header().Rrtype == dns.TypeOPT {
+				continue
+			}
 			record.Header().Ttl = timeToLive
 		}
 	}
@@ -381,21 +387,21 @@ func (c *Client) storeCache(transport adapter.DNSTransport, question dns.Questio
 	}
 	if c.disableExpire {
 		if !c.independentCache {
-			c.cache.Add(question, message)
+			c.cache.Add(question, message.Copy())
 		} else {
 			c.transportCache.Add(transportCacheKey{
 				Question:     question,
 				transportTag: transport.Tag(),
-			}, message)
+			}, message.Copy())
 		}
 	} else {
 		if !c.independentCache {
-			c.cache.AddWithLifetime(question, message, time.Second*time.Duration(timeToLive))
+			c.cache.AddWithLifetime(question, message.Copy(), time.Second*time.Duration(timeToLive))
 		} else {
 			c.transportCache.AddWithLifetime(transportCacheKey{
 				Question:     question,
 				transportTag: transport.Tag(),
-			}, message, time.Second*time.Duration(timeToLive))
+			}, message.Copy(), time.Second*time.Duration(timeToLive))
 		}
 	}
 }
@@ -486,6 +492,9 @@ func (c *Client) loadResponse(question dns.Question, transport adapter.DNSTransp
 		var originTTL int
 		for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
 			for _, record := range recordList {
+				if record.Header().Rrtype == dns.TypeOPT {
+					continue
+				}
 				if originTTL == 0 || record.Header().Ttl > 0 && int(record.Header().Ttl) < originTTL {
 					originTTL = int(record.Header().Ttl)
 				}
@@ -500,12 +509,18 @@ func (c *Client) loadResponse(question dns.Question, transport adapter.DNSTransp
 			duration := uint32(originTTL - nowTTL)
 			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
 				for _, record := range recordList {
+					if record.Header().Rrtype == dns.TypeOPT {
+						continue
+					}
 					record.Header().Ttl = record.Header().Ttl - duration
 				}
 			}
 		} else {
 			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
 				for _, record := range recordList {
+					if record.Header().Rrtype == dns.TypeOPT {
+						continue
+					}
 					record.Header().Ttl = uint32(nowTTL)
 				}
 			}

docs/changelog.md

@@ -2,7 +2,7 @@
 icon: material/alert-decagram
 ---
 
-#### 1.14.0-alpha.9
+#### 1.13.7
 
 * Fixes and improvements
 
@@ -10,50 +10,14 @@ icon: material/alert-decagram
 
 * Fixes and improvements
 
-#### 1.14.0-alpha.8
-
-* Add BBR profile and hop interval randomization for Hysteria2 **1**
-* Fixes and improvements
-
-**1**:
-
-See [Hysteria2 Inbound](/configuration/inbound/hysteria2/#bbr_profile) and [Hysteria2 Outbound](/configuration/outbound/hysteria2/#bbr_profile).
-
-#### 1.14.0-alpha.8
-
-* Fixes and improvements
-
 #### 1.13.5
 
 * Fixes and improvements
 
-#### 1.14.0-alpha.7
-
-* Fixes and improvements
-
 #### 1.13.4
 
 * Fixes and improvements
 
-#### 1.14.0-alpha.4
-
-* Refactor ACME support to certificate provider system **1**
-* Add Cloudflare Origin CA certificate provider **2**
-* Add Tailscale certificate provider **3**
-* Fixes and improvements
-
-**1**:
-
-See [Certificate Provider](/configuration/shared/certificate-provider/) and [Migration](/migration/#migrate-inline-acme-to-certificate-provider).
-
-**2**:
-
-See [Cloudflare Origin CA](/configuration/shared/certificate-provider/cloudflare-origin-ca).
-
-**3**:
-
-See [Tailscale](/configuration/shared/certificate-provider/tailscale).
-
 #### 1.13.3
 
 * Add OpenWrt and Alpine APK packages to release **1**
@@ -78,59 +42,6 @@ from [SagerNet/go](https://github.com/SagerNet/go).
 
 See [OCM](/configuration/service/ocm).
 
-#### 1.12.24
-
-* Fixes and improvements
-
-#### 1.14.0-alpha.2
-
-* Add OpenWrt and Alpine APK packages to release **1**
-* Backport to macOS 10.13 High Sierra **2**
-* OCM service: Add WebSocket support for Responses API **3**
-* Fixes and improvements
-
-**1**:
-
-Alpine APK files use `linux` in the filename to distinguish from OpenWrt APKs which use the `openwrt` prefix:
-
-- OpenWrt: `sing-box_{version}_openwrt_{architecture}.apk`
-- Alpine: `sing-box_{version}_linux_{architecture}.apk`
-
-**2**:
-
-Legacy macOS binaries (with `-legacy-macos-10.13` suffix) now support
-macOS 10.13 High Sierra, built using Go 1.25 with patches
-from [SagerNet/go](https://github.com/SagerNet/go).
-
-**3**:
-
-See [OCM](/configuration/service/ocm).
-
-#### 1.14.0-alpha.1
-
-* Add `source_mac_address` and `source_hostname` rule items **1**
-* Add `include_mac_address` and `exclude_mac_address` TUN options **2**
-* Update NaiveProxy to 145.0.7632.159 **3**
-* Fixes and improvements
-
-**1**:
-
-New rule items for matching LAN devices by MAC address and hostname via neighbor resolution.
-Supported on Linux, macOS, or in graphical clients on Android and macOS.
-
-See [Route Rule](/configuration/route/rule/#source_mac_address), [DNS Rule](/configuration/dns/rule/#source_mac_address) and [Neighbor Resolution](/configuration/shared/neighbor/).
-
-**2**:
-
-Limit or exclude devices from TUN routing by MAC address.
-Only supported on Linux with `auto_route` and `auto_redirect` enabled.
-
-See [TUN](/configuration/inbound/tun/#include_mac_address).
-
-**3**:
-
-This is not an official update from NaiveProxy. Instead, it's a Chromium codebase update maintained by Project S.
-
 #### 1.13.2
 
 * Fixes and improvements

docs/configuration/dns/rule.md

@@ -2,11 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [interface_address](#interface_address)  
@@ -154,12 +149,6 @@ icon: material/alert-decagram
         "default_interface_address": [
           "2000::/3"
         ],
-        "source_mac_address": [
-          "00:11:22:33:44:55"
-        ],
-        "source_hostname": [
-          "my-device"
-        ],
         "wifi_ssid": [
           "My WIFI"
         ],
@@ -419,26 +408,6 @@ Matches network interface (same values as `network_type`) address.
 
 Match default interface address.
 
-#### source_mac_address
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.
-
-Match source device MAC address.
-
-#### source_hostname
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.
-
-Match source device hostname from DHCP leases.
-
 #### wifi_ssid
 
 !!! quote ""

docs/configuration/dns/rule.zh.md

@@ -2,11 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [interface_address](#interface_address)  
@@ -154,12 +149,6 @@ icon: material/alert-decagram
         "default_interface_address": [
           "2000::/3"
         ],
-        "source_mac_address": [
-          "00:11:22:33:44:55"
-        ],
-        "source_hostname": [
-          "my-device"
-        ],
         "wifi_ssid": [
           "My WIFI"
         ],
@@ -418,26 +407,6 @@ Available values: `wifi`, `cellular`, `ethernet` and `other`.
 
 匹配默认接口地址。
 
-#### source_mac_address
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux、macOS，或在 Android 和 macOS 图形客户端中支持。参阅 [邻居解析](/configuration/shared/neighbor/) 了解设置方法。
-
-匹配源设备 MAC 地址。
-
-#### source_hostname
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux、macOS，或在 Android 和 macOS 图形客户端中支持。参阅 [邻居解析](/configuration/shared/neighbor/) 了解设置方法。
-
-匹配源设备从 DHCP 租约获取的主机名。
-
 #### wifi_ssid
 
 !!! quote ""

docs/configuration/inbound/hysteria2.md

@@ -2,10 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [bbr_profile](#bbr_profile)
-
 !!! quote "Changes in sing-box 1.11.0"
 
     :material-alert: [masquerade](#masquerade)  
@@ -35,7 +31,6 @@ icon: material/alert-decagram
   "ignore_client_bandwidth": false,
   "tls": {},
   "masquerade": "", // or {}
-  "bbr_profile": "",
   "brutal_debug": false
 }
 ```
@@ -146,14 +141,6 @@ Fixed response headers.
 
 Fixed response content.
 
-#### bbr_profile
-
-!!! question "Since sing-box 1.14.0"
-
-BBR congestion control algorithm profile, one of `conservative` `standard` `aggressive`.
-
-`standard` is used by default.
-
 #### brutal_debug
 
 Enable debug information logging for Hysteria Brutal CC.

docs/configuration/inbound/hysteria2.zh.md

@@ -2,10 +2,6 @@
 icon: material/alert-decagram
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [bbr_profile](#bbr_profile)
-
 !!! quote "sing-box 1.11.0 中的更改"
 
     :material-alert: [masquerade](#masquerade)  
@@ -35,7 +31,6 @@ icon: material/alert-decagram
   "ignore_client_bandwidth": false,
   "tls": {},
   "masquerade": "", // 或 {}
-  "bbr_profile": "",
   "brutal_debug": false
 }
 ```
@@ -143,14 +138,6 @@ HTTP3 服务器认证失败时的行为 （对象配置）。
 
 固定响应内容。
 
-#### bbr_profile
-
-!!! question "自 sing-box 1.14.0 起"
-
-BBR 拥塞控制算法配置，可选 `conservative` `standard` `aggressive`。
-
-默认使用 `standard`。
-
 #### brutal_debug
 
 启用 Hysteria Brutal CC 的调试信息日志记录。

docs/configuration/inbound/tun.md

@@ -4,7 +4,7 @@ icon: material/new-box
 
 !!! quote "Changes in sing-box 1.14.0"
 
-    :material-plus: [include_mac_address](#include_mac_address)  
+    :material-plus: [include_mac_address](#include_mac_address)
     :material-plus: [exclude_mac_address](#exclude_mac_address)
 
 !!! quote "Changes in sing-box 1.13.3"
@@ -134,12 +134,6 @@ icon: material/new-box
   "exclude_package": [
     "com.android.captiveportallogin"
   ],
-  "include_mac_address": [
-    "00:11:22:33:44:55"
-  ],
-  "exclude_mac_address": [
-    "66:77:88:99:aa:bb"
-  ],
   "platform": {
     "http_proxy": {
       "enabled": false,
@@ -566,30 +560,6 @@ Limit android packages in route.
 
 Exclude android packages in route.
 
-#### include_mac_address
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux with `auto_route` and `auto_redirect` enabled.
-
-Limit MAC addresses in route. Not limited by default.
-
-Conflict with `exclude_mac_address`.
-
-#### exclude_mac_address
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux with `auto_route` and `auto_redirect` enabled.
-
-Exclude MAC addresses in route.
-
-Conflict with `include_mac_address`.
-
 #### platform
 
 Platform-specific settings, provided by client applications.

docs/configuration/inbound/tun.zh.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [include_mac_address](#include_mac_address)  
-    :material-plus: [exclude_mac_address](#exclude_mac_address)
-
 !!! quote "sing-box 1.13.3 中的更改"
 
     :material-alert: [strict_route](#strict_route)
@@ -135,12 +130,6 @@ icon: material/new-box
   "exclude_package": [
     "com.android.captiveportallogin"
   ],
-  "include_mac_address": [
-    "00:11:22:33:44:55"
-  ],
-  "exclude_mac_address": [
-    "66:77:88:99:aa:bb"
-  ],
   "platform": {
     "http_proxy": {
       "enabled": false,
@@ -554,30 +543,6 @@ TCP/IP 栈。
 
 排除路由的 Android 应用包名。
 
-#### include_mac_address
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux，且需要 `auto_route` 和 `auto_redirect` 已启用。
-
-限制被路由的 MAC 地址。默认不限制。
-
-与 `exclude_mac_address` 冲突。
-
-#### exclude_mac_address
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux，且需要 `auto_route` 和 `auto_redirect` 已启用。
-
-排除路由的 MAC 地址。
-
-与 `include_mac_address` 冲突。
-
 #### platform
 
 平台特定的设置，由客户端应用提供。

docs/configuration/index.md

@@ -1,6 +1,7 @@
 # Introduction
 
 sing-box uses JSON for configuration files.
+
 ### Structure
 
 ```json
@@ -9,7 +10,6 @@ sing-box uses JSON for configuration files.
   "dns": {},
   "ntp": {},
   "certificate": {},
-  "certificate_providers": [],
   "endpoints": [],
   "inbounds": [],
   "outbounds": [],
@@ -27,7 +27,6 @@ sing-box uses JSON for configuration files.
 | `dns`          | [DNS](./dns/)                   |
 | `ntp`          | [NTP](./ntp/)                   |
 | `certificate`  | [Certificate](./certificate/)   |
-| `certificate_providers` | [Certificate Provider](./shared/certificate-provider/) |
 | `endpoints`    | [Endpoint](./endpoint/)         |
 | `inbounds`     | [Inbound](./inbound/)           |
 | `outbounds`    | [Outbound](./outbound/)         |
@@ -51,4 +50,4 @@ sing-box format -w -c config.json -D config_directory
 
 ```bash
 sing-box merge output.json -c config.json -D config_directory
-```
+```

docs/configuration/index.zh.md

@@ -1,6 +1,7 @@
 # 引言
 
 sing-box 使用 JSON 作为配置文件格式。
+
 ### 结构
 
 ```json
@@ -9,7 +10,6 @@ sing-box 使用 JSON 作为配置文件格式。
   "dns": {},
   "ntp": {},
   "certificate": {},
-  "certificate_providers": [],
   "endpoints": [],
   "inbounds": [],
   "outbounds": [],
@@ -27,7 +27,6 @@ sing-box 使用 JSON 作为配置文件格式。
 | `dns`          | [DNS](./dns/)          |
 | `ntp`          | [NTP](./ntp/)          |
 | `certificate`  | [证书](./certificate/)   |
-| `certificate_providers` | [证书提供者](./shared/certificate-provider/) |
 | `endpoints`    | [端点](./endpoint/)      |
 | `inbounds`     | [入站](./inbound/)       |
 | `outbounds`    | [出站](./outbound/)      |
@@ -51,4 +50,4 @@ sing-box format -w -c config.json -D config_directory
 
 ```bash
 sing-box merge output.json -c config.json -D config_directory
-```
+```

docs/configuration/outbound/hysteria2.md

@@ -1,8 +1,3 @@
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [hop_interval_max](#hop_interval_max)  
-    :material-plus: [bbr_profile](#bbr_profile)
-
 !!! quote "Changes in sing-box 1.11.0"
 
     :material-plus: [server_ports](#server_ports)  
@@ -14,14 +9,13 @@
 {
   "type": "hysteria2",
   "tag": "hy2-out",
-
+  
   "server": "127.0.0.1",
   "server_port": 1080,
   "server_ports": [
     "2080:3000"
   ],
   "hop_interval": "",
-  "hop_interval_max": "",
   "up_mbps": 100,
   "down_mbps": 100,
   "obfs": {
@@ -31,9 +25,8 @@
   "password": "goofy_ahh_password",
   "network": "tcp",
   "tls": {},
-  "bbr_profile": "",
   "brutal_debug": false,
-
+  
   ... // Dial Fields
 }
 ```
@@ -82,14 +75,6 @@ Port hopping interval.
 
 `30s` is used by default.
 
-#### hop_interval_max
-
-!!! question "Since sing-box 1.14.0"
-
-Maximum port hopping interval, used for randomization.
-
-If set, the actual hop interval will be randomly chosen between `hop_interval` and `hop_interval_max`.
-
 #### up_mbps, down_mbps
 
 Max bandwidth, in Mbps.
@@ -124,14 +109,6 @@ Both is enabled by default.
 
 TLS configuration, see [TLS](/configuration/shared/tls/#outbound).
 
-#### bbr_profile
-
-!!! question "Since sing-box 1.14.0"
-
-BBR congestion control algorithm profile, one of `conservative` `standard` `aggressive`.
-
-`standard` is used by default.
-
 #### brutal_debug
 
 Enable debug information logging for Hysteria Brutal CC.

docs/configuration/outbound/hysteria2.zh.md

@@ -1,8 +1,3 @@
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [hop_interval_max](#hop_interval_max)  
-    :material-plus: [bbr_profile](#bbr_profile)
-
 !!! quote "sing-box 1.11.0 中的更改"
 
     :material-plus: [server_ports](#server_ports)  
@@ -21,7 +16,6 @@
     "2080:3000"
   ],
   "hop_interval": "",
-  "hop_interval_max": "",
   "up_mbps": 100,
   "down_mbps": 100,
   "obfs": {
@@ -31,9 +25,8 @@
   "password": "goofy_ahh_password",
   "network": "tcp",
   "tls": {},
-  "bbr_profile": "",
   "brutal_debug": false,
-
+  
   ... // 拨号字段
 }
 ```
@@ -80,14 +73,6 @@
 
 默认使用 `30s`。
 
-#### hop_interval_max
-
-!!! question "自 sing-box 1.14.0 起"
-
-最大端口跳跃间隔，用于随机化。
-
-如果设置，实际跳跃间隔将在 `hop_interval` 和 `hop_interval_max` 之间随机选择。
-
 #### up_mbps, down_mbps
 
 最大带宽。
@@ -122,14 +107,6 @@ QUIC 流量混淆器密码.
 
 TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#出站)。
 
-#### bbr_profile
-
-!!! question "自 sing-box 1.14.0 起"
-
-BBR 拥塞控制算法配置，可选 `conservative` `standard` `aggressive`。
-
-默认使用 `standard`。
-
 #### brutal_debug
 
 启用 Hysteria Brutal CC 的调试信息日志记录。

docs/configuration/route/index.md

@@ -4,11 +4,6 @@ icon: material/alert-decagram
 
 # Route
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [find_neighbor](#find_neighbor)  
-    :material-plus: [dhcp_lease_files](#dhcp_lease_files)
-
 !!! quote "Changes in sing-box 1.12.0"
 
     :material-plus: [default_domain_resolver](#default_domain_resolver)  
@@ -40,9 +35,6 @@ icon: material/alert-decagram
     "override_android_vpn": false,
     "default_interface": "",
     "default_mark": 0,
-    "find_process": false,
-    "find_neighbor": false,
-    "dhcp_lease_files": [],
     "default_domain_resolver": "", // or {}
     "default_network_strategy": "",
     "default_network_type": [],
@@ -115,38 +107,6 @@ Set routing mark by default.
 
 Takes no effect if `outbound.routing_mark` is set.
 
-#### find_process
-
-!!! quote ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Enable process search for logging when no `process_name`, `process_path`, `package_name`, `user` or `user_id` rules exist.
-
-#### find_neighbor
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux and macOS.
-
-Enable neighbor resolution for logging when no `source_mac_address` or `source_hostname` rules exist.
-
-See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.
-
-#### dhcp_lease_files
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux and macOS.
-
-Custom DHCP lease file paths for hostname and MAC address resolution.
-
-Automatically detected from common DHCP servers (dnsmasq, odhcpd, ISC dhcpd, Kea) if empty.
-
 #### default_domain_resolver
 
 !!! question "Since sing-box 1.12.0"

docs/configuration/route/index.zh.md

@@ -4,11 +4,6 @@ icon: material/alert-decagram
 
 # 路由
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [find_neighbor](#find_neighbor)  
-    :material-plus: [dhcp_lease_files](#dhcp_lease_files)
-
 !!! quote "sing-box 1.12.0 中的更改"
 
     :material-plus: [default_domain_resolver](#default_domain_resolver)  
@@ -42,9 +37,6 @@ icon: material/alert-decagram
     "override_android_vpn": false,
     "default_interface": "",
     "default_mark": 0,
-    "find_process": false,
-    "find_neighbor": false,
-    "dhcp_lease_files": [],
     "default_network_strategy": "",
     "default_fallback_delay": ""
   }
@@ -114,38 +106,6 @@ icon: material/alert-decagram
 
 如果设置了 `outbound.routing_mark` 设置，则不生效。
 
-#### find_process
-
-!!! quote ""
-
-    仅支持 Linux、Windows 和 macOS。
-
-在没有 `process_name`、`process_path`、`package_name`、`user` 或 `user_id` 规则时启用进程搜索以输出日志。
-
-#### find_neighbor
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux 和 macOS。
-
-在没有 `source_mac_address` 或 `source_hostname` 规则时启用邻居解析以输出日志。
-
-参阅 [邻居解析](/configuration/shared/neighbor/) 了解设置方法。
-
-#### dhcp_lease_files
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux 和 macOS。
-
-用于主机名和 MAC 地址解析的自定义 DHCP 租约文件路径。
-
-为空时自动从常见 DHCP 服务器（dnsmasq、odhcpd、ISC dhcpd、Kea）检测。
-
 #### default_domain_resolver
 
 !!! question "自 sing-box 1.12.0 起"

docs/configuration/route/rule.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [interface_address](#interface_address)  
@@ -164,12 +159,6 @@ icon: material/new-box
           "tailscale",
           "wireguard"
         ],
-        "source_mac_address": [
-          "00:11:22:33:44:55"
-        ],
-        "source_hostname": [
-          "my-device"
-        ],
         "rule_set": [
           "geoip-cn",
           "geosite-cn"
@@ -460,26 +449,6 @@ Match specified outbounds' preferred routes.
 | `tailscale` | Match MagicDNS domains and peers' allowed IPs |
 | `wireguard` | Match peers's allowed IPs                     |
 
-#### source_mac_address
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.
-
-Match source device MAC address.
-
-#### source_hostname
-
-!!! question "Since sing-box 1.14.0"
-
-!!! quote ""
-
-    Only supported on Linux, macOS, or in graphical clients on Android and macOS. See [Neighbor Resolution](/configuration/shared/neighbor/) for setup.
-
-Match source device hostname from DHCP leases.
-
 #### rule_set
 
 !!! question "Since sing-box 1.8.0"

docs/configuration/route/rule.zh.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [source_mac_address](#source_mac_address)  
-    :material-plus: [source_hostname](#source_hostname)
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [interface_address](#interface_address)  
@@ -162,12 +157,6 @@ icon: material/new-box
           "tailscale",
           "wireguard"
         ],
-        "source_mac_address": [
-          "00:11:22:33:44:55"
-        ],
-        "source_hostname": [
-          "my-device"
-        ],
         "rule_set": [
           "geoip-cn",
           "geosite-cn"
@@ -458,26 +447,6 @@ icon: material/new-box
 | `tailscale` | 匹配 MagicDNS 域名和对端的 allowed IPs |
 | `wireguard` | 匹配对端的 allowed IPs              |
 
-#### source_mac_address
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux、macOS，或在 Android 和 macOS 图形客户端中支持。参阅 [邻居解析](/configuration/shared/neighbor/) 了解设置方法。
-
-匹配源设备 MAC 地址。
-
-#### source_hostname
-
-!!! question "自 sing-box 1.14.0 起"
-
-!!! quote ""
-
-    仅支持 Linux、macOS，或在 Android 和 macOS 图形客户端中支持。参阅 [邻居解析](/configuration/shared/neighbor/) 了解设置方法。
-
-匹配源设备从 DHCP 租约获取的主机名。
-
 #### rule_set
 
 !!! question "自 sing-box 1.8.0 起"

docs/configuration/shared/certificate-provider/acme.md

@@ -1,150 +0,0 @@
----
-icon: material/new-box
----
-
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [account_key](#account_key)  
-    :material-plus: [key_type](#key_type)  
-    :material-plus: [detour](#detour)
-
-# ACME
-
-!!! quote ""
-
-    `with_acme` build tag required.
-
-### Structure
-
-```json
-{
-  "type": "acme",
-  "tag": "",
-
-  "domain": [],
-  "data_directory": "",
-  "default_server_name": "",
-  "email": "",
-  "provider": "",
-  "account_key": "",
-  "disable_http_challenge": false,
-  "disable_tls_alpn_challenge": false,
-  "alternative_http_port": 0,
-  "alternative_tls_port": 0,
-  "external_account": {
-    "key_id": "",
-    "mac_key": ""
-  },
-  "dns01_challenge": {},
-  "key_type": "",
-  "detour": ""
-}
-```
-
-### Fields
-
-#### domain
-
-==Required==
-
-List of domains.
-
-#### data_directory
-
-The directory to store ACME data.
-
-`$XDG_DATA_HOME/certmagic|$HOME/.local/share/certmagic` will be used if empty.
-
-#### default_server_name
-
-Server name to use when choosing a certificate if the ClientHello's ServerName field is empty.
-
-#### email
-
-The email address to use when creating or selecting an existing ACME server account.
-
-#### provider
-
-The ACME CA provider to use.
-
-| Value                   | Provider      |
-|-------------------------|---------------|
-| `letsencrypt (default)` | Let's Encrypt |
-| `zerossl`               | ZeroSSL       |
-| `https://...`           | Custom        |
-
-When `provider` is `zerossl`, sing-box will automatically request ZeroSSL EAB credentials if `email` is set and
-`external_account` is empty.
-
-When `provider` is `zerossl`, at least one of `external_account`, `email`, or `account_key` is required.
-
-#### account_key
-
-!!! question "Since sing-box 1.14.0"
-
-The PEM-encoded private key of an existing ACME account.
-
-#### disable_http_challenge
-
-Disable all HTTP challenges.
-
-#### disable_tls_alpn_challenge
-
-Disable all TLS-ALPN challenges
-
-#### alternative_http_port
-
-The alternate port to use for the ACME HTTP challenge; if non-empty, this port will be used instead of 80 to spin up a
-listener for the HTTP challenge.
-
-#### alternative_tls_port
-
-The alternate port to use for the ACME TLS-ALPN challenge; the system must forward 443 to this port for challenge to
-succeed.
-
-#### external_account
-
-EAB (External Account Binding) contains information necessary to bind or map an ACME account to some other account known
-by the CA.
-
-External account bindings are used to associate an ACME account with an existing account in a non-ACME system, such as
-a CA customer database.
-
-To enable ACME account binding, the CA operating the ACME server needs to provide the ACME client with a MAC key and a
-key identifier, using some mechanism outside of ACME. §7.3.4
-
-#### external_account.key_id
-
-The key identifier.
-
-#### external_account.mac_key
-
-The MAC key.
-
-#### dns01_challenge
-
-ACME DNS01 challenge field. If configured, other challenge methods will be disabled.
-
-See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/) for details.
-
-#### key_type
-
-!!! question "Since sing-box 1.14.0"
-
-The private key type to generate for new certificates.
-
-| Value      | Type    |
-|------------|---------|
-| `ed25519`  | Ed25519 |
-| `p256`     | P-256   |
-| `p384`     | P-384   |
-| `rsa2048`  | RSA     |
-| `rsa4096`  | RSA     |
-
-#### detour
-
-!!! question "Since sing-box 1.14.0"
-
-The tag of the upstream outbound.
-
-All provider HTTP requests will use this outbound.

docs/configuration/shared/certificate-provider/acme.zh.md

@@ -1,145 +0,0 @@
----
-icon: material/new-box
----
-
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [account_key](#account_key)  
-    :material-plus: [key_type](#key_type)  
-    :material-plus: [detour](#detour)
-
-# ACME
-
-!!! quote ""
-
-    需要 `with_acme` 构建标签。
-
-### 结构
-
-```json
-{
-  "type": "acme",
-  "tag": "",
-
-  "domain": [],
-  "data_directory": "",
-  "default_server_name": "",
-  "email": "",
-  "provider": "",
-  "account_key": "",
-  "disable_http_challenge": false,
-  "disable_tls_alpn_challenge": false,
-  "alternative_http_port": 0,
-  "alternative_tls_port": 0,
-  "external_account": {
-    "key_id": "",
-    "mac_key": ""
-  },
-  "dns01_challenge": {},
-  "key_type": "",
-  "detour": ""
-}
-```
-
-### 字段
-
-#### domain
-
-==必填==
-
-域名列表。
-
-#### data_directory
-
-ACME 数据存储目录。
-
-如果为空则使用 `$XDG_DATA_HOME/certmagic|$HOME/.local/share/certmagic`。
-
-#### default_server_name
-
-如果 ClientHello 的 ServerName 字段为空，则选择证书时要使用的服务器名称。
-
-#### email
-
-创建或选择现有 ACME 服务器帐户时使用的电子邮件地址。
-
-#### provider
-
-要使用的 ACME CA 提供商。
-
-| 值                  | 提供商           |
-|--------------------|---------------|
-| `letsencrypt (默认)` | Let's Encrypt |
-| `zerossl`          | ZeroSSL       |
-| `https://...`      | 自定义           |
-
-当 `provider` 为 `zerossl` 时，如果设置了 `email` 且未设置 `external_account`，
-sing-box 会自动向 ZeroSSL 请求 EAB 凭据。
-
-当 `provider` 为 `zerossl` 时，必须至少设置 `external_account`、`email` 或 `account_key` 之一。
-
-#### account_key
-
-!!! question "自 sing-box 1.14.0 起"
-
-现有 ACME 帐户的 PEM 编码私钥。
-
-#### disable_http_challenge
-
-禁用所有 HTTP 质询。
-
-#### disable_tls_alpn_challenge
-
-禁用所有 TLS-ALPN 质询。
-
-#### alternative_http_port
-
-用于 ACME HTTP 质询的备用端口；如果非空，将使用此端口而不是 80 来启动 HTTP 质询的侦听器。
-
-#### alternative_tls_port
-
-用于 ACME TLS-ALPN 质询的备用端口； 系统必须将 443 转发到此端口以使质询成功。
-
-#### external_account
-
-EAB（外部帐户绑定）包含将 ACME 帐户绑定或映射到 CA 已知的其他帐户所需的信息。
-
-外部帐户绑定用于将 ACME 帐户与非 ACME 系统中的现有帐户相关联，例如 CA 客户数据库。
-
-为了启用 ACME 帐户绑定，运行 ACME 服务器的 CA 需要使用 ACME 之外的某种机制向 ACME 客户端提供 MAC 密钥和密钥标识符。§7.3.4
-
-#### external_account.key_id
-
-密钥标识符。
-
-#### external_account.mac_key
-
-MAC 密钥。
-
-#### dns01_challenge
-
-ACME DNS01 质询字段。如果配置，将禁用其他质询方法。
-
-参阅 [DNS01 质询字段](/zh/configuration/shared/dns01_challenge/)。
-
-#### key_type
-
-!!! question "自 sing-box 1.14.0 起"
-
-为新证书生成的私钥类型。
-
-| 值         | 类型      |
-|-----------|----------|
-| `ed25519` | Ed25519 |
-| `p256`    | P-256   |
-| `p384`    | P-384   |
-| `rsa2048` | RSA     |
-| `rsa4096` | RSA     |
-
-#### detour
-
-!!! question "自 sing-box 1.14.0 起"
-
-上游出站的标签。
-
-所有提供者 HTTP 请求将使用此出站。

docs/configuration/shared/certificate-provider/cloudflare-origin-ca.md

@@ -1,82 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.14.0"
-
-# Cloudflare Origin CA
-
-### Structure
-
-```json
-{
-  "type": "cloudflare-origin-ca",
-  "tag": "",
-
-  "domain": [],
-  "data_directory": "",
-  "api_token": "",
-  "origin_ca_key": "",
-  "request_type": "",
-  "requested_validity": 0,
-  "detour": ""
-}
-```
-
-### Fields
-
-#### domain
-
-==Required==
-
-List of domain names or wildcard domain names to include in the certificate.
-
-#### data_directory
-
-Root directory used to store the issued certificate, private key, and metadata.
-
-If empty, sing-box uses the same default data directory as the ACME certificate provider:
-`$XDG_DATA_HOME/certmagic` or `$HOME/.local/share/certmagic`.
-
-#### api_token
-
-Cloudflare API token used to create the certificate.
-
-Get or create one in [Cloudflare Dashboard > My Profile > API Tokens](https://dash.cloudflare.com/profile/api-tokens).
-
-Requires the `Zone / SSL and Certificates / Edit` permission.
-
-Conflict with `origin_ca_key`.
-
-#### origin_ca_key
-
-Cloudflare Origin CA Key.
-
-Get it in [Cloudflare Dashboard > My Profile > API Tokens > API Keys > Origin CA Key](https://dash.cloudflare.com/profile/api-tokens).
-
-Conflict with `api_token`.
-
-#### request_type
-
-The signature type to request from Cloudflare.
-
-| Value                | Type        |
-|----------------------|-------------|
-| `origin-rsa`         | RSA         |
-| `origin-ecc`         | ECDSA P-256 |
-
-`origin-rsa` is used if empty.
-
-#### requested_validity
-
-The requested certificate validity in days.
-
-Available values: `7`, `30`, `90`, `365`, `730`, `1095`, `5475`.
-
-`5475` days (15 years) is used if empty.
-
-#### detour
-
-The tag of the upstream outbound.
-
-All provider HTTP requests will use this outbound.

docs/configuration/shared/certificate-provider/cloudflare-origin-ca.zh.md

@@ -1,82 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "自 sing-box 1.14.0 起"
-
-# Cloudflare Origin CA
-
-### 结构
-
-```json
-{
-  "type": "cloudflare-origin-ca",
-  "tag": "",
-
-  "domain": [],
-  "data_directory": "",
-  "api_token": "",
-  "origin_ca_key": "",
-  "request_type": "",
-  "requested_validity": 0,
-  "detour": ""
-}
-```
-
-### 字段
-
-#### domain
-
-==必填==
-
-要写入证书的域名或通配符域名列表。
-
-#### data_directory
-
-保存签发证书、私钥和元数据的根目录。
-
-如果为空，sing-box 会使用与 ACME 证书提供者相同的默认数据目录：
-`$XDG_DATA_HOME/certmagic` 或 `$HOME/.local/share/certmagic`。
-
-#### api_token
-
-用于创建证书的 Cloudflare API Token。
-
-可在 [Cloudflare Dashboard > My Profile > API Tokens](https://dash.cloudflare.com/profile/api-tokens) 获取或创建。
-
-需要 `Zone / SSL and Certificates / Edit` 权限。
-
-与 `origin_ca_key` 冲突。
-
-#### origin_ca_key
-
-Cloudflare Origin CA Key。
-
-可在 [Cloudflare Dashboard > My Profile > API Tokens > API Keys > Origin CA Key](https://dash.cloudflare.com/profile/api-tokens) 获取。
-
-与 `api_token` 冲突。
-
-#### request_type
-
-向 Cloudflare 请求的签名类型。
-
-| 值                   | 类型        |
-|----------------------|-------------|
-| `origin-rsa`         | RSA         |
-| `origin-ecc`         | ECDSA P-256 |
-
-如果为空，使用 `origin-rsa`。
-
-#### requested_validity
-
-请求的证书有效期，单位为天。
-
-可用值：`7`、`30`、`90`、`365`、`730`、`1095`、`5475`。
-
-如果为空，使用 `5475` 天（15 年）。
-
-#### detour
-
-上游出站的标签。
-
-所有提供者 HTTP 请求将使用此出站。

docs/configuration/shared/certificate-provider/index.md

@@ -1,32 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.14.0"
-
-# Certificate Provider
-
-### Structure
-
-```json
-{
-  "certificate_providers": [
-    {
-      "type": "",
-      "tag": ""
-    }
-  ]
-}
-```
-
-### Fields
-
-| Type   | Format           |
-|--------|------------------|
-| `acme` | [ACME](/configuration/shared/certificate-provider/acme)   |
-| `tailscale` | [Tailscale](/configuration/shared/certificate-provider/tailscale) |
-| `cloudflare-origin-ca` | [Cloudflare Origin CA](/configuration/shared/certificate-provider/cloudflare-origin-ca) |
-
-#### tag
-
-The tag of the certificate provider.

docs/configuration/shared/certificate-provider/index.zh.md

@@ -1,32 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "自 sing-box 1.14.0 起"
-
-# 证书提供者
-
-### 结构
-
-```json
-{
-  "certificate_providers": [
-    {
-      "type": "",
-      "tag": ""
-    }
-  ]
-}
-```
-
-### 字段
-
-| 类型   | 格式             |
-|--------|------------------|
-| `acme` | [ACME](/zh/configuration/shared/certificate-provider/acme)   |
-| `tailscale` | [Tailscale](/zh/configuration/shared/certificate-provider/tailscale) |
-| `cloudflare-origin-ca` | [Cloudflare Origin CA](/zh/configuration/shared/certificate-provider/cloudflare-origin-ca) |
-
-#### tag
-
-证书提供者的标签。

docs/configuration/shared/certificate-provider/tailscale.md

@@ -1,27 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.14.0"
-
-# Tailscale
-
-### Structure
-
-```json
-{
-  "type": "tailscale",
-  "tag": "ts-cert",
-  "endpoint": "ts-ep"
-}
-```
-
-### Fields
-
-#### endpoint
-
-==Required==
-
-The tag of the [Tailscale endpoint](/configuration/endpoint/tailscale/) to reuse.
-
-[MagicDNS and HTTPS](https://tailscale.com/kb/1153/enabling-https) must be enabled in the Tailscale admin console.

docs/configuration/shared/certificate-provider/tailscale.zh.md

@@ -1,27 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "自 sing-box 1.14.0 起"
-
-# Tailscale
-
-### 结构
-
-```json
-{
-  "type": "tailscale",
-  "tag": "ts-cert",
-  "endpoint": "ts-ep"
-}
-```
-
-### 字段
-
-#### endpoint
-
-==必填==
-
-要复用的 [Tailscale 端点](/zh/configuration/endpoint/tailscale/) 的标签。
-
-必须在 Tailscale 管理控制台中启用 [MagicDNS 和 HTTPS](https://tailscale.com/kb/1153/enabling-https)。

docs/configuration/shared/dns01_challenge.md

@@ -2,14 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [ttl](#ttl)  
-    :material-plus: [propagation_delay](#propagation_delay)  
-    :material-plus: [propagation_timeout](#propagation_timeout)  
-    :material-plus: [resolvers](#resolvers)  
-    :material-plus: [override_domain](#override_domain)
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [alidns.security_token](#security_token)  
@@ -20,57 +12,12 @@ icon: material/new-box
 
 ```json
 {
-  "ttl": "",
-  "propagation_delay": "",
-  "propagation_timeout": "",
-  "resolvers": [],
-  "override_domain": "",
   "provider": "",
 
   ... // Provider Fields
 }
 ```
 
-### Fields
-
-#### ttl
-
-!!! question "Since sing-box 1.14.0"
-
-The TTL of the temporary TXT record used for the DNS challenge.
-
-#### propagation_delay
-
-!!! question "Since sing-box 1.14.0"
-
-How long to wait after creating the challenge record before starting propagation checks.
-
-#### propagation_timeout
-
-!!! question "Since sing-box 1.14.0"
-
-The maximum time to wait for the challenge record to propagate.
-
-Set to `-1` to disable propagation checks.
-
-#### resolvers
-
-!!! question "Since sing-box 1.14.0"
-
-Preferred DNS resolvers to use for DNS propagation checks.
-
-#### override_domain
-
-!!! question "Since sing-box 1.14.0"
-
-Override the domain name used for the DNS challenge record.
-
-Useful when `_acme-challenge` is delegated to a different zone.
-
-#### provider
-
-The DNS provider. See below for provider-specific fields.
-
 ### Provider Fields
 
 #### Alibaba Cloud DNS

docs/configuration/shared/dns01_challenge.zh.md

@@ -2,14 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [ttl](#ttl)  
-    :material-plus: [propagation_delay](#propagation_delay)  
-    :material-plus: [propagation_timeout](#propagation_timeout)  
-    :material-plus: [resolvers](#resolvers)  
-    :material-plus: [override_domain](#override_domain)
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [alidns.security_token](#security_token)  
@@ -20,57 +12,12 @@ icon: material/new-box
 
 ```json
 {
-  "ttl": "",
-  "propagation_delay": "",
-  "propagation_timeout": "",
-  "resolvers": [],
-  "override_domain": "",
   "provider": "",
 
   ... // 提供商字段
 }
 ```
 
-### 字段
-
-#### ttl
-
-!!! question "自 sing-box 1.14.0 起"
-
-DNS 质询临时 TXT 记录的 TTL。
-
-#### propagation_delay
-
-!!! question "自 sing-box 1.14.0 起"
-
-创建质询记录后，在开始传播检查前要等待的时间。
-
-#### propagation_timeout
-
-!!! question "自 sing-box 1.14.0 起"
-
-等待质询记录传播完成的最长时间。
-
-设为 `-1` 可禁用传播检查。
-
-#### resolvers
-
-!!! question "自 sing-box 1.14.0 起"
-
-进行 DNS 传播检查时优先使用的 DNS 解析器。
-
-#### override_domain
-
-!!! question "自 sing-box 1.14.0 起"
-
-覆盖 DNS 质询记录使用的域名。
-
-适用于将 `_acme-challenge` 委托到其他 zone 的场景。
-
-#### provider
-
-DNS 提供商。提供商专有字段见下文。
-
 ### 提供商字段
 
 #### Alibaba Cloud DNS

docs/configuration/shared/neighbor.md

@@ -1,49 +0,0 @@
----
-icon: material/lan
----
-
-# Neighbor Resolution
-
-Match LAN devices by MAC address and hostname using
-[`source_mac_address`](/configuration/route/rule/#source_mac_address) and
-[`source_hostname`](/configuration/route/rule/#source_hostname) rule items.
-
-Neighbor resolution is automatically enabled when these rule items exist.
-Use [`route.find_neighbor`](/configuration/route/#find_neighbor) to force enable it for logging without rules.
-
-## Linux
-
-Works natively. No special setup required.
-
-Hostname resolution requires DHCP lease files,
-automatically detected from common DHCP servers (dnsmasq, odhcpd, ISC dhcpd, Kea).
-Custom paths can be set via [`route.dhcp_lease_files`](/configuration/route/#dhcp_lease_files).
-
-## Android
-
-!!! quote ""
-
-    Only supported in graphical clients.
-
-Requires Android 11 or above and ROOT.
-
-Must use [VPNHotspot](https://github.com/Mygod/VPNHotspot) to share the VPN connection.
-ROM built-in features like "Use VPN for connected devices" can share VPN
-but cannot provide MAC address or hostname information.
-
-Set **IP Masquerade Mode** to **None** in VPNHotspot settings.
-
-Only route/DNS rules are supported. TUN include/exclude routes are not supported.
-
-### Hostname Visibility
-
-Hostname is only visible in sing-box if it is visible in VPNHotspot.
-For Apple devices, change **Private Wi-Fi Address** from **Rotating** to **Fixed** in the Wi-Fi settings
-of the connected network. Non-Apple devices are always visible.
-
-## macOS
-
-Requires the standalone version (macOS system extension).
-The App Store version can share the VPN as a hotspot but does not support MAC address or hostname reading.
-
-See [VPN Hotspot](/manual/misc/vpn-hotspot/#macos) for Internet Sharing setup.

docs/configuration/shared/neighbor.zh.md

@@ -1,49 +0,0 @@
----
-icon: material/lan
----
-
-# 邻居解析
-
-通过
-[`source_mac_address`](/configuration/route/rule/#source_mac_address) 和
-[`source_hostname`](/configuration/route/rule/#source_hostname) 规则项匹配局域网设备的 MAC 地址和主机名。
-
-当这些规则项存在时，邻居解析自动启用。
-使用 [`route.find_neighbor`](/configuration/route/#find_neighbor) 可在没有规则时强制启用以输出日志。
-
-## Linux
-
-原生支持，无需特殊设置。
-
-主机名解析需要 DHCP 租约文件，
-自动从常见 DHCP 服务器（dnsmasq、odhcpd、ISC dhcpd、Kea）检测。
-可通过 [`route.dhcp_lease_files`](/configuration/route/#dhcp_lease_files) 设置自定义路径。
-
-## Android
-
-!!! quote ""
-
-    仅在图形客户端中支持。
-
-需要 Android 11 或以上版本和 ROOT。
-
-必须使用 [VPNHotspot](https://github.com/Mygod/VPNHotspot) 共享 VPN 连接。
-ROM 自带的「通过 VPN 共享连接」等功能可以共享 VPN，
-但无法提供 MAC 地址或主机名信息。
-
-在 VPNHotspot 设置中将 **IP 遮掩模式** 设为 **无**。
-
-仅支持路由/DNS 规则。不支持 TUN 的 include/exclude 路由。
-
-### 设备可见性
-
-MAC 地址和主机名仅在 VPNHotspot 中可见时 sing-box 才能读取。
-对于 Apple 设备，需要在所连接网络的 Wi-Fi 设置中将**私有无线局域网地址**从**轮替**改为**固定**。
-非 Apple 设备始终可见。
-
-## macOS
-
-需要独立版本（macOS 系统扩展）。
-App Store 版本可以共享 VPN 热点但不支持 MAC 地址或主机名读取。
-
-参阅 [VPN 热点](/manual/misc/vpn-hotspot/#macos) 了解互联网共享设置。

docs/configuration/shared/tls.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "Changes in sing-box 1.14.0"
-
-    :material-plus: [certificate_provider](#certificate_provider)  
-    :material-delete-clock: [acme](#acme-fields)
-
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [kernel_tx](#kernel_tx)  
@@ -54,10 +49,6 @@ icon: material/new-box
   "key_path": "",
   "kernel_tx": false,
   "kernel_rx": false,
-  "certificate_provider": "",
-
-  // Deprecated
-
   "acme": {
     "domain": [],
     "data_directory": "",
@@ -417,18 +408,6 @@ Enable kernel TLS transmit support.
 
 Enable kernel TLS receive support.
 
-#### certificate_provider
-
-!!! question "Since sing-box 1.14.0"
-
-==Server only==
-
-A string or an object.
-
-When string, the tag of a shared [Certificate Provider](/configuration/shared/certificate-provider/).
-
-When object, an inline certificate provider. See [Certificate Provider](/configuration/shared/certificate-provider/) for available types and fields.
-
 ## Custom TLS support
 
 !!! info "QUIC support"
@@ -490,7 +469,7 @@ The ECH key and configuration can be generated by `sing-box generate ech-keypair
 
 !!! failure "Deprecated in sing-box 1.12.0"
 
-    `pq_signature_schemes_enabled` is deprecated in sing-box 1.12.0 and removed in sing-box 1.13.0.
+    ECH support has been migrated to use stdlib in sing-box 1.12.0, which does not come with support for PQ signature schemes, so `pq_signature_schemes_enabled` has been deprecated and no longer works.
 
 Enable support for post-quantum peer certificate signature schemes.
 
@@ -498,7 +477,7 @@ Enable support for post-quantum peer certificate signature schemes.
 
 !!! failure "Deprecated in sing-box 1.12.0"
 
-    `dynamic_record_sizing_disabled` is deprecated in sing-box 1.12.0 and removed in sing-box 1.13.0.
+    `dynamic_record_sizing_disabled` has nothing to do with ECH, was added by mistake, has been deprecated and no longer works.
 
 Disables adaptive sizing of TLS records.
 
@@ -587,10 +566,6 @@ Fragment TLS handshake into multiple TLS records to bypass firewalls.
 
 ### ACME Fields
 
-!!! failure "Deprecated in sing-box 1.14.0"
-
-    Inline ACME options are deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0, check [Migration](/migration/#migrate-inline-acme-to-certificate-provider).
-
 #### domain
 
 List of domain.
@@ -702,4 +677,4 @@ A hexadecimal string with zero to eight digits.
 
 The maximum time difference between the server and the client.
 
-Check disabled if empty.
+Check disabled if empty.

docs/configuration/shared/tls.zh.md

@@ -2,11 +2,6 @@
 icon: material/new-box
 ---
 
-!!! quote "sing-box 1.14.0 中的更改"
-
-    :material-plus: [certificate_provider](#certificate_provider)  
-    :material-delete-clock: [acme](#acme-字段)
-
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [kernel_tx](#kernel_tx)  
@@ -54,10 +49,6 @@ icon: material/new-box
   "key_path": "",
   "kernel_tx": false,
   "kernel_rx": false,
-  "certificate_provider": "",
-
-  // 废弃的
-
   "acme": {
     "domain": [],
     "data_directory": "",
@@ -416,18 +407,6 @@ echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/
 
 启用内核 TLS 接收支持。
 
-#### certificate_provider
-
-!!! question "自 sing-box 1.14.0 起"
-
-==仅服务器==
-
-字符串或对象。
-
-为字符串时，共享[证书提供者](/zh/configuration/shared/certificate-provider/)的标签。
-
-为对象时，内联的证书提供者。可用类型和字段参阅[证书提供者](/zh/configuration/shared/certificate-provider/)。
-
 ## 自定义 TLS 支持
 
 !!! info "QUIC 支持"
@@ -486,7 +465,7 @@ ECH 密钥和配置可以通过 `sing-box generate ech-keypair` 生成。
 
 !!! failure "已在 sing-box 1.12.0 废弃"
 
-    `pq_signature_schemes_enabled` 已在 sing-box 1.12.0 废弃且已在 sing-box 1.13.0 中被移除。
+    ECH 支持已在 sing-box 1.12.0 迁移至使用标准库，但标准库不支持后量子对等证书签名方案，因此 `pq_signature_schemes_enabled` 已被弃用且不再工作。
 
 启用对后量子对等证书签名方案的支持。
 
@@ -494,7 +473,7 @@ ECH 密钥和配置可以通过 `sing-box generate ech-keypair` 生成。
 
 !!! failure "已在 sing-box 1.12.0 废弃"
 
-    `dynamic_record_sizing_disabled` 已在 sing-box 1.12.0 废弃且已在 sing-box 1.13.0 中被移除。
+    `dynamic_record_sizing_disabled` 与 ECH 无关，是错误添加的，现已弃用且不再工作。
 
 禁用 TLS 记录的自适应大小调整。
 
@@ -582,10 +561,6 @@ ECH 配置路径，PEM 格式。
 
 ### ACME 字段
 
-!!! failure "已在 sing-box 1.14.0 废弃"
-
-    内联 ACME 选项已在 sing-box 1.14.0 废弃且将在 sing-box 1.16.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移内联-acme-到证书提供者)。
-
 #### domain
 
 域名列表。

docs/deprecated.md

@@ -4,16 +4,6 @@ icon: material/delete-alert
 
 # Deprecated Feature List
 
-## 1.14.0
-
-#### Inline ACME options in TLS
-
-Inline ACME options (`tls.acme`) are deprecated
-and can be replaced by the ACME certificate provider,
-check [Migration](../migration/#migrate-inline-acme-to-certificate-provider).
-
-Old fields will be removed in sing-box 1.16.0.
-
 ## 1.12.0
 
 #### Legacy DNS server formats
@@ -38,7 +28,7 @@ so `pq_signature_schemes_enabled` has been deprecated and no longer works.
 Also, `dynamic_record_sizing_disabled` has nothing to do with ECH,
 was added by mistake, has been deprecated and no longer works.
 
-These fields were removed in sing-box 1.13.0.
+These fields will be removed in sing-box 1.13.0.
 
 ## 1.11.0
 
@@ -48,7 +38,7 @@ Legacy special outbounds (`block` / `dns`) are deprecated
 and can be replaced by rule actions,
 check [Migration](../migration/#migrate-legacy-special-outbounds-to-rule-actions).
 
-Old fields were removed in sing-box 1.13.0.
+Old fields will be removed in sing-box 1.13.0.
 
 #### Legacy inbound fields
 
@@ -56,7 +46,7 @@ Legacy inbound fields （`inbound.<sniff/domain_strategy/...>` are deprecated
 and can be replaced by rule actions,
 check [Migration](../migration/#migrate-legacy-inbound-fields-to-rule-actions).
 
-Old fields were removed in sing-box 1.13.0.
+Old fields will be removed in sing-box 1.13.0.
 
 #### Destination override fields in direct outbound
 
@@ -64,20 +54,18 @@ Destination override fields (`override_address` / `override_port`) in direct out
 and can be replaced by rule actions,
 check [Migration](../migration/#migrate-destination-override-fields-to-route-options).
 
-Old fields were removed in sing-box 1.13.0.
-
 #### WireGuard outbound
 
 WireGuard outbound is deprecated and can be replaced by endpoint,
 check [Migration](../migration/#migrate-wireguard-outbound-to-endpoint).
 
-Old outbound was removed in sing-box 1.13.0.
+Old outbound will be removed in sing-box 1.13.0.
 
 #### GSO option in TUN
 
 GSO has no advantages for transparent proxy scenarios, is deprecated and no longer works in TUN.
 
-Old fields were removed in sing-box 1.13.0.
+Old fields will be removed in sing-box 1.13.0.
 
 ## 1.10.0
 
@@ -87,12 +75,12 @@ Old fields were removed in sing-box 1.13.0.
 `inet4_route_address` and `inet6_route_address` are merged into `route_address`,
 `inet4_route_exclude_address` and `inet6_route_exclude_address` are merged into `route_exclude_address`.
 
-Old fields were removed in sing-box 1.12.0.
+Old fields will be removed in sing-box 1.12.0.
 
 #### Match source rule items are renamed
 
 `rule_set_ipcidr_match_source` route and DNS rule items are renamed to
-`rule_set_ip_cidr_match_source` and were removed in sing-box 1.11.0.
+`rule_set_ip_cidr_match_source` and will be remove in sing-box 1.11.0.
 
 #### Drop support for go1.18 and go1.19
 
@@ -107,7 +95,7 @@ check [Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-o
 
 #### GeoIP
 
-GeoIP is deprecated and was removed in sing-box 1.12.0.
+GeoIP is deprecated and will be removed in sing-box 1.12.0.
 
 The maxmind GeoIP National Database, as an IP classification database,
 is not entirely suitable for traffic bypassing,
@@ -118,7 +106,7 @@ check [Migration](/migration/#migrate-geoip-to-rule-sets).
 
 #### Geosite
 
-Geosite is deprecated and was removed in sing-box 1.12.0.
+Geosite is deprecated and will be removed in sing-box 1.12.0.
 
 Geosite, the `domain-list-community` project maintained by V2Ray as an early traffic bypassing solution,
 suffers from a number of problems, including lack of maintenance, inaccurate rules, and difficult management.

docs/deprecated.zh.md

@@ -4,18 +4,6 @@ icon: material/delete-alert
 
 # 废弃功能列表
 
-## 1.14.0
-
-#### TLS 中的内联 ACME 选项
-
-TLS 中的内联 ACME 选项（`tls.acme`）已废弃，
-且可以通过 ACME 证书提供者替代，
-参阅 [迁移指南](/zh/migration/#迁移内联-acme-到证书提供者)。
-
-旧字段将在 sing-box 1.16.0 中被移除。
-
-## 1.12.0
-
 #### 旧的 DNS 服务器格式
 
 DNS 服务器已重构，
@@ -36,7 +24,7 @@ ECH 支持已在 sing-box 1.12.0 迁移至使用标准库，但标准库不支
 
 另外，`dynamic_record_sizing_disabled` 与 ECH 无关，是错误添加的，现已弃用且不再工作。
 
-相关字段已在 sing-box 1.13.0 中被移除。
+相关字段将在 sing-box 1.13.0 中被移除。
 
 ## 1.11.0
 
@@ -45,41 +33,41 @@ ECH 支持已在 sing-box 1.12.0 迁移至使用标准库，但标准库不支
 旧的特殊出站（`block` / `dns`）已废弃且可以通过规则动作替代，
 参阅 [迁移指南](/zh/migration/#迁移旧的特殊出站到规则动作)。
 
-旧字段已在 sing-box 1.13.0 中被移除。
+旧字段将在 sing-box 1.13.0 中被移除。
 
 #### 旧的入站字段
 
 旧的入站字段（`inbound.<sniff/domain_strategy/...>`）已废弃且可以通过规则动作替代，
 参阅 [迁移指南](/zh/migration/#迁移旧的入站字段到规则动作)。
 
-旧字段已在 sing-box 1.13.0 中被移除。
+旧字段将在 sing-box 1.13.0 中被移除。
 
 #### direct 出站中的目标地址覆盖字段
 
 direct 出站中的目标地址覆盖字段（`override_address` / `override_port`）已废弃且可以通过规则动作替代，
 参阅 [迁移指南](/zh/migration/#迁移-direct-出站中的目标地址覆盖字段到路由字段)。
 
-旧字段已在 sing-box 1.13.0 中被移除。
+旧字段将在 sing-box 1.13.0 中被移除。
 
 #### WireGuard 出站
 
 WireGuard 出站已废弃且可以通过端点替代，
 参阅 [迁移指南](/zh/migration/#迁移-wireguard-出站到端点)。
 
-旧出站已在 sing-box 1.13.0 中被移除。
+旧出站将在 sing-box 1.13.0 中被移除。
 
 #### TUN 的 GSO 字段
 
 GSO 对透明代理场景没有优势，已废弃且在 TUN 中不再起作用。
 
-旧字段已在 sing-box 1.13.0 中被移除。
+旧字段将在 sing-box 1.13.0 中被移除。
 
 ## 1.10.0
 
 #### Match source 规则项已重命名
 
 `rule_set_ipcidr_match_source` 路由和 DNS 规则项已被重命名为
-`rule_set_ip_cidr_match_source` 且已在 sing-box 1.11.0 中被移除。
+`rule_set_ip_cidr_match_source` 且将在 sing-box 1.11.0 中被移除。
 
 #### TUN 地址字段已合并
 
@@ -87,7 +75,7 @@ GSO 对透明代理场景没有优势，已废弃且在 TUN 中不再起作用
 `inet4_route_address` 和 `inet6_route_address` 已合并为 `route_address`，
 `inet4_route_exclude_address` 和 `inet6_route_exclude_address` 已合并为 `route_exclude_address`。
 
-旧字段已在 sing-box 1.12.0 中被移除。
+旧字段将在 sing-box 1.11.0 中被移除。
 
 #### 移除对 go1.18 和 go1.19 的支持
 
@@ -102,7 +90,7 @@ Clash API 中的 `cache_file` 及相关功能已废弃且已迁移到独立的 `
 
 #### GeoIP
 
-GeoIP 已废弃且已在 sing-box 1.12.0 中被移除。
+GeoIP 已废弃且将在 sing-box 1.12.0 中被移除。
 
 maxmind GeoIP 国家数据库作为 IP 分类数据库，不完全适合流量绕过，
 且现有的实现均存在内存使用大与管理困难的问题。
@@ -112,7 +100,7 @@ sing-box 1.8.0 引入了[规则集](/zh/configuration/rule-set/)，
 
 #### Geosite
 
-Geosite 已废弃且已在 sing-box 1.12.0 中被移除。
+Geosite 已废弃且将在 sing-box 1.12.0 中被移除。
 
 Geosite，即由 V2Ray 维护的 domain-list-community 项目，作为早期流量绕过解决方案，
 存在着包括缺少维护、规则不准确和管理困难内的大量问题。

docs/migration.md

@@ -2,83 +2,6 @@
 icon: material/arrange-bring-forward
 ---
 
-## 1.14.0
-
-### Migrate inline ACME to certificate provider
-
-Inline ACME options in TLS are deprecated and can be replaced by certificate providers.
-
-Most `tls.acme` fields can be moved into the ACME certificate provider unchanged.
-See [ACME](/configuration/shared/certificate-provider/acme/) for fields newly added in sing-box 1.14.0.
-
-!!! info "References"
-
-    [TLS](/configuration/shared/tls/#certificate_provider) /
-    [Certificate Provider](/configuration/shared/certificate-provider/)
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "acme": {
-              "domain": ["example.com"],
-              "email": "admin@example.com"
-            }
-          }
-        }
-      ]
-    }
-    ```
-
-=== ":material-card-multiple: Inline"
-
-    ```json
-    {
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "certificate_provider": {
-              "type": "acme",
-              "domain": ["example.com"],
-              "email": "admin@example.com"
-            }
-          }
-        }
-      ]
-    }
-    ```
-
-=== ":material-card-multiple: Shared"
-
-    ```json
-    {
-      "certificate_providers": [
-        {
-          "type": "acme",
-          "tag": "my-cert",
-          "domain": ["example.com"],
-          "email": "admin@example.com"
-        }
-      ],
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "certificate_provider": "my-cert"
-          }
-        }
-      ]
-    }
-    ```
-
 ## 1.12.0
 
 ### Migrate to new DNS server formats

docs/migration.zh.md

@@ -2,83 +2,6 @@
 icon: material/arrange-bring-forward
 ---
 
-## 1.14.0
-
-### 迁移内联 ACME 到证书提供者
-
-TLS 中的内联 ACME 选项已废弃，且可以被证书提供者替代。
-
-`tls.acme` 的大多数字段都可以原样迁移到 ACME 证书提供者中。
-sing-box 1.14.0 新增字段参阅 [ACME](/zh/configuration/shared/certificate-provider/acme/) 页面。
-
-!!! info "参考"
-
-    [TLS](/zh/configuration/shared/tls/#certificate_provider) /
-    [证书提供者](/zh/configuration/shared/certificate-provider/)
-
-=== ":material-card-remove: 弃用的"
-
-    ```json
-    {
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "acme": {
-              "domain": ["example.com"],
-              "email": "admin@example.com"
-            }
-          }
-        }
-      ]
-    }
-    ```
-
-=== ":material-card-multiple: 内联"
-
-    ```json
-    {
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "certificate_provider": {
-              "type": "acme",
-              "domain": ["example.com"],
-              "email": "admin@example.com"
-            }
-          }
-        }
-      ]
-    }
-    ```
-
-=== ":material-card-multiple: 共享"
-
-    ```json
-    {
-      "certificate_providers": [
-        {
-          "type": "acme",
-          "tag": "my-cert",
-          "domain": ["example.com"],
-          "email": "admin@example.com"
-        }
-      ],
-      "inbounds": [
-        {
-          "type": "trojan",
-          "tls": {
-            "enabled": true,
-            "certificate_provider": "my-cert"
-          }
-        }
-      ]
-    }
-    ```
-
 ## 1.12.0
 
 ### 迁移到新的 DNS 服务器格式

experimental/deprecated/constants.go

@@ -102,20 +102,10 @@ var OptionLegacyDomainStrategyOptions = Note{
 	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-domain-strategy-options",
 }
 
-var OptionInlineACME = Note{
-	Name:              "inline-acme-options",
-	Description:       "inline ACME options in TLS",
-	DeprecatedVersion: "1.14.0",
-	ScheduledVersion:  "1.16.0",
-	EnvName:           "INLINE_ACME_OPTIONS",
-	MigrationLink:     "https://sing-box.sagernet.org/migration/#migrate-inline-acme-to-certificate-provider",
-}
-
 var Options = []Note{
 	OptionLegacyDNSTransport,
 	OptionLegacyDNSFakeIPOptions,
 	OptionOutboundDNSRuleItem,
 	OptionMissingDomainResolver,
 	OptionLegacyDomainStrategyOptions,
-	OptionInlineACME,
 }

experimental/libbox/command_client.go

@@ -540,31 +540,6 @@ func (c *CommandClient) SetSystemProxyEnabled(isEnabled bool) error {
 	return err
 }
 
-func (c *CommandClient) TriggerGoCrash() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerDebugCrash(context.Background(), &daemon.DebugCrashRequest{
-			Type: daemon.DebugCrashRequest_GO,
-		})
-	})
-	return err
-}
-
-func (c *CommandClient) TriggerNativeCrash() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerDebugCrash(context.Background(), &daemon.DebugCrashRequest{
-			Type: daemon.DebugCrashRequest_NATIVE,
-		})
-	})
-	return err
-}
-
-func (c *CommandClient) TriggerOOMReport() error {
-	_, err := callWithResult(c, func(client daemon.StartedServiceClient) (*emptypb.Empty, error) {
-		return client.TriggerOOMReport(context.Background(), &emptypb.Empty{})
-	})
-	return err
-}
-
 func (c *CommandClient) GetDeprecatedNotes() (DeprecatedNoteIterator, error) {
 	return callWithResult(c, func(client daemon.StartedServiceClient) (DeprecatedNoteIterator, error) {
 		warnings, err := client.GetDeprecatedWarnings(context.Background(), &emptypb.Empty{})

experimental/libbox/command_server.go

@@ -39,7 +39,6 @@ type CommandServerHandler interface {
 	ServiceReload() error
 	GetSystemProxyStatus() (*SystemProxyStatus, error)
 	SetSystemProxyEnabled(enabled bool) error
-	TriggerNativeCrash() error
 	WriteDebugMessage(message string)
 }
 
@@ -58,12 +57,10 @@ func NewCommandServer(handler CommandServerHandler, platformInterface PlatformIn
 	server.StartedService = daemon.NewStartedService(daemon.ServiceOptions{
 		Context: ctx,
 		// Platform:         platformWrapper,
-		Handler:           (*platformHandler)(server),
-		Debug:             sDebug,
-		LogMaxLines:       sLogMaxLines,
-		OOMKillerEnabled:  sOOMKillerEnabled,
-		OOMKillerDisabled: sOOMKillerDisabled,
-		OOMMemoryLimit:    uint64(sOOMMemoryLimit),
+		Handler:     (*platformHandler)(server),
+		Debug:       sDebug,
+		LogMaxLines: sLogMaxLines,
+		OOMKiller:   memoryLimitEnabled,
 		// WorkingDirectory: sWorkingPath,
 		// TempDirectory:    sTempPath,
 		// UserID:           sUserID,
@@ -173,16 +170,11 @@ type OverrideOptions struct {
 }
 
 func (s *CommandServer) StartOrReloadService(configContent string, options *OverrideOptions) error {
-	saveConfigSnapshot(configContent)
-	err := s.StartedService.StartOrReloadService(configContent, &daemon.OverrideOptions{
+	return s.StartedService.StartOrReloadService(configContent, &daemon.OverrideOptions{
 		AutoRedirect:   options.AutoRedirect,
 		IncludePackage: iteratorToArray(options.IncludePackage),
 		ExcludePackage: iteratorToArray(options.ExcludePackage),
 	})
-	if err != nil {
-		return err
-	}
-	return nil
 }
 
 func (s *CommandServer) CloseService() error {
@@ -279,10 +271,6 @@ func (h *platformHandler) SetSystemProxyEnabled(enabled bool) error {
 	return (*CommandServer)(h).handler.SetSystemProxyEnabled(enabled)
 }
 
-func (h *platformHandler) TriggerNativeCrash() error {
-	return (*CommandServer)(h).handler.TriggerNativeCrash()
-}
-
 func (h *platformHandler) WriteDebugMessage(message string) {
 	(*CommandServer)(h).handler.WriteDebugMessage(message)
 }

experimental/libbox/config.go

@@ -12,7 +12,6 @@ import (
 	"github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-box/service/oomkiller"
 	tun "github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -23,8 +22,6 @@ import (
 	"github.com/sagernet/sing/service/filemanager"
 )
 
-var sOOMReporter oomkiller.OOMReporter
-
 func baseContext(platformInterface PlatformInterface) context.Context {
 	dnsRegistry := include.DNSTransportRegistry()
 	if platformInterface != nil {
@@ -36,10 +33,7 @@ func baseContext(platformInterface PlatformInterface) context.Context {
 	}
 	ctx := context.Background()
 	ctx = filemanager.WithDefault(ctx, sWorkingPath, sTempPath, sUserID, sGroupID)
-	if sOOMReporter != nil {
-		ctx = service.ContextWith[oomkiller.OOMReporter](ctx, sOOMReporter)
-	}
-	return box.Context(ctx, include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry(), dnsRegistry, include.ServiceRegistry(), include.CertificateProviderRegistry())
+	return box.Context(ctx, include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry(), dnsRegistry, include.ServiceRegistry())
 }
 
 func parseConfig(ctx context.Context, configContent string) (option.Options, error) {
@@ -150,18 +144,6 @@ func (s *platformInterfaceStub) SendNotification(notification *adapter.Notificat
 	return nil
 }
 
-func (s *platformInterfaceStub) UsePlatformNeighborResolver() bool {
-	return false
-}
-
-func (s *platformInterfaceStub) StartNeighborMonitor(listener adapter.NeighborUpdateListener) error {
-	return os.ErrInvalid
-}
-
-func (s *platformInterfaceStub) CloseNeighborMonitor(listener adapter.NeighborUpdateListener) error {
-	return nil
-}
-
 func (s *platformInterfaceStub) UsePlatformLocalDNSTransport() bool {
 	return false
 }

experimental/libbox/debug.go

@@ -1,9 +0,0 @@
-package libbox
-
-import "time"
-
-func TriggerGoPanic() {
-	time.AfterFunc(200*time.Millisecond, func() {
-		panic("debug go crash")
-	})
-}

experimental/libbox/internal/oomprofile/builder.go

@@ -1,390 +0,0 @@
-//go:build darwin || linux || windows
-
-package oomprofile
-
-import (
-	"fmt"
-	"io"
-	"runtime"
-	"time"
-)
-
-const (
-	tagProfile_SampleType        = 1
-	tagProfile_Sample            = 2
-	tagProfile_Mapping           = 3
-	tagProfile_Location          = 4
-	tagProfile_Function          = 5
-	tagProfile_StringTable       = 6
-	tagProfile_TimeNanos         = 9
-	tagProfile_PeriodType        = 11
-	tagProfile_Period            = 12
-	tagProfile_DefaultSampleType = 14
-
-	tagValueType_Type = 1
-	tagValueType_Unit = 2
-
-	tagSample_Location = 1
-	tagSample_Value    = 2
-	tagSample_Label    = 3
-
-	tagLabel_Key = 1
-	tagLabel_Str = 2
-	tagLabel_Num = 3
-
-	tagMapping_ID              = 1
-	tagMapping_Start           = 2
-	tagMapping_Limit           = 3
-	tagMapping_Offset          = 4
-	tagMapping_Filename        = 5
-	tagMapping_BuildID         = 6
-	tagMapping_HasFunctions    = 7
-	tagMapping_HasFilenames    = 8
-	tagMapping_HasLineNumbers  = 9
-	tagMapping_HasInlineFrames = 10
-
-	tagLocation_ID        = 1
-	tagLocation_MappingID = 2
-	tagLocation_Address   = 3
-	tagLocation_Line      = 4
-
-	tagLine_FunctionID = 1
-	tagLine_Line       = 2
-
-	tagFunction_ID         = 1
-	tagFunction_Name       = 2
-	tagFunction_SystemName = 3
-	tagFunction_Filename   = 4
-	tagFunction_StartLine  = 5
-)
-
-type memMap struct {
-	start   uintptr
-	end     uintptr
-	offset  uint64
-	file    string
-	buildID string
-	funcs   symbolizeFlag
-	fake    bool
-}
-
-type symbolizeFlag uint8
-
-const (
-	lookupTried symbolizeFlag = 1 << iota
-	lookupFailed
-)
-
-func newProfileBuilder(w io.Writer) *profileBuilder {
-	builder := &profileBuilder{
-		start:     time.Now(),
-		w:         w,
-		strings:   []string{""},
-		stringMap: map[string]int{"": 0},
-		locs:      map[uintptr]locInfo{},
-		funcs:     map[string]int{},
-	}
-	builder.readMapping()
-	return builder
-}
-
-func (b *profileBuilder) stringIndex(s string) int64 {
-	id, ok := b.stringMap[s]
-	if !ok {
-		id = len(b.strings)
-		b.strings = append(b.strings, s)
-		b.stringMap[s] = id
-	}
-	return int64(id)
-}
-
-func (b *profileBuilder) flush() {
-	const dataFlush = 4096
-	if b.err != nil || b.pb.nest != 0 || len(b.pb.data) <= dataFlush {
-		return
-	}
-
-	_, b.err = b.w.Write(b.pb.data)
-	b.pb.data = b.pb.data[:0]
-}
-
-func (b *profileBuilder) pbValueType(tag int, typ string, unit string) {
-	start := b.pb.startMessage()
-	b.pb.int64(tagValueType_Type, b.stringIndex(typ))
-	b.pb.int64(tagValueType_Unit, b.stringIndex(unit))
-	b.pb.endMessage(tag, start)
-}
-
-func (b *profileBuilder) pbSample(values []int64, locs []uint64, labels func()) {
-	start := b.pb.startMessage()
-	b.pb.int64s(tagSample_Value, values)
-	b.pb.uint64s(tagSample_Location, locs)
-	if labels != nil {
-		labels()
-	}
-	b.pb.endMessage(tagProfile_Sample, start)
-	b.flush()
-}
-
-func (b *profileBuilder) pbLabel(tag int, key string, str string, num int64) {
-	start := b.pb.startMessage()
-	b.pb.int64Opt(tagLabel_Key, b.stringIndex(key))
-	b.pb.int64Opt(tagLabel_Str, b.stringIndex(str))
-	b.pb.int64Opt(tagLabel_Num, num)
-	b.pb.endMessage(tag, start)
-}
-
-func (b *profileBuilder) pbLine(tag int, funcID uint64, line int64) {
-	start := b.pb.startMessage()
-	b.pb.uint64Opt(tagLine_FunctionID, funcID)
-	b.pb.int64Opt(tagLine_Line, line)
-	b.pb.endMessage(tag, start)
-}
-
-func (b *profileBuilder) pbMapping(tag int, id uint64, base uint64, limit uint64, offset uint64, file string, buildID string, hasFuncs bool) {
-	start := b.pb.startMessage()
-	b.pb.uint64Opt(tagMapping_ID, id)
-	b.pb.uint64Opt(tagMapping_Start, base)
-	b.pb.uint64Opt(tagMapping_Limit, limit)
-	b.pb.uint64Opt(tagMapping_Offset, offset)
-	b.pb.int64Opt(tagMapping_Filename, b.stringIndex(file))
-	b.pb.int64Opt(tagMapping_BuildID, b.stringIndex(buildID))
-	if hasFuncs {
-		b.pb.bool(tagMapping_HasFunctions, true)
-	}
-	b.pb.endMessage(tag, start)
-}
-
-func (b *profileBuilder) build() error {
-	if b.err != nil {
-		return b.err
-	}
-
-	b.pb.int64Opt(tagProfile_TimeNanos, b.start.UnixNano())
-	for i, mapping := range b.mem {
-		hasFunctions := mapping.funcs == lookupTried
-		b.pbMapping(tagProfile_Mapping, uint64(i+1), uint64(mapping.start), uint64(mapping.end), mapping.offset, mapping.file, mapping.buildID, hasFunctions)
-	}
-	b.pb.strings(tagProfile_StringTable, b.strings)
-	if b.err != nil {
-		return b.err
-	}
-	_, err := b.w.Write(b.pb.data)
-	return err
-}
-
-func allFrames(addr uintptr) ([]runtime.Frame, symbolizeFlag) {
-	frames := runtime.CallersFrames([]uintptr{addr})
-	frame, more := frames.Next()
-	if frame.Function == "runtime.goexit" {
-		return nil, 0
-	}
-
-	result := lookupTried
-	if frame.PC == 0 || frame.Function == "" || frame.File == "" || frame.Line == 0 {
-		result |= lookupFailed
-	}
-	if frame.PC == 0 {
-		frame.PC = addr - 1
-	}
-
-	ret := []runtime.Frame{frame}
-	for frame.Function != "runtime.goexit" && more {
-		frame, more = frames.Next()
-		ret = append(ret, frame)
-	}
-	return ret, result
-}
-
-type locInfo struct {
-	id uint64
-
-	pcs []uintptr
-
-	firstPCFrames          []runtime.Frame
-	firstPCSymbolizeResult symbolizeFlag
-}
-
-func (b *profileBuilder) appendLocsForStack(locs []uint64, stk []uintptr) []uint64 {
-	b.deck.reset()
-	origStk := stk
-	stk = runtimeExpandFinalInlineFrame(stk)
-
-	for len(stk) > 0 {
-		addr := stk[0]
-		if loc, ok := b.locs[addr]; ok {
-			if len(b.deck.pcs) > 0 {
-				if b.deck.tryAdd(addr, loc.firstPCFrames, loc.firstPCSymbolizeResult) {
-					stk = stk[1:]
-					continue
-				}
-			}
-			if id := b.emitLocation(); id > 0 {
-				locs = append(locs, id)
-			}
-			locs = append(locs, loc.id)
-			if len(loc.pcs) > len(stk) {
-				panic(fmt.Sprintf("stack too short to match cached location; stk = %#x, loc.pcs = %#x, original stk = %#x", stk, loc.pcs, origStk))
-			}
-			stk = stk[len(loc.pcs):]
-			continue
-		}
-
-		frames, symbolizeResult := allFrames(addr)
-		if len(frames) == 0 {
-			if id := b.emitLocation(); id > 0 {
-				locs = append(locs, id)
-			}
-			stk = stk[1:]
-			continue
-		}
-
-		if b.deck.tryAdd(addr, frames, symbolizeResult) {
-			stk = stk[1:]
-			continue
-		}
-		if id := b.emitLocation(); id > 0 {
-			locs = append(locs, id)
-		}
-
-		if loc, ok := b.locs[addr]; ok {
-			locs = append(locs, loc.id)
-			stk = stk[len(loc.pcs):]
-		} else {
-			b.deck.tryAdd(addr, frames, symbolizeResult)
-			stk = stk[1:]
-		}
-	}
-	if id := b.emitLocation(); id > 0 {
-		locs = append(locs, id)
-	}
-	return locs
-}
-
-type pcDeck struct {
-	pcs             []uintptr
-	frames          []runtime.Frame
-	symbolizeResult symbolizeFlag
-
-	firstPCFrames          int
-	firstPCSymbolizeResult symbolizeFlag
-}
-
-func (d *pcDeck) reset() {
-	d.pcs = d.pcs[:0]
-	d.frames = d.frames[:0]
-	d.symbolizeResult = 0
-	d.firstPCFrames = 0
-	d.firstPCSymbolizeResult = 0
-}
-
-func (d *pcDeck) tryAdd(pc uintptr, frames []runtime.Frame, symbolizeResult symbolizeFlag) bool {
-	if existing := len(d.frames); existing > 0 {
-		newFrame := frames[0]
-		last := d.frames[existing-1]
-		if last.Func != nil {
-			return false
-		}
-		if last.Entry == 0 || newFrame.Entry == 0 {
-			return false
-		}
-		if last.Entry != newFrame.Entry {
-			return false
-		}
-		if runtimeFrameSymbolName(&last) == runtimeFrameSymbolName(&newFrame) {
-			return false
-		}
-	}
-
-	d.pcs = append(d.pcs, pc)
-	d.frames = append(d.frames, frames...)
-	d.symbolizeResult |= symbolizeResult
-	if len(d.pcs) == 1 {
-		d.firstPCFrames = len(d.frames)
-		d.firstPCSymbolizeResult = symbolizeResult
-	}
-	return true
-}
-
-func (b *profileBuilder) emitLocation() uint64 {
-	if len(b.deck.pcs) == 0 {
-		return 0
-	}
-	defer b.deck.reset()
-
-	addr := b.deck.pcs[0]
-	firstFrame := b.deck.frames[0]
-
-	type newFunc struct {
-		id        uint64
-		name      string
-		file      string
-		startLine int64
-	}
-
-	newFuncs := make([]newFunc, 0, 8)
-	id := uint64(len(b.locs)) + 1
-	b.locs[addr] = locInfo{
-		id:                     id,
-		pcs:                    append([]uintptr{}, b.deck.pcs...),
-		firstPCFrames:          append([]runtime.Frame{}, b.deck.frames[:b.deck.firstPCFrames]...),
-		firstPCSymbolizeResult: b.deck.firstPCSymbolizeResult,
-	}
-
-	start := b.pb.startMessage()
-	b.pb.uint64Opt(tagLocation_ID, id)
-	b.pb.uint64Opt(tagLocation_Address, uint64(firstFrame.PC))
-	for _, frame := range b.deck.frames {
-		funcName := runtimeFrameSymbolName(&frame)
-		funcID := uint64(b.funcs[funcName])
-		if funcID == 0 {
-			funcID = uint64(len(b.funcs)) + 1
-			b.funcs[funcName] = int(funcID)
-			newFuncs = append(newFuncs, newFunc{
-				id:        funcID,
-				name:      funcName,
-				file:      frame.File,
-				startLine: int64(runtimeFrameStartLine(&frame)),
-			})
-		}
-		b.pbLine(tagLocation_Line, funcID, int64(frame.Line))
-	}
-	for i := range b.mem {
-		if (b.mem[i].start <= addr && addr < b.mem[i].end) || b.mem[i].fake {
-			b.pb.uint64Opt(tagLocation_MappingID, uint64(i+1))
-			mapping := b.mem[i]
-			mapping.funcs |= b.deck.symbolizeResult
-			b.mem[i] = mapping
-			break
-		}
-	}
-	b.pb.endMessage(tagProfile_Location, start)
-
-	for _, fn := range newFuncs {
-		start := b.pb.startMessage()
-		b.pb.uint64Opt(tagFunction_ID, fn.id)
-		b.pb.int64Opt(tagFunction_Name, b.stringIndex(fn.name))
-		b.pb.int64Opt(tagFunction_SystemName, b.stringIndex(fn.name))
-		b.pb.int64Opt(tagFunction_Filename, b.stringIndex(fn.file))
-		b.pb.int64Opt(tagFunction_StartLine, fn.startLine)
-		b.pb.endMessage(tagProfile_Function, start)
-	}
-
-	b.flush()
-	return id
-}
-
-func (b *profileBuilder) addMapping(lo uint64, hi uint64, offset uint64, file string, buildID string) {
-	b.addMappingEntry(lo, hi, offset, file, buildID, false)
-}
-
-func (b *profileBuilder) addMappingEntry(lo uint64, hi uint64, offset uint64, file string, buildID string, fake bool) {
-	b.mem = append(b.mem, memMap{
-		start:   uintptr(lo),
-		end:     uintptr(hi),
-		offset:  offset,
-		file:    file,
-		buildID: buildID,
-		fake:    fake,
-	})
-}

experimental/libbox/internal/oomprofile/defs_darwin_amd64.go

@@ -1,24 +0,0 @@
-//go:build darwin && amd64
-
-package oomprofile
-
-type machVMRegionBasicInfoData struct {
-	Protection     int32
-	MaxProtection  int32
-	Inheritance    uint32
-	Shared         uint32
-	Reserved       uint32
-	Offset         [8]byte
-	Behavior       int32
-	UserWiredCount uint16
-	PadCgo1        [2]byte
-}
-
-const (
-	_VM_PROT_READ    = 0x1
-	_VM_PROT_EXECUTE = 0x4
-
-	_MACH_SEND_INVALID_DEST = 0x10000003
-
-	_MAXPATHLEN = 0x400
-)

experimental/libbox/internal/oomprofile/defs_darwin_arm64.go

@@ -1,24 +0,0 @@
-//go:build darwin && arm64
-
-package oomprofile
-
-type machVMRegionBasicInfoData struct {
-	Protection     int32
-	MaxProtection  int32
-	Inheritance    uint32
-	Shared         int32
-	Reserved       int32
-	Offset         [8]byte
-	Behavior       int32
-	UserWiredCount uint16
-	PadCgo1        [2]byte
-}
-
-const (
-	_VM_PROT_READ    = 0x1
-	_VM_PROT_EXECUTE = 0x4
-
-	_MACH_SEND_INVALID_DEST = 0x10000003
-
-	_MAXPATHLEN = 0x400
-)

experimental/libbox/internal/oomprofile/linkname.go

@@ -1,47 +0,0 @@
-//go:build darwin || linux || windows
-
-package oomprofile
-
-import (
-	"runtime"
-	_ "runtime/pprof"
-	"unsafe"
-
-	_ "unsafe"
-)
-
-//go:linkname runtimeMemProfileInternal runtime.pprof_memProfileInternal
-func runtimeMemProfileInternal(p []memProfileRecord, inuseZero bool) (n int, ok bool)
-
-//go:linkname runtimeBlockProfileInternal runtime.pprof_blockProfileInternal
-func runtimeBlockProfileInternal(p []blockProfileRecord) (n int, ok bool)
-
-//go:linkname runtimeMutexProfileInternal runtime.pprof_mutexProfileInternal
-func runtimeMutexProfileInternal(p []blockProfileRecord) (n int, ok bool)
-
-//go:linkname runtimeThreadCreateInternal runtime.pprof_threadCreateInternal
-func runtimeThreadCreateInternal(p []stackRecord) (n int, ok bool)
-
-//go:linkname runtimeGoroutineProfileWithLabels runtime.pprof_goroutineProfileWithLabels
-func runtimeGoroutineProfileWithLabels(p []stackRecord, labels []unsafe.Pointer) (n int, ok bool)
-
-//go:linkname runtimeCyclesPerSecond runtime/pprof.runtime_cyclesPerSecond
-func runtimeCyclesPerSecond() int64
-
-//go:linkname runtimeMakeProfStack runtime.pprof_makeProfStack
-func runtimeMakeProfStack() []uintptr
-
-//go:linkname runtimeFrameStartLine runtime/pprof.runtime_FrameStartLine
-func runtimeFrameStartLine(f *runtime.Frame) int
-
-//go:linkname runtimeFrameSymbolName runtime/pprof.runtime_FrameSymbolName
-func runtimeFrameSymbolName(f *runtime.Frame) string
-
-//go:linkname runtimeExpandFinalInlineFrame runtime/pprof.runtime_expandFinalInlineFrame
-func runtimeExpandFinalInlineFrame(stk []uintptr) []uintptr
-
-//go:linkname stdParseProcSelfMaps runtime/pprof.parseProcSelfMaps
-func stdParseProcSelfMaps(data []byte, addMapping func(lo uint64, hi uint64, offset uint64, file string, buildID string))
-
-//go:linkname stdELFBuildID runtime/pprof.elfBuildID
-func stdELFBuildID(file string) (string, error)

experimental/libbox/internal/oomprofile/mapping_darwin.go

@@ -1,57 +0,0 @@
-//go:build darwin
-
-package oomprofile
-
-import (
-	"encoding/binary"
-	"os"
-	"unsafe"
-
-	_ "unsafe"
-)
-
-func isExecutable(protection int32) bool {
-	return (protection&_VM_PROT_EXECUTE) != 0 && (protection&_VM_PROT_READ) != 0
-}
-
-func (b *profileBuilder) readMapping() {
-	if !machVMInfo(b.addMapping) {
-		b.addMappingEntry(0, 0, 0, "", "", true)
-	}
-}
-
-func machVMInfo(addMapping func(lo uint64, hi uint64, off uint64, file string, buildID string)) bool {
-	added := false
-	addr := uint64(0x1)
-	for {
-		var regionSize uint64
-		var info machVMRegionBasicInfoData
-		kr := machVMRegion(&addr, &regionSize, unsafe.Pointer(&info))
-		if kr != 0 {
-			if kr == _MACH_SEND_INVALID_DEST {
-				return true
-			}
-			return added
-		}
-		if isExecutable(info.Protection) {
-			addMapping(addr, addr+regionSize, binary.LittleEndian.Uint64(info.Offset[:]), regionFilename(addr), "")
-			added = true
-		}
-		addr += regionSize
-	}
-}
-
-func regionFilename(address uint64) string {
-	buf := make([]byte, _MAXPATHLEN)
-	n := procRegionFilename(os.Getpid(), address, unsafe.SliceData(buf), int64(cap(buf)))
-	if n == 0 {
-		return ""
-	}
-	return string(buf[:n])
-}
-
-//go:linkname machVMRegion runtime/pprof.mach_vm_region
-func machVMRegion(address *uint64, regionSize *uint64, info unsafe.Pointer) int32
-
-//go:linkname procRegionFilename runtime/pprof.proc_regionfilename
-func procRegionFilename(pid int, address uint64, buf *byte, buflen int64) int32

experimental/libbox/internal/oomprofile/mapping_linux.go

@@ -1,13 +0,0 @@
-//go:build linux
-
-package oomprofile
-
-import "os"
-
-func (b *profileBuilder) readMapping() {
-	data, _ := os.ReadFile("/proc/self/maps")
-	stdParseProcSelfMaps(data, b.addMapping)
-	if len(b.mem) == 0 {
-		b.addMappingEntry(0, 0, 0, "", "", true)
-	}
-}

experimental/libbox/internal/oomprofile/mapping_windows.go

@@ -1,58 +0,0 @@
-//go:build windows
-
-package oomprofile
-
-import (
-	"errors"
-	"os"
-
-	"golang.org/x/sys/windows"
-)
-
-func (b *profileBuilder) readMapping() {
-	snapshot, err := createModuleSnapshot()
-	if err != nil {
-		b.addMappingEntry(0, 0, 0, "", "", true)
-		return
-	}
-	defer windows.CloseHandle(snapshot)
-
-	var module windows.ModuleEntry32
-	module.Size = uint32(windows.SizeofModuleEntry32)
-	err = windows.Module32First(snapshot, &module)
-	if err != nil {
-		b.addMappingEntry(0, 0, 0, "", "", true)
-		return
-	}
-	for err == nil {
-		exe := windows.UTF16ToString(module.ExePath[:])
-		b.addMappingEntry(
-			uint64(module.ModBaseAddr),
-			uint64(module.ModBaseAddr)+uint64(module.ModBaseSize),
-			0,
-			exe,
-			peBuildID(exe),
-			false,
-		)
-		err = windows.Module32Next(snapshot, &module)
-	}
-}
-
-func createModuleSnapshot() (windows.Handle, error) {
-	for {
-		snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPMODULE|windows.TH32CS_SNAPMODULE32, uint32(windows.GetCurrentProcessId()))
-		var errno windows.Errno
-		if err != nil && errors.As(err, &errno) && errno == windows.ERROR_BAD_LENGTH {
-			continue
-		}
-		return snapshot, err
-	}
-}
-
-func peBuildID(file string) string {
-	info, err := os.Stat(file)
-	if err != nil {
-		return file
-	}
-	return file + info.ModTime().String()
-}

experimental/libbox/internal/oomprofile/oomprofile.go

@@ -1,380 +0,0 @@
-//go:build darwin || linux || windows
-
-package oomprofile
-
-import (
-	"fmt"
-	"io"
-	"math"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sort"
-	"strings"
-	"time"
-	"unsafe"
-)
-
-type stackRecord struct {
-	Stack []uintptr
-}
-
-type memProfileRecord struct {
-	AllocBytes, FreeBytes     int64
-	AllocObjects, FreeObjects int64
-	Stack                     []uintptr
-}
-
-func (r *memProfileRecord) InUseBytes() int64 {
-	return r.AllocBytes - r.FreeBytes
-}
-
-func (r *memProfileRecord) InUseObjects() int64 {
-	return r.AllocObjects - r.FreeObjects
-}
-
-type blockProfileRecord struct {
-	Count  int64
-	Cycles int64
-	Stack  []uintptr
-}
-
-type label struct {
-	key   string
-	value string
-}
-
-type labelSet struct {
-	list []label
-}
-
-type labelMap struct {
-	labelSet
-}
-
-func WriteFile(destPath string, name string) (string, error) {
-	writer, ok := profileWriters[name]
-	if !ok {
-		return "", fmt.Errorf("unsupported profile %q", name)
-	}
-
-	filePath := filepath.Join(destPath, name+".pb")
-	file, err := os.Create(filePath)
-	if err != nil {
-		return "", err
-	}
-	defer file.Close()
-
-	if err := writer(file); err != nil {
-		_ = os.Remove(filePath)
-		return "", err
-	}
-	if err := file.Close(); err != nil {
-		_ = os.Remove(filePath)
-		return "", err
-	}
-	return filePath, nil
-}
-
-var profileWriters = map[string]func(io.Writer) error{
-	"allocs":       writeAlloc,
-	"block":        writeBlock,
-	"goroutine":    writeGoroutine,
-	"heap":         writeHeap,
-	"mutex":        writeMutex,
-	"threadcreate": writeThreadCreate,
-}
-
-func writeHeap(w io.Writer) error {
-	return writeHeapInternal(w, "")
-}
-
-func writeAlloc(w io.Writer) error {
-	return writeHeapInternal(w, "alloc_space")
-}
-
-func writeHeapInternal(w io.Writer, defaultSampleType string) error {
-	var profile []memProfileRecord
-	n, ok := runtimeMemProfileInternal(nil, true)
-	for {
-		profile = make([]memProfileRecord, n+50)
-		n, ok = runtimeMemProfileInternal(profile, true)
-		if ok {
-			profile = profile[:n]
-			break
-		}
-	}
-	return writeHeapProto(w, profile, int64(runtime.MemProfileRate), defaultSampleType)
-}
-
-func writeGoroutine(w io.Writer) error {
-	return writeRuntimeProfile(w, "goroutine", runtimeGoroutineProfileWithLabels)
-}
-
-func writeThreadCreate(w io.Writer) error {
-	return writeRuntimeProfile(w, "threadcreate", func(p []stackRecord, _ []unsafe.Pointer) (int, bool) {
-		return runtimeThreadCreateInternal(p)
-	})
-}
-
-func writeRuntimeProfile(w io.Writer, name string, fetch func([]stackRecord, []unsafe.Pointer) (int, bool)) error {
-	var profile []stackRecord
-	var labels []unsafe.Pointer
-
-	n, ok := fetch(nil, nil)
-	for {
-		profile = make([]stackRecord, n+10)
-		labels = make([]unsafe.Pointer, n+10)
-		n, ok = fetch(profile, labels)
-		if ok {
-			profile = profile[:n]
-			labels = labels[:n]
-			break
-		}
-	}
-
-	return writeCountProfile(w, name, &runtimeProfile{profile, labels})
-}
-
-func writeBlock(w io.Writer) error {
-	return writeCycleProfile(w, "contentions", "delay", runtimeBlockProfileInternal)
-}
-
-func writeMutex(w io.Writer) error {
-	return writeCycleProfile(w, "contentions", "delay", runtimeMutexProfileInternal)
-}
-
-func writeCycleProfile(w io.Writer, countName string, cycleName string, fetch func([]blockProfileRecord) (int, bool)) error {
-	var profile []blockProfileRecord
-	n, ok := fetch(nil)
-	for {
-		profile = make([]blockProfileRecord, n+50)
-		n, ok = fetch(profile)
-		if ok {
-			profile = profile[:n]
-			break
-		}
-	}
-
-	sort.Slice(profile, func(i, j int) bool {
-		return profile[i].Cycles > profile[j].Cycles
-	})
-
-	builder := newProfileBuilder(w)
-	builder.pbValueType(tagProfile_PeriodType, countName, "count")
-	builder.pb.int64Opt(tagProfile_Period, 1)
-	builder.pbValueType(tagProfile_SampleType, countName, "count")
-	builder.pbValueType(tagProfile_SampleType, cycleName, "nanoseconds")
-
-	cpuGHz := float64(runtimeCyclesPerSecond()) / 1e9
-	values := []int64{0, 0}
-	var locs []uint64
-	expandedStack := runtimeMakeProfStack()
-	for _, record := range profile {
-		values[0] = record.Count
-		if cpuGHz > 0 {
-			values[1] = int64(float64(record.Cycles) / cpuGHz)
-		} else {
-			values[1] = 0
-		}
-		n := expandInlinedFrames(expandedStack, record.Stack)
-		locs = builder.appendLocsForStack(locs[:0], expandedStack[:n])
-		builder.pbSample(values, locs, nil)
-	}
-
-	return builder.build()
-}
-
-type countProfile interface {
-	Len() int
-	Stack(i int) []uintptr
-	Label(i int) *labelMap
-}
-
-type runtimeProfile struct {
-	stk    []stackRecord
-	labels []unsafe.Pointer
-}
-
-func (p *runtimeProfile) Len() int {
-	return len(p.stk)
-}
-
-func (p *runtimeProfile) Stack(i int) []uintptr {
-	return p.stk[i].Stack
-}
-
-func (p *runtimeProfile) Label(i int) *labelMap {
-	return (*labelMap)(p.labels[i])
-}
-
-func writeCountProfile(w io.Writer, name string, profile countProfile) error {
-	var buf strings.Builder
-	key := func(stk []uintptr, labels *labelMap) string {
-		buf.Reset()
-		buf.WriteByte('@')
-		for _, pc := range stk {
-			fmt.Fprintf(&buf, " %#x", pc)
-		}
-		if labels != nil {
-			buf.WriteString("\n# labels:")
-			for _, label := range labels.list {
-				fmt.Fprintf(&buf, " %q:%q", label.key, label.value)
-			}
-		}
-		return buf.String()
-	}
-
-	counts := make(map[string]int)
-	index := make(map[string]int)
-	var keys []string
-	for i := 0; i < profile.Len(); i++ {
-		k := key(profile.Stack(i), profile.Label(i))
-		if counts[k] == 0 {
-			index[k] = i
-			keys = append(keys, k)
-		}
-		counts[k]++
-	}
-
-	sort.Sort(&keysByCount{keys: keys, count: counts})
-
-	builder := newProfileBuilder(w)
-	builder.pbValueType(tagProfile_PeriodType, name, "count")
-	builder.pb.int64Opt(tagProfile_Period, 1)
-	builder.pbValueType(tagProfile_SampleType, name, "count")
-
-	values := []int64{0}
-	var locs []uint64
-	for _, k := range keys {
-		values[0] = int64(counts[k])
-		idx := index[k]
-		locs = builder.appendLocsForStack(locs[:0], profile.Stack(idx))
-
-		var labels func()
-		if profile.Label(idx) != nil {
-			labels = func() {
-				for _, label := range profile.Label(idx).list {
-					builder.pbLabel(tagSample_Label, label.key, label.value, 0)
-				}
-			}
-		}
-		builder.pbSample(values, locs, labels)
-	}
-
-	return builder.build()
-}
-
-type keysByCount struct {
-	keys  []string
-	count map[string]int
-}
-
-func (x *keysByCount) Len() int {
-	return len(x.keys)
-}
-
-func (x *keysByCount) Swap(i int, j int) {
-	x.keys[i], x.keys[j] = x.keys[j], x.keys[i]
-}
-
-func (x *keysByCount) Less(i int, j int) bool {
-	ki, kj := x.keys[i], x.keys[j]
-	ci, cj := x.count[ki], x.count[kj]
-	if ci != cj {
-		return ci > cj
-	}
-	return ki < kj
-}
-
-func expandInlinedFrames(dst []uintptr, pcs []uintptr) int {
-	frames := runtime.CallersFrames(pcs)
-	var n int
-	for n < len(dst) {
-		frame, more := frames.Next()
-		dst[n] = frame.PC + 1
-		n++
-		if !more {
-			break
-		}
-	}
-	return n
-}
-
-func writeHeapProto(w io.Writer, profile []memProfileRecord, rate int64, defaultSampleType string) error {
-	builder := newProfileBuilder(w)
-	builder.pbValueType(tagProfile_PeriodType, "space", "bytes")
-	builder.pb.int64Opt(tagProfile_Period, rate)
-	builder.pbValueType(tagProfile_SampleType, "alloc_objects", "count")
-	builder.pbValueType(tagProfile_SampleType, "alloc_space", "bytes")
-	builder.pbValueType(tagProfile_SampleType, "inuse_objects", "count")
-	builder.pbValueType(tagProfile_SampleType, "inuse_space", "bytes")
-	if defaultSampleType != "" {
-		builder.pb.int64Opt(tagProfile_DefaultSampleType, builder.stringIndex(defaultSampleType))
-	}
-
-	values := []int64{0, 0, 0, 0}
-	var locs []uint64
-	for _, record := range profile {
-		hideRuntime := true
-		for tries := 0; tries < 2; tries++ {
-			stk := record.Stack
-			if hideRuntime {
-				for i, addr := range stk {
-					if f := runtime.FuncForPC(addr); f != nil && (strings.HasPrefix(f.Name(), "runtime.") || strings.HasPrefix(f.Name(), "internal/runtime/")) {
-						continue
-					}
-					stk = stk[i:]
-					break
-				}
-			}
-			locs = builder.appendLocsForStack(locs[:0], stk)
-			if len(locs) > 0 {
-				break
-			}
-			hideRuntime = false
-		}
-
-		values[0], values[1] = scaleHeapSample(record.AllocObjects, record.AllocBytes, rate)
-		values[2], values[3] = scaleHeapSample(record.InUseObjects(), record.InUseBytes(), rate)
-
-		var blockSize int64
-		if record.AllocObjects > 0 {
-			blockSize = record.AllocBytes / record.AllocObjects
-		}
-		builder.pbSample(values, locs, func() {
-			if blockSize != 0 {
-				builder.pbLabel(tagSample_Label, "bytes", "", blockSize)
-			}
-		})
-	}
-
-	return builder.build()
-}
-
-func scaleHeapSample(count int64, size int64, rate int64) (int64, int64) {
-	if count == 0 || size == 0 {
-		return 0, 0
-	}
-	if rate <= 1 {
-		return count, size
-	}
-
-	avgSize := float64(size) / float64(count)
-	scale := 1 / (1 - math.Exp(-avgSize/float64(rate)))
-	return int64(float64(count) * scale), int64(float64(size) * scale)
-}
-
-type profileBuilder struct {
-	start time.Time
-	w     io.Writer
-	err   error
-
-	pb        protobuf
-	strings   []string
-	stringMap map[string]int
-	locs      map[uintptr]locInfo
-	funcs     map[string]int
-	mem       []memMap
-	deck      pcDeck
-}

experimental/libbox/internal/oomprofile/protobuf.go

@@ -1,120 +0,0 @@
-//go:build darwin || linux || windows
-
-package oomprofile
-
-type protobuf struct {
-	data []byte
-	tmp  [16]byte
-	nest int
-}
-
-func (b *protobuf) varint(x uint64) {
-	for x >= 128 {
-		b.data = append(b.data, byte(x)|0x80)
-		x >>= 7
-	}
-	b.data = append(b.data, byte(x))
-}
-
-func (b *protobuf) length(tag int, length int) {
-	b.varint(uint64(tag)<<3 | 2)
-	b.varint(uint64(length))
-}
-
-func (b *protobuf) uint64(tag int, x uint64) {
-	b.varint(uint64(tag)<<3 | 0)
-	b.varint(x)
-}
-
-func (b *protobuf) uint64s(tag int, x []uint64) {
-	if len(x) > 2 {
-		n1 := len(b.data)
-		for _, u := range x {
-			b.varint(u)
-		}
-		n2 := len(b.data)
-		b.length(tag, n2-n1)
-		n3 := len(b.data)
-		copy(b.tmp[:], b.data[n2:n3])
-		copy(b.data[n1+(n3-n2):], b.data[n1:n2])
-		copy(b.data[n1:], b.tmp[:n3-n2])
-		return
-	}
-	for _, u := range x {
-		b.uint64(tag, u)
-	}
-}
-
-func (b *protobuf) uint64Opt(tag int, x uint64) {
-	if x == 0 {
-		return
-	}
-	b.uint64(tag, x)
-}
-
-func (b *protobuf) int64(tag int, x int64) {
-	b.uint64(tag, uint64(x))
-}
-
-func (b *protobuf) int64Opt(tag int, x int64) {
-	if x == 0 {
-		return
-	}
-	b.int64(tag, x)
-}
-
-func (b *protobuf) int64s(tag int, x []int64) {
-	if len(x) > 2 {
-		n1 := len(b.data)
-		for _, u := range x {
-			b.varint(uint64(u))
-		}
-		n2 := len(b.data)
-		b.length(tag, n2-n1)
-		n3 := len(b.data)
-		copy(b.tmp[:], b.data[n2:n3])
-		copy(b.data[n1+(n3-n2):], b.data[n1:n2])
-		copy(b.data[n1:], b.tmp[:n3-n2])
-		return
-	}
-	for _, u := range x {
-		b.int64(tag, u)
-	}
-}
-
-func (b *protobuf) bool(tag int, x bool) {
-	if x {
-		b.uint64(tag, 1)
-	} else {
-		b.uint64(tag, 0)
-	}
-}
-
-func (b *protobuf) string(tag int, x string) {
-	b.length(tag, len(x))
-	b.data = append(b.data, x...)
-}
-
-func (b *protobuf) strings(tag int, x []string) {
-	for _, s := range x {
-		b.string(tag, s)
-	}
-}
-
-type msgOffset int
-
-func (b *protobuf) startMessage() msgOffset {
-	b.nest++
-	return msgOffset(len(b.data))
-}
-
-func (b *protobuf) endMessage(tag int, start msgOffset) {
-	n1 := int(start)
-	n2 := len(b.data)
-	b.length(tag, n2-n1)
-	n3 := len(b.data)
-	copy(b.tmp[:], b.data[n2:n3])
-	copy(b.data[n1+(n3-n2):], b.data[n1:n2])
-	copy(b.data[n1:], b.tmp[:n3-n2])
-	b.nest--
-}

experimental/libbox/log.go

@@ -1,76 +1,24 @@
-//go:build darwin || linux || windows
+//go:build darwin || linux
 
 package libbox
 
 import (
-	"archive/zip"
-	"io"
-	"io/fs"
 	"os"
-	"path/filepath"
 	"runtime"
 	"runtime/debug"
-	"time"
 )
 
-type crashReportMetadata struct {
-	reportMetadata
-	CrashedAt       string `json:"crashedAt,omitempty"`
-	SignalName      string `json:"signalName,omitempty"`
-	SignalCode      string `json:"signalCode,omitempty"`
-	ExceptionName   string `json:"exceptionName,omitempty"`
-	ExceptionReason string `json:"exceptionReason,omitempty"`
-}
+var crashOutputFile *os.File
 
-func archiveCrashReport(path string, crashReportsDir string) {
-	content, err := os.ReadFile(path)
-	if err != nil || len(content) == 0 {
-		return
+func RedirectStderr(path string) error {
+	if stats, err := os.Stat(path); err == nil && stats.Size() > 0 {
+		_ = os.Rename(path, path+".old")
 	}
-
-	info, _ := os.Stat(path)
-	crashTime := time.Now().UTC()
-	if info != nil {
-		crashTime = info.ModTime().UTC()
-	}
-
-	initReportDir(crashReportsDir)
-	destPath, err := nextAvailableReportPath(crashReportsDir, crashTime)
-	if err != nil {
-		return
-	}
-	initReportDir(destPath)
-
-	writeReportFile(destPath, "go.log", content)
-	metadata := crashReportMetadata{
-		reportMetadata: baseReportMetadata(),
-		CrashedAt:      crashTime.Format(time.RFC3339),
-	}
-	writeReportMetadata(destPath, metadata)
-	os.Remove(path)
-	copyConfigSnapshot(destPath)
-}
-
-func configSnapshotPath() string {
-	return filepath.Join(sBasePath, "configuration.json")
-}
-
-func saveConfigSnapshot(configContent string) {
-	snapshotPath := configSnapshotPath()
-	os.WriteFile(snapshotPath, []byte(configContent), 0o666)
-	chownReport(snapshotPath)
-}
-
-func redirectStderr(path string) error {
-	crashReportsDir := filepath.Join(sWorkingPath, "crash_reports")
-	archiveCrashReport(path, crashReportsDir)
-	archiveCrashReport(path+".old", crashReportsDir)
-
 	outputFile, err := os.Create(path)
 	if err != nil {
 		return err
 	}
-	if runtime.GOOS != "android" && runtime.GOOS != "windows" {
+	if runtime.GOOS != "android" {
 		err = outputFile.Chown(sUserID, sGroupID)
 		if err != nil {
 			outputFile.Close()
@@ -78,88 +26,12 @@ func redirectStderr(path string) error {
 			return err
 		}
 	}
-
 	err = debug.SetCrashOutput(outputFile, debug.CrashOptions{})
 	if err != nil {
 		outputFile.Close()
 		os.Remove(outputFile.Name())
 		return err
 	}
-	_ = outputFile.Close()
+	crashOutputFile = outputFile
 	return nil
 }
-
-func CreateZipArchive(sourcePath string, destinationPath string) error {
-	sourceInfo, err := os.Stat(sourcePath)
-	if err != nil {
-		return err
-	}
-	if !sourceInfo.IsDir() {
-		return os.ErrInvalid
-	}
-
-	destinationFile, err := os.Create(destinationPath)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		_ = destinationFile.Close()
-	}()
-
-	zipWriter := zip.NewWriter(destinationFile)
-
-	rootName := filepath.Base(sourcePath)
-	err = filepath.WalkDir(sourcePath, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-
-		relativePath, err := filepath.Rel(sourcePath, path)
-		if err != nil {
-			return err
-		}
-		if relativePath == "." {
-			return nil
-		}
-
-		archivePath := filepath.ToSlash(filepath.Join(rootName, relativePath))
-		if d.IsDir() {
-			_, err = zipWriter.Create(archivePath + "/")
-			return err
-		}
-
-		fileInfo, err := d.Info()
-		if err != nil {
-			return err
-		}
-		header, err := zip.FileInfoHeader(fileInfo)
-		if err != nil {
-			return err
-		}
-		header.Name = archivePath
-		header.Method = zip.Deflate
-
-		writer, err := zipWriter.CreateHeader(header)
-		if err != nil {
-			return err
-		}
-
-		sourceFile, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-
-		_, err = io.Copy(writer, sourceFile)
-		closeErr := sourceFile.Close()
-		if err != nil {
-			return err
-		}
-		return closeErr
-	})
-	if err != nil {
-		_ = zipWriter.Close()
-		return err
-	}
-
-	return zipWriter.Close()
-}

experimental/libbox/memory.go

@@ -0,0 +1,26 @@
+package libbox
+
+import (
+	"math"
+	runtimeDebug "runtime/debug"
+
+	C "github.com/sagernet/sing-box/constant"
+)
+
+var memoryLimitEnabled bool
+
+func SetMemoryLimit(enabled bool) {
+	memoryLimitEnabled = enabled
+	const memoryLimitGo = 45 * 1024 * 1024
+	if enabled {
+		runtimeDebug.SetGCPercent(10)
+		if C.IsIos {
+			runtimeDebug.SetMemoryLimit(memoryLimitGo)
+		}
+	} else {
+		runtimeDebug.SetGCPercent(100)
+		if C.IsIos {
+			runtimeDebug.SetMemoryLimit(math.MaxInt64)
+		}
+	}
+}

experimental/libbox/neighbor.go

@@ -1,53 +0,0 @@
-package libbox
-
-import (
-	"net"
-	"net/netip"
-)
-
-type NeighborEntry struct {
-	Address    string
-	MacAddress string
-	Hostname   string
-}
-
-type NeighborEntryIterator interface {
-	Next() *NeighborEntry
-	HasNext() bool
-}
-
-type NeighborSubscription struct {
-	done chan struct{}
-}
-
-func (s *NeighborSubscription) Close() {
-	close(s.done)
-}
-
-func tableToIterator(table map[netip.Addr]net.HardwareAddr) NeighborEntryIterator {
-	entries := make([]*NeighborEntry, 0, len(table))
-	for address, mac := range table {
-		entries = append(entries, &NeighborEntry{
-			Address:    address.String(),
-			MacAddress: mac.String(),
-		})
-	}
-	return &neighborEntryIterator{entries}
-}
-
-type neighborEntryIterator struct {
-	entries []*NeighborEntry
-}
-
-func (i *neighborEntryIterator) HasNext() bool {
-	return len(i.entries) > 0
-}
-
-func (i *neighborEntryIterator) Next() *NeighborEntry {
-	if len(i.entries) == 0 {
-		return nil
-	}
-	entry := i.entries[0]
-	i.entries = i.entries[1:]
-	return entry
-}

experimental/libbox/neighbor_darwin.go

@@ -1,123 +0,0 @@
-//go:build darwin
-
-package libbox
-
-import (
-	"net"
-	"net/netip"
-	"os"
-	"slices"
-	"time"
-
-	"github.com/sagernet/sing-box/route"
-	"github.com/sagernet/sing/common/buf"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	xroute "golang.org/x/net/route"
-	"golang.org/x/sys/unix"
-)
-
-func SubscribeNeighborTable(listener NeighborUpdateListener) (*NeighborSubscription, error) {
-	entries, err := route.ReadNeighborEntries()
-	if err != nil {
-		return nil, E.Cause(err, "initial neighbor dump")
-	}
-	table := make(map[netip.Addr]net.HardwareAddr)
-	for _, entry := range entries {
-		table[entry.Address] = entry.MACAddress
-	}
-	listener.UpdateNeighborTable(tableToIterator(table))
-	routeSocket, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
-	if err != nil {
-		return nil, E.Cause(err, "open route socket")
-	}
-	err = unix.SetNonblock(routeSocket, true)
-	if err != nil {
-		unix.Close(routeSocket)
-		return nil, E.Cause(err, "set route socket nonblock")
-	}
-	subscription := &NeighborSubscription{
-		done: make(chan struct{}),
-	}
-	go subscription.loop(listener, routeSocket, table)
-	return subscription, nil
-}
-
-func (s *NeighborSubscription) loop(listener NeighborUpdateListener, routeSocket int, table map[netip.Addr]net.HardwareAddr) {
-	routeSocketFile := os.NewFile(uintptr(routeSocket), "route")
-	defer routeSocketFile.Close()
-	buffer := buf.NewPacket()
-	defer buffer.Release()
-	for {
-		select {
-		case <-s.done:
-			return
-		default:
-		}
-		tv := unix.NsecToTimeval(int64(3 * time.Second))
-		_ = unix.SetsockoptTimeval(routeSocket, unix.SOL_SOCKET, unix.SO_RCVTIMEO, &tv)
-		n, err := routeSocketFile.Read(buffer.FreeBytes())
-		if err != nil {
-			if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
-				continue
-			}
-			select {
-			case <-s.done:
-				return
-			default:
-			}
-			continue
-		}
-		messages, err := xroute.ParseRIB(xroute.RIBTypeRoute, buffer.FreeBytes()[:n])
-		if err != nil {
-			continue
-		}
-		changed := false
-		for _, message := range messages {
-			routeMessage, isRouteMessage := message.(*xroute.RouteMessage)
-			if !isRouteMessage {
-				continue
-			}
-			if routeMessage.Flags&unix.RTF_LLINFO == 0 {
-				continue
-			}
-			address, mac, isDelete, ok := route.ParseRouteNeighborMessage(routeMessage)
-			if !ok {
-				continue
-			}
-			if isDelete {
-				if _, exists := table[address]; exists {
-					delete(table, address)
-					changed = true
-				}
-			} else {
-				existing, exists := table[address]
-				if !exists || !slices.Equal(existing, mac) {
-					table[address] = mac
-					changed = true
-				}
-			}
-		}
-		if changed {
-			listener.UpdateNeighborTable(tableToIterator(table))
-		}
-	}
-}
-
-func ReadBootpdLeases() NeighborEntryIterator {
-	leaseIPToMAC, ipToHostname, macToHostname := route.ReloadLeaseFiles([]string{"/var/db/dhcpd_leases"})
-	entries := make([]*NeighborEntry, 0, len(leaseIPToMAC))
-	for address, mac := range leaseIPToMAC {
-		entry := &NeighborEntry{
-			Address:    address.String(),
-			MacAddress: mac.String(),
-		}
-		hostname, found := ipToHostname[address]
-		if !found {
-			hostname = macToHostname[mac.String()]
-		}
-		entry.Hostname = hostname
-		entries = append(entries, entry)
-	}
-	return &neighborEntryIterator{entries}
-}

experimental/libbox/neighbor_linux.go

@@ -1,88 +0,0 @@
-//go:build linux
-
-package libbox
-
-import (
-	"net"
-	"net/netip"
-	"slices"
-	"time"
-
-	"github.com/sagernet/sing-box/route"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/mdlayher/netlink"
-	"golang.org/x/sys/unix"
-)
-
-func SubscribeNeighborTable(listener NeighborUpdateListener) (*NeighborSubscription, error) {
-	entries, err := route.ReadNeighborEntries()
-	if err != nil {
-		return nil, E.Cause(err, "initial neighbor dump")
-	}
-	table := make(map[netip.Addr]net.HardwareAddr)
-	for _, entry := range entries {
-		table[entry.Address] = entry.MACAddress
-	}
-	listener.UpdateNeighborTable(tableToIterator(table))
-	connection, err := netlink.Dial(unix.NETLINK_ROUTE, &netlink.Config{
-		Groups: 1 << (unix.RTNLGRP_NEIGH - 1),
-	})
-	if err != nil {
-		return nil, E.Cause(err, "subscribe neighbor updates")
-	}
-	subscription := &NeighborSubscription{
-		done: make(chan struct{}),
-	}
-	go subscription.loop(listener, connection, table)
-	return subscription, nil
-}
-
-func (s *NeighborSubscription) loop(listener NeighborUpdateListener, connection *netlink.Conn, table map[netip.Addr]net.HardwareAddr) {
-	defer connection.Close()
-	for {
-		select {
-		case <-s.done:
-			return
-		default:
-		}
-		err := connection.SetReadDeadline(time.Now().Add(3 * time.Second))
-		if err != nil {
-			return
-		}
-		messages, err := connection.Receive()
-		if err != nil {
-			if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
-				continue
-			}
-			select {
-			case <-s.done:
-				return
-			default:
-			}
-			continue
-		}
-		changed := false
-		for _, message := range messages {
-			address, mac, isDelete, ok := route.ParseNeighborMessage(message)
-			if !ok {
-				continue
-			}
-			if isDelete {
-				if _, exists := table[address]; exists {
-					delete(table, address)
-					changed = true
-				}
-			} else {
-				existing, exists := table[address]
-				if !exists || !slices.Equal(existing, mac) {
-					table[address] = mac
-					changed = true
-				}
-			}
-		}
-		if changed {
-			listener.UpdateNeighborTable(tableToIterator(table))
-		}
-	}
-}

experimental/libbox/neighbor_stub.go

@@ -1,9 +0,0 @@
-//go:build !linux && !darwin
-
-package libbox
-
-import "os"
-
-func SubscribeNeighborTable(_ NeighborUpdateListener) (*NeighborSubscription, error) {
-	return nil, os.ErrInvalid
-}

experimental/libbox/oom_report.go

@@ -1,141 +0,0 @@
-//go:build darwin || linux || windows
-
-package libbox
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/experimental/libbox/internal/oomprofile"
-	"github.com/sagernet/sing-box/service/oomkiller"
-	"github.com/sagernet/sing/common/byteformats"
-	"github.com/sagernet/sing/common/memory"
-)
-
-func init() {
-	sOOMReporter = &oomReporter{}
-}
-
-var oomReportProfiles = []string{
-	"allocs",
-	"block",
-	"goroutine",
-	"heap",
-	"mutex",
-	"threadcreate",
-}
-
-type oomReportMetadata struct {
-	reportMetadata
-	RecordedAt      string `json:"recordedAt"`
-	MemoryUsage     string `json:"memoryUsage"`
-	AvailableMemory string `json:"availableMemory,omitempty"`
-	// Heap
-	HeapAlloc    string `json:"heapAlloc,omitempty"`
-	HeapObjects  uint64 `json:"heapObjects,omitempty,string"`
-	HeapInuse    string `json:"heapInuse,omitempty"`
-	HeapIdle     string `json:"heapIdle,omitempty"`
-	HeapReleased string `json:"heapReleased,omitempty"`
-	HeapSys      string `json:"heapSys,omitempty"`
-	// Stack
-	StackInuse string `json:"stackInuse,omitempty"`
-	StackSys   string `json:"stackSys,omitempty"`
-	// Runtime metadata
-	MSpanInuse  string `json:"mSpanInuse,omitempty"`
-	MSpanSys    string `json:"mSpanSys,omitempty"`
-	MCacheSys   string `json:"mCacheSys,omitempty"`
-	BuckHashSys string `json:"buckHashSys,omitempty"`
-	GCSys       string `json:"gcSys,omitempty"`
-	OtherSys    string `json:"otherSys,omitempty"`
-	Sys         string `json:"sys,omitempty"`
-	// GC & runtime
-	TotalAlloc   string `json:"totalAlloc,omitempty"`
-	NumGC        uint32 `json:"numGC,omitempty,string"`
-	NumGoroutine int    `json:"numGoroutine,omitempty,string"`
-	NextGC       string `json:"nextGC,omitempty"`
-	LastGC       string `json:"lastGC,omitempty"`
-}
-
-type oomReporter struct{}
-
-var _ oomkiller.OOMReporter = (*oomReporter)(nil)
-
-func (r *oomReporter) WriteReport(memoryUsage uint64) error {
-	now := time.Now().UTC()
-	reportsDir := filepath.Join(sWorkingPath, "oom_reports")
-	err := os.MkdirAll(reportsDir, 0o777)
-	if err != nil {
-		return err
-	}
-	chownReport(reportsDir)
-
-	destPath, err := nextAvailableReportPath(reportsDir, now)
-	if err != nil {
-		return err
-	}
-	err = os.MkdirAll(destPath, 0o777)
-	if err != nil {
-		return err
-	}
-	chownReport(destPath)
-
-	for _, name := range oomReportProfiles {
-		writeOOMProfile(destPath, name)
-	}
-
-	writeReportFile(destPath, "cmdline", []byte(strings.Join(os.Args, "\000")))
-
-	var memStats runtime.MemStats
-	runtime.ReadMemStats(&memStats)
-
-	metadata := oomReportMetadata{
-		reportMetadata: baseReportMetadata(),
-		RecordedAt:     now.Format(time.RFC3339),
-		MemoryUsage:    byteformats.FormatMemoryBytes(memoryUsage),
-		// Heap
-		HeapAlloc:    byteformats.FormatMemoryBytes(memStats.HeapAlloc),
-		HeapObjects:  memStats.HeapObjects,
-		HeapInuse:    byteformats.FormatMemoryBytes(memStats.HeapInuse),
-		HeapIdle:     byteformats.FormatMemoryBytes(memStats.HeapIdle),
-		HeapReleased: byteformats.FormatMemoryBytes(memStats.HeapReleased),
-		HeapSys:      byteformats.FormatMemoryBytes(memStats.HeapSys),
-		// Stack
-		StackInuse: byteformats.FormatMemoryBytes(memStats.StackInuse),
-		StackSys:   byteformats.FormatMemoryBytes(memStats.StackSys),
-		// Runtime metadata
-		MSpanInuse:  byteformats.FormatMemoryBytes(memStats.MSpanInuse),
-		MSpanSys:    byteformats.FormatMemoryBytes(memStats.MSpanSys),
-		MCacheSys:   byteformats.FormatMemoryBytes(memStats.MCacheSys),
-		BuckHashSys: byteformats.FormatMemoryBytes(memStats.BuckHashSys),
-		GCSys:       byteformats.FormatMemoryBytes(memStats.GCSys),
-		OtherSys:    byteformats.FormatMemoryBytes(memStats.OtherSys),
-		Sys:         byteformats.FormatMemoryBytes(memStats.Sys),
-		// GC & runtime
-		TotalAlloc:   byteformats.FormatMemoryBytes(memStats.TotalAlloc),
-		NumGC:        memStats.NumGC,
-		NumGoroutine: runtime.NumGoroutine(),
-		NextGC:       byteformats.FormatMemoryBytes(memStats.NextGC),
-	}
-	if memStats.LastGC > 0 {
-		metadata.LastGC = time.Unix(0, int64(memStats.LastGC)).UTC().Format(time.RFC3339)
-	}
-	availableMemory := memory.Available()
-	if availableMemory > 0 {
-		metadata.AvailableMemory = byteformats.FormatMemoryBytes(availableMemory)
-	}
-	writeReportMetadata(destPath, metadata)
-	copyConfigSnapshot(destPath)
-
-	return nil
-}
-
-func writeOOMProfile(destPath string, name string) {
-	filePath, err := oomprofile.WriteFile(destPath, name)
-	if err != nil {
-		return
-	}
-	chownReport(filePath)
-}

experimental/libbox/platform.go

@@ -21,13 +21,6 @@ type PlatformInterface interface {
 	SystemCertificates() StringIterator
 	ClearDNSCache()
 	SendNotification(notification *Notification) error
-	StartNeighborMonitor(listener NeighborUpdateListener) error
-	CloseNeighborMonitor(listener NeighborUpdateListener) error
-	RegisterMyInterface(name string)
-}
-
-type NeighborUpdateListener interface {
-	UpdateNeighborTable(entries NeighborEntryIterator)
 }
 
 type ConnectionOwner struct {

experimental/libbox/report.go

@@ -1,97 +0,0 @@
-//go:build darwin || linux || windows
-
-package libbox
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"time"
-
-	C "github.com/sagernet/sing-box/constant"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type reportMetadata struct {
-	Source              string `json:"source,omitempty"`
-	BundleIdentifier    string `json:"bundleIdentifier,omitempty"`
-	ProcessName         string `json:"processName,omitempty"`
-	ProcessPath         string `json:"processPath,omitempty"`
-	StartedAt           string `json:"startedAt,omitempty"`
-	AppVersion          string `json:"appVersion,omitempty"`
-	AppMarketingVersion string `json:"appMarketingVersion,omitempty"`
-	CoreVersion         string `json:"coreVersion,omitempty"`
-	GoVersion           string `json:"goVersion,omitempty"`
-}
-
-func baseReportMetadata() reportMetadata {
-	processPath, _ := os.Executable()
-	processName := filepath.Base(processPath)
-	if processName == "." {
-		processName = ""
-	}
-	return reportMetadata{
-		Source:      sCrashReportSource,
-		ProcessName: processName,
-		ProcessPath: processPath,
-		CoreVersion: C.Version,
-		GoVersion:   GoVersion(),
-	}
-}
-
-func writeReportFile(destPath string, name string, content []byte) {
-	filePath := filepath.Join(destPath, name)
-	os.WriteFile(filePath, content, 0o666)
-	chownReport(filePath)
-}
-
-func writeReportMetadata(destPath string, metadata any) {
-	data, err := json.Marshal(metadata)
-	if err != nil {
-		return
-	}
-	writeReportFile(destPath, "metadata.json", data)
-}
-
-func copyConfigSnapshot(destPath string) {
-	snapshotPath := configSnapshotPath()
-	content, err := os.ReadFile(snapshotPath)
-	if err != nil {
-		return
-	}
-	if len(bytes.TrimSpace(content)) == 0 {
-		return
-	}
-	writeReportFile(destPath, "configuration.json", content)
-}
-
-func initReportDir(path string) {
-	os.MkdirAll(path, 0o777)
-	chownReport(path)
-}
-
-func chownReport(path string) {
-	if runtime.GOOS != "android" && runtime.GOOS != "windows" {
-		os.Chown(path, sUserID, sGroupID)
-	}
-}
-
-func nextAvailableReportPath(reportsDir string, timestamp time.Time) (string, error) {
-	destName := timestamp.Format("2006-01-02T15-04-05")
-	destPath := filepath.Join(reportsDir, destName)
-	_, err := os.Stat(destPath)
-	if os.IsNotExist(err) {
-		return destPath, nil
-	}
-	for i := 1; i <= 1000; i++ {
-		suffixedPath := filepath.Join(reportsDir, destName+"-"+strconv.Itoa(i))
-		_, err = os.Stat(suffixedPath)
-		if os.IsNotExist(err) {
-			return suffixedPath, nil
-		}
-	}
-	return "", E.New("no available report path for ", destName)
-}

experimental/libbox/service.go

@@ -78,7 +78,6 @@ func (w *platformInterfaceWrapper) OpenInterface(options *tun.Options, platformO
 	}
 	options.FileDescriptor = dupFd
 	w.myTunName = options.Name
-	w.iif.RegisterMyInterface(options.Name)
 	return tun.New(*options)
 }
 
@@ -221,46 +220,6 @@ func (w *platformInterfaceWrapper) SendNotification(notification *adapter.Notifi
 	return w.iif.SendNotification((*Notification)(notification))
 }
 
-func (w *platformInterfaceWrapper) UsePlatformNeighborResolver() bool {
-	return true
-}
-
-func (w *platformInterfaceWrapper) StartNeighborMonitor(listener adapter.NeighborUpdateListener) error {
-	return w.iif.StartNeighborMonitor(&neighborUpdateListenerWrapper{listener: listener})
-}
-
-func (w *platformInterfaceWrapper) CloseNeighborMonitor(listener adapter.NeighborUpdateListener) error {
-	return w.iif.CloseNeighborMonitor(nil)
-}
-
-type neighborUpdateListenerWrapper struct {
-	listener adapter.NeighborUpdateListener
-}
-
-func (w *neighborUpdateListenerWrapper) UpdateNeighborTable(entries NeighborEntryIterator) {
-	var result []adapter.NeighborEntry
-	for entries.HasNext() {
-		entry := entries.Next()
-		if entry == nil {
-			continue
-		}
-		address, err := netip.ParseAddr(entry.Address)
-		if err != nil {
-			continue
-		}
-		macAddress, err := net.ParseMAC(entry.MacAddress)
-		if err != nil {
-			continue
-		}
-		result = append(result, adapter.NeighborEntry{
-			Address:    address,
-			MACAddress: macAddress,
-			Hostname:   entry.Hostname,
-		})
-	}
-	w.listener.UpdateNeighborTable(result)
-}
-
 func AvailablePort(startPort int32) (int32, error) {
 	for port := int(startPort); ; port++ {
 		if port > 65535 {

experimental/libbox/setup.go

@@ -1,17 +1,13 @@
 package libbox
 
 import (
-	"math"
 	"os"
-	"path/filepath"
-	"runtime"
 	"runtime/debug"
 	"time"
 
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/experimental/locale"
 	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/service/oomkiller"
 	"github.com/sagernet/sing/common/byteformats"
 )
 
@@ -26,10 +22,6 @@ var (
 	sCommandServerSecret     string
 	sLogMaxLines             int
 	sDebug                   bool
-	sCrashReportSource       string
-	sOOMKillerEnabled        bool
-	sOOMKillerDisabled       bool
-	sOOMMemoryLimit          int64
 )
 
 func init() {
@@ -46,13 +38,9 @@ type SetupOptions struct {
 	CommandServerSecret     string
 	LogMaxLines             int
 	Debug                   bool
-	CrashReportSource       string
-	OomKillerEnabled        bool
-	OomKillerDisabled       bool
-	OomMemoryLimit          int64
 }
 
-func applySetupOptions(options *SetupOptions) {
+func Setup(options *SetupOptions) error {
 	sBasePath = options.BasePath
 	sWorkingPath = options.WorkingPath
 	sTempPath = options.TempPath
@@ -68,33 +56,10 @@ func applySetupOptions(options *SetupOptions) {
 	sCommandServerSecret = options.CommandServerSecret
 	sLogMaxLines = options.LogMaxLines
 	sDebug = options.Debug
-	sCrashReportSource = options.CrashReportSource
-	ReloadSetupOptions(options)
-}
 
-func ReloadSetupOptions(options *SetupOptions) {
-	sOOMKillerEnabled = options.OomKillerEnabled
-	sOOMKillerDisabled = options.OomKillerDisabled
-	sOOMMemoryLimit = options.OomMemoryLimit
-	if sOOMKillerEnabled {
-		if sOOMMemoryLimit == 0 && C.IsIos {
-			sOOMMemoryLimit = oomkiller.DefaultAppleNetworkExtensionMemoryLimit
-		}
-		if sOOMMemoryLimit > 0 {
-			debug.SetMemoryLimit(sOOMMemoryLimit * 3 / 4)
-		} else {
-			debug.SetMemoryLimit(math.MaxInt64)
-		}
-	} else {
-		debug.SetMemoryLimit(math.MaxInt64)
-	}
-}
-
-func Setup(options *SetupOptions) error {
-	applySetupOptions(options)
 	os.MkdirAll(sWorkingPath, 0o777)
 	os.MkdirAll(sTempPath, 0o777)
-	return redirectStderr(filepath.Join(sWorkingPath, "CrashReport-"+sCrashReportSource+".log"))
+	return nil
 }
 
 func SetLocale(localeId string) {
@@ -105,10 +70,6 @@ func Version() string {
 	return C.Version
 }
 
-func GoVersion() string {
-	return runtime.Version() + ", " + runtime.GOOS + "/" + runtime.GOARCH
-}
-
 func FormatBytes(length int64) string {
 	return byteformats.FormatKBytes(uint64(length))
 }

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.26.0
 	github.com/anytls/sing-anytls v0.0.11
 	github.com/caddyserver/certmagic v0.25.2
-	github.com/caddyserver/zerossl v0.1.5
 	github.com/coder/websocket v1.8.14
 	github.com/cretz/bine v0.2.0
 	github.com/database64128/tfo-go/v2 v2.3.2
@@ -15,14 +14,11 @@ require (
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/gofrs/uuid/v5 v5.4.0
 	github.com/insomniacslk/dhcp v0.0.0-20260220084031-5adc3eb26f91
-	github.com/jsimonetti/rtnetlink v1.4.0
 	github.com/keybase/go-keychain v0.0.1
 	github.com/libdns/acmedns v0.5.0
 	github.com/libdns/alidns v1.0.6
 	github.com/libdns/cloudflare v0.2.2
-	github.com/libdns/libdns v1.1.1
 	github.com/logrusorgru/aurora v2.0.3+incompatible
-	github.com/mdlayher/netlink v1.9.0
 	github.com/metacubex/utls v1.8.4
 	github.com/mholt/acmez/v3 v3.1.6
 	github.com/miekg/dns v1.1.72
@@ -31,19 +27,19 @@ require (
 	github.com/sagernet/asc-go v0.0.0-20241217030726-d563060fe4e1
 	github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a
 	github.com/sagernet/cors v1.2.1
-	github.com/sagernet/cronet-go v0.0.0-20260309100020-c128886ff3fc
-	github.com/sagernet/cronet-go/all v0.0.0-20260309100020-c128886ff3fc
+	github.com/sagernet/cronet-go v0.0.0-20260309102448-2fef65f9dba9
+	github.com/sagernet/cronet-go/all v0.0.0-20260309102448-2fef65f9dba9
 	github.com/sagernet/fswatch v0.1.1
 	github.com/sagernet/gomobile v0.1.12
 	github.com/sagernet/gvisor v0.0.0-20250811.0-sing-box-mod.1
 	github.com/sagernet/quic-go v0.59.0-sing-box-mod.4
-	github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849
+	github.com/sagernet/sing v0.8.4
 	github.com/sagernet/sing-mux v0.3.4
-	github.com/sagernet/sing-quic v0.6.2-0.20260330152607-bf674c163212
+	github.com/sagernet/sing-quic v0.6.1
 	github.com/sagernet/sing-shadowsocks v0.2.8
 	github.com/sagernet/sing-shadowsocks2 v0.2.1
 	github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11
-	github.com/sagernet/sing-tun v0.8.7-0.20260323120017-8eb4e8acfc2d
+	github.com/sagernet/sing-tun v0.8.7
 	github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1
 	github.com/sagernet/smux v1.5.50-sing-box-mod.1
 	github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.7
@@ -71,6 +67,7 @@ require (
 	github.com/akutz/memconn v0.1.0 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
 	github.com/andybalholm/brotli v1.1.0 // indirect
+	github.com/caddyserver/zerossl v0.1.5 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 // indirect
 	github.com/database64128/netx-go v0.1.1 // indirect
@@ -95,8 +92,11 @@ require (
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/libdns/libdns v1.1.1 // indirect
+	github.com/mdlayher/netlink v1.9.0 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect

go.sum

@@ -162,10 +162,10 @@ github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a h1:+NkI2670SQpQWvkk
 github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a/go.mod h1:63s7jpZqcDAIpj8oI/1v4Izok+npJOHACFCU6+huCkM=
 github.com/sagernet/cors v1.2.1 h1:Cv5Z8y9YSD6Gm+qSpNrL3LO4lD3eQVvbFYJSG7JCMHQ=
 github.com/sagernet/cors v1.2.1/go.mod h1:O64VyOjjhrkLmQIjF4KGRrJO/5dVXFdpEmCW/eISRAI=
-github.com/sagernet/cronet-go v0.0.0-20260309100020-c128886ff3fc h1:YK7PwJT0irRAEui9ASdXSxcE2BOVQipWMF/A1Ogt+7c=
-github.com/sagernet/cronet-go v0.0.0-20260309100020-c128886ff3fc/go.mod h1:hwFHBEjjthyEquDULbr4c4ucMedp8Drb6Jvm2kt/0Bw=
-github.com/sagernet/cronet-go/all v0.0.0-20260309100020-c128886ff3fc h1:EJPHOqk23IuBsTjXK9OXqkNxPbKOBWKRmviQoCcriAs=
-github.com/sagernet/cronet-go/all v0.0.0-20260309100020-c128886ff3fc/go.mod h1:8aty0RW96DrJSMWXO6bRPMBJEjuqq5JWiOIi4bCRzFA=
+github.com/sagernet/cronet-go v0.0.0-20260309102448-2fef65f9dba9 h1:xq5Yr10jXEppD3cnGjE3WENaB6D0YsZu6KptZ8d3054=
+github.com/sagernet/cronet-go v0.0.0-20260309102448-2fef65f9dba9/go.mod h1:hwFHBEjjthyEquDULbr4c4ucMedp8Drb6Jvm2kt/0Bw=
+github.com/sagernet/cronet-go/all v0.0.0-20260309102448-2fef65f9dba9 h1:uxQyy6Y/boOuecVA66tf79JgtoRGfeDJcfYZZLKVA5E=
+github.com/sagernet/cronet-go/all v0.0.0-20260309102448-2fef65f9dba9/go.mod h1:Xm6cCvs0/twozC1JYNq0sVlOVmcSGzV7YON1XGcD97w=
 github.com/sagernet/cronet-go/lib/android_386 v0.0.0-20260309101654-0cbdcfddded9 h1:Qi0IKBpoPP3qZqIXuOKMsT2dv+l/MLWMyBHDMLRw2EA=
 github.com/sagernet/cronet-go/lib/android_386 v0.0.0-20260309101654-0cbdcfddded9/go.mod h1:XXDwdjX/T8xftoeJxQmbBoYXZp8MAPFR2CwbFuTpEtw=
 github.com/sagernet/cronet-go/lib/android_amd64 v0.0.0-20260309101654-0cbdcfddded9 h1:p+wCMjOhj46SpSD/AJeTGgkCcbyA76FyH631XZatyU8=
@@ -236,20 +236,20 @@ github.com/sagernet/nftables v0.3.0-beta.4 h1:kbULlAwAC3jvdGAC1P5Fa3GSxVwQJibNen
 github.com/sagernet/nftables v0.3.0-beta.4/go.mod h1:OQXAjvjNGGFxaTgVCSTRIhYB5/llyVDeapVoENYBDS8=
 github.com/sagernet/quic-go v0.59.0-sing-box-mod.4 h1:6qvrUW79S+CrPwWz6cMePXohgjHoKxLo3c+MDhNwc3o=
 github.com/sagernet/quic-go v0.59.0-sing-box-mod.4/go.mod h1:OqILvS182CyOol5zNNo6bguvOGgXzV459+chpRaUC+4=
-github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849 h1:P8jaGN561IbHBxjlU8IGrFK65n1vDOrHo8FOMgHfn14=
-github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
+github.com/sagernet/sing v0.8.4 h1:Fj+jlY3F8vhcRfz/G/P3Dwcs5wqnmyNPT7u1RVVmjFI=
+github.com/sagernet/sing v0.8.4/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
 github.com/sagernet/sing-mux v0.3.4 h1:ZQplKl8MNXutjzbMVtWvWG31fohhgOfCuUZR4dVQ8+s=
 github.com/sagernet/sing-mux v0.3.4/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
-github.com/sagernet/sing-quic v0.6.2-0.20260330152607-bf674c163212 h1:7mFOUqy+DyOj7qKGd1X54UMXbnbJiiMileK/tn17xYc=
-github.com/sagernet/sing-quic v0.6.2-0.20260330152607-bf674c163212/go.mod h1:K5bWvITOm4vE10fwLfrWpw27bCoVJ+tfQ79tOWg+Ko8=
+github.com/sagernet/sing-quic v0.6.1 h1:lx0tcm99wIA1RkyvILNzRSsMy1k7TTQYIhx71E/WBlw=
+github.com/sagernet/sing-quic v0.6.1/go.mod h1:K5bWvITOm4vE10fwLfrWpw27bCoVJ+tfQ79tOWg+Ko8=
 github.com/sagernet/sing-shadowsocks v0.2.8 h1:PURj5PRoAkqeHh2ZW205RWzN9E9RtKCVCzByXruQWfE=
 github.com/sagernet/sing-shadowsocks v0.2.8/go.mod h1:lo7TWEMDcN5/h5B8S0ew+r78ZODn6SwVaFhvB6H+PTI=
 github.com/sagernet/sing-shadowsocks2 v0.2.1 h1:dWV9OXCeFPuYGHb6IRqlSptVnSzOelnqqs2gQ2/Qioo=
 github.com/sagernet/sing-shadowsocks2 v0.2.1/go.mod h1:RnXS0lExcDAovvDeniJ4IKa2IuChrdipolPYWBv9hWQ=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11 h1:tK+75l64tm9WvEFrYRE1t0YxoFdWQqw/h7Uhzj0vJ+w=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11/go.mod h1:sWqKnGlMipCHaGsw1sTTlimyUpgzP4WP3pjhCsYt9oA=
-github.com/sagernet/sing-tun v0.8.7-0.20260323120017-8eb4e8acfc2d h1:vi0j6301f6H8t2GYgAC2PA2AdnGdMwkP34B4+N03Qt4=
-github.com/sagernet/sing-tun v0.8.7-0.20260323120017-8eb4e8acfc2d/go.mod h1:pLCo4o+LacXEzz0bhwhJkKBjLlKOGPBNOAZ97ZVZWzs=
+github.com/sagernet/sing-tun v0.8.7 h1:q49cI7Cbp+BcgzaJitQ9QdLO77BqnnaQRkSEMoGmF3g=
+github.com/sagernet/sing-tun v0.8.7/go.mod h1:pLCo4o+LacXEzz0bhwhJkKBjLlKOGPBNOAZ97ZVZWzs=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1 h1:aSwUNYUkVyVvdmBSufR8/nRFonwJeKSIROxHcm5br9o=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1/go.mod h1:P11scgTxMxVVQ8dlM27yNm3Cro40mD0+gHbnqrNGDuY=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1 h1:XkJcivBC9V4wBjiGXIXZ229aZCU1hzcbp6kSkkyQ478=

include/acme.go

@@ -1,12 +0,0 @@
-//go:build with_acme
-
-package include
-
-import (
-	"github.com/sagernet/sing-box/adapter/certificate"
-	"github.com/sagernet/sing-box/service/acme"
-)
-
-func registerACMECertificateProvider(registry *certificate.Registry) {
-	acme.RegisterCertificateProvider(registry)
-}

include/acme_stub.go

@@ -1,20 +0,0 @@
-//go:build !with_acme
-
-package include
-
-import (
-	"context"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/adapter/certificate"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-func registerACMECertificateProvider(registry *certificate.Registry) {
-	certificate.Register[option.ACMECertificateProviderOptions](registry, C.TypeACME, func(ctx context.Context, logger log.ContextLogger, tag string, options option.ACMECertificateProviderOptions) (adapter.CertificateProviderService, error) {
-		return nil, E.New(`ACME is not included in this build, rebuild with -tags with_acme`)
-	})
-}

include/registry.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/sagernet/sing-box"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/inbound"
 	"github.com/sagernet/sing-box/adapter/outbound"
@@ -35,14 +34,13 @@ import (
 	"github.com/sagernet/sing-box/protocol/tun"
 	"github.com/sagernet/sing-box/protocol/vless"
 	"github.com/sagernet/sing-box/protocol/vmess"
-	originca "github.com/sagernet/sing-box/service/origin_ca"
 	"github.com/sagernet/sing-box/service/resolved"
 	"github.com/sagernet/sing-box/service/ssmapi"
 	E "github.com/sagernet/sing/common/exceptions"
 )
 
 func Context(ctx context.Context) context.Context {
-	return box.Context(ctx, InboundRegistry(), OutboundRegistry(), EndpointRegistry(), DNSTransportRegistry(), ServiceRegistry(), CertificateProviderRegistry())
+	return box.Context(ctx, InboundRegistry(), OutboundRegistry(), EndpointRegistry(), DNSTransportRegistry(), ServiceRegistry())
 }
 
 func InboundRegistry() *inbound.Registry {
@@ -141,16 +139,6 @@ func ServiceRegistry() *service.Registry {
 	return registry
 }
 
-func CertificateProviderRegistry() *certificate.Registry {
-	registry := certificate.NewRegistry()
-
-	registerACMECertificateProvider(registry)
-	registerTailscaleCertificateProvider(registry)
-	originca.RegisterCertificateProvider(registry)
-
-	return registry
-}
-
 func registerStubForRemovedInbounds(registry *inbound.Registry) {
 	inbound.Register[option.ShadowsocksInboundOptions](registry, C.TypeShadowsocksR, func(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.ShadowsocksInboundOptions) (adapter.Inbound, error) {
 		return nil, E.New("ShadowsocksR is deprecated and removed in sing-box 1.6.0")

include/tailscale.go

@@ -3,7 +3,6 @@
 package include
 
 import (
-	"github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/service"
 	"github.com/sagernet/sing-box/dns"
@@ -19,10 +18,6 @@ func registerTailscaleTransport(registry *dns.TransportRegistry) {
 	tailscale.RegistryTransport(registry)
 }
 
-func registerTailscaleCertificateProvider(registry *certificate.Registry) {
-	tailscale.RegisterCertificateProvider(registry)
-}
-
 func registerDERPService(registry *service.Registry) {
 	derp.Register(registry)
 }

include/tailscale_stub.go

@@ -6,7 +6,6 @@ import (
 	"context"
 
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/service"
 	C "github.com/sagernet/sing-box/constant"
@@ -28,12 +27,6 @@ func registerTailscaleTransport(registry *dns.TransportRegistry) {
 	})
 }
 
-func registerTailscaleCertificateProvider(registry *certificate.Registry) {
-	certificate.Register[option.TailscaleCertificateProviderOptions](registry, C.TypeTailscale, func(ctx context.Context, logger log.ContextLogger, tag string, options option.TailscaleCertificateProviderOptions) (adapter.CertificateProviderService, error) {
-		return nil, E.New(`Tailscale is not included in this build, rebuild with -tags with_tailscale`)
-	})
-}
-
 func registerDERPService(registry *service.Registry) {
 	service.Register[option.DERPServiceOptions](registry, C.TypeDERP, func(ctx context.Context, logger log.ContextLogger, tag string, options option.DERPServiceOptions) (adapter.Service, error) {
 		return nil, E.New(`DERP is not included in this build, rebuild with -tags with_tailscale`)

mkdocs.yml

@@ -122,11 +122,6 @@ nav:
           - Listen Fields: configuration/shared/listen.md
           - Dial Fields: configuration/shared/dial.md
           - TLS: configuration/shared/tls.md
-          - Certificate Provider:
-              - configuration/shared/certificate-provider/index.md
-              - ACME: configuration/shared/certificate-provider/acme.md
-              - Tailscale: configuration/shared/certificate-provider/tailscale.md
-              - Cloudflare Origin CA: configuration/shared/certificate-provider/cloudflare-origin-ca.md
           - DNS01 Challenge Fields: configuration/shared/dns01_challenge.md
           - Pre-match: configuration/shared/pre-match.md
           - Multiplex: configuration/shared/multiplex.md
@@ -134,7 +129,6 @@ nav:
           - UDP over TCP: configuration/shared/udp-over-tcp.md
           - TCP Brutal: configuration/shared/tcp-brutal.md
           - Wi-Fi State: configuration/shared/wifi-state.md
-          - Neighbor Resolution: configuration/shared/neighbor.md
       - Endpoint:
           - configuration/endpoint/index.md
           - WireGuard: configuration/endpoint/wireguard.md
@@ -278,7 +272,6 @@ plugins:
             Shared: 通用
             Listen Fields: 监听字段
             Dial Fields: 拨号字段
-            Certificate Provider Fields: 证书提供者字段
             DNS01 Challenge Fields: DNS01 验证字段
             Multiplex: 多路复用
             V2Ray Transport: V2Ray 传输层
@@ -287,7 +280,6 @@ plugins:
             Endpoint: 端点
             Inbound: 入站
             Outbound: 出站
-            Certificate Provider: 证书提供者
 
             Manual: 手册
       reconfigure_material: true

option/acme.go

@@ -1,106 +0,0 @@
-package option
-
-import (
-	"strings"
-
-	C "github.com/sagernet/sing-box/constant"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
-	"github.com/sagernet/sing/common/json/badjson"
-	"github.com/sagernet/sing/common/json/badoption"
-)
-
-type ACMECertificateProviderOptions struct {
-	Domain                  badoption.Listable[string]         `json:"domain,omitempty"`
-	DataDirectory           string                             `json:"data_directory,omitempty"`
-	DefaultServerName       string                             `json:"default_server_name,omitempty"`
-	Email                   string                             `json:"email,omitempty"`
-	Provider                string                             `json:"provider,omitempty"`
-	AccountKey              string                             `json:"account_key,omitempty"`
-	DisableHTTPChallenge    bool                               `json:"disable_http_challenge,omitempty"`
-	DisableTLSALPNChallenge bool                               `json:"disable_tls_alpn_challenge,omitempty"`
-	AlternativeHTTPPort     uint16                             `json:"alternative_http_port,omitempty"`
-	AlternativeTLSPort      uint16                             `json:"alternative_tls_port,omitempty"`
-	ExternalAccount         *ACMEExternalAccountOptions        `json:"external_account,omitempty"`
-	DNS01Challenge          *ACMEProviderDNS01ChallengeOptions `json:"dns01_challenge,omitempty"`
-	KeyType                 ACMEKeyType                        `json:"key_type,omitempty"`
-	Detour                  string                             `json:"detour,omitempty"`
-}
-
-type _ACMEProviderDNS01ChallengeOptions struct {
-	TTL                badoption.Duration         `json:"ttl,omitempty"`
-	PropagationDelay   badoption.Duration         `json:"propagation_delay,omitempty"`
-	PropagationTimeout badoption.Duration         `json:"propagation_timeout,omitempty"`
-	Resolvers          badoption.Listable[string] `json:"resolvers,omitempty"`
-	OverrideDomain     string                     `json:"override_domain,omitempty"`
-	Provider           string                     `json:"provider,omitempty"`
-	AliDNSOptions      ACMEDNS01AliDNSOptions     `json:"-"`
-	CloudflareOptions  ACMEDNS01CloudflareOptions `json:"-"`
-	ACMEDNSOptions     ACMEDNS01ACMEDNSOptions    `json:"-"`
-}
-
-type ACMEProviderDNS01ChallengeOptions _ACMEProviderDNS01ChallengeOptions
-
-func (o ACMEProviderDNS01ChallengeOptions) MarshalJSON() ([]byte, error) {
-	var v any
-	switch o.Provider {
-	case C.DNSProviderAliDNS:
-		v = o.AliDNSOptions
-	case C.DNSProviderCloudflare:
-		v = o.CloudflareOptions
-	case C.DNSProviderACMEDNS:
-		v = o.ACMEDNSOptions
-	case "":
-		return nil, E.New("missing provider type")
-	default:
-		return nil, E.New("unknown provider type: ", o.Provider)
-	}
-	return badjson.MarshallObjects((_ACMEProviderDNS01ChallengeOptions)(o), v)
-}
-
-func (o *ACMEProviderDNS01ChallengeOptions) UnmarshalJSON(bytes []byte) error {
-	err := json.Unmarshal(bytes, (*_ACMEProviderDNS01ChallengeOptions)(o))
-	if err != nil {
-		return err
-	}
-	var v any
-	switch o.Provider {
-	case C.DNSProviderAliDNS:
-		v = &o.AliDNSOptions
-	case C.DNSProviderCloudflare:
-		v = &o.CloudflareOptions
-	case C.DNSProviderACMEDNS:
-		v = &o.ACMEDNSOptions
-	case "":
-		return E.New("missing provider type")
-	default:
-		return E.New("unknown provider type: ", o.Provider)
-	}
-	return badjson.UnmarshallExcluded(bytes, (*_ACMEProviderDNS01ChallengeOptions)(o), v)
-}
-
-type ACMEKeyType string
-
-const (
-	ACMEKeyTypeED25519 = ACMEKeyType("ed25519")
-	ACMEKeyTypeP256    = ACMEKeyType("p256")
-	ACMEKeyTypeP384    = ACMEKeyType("p384")
-	ACMEKeyTypeRSA2048 = ACMEKeyType("rsa2048")
-	ACMEKeyTypeRSA4096 = ACMEKeyType("rsa4096")
-)
-
-func (t *ACMEKeyType) UnmarshalJSON(data []byte) error {
-	var value string
-	err := json.Unmarshal(data, &value)
-	if err != nil {
-		return err
-	}
-	value = strings.ToLower(value)
-	switch ACMEKeyType(value) {
-	case "", ACMEKeyTypeED25519, ACMEKeyTypeP256, ACMEKeyTypeP384, ACMEKeyTypeRSA2048, ACMEKeyTypeRSA4096:
-		*t = ACMEKeyType(value)
-	default:
-		return E.New("unknown ACME key type: ", value)
-	}
-	return nil
-}

option/certificate_provider.go

@@ -1,100 +0,0 @@
-package option
-
-import (
-	"context"
-
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
-	"github.com/sagernet/sing/common/json/badjson"
-	"github.com/sagernet/sing/service"
-)
-
-type CertificateProviderOptionsRegistry interface {
-	CreateOptions(providerType string) (any, bool)
-}
-
-type _CertificateProvider struct {
-	Type    string `json:"type"`
-	Tag     string `json:"tag,omitempty"`
-	Options any    `json:"-"`
-}
-
-type CertificateProvider _CertificateProvider
-
-func (h *CertificateProvider) MarshalJSONContext(ctx context.Context) ([]byte, error) {
-	return badjson.MarshallObjectsContext(ctx, (*_CertificateProvider)(h), h.Options)
-}
-
-func (h *CertificateProvider) UnmarshalJSONContext(ctx context.Context, content []byte) error {
-	err := json.UnmarshalContext(ctx, content, (*_CertificateProvider)(h))
-	if err != nil {
-		return err
-	}
-	registry := service.FromContext[CertificateProviderOptionsRegistry](ctx)
-	if registry == nil {
-		return E.New("missing certificate provider options registry in context")
-	}
-	options, loaded := registry.CreateOptions(h.Type)
-	if !loaded {
-		return E.New("unknown certificate provider type: ", h.Type)
-	}
-	err = badjson.UnmarshallExcludedContext(ctx, content, (*_CertificateProvider)(h), options)
-	if err != nil {
-		return err
-	}
-	h.Options = options
-	return nil
-}
-
-type CertificateProviderOptions struct {
-	Tag     string `json:"-"`
-	Type    string `json:"-"`
-	Options any    `json:"-"`
-}
-
-type _CertificateProviderInline struct {
-	Type string `json:"type"`
-}
-
-func (o *CertificateProviderOptions) MarshalJSONContext(ctx context.Context) ([]byte, error) {
-	if o.Tag != "" {
-		return json.Marshal(o.Tag)
-	}
-	return badjson.MarshallObjectsContext(ctx, _CertificateProviderInline{Type: o.Type}, o.Options)
-}
-
-func (o *CertificateProviderOptions) UnmarshalJSONContext(ctx context.Context, content []byte) error {
-	if len(content) == 0 {
-		return E.New("empty certificate_provider value")
-	}
-	if content[0] == '"' {
-		return json.UnmarshalContext(ctx, content, &o.Tag)
-	}
-	var inline _CertificateProviderInline
-	err := json.UnmarshalContext(ctx, content, &inline)
-	if err != nil {
-		return err
-	}
-	o.Type = inline.Type
-	if o.Type == "" {
-		return E.New("missing certificate provider type")
-	}
-	registry := service.FromContext[CertificateProviderOptionsRegistry](ctx)
-	if registry == nil {
-		return E.New("missing certificate provider options registry in context")
-	}
-	options, loaded := registry.CreateOptions(o.Type)
-	if !loaded {
-		return E.New("unknown certificate provider type: ", o.Type)
-	}
-	err = badjson.UnmarshallExcludedContext(ctx, content, &inline, options)
-	if err != nil {
-		return err
-	}
-	o.Options = options
-	return nil
-}
-
-func (o *CertificateProviderOptions) IsShared() bool {
-	return o.Tag != ""
-}

option/hysteria2.go

@@ -19,7 +19,6 @@ type Hysteria2InboundOptions struct {
 	IgnoreClientBandwidth bool            `json:"ignore_client_bandwidth,omitempty"`
 	InboundTLSOptionsContainer
 	Masquerade  *Hysteria2Masquerade `json:"masquerade,omitempty"`
-	BBRProfile  string               `json:"bbr_profile,omitempty"`
 	BrutalDebug bool                 `json:"brutal_debug,omitempty"`
 }
 
@@ -113,15 +112,13 @@ type Hysteria2MasqueradeString struct {
 type Hysteria2OutboundOptions struct {
 	DialerOptions
 	ServerOptions
-	ServerPorts    badoption.Listable[string] `json:"server_ports,omitempty"`
-	HopInterval    badoption.Duration         `json:"hop_interval,omitempty"`
-	HopIntervalMax badoption.Duration         `json:"hop_interval_max,omitempty"`
-	UpMbps         int                        `json:"up_mbps,omitempty"`
-	DownMbps       int                        `json:"down_mbps,omitempty"`
-	Obfs           *Hysteria2Obfs             `json:"obfs,omitempty"`
-	Password       string                     `json:"password,omitempty"`
-	Network        NetworkList                `json:"network,omitempty"`
+	ServerPorts badoption.Listable[string] `json:"server_ports,omitempty"`
+	HopInterval badoption.Duration         `json:"hop_interval,omitempty"`
+	UpMbps      int                        `json:"up_mbps,omitempty"`
+	DownMbps    int                        `json:"down_mbps,omitempty"`
+	Obfs        *Hysteria2Obfs             `json:"obfs,omitempty"`
+	Password    string                     `json:"password,omitempty"`
+	Network     NetworkList                `json:"network,omitempty"`
 	OutboundTLSOptionsContainer
-	BBRProfile  string `json:"bbr_profile,omitempty"`
-	BrutalDebug bool   `json:"brutal_debug,omitempty"`
+	BrutalDebug bool `json:"brutal_debug,omitempty"`
 }

option/oom_killer.go

@@ -6,10 +6,9 @@ import (
 )
 
 type OOMKillerServiceOptions struct {
-	MemoryLimit         *byteformats.MemoryBytes `json:"memory_limit,omitempty"`
-	SafetyMargin        *byteformats.MemoryBytes `json:"safety_margin,omitempty"`
-	MinInterval         badoption.Duration       `json:"min_interval,omitempty"`
-	MaxInterval         badoption.Duration       `json:"max_interval,omitempty"`
-	KillerDisabled      bool                     `json:"-"`
-	MemoryLimitOverride uint64                   `json:"-"`
+	MemoryLimit       *byteformats.MemoryBytes `json:"memory_limit,omitempty"`
+	SafetyMargin      *byteformats.MemoryBytes `json:"safety_margin,omitempty"`
+	MinInterval       badoption.Duration       `json:"min_interval,omitempty"`
+	MaxInterval       badoption.Duration       `json:"max_interval,omitempty"`
+	ChecksBeforeLimit int                      `json:"checks_before_limit,omitempty"`
 }

option/options.go

@@ -10,19 +10,18 @@ import (
 )
 
 type _Options struct {
-	RawMessage           json.RawMessage       `json:"-"`
-	Schema               string                `json:"$schema,omitempty"`
-	Log                  *LogOptions           `json:"log,omitempty"`
-	DNS                  *DNSOptions           `json:"dns,omitempty"`
-	NTP                  *NTPOptions           `json:"ntp,omitempty"`
-	Certificate          *CertificateOptions   `json:"certificate,omitempty"`
-	CertificateProviders []CertificateProvider `json:"certificate_providers,omitempty"`
-	Endpoints            []Endpoint            `json:"endpoints,omitempty"`
-	Inbounds             []Inbound             `json:"inbounds,omitempty"`
-	Outbounds            []Outbound            `json:"outbounds,omitempty"`
-	Route                *RouteOptions         `json:"route,omitempty"`
-	Services             []Service             `json:"services,omitempty"`
-	Experimental         *ExperimentalOptions  `json:"experimental,omitempty"`
+	RawMessage   json.RawMessage      `json:"-"`
+	Schema       string               `json:"$schema,omitempty"`
+	Log          *LogOptions          `json:"log,omitempty"`
+	DNS          *DNSOptions          `json:"dns,omitempty"`
+	NTP          *NTPOptions          `json:"ntp,omitempty"`
+	Certificate  *CertificateOptions  `json:"certificate,omitempty"`
+	Endpoints    []Endpoint           `json:"endpoints,omitempty"`
+	Inbounds     []Inbound            `json:"inbounds,omitempty"`
+	Outbounds    []Outbound           `json:"outbounds,omitempty"`
+	Route        *RouteOptions        `json:"route,omitempty"`
+	Services     []Service            `json:"services,omitempty"`
+	Experimental *ExperimentalOptions `json:"experimental,omitempty"`
 }
 
 type Options _Options
@@ -57,25 +56,6 @@ func checkOptions(options *Options) error {
 	if err != nil {
 		return err
 	}
-	err = checkCertificateProviders(options.CertificateProviders)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func checkCertificateProviders(providers []CertificateProvider) error {
-	seen := make(map[string]bool)
-	for i, provider := range providers {
-		tag := provider.Tag
-		if tag == "" {
-			tag = F.ToString(i)
-		}
-		if seen[tag] {
-			return E.New("duplicate certificate provider tag: ", tag)
-		}
-		seen[tag] = true
-	}
 	return nil
 }
 

option/origin_ca.go

@@ -1,76 +0,0 @@
-package option
-
-import (
-	"strings"
-
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
-	"github.com/sagernet/sing/common/json/badoption"
-)
-
-type CloudflareOriginCACertificateProviderOptions struct {
-	Domain            badoption.Listable[string]        `json:"domain,omitempty"`
-	DataDirectory     string                            `json:"data_directory,omitempty"`
-	APIToken          string                            `json:"api_token,omitempty"`
-	OriginCAKey       string                            `json:"origin_ca_key,omitempty"`
-	RequestType       CloudflareOriginCARequestType     `json:"request_type,omitempty"`
-	RequestedValidity CloudflareOriginCARequestValidity `json:"requested_validity,omitempty"`
-	Detour            string                            `json:"detour,omitempty"`
-}
-
-type CloudflareOriginCARequestType string
-
-const (
-	CloudflareOriginCARequestTypeOriginRSA = CloudflareOriginCARequestType("origin-rsa")
-	CloudflareOriginCARequestTypeOriginECC = CloudflareOriginCARequestType("origin-ecc")
-)
-
-func (t *CloudflareOriginCARequestType) UnmarshalJSON(data []byte) error {
-	var value string
-	err := json.Unmarshal(data, &value)
-	if err != nil {
-		return err
-	}
-	value = strings.ToLower(value)
-	switch CloudflareOriginCARequestType(value) {
-	case "", CloudflareOriginCARequestTypeOriginRSA, CloudflareOriginCARequestTypeOriginECC:
-		*t = CloudflareOriginCARequestType(value)
-	default:
-		return E.New("unsupported Cloudflare Origin CA request type: ", value)
-	}
-	return nil
-}
-
-type CloudflareOriginCARequestValidity uint16
-
-const (
-	CloudflareOriginCARequestValidity7    = CloudflareOriginCARequestValidity(7)
-	CloudflareOriginCARequestValidity30   = CloudflareOriginCARequestValidity(30)
-	CloudflareOriginCARequestValidity90   = CloudflareOriginCARequestValidity(90)
-	CloudflareOriginCARequestValidity365  = CloudflareOriginCARequestValidity(365)
-	CloudflareOriginCARequestValidity730  = CloudflareOriginCARequestValidity(730)
-	CloudflareOriginCARequestValidity1095 = CloudflareOriginCARequestValidity(1095)
-	CloudflareOriginCARequestValidity5475 = CloudflareOriginCARequestValidity(5475)
-)
-
-func (v *CloudflareOriginCARequestValidity) UnmarshalJSON(data []byte) error {
-	var value uint16
-	err := json.Unmarshal(data, &value)
-	if err != nil {
-		return err
-	}
-	switch CloudflareOriginCARequestValidity(value) {
-	case 0,
-		CloudflareOriginCARequestValidity7,
-		CloudflareOriginCARequestValidity30,
-		CloudflareOriginCARequestValidity90,
-		CloudflareOriginCARequestValidity365,
-		CloudflareOriginCARequestValidity730,
-		CloudflareOriginCARequestValidity1095,
-		CloudflareOriginCARequestValidity5475:
-		*v = CloudflareOriginCARequestValidity(value)
-	default:
-		return E.New("unsupported Cloudflare Origin CA requested validity: ", value)
-	}
-	return nil
-}

option/route.go

@@ -9,8 +9,6 @@ type RouteOptions struct {
 	RuleSet                    []RuleSet                         `json:"rule_set,omitempty"`
 	Final                      string                            `json:"final,omitempty"`
 	FindProcess                bool                              `json:"find_process,omitempty"`
-	FindNeighbor               bool                              `json:"find_neighbor,omitempty"`
-	DHCPLeaseFiles             badoption.Listable[string]        `json:"dhcp_lease_files,omitempty"`
 	AutoDetectInterface        bool                              `json:"auto_detect_interface,omitempty"`
 	OverrideAndroidVPN         bool                              `json:"override_android_vpn,omitempty"`
 	DefaultInterface           string                            `json:"default_interface,omitempty"`

option/rule.go

@@ -103,8 +103,6 @@ type RawDefaultRule struct {
 	InterfaceAddress         *badjson.TypedMap[string, badoption.Listable[*badoption.Prefixable]]        `json:"interface_address,omitempty"`
 	NetworkInterfaceAddress  *badjson.TypedMap[InterfaceType, badoption.Listable[*badoption.Prefixable]] `json:"network_interface_address,omitempty"`
 	DefaultInterfaceAddress  badoption.Listable[*badoption.Prefixable]                                   `json:"default_interface_address,omitempty"`
-	SourceMACAddress         badoption.Listable[string]                                                  `json:"source_mac_address,omitempty"`
-	SourceHostname           badoption.Listable[string]                                                  `json:"source_hostname,omitempty"`
 	PreferredBy              badoption.Listable[string]                                                  `json:"preferred_by,omitempty"`
 	RuleSet                  badoption.Listable[string]                                                  `json:"rule_set,omitempty"`
 	RuleSetIPCIDRMatchSource bool                                                                        `json:"rule_set_ip_cidr_match_source,omitempty"`