documentation: Bump version & Refactor docs

.gitignore

@@ -1,7 +1,6 @@
 /.idea/
 /vendor/
 /*.json
-/*.srs
 /*.db
 /site/
 /bin/

adapter/experimental.go

@@ -1,16 +1,11 @@
 package adapter
 
 import (
-	"bytes"
 	"context"
-	"encoding/binary"
-	"io"
 	"net"
-	"time"
 
 	"github.com/sagernet/sing-box/common/urltest"
 	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/common/rw"
 )
 
 type ClashServer interface {
@@ -18,83 +13,22 @@ type ClashServer interface {
 	PreStarter
 	Mode() string
 	ModeList() []string
+	StoreSelected() bool
+	StoreFakeIP() bool
+	CacheFile() ClashCacheFile
 	HistoryStorage() *urltest.HistoryStorage
 	RoutedConnection(ctx context.Context, conn net.Conn, metadata InboundContext, matchedRule Rule) (net.Conn, Tracker)
 	RoutedPacketConnection(ctx context.Context, conn N.PacketConn, metadata InboundContext, matchedRule Rule) (N.PacketConn, Tracker)
 }
 
-type CacheFile interface {
-	Service
-	PreStarter
-
-	StoreFakeIP() bool
-	FakeIPStorage
-
+type ClashCacheFile interface {
 	LoadMode() string
 	StoreMode(mode string) error
 	LoadSelected(group string) string
 	StoreSelected(group string, selected string) error
 	LoadGroupExpand(group string) (isExpand bool, loaded bool)
 	StoreGroupExpand(group string, expand bool) error
-	LoadRuleSet(tag string) *SavedRuleSet
-	SaveRuleSet(tag string, set *SavedRuleSet) error
-}
-
-type SavedRuleSet struct {
-	Content     []byte
-	LastUpdated time.Time
-	LastEtag    string
-}
-
-func (s *SavedRuleSet) MarshalBinary() ([]byte, error) {
-	var buffer bytes.Buffer
-	err := binary.Write(&buffer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return nil, err
-	}
-	err = rw.WriteUVariant(&buffer, uint64(len(s.Content)))
-	if err != nil {
-		return nil, err
-	}
-	buffer.Write(s.Content)
-	err = binary.Write(&buffer, binary.BigEndian, s.LastUpdated.Unix())
-	if err != nil {
-		return nil, err
-	}
-	err = rw.WriteVString(&buffer, s.LastEtag)
-	if err != nil {
-		return nil, err
-	}
-	return buffer.Bytes(), nil
-}
-
-func (s *SavedRuleSet) UnmarshalBinary(data []byte) error {
-	reader := bytes.NewReader(data)
-	var version uint8
-	err := binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return err
-	}
-	contentLen, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return err
-	}
-	s.Content = make([]byte, contentLen)
-	_, err = io.ReadFull(reader, s.Content)
-	if err != nil {
-		return err
-	}
-	var lastUpdated int64
-	err = binary.Read(reader, binary.BigEndian, &lastUpdated)
-	if err != nil {
-		return err
-	}
-	s.LastUpdated = time.Unix(lastUpdated, 0)
-	s.LastEtag, err = rw.ReadVString(reader)
-	if err != nil {
-		return err
-	}
-	return nil
+	FakeIPStorage
 }
 
 type Tracker interface {

adapter/inbound.go

@@ -47,7 +47,6 @@ type InboundContext struct {
 	GeoIPCode            string
 	ProcessInfo          *process.Info
 	FakeIP               bool
-	IPCIDRMatchSource    bool
 
 	// dns cache
 

adapter/router.go

@@ -2,14 +2,12 @@ package adapter
 
 import (
 	"context"
-	"net/http"
 	"net/netip"
 
 	"github.com/sagernet/sing-box/common/geoip"
 	"github.com/sagernet/sing-dns"
 	"github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common/control"
-	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/service"
 
 	mdns "github.com/miekg/dns"
@@ -20,7 +18,7 @@ type Router interface {
 
 	Outbounds() []Outbound
 	Outbound(tag string) (Outbound, bool)
-	DefaultOutbound(network string) (Outbound, error)
+	DefaultOutbound(network string) Outbound
 
 	FakeIPStore() FakeIPStore
 
@@ -29,8 +27,6 @@ type Router interface {
 	GeoIPReader() *geoip.Reader
 	LoadGeosite(code string) (Rule, error)
 
-	RuleSet(tag string) (RuleSet, bool)
-
 	Exchange(ctx context.Context, message *mdns.Msg) (*mdns.Msg, error)
 	Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error)
 	LookupDefault(ctx context.Context, domain string) ([]netip.Addr, error)
@@ -45,7 +41,6 @@ type Router interface {
 	NetworkMonitor() tun.NetworkUpdateMonitor
 	InterfaceMonitor() tun.DefaultInterfaceMonitor
 	PackageManager() tun.PackageManager
-	WIFIState() WIFIState
 	Rules() []Rule
 
 	ClashServer() ClashServer
@@ -65,15 +60,11 @@ func RouterFromContext(ctx context.Context) Router {
 	return service.FromContext[Router](ctx)
 }
 
-type HeadlessRule interface {
-	Match(metadata *InboundContext) bool
-}
-
 type Rule interface {
-	HeadlessRule
 	Service
 	Type() string
 	UpdateGeosite() error
+	Match(metadata *InboundContext) bool
 	Outbound() string
 	String() string
 }
@@ -84,22 +75,6 @@ type DNSRule interface {
 	RewriteTTL() *uint32
 }
 
-type RuleSet interface {
-	StartContext(ctx context.Context, startContext RuleSetStartContext) error
-	Close() error
-	HeadlessRule
-}
-
-type RuleSetStartContext interface {
-	HTTPClient(detour string, dialer N.Dialer) *http.Client
-	Close()
-}
-
 type InterfaceUpdateListener interface {
 	InterfaceUpdated()
 }
-
-type WIFIState struct {
-	SSID  string
-	BSSID string
-}

box.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/experimental"
-	"github.com/sagernet/sing-box/experimental/cachefile"
 	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/inbound"
 	"github.com/sagernet/sing-box/log"
@@ -33,8 +32,7 @@ type Box struct {
 	outbounds    []adapter.Outbound
 	logFactory   log.Factory
 	logger       log.ContextLogger
-	preServices1 map[string]adapter.Service
-	preServices2 map[string]adapter.Service
+	preServices  map[string]adapter.Service
 	postServices map[string]adapter.Service
 	done         chan struct{}
 }
@@ -47,22 +45,18 @@ type Options struct {
 }
 
 func New(options Options) (*Box, error) {
-	createdAt := time.Now()
 	ctx := options.Context
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	ctx = service.ContextWithDefaultRegistry(ctx)
 	ctx = pause.ContextWithDefaultManager(ctx)
+	createdAt := time.Now()
 	experimentalOptions := common.PtrValueOrDefault(options.Experimental)
 	applyDebugOptions(common.PtrValueOrDefault(experimentalOptions.Debug))
-	var needCacheFile bool
 	var needClashAPI bool
 	var needV2RayAPI bool
-	if experimentalOptions.CacheFile != nil && experimentalOptions.CacheFile.Enabled || options.PlatformLogWriter != nil {
-		needCacheFile = true
-	}
-	if experimentalOptions.ClashAPI != nil || options.PlatformLogWriter != nil {
+	if experimentalOptions.ClashAPI != nil || options.PlatformInterface != nil {
 		needClashAPI = true
 	}
 	if experimentalOptions.V2RayAPI != nil && experimentalOptions.V2RayAPI.Listen != "" {
@@ -151,14 +145,8 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "initialize platform interface")
 		}
 	}
-	preServices1 := make(map[string]adapter.Service)
-	preServices2 := make(map[string]adapter.Service)
+	preServices := make(map[string]adapter.Service)
 	postServices := make(map[string]adapter.Service)
-	if needCacheFile {
-		cacheFile := cachefile.NewCacheFile(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
-		preServices1["cache file"] = cacheFile
-		service.MustRegister[adapter.CacheFile](ctx, cacheFile)
-	}
 	if needClashAPI {
 		clashAPIOptions := common.PtrValueOrDefault(experimentalOptions.ClashAPI)
 		clashAPIOptions.ModeList = experimental.CalculateClashModeList(options.Options)
@@ -167,7 +155,7 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "create clash api server")
 		}
 		router.SetClashServer(clashServer)
-		preServices2["clash api"] = clashServer
+		preServices["clash api"] = clashServer
 	}
 	if needV2RayAPI {
 		v2rayServer, err := experimental.NewV2RayServer(logFactory.NewLogger("v2ray-api"), common.PtrValueOrDefault(experimentalOptions.V2RayAPI))
@@ -175,7 +163,7 @@ func New(options Options) (*Box, error) {
 			return nil, E.Cause(err, "create v2ray api server")
 		}
 		router.SetV2RayServer(v2rayServer)
-		preServices2["v2ray api"] = v2rayServer
+		preServices["v2ray api"] = v2rayServer
 	}
 	return &Box{
 		router:       router,
@@ -184,8 +172,7 @@ func New(options Options) (*Box, error) {
 		createdAt:    createdAt,
 		logFactory:   logFactory,
 		logger:       logFactory.Logger(),
-		preServices1: preServices1,
-		preServices2: preServices2,
+		preServices:  preServices,
 		postServices: postServices,
 		done:         make(chan struct{}),
 	}, nil
@@ -230,16 +217,7 @@ func (s *Box) Start() error {
 }
 
 func (s *Box) preStart() error {
-	for serviceName, service := range s.preServices1 {
-		if preService, isPreService := service.(adapter.PreStarter); isPreService {
-			s.logger.Trace("pre-start ", serviceName)
-			err := preService.PreStart()
-			if err != nil {
-				return E.Cause(err, "pre-starting ", serviceName)
-			}
-		}
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		if preService, isPreService := service.(adapter.PreStarter); isPreService {
 			s.logger.Trace("pre-start ", serviceName)
 			err := preService.PreStart()
@@ -260,14 +238,7 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	for serviceName, service := range s.preServices1 {
-		s.logger.Trace("starting ", serviceName)
-		err = service.Start()
-		if err != nil {
-			return E.Cause(err, "start ", serviceName)
-		}
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		s.logger.Trace("starting ", serviceName)
 		err = service.Start()
 		if err != nil {
@@ -342,13 +313,7 @@ func (s *Box) Close() error {
 			return E.Cause(err, "close router")
 		})
 	}
-	for serviceName, service := range s.preServices1 {
-		s.logger.Trace("closing ", serviceName)
-		errors = E.Append(errors, service.Close(), func(err error) error {
-			return E.Cause(err, "close ", serviceName)
-		})
-	}
-	for serviceName, service := range s.preServices2 {
+	for serviceName, service := range s.preServices {
 		s.logger.Trace("closing ", serviceName)
 		errors = E.Append(errors, service.Close(), func(err error) error {
 			return E.Cause(err, "close ", serviceName)

cmd/sing-box/cmd_format.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/sagernet/sing-box/common/json"
 	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
 
 	"github.com/spf13/cobra"
@@ -68,3 +69,41 @@ func format() error {
 	}
 	return nil
 }
+
+func formatOne(configPath string) error {
+	configContent, err := os.ReadFile(configPath)
+	if err != nil {
+		return E.Cause(err, "read config")
+	}
+	var options option.Options
+	err = options.UnmarshalJSON(configContent)
+	if err != nil {
+		return E.Cause(err, "decode config")
+	}
+	buffer := new(bytes.Buffer)
+	encoder := json.NewEncoder(buffer)
+	encoder.SetIndent("", "  ")
+	err = encoder.Encode(options)
+	if err != nil {
+		return E.Cause(err, "encode config")
+	}
+	if !commandFormatFlagWrite {
+		os.Stdout.WriteString(buffer.String() + "\n")
+		return nil
+	}
+	if bytes.Equal(configContent, buffer.Bytes()) {
+		return nil
+	}
+	output, err := os.Create(configPath)
+	if err != nil {
+		return E.Cause(err, "open output")
+	}
+	_, err = output.Write(buffer.Bytes())
+	output.Close()
+	if err != nil {
+		return E.Cause(err, "write output")
+	}
+	outputPath, _ := filepath.Abs(configPath)
+	os.Stderr.WriteString(outputPath + "\n")
+	return nil
+}

cmd/sing-box/cmd_geoip.go

@@ -1,43 +0,0 @@
-package main
-
-import (
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/oschwald/maxminddb-golang"
-	"github.com/spf13/cobra"
-)
-
-var (
-	geoipReader          *maxminddb.Reader
-	commandGeoIPFlagFile string
-)
-
-var commandGeoip = &cobra.Command{
-	Use:   "geoip",
-	Short: "GeoIP tools",
-	PersistentPreRun: func(cmd *cobra.Command, args []string) {
-		err := geoipPreRun()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.PersistentFlags().StringVarP(&commandGeoIPFlagFile, "file", "f", "geoip.db", "geoip file")
-	mainCommand.AddCommand(commandGeoip)
-}
-
-func geoipPreRun() error {
-	reader, err := maxminddb.Open(commandGeoIPFlagFile)
-	if err != nil {
-		return err
-	}
-	if reader.Metadata.DatabaseType != "sing-geoip" {
-		reader.Close()
-		return E.New("incorrect database type, expected sing-geoip, got ", reader.Metadata.DatabaseType)
-	}
-	geoipReader = reader
-	return nil
-}

cmd/sing-box/cmd_geoip_export.go

@@ -1,98 +0,0 @@
-package main
-
-import (
-	"io"
-	"net"
-	"os"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/json"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/oschwald/maxminddb-golang"
-	"github.com/spf13/cobra"
-)
-
-var flagGeoipExportOutput string
-
-const flagGeoipExportDefaultOutput = "geoip-<country>.srs"
-
-var commandGeoipExport = &cobra.Command{
-	Use:   "export <country>",
-	Short: "Export geoip country as rule-set",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geoipExport(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoipExport.Flags().StringVarP(&flagGeoipExportOutput, "output", "o", flagGeoipExportDefaultOutput, "Output path")
-	commandGeoip.AddCommand(commandGeoipExport)
-}
-
-func geoipExport(countryCode string) error {
-	networks := geoipReader.Networks(maxminddb.SkipAliasedNetworks)
-	countryMap := make(map[string][]*net.IPNet)
-	var (
-		ipNet           *net.IPNet
-		nextCountryCode string
-		err             error
-	)
-	for networks.Next() {
-		ipNet, err = networks.Network(&nextCountryCode)
-		if err != nil {
-			return err
-		}
-		countryMap[nextCountryCode] = append(countryMap[nextCountryCode], ipNet)
-	}
-	ipNets := countryMap[strings.ToLower(countryCode)]
-	if len(ipNets) == 0 {
-		return E.New("country code not found: ", countryCode)
-	}
-
-	var (
-		outputFile   *os.File
-		outputWriter io.Writer
-	)
-	if flagGeoipExportOutput == "stdout" {
-		outputWriter = os.Stdout
-	} else if flagGeoipExportOutput == flagGeoipExportDefaultOutput {
-		outputFile, err = os.Create("geoip-" + countryCode + ".json")
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	} else {
-		outputFile, err = os.Create(flagGeoipExportOutput)
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	}
-
-	encoder := json.NewEncoder(outputWriter)
-	encoder.SetIndent("", "  ")
-	var headlessRule option.DefaultHeadlessRule
-	headlessRule.IPCIDR = make([]string, 0, len(ipNets))
-	for _, cidr := range ipNets {
-		headlessRule.IPCIDR = append(headlessRule.IPCIDR, cidr.String())
-	}
-	var plainRuleSet option.PlainRuleSetCompat
-	plainRuleSet.Version = C.RuleSetVersion1
-	plainRuleSet.Options.Rules = []option.HeadlessRule{
-		{
-			Type:           C.RuleTypeDefault,
-			DefaultOptions: headlessRule,
-		},
-	}
-	return encoder.Encode(plainRuleSet)
-}

cmd/sing-box/cmd_geoip_list.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"os"
-
-	"github.com/sagernet/sing-box/log"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeoipList = &cobra.Command{
-	Use:   "list",
-	Short: "List geoip country codes",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := listGeoip()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.AddCommand(commandGeoipList)
-}
-
-func listGeoip() error {
-	for _, code := range geoipReader.Metadata.Languages {
-		os.Stdout.WriteString(code + "\n")
-	}
-	return nil
-}

cmd/sing-box/cmd_geoip_lookup.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"net/netip"
-	"os"
-
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-	N "github.com/sagernet/sing/common/network"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeoipLookup = &cobra.Command{
-	Use:   "lookup <address>",
-	Short: "Lookup if an IP address is contained in the GeoIP database",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geoipLookup(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoip.AddCommand(commandGeoipLookup)
-}
-
-func geoipLookup(address string) error {
-	addr, err := netip.ParseAddr(address)
-	if err != nil {
-		return E.Cause(err, "parse address")
-	}
-	if !N.IsPublicAddr(addr) {
-		os.Stdout.WriteString("private\n")
-		return nil
-	}
-	var code string
-	_ = geoipReader.Lookup(addr.AsSlice(), &code)
-	if code != "" {
-		os.Stdout.WriteString(code + "\n")
-		return nil
-	}
-	os.Stdout.WriteString("unknown\n")
-	return nil
-}

cmd/sing-box/cmd_geosite.go

@@ -1,41 +0,0 @@
-package main
-
-import (
-	"github.com/sagernet/sing-box/common/geosite"
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	commandGeoSiteFlagFile string
-	geositeReader          *geosite.Reader
-	geositeCodeList        []string
-)
-
-var commandGeoSite = &cobra.Command{
-	Use:   "geosite",
-	Short: "Geosite tools",
-	PersistentPreRun: func(cmd *cobra.Command, args []string) {
-		err := geositePreRun()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.PersistentFlags().StringVarP(&commandGeoSiteFlagFile, "file", "f", "geosite.db", "geosite file")
-	mainCommand.AddCommand(commandGeoSite)
-}
-
-func geositePreRun() error {
-	reader, codeList, err := geosite.Open(commandGeoSiteFlagFile)
-	if err != nil {
-		return E.Cause(err, "open geosite file")
-	}
-	geositeReader = reader
-	geositeCodeList = codeList
-	return nil
-}

cmd/sing-box/cmd_geosite_export.go

@@ -1,81 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"io"
-	"os"
-
-	"github.com/sagernet/sing-box/common/geosite"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeExportOutput string
-
-const commandGeositeExportDefaultOutput = "geosite-<category>.json"
-
-var commandGeositeExport = &cobra.Command{
-	Use:   "export <category>",
-	Short: "Export geosite category as rule-set",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geositeExport(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeositeExport.Flags().StringVarP(&commandGeositeExportOutput, "output", "o", commandGeositeExportDefaultOutput, "Output path")
-	commandGeoSite.AddCommand(commandGeositeExport)
-}
-
-func geositeExport(category string) error {
-	sourceSet, err := geositeReader.Read(category)
-	if err != nil {
-		return err
-	}
-	var (
-		outputFile   *os.File
-		outputWriter io.Writer
-	)
-	if commandGeositeExportOutput == "stdout" {
-		outputWriter = os.Stdout
-	} else if commandGeositeExportOutput == commandGeositeExportDefaultOutput {
-		outputFile, err = os.Create("geosite-" + category + ".json")
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	} else {
-		outputFile, err = os.Create(commandGeositeExportOutput)
-		if err != nil {
-			return err
-		}
-		defer outputFile.Close()
-		outputWriter = outputFile
-	}
-
-	encoder := json.NewEncoder(outputWriter)
-	encoder.SetIndent("", "  ")
-	var headlessRule option.DefaultHeadlessRule
-	defaultRule := geosite.Compile(sourceSet)
-	headlessRule.Domain = defaultRule.Domain
-	headlessRule.DomainSuffix = defaultRule.DomainSuffix
-	headlessRule.DomainKeyword = defaultRule.DomainKeyword
-	headlessRule.DomainRegex = defaultRule.DomainRegex
-	var plainRuleSet option.PlainRuleSetCompat
-	plainRuleSet.Version = C.RuleSetVersion1
-	plainRuleSet.Options.Rules = []option.HeadlessRule{
-		{
-			Type:           C.RuleTypeDefault,
-			DefaultOptions: headlessRule,
-		},
-	}
-	return encoder.Encode(plainRuleSet)
-}

cmd/sing-box/cmd_geosite_list.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"os"
-	"sort"
-
-	"github.com/sagernet/sing-box/log"
-	F "github.com/sagernet/sing/common/format"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeList = &cobra.Command{
-	Use:   "list <category>",
-	Short: "List geosite categories",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := geositeList()
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.AddCommand(commandGeositeList)
-}
-
-func geositeList() error {
-	var geositeEntry []struct {
-		category string
-		items    int
-	}
-	for _, category := range geositeCodeList {
-		sourceSet, err := geositeReader.Read(category)
-		if err != nil {
-			return err
-		}
-		geositeEntry = append(geositeEntry, struct {
-			category string
-			items    int
-		}{category, len(sourceSet)})
-	}
-	sort.SliceStable(geositeEntry, func(i, j int) bool {
-		return geositeEntry[i].items < geositeEntry[j].items
-	})
-	for _, entry := range geositeEntry {
-		os.Stdout.WriteString(F.ToString(entry.category, " (", entry.items, ")\n"))
-	}
-	return nil
-}

cmd/sing-box/cmd_geosite_lookup.go

@@ -1,97 +0,0 @@
-package main
-
-import (
-	"os"
-	"sort"
-
-	"github.com/sagernet/sing-box/log"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var commandGeositeLookup = &cobra.Command{
-	Use:   "lookup [category] <domain>",
-	Short: "Check if a domain is in the geosite",
-	Args:  cobra.RangeArgs(1, 2),
-	Run: func(cmd *cobra.Command, args []string) {
-		var (
-			source string
-			target string
-		)
-		switch len(args) {
-		case 1:
-			target = args[0]
-		case 2:
-			source = args[0]
-			target = args[1]
-		}
-		err := geositeLookup(source, target)
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandGeoSite.AddCommand(commandGeositeLookup)
-}
-
-func geositeLookup(source string, target string) error {
-	var sourceMatcherList []struct {
-		code    string
-		matcher *searchGeositeMatcher
-	}
-	if source != "" {
-		sourceSet, err := geositeReader.Read(source)
-		if err != nil {
-			return err
-		}
-		sourceMatcher, err := newSearchGeositeMatcher(sourceSet)
-		if err != nil {
-			return E.Cause(err, "compile code: "+source)
-		}
-		sourceMatcherList = []struct {
-			code    string
-			matcher *searchGeositeMatcher
-		}{
-			{
-				code:    source,
-				matcher: sourceMatcher,
-			},
-		}
-
-	} else {
-		for _, code := range geositeCodeList {
-			sourceSet, err := geositeReader.Read(code)
-			if err != nil {
-				return err
-			}
-			sourceMatcher, err := newSearchGeositeMatcher(sourceSet)
-			if err != nil {
-				return E.Cause(err, "compile code: "+code)
-			}
-			sourceMatcherList = append(sourceMatcherList, struct {
-				code    string
-				matcher *searchGeositeMatcher
-			}{
-				code:    code,
-				matcher: sourceMatcher,
-			})
-		}
-	}
-	sort.SliceStable(sourceMatcherList, func(i, j int) bool {
-		return sourceMatcherList[i].code < sourceMatcherList[j].code
-	})
-
-	for _, matcherItem := range sourceMatcherList {
-		if matchRule := matcherItem.matcher.Match(target); matchRule != "" {
-			os.Stdout.WriteString("Match code (")
-			os.Stdout.WriteString(matcherItem.code)
-			os.Stdout.WriteString(") ")
-			os.Stdout.WriteString(matchRule)
-			os.Stdout.WriteString("\n")
-		}
-	}
-	return nil
-}

cmd/sing-box/cmd_geosite_matcher.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/geosite"
-)
-
-type searchGeositeMatcher struct {
-	domainMap   map[string]bool
-	suffixList  []string
-	keywordList []string
-	regexList   []string
-}
-
-func newSearchGeositeMatcher(items []geosite.Item) (*searchGeositeMatcher, error) {
-	options := geosite.Compile(items)
-	domainMap := make(map[string]bool)
-	for _, domain := range options.Domain {
-		domainMap[domain] = true
-	}
-	rule := &searchGeositeMatcher{
-		domainMap:   domainMap,
-		suffixList:  options.DomainSuffix,
-		keywordList: options.DomainKeyword,
-		regexList:   options.DomainRegex,
-	}
-	return rule, nil
-}
-
-func (r *searchGeositeMatcher) Match(domain string) string {
-	if r.domainMap[domain] {
-		return "domain=" + domain
-	}
-	for _, suffix := range r.suffixList {
-		if strings.HasSuffix(domain, suffix) {
-			return "domain_suffix=" + suffix
-		}
-	}
-	for _, keyword := range r.keywordList {
-		if strings.Contains(domain, keyword) {
-			return "domain_keyword=" + keyword
-		}
-	}
-	for _, regexStr := range r.regexList {
-		regex, err := regexp.Compile(regexStr)
-		if err != nil {
-			continue
-		}
-		if regex.MatchString(domain) {
-			return "domain_regex=" + regexStr
-		}
-	}
-	return ""
-}

cmd/sing-box/cmd_merge.go

@@ -18,7 +18,7 @@ import (
 )
 
 var commandMerge = &cobra.Command{
-	Use:   "merge <output>",
+	Use:   "merge [output]",
 	Short: "Merge configurations",
 	Run: func(cmd *cobra.Command, args []string) {
 		err := merge(args[0])

cmd/sing-box/cmd_rule_set.go

@@ -1,14 +0,0 @@
-package main
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var commandRuleSet = &cobra.Command{
-	Use:   "rule-set",
-	Short: "Manage rule sets",
-}
-
-func init() {
-	mainCommand.AddCommand(commandRuleSet)
-}

cmd/sing-box/cmd_rule_set_compile.go

@@ -1,80 +0,0 @@
-package main
-
-import (
-	"io"
-	"os"
-	"strings"
-
-	"github.com/sagernet/sing-box/common/json"
-	"github.com/sagernet/sing-box/common/srs"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-
-	"github.com/spf13/cobra"
-)
-
-var flagRuleSetCompileOutput string
-
-const flagRuleSetCompileDefaultOutput = "<file_name>.srs"
-
-var commandRuleSetCompile = &cobra.Command{
-	Use:   "compile [source-path]",
-	Short: "Compile rule-set json to binary",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := compileRuleSet(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandRuleSet.AddCommand(commandRuleSetCompile)
-	commandRuleSetCompile.Flags().StringVarP(&flagRuleSetCompileOutput, "output", "o", flagRuleSetCompileDefaultOutput, "Output file")
-}
-
-func compileRuleSet(sourcePath string) error {
-	var (
-		reader io.Reader
-		err    error
-	)
-	if sourcePath == "stdin" {
-		reader = os.Stdin
-	} else {
-		reader, err = os.Open(sourcePath)
-		if err != nil {
-			return err
-		}
-	}
-	decoder := json.NewDecoder(json.NewCommentFilter(reader))
-	decoder.DisallowUnknownFields()
-	var plainRuleSet option.PlainRuleSetCompat
-	err = decoder.Decode(&plainRuleSet)
-	if err != nil {
-		return err
-	}
-	ruleSet := plainRuleSet.Upgrade()
-	var outputPath string
-	if flagRuleSetCompileOutput == flagRuleSetCompileDefaultOutput {
-		if strings.HasSuffix(sourcePath, ".json") {
-			outputPath = sourcePath[:len(sourcePath)-5] + ".srs"
-		} else {
-			outputPath = sourcePath + ".srs"
-		}
-	} else {
-		outputPath = flagRuleSetCompileOutput
-	}
-	outputFile, err := os.Create(outputPath)
-	if err != nil {
-		return err
-	}
-	err = srs.Write(outputFile, ruleSet)
-	if err != nil {
-		outputFile.Close()
-		os.Remove(outputPath)
-		return err
-	}
-	outputFile.Close()
-	return nil
-}

cmd/sing-box/cmd_rule_set_format.go

@@ -1,87 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-
-	"github.com/sagernet/sing-box/common/json"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	"github.com/spf13/cobra"
-)
-
-var commandRuleSetFormatFlagWrite bool
-
-var commandRuleSetFormat = &cobra.Command{
-	Use:   "format <source-path>",
-	Short: "Format rule-set json",
-	Args:  cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		err := formatRuleSet(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-}
-
-func init() {
-	commandRuleSetFormat.Flags().BoolVarP(&commandRuleSetFormatFlagWrite, "write", "w", false, "write result to (source) file instead of stdout")
-	commandRuleSet.AddCommand(commandRuleSetFormat)
-}
-
-func formatRuleSet(sourcePath string) error {
-	var (
-		reader io.Reader
-		err    error
-	)
-	if sourcePath == "stdin" {
-		reader = os.Stdin
-	} else {
-		reader, err = os.Open(sourcePath)
-		if err != nil {
-			return err
-		}
-	}
-	content, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	decoder := json.NewDecoder(json.NewCommentFilter(bytes.NewReader(content)))
-	decoder.DisallowUnknownFields()
-	var plainRuleSet option.PlainRuleSetCompat
-	err = decoder.Decode(&plainRuleSet)
-	if err != nil {
-		return err
-	}
-	ruleSet := plainRuleSet.Upgrade()
-	buffer := new(bytes.Buffer)
-	encoder := json.NewEncoder(buffer)
-	encoder.SetIndent("", "  ")
-	err = encoder.Encode(ruleSet)
-	if err != nil {
-		return E.Cause(err, "encode config")
-	}
-	outputPath, _ := filepath.Abs(sourcePath)
-	if !commandRuleSetFormatFlagWrite || sourcePath == "stdin" {
-		os.Stdout.WriteString(buffer.String() + "\n")
-		return nil
-	}
-	if bytes.Equal(content, buffer.Bytes()) {
-		return nil
-	}
-	output, err := os.Create(sourcePath)
-	if err != nil {
-		return E.Cause(err, "open output")
-	}
-	_, err = output.Write(buffer.Bytes())
-	output.Close()
-	if err != nil {
-		return E.Cause(err, "write output")
-	}
-	os.Stderr.WriteString(outputPath + "\n")
-	return nil
-}

cmd/sing-box/cmd_tools.go

@@ -38,7 +38,11 @@ func createPreStartedClient() (*box.Box, error) {
 
 func createDialer(instance *box.Box, network string, outboundTag string) (N.Dialer, error) {
 	if outboundTag == "" {
-		return instance.Router().DefaultOutbound(N.NetworkName(network))
+		outbound := instance.Router().DefaultOutbound(N.NetworkName(network))
+		if outbound == nil {
+			return nil, E.New("missing default outbound")
+		}
+		return outbound, nil
 	} else {
 		outbound, loaded := instance.Router().Outbound(outboundTag)
 		if !loaded {

cmd/sing-box/cmd_tools_connect.go

@@ -18,7 +18,7 @@ import (
 var commandConnectFlagNetwork string
 
 var commandConnect = &cobra.Command{
-	Use:   "connect <address>",
+	Use:   "connect [address]",
 	Short: "Connect to an address",
 	Args:  cobra.ExactArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {

common/dialer/router.go

@@ -18,19 +18,11 @@ func NewRouter(router adapter.Router) N.Dialer {
 }
 
 func (d *RouterDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	dialer, err := d.router.DefaultOutbound(network)
-	if err != nil {
-		return nil, err
-	}
-	return dialer.DialContext(ctx, network, destination)
+	return d.router.DefaultOutbound(network).DialContext(ctx, network, destination)
 }
 
 func (d *RouterDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	dialer, err := d.router.DefaultOutbound(N.NetworkUDP)
-	if err != nil {
-		return nil, err
-	}
-	return dialer.ListenPacket(ctx, destination)
+	return d.router.DefaultOutbound(N.NetworkUDP).ListenPacket(ctx, destination)
 }
 
 func (d *RouterDialer) Upstream() any {

common/sniff/quic.go

@@ -182,52 +182,11 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 			break
 		}
 		switch frameType {
-		case 0x00: // PADDING
+		case 0x0:
 			continue
-		case 0x01: // PING
+		case 0x1:
 			continue
-		case 0x02, 0x03: // ACK
-			_, err = qtls.ReadUvarint(decryptedReader) // Largest Acknowledged
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // ACK Delay
-			if err != nil {
-				return nil, err
-			}
-			ackRangeCount, err := qtls.ReadUvarint(decryptedReader) // ACK Range Count
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // First ACK Range
-			if err != nil {
-				return nil, err
-			}
-			for i := 0; i < int(ackRangeCount); i++ {
-				_, err = qtls.ReadUvarint(decryptedReader) // Gap
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ACK Range Length
-				if err != nil {
-					return nil, err
-				}
-			}
-			if frameType == 0x03 {
-				_, err = qtls.ReadUvarint(decryptedReader) // ECT0 Count
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ECT1 Count
-				if err != nil {
-					return nil, err
-				}
-				_, err = qtls.ReadUvarint(decryptedReader) // ECN-CE Count
-				if err != nil {
-					return nil, err
-				}
-			}
-		case 0x06: // CRYPTO
+		case 0x6:
 			var offset uint64
 			offset, err = qtls.ReadUvarint(decryptedReader)
 			if err != nil {
@@ -249,26 +208,8 @@ func QUICClientHello(ctx context.Context, packet []byte) (*adapter.InboundContex
 			if err != nil {
 				return nil, err
 			}
-		case 0x1c: // CONNECTION_CLOSE
-			_, err = qtls.ReadUvarint(decryptedReader) // Error Code
-			if err != nil {
-				return nil, err
-			}
-			_, err = qtls.ReadUvarint(decryptedReader) // Frame Type
-			if err != nil {
-				return nil, err
-			}
-			var length uint64
-			length, err = qtls.ReadUvarint(decryptedReader) // Reason Phrase Length
-			if err != nil {
-				return nil, err
-			}
-			_, err = decryptedReader.Seek(int64(length), io.SeekCurrent) // Reason Phrase
-			if err != nil {
-				return nil, err
-			}
 		default:
-			return nil, os.ErrInvalid
+			// ignore unknown frame type
 		}
 	}
 	tlsHdr := make([]byte, 5)

common/srs/binary.go

@@ -1,485 +0,0 @@
-package srs
-
-import (
-	"compress/zlib"
-	"encoding/binary"
-	"io"
-	"net/netip"
-
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/domain"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/rw"
-
-	"go4.org/netipx"
-)
-
-var MagicBytes = [3]byte{0x53, 0x52, 0x53} // SRS
-
-const (
-	ruleItemQueryType uint8 = iota
-	ruleItemNetwork
-	ruleItemDomain
-	ruleItemDomainKeyword
-	ruleItemDomainRegex
-	ruleItemSourceIPCIDR
-	ruleItemIPCIDR
-	ruleItemSourcePort
-	ruleItemSourcePortRange
-	ruleItemPort
-	ruleItemPortRange
-	ruleItemProcessName
-	ruleItemProcessPath
-	ruleItemPackageName
-	ruleItemWIFISSID
-	ruleItemWIFIBSSID
-	ruleItemFinal uint8 = 0xFF
-)
-
-func Read(reader io.Reader, recovery bool) (ruleSet option.PlainRuleSet, err error) {
-	var magicBytes [3]byte
-	_, err = io.ReadFull(reader, magicBytes[:])
-	if err != nil {
-		return
-	}
-	if magicBytes != MagicBytes {
-		err = E.New("invalid sing-box rule set file")
-		return
-	}
-	var version uint8
-	err = binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return ruleSet, err
-	}
-	if version != 1 {
-		return ruleSet, E.New("unsupported version: ", version)
-	}
-	zReader, err := zlib.NewReader(reader)
-	if err != nil {
-		return
-	}
-	length, err := rw.ReadUVariant(zReader)
-	if err != nil {
-		return
-	}
-	ruleSet.Rules = make([]option.HeadlessRule, length)
-	for i := uint64(0); i < length; i++ {
-		ruleSet.Rules[i], err = readRule(zReader, recovery)
-		if err != nil {
-			err = E.Cause(err, "read rule[", i, "]")
-			return
-		}
-	}
-	return
-}
-
-func Write(writer io.Writer, ruleSet option.PlainRuleSet) error {
-	_, err := writer.Write(MagicBytes[:])
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	zWriter, err := zlib.NewWriterLevel(writer, zlib.BestCompression)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(zWriter, uint64(len(ruleSet.Rules)))
-	if err != nil {
-		return err
-	}
-	for _, rule := range ruleSet.Rules {
-		err = writeRule(zWriter, rule)
-		if err != nil {
-			return err
-		}
-	}
-	return zWriter.Close()
-}
-
-func readRule(reader io.Reader, recovery bool) (rule option.HeadlessRule, err error) {
-	var ruleType uint8
-	err = binary.Read(reader, binary.BigEndian, &ruleType)
-	if err != nil {
-		return
-	}
-	switch ruleType {
-	case 0:
-		rule.DefaultOptions, err = readDefaultRule(reader, recovery)
-	case 1:
-		rule.LogicalOptions, err = readLogicalRule(reader, recovery)
-	default:
-		err = E.New("unknown rule type: ", ruleType)
-	}
-	return
-}
-
-func writeRule(writer io.Writer, rule option.HeadlessRule) error {
-	switch rule.Type {
-	case C.RuleTypeDefault:
-		return writeDefaultRule(writer, rule.DefaultOptions)
-	case C.RuleTypeLogical:
-		return writeLogicalRule(writer, rule.LogicalOptions)
-	default:
-		panic("unknown rule type: " + rule.Type)
-	}
-}
-
-func readDefaultRule(reader io.Reader, recovery bool) (rule option.DefaultHeadlessRule, err error) {
-	var lastItemType uint8
-	for {
-		var itemType uint8
-		err = binary.Read(reader, binary.BigEndian, &itemType)
-		if err != nil {
-			return
-		}
-		switch itemType {
-		case ruleItemQueryType:
-			var rawQueryType []uint16
-			rawQueryType, err = readRuleItemUint16(reader)
-			if err != nil {
-				return
-			}
-			rule.QueryType = common.Map(rawQueryType, func(it uint16) option.DNSQueryType {
-				return option.DNSQueryType(it)
-			})
-		case ruleItemNetwork:
-			rule.Network, err = readRuleItemString(reader)
-		case ruleItemDomain:
-			var matcher *domain.Matcher
-			matcher, err = domain.ReadMatcher(reader)
-			if err != nil {
-				return
-			}
-			rule.DomainMatcher = matcher
-		case ruleItemDomainKeyword:
-			rule.DomainKeyword, err = readRuleItemString(reader)
-		case ruleItemDomainRegex:
-			rule.DomainRegex, err = readRuleItemString(reader)
-		case ruleItemSourceIPCIDR:
-			rule.SourceIPSet, err = readIPSet(reader)
-			if err != nil {
-				return
-			}
-			if recovery {
-				rule.SourceIPCIDR = common.Map(rule.SourceIPSet.Prefixes(), netip.Prefix.String)
-			}
-		case ruleItemIPCIDR:
-			rule.IPSet, err = readIPSet(reader)
-			if err != nil {
-				return
-			}
-			if recovery {
-				rule.IPCIDR = common.Map(rule.IPSet.Prefixes(), netip.Prefix.String)
-			}
-		case ruleItemSourcePort:
-			rule.SourcePort, err = readRuleItemUint16(reader)
-		case ruleItemSourcePortRange:
-			rule.SourcePortRange, err = readRuleItemString(reader)
-		case ruleItemPort:
-			rule.Port, err = readRuleItemUint16(reader)
-		case ruleItemPortRange:
-			rule.PortRange, err = readRuleItemString(reader)
-		case ruleItemProcessName:
-			rule.ProcessName, err = readRuleItemString(reader)
-		case ruleItemProcessPath:
-			rule.ProcessPath, err = readRuleItemString(reader)
-		case ruleItemPackageName:
-			rule.PackageName, err = readRuleItemString(reader)
-		case ruleItemWIFISSID:
-			rule.WIFISSID, err = readRuleItemString(reader)
-		case ruleItemWIFIBSSID:
-			rule.WIFIBSSID, err = readRuleItemString(reader)
-		case ruleItemFinal:
-			err = binary.Read(reader, binary.BigEndian, &rule.Invert)
-			return
-		default:
-			err = E.New("unknown rule item type: ", itemType, ", last type: ", lastItemType)
-		}
-		if err != nil {
-			return
-		}
-		lastItemType = itemType
-	}
-}
-
-func writeDefaultRule(writer io.Writer, rule option.DefaultHeadlessRule) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(0))
-	if err != nil {
-		return err
-	}
-	if len(rule.QueryType) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemQueryType, common.Map(rule.QueryType, func(it option.DNSQueryType) uint16 {
-			return uint16(it)
-		}))
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Network) > 0 {
-		err = writeRuleItemString(writer, ruleItemNetwork, rule.Network)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Domain) > 0 || len(rule.DomainSuffix) > 0 {
-		err = binary.Write(writer, binary.BigEndian, ruleItemDomain)
-		if err != nil {
-			return err
-		}
-		err = domain.NewMatcher(rule.Domain, rule.DomainSuffix).Write(writer)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.DomainKeyword) > 0 {
-		err = writeRuleItemString(writer, ruleItemDomainKeyword, rule.DomainKeyword)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.DomainRegex) > 0 {
-		err = writeRuleItemString(writer, ruleItemDomainRegex, rule.DomainRegex)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.SourceIPCIDR) > 0 {
-		err = writeRuleItemCIDR(writer, ruleItemSourceIPCIDR, rule.SourceIPCIDR)
-		if err != nil {
-			return E.Cause(err, "source_ipcidr")
-		}
-	}
-	if len(rule.IPCIDR) > 0 {
-		err = writeRuleItemCIDR(writer, ruleItemIPCIDR, rule.IPCIDR)
-		if err != nil {
-			return E.Cause(err, "ipcidr")
-		}
-	}
-	if len(rule.SourcePort) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemSourcePort, rule.SourcePort)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.SourcePortRange) > 0 {
-		err = writeRuleItemString(writer, ruleItemSourcePortRange, rule.SourcePortRange)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.Port) > 0 {
-		err = writeRuleItemUint16(writer, ruleItemPort, rule.Port)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.PortRange) > 0 {
-		err = writeRuleItemString(writer, ruleItemPortRange, rule.PortRange)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.ProcessName) > 0 {
-		err = writeRuleItemString(writer, ruleItemProcessName, rule.ProcessName)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.ProcessPath) > 0 {
-		err = writeRuleItemString(writer, ruleItemProcessPath, rule.ProcessPath)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.PackageName) > 0 {
-		err = writeRuleItemString(writer, ruleItemPackageName, rule.PackageName)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.WIFISSID) > 0 {
-		err = writeRuleItemString(writer, ruleItemWIFISSID, rule.WIFISSID)
-		if err != nil {
-			return err
-		}
-	}
-	if len(rule.WIFIBSSID) > 0 {
-		err = writeRuleItemString(writer, ruleItemWIFIBSSID, rule.WIFIBSSID)
-		if err != nil {
-			return err
-		}
-	}
-	err = binary.Write(writer, binary.BigEndian, ruleItemFinal)
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, rule.Invert)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func readRuleItemString(reader io.Reader) ([]string, error) {
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return nil, err
-	}
-	value := make([]string, length)
-	for i := uint64(0); i < length; i++ {
-		value[i], err = rw.ReadVString(reader)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return value, nil
-}
-
-func writeRuleItemString(writer io.Writer, itemType uint8, value []string) error {
-	err := binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(value)))
-	if err != nil {
-		return err
-	}
-	for _, item := range value {
-		err = rw.WriteVString(writer, item)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func readRuleItemUint16(reader io.Reader) ([]uint16, error) {
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return nil, err
-	}
-	value := make([]uint16, length)
-	for i := uint64(0); i < length; i++ {
-		err = binary.Read(reader, binary.BigEndian, &value[i])
-		if err != nil {
-			return nil, err
-		}
-	}
-	return value, nil
-}
-
-func writeRuleItemUint16(writer io.Writer, itemType uint8, value []uint16) error {
-	err := binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(value)))
-	if err != nil {
-		return err
-	}
-	for _, item := range value {
-		err = binary.Write(writer, binary.BigEndian, item)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func writeRuleItemCIDR(writer io.Writer, itemType uint8, value []string) error {
-	var builder netipx.IPSetBuilder
-	for i, prefixString := range value {
-		prefix, err := netip.ParsePrefix(prefixString)
-		if err == nil {
-			builder.AddPrefix(prefix)
-			continue
-		}
-		addr, addrErr := netip.ParseAddr(prefixString)
-		if addrErr == nil {
-			builder.Add(addr)
-			continue
-		}
-		return E.Cause(err, "parse [", i, "]")
-	}
-	ipSet, err := builder.IPSet()
-	if err != nil {
-		return err
-	}
-	err = binary.Write(writer, binary.BigEndian, itemType)
-	if err != nil {
-		return err
-	}
-	return writeIPSet(writer, ipSet)
-}
-
-func readLogicalRule(reader io.Reader, recovery bool) (logicalRule option.LogicalHeadlessRule, err error) {
-	var mode uint8
-	err = binary.Read(reader, binary.BigEndian, &mode)
-	if err != nil {
-		return
-	}
-	switch mode {
-	case 0:
-		logicalRule.Mode = C.LogicalTypeAnd
-	case 1:
-		logicalRule.Mode = C.LogicalTypeOr
-	default:
-		err = E.New("unknown logical mode: ", mode)
-		return
-	}
-	length, err := rw.ReadUVariant(reader)
-	if err != nil {
-		return
-	}
-	logicalRule.Rules = make([]option.HeadlessRule, length)
-	for i := uint64(0); i < length; i++ {
-		logicalRule.Rules[i], err = readRule(reader, recovery)
-		if err != nil {
-			err = E.Cause(err, "read logical rule [", i, "]")
-			return
-		}
-	}
-	err = binary.Read(reader, binary.BigEndian, &logicalRule.Invert)
-	if err != nil {
-		return
-	}
-	return
-}
-
-func writeLogicalRule(writer io.Writer, logicalRule option.LogicalHeadlessRule) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	switch logicalRule.Mode {
-	case C.LogicalTypeAnd:
-		err = binary.Write(writer, binary.BigEndian, uint8(0))
-	case C.LogicalTypeOr:
-		err = binary.Write(writer, binary.BigEndian, uint8(1))
-	default:
-		panic("unknown logical mode: " + logicalRule.Mode)
-	}
-	if err != nil {
-		return err
-	}
-	err = rw.WriteUVariant(writer, uint64(len(logicalRule.Rules)))
-	if err != nil {
-		return err
-	}
-	for _, rule := range logicalRule.Rules {
-		err = writeRule(writer, rule)
-		if err != nil {
-			return err
-		}
-	}
-	err = binary.Write(writer, binary.BigEndian, logicalRule.Invert)
-	if err != nil {
-		return err
-	}
-	return nil
-}

common/srs/ip_set.go

@@ -1,116 +0,0 @@
-package srs
-
-import (
-	"encoding/binary"
-	"io"
-	"net/netip"
-	"unsafe"
-
-	"github.com/sagernet/sing/common/rw"
-
-	"go4.org/netipx"
-)
-
-type myIPSet struct {
-	rr []myIPRange
-}
-
-type myIPRange struct {
-	from netip.Addr
-	to   netip.Addr
-}
-
-func readIPSet(reader io.Reader) (*netipx.IPSet, error) {
-	var version uint8
-	err := binary.Read(reader, binary.BigEndian, &version)
-	if err != nil {
-		return nil, err
-	}
-	var length uint64
-	err = binary.Read(reader, binary.BigEndian, &length)
-	if err != nil {
-		return nil, err
-	}
-	mySet := &myIPSet{
-		rr: make([]myIPRange, length),
-	}
-	for i := uint64(0); i < length; i++ {
-		var (
-			fromLen  uint64
-			toLen    uint64
-			fromAddr netip.Addr
-			toAddr   netip.Addr
-		)
-		fromLen, err = rw.ReadUVariant(reader)
-		if err != nil {
-			return nil, err
-		}
-		fromBytes := make([]byte, fromLen)
-		_, err = io.ReadFull(reader, fromBytes)
-		if err != nil {
-			return nil, err
-		}
-		err = fromAddr.UnmarshalBinary(fromBytes)
-		if err != nil {
-			return nil, err
-		}
-		toLen, err = rw.ReadUVariant(reader)
-		if err != nil {
-			return nil, err
-		}
-		toBytes := make([]byte, toLen)
-		_, err = io.ReadFull(reader, toBytes)
-		if err != nil {
-			return nil, err
-		}
-		err = toAddr.UnmarshalBinary(toBytes)
-		if err != nil {
-			return nil, err
-		}
-		mySet.rr[i] = myIPRange{fromAddr, toAddr}
-	}
-	return (*netipx.IPSet)(unsafe.Pointer(mySet)), nil
-}
-
-func writeIPSet(writer io.Writer, set *netipx.IPSet) error {
-	err := binary.Write(writer, binary.BigEndian, uint8(1))
-	if err != nil {
-		return err
-	}
-	mySet := (*myIPSet)(unsafe.Pointer(set))
-	err = binary.Write(writer, binary.BigEndian, uint64(len(mySet.rr)))
-	if err != nil {
-		return err
-	}
-	for _, rr := range mySet.rr {
-		var (
-			fromBinary []byte
-			toBinary   []byte
-		)
-		fromBinary, err = rr.from.MarshalBinary()
-		if err != nil {
-			return err
-		}
-		err = rw.WriteUVariant(writer, uint64(len(fromBinary)))
-		if err != nil {
-			return err
-		}
-		_, err = writer.Write(fromBinary)
-		if err != nil {
-			return err
-		}
-		toBinary, err = rr.to.MarshalBinary()
-		if err != nil {
-			return err
-		}
-		err = rw.WriteUVariant(writer, uint64(len(toBinary)))
-		if err != nil {
-			return err
-		}
-		_, err = writer.Write(toBinary)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}

constant/rule.go

@@ -9,11 +9,3 @@ const (
 	LogicalTypeAnd = "and"
 	LogicalTypeOr  = "or"
 )
-
-const (
-	RuleSetTypeLocal    = "local"
-	RuleSetTypeRemote   = "remote"
-	RuleSetVersion1     = 1
-	RuleSetFormatSource = "source"
-	RuleSetFormatBinary = "binary"
-)

docs/changelog.md

@@ -1,133 +1,4 @@
----
-icon: material/alert-decagram
----
-
-# ChangeLog
-
-#### 1.8.0-alpha.3
-
-* Parallel rule-set initialization
-* Independent `source_ip_is_private` and `ip_is_private` rules **1**
-
-**1**:
-
-The `private` GeoIP country never existed and was actually implemented inside V2Ray. 
-Since GeoIP was deprecated, we made this rule independent, see [Migration](/migration/#migrate-geoip-to-rule-sets).
-
-#### 1.8.0-alpha.1
-
-* Migrate cache file from Clash API to independent options **1**
-* Introducing [Rule Set](/configuration/rule-set) **2**
-* Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands **3**
-* Allow nested logical rules **4**
-
-**1**:
-
-See [Cache File](/configuration/experimental/cache-file) and
-[Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).
-
-**2**:
-
-Rule set is independent collections of rules that can be compiled into binaries to improve performance.
-Compared to legacy GeoIP and Geosite resources,
-it can include more types of rules, load faster,
-use less memory, and update automatically.
-
-See [Route#rule_set](/configuration/route/#rule_set),
-[Route Rule](/configuration/route/rule),
-[DNS Rule](/configuration/dns/rule),
-[Rule Set](/configuration/rule-set),
-[Source Format](/configuration/rule-set/source-format) and
-[Headless Rule](/configuration/rule-set/headless-rule).
-
-For GEO resources migration, see [Migrate GeoIP to rule sets](/migration/#migrate-geoip-to-rule-sets) and
-[Migrate Geosite to rule sets](/migration/#migrate-geosite-to-rule-sets).
-
-**3**:
-
-New commands manage GeoIP, Geosite and rule set resources, and help you migrate GEO resources to rule sets.
-
-**4**:
-
-Logical rules in route rules, DNS rules, and the new headless rule now allow nesting of logical rules.
-
-#### 1.7.0
-
-* Fixes and improvements
-
-Important changes since 1.6:
-
-* Add [exclude route support](/configuration/inbound/tun) for TUN inbound
-* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen) **1**
-* Add [HTTPUpgrade V2Ray transport](/configuration/shared/v2ray-transport#HTTPUpgrade) support **2**
-* Migrate multiplex and UoT server to inbound **3**
-* Add TCP Brutal support for multiplex **4**
-* Add `wifi_ssid` and `wifi_bssid` route and DNS rules **5**
-* Update quic-go to v0.40.0
-* Update gVisor to 20231113.0
-
-**1**:
-
-If enabled, for UDP proxy requests addressed to a domain,
-the original packet address will be sent in the response instead of the mapped domain.
-
-This option is used for compatibility with clients that
-do not support receiving UDP packets with domain addresses, such as Surge.
-
-**2**:
-
-Introduced in V2Ray 5.10.0.
-
-The new HTTPUpgrade transport has better performance than WebSocket and is better suited for CDN abuse.
-
-**3**:
-
-Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound options.
-
-**4**
-
-Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server, see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
-
-**5**:
-
-Only supported in graphical clients on Android and iOS.
-
-#### 1.7.0-rc.3
-
-* Fixes and improvements
-
-#### 1.6.7
-
-* macOS: Add button for uninstall SystemExtension in the standalone graphical client
-* Fix missing UDP user context on TUIC/Hysteria2 inbounds
-* Fixes and improvements
-
-#### 1.7.0-rc.2
-
-* Fix missing UDP user context on TUIC/Hysteria2 inbounds
-* macOS: Add button for uninstall SystemExtension in the standalone graphical client
-
-#### 1.6.6
-
-* Fixes and improvements
-
-#### 1.7.0-rc.1
-
-* Fixes and improvements
-
-#### 1.7.0-beta.5
-
-* Update gVisor to 20231113.0
-* Fixes and improvements
-
-#### 1.7.0-beta.4
-
-* Add `wifi_ssid` and `wifi_bssid` route and DNS rules **1**
-* Fixes and improvements
-
-**1**:
-
-Only supported in graphical clients on Android and iOS.
+# :material-alert-decagram: ChangeLog
 
 #### 1.7.0-beta.3
 
@@ -189,13 +60,11 @@ Only supported in graphical clients on Android and iOS.
 
 **1**:
 
-Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound
-options.
+Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound options.
 
 **2**
 
-Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
-see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
+Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server, see [TCP Brutal](/configuration/shared/tcp-brutal) for details.
 
 #### 1.7.0-alpha.3
 
@@ -262,8 +131,8 @@ When `auto_route` is enabled and `strict_route` is disabled, the device can now
 
 **2**:
 
-Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
-Sierra, 10.14 Mojave.
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High Sierra, 10.14 Mojave.
+
 
 #### 1.6.0-rc.4
 
@@ -276,8 +145,7 @@ Sierra, 10.14 Mojave.
 
 **1**:
 
-Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
-Sierra, 10.14 Mojave.
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High Sierra, 10.14 Mojave.
 
 #### 1.6.0-beta.4
 

docs/clients/android/features.md

@@ -12,38 +12,28 @@ SFA allows you to run sing-box through ForegroundService or VpnService (when TUN
 
 SFA provides an unprivileged TUN implementation through Android VpnService.
 
-| TUN inbound option            | Available        | Note               |
-|-------------------------------|------------------|--------------------|
-| `interface_name`              | :material-close: | Managed by Android |
-| `inet4_address`               | :material-check: | /                  |
-| `inet6_address`               | :material-check: | /                  |
-| `mtu`                         | :material-check: | /                  |
-| `auto_route`                  | :material-check: | /                  |
-| `strict_route`                | :material-close: | Not implemented    |
-| `inet4_route_address`         | :material-check: | /                  |
-| `inet6_route_address`         | :material-check: | /                  |
-| `inet4_route_exclude_address` | :material-check: | /                  |
-| `inet6_route_exclude_address` | :material-check: | /                  |
-| `endpoint_independent_nat`    | :material-check: | /                  |
-| `stack`                       | :material-check: | /                  |
-| `include_interface`           | :material-close: | No permission      |
-| `exclude_interface`           | :material-close: | No permission      |
-| `include_uid`                 | :material-close: | No permission      |
-| `exclude_uid`                 | :material-close: | No permission      |
-| `include_android_user`        | :material-close: | No permission      |
-| `include_package`             | :material-check: | /                  |
-| `exclude_package`             | :material-check: | /                  |
-| `platform`                    | :material-check: | /                  |
-
-| Route/DNS rule option | Available        | Note                              |
-|-----------------------|------------------|-----------------------------------|
-| `process_name`        | :material-close: | No permission                     |
-| `process_path`        | :material-close: | No permission                     |
-| `package_name`        | :material-check: | /                                 |
-| `user`                | :material-close: | Use `package_name` instead        |
-| `user_id`             | :material-close: | Use `package_name` instead        |
-| `wifi_ssid`           | :material-check: | Fine location permission required |
-| `wifi_bssid`          | :material-check: | Fine location permission required |
+| TUN inbound option            | Available | Note               |
+|-------------------------------|-----------|--------------------|
+| `interface_name`              | ✖️        | Managed by Android |
+| `inet4_address`               | ✔️        | /                  |
+| `inet6_address`               | ✔️        | /                  |
+| `mtu`                         | ✔️        | /                  |
+| `auto_route`                  | ✔️        | /                  |
+| `strict_route`                | ✖️        | Not implemented    |
+| `inet4_route_address`         | ✔️        | /                  |
+| `inet6_route_address`         | ✔️        | /                  |
+| `inet4_route_exclude_address` | ✔️        | /                  |
+| `inet6_route_exclude_address` | ✔️        | /                  |
+| `endpoint_independent_nat`    | ✔️        | /                  |
+| `stack`                       | ✔️        | /                  |
+| `include_interface`           | ✖️        | No permission      |
+| `exclude_interface`           | ✖️        | No permission      |
+| `include_uid`                 | ✖️        | No permission      |
+| `exclude_uid`                 | ✖️        | No permission      |
+| `include_android_user`        | ✖️        | No permission      |
+| `include_package`             | ✔️        | /                  |
+| `exclude_package`             | ✔️        | /                  |
+| `platform`                    | ✔️        | /                  |
 
 ### Override
 

docs/clients/android/index.md

@@ -1,8 +1,4 @@
----
-icon: material/android
----
-
-# sing-box for Android
+# :material-android: sing-box for Android
 
 SFA allows users to manage and run local or remote sing-box configuration files, and provides
 platform-specific function implementation, such as TUN transparent proxy implementation.
@@ -15,8 +11,8 @@ platform-specific function implementation, such as TUN transparent proxy impleme
 
 * [Play Store](https://play.google.com/store/apps/details?id=io.nekohasekai.sfa)
 * [Play Store (Beta)](https://play.google.com/apps/testing/io.nekohasekai.sfa)
-* [GitHub Releases](https://github.com/SagerNet/sing-box/releases)
+* [Github Releases](https://github.com/SagerNet/sing-box/releases)
 
 ## :material-source-repository: Source code
 
-* [GitHub](https://github.com/SagerNet/sing-box-for-android)
+* [Github](https://github.com/SagerNet/sing-box-for-android)

docs/clients/apple/features.md

@@ -37,16 +37,6 @@ SFI/SFM/SFT provides an unprivileged TUN implementation through NetworkExtension
 | `exclude_package`             | ✖️        | Not implemented   |
 | `platform`                    | ✔️        | /                 |
 
-| Route/DNS rule option | Available        | Note                  |
-|-----------------------|------------------|-----------------------|
-| `process_name`        | :material-close: | No permission         |
-| `process_path`        | :material-close: | No permission         |
-| `package_name`        | :material-close: | /                     |
-| `user`                | :material-close: | No permission         |
-| `user_id`             | :material-close: | No permission         |
-| `wifi_ssid`           | :material-alert: | Only supported on iOS |
-| `wifi_bssid`          | :material-alert: | Only supported on iOS |
-
 ### Chore
 
 * Crash logs is located in `Settings` -> `View Service Log`

docs/clients/apple/index.md

@@ -1,8 +1,4 @@
----
-icon: material/apple
----
-
-# sing-box for Apple platforms
+# :material-apple: sing-box for Apple platforms
 
 SFI/SFM/SFT allows users to manage and run local or remote sing-box configuration files, and provides
 platform-specific function implementation, such as TUN transparent proxy implementation.
@@ -14,19 +10,9 @@ platform-specific function implementation, such as TUN transparent proxy impleme
 
 ## :material-download: Download
 
-* [App Store](https://apps.apple.com/us/app/sing-box/id6451272673)
+* [AppStore](https://apps.apple.com/us/app/sing-box/id6451272673)
 * [TestFlight (Beta)](https://testflight.apple.com/join/AcqO44FH)
 
-## :material-file-download: Download (macOS standalone version)
-
-* [Homebrew Cask](https://formulae.brew.sh/cask/sfm)
-
-```bash
-brew install sfm
-```
-
-* [GitHub Releases](https://github.com/SagerNet/sing-box/releases)
-
 ## :material-source-repository: Source code
 
-* [GitHub](https://github.com/SagerNet/sing-box-for-apple)
+* [Github](https://github.com/SagerNet/sing-box-for-apple)

docs/clients/general.md

@@ -1,8 +1,4 @@
----
-icon: material/pencil-ruler
----
-
-# General
+# :material-pencil-ruler: General
 
 Describes and explains the functions implemented uniformly by sing-box graphical clients.
 

docs/clients/index.md

@@ -6,7 +6,7 @@ Maintained by Project S to provide a unified experience and platform-specific fu
 |---------------------------------------|-----------------------------------------|
 | :material-android: Android            | [sing-box for Android](./android)       |
 | :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
-| :material-laptop: Desktop             | Working in progress                     |
+| TODO                                  | /                                       |
 
 Some third-party projects that claim to use sing-box or use sing-box as a selling point are not listed here. The core
 motivation of the maintainers of such projects is to acquire more users, and even though they provide friendly VPN

docs/clients/index.zh.md

@@ -6,7 +6,7 @@
 |---------------------------------------|-----------------------------------------|
 | :material-android: Android            | [sing-box for Android](./android)       |
 | :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
-| :material-laptop: Desktop             | 施工中                                     |
+| TODO                                  | /                                       |
 
 此处没有列出一些声称使用或以 sing-box 为卖点的第三方项目。此类项目维护者的动机是获得更多用户，即使它们提供友好的商业
 VPN 客户端功能， 但代码质量很差且包含广告。

docs/clients/privacy.md

@@ -1,8 +1,4 @@
----
-icon: material/security
----
-
-# Privacy policy
+# :material-security: Privacy policy
 
 sing-box and official graphics clients do not collect or share personal data,
 and the data generated by the software is always on your device.

docs/configuration/dns/rule.md

@@ -1,14 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [source_ip_is_private](#source_ip_is_private)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -57,7 +46,6 @@ icon: material/alert-decagram
           "10.0.0.0/24",
           "192.168.0.1"
         ],
-        "source_ip_is_private": false,
         "source_port": [
           12345
         ],
@@ -91,16 +79,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": [
           "direct"
@@ -182,29 +160,15 @@ Match domain using regular expression.
 
 #### geosite
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 Match geosite.
 
 #### source_geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match source geoip.
 
 #### source_ip_cidr
 
-Match source IP CIDR.
-
-#### source_ip_is_private
-
-!!! question "Since sing-box 1.8.0"
-
-Match non-public source IP.
+Match source ip cidr.
 
 #### source_port
 
@@ -224,7 +188,7 @@ Match port range.
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -232,7 +196,7 @@ Match process name.
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -244,7 +208,7 @@ Match android package name.
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -252,7 +216,7 @@ Match user name.
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -262,30 +226,6 @@ Match user id.
 
 Match Clash mode.
 
-#### wifi_ssid
-
-<!-- md:version 1.7.0-beta.4 -->
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-Match [Rule Set](/configuration/route/#rule_set).
-
 #### invert
 
 Invert match result.
@@ -322,4 +262,4 @@ Rewrite TTL in DNS responses.
 
 #### rules
 
-Included rules.
+Included default rules.

docs/configuration/dns/rule.zh.md

@@ -1,14 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [source_ip_is_private](#source_ip_is_private)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -56,7 +45,6 @@ icon: material/alert-decagram
         "source_ip_cidr": [
           "10.0.0.0/24"
         ],
-        "source_ip_is_private": false,
         "source_port": [
           12345
         ],
@@ -90,16 +78,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": [
           "direct"
@@ -179,30 +157,16 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### geosite
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
-
-匹配 Geosite。
+匹配 GeoSite。
 
 #### source_geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配源 GeoIP。
 
 #### source_ip_cidr
 
 匹配源 IP CIDR。
 
-#### source_ip_is_private
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配非公开源 IP。
-
 #### source_port
 
 匹配源端口。
@@ -221,7 +185,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -229,7 +193,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -241,7 +205,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 
@@ -249,7 +213,7 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 
@@ -259,28 +223,6 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 匹配 Clash 模式。
 
-#### wifi_ssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi SSID。
-
-#### wifi_bssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi BSSID。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配[规则集](/zh/configuration/route/#rule_set)。
-
 #### invert
 
 反选匹配结果。
@@ -317,4 +259,4 @@ DNS 查询类型。值可以为整数或者类型名称字符串。
 
 #### rules
 
-包括的规则。
+包括的默认规则。

docs/configuration/experimental/cache-file.md

@@ -1,34 +0,0 @@
----
-icon: material/new-box
----
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "enabled": true,
-  "path": "",
-  "cache_id": "",
-  "store_fakeip": false
-}
-```
-
-### Fields
-
-#### enabled
-
-Enable cache file.
-
-#### path
-
-Path to the cache file.
-
-`cache.db` will be used if empty.
-
-#### cache_id
-
-Identifier in cache file.
-
-If not empty, configuration specified data will use a separate store keyed by it.

docs/configuration/experimental/clash-api.md

@@ -1,121 +0,0 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-delete-alert: [store_mode](#store_mode)  
-    :material-delete-alert: [store_selected](#store_selected)  
-    :material-delete-alert: [store_fakeip](#store_fakeip)  
-    :material-delete-alert: [cache_file](#cache_file)  
-    :material-delete-alert: [cache_id](#cache_id)
-
-
-!!! quote ""
-
-    Clash API is not included by default, see [Installation](./#installation).
-
-### Structure
-
-```json
-{
-  "external_controller": "127.0.0.1:9090",
-  "external_ui": "",
-  "external_ui_download_url": "",
-  "external_ui_download_detour": "",
-  "secret": "",
-  "default_mode": "",
-  
-  // Deprecated
-  
-  "store_mode": false,
-  "store_selected": false,
-  "store_fakeip": false,
-  "cache_file": "",
-  "cache_id": ""
-}
-```
-
-### Fields
-
-#### external_controller
-
-RESTful web API listening address. Clash API will be disabled if empty.
-
-#### external_ui
-
-A relative path to the configuration directory or an absolute path to a
-directory in which you put some static web resource. sing-box will then
-serve it at `http://{{external-controller}}/ui`.
-
-
-
-#### external_ui_download_url
-
-ZIP download URL for the external UI, will be used if the specified `external_ui` directory is empty.
-
-`https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip` will be used if empty.
-
-#### external_ui_download_detour
-
-The tag of the outbound to download the external UI.
-
-Default outbound will be used if empty.
-
-#### secret
-
-Secret for the RESTful API (optional)
-Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
-ALWAYS set a secret if RESTful API is listening on 0.0.0.0
-
-#### default_mode
-
-Default mode in clash, `Rule` will be used if empty.
-
-This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
-
-#### store_mode
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_mode` is deprecated in Clash API and enabled by default if `cache_file.enabled`.
-
-Store Clash mode in cache file.
-
-#### store_selected
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_selected` is deprecated in Clash API and enabled by default if `cache_file.enabled`.
-
-!!! note ""
-
-    The tag must be set for target outbounds.
-
-Store selected outbound for the `Selector` outbound in cache file.
-
-#### store_fakeip
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `store_selected` is deprecated in Clash API and migrated to `cache_file.store_fakeip`.
-
-Store fakeip in cache file.
-
-#### cache_file
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `cache_file` is deprecated in Clash API and migrated to `cache_file.enabled` and `cache_file.path`.
-
-Cache file path, `cache.db` will be used if empty.
-
-#### cache_id
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    `cache_id` is deprecated in Clash API and migrated to `cache_file.cache_id`.
-
-Identifier in cache file.
-
-If not empty, configuration specified data will use a separate store keyed by it.

docs/configuration/experimental/index.md

@@ -1,30 +1,139 @@
----
-icon: material/alert-decagram
----
-
 # Experimental
 
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [cache_file](#cache_file)  
-    :material-alert-decagram: [clash_api](#clash_api)
-
 ### Structure
 
 ```json
 {
   "experimental": {
-    "cache_file": {},
-    "clash_api": {},
-    "v2ray_api": {}
+    "clash_api": {
+      "external_controller": "127.0.0.1:9090",
+      "external_ui": "",
+      "external_ui_download_url": "",
+      "external_ui_download_detour": "",
+      "secret": "",
+      "default_mode": "",
+      "store_mode": false,
+      "store_selected": false,
+      "store_fakeip": false,
+      "cache_file": "",
+      "cache_id": ""
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ],
+        "users": [
+          "sekai"
+        ]
+      }
+    }
   }
 }
 ```
 
-### Fields
+!!! note ""
 
-| Key          | Format                     |
-|--------------|----------------------------|
-| `cache_file` | [Cache File](./cache-file) |
-| `clash_api`  | [Clash API](./clash-api)   |
-| `v2ray_api`  | [V2Ray API](./v2ray-api)   |
+    Traffic statistics and connection management can degrade performance.
+
+### Clash API Fields
+
+!!! error ""
+
+    Clash API is not included by default, see [Installation](./#installation).
+
+#### external_controller
+
+RESTful web API listening address. Clash API will be disabled if empty.
+
+#### external_ui
+
+A relative path to the configuration directory or an absolute path to a
+directory in which you put some static web resource. sing-box will then
+serve it at `http://{{external-controller}}/ui`.
+
+#### external_ui_download_url
+
+ZIP download URL for the external UI, will be used if the specified `external_ui` directory is empty.
+
+`https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip` will be used if empty.
+
+#### external_ui_download_detour
+
+The tag of the outbound to download the external UI.
+
+Default outbound will be used if empty.
+
+#### secret
+
+Secret for the RESTful API (optional)
+Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
+ALWAYS set a secret if RESTful API is listening on 0.0.0.0
+
+#### default_mode
+
+Default mode in clash, `Rule` will be used if empty.
+
+This setting has no direct effect, but can be used in routing and DNS rules via the `clash_mode` rule item.
+
+#### store_mode
+
+Store Clash mode in cache file.
+
+#### store_selected
+
+!!! note ""
+
+    The tag must be set for target outbounds.
+
+Store selected outbound for the `Selector` outbound in cache file.
+
+#### store_fakeip
+
+Store fakeip in cache file.
+
+#### cache_file
+
+Cache file path, `cache.db` will be used if empty.
+
+#### cache_id
+
+Cache ID.
+
+If not empty, `store_selected` will use a separate store keyed by it.
+
+### V2Ray API Fields
+
+!!! error ""
+
+    V2Ray API is not included by default, see [Installation](./#installation).
+
+#### listen
+
+gRPC API listening address. V2Ray API will be disabled if empty.
+
+#### stats
+
+Traffic statistics service settings.
+
+#### stats.enabled
+
+Enable statistics service.
+
+#### stats.inbounds
+
+Inbound list to count traffic.
+
+#### stats.outbounds
+
+Outbound list to count traffic.
+
+#### stats.users
+
+User list to count traffic.

docs/configuration/experimental/index.zh.md

@@ -0,0 +1,137 @@
+# 实验性
+
+### 结构
+
+```json
+{
+  "experimental": {
+    "clash_api": {
+      "external_controller": "127.0.0.1:9090",
+      "external_ui": "",
+      "external_ui_download_url": "",
+      "external_ui_download_detour": "",
+      "secret": "",
+      "default_mode": "",
+      "store_mode": false,
+      "store_selected": false,
+      "store_fakeip": false,
+      "cache_file": "",
+      "cache_id": ""
+    },
+    "v2ray_api": {
+      "listen": "127.0.0.1:8080",
+      "stats": {
+        "enabled": true,
+        "inbounds": [
+          "socks-in"
+        ],
+        "outbounds": [
+          "proxy",
+          "direct"
+        ],
+        "users": [
+          "sekai"
+        ]
+      }
+    }
+  }
+}
+```
+
+!!! note ""
+
+    流量统计和连接管理会降低性能。
+
+### Clash API 字段
+
+!!! error ""
+
+    默认安装不包含 Clash API，参阅 [安装](/zh/#_2)。
+
+#### external_controller
+
+RESTful web API 监听地址。如果为空，则禁用 Clash API。
+
+#### external_ui
+
+到静态网页资源目录的相对路径或绝对路径。sing-box 会在 `http://{{external-controller}}/ui` 下提供它。
+
+#### external_ui_download_url
+
+静态网页资源的 ZIP 下载 URL，如果指定的 `external_ui` 目录为空，将使用。
+
+默认使用 `https://github.com/MetaCubeX/Yacd-meta/archive/gh-pages.zip`。
+
+#### external_ui_download_detour
+
+用于下载静态网页资源的出站的标签。
+
+如果为空，将使用默认出站。
+
+#### secret
+
+RESTful API 的密钥（可选）
+通过指定 HTTP 标头 `Authorization: Bearer ${secret}` 进行身份验证
+如果 RESTful API 正在监听 0.0.0.0，请始终设置一个密钥。
+
+#### default_mode
+
+Clash 中的默认模式，默认使用 `Rule`。
+
+此设置没有直接影响，但可以通过 `clash_mode` 规则项在路由和 DNS 规则中使用。
+
+#### store_mode
+
+将 Clash 模式存储在缓存文件中。
+
+#### store_selected
+
+!!! note ""
+
+    必须为目标出站设置标签。
+
+将 `Selector` 中出站的选定的目标出站存储在缓存文件中。
+
+#### store_fakeip
+
+将 fakeip 存储在缓存文件中。
+
+#### cache_file
+
+缓存文件路径，默认使用`cache.db`。
+
+#### cache_id
+
+缓存 ID。
+
+如果不为空，`store_selected` 将会使用以此为键的独立存储。
+
+### V2Ray API 字段
+
+!!! error ""
+
+    默认安装不包含 V2Ray API，参阅 [安装](/zh/#_2)。
+
+#### listen
+
+gRPC API 监听地址。如果为空，则禁用 V2Ray API。
+
+#### stats
+
+流量统计服务设置。
+
+#### stats.enabled
+
+启用统计服务。
+
+#### stats.inbounds
+
+统计流量的入站列表。
+
+#### stats.outbounds
+
+统计流量的出站列表。
+
+#### stats.users
+
+统计流量的用户列表。

docs/configuration/experimental/v2ray-api.md

@@ -1,50 +0,0 @@
-### Structure
-
-!!! quote ""
-
-    V2Ray API is not included by default, see [Installation](./#installation).
-
-```json
-{
-  "listen": "127.0.0.1:8080",
-  "stats": {
-    "enabled": true,
-    "inbounds": [
-      "socks-in"
-    ],
-    "outbounds": [
-      "proxy",
-      "direct"
-    ],
-    "users": [
-      "sekai"
-    ]
-  }
-}
-```
-
-### Fields
-
-#### listen
-
-gRPC API listening address. V2Ray API will be disabled if empty.
-
-#### stats
-
-Traffic statistics service settings.
-
-#### stats.enabled
-
-Enable statistics service.
-
-#### stats.inbounds
-
-Inbound list to count traffic.
-
-#### stats.outbounds
-
-Outbound list to count traffic.
-
-#### stats.users
-
-User list to count traffic.

docs/configuration/inbound/http.md

@@ -36,7 +36,7 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.
 

docs/configuration/inbound/http.zh.md

@@ -36,7 +36,7 @@ HTTP 用户
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Android、Windows 和 macOS。
 

docs/configuration/inbound/mixed.md

@@ -33,7 +33,7 @@ No authentication required if empty.
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Android, Windows, and macOS.
 

docs/configuration/inbound/mixed.zh.md

@@ -33,7 +33,7 @@ SOCKS 和 HTTP 用户
 
 #### set_system_proxy
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Android、Windows 和 macOS。
 

docs/configuration/inbound/redirect.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux and macOS.
 

docs/configuration/inbound/redirect.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux 和 macOS。
 

docs/configuration/inbound/tproxy.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/inbound/tproxy.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 

docs/configuration/inbound/trojan.md

@@ -47,7 +47,7 @@ TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
 
 #### fallback
 
-!!! quote ""
+!!! error ""
 
     There is no evidence that GFW detects and blocks Trojan servers based on HTTP responses, and opening the standard http/s port on the server is a much bigger signature.
 

docs/configuration/inbound/trojan.zh.md

@@ -49,7 +49,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。
 
 #### fallback
 
-!!! quote ""
+!!! error ""
 
     没有证据表明 GFW 基于 HTTP 响应检测并阻止 Trojan 服务器，并且在服务器上打开标准 http/s 端口是一个更大的特征。
 

docs/configuration/inbound/tun.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -102,7 +102,7 @@ The maximum transmission unit.
 
 Set the default route to the Tun.
 
-!!! quote ""
+!!! error ""
 
     To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
 
@@ -175,7 +175,7 @@ TCP/IP stack.
 
 #### include_interface
 
-!!! quote ""
+!!! error ""
 
     Interface rules are only supported on Linux and require auto_route.
 
@@ -191,7 +191,7 @@ Conflict with `include_interface`.
 
 #### include_uid
 
-!!! quote ""
+!!! error ""
 
     UID rules are only supported on Linux and require auto_route.
 
@@ -211,7 +211,7 @@ Exclude users in route, but in range.
 
 #### include_android_user
 
-!!! quote ""
+!!! error ""
 
     Android user and package rules are only supported on Android and require auto_route.
 

docs/configuration/inbound/tun.zh.md

@@ -1,4 +1,4 @@
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -102,7 +102,7 @@ tun 接口的 IPv6 前缀。
 
 设置到 Tun 的默认路由。
 
-!!! quote ""
+!!! error ""
 
     为避免流量环回，请设置 `route.auto_detect_interface` 或 `route.default_interface` 或 `outbound.bind_interface`。
 
@@ -171,7 +171,7 @@ TCP/IP 栈。
 
 #### include_interface
 
-!!! quote ""
+!!! error ""
 
     接口规则仅在 Linux 下被支持，并且需要 `auto_route`。
 
@@ -187,7 +187,7 @@ TCP/IP 栈。
 
 #### include_uid
 
-!!! quote ""
+!!! error ""
 
     UID 规则仅在 Linux 下被支持，并且需要 `auto_route`。
 
@@ -207,7 +207,7 @@ TCP/IP 栈。
 
 #### include_android_user
 
-!!! quote ""
+!!! error ""
 
     Android 用户和应用规则仅在 Android 下被支持，并且需要 `auto_route`。
 

docs/configuration/outbound/selector.md

@@ -15,7 +15,7 @@
 }
 ```
 
-!!! quote ""
+!!! error ""
 
     The selector can only be controlled through the [Clash API](/configuration/experimental#clash-api-fields) currently.
 

docs/configuration/outbound/selector.zh.md

@@ -15,7 +15,7 @@
 }
 ```
 
-!!! quote ""
+!!! error ""
 
     选择器目前只能通过 [Clash API](/zh/configuration/experimental#clash-api) 来控制。
 

docs/configuration/route/geoip.md

@@ -1,11 +1,3 @@
----
-icon: material/delete-clock
----
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 ### Structure
 
 ```json

docs/configuration/route/geoip.zh.md

@@ -0,0 +1,33 @@
+### 结构
+
+```json
+{
+  "route": {
+    "geoip": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoIP 资源的路径。
+
+默认 `geoip.db`。
+
+#### download_url
+
+指定 GeoIP 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db`。
+
+#### download_detour
+
+用于下载 GeoIP 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/geosite.md

@@ -1,11 +1,3 @@
----
-icon: material/delete-clock
----
-
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 ### Structure
 
 ```json

docs/configuration/route/geosite.zh.md

@@ -0,0 +1,33 @@
+### 结构
+
+```json
+{
+  "route": {
+    "geosite": {
+      "path": "",
+      "download_url": "",
+      "download_detour": ""
+    }
+  }
+}
+```
+
+### 字段
+
+#### path
+
+指定 GeoSite 资源的路径。
+
+默认 `geosite.db`。
+
+#### download_url
+
+指定 GeoSite 资源的下载链接。
+
+默认为 `https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db`。
+
+#### download_detour
+
+用于下载 GeoSite 资源的出站的标签。
+
+如果为空，将使用默认出站。

docs/configuration/route/index.md

@@ -1,15 +1,5 @@
----
-icon: material/alert-decagram
----
-
 # Route
 
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -18,7 +8,6 @@ icon: material/alert-decagram
     "geoip": {},
     "geosite": {},
     "rules": [],
-    "rule_set": [],
     "final": "",
     "auto_detect_interface": false,
     "override_android_vpn": false,
@@ -30,20 +19,11 @@ icon: material/alert-decagram
 
 ### Fields
 
-| Key       | Format               |
-|-----------|----------------------|
-| `geoip`   | [GeoIP](./geoip)     |
-| `geosite` | [Geosite](./geosite) |
-
-#### rules
-
-List of [Route Rule](./rule)
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-List of [Rule Set](/configuration/rule-set)
+| Key        | Format                             |
+|------------|------------------------------------|
+| `geoip`    | [GeoIP](./geoip)                   |
+| `geosite`  | [Geosite](./geosite)               |
+| `rules`    | List of [Route Rule](./rule)       |
 
 #### final
 
@@ -51,7 +31,7 @@ Default outbound tag. the first outbound will be used if empty.
 
 #### auto_detect_interface
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -61,7 +41,7 @@ Takes no effect if `outbound.bind_interface` is set.
 
 #### override_android_vpn
 
-!!! quote ""
+!!! error ""
 
     Only supported on Android.
 
@@ -69,7 +49,7 @@ Accept Android VPN as upstream NIC when `auto_detect_interface` enabled.
 
 #### default_interface
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows and macOS.
 
@@ -79,7 +59,7 @@ Takes no effect if `auto_detect_interface` is set.
 
 #### default_mark
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/route/index.zh.md

@@ -1,15 +1,5 @@
----
-icon: material/alert-decagram
----
-
 # 路由
 
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -17,8 +7,8 @@ icon: material/alert-decagram
   "route": {
     "geoip": {},
     "geosite": {},
+    "ip_rules": [],
     "rules": [],
-    "rule_set": [],
     "final": "",
     "auto_detect_interface": false,
     "override_android_vpn": false,
@@ -30,21 +20,11 @@ icon: material/alert-decagram
 
 ### 字段
 
-| 键          | 格式                                |
-|------------|-----------------------------------|
-| `geoip`    | [GeoIP](./geoip)                  |
-| `geosite`  | [Geosite](./geosite)              |
-
-
-#### rule
-
-一组 [路由规则](./rule)。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-一组 [规则集](/configuration/rule-set)。
+| 键          | 格式                      |
+|------------|-------------------------|
+| `geoip`    | [GeoIP](./geoip)        |
+| `geosite`  | [GeoSite](./geosite)    |
+| `rules`    | 一组 [路由规则](./rule)       |
 
 #### final
 
@@ -52,7 +32,7 @@ icon: material/alert-decagram
 
 #### auto_detect_interface
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -62,7 +42,7 @@ icon: material/alert-decagram
 
 #### override_android_vpn
 
-!!! quote ""
+!!! error ""
 
     仅支持 Android。
 
@@ -70,7 +50,7 @@ icon: material/alert-decagram
 
 #### default_interface
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -80,7 +60,7 @@ icon: material/alert-decagram
 
 #### default_mark
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 

docs/configuration/route/rule.md

@@ -1,17 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
-    :material-plus: [source_ip_is_private](#source_ip_is_private)  
-    :material-plus: [ip_is_private](#ip_is_private)  
-    :material-delete-clock: [source_geoip](#source_geoip)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### Structure
 
 ```json
@@ -60,12 +46,10 @@ icon: material/alert-decagram
           "10.0.0.0/24",
           "192.168.0.1"
         ],
-        "source_ip_is_private": false,
         "ip_cidr": [
           "10.0.0.0/24",
           "192.168.0.1"
         ],
-        "ip_is_private": false,
         "source_port": [
           12345
         ],
@@ -99,16 +83,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": "direct"
       },
@@ -180,47 +154,23 @@ Match domain using regular expression.
 
 #### geosite
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    Geosite is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geosite-to-rule-set).
-
 Match geosite.
 
 #### source_geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match source geoip.
 
 #### geoip
 
-!!! failure "Deprecated in sing-box 1.8.0"
-
-    GeoIP is deprecated and may be removed in the future, check [Migration](/migration/#migrate-geoip-to-rule-set).
-
 Match geoip.
 
 #### source_ip_cidr
 
-Match source IP CIDR.
-
-#### ip_is_private
-
-!!! question "Since sing-box 1.8.0"
-
-Match non-public IP.
+Match source ip cidr.
 
 #### ip_cidr
 
-Match IP CIDR.
-
-#### source_ip_is_private
-
-!!! question "Since sing-box 1.8.0"
-
-Match non-public source IP.
+Match ip cidr.
 
 #### source_port
 
@@ -240,7 +190,7 @@ Match port range.
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -248,7 +198,7 @@ Match process name.
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux, Windows, and macOS.
 
@@ -260,7 +210,7 @@ Match android package name.
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -268,7 +218,7 @@ Match user name.
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 
@@ -278,34 +228,6 @@ Match user id.
 
 Match Clash mode.
 
-#### wifi_ssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### rule_set
-
-!!! question "Since sing-box 1.8.0"
-
-Match [Rule Set](/configuration/route/#rule_set).
-
-#### rule_set_ipcidr_match_source
-
-!!! question "Since sing-box 1.8.0"
-
-Make `ipcidr` in rule sets match the source IP.
-
 #### invert
 
 Invert match result.
@@ -332,4 +254,4 @@ Tag of the target outbound.
 
 ==Required==
 
-Included rules.
+Included default rules.

docs/configuration/route/rule.zh.md

@@ -1,17 +1,3 @@
----
-icon: material/alert-decagram
----
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [rule_set](#rule_set)  
-    :material-plus: [rule_set_ipcidr_match_source](#rule_set_ipcidr_match_source)  
-    :material-plus: [source_ip_is_private](#source_ip_is_private)  
-    :material-plus: [ip_is_private](#ip_is_private)  
-    :material-delete-clock: [source_geoip](#source_geoip)  
-    :material-delete-clock: [geoip](#geoip)  
-    :material-delete-clock: [geosite](#geosite)
-
 ### 结构
 
 ```json
@@ -59,11 +45,9 @@ icon: material/alert-decagram
         "source_ip_cidr": [
           "10.0.0.0/24"
         ],
-        "source_ip_is_private": false,
         "ip_cidr": [
           "10.0.0.0/24"
         ],
-        "ip_is_private": false,
         "source_port": [
           12345
         ],
@@ -97,16 +81,6 @@ icon: material/alert-decagram
           1000
         ],
         "clash_mode": "direct",
-        "wifi_ssid": [
-          "My WIFI"
-        ],
-        "wifi_bssid": [
-          "00:00:00:00:00:00"
-        ],
-        "rule_set": [
-          "geoip-cn",
-          "geosite-cn"
-        ],
         "invert": false,
         "outbound": "direct"
       },
@@ -178,48 +152,24 @@ icon: material/alert-decagram
 
 #### geosite
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    Geosite 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geosite-to-rule-set)。
-
-匹配 Geosite。
+匹配 GeoSite。
 
 #### source_geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配源 GeoIP。
 
 #### geoip
 
-!!! failure "已在 sing-box 1.8.0 废弃"
-
-    GeoIp 已废弃且可能在不久的将来移除，参阅 [迁移指南](/migration/#migrate-geoip-to-rule-set)。
-
 匹配 GeoIP。
 
 #### source_ip_cidr
 
 匹配源 IP CIDR。
 
-#### source_ip_is_private
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配非公开源 IP。
-
 #### ip_cidr
 
 匹配 IP CIDR。
 
-#### ip_is_private
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配非公开 IP。
-
 #### source_port
 
 匹配源端口。
@@ -238,7 +188,7 @@ icon: material/alert-decagram
 
 #### process_name
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS。
 
@@ -246,7 +196,7 @@ icon: material/alert-decagram
 
 #### process_path
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux、Windows 和 macOS.
 
@@ -258,7 +208,7 @@ icon: material/alert-decagram
 
 #### user
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux.
 
@@ -266,7 +216,7 @@ icon: material/alert-decagram
 
 #### user_id
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux.
 
@@ -276,34 +226,6 @@ icon: material/alert-decagram
 
 匹配 Clash 模式。
 
-#### wifi_ssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi SSID。
-
-#### wifi_bssid
-
-!!! quote ""
-
-    仅在 Android 与 iOS 的图形客户端中支持。
-
-匹配 WiFi BSSID。
-
-#### rule_set
-
-!!! question "自 sing-box 1.8.0 起"
-
-匹配[规则集](/zh/configuration/route/#rule_set)。
-
-#### rule_set_ipcidr_match_source
-
-!!! question "自 sing-box 1.8.0 起"
-
-使规则集中的 `ipcidr` 规则匹配源 IP。
-
 #### invert
 
 反选匹配结果。
@@ -330,4 +252,4 @@ icon: material/alert-decagram
 
 ==必填==
 
-包括的规则。
+包括的默认规则。

docs/configuration/rule-set/headless-rule.md

@@ -1,207 +0,0 @@
----
-icon: material/new-box
----
-
-### Structure
-
-!!! question "Since sing-box 1.8.0"
-
-```json
-{
-  "rules": [
-    {
-      "query_type": [
-        "A",
-        "HTTPS",
-        32768
-      ],
-      "network": [
-        "tcp"
-      ],
-      "domain": [
-        "test.com"
-      ],
-      "domain_suffix": [
-        ".cn"
-      ],
-      "domain_keyword": [
-        "test"
-      ],
-      "domain_regex": [
-        "^stun\\..+"
-      ],
-      "source_ip_cidr": [
-        "10.0.0.0/24",
-        "192.168.0.1"
-      ],
-      "ip_cidr": [
-        "10.0.0.0/24",
-        "192.168.0.1"
-      ],
-      "source_port": [
-        12345
-      ],
-      "source_port_range": [
-        "1000:2000",
-        ":3000",
-        "4000:"
-      ],
-      "port": [
-        80,
-        443
-      ],
-      "port_range": [
-        "1000:2000",
-        ":3000",
-        "4000:"
-      ],
-      "process_name": [
-        "curl"
-      ],
-      "process_path": [
-        "/usr/bin/curl"
-      ],
-      "package_name": [
-        "com.termux"
-      ],
-      "wifi_ssid": [
-        "My WIFI"
-      ],
-      "wifi_bssid": [
-        "00:00:00:00:00:00"
-      ],
-      "invert": false
-    },
-    {
-      "type": "logical",
-      "mode": "and",
-      "rules": [],
-      "invert": false
-    }
-  ]
-}
-```
-
-!!! note ""
-
-    You can ignore the JSON Array [] tag when the content is only one item
-
-### Default Fields
-
-!!! note ""
-
-    The default rule uses the following matching logic:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `ip_cidr`) &&  
-    (`port` || `port_range`) &&  
-    (`source_port` || `source_port_range`) &&  
-    `other fields`
-
-#### query_type
-
-DNS query type. Values can be integers or type name strings.
-
-#### network
-
-`tcp` or `udp`.
-
-#### domain
-
-Match full domain.
-
-#### domain_suffix
-
-Match domain suffix.
-
-#### domain_keyword
-
-Match domain using keyword.
-
-#### domain_regex
-
-Match domain using regular expression.
-
-#### source_ip_cidr
-
-Match source IP CIDR.
-
-#### ip_cidr
-
-!!! info ""
-
-    `ip_cidr` is an alias for `source_ip_cidr` when the Rule Set is used in DNS rules or `rule_set_ipcidr_match_source` enabled in route rules.
-
-Match IP CIDR.
-
-#### source_port
-
-Match source port.
-
-#### source_port_range
-
-Match source port range.
-
-#### port
-
-Match port.
-
-#### port_range
-
-Match port range.
-
-#### process_name
-
-!!! quote ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process name.
-
-#### process_path
-
-!!! quote ""
-
-    Only supported on Linux, Windows, and macOS.
-
-Match process path.
-
-#### package_name
-
-Match android package name.
-
-#### wifi_ssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi SSID.
-
-#### wifi_bssid
-
-!!! quote ""
-
-    Only supported in graphical clients on Android and iOS.
-
-Match WiFi BSSID.
-
-#### invert
-
-Invert match result.
-
-### Logical Fields
-
-#### type
-
-`logical`
-
-#### mode
-
-==Required==
-
-`and` or `or`
-
-#### rules
-
-==Required==
-
-Included rules.

docs/configuration/rule-set/index.md

@@ -1,97 +0,0 @@
----
-icon: material/new-box
----
-
-# Rule Set
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "type": "",
-  "tag": "",
-  "format": "",
-  
-  ... // Typed Fields
-}
-```
-
-#### Local Structure
-
-```json
-{
-  "type": "local",
-  
-  ...
-  
-  "path": ""
-}
-```
-
-#### Remote Structure
-
-!!! info ""
-
-    Remote rule-set will be cached if `experimental.cache_file.enabled`.
-
-```json
-{
-  "type": "remote",
-  
-  ...,
-  
-  "url": "",
-  "download_detour": "",
-  "update_interval": ""
-}
-```
-
-### Fields
-
-#### type
-
-==Required==
-
-Type of Rule Set, `local` or `remote`.
-
-#### tag
-
-==Required==
-
-Tag of Rule Set.
-
-#### format
-
-==Required==
-
-Format of Rule Set, `source` or `binary`.
-
-### Local Fields
-
-#### path
-
-==Required==
-
-File path of Rule Set.
-
-### Remote Fields
-
-#### url
-
-==Required==
-
-Download URL of Rule Set.
-
-#### download_detour
-
-Tag of the outbound to download rule-set.
-
-Default outbound will be used if empty.
-
-#### update_interval
-
-Update interval of Rule Set.
-
-`1d` will be used if empty.

docs/configuration/rule-set/source-format.md

@@ -1,34 +0,0 @@
----
-icon: material/new-box
----
-
-# Source Format
-
-!!! question "Since sing-box 1.8.0"
-
-### Structure
-
-```json
-{
-  "version": 1,
-  "rules": []
-}
-```
-
-### Compile
-
-Use `sing-box rule-set compile [--output <file-name>.srs] <file-name>.json` to compile source to binary rule-set.
-
-### Fields
-
-#### version
-
-==Required==
-
-Version of Rule Set, must be `1`.
-
-#### rules
-
-==Required==
-
-List of [Headless Rule](./headless-rule.md).

docs/configuration/shared/dial.md

@@ -41,7 +41,7 @@ The IPv6 address to bind to.
 
 #### routing_mark
 
-!!! quote ""
+!!! error ""
 
     Only supported on Linux.
 

docs/configuration/shared/dial.zh.md

@@ -44,7 +44,7 @@
 
 #### routing_mark
 
-!!! quote ""
+!!! error ""
 
     仅支持 Linux。
 

docs/deprecated.md

@@ -1,8 +1,4 @@
----
-icon: material/delete-alert
----
-
-# Deprecated Feature List
+# :material-delete-alert: Deprecated Feature List
 
 ### 1.6.0
 

docs/deprecated.zh.md

@@ -1,8 +1,4 @@
----
-icon: material/delete-alert
----
-
-# 废弃功能列表
+# :material-delete-alert: 废弃功能列表
 
 ### 1.6.0
 

docs/installation/build-from-source.md

@@ -1,8 +1,4 @@
----
-icon: material/file-code
----
-
-# Build from source
+# :material-file-code: Build from source
 
 ## :material-graph: Requirements
 

docs/installation/docker.md

@@ -1,8 +1,4 @@
----
-icon: material/docker
----
-
-# Docker
+# :material-docker: Docker
 
 ## :material-console: Command
 

docs/installation/package-manager.md

@@ -1,8 +1,4 @@
----
-icon: material/package
----
-
-# Package Manager
+# :material-package: Package Manager
 
 ## :material-download-box: Manual Installation
 
@@ -55,36 +51,12 @@ icon: material/package
     |------------|--------------------|---------------------|------------------------------|---------------------|
     | Termux     | Android            | [sing-box][termux]  | `pkg add sing-box`           | :material-check:    |
 
-## :material-book-multiple: Service Management
-
-For Linux systems with [systemd][systemd], usually the installation already includes a sing-box service,
-you can manage the service using the following command:
-
-| Operation | Command                                       |
-|-----------|-----------------------------------------------|
-| Enable    | `sudo systemctl enable sing-box`              |
-| Disable   | `sudo systemctl disable sing-box`             |
-| Start     | `sudo systemctl start sing-box`               |
-| Stop      | `sudo systemctl stop sing-box`                |
-| Kill      | `sudo systemctl kill sing-box`                |
-| Restart   | `sudo systemctl restart sing-box`             |
-| Logs      | `sudo journalctl -u sing-box --output cat -e` |
-| New Logs  | `sudo journalctl -u sing-box --output cat -f` |
 
 [alpine]: https://pkgs.alpinelinux.org/packages?name=sing-box
-
 [aur]: https://aur.archlinux.org/packages/sing-box
-
 [nixpkgs]: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/networking/sing-box/default.nix
-
 [termux]: https://github.com/termux/termux-packages/tree/master/packages/sing-box
-
 [brew]: https://formulae.brew.sh/formula/sing-box
-
 [choco]: https://chocolatey.org/packages/sing-box
-
 [scoop]: https://github.com/ScoopInstaller/Main/blob/master/bucket/sing-box.json
-
-[winget]: https://github.com/microsoft/winget-pkgs/tree/master/manifests/s/SagerNet/sing-box
-
-[systemd]: https://systemd.io/
+[winget]: https://github.com/microsoft/winget-pkgs/tree/master/manifests/s/SagerNet/sing-box

docs/manual/proxy-protocol/hysteria2.md

@@ -1,8 +1,4 @@
----
-icon: material/lightning-bolt
----
-
-# Hysteria 2
+# :material-lightning-bolt: Hysteria 2
 
 The most popular Chinese-made simple protocol based on QUIC, the selling point is Brutal,
 a congestion control algorithm that can resist packet loss by manually specifying the required rate by the user.
@@ -17,9 +13,9 @@ a congestion control algorithm that can resist packet loss by manually specifyin
 
 ## :material-text-box-check: Password Generator
 
-| Generate Password          | Action                                                          |
-|----------------------------|-----------------------------------------------------------------|
-| <code id="password"><code> | <button class="md-button" onclick="generate()">Refresh</button> |
+| Generate Password          | Action                                        |
+|----------------------------|-----------------------------------------------|
+| <code id="password"><code> | <button onclick="generate()">Refresh</button> |
 
 <script>
     function generate() {

docs/manual/proxy-protocol/shadowsocks.md

@@ -1,8 +1,4 @@
----
-icon: material/send
----
-
-# Shadowsocks
+# :material-send: Shadowsocks
 
 As the most well-known Chinese-made proxy protocol,
 Shadowsocks exists in multiple versions,
@@ -16,9 +12,10 @@ but only AEAD 2022 ciphers TCP with multiplexing is recommended.
 
 ## :material-text-box-check: Password Generator
 
-| For `2022-blake3-aes-128-gcm` cipher | For other ciphers             | Action                                                          |
-|--------------------------------------|-------------------------------|-----------------------------------------------------------------|
-| <code id="password_16"><code>        | <code id="password_32"><code> | <button class="md-button" onclick="generate()">Refresh</button> |
+
+| For `2022-blake3-aes-128-gcm` cipher | For other ciphers             | Action                                        |
+|--------------------------------------|-------------------------------|-----------------------------------------------|
+| <code id="password_16"><code>        | <code id="password_32"><code> | <button onclick="generate()">Refresh</button> |
 
 <script>
     function generatePassword(element, length) {

docs/manual/proxy-protocol/trojan.md

@@ -1,8 +1,4 @@
----
-icon: material/horse
----
-
-# Trojan
+# :material-horse: Trojan
 
 As the most commonly used TLS proxy made in China, Trojan can be used in various combinations,
 but only the combination of uTLS and multiplexing is recommended.
@@ -16,9 +12,9 @@ but only the combination of uTLS and multiplexing is recommended.
 
 ## :material-text-box-check: Password Generator
 
-| Generate Password          | Action                                                          |
-|----------------------------|-----------------------------------------------------------------|
-| <code id="password"><code> | <button class="md-button" onclick="generate()">Refresh</button> |
+| Generate Password          | Action                                        |
+|----------------------------|-----------------------------------------------|
+| <code id="password"><code> | <button onclick="generate()">Refresh</button> |
 
 <script>
     function generate() {

docs/manual/proxy-protocol/tuic.md

@@ -1,8 +1,4 @@
----
-icon: material/alpha-t-box
----
-
-# TUIC
+# :material-alpha-t-box: TUIC
 
 A recently popular Chinese-made simple protocol based on QUIC, the selling point is the BBR congestion control algorithm.
 
@@ -12,13 +8,13 @@ A recently popular Chinese-made simple protocol based on QUIC, the selling point
 
 | Specification                                             | Binary Characteristics | Active Detect Hiddenness |
 |-----------------------------------------------------------|------------------------|--------------------------|
-| [GitHub](https://github.com/EAimTY/tuic/blob/dev/SPEC.md) | :material-alert:       | :material-check:         | 
+| [Github](https://github.com/EAimTY/tuic/blob/dev/SPEC.md) | :material-alert:       | :material-check:         | 
 
 ## Password Generator
 
-| Generated UUID         | Generated  Password        | Action                                                          |
-|------------------------|----------------------------|-----------------------------------------------------------------|
-| <code id="uuid"><code> | <code id="password"><code> | <button class="md-button" onclick="generate()">Refresh</button> |
+| Generated UUID         | Generated  Password        | Action                                        |
+|------------------------|----------------------------|-----------------------------------------------|
+| <code id="uuid"><code> | <code id="password"><code> | <button onclick="generate()">Refresh</button> |
 
 <script>
     function generateUUID() {

docs/manual/proxy/client.md

@@ -1,17 +1,13 @@
----
-icon: material/cellphone-link
----
+# :material-cellphone-link: Client
 
-# Client
-
-### :material-ray-start: Introduction
+## :material-ray-start: Introduction
 
 For a long time, the modern usage and principles of proxy clients
 for graphical operating systems have not been clearly described.
 However, we can categorize them into three types:
 system proxy, firewall redirection, and virtual interface.
 
-### :material-web-refresh: System Proxy
+## :material-web-refresh: System Proxy
 
 Almost all graphical environments support system-level proxies,
 which are essentially ordinary HTTP proxies that only support TCP.
@@ -38,7 +34,7 @@ flowchart LR
     udp[UDP packet] --> leak
 ```
 
-### :material-wall-fire: Firewall Redirection
+## :material-wall-fire: Firewall Redirection
 
 This type of usage typically relies on the firewall or hook interface provided by the operating system,
 such as Windows’ WFP, Linux’s redirect, TProxy and eBPF, and macOS’s pf.
@@ -46,7 +42,7 @@ Although it is intrusive and cumbersome to configure,
 it remains popular within the community of amateur proxy open source projects like V2Ray,
 due to the low technical requirements it imposes on the software.
 
-### :material-expansion-card: Virtual Interface
+## :material-expansion-card: Virtual Interface
 
 All L2/L3 proxies (seriously defined VPNs, such as OpenVPN, WireGuard) are based on virtual network interfaces,
 which is also the only way for all L4 proxies to work as VPNs on mobile platforms like Android, iOS.
@@ -70,7 +66,7 @@ flowchart TB
     assemble --> conn[TCP and UDP connections]
     conn --> router[sing-box Router]
     router --> direct[Direct outbound]
-    router --> proxy[Proxy outbounds]
+    router -->  proxy[Proxy outbounds]
     router -- DNS hijack --> dns_out[DNS outbound]
     dns_out --> dns_router[DNS router]
     dns_router --> router
@@ -80,530 +76,4 @@ flowchart TB
     default --> destination[Destination server]
     default --> proxy_server[Proxy server]
     proxy_server --> destination
-```
-
-## :material-cellphone-link: Examples
-
-### Basic TUN usage for Chinese users
-
-=== ":material-numeric-4-box: IPv4 only"
-
-    ```json
-    {
-      "dns": {
-        "servers": [
-          {
-            "tag": "google",
-            "address": "tls://8.8.8.8"
-          },
-          {
-            "tag": "local",
-            "address": "223.5.5.5",
-            "detour": "direct"
-          }
-        ],
-        "rules": [
-          {
-            "outbound": "any",
-            "server": "local"
-          }
-        ],
-        "strategy": "ipv4_only"
-      },
-      "inbounds": [
-        {
-          "type": "tun",
-          "inet4_address": "172.19.0.1/30",
-          "auto_route": true,
-          "strict_route": false
-        }
-      ],
-      "outbounds": [
-        // ...
-        {
-          "type": "direct",
-          "tag": "direct"
-        },
-        {
-          "type": "dns",
-          "tag": "dns-out"
-        }
-      ],
-      "route": {
-        "rules": [
-          {
-            "protocol": "dns",
-            "outbound": "dns-out"
-          },
-          {
-            "geoip": [
-              "private"
-            ],
-            "outbound": "direct"
-          }
-        ],
-        "auto_detect_interface": true
-      }
-    }
-    ```
-
-=== ":material-numeric-6-box: IPv4 & IPv6"
-
-    ```json
-    {
-      "dns": {
-        "servers": [
-          {
-            "tag": "google",
-            "address": "tls://8.8.8.8"
-          },
-          {
-            "tag": "local",
-            "address": "223.5.5.5",
-            "detour": "direct"
-          }
-        ],
-        "rules": [
-          {
-            "outbound": "any",
-            "server": "local"
-          }
-        ]
-      },
-      "inbounds": [
-        {
-          "type": "tun",
-          "inet4_address": "172.19.0.1/30",
-          "inet6_address": "fdfe:dcba:9876::1/126",
-          "auto_route": true,
-          "strict_route": false
-        }
-      ],
-      "outbounds": [
-        // ...
-        {
-          "type": "direct",
-          "tag": "direct"
-        },
-        {
-          "type": "dns",
-          "tag": "dns-out"
-        }
-      ],
-      "route": {
-        "rules": [
-          {
-            "protocol": "dns",
-            "outbound": "dns-out"
-          },
-          {
-            "geoip": [
-              "private"
-            ],
-            "outbound": "direct"
-          }
-        ],
-        "auto_detect_interface": true
-      }
-    }
-    ```
-
-=== ":material-domain-switch: FakeIP"
-
-    ```json
-    {
-      "dns": {
-        "servers": [
-          {
-            "tag": "google",
-            "address": "tls://8.8.8.8"
-          },
-          {
-            "tag": "local",
-            "address": "223.5.5.5",
-            "detour": "direct"
-          },
-          {
-            "tag": "remote",
-            "address": "fakeip"
-          }
-        ],
-        "rules": [
-          {
-            "outbound": "any",
-            "server": "local"
-          },
-          {
-            "query_type": [
-              "A",
-              "AAAA"
-            ],
-            "server": "remote"
-          }
-        ],
-        "fakeip": {
-          "enabled": true,
-          "inet4_range": "198.18.0.0/15",
-          "inet6_range": "fc00::/18"
-        },
-        "independent_cache": true
-      },
-      "inbounds": [
-        {
-          "type": "tun",
-          "inet4_address": "172.19.0.1/30",
-          "inet6_address": "fdfe:dcba:9876::1/126",
-          "auto_route": true,
-          "strict_route": true
-        }
-      ],
-      "outbounds": [
-        // ...
-        {
-          "type": "direct",
-          "tag": "direct"
-        },
-        {
-          "type": "dns",
-          "tag": "dns-out"
-        }
-      ],
-      "route": {
-        "rules": [
-          {
-            "protocol": "dns",
-            "outbound": "dns-out"
-          },
-          {
-            "geoip": [
-              "private"
-            ],
-            "outbound": "direct"
-          }
-        ],
-        "auto_detect_interface": true
-      }
-    }
-    ```
-
-### Traffic bypass usage for Chinese users
-
-=== ":material-dns: DNS rules"
-
-    !!! info
-    
-        DNS rules are optional if FakeIP is used.
-
-    ```json
-    {
-      "dns": {
-        "servers": [
-          {
-            "tag": "google",
-            "address": "tls://8.8.8.8"
-          },
-          {
-            "tag": "local",
-            "address": "223.5.5.5",
-            "detour": "direct"
-          }
-        ],
-        "rules": [
-          {
-            "outbound": "any",
-            "server": "local"
-          },
-          {
-            "clash_mode": "Direct",
-            "server": "local"
-          },
-          {
-            "clash_mode": "Global",
-            "server": "google"
-          },
-          {
-            "type": "logical",
-            "mode": "and",
-            "rules": [
-              {
-                "geosite": "geolocation-!cn",
-                "invert": true
-              },
-              {
-                "geosite": [
-                  "cn",
-                  "category-companies@cn"
-                ],
-              }
-            ],
-            "server": "local"
-          }
-        ]
-      }
-    }
-    ```
-
-=== ":material-dns: DNS rules (1.8.0+)"
-
-    !!! info
-    
-        DNS rules are optional if FakeIP is used.
-
-    ```json
-    {
-      "dns": {
-        "servers": [
-          {
-            "tag": "google",
-            "address": "tls://8.8.8.8"
-          },
-          {
-            "tag": "local",
-            "address": "223.5.5.5",
-            "detour": "direct"
-          }
-        ],
-        "rules": [
-          {
-            "outbound": "any",
-            "server": "local"
-          },
-          {
-            "clash_mode": "Direct",
-            "server": "local"
-          },
-          {
-            "clash_mode": "Global",
-            "server": "google"
-          },
-          {
-            "type": "logical",
-            "mode": "and",
-            "rules": [
-              {
-                "rule_set": "geosite-geolocation-!cn",
-                "invert": true
-              },
-              {
-                "rule_set": [
-                  "geosite-cn",
-                  "geosite-category-companies@cn"
-                ]
-              }
-            ],
-            "server": "local"
-          }
-        ]
-      },
-      "route": {
-        "rule_set": [
-          {
-            "type": "remote",
-            "tag": "geosite-cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-geolocation-!cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-category-companies@cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
-          }
-        ]
-      }
-    }
-    ```
-
-=== ":material-router-network: Route rules"
-
-    ```json
-    {
-      "outbounds": [
-        {
-          "type": "direct",
-          "tag": "direct"
-        },
-        {
-          "type": "block",
-          "tag": "block"
-        }
-      ],
-      "route": {
-        "rules": [
-          {
-            "type": "logical",
-            "mode": "or",
-            "rules": [
-              {
-                "protocol": "dns"
-              },
-              {
-                "port": 53
-              }
-            ],
-            "outbound": "dns"
-          },
-          {
-            "geoip": "private",
-            "outbound": "direct"
-          },
-          {
-            "clash_mode": "Direct",
-            "outbound": "direct"
-          },
-          {
-            "clash_mode": "Global",
-            "outbound": "default"
-          },
-          {
-            "type": "logical",
-            "mode": "or",
-            "rules": [
-              {
-                "port": 853
-              },
-              {
-                "network": "udp",
-                "port": 443
-              },
-              {
-                "protocol": "stun"
-              }
-            ],
-            "outbound": "block"
-          },
-          {
-            "type": "logical",
-            "mode": "and",
-            "rules": [
-              {
-                "geosite": "geolocation-!cn",
-                "invert": true
-              },
-              {
-                "geosite": [
-                  "cn",
-                  "category-companies@cn"
-                ],
-                "geoip": "cn"
-              }
-            ],
-            "outbound": "direct"
-          }
-        ]
-      }
-    }
-    ```
-
-=== ":material-router-network: Route rules (1.8.0+)"
-
-    ```json
-    {
-      "outbounds": [
-        {
-          "type": "direct",
-          "tag": "direct"
-        },
-        {
-          "type": "block",
-          "tag": "block"
-        }
-      ],
-      "route": {
-        "rules": [
-          {
-            "type": "logical",
-            "mode": "or",
-            "rules": [
-              {
-                "protocol": "dns"
-              },
-              {
-                "port": 53
-              }
-            ],
-            "outbound": "dns"
-          },
-          {
-            "ip_is_private": true,
-            "outbound": "direct"
-          },
-          {
-            "clash_mode": "Direct",
-            "outbound": "direct"
-          },
-          {
-            "clash_mode": "Global",
-            "outbound": "default"
-          },
-          {
-            "type": "logical",
-            "mode": "or",
-            "rules": [
-              {
-                "port": 853
-              },
-              {
-                "network": "udp",
-                "port": 443
-              },
-              {
-                "protocol": "stun"
-              }
-            ],
-            "outbound": "block"
-          },
-          {
-            "type": "logical",
-            "mode": "and",
-            "rules": [
-              {
-                "rule_set": "geosite-geolocation-!cn",
-                "invert": true
-              },
-              {
-                "rule_set": [
-                  "geoip-cn",
-                  "geosite-cn",
-                  "geosite-category-companies@cn"
-                ]
-              }
-            ],
-            "outbound": "direct"
-          }
-        ],
-        "rule_set": [
-          {
-            "type": "remote",
-            "tag": "geoip-cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-geolocation-!cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs"
-          },
-          {
-            "type": "remote",
-            "tag": "geosite-category-companies@cn",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-companies@cn.srs"
-          }
-        ]
-      }
-    }
-    ```
+```

docs/manual/proxy/server.md

@@ -1,8 +1,4 @@
----
-icon: material/server
----
-
-# Server
+# :material-server: Server
 
 To use sing-box as a proxy protocol server, you pretty much only need to configure the inbound for that protocol.
 

docs/manual/proxy/tun.md

@@ -0,0 +1,66 @@
+# :material-expansion-card: TUN
+
+## :material-text-box: Definition
+
+Refers to TUNnel, a virtual network device supported by the kernel.
+It’s also used in sing-box to denote the extensive functionality surrounding TUN inbound:
+including traffic assembly, automatic routing, and network and default interface monitoring.
+
+The following flow chart describes the minimal TUN-based transparent proxy process in sing-box:
+
+``` mermaid
+flowchart LR
+    subgraph inbound [Inbound]
+        direction TB
+        packet[IP Packet]
+        packet --> windows[Windows / macOS]
+        packet --> linux[Linux]
+        tun[TUN interface]
+        windows -. route .-> tun
+        linux -. iproute2 route/rule .-> tun
+        tun --> gvisor[gVisor TUN stack]
+        tun --> system[system TUN stack]
+        assemble([L3 to L4 assemble])
+        gvisor --> assemble
+        system --> assemble
+        assemble --> conn[TCP and UDP connections]
+        conn --> router[sing-box Router]
+    end
+
+    subgraph outbound [Outbound]
+        direction TB
+        direct[Direct outbound]
+        proxy[Proxy outbounds]
+        direct --> adi([auto detect interface])
+        proxy --> adi
+        adi --> default[Default network interface in the system]
+        default --> destination[Destination server]
+        default --> proxy_server[Proxy server]
+        proxy_server --> destination
+    end
+
+    inbound --> outbound
+```
+
+## :material-help-box: How to
+
+A basic TUN-based transparent proxy configuration file includes: an TUN inbound, `route.auto_detect_interface`, like:
+
+```json
+{
+  "inbounds": [
+    {
+      "type": "tun",
+      "inet4_address": "172.19.0.1/30",
+      "inet6_address": "fdfe:dcba:9876::1/126",
+      "auto_route": true,
+      "strict_route": true
+    }
+  ],
+  "route": {
+    "auto_detect_interface": true
+  }
+}
+```
+
+TODO: finish this wiki

docs/migration.md

@@ -1,195 +0,0 @@
----
-icon: material/arrange-bring-forward
----
-
-# Migration
-
-## 1.8.0
-
-!!! warning "Unstable"
-
-    This version is still under development, and the following migration guide may be changed in the future.
-
-### :material-close-box: Migrate cache file from Clash API to independent options
-
-!!! info "Reference"
-
-    [Clash API](/configuration/experimental/clash-api) / 
-    [Cache File](/configuration/experimental/cache-file)
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "experimental": {
-        "clash_api": {
-          "cache_file": "cache.db", // default value
-          "cahce_id": "my_profile2",
-          "store_mode": true,
-          "store_selected": true,
-          "store_fakeip": true
-        }
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "experimental"  : {
-        "cache_file": {
-          "enabled": true,
-          "path": "cache.db", // default value
-          "cache_id": "my_profile2",
-          "store_fakeip": true
-        }
-      }
-    }
-    ```
-
-### :material-checkbox-intermediate: Migrate GeoIP to rule sets
-
-!!! info "Reference"
-
-    [GeoIP](/configuration/route/geoip) / 
-    [Route](/configuration/route) / 
-    [Route Rule](/configuration/route/rule) / 
-    [DNS Rule](/configuration/dns/rule) / 
-    [Rule Set](/configuration/rule-set)
-
-!!! tip
-
-    `sing-box geoip` commands can help you convert custom GeoIP into rule sets.
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "route": {
-        "rules": [
-          {
-            "geoip": "private",
-            "outbound": "direct"
-          },
-          {
-            "geoip": "cn",
-            "outbound": "direct"
-          },
-          {
-            "source_geoip": "cn",
-            "outbound": "block"
-          }
-        ],
-        "geoip": {
-          "download_detour": "proxy"
-        }
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "route": {
-        "rules": [
-          {
-            "ip_is_private": true,
-            "outbound": "direct"
-          },
-          {
-            "rule_set": "geoip-cn",
-            "outbound": "direct"
-          },
-          {
-            "rule_set": "geoip-us",
-            "rule_set_ipcidr_match_source": true,
-            "outbound": "block"
-          }
-        ],
-        "rule_set": [
-          {
-            "tag": "geoip-cn",
-            "type": "remote",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
-            "download_detour": "proxy"
-          },
-          {
-            "tag": "geoip-us",
-            "type": "remote",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-us.srs",
-            "download_detour": "proxy"
-          }
-        ]
-      },
-      "experimental": {
-        "cache_file": {
-          "enabled": true // required to save Rule Set cache
-        }
-      }
-    }
-    ```
-
-### :material-checkbox-intermediate: Migrate Geosite to rule sets
-
-!!! info "Reference"
-
-    [Geosite](/configuration/route/geosite) / 
-    [Route](/configuration/route) / 
-    [Route Rule](/configuration/route/rule) / 
-    [DNS Rule](/configuration/dns/rule) / 
-    [Rule Set](/configuration/rule-set)
-
-!!! tip
-
-    `sing-box geosite` commands can help you convert custom Geosite into rule sets.
-
-=== ":material-card-remove: Deprecated"
-
-    ```json
-    {
-      "route": {
-        "rules": [
-          {
-            "geosite": "cn",
-            "outbound": "direct"
-          }
-        ],
-        "geosite": {
-          "download_detour": "proxy"
-        }
-      }
-    }
-    ```
-
-=== ":material-card-multiple: New"
-
-    ```json
-    {
-      "route": {
-        "rules": [
-          {
-            "rule_set": "geosite-cn",
-            "outbound": "direct"
-          }
-        ],
-        "rule_set": [
-          {
-            "tag": "geosite-cn",
-            "type": "remote",
-            "format": "binary",
-            "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
-            "download_detour": "proxy"
-          }
-        ]
-      },
-      "experimental": {
-        "cache_file": {
-          "enabled": true // required to save Rule Set cache
-        }
-      }
-    }
-    ```

docs/support.md

@@ -1,13 +1,9 @@
----
-icon: material/forum
----
-
-# Support
+# :material-forum: Support
 
 | Channel                       | Link                                        |
 |:------------------------------|:--------------------------------------------|
 | Community                     | https://community.sagernet.org              |
-| GitHub Issues                 | https://github.com/SagerNet/sing-box/issues |
+| Github Issues                 | https://github.com/SagerNet/sing-box/issues |
 | Telegram notification channel | https://t.me/yapnc                          |
 | Telegram user group           | https://t.me/yapug                          |
 | Email                         | contact@sagernet.org                        |

docs/support.zh.md

@@ -1,13 +1,9 @@
----
-icon: material/forum
----
-
-# 支持
+# :material-forum: 支持
 
 | 通道            | 链接                                          |
 |:--------------|:--------------------------------------------|
 | 社区            | https://community.sagernet.org              |
-| GitHub Issues | https://github.com/SagerNet/sing-box/issues |
+| Github Issues | https://github.com/SagerNet/sing-box/issues |
 | Telegram 通知频道 | https://t.me/yapnc                          |
 | Telegram 用户组  | https://t.me/yapug                          |
 | 邮件            | contact@sagernet.org                        |

experimental/clashapi.go

@@ -5,7 +5,6 @@ import (
 	"os"
 
 	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
@@ -28,37 +27,24 @@ func NewClashServer(ctx context.Context, router adapter.Router, logFactory log.O
 
 func CalculateClashModeList(options option.Options) []string {
 	var clashMode []string
-	clashMode = append(clashMode, extraClashModeFromRule(common.PtrValueOrDefault(options.Route).Rules)...)
-	clashMode = append(clashMode, extraClashModeFromDNSRule(common.PtrValueOrDefault(options.DNS).Rules)...)
-	clashMode = common.FilterNotDefault(common.Uniq(clashMode))
-	return clashMode
-}
-
-func extraClashModeFromRule(rules []option.Rule) []string {
-	var clashMode []string
-	for _, rule := range rules {
-		switch rule.Type {
-		case C.RuleTypeDefault:
-			if rule.DefaultOptions.ClashMode != "" {
-				clashMode = append(clashMode, rule.DefaultOptions.ClashMode)
+	for _, dnsRule := range common.PtrValueOrDefault(options.DNS).Rules {
+		if dnsRule.DefaultOptions.ClashMode != "" && !common.Contains(clashMode, dnsRule.DefaultOptions.ClashMode) {
+			clashMode = append(clashMode, dnsRule.DefaultOptions.ClashMode)
+		}
+		for _, defaultRule := range dnsRule.LogicalOptions.Rules {
+			if defaultRule.ClashMode != "" && !common.Contains(clashMode, defaultRule.ClashMode) {
+				clashMode = append(clashMode, defaultRule.ClashMode)
+			}
+		}
+	}
+	for _, rule := range common.PtrValueOrDefault(options.Route).Rules {
+		if rule.DefaultOptions.ClashMode != "" && !common.Contains(clashMode, rule.DefaultOptions.ClashMode) {
+			clashMode = append(clashMode, rule.DefaultOptions.ClashMode)
+		}
+		for _, defaultRule := range rule.LogicalOptions.Rules {
+			if defaultRule.ClashMode != "" && !common.Contains(clashMode, defaultRule.ClashMode) {
+				clashMode = append(clashMode, defaultRule.ClashMode)
 			}
-		case C.RuleTypeLogical:
-			clashMode = append(clashMode, extraClashModeFromRule(rule.LogicalOptions.Rules)...)
-		}
-	}
-	return clashMode
-}
-
-func extraClashModeFromDNSRule(rules []option.DNSRule) []string {
-	var clashMode []string
-	for _, rule := range rules {
-		switch rule.Type {
-		case C.RuleTypeDefault:
-			if rule.DefaultOptions.ClashMode != "" {
-				clashMode = append(clashMode, rule.DefaultOptions.ClashMode)
-			}
-		case C.RuleTypeLogical:
-			clashMode = append(clashMode, extraClashModeFromDNSRule(rule.LogicalOptions.Rules)...)
 		}
 	}
 	return clashMode

experimental/clashapi/cache.go

@@ -1,26 +1,23 @@
 package clashapi
 
 import (
-	"context"
 	"net/http"
 
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing/service"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 )
 
-func cacheRouter(ctx context.Context) http.Handler {
+func cacheRouter(router adapter.Router) http.Handler {
 	r := chi.NewRouter()
-	r.Post("/fakeip/flush", flushFakeip(ctx))
+	r.Post("/fakeip/flush", flushFakeip(router))
 	return r
 }
 
-func flushFakeip(ctx context.Context) func(w http.ResponseWriter, r *http.Request) {
+func flushFakeip(router adapter.Router) func(w http.ResponseWriter, r *http.Request) {
 	return func(w http.ResponseWriter, r *http.Request) {
-		cacheFile := service.FromContext[adapter.CacheFile](ctx)
-		if cacheFile != nil {
+		if cacheFile := router.ClashServer().CacheFile(); cacheFile != nil {
 			err := cacheFile.FakeIPReset()
 			if err != nil {
 				render.Status(r, http.StatusInternalServerError)

experimental/clashapi/cachefile/cache.go

@@ -1,7 +1,6 @@
 package cachefile
 
 import (
-	"context"
 	"errors"
 	"net/netip"
 	"os"
@@ -12,37 +11,29 @@ import (
 	"github.com/sagernet/bbolt"
 	bboltErrors "github.com/sagernet/bbolt/errors"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/service/filemanager"
 )
 
 var (
 	bucketSelected = []byte("selected")
 	bucketExpand   = []byte("group_expand")
 	bucketMode     = []byte("clash_mode")
-	bucketRuleSet  = []byte("rule_set")
 
 	bucketNameList = []string{
 		string(bucketSelected),
 		string(bucketExpand),
 		string(bucketMode),
-		string(bucketRuleSet),
 	}
 
 	cacheIDDefault = []byte("default")
 )
 
-var _ adapter.CacheFile = (*CacheFile)(nil)
+var _ adapter.ClashCacheFile = (*CacheFile)(nil)
 
 type CacheFile struct {
-	ctx         context.Context
-	path        string
-	cacheID     []byte
-	storeFakeIP bool
-
 	DB                *bbolt.DB
+	cacheID           []byte
 	saveAccess        sync.RWMutex
 	saveDomain        map[netip.Addr]string
 	saveAddress4      map[string]netip.Addr
@@ -50,29 +41,7 @@ type CacheFile struct {
 	saveMetadataTimer *time.Timer
 }
 
-func NewCacheFile(ctx context.Context, options option.CacheFileOptions) *CacheFile {
-	var path string
-	if options.Path != "" {
-		path = options.Path
-	} else {
-		path = "cache.db"
-	}
-	var cacheIDBytes []byte
-	if options.CacheID != "" {
-		cacheIDBytes = append([]byte{0}, []byte(options.CacheID)...)
-	}
-	return &CacheFile{
-		ctx:          ctx,
-		path:         filemanager.BasePath(ctx, path),
-		cacheID:      cacheIDBytes,
-		storeFakeIP:  options.StoreFakeIP,
-		saveDomain:   make(map[netip.Addr]string),
-		saveAddress4: make(map[string]netip.Addr),
-		saveAddress6: make(map[string]netip.Addr),
-	}
-}
-
-func (c *CacheFile) start() error {
+func Open(path string, cacheID string) (*CacheFile, error) {
 	const fileMode = 0o666
 	options := bbolt.Options{Timeout: time.Second}
 	var (
@@ -80,7 +49,7 @@ func (c *CacheFile) start() error {
 		err error
 	)
 	for i := 0; i < 10; i++ {
-		db, err = bbolt.Open(c.path, fileMode, &options)
+		db, err = bbolt.Open(path, fileMode, &options)
 		if err == nil {
 			break
 		}
@@ -88,20 +57,19 @@ func (c *CacheFile) start() error {
 			continue
 		}
 		if E.IsMulti(err, bboltErrors.ErrInvalid, bboltErrors.ErrChecksum, bboltErrors.ErrVersionMismatch) {
-			rmErr := os.Remove(c.path)
+			rmErr := os.Remove(path)
 			if rmErr != nil {
-				return err
+				return nil, err
 			}
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
 	if err != nil {
-		return err
+		return nil, err
 	}
-	err = filemanager.Chown(c.ctx, c.path)
-	if err != nil {
-		db.Close()
-		return E.Cause(err, "platform chown")
+	var cacheIDBytes []byte
+	if cacheID != "" {
+		cacheIDBytes = append([]byte{0}, []byte(cacheID)...)
 	}
 	err = db.Batch(func(tx *bbolt.Tx) error {
 		return tx.ForEach(func(name []byte, b *bbolt.Bucket) error {
@@ -123,30 +91,15 @@ func (c *CacheFile) start() error {
 		})
 	})
 	if err != nil {
-		db.Close()
-		return err
+		return nil, err
 	}
-	c.DB = db
-	return nil
-}
-
-func (c *CacheFile) PreStart() error {
-	return c.start()
-}
-
-func (c *CacheFile) Start() error {
-	return nil
-}
-
-func (c *CacheFile) Close() error {
-	if c.DB == nil {
-		return nil
-	}
-	return c.DB.Close()
-}
-
-func (c *CacheFile) StoreFakeIP() bool {
-	return c.storeFakeIP
+	return &CacheFile{
+		DB:           db,
+		cacheID:      cacheIDBytes,
+		saveDomain:   make(map[netip.Addr]string),
+		saveAddress4: make(map[string]netip.Addr),
+		saveAddress6: make(map[string]netip.Addr),
+	}, nil
 }
 
 func (c *CacheFile) LoadMode() string {
@@ -260,35 +213,6 @@ func (c *CacheFile) StoreGroupExpand(group string, isExpand bool) error {
 	})
 }
 
-func (c *CacheFile) LoadRuleSet(tag string) *adapter.SavedRuleSet {
-	var savedSet adapter.SavedRuleSet
-	err := c.DB.View(func(t *bbolt.Tx) error {
-		bucket := c.bucket(t, bucketRuleSet)
-		if bucket == nil {
-			return os.ErrNotExist
-		}
-		setBinary := bucket.Get([]byte(tag))
-		if len(setBinary) == 0 {
-			return os.ErrInvalid
-		}
-		return savedSet.UnmarshalBinary(setBinary)
-	})
-	if err != nil {
-		return nil
-	}
-	return &savedSet
-}
-
-func (c *CacheFile) SaveRuleSet(tag string, set *adapter.SavedRuleSet) error {
-	return c.DB.Batch(func(t *bbolt.Tx) error {
-		bucket, err := c.createBucket(t, bucketRuleSet)
-		if err != nil {
-			return err
-		}
-		setBinary, err := set.MarshalBinary()
-		if err != nil {
-			return err
-		}
-		return bucket.Put([]byte(tag), setBinary)
-	})
+func (c *CacheFile) Close() error {
+	return c.DB.Close()
 }

experimental/clashapi/cachefile/fakeip.go

@@ -25,7 +25,7 @@ func (c *CacheFile) FakeIPMetadata() *adapter.FakeIPMetadata {
 	err := c.DB.Batch(func(tx *bbolt.Tx) error {
 		bucket := tx.Bucket(bucketFakeIP)
 		if bucket == nil {
-			return os.ErrNotExist
+			return nil
 		}
 		metadataBinary := bucket.Get(keyMetadata)
 		if len(metadataBinary) == 0 {

experimental/clashapi/proxies.go

@@ -100,10 +100,8 @@ func getProxies(server *Server, router adapter.Router) func(w http.ResponseWrite
 			allProxies = append(allProxies, detour.Tag())
 		}
 
-		var defaultTag string
-		if defaultOutbound, err := router.DefaultOutbound(N.NetworkTCP); err == nil {
-			defaultTag = defaultOutbound.Tag()
-		} else {
+		defaultTag := router.DefaultOutbound(N.NetworkTCP).Tag()
+		if defaultTag == "" {
 			defaultTag = allProxies[0]
 		}
 

experimental/clashapi/server.go

@@ -15,6 +15,7 @@ import (
 	"github.com/sagernet/sing-box/common/urltest"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/experimental"
+	"github.com/sagernet/sing-box/experimental/clashapi/cachefile"
 	"github.com/sagernet/sing-box/experimental/clashapi/trafficontrol"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
@@ -48,6 +49,12 @@ type Server struct {
 	mode           string
 	modeList       []string
 	modeUpdateHook chan<- struct{}
+	storeMode      bool
+	storeSelected  bool
+	storeFakeIP    bool
+	cacheFilePath  string
+	cacheID        string
+	cacheFile      adapter.ClashCacheFile
 
 	externalController       bool
 	externalUI               string
@@ -69,6 +76,9 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 		trafficManager:           trafficManager,
 		modeList:                 options.ModeList,
 		externalController:       options.ExternalController != "",
+		storeMode:                options.StoreMode,
+		storeSelected:            options.StoreSelected,
+		storeFakeIP:              options.StoreFakeIP,
 		externalUIDownloadURL:    options.ExternalUIDownloadURL,
 		externalUIDownloadDetour: options.ExternalUIDownloadDetour,
 	}
@@ -84,10 +94,18 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 		server.modeList = append([]string{defaultMode}, server.modeList...)
 	}
 	server.mode = defaultMode
-	//goland:noinspection GoDeprecation
-	//nolint:staticcheck
-	if options.StoreMode || options.StoreSelected || options.StoreFakeIP || options.CacheFile != "" || options.CacheID != "" {
-		return nil, E.New("cache_file and related fields in Clash API is deprecated in sing-box 1.8.0, use experimental.cache_file instead.")
+	if options.StoreMode || options.StoreSelected || options.StoreFakeIP || options.ExternalController == "" {
+		cachePath := os.ExpandEnv(options.CacheFile)
+		if cachePath == "" {
+			cachePath = "cache.db"
+		}
+		if foundPath, loaded := C.FindPath(cachePath); loaded {
+			cachePath = foundPath
+		} else {
+			cachePath = filemanager.BasePath(ctx, cachePath)
+		}
+		server.cacheFilePath = cachePath
+		server.cacheID = options.CacheID
 	}
 	cors := cors.New(cors.Options{
 		AllowedOrigins: []string{"*"},
@@ -110,7 +128,7 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 		r.Mount("/providers/rules", ruleProviderRouter())
 		r.Mount("/script", scriptRouter())
 		r.Mount("/profile", profileRouter())
-		r.Mount("/cache", cacheRouter(ctx))
+		r.Mount("/cache", cacheRouter(router))
 		r.Mount("/dns", dnsRouter(router))
 
 		server.setupMetaAPI(r)
@@ -129,13 +147,19 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 }
 
 func (s *Server) PreStart() error {
-	cacheFile := service.FromContext[adapter.CacheFile](s.ctx)
-	if cacheFile != nil {
-		mode := cacheFile.LoadMode()
-		if common.Any(s.modeList, func(it string) bool {
-			return strings.EqualFold(it, mode)
-		}) {
-			s.mode = mode
+	if s.cacheFilePath != "" {
+		cacheFile, err := cachefile.Open(s.cacheFilePath, s.cacheID)
+		if err != nil {
+			return E.Cause(err, "open cache file")
+		}
+		s.cacheFile = cacheFile
+		if s.storeMode {
+			mode := s.cacheFile.LoadMode()
+			if common.Any(s.modeList, func(it string) bool {
+				return strings.EqualFold(it, mode)
+			}) {
+				s.mode = mode
+			}
 		}
 	}
 	return nil
@@ -163,6 +187,7 @@ func (s *Server) Close() error {
 	return common.Close(
 		common.PtrOrNil(s.httpServer),
 		s.trafficManager,
+		s.cacheFile,
 		s.urlTestHistory,
 	)
 }
@@ -199,9 +224,8 @@ func (s *Server) SetMode(newMode string) {
 		}
 	}
 	s.router.ClearDNSCache()
-	cacheFile := service.FromContext[adapter.CacheFile](s.ctx)
-	if cacheFile != nil {
-		err := cacheFile.StoreMode(newMode)
+	if s.storeMode {
+		err := s.cacheFile.StoreMode(newMode)
 		if err != nil {
 			s.logger.Error(E.Cause(err, "save mode"))
 		}
@@ -209,6 +233,18 @@ func (s *Server) SetMode(newMode string) {
 	s.logger.Info("updated mode: ", newMode)
 }
 
+func (s *Server) StoreSelected() bool {
+	return s.storeSelected
+}
+
+func (s *Server) StoreFakeIP() bool {
+	return s.storeFakeIP
+}
+
+func (s *Server) CacheFile() adapter.ClashCacheFile {
+	return s.cacheFile
+}
+
 func (s *Server) HistoryStorage() *urltest.HistoryStorage {
 	return s.urlTestHistory
 }

experimental/clashapi/server_resources.go

@@ -51,11 +51,7 @@ func (s *Server) downloadExternalUI() error {
 		}
 		detour = outbound
 	} else {
-		outbound, err := s.router.DefaultOutbound(N.NetworkTCP)
-		if err != nil {
-			return err
-		}
-		detour = outbound
+		detour = s.router.DefaultOutbound(N.NetworkTCP)
 	}
 	httpClient := &http.Client{
 		Transport: &http.Transport{

experimental/clashapi/trafficontrol/manager.go

@@ -70,6 +70,9 @@ func (m *Manager) Snapshot() *Snapshot {
 		return true
 	})
 
+	//if memoryInfo, err := m.process.MemoryInfo(); err == nil {
+	//	m.memory = memoryInfo.RSS
+	//} else {
 	var memStats runtime.MemStats
 	runtime.ReadMemStats(&memStats)
 	m.memory = memStats.StackInuse + memStats.HeapInuse + memStats.HeapIdle - memStats.HeapReleased

experimental/clashapi/trafficontrol/tracker.go

@@ -94,9 +94,7 @@ func NewTCPTracker(conn net.Conn, manager *Manager, metadata Metadata, router ad
 	var chain []string
 	var next string
 	if rule == nil {
-		if defaultOutbound, err := router.DefaultOutbound(N.NetworkTCP); err == nil {
-			next = defaultOutbound.Tag()
-		}
+		next = router.DefaultOutbound(N.NetworkTCP).Tag()
 	} else {
 		next = rule.Outbound()
 	}
@@ -183,9 +181,7 @@ func NewUDPTracker(conn N.PacketConn, manager *Manager, metadata Metadata, route
 	var chain []string
 	var next string
 	if rule == nil {
-		if defaultOutbound, err := router.DefaultOutbound(N.NetworkUDP); err == nil {
-			next = defaultOutbound.Tag()
-		}
+		next = router.DefaultOutbound(N.NetworkUDP).Tag()
 	} else {
 		next = rule.Outbound()
 	}

experimental/libbox/command_group.go

@@ -159,7 +159,11 @@ func readGroups(reader io.Reader) (OutboundGroupIterator, error) {
 
 func writeGroups(writer io.Writer, boxService *BoxService) error {
 	historyStorage := service.PtrFromContext[urltest.HistoryStorage](boxService.ctx)
-	cacheFile := service.FromContext[adapter.CacheFile](boxService.ctx)
+	var cacheFile adapter.ClashCacheFile
+	if clashServer := boxService.instance.Router().ClashServer(); clashServer != nil {
+		cacheFile = clashServer.CacheFile()
+	}
+
 	outbounds := boxService.instance.Router().Outbounds()
 	var iGroups []adapter.OutboundGroup
 	for _, it := range outbounds {
@@ -284,15 +288,16 @@ func (s *CommandServer) handleSetGroupExpand(conn net.Conn) error {
 	if err != nil {
 		return err
 	}
-	serviceNow := s.service
-	if serviceNow == nil {
+	service := s.service
+	if service == nil {
 		return writeError(conn, E.New("service not ready"))
 	}
-	cacheFile := service.FromContext[adapter.CacheFile](serviceNow.ctx)
-	if cacheFile != nil {
-		err = cacheFile.StoreGroupExpand(groupTag, isExpand)
-		if err != nil {
-			return writeError(conn, err)
+	if clashServer := service.instance.Router().ClashServer(); clashServer != nil {
+		if cacheFile := clashServer.CacheFile(); cacheFile != nil {
+			err = cacheFile.StoreGroupExpand(groupTag, isExpand)
+			if err != nil {
+				return writeError(conn, err)
+			}
 		}
 	}
 	return writeError(conn, nil)

experimental/libbox/command_status.go

@@ -14,6 +14,7 @@ import (
 
 type StatusMessage struct {
 	Memory           int64
+	MemoryInuse      int64
 	Goroutines       int32
 	ConnectionsIn    int32
 	ConnectionsOut   int32

experimental/libbox/command_urltest.go

@@ -12,7 +12,6 @@ import (
 	"github.com/sagernet/sing/common/batch"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/rw"
-	"github.com/sagernet/sing/service"
 )
 
 func (c *CommandClient) URLTest(groupTag string) error {
@@ -38,11 +37,11 @@ func (s *CommandServer) handleURLTest(conn net.Conn) error {
 	if err != nil {
 		return err
 	}
-	serviceNow := s.service
-	if serviceNow == nil {
+	service := s.service
+	if service == nil {
 		return nil
 	}
-	abstractOutboundGroup, isLoaded := serviceNow.instance.Router().Outbound(groupTag)
+	abstractOutboundGroup, isLoaded := service.instance.Router().Outbound(groupTag)
 	if !isLoaded {
 		return writeError(conn, E.New("outbound group not found: ", groupTag))
 	}
@@ -54,9 +53,15 @@ func (s *CommandServer) handleURLTest(conn net.Conn) error {
 	if isURLTest {
 		go urlTest.CheckOutbounds()
 	} else {
-		historyStorage := service.PtrFromContext[urltest.HistoryStorage](serviceNow.ctx)
+		var historyStorage *urltest.HistoryStorage
+		if clashServer := service.instance.Router().ClashServer(); clashServer != nil {
+			historyStorage = clashServer.HistoryStorage()
+		} else {
+			return writeError(conn, E.New("Clash API is required for URLTest on non-URLTest group"))
+		}
+
 		outbounds := common.Filter(common.Map(outboundGroup.All(), func(it string) adapter.Outbound {
-			itOutbound, _ := serviceNow.instance.Router().Outbound(it)
+			itOutbound, _ := service.instance.Router().Outbound(it)
 			return itOutbound
 		}), func(it adapter.Outbound) bool {
 			if it == nil {
@@ -68,12 +73,12 @@ func (s *CommandServer) handleURLTest(conn net.Conn) error {
 			}
 			return true
 		})
-		b, _ := batch.New(serviceNow.ctx, batch.WithConcurrencyNum[any](10))
+		b, _ := batch.New(service.ctx, batch.WithConcurrencyNum[any](10))
 		for _, detour := range outbounds {
 			outboundToTest := detour
 			outboundTag := outboundToTest.Tag()
 			b.Go(outboundTag, func() (any, error) {
-				t, err := urltest.URLTest(serviceNow.ctx, "", outboundToTest)
+				t, err := urltest.URLTest(service.ctx, "", outboundToTest)
 				if err != nil {
 					historyStorage.DeleteURLTestHistory(outboundTag)
 				} else {

experimental/libbox/platform.go

@@ -19,7 +19,6 @@ type PlatformInterface interface {
 	UsePlatformInterfaceGetter() bool
 	GetInterfaces() (NetworkInterfaceIterator, error)
 	UnderNetworkExtension() bool
-	ReadWIFIState() *WIFIState
 	ClearDNSCache()
 }
 
@@ -39,15 +38,6 @@ type NetworkInterface struct {
 	Addresses StringIterator
 }
 
-type WIFIState struct {
-	SSID  string
-	BSSID string
-}
-
-func NewWIFIState(wifiSSID string, wifiBSSID string) *WIFIState {
-	return &WIFIState{wifiSSID, wifiBSSID}
-}
-
 type NetworkInterfaceIterator interface {
 	Next() *NetworkInterface
 	HasNext() bool

experimental/libbox/platform/interface.go

@@ -23,7 +23,6 @@ type Interface interface {
 	Interfaces() ([]NetworkInterface, error)
 	UnderNetworkExtension() bool
 	ClearDNSCache()
-	ReadWIFIState() adapter.WIFIState
 	process.Searcher
 }
 

experimental/libbox/service.go

@@ -210,14 +210,6 @@ func (w *platformInterfaceWrapper) ClearDNSCache() {
 	w.iif.ClearDNSCache()
 }
 
-func (w *platformInterfaceWrapper) ReadWIFIState() adapter.WIFIState {
-	wifiState := w.iif.ReadWIFIState()
-	if wifiState == nil {
-		return adapter.WIFIState{}
-	}
-	return (adapter.WIFIState)(*wifiState)
-}
-
 func (w *platformInterfaceWrapper) DisableColors() bool {
 	return runtime.GOOS != "android"
 }

go.mod

@@ -12,28 +12,28 @@ require (
 	github.com/go-chi/cors v1.2.1
 	github.com/go-chi/render v1.0.3
 	github.com/gofrs/uuid/v5 v5.0.0
-	github.com/insomniacslk/dhcp v0.0.0-20231126010706-b0416c0f187a
+	github.com/insomniacslk/dhcp v0.0.0-20231016090811-6a2c8fbdcc1c
 	github.com/libdns/alidns v1.0.3
 	github.com/libdns/cloudflare v0.1.0
 	github.com/logrusorgru/aurora v2.0.3+incompatible
 	github.com/mholt/acmez v1.2.0
-	github.com/miekg/dns v1.1.57
+	github.com/miekg/dns v1.1.56
 	github.com/ooni/go-libtor v1.1.8
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a
 	github.com/sagernet/cloudflare-tls v0.0.0-20230829051644-4a68352d0c4a
 	github.com/sagernet/gomobile v0.0.0-20230915142329-c6740b6d2950
-	github.com/sagernet/gvisor v0.0.0-20231119034329-07cfb6aaf930
+	github.com/sagernet/gvisor v0.0.0-20230930141345-5fef6f2e17ab
 	github.com/sagernet/quic-go v0.40.0
 	github.com/sagernet/reality v0.0.0-20230406110435-ee17307e7691
-	github.com/sagernet/sing v0.2.18-0.20231130092223-1f82310f0375
-	github.com/sagernet/sing-dns v0.1.11
+	github.com/sagernet/sing v0.2.18-0.20231108041402-4fbbd193203c
+	github.com/sagernet/sing-dns v0.1.11-0.20231116102430-5a2133f5d358
 	github.com/sagernet/sing-mux v0.1.5-0.20231109075101-6b086ed6bb07
-	github.com/sagernet/sing-quic v0.1.5-0.20231123150216-00957d136203
+	github.com/sagernet/sing-quic v0.1.4-0.20231114135334-e2a6aab55cca
 	github.com/sagernet/sing-shadowsocks v0.2.5
-	github.com/sagernet/sing-shadowsocks2 v0.1.5
+	github.com/sagernet/sing-shadowsocks2 v0.1.4
 	github.com/sagernet/sing-shadowtls v0.1.4
-	github.com/sagernet/sing-tun v0.1.21-0.20231119035513-f6ea97c5af71
+	github.com/sagernet/sing-tun v0.1.20-0.20231116102736-3fa4ee409a9d
 	github.com/sagernet/sing-vmess v0.1.8
 	github.com/sagernet/smux v0.0.0-20230312102458-337ec2a5af37
 	github.com/sagernet/tfo-go v0.0.0-20230816093905-5a5c285d44a6
@@ -44,9 +44,9 @@ require (
 	github.com/stretchr/testify v1.8.4
 	go.uber.org/zap v1.26.0
 	go4.org/netipx v0.0.0-20230824141953-6213f710f925
-	golang.org/x/crypto v0.16.0
-	golang.org/x/net v0.19.0
-	golang.org/x/sys v0.15.0
+	golang.org/x/crypto v0.15.0
+	golang.org/x/net v0.18.0
+	golang.org/x/sys v0.14.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	google.golang.org/grpc v1.59.0
 	google.golang.org/protobuf v1.31.0
@@ -89,7 +89,7 @@ require (
 	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
 	golang.org/x/mod v0.14.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.4.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect