documentation: Bump version

.gitignore

@@ -1,7 +1,6 @@
 /.idea/
 /vendor/
 /*.json
-/*.srs
 /*.db
 /site/
 /bin/

Makefile

@@ -14,7 +14,7 @@ MAIN_PARAMS = $(PARAMS) -tags $(TAGS)
 MAIN = ./cmd/sing-box
 PREFIX ?= $(shell go env GOPATH)
 
-.PHONY: test release docs
+.PHONY: test release
 
 build:
 	go build $(MAIN_PARAMS) $(MAIN)
@@ -182,14 +182,6 @@ lib_install:
 	go install -v github.com/sagernet/gomobile/cmd/gomobile@v0.0.0-20230915142329-c6740b6d2950
 	go install -v github.com/sagernet/gomobile/cmd/gobind@v0.0.0-20230915142329-c6740b6d2950
 
-docs:
-	mkdocs serve
-
-publish_docs:
-	mkdocs gh-deploy -m "Update" --force --ignore-version --no-history
-
-docs_install:
-	pip install --force-reinstall mkdocs-material=="9.*" mkdocs-static-i18n=="1.2.*"
 clean:
 	rm -rf bin dist sing-box
 	rm -f $(shell go env GOPATH)/sing-box

adapter/experimental.go

@@ -1,16 +1,11 @@
 package adapter
 
 import (
-	"bytes"
 	"context"
-	"encoding/binary"
-	"io"
 	"net"
-	"time"
 
 	"github.com/sagernet/sing-box/common/urltest"
 	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/common/rw"
 )
 
 type ClashServer interface {
@@ -18,83 +13,22 @@ type ClashServer interface {
 	PreStarter
 	Mode() string
 	ModeList() []string
+	StoreSelected() bool
+	StoreFakeIP() bool
+	CacheFile() ClashCacheFile
 	HistoryStorage() *urltest.HistoryStorage
 	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
 	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
 }
 
-type CacheFile interface {
-	Service
-	PreStarter
-
-	StoreFakeIP() bool
-	FakeIPStorage
-
+type ClashCacheFile interface {
 	LoadMode() string
 	StoreMode(mode string) error
 	LoadSelected(group string) string
 	StoreSelected(group string, selected string) error
 	LoadGroupExpand(group string) (isExpand bool, loaded bool)
 	StoreGroupExpand(group string, expand bool) error
-	LoadRuleSet(tag string) *SavedRuleSet
-	SaveRuleSet(tag string, set *SavedRuleSet) error
-}
-
-type SavedRuleSet struct {
-	Content     []byte
-	LastUpdated time.Time
-	LastEtag    string
-}
-
-func (s *SavedRuleSet) MarshalBinary() ([]byte, error) {
-	var buffer bytes.Buffer
-	err := binary.Write(&buffer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return nil, err
-	}
-	err = rw.WriteUVariant(&buffer, uint64(len(s.Content)))
-	if err != nil {
-		return nil, err
-	}
-	buffer.Write(s.Content)
-	err = binary.Write(&buffer, binary.BigEndian, s.LastUpdated.Unix())
-	if err != nil {
-		return nil, err
-	}
-	err = rw.WriteVString(&buffer, s.LastEtag)
-	if err != nil {
-		return nil, err
-	}
-	return buffer.Bytes(), nil
-}
-
-func (s *SavedRuleSet) UnmarshalBinary(data []byte) error {
-	reader := bytes.NewReader(data)
-	var version uint8
-	err := binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return err
-	}
-	contentLen, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return err
-	}
-	s.Content = make([]byte, contentLen)
-	_, err = io.ReadFull(reader, s.Content)
-	if err != nil {
-		return err
-	}
-	var lastUpdated int64
-	err = binary.Read(reader, binary.BigEndian, &lastUpdated)
-	if err != nil {
-		return err
-	}
-	s.LastUpdated = time.Unix(lastUpdated, 0)
-	s.LastEtag, err = rw.ReadVString(reader)
-	if err != nil {
-		return err
-	}
-	return nil
+	FakeIPStorage
 }
 
 type Tracker interface {

adapter/inbound.go

@@ -47,7 +47,6 @@ type InboundContext struct {
 	GeoIPCode            string
 	ProcessInfo          *process.Info
 	FakeIP               bool
-	IPCIDRMatchSource    bool
 
 	// dns cache
 

adapter/router.go

@@ -18,7 +18,7 @@ type Router interface {
 
 	Outbounds() []Outbound
 	Outbound(tag string) (Outbound, bool)
-	DefaultOutbound(network string) (Outbound, error)
+	DefaultOutbound(network string) Outbound
 
 	FakeIPStore() FakeIPStore
 
@@ -27,8 +27,6 @@ type Router interface {
 	GeoIPReader() *geoip.Reader
 	LoadGeosite(code string) (Rule, error)
 
-	RuleSet(tag string) (RuleSet, bool)
-
 	Exchange(ctx context.Context, message *mdns.Msg) (*mdns.Msg, error)
 	Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error)
 	LookupDefault(ctx context.Context, domain string) ([]netip.Addr, error)
@@ -43,7 +41,6 @@ type Router interface {
 	NetworkMonitor() tun.NetworkUpdateMonitor
 	InterfaceMonitor() tun.DefaultInterfaceMonitor
 	PackageManager() tun.PackageManager
-	WIFIState() WIFIState
 	Rules() []Rule
 
 	ClashServer() ClashServer
@@ -63,15 +60,11 @@ func RouterFromContext(ctx context.Context) Router {
 	return service.FromContext[Router](ctx)
 }
 
-type HeadlessRule interface {
-	Match(metadata *InboundContext) bool
-}
-
 type Rule interface {
-	HeadlessRule
 	Service
 	Type() string
 	UpdateGeosite() error
+	Match(metadata *InboundContext) bool
 	Outbound() string
 	String() string
 }
@@ -82,16 +75,6 @@ type DNSRule interface {
 	RewriteTTL() *uint32
 }
 
-type RuleSet interface {
-	HeadlessRule
-	Service
-}
-
 type InterfaceUpdateListener interface {
 	InterfaceUpdated()
 }
-
-type WIFIState struct {
-	SSID  string
-	BSSID string
-}

box.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/experimental"
-	"github.com/sagernet/sing-box/experimental/cachefile"
 	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/inbound"
 	"github.com/sagernet/sing-box/log"
@@ -33,8 +32,7 @@ type Box struct {
 	outbounds    []adapter.Outbound
 	logFactory   log.Factory
 	logger       log.ContextLogger
-	preServices1 map[string]adapter.Service
-	preServices2 map[string]adapter.Service
+	preServices  map[string]adapter.Service
 	postServices map[string]adapter.Service
 	done         chan struct{}
 }
@@ -43,26 +41,21 @@ type Options struct {
 	option.Options
 	Context           context.Context
 	PlatformInterface platform.Interface
-	PlatformLogWriter log.PlatformWriter
 }
 
 func New(options Options) (*Box, error) {
-	createdAt := time.Now()
 	ctx := options.Context
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	ctx = service.ContextWithDefaultRegistry(ctx)
 	ctx = pause.ContextWithDefaultManager(ctx)
+	createdAt := time.Now()
 	experimentalOptions := common.PtrValueOrDefault(options.Experimental)
 	applyDebugOptions(common.PtrValueOrDefault(experimentalOptions.Debug))
-	var needCacheFile bool
 	var needClashAPI bool
 	var needV2RayAPI bool
-	if experimentalOptions.CacheFile != nil && experimentalOptions.CacheFile.Enabled || options.PlatformLogWriter != nil {
-		needCacheFile = true
-	}
-	if experimentalOptions.ClashAPI != nil || options.PlatformLogWriter != nil {
+	if experimentalOptions.ClashAPI != nil || options.PlatformInterface != nil {
 		needClashAPI = true
 	}
 	if experimentalOptions.V2RayAPI != nil && experimentalOptions.V2RayAPI.Listen != "" {
@@ -78,7 +71,7 @@ func New(options Options) (*Box, error) {
 		Observable:     needClashAPI,
 		DefaultWriter:  defaultLogWriter,
 		BaseTime:       createdAt,
-		PlatformWriter: options.PlatformLogWriter,
+		PlatformWriter: options.PlatformInterface,
 	})
 	if err != nil {
 		return nil, E.Cause(err, "create log factory")
@@ -151,14 +144,8 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize platform interface")
 		}
 	}
-	preServices1 := make(map[string]adapter.Service)
-	preServices2 := make(map[string]adapter.Service)
+	preServices := make(map[string]adapter.Service)
 	postServices := make(map[string]adapter.Service)
-	if needCacheFile {
-		cacheFile := cachefile.NewCacheFile(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
-		preServices1["cache file"] = cacheFile
-		service.MustRegister[adapter.CacheFile](ctx, cacheFile)
-	}
 	if needClashAPI {
 		clashAPIOptions := common.PtrValueOrDefault(experimentalOptions.ClashAPI)
 		clashAPIOptions.ModeList = experimental.CalculateClashModeList(options.Options)
@@ -167,7 +154,7 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "create clash api server")
 		}
 		router.SetClashServer(clashServer)
-		preServices2["clash api"] = clashServer
+		preServices["clash api"] = clashServer
 	}
 	if needV2RayAPI {
 		v2rayServer, err := experimental.NewV2RayServer(logFactory.NewLogger("v2ray-api"), common.PtrValueOrDefault(experimentalOptions.V2RayAPI))
@@ -175,7 +162,7 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "create v2ray api server")
 		}
 		router.SetV2RayServer(v2rayServer)
-		preServices2["v2ray api"] = v2rayServer
+		preServices["v2ray api"] = v2rayServer
 	}
 	return &Box{
 		router:       router,
@@ -184,8 +171,7 @@ func New(options Options) (*Box, error) {
 		createdAt:    createdAt,
 		logFactory:   logFactory,
 		logger:       logFactory.Logger(),
-		preServices1: preServices1,
-		preServices2: preServices2,
+		preServices:  preServices,
 		postServices: postServices,
 		done:         make(chan struct{}),
 	}, nil
@@ -230,16 +216,7 @@ func (s *Box) Start() error {
 }
 
 func (s *Box) preStart() error {
-	for serviceName, service := range s.preServices1 {
-		if preService, isPreService := service.(adapter.PreStarter); isPreService {
-			s.logger.Trace("pre-start ", serviceName)
-			err := preService.PreStart()
-			if err != nil {
-				return E.Cause(err, "pre-starting ", serviceName)
-			}
-		}
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		if preService, isPreService := service.(adapter.PreStarter); isPreService {
 			s.logger.Trace("pre-start ", serviceName)
 			err := preService.PreStart()
@@ -260,14 +237,7 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	for serviceName, service := range s.preServices1 {
-		s.logger.Trace("starting ", serviceName)
-		err = service.Start()
-		if err != nil {
-			return E.Cause(err, "start ", serviceName)
-		}
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		s.logger.Trace("starting ", serviceName)
 		err = service.Start()
 		if err != nil {
@@ -342,13 +312,7 @@ func (s *Box) Close() error {
 			return E.Cause(err, "close router")
 		})
 	}
-	for serviceName, service := range s.preServices1 {
-		s.logger.Trace("closing ", serviceName)
-		errors = E.Append(errors, service.Close(), func(err error) error {
-			return E.Cause(err, "close ", serviceName)
-		})
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		s.logger.Trace("closing ", serviceName)
 		errors = E.Append(errors, service.Close(), func(err error) error {
 			return E.Cause(err, "close ", serviceName)

cmd/internal/build/main.go

@@ -12,7 +12,7 @@ import (
 func main() {
 	build_shared.FindSDK()
 
-	if os.Getenv("GOPATH") == "" {
+	if os.Getenv("build.Default.GOPATH") == "" {
 		os.Setenv("GOPATH", build.Default.GOPATH)
 	}
 

cmd/sing-box/cmd_format.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 
 	"github.com/spf13/cobra"
@@ -68,3 +69,41 @@ func format() error {
 	}
 	return nil
 }
+
+func formatOne(configPath string) error {
+	configContent, err := os.ReadFile(configPath)
+	if err != nil {
+		return E.Cause(err, "read config")
+	}
+	var options option.Options
+	err = options.UnmarshalJSON(configContent)
+	if err != nil {
+		return E.Cause(err, "decode config")
+	}
+	buffer := new(bytes.Buffer)
+	encoder := json.NewEncoder(buffer)
+	encoder.SetIndent("", "  ")
+	err = encoder.Encode(options)
+	if err != nil {
+		return E.Cause(err, "encode config")
+	}
+	if !commandFormatFlagWrite {
+		os.Stdout.WriteString(buffer.String() + "\n")
+		return nil
+	}
+	if bytes.Equal(configContent, buffer.Bytes()) {
+		return nil
+	}
+	output, err := os.Create(configPath)
+	if err != nil {
+		return E.Cause(err, "open output")
+	}
+	_, err = output.Write(buffer.Bytes())
+	output.Close()
+	if err != nil {
+		return E.Cause(err, "write output")
+	}
+	outputPath, _ := filepath.Abs(configPath)
+	os.Stderr.WriteString(outputPath + "\n")
+	return nil
+}

cmd/sing-box/cmd_geoip.go

@@ -1,43 +0,0 @@
-package main
-
-import (
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/oschwald/maxminddb-golang"
-	"github.com/spf13/cobra"
-)
-
-var (
-	geoipReader          *maxminddb.Reader
-	commandGeoIPFlagFile string
-)
-
-var commandGeoip = &cobra.Command{
-	Use:   "geoip",
-	Short: "GeoIP tools",
-	PersistentPreRun: func(cmd *cobra.Command, args []string) {
-		err := geoipPreRun()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.PersistentFlags().StringVarP(&commandGeoIPFlagFile, "file", "f", "geoip.db", "geoip file")
-	mainCommand.AddCommand(commandGeoip)
-}
-
-func geoipPreRun() error {
-	reader, err := maxminddb.Open(commandGeoIPFlagFile)
-	if err != nil {
-		return err
-	}
-	if reader.Metadata.DatabaseType != "sing-geoip" {
-		reader.Close()
-		return E.New("incorrect database type, expected sing-geoip, got ", reader.Metadata.DatabaseType)
-	}
-	geoipReader = reader
-	return nil
-}

cmd/sing-box/cmd_geoip_export.go

@@ -1,98 +0,0 @@
-package main
-
-import (
-	"io"
-	"net"
-	"os"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/json"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/oschwald/maxminddb-golang"
-	"github.com/spf13/cobra"
-)
-
-var flagGeoipExportOutput string
-
-const flagGeoipExportDefaultOutput = "geoip-<country>.srs"
-
-var commandGeoipExport = &cobra.Command{
-	Use:   "export <country>",
-	Short: "Export geoip country as rule-set",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geoipExport(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoipExport.Flags().StringVarP(&flagGeoipExportOutput, "output", "o", flagGeoipExportDefaultOutput, "Output path")
-	commandGeoip.AddCommand(commandGeoipExport)
-}
-
-func geoipExport(countryCode string) error {
-	networks := geoipReader.Networks(maxminddb.SkipAliasedNetworks)
-	countryMap := make(map[string][]*net.IPNet)
-	var (
-		ipNet           *net.IPNet
-		nextCountryCode string
-		err             error
-	)
-	for networks.Next() {
-		ipNet, err = networks.Network(&nextCountryCode)
-		if err != nil {
-			return err
-		}
-		countryMap[nextCountryCode] = append(countryMap[nextCountryCode], ipNet)
-	}
-	ipNets := countryMap[strings.ToLower(countryCode)]
-	if len(ipNets) == 0 {
-		return E.New("country code not found: ", countryCode)
-	}
-
-	var (
-		outputFile   *os.File
-		outputWriter io.Writer
-	)
-	if flagGeoipExportOutput == "stdout" {
-		outputWriter = os.Stdout
-	} else if flagGeoipExportOutput == flagGeoipExportDefaultOutput {
-		outputFile, err = os.Create("geoip-" + countryCode + ".json")
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	} else {
-		outputFile, err = os.Create(flagGeoipExportOutput)
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	}
-
-	encoder := json.NewEncoder(outputWriter)
-	encoder.SetIndent("", "  ")
-	var headlessRule option.DefaultHeadlessRule
-	headlessRule.IPCIDR = make([]string, 0, len(ipNets))
-	for _, cidr := range ipNets {
-		headlessRule.IPCIDR = append(headlessRule.IPCIDR, cidr.String())
-	}
-	var plainRuleSet option.PlainRuleSetCompat
-	plainRuleSet.Version = C.RuleSetVersion1
-	plainRuleSet.Options.Rules = []option.HeadlessRule{
-		{
-			Type:           C.RuleTypeDefault,
-			DefaultOptions: headlessRule,
-		},
-	}
-	return encoder.Encode(plainRuleSet)
-}

cmd/sing-box/cmd_geoip_list.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"os"
-
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeoipList = &cobra.Command{
-	Use:   "list",
-	Short: "List geoip country codes",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := listGeoip()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.AddCommand(commandGeoipList)
-}
-
-func listGeoip() error {
-	for _, code := range geoipReader.Metadata.Languages {
-		os.Stdout.WriteString(code + "\n")
-	}
-	return nil
-}

cmd/sing-box/cmd_geoip_lookup.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"net/netip"
-	"os"
-
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-	N "github.com/sagernet/sing/common/network"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeoipLookup = &cobra.Command{
-	Use:   "lookup <address>",
-	Short: "Lookup if an IP address is contained in the GeoIP database",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geoipLookup(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.AddCommand(commandGeoipLookup)
-}
-
-func geoipLookup(address string) error {
-	addr, err := netip.ParseAddr(address)
-	if err != nil {
-		return E.Cause(err, "parse address")
-	}
-	if !N.IsPublicAddr(addr) {
-		os.Stdout.WriteString("private\n")
-		return nil
-	}
-	var code string
-	_ = geoipReader.Lookup(addr.AsSlice(), &code)
-	if code != "" {
-		os.Stdout.WriteString(code + "\n")
-		return nil
-	}
-	os.Stdout.WriteString("unknown\n")
-	return nil
-}

cmd/sing-box/cmd_geosite.go

@@ -1,41 +0,0 @@
-package main
-
-import (
-	"github.com/sagernet/sing-box/common/geosite"
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	commandGeoSiteFlagFile string
-	geositeReader          *geosite.Reader
-	geositeCodeList        []string
-)
-
-var commandGeoSite = &cobra.Command{
-	Use:   "geosite",
-	Short: "Geosite tools",
-	PersistentPreRun: func(cmd *cobra.Command, args []string) {
-		err := geositePreRun()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.PersistentFlags().StringVarP(&commandGeoSiteFlagFile, "file", "f", "geosite.db", "geosite file")
-	mainCommand.AddCommand(commandGeoSite)
-}
-
-func geositePreRun() error {
-	reader, codeList, err := geosite.Open(commandGeoSiteFlagFile)
-	if err != nil {
-		return E.Cause(err, "open geosite file")
-	}
-	geositeReader = reader
-	geositeCodeList = codeList
-	return nil
-}

cmd/sing-box/cmd_geosite_export.go

@@ -1,81 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"io"
-	"os"
-
-	"github.com/sagernet/sing-box/common/geosite"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeExportOutput string
-
-const commandGeositeExportDefaultOutput = "geosite-<category>.json"
-
-var commandGeositeExport = &cobra.Command{
-	Use:   "export <category>",
-	Short: "Export geosite category as rule-set",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geositeExport(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeositeExport.Flags().StringVarP(&commandGeositeExportOutput, "output", "o", commandGeositeExportDefaultOutput, "Output path")
-	commandGeoSite.AddCommand(commandGeositeExport)
-}
-
-func geositeExport(category string) error {
-	sourceSet, err := geositeReader.Read(category)
-	if err != nil {
-		return err
-	}
-	var (
-		outputFile   *os.File
-		outputWriter io.Writer
-	)
-	if commandGeositeExportOutput == "stdout" {
-		outputWriter = os.Stdout
-	} else if commandGeositeExportOutput == commandGeositeExportDefaultOutput {
-		outputFile, err = os.Create("geosite-" + category + ".json")
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	} else {
-		outputFile, err = os.Create(commandGeositeExportOutput)
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	}
-
-	encoder := json.NewEncoder(outputWriter)
-	encoder.SetIndent("", "  ")
-	var headlessRule option.DefaultHeadlessRule
-	defaultRule := geosite.Compile(sourceSet)
-	headlessRule.Domain = defaultRule.Domain
-	headlessRule.DomainSuffix = defaultRule.DomainSuffix
-	headlessRule.DomainKeyword = defaultRule.DomainKeyword
-	headlessRule.DomainRegex = defaultRule.DomainRegex
-	var plainRuleSet option.PlainRuleSetCompat
-	plainRuleSet.Version = C.RuleSetVersion1
-	plainRuleSet.Options.Rules = []option.HeadlessRule{
-		{
-			Type:           C.RuleTypeDefault,
-			DefaultOptions: headlessRule,
-		},
-	}
-	return encoder.Encode(plainRuleSet)
-}

cmd/sing-box/cmd_geosite_list.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"os"
-	"sort"
-
-	"github.com/sagernet/sing-box/log"
-	F "github.com/sagernet/sing/common/format"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeList = &cobra.Command{
-	Use:   "list <category>",
-	Short: "List geosite categories",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geositeList()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.AddCommand(commandGeositeList)
-}
-
-func geositeList() error {
-	var geositeEntry []struct {
-		category string
-		items    int
-	}
-	for _, category := range geositeCodeList {
-		sourceSet, err := geositeReader.Read(category)
-		if err != nil {
-			return err
-		}
-		geositeEntry = append(geositeEntry, struct {
-			category string
-			items    int
-		}{category, len(sourceSet)})
-	}
-	sort.SliceStable(geositeEntry, func(i, j int) bool {
-		return geositeEntry[i].items < geositeEntry[j].items
-	})
-	for _, entry := range geositeEntry {
-		os.Stdout.WriteString(F.ToString(entry.category, " (", entry.items, ")\n"))
-	}
-	return nil
-}

cmd/sing-box/cmd_geosite_lookup.go

@@ -1,97 +0,0 @@
-package main
-
-import (
-	"os"
-	"sort"
-
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeLookup = &cobra.Command{
-	Use:   "lookup [category] <domain>",
-	Short: "Check if a domain is in the geosite",
-	Args:  cobra.RangeArgs(1, 2),
-	Run: func(cmd *cobra.Command, args []string) {
-		var (
-			source string
-			target string
-		)
-		switch len(args) {
-		case 1:
-			target = args[0]
-		case 2:
-			source = args[0]
-			target = args[1]
-		}
-		err := geositeLookup(source, target)
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.AddCommand(commandGeositeLookup)
-}
-
-func geositeLookup(source string, target string) error {
-	var sourceMatcherList []struct {
-		code    string
-		matcher *searchGeositeMatcher
-	}
-	if source != "" {
-		sourceSet, err := geositeReader.Read(source)
-		if err != nil {
-			return err
-		}
-		sourceMatcher, err := newSearchGeositeMatcher(sourceSet)
-		if err != nil {
-			return E.Cause(err, "compile code: "+source)
-		}
-		sourceMatcherList = []struct {
-			code    string
-			matcher *searchGeositeMatcher
-		}{
-			{
-				code:    source,
-				matcher: sourceMatcher,
-			},
-		}
-
-	} else {
-		for _, code := range geositeCodeList {
-			sourceSet, err := geositeReader.Read(code)
-			if err != nil {
-				return err
-			}
-			sourceMatcher, err := newSearchGeositeMatcher(sourceSet)
-			if err != nil {
-				return E.Cause(err, "compile code: "+code)
-			}
-			sourceMatcherList = append(sourceMatcherList, struct {
-				code    string
-				matcher *searchGeositeMatcher
-			}{
-				code:    code,
-				matcher: sourceMatcher,
-			})
-		}
-	}
-	sort.SliceStable(sourceMatcherList, func(i, j int) bool {
-		return sourceMatcherList[i].code < sourceMatcherList[j].code
-	})
-
-	for _, matcherItem := range sourceMatcherList {
-		if matchRule := matcherItem.matcher.Match(target); matchRule != "" {
-			os.Stdout.WriteString("Match code (")
-			os.Stdout.WriteString(matcherItem.code)
-			os.Stdout.WriteString(") ")
-			os.Stdout.WriteString(matchRule)
-			os.Stdout.WriteString("\n")
-		}
-	}
-	return nil
-}

cmd/sing-box/cmd_geosite_matcher.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/geosite"
-)
-
-type searchGeositeMatcher struct {
-	domainMap   map[string]bool
-	suffixList  []string
-	keywordList []string
-	regexList   []string
-}
-
-func newSearchGeositeMatcher(items []geosite.Item) (*searchGeositeMatcher, error) {
-	options := geosite.Compile(items)
-	domainMap := make(map[string]bool)
-	for _, domain := range options.Domain {
-		domainMap[domain] = true
-	}
-	rule := &searchGeositeMatcher{
-		domainMap:   domainMap,
-		suffixList:  options.DomainSuffix,
-		keywordList: options.DomainKeyword,
-		regexList:   options.DomainRegex,
-	}
-	return rule, nil
-}
-
-func (r *searchGeositeMatcher) Match(domain string) string {
-	if r.domainMap[domain] {
-		return "domain=" + domain
-	}
-	for _, suffix := range r.suffixList {
-		if strings.HasSuffix(domain, suffix) {
-			return "domain_suffix=" + suffix
-		}
-	}
-	for _, keyword := range r.keywordList {
-		if strings.Contains(domain, keyword) {
-			return "domain_keyword=" + keyword
-		}
-	}
-	for _, regexStr := range r.regexList {
-		regex, err := regexp.Compile(regexStr)
-		if err != nil {
-			continue
-		}
-		if regex.MatchString(domain) {
-			return "domain_regex=" + regexStr
-		}
-	}
-	return ""
-}

cmd/sing-box/cmd_merge.go

@@ -18,7 +18,7 @@ import (
 )
 
 var commandMerge = &cobra.Command{
-	Use:   "merge <output>",
+	Use:   "merge [output]",
 	Short: "Merge configurations",
 	Run: func(cmd *cobra.Command, args []string) {
 		err := merge(args[0])

cmd/sing-box/cmd_rule_set.go

@@ -1,14 +0,0 @@
-package main
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var commandRuleSet = &cobra.Command{
-	Use:   "rule-set",
-	Short: "Manage rule sets",
-}
-
-func init() {
-	mainCommand.AddCommand(commandRuleSet)
-}

cmd/sing-box/cmd_rule_set_compile.go

@@ -1,80 +0,0 @@
-package main
-
-import (
-	"io"
-	"os"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/json"
-	"github.com/sagernet/sing-box/common/srs"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-
-	"github.com/spf13/cobra"
-)
-
-var flagRuleSetCompileOutput string
-
-const flagRuleSetCompileDefaultOutput = "<file_name>.srs"
-
-var commandRuleSetCompile = &cobra.Command{
-	Use:   "compile [source-path]",
-	Short: "Compile rule-set json to binary",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := compileRuleSet(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandRuleSet.AddCommand(commandRuleSetCompile)
-	commandRuleSetCompile.Flags().StringVarP(&flagRuleSetCompileOutput, "output", "o", flagRuleSetCompileDefaultOutput, "Output file")
-}
-
-func compileRuleSet(sourcePath string) error {
-	var (
-		reader io.Reader
-		err    error
-	)
-	if sourcePath == "stdin" {
-		reader = os.Stdin
-	} else {
-		reader, err = os.Open(sourcePath)
-		if err != nil {
-			return err
-		}
-	}
-	decoder := json.NewDecoder(json.NewCommentFilter(reader))
-	decoder.DisallowUnknownFields()
-	var plainRuleSet option.PlainRuleSetCompat
-	err = decoder.Decode(&plainRuleSet)
-	if err != nil {
-		return err
-	}
-	ruleSet := plainRuleSet.Upgrade()
-	var outputPath string
-	if flagRuleSetCompileOutput == flagRuleSetCompileDefaultOutput {
-		if strings.HasSuffix(sourcePath, ".json") {
-			outputPath = sourcePath[:len(sourcePath)-5] + ".srs"
-		} else {
-			outputPath = sourcePath + ".srs"
-		}
-	} else {
-		outputPath = flagRuleSetCompileOutput
-	}
-	outputFile, err := os.Create(outputPath)
-	if err != nil {
-		return err
-	}
-	err = srs.Write(outputFile, ruleSet)
-	if err != nil {
-		outputFile.Close()
-		os.Remove(outputPath)
-		return err
-	}
-	outputFile.Close()
-	return nil
-}

cmd/sing-box/cmd_rule_set_format.go

@@ -1,87 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-
-	"github.com/sagernet/sing-box/common/json"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var commandRuleSetFormatFlagWrite bool
-
-var commandRuleSetFormat = &cobra.Command{
-	Use:   "format <source-path>",
-	Short: "Format rule-set json",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := formatRuleSet(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandRuleSetFormat.Flags().BoolVarP(&commandRuleSetFormatFlagWrite, "write", "w", false, "write result to (source) file instead of stdout")
-	commandRuleSet.AddCommand(commandRuleSetFormat)
-}
-
-func formatRuleSet(sourcePath string) error {
-	var (
-		reader io.Reader
-		err    error
-	)
-	if sourcePath == "stdin" {
-		reader = os.Stdin
-	} else {
-		reader, err = os.Open(sourcePath)
-		if err != nil {
-			return err
-		}
-	}
-	content, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	decoder := json.NewDecoder(json.NewCommentFilter(bytes.NewReader(content)))
-	decoder.DisallowUnknownFields()
-	var plainRuleSet option.PlainRuleSetCompat
-	err = decoder.Decode(&plainRuleSet)
-	if err != nil {
-		return err
-	}
-	ruleSet := plainRuleSet.Upgrade()
-	buffer := new(bytes.Buffer)
-	encoder := json.NewEncoder(buffer)
-	encoder.SetIndent("", "  ")
-	err = encoder.Encode(ruleSet)
-	if err != nil {
-		return E.Cause(err, "encode config")
-	}
-	outputPath, _ := filepath.Abs(sourcePath)
-	if !commandRuleSetFormatFlagWrite || sourcePath == "stdin" {
-		os.Stdout.WriteString(buffer.String() + "\n")
-		return nil
-	}
-	if bytes.Equal(content, buffer.Bytes()) {
-		return nil
-	}
-	output, err := os.Create(sourcePath)
-	if err != nil {
-		return E.Cause(err, "open output")
-	}
-	_, err = output.Write(buffer.Bytes())
-	output.Close()
-	if err != nil {
-		return E.Cause(err, "write output")
-	}
-	os.Stderr.WriteString(outputPath + "\n")
-	return nil
-}

cmd/sing-box/cmd_tools.go

@@ -38,7 +38,11 @@ func createPreStartedClient() (*box.Box, error) {
 
 func createDialer(instance *box.Box, network string, outboundTag string) (N.Dialer, error) {
 	if outboundTag == "" {
-		return instance.Router().DefaultOutbound(N.NetworkName(network))
+		outbound := instance.Router().DefaultOutbound(N.NetworkName(network))
+		if outbound == nil {
+			return nil, E.New("missing default outbound")
+		}
+		return outbound, nil
 	} else {
 		outbound, loaded := instance.Router().Outbound(outboundTag)
 		if !loaded {

cmd/sing-box/cmd_tools_connect.go

@@ -18,7 +18,7 @@ import (
 var commandConnectFlagNetwork string
 
 var commandConnect = &cobra.Command{
-	Use:   "connect <address>",
+	Use:   "connect [address]",
 	Short: "Connect to an address",
 	Args:  cobra.ExactArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {

common/dialer/router.go

@@ -18,19 +18,11 @@ func NewRouter(router adapter.Router) N.Dialer {
 }
 
 func (d *RouterDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	dialer, err := d.router.DefaultOutbound(network)
-	if err != nil {
-		return nil, err
-	}
-	return dialer.DialContext(ctx, network, destination)
+	return d.router.DefaultOutbound(network).DialContext(ctx, network, destination)
 }
 
 func (d *RouterDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	dialer, err := d.router.DefaultOutbound(N.NetworkUDP)
-	if err != nil {
-		return nil, err
-	}
-	return dialer.ListenPacket(ctx, destination)
+	return d.router.DefaultOutbound(N.NetworkUDP).ListenPacket(ctx, destination)
 }
 
 func (d *RouterDialer) Upstream() any {

common/sniff/quic.go

@@ -182,52 +182,11 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 			break
 		}
 		switch frameType {
-		case 0x00: // PADDING
+		case 0x0:
 			continue
-		case 0x01: // PING
+		case 0x1:
 			continue
-		case 0x02, 0x03: // ACK
-			_, err = qtls.ReadUvarint(decryptedReader) // Largest Acknowledged
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // ACK Delay
-			if err != nil {
-				return nil, err
-			}
-			ackRangeCount, err := qtls.ReadUvarint(decryptedReader) // ACK Range Count
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // First ACK Range
-			if err != nil {
-				return nil, err
-			}
-			for i := 0; i < int(ackRangeCount); i++ {
-				_, err = qtls.ReadUvarint(decryptedReader) // Gap
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ACK Range Length
-				if err != nil {
-					return nil, err
-				}
-			}
-			if frameType == 0x03 {
-				_, err = qtls.ReadUvarint(decryptedReader) // ECT0 Count
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ECT1 Count
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ECN-CE Count
-				if err != nil {
-					return nil, err
-				}
-			}
-		case 0x06: // CRYPTO
+		case 0x6:
 			var offset uint64
 			offset, err = qtls.ReadUvarint(decryptedReader)
 			if err != nil {
@@ -249,26 +208,8 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 			if err != nil {
 				return nil, err
 			}
-		case 0x1c: // CONNECTION_CLOSE
-			_, err = qtls.ReadUvarint(decryptedReader) // Error Code
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // Frame Type
-			if err != nil {
-				return nil, err
-			}
-			var length uint64
-			length, err = qtls.ReadUvarint(decryptedReader) // Reason Phrase Length
-			if err != nil {
-				return nil, err
-			}
-			_, err = decryptedReader.Seek(int64(length), io.SeekCurrent) // Reason Phrase
-			if err != nil {
-				return nil, err
-			}
 		default:
-			return nil, os.ErrInvalid
+			// ignore unknown frame type
 		}
 	}
 	tlsHdr := make([]byte, 5)

common/srs/binary.go

@@ -1,485 +0,0 @@
-package srs
-
-import (
-	"compress/zlib"
-	"encoding/binary"
-	"io"
-	"net/netip"
-
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/domain"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/rw"
-
-	"go4.org/netipx"
-)
-
-var MagicBytes = [3]byte{0x53, 0x52, 0x53} // SRS
-
-const (
-	ruleItemQueryType uint8 = iota
-	ruleItemNetwork
-	ruleItemDomain
-	ruleItemDomainKeyword
-	ruleItemDomainRegex
-	ruleItemSourceIPCIDR
-	ruleItemIPCIDR
-	ruleItemSourcePort
-	ruleItemSourcePortRange
-	ruleItemPort
-	ruleItemPortRange
-	ruleItemProcessName
-	ruleItemProcessPath
-	ruleItemPackageName
-	ruleItemWIFISSID
-	ruleItemWIFIBSSID
-	ruleItemFinal uint8 = 0xFF
-)
-
-func Read(reader io.Reader, recovery bool) (ruleSet option.PlainRuleSet, err error) {
-	var magicBytes [3]byte
-	_, err = io.ReadFull(reader, magicBytes[:])
-	if err != nil {
-		return
-	}
-	if magicBytes != MagicBytes {
-		err = E.New("invalid sing-box rule set file")
-		return
-	}
-	var version uint8
-	err = binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return ruleSet, err
-	}
-	if version != 1 {
-		return ruleSet, E.New("unsupported version: ", version)
-	}
-	zReader, err := zlib.NewReader(reader)
-	if err != nil {
-		return
-	}
-	length, err := rw.ReadUVariant(zReader)
-	if err != nil {
-		return
-	}
-	ruleSet.Rules = make([]option.HeadlessRule, length)
-	for i := uint64(0); i < length; i++ {
-		ruleSet.Rules[i], err = readRule(zReader, recovery)
-		if err != nil {
-			err = E.Cause(err, "read rule[", i, "]")
-			return
-		}
-	}
-	return
-}
-
-func Write(writer io.Writer, ruleSet option.PlainRuleSet) error {
-	_, err := writer.Write(MagicBytes[:])
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	zWriter, err := zlib.NewWriterLevel(writer, zlib.BestCompression)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(zWriter, uint64(len(ruleSet.Rules)))
-	if err != nil {
-		return err
-	}
-	for _, rule := range ruleSet.Rules {
-		err = writeRule(zWriter, rule)
-		if err != nil {
-			return err
-		}
-	}
-	return zWriter.Close()
-}
-
-func readRule(reader io.Reader, recovery bool) (rule option.HeadlessRule, err error) {
-	var ruleType uint8
-	err = binary.Read(reader, binary.BigEndian, &ruleType)
-	if err != nil {
-		return
-	}
-	switch ruleType {
-	case 0:
-		rule.DefaultOptions, err = readDefaultRule(reader, recovery)
-	case 1:
-		rule.LogicalOptions, err = readLogicalRule(reader, recovery)
-	default:
-		err = E.New("unknown rule type: ", ruleType)
-	}
-	return
-}
-
-func writeRule(writer io.Writer, rule option.HeadlessRule) error {
-	switch rule.Type {
-	case C.RuleTypeDefault:
-		return writeDefaultRule(writer, rule.DefaultOptions)
-	case C.RuleTypeLogical:
-		return writeLogicalRule(writer, rule.LogicalOptions)
-	default:
-		panic("unknown rule type: " + rule.Type)
-	}
-}
-
-func readDefaultRule(reader io.Reader, recovery bool) (rule option.DefaultHeadlessRule, err error) {
-	var lastItemType uint8
-	for {
-		var itemType uint8
-		err = binary.Read(reader, binary.BigEndian, &itemType)
-		if err != nil {
-			return
-		}
-		switch itemType {
-		case ruleItemQueryType:
-			var rawQueryType []uint16
-			rawQueryType, err = readRuleItemUint16(reader)
-			if err != nil {
-				return
-			}
-			rule.QueryType = common.Map(rawQueryType, func(it uint16) option.DNSQueryType {
-				return option.DNSQueryType(it)
-			})
-		case ruleItemNetwork:
-			rule.Network, err = readRuleItemString(reader)
-		case ruleItemDomain:
-			var matcher *domain.Matcher
-			matcher, err = domain.ReadMatcher(reader)
-			if err != nil {
-				return
-			}
-			rule.DomainMatcher = matcher
-		case ruleItemDomainKeyword:
-			rule.DomainKeyword, err = readRuleItemString(reader)
-		case ruleItemDomainRegex:
-			rule.DomainRegex, err = readRuleItemString(reader)
-		case ruleItemSourceIPCIDR:
-			rule.SourceIPSet, err = readIPSet(reader)
-			if err != nil {
-				return
-			}
-			if recovery {
-				rule.SourceIPCIDR = common.Map(rule.SourceIPSet.Prefixes(), netip.Prefix.String)
-			}
-		case ruleItemIPCIDR:
-			rule.IPSet, err = readIPSet(reader)
-			if err != nil {
-				return
-			}
-			if recovery {
-				rule.IPCIDR = common.Map(rule.IPSet.Prefixes(), netip.Prefix.String)
-			}
-		case ruleItemSourcePort:
-			rule.SourcePort, err = readRuleItemUint16(reader)
-		case ruleItemSourcePortRange:
-			rule.SourcePortRange, err = readRuleItemString(reader)
-		case ruleItemPort:
-			rule.Port, err = readRuleItemUint16(reader)
-		case ruleItemPortRange:
-			rule.PortRange, err = readRuleItemString(reader)
-		case ruleItemProcessName:
-			rule.ProcessName, err = readRuleItemString(reader)
-		case ruleItemProcessPath:
-			rule.ProcessPath, err = readRuleItemString(reader)
-		case ruleItemPackageName:
-			rule.PackageName, err = readRuleItemString(reader)
-		case ruleItemWIFISSID:
-			rule.WIFISSID, err = readRuleItemString(reader)
-		case ruleItemWIFIBSSID:
-			rule.WIFIBSSID, err = readRuleItemString(reader)
-		case ruleItemFinal:
-			err = binary.Read(reader, binary.BigEndian, &rule.Invert)
-			return
-		default:
-			err = E.New("unknown rule item type: ", itemType, ", last type: ", lastItemType)
-		}
-		if err != nil {
-			return
-		}
-		lastItemType = itemType
-	}
-}
-
-func writeDefaultRule(writer io.Writer, rule option.DefaultHeadlessRule) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(0))
-	if err != nil {
-		return err
-	}
-	if len(rule.QueryType) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemQueryType, common.Map(rule.QueryType, func(it option.DNSQueryType) uint16 {
-			return uint16(it)
-		}))
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Network) > 0 {
-		err = writeRuleItemString(writer, ruleItemNetwork, rule.Network)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Domain) > 0 || len(rule.DomainSuffix) > 0 {
-		err = binary.Write(writer, binary.BigEndian, ruleItemDomain)
-		if err != nil {
-			return err
-		}
-		err = domain.NewMatcher(rule.Domain, rule.DomainSuffix).Write(writer)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.DomainKeyword) > 0 {
-		err = writeRuleItemString(writer, ruleItemDomainKeyword, rule.DomainKeyword)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.DomainRegex) > 0 {
-		err = writeRuleItemString(writer, ruleItemDomainRegex, rule.DomainRegex)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.SourceIPCIDR) > 0 {
-		err = writeRuleItemCIDR(writer, ruleItemSourceIPCIDR, rule.SourceIPCIDR)
-		if err != nil {
-			return E.Cause(err, "source_ipcidr")
-		}
-	}
-	if len(rule.IPCIDR) > 0 {
-		err = writeRuleItemCIDR(writer, ruleItemIPCIDR, rule.IPCIDR)
-		if err != nil {
-			return E.Cause(err, "ipcidr")
-		}
-	}
-	if len(rule.SourcePort) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemSourcePort, rule.SourcePort)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.SourcePortRange) > 0 {
-		err = writeRuleItemString(writer, ruleItemSourcePortRange, rule.SourcePortRange)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Port) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemPort, rule.Port)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.PortRange) > 0 {
-		err = writeRuleItemString(writer, ruleItemPortRange, rule.PortRange)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.ProcessName) > 0 {
-		err = writeRuleItemString(writer, ruleItemProcessName, rule.ProcessName)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.ProcessPath) > 0 {
-		err = writeRuleItemString(writer, ruleItemProcessPath, rule.ProcessPath)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.PackageName) > 0 {
-		err = writeRuleItemString(writer, ruleItemPackageName, rule.PackageName)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.WIFISSID) > 0 {
-		err = writeRuleItemString(writer, ruleItemWIFISSID, rule.WIFISSID)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.WIFIBSSID) > 0 {
-		err = writeRuleItemString(writer, ruleItemWIFIBSSID, rule.WIFIBSSID)
-		if err != nil {
-			return err
-		}
-	}
-	err = binary.Write(writer, binary.BigEndian, ruleItemFinal)
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, rule.Invert)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func readRuleItemString(reader io.Reader) ([]string, error) {
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return nil, err
-	}
-	value := make([]string, length)
-	for i := uint64(0); i < length; i++ {
-		value[i], err = rw.ReadVString(reader)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return value, nil
-}
-
-func writeRuleItemString(writer io.Writer, itemType uint8, value []string) error {
-	err := binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(value)))
-	if err != nil {
-		return err
-	}
-	for _, item := range value {
-		err = rw.WriteVString(writer, item)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func readRuleItemUint16(reader io.Reader) ([]uint16, error) {
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return nil, err
-	}
-	value := make([]uint16, length)
-	for i := uint64(0); i < length; i++ {
-		err = binary.Read(reader, binary.BigEndian, &value[i])
-		if err != nil {
-			return nil, err
-		}
-	}
-	return value, nil
-}
-
-func writeRuleItemUint16(writer io.Writer, itemType uint8, value []uint16) error {
-	err := binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(value)))
-	if err != nil {
-		return err
-	}
-	for _, item := range value {
-		err = binary.Write(writer, binary.BigEndian, item)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func writeRuleItemCIDR(writer io.Writer, itemType uint8, value []string) error {
-	var builder netipx.IPSetBuilder
-	for i, prefixString := range value {
-		prefix, err := netip.ParsePrefix(prefixString)
-		if err == nil {
-			builder.AddPrefix(prefix)
-			continue
-		}
-		addr, addrErr := netip.ParseAddr(prefixString)
-		if addrErr == nil {
-			builder.Add(addr)
-			continue
-		}
-		return E.Cause(err, "parse [", i, "]")
-	}
-	ipSet, err := builder.IPSet()
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	return writeIPSet(writer, ipSet)
-}
-
-func readLogicalRule(reader io.Reader, recovery bool) (logicalRule option.LogicalHeadlessRule, err error) {
-	var mode uint8
-	err = binary.Read(reader, binary.BigEndian, &mode)
-	if err != nil {
-		return
-	}
-	switch mode {
-	case 0:
-		logicalRule.Mode = C.LogicalTypeAnd
-	case 1:
-		logicalRule.Mode = C.LogicalTypeOr
-	default:
-		err = E.New("unknown logical mode: ", mode)
-		return
-	}
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return
-	}
-	logicalRule.Rules = make([]option.HeadlessRule, length)
-	for i := uint64(0); i < length; i++ {
-		logicalRule.Rules[i], err = readRule(reader, recovery)
-		if err != nil {
-			err = E.Cause(err, "read logical rule [", i, "]")
-			return
-		}
-	}
-	err = binary.Read(reader, binary.BigEndian, &logicalRule.Invert)
-	if err != nil {
-		return
-	}
-	return
-}
-
-func writeLogicalRule(writer io.Writer, logicalRule option.LogicalHeadlessRule) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	switch logicalRule.Mode {
-	case C.LogicalTypeAnd:
-		err = binary.Write(writer, binary.BigEndian, uint8(0))
-	case C.LogicalTypeOr:
-		err = binary.Write(writer, binary.BigEndian, uint8(1))
-	default:
-		panic("unknown logical mode: " + logicalRule.Mode)
-	}
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(logicalRule.Rules)))
-	if err != nil {
-		return err
-	}
-	for _, rule := range logicalRule.Rules {
-		err = writeRule(writer, rule)
-		if err != nil {
-			return err
-		}
-	}
-	err = binary.Write(writer, binary.BigEndian, logicalRule.Invert)
-	if err != nil {
-		return err
-	}
-	return nil
-}

common/srs/ip_set.go

@@ -1,116 +0,0 @@
-package srs
-
-import (
-	"encoding/binary"
-	"io"
-	"net/netip"
-	"unsafe"
-
-	"github.com/sagernet/sing/common/rw"
-
-	"go4.org/netipx"
-)
-
-type myIPSet struct {
-	rr []myIPRange
-}
-
-type myIPRange struct {
-	from netip.Addr
-	to   netip.Addr
-}
-
-func readIPSet(reader io.Reader) (*netipx.IPSet, error) {
-	var version uint8
-	err := binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return nil, err
-	}
-	var length uint64
-	err = binary.Read(reader, binary.BigEndian, &length)
-	if err != nil {
-		return nil, err
-	}
-	mySet := &myIPSet{
-		rr: make([]myIPRange, length),
-	}
-	for i := uint64(0); i < length; i++ {
-		var (
-			fromLen  uint64
-			toLen    uint64
-			fromAddr netip.Addr
-			toAddr   netip.Addr
-		)
-		fromLen, err = rw.ReadUVariant(reader)
-		if err != nil {
-			return nil, err
-		}
-		fromBytes := make([]byte, fromLen)
-		_, err = io.ReadFull(reader, fromBytes)
-		if err != nil {
-			return nil, err
-		}
-		err = fromAddr.UnmarshalBinary(fromBytes)
-		if err != nil {
-			return nil, err
-		}
-		toLen, err = rw.ReadUVariant(reader)
-		if err != nil {
-			return nil, err
-		}
-		toBytes := make([]byte, toLen)
-		_, err = io.ReadFull(reader, toBytes)
-		if err != nil {
-			return nil, err
-		}
-		err = toAddr.UnmarshalBinary(toBytes)
-		if err != nil {
-			return nil, err
-		}
-		mySet.rr[i] = myIPRange{fromAddr, toAddr}
-	}
-	return (*netipx.IPSet)(unsafe.Pointer(mySet)), nil
-}
-
-func writeIPSet(writer io.Writer, set *netipx.IPSet) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	mySet := (*myIPSet)(unsafe.Pointer(set))
-	err = binary.Write(writer, binary.BigEndian, uint64(len(mySet.rr)))
-	if err != nil {
-		return err
-	}
-	for _, rr := range mySet.rr {
-		var (
-			fromBinary []byte
-			toBinary   []byte
-		)
-		fromBinary, err = rr.from.MarshalBinary()
-		if err != nil {
-			return err
-		}
-		err = rw.WriteUVariant(writer, uint64(len(fromBinary)))
-		if err != nil {
-			return err
-		}
-		_, err = writer.Write(fromBinary)
-		if err != nil {
-			return err
-		}
-		toBinary, err = rr.to.MarshalBinary()
-		if err != nil {
-			return err
-		}
-		err = rw.WriteUVariant(writer, uint64(len(toBinary)))
-		if err != nil {
-			return err
-		}
-		_, err = writer.Write(toBinary)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}

constant/rule.go

@@ -9,11 +9,3 @@ const (
 	LogicalTypeAnd = "and"
 	LogicalTypeOr  = "or"
 )
-
-const (
-	RuleSetTypeLocal    = "local"
-	RuleSetTypeRemote   = "remote"
-	RuleSetVersion1     = 1
-	RuleSetFormatSource = "source"
-	RuleSetFormatBinary = "binary"
-)

docs/changelog.md

@@ -1,134 +1,3 @@
----
-icon: material/alert-decagram
----
-
-# ChangeLog
-
-#### 1.8.0-alpha.1
-
-* Migrate cache file from Clash API to independent options **1**
-* Introducing [Rule Set](/configuration/rule-set) **2**
-* Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands **3**
-* Allow nested logical rules **4**
-
-**1**:
-
-See [Cache File](/configuration/experimental/cache-file) and
-[Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).
-
-**2**:
-
-Rule set is independent collections of rules that can be compiled into binaries to improve performance.
-Compared to legacy GeoIP and Geosite resources,
-it can include more types of rules, load faster,
-use less memory, and update automatically.
-
-See [Route#rule_set](/configuration/route/#rule_set),
-[Route Rule](/configuration/route/rule),
-[DNS Rule](/configuration/dns/rule),
-[Rule Set](/configuration/rule-set),
-[Source Format](/configuration/rule-set/source-format) and
-[Headless Rule](/configuration/rule-set/headless-rule).
-
-For GEO resources migration, see [Migrate GeoIP to rule sets](/migration/#migrate-geoip-to-rule-sets) and
-[Migrate Geosite to rule sets](/migration/#migrate-geosite-to-rule-sets).
-
-**3**:
-
-New commands manage GeoIP, Geosite and rule set resources, and help you migrate GEO resources to rule sets.
-
-**4**:
-
-Logical rules in route rules, DNS rules, and the new headless rule now allow nesting of logical rules.
-
-#### 1.7.0
-
-* Fixes and improvements
-
-Important changes since 1.6:
-
-* Add [exclude route support](/configuration/inbound/tun) for TUN inbound
-* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen) **1**
-* Add [HTTPUpgrade V2Ray transport](/configuration/shared/v2ray-transport#HTTPUpgrade) support **2**
-* Migrate multiplex and UoT server to inbound **3**
-* Add TCP Brutal support for multiplex **4**
-* Add `wifi_ssid` and `wifi_bssid` route and DNS rules **5**
-* Update quic-go to v0.40.0
-* Update gVisor to 20231113.0
-
-**1**:
-
-If enabled, for UDP proxy requests addressed to a domain,
-the original packet address will be sent in the response instead of the mapped domain.
-
-This option is used for compatibility with clients that
-do not support receiving UDP packets with domain addresses, such as Surge.
-
-**2**:
-
-Introduced in V2Ray 5.10.0.
-
-The new HTTPUpgrade transport has better performance than WebSocket and is better suited for CDN abuse.
-
-**3**:
-
-Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound options.
-
-**4**
-
-Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server, see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
-
-**5**:
-
-Only supported in graphical clients on Android and iOS.
-
-#### 1.7.0-rc.3
-
-* Fixes and improvements
-
-#### 1.6.7
-
-* macOS: Add button for uninstall SystemExtension in the standalone graphical client
-* Fix missing UDP user context on TUIC/Hysteria2 inbounds
-* Fixes and improvements
-
-#### 1.7.0-rc.2
-
-* Fix missing UDP user context on TUIC/Hysteria2 inbounds
-* macOS: Add button for uninstall SystemExtension in the standalone graphical client
-
-#### 1.6.6
-
-* Fixes and improvements
-
-#### 1.7.0-rc.1
-
-* Fixes and improvements
-
-#### 1.7.0-beta.5
-
-* Update gVisor to 20231113.0
-* Fixes and improvements
-
-#### 1.7.0-beta.4
-
-* Add `wifi_ssid` and `wifi_bssid` route and DNS rules **1**
-* Fixes and improvements
-
-**1**:
-
-Only supported in graphical clients on Android and iOS.
-
-#### 1.7.0-beta.3
-
-* Fix zero TTL was incorrectly reset
-* Fixes and improvements
-
-#### 1.6.5
-
-* Fix crash if TUIC inbound authentication failed
-* Fixes and improvements
-
 #### 1.7.0-beta.2
 
 * Fix crash if TUIC inbound authentication failed
@@ -179,13 +48,11 @@ Only supported in graphical clients on Android and iOS.
 
 **1**:
 
-Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound
-options.
+Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound options.
 
 **2**
 
-Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
-see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
+Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server, see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
 
 #### 1.7.0-alpha.3
 
@@ -252,8 +119,8 @@ When `auto_route` is enabled and `strict_route` is disabled, the device can now
 
 **2**:
 
-Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
-Sierra, 10.14 Mojave.
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High Sierra, 10.14 Mojave.
+
 
 #### 1.6.0-rc.4
 
@@ -266,8 +133,7 @@ Sierra, 10.14 Mojave.
 
 **1**:
 
-Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
-Sierra, 10.14 Mojave.
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High Sierra, 10.14 Mojave.
 
 #### 1.6.0-beta.4
 

docs/clients/android/features.md

@@ -1,64 +0,0 @@
-# :material-decagram: Features
-
-#### UI options
-
-* Display realtime network speed in the notification
-
-#### Service
-
-SFA allows you to run sing-box through ForegroundService or VpnService (when TUN is required).
-
-#### TUN
-
-SFA provides an unprivileged TUN implementation through Android VpnService.
-
-| TUN inbound option            | Available        | Note               |
-|-------------------------------|------------------|--------------------|
-| `interface_name`              | :material-close: | Managed by Android |
-| `inet4_address`               | :material-check: | /                  |
-| `inet6_address`               | :material-check: | /                  |
-| `mtu`                         | :material-check: | /                  |
-| `auto_route`                  | :material-check: | /                  |
-| `strict_route`                | :material-close: | Not implemented    |
-| `inet4_route_address`         | :material-check: | /                  |
-| `inet6_route_address`         | :material-check: | /                  |
-| `inet4_route_exclude_address` | :material-check: | /                  |
-| `inet6_route_exclude_address` | :material-check: | /                  |
-| `endpoint_independent_nat`    | :material-check: | /                  |
-| `stack`                       | :material-check: | /                  |
-| `include_interface`           | :material-close: | No permission      |
-| `exclude_interface`           | :material-close: | No permission      |
-| `include_uid`                 | :material-close: | No permission      |
-| `exclude_uid`                 | :material-close: | No permission      |
-| `include_android_user`        | :material-close: | No permission      |
-| `include_package`             | :material-check: | /                  |
-| `exclude_package`             | :material-check: | /                  |
-| `platform`                    | :material-check: | /                  |
-
-| Route/DNS rule option | Available        | Note                              |
-|-----------------------|------------------|-----------------------------------|
-| `process_name`        | :material-close: | No permission                     |
-| `process_path`        | :material-close: | No permission                     |
-| `package_name`        | :material-check: | /                                 |
-| `user`                | :material-close: | Use `package_name` instead        |
-| `user_id`             | :material-close: | Use `package_name` instead        |
-| `wifi_ssid`           | :material-check: | Fine location permission required |
-| `wifi_bssid`          | :material-check: | Fine location permission required |
-
-### Override
-
-Overrides profile configuration items with platform-specific values.
-
-#### Per-app proxy
-
-SFA allows you to select a list of Android apps that require proxying or bypassing in the graphical interface to
-override the `include_package` and `exclude_package` configuration items.
-
-In particular, the selector also provides the “China apps” scanning feature, providing Chinese users with an excellent
-experience to bypass apps that do not require a proxy. Specifically, by scanning China application or SDK
-characteristics through dex class path and other means, there will be almost no missed reports.
-
-### Chore
-
-* The working directory is located at `/sdcard/Android/data/io.nekohasekai.sfa/files` (External files directory)
-* Crash logs is located in `$working_directory/stderr.log`

docs/clients/android/index.md

@@ -1,22 +0,0 @@
----
-icon: material/android
----
-
-# sing-box for Android
-
-SFA allows users to manage and run local or remote sing-box configuration files, and provides
-platform-specific function implementation, such as TUN transparent proxy implementation.
-
-## :material-graph: Requirements
-
-* Android 5.0+
-
-## :material-download: Download
-
-* [Play Store](https://play.google.com/store/apps/details?id=io.nekohasekai.sfa)
-* [Play Store (Beta)](https://play.google.com/apps/testing/io.nekohasekai.sfa)
-* [GitHub Releases](https://github.com/SagerNet/sing-box/releases)
-
-## :material-source-repository: Source code
-
-* [GitHub](https://github.com/SagerNet/sing-box-for-android)

docs/clients/apple/features.md

@@ -1,52 +0,0 @@
-# :material-decagram: Features
-
-#### UI options
-
-* Always On
-* Include All Networks (Proxy traffic for LAN and cellular services)
-* (Apple tvOS) Import profile from iPhone/iPad
-
-#### Service
-
-SFI/SFM/SFT allows you to run sing-box through NetworkExtension with Application Extension or System Extension.
-
-#### TUN
-
-SFI/SFM/SFT provides an unprivileged TUN implementation through NetworkExtension.
-
-| TUN inbound option            | Available | Note              |
-|-------------------------------|-----------|-------------------|
-| `interface_name`              | ✖️        | Managed by Darwin |
-| `inet4_address`               | ✔️        | /                 |
-| `inet6_address`               | ✔️        | /                 |
-| `mtu`                         | ✔️        | /                 |
-| `auto_route`                  | ✔️        | /                 |
-| `strict_route`                | ✖️        | Not implemented   |
-| `inet4_route_address`         | ✔️        | /                 |
-| `inet6_route_address`         | ✔️        | /                 |
-| `inet4_route_exclude_address` | ✔️        | /                 |
-| `inet6_route_exclude_address` | ✔️        | /                 |
-| `endpoint_independent_nat`    | ✔️        | /                 |
-| `stack`                       | ✔️        | /                 |
-| `include_interface`           | ✖️        | Not implemented   |
-| `exclude_interface`           | ✖️        | Not implemented   |
-| `include_uid`                 | ✖️        | Not implemented   |
-| `exclude_uid`                 | ✖️        | Not implemented   |
-| `include_android_user`        | ✖️        | Not implemented   |
-| `include_package`             | ✖️        | Not implemented   |
-| `exclude_package`             | ✖️        | Not implemented   |
-| `platform`                    | ✔️        | /                 |
-
-| Route/DNS rule option | Available        | Note                  |
-|-----------------------|------------------|-----------------------|
-| `process_name`        | :material-close: | No permission         |
-| `process_path`        | :material-close: | No permission         |
-| `package_name`        | :material-close: | /                     |
-| `user`                | :material-close: | No permission         |
-| `user_id`             | :material-close: | No permission         |
-| `wifi_ssid`           | :material-alert: | Only supported on iOS |
-| `wifi_bssid`          | :material-alert: | Only supported on iOS |
-
-### Chore
-
-* Crash logs is located in `Settings` -> `View Service Log`

docs/clients/apple/index.md

@@ -1,32 +0,0 @@
----
-icon: material/apple
----
-
-# sing-box for Apple platforms
-
-SFI/SFM/SFT allows users to manage and run local or remote sing-box configuration files, and provides
-platform-specific function implementation, such as TUN transparent proxy implementation.
-
-## :material-graph: Requirements
-
-* iOS 15.0+ / macOS 13.0+ / Apple tvOS 17.0+
-* An Apple account outside of mainland China
-
-## :material-download: Download
-
-* [App Store](https://apps.apple.com/us/app/sing-box/id6451272673)
-* [TestFlight (Beta)](https://testflight.apple.com/join/AcqO44FH)
-
-## :material-file-download: Download (macOS standalone version)
-
-* [Homebrew Cask](https://formulae.brew.sh/cask/sfm)
-
-```bash
-brew install sfm
-```
-
-* [GitHub Releases](https://github.com/SagerNet/sing-box/releases)
-
-## :material-source-repository: Source code
-
-* [GitHub](https://github.com/SagerNet/sing-box-for-apple)

docs/clients/general.md

@@ -1,63 +0,0 @@
----
-icon: material/pencil-ruler
----
-
-# General
-
-Describes and explains the functions implemented uniformly by sing-box graphical clients.
-
-### Profile
-
-Profile describes a sing-box configuration file and its state.
-
-#### Local
-
-* Local Profile represents a local sing-box configuration with minimal state
-* The graphical client must provide an editor to modify configuration content
-
-#### iCloud (on iOS and macOS)
-
-* iCloud Profile represents a remote sing-box configuration with iCloud as the update source
-* The configuration file is stored in the sing-box folder under iCloud
-* The graphical client must provide an editor to modify configuration content
-
-#### Remote
-
-* Remote Profile represents a remote sing-box configuration with a URL as the update source.
-* The graphical client should provide a configuration content viewer
-* The graphical client must implement automatic profile update (default interval is 60 minutes) and HTTP Basic
-  authorization.
-
-At the same time, the graphical client must provide support for importing remote profiles
-through a specific URL Scheme. The URL is defined as follows:
-
-```
-sing-box://import-remote-profile?url=urlEncodedURL#urlEncodedName
-```
-
-### Dashboard
-
-While the sing-box service is running, the graphical client should provide a Dashboard interface to manage the service.
-
-#### Status
-
-Dashboard should display status information such as memory, connection, and traffic.
-
-#### Mode
-
-Dashboard should provide a Mode selector for switching when the configuration uses at least two `clash_mode` values.
-
-#### Groups
-
-When the configuration includes group outbounds (specifically, Selector or URLTest),
-the dashboard should provide a Group selector for status display or switching.
-
-### Chore
-
-#### Core
-
-Graphical clients should provide a Core region:
-
-* Display the current sing-box version
-* Provides a button to clean the working directory
-* Provides a memory limiter switch

docs/clients/index.md

@@ -1,13 +0,0 @@
-# :material-cellphone-link: Graphical Clients
-
-Maintained by Project S to provide a unified experience and platform-specific functionality.
-
-| Platform                              | Client                                  |
-|---------------------------------------|-----------------------------------------|
-| :material-android: Android            | [sing-box for Android](./android)       |
-| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
-| :material-laptop: Desktop             | Working in progress                     |
-
-Some third-party projects that claim to use sing-box or use sing-box as a selling point are not listed here. The core
-motivation of the maintainers of such projects is to acquire more users, and even though they provide friendly VPN
-client features, the code is usually of poor quality and contains ads.

docs/clients/index.zh.md

@@ -1,12 +0,0 @@
-# :material-cellphone-link: 图形界面客户端
-
-由 Project S 维护，提供统一的体验与平台特定的功能。
-
-| 平台                                    | 客户端                                     |
-|---------------------------------------|-----------------------------------------|
-| :material-android: Android            | [sing-box for Android](./android)       |
-| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
-| :material-laptop: Desktop             | 施工中                                     |
-
-此处没有列出一些声称使用或以 sing-box 为卖点的第三方项目。此类项目维护者的动机是获得更多用户，即使它们提供友好的商业
-VPN 客户端功能， 但代码质量很差且包含广告。

docs/clients/privacy.md

@@ -1,8 +0,0 @@
----
-icon: material/security
----
-
-# Privacy policy
-
-sing-box and official graphics clients do not collect or share personal data,
-and the data generated by the software is always on your device.

docs/configuration/dns/rule.md

@@ -1,13 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -89,16 +79,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": [
           "direct"
@@ -180,23 +160,15 @@ Match domain using regular expression.
 
 #### geosite
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 Match geosite.
 
 #### source_geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match source geoip.
 
 #### source_ip_cidr
 
-Match source IP CIDR.
+Match source ip cidr.
 
 #### source_port
 
@@ -216,7 +188,7 @@ Match port range.
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -224,7 +196,7 @@ Match process name.
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -236,7 +208,7 @@ Match android package name.
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -244,7 +216,7 @@ Match user name.
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -254,30 +226,6 @@ Match user id.
 
 Match Clash mode.
 
-#### wifi_ssid
-
-<!-- md:version 1.7.0-beta.4 -->
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-Match [Rule Set](/configuration/route/#rule_set).
-
 #### invert
 
 Invert match result.
@@ -314,4 +262,4 @@ Rewrite TTL in DNS responses.
 
 #### rules
 
-Included rules.
+Included default rules.

docs/configuration/dns/rule.zh.md

@@ -1,13 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -88,16 +78,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": [
           "direct"
@@ -177,18 +157,10 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### geosite
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
-
-匹配 Geosite。
+匹配 GeoSite。
 
 #### source_geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配源 GeoIP。
 
 #### source_ip_cidr
@@ -213,7 +185,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -221,7 +193,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -233,7 +205,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 
@@ -241,7 +213,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 
@@ -251,28 +223,6 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 匹配 Clash 模式。
 
-#### wifi_ssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi SSID。
-
-#### wifi_bssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi BSSID。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配[规则集](/zh/configuration/route/#rule_set)。
-
 #### invert
 
 反选匹配结果。
@@ -309,4 +259,4 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### rules
 
-包括的规则。
+包括的默认规则。

docs/configuration/dns/server.md

@@ -49,7 +49,7 @@ The address of the dns server.
 
 !!! warning ""
 
-    QUIC and HTTP3 transport is not included by default, see [Installation](./#installation).
+    QUIC and HTTP3 transport is not included by default, see [Installation](/#installation).
 
 !!! info ""
 
@@ -57,7 +57,7 @@ The address of the dns server.
 
 !!! warning ""
 
-    DHCP transport is not included by default, see [Installation](./#installation).
+    DHCP transport is not included by default, see [Installation](/#installation).
 
 | RCode             | Description           | 
 |-------------------|-----------------------|

docs/configuration/experimental/cache-file.md

@@ -1,34 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "enabled": true,
-  "path": "",
-  "cache_id": "",
-  "store_fakeip": false
-}
-```
-
-### Fields
-
-#### enabled
-
-Enable cache file.
-
-#### path
-
-Path to the cache file.
-
-`cache.db` will be used if empty.
-
-#### cache_id
-
-Identifier in cache file.
-
-If not empty, configuration specified data will use a separate store keyed by it.

docs/configuration/experimental/clash-api.md

@@ -1,121 +0,0 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-delete-alert: [store_mode](#store_mode)  
-    :material-delete-alert: [store_selected](#store_selected)  
-    :material-delete-alert: [store_fakeip](#store_fakeip)  
-    :material-delete-alert: [cache_file](#cache_file)  
-    :material-delete-alert: [cache_id](#cache_id)
-
-
-!!! quote ""
-
-    Clash API is not included by default, see [Installation](./#installation).
-
-### Structure
-
-```json
-{
-  "external_controller": "127.0.0.1:9090",
-  "external_ui": "",
-  "external_ui_download_url": "",
-  "external_ui_download_detour": "",
-  "secret": "",
-  "default_mode": "",
-  
-  // Deprecated
-  
-  "store_mode": false,
-  "store_selected": false,
-  "store_fakeip": false,
-  "cache_file": "",
-  "cache_id": ""
-}
-```
-
-### Fields
-
-#### external_controller
-
-RESTful web API listening address. Clash API will be disabled if empty.
-
-#### external_ui
-
-A relative path to the configuration directory or an absolute path to a
-directory in which you put some static web resource. sing-box will then
-serve it at `http://{{external-controller}}/ui`.
-
-
-
-#### external_ui_download_url
-
-ZIP download URL for the external UI, will be used if the specified `external_ui` directory is empty.
-
-`https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip` will be used if empty.
-
-#### external_ui_download_detour
-
-The tag of the outbound to download the external UI.
-
-Default outbound will be used if empty.
-
-#### secret
-
-Secret for the RESTful API (optional)
-Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
-ALWAYS set a secret if RESTful API is listening on 0.0.0.0
-
-#### default_mode
-
-Default mode in clash, `Rule` will be used if empty.
-
-This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
-
-#### store_mode
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_mode` is deprecated in Clash API and enabled by default if `cache_file.enabled`.
-
-Store Clash mode in cache file.
-
-#### store_selected
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_selected` is deprecated in Clash API and enabled by default if `cache_file.enabled`.
-
-!!! note ""
-
-    The tag must be set for target outbounds.
-
-Store selected outbound for the `Selector` outbound in cache file.
-
-#### store_fakeip
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_selected` is deprecated in Clash API and migrated to `cache_file.store_fakeip`.
-
-Store fakeip in cache file.
-
-#### cache_file
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `cache_file` is deprecated in Clash API and migrated to `cache_file.enabled` and `cache_file.path`.
-
-Cache file path, `cache.db` will be used if empty.
-
-#### cache_id
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `cache_id` is deprecated in Clash API and migrated to `cache_file.cache_id`.
-
-Identifier in cache file.
-
-If not empty, configuration specified data will use a separate store keyed by it.

docs/configuration/experimental/index.md

@@ -1,30 +1,139 @@
----
-icon: material/alert-decagram
----
-
 # Experimental
 
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [cache_file](#cache_file)  
-    :material-alert-decagram: [clash_api](#clash_api)
-
 ### Structure
 
 ```json
 {
   "experimental": {
-    "cache_file": {},
-    "clash_api": {},
-    "v2ray_api": {}
+    "clash_api": {
+      "external_controller": "127.0.0.1:9090",
+      "external_ui": "",
+      "external_ui_download_url": "",
+      "external_ui_download_detour": "",
+      "secret": "",
+      "default_mode": "",
+      "store_mode": false,
+      "store_selected": false,
+      "store_fakeip": false,
+      "cache_file": "",
+      "cache_id": ""
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ],
+        "users": [
+          "sekai"
+        ]
+      }
+    }
   }
 }
 ```
 
-### Fields
+!!! note ""
 
-| Key          | Format                     |
-|--------------|----------------------------|
-| `cache_file` | [Cache File](./cache-file) |
-| `clash_api`  | [Clash API](./clash-api)   |
-| `v2ray_api`  | [V2Ray API](./v2ray-api)   |
+    Traffic statistics and connection management can degrade performance.
+
+### Clash API Fields
+
+!!! error ""
+
+    Clash API is not included by default, see [Installation](/#installation).
+
+#### external_controller
+
+RESTful web API listening address. Clash API will be disabled if empty.
+
+#### external_ui
+
+A relative path to the configuration directory or an absolute path to a
+directory in which you put some static web resource. sing-box will then
+serve it at `http://{{external-controller}}/ui`.
+
+#### external_ui_download_url
+
+ZIP download URL for the external UI, will be used if the specified `external_ui` directory is empty.
+
+`https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip` will be used if empty.
+
+#### external_ui_download_detour
+
+The tag of the outbound to download the external UI.
+
+Default outbound will be used if empty.
+
+#### secret
+
+Secret for the RESTful API (optional)
+Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
+ALWAYS set a secret if RESTful API is listening on 0.0.0.0
+
+#### default_mode
+
+Default mode in clash, `Rule` will be used if empty.
+
+This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
+
+#### store_mode
+
+Store Clash mode in cache file.
+
+#### store_selected
+
+!!! note ""
+
+    The tag must be set for target outbounds.
+
+Store selected outbound for the `Selector` outbound in cache file.
+
+#### store_fakeip
+
+Store fakeip in cache file.
+
+#### cache_file
+
+Cache file path, `cache.db` will be used if empty.
+
+#### cache_id
+
+Cache ID.
+
+If not empty, `store_selected` will use a separate store keyed by it.
+
+### V2Ray API Fields
+
+!!! error ""
+
+    V2Ray API is not included by default, see [Installation](/#installation).
+
+#### listen
+
+gRPC API listening address. V2Ray API will be disabled if empty.
+
+#### stats
+
+Traffic statistics service settings.
+
+#### stats.enabled
+
+Enable statistics service.
+
+#### stats.inbounds
+
+Inbound list to count traffic.
+
+#### stats.outbounds
+
+Outbound list to count traffic.
+
+#### stats.users
+
+User list to count traffic.

docs/configuration/experimental/index.zh.md

@@ -0,0 +1,137 @@
+# 实验性
+
+### 结构
+
+```json
+{
+  "experimental": {
+    "clash_api": {
+      "external_controller": "127.0.0.1:9090",
+      "external_ui": "",
+      "external_ui_download_url": "",
+      "external_ui_download_detour": "",
+      "secret": "",
+      "default_mode": "",
+      "store_mode": false,
+      "store_selected": false,
+      "store_fakeip": false,
+      "cache_file": "",
+      "cache_id": ""
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ],
+        "users": [
+          "sekai"
+        ]
+      }
+    }
+  }
+}
+```
+
+!!! note ""
+
+    流量统计和连接管理会降低性能。
+
+### Clash API 字段
+
+!!! error ""
+
+    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
+
+#### external_controller
+
+RESTful web API 监听地址。如果为空，则禁用 Clash API。
+
+#### external_ui
+
+到静态网页资源目录的相对路径或绝对路径。sing-box 会在 `http://{{external-controller}}/ui` 下提供它。
+
+#### external_ui_download_url
+
+静态网页资源的 ZIP 下载 URL，如果指定的 `external_ui` 目录为空，将使用。
+
+默认使用 `https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip`。
+
+#### external_ui_download_detour
+
+用于下载静态网页资源的出站的标签。
+
+如果为空，将使用默认出站。
+
+#### secret
+
+RESTful API 的密钥（可选）
+通过指定 HTTP 标头 `Authorization: Bearer ${secret}` 进行身份验证
+如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
+
+#### default_mode
+
+Clash 中的默认模式，默认使用 `Rule`。
+
+此设置没有直接影响，但可以通过 `clash_mode` 规则项在路由和 DNS 规则中使用。
+
+#### store_mode
+
+将 Clash 模式存储在缓存文件中。
+
+#### store_selected
+
+!!! note ""
+
+    必须为目标出站设置标签。
+
+将 `Selector` 中出站的选定的目标出站存储在缓存文件中。
+
+#### store_fakeip
+
+将 fakeip 存储在缓存文件中。
+
+#### cache_file
+
+缓存文件路径，默认使用`cache.db`。
+
+#### cache_id
+
+缓存 ID。
+
+如果不为空，`store_selected` 将会使用以此为键的独立存储。
+
+### V2Ray API 字段
+
+!!! error ""
+
+    默认安装不包含 V2Ray API，参阅 [安装](/zh/#_2)。
+
+#### listen
+
+gRPC API 监听地址。如果为空，则禁用 V2Ray API。
+
+#### stats
+
+流量统计服务设置。
+
+#### stats.enabled
+
+启用统计服务。
+
+#### stats.inbounds
+
+统计流量的入站列表。
+
+#### stats.outbounds
+
+统计流量的出站列表。
+
+#### stats.users
+
+统计流量的用户列表。

docs/configuration/experimental/v2ray-api.md

@@ -1,50 +0,0 @@
-### Structure
-
-!!! quote ""
-
-    V2Ray API is not included by default, see [Installation](./#installation).
-
-```json
-{
-  "listen": "127.0.0.1:8080",
-  "stats": {
-    "enabled": true,
-    "inbounds": [
-      "socks-in"
-    ],
-    "outbounds": [
-      "proxy",
-      "direct"
-    ],
-    "users": [
-      "sekai"
-    ]
-  }
-}
-```
-
-### Fields
-
-#### listen
-
-gRPC API listening address. V2Ray API will be disabled if empty.
-
-#### stats
-
-Traffic statistics service settings.
-
-#### stats.enabled
-
-Enable statistics service.
-
-#### stats.inbounds
-
-Inbound list to count traffic.
-
-#### stats.outbounds
-
-Outbound list to count traffic.
-
-#### stats.users
-
-User list to count traffic.

docs/configuration/inbound/http.md

@@ -36,7 +36,7 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.
 

docs/configuration/inbound/http.zh.md

@@ -36,7 +36,7 @@ HTTP 用户
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Android、Windows 和 macOS。
 

docs/configuration/inbound/hysteria.md

@@ -31,7 +31,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by hysteria is not included by default, see [Installation](./#installation).
+    QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
 ### Listen Fields
 

docs/configuration/inbound/hysteria2.md

@@ -4,8 +4,8 @@
 {
   "type": "hysteria2",
   "tag": "hy2-in",
-  ...
-  // Listen Fields
+  
+  ... // Listen Fields
 
   "up_mbps": 100,
   "down_mbps": 100,
@@ -28,14 +28,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by Hysteria2 is not included by default, see [Installation](./#installation).
-
-!!! warning "Difference from official Hysteria2"
-
-    The official program supports an authentication method called **userpass**,
-    which essentially uses a combination of `<username>:<password>` as the actual password,
-    while sing-box does not provide this alias.
-    To use sing-box with the official program, you need to fill in that combination as the actual password.
+    QUIC, which is required by Hysteria2 is not included by default, see [Installation](/#installation).
 
 ### Listen Fields
 

docs/configuration/inbound/hysteria2.zh.md

@@ -4,8 +4,8 @@
 {
   "type": "hysteria2",
   "tag": "hy2-in",
-  ...
-  // 监听字段
+  
+  ... // 监听字段
 
   "up_mbps": 100,
   "down_mbps": 100,
@@ -30,12 +30,6 @@
 
     默认安装不包含被 Hysteria2 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-!!! warning "与官方 Hysteria2 的区别"
-
-    官方程序支持一种名为 **userpass** 的验证方式，
-    本质上上是将用户名与密码的组合 `<username>:<password>` 作为实际上的密码，而 sing-box 不提供此别名。
-    要将 sing-box 与官方程序一起使用， 您需要填写该组合作为实际密码。
-
 ### 监听字段
 
 参阅 [监听字段](/zh/configuration/shared/listen/)。

docs/configuration/inbound/mixed.md

@@ -33,7 +33,7 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.
 

docs/configuration/inbound/mixed.zh.md

@@ -33,7 +33,7 @@ SOCKS 和 HTTP 用户
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Android、Windows 和 macOS。
 

docs/configuration/inbound/naive.md

@@ -20,7 +20,7 @@
 
 !!! warning ""
 
-    HTTP3 transport is not included by default, see [Installation](./#installation).
+    HTTP3 transport is not included by default, see [Installation](/#installation).
 
 ### Listen Fields
 

docs/configuration/inbound/redirect.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux and macOS.
 

docs/configuration/inbound/redirect.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux 和 macOS。
 

docs/configuration/inbound/tproxy.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/inbound/tproxy.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 

docs/configuration/inbound/trojan.md

@@ -47,7 +47,7 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
 #### fallback
 
-!!! quote ""
+!!! error ""
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 

docs/configuration/inbound/trojan.zh.md

@@ -49,7 +49,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 #### fallback
 
-!!! quote ""
+!!! error ""
 
     没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 

docs/configuration/inbound/tuic.md

@@ -24,7 +24,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by TUIC is not included by default, see [Installation](./#installation).
+    QUIC, which is required by TUIC is not included by default, see [Installation](/#installation).
 
 ### Listen Fields
 

docs/configuration/inbound/tun.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -102,7 +102,7 @@ The maximum transmission unit.
 
 Set the default route to the Tun.
 
-!!! quote ""
+!!! error ""
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
@@ -171,11 +171,11 @@ TCP/IP stack.
 
 !!! warning ""
 
-    gVisor and LWIP stacks is not included by default, see [Installation](./#installation).
+    gVisor and LWIP stacks is not included by default, see [Installation](/#installation).
 
 #### include_interface
 
-!!! quote ""
+!!! error ""
 
     Interface rules are only supported on Linux and require auto_route.
 
@@ -191,7 +191,7 @@ Conflict with `include_interface`.
 
 #### include_uid
 
-!!! quote ""
+!!! error ""
 
     UID rules are only supported on Linux and require auto_route.
 
@@ -211,7 +211,7 @@ Exclude users in route, but in range.
 
 #### include_android_user
 
-!!! quote ""
+!!! error ""
 
     Android user and package rules are only supported on Android and require auto_route.
 

docs/configuration/inbound/tun.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -102,7 +102,7 @@ tun 接口的 IPv6 前缀。
 
 设置到 Tun 的默认路由。
 
-!!! quote ""
+!!! error ""
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
@@ -171,7 +171,7 @@ TCP/IP 栈。
 
 #### include_interface
 
-!!! quote ""
+!!! error ""
 
     接口规则仅在 Linux 下被支持，并且需要 `auto_route`。
 
@@ -187,7 +187,7 @@ TCP/IP 栈。
 
 #### include_uid
 
-!!! quote ""
+!!! error ""
 
     UID 规则仅在 Linux 下被支持，并且需要 `auto_route`。
 
@@ -207,7 +207,7 @@ TCP/IP 栈。
 
 #### include_android_user
 
-!!! quote ""
+!!! error ""
 
     Android 用户和应用规则仅在 Android 下被支持，并且需要 `auto_route`。
 

docs/configuration/outbound/hysteria.md

@@ -26,7 +26,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by hysteria is not included by default, see [Installation](./#installation).
+    QUIC, which is required by hysteria is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/outbound/hysteria2.md

@@ -24,15 +24,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by Hysteria2 is not included by default, see [Installation](./#installation).
-
-!!! warning "Difference from official Hysteria2"
-
-    The official Hysteria2 supports an authentication method called **userpass**,
-    which essentially uses a combination of `<username>:<password>` as the actual password,
-    while sing-box does not provide this alias.
-    If you are planning to use sing-box with the official program,
-    please note that you will need to fill the combination as the password.
+    QUIC, which is required by Hysteria2 is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/outbound/hysteria2.zh.md

@@ -26,12 +26,6 @@
 
     默认安装不包含被 Hysteria2 依赖的 QUIC，参阅 [安装](/zh/#_2)。
 
-!!! warning "与官方 Hysteria2 的区别"
-
-    官方程序支持一种名为 **userpass** 的验证方式，
-    本质上上是将用户名与密码的组合 `<username>:<password>` 作为实际上的密码，而 sing-box 不提供此别名。
-    要将 sing-box 与官方程序一起使用， 您需要填写该组合作为实际密码。
-
 ### 字段
 
 #### server

docs/configuration/outbound/selector.md

@@ -15,7 +15,7 @@
 }
 ```
 
-!!! quote ""
+!!! error ""
 
     The selector can only be controlled through the [Clash API](/configuration/experimental#clash-api-fields) currently.
 

docs/configuration/outbound/selector.zh.md

@@ -15,7 +15,7 @@
 }
 ```
 
-!!! quote ""
+!!! error ""
 
     选择器目前只能通过 [Clash API](/zh/configuration/experimental#clash-api) 来控制。
 

docs/configuration/outbound/shadowsocksr.md

@@ -25,7 +25,7 @@
 
 !!! warning ""
 
-    ShadowsocksR is not included by default, see [Installation](./#installation).
+    ShadowsocksR is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/outbound/tor.md

@@ -18,7 +18,7 @@
 
 !!! info ""
 
-    Embedded tor is not included by default, see [Installation](./#installation).
+    Embedded tor is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/outbound/tuic.md

@@ -23,7 +23,7 @@
 
 !!! warning ""
 
-    QUIC, which is required by TUIC is not included by default, see [Installation](./#installation).
+    QUIC, which is required by TUIC is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/outbound/wireguard.md

@@ -38,11 +38,11 @@
 
 !!! warning ""
 
-    WireGuard is not included by default, see [Installation](./#installation).
+    WireGuard is not included by default, see [Installation](/#installation).
 
 !!! warning ""
 
-    gVisor, which is required by the unprivileged WireGuard is not included by default, see [Installation](./#installation).
+    gVisor, which is required by the unprivileged WireGuard is not included by default, see [Installation](/#installation).
 
 ### Fields
 

docs/configuration/route/geoip.md

@@ -1,11 +1,3 @@
----
-icon: material/delete-clock
----
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 ### Structure
 
 ```json

docs/configuration/route/geoip.zh.md

@@ -0,0 +1,33 @@
+### 结构
+
+```json
+{
+  "route": {
+    "geoip": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoIP 资源的路径。
+
+默认 `geoip.db`。
+
+#### download_url
+
+指定 GeoIP 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db`。
+
+#### download_detour
+
+用于下载 GeoIP 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/geosite.md

@@ -1,11 +1,3 @@
----
-icon: material/delete-clock
----
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 ### Structure
 
 ```json

docs/configuration/route/geosite.zh.md

@@ -0,0 +1,33 @@
+### 结构
+
+```json
+{
+  "route": {
+    "geosite": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoSite 资源的路径。
+
+默认 `geosite.db`。
+
+#### download_url
+
+指定 GeoSite 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db`。
+
+#### download_detour
+
+用于下载 GeoSite 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/index.md

@@ -1,15 +1,5 @@
----
-icon: material/alert-decagram
----
-
 # Route
 
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -18,7 +8,6 @@ icon: material/alert-decagram
     "geoip": {},
     "geosite": {},
     "rules": [],
-    "rule_set": [],
     "final": "",
     "auto_detect_interface": false,
     "override_android_vpn": false,
@@ -30,20 +19,11 @@ icon: material/alert-decagram
 
 ### Fields
 
-| Key       | Format               |
-|-----------|----------------------|
-| `geoip`   | [GeoIP](./geoip)     |
-| `geosite` | [Geosite](./geosite) |
-
-#### rules
-
-List of [Route Rule](./rule)
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-List of [Rule Set](/configuration/rule-set)
+| Key        | Format                             |
+|------------|------------------------------------|
+| `geoip`    | [GeoIP](./geoip)                   |
+| `geosite`  | [Geosite](./geosite)               |
+| `rules`    | List of [Route Rule](./rule)       |
 
 #### final
 
@@ -51,7 +31,7 @@ Default outbound tag. the first outbound will be used if empty.
 
 #### auto_detect_interface
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -61,7 +41,7 @@ Takes no effect if `outbound.bind_interface` is set.
 
 #### override_android_vpn
 
-!!! quote ""
+!!! error ""
 
     Only supported on Android.
 
@@ -69,7 +49,7 @@ Accept Android VPN as upstream NIC when `auto_detect_interface` enabled.
 
 #### default_interface
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -79,7 +59,7 @@ Takes no effect if `auto_detect_interface` is set.
 
 #### default_mark
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/route/index.zh.md

@@ -1,15 +1,5 @@
----
-icon: material/alert-decagram
----
-
 # 路由
 
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -17,8 +7,8 @@ icon: material/alert-decagram
   "route": {
     "geoip": {},
     "geosite": {},
+    "ip_rules": [],
     "rules": [],
-    "rule_set": [],
     "final": "",
     "auto_detect_interface": false,
     "override_android_vpn": false,
@@ -30,29 +20,19 @@ icon: material/alert-decagram
 
 ### 字段
 
-| 键          | 格式                                |
-|------------|-----------------------------------|
-| `geoip`    | [GeoIP](./geoip)                  |
-| `geosite`  | [Geosite](./geosite)              |
-
-
-#### rule
-
-一组 [路由规则](./rule)。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-一组 [规则集](/configuration/rule-set)。
+| 键          | 格式                      |
+|------------|-------------------------|
+| `geoip`    | [GeoIP](./geoip)        |
+| `geosite`  | [GeoSite](./geosite)    |
+| `rules`    | 一组 [路由规则](./rule)       |
 
 #### final
 
-默认出站标签。如果为空，将使用第一个可用于对应协议的出站。
+默认出站标签。如果未空，将使用第一个可用于对应协议的出站。
 
 #### auto_detect_interface
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -62,7 +42,7 @@ icon: material/alert-decagram
 
 #### override_android_vpn
 
-!!! quote ""
+!!! error ""
 
     仅支持 Android。
 
@@ -70,7 +50,7 @@ icon: material/alert-decagram
 
 #### default_interface
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -80,10 +60,10 @@ icon: material/alert-decagram
 
 #### default_mark
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 
 默认为出站连接设置路由标记。
 
-如果设置了 `outbound.routing_mark` 设置，则不生效。
+如果设置了 `outbound.routing_mark` 设置，则不生效。

docs/configuration/route/rule.md

@@ -1,15 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
-    :material-delete-clock: [source_geoip](#source_geoip)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -95,16 +83,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": "direct"
       },
@@ -176,35 +154,23 @@ Match domain using regular expression.
 
 #### geosite
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 Match geosite.
 
 #### source_geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match source geoip.
 
 #### geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match geoip.
 
 #### source_ip_cidr
 
-Match source IP CIDR.
+Match source ip cidr.
 
 #### ip_cidr
 
-Match IP CIDR.
+Match ip cidr.
 
 #### source_port
 
@@ -224,7 +190,7 @@ Match port range.
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -232,7 +198,7 @@ Match process name.
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -244,7 +210,7 @@ Match android package name.
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -252,7 +218,7 @@ Match user name.
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -262,34 +228,6 @@ Match user id.
 
 Match Clash mode.
 
-#### wifi_ssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-Match [Rule Set](/configuration/route/#rule_set).
-
-#### rule_set_ipcidr_match_source
-
-!!! question "Since sing-box 1.8.0"
-
-Make `ipcidr` in rule sets match the source IP.
-
 #### invert
 
 Invert match result.
@@ -316,4 +254,4 @@ Tag of the target outbound.
 
 ==Required==
 
-Included rules.
+Included default rules.

docs/configuration/route/rule.zh.md

@@ -1,15 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
-    :material-delete-clock: [source_geoip](#source_geoip)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -93,16 +81,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": "direct"
       },
@@ -174,26 +152,14 @@ icon: material/alert-decagram
 
 #### geosite
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
-
-匹配 Geosite。
+匹配 GeoSite。
 
 #### source_geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配源 GeoIP。
 
 #### geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配 GeoIP。
 
 #### source_ip_cidr
@@ -222,7 +188,7 @@ icon: material/alert-decagram
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -230,7 +196,7 @@ icon: material/alert-decagram
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -242,7 +208,7 @@ icon: material/alert-decagram
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux.
 
@@ -250,7 +216,7 @@ icon: material/alert-decagram
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux.
 
@@ -260,34 +226,6 @@ icon: material/alert-decagram
 
 匹配 Clash 模式。
 
-#### wifi_ssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi SSID。
-
-#### wifi_bssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi BSSID。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配[规则集](/zh/configuration/route/#rule_set)。
-
-#### rule_set_ipcidr_match_source
-
-!!! question "自 sing-box 1.8.0 起"
-
-使规则集中的 `ipcidr` 规则匹配源 IP。
-
 #### invert
 
 反选匹配结果。
@@ -314,4 +252,4 @@ icon: material/alert-decagram
 
 ==必填==
 
-包括的规则。
+包括的默认规则。

docs/configuration/rule-set/headless-rule.md

@@ -1,207 +0,0 @@
----
-icon: material/new-box
----
-
-### Structure
-
-!!! question "Since sing-box 1.8.0"
-
-```json
-{
-  "rules": [
-    {
-      "query_type": [
-        "A",
-        "HTTPS",
-        32768
-      ],
-      "network": [
-        "tcp"
-      ],
-      "domain": [
-        "test.com"
-      ],
-      "domain_suffix": [
-        ".cn"
-      ],
-      "domain_keyword": [
-        "test"
-      ],
-      "domain_regex": [
-        "^stun\\..+"
-      ],
-      "source_ip_cidr": [
-        "10.0.0.0/24",
-        "192.168.0.1"
-      ],
-      "ip_cidr": [
-        "10.0.0.0/24",
-        "192.168.0.1"
-      ],
-      "source_port": [
-        12345
-      ],
-      "source_port_range": [
-        "1000:2000",
-        ":3000",
-        "4000:"
-      ],
-      "port": [
-        80,
-        443
-      ],
-      "port_range": [
-        "1000:2000",
-        ":3000",
-        "4000:"
-      ],
-      "process_name": [
-        "curl"
-      ],
-      "process_path": [
-        "/usr/bin/curl"
-      ],
-      "package_name": [
-        "com.termux"
-      ],
-      "wifi_ssid": [
-        "My WIFI"
-      ],
-      "wifi_bssid": [
-        "00:00:00:00:00:00"
-      ],
-      "invert": false
-    },
-    {
-      "type": "logical",
-      "mode": "and",
-      "rules": [],
-      "invert": false
-    }
-  ]
-}
-```
-
-!!! note ""
-
-    You can ignore the JSON Array [] tag when the content is only one item
-
-### Default Fields
-
-!!! note ""
-
-    The default rule uses the following matching logic:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `ip_cidr`) &&  
-    (`port` || `port_range`) &&  
-    (`source_port` || `source_port_range`) &&  
-    `other fields`
-
-#### query_type
-
-DNS query type. Values can be integers or type name strings.
-
-#### network
-
-`tcp` or `udp`.
-
-#### domain
-
-Match full domain.
-
-#### domain_suffix
-
-Match domain suffix.
-
-#### domain_keyword
-
-Match domain using keyword.
-
-#### domain_regex
-
-Match domain using regular expression.
-
-#### source_ip_cidr
-
-Match source IP CIDR.
-
-#### ip_cidr
-
-!!! info ""
-
-    `ip_cidr` is an alias for `source_ip_cidr` when the Rule Set is used in DNS rules or `rule_set_ipcidr_match_source` enabled in route rules.
-
-Match IP CIDR.
-
-#### source_port
-
-Match source port.
-
-#### source_port_range
-
-Match source port range.
-
-#### port
-
-Match port.
-
-#### port_range
-
-Match port range.
-
-#### process_name
-
-!!! quote ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process name.
-
-#### process_path
-
-!!! quote ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process path.
-
-#### package_name
-
-Match android package name.
-
-#### wifi_ssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### invert
-
-Invert match result.
-
-### Logical Fields
-
-#### type
-
-`logical`
-
-#### mode
-
-==Required==
-
-`and` or `or`
-
-#### rules
-
-==Required==
-
-Included rules.

docs/configuration/rule-set/index.md

@@ -1,97 +0,0 @@
----
-icon: material/new-box
----
-
-# Rule Set
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "type": "",
-  "tag": "",
-  "format": "",
-  
-  ... // Typed Fields
-}
-```
-
-#### Local Structure
-
-```json
-{
-  "type": "local",
-  
-  ...
-  
-  "path": ""
-}
-```
-
-#### Remote Structure
-
-!!! info ""
-
-    Remote rule-set will be cached if `experimental.cache_file.enabled`.
-
-```json
-{
-  "type": "remote",
-  
-  ...,
-  
-  "url": "",
-  "download_detour": "",
-  "update_interval": ""
-}
-```
-
-### Fields
-
-#### type
-
-==Required==
-
-Type of Rule Set, `local` or `remote`.
-
-#### tag
-
-==Required==
-
-Tag of Rule Set.
-
-#### format
-
-==Required==
-
-Format of Rule Set, `source` or `binary`.
-
-### Local Fields
-
-#### path
-
-==Required==
-
-File path of Rule Set.
-
-### Remote Fields
-
-#### url
-
-==Required==
-
-Download URL of Rule Set.
-
-#### download_detour
-
-Tag of the outbound to download rule-set.
-
-Default outbound will be used if empty.
-
-#### update_interval
-
-Update interval of Rule Set.
-
-`1d` will be used if empty.

docs/configuration/rule-set/source-format.md

@@ -1,34 +0,0 @@
----
-icon: material/new-box
----
-
-# Source Format
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "version": 1,
-  "rules": []
-}
-```
-
-### Compile
-
-Use `sing-box rule-set compile [--output <file-name>.srs] <file-name>.json` to compile source to binary rule-set.
-
-### Fields
-
-#### version
-
-==Required==
-
-Version of Rule Set, must be `1`.
-
-#### rules
-
-==Required==
-
-List of [Headless Rule](./headless-rule.md).

docs/configuration/shared/dial.md

@@ -41,7 +41,7 @@ The IPv6 address to bind to.
 
 #### routing_mark
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/shared/dial.zh.md

@@ -44,7 +44,7 @@
 
 #### routing_mark
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 

docs/configuration/shared/tls.md

@@ -201,7 +201,7 @@ The path to the server private key, in PEM format.
 
 !!! warning ""
 
-    uTLS is not included by default, see [Installation](./#installation).
+    uTLS is not included by default, see [Installation](/#installation).
 
 !!! note ""
 
@@ -228,7 +228,7 @@ Chrome fingerprint will be used if empty.
 
 !!! warning ""
 
-    ECH is not included by default, see [Installation](./#installation).
+    ECH is not included by default, see [Installation](/#installation).
 
 ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
 message.
@@ -280,7 +280,7 @@ If empty, load from DNS will be attempted.
 
 !!! warning ""
 
-    ACME is not included by default, see [Installation](./#installation).
+    ACME is not included by default, see [Installation](/#installation).
 
 #### domain
 
@@ -359,11 +359,11 @@ See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge) for details.
 
 !!! warning ""
 
-    reality server is not included by default, see [Installation](./#installation).
+    reality server is not included by default, see [Installation](/#installation).
 
 !!! warning ""
 
-    uTLS, which is required by reality client is not included by default, see [Installation](./#installation).
+    uTLS, which is required by reality client is not included by default, see [Installation](/#installation).
 
 #### handshake
 

docs/configuration/shared/v2ray-transport.md

@@ -131,7 +131,7 @@ It needs to be consistent with the server.
 
 !!! warning ""
 
-    QUIC is not included by default, see [Installation](./#installation).
+    QUIC is not included by default, see [Installation](/#installation).
 
 !!! warning "Difference from v2ray-core"
 
@@ -142,7 +142,7 @@ It needs to be consistent with the server.
 
 !!! note ""
 
-    standard gRPC has good compatibility but poor performance and is not included by default, see [Installation](./#installation).
+    standard gRPC has good compatibility but poor performance and is not included by default, see [Installation](/#installation).
 
 ```json
 {

docs/contributing/environment.md

@@ -0,0 +1,50 @@
+# Development environment
+
+#### For the documentation
+
+##### Setup
+
+You need to configure python3 and pip first.
+
+```shell
+pip install mkdocs-material mkdocs-static-i18n
+```
+
+##### Run the site locally
+
+```shell
+mkdocs serve
+```
+
+or
+
+```shell
+python3 -m mkdocs serve
+```
+
+#### For the project
+
+By default you have the latest Go installed (currently 1.19), and added `GOPATH/bin` to the PATH environment variable.
+
+##### Setup
+
+```shell
+make fmt_insalll
+make lint_install
+```
+
+This installs the formatting and lint tools, which can be used via `make fmt` and `make lint`.
+
+For ProtoBuffer changes, you also need `make proto_install` and `make proto`.
+
+##### Build binary to the project directory
+
+```shell
+make
+```
+
+##### Install binary to GOPATH/bin
+
+```shell
+make install
+```

docs/contributing/index.md

@@ -0,0 +1,17 @@
+# Contributing to sing-box
+
+An introduction to contributing to the sing-box project.
+
+The sing-box project welcomes, and depends, on contributions from developers and users in the open source community.
+Contributions can be made in a number of ways, a few examples are:
+
+* Code patches via pull requests
+* Documentation improvements
+* Bug reports and patch reviews
+
+### Reporting an Issue?
+
+Please follow
+the [issue template](https://github.com/SagerNet/sing-box/issues/new?assignees=&labels=&template=bug_report.yml) to
+submit bugs. Always include **FULL** log content, especially if you don't understand the code that generates it.
+

docs/contributing/sub-projects.md

@@ -0,0 +1,67 @@
+The sing-box uses the following projects which also need to be maintained:
+
+#### sing
+
+Link: [GitHub repository](https://github.com/SagerNet/sing)
+
+As a base tool library, there are no dependencies other than `golang.org/x/sys`.
+
+#### sing-dns
+
+Link: [GitHub repository](https://github.com/SagerNet/sing-dns)
+
+Handles DNS lookups and caching.
+
+#### sing-tun
+
+Link: [GitHub repository](https://github.com/SagerNet/sing-tun)
+
+Handle Tun traffic forwarding, configure routing, monitor network and routing.
+
+This library needs to periodically update its dependency gVisor (according to tags), including checking for changes to
+the used parts of the code and updating its usage. If you are involved in maintenance, you also need to check that if it
+works or contains memory leaks.
+
+#### sing-shadowsocks
+
+Link: [GitHub repository](https://github.com/SagerNet/sing-shadowsocks)
+
+Provides Shadowsocks client and server
+
+#### sing-vmess
+
+Link: [GitHub repository](https://github.com/SagerNet/sing-vmess)
+
+Provides VMess client and server
+
+#### netlink
+
+Link: [GitHub repository](https://github.com/SagerNet/netlink)
+
+Fork of `vishvananda/netlink`, with some rule fixes.
+
+The library needs to be updated with the upstream.
+
+#### quic-go
+
+Link: [GitHub repository](https://github.com/SagerNet/quic-go)
+
+Fork of `lucas-clemente/quic-go`  and `HyNetwork/quic-go`, contains quic flow control and other fixes used by Hysteria.
+
+Since the author of Hysteria does not follow the upstream updates in time, and the provided fork needs to use replace,
+we need to do this.
+
+The library needs to be updated with the upstream.
+
+#### smux
+
+Link: [GitHub repository](https://github.com/SagerNet/smux)
+
+Fork of `xtaci/smux`
+
+Modify the code to support the writev it uses internally and unify the buffer pool, which prevents it from allocating
+64k buffers for per connection and improves performance.
+
+Upstream doesn't seem to be updated anymore, maybe a replacement is needed.
+
+Note: while yamux is still actively maintained and better known, it seems to be less performant.

docs/deprecated.md

@@ -1,11 +1,5 @@
----
-icon: material/delete-alert
----
-
 # Deprecated Feature List
 
-### 1.6.0
-
 The following features will be marked deprecated in 1.5.0 and removed entirely in 1.6.0.
 
 #### ShadowsocksR

docs/deprecated.zh.md

@@ -1,17 +0,0 @@
----
-icon: material/delete-alert
----
-
-# 废弃功能列表
-
-### 1.6.0
-
-下列功能已在 1.5.0 中标记为已弃用，并在 1.6.0 中完全删除。
-
-#### ShadowsocksR
-
-ShadowsocksR 支持从未默认启用，自从常用的黑产代理销售面板停止使用该协议，继续维护它是没有意义的。
-
-#### Proxy Protocol
-
-Proxy Protocol 支持由 Pull Request 添加，存在问题且仅由 HTTP 多路复用器（如 nginx）的后端使用，具有侵入性，对于代理目的毫无意义。

docs/examples/clash-api.md

@@ -0,0 +1,52 @@
+```json
+{
+  "dns": {
+    "rules": [
+      {
+        "domain": [
+          "clash.razord.top",
+          "yacd.haishan.me"
+        ],
+        "server": "local"
+      },
+      {
+        "clash_mode": "direct",
+        "server": "local"
+      }
+    ]
+  },
+  "outbounds": [
+    {
+      "type": "selector",
+      "tag": "default",
+      "outbounds": [
+        "proxy-a",
+        "proxy-b"
+      ]
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "clash_mode": "direct",
+        "outbound": "direct"
+      },
+      {
+        "domain": [
+          "clash.razord.top",
+          "yacd.haishan.me"
+        ],
+        "outbound": "direct"
+      }
+    ],
+    "final": "default"
+  },
+  "experimental": {
+    "clash_api": {
+      "external_controller": "127.0.0.1:9090",
+      "store_selected": true
+    }
+  }
+}
+
+```

docs/examples/dns-hijack.md

@@ -0,0 +1,65 @@
+#### Sniff Mode
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true // required
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "outbound": "dns-out"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```
+
+#### Port Mode
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true // not required
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "port": 53,
+        "outbound": "dns-out"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```

docs/examples/dns-hijack.zh.md

@@ -0,0 +1,65 @@
+#### 探测模式
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true // 必须
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "outbound": "dns-out"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```
+
+#### 端口模式
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true // 非必须
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "port": 53,
+        "outbound": "dns-out"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```

docs/examples/fakeip.md

@@ -0,0 +1,106 @@
+```json
+{
+  "dns": {
+    "servers": [
+      {
+        "tag": "google",
+        "address": "tls://8.8.8.8"
+      },
+      {
+        "tag": "local",
+        "address": "223.5.5.5",
+        "detour": "direct"
+      },
+      {
+        "tag": "remote",
+        "address": "fakeip"
+      },
+      {
+        "tag": "block",
+        "address": "rcode://success"
+      }
+    ],
+    "rules": [
+      {
+        "geosite": "category-ads-all",
+        "server": "block",
+        "disable_cache": true
+      },
+      {
+        "outbound": "any",
+        "server": "local"
+      },
+      {
+        "geosite": "cn",
+        "server": "local"
+      },
+      {
+        "query_type": [
+          "A",
+          "AAAA"
+        ],
+        "server": "remote"
+      }
+    ],
+    "fakeip": {
+      "enabled": true,
+      "inet4_range": "198.18.0.0/15",
+      "inet6_range": "fc00::/18"
+    },
+    "independent_cache": true,
+    "strategy": "ipv4_only"
+  },
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true,
+      "domain_strategy": "ipv4_only" // remove this line if you want to resolve the domain remotely (if the server is not sing-box, UDP may not work due to wrong behavior).
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "proxy",
+      "server": "mydomain.com",
+      "server_port": 8080,
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    },
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "block",
+      "tag": "block"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "outbound": "dns-out"
+      },
+      {
+        "geosite": "cn",
+        "geoip": [
+          "private",
+          "cn"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "geosite": "category-ads-all",
+        "outbound": "block"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```

docs/examples/fakeip.zh.md

@@ -0,0 +1,106 @@
+```json
+{
+  "dns": {
+    "servers": [
+      {
+        "tag": "google",
+        "address": "tls://8.8.8.8"
+      },
+      {
+        "tag": "local",
+        "address": "223.5.5.5",
+        "detour": "direct"
+      },
+      {
+        "tag": "remote",
+        "address": "fakeip"
+      },
+      {
+        "tag": "block",
+        "address": "rcode://success"
+      }
+    ],
+    "rules": [
+      {
+        "geosite": "category-ads-all",
+        "server": "block",
+        "disable_cache": true
+      },
+      {
+        "outbound": "any",
+        "server": "local"
+      },
+      {
+        "geosite": "cn",
+        "server": "local"
+      },
+      {
+        "query_type": [
+          "A",
+          "AAAA"
+        ],
+        "server": "remote"
+      }
+    ],
+    "fakeip": {
+      "enabled": true,
+      "inet4_range": "198.18.0.0/15",
+      "inet6_range": "fc00::/18"
+    },
+    "independent_cache": true,
+    "strategy": "ipv4_only"
+  },
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "auto_route": true,
+      "sniff": true,
+      "domain_strategy": "ipv4_only" // 如果您想在远程解析域，删除此行 (如果服务器程序不为 sing-box，可能由于错误的行为导致 UDP 无法使用)。
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "proxy",
+      "server": "mydomain.com",
+      "server_port": 8080,
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "8JCsPssfgS8tiRwiMlhARg=="
+    },
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "block",
+      "tag": "block"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "outbound": "dns-out"
+      },
+      {
+        "geosite": "cn",
+        "geoip": [
+          "private",
+          "cn"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "geosite": "category-ads-all",
+        "outbound": "block"
+      }
+    ],
+    "auto_detect_interface": true
+  }
+}
+```

docs/examples/index.md

@@ -0,0 +1,11 @@
+# Examples
+
+Configuration examples for sing-box.
+
+* [Linux Server Installation](./linux-server-installation)
+* [Tun](./tun)
+* [DNS Hijack](./dns-hijack.md)
+* [Shadowsocks](./shadowsocks)
+* [ShadowTLS](./shadowtls)
+* [Clash API](./clash-api)
+* [FakeIP](./fakeip)

docs/examples/index.zh.md

@@ -0,0 +1,11 @@
+# 示例
+
+sing-box 的配置示例。
+
+* [Linux 服务器安装](./linux-server-installation)
+* [Tun](./tun)
+* [DNS 劫持](./dns-hijack.md)
+* [Shadowsocks](./shadowsocks)
+* [ShadowTLS](./shadowtls)
+* [Clash API](./clash-api)
+* [FakeIP](./fakeip)

docs/examples/linux-server-installation.md

@@ -0,0 +1,38 @@
+#### Requirements
+
+* Linux & Systemd
+* Git
+* C compiler environment
+
+#### Install
+
+```shell
+git clone -b main https://github.com/SagerNet/sing-box
+cd sing-box
+./release/local/install_go.sh # skip if you have golang already installed
+./release/local/install.sh
+```
+
+Edit configuration file in `/usr/local/etc/sing-box/config.json`
+
+```shell
+./release/local/enable.sh
+```
+
+#### Update
+
+```shell
+./release/local/update.sh
+```
+
+#### Other commands
+
+| Operation | Command                                       |
+|-----------|-----------------------------------------------|
+| Start     | `sudo systemctl start sing-box`               |
+| Stop      | `sudo systemctl stop sing-box`                |
+| Kill      | `sudo systemctl kill sing-box`                |
+| Restart   | `sudo systemctl restart sing-box`             |
+| Logs      | `sudo journalctl -u sing-box --output cat -e` |
+| New Logs  | `sudo journalctl -u sing-box --output cat -f` |
+| Uninstall | `./release/local/uninstall.sh`                |

docs/examples/linux-server-installation.zh.md

@@ -0,0 +1,38 @@
+#### 依赖
+
+* Linux & Systemd
+* Git
+* C 编译器环境
+
+#### 安装
+
+```shell
+git clone -b main https://github.com/SagerNet/sing-box
+cd sing-box
+./release/local/install_go.sh # 如果已安装 golang 则跳过
+./release/local/install.sh
+```
+
+编辑配置文件 `/usr/local/etc/sing-box/config.json`
+
+```shell
+./release/local/enable.sh
+```
+
+#### 更新
+
+```shell
+./release/local/update.sh
+```
+
+#### 其他命令
+
+| 操作   | 命令                                            |
+|------|-----------------------------------------------|
+| 启动   | `sudo systemctl start sing-box`               |
+| 停止   | `sudo systemctl stop sing-box`                |
+| 强制停止 | `sudo systemctl kill sing-box`                |
+| 重启   | `sudo systemctl restart sing-box`             |
+| 查看日志 | `sudo journalctl -u sing-box --output cat -e` |
+| 实时日志 | `sudo journalctl -u sing-box --output cat -f` |
+| 卸载   | `./release/local/uninstall.sh`                |