documentation: Bump version

Refactor Authenticator interface to struct &
Update smux &
Update gVisor to 20231204.0 &
Update wireguard-go &
Add GSO support for TUN/WireGuard &
Fix router pre-start &
Fix bind forwarder to interface for systems stack

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -61,22 +61,7 @@ body:
     attributes:
       label: Logs
       description: |-
-        In addition, if you encounter a crash with the graphical client, please also provide crash logs.
+        If you encounter a crash with the graphical client, please provide crash logs.
         For Apple platform clients, please check `Settings - View Service Log` for crash logs.
         For the Android client, please check the `/sdcard/Android/data/io.nekohasekai.sfa/files/stderr.log` file for crash logs.
-      render: shell
-  - type: checkboxes
-    attributes:
-      label: Integrity requirements
-      description: |-
-        Please check all of the following options to prove that you have read and understood the requirements, otherwise this issue will be closed.
-        Sing-box is not a project aimed to please users who can't make any meaningful contributions and gain unethical influence. If you deceive here to deliberately waste the time of the developers, you will be permanently blocked.
-      options:
-        - label: I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
-          required: true
-        - label: I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
-          required: true
-        - label: I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
-          required: true
-        - label: I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.
-          required: true
+      render: shell

.github/ISSUE_TEMPLATE/bug_report_zh.yml

@@ -61,22 +61,21 @@ body:
     attributes:
       label: 日志
       description: |-
-        此外，如果您遭遇图形界面应用程序崩溃，请附加提供崩溃日志。
+        如果您遭遇图形界面应用程序崩溃，请提供崩溃日志。
         对于 Apple 平台图形客户端程序，请检查 `Settings - View Service Log` 以导出崩溃日志。
         对于 Android 图形客户端程序，请检查 `/sdcard/Android/data/io.nekohasekai.sfa/files/stderr.log` 文件以导出崩溃日志。
       render: shell
   - type: checkboxes
     attributes:
       label: 完整性要求
-      description: |-
-        请勾选以下所有选项以证明您已经阅读并理解了以下要求，否则该 issue 将被关闭。
-        sing-box 不是讨好无法作出任何意义上的贡献的最终用户并获取非道德影响力的项目，如果您在此处欺骗以故意浪费开发者的时间，您将被永久封锁。
+      description: 我保证我提供了完整的可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件，否则该 issue 将被关闭。
       options:
-        - label: 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
-          required: true
-        - label: 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
-          required: true
-        - label: 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
-          required: true
-        - label: 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
+        - label: 我保证
           required: true
+  - type: checkboxes
+    attributes:
+      label: 负责性要求
+      description: 我保证我阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值，否则该 issue 将被关闭。
+      options:
+        - label: 我保证
+          required: true

.github/workflows/debug.yml

@@ -216,7 +216,7 @@ jobs:
         id: build
         run: make
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: sing-box-${{ matrix.name }}
           path: sing-box*

cmd/sing-box/cmd_rule_set_compile.go

@@ -47,14 +47,10 @@ func compileRuleSet(sourcePath string) error {
 			return err
 		}
 	}
-	content, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	plainRuleSet, err := json.UnmarshalExtended[option.PlainRuleSetCompat](content)
-	if err != nil {
-		return err
-	}
+	decoder := json.NewDecoder(json.NewCommentFilter(reader))
+	decoder.DisallowUnknownFields()
+	var plainRuleSet option.PlainRuleSetCompat
+	err = decoder.Decode(&plainRuleSet)
 	if err != nil {
 		return err
 	}

cmd/sing-box/cmd_rule_set_format.go

@@ -50,14 +50,18 @@ func formatRuleSet(sourcePath string) error {
 	if err != nil {
 		return err
 	}
-	plainRuleSet, err := json.UnmarshalExtended[option.PlainRuleSetCompat](content)
+	decoder := json.NewDecoder(json.NewCommentFilter(bytes.NewReader(content)))
+	decoder.DisallowUnknownFields()
+	var plainRuleSet option.PlainRuleSetCompat
+	err = decoder.Decode(&plainRuleSet)
 	if err != nil {
 		return err
 	}
+	ruleSet := plainRuleSet.Upgrade()
 	buffer := new(bytes.Buffer)
 	encoder := json.NewEncoder(buffer)
 	encoder.SetIndent("", "  ")
-	err = encoder.Encode(plainRuleSet)
+	err = encoder.Encode(ruleSet)
 	if err != nil {
 		return E.Cause(err, "encode config")
 	}

common/geoip/reader.go

@@ -32,7 +32,3 @@ func (r *Reader) Lookup(addr netip.Addr) string {
 	}
 	return "unknown"
 }
-
-func (r *Reader) Close() error {
-	return r.reader.Close()
-}

common/tls/acme.go

@@ -105,16 +105,5 @@ func startACME(ctx context.Context, options option.InboundACMEOptions) (*tls.Con
 		},
 	})
 	config = certmagic.New(cache, *config)
-	var tlsConfig *tls.Config
-	if acmeConfig.DisableTLSALPNChallenge || acmeConfig.DNS01Solver != nil {
-		tlsConfig = &tls.Config{
-			GetCertificate: config.GetCertificate,
-		}
-	} else {
-		tlsConfig = &tls.Config{
-			GetCertificate: config.GetCertificate,
-			NextProtos:     []string{ACMETLS1Protocol},
-		}
-	}
-	return tlsConfig, &acmeWrapper{ctx: ctx, cfg: config, cache: cache, domain: options.Domain}, nil
+	return config.TLSConfig(), &acmeWrapper{ctx: ctx, cfg: config, cache: cache, domain: options.Domain}, nil
 }

common/tls/acme_contstant.go

@@ -1,3 +0,0 @@
-package tls
-
-const ACMETLS1Protocol = "acme-tls/1"

common/tls/std_server.go

@@ -39,19 +39,11 @@ func (c *STDServerConfig) SetServerName(serverName string) {
 }
 
 func (c *STDServerConfig) NextProtos() []string {
-	if c.acmeService != nil && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == ACMETLS1Protocol {
-		return c.config.NextProtos[1:]
-	} else {
-		return c.config.NextProtos
-	}
+	return c.config.NextProtos
 }
 
 func (c *STDServerConfig) SetNextProtos(nextProto []string) {
-	if c.acmeService != nil && len(c.config.NextProtos) > 1 && c.config.NextProtos[0] == ACMETLS1Protocol {
-		c.config.NextProtos = append(c.config.NextProtos[:1], nextProto...)
-	} else {
-		c.config.NextProtos = nextProto
-	}
+	c.config.NextProtos = nextProto
 }
 
 func (c *STDServerConfig) Config() (*STDConfig, error) {

debug_http.go

@@ -5,7 +5,6 @@ import (
 	"net/http/pprof"
 	"runtime"
 	"runtime/debug"
-	"strings"
 
 	"github.com/sagernet/sing-box/common/humanize"
 	"github.com/sagernet/sing-box/log"
@@ -48,20 +47,12 @@ func applyDebugListenOption(options option.DebugOptions) {
 			encoder.SetIndent("", "  ")
 			encoder.Encode(memObject)
 		})
-		r.Route("/pprof", func(r chi.Router) {
-			r.HandleFunc("/", func(writer http.ResponseWriter, request *http.Request) {
-				if !strings.HasSuffix(request.URL.Path, "/") {
-					http.Redirect(writer, request, request.URL.Path+"/", http.StatusMovedPermanently)
-				} else {
-					pprof.Index(writer, request)
-				}
-			})
-			r.HandleFunc("/*", pprof.Index)
-			r.HandleFunc("/cmdline", pprof.Cmdline)
-			r.HandleFunc("/profile", pprof.Profile)
-			r.HandleFunc("/symbol", pprof.Symbol)
-			r.HandleFunc("/trace", pprof.Trace)
-		})
+		r.HandleFunc("/pprof", pprof.Index)
+		r.HandleFunc("/pprof/*", pprof.Index)
+		r.HandleFunc("/pprof/cmdline", pprof.Cmdline)
+		r.HandleFunc("/pprof/profile", pprof.Profile)
+		r.HandleFunc("/pprof/symbol", pprof.Symbol)
+		r.HandleFunc("/pprof/trace", pprof.Trace)
 	})
 	debugHTTPServer = &http.Server{
 		Addr:    options.Listen,

debug_linux.go

@@ -1,5 +1,3 @@
-//go:build linux || darwin
-
 package box
 
 import (

debug_stub.go

@@ -1,4 +1,4 @@
-//go:build !(linux || darwin)
+//go:build !linux
 
 package box
 

docs/changelog.md

@@ -2,40 +2,10 @@
 icon: material/alert-decagram
 ---
 
-#### 1.8.0-rc.11
+#### 1.8.0-rc.2
 
 * Fixes and improvements
 
-#### 1.7.8
-
-* Fixes and improvements
-
-#### 1.8.0-rc.10
-
-* Fixes and improvements
-
-#### 1.7.7
-
-* Fix V2Ray transport `path` validation behavior **1**
-* Fixes and improvements
-
-**1**:
-
-See [V2Ray transport](/configuration/shared/v2ray-transport/).
-
-#### 1.8.0-rc.7
-
-* Fixes and improvements
-
-#### 1.8.0-rc.3
-
-* Fix V2Ray transport `path` validation behavior **1**
-* Fixes and improvements
-
-**1**:
-
-See [V2Ray transport](/configuration/shared/v2ray-transport/).
-
 #### 1.7.6
 
 * Fixes and improvements

docs/configuration/shared/tls.md

@@ -173,9 +173,10 @@ By default, the maximum version is currently TLS 1.3.
 
 #### cipher_suites
 
-A list of enabled TLS 1.0–1.2 cipher suites. The order of the list is ignored. Note that TLS 1.3 cipher suites are not configurable.
+The elliptic curves that will be used in an ECDHE handshake, in preference order.
 
-If empty, a safe default list is used. The default cipher suites might change over time.
+If empty, the default will be used. The client will use the first preference as the type for its key share in TLS 1.3.
+This may change in the future.
 
 #### certificate
 

docs/configuration/shared/tls.zh.md

@@ -170,9 +170,12 @@ TLS 版本值：
 
 #### cipher_suites
 
-启用的 TLS 1.0-1.2密码套件的列表。列表的顺序被忽略。请注意，TLS 1.3 的密码套件是不可配置的。
+将在 ECDHE 握手中使用的椭圆曲线，按优先顺序排列。
 
-如果为空，则使用安全的默认列表。默认密码套件可能会随着时间的推移而改变。
+如果为空，将使用默认值。
+
+客户端将使用第一个首选项作为其在 TLS 1.3 中的密钥共享类型。
+这在未来可能会改变。
 
 #### certificate
 

docs/configuration/shared/v2ray-transport.md

@@ -53,15 +53,9 @@ The client will choose randomly and the server will verify if not empty.
 
 #### path
 
-!!! warning
-
-    V2Ray's documentation says that the path between the server and the client must be consistent, 
-    but the actual code allows the client to add any suffix to the path.
-    sing-box uses the same behavior as V2Ray, but note that the behavior does not exist in `WebSocket` and `HTTPUpgrade` transport.
-
 Path of HTTP request.
 
-The server will verify.
+The server will verify if not empty.
 
 #### method
 
@@ -83,10 +77,7 @@ Specifies the time until idle clients should be closed with a GOAWAY frame. PING
 
 In HTTP2 client:
 
-Specifies the period of time after which a health check will be performed using a ping frame if no frames have been
-received on the connection.Please note that a ping response is considered a received frame, so if there is no other
-traffic on the connection, the health check will be executed every interval. If the value is zero, no health check will
-be performed.
+Specifies the period of time after which a health check will be performed using a ping frame if no frames have been received on the connection. Please note that a ping response is considered a received frame, so if there is no other traffic on the connection, the health check will be executed every interval. If the value is zero, no health check will be performed.
 
 Zero is used by default.
 
@@ -94,9 +85,7 @@ Zero is used by default.
 
 In HTTP2 client:
 
-Specifies the timeout duration after sending a PING frame, within which a response must be received.
-If a response to the PING frame is not received within the specified timeout duration, the connection will be closed.
-The default timeout duration is 15 seconds.
+Specifies the timeout duration after sending a PING frame, within which a response must be received. If a response to the PING frame is not received within the specified timeout duration, the connection will be closed. The default timeout duration is 15 seconds.
 
 ### WebSocket
 
@@ -114,14 +103,12 @@ The default timeout duration is 15 seconds.
 
 Path of HTTP request.
 
-The server will verify.
+The server will verify if not empty.
 
 #### headers
 
 Extra headers of HTTP request.
 
-The server will write in response if not empty.
-
 #### max_early_data
 
 Allowed payload size is in the request. Enabled if not zero.
@@ -171,8 +158,7 @@ Service name of gRPC.
 
 In standard gRPC server/client:
 
-If the transport doesn't see any activity after a duration of this time,
-it pings the client to check if the connection is still active.
+If the transport doesn't see any activity after a duration of this time, it pings the client to check if the connection is still active.
 
 In default gRPC server/client:
 
@@ -182,8 +168,7 @@ It has the same behavior as the corresponding setting in HTTP transport.
 
 In standard gRPC server/client:
 
-The timeout that after performing a keepalive check, the client will wait for activity.
-If no activity is detected, the connection will be closed.
+The timeout that after performing a keepalive check, the client will wait for activity. If no activity is detected, the connection will be closed.
 
 In default gRPC server/client:
 
@@ -193,9 +178,7 @@ It has the same behavior as the corresponding setting in HTTP transport.
 
 In standard gRPC client:
 
-If enabled, the client transport sends keepalive pings even with no active connections.
-If disabled, when there are no active connections, `idle_timeout` and `ping_timeout` will be ignored and no keepalive
-pings will be sent.
+If enabled, the client transport sends keepalive pings even with no active connections. If disabled, when there are no active connections, `idle_timeout` and `ping_timeout` will be ignored and no keepalive pings will be sent.
 
 Disabled by default.
 
@@ -220,7 +203,7 @@ The server will verify if not empty.
 
 Path of HTTP request.
 
-The server will verify.
+The server will verify if not empty.
 
 #### headers
 

docs/configuration/shared/v2ray-transport.zh.md

@@ -48,30 +48,25 @@ V2Ray Transport 是 v2ray 发明的一组私有协议，并污染了其他协议
 
 主机域名列表。
 
-如果设置，客户端将随机选择，服务器将验证。
+客户端将随机选择，默认服务器将验证。
 
 #### path
 
-!!! warning
-
-    V2Ray 文档称服务端和客户端的路径必须一致，但实际代码允许客户端向路径添加任何后缀。
-    sing-box 使用与 V2Ray 相同的行为，但请注意，该行为在 `WebSocket` 和 `HTTPUpgrade` 传输层中不存在。
-
 HTTP 请求路径
 
-服务器将验证。
+默认服务器将验证。
 
 #### method
 
 HTTP 请求方法
 
-如果设置，服务器将验证。
+默认服务器将验证。
 
 #### headers
 
 HTTP 请求的额外标头
 
-如果设置，服务器将写入响应。
+默认服务器将写入响应。
 
 #### idle_timeout
 
@@ -107,13 +102,11 @@ HTTP 请求的额外标头
 
 HTTP 请求路径
 
-服务器将验证。
+默认服务器将验证。
 
 #### headers
 
-HTTP 请求的额外标头
-
-如果设置，服务器将写入响应。
+HTTP 请求的额外标头。
 
 #### max_early_data
 
@@ -203,16 +196,16 @@ gRPC 服务名称。
 
 主机域名。
 
-服务器将验证。
+默认服务器将验证。
 
 #### path
 
 HTTP 请求路径
 
-服务器将验证。
+默认服务器将验证。
 
 #### headers
 
 HTTP 请求的额外标头。
 
-如果设置，服务器将写入响应。
+默认服务器将写入响应。

docs/manual/proxy/client.md

@@ -330,7 +330,10 @@ flowchart TB
                 "invert": true
               },
               {
-                "geosite": "cn",
+                "geosite": [
+                  "cn",
+                  "category-companies@cn"
+                ],
               }
             ],
             "server": "local"
@@ -382,7 +385,10 @@ flowchart TB
                 "invert": true
               },
               {
-                "rule_set": "geosite-cn",
+                "rule_set": [
+                  "geosite-cn",
+                  "geosite-category-companies@cn"
+                ]
               }
             ],
             "server": "local"
@@ -402,6 +408,12 @@ flowchart TB
             "tag": "geosite-geolocation-!cn",
             "format": "binary",
             "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
+          },
+          {
+            "type": "remote",
+            "tag": "geosite-category-companies@cn",
+            "format": "binary",
+            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
           }
         ]
       }
@@ -475,7 +487,10 @@ flowchart TB
                 "invert": true
               },
               {
-                "geosite": "cn",
+                "geosite": [
+                  "cn",
+                  "category-companies@cn"
+                ],
                 "geoip": "cn"
               }
             ],
@@ -555,7 +570,8 @@ flowchart TB
               {
                 "rule_set": [
                   "geoip-cn",
-                  "geosite-cn"
+                  "geosite-cn",
+                  "geosite-category-companies@cn"
                 ]
               }
             ],
@@ -580,6 +596,12 @@ flowchart TB
             "tag": "geosite-geolocation-!cn",
             "format": "binary",
             "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
+          },
+          {
+            "type": "remote",
+            "tag": "geosite-category-companies@cn",
+            "format": "binary",
+            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
           }
         ]
       }

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/cloudflare/circl v1.3.6
 	github.com/cretz/bine v0.2.0
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-chi/chi/v5 v5.0.11
+	github.com/go-chi/chi/v5 v5.0.10
 	github.com/go-chi/cors v1.2.1
 	github.com/go-chi/render v1.0.3
 	github.com/gofrs/uuid/v5 v5.0.0
@@ -24,12 +24,12 @@ require (
 	github.com/sagernet/cloudflare-tls v0.0.0-20231208171750-a4483c1b7cd1
 	github.com/sagernet/gomobile v0.1.1
 	github.com/sagernet/gvisor v0.0.0-20231209105102-8d27a30e436e
-	github.com/sagernet/quic-go v0.40.1-beta.2
+	github.com/sagernet/quic-go v0.40.0
 	github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691
-	github.com/sagernet/sing v0.3.0-rc.7
+	github.com/sagernet/sing v0.3.0-rc.3
 	github.com/sagernet/sing-dns v0.1.12
-	github.com/sagernet/sing-mux v0.1.8-rc.1
-	github.com/sagernet/sing-quic v0.1.7-rc.2
+	github.com/sagernet/sing-mux v0.1.7-rc.1
+	github.com/sagernet/sing-quic v0.1.7-rc.1
 	github.com/sagernet/sing-shadowsocks v0.2.6
 	github.com/sagernet/sing-shadowsocks2 v0.1.6-rc.1
 	github.com/sagernet/sing-shadowtls v0.1.4
@@ -48,8 +48,8 @@ require (
 	golang.org/x/net v0.19.0
 	golang.org/x/sys v0.15.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
-	google.golang.org/grpc v1.60.1
-	google.golang.org/protobuf v1.32.0
+	google.golang.org/grpc v1.59.0
+	google.golang.org/protobuf v1.31.0
 	howett.net/plist v1.0.1
 )
 
@@ -86,12 +86,12 @@ require (
 	github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20231226003508-02704c960a9b // indirect
+	golang.org/x/exp v0.0.0-20231219180239-dc181d75b848 // indirect
 	golang.org/x/mod v0.14.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.16.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/blake3 v1.2.1 // indirect

go.sum

@@ -19,8 +19,8 @@ github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nos
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/gaukas/godicttls v0.0.4 h1:NlRaXb3J6hAnTmWdsEKb9bcSBD6BvcIjdGdeb0zfXbk=
 github.com/gaukas/godicttls v0.0.4/go.mod h1:l6EenT4TLWgTdwslVb4sEMOCf7Bv0JAK67deKr9/NCI=
-github.com/go-chi/chi/v5 v5.0.11 h1:BnpYbFZ3T3S1WMpD79r7R5ThWX40TaFB7L31Y8xqSwA=
-github.com/go-chi/chi/v5 v5.0.11/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/chi/v5 v5.0.10 h1:rLz5avzKpjqxrYwXNfmjkrYYXOyLJd37pz53UFHC6vk=
+github.com/go-chi/chi/v5 v5.0.10/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
 github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
 github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
@@ -104,19 +104,21 @@ github.com/sagernet/gvisor v0.0.0-20231209105102-8d27a30e436e h1:DOkjByVeAR56dks
 github.com/sagernet/gvisor v0.0.0-20231209105102-8d27a30e436e/go.mod h1:fLxq/gtp0qzkaEwywlRRiGmjOK5ES/xUzyIKIFP2Asw=
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97 h1:iL5gZI3uFp0X6EslacyapiRz7LLSJyr4RajF/BhMVyE=
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
-github.com/sagernet/quic-go v0.40.1-beta.2 h1:USRwm36XuAFdcrmv4vDRD+YUOO08DfvLNruXThrVHZU=
-github.com/sagernet/quic-go v0.40.1-beta.2/go.mod h1:CcKTpzTAISxrM4PA5M20/wYuz9Tj6Tx4DwGbNl9UQrU=
+github.com/sagernet/quic-go v0.40.0 h1:DvQNPb72lzvNQDe9tcUyHTw8eRv6PLtM2mNYmdlzUMo=
+github.com/sagernet/quic-go v0.40.0/go.mod h1:VqtdhlbkeeG5Okhb3eDMb/9o0EoglReHunNT9ukrJAI=
 github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691 h1:5Th31OC6yj8byLGkEnIYp6grlXfo1QYUfiYFGjewIdc=
 github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691/go.mod h1:B8lp4WkQ1PwNnrVMM6KyuFR20pU8jYBD+A4EhJovEXU=
 github.com/sagernet/sing v0.2.18/go.mod h1:OL6k2F0vHmEzXz2KW19qQzu172FDgSbUSODylighuVo=
-github.com/sagernet/sing v0.3.0-rc.7 h1:FmnzFRYC6usVgWf112cUxiexwvL+iAurKmCL4Axa9+A=
-github.com/sagernet/sing v0.3.0-rc.7/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
+github.com/sagernet/sing v0.3.0-rc.3 h1:4GVTffZlbFkBTg3woQBY3O+y/jFUvlbY6u5TYu4G4Ck=
+github.com/sagernet/sing v0.3.0-rc.3/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
+github.com/sagernet/sing v0.3.0-rc.3.0.20231221131018-2b0a53a3a6c4 h1:0fzuZBSmCSWUQu2ZexJ8ys4Cg+mth2Nzu4ZwYolJ2GU=
+github.com/sagernet/sing v0.3.0-rc.3.0.20231221131018-2b0a53a3a6c4/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
 github.com/sagernet/sing-dns v0.1.12 h1:1HqZ+ln+Rezx/aJMStaS0d7oPeX2EobSV1NT537kyj4=
 github.com/sagernet/sing-dns v0.1.12/go.mod h1:rx/DTOisneQpCgNQ4jbFU/JNEtnz0lYcHXenlVzpjEU=
-github.com/sagernet/sing-mux v0.1.8-rc.1 h1:5dsZgWmNr9W6JzQj4fb3xX2pMP0OyJH6kVtlqc2kFKA=
-github.com/sagernet/sing-mux v0.1.8-rc.1/go.mod h1:KK5zCbNujj5kn36G+wLFROOXyJhaaXLyaZWY2w7kBNQ=
-github.com/sagernet/sing-quic v0.1.7-rc.2 h1:rCWhtvzQwgkWbX4sVHYdNwzyPweoUPEgBCBatywHjMs=
-github.com/sagernet/sing-quic v0.1.7-rc.2/go.mod h1:IbKCPWXP13zd3cdu0rirtYjkMlquc5zWtc3avfSUGAw=
+github.com/sagernet/sing-mux v0.1.7-rc.1 h1:4XlQSeIqKA6uaW1KGQA9wCG5zt9ajhvc/zJnnZV/n1c=
+github.com/sagernet/sing-mux v0.1.7-rc.1/go.mod h1:KK5zCbNujj5kn36G+wLFROOXyJhaaXLyaZWY2w7kBNQ=
+github.com/sagernet/sing-quic v0.1.7-rc.1 h1:HoZC7YFmHCpfrUNXbousGauLw6yg25f6qcIkqrYIDbg=
+github.com/sagernet/sing-quic v0.1.7-rc.1/go.mod h1:+XDZtFPD8YJ4V1MMObOdf2k5+Ma1jy75OlRnlBUHihI=
 github.com/sagernet/sing-shadowsocks v0.2.6 h1:xr7ylAS/q1cQYS8oxKKajhuQcchd5VJJ4K4UZrrpp0s=
 github.com/sagernet/sing-shadowsocks v0.2.6/go.mod h1:j2YZBIpWIuElPFL/5sJAj470bcn/3QQ5lxZUNKLDNAM=
 github.com/sagernet/sing-shadowsocks2 v0.1.6-rc.1 h1:E+8OyyVg0YfFNUmxMx9jYBEhjLYMQSAMzJrUmE934bo=
@@ -170,8 +172,8 @@ golang.org/x/crypto v0.0.0-20190404164418-38d8ce5564a5/go.mod h1:WFFai1msRO1wXaE
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/exp v0.0.0-20231226003508-02704c960a9b h1:kLiC65FbiHWFAOu+lxwNPujcsl8VYyTYYEZnsOO1WK4=
-golang.org/x/exp v0.0.0-20231226003508-02704c960a9b/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20231219180239-dc181d75b848 h1:+iq7lrkxmFNBM7xx+Rae2W6uyPfhPeDWD+n+JgppptE=
+golang.org/x/exp v0.0.0-20231219180239-dc181d75b848/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -204,14 +206,14 @@ golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97 h1:6GQBEOdGkX6MMTLT9V+TjtIRZCw9VPD5Z+yHY9wMgS0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97/go.mod h1:v7nGkzlmW8P3n/bKmWBn2WpBjpOEx8Q6gMueudAmKfY=
-google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
-google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

option/inbound.go

@@ -122,18 +122,14 @@ type ListenOptions struct {
 
 type UDPTimeoutCompat Duration
 
-func (c UDPTimeoutCompat) MarshalJSON() ([]byte, error) {
-	return json.Marshal((time.Duration)(c).String())
-}
-
-func (c *UDPTimeoutCompat) UnmarshalJSON(data []byte) error {
+func (u *UDPTimeoutCompat) UnmarshalJSON(data []byte) error {
 	var valueNumber int64
 	err := json.Unmarshal(data, &valueNumber)
 	if err == nil {
-		*c = UDPTimeoutCompat(time.Second * time.Duration(valueNumber))
+		*u = UDPTimeoutCompat(time.Second * time.Duration(valueNumber))
 		return nil
 	}
-	return json.Unmarshal(data, (*Duration)(c))
+	return json.Unmarshal(data, (*Duration)(u))
 }
 
 type ListenOptionsWrapper interface {

outbound/urltest.go

@@ -44,7 +44,6 @@ func NewURLTest(ctx context.Context, router adapter.Router, logger log.ContextLo
 	outbound := &URLTest{
 		myOutboundAdapter: myOutboundAdapter{
 			protocol:     C.TypeURLTest,
-			network:      []string{N.NetworkTCP, N.NetworkUDP},
 			router:       router,
 			logger:       logger,
 			tag:          tag,
@@ -64,6 +63,13 @@ func NewURLTest(ctx context.Context, router adapter.Router, logger log.ContextLo
 	return outbound, nil
 }
 
+func (s *URLTest) Network() []string {
+	if s.group == nil {
+		return []string{N.NetworkTCP, N.NetworkUDP}
+	}
+	return s.group.Select(N.NetworkTCP).Network()
+}
+
 func (s *URLTest) Start() error {
 	outbounds := make([]adapter.Outbound, 0, len(s.tags))
 	for i, tag := range s.tags {
@@ -103,12 +109,7 @@ func (s *URLTest) Close() error {
 }
 
 func (s *URLTest) Now() string {
-	if s.group.selectedOutboundTCP != nil {
-		return s.group.selectedOutboundTCP.Tag()
-	} else if s.group.selectedOutboundUDP != nil {
-		return s.group.selectedOutboundUDP.Tag()
-	}
-	return ""
+	return s.group.Select(N.NetworkTCP).Tag()
 }
 
 func (s *URLTest) All() []string {
@@ -126,9 +127,6 @@ func (s *URLTest) CheckOutbounds() {
 func (s *URLTest) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
 	s.group.Touch()
 	outbound := s.group.Select(network)
-	if outbound == nil {
-		return nil, E.New("missing supported outbound")
-	}
 	conn, err := outbound.DialContext(ctx, network, destination)
 	if err == nil {
 		return s.group.interruptGroup.NewConn(conn, interrupt.IsExternalConnectionFromContext(ctx)), nil
@@ -141,9 +139,6 @@ func (s *URLTest) DialContext(ctx context.Context, network string, destination M
 func (s *URLTest) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
 	s.group.Touch()
 	outbound := s.group.Select(N.NetworkUDP)
-	if outbound == nil {
-		return nil, E.New("missing supported outbound")
-	}
 	conn, err := outbound.ListenPacket(ctx, destination)
 	if err == nil {
 		return s.group.interruptGroup.NewPacketConn(conn, interrupt.IsExternalConnectionFromContext(ctx)), nil
@@ -384,12 +379,12 @@ func (g *URLTestGroup) urlTest(ctx context.Context, force bool) (map[string]uint
 func (g *URLTestGroup) performUpdateCheck() {
 	outbound := g.Select(N.NetworkTCP)
 	var updated bool
-	if outbound != nil && outbound != g.selectedOutboundTCP {
+	if outbound != g.selectedOutboundTCP {
 		g.selectedOutboundTCP = outbound
 		updated = true
 	}
 	outbound = g.Select(N.NetworkUDP)
-	if outbound != nil && outbound != g.selectedOutboundUDP {
+	if outbound != g.selectedOutboundUDP {
 		g.selectedOutboundUDP = outbound
 		updated = true
 	}

route/router.go

@@ -629,7 +629,7 @@ func (r *Router) Close() error {
 	}
 	if r.geoIPReader != nil {
 		monitor.Start("close geoip reader")
-		err = E.Append(err, r.geoIPReader.Close(), func(err error) error {
+		err = E.Append(err, common.Close(r.geoIPReader), func(err error) error {
 			return E.Cause(err, "close geoip reader")
 		})
 		monitor.Finish()

route/rule_set_local.go

@@ -20,23 +20,22 @@ type LocalRuleSet struct {
 }
 
 func NewLocalRuleSet(router adapter.Router, options option.RuleSet) (*LocalRuleSet, error) {
+	setFile, err := os.Open(options.LocalOptions.Path)
+	if err != nil {
+		return nil, err
+	}
 	var plainRuleSet option.PlainRuleSet
 	switch options.Format {
 	case C.RuleSetFormatSource, "":
-		content, err := os.ReadFile(options.LocalOptions.Path)
-		if err != nil {
-			return nil, err
-		}
-		compat, err := json.UnmarshalExtended[option.PlainRuleSetCompat](content)
+		var compat option.PlainRuleSetCompat
+		decoder := json.NewDecoder(json.NewCommentFilter(setFile))
+		decoder.DisallowUnknownFields()
+		err = decoder.Decode(&compat)
 		if err != nil {
 			return nil, err
 		}
 		plainRuleSet = compat.Upgrade()
 	case C.RuleSetFormatBinary:
-		setFile, err := os.Open(options.LocalOptions.Path)
-		if err != nil {
-			return nil, err
-		}
 		plainRuleSet, err = srs.Read(setFile, false)
 		if err != nil {
 			return nil, err
@@ -45,7 +44,6 @@ func NewLocalRuleSet(router adapter.Router, options option.RuleSet) (*LocalRuleS
 		return nil, E.New("unknown rule set format: ", options.Format)
 	}
 	rules := make([]adapter.HeadlessRule, len(plainRuleSet.Rules))
-	var err error
 	for i, ruleOptions := range plainRuleSet.Rules {
 		rules[i], err = NewHeadlessRule(router, ruleOptions)
 		if err != nil {

route/rule_set_remote.go

@@ -128,7 +128,9 @@ func (s *RemoteRuleSet) loadBytes(content []byte) error {
 	switch s.options.Format {
 	case C.RuleSetFormatSource:
 		var compat option.PlainRuleSetCompat
-		compat, err = json.UnmarshalExtended[option.PlainRuleSetCompat](content)
+		decoder := json.NewDecoder(json.NewCommentFilter(bytes.NewReader(content)))
+		decoder.DisallowUnknownFields()
+		err = decoder.Decode(&compat)
 		if err != nil {
 			return err
 		}

test/mux_test.go

@@ -75,9 +75,6 @@ func testShadowsocksMux(t *testing.T, options option.OutboundMultiplexOptions) {
 					},
 					Method:   method,
 					Password: password,
-					Multiplex: &option.InboundMultiplexOptions{
-						Enabled: true,
-					},
 				},
 			},
 		},

transport/v2raygrpclite/conn.go

@@ -2,16 +2,19 @@ package v2raygrpclite
 
 import (
 	std_bufio "bufio"
+	"bytes"
 	"encoding/binary"
 	"io"
 	"net"
 	"net/http"
 	"os"
+	"sync"
 	"time"
 
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/baderror"
 	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/bufio"
 	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/rw"
 )
@@ -27,6 +30,7 @@ type GunConn struct {
 	create        chan struct{}
 	err           error
 	readRemaining int
+	writeAccess   sync.Mutex
 }
 
 func newGunConn(reader io.Reader, writer io.Writer, flusher http.Flusher) *GunConn {
@@ -96,22 +100,19 @@ func (c *GunConn) read(b []byte) (n int, err error) {
 }
 
 func (c *GunConn) Write(b []byte) (n int, err error) {
-	varLen := rw.UVariantLen(uint64(len(b)))
-	buffer := buf.NewSize(6 + varLen + len(b))
-	header := buffer.Extend(6 + varLen)
-	header[0] = 0x00
-	binary.BigEndian.PutUint32(header[1:5], uint32(1+varLen+len(b)))
-	header[5] = 0x0A
-	binary.PutUvarint(header[6:], uint64(len(b)))
-	common.Must1(buffer.Write(b))
-	_, err = c.writer.Write(buffer.Bytes())
-	if err != nil {
-		return 0, baderror.WrapH2(err)
-	}
-	if c.flusher != nil {
+	protobufHeader := [1 + binary.MaxVarintLen64]byte{0x0A}
+	varuintLen := binary.PutUvarint(protobufHeader[1:], uint64(len(b)))
+	grpcHeader := buf.Get(5)
+	grpcPayloadLen := uint32(1 + varuintLen + len(b))
+	binary.BigEndian.PutUint32(grpcHeader[1:5], grpcPayloadLen)
+	c.writeAccess.Lock()
+	_, err = bufio.Copy(c.writer, io.MultiReader(bytes.NewReader(grpcHeader), bytes.NewReader(protobufHeader[:varuintLen+1]), bytes.NewReader(b)))
+	c.writeAccess.Unlock()
+	buf.Put(grpcHeader)
+	if err == nil && c.flusher != nil {
 		c.flusher.Flush()
 	}
-	return len(b), nil
+	return len(b), baderror.WrapH2(err)
 }
 
 func (c *GunConn) WriteBuffer(buffer *buf.Buffer) error {
@@ -119,18 +120,16 @@ func (c *GunConn) WriteBuffer(buffer *buf.Buffer) error {
 	dataLen := buffer.Len()
 	varLen := rw.UVariantLen(uint64(dataLen))
 	header := buffer.ExtendHeader(6 + varLen)
+	_ = header[6]
 	header[0] = 0x00
 	binary.BigEndian.PutUint32(header[1:5], uint32(1+varLen+dataLen))
 	header[5] = 0x0A
 	binary.PutUvarint(header[6:], uint64(dataLen))
 	err := rw.WriteBytes(c.writer, buffer.Bytes())
-	if err != nil {
-		return baderror.WrapH2(err)
-	}
-	if c.flusher != nil {
+	if err == nil && c.flusher != nil {
 		c.flusher.Flush()
 	}
-	return nil
+	return baderror.WrapH2(err)
 }
 
 func (c *GunConn) FrontHeadroom() int {

transport/v2rayhttp/client.go

@@ -7,7 +7,6 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"strings"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -29,7 +28,7 @@ type Client struct {
 	serverAddr M.Socksaddr
 	transport  http.RoundTripper
 	http2      bool
-	requestURL url.URL
+	url        *url.URL
 	host       []string
 	method     string
 	headers    http.Header
@@ -59,35 +58,33 @@ func NewClient(ctx context.Context, dialer N.Dialer, serverAddr M.Socksaddr, opt
 			},
 		}
 	}
-	if options.Method == "" {
-		options.Method = http.MethodPut
-	}
-	var requestURL url.URL
-	if tlsConfig == nil {
-		requestURL.Scheme = "http"
-	} else {
-		requestURL.Scheme = "https"
-	}
-	requestURL.Host = serverAddr.String()
-	requestURL.Path = options.Path
-	err := sHTTP.URLSetPath(&requestURL, options.Path)
-	if err != nil {
-		return nil, E.Cause(err, "parse path")
-	}
-	if !strings.HasPrefix(requestURL.Path, "/") {
-		requestURL.Path = "/" + requestURL.Path
-	}
-	return &Client{
+	client := &Client{
 		ctx:        ctx,
 		dialer:     dialer,
 		serverAddr: serverAddr,
-		requestURL: requestURL,
 		host:       options.Host,
 		method:     options.Method,
 		headers:    options.Headers.Build(),
 		transport:  transport,
 		http2:      tlsConfig != nil,
-	}, nil
+	}
+	if client.method == "" {
+		client.method = "PUT"
+	}
+	var uri url.URL
+	if tlsConfig == nil {
+		uri.Scheme = "http"
+	} else {
+		uri.Scheme = "https"
+	}
+	uri.Host = serverAddr.String()
+	uri.Path = options.Path
+	err := sHTTP.URLSetPath(&uri, options.Path)
+	if err != nil {
+		return nil, E.Cause(err, "parse path")
+	}
+	client.url = &uri
+	return client, nil
 }
 
 func (c *Client) DialContext(ctx context.Context) (net.Conn, error) {
@@ -106,7 +103,7 @@ func (c *Client) dialHTTP(ctx context.Context) (net.Conn, error) {
 
 	request := &http.Request{
 		Method: c.method,
-		URL:    &c.requestURL,
+		URL:    c.url,
 		Header: c.headers.Clone(),
 	}
 	switch hostLen := len(c.host); hostLen {
@@ -126,7 +123,7 @@ func (c *Client) dialHTTP2(ctx context.Context) (net.Conn, error) {
 	request := &http.Request{
 		Method: c.method,
 		Body:   pipeInReader,
-		URL:    &c.requestURL,
+		URL:    c.url,
 		Header: c.headers.Clone(),
 	}
 	request = request.WithContext(ctx)

transport/v2rayhttpupgrade/server.go

@@ -65,7 +65,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 		s.invalidRequest(writer, request, http.StatusBadRequest, E.New("bad host: ", host))
 		return
 	}
-	if request.URL.Path != s.path {
+	if !strings.HasPrefix(request.URL.Path, s.path) {
 		s.invalidRequest(writer, request, http.StatusNotFound, E.New("bad path: ", request.URL.Path))
 		return
 	}

transport/v2raywebsocket/client.go

@@ -55,10 +55,15 @@ func NewClient(ctx context.Context, dialer N.Dialer, serverAddr M.Socksaddr, opt
 	if !strings.HasPrefix(requestURL.Path, "/") {
 		requestURL.Path = "/" + requestURL.Path
 	}
-	headers := options.Headers.Build()
-	if host := headers.Get("Host"); host != "" {
-		headers.Del("Host")
-		requestURL.Host = host
+	headers := make(http.Header)
+	for key, value := range options.Headers {
+		headers[key] = value
+		if key == "Host" {
+			if len(value) > 1 {
+				return nil, E.New("multiple Host headers")
+			}
+			requestURL.Host = value[0]
+		}
 	}
 	if headers.Get("User-Agent") == "" {
 		headers.Set("User-Agent", "Go-http-client/1.1")

transport/v2raywebsocket/server.go

@@ -33,7 +33,6 @@ type Server struct {
 	path                string
 	maxEarlyData        uint32
 	earlyDataHeaderName string
-	upgrader            ws.HTTPUpgrader
 }
 
 func NewServer(ctx context.Context, options option.V2RayWebsocketOptions, tlsConfig tls.ServerConfig, handler adapter.V2RayServerTransportHandler) (*Server, error) {
@@ -44,10 +43,6 @@ func NewServer(ctx context.Context, options option.V2RayWebsocketOptions, tlsCon
 		path:                options.Path,
 		maxEarlyData:        options.MaxEarlyData,
 		earlyDataHeaderName: options.EarlyDataHeaderName,
-		upgrader: ws.HTTPUpgrader{
-			Timeout: C.TCPTimeout,
-			Header:  options.Headers.Build(),
-		},
 	}
 	if !strings.HasPrefix(server.path, "/") {
 		server.path = "/" + server.path
@@ -84,10 +79,6 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 			return
 		}
 	} else {
-		if request.URL.Path != s.path {
-			s.invalidRequest(writer, request, http.StatusNotFound, E.New("bad path: ", request.URL.Path))
-			return
-		}
 		earlyDataStr := request.Header.Get(s.earlyDataHeaderName)
 		if earlyDataStr != "" {
 			earlyData, err = base64.RawURLEncoding.DecodeString(earlyDataStr)