documentation: Bump version

Refactor Authenticator interface to struct &
Update smux &
Update gVisor to 20231204.0 &
Update quic-go to v0.40.1 &
Update wireguard-go &
Add GSO support for TUN/WireGuard &
Fix router pre-start &
Fix bind forwarder to interface for systems stack

common/geoip/reader.go

@@ -32,3 +32,7 @@ func (r *Reader) Lookup(addr netip.Addr) string {
 	}
 	return "unknown"
 }
+
+func (r *Reader) Close() error {
+	return r.reader.Close()
+}

debug_http.go

@@ -5,6 +5,7 @@ import (
 	"net/http/pprof"
 	"runtime"
 	"runtime/debug"
+	"strings"
 
 	"github.com/sagernet/sing-box/common/humanize"
 	"github.com/sagernet/sing-box/log"
@@ -47,12 +48,20 @@ func applyDebugListenOption(options option.DebugOptions) {
 			encoder.SetIndent("", "  ")
 			encoder.Encode(memObject)
 		})
-		r.HandleFunc("/pprof", pprof.Index)
-		r.HandleFunc("/pprof/*", pprof.Index)
-		r.HandleFunc("/pprof/cmdline", pprof.Cmdline)
-		r.HandleFunc("/pprof/profile", pprof.Profile)
-		r.HandleFunc("/pprof/symbol", pprof.Symbol)
-		r.HandleFunc("/pprof/trace", pprof.Trace)
+		r.Route("/pprof", func(r chi.Router) {
+			r.HandleFunc("/", func(writer http.ResponseWriter, request *http.Request) {
+				if !strings.HasSuffix(request.URL.Path, "/") {
+					http.Redirect(writer, request, request.URL.Path+"/", http.StatusMovedPermanently)
+				} else {
+					pprof.Index(writer, request)
+				}
+			})
+			r.HandleFunc("/*", pprof.Index)
+			r.HandleFunc("/cmdline", pprof.Cmdline)
+			r.HandleFunc("/profile", pprof.Profile)
+			r.HandleFunc("/symbol", pprof.Symbol)
+			r.HandleFunc("/trace", pprof.Trace)
+		})
 	})
 	debugHTTPServer = &http.Server{
 		Addr:    options.Listen,

debug_stub.go

@@ -1,4 +1,4 @@
-//go:build !linux
+//go:build !(linux || darwin)
 
 package box
 

debug_unix.go

@@ -1,3 +1,5 @@
+//go:build linux || darwin
+
 package box
 
 import (

docs/changelog.md

@@ -2,6 +2,27 @@
 icon: material/alert-decagram
 ---
 
+#### 1.8.0-rc.11
+
+* Fixes and improvements
+
+#### 1.7.8
+
+* Fixes and improvements
+
+#### 1.8.0-rc.10
+
+* Fixes and improvements
+
+#### 1.7.7
+
+* Fix V2Ray transport `path` validation behavior **1**
+* Fixes and improvements
+
+**1**:
+
+See [V2Ray transport](/configuration/shared/v2ray-transport/).
+
 #### 1.8.0-rc.7
 
 * Fixes and improvements

docs/configuration/shared/tls.md

@@ -173,10 +173,9 @@ By default, the maximum version is currently TLS 1.3.
 
 #### cipher_suites
 
-The elliptic curves that will be used in an ECDHE handshake, in preference order.
+A list of enabled TLS 1.0–1.2 cipher suites. The order of the list is ignored. Note that TLS 1.3 cipher suites are not configurable.
 
-If empty, the default will be used. The client will use the first preference as the type for its key share in TLS 1.3.
-This may change in the future.
+If empty, a safe default list is used. The default cipher suites might change over time.
 
 #### certificate
 

docs/configuration/shared/tls.zh.md

@@ -170,12 +170,9 @@ TLS 版本值：
 
 #### cipher_suites
 
-将在 ECDHE 握手中使用的椭圆曲线，按优先顺序排列。
+启用的 TLS 1.0-1.2密码套件的列表。列表的顺序被忽略。请注意，TLS 1.3 的密码套件是不可配置的。
 
-如果为空，将使用默认值。
-
-客户端将使用第一个首选项作为其在 TLS 1.3 中的密钥共享类型。
-这在未来可能会改变。
+如果为空，则使用安全的默认列表。默认密码套件可能会随着时间的推移而改变。
 
 #### certificate
 

docs/manual/proxy/client.md

@@ -330,10 +330,7 @@ flowchart TB
                 "invert": true
               },
               {
-                "geosite": [
-                  "cn",
-                  "category-companies@cn"
-                ],
+                "geosite": "cn",
               }
             ],
             "server": "local"
@@ -385,10 +382,7 @@ flowchart TB
                 "invert": true
               },
               {
-                "rule_set": [
-                  "geosite-cn",
-                  "geosite-category-companies@cn"
-                ]
+                "rule_set": "geosite-cn",
               }
             ],
             "server": "local"
@@ -408,12 +402,6 @@ flowchart TB
             "tag": "geosite-geolocation-!cn",
             "format": "binary",
             "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-category-companies@cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
           }
         ]
       }
@@ -487,10 +475,7 @@ flowchart TB
                 "invert": true
               },
               {
-                "geosite": [
-                  "cn",
-                  "category-companies@cn"
-                ],
+                "geosite": "cn",
                 "geoip": "cn"
               }
             ],
@@ -570,8 +555,7 @@ flowchart TB
               {
                 "rule_set": [
                   "geoip-cn",
-                  "geosite-cn",
-                  "geosite-category-companies@cn"
+                  "geosite-cn"
                 ]
               }
             ],
@@ -596,12 +580,6 @@ flowchart TB
             "tag": "geosite-geolocation-!cn",
             "format": "binary",
             "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-category-companies@cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
           }
         ]
       }

go.mod

@@ -28,7 +28,7 @@ require (
 	github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691
 	github.com/sagernet/sing v0.3.0-rc.7
 	github.com/sagernet/sing-dns v0.1.12
-	github.com/sagernet/sing-mux v0.1.7-rc.1
+	github.com/sagernet/sing-mux v0.1.8-rc.1
 	github.com/sagernet/sing-quic v0.1.7-rc.2
 	github.com/sagernet/sing-shadowsocks v0.2.6
 	github.com/sagernet/sing-shadowsocks2 v0.1.6-rc.1

go.sum

@@ -113,8 +113,8 @@ github.com/sagernet/sing v0.3.0-rc.7 h1:FmnzFRYC6usVgWf112cUxiexwvL+iAurKmCL4Axa
 github.com/sagernet/sing v0.3.0-rc.7/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
 github.com/sagernet/sing-dns v0.1.12 h1:1HqZ+ln+Rezx/aJMStaS0d7oPeX2EobSV1NT537kyj4=
 github.com/sagernet/sing-dns v0.1.12/go.mod h1:rx/DTOisneQpCgNQ4jbFU/JNEtnz0lYcHXenlVzpjEU=
-github.com/sagernet/sing-mux v0.1.7-rc.1 h1:4XlQSeIqKA6uaW1KGQA9wCG5zt9ajhvc/zJnnZV/n1c=
-github.com/sagernet/sing-mux v0.1.7-rc.1/go.mod h1:KK5zCbNujj5kn36G+wLFROOXyJhaaXLyaZWY2w7kBNQ=
+github.com/sagernet/sing-mux v0.1.8-rc.1 h1:5dsZgWmNr9W6JzQj4fb3xX2pMP0OyJH6kVtlqc2kFKA=
+github.com/sagernet/sing-mux v0.1.8-rc.1/go.mod h1:KK5zCbNujj5kn36G+wLFROOXyJhaaXLyaZWY2w7kBNQ=
 github.com/sagernet/sing-quic v0.1.7-rc.2 h1:rCWhtvzQwgkWbX4sVHYdNwzyPweoUPEgBCBatywHjMs=
 github.com/sagernet/sing-quic v0.1.7-rc.2/go.mod h1:IbKCPWXP13zd3cdu0rirtYjkMlquc5zWtc3avfSUGAw=
 github.com/sagernet/sing-shadowsocks v0.2.6 h1:xr7ylAS/q1cQYS8oxKKajhuQcchd5VJJ4K4UZrrpp0s=

route/router.go

@@ -629,7 +629,7 @@ func (r *Router) Close() error {
 	}
 	if r.geoIPReader != nil {
 		monitor.Start("close geoip reader")
-		err = E.Append(err, common.Close(r.geoIPReader), func(err error) error {
+		err = E.Append(err, r.geoIPReader.Close(), func(err error) error {
 			return E.Cause(err, "close geoip reader")
 		})
 		monitor.Finish()

transport/v2raygrpclite/conn.go

@@ -2,19 +2,16 @@ package v2raygrpclite
 
 import (
 	std_bufio "bufio"
-	"bytes"
 	"encoding/binary"
 	"io"
 	"net"
 	"net/http"
 	"os"
-	"sync"
 	"time"
 
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/baderror"
 	"github.com/sagernet/sing/common/buf"
-	"github.com/sagernet/sing/common/bufio"
 	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/rw"
 )
@@ -30,7 +27,6 @@ type GunConn struct {
 	create        chan struct{}
 	err           error
 	readRemaining int
-	writeAccess   sync.Mutex
 }
 
 func newGunConn(reader io.Reader, writer io.Writer, flusher http.Flusher) *GunConn {
@@ -100,19 +96,22 @@ func (c *GunConn) read(b []byte) (n int, err error) {
 }
 
 func (c *GunConn) Write(b []byte) (n int, err error) {
-	protobufHeader := [1 + binary.MaxVarintLen64]byte{0x0A}
-	varuintLen := binary.PutUvarint(protobufHeader[1:], uint64(len(b)))
-	grpcHeader := buf.Get(5)
-	grpcPayloadLen := uint32(1 + varuintLen + len(b))
-	binary.BigEndian.PutUint32(grpcHeader[1:5], grpcPayloadLen)
-	c.writeAccess.Lock()
-	_, err = bufio.Copy(c.writer, io.MultiReader(bytes.NewReader(grpcHeader), bytes.NewReader(protobufHeader[:varuintLen+1]), bytes.NewReader(b)))
-	c.writeAccess.Unlock()
-	buf.Put(grpcHeader)
-	if err == nil && c.flusher != nil {
+	varLen := rw.UVariantLen(uint64(len(b)))
+	buffer := buf.NewSize(6 + varLen + len(b))
+	header := buffer.Extend(6 + varLen)
+	header[0] = 0x00
+	binary.BigEndian.PutUint32(header[1:5], uint32(1+varLen+len(b)))
+	header[5] = 0x0A
+	binary.PutUvarint(header[6:], uint64(len(b)))
+	common.Must1(buffer.Write(b))
+	_, err = c.writer.Write(buffer.Bytes())
+	if err != nil {
+		return 0, baderror.WrapH2(err)
+	}
+	if c.flusher != nil {
 		c.flusher.Flush()
 	}
-	return len(b), baderror.WrapH2(err)
+	return len(b), nil
 }
 
 func (c *GunConn) WriteBuffer(buffer *buf.Buffer) error {
@@ -120,16 +119,18 @@ func (c *GunConn) WriteBuffer(buffer *buf.Buffer) error {
 	dataLen := buffer.Len()
 	varLen := rw.UVariantLen(uint64(dataLen))
 	header := buffer.ExtendHeader(6 + varLen)
-	_ = header[6]
 	header[0] = 0x00
 	binary.BigEndian.PutUint32(header[1:5], uint32(1+varLen+dataLen))
 	header[5] = 0x0A
 	binary.PutUvarint(header[6:], uint64(dataLen))
 	err := rw.WriteBytes(c.writer, buffer.Bytes())
-	if err == nil && c.flusher != nil {
+	if err != nil {
+		return baderror.WrapH2(err)
+	}
+	if c.flusher != nil {
 		c.flusher.Flush()
 	}
-	return baderror.WrapH2(err)
+	return nil
 }
 
 func (c *GunConn) FrontHeadroom() int {