mirror of
https://github.com/shtorm-7/sing-box-extended.git
synced 2026-10-21 16:54:26 +00:00
Cleanup documentations
This commit is contained in:
世界
@@ -153,5 +153,3 @@ ACME DNS01 质询字段。如果配置，将禁用其他质询方法。
|
||||
用于所有提供者 HTTP 请求的 HTTP 客户端。
|
||||
|
||||
参阅 [HTTP 客户端字段](/zh/configuration/shared/http-client/) 了解详情。
|
||||
|
||||
所有提供者 HTTP 请求将使用此出站。
|
||||
|
||||
@@ -120,7 +120,7 @@ Reuse listener address.
|
||||
Set network namespace, name or path.
|
||||
|
||||
Since sing-box 1.14.0, the tag of a [network namespace](/configuration/network-namespace/) can also be used.
|
||||
Referencing an `unshare` network namespace should be avoided, since its only route out is the tun interface managed by sing-box itself.
|
||||
Referencing an `unshare` network namespace should be avoided.
|
||||
|
||||
#### connect_timeout
|
||||
|
||||
|
||||
@@ -120,7 +120,7 @@ icon: material/new-box
|
||||
设置网络命名空间，名称或路径。
|
||||
|
||||
自 sing-box 1.14.0 起，也可以使用[网络命名空间](/zh/configuration/network-namespace/)的标签。
|
||||
应避免引用 `unshare` 类型的网络命名空间，因为其唯一出口是由 sing-box 自身管理的 tun 接口。
|
||||
应避免引用 `unshare` 类型的网络命名空间。
|
||||
|
||||
#### connect_timeout
|
||||
|
||||
|
||||
@@ -42,8 +42,7 @@ Values:
|
||||
|
||||
!!! warning ""
|
||||
|
||||
Experimental only: due to the high memory overhead of both CGO and Network.framework,
|
||||
do not use in hot paths on iOS and tvOS.
|
||||
Experimental only: do not use in hot paths on iOS and tvOS.
|
||||
|
||||
Supported fields:
|
||||
|
||||
|
||||
@@ -42,8 +42,7 @@ icon: material/new-box
|
||||
|
||||
!!! warning ""
|
||||
|
||||
仅供实验用途：由于 CGO 和 Network.framework 占用的内存都很多，
|
||||
不应在 iOS 和 tvOS 的热路径中使用。
|
||||
仅供实验用途：不应在 iOS 和 tvOS 的热路径中使用。
|
||||
|
||||
支持的字段：
|
||||
|
||||
|
||||
@@ -58,8 +58,7 @@ See [route](/configuration/route/rule_action/#route) for details.
|
||||
|
||||
!!! question "Since sing-box 1.14.0"
|
||||
|
||||
For UDP connections, the first packet is available in pre-match,
|
||||
so protocol sniffing runs on it directly and rule matching continues with the sniffed metadata.
|
||||
For UDP connections, sniffing runs on the first packet and rule matching continues with the sniffed metadata.
|
||||
|
||||
When sniffers require more data (like a fragmented QUIC Client Hello), pre-match stops at that rule.
|
||||
|
||||
|
||||
@@ -52,7 +52,7 @@ FakeIP 目标需要在预匹配中先执行 `resolve` 动作，否则连接将
|
||||
|
||||
!!! question "自 sing-box 1.14.0 起"
|
||||
|
||||
对于 UDP 连接，首个数据包在预匹配中可用，因此协议探测将直接在其上运行，随后规则匹配将携带探测结果继续。
|
||||
对于 UDP 连接，协议探测在首个数据包上运行，随后规则匹配将携带探测结果继续。
|
||||
|
||||
当探测器需要更多数据时（如分片的 QUIC Client Hello），预匹配将在该规则处停止。
|
||||
|
||||
|
||||
@@ -237,33 +237,10 @@ Unsupported fields:
|
||||
|
||||
!!! note ""
|
||||
|
||||
TLS 1.3 is only negotiated on Windows 11 or Windows Server 2022 and newer. On older Windows versions, Schannel caps the connection at TLS 1.2 even when `max_version` is `1.3`.
|
||||
TLS 1.3 is only negotiated on Windows 11 or Windows Server 2022 and newer.
|
||||
|
||||
The default version range is TLS 1.2 to TLS 1.3, matching the `go` engine.
|
||||
|
||||
Supported fields:
|
||||
|
||||
* `server_name`
|
||||
* `insecure`
|
||||
* `alpn`
|
||||
* `min_version`
|
||||
* `max_version`
|
||||
* `certificate` / `certificate_path`
|
||||
* `certificate_public_key_sha256`
|
||||
* `handshake_timeout`
|
||||
|
||||
Unsupported fields:
|
||||
|
||||
* `disable_sni`
|
||||
* `cipher_suites`
|
||||
* `curve_preferences`
|
||||
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
|
||||
* `fragment` / `record_fragment`
|
||||
* `kernel_tx` / `kernel_rx`
|
||||
* `ech`
|
||||
* `utls`
|
||||
* `reality`
|
||||
|
||||
#### disable_sni
|
||||
|
||||
==Client only==
|
||||
@@ -686,16 +663,8 @@ Fragment TLS handshake into multiple TLS records to bypass firewalls.
|
||||
Inject a forged TLS ClientHello carrying a whitelisted SNI before the real one,
|
||||
to fool SNI-filtering middleboxes that permit specific hostnames.
|
||||
|
||||
The forged segment is a copy of the real ClientHello with only the SNI value
|
||||
replaced by the value of this field, so TLS fingerprinting cannot distinguish
|
||||
it from the real one. The receiving server drops the forged segment
|
||||
(see `spoof_method`) while the middlebox treats it as a legitimate session.
|
||||
|
||||
Requires raw-socket access (`CAP_NET_RAW` on Linux, root on macOS);
|
||||
on Linux, `CAP_NET_ADMIN` is additionally required because the send sequence
|
||||
number is read via `TCP_REPAIR`.
|
||||
On Windows, Administrator is required to install the embedded WinDivert kernel
|
||||
driver on first use. Windows on ARM64 is not supported.
|
||||
Requires `CAP_NET_RAW` and `CAP_NET_ADMIN` on Linux, root on macOS, and
|
||||
Administrator on Windows. Windows on ARM64 is not supported.
|
||||
|
||||
#### spoof_method
|
||||
|
||||
@@ -710,8 +679,8 @@ How the forged segment is rejected by the real server.
|
||||
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
|
||||
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
|
||||
| `wrong-ack` | The forged segment's TCP acknowledgment number is placed before the server's send window. |
|
||||
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option, which the server rejects since no MD5 key is negotiated. |
|
||||
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp, which the server rejects as a PAWS replay. Linux/Windows only; not supported on macOS. |
|
||||
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option. |
|
||||
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp. Linux/Windows only; not supported on macOS. |
|
||||
|
||||
### ACME Fields
|
||||
|
||||
|
||||
@@ -237,32 +237,9 @@ TLS 版本值：
|
||||
|
||||
!!! note ""
|
||||
|
||||
TLS 1.3 仅在 Windows 11 或 Windows Server 2022 及后续版本上协商。在更早的 Windows 版本上，即使 `max_version` 设为 `1.3`，Schannel 也会把连接上限固定在 TLS 1.2。
|
||||
TLS 1.3 仅在 Windows 11 或 Windows Server 2022 及后续版本上协商。
|
||||
|
||||
默认版本范围为 TLS 1.2 到 TLS 1.3，与 `go` 引擎一致。证书验证在 Go 侧基于 Schannel 返回的证书链执行，默认使用系统证书存储。当设置了 `certificate` 或 `certificate_path` 时，这些根证书会替代系统存储。
|
||||
|
||||
支持的字段：
|
||||
|
||||
* `server_name`
|
||||
* `insecure`
|
||||
* `alpn`
|
||||
* `min_version`
|
||||
* `max_version`
|
||||
* `certificate` / `certificate_path`
|
||||
* `certificate_public_key_sha256`
|
||||
* `handshake_timeout`
|
||||
|
||||
不支持的字段：
|
||||
|
||||
* `disable_sni`
|
||||
* `cipher_suites`
|
||||
* `curve_preferences`
|
||||
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
|
||||
* `fragment` / `record_fragment`
|
||||
* `kernel_tx` / `kernel_rx`
|
||||
* `ech`
|
||||
* `utls`
|
||||
* `reality`
|
||||
默认版本范围为 TLS 1.2 到 TLS 1.3，与 `go` 引擎一致。
|
||||
|
||||
#### disable_sni
|
||||
|
||||
@@ -682,13 +659,7 @@ ECH 配置路径，PEM 格式。
|
||||
在真实 ClientHello 之前注入一个伪造的、携带白名单 SNI 的 TLS ClientHello，
|
||||
以欺骗基于 SNI 过滤的中间盒放行连接。
|
||||
|
||||
伪造报文是真实 ClientHello 的副本，仅将 SNI 值替换为本字段的值，
|
||||
因此 TLS 指纹无法区分伪造与真实报文。真实服务器会丢弃伪造报文（见 `spoof_method`），
|
||||
而中间盒将该连接视为合法会话。
|
||||
|
||||
需要原始套接字权限（Linux 上需 `CAP_NET_RAW`，macOS 上需 root）；
|
||||
在 Linux 上还需 `CAP_NET_ADMIN`，因为需要通过 `TCP_REPAIR` 读取发送序列号。
|
||||
Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内核驱动，
|
||||
Linux 上需要 `CAP_NET_RAW` 和 `CAP_NET_ADMIN`，macOS 上需要 root，Windows 上需要 Administrator。
|
||||
不支持 Windows ARM64。
|
||||
|
||||
#### spoof_method
|
||||
@@ -704,8 +675,8 @@ Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内
|
||||
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
|
||||
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
|
||||
| `wrong-ack` | 伪造报文的 TCP 确认号位于服务器发送窗口之前。 |
|
||||
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项，未协商 MD5 密钥的服务器将拒绝。 |
|
||||
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳，服务器按 PAWS 规则视为重放并拒绝。仅支持 Linux/Windows，不支持 macOS。 |
|
||||
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项。 |
|
||||
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳。仅支持 Linux/Windows，不支持 macOS。 |
|
||||
|
||||
### ACME 字段
|
||||
|
||||
|
||||
Reference in New Issue
Block a user