hesoyam/sing-box-extended-mirror
1
0
Fork 0
mirror of https://github.com/shtorm-7/sing-box-extended.git synced 2026-10-07 22:59:59 +00:00
Code Issues Packages Projects Releases 2 Wiki Activity

Merge tag 'v1.14.0'

Browse Source
This commit is contained in:
Shtorm
2026-09-04 01:08:30 +03:00
parent 99bbd49406 0b8995879f
commit c0bfc731ec
987 changed files with 141481 additions and 11302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/shared/certificate-provider/acme.md
+160
View File
@@ -0,0 +1,160 @@
---
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [account_key](#account_key)
:material-plus: [key_type](#key_type)
:material-plus: [profile](#profile)
:material-plus: [http_client](#http_client)
# ACME
!!! quote ""
`with_acme` build tag required.
### Structure
```json
{
"type": "acme",
"tag": "",
"domain": [],
"data_directory": "",
"default_server_name": "",
"email": "",
"provider": "",
"account_key": "",
"disable_http_challenge": false,
"disable_tls_alpn_challenge": false,
"alternative_http_port": 0,
"alternative_tls_port": 0,
"external_account": {
"key_id": "",
"mac_key": ""
},
"dns01_challenge": {},
"key_type": "",
"profile": "",
"http_client": "" // or {}
}
```
### Fields
#### domain
==Required==
List of domains.
#### data_directory
The directory to store ACME data.
`$XDG_DATA_HOME/certmagic|$HOME/.local/share/certmagic` will be used if empty.
#### default_server_name
Server name to use when choosing a certificate if the ClientHello's ServerName field is empty.
#### email
The email address to use when creating or selecting an existing ACME server account.
#### provider
The ACME CA provider to use.
| Value | Provider |
|-------------------------|---------------|
| `letsencrypt (default)` | Let's Encrypt |
| `zerossl` | ZeroSSL |
| `https://...` | Custom |
When `provider` is `zerossl`, sing-box will automatically request ZeroSSL EAB credentials if `email` is set and
`external_account` is empty.
When `provider` is `zerossl`, at least one of `external_account`, `email`, or `account_key` is required.
#### account_key
!!! question "Since sing-box 1.14.0"
The PEM-encoded private key of an existing ACME account.
#### disable_http_challenge
Disable all HTTP challenges.
#### disable_tls_alpn_challenge
Disable all TLS-ALPN challenges
#### alternative_http_port
The alternate port to use for the ACME HTTP challenge; if non-empty, this port will be used instead of 80 to spin up a
listener for the HTTP challenge.
#### alternative_tls_port
The alternate port to use for the ACME TLS-ALPN challenge; the system must forward 443 to this port for challenge to
succeed.
#### external_account
EAB (External Account Binding) contains information necessary to bind or map an ACME account to some other account known
by the CA.
External account bindings are used to associate an ACME account with an existing account in a non-ACME system, such as
a CA customer database.
To enable ACME account binding, the CA operating the ACME server needs to provide the ACME client with a MAC key and a
key identifier, using some mechanism outside of ACME. §7.3.4
#### external_account.key_id
The key identifier.
#### external_account.mac_key
The MAC key.
#### dns01_challenge
ACME DNS01 challenge field. If configured, other challenge methods will be disabled.
See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/) for details.
#### key_type
!!! question "Since sing-box 1.14.0"
The private key type to generate for new certificates.
| Value | Type |
|------------|---------|
| `ed25519` | Ed25519 |
| `p256` | P-256 |
| `p384` | P-384 |
| `rsa2048` | RSA |
| `rsa4096` | RSA |
#### profile
!!! question "Since sing-box 1.14.0"
The ACME profile to use for certificate issuance.
When empty and `provider` is Let's Encrypt, `shortlived` will be used automatically if any domain is an IP address.
#### http_client
!!! question "Since sing-box 1.14.0"
HTTP Client for all provider HTTP requests.
See [HTTP Client Fields](/configuration/shared/http-client/) for details.
docs/configuration/shared/certificate-provider/acme.zh.md
+157
View File
@@ -0,0 +1,157 @@
---
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [account_key](#account_key)
:material-plus: [key_type](#key_type)
:material-plus: [profile](#profile)
:material-plus: [http_client](#http_client)
# ACME
!!! quote ""
需要 `with_acme` 构建标签。
### 结构
```json
{
"type": "acme",
"tag": "",
"domain": [],
"data_directory": "",
"default_server_name": "",
"email": "",
"provider": "",
"account_key": "",
"disable_http_challenge": false,
"disable_tls_alpn_challenge": false,
"alternative_http_port": 0,
"alternative_tls_port": 0,
"external_account": {
"key_id": "",
"mac_key": ""
},
"dns01_challenge": {},
"key_type": "",
"profile": "",
"http_client": "" // 或 {}
}
```
### 字段
#### domain
==必填==
域名列表。
#### data_directory
ACME 数据存储目录。
如果为空则使用 `$XDG_DATA_HOME/certmagic|$HOME/.local/share/certmagic`。
#### default_server_name
如果 ClientHello 的 ServerName 字段为空，则选择证书时要使用的服务器名称。
#### email
创建或选择现有 ACME 服务器帐户时使用的电子邮件地址。
#### provider
要使用的 ACME CA 提供商。
| 值 | 提供商 |
|--------------------|---------------|
| `letsencrypt (默认)` | Let's Encrypt |
| `zerossl` | ZeroSSL |
| `https://...` | 自定义 |
当 `provider` 为 `zerossl` 时，如果设置了 `email` 且未设置 `external_account`，
sing-box 会自动向 ZeroSSL 请求 EAB 凭据。
当 `provider` 为 `zerossl` 时，必须至少设置 `external_account`、`email` 或 `account_key` 之一。
#### account_key
!!! question "自 sing-box 1.14.0 起"
现有 ACME 帐户的 PEM 编码私钥。
#### disable_http_challenge
禁用所有 HTTP 质询。
#### disable_tls_alpn_challenge
禁用所有 TLS-ALPN 质询。
#### alternative_http_port
用于 ACME HTTP 质询的备用端口；如果非空，将使用此端口而不是 80 来启动 HTTP 质询的侦听器。
#### alternative_tls_port
用于 ACME TLS-ALPN 质询的备用端口； 系统必须将 443 转发到此端口以使质询成功。
#### external_account
EAB（外部帐户绑定）包含将 ACME 帐户绑定或映射到 CA 已知的其他帐户所需的信息。
外部帐户绑定用于将 ACME 帐户与非 ACME 系统中的现有帐户相关联，例如 CA 客户数据库。
为了启用 ACME 帐户绑定，运行 ACME 服务器的 CA 需要使用 ACME 之外的某种机制向 ACME 客户端提供 MAC 密钥和密钥标识符。§7.3.4
#### external_account.key_id
密钥标识符。
#### external_account.mac_key
MAC 密钥。
#### dns01_challenge
ACME DNS01 质询字段。如果配置，将禁用其他质询方法。
参阅 [DNS01 质询字段](/zh/configuration/shared/dns01_challenge/)。
#### key_type
!!! question "自 sing-box 1.14.0 起"
为新证书生成的私钥类型。
| 值 | 类型 |
|-----------|----------|
| `ed25519` | Ed25519 |
| `p256` | P-256 |
| `p384` | P-384 |
| `rsa2048` | RSA |
| `rsa4096` | RSA |
#### profile
!!! question "自 sing-box 1.14.0 起"
用于证书签发的 ACME profile。
当为空且 `provider` 为 Let's Encrypt 时，如果任意域名为 IP 地址，将自动使用 `shortlived`。
#### http_client
!!! question "自 sing-box 1.14.0 起"
用于所有提供者 HTTP 请求的 HTTP 客户端。
参阅 [HTTP 客户端字段](/zh/configuration/shared/http-client/) 了解详情。
所有提供者 HTTP 请求将使用此出站。
docs/configuration/shared/certificate-provider/cloudflare-origin-ca.md
+82
View File
@@ -0,0 +1,82 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
# Cloudflare Origin CA
### Structure
```json
{
"type": "cloudflare-origin-ca",
"tag": "",
"domain": [],
"data_directory": "",
"api_token": "",
"origin_ca_key": "",
"request_type": "",
"requested_validity": 0,
"http_client": "" // or {}
}
```
### Fields
#### domain
==Required==
List of domain names or wildcard domain names to include in the certificate.
#### data_directory
Root directory used to store the issued certificate, private key, and metadata.
If empty, sing-box uses the same default data directory as the ACME certificate provider:
`$XDG_DATA_HOME/certmagic` or `$HOME/.local/share/certmagic`.
#### api_token
Cloudflare API token used to create the certificate.
Get or create one in [Cloudflare Dashboard > My Profile > API Tokens](https://dash.cloudflare.com/profile/api-tokens).
Requires the `Zone / SSL and Certificates / Edit` permission.
Conflict with `origin_ca_key`.
#### origin_ca_key
Cloudflare Origin CA Key.
Get it in [Cloudflare Dashboard > My Profile > API Tokens > API Keys > Origin CA Key](https://dash.cloudflare.com/profile/api-tokens).
Conflict with `api_token`.
#### request_type
The signature type to request from Cloudflare.
| Value | Type |
|----------------------|-------------|
| `origin-rsa` | RSA |
| `origin-ecc` | ECDSA P-256 |
`origin-rsa` is used if empty.
#### requested_validity
The requested certificate validity in days.
Available values: `7`, `30`, `90`, `365`, `730`, `1095`, `5475`.
`5475` days (15 years) is used if empty.
#### http_client
HTTP Client for all provider HTTP requests.
See [HTTP Client Fields](/configuration/shared/http-client/) for details.
docs/configuration/shared/certificate-provider/cloudflare-origin-ca.zh.md
+82
View File
@@ -0,0 +1,82 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
# Cloudflare Origin CA
### 结构
```json
{
"type": "cloudflare-origin-ca",
"tag": "",
"domain": [],
"data_directory": "",
"api_token": "",
"origin_ca_key": "",
"request_type": "",
"requested_validity": 0,
"http_client": "" // 或 {}
}
```
### 字段
#### domain
==必填==
要写入证书的域名或通配符域名列表。
#### data_directory
保存签发证书、私钥和元数据的根目录。
如果为空，sing-box 会使用与 ACME 证书提供者相同的默认数据目录：
`$XDG_DATA_HOME/certmagic` 或 `$HOME/.local/share/certmagic`。
#### api_token
用于创建证书的 Cloudflare API Token。
可在 [Cloudflare Dashboard > My Profile > API Tokens](https://dash.cloudflare.com/profile/api-tokens) 获取或创建。
需要 `Zone / SSL and Certificates / Edit` 权限。
与 `origin_ca_key` 冲突。
#### origin_ca_key
Cloudflare Origin CA Key。
可在 [Cloudflare Dashboard > My Profile > API Tokens > API Keys > Origin CA Key](https://dash.cloudflare.com/profile/api-tokens) 获取。
与 `api_token` 冲突。
#### request_type
向 Cloudflare 请求的签名类型。
| 值 | 类型 |
|----------------------|-------------|
| `origin-rsa` | RSA |
| `origin-ecc` | ECDSA P-256 |
如果为空，使用 `origin-rsa`。
#### requested_validity
请求的证书有效期，单位为天。
可用值：`7`、`30`、`90`、`365`、`730`、`1095`、`5475`。
如果为空，使用 `5475` 天（15 年）。
#### http_client
用于所有提供者 HTTP 请求的 HTTP 客户端。
参阅 [HTTP 客户端字段](/zh/configuration/shared/http-client/) 了解详情。
docs/configuration/shared/certificate-provider/index.md
+32
View File
@@ -0,0 +1,32 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
# Certificate Provider
### Structure
```json
{
"certificate_providers": [
{
"type": "",
"tag": ""
}
]
}
```
### Fields
| Type | Format |
|--------|------------------|
| `acme` | [ACME](/configuration/shared/certificate-provider/acme) |
| `tailscale` | [Tailscale](/configuration/shared/certificate-provider/tailscale) |
| `cloudflare-origin-ca` | [Cloudflare Origin CA](/configuration/shared/certificate-provider/cloudflare-origin-ca) |
#### tag
The tag of the certificate provider.
docs/configuration/shared/certificate-provider/index.zh.md
+32
View File
@@ -0,0 +1,32 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
# 证书提供者
### 结构
```json
{
"certificate_providers": [
{
"type": "",
"tag": ""
}
]
}
```
### 字段
| 类型 | 格式 |
|--------|------------------|
| `acme` | [ACME](/zh/configuration/shared/certificate-provider/acme) |
| `tailscale` | [Tailscale](/zh/configuration/shared/certificate-provider/tailscale) |
| `cloudflare-origin-ca` | [Cloudflare Origin CA](/zh/configuration/shared/certificate-provider/cloudflare-origin-ca) |
#### tag
证书提供者的标签。
docs/configuration/shared/certificate-provider/tailscale.md
+27
View File
@@ -0,0 +1,27 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
# Tailscale
### Structure
```json
{
"type": "tailscale",
"tag": "ts-cert",
"endpoint": "ts-ep"
}
```
### Fields
#### endpoint
==Required==
The tag of the [Tailscale endpoint](/configuration/endpoint/tailscale/) to reuse.
[MagicDNS and HTTPS](https://tailscale.com/kb/1153/enabling-https) must be enabled in the Tailscale admin console.
docs/configuration/shared/certificate-provider/tailscale.zh.md
+27
View File
@@ -0,0 +1,27 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
# Tailscale
### 结构
```json
{
"type": "tailscale",
"tag": "ts-cert",
"endpoint": "ts-ep"
}
```
### 字段
#### endpoint
==必填==
要复用的 [Tailscale 端点](/zh/configuration/endpoint/tailscale/) 的标签。
必须在 Tailscale 管理控制台中启用 [MagicDNS 和 HTTPS](https://tailscale.com/kb/1153/enabling-https)。
docs/configuration/shared/dial.md
+8
View File
@@ -2,6 +2,11 @@
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-alert: [domain_resolver](#domain_resolver)
:material-alert: [netns](#netns)
!!! quote "Changes in sing-box 1.13.0"
:material-plus: [disable_tcp_keep_alive](#disable_tcp_keep_alive)
@@ -114,6 +119,9 @@ Reuse listener address.
Set network namespace, name or path.
Since sing-box 1.14.0, the tag of a [network namespace](/configuration/network-namespace/) can also be used.
Referencing an `unshare` network namespace should be avoided, since its only route out is the tun interface managed by sing-box itself.
#### connect_timeout
Connect timeout, in golang's Duration format.
docs/configuration/shared/dial.zh.md
+8
View File
@@ -2,6 +2,11 @@
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-alert: [domain_resolver](#domain_resolver)
:material-alert: [netns](#netns)
!!! quote "sing-box 1.13.0 中的更改"
:material-plus: [disable_tcp_keep_alive](#disable_tcp_keep_alive)
@@ -114,6 +119,9 @@ icon: material/new-box
设置网络命名空间，名称或路径。
自 sing-box 1.14.0 起，也可以使用[网络命名空间](/zh/configuration/network-namespace/)的标签。
应避免引用 `unshare` 类型的网络命名空间，因为其唯一出口是由 sing-box 自身管理的 tun 接口。
#### connect_timeout
连接超时，采用 golang 的 Duration 格式。
docs/configuration/shared/dns01_challenge.md
+53
View File
@@ -2,6 +2,14 @@
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [ttl](#ttl)
:material-plus: [propagation_delay](#propagation_delay)
:material-plus: [propagation_timeout](#propagation_timeout)
:material-plus: [resolvers](#resolvers)
:material-plus: [override_domain](#override_domain)
!!! quote "Changes in sing-box 1.13.0"
:material-plus: [alidns.security_token](#security_token)
@@ -12,12 +20,57 @@ icon: material/new-box
```json
{
"ttl": "",
"propagation_delay": "",
"propagation_timeout": "",
"resolvers": [],
"override_domain": "",
"provider": "",
... // Provider Fields
}
```
### Fields
#### ttl
!!! question "Since sing-box 1.14.0"
The TTL of the temporary TXT record used for the DNS challenge.
#### propagation_delay
!!! question "Since sing-box 1.14.0"
How long to wait after creating the challenge record before starting propagation checks.
#### propagation_timeout
!!! question "Since sing-box 1.14.0"
The maximum time to wait for the challenge record to propagate.
Set to `-1` to disable propagation checks.
#### resolvers
!!! question "Since sing-box 1.14.0"
Preferred DNS resolvers to use for DNS propagation checks.
#### override_domain
!!! question "Since sing-box 1.14.0"
Override the domain name used for the DNS challenge record.
Useful when `_acme-challenge` is delegated to a different zone.
#### provider
The DNS provider. See below for provider-specific fields.
### Provider Fields
#### Alibaba Cloud DNS
docs/configuration/shared/dns01_challenge.zh.md
+53
View File
@@ -2,6 +2,14 @@
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [ttl](#ttl)
:material-plus: [propagation_delay](#propagation_delay)
:material-plus: [propagation_timeout](#propagation_timeout)
:material-plus: [resolvers](#resolvers)
:material-plus: [override_domain](#override_domain)
!!! quote "sing-box 1.13.0 中的更改"
:material-plus: [alidns.security_token](#security_token)
@@ -12,12 +20,57 @@ icon: material/new-box
```json
{
"ttl": "",
"propagation_delay": "",
"propagation_timeout": "",
"resolvers": [],
"override_domain": "",
"provider": "",
... // 提供商字段
}
```
### 字段
#### ttl
!!! question "自 sing-box 1.14.0 起"
DNS 质询临时 TXT 记录的 TTL。
#### propagation_delay
!!! question "自 sing-box 1.14.0 起"
创建质询记录后，在开始传播检查前要等待的时间。
#### propagation_timeout
!!! question "自 sing-box 1.14.0 起"
等待质询记录传播完成的最长时间。
设为 `-1` 可禁用传播检查。
#### resolvers
!!! question "自 sing-box 1.14.0 起"
进行 DNS 传播检查时优先使用的 DNS 解析器。
#### override_domain
!!! question "自 sing-box 1.14.0 起"
覆盖 DNS 质询记录使用的域名。
适用于将 `_acme-challenge` 委托到其他 zone 的场景。
#### provider
DNS 提供商。提供商专有字段见下文。
### 提供商字段
#### Alibaba Cloud DNS
docs/configuration/shared/http-client.md
+114
View File
@@ -0,0 +1,114 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
### Structure
A string or an object.
When string, the tag of a shared [HTTP Client](/configuration/shared/http-client/) defined in top-level `http_clients`.
When object:
```json
{
"engine": "",
"version": 0,
"disable_version_fallback": false,
"headers": {},
... // HTTP2 Fields
"tls": {},
... // Dial Fields
}
```
### Fields
#### engine
HTTP engine to use.
Values:
* `go` (default)
* `apple`
`apple` uses NSURLSession, only available on Apple platforms.
!!! warning ""
Experimental only: due to the high memory overhead of both CGO and Network.framework,
do not use in hot paths on iOS and tvOS.
Supported fields:
* `headers`
* `tls.server_name` (must match request host)
* `tls.insecure`
* `tls.min_version` / `tls.max_version`
* `tls.certificate` / `tls.certificate_path`
* `tls.certificate_public_key_sha256`
* Dial Fields
Unsupported fields:
* `version`
* `disable_version_fallback`
* HTTP2 Fields
* QUIC Fields
* `tls.engine`
* `tls.alpn`
* `tls.disable_sni`
* `tls.cipher_suites`
* `tls.curve_preferences`
* `tls.client_certificate` / `tls.client_certificate_path` / `tls.client_key` / `tls.client_key_path`
* `tls.fragment` / `tls.record_fragment`
* `tls.kernel_tx` / `tls.kernel_rx`
* `tls.ech`
* `tls.utls`
* `tls.reality`
#### version
HTTP version.
Available values: `1`, `2`, `3`.
`2` is used by default.
When `3`, [HTTP2 Fields](#http2-fields) are replaced by [QUIC Fields](#quic-fields).
#### disable_version_fallback
Disable automatic fallback to lower HTTP version.
#### headers
Custom HTTP headers.
`Host` header is used as request host.
### HTTP2 Fields
When `version` is `2` (default).
See [HTTP2 Fields](/configuration/shared/http2/) for details.
### QUIC Fields
When `version` is `3`.
See [QUIC Fields](/configuration/shared/quic/) for details.
### TLS Fields
See [TLS](/configuration/shared/tls/#outbound) for details.
### Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/shared/http-client.zh.md
+114
View File
@@ -0,0 +1,114 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
### 结构
字符串或对象。
当为字符串时，为顶层 `http_clients` 中定义的共享 [HTTP 客户端](/zh/configuration/shared/http-client/) 的标签。
当为对象时：
```json
{
"engine": "",
"version": 0,
"disable_version_fallback": false,
"headers": {},
... // HTTP2 字段
"tls": {},
... // 拨号字段
}
```
### 字段
#### engine
要使用的 HTTP 引擎。
可用值：
* `go`（默认）
* `apple`
`apple` 使用 NSURLSession，仅在 Apple 平台可用。
!!! warning ""
仅供实验用途：由于 CGO 和 Network.framework 占用的内存都很多，
不应在 iOS 和 tvOS 的热路径中使用。
支持的字段：
* `headers`
* `tls.server_name`（必须与请求主机匹配）
* `tls.insecure`
* `tls.min_version` / `tls.max_version`
* `tls.certificate` / `tls.certificate_path`
* `tls.certificate_public_key_sha256`
* 拨号字段
不支持的字段：
* `version`
* `disable_version_fallback`
* HTTP2 字段
* QUIC 字段
* `tls.engine`
* `tls.alpn`
* `tls.disable_sni`
* `tls.cipher_suites`
* `tls.curve_preferences`
* `tls.client_certificate` / `tls.client_certificate_path` / `tls.client_key` / `tls.client_key_path`
* `tls.fragment` / `tls.record_fragment`
* `tls.kernel_tx` / `tls.kernel_rx`
* `tls.ech`
* `tls.utls`
* `tls.reality`
#### version
HTTP 版本。
可用值：`1`、`2`、`3`。
默认使用 `2`。
当为 `3` 时，[HTTP2 字段](#http2-字段) 替换为 [QUIC 字段](#quic-字段)。
#### disable_version_fallback
禁用自动回退到更低的 HTTP 版本。
#### headers
自定义 HTTP 标头。
`Host` 标头用作请求主机。
### HTTP2 字段
当 `version` 为 `2`（默认）时。
参阅 [HTTP2 字段](/zh/configuration/shared/http2/) 了解详情。
### QUIC 字段
当 `version` 为 `3` 时。
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
### TLS 字段
参阅 [TLS](/zh/configuration/shared/tls/#出站) 了解详情。
### 拨号字段
参阅 [拨号字段](/zh/configuration/shared/dial/) 了解详情。
docs/configuration/shared/http2.md
+43
View File
@@ -0,0 +1,43 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
### Structure
```json
{
"idle_timeout": "",
"keep_alive_period": "",
"stream_receive_window": "",
"connection_receive_window": "",
"max_concurrent_streams": 0
}
```
### Fields
#### idle_timeout
Idle connection timeout, in golang's Duration format.
#### keep_alive_period
Keep alive period, in golang's Duration format.
#### stream_receive_window
HTTP2 stream-level flow-control receive window size.
Accepts memory size format, e.g. `"64 MB"`.
#### connection_receive_window
HTTP2 connection-level flow-control receive window size.
Accepts memory size format, e.g. `"64 MB"`.
#### max_concurrent_streams
Maximum concurrent streams per connection.
docs/configuration/shared/http2.zh.md
+43
View File
@@ -0,0 +1,43 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
### 结构
```json
{
"idle_timeout": "",
"keep_alive_period": "",
"stream_receive_window": "",
"connection_receive_window": "",
"max_concurrent_streams": 0
}
```
### 字段
#### idle_timeout
空闲连接超时，采用 golang 的 Duration 格式。
#### keep_alive_period
Keep alive 周期，采用 golang 的 Duration 格式。
#### stream_receive_window
HTTP2 流级别流控接收窗口大小。
接受内存大小格式，例如 `"64 MB"`。
#### connection_receive_window
HTTP2 连接级别流控接收窗口大小。
接受内存大小格式，例如 `"64 MB"`。
#### max_concurrent_streams
每个连接的最大并发流数。
docs/configuration/shared/listen.md
+6
View File
@@ -2,6 +2,10 @@
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-alert: [netns](#netns)
!!! quote "Changes in sing-box 1.13.0"
:material-plus: [disable_tcp_keep_alive](#disable_tcp_keep_alive)
@@ -97,6 +101,8 @@ Reuse listener address.
Set network namespace, name or path.
Since sing-box 1.14.0, the tag of a [network namespace](/configuration/network-namespace/) can also be used.
#### tcp_fast_open
Enable TCP Fast Open.
docs/configuration/shared/listen.zh.md
+6
View File
@@ -2,6 +2,10 @@
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-alert: [netns](#netns)
!!! quote "sing-box 1.13.0 中的更改"
:material-plus: [disable_tcp_keep_alive](#disable_tcp_keep_alive)
@@ -97,6 +101,8 @@ icon: material/new-box
设置网络命名空间，名称或路径。
自 sing-box 1.14.0 起，也可以使用[网络命名空间](/zh/configuration/network-namespace/)的标签。
#### tcp_fast_open
启用 TCP Fast Open。
docs/configuration/shared/neighbor.md
+51
View File
@@ -0,0 +1,51 @@
---
icon: material/lan
---
# Neighbor Resolution
Match LAN devices by MAC address and hostname using
[`source_mac_address`](/configuration/route/rule/#source_mac_address) and
[`source_hostname`](/configuration/route/rule/#source_hostname) rule items.
Neighbor resolution is automatically enabled when these rule items exist
or when a [local DNS server](/configuration/dns/server/local/) sets
[neighbor_domain](/configuration/dns/server/local/#neighbor_domain).
Use [`route.find_neighbor`](/configuration/route/#find_neighbor) to force enable it for logging without rules.
## Linux
Works natively. No special setup required.
Hostname resolution requires DHCP lease files,
automatically detected from common DHCP servers (dnsmasq, odhcpd, ISC dhcpd, Kea).
Custom paths can be set via [`route.dhcp_lease_files`](/configuration/route/#dhcp_lease_files).
## Android
!!! quote ""
Only supported in graphical clients.
Requires Android 11 or above and ROOT.
Must use [VPNHotspot](https://github.com/Mygod/VPNHotspot) to share the VPN connection.
ROM built-in features like "Use VPN for connected devices" can share VPN
but cannot provide MAC address or hostname information.
Set **IP Masquerade Mode** to **None** in VPNHotspot settings.
Only route/DNS rules are supported. TUN include/exclude routes are not supported.
### Hostname Visibility
Hostname is only visible in sing-box if it is visible in VPNHotspot.
For Apple devices, change **Private Wi-Fi Address** from **Rotating** to **Fixed** in the Wi-Fi settings
of the connected network. Non-Apple devices are always visible.
## macOS
Requires the standalone version (macOS system extension).
The App Store version can share the VPN as a hotspot but does not support MAC address or hostname reading.
See [VPN Hotspot](/manual/misc/vpn-hotspot/#macos) for Internet Sharing setup.
docs/configuration/shared/neighbor.zh.md
+49
View File
@@ -0,0 +1,49 @@
---
icon: material/lan
---
# 邻居解析
通过
[`source_mac_address`](/configuration/route/rule/#source_mac_address) 和
[`source_hostname`](/configuration/route/rule/#source_hostname) 规则项匹配局域网设备的 MAC 地址和主机名。
当这些规则项存在，或 [local DNS 服务器](/zh/configuration/dns/server/local/) 设置了 [neighbor_domain](/zh/configuration/dns/server/local/#neighbor_domain) 时，邻居解析自动启用。
使用 [`route.find_neighbor`](/configuration/route/#find_neighbor) 可在没有规则时强制启用以输出日志。
## Linux
原生支持，无需特殊设置。
主机名解析需要 DHCP 租约文件，
自动从常见 DHCP 服务器（dnsmasq、odhcpd、ISC dhcpd、Kea）检测。
可通过 [`route.dhcp_lease_files`](/configuration/route/#dhcp_lease_files) 设置自定义路径。
## Android
!!! quote ""
仅在图形客户端中支持。
需要 Android 11 或以上版本和 ROOT。
必须使用 [VPNHotspot](https://github.com/Mygod/VPNHotspot) 共享 VPN 连接。
ROM 自带的「通过 VPN 共享连接」等功能可以共享 VPN，
但无法提供 MAC 地址或主机名信息。
在 VPNHotspot 设置中将 **IP 遮掩模式** 设为 **无**。
仅支持路由/DNS 规则。不支持 TUN 的 include/exclude 路由。
### 设备可见性
MAC 地址和主机名仅在 VPNHotspot 中可见时 sing-box 才能读取。
对于 Apple 设备，需要在所连接网络的 Wi-Fi 设置中将**私有无线局域网地址**从**轮替**改为**固定**。
非 Apple 设备始终可见。
## macOS
需要独立版本（macOS 系统扩展）。
App Store 版本可以共享 VPN 热点但不支持 MAC 地址或主机名读取。
参阅 [VPN 热点](/manual/misc/vpn-hotspot/#macos) 了解互联网共享设置。
docs/configuration/shared/pre-match.md
+40 -5
View File
@@ -4,6 +4,11 @@ icon: material/new-box
# Pre-match
!!! quote "Changes in sing-box 1.14.0"
:material-alert: [route](#route)
:material-plus: [sniff](#sniff)
!!! quote "Changes in sing-box 1.13.0"
:material-plus: [bypass](#bypass)
@@ -12,11 +17,11 @@ Pre-match is rule matching that runs before the connection is established.
### How it works
When TUN receives a connection request, the connection has not yet been established,
so no connection data can be read. In this phase, sing-box runs the routing rules in pre-match mode.
When an L3 inbound (TUN, WireGuard, or Tailscale) receives a connection request, the connection has not yet been established:
for TCP connections no connection data is available, while for UDP connections only the first packet is available.
In this phase, sing-box runs the routing rules in pre-match mode.
Since connection data is unavailable, only actions that do not require connection data can be executed.
When a rule matches an action that requires an established connection, pre-match stops at that rule.
When a rule matches an action that requires more connection data than available, pre-match stops at that rule.
### Supported actions
@@ -28,10 +33,40 @@ See [reject](/configuration/route/rule_action/#reject) for details.
#### route
Route ICMP connections to the specified outbound for direct reply.
!!! quote "Changes in sing-box 1.14.0"
Since sing-box 1.14.0, TCP and UDP connections can also be forwarded at L3;
previously only ICMP connections were supported.
Forward connections directly at L3 to the specified outbound,
without going through L3 to L4 translation.
Supported targets:
- ICMP connections: Direct and Bridge outbounds, and WireGuard / Tailscale endpoints.
- TCP and UDP connections: Bridge outbounds, and WireGuard / Tailscale endpoints.
L3 forwarding also applies when no rule matches and the default outbound is a supported
target; for outbound groups, the currently selected outbound is used.
FakeIP destinations require a `resolve` action performed in pre-match,
otherwise connections will be rejected.
See [route](/configuration/route/rule_action/#route) for details.
#### sniff
!!! question "Since sing-box 1.14.0"
For UDP connections, the first packet is available in pre-match,
so protocol sniffing runs on it directly and rule matching continues with the sniffed metadata.
When sniffers require more data (like a fragmented QUIC Client Hello), pre-match stops at that rule.
For TCP connections, pre-match always stops at that rule.
See [sniff](/configuration/route/rule_action/#sniff) for details.
#### bypass
!!! question "Since sing-box 1.13.0"
docs/configuration/shared/pre-match.zh.md
+33 -3
View File
@@ -4,6 +4,11 @@ icon: material/new-box
# 预匹配
!!! quote "sing-box 1.14.0 中的更改"
:material-alert: [route](#route)
:material-plus: [sniff](#sniff)
!!! quote "sing-box 1.13.0 中的更改"
:material-plus: [bypass](#bypass)
@@ -12,9 +17,9 @@ icon: material/new-box
### 工作原理
当 TUN 收到连接请求时，连接尚未建立，因此无法读取连接数据。在此阶段，sing-box 在预匹配模式下运行路由规则。
当 L3 入站（TUN、WireGuard 或 Tailscale）收到连接请求时，连接尚未建立：对于 TCP 连接，无连接数据可用；对于 UDP 连接，仅首个数据包可用。在此阶段，sing-box 在预匹配模式下运行路由规则。
由于连接数据不可用，只有不需要连接数据的动作才能执行。当规则匹配到需要已建立连接的动作时，预匹配将在该规则处停止。
当规则匹配到需要比当前可用数据更多连接数据的动作时，预匹配将在该规则处停止。
### 支持的动作
@@ -26,10 +31,35 @@ icon: material/new-box
#### route
将 ICMP 连接路由到指定出站以直接回复。
!!! quote "sing-box 1.14.0 中的更改"
自 sing-box 1.14.0 起，TCP 和 UDP 连接也可以在 L3 转发；此前仅支持 ICMP 连接。
将连接直接在 L3 转发到指定出站，不经过 L3 到 L4 转换。
支持的目标：
- ICMP 连接：direct 和 bridge 出站以及 WireGuard / Tailscale 端点。
- TCP 和 UDP 连接：bridge 出站以及 WireGuard / Tailscale 端点。
当没有规则匹配且默认出站为受支持的目标时，L3 转发同样生效；对于出站组，使用当前选中的出站。
FakeIP 目标需要在预匹配中先执行 `resolve` 动作，否则连接将被拒绝。
详情参阅 [route](/zh/configuration/route/rule_action/#route)。
#### sniff
!!! question "自 sing-box 1.14.0 起"
对于 UDP 连接，首个数据包在预匹配中可用，因此协议探测将直接在其上运行，随后规则匹配将携带探测结果继续。
当探测器需要更多数据时（如分片的 QUIC Client Hello），预匹配将在该规则处停止。
对于 TCP 连接，预匹配总是在该规则处停止。
详情参阅 [sniff](/zh/configuration/route/rule_action/#sniff)。
#### bypass
!!! question "自 sing-box 1.13.0 起"
docs/configuration/shared/quic.md
+30
View File
@@ -0,0 +1,30 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
### Structure
```json
{
"initial_packet_size": 0,
"disable_path_mtu_discovery": false,
... // HTTP2 Fields
}
```
### Fields
#### initial_packet_size
Initial QUIC packet size.
#### disable_path_mtu_discovery
Disable QUIC path MTU discovery.
### HTTP2 Fields
See [HTTP2 Fields](/configuration/shared/http2/) for details.
docs/configuration/shared/quic.zh.md
+30
View File
@@ -0,0 +1,30 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
### 结构
```json
{
"initial_packet_size": 0,
"disable_path_mtu_discovery": false,
... // HTTP2 字段
}
```
### 字段
#### initial_packet_size
初始 QUIC 数据包大小。
#### disable_path_mtu_discovery
禁用 QUIC 路径 MTU 发现。
### HTTP2 字段
参阅 [HTTP2 字段](/zh/configuration/shared/http2/) 了解详情。
docs/configuration/shared/tls.md
+157 -3
View File
@@ -2,6 +2,15 @@
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [certificate_provider](#certificate_provider)
:material-plus: [handshake_timeout](#handshake_timeout)
:material-plus: [spoof](#spoof)
:material-plus: [spoof_method](#spoof_method)
:material-plus: [engine](#engine)
:material-delete-clock: [acme](#acme-fields)
!!! quote "Changes in sing-box 1.13.0"
:material-plus: [kernel_tx](#kernel_tx)
@@ -49,6 +58,11 @@ icon: material/new-box
"key_path": "",
"kernel_tx": false,
"kernel_rx": false,
"handshake_timeout": "",
"certificate_provider": "",
// Deprecated
"acme": {
"domain": [],
"data_directory": "",
@@ -97,6 +111,7 @@ icon: material/new-box
```json
{
"enabled": true,
"engine": "",
"disable_sni": false,
"server_name": "",
"insecure": false,
@@ -115,6 +130,11 @@ icon: material/new-box
"fragment": false,
"fragment_fallback_delay": "",
"record_fragment": false,
"spoof": "",
"spoof_method": "",
"kernel_tx": false,
"kernel_rx": false,
"handshake_timeout": "",
"ech": {
"enabled": false,
"config": [],
@@ -174,6 +194,76 @@ Cipher suite values:
Enable TLS.
#### engine
!!! question "Since sing-box 1.14.0"
==Client only==
TLS engine to use.
Values:
* `go` (default)
* `apple`
* `windows`
Supported fields:
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
Unsupported fields:
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
!!! note ""
`windows` uses Schannel via SSPI. Only available on Windows build 17763 or later (Windows 10 version 1809, Windows Server 2019, or newer).
!!! note ""
TLS 1.3 is only negotiated on Windows 11 or Windows Server 2022 and newer. On older Windows versions, Schannel caps the connection at TLS 1.2 even when `max_version` is `1.3`.
The default version range is TLS 1.2 to TLS 1.3, matching the `go` engine.
Supported fields:
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
Unsupported fields:
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
#### disable_sni
==Client only==
@@ -408,6 +498,26 @@ Enable kernel TLS transmit support.
Enable kernel TLS receive support.
#### handshake_timeout
!!! question "Since sing-box 1.14.0"
TLS handshake timeout, in golang's Duration format.
`15s` is used by default.
#### certificate_provider
!!! question "Since sing-box 1.14.0"
==Server only==
A string or an object.
When string, the tag of a shared [Certificate Provider](/configuration/shared/certificate-provider/).
When object, an inline certificate provider. See [Certificate Provider](/configuration/shared/certificate-provider/) for available types and fields.
## Custom TLS support
!!! info "QUIC support"
@@ -469,7 +579,7 @@ The ECH key and configuration can be generated by `sing-box generate ech-keypair
!!! failure "Deprecated in sing-box 1.12.0"
ECH support has been migrated to use stdlib in sing-box 1.12.0, which does not come with support for PQ signature schemes, so `pq_signature_schemes_enabled` has been deprecated and no longer works.
`pq_signature_schemes_enabled` is deprecated in sing-box 1.12.0 and removed in sing-box 1.13.0.
Enable support for post-quantum peer certificate signature schemes.
@@ -477,7 +587,7 @@ Enable support for post-quantum peer certificate signature schemes.
!!! failure "Deprecated in sing-box 1.12.0"
`dynamic_record_sizing_disabled` has nothing to do with ECH, was added by mistake, has been deprecated and no longer works.
`dynamic_record_sizing_disabled` is deprecated in sing-box 1.12.0 and removed in sing-box 1.13.0.
Disables adaptive sizing of TLS records.
@@ -564,8 +674,52 @@ The fallback value used when TLS segmentation cannot automatically determine the
Fragment TLS handshake into multiple TLS records to bypass firewalls.
#### spoof
!!! question "Since sing-box 1.14.0"
==Client only==
!!! quote ""
Only supported on Linux, macOS, and Windows, and requires elevated privileges.
Inject a forged TLS ClientHello carrying a whitelisted SNI before the real one,
to fool SNI-filtering middleboxes that permit specific hostnames.
The forged segment is a copy of the real ClientHello with only the SNI value
replaced by the value of this field, so TLS fingerprinting cannot distinguish
it from the real one. The receiving server drops the forged segment
(see `spoof_method`) while the middlebox treats it as a legitimate session.
Requires raw-socket access (`CAP_NET_RAW` on Linux, root on macOS);
on Linux, `CAP_NET_ADMIN` is additionally required because the send sequence
number is read via `TCP_REPAIR`.
On Windows, Administrator is required to install the embedded WinDivert kernel
driver on first use. Windows on ARM64 is not supported.
#### spoof_method
!!! question "Since sing-box 1.14.0"
==Client only==
How the forged segment is rejected by the real server.
| Value | Behavior |
|----------------------------|----------------------------------------------------------------------------------------------------------------|
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
| `wrong-ack` | The forged segment's TCP acknowledgment number is placed before the server's send window. |
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option, which the server rejects since no MD5 key is negotiated. |
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp, which the server rejects as a PAWS replay. Linux/Windows only; not supported on macOS. |
### ACME Fields
!!! failure "Deprecated in sing-box 1.14.0"
Inline ACME options are deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0, check [Migration](/migration/#migrate-inline-acme-to-certificate-provider).
#### domain
List of domain.
@@ -677,4 +831,4 @@ A hexadecimal string with zero to eight digits.
The maximum time difference between the server and the client.
Check disabled if empty.
Check disabled if empty.
docs/configuration/shared/tls.zh.md
+154 -2
View File
@@ -2,6 +2,15 @@
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [certificate_provider](#certificate_provider)
:material-plus: [handshake_timeout](#handshake_timeout)
:material-plus: [spoof](#spoof)
:material-plus: [spoof_method](#spoof_method)
:material-plus: [engine](#engine)
:material-delete-clock: [acme](#acme-字段)
!!! quote "sing-box 1.13.0 中的更改"
:material-plus: [kernel_tx](#kernel_tx)
@@ -49,6 +58,11 @@ icon: material/new-box
"key_path": "",
"kernel_tx": false,
"kernel_rx": false,
"handshake_timeout": "",
"certificate_provider": "",
// 废弃的
"acme": {
"domain": [],
"data_directory": "",
@@ -97,6 +111,7 @@ icon: material/new-box
```json
{
"enabled": true,
"engine": "",
"disable_sni": false,
"server_name": "",
"insecure": false,
@@ -115,6 +130,11 @@ icon: material/new-box
"fragment": false,
"fragment_fallback_delay": "",
"record_fragment": false,
"spoof": "",
"spoof_method": "",
"kernel_tx": false,
"kernel_rx": false,
"handshake_timeout": "",
"ech": {
"enabled": false,
"config": [],
@@ -174,6 +194,76 @@ TLS 版本值：
启用 TLS
#### engine
!!! question "自 sing-box 1.14.0 起"
==仅客户端==
要使用的 TLS 引擎。
可用值：
* `go`（默认）
* `apple`
* `windows`
支持的字段：
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
不支持的字段：
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
!!! note ""
`windows` 通过 SSPI 使用 Schannel，仅在 Windows build 17763 及以上可用，包括 Windows 10 版本 1809、Windows Server 2019 及后续版本。
!!! note ""
TLS 1.3 仅在 Windows 11 或 Windows Server 2022 及后续版本上协商。在更早的 Windows 版本上，即使 `max_version` 设为 `1.3`，Schannel 也会把连接上限固定在 TLS 1.2。
默认版本范围为 TLS 1.2 到 TLS 1.3，与 `go` 引擎一致。证书验证在 Go 侧基于 Schannel 返回的证书链执行，默认使用系统证书存储。当设置了 `certificate` 或 `certificate_path` 时，这些根证书会替代系统存储。
支持的字段：
* `server_name`
* `insecure`
* `alpn`
* `min_version`
* `max_version`
* `certificate` / `certificate_path`
* `certificate_public_key_sha256`
* `handshake_timeout`
不支持的字段：
* `disable_sni`
* `cipher_suites`
* `curve_preferences`
* `client_certificate` / `client_certificate_path` / `client_key` / `client_key_path`
* `fragment` / `record_fragment`
* `kernel_tx` / `kernel_rx`
* `ech`
* `utls`
* `reality`
#### disable_sni
==仅客户端==
@@ -407,6 +497,26 @@ echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/
启用内核 TLS 接收支持。
#### handshake_timeout
!!! question "自 sing-box 1.14.0 起"
TLS 握手超时，采用 golang 的 Duration 格式。
默认使用 `15s`。
#### certificate_provider
!!! question "自 sing-box 1.14.0 起"
==仅服务器==
字符串或对象。
为字符串时，共享[证书提供者](/zh/configuration/shared/certificate-provider/)的标签。
为对象时，内联的证书提供者。可用类型和字段参阅[证书提供者](/zh/configuration/shared/certificate-provider/)。
## 自定义 TLS 支持
!!! info "QUIC 支持"
@@ -465,7 +575,7 @@ ECH 密钥和配置可以通过 `sing-box generate ech-keypair` 生成。
!!! failure "已在 sing-box 1.12.0 废弃"
ECH 支持已在 sing-box 1.12.0 迁移至使用标准库，但标准库不支持后量子对等证书签名方案，因此 `pq_signature_schemes_enabled` 已被弃用且不再工作。
`pq_signature_schemes_enabled` 已在 sing-box 1.12.0 废弃且已在 sing-box 1.13.0 中被移除。
启用对后量子对等证书签名方案的支持。
@@ -473,7 +583,7 @@ ECH 密钥和配置可以通过 `sing-box generate ech-keypair` 生成。
!!! failure "已在 sing-box 1.12.0 废弃"
`dynamic_record_sizing_disabled` 与 ECH 无关，是错误添加的，现已弃用且不再工作。
`dynamic_record_sizing_disabled` 已在 sing-box 1.12.0 废弃且已在 sing-box 1.13.0 中被移除。
禁用 TLS 记录的自适应大小调整。
@@ -559,8 +669,50 @@ ECH 配置路径，PEM 格式。
将 TLS 握手分段为多个 TLS 记录以绕过防火墙。
#### spoof
!!! question "自 sing-box 1.14.0 起"
==仅客户端==
!!! quote ""
仅支持 Linux、macOS 和 Windows，需要提升的权限。
在真实 ClientHello 之前注入一个伪造的、携带白名单 SNI 的 TLS ClientHello，
以欺骗基于 SNI 过滤的中间盒放行连接。
伪造报文是真实 ClientHello 的副本，仅将 SNI 值替换为本字段的值，
因此 TLS 指纹无法区分伪造与真实报文。真实服务器会丢弃伪造报文（见 `spoof_method`），
而中间盒将该连接视为合法会话。
需要原始套接字权限（Linux 上需 `CAP_NET_RAW`，macOS 上需 root）；
在 Linux 上还需 `CAP_NET_ADMIN`，因为需要通过 `TCP_REPAIR` 读取发送序列号。
Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内核驱动，
不支持 Windows ARM64。
#### spoof_method
!!! question "自 sing-box 1.14.0 起"
==仅客户端==
控制伪造报文被真实服务器拒绝的方式。
| 取值 | 行为 |
|--------------------------|-------------------------------------------------------------------|
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
| `wrong-ack` | 伪造报文的 TCP 确认号位于服务器发送窗口之前。 |
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项，未协商 MD5 密钥的服务器将拒绝。 |
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳，服务器按 PAWS 规则视为重放并拒绝。仅支持 Linux/Windows，不支持 macOS。 |
### ACME 字段
!!! failure "已在 sing-box 1.14.0 废弃"
内联 ACME 选项已在 sing-box 1.14.0 废弃且将在 sing-box 1.16.0 中被移除，参阅 [迁移指南](/zh/migration/#迁移内联-acme-到证书提供者)。
#### domain
域名列表。
docs/configuration/shared/udp-nat.md
+67
View File
@@ -0,0 +1,67 @@
---
icon: material/new-box
---
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [udp_mapping](#udp_mapping)
:material-plus: [udp_filtering](#udp_filtering)
:material-plus: [udp_nat_max](#udp_nat_max)
### Structure
```json
{
"udp_timeout": "5m",
"udp_mapping": "endpoint_independent",
"udp_filtering": "endpoint_independent",
"udp_nat_max": 0
}
```
### Fields
#### udp_timeout
UDP NAT expiration time.
`5m` will be used by default.
#### udp_mapping
!!! question "Since sing-box 1.14.0"
UDP NAT mapping behavior.
| Value | Behavior |
|------------------------------|-------------------------------------------------------------------------------|
| `endpoint_independent` | Reuse the same mapping for the same source address and port for all destinations. |
| `address_dependent` | Use a separate mapping for each destination address. |
| `address_and_port_dependent` | Use a separate mapping for each destination address and port. |
`endpoint_independent` is used by default.
#### udp_filtering
!!! question "Since sing-box 1.14.0"
UDP NAT filtering behavior.
| Value | Behavior |
|------------------------------|-----------------------------------------------------------------------------|
| `endpoint_independent` | Accept packets from any remote endpoint. |
| `address_dependent` | Accept packets only from remote addresses to which packets have been sent. |
| `address_and_port_dependent` | Accept packets only from remote addresses and ports to which packets have been sent. |
`endpoint_independent` is used by default.
#### udp_nat_max
!!! question "Since sing-box 1.14.0"
Maximum number of UDP NAT sessions.
When the limit is reached, the least recently used session is closed.
When unset or set to `0`, `4096` is used on iOS. On other platforms, a value from `4096` to `16384` is selected based on total memory;
`16384` is used if total memory cannot be detected.
docs/configuration/shared/udp-nat.zh.md
+67
View File
@@ -0,0 +1,67 @@
---
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [udp_mapping](#udp_mapping)
:material-plus: [udp_filtering](#udp_filtering)
:material-plus: [udp_nat_max](#udp_nat_max)
### 结构
```json
{
"udp_timeout": "5m",
"udp_mapping": "endpoint_independent",
"udp_filtering": "endpoint_independent",
"udp_nat_max": 0
}
```
### 字段
#### udp_timeout
UDP NAT 过期时间。
默认使用 `5m`。
#### udp_mapping
!!! question "自 sing-box 1.14.0 起"
UDP NAT 映射行为。
| 值 | 行为 |
|------------------------------|----------------------------------------------------------|
| `endpoint_independent` | 对相同的源地址和端口，所有目标复用同一映射。 |
| `address_dependent` | 每个目标地址使用单独的映射。 |
| `address_and_port_dependent` | 每个目标地址和端口使用单独的映射。 |
默认使用 `endpoint_independent`。
#### udp_filtering
!!! question "自 sing-box 1.14.0 起"
UDP NAT 过滤行为。
| 值 | 行为 |
|------------------------------|----------------------------------------------------------|
| `endpoint_independent` | 接受来自任意远程端点的数据包。 |
| `address_dependent` | 仅接受来自已向其发送过数据包的远程地址的数据包。 |
| `address_and_port_dependent` | 仅接受来自已向其发送过数据包的远程地址和端口的数据包。 |
默认使用 `endpoint_independent`。
#### udp_nat_max
!!! question "自 sing-box 1.14.0 起"
UDP NAT 会话的最大数量。
达到限制时，将关闭最近最少使用的会话。
未设置或设置为 `0` 时，iOS 使用 `4096`。其他平台根据总内存在 `4096` 到 `16384` 之间选择；
无法检测总内存时使用 `16384`。