hesoyam/sing-box-extended-mirror
1
0
Fork 0
mirror of https://github.com/shtorm-7/sing-box-extended.git synced 2026-10-21 08:44:24 +00:00
Code Issues Packages Projects Releases 2 Wiki Activity

Merge tag 'v1.14.3'

Browse Source
This commit is contained in:
Shtorm
2026-10-19 01:05:55 +03:00
parent 6cfc2a86f8 7054cac512
commit 2283c95513
321 changed files with 6750 additions and 5105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/shared/certificate-provider/acme.zh.md
-2
View File
@@ -153,5 +153,3 @@ ACME DNS01 质询字段。如果配置，将禁用其他质询方法。
用于所有提供者 HTTP 请求的 HTTP 客户端。
参阅 [HTTP 客户端字段](/zh/configuration/shared/http-client/) 了解详情。
所有提供者 HTTP 请求将使用此出站。
docs/configuration/shared/dial.md
+1 -1
View File
@@ -120,7 +120,7 @@ Reuse listener address.
Set network namespace, name or path.
Since sing-box 1.14.0, the tag of a [network namespace](/configuration/network-namespace/) can also be used.
Referencing an `unshare` network namespace should be avoided, since its only route out is the tun interface managed by sing-box itself.
Referencing an `unshare` network namespace should be avoided.
#### connect_timeout
docs/configuration/shared/dial.zh.md
+1 -1
View File
@@ -120,7 +120,7 @@ icon: material/new-box
设置网络命名空间，名称或路径。
自 sing-box 1.14.0 起，也可以使用[网络命名空间](/zh/configuration/network-namespace/)的标签。
应避免引用 `unshare` 类型的网络命名空间，因为其唯一出口是由 sing-box 自身管理的 tun 接口。
应避免引用 `unshare` 类型的网络命名空间。
#### connect_timeout
docs/configuration/shared/http-client.md
+1 -2
View File
@@ -42,8 +42,7 @@ Values:
!!! warning ""
Experimental only: due to the high memory overhead of both CGO and Network.framework,
do not use in hot paths on iOS and tvOS.
Experimental only: do not use in hot paths on iOS and tvOS.
Supported fields:
docs/configuration/shared/http-client.zh.md
+1 -2
View File
@@ -42,8 +42,7 @@ icon: material/new-box
!!! warning ""
仅供实验用途：由于 CGO 和 Network.framework 占用的内存都很多，
不应在 iOS 和 tvOS 的热路径中使用。
仅供实验用途：不应在 iOS 和 tvOS 的热路径中使用。
支持的字段：
docs/configuration/shared/pre-match.md
+1 -2
View File
@@ -58,8 +58,7 @@ See [route](/configuration/route/rule_action/#route) for details.
!!! question "Since sing-box 1.14.0"
For UDP connections, the first packet is available in pre-match,
so protocol sniffing runs on it directly and rule matching continues with the sniffed metadata.
For UDP connections, sniffing runs on the first packet and rule matching continues with the sniffed metadata.
When sniffers require more data (like a fragmented QUIC Client Hello), pre-match stops at that rule.
docs/configuration/shared/pre-match.zh.md
+1 -1
View File
@@ -52,7 +52,7 @@ FakeIP 目标需要在预匹配中先执行 `resolve` 动作，否则连接将
!!! question "自 sing-box 1.14.0 起"
对于 UDP 连接，首个数据包在预匹配中可用，因此协议探测将直接在其上运行，随后规则匹配将携带探测结果继续。
对于 UDP 连接，协议探测在首个数据包上运行，随后规则匹配将携带探测结果继续。
当探测器需要更多数据时（如分片的 QUIC Client Hello），预匹配将在该规则处停止。
docs/configuration/shared/tls.md
+6 -38
View File
@@ -238,33 +238,10 @@ Unsupported fields:
!!! note ""
TLS 1.3 is only negotiated on Windows 11 or Windows Server 2022 and newer. On older Windows versions, Schannel caps the connection at TLS 1.2 even when `max_version` is `1.3`.
TLS 1.3 is only negotiated on Windows 11 or Windows Server 2022 and newer.
The default version range is TLS 1.2 to TLS 1.3, matching the `go` engine.
Supported fields:
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
Unsupported fields:
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
#### disable_sni
==Client only==
@@ -296,8 +273,7 @@ See [Application-Layer Protocol Negotiation](https://en.wikipedia.org/wiki/Appli
The minimum TLS version that is acceptable.
By default, TLS 1.2 is currently used as the minimum when acting as a
client, and TLS 1.0 when acting as a server.
TLS 1.2 is used by default.
#### max_version
@@ -688,16 +664,8 @@ Fragment TLS handshake into multiple TLS records to bypass firewalls.
Inject a forged TLS ClientHello carrying a whitelisted SNI before the real one,
to fool SNI-filtering middleboxes that permit specific hostnames.
The forged segment is a copy of the real ClientHello with only the SNI value
replaced by the value of this field, so TLS fingerprinting cannot distinguish
it from the real one. The receiving server drops the forged segment
(see `spoof_method`) while the middlebox treats it as a legitimate session.
Requires raw-socket access (`CAP_NET_RAW` on Linux, root on macOS);
on Linux, `CAP_NET_ADMIN` is additionally required because the send sequence
number is read via `TCP_REPAIR`.
On Windows, Administrator is required to install the embedded WinDivert kernel
driver on first use. Windows on ARM64 is not supported.
Requires `CAP_NET_RAW` and `CAP_NET_ADMIN` on Linux, root on macOS, and
Administrator on Windows. Windows on ARM64 is not supported.
#### spoof_method
@@ -712,8 +680,8 @@ How the forged segment is rejected by the real server.
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
| `wrong-ack` | The forged segment's TCP acknowledgment number is placed before the server's send window. |
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option, which the server rejects since no MD5 key is negotiated. |
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp, which the server rejects as a PAWS replay. Linux/Windows only; not supported on macOS. |
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option. |
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp. Linux/Windows only; not supported on macOS. |
### ACME Fields
docs/configuration/shared/tls.zh.md
+6 -35
View File
@@ -237,32 +237,9 @@ TLS 版本值：
!!! note ""
TLS 1.3 仅在 Windows 11 或 Windows Server 2022 及后续版本上协商。在更早的 Windows 版本上，即使 `max_version` 设为 `1.3`，Schannel 也会把连接上限固定在 TLS 1.2。
TLS 1.3 仅在 Windows 11 或 Windows Server 2022 及后续版本上协商。
默认版本范围为 TLS 1.2 到 TLS 1.3，与 `go` 引擎一致。证书验证在 Go 侧基于 Schannel 返回的证书链执行，默认使用系统证书存储。当设置了 `certificate` 或 `certificate_path` 时，这些根证书会替代系统存储。
支持的字段：
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
不支持的字段：
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
默认版本范围为 TLS 1.2 到 TLS 1.3，与 `go` 引擎一致。
#### disable_sni
@@ -294,7 +271,7 @@ TLS 版本值：
可接受的最低 TLS 版本。
默认情况下，当前使用 TLS 1.2 作为客户端的最低要求。作为服务器时使用 TLS 1.0。
默认使用 TLS 1.2。
#### max_version
@@ -682,13 +659,7 @@ ECH 配置路径，PEM 格式。
在真实 ClientHello 之前注入一个伪造的、携带白名单 SNI 的 TLS ClientHello，
以欺骗基于 SNI 过滤的中间盒放行连接。
伪造报文是真实 ClientHello 的副本，仅将 SNI 值替换为本字段的值，
因此 TLS 指纹无法区分伪造与真实报文。真实服务器会丢弃伪造报文（见 `spoof_method`），
而中间盒将该连接视为合法会话。
需要原始套接字权限（Linux 上需 `CAP_NET_RAW`，macOS 上需 root）；
在 Linux 上还需 `CAP_NET_ADMIN`，因为需要通过 `TCP_REPAIR` 读取发送序列号。
Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内核驱动，
Linux 上需要 `CAP_NET_RAW` 和 `CAP_NET_ADMIN`，macOS 上需要 root，Windows 上需要 Administrator。
不支持 Windows ARM64。
#### spoof_method
@@ -704,8 +675,8 @@ Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
| `wrong-ack` | 伪造报文的 TCP 确认号位于服务器发送窗口之前。 |
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项，未协商 MD5 密钥的服务器将拒绝。 |
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳，服务器按 PAWS 规则视为重放并拒绝。仅支持 Linux/Windows，不支持 macOS。 |
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项。 |
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳。仅支持 Linux/Windows，不支持 macOS。 |
### ACME 字段