documentation: Bump version

Improve read waiter interface
Make type check strict
2026-10-19 15:54:24 +00:00 · 2023-12-07 18:04:30 +08:00 · 2023-12-07 18:04:30 +08:00 · 2023-12-07 11:17:39 +08:00 · 2023-12-07 11:17:39 +08:00 · 2023-12-07 11:17:39 +08:00
160 changed files with 1507 additions and 2178 deletions
@@ -44,7 +44,13 @@ body:
    attributes:
      label: Version
      description: If you are using the original command line program, please provide the output of the `sing-box version` command.
-      render: shell
+      value: |-
+        <details>
+
+        ```console
+        # Replace this line with the output
+        ```
+        </details>
  - type: textarea
    attributes:
      label: Description
@@ -64,4 +70,10 @@ body:
        If you encounter a crash with the graphical client, please provide crash logs.
        For Apple platform clients, please check `Settings - View Service Log` for crash logs.
        For the Android client, please check the `/sdcard/Android/data/io.nekohasekai.sfa/files/stderr.log` file for crash logs.
-      render: shell
+      value: |-
+        <details>
+        
+        ```console
+        # Replace this line with logs
+        ```
+        </details>
@@ -44,7 +44,13 @@ body:
    attributes:
      label: 版本
      description: 如果您使用原始命令行程序，请提供 `sing-box version` 命令的输出。
-      render: shell
+      value: |-
+        <details>
+
+        ```console
+        # 使用输出内容覆盖此行
+        ```
+        </details>
  - type: textarea
    attributes:
      label: 描述
@@ -64,18 +70,10 @@ body:
        如果您遭遇图形界面应用程序崩溃，请提供崩溃日志。
        对于 Apple 平台图形客户端程序，请检查 `Settings - View Service Log` 以导出崩溃日志。
        对于 Android 图形客户端程序，请检查 `/sdcard/Android/data/io.nekohasekai.sfa/files/stderr.log` 文件以导出崩溃日志。
-      render: shell
-  - type: checkboxes
-    attributes:
-      label: 完整性要求
-      description: 我保证我提供了完整的可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件，否则该 issue 将被关闭。
-      options:
-        - label: 我保证
-          required: true
-  - type: checkboxes
-    attributes:
-      label: 负责性要求
-      description: 我保证我阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值，否则该 issue 将被关闭。
-      options:
-        - label: 我保证
-          required: true
+      value: |-
+        <details>
+        
+        ```console
+        # 使用日志内容覆盖此行
+        ```
+        </details>
@@ -30,7 +30,7 @@ jobs:
        run: |
          echo go_version=$(curl -s https://raw.githubusercontent.com/actions/go-versions/main/versions-manifest.json | grep -oE '"version": "[0-9]{1}.[0-9]{1,}(.[0-9]{1,})?"' | head -1 | cut -d':' -f2 | sed 's/ //g; s/"//g') >> $GITHUB_OUTPUT
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
        with:
          go-version: ${{ steps.version.outputs.go_version }}
      - name: Add cache to Go proxy
@@ -54,7 +54,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
        with:
          go-version: 1.18.10
      - name: Cache go module
@@ -74,7 +74,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
        with:
          go-version: 1.20.7
      - name: Cache go module
@@ -209,7 +209,7 @@ jobs:
        run: |
          echo go_version=$(curl -s https://raw.githubusercontent.com/actions/go-versions/main/versions-manifest.json | grep -oE '"version": "[0-9]{1}.[0-9]{1,}(.[0-9]{1,})?"' | head -1 | cut -d':' -f2 | sed 's/ //g; s/"//g') >> $GITHUB_OUTPUT
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
        with:
          go-version: ${{ steps.version.outputs.go_version }}
      - name: Build
@@ -30,7 +30,7 @@ jobs:
        run: |
          echo go_version=$(curl -s https://raw.githubusercontent.com/actions/go-versions/main/versions-manifest.json | grep -oE '"version": "[0-9]{1}.[0-9]{1,}(.[0-9]{1,})?"' | head -1 | cut -d':' -f2 | sed 's/ //g; s/"//g') >> $GITHUB_OUTPUT
      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
        with:
          go-version: ${{ steps.version.outputs.go_version }}
      - name: golangci-lint
@@ -8,7 +8,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v8
        with:
          stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days'
          days-before-stale: 60
@@ -1,7 +1,7 @@
 NAME = sing-box
 COMMIT = $(shell git rev-parse --short HEAD)
-TAGS_GO118 = with_gvisor,with_dhcp,with_wireguard,with_reality_server,with_clash_api
-TAGS_GO120 = with_quic,with_ech,with_utls
+TAGS_GO118 = with_gvisor,with_dhcp,with_wireguard,with_utls,with_reality_server,with_clash_api
+TAGS_GO120 = with_quic,with_ech
 TAGS ?= $(TAGS_GO118),$(TAGS_GO120)
 TAGS_TEST ?= with_gvisor,with_quic,with_wireguard,with_grpc,with_ech,with_utls,with_reality_server

@@ -178,8 +178,9 @@ lib:
 	go run ./cmd/internal/build_libbox -target ios

 lib_install:
-	go install -v github.com/sagernet/gomobile/cmd/gomobile@v0.1.1
-	go install -v github.com/sagernet/gomobile/cmd/gobind@v0.1.1
+	go get -v -d
+	go install -v github.com/sagernet/gomobile/cmd/gomobile@v0.0.0-20230915142329-c6740b6d2950
+	go install -v github.com/sagernet/gomobile/cmd/gobind@v0.0.0-20230915142329-c6740b6d2950

 docs:
 	mkdocs serve
@@ -17,7 +17,6 @@ import (

 type Router interface {
 	Service
-	PreStarter
 	PostStarter

 	Outbounds() []Outbound
@@ -55,7 +55,7 @@ func New(options Options) (*Box, error) {
 		ctx = context.Background()
 	}
 	ctx = service.ContextWithDefaultRegistry(ctx)
-	ctx = pause.WithDefaultManager(ctx)
+	ctx = pause.ContextWithDefaultManager(ctx)
 	experimentalOptions := common.PtrValueOrDefault(options.Experimental)
 	applyDebugOptions(common.PtrValueOrDefault(experimentalOptions.Debug))
 	var needCacheFile bool
@@ -157,12 +157,9 @@ func New(options Options) (*Box, error) {
 	preServices2 := make(map[string]adapter.Service)
 	postServices := make(map[string]adapter.Service)
 	if needCacheFile {
-		cacheFile := service.FromContext[adapter.CacheFile](ctx)
-		if cacheFile == nil {
-			cacheFile = cachefile.New(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
-			service.MustRegister[adapter.CacheFile](ctx, cacheFile)
-		}
+		cacheFile := cachefile.New(ctx, common.PtrValueOrDefault(experimentalOptions.CacheFile))
 		preServices1["cache file"] = cacheFile
+		service.MustRegister[adapter.CacheFile](ctx, cacheFile)
 	}
 	if needClashAPI {
 		clashAPIOptions := common.PtrValueOrDefault(experimentalOptions.ClashAPI)
@@ -262,10 +259,6 @@ func (s *Box) preStart() error {
 			}
 		}
 	}
-	err = s.router.PreStart()
-	if err != nil {
-		return E.Cause(err, "pre-start router")
-	}
 	err = s.startOutbounds()
 	if err != nil {
 		return err
@@ -320,7 +313,10 @@ func (s *Box) postStart() error {
 			}
 		}
 	}
-
+	err := s.router.PostStart()
+	if err != nil {
+		return E.Cause(err, "post-start router")
+	}
 	return s.router.PostStart()
 }

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"strings"

-	_ "github.com/sagernet/gomobile"
+	_ "github.com/sagernet/gomobile/event/key"
 	"github.com/sagernet/sing-box/cmd/internal/build_shared"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common/rw"
@@ -65,26 +65,50 @@ func merge(outputPath string) error {

 func mergePathResources(options *option.Options) error {
 	for index, inbound := range options.Inbounds {
-		rawOptions, err := inbound.RawOptions()
-		if err != nil {
-			return err
-		}
-		if tlsOptions, containsTLSOptions := rawOptions.(option.InboundTLSOptionsWrapper); containsTLSOptions {
-			tlsOptions.ReplaceInboundTLSOptions(mergeTLSInboundOptions(tlsOptions.TakeInboundTLSOptions()))
+		switch inbound.Type {
+		case C.TypeHTTP:
+			inbound.HTTPOptions.TLS = mergeTLSInboundOptions(inbound.HTTPOptions.TLS)
+		case C.TypeMixed:
+			inbound.MixedOptions.TLS = mergeTLSInboundOptions(inbound.MixedOptions.TLS)
+		case C.TypeVMess:
+			inbound.VMessOptions.TLS = mergeTLSInboundOptions(inbound.VMessOptions.TLS)
+		case C.TypeTrojan:
+			inbound.TrojanOptions.TLS = mergeTLSInboundOptions(inbound.TrojanOptions.TLS)
+		case C.TypeNaive:
+			inbound.NaiveOptions.TLS = mergeTLSInboundOptions(inbound.NaiveOptions.TLS)
+		case C.TypeHysteria:
+			inbound.HysteriaOptions.TLS = mergeTLSInboundOptions(inbound.HysteriaOptions.TLS)
+		case C.TypeVLESS:
+			inbound.VLESSOptions.TLS = mergeTLSInboundOptions(inbound.VLESSOptions.TLS)
+		case C.TypeTUIC:
+			inbound.TUICOptions.TLS = mergeTLSInboundOptions(inbound.TUICOptions.TLS)
+		case C.TypeHysteria2:
+			inbound.Hysteria2Options.TLS = mergeTLSInboundOptions(inbound.Hysteria2Options.TLS)
+		default:
+			continue
 		}
 		options.Inbounds[index] = inbound
 	}
 	for index, outbound := range options.Outbounds {
-		rawOptions, err := outbound.RawOptions()
-		if err != nil {
-			return err
-		}
 		switch outbound.Type {
+		case C.TypeHTTP:
+			outbound.HTTPOptions.TLS = mergeTLSOutboundOptions(outbound.HTTPOptions.TLS)
+		case C.TypeVMess:
+			outbound.VMessOptions.TLS = mergeTLSOutboundOptions(outbound.VMessOptions.TLS)
+		case C.TypeTrojan:
+			outbound.TrojanOptions.TLS = mergeTLSOutboundOptions(outbound.TrojanOptions.TLS)
+		case C.TypeHysteria:
+			outbound.HysteriaOptions.TLS = mergeTLSOutboundOptions(outbound.HysteriaOptions.TLS)
 		case C.TypeSSH:
 			outbound.SSHOptions = mergeSSHOutboundOptions(outbound.SSHOptions)
-		}
-		if tlsOptions, containsTLSOptions := rawOptions.(option.OutboundTLSOptionsWrapper); containsTLSOptions {
-			tlsOptions.ReplaceOutboundTLSOptions(mergeTLSOutboundOptions(tlsOptions.TakeOutboundTLSOptions()))
+		case C.TypeVLESS:
+			outbound.VLESSOptions.TLS = mergeTLSOutboundOptions(outbound.VLESSOptions.TLS)
+		case C.TypeTUIC:
+			outbound.TUICOptions.TLS = mergeTLSOutboundOptions(outbound.TUICOptions.TLS)
+		case C.TypeHysteria2:
+			outbound.Hysteria2Options.TLS = mergeTLSOutboundOptions(outbound.Hysteria2Options.TLS)
+		default:
+			continue
 		}
 		options.Outbounds[index] = outbound
 	}
@@ -17,7 +17,6 @@ import (
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
 	"github.com/sagernet/sing/common/json/badjson"

 	"github.com/spf13/cobra"
@@ -57,7 +56,8 @@ func readConfigAt(path string) (*OptionsEntry, error) {
 	if err != nil {
 		return nil, E.Cause(err, "read config at ", path)
 	}
-	options, err := json.UnmarshalExtended[option.Options](configContent)
+	var options option.Options
+	err = options.UnmarshalJSON(configContent)
 	if err != nil {
 		return nil, E.Cause(err, "decode config at ", path)
 	}
@@ -107,18 +107,13 @@ func readConfigAndMerge() (option.Options, error) {
 	if len(optionsList) == 1 {
 		return optionsList[0].options, nil
 	}
-	var mergedMessage json.RawMessage
+	var mergedOptions option.Options
 	for _, options := range optionsList {
-		mergedMessage, err = badjson.MergeJSON(options.options.RawMessage, mergedMessage)
+		mergedOptions, err = badjson.Merge(options.options, mergedOptions)
 		if err != nil {
 			return option.Options{}, E.Cause(err, "merge config at ", options.path)
 		}
 	}
-	var mergedOptions option.Options
-	err = mergedOptions.UnmarshalJSON(mergedMessage)
-	if err != nil {
-		return option.Options{}, E.Cause(err, "unmarshal merged config")
-	}
 	return mergedOptions, nil
 }

@@ -133,7 +128,7 @@ func create() (*box.Box, context.CancelFunc, error) {
 		}
 		options.Log.DisableColor = true
 	}
-	ctx, cancel := context.WithCancel(globalCtx)
+	ctx, cancel := context.WithCancel(context.Background())
 	instance, err := box.New(box.Options{
 		Context: ctx,
 		Options: options,
@@ -3,19 +3,15 @@ package main
 import (
 	"context"
 	"os"
-	"os/user"
-	"strconv"
 	"time"

 	_ "github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/service/filemanager"

 	"github.com/spf13/cobra"
 )

 var (
-	globalCtx         context.Context
 	configPaths       []string
 	configDirectories []string
 	workingDir        string
@@ -41,30 +37,15 @@ func main() {
 }

 func preRun(cmd *cobra.Command, args []string) {
-	globalCtx = context.Background()
-	sudoUser := os.Getenv("SUDO_USER")
-	sudoUID, _ := strconv.Atoi(os.Getenv("SUDO_UID"))
-	sudoGID, _ := strconv.Atoi(os.Getenv("SUDO_GID"))
-	if sudoUID == 0 && sudoGID == 0 && sudoUser != "" {
-		sudoUserObject, _ := user.Lookup(sudoUser)
-		if sudoUserObject != nil {
-			sudoUID, _ = strconv.Atoi(sudoUserObject.Uid)
-			sudoGID, _ = strconv.Atoi(sudoUserObject.Gid)
-		}
-	}
-	if sudoUID > 0 && sudoGID > 0 {
-		globalCtx = filemanager.WithDefault(globalCtx, "", "", sudoUID, sudoGID)
-	}
 	if disableColor {
 		log.SetStdLogger(log.NewDefaultFactory(context.Background(), log.Formatter{BaseTime: time.Now(), DisableColors: true}, os.Stderr, "", nil, false).Logger())
 	}
 	if workingDir != "" {
 		_, err := os.Stat(workingDir)
 		if err != nil {
-			filemanager.MkdirAll(globalCtx, workingDir, 0o777)
+			os.MkdirAll(workingDir, 0o777)
 		}
-		err = os.Chdir(workingDir)
-		if err != nil {
+		if err := os.Chdir(workingDir); err != nil {
 			log.Fatal(err)
 		}
 	}
@@ -41,12 +41,12 @@ func NewReadWaitConn(conn tls.Conn) (tls.Conn, error) {
 		return nil, E.New("badtls: invalid half mutex")
 	}
 	halfAccess := (*sync.Mutex)(unsafe.Pointer(rawHalfMutex.UnsafeAddr()))
-	rawRawInput := rawConn.FieldByName("rawInput")
+	rawRawInput := rawHalfConn.FieldByName("rawInput")
 	if !rawRawInput.IsValid() || rawRawInput.Kind() != reflect.Struct {
 		return nil, E.New("badtls: invalid raw input")
 	}
 	rawInput := (*bytes.Buffer)(unsafe.Pointer(rawRawInput.UnsafeAddr()))
-	rawInput0 := rawConn.FieldByName("input")
+	rawInput0 := rawHalfConn.FieldByName("input")
 	if !rawInput0.IsValid() || rawInput0.Kind() != reflect.Struct {
 		return nil, E.New("badtls: invalid input")
 	}
@@ -56,6 +56,10 @@ func NewReadWaitConn(conn tls.Conn) (tls.Conn, error) {
 		return nil, E.New("badtls: invalid hand")
 	}
 	hand := (*bytes.Buffer)(unsafe.Pointer(rawHand.UnsafeAddr()))
+	rawReadRecord := rawConn.MethodByName("readRecord")
+	if !rawReadRecord.IsValid() {
+		return nil, E.New("badtls: invalid readRecord")
+	}
 	return &ReadWaitConn{
 		STDConn:    stdConn,
 		halfAccess: halfAccess,
@@ -15,17 +15,14 @@ import (
 	N "github.com/sagernet/sing/common/network"
 )

-var _ WireGuardListener = (*DefaultDialer)(nil)
-
 type DefaultDialer struct {
-	dialer4             tcpDialer
-	dialer6             tcpDialer
-	udpDialer4          net.Dialer
-	udpDialer6          net.Dialer
-	udpListener         net.ListenConfig
-	udpAddr4            string
-	udpAddr6            string
-	isWireGuardListener bool
+	dialer4     tcpDialer
+	dialer6     tcpDialer
+	udpDialer4  net.Dialer
+	udpDialer6  net.Dialer
+	udpListener net.ListenConfig
+	udpAddr4    string
+	udpAddr6    string
 }

 func NewDefault(router adapter.Router, options option.DialerOptions) (*DefaultDialer, error) {
@@ -101,11 +98,6 @@ func NewDefault(router adapter.Router, options option.DialerOptions) (*DefaultDi
 		}
 		setMultiPathTCP(&dialer4)
 	}
-	if options.IsWireGuardListener {
-		for _, controlFn := range wgControlFns {
-			listener.Control = control.Append(listener.Control, controlFn)
-		}
-	}
 	tcpDialer4, err := newTCPDialer(dialer4, options.TCPFastOpen)
 	if err != nil {
 		return nil, err
@@ -122,7 +114,6 @@ func NewDefault(router adapter.Router, options option.DialerOptions) (*DefaultDi
 		listener,
 		udpAddr4,
 		udpAddr6,
-		options.IsWireGuardListener,
 	}, nil
 }

@@ -155,10 +146,6 @@ func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	}
 }

-func (d *DefaultDialer) ListenPacketCompat(network, address string) (net.PacketConn, error) {
-	return trackPacketConn(d.udpListener.ListenPacket(context.Background(), network, address))
-}
-
 func trackConn(conn net.Conn, err error) (net.Conn, error) {
 	if !conntrack.Enabled || err != nil {
 		return conn, err
@@ -6,13 +6,15 @@ import (
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing-dns"
+	"github.com/sagernet/sing/common"
 	N "github.com/sagernet/sing/common/network"
 )

+func MustNew(router adapter.Router, options option.DialerOptions) N.Dialer {
+	return common.Must1(New(router, options))
+}
+
 func New(router adapter.Router, options option.DialerOptions) (N.Dialer, error) {
-	if options.IsWireGuardListener {
-		return NewDefault(router, options)
-	}
 	var (
 		dialer N.Dialer
 		err    error
@@ -1,9 +0,0 @@
-package dialer
-
-import (
-	"net"
-)
-
-type WireGuardListener interface {
-	ListenPacketCompat(network, address string) (net.PacketConn, error)
-}
@@ -1,11 +0,0 @@
-//go:build with_wireguard
-
-package dialer
-
-import (
-	"github.com/sagernet/wireguard-go/conn"
-)
-
-var _ WireGuardListener = (conn.Listener)(nil)
-
-var wgControlFns = conn.ControlFns
@@ -1,9 +0,0 @@
-//go:build !with_wireguard
-
-package dialer
-
-import (
-	"github.com/sagernet/sing/common/control"
-)
-
-var wgControlFns []control.Func
@@ -109,10 +109,8 @@ func readRule(reader io.Reader, recovery bool) (rule option.HeadlessRule, err er
 	}
 	switch ruleType {
 	case 0:
-		rule.Type = C.RuleTypeDefault
 		rule.DefaultOptions, err = readDefaultRule(reader, recovery)
 	case 1:
-		rule.Type = C.RuleTypeLogical
 		rule.LogicalOptions, err = readLogicalRule(reader, recovery)
 	default:
 		err = E.New("unknown rule type: ", ruleType)
@@ -7,7 +7,6 @@ import (
 	"context"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/ecdh"
 	"crypto/ed25519"
 	"crypto/hmac"
 	"crypto/sha256"
@@ -138,21 +137,12 @@ func (e *RealityClientConfig) ClientHandshake(ctx context.Context, conn net.Conn
 	hello.SessionId[2] = 1
 	binary.BigEndian.PutUint32(hello.SessionId[4:], uint32(time.Now().Unix()))
 	copy(hello.SessionId[8:], e.shortID[:])
+
 	if debug.Enabled {
 		fmt.Printf("REALITY hello.sessionId[:16]: %v\n", hello.SessionId[:16])
 	}
-	publicKey, err := ecdh.X25519().NewPublicKey(e.publicKey)
-	if err != nil {
-		return nil, err
-	}
-	ecdheKey := uConn.HandshakeState.State13.EcdheKey
-	if ecdheKey == nil {
-		return nil, E.New("nil ecdhe_key")
-	}
-	authKey, err := ecdheKey.ECDH(publicKey)
-	if err != nil {
-		return nil, err
-	}
+
+	authKey := uConn.HandshakeState.State13.EcdheParams.SharedKey(e.publicKey)
 	if authKey == nil {
 		return nil, E.New("nil auth_key")
 	}
@@ -219,16 +219,6 @@ func uTLSClientHelloID(name string) (utls.ClientHelloID, error) {
 	switch name {
 	case "chrome", "":
 		return utls.HelloChrome_Auto, nil
-	case "chrome_psk":
-		return utls.HelloChrome_100_PSK, nil
-	case "chrome_psk_shuffle":
-		return utls.HelloChrome_112_PSK_Shuf, nil
-	case "chrome_padding_psk_shuffle":
-		return utls.HelloChrome_114_Padding_PSK_Shuf, nil
-	case "chrome_pq":
-		return utls.HelloChrome_115_PQ, nil
-	case "chrome_pq_psk":
-		return utls.HelloChrome_115_PQ_PSK, nil
 	case "firefox":
 		return utls.HelloFirefox_Auto, nil
 	case "edge":
@@ -2,48 +2,7 @@
 icon: material/alert-decagram
 ---

-#### 1.8.0-beta.8
-
-* Fixes and improvements
-
-#### 1.7.5
-
-* Fixes and improvements
-
-#### 1.8.0-alpha.17
-
-* Add GSO support for TUN and WireGuard system interface **1**
-* Update uTLS to 1.5.4 **2**
-* Update dependencies **3**
-* Fixes and improvements
-
-**1**:
-
-See [TUN](/configuration/inbound/tun/) inbound and [WireGuard](/configuration/outbound/wireguard/) outbound.
-
-**2**:
-
-Added some new [fingerprints](/configuration/shared/tls#utls).
-Also, starting with this release, uTLS requires at least Go 1.20.
-
-**3**:
-
-Updated `cloudflare-tls`, `gomobile`, `smux`, `tfo-go` and `wireguard-go` to latest, and `gvisor` to `20231204.0`
-
-This may break something, good luck!
-
-#### 1.7.4
-
-* Fixes and improvements
-
-_Due to the long waiting time, this version is no longer waiting for approval
-by the Apple App Store, so updates to Apple Platforms will be delayed._
-
-#### 1.8.0-alpha.16
-
-* Fixes and improvements
-
-#### 1.8.0-alpha.15
+#### 1.8.0-alpha.14

 * Some chaotic changes **1**
 * Fixes and improvements
@@ -131,13 +90,13 @@ Since GeoIP was deprecated, we made this rule independent, see [Migration](/migr
 #### 1.8.0-alpha.1

 * Migrate cache file from Clash API to independent options **1**
-* Introducing [Rule Set](/configuration/rule-set/) **2**
+* Introducing [Rule Set](/configuration/rule-set) **2**
 * Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands **3**
 * Allow nested logical rules **4**

 **1**:

-See [Cache File](/configuration/experimental/cache-file/) and
+See [Cache File](/configuration/experimental/cache-file) and
 [Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).

 **2**:
@@ -148,11 +107,11 @@ it can include more types of rules, load faster,
 use less memory, and update automatically.

 See [Route#rule_set](/configuration/route/#rule_set),
-[Route Rule](/configuration/route/rule/),
-[DNS Rule](/configuration/dns/rule/),
-[Rule Set](/configuration/rule-set/),
-[Source Format](/configuration/rule-set/source-format/) and
-[Headless Rule](/configuration/rule-set/headless-rule/).
+[Route Rule](/configuration/route/rule),
+[DNS Rule](/configuration/dns/rule),
+[Rule Set](/configuration/rule-set),
+[Source Format](/configuration/rule-set/source-format) and
+[Headless Rule](/configuration/rule-set/headless-rule).

 For GEO resources migration, see [Migrate GeoIP to rule sets](/migration/#migrate-geoip-to-rule-sets) and
 [Migrate Geosite to rule sets](/migration/#migrate-geosite-to-rule-sets).
@@ -171,8 +130,8 @@ Logical rules in route rules, DNS rules, and the new headless rule now allow nes

 Important changes since 1.6:

-* Add [exclude route support](/configuration/inbound/tun/) for TUN inbound
-* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen/) **1**
+* Add [exclude route support](/configuration/inbound/tun) for TUN inbound
+* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen) **1**
 * Add [HTTPUpgrade V2Ray transport](/configuration/shared/v2ray-transport#HTTPUpgrade) support **2**
 * Migrate multiplex and UoT server to inbound **3**
 * Add TCP Brutal support for multiplex **4**
@@ -196,14 +155,13 @@ The new HTTPUpgrade transport has better performance than WebSocket and is bette

 **3**:

-Starting in 1.7.0, multiplexing support is no longer enabled by default
-and needs to be turned on explicitly in inbound
+Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound
 options.

 **4**

 Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
-see [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
+see [TCP Brutal](/configuration/shared/tcp-brutal) for details.

 **5**:

@@ -292,7 +250,7 @@ Only supported in graphical clients on Android and iOS.

 #### 1.6.1

-* Our [Android client](/installation/clients/sfa/) is now available in the Google Play Store ▶️
+* Our [Android client](/installation/clients/sfa) is now available in the Google Play Store ▶️
 * Fixes and improvements

 #### 1.7.0-alpha.6
@@ -312,7 +270,7 @@ options.
 **2**

 Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
-see [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
+see [TCP Brutal](/configuration/shared/tcp-brutal) for details.

 #### 1.7.0-alpha.3

@@ -331,13 +289,13 @@ The new HTTPUpgrade transport has better performance than WebSocket and is bette

 Important changes since 1.5:

-* Our [Apple tvOS client](/installation/clients/sft/) is now available in the App Store 🍎
+* Our [Apple tvOS client](/installation/clients/sft) is now available in the App Store 🍎
 * Update BBR congestion control for TUIC and Hysteria2 **1**
 * Update brutal congestion control for Hysteria2
 * Add `brutal_debug` option for Hysteria2
 * Update legacy Hysteria protocol **2**
 * Add TLS self sign key pair generate command
-* Remove [Deprecated Features](/deprecated/) by agreement
+* Remove [Deprecated Features](/deprecated) by agreement

 **1**:

@@ -355,8 +313,8 @@ the old protocol (Hysteria 1) have been updated to be consistent with Hysteria 2

 #### 1.7.0-alpha.1

-* Add [exclude route support](/configuration/inbound/tun/) for TUN inbound
-* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen/) **1**
+* Add [exclude route support](/configuration/inbound/tun) for TUN inbound
+* Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen) **1**
 * Fixes and improvements

 **1**:
@@ -379,8 +337,7 @@ When `auto_route` is enabled and `strict_route` is disabled, the device can now

 **2**:

-Built using Go 1.20, the last version that will run on
-Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
 Sierra, 10.14 Mojave.

 #### 1.6.0-rc.4
@@ -394,8 +351,7 @@ Sierra, 10.14 Mojave.

 **1**:

-Built using Go 1.20, the last version that will run on
-Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
+Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
 Sierra, 10.14 Mojave.

 #### 1.6.0-beta.4
@@ -476,7 +432,7 @@ introduce new issues.

 #### 1.5.2

-* Our [Apple tvOS client](/installation/clients/sft/) is now available in the App Store 🍎
+* Our [Apple tvOS client](/installation/clients/sft) is now available in the App Store 🍎
 * Fixes and improvements

 #### 1.6.0-alpha.3
@@ -496,7 +452,7 @@ introduce new issues.
 * Update BBR congestion control for TUIC and Hysteria2 **1**
 * Update quic-go to v0.39.0
 * Update gVisor to 20230814.0
-* Remove [Deprecated Features](/deprecated/) by agreement
+* Remove [Deprecated Features](/deprecated) by agreement
 * Fixes and improvements

 **1**:
@@ -510,7 +466,7 @@ This update is intended to address the multi-send defects of the old implementat

 Important changes since 1.4:

-* Add TLS [ECH server](/configuration/shared/tls/) support
+* Add TLS [ECH server](/configuration/shared/tls) support
 * Improve TLS TCH client configuration
 * Add TLS ECH key pair generator **1**
 * Add TLS ECH support for QUIC based protocols **2**
@@ -519,7 +475,7 @@ Important changes since 1.4:
 * Add `interrupt_exist_connections` option for `Selector` and `URLTest` outbounds **4**
 * Add DNS01 challenge support for ACME TLS certificate issuer **5**
 * Add `merge` command **6**
-* Mark [Deprecated Features](/deprecated/)
+* Mark [Deprecated Features](/deprecated)

 **1**:

@@ -531,7 +487,7 @@ All inbounds and outbounds are supported, including `Naiveproxy`, `Hysteria[/2]`

 **3**:

-See [Hysteria2 inbound](/configuration/inbound/hysteria2/) and [Hysteria2 outbound](/configuration/outbound/hysteria2/)
+See [Hysteria2 inbound](/configuration/inbound/hysteria2) and [Hysteria2 outbound](/configuration/outbound/hysteria2)

 For protocol description, please refer to [https://v2.hysteria.network](https://v2.hysteria.network)

@@ -544,7 +500,7 @@ Only inbound connections are affected by this setting, internal connections will
 **5**:

 Only `Alibaba Cloud DNS` and `Cloudflare` are supported, see [ACME Fields](/configuration/shared/tls#acme-fields)
-and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/).
+and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge).

 **6**:

@@ -626,7 +582,7 @@ Global Flags:

 Only `Alibaba Cloud DNS` and `Cloudflare` are supported,
 see [ACME Fields](/configuration/shared/tls#acme-fields)
-and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/).
+and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge).

 #### 1.5.0-beta.10

@@ -655,7 +611,7 @@ Only inbound connections are affected by this setting, internal connections will

 * Fix compatibility issues with official Hysteria2 server and client
 * Fixes and improvements
-* Mark [deprecated features](/deprecated/)
+* Mark [deprecated features](/deprecated)

 #### 1.5.0-beta.3

@@ -674,13 +630,13 @@ Hysteria2 server and client when using `fastOpen=false` or UDP MTU >= 1200.

 **1**:

-See [Hysteria2 inbound](/configuration/inbound/hysteria2/) and [Hysteria2 outbound](/configuration/outbound/hysteria2/)
+See [Hysteria2 inbound](/configuration/inbound/hysteria2) and [Hysteria2 outbound](/configuration/outbound/hysteria2)

 For protocol description, please refer to [https://v2.hysteria.network](https://v2.hysteria.network)

 #### 1.5.0-beta.1

-* Add TLS [ECH server](/configuration/shared/tls/) support
+* Add TLS [ECH server](/configuration/shared/tls) support
 * Improve TLS TCH client configuration
 * Add TLS ECH key pair generator **1**
 * Add TLS ECH support for QUIC based protocols **2**
@@ -713,12 +669,12 @@ Important changes since 1.3:

 *1*:

-See [TUIC inbound](/configuration/inbound/tuic/)
-and [TUIC outbound](/configuration/outbound/tuic/)
+See [TUIC inbound](/configuration/inbound/tuic)
+and [TUIC outbound](/configuration/outbound/tuic)

 **2**:

-This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp/), designed to provide a QUIC
+This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp), designed to provide a QUIC
 stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or
 another program compatible with the protocol as a server.

@@ -749,7 +705,7 @@ Requires sing-box to be compiled with Go 1.21.

 **1**:

-This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp/), designed to provide a QUIC
+This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp), designed to provide a QUIC
 stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or
 another program compatible with the protocol as a server.

@@ -787,8 +743,8 @@ Requires sing-box to be compiled with Go 1.21.

 *1*:

-See [TUIC inbound](/configuration/inbound/tuic/)
-and [TUIC outbound](/configuration/outbound/tuic/)
+See [TUIC inbound](/configuration/inbound/tuic)
+and [TUIC outbound](/configuration/outbound/tuic)

 #### 1.3.6

@@ -797,7 +753,7 @@ and [TUIC outbound](/configuration/outbound/tuic/)
 #### 1.3.5

 * Fixes and improvements
-* Introducing our [Apple tvOS](/installation/clients/sft/) client applications **1**
+* Introducing our [Apple tvOS](/installation/clients/sft) client applications **1**
 * Add per app proxy and app installed/updated trigger support for Android client
 * Add profile sharing support for Android/iOS/macOS clients

@@ -824,8 +780,7 @@ downloaded through TestFlight.

 #### 1.3.1-beta.3

-* Introducing our [new iOS](/installation/clients/sfi/) and [macOS](/installation/clients/sfm/) client applications **1
-  **
+* Introducing our [new iOS](/installation/clients/sfi) and [macOS](/installation/clients/sfm) client applications **1**
 * Fixes and improvements

 **1**:
@@ -846,7 +801,7 @@ The old testflight link and app are no longer valid.

 Important changes since 1.2:

-* Add [FakeIP](/configuration/dns/fakeip/) support **1**
+* Add [FakeIP](/configuration/dns/fakeip) support **1**
 * Improve multiplex **2**
 * Add [DNS reverse mapping](/configuration/dns#reverse_mapping) support
 * Add `rewrite_ttl` DNS rule action
@@ -873,11 +828,11 @@ Important changes since 1.2:

 *1*:

-See [FAQ](/faq/fakeip/) for more information.
+See [FAQ](/faq/fakeip) for more information.

 *2*:

-Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex/).
+Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex).

 #### 1.3-rc2

@@ -939,7 +894,7 @@ Improved performance and reduced memory usage.

 *1*:

-Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex/).
+Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex).

 #### 1.2.6

@@ -991,25 +946,25 @@ This is an incompatible update for XUDP in VLESS if vision flow is enabled.
 #### 1.3-beta1

 * Add [DNS reverse mapping](/configuration/dns#reverse_mapping) support
-* Add [L3 routing](/configuration/route/ip-rule/) support **1**
+* Add [L3 routing](/configuration/route/ip-rule) support **1**
 * Add `rewrite_ttl` DNS rule action
-* Add [FakeIP](/configuration/dns/fakeip/) support **2**
+* Add [FakeIP](/configuration/dns/fakeip) support **2**
 * Add `store_fakeip` Clash API option
 * Add multi-peer support for [WireGuard](/configuration/outbound/wireguard#peers) outbound
 * Add loopback detect

 *1*:

-It can currently be used to [route connections directly to WireGuard](/examples/wireguard-direct/) or block connections
+It can currently be used to [route connections directly to WireGuard](/examples/wireguard-direct) or block connections
 at the IP layer.

 *2*:

-See [FAQ](/faq/fakeip/) for more information.
+See [FAQ](/faq/fakeip) for more information.

 #### 1.2.3

-* Introducing our [new Android client application](/installation/clients/sfa/)
+* Introducing our [new Android client application](/installation/clients/sfa)
 * Improve UDP domain destination NAT
 * Update reality protocol
 * Fix TTL calculation for DNS response
@@ -1038,16 +993,16 @@ to `domain` rule.

 Important changes since 1.1:

-* Introducing our [new iOS client application](/installation/clients/sfi/)
-* Introducing [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp/)
+* Introducing our [new iOS client application](/installation/clients/sfi)
+* Introducing [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp)
 * Add [platform options](/configuration/inbound/tun#platform) for tun inbound
 * Add [ShadowTLS protocol v3](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-v3-en.md)
-* Add [VLESS server](/configuration/inbound/vless/) and [vision](/configuration/outbound/vless#flow) support
-* Add [reality TLS](/configuration/shared/tls/) support
-* Add [NTP service](/configuration/ntp/)
-* Add [DHCP DNS server](/configuration/dns/server/) support
-* Add SSH [host key validation](/configuration/outbound/ssh/) support
-* Add [query_type](/configuration/dns/rule/) DNS rule item
+* Add [VLESS server](/configuration/inbound/vless) and [vision](/configuration/outbound/vless#flow) support
+* Add [reality TLS](/configuration/shared/tls) support
+* Add [NTP service](/configuration/ntp)
+* Add [DHCP DNS server](/configuration/dns/server) support
+* Add SSH [host key validation](/configuration/outbound/ssh) support
+* Add [query_type](/configuration/dns/rule) DNS rule item
 * Add fallback support for v2ray transport
 * Add custom TLS server support for http based v2ray transports
 * Add health check support for http-based v2ray transports
@@ -1078,7 +1033,7 @@ name.

 #### 1.2-beta9

-* Introducing the [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp/)
+* Introducing the [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp)
 * Add health check support for http-based v2ray transports
 * Remove length limit on short_id for reality TLS config
 * Fix bugs and update dependencies
@@ -1095,7 +1050,7 @@ name.

 #### 1.2-beta6

-* Introducing our [new iOS client application](/installation/clients/sfi/)
+* Introducing our [new iOS client application](/installation/clients/sfi)
 * Add [platform options](/configuration/inbound/tun#platform) for tun inbound
 * Add custom TLS server support for http based v2ray transports
 * Add generate commands
@@ -1108,8 +1063,8 @@ name.

 #### 1.2-beta5

-* Add [VLESS server](/configuration/inbound/vless/) and [vision](/configuration/outbound/vless#flow) support
-* Add [reality TLS](/configuration/shared/tls/) support
+* Add [VLESS server](/configuration/inbound/vless) and [vision](/configuration/outbound/vless#flow) support
+* Add [reality TLS](/configuration/shared/tls) support
 * Fix match private address

 #### 1.1.6
@@ -1124,7 +1079,7 @@ name.

 #### 1.2-beta4

-* Add [NTP service](/configuration/ntp/)
+* Add [NTP service](/configuration/ntp)
 * Add Add multiple server names and multi-user support for shadowtls
 * Add strict mode support for shadowtls v3
 * Add uTLS support for shadowtls v3
@@ -1144,9 +1099,9 @@ name.

 #### 1.2-beta1

-* Add [DHCP DNS server](/configuration/dns/server/) support
-* Add SSH [host key validation](/configuration/outbound/ssh/) support
-* Add [query_type](/configuration/dns/rule/) DNS rule item
+* Add [DHCP DNS server](/configuration/dns/server) support
+* Add SSH [host key validation](/configuration/outbound/ssh) support
+* Add [query_type](/configuration/dns/rule) DNS rule item
 * Add v2ray [user stats](/configuration/experimental#statsusers) api
 * Add new clash DNS query api
 * Improve vmess request
@@ -1375,7 +1330,7 @@ and [ShadowTLS outbound](/configuration/outbound/shadowtls#version)

 #### 1.1-beta6

-* Add [URLTest outbound](/configuration/outbound/urltest/)
+* Add [URLTest outbound](/configuration/outbound/urltest)
 * Fix bugs in 1.1-beta5

 #### 1.1-beta5
@@ -1407,8 +1362,8 @@ The default tun stack is changed to system.
 #### 1.1-beta4

 * Add internal simple-obfs and v2ray-plugin [Shadowsocks plugins](/configuration/outbound/shadowsocks#plugin)
-* Add [ShadowsocksR outbound](/configuration/outbound/shadowsocksr/)
-* Add [VLESS outbound and XUDP](/configuration/outbound/vless/)
+* Add [ShadowsocksR outbound](/configuration/outbound/shadowsocksr)
+* Add [VLESS outbound and XUDP](/configuration/outbound/vless)
 * Skip wait for hysteria tcp handshake response
 * Fix socks4 client
 * Fix hysteria inbound
@@ -1435,7 +1390,7 @@ The default tun stack is changed to system.
 *1*:

 Switching modes using the Clash API, and `store-selected` are now supported,
-see [Experimental](/configuration/experimental/).
+see [Experimental](/configuration/experimental).

 *2*:

@@ -1516,15 +1471,15 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 * Fix write trojan udp
 * Fix DNS routing
 * Add attribute support for geosite
-* Update documentation for [Dial Fields](/configuration/shared/dial/)
+* Update documentation for [Dial Fields](/configuration/shared/dial)

 #### 1.0-beta3

 * Add [chained inbound](/configuration/shared/listen#detour) support
 * Add process_path rule item
 * Add macOS redirect support
-* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls/), [Outbound](/configuration/outbound/shadowtls/)
-  and [Examples](/examples/shadowtls/)
+* Add ShadowTLS [Inbound](/configuration/inbound/shadowtls), [Outbound](/configuration/outbound/shadowtls)
+  and [Examples](/examples/shadowtls)
 * Fix search android package in non-owner users
 * Fix socksaddr type condition
 * Fix smux session status
@@ -1568,7 +1523,7 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).

 ##### 2022/08/23

-* Add [V2Ray Transport](/configuration/shared/v2ray-transport/) support for VMess and Trojan
+* Add [V2Ray Transport](/configuration/shared/v2ray-transport) support for VMess and Trojan
 * Allow plain http request in Naive inbound (It can now be used with nginx)
 * Add proxy protocol support
 * Free memory after start
@@ -1577,13 +1532,13 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).

 ##### 2022/08/22

-* Add strategy setting for each [DNS server](/configuration/dns/server/)
+* Add strategy setting for each [DNS server](/configuration/dns/server)
 * Add bind address to outbound options

 ##### 2022/08/21

-* Add [Tor outbound](/configuration/outbound/tor/)
-* Add [SSH outbound](/configuration/outbound/ssh/)
+* Add [Tor outbound](/configuration/outbound/tor)
+* Add [SSH outbound](/configuration/outbound/ssh)

 ##### 2022/08/20

@@ -1597,8 +1552,8 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).

 ##### 2022/08/19

-* Add Hysteria [Inbound](/configuration/inbound/hysteria/) and [Outbund](/configuration/outbound/hysteria/)
-* Add [ACME TLS certificate issuer](/configuration/shared/tls/)
+* Add Hysteria [Inbound](/configuration/inbound/hysteria) and [Outbund](/configuration/outbound/hysteria)
+* Add [ACME TLS certificate issuer](/configuration/shared/tls)
 * Allow read config from stdin (-c stdin)
 * Update gVisor to 20220815.0

@@ -1616,11 +1571,11 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 ##### 2022/08/16

 * Add ip_version (route/dns) rule item
-* Add [WireGuard](/configuration/outbound/wireguard/) outbound
+* Add [WireGuard](/configuration/outbound/wireguard) outbound

 ##### 2022/08/15

-* Add uid, android user and package rules support in [Tun](/configuration/inbound/tun/) routing.
+* Add uid, android user and package rules support in [Tun](/configuration/inbound/tun) routing.

 ##### 2022/08/13

@@ -1629,15 +1584,15 @@ and [Listen Fields](/configuration/shared/listen#udp_fragment).
 ##### 2022/08/12

 * Performance improvements
-* Add UoT option for [SOCKS](/configuration/outbound/socks/) outbound
+* Add UoT option for [SOCKS](/configuration/outbound/socks) outbound

 ##### 2022/08/11

-* Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks/) outbound, UoT support for all inbounds
+* Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks) outbound, UoT support for all inbounds

 ##### 2022/08/10

-* Add full-featured [Naive](/configuration/inbound/naive/) inbound
+* Add full-featured [Naive](/configuration/inbound/naive) inbound
 * Fix default dns server option [#9] by iKirby

 ##### 2022/08/09
@@ -18,7 +18,6 @@ SFA provides an unprivileged TUN implementation through Android VpnService.
 | `inet4_address`               | :material-check: | /                  |
 | `inet6_address`               | :material-check: | /                  |
 | `mtu`                         | :material-check: | /                  |
-| `gso`                         | :material-close: | No permission      |
 | `auto_route`                  | :material-check: | /                  |
 | `strict_route`                | :material-close: | Not implemented    |
 | `inet4_route_address`         | :material-check: | /                  |
@@ -14,29 +14,28 @@ SFI/SFM/SFT allows you to run sing-box through NetworkExtension with Application

 SFI/SFM/SFT provides an unprivileged TUN implementation through NetworkExtension.

-| TUN inbound option            | Available         | Note              |
-|-------------------------------|-------------------|-------------------|
-| `interface_name`              | :material-close:️ | Managed by Darwin |
-| `inet4_address`               | :material-check:  | /                 |
-| `inet6_address`               | :material-check:  | /                 |
-| `mtu`                         | :material-check:  | /                 |
-| `gso`                         | :material-close:  | Not implemented   |
-| `auto_route`                  | :material-check:  | /                 |
-| `strict_route`                | :material-close:️ | Not implemented   |
-| `inet4_route_address`         | :material-check:  | /                 |
-| `inet6_route_address`         | :material-check:  | /                 |
-| `inet4_route_exclude_address` | :material-check:  | /                 |
-| `inet6_route_exclude_address` | :material-check:  | /                 |
-| `endpoint_independent_nat`    | :material-check:  | /                 |
-| `stack`                       | :material-check:  | /                 |
-| `include_interface`           | :material-close:️ | Not implemented   |
-| `exclude_interface`           | :material-close:️ | Not implemented   |
-| `include_uid`                 | :material-close:️ | Not implemented   |
-| `exclude_uid`                 | :material-close:️ | Not implemented   |
-| `include_android_user`        | :material-close:️ | Not implemented   |
-| `include_package`             | :material-close:️ | Not implemented   |
-| `exclude_package`             | :material-close:️ | Not implemented   |
-| `platform`                    | :material-check:  | /                 |
+| TUN inbound option            | Available | Note              |
+|-------------------------------|-----------|-------------------|
+| `interface_name`              | ✖️        | Managed by Darwin |
+| `inet4_address`               | ✔️        | /                 |
+| `inet6_address`               | ✔️        | /                 |
+| `mtu`                         | ✔️        | /                 |
+| `auto_route`                  | ✔️        | /                 |
+| `strict_route`                | ✖️        | Not implemented   |
+| `inet4_route_address`         | ✔️        | /                 |
+| `inet6_route_address`         | ✔️        | /                 |
+| `inet4_route_exclude_address` | ✔️        | /                 |
+| `inet6_route_exclude_address` | ✔️        | /                 |
+| `endpoint_independent_nat`    | ✔️        | /                 |
+| `stack`                       | ✔️        | /                 |
+| `include_interface`           | ✖️        | Not implemented   |
+| `exclude_interface`           | ✖️        | Not implemented   |
+| `include_uid`                 | ✖️        | Not implemented   |
+| `exclude_uid`                 | ✖️        | Not implemented   |
+| `include_android_user`        | ✖️        | Not implemented   |
+| `include_package`             | ✖️        | Not implemented   |
+| `exclude_package`             | ✖️        | Not implemented   |
+| `platform`                    | ✔️        | /                 |

 | Route/DNS rule option | Available        | Note                  |
 |-----------------------|------------------|-----------------------|
@@ -4,8 +4,8 @@ Maintained by Project S to provide a unified experience and platform-specific fu

 | Platform                              | Client                                  |
 |---------------------------------------|-----------------------------------------|
-| :material-android: Android            | [sing-box for Android](./android/)       |
-| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple/) |
+| :material-android: Android            | [sing-box for Android](./android)       |
+| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
 | :material-laptop: Desktop             | Working in progress                     |

 Some third-party projects that claim to use sing-box or use sing-box as a selling point are not listed here. The core
@@ -4,8 +4,8 @@

 | 平台                                    | 客户端                                     |
 |---------------------------------------|-----------------------------------------|
-| :material-android: Android            | [sing-box for Android](./android/)       |
-| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple/) |
+| :material-android: Android            | [sing-box for Android](./android)       |
+| :material-apple: iOS/macOS/Apple tvOS | [sing-box for Apple platforms](./apple) |
 | :material-laptop: Desktop             | 施工中                                     |

 此处没有列出一些声称使用或以 sing-box 为卖点的第三方项目。此类项目维护者的动机是获得更多用户，即使它们提供友好的商业
@@ -23,9 +23,9 @@

 | Key      | Format                         |
 |----------|--------------------------------|
-| `server` | List of [DNS Server](./server/) |
-| `rules`  | List of [DNS Rule](./rule/)     |
-| `fakeip` | [FakeIP](./fakeip/)             |
+| `server` | List of [DNS Server](./server) |
+| `rules`  | List of [DNS Rule](./rule)     |
+| `fakeip` | [FakeIP](./fakeip)             |

 #### final

@@ -62,4 +62,4 @@ problematic in environments such as macOS, where DNS is proxied and cached by th

 #### fakeip

-[FakeIP](./fakeip/) settings.
+[FakeIP](./fakeip) settings.
@@ -23,8 +23,8 @@

 | 键        | 格式                     |
 |----------|------------------------|
-| `server` | 一组 [DNS 服务器](./server/) |
-| `rules`  | 一组 [DNS 规则](./rule/)    |
+| `server` | 一组 [DNS 服务器](./server) |
+| `rules`  | 一组 [DNS 规则](./rule)    |

 #### final

@@ -60,4 +60,4 @@

 #### fakeip

-[FakeIP](./fakeip/) 设置。
+[FakeIP](./fakeip) 设置。
@@ -134,15 +134,13 @@ icon: material/alert-decagram
    The default rule uses the following matching logic:  
    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
    (`port` || `port_range`) &&  
-    (`source_geoip` || `source_ip_cidr` ｜｜ `source_ip_is_private`) &&  
+    (`source_geoip` || `source_ip_cidr`) &&  
    (`source_port` || `source_port_range`) &&  
    `other fields`

-    Additionally, included rule sets can be considered merged rather than as a single rule sub-item.
-
 #### inbound

-Tags of [Inbound](/configuration/inbound/).
+Tags of [Inbound](/configuration/inbound).

 #### ip_version

@@ -131,15 +131,13 @@ icon: material/alert-decagram
    默认规则使用以下匹配逻辑:  
    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
    (`port` || `port_range`) &&  
-    (`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
+    (`source_geoip` || `source_ip_cidr`) &&  
    (`source_port` || `source_port_range`) &&  
    `other fields`

-    另外，引用的规则集可视为被合并，而不是作为一个单独的规则子项。
-
 #### inbound

-[入站](/zh/configuration/inbound/) 标签.
+[入站](/zh/configuration/inbound) 标签.

 #### ip_version

@@ -41,7 +41,7 @@ The address of the dns server.
 | `HTTP3`                             | `h3://8.8.8.8/dns-query`      |
 | `RCode`                             | `rcode://refused`             |
 | `DHCP`                              | `dhcp://auto` or `dhcp://en0` |
-| [FakeIP](/configuration/dns/fakeip/) | `fakeip`                      |
+| [FakeIP](/configuration/dns/fakeip) | `fakeip`                      |

 !!! warning ""

@@ -41,7 +41,7 @@ DNS 服务器的地址。
 | `HTTP3`                             | `h3://8.8.8.8/dns-query`     |
 | `RCode`                             | `rcode://refused`            |
 | `DHCP`                              | `dhcp://auto` 或 `dhcp://en0` |
-| [FakeIP](/configuration/dns/fakeip/) | `fakeip`                     |
+| [FakeIP](/configuration/dns/fakeip) | `fakeip`                     |

 !!! warning ""

@@ -25,6 +25,6 @@ icon: material/alert-decagram

 | Key          | Format                     |
 |--------------|----------------------------|
-| `cache_file` | [Cache File](./cache-file/) |
-| `clash_api`  | [Clash API](./clash-api/)   |
-| `v2ray_api`  | [V2Ray API](./v2ray-api/)   |
+| `cache_file` | [Cache File](./cache-file) |
+| `clash_api`  | [Clash API](./clash-api)   |
+| `v2ray_api`  | [V2Ray API](./v2ray-api)   |
@@ -25,6 +25,6 @@ icon: material/alert-decagram

 | 键            | 格式                       |
 |--------------|--------------------------|
-| `cache_file` | [缓存文件](./cache-file/)     |
-| `clash_api`  | [Clash API](./clash-api/) |
-| `v2ray_api`  | [V2Ray API](./v2ray-api/) |
+| `cache_file` | [缓存文件](./cache-file)     |
+| `clash_api`  | [Clash API](./clash-api) |
+| `v2ray_api`  | [V2Ray API](./v2ray-api) |
@@ -17,7 +17,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -20,7 +20,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -31,7 +31,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -35,7 +35,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -17,22 +17,22 @@

 | Type          | Format                       | Injectable |
 |---------------|------------------------------|------------|
-| `direct`      | [Direct](./direct/)           | X          |
-| `mixed`       | [Mixed](./mixed/)             | TCP        |
-| `socks`       | [SOCKS](./socks/)             | TCP        |
-| `http`        | [HTTP](./http/)               | TCP        |
-| `shadowsocks` | [Shadowsocks](./shadowsocks/) | TCP        |
-| `vmess`       | [VMess](./vmess/)             | TCP        |
-| `trojan`      | [Trojan](./trojan/)           | TCP        |
-| `naive`       | [Naive](./naive/)             | X          |
-| `hysteria`    | [Hysteria](./hysteria/)       | X          |
-| `shadowtls`   | [ShadowTLS](./shadowtls/)     | TCP        |
-| `tuic`        | [TUIC](./tuic/)               | X          |
-| `hysteria2`   | [Hysteria2](./hysteria2/)     | X          |
-| `vless`       | [VLESS](./vless/)             | TCP        |
-| `tun`         | [Tun](./tun/)                 | X          |
-| `redirect`    | [Redirect](./redirect/)       | X          |
-| `tproxy`      | [TProxy](./tproxy/)           | X          |
+| `direct`      | [Direct](./direct)           | X          |
+| `mixed`       | [Mixed](./mixed)             | TCP        |
+| `socks`       | [SOCKS](./socks)             | TCP        |
+| `http`        | [HTTP](./http)               | TCP        |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP        |
+| `vmess`       | [VMess](./vmess)             | TCP        |
+| `trojan`      | [Trojan](./trojan)           | TCP        |
+| `naive`       | [Naive](./naive)             | X          |
+| `hysteria`    | [Hysteria](./hysteria)       | X          |
+| `shadowtls`   | [ShadowTLS](./shadowtls)     | TCP        |
+| `tuic`        | [TUIC](./tuic)               | X          |
+| `hysteria2`   | [Hysteria2](./hysteria2)     | X          |
+| `vless`       | [VLESS](./vless)             | TCP        |
+| `tun`         | [Tun](./tun)                 | X          |
+| `redirect`    | [Redirect](./redirect)       | X          |
+| `tproxy`      | [TProxy](./tproxy)           | X          |

 #### tag

@@ -17,22 +17,22 @@

 | 类型            | 格式                           | 注入支持 |
 |---------------|------------------------------|------|
-| `direct`      | [Direct](./direct/)           | X    |
-| `mixed`       | [Mixed](./mixed/)             | TCP  |
-| `socks`       | [SOCKS](./socks/)             | TCP  |
-| `http`        | [HTTP](./http/)               | TCP  |
-| `shadowsocks` | [Shadowsocks](./shadowsocks/) | TCP  |
-| `vmess`       | [VMess](./vmess/)             | TCP  |
-| `trojan`      | [Trojan](./trojan/)           | TCP  |
-| `naive`       | [Naive](./naive/)             | X    |
-| `hysteria`    | [Hysteria](./hysteria/)       | X    |
-| `shadowtls`   | [ShadowTLS](./shadowtls/)     | TCP  |
-| `tuic`        | [TUIC](./tuic/)               | X    |
-| `hysteria2`   | [Hysteria2](./hysteria2/)     | X    |
-| `vless`       | [VLESS](./vless/)             | TCP  |
-| `tun`         | [Tun](./tun/)                 | X    |
-| `redirect`    | [Redirect](./redirect/)       | X    |
-| `tproxy`      | [TProxy](./tproxy/)           | X    |
+| `direct`      | [Direct](./direct)           | X    |
+| `mixed`       | [Mixed](./mixed)             | TCP  |
+| `socks`       | [SOCKS](./socks)             | TCP  |
+| `http`        | [HTTP](./http)               | TCP  |
+| `shadowsocks` | [Shadowsocks](./shadowsocks) | TCP  |
+| `vmess`       | [VMess](./vmess)             | TCP  |
+| `trojan`      | [Trojan](./trojan)           | TCP  |
+| `naive`       | [Naive](./naive)             | X    |
+| `hysteria`    | [Hysteria](./hysteria)       | X    |
+| `shadowtls`   | [ShadowTLS](./shadowtls)     | TCP  |
+| `tuic`        | [TUIC](./tuic)               | X    |
+| `hysteria2`   | [Hysteria2](./hysteria2)     | X    |
+| `vless`       | [VLESS](./vless)             | TCP  |
+| `tun`         | [Tun](./tun)                 | X    |
+| `redirect`    | [Redirect](./redirect)       | X    |
+| `tproxy`      | [TProxy](./tproxy)           | X    |

 #### tag

@@ -21,7 +21,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -20,7 +20,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -15,4 +15,4 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.
@@ -50,7 +50,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -50,7 +50,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### 字段

@@ -35,7 +35,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -66,11 +66,11 @@ Only available in the ShadowTLS protocol 3.

 ==Required==

-Handshake server address and [Dial options](/configuration/shared/dial/).
+Handshake server address and [Dial options](/configuration/shared/dial).

 #### handshake_for_server_name

-Handshake server address and [Dial options](/configuration/shared/dial/) for specific server name.
+Handshake server address and [Dial options](/configuration/shared/dial) for specific server name.

 Only available in the ShadowTLS protocol 2/3.

@@ -20,7 +20,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -17,7 +17,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -31,7 +31,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -65,4 +65,4 @@ See [Multiplex](/configuration/shared/multiplex#inbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
@@ -67,4 +67,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
@@ -24,7 +24,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -1,12 +1,3 @@
---
-icon: material/alert-decagram
---
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-plus: [gso](#gso)  
-    :material-alert-decagram: [stack](#stack)
-
 !!! quote ""

    Only supported on Linux, Windows and macOS.
@@ -21,7 +12,6 @@ icon: material/alert-decagram
  "inet4_address": "172.19.0.1/30",
  "inet6_address": "fdfe:dcba:9876::1/126",
  "mtu": 9000,
-  "gso": false,
  "auto_route": true,
  "strict_route": true,
  "inet4_route_address": [
@@ -108,16 +98,6 @@ IPv6 prefix for the tun interface.

 The maximum transmission unit.

-#### gso
-
-!!! question "Since sing-box 1.8.0"
-
-!!! quote ""
-
-    Only supported on Linux.
-
-Enable generic segmentation offload.
-
 #### auto_route

 Set the default route to the Tun.
@@ -180,19 +160,18 @@ UDP NAT expiration time in seconds, default is 300 (5 minutes).

 #### stack

-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-delete-alert: The legacy LWIP stack has been deprecated and removed.
-
 TCP/IP stack.

-| Stack    | Description                                                                                           | 
-|----------|-------------------------------------------------------------------------------------------------------|
-| `system` | Perform L3 to L4 translation using the system network stack                                           |
-| `gvisor` | Perform L3 to L4 translation using [gVisor](https://github.com/google/gvisor)'s virtual network stack |
-| `mixed`  | Mixed `system` TCP stack and `gvisor` UDP stack                                                       |
+| Stack  | Description                                                                      | Status            |
+|--------|----------------------------------------------------------------------------------|-------------------|
+| system | Sometimes better performance                                                     | recommended       |
+| gVisor | Better compatibility, based on [google/gvisor](https://github.com/google/gvisor) | recommended       |
+| mixed  | Mixed `system` TCP stack and `gVisor` UDP stack                                  | recommended       |
+| LWIP   | Based on [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks)   | upstream archived |

-Defaults to the `mixed` stack if the gVisor build tag is enabled, otherwise defaults to the `system` stack.
+!!! warning ""
+
+    LWIP stacks is not included by default, see [Installation](/installation/build-from-source/#build-tags).

 #### include_interface

@@ -238,10 +217,10 @@ Exclude users in route, but in range.

 Limit android users in route.

-| Common user  | ID |
-|--------------|----|
-| Main         | 0  |
-| Work Profile | 10 |
+| Common user  | ID  |
+|--------------|-----|
+| Main         | 0   |
+| Work Profile | 10  |

 #### include_package

@@ -261,4 +240,4 @@ System HTTP proxy settings.

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.
@@ -1,12 +1,3 @@
---
-icon: material/alert-decagram
---
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [gso](#gso)  
-    :material-alert-decagram: [stack](#stack)
-
 !!! quote ""

    仅支持 Linux、Windows 和 macOS。
@@ -21,7 +12,6 @@ icon: material/alert-decagram
  "inet4_address": "172.19.0.1/30",
  "inet6_address": "fdfe:dcba:9876::1/126",
  "mtu": 9000,
-  "gso": false,
  "auto_route": true,
  "strict_route": true,
  "inet4_route_address": [
@@ -108,16 +98,6 @@ tun 接口的 IPv6 前缀。

 最大传输单元。

-#### gso
-
-!!! question "自 sing-box 1.8.0 起"
-
-!!! quote ""
-
-    仅支持 Linux。
-
-启用通用分段卸载。
-
 #### auto_route

 设置到 Tun 的默认路由。
@@ -177,19 +157,17 @@ UDP NAT 过期时间，以秒为单位，默认为 300（5 分钟）。

 #### stack

-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-delete-alert: 旧的 LWIP 栈已被弃用并移除。
-
 TCP/IP 栈。

-| 栈      | 描述                                                               |
-|--------|------------------------------------------------------------------|
-| system | 基于系统网络栈执行 L3 到 L4 转换                                             |
-| gVisor | 基于 [gVisor](https://github.com/google/gvisor) 虚拟网络栈执行 L3 到 L4 转换 |
-| mixed  | 混合 `system` TCP 栈与 `gvisor` UDP 栈                                |
+| 栈           | 描述                                                                       | 状态    |
+|-------------|--------------------------------------------------------------------------|-------|
+| system （默认） | 有时性能更好                                                                   | 推荐    |
+| gVisor      | 兼容性较好，基于 [google/gvisor](https://github.com/google/gvisor)               | 推荐    |
+| LWIP        | 基于 [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks) | 上游已存档 |

-默认使用 `mixed` 栈如果 gVisor 构建标记已启用，否则默认使用 `system` 栈。
+!!! warning ""
+
+    默认安装不包含 LWIP 栈，参阅 [安装](/zh/installation/build-from-source/#_5)。

 #### include_interface

@@ -236,8 +214,8 @@ TCP/IP 栈。
 限制被路由的 Android 用户。

 | 常用用户 | ID |
-|------|----|
-| 您    | 0  |
+|--|-----|
+| 您 | 0 |
 | 工作资料 | 10 |

 #### include_package
@@ -22,7 +22,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -56,4 +56,4 @@ See [Multiplex](/configuration/shared/multiplex#inbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
@@ -56,4 +56,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
@@ -22,7 +22,7 @@

 ### Listen Fields

-See [Listen Fields](/configuration/shared/listen/) for details.
+See [Listen Fields](/configuration/shared/listen) for details.

 ### Fields

@@ -51,4 +51,4 @@ See [Multiplex](/configuration/shared/multiplex#inbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).
@@ -51,4 +51,4 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#inbound)。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。
@@ -20,13 +20,13 @@ sing-box uses JSON for configuration files.

 | Key            | Format                         |
 |----------------|--------------------------------|
-| `log`          | [Log](./log/)                   |
-| `dns`          | [DNS](./dns/)                   |
-| `ntp`          | [NTP](./ntp/)                   |
-| `inbounds`     | [Inbound](./inbound/)           |
-| `outbounds`    | [Outbound](./outbound/)         |
-| `route`        | [Route](./route/)               |
-| `experimental` | [Experimental](./experimental/) |
+| `log`          | [Log](./log)                   |
+| `dns`          | [DNS](./dns)                   |
+| `ntp`          | [NTP](./ntp)                   |
+| `inbounds`     | [Inbound](./inbound)           |
+| `outbounds`    | [Outbound](./outbound)         |
+| `route`        | [Route](./route)               |
+| `experimental` | [Experimental](./experimental) |

 ### Check

@@ -19,12 +19,12 @@ sing-box 使用 JSON 作为配置文件格式。

 | Key            | Format                |
 |----------------|-----------------------|
-| `log`          | [日志](./log/)           |
-| `dns`          | [DNS](./dns/)          |
-| `inbounds`     | [入站](./inbound/)       |
-| `outbounds`    | [出站](./outbound/)      |
-| `route`        | [路由](./route/)         |
-| `experimental` | [实验性](./experimental/) |
+| `log`          | [日志](./log)           |
+| `dns`          | [DNS](./dns)          |
+| `inbounds`     | [入站](./inbound)       |
+| `outbounds`    | [出站](./outbound)      |
+| `route`        | [路由](./route)         |
+| `experimental` | [实验性](./experimental) |

 ### 检查

@@ -47,4 +47,4 @@ Time synchronization interval.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -33,4 +33,4 @@ Protocol value can be `1` or `2`.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -55,4 +55,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -109,4 +109,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -84,4 +84,4 @@ Enable debug information logging for Hysteria Brutal CC.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -17,24 +17,24 @@

 | Type           | Format                         |
 |----------------|--------------------------------|
-| `direct`       | [Direct](./direct/)             |
-| `block`        | [Block](./block/)               |
-| `socks`        | [SOCKS](./socks/)               |
-| `http`         | [HTTP](./http/)                 |
-| `shadowsocks`  | [Shadowsocks](./shadowsocks/)   |
-| `vmess`        | [VMess](./vmess/)               |
-| `trojan`       | [Trojan](./trojan/)             |
-| `wireguard`    | [Wireguard](./wireguard/)       |
-| `hysteria`     | [Hysteria](./hysteria/)         |
-| `vless`        | [VLESS](./vless/)               |
-| `shadowtls`    | [ShadowTLS](./shadowtls/)       |
-| `tuic`         | [TUIC](./tuic/)                 |
-| `hysteria2`    | [Hysteria2](./hysteria2/)       |
-| `tor`          | [Tor](./tor/)                   |
-| `ssh`          | [SSH](./ssh/)                   |
-| `dns`          | [DNS](./dns/)                   |
-| `selector`     | [Selector](./selector/)         |
-| `urltest`      | [URLTest](./urltest/)           |
+| `direct`       | [Direct](./direct)             |
+| `block`        | [Block](./block)               |
+| `socks`        | [SOCKS](./socks)               |
+| `http`         | [HTTP](./http)                 |
+| `shadowsocks`  | [Shadowsocks](./shadowsocks)   |
+| `vmess`        | [VMess](./vmess)               |
+| `trojan`       | [Trojan](./trojan)             |
+| `wireguard`    | [Wireguard](./wireguard)       |
+| `hysteria`     | [Hysteria](./hysteria)         |
+| `vless`        | [VLESS](./vless)               |
+| `shadowtls`    | [ShadowTLS](./shadowtls)       |
+| `tuic`         | [TUIC](./tuic)                 |
+| `hysteria2`    | [Hysteria2](./hysteria2)       |
+| `tor`          | [Tor](./tor)                   |
+| `ssh`          | [SSH](./ssh)                   |
+| `dns`          | [DNS](./dns)                   |
+| `selector`     | [Selector](./selector)         |
+| `urltest`      | [URLTest](./urltest)           |

 #### tag

@@ -17,24 +17,24 @@

 | 类型             | 格式                             |
 |----------------|--------------------------------|
-| `direct`       | [Direct](./direct/)             |
-| `block`        | [Block](./block/)               |
-| `socks`        | [SOCKS](./socks/)               |
-| `http`         | [HTTP](./http/)                 |
-| `shadowsocks`  | [Shadowsocks](./shadowsocks/)   |
-| `vmess`        | [VMess](./vmess/)               |
-| `trojan`       | [Trojan](./trojan/)             |
-| `wireguard`    | [Wireguard](./wireguard/)       |
-| `hysteria`     | [Hysteria](./hysteria/)         |
-| `vless`        | [VLESS](./vless/)               |
-| `shadowtls`    | [ShadowTLS](./shadowtls/)       |
-| `tuic`         | [TUIC](./tuic/)                 |
-| `hysteria2`    | [Hysteria2](./hysteria2/)       |
-| `tor`          | [Tor](./tor/)                   |
-| `ssh`          | [SSH](./ssh/)                   |
-| `dns`          | [DNS](./dns/)                   |
-| `selector`     | [Selector](./selector/)         |
-| `urltest`      | [URLTest](./urltest/)           |
+| `direct`       | [Direct](./direct)             |
+| `block`        | [Block](./block)               |
+| `socks`        | [SOCKS](./socks)               |
+| `http`         | [HTTP](./http)                 |
+| `shadowsocks`  | [Shadowsocks](./shadowsocks)   |
+| `vmess`        | [VMess](./vmess)               |
+| `trojan`       | [Trojan](./trojan)             |
+| `wireguard`    | [Wireguard](./wireguard)       |
+| `hysteria`     | [Hysteria](./hysteria)         |
+| `vless`        | [VLESS](./vless)               |
+| `shadowtls`    | [ShadowTLS](./shadowtls)       |
+| `tuic`         | [TUIC](./tuic)                 |
+| `hysteria2`    | [Hysteria2](./hysteria2)       |
+| `tor`          | [Tor](./tor)                   |
+| `ssh`          | [SSH](./ssh)                   |
+| `dns`          | [DNS](./dns)                   |
+| `selector`     | [Selector](./selector)         |
+| `urltest`      | [URLTest](./urltest)           |

 #### tag

@@ -89,7 +89,7 @@ Both is enabled by default.

 UDP over TCP configuration.

-See [UDP Over TCP](/configuration/shared/udp-over-tcp/) for details.
+See [UDP Over TCP](/configuration/shared/udp-over-tcp) for details.

 Conflict with `multiplex`.

@@ -99,4 +99,4 @@ See [Multiplex](/configuration/shared/multiplex#outbound) for details.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -89,7 +89,7 @@ Shadowsocks SIP003 插件参数。

 UDP over TCP 配置。

-参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp/)。
+参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp)。

 与 `multiplex` 冲突。

@@ -53,4 +53,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -59,8 +59,8 @@ Both is enabled by default.

 UDP over TCP protocol settings.

-See [UDP Over TCP](/configuration/shared/udp-over-tcp/) for details.
+See [UDP Over TCP](/configuration/shared/udp-over-tcp) for details.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -59,7 +59,7 @@ SOCKS5 密码。

 UDP over TCP 配置。

-参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp/)。
+参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp)。

 ### 拨号字段

@@ -68,4 +68,4 @@ Client version. Random version will be used if empty.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -48,4 +48,4 @@ See [tor(1)](https://linux.die.net/man/1/tor) for details.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -55,8 +55,8 @@ See [Multiplex](/configuration/shared/multiplex#outbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -55,7 +55,7 @@ TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#outbound)。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

 ### 拨号字段

@@ -68,7 +68,7 @@ Conflict with `udp_over_stream`.

 #### udp_over_stream

-This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp/), designed to provide a QUIC
+This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp), designed to provide a QUIC
 stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or
 another program compatible with the protocol as a server.

@@ -93,4 +93,4 @@ TLS configuration, see [TLS](/configuration/shared/tls/#outbound).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -66,7 +66,7 @@ UDP 包中继模式

 #### udp_over_stream

-这是 TUIC 的 [UDP over TCP 协议](/configuration/shared/udp-over-tcp/) 移植， 旨在提供 TUIC 不提供的 基于 QUIC 流的 UDP 中继模式。 由于它是一个附加协议，因此您需要使用 sing-box 或其他兼容的程序作为服务器。
+这是 TUIC 的 [UDP over TCP 协议](/configuration/shared/udp-over-tcp) 移植， 旨在提供 TUIC 不提供的 基于 QUIC 流的 UDP 中继模式。 由于它是一个附加协议，因此您需要使用 sing-box 或其他兼容的程序作为服务器。

 此模式在正确的 UDP 代理场景中没有任何积极作用，仅适用于中继流式 UDP 流量（基本上是 QUIC 流）。

@@ -75,8 +75,8 @@ See [Multiplex](/configuration/shared/multiplex#outbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -75,7 +75,7 @@ UDP 包编码，默认使用 xudp。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

 ### 拨号字段

@@ -100,8 +100,8 @@ See [Multiplex](/configuration/shared/multiplex#outbound) for details.

 #### transport

-V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport/).
+V2Ray Transport configuration, see [V2Ray Transport](/configuration/shared/v2ray-transport).

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -100,7 +100,7 @@ UDP 包编码。

 #### transport

-V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport/)。
+V2Ray 传输配置，参阅 [V2Ray 传输层](/zh/configuration/shared/v2ray-transport)。

 ### 拨号字段

@@ -1,11 +1,3 @@
---
-icon: material/new-box
---
-
-!!! quote "Changes in sing-box 1.8.0"
-    
-    :material-plus: [gso](#gso)  
-
 ### Structure

 ```json
@@ -16,7 +8,6 @@ icon: material/new-box
  "server": "127.0.0.1",
  "server_port": 1080,
  "system_interface": false,
-  "gso": false,
  "interface_name": "wg0",
  "local_address": [
    "10.0.0.2/32"
@@ -61,25 +52,15 @@ The server port.

 #### system_interface

-Use system interface.
+Use system tun support.

-Requires privilege and cannot conflict with exists system interfaces.
+Requires privilege and cannot conflict with system interfaces.

 Forced if gVisor not included in the build.

 #### interface_name

-Custom interface name for system interface.
-
-#### gso
-
-!!! question "Since sing-box 1.8.0"
-
-!!! quote ""
-
-    Only supported on Linux.
-
-Try to enable generic segmentation offload.
+Custom device name when `system_interface` enabled.

 #### local_address

@@ -150,4 +131,4 @@ Both is enabled by default.

 ### Dial Fields

-See [Dial Fields](/configuration/shared/dial/) for details.
+See [Dial Fields](/configuration/shared/dial) for details.
@@ -1,11 +1,3 @@
---
-icon: material/new-box
---
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-plus: [gso](#gso)  
-
 ### 结构

 ```json
@@ -16,7 +8,6 @@ icon: material/new-box
  "server": "127.0.0.1",
  "server_port": 1080,
  "system_interface": false,
-  "gso": false,
  "interface_name": "wg0",
  "local_address": [
    "10.0.0.2/32"
@@ -49,25 +40,15 @@ icon: material/new-box

 #### system_interface

-使用系统设备。
+使用系统 tun 支持。

-需要特权且不能与已有系统接口冲突。
+需要特权且不能与系统接口冲突。

 如果 gVisor 未包含在构建中，则强制执行。

 #### interface_name

-为系统接口自定义设备名称。
-
-#### gso
-
-!!! question "自 sing-box 1.8.0 起"
-
-!!! quote ""
-
-    仅支持 Linux。
-
-尝试启用通用分段卸载。
+启用 `system_interface` 时的自定义设备名称。

 #### local_address

@@ -32,18 +32,18 @@ icon: material/alert-decagram

 | Key       | Format               |
 |-----------|----------------------|
-| `geoip`   | [GeoIP](./geoip/)     |
-| `geosite` | [Geosite](./geosite/) |
+| `geoip`   | [GeoIP](./geoip)     |
+| `geosite` | [Geosite](./geosite) |

 #### rules

-List of [Route Rule](./rule/)
+List of [Route Rule](./rule)

 #### rule_set

 !!! question "Since sing-box 1.8.0"

-List of [Rule Set](/configuration/rule-set/)
+List of [Rule Set](/configuration/rule-set)

 #### final

@@ -32,19 +32,19 @@ icon: material/alert-decagram

 | 键          | 格式                                |
 |------------|-----------------------------------|
-| `geoip`    | [GeoIP](./geoip/)                  |
-| `geosite`  | [Geosite](./geosite/)              |
+| `geoip`    | [GeoIP](./geoip)                  |
+| `geosite`  | [Geosite](./geosite)              |


 #### rule

-一组 [路由规则](./rule/)。
+一组 [路由规则](./rule)。

 #### rule_set

 !!! question "自 sing-box 1.8.0 起"

-一组 [规则集](/configuration/rule-set/)。
+一组 [规则集](/configuration/rule-set)。

 #### final

@@ -134,17 +134,15 @@ icon: material/alert-decagram
 !!! note ""

    The default rule uses the following matching logic:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr` || `ip_is_private`) &&  
+    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr`) &&  
    (`port` || `port_range`) &&  
-    (`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
+    (`source_geoip` || `source_ip_cidr`) &&  
    (`source_port` || `source_port_range`) &&  
    `other fields`

-    Additionally, included rule sets can be considered merged rather than as a single rule sub-item.
-
 #### inbound

-Tags of [Inbound](/configuration/inbound/).
+Tags of [Inbound](/configuration/inbound).

 #### ip_version

@@ -132,17 +132,15 @@ icon: material/alert-decagram
 !!! note ""

    默认规则使用以下匹配逻辑:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr` || `ip_is_private`) &&  
+    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `geoip` || `ip_cidr`) &&  
    (`port` || `port_range`) &&  
-    (`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
+    (`source_geoip` || `source_ip_cidr`) &&  
    (`source_port` || `source_port_range`) &&  
    `other fields`

-    另外，引用的规则集可视为被合并，而不是作为一个单独的规则子项。
-
 #### inbound

-[入站](/zh/configuration/inbound/) 标签。
+[入站](/zh/configuration/inbound) 标签。

 #### ip_version

@@ -31,4 +31,4 @@ Version of Rule Set, must be `1`.

 ==Required==

-List of [Headless Rule](./headless-rule/).
+List of [Headless Rule](./headless-rule.md).
@@ -35,7 +35,7 @@ If enabled, non-padded connections will be rejected.

 #### brutal

-See [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
+See [TCP Brutal](/configuration/shared/tcp-brutal) for details.

 ### Outbound Fields

@@ -83,4 +83,4 @@ Enable padding.

 #### brutal

-See [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
+See [TCP Brutal](/configuration/shared/tcp-brutal) for details.
@@ -34,7 +34,7 @@

 #### brutal

-参阅 [TCP Brutal](/zh/configuration/shared/tcp-brutal/)。
+参阅 [TCP Brutal](/zh/configuration/shared/tcp-brutal)。

 ### 出站字段

@@ -82,4 +82,4 @@

 #### brutal

-参阅 [TCP Brutal](/zh/configuration/shared/tcp-brutal/)。
+参阅 [TCP Brutal](/zh/configuration/shared/tcp-brutal)。
@@ -1,12 +1,3 @@
---
-icon: material/alert-decagram
---
-
-
-!!! quote "Changes in sing-box 1.8.0"
-
-    :material-alert-decagram: [utls](#utls)  
-
 ### Inbound

 ```json
@@ -216,20 +207,7 @@ uTLS is a fork of "crypto/tls", which provides ClientHello fingerprinting resist

 Available fingerprint values:

-!!! question "Since sing-box 1.8.0"
-
-    :material-plus: chrome_psk  
-    :material-plus: chrome_psk_shuffle  
-    :material-plus: chrome_padding_psk_shuffle  
-    :material-plus: chrome_pq  
-    :material-plus: chrome_pq_psk
-
 * chrome
-* chrome_psk
-* chrome_psk_shuffle
-* chrome_padding_psk_shuffle
-* chrome_pq
-* chrome_pq_psk
 * firefox
 * edge
 * safari
@@ -363,7 +341,7 @@ The MAC key.

 ACME DNS01 challenge field. If configured, other challenge methods will be disabled.

-See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/) for details.
+See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge) for details.

 ### Reality Fields

@@ -373,7 +351,7 @@ See [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/) for details

 ==Required==

-Handshake server address and [Dial options](/configuration/shared/dial/).
+Handshake server address and [Dial options](/configuration/shared/dial).

 #### private_key

@@ -1,11 +1,3 @@
---
-icon: material/alert-decagram
---
-
-!!! quote "sing-box 1.8.0 中的更改"
-
-    :material-alert-decagram: [utls](#utls)  
-
 ### 入站

 ```json
@@ -209,20 +201,7 @@ uTLS 是 "crypto/tls" 的一个分支，它提供了 ClientHello 指纹识别阻

 可用的指纹值：

-!!! question "自 sing-box 1.8.0 起"
-
-    :material-plus: chrome_psk  
-    :material-plus: chrome_psk_shuffle  
-    :material-plus: chrome_padding_psk_shuffle  
-    :material-plus: chrome_pq  
-    :material-plus: chrome_pq_psk
-
 * chrome
-* chrome_psk
-* chrome_psk_shuffle
-* chrome_padding_psk_shuffle
-* chrome_pq
-* chrome_pq_psk
 * firefox
 * edge
 * safari
@@ -352,7 +331,7 @@ MAC 密钥。

 ACME DNS01 验证字段。如果配置，将禁用其他验证方法。

-参阅 [DNS01 验证字段](/configuration/shared/dns01_challenge/)。
+参阅 [DNS01 验证字段](/configuration/shared/dns01_challenge)。

 ### Reality 字段

@@ -19,7 +19,7 @@ The maxmind GeoIP National Database, as an IP classification database,
 is not entirely suitable for traffic bypassing,
 and all existing implementations suffer from high memory usage and difficult management.

-sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set/), which can completely replace GeoIP,
+sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set), which can completely replace GeoIP,
 check [Migration](/migration/#migrate-geoip-to-rule-sets).

 #### Geosite
@@ -29,7 +29,7 @@ Geosite is deprecated and may be removed in the future.
 Geosite, the `domain-list-community` project maintained by V2Ray as an early traffic bypassing solution,
 suffers from a number of problems, including lack of maintenance, inaccurate rules, and difficult management.

-sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set/), which can completely replace Geosite,
+sing-box 1.8.0 introduces [Rule Set](/configuration/rule_set), which can completely replace Geosite,
 check [Migration](/migration/#migrate-geosite-to-rule-sets).

 Geosite，即由 V2Ray 维护的 domain-list-community 项目，作为早期流量绕过解决方案，存在着大量问题，包括缺少维护、规则不准确、管理困难。
@@ -18,7 +18,7 @@ GeoIP 已废弃且可能在不久的将来移除。
 maxmind GeoIP 国家数据库作为 IP 分类数据库，不完全适合流量绕过，
 且现有的实现均存在内存使用大与管理困难的问题。

-sing-box 1.8.0 引入了[规则集](/configuration/rule_set/)，
+sing-box 1.8.0 引入了[规则集](/configuration/rule_set)，
 可以完全替代 GeoIP， 参阅 [迁移指南](/zh/migration/#geoip)。

 #### Geosite
@@ -28,7 +28,7 @@ Geosite 已废弃且可能在不久的将来移除。
 Geosite，即由 V2Ray 维护的 domain-list-community 项目，作为早期流量绕过解决方案，
 存在着包括缺少维护、规则不准确和管理困难内的大量问题。

-sing-box 1.8.0 引入了[规则集](/configuration/rule_set/)，
+sing-box 1.8.0 引入了[规则集](/configuration/rule_set)，
 可以完全替代 Geosite，参阅 [迁移指南](/zh/migration/#geosite)。

 ## 1.6.0
@@ -13,17 +13,7 @@ Before sing-box 1.4.0:
 Since sing-box 1.4.0:

 * Go 1.18.5 - ~
-* Go 1.20.0 - ~ with tag `with_quic` enabled
-
-Since sing-box 1.5.0:
-
-* Go 1.18.5 - ~
-* Go 1.20.0 - ~ with tag `with_quic` or `with_ech` enabled
-
-Since sing-box 1.8.0:
-
-* Go 1.18.5 - ~
-* Go 1.20.0 - ~ with tag `with_quic`, `with_ech`, or `with_utls` enabled
+* Go 1.20.0 - ~ if `with_quic` tag enabled

 You can download and install Go from: https://go.dev/doc/install, latest version is recommended.

@@ -55,17 +45,19 @@ go build -tags "tag_a tag_b" ./cmd/sing-box

 | Build Tag                          | Enabled by default | Description                                                                                                                                                                                                                                                                                                                |
 |------------------------------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `with_quic`                        | :material-check:   | Build with QUIC support, see [QUIC and HTTP3 DNS transports](/configuration/dns/server/), [Naive inbound](/configuration/inbound/naive/), [Hysteria Inbound](/configuration/inbound/hysteria/), [Hysteria Outbound](/configuration/outbound/hysteria/) and [V2Ray Transport#QUIC](/configuration/shared/v2ray-transport#quic). |
-| `with_grpc`                        | :material-close:️  | Build with standard gRPC support, see [V2Ray Transport#gRPC](/configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                  |
-| `with_dhcp`                        | :material-check:   | Build with DHCP support, see [DHCP DNS transport](/configuration/dns/server/).                                                                                                                                                                                                                                              |
-| `with_wireguard`                   | :material-check:   | Build with WireGuard support, see [WireGuard outbound](/configuration/outbound/wireguard/).                                                                                                                                                                                                                                 |
-| `with_ech`                         | :material-check:   | Build with TLS ECH extension support for TLS outbound, see [TLS](/configuration/shared/tls#ech).                                                                                                                                                                                                                           |
-| `with_utls`                        | :material-check:   | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](/configuration/shared/tls#utls).                                                                                                                                                                                      |
-| `with_reality_server`              | :material-check:   | Build with reality TLS server support,  see [TLS](/configuration/shared/tls/).                                                                                                                                                                                                                                              |
-| `with_acme`                        | :material-check:   | Build with ACME TLS certificate issuer support, see [TLS](/configuration/shared/tls/).                                                                                                                                                                                                                                      |
-| `with_clash_api`                   | :material-check:   | Build with Clash API support, see [Experimental](/configuration/experimental#clash-api-fields).                                                                                                                                                                                                                            |
-| `with_v2ray_api`                   | :material-close:️  | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                            |
-| `with_gvisor`                      | :material-check:   | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface).                                                                                                                                                               |
-| `with_embedded_tor` (CGO required) | :material-close:️  | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor/).                                                                                                                                                                                                                                          |
+| `with_quic`                        | ✔                  | Build with QUIC support, see [QUIC and HTTP3 DNS transports](/configuration/dns/server), [Naive inbound](/configuration/inbound/naive), [Hysteria Inbound](/configuration/inbound/hysteria), [Hysteria Outbound](/configuration/outbound/hysteria) and [V2Ray Transport#QUIC](/configuration/shared/v2ray-transport#quic). |
+| `with_grpc`                        | ✖️                 | Build with standard gRPC support, see [V2Ray Transport#gRPC](/configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                  |
+| `with_dhcp`                        | ✔                  | Build with DHCP support, see [DHCP DNS transport](/configuration/dns/server).                                                                                                                                                                                                                                              |
+| `with_wireguard`                   | ✔                  | Build with WireGuard support, see [WireGuard outbound](/configuration/outbound/wireguard).                                                                                                                                                                                                                                 |
+| `with_ech`                         | ✔                  | Build with TLS ECH extension support for TLS outbound, see [TLS](/configuration/shared/tls#ech).                                                                                                                                                                                                                           |
+| `with_utls`                        | ✔                  | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](/configuration/shared/tls#utls).                                                                                                                                                                                      |
+| `with_reality_server`              | ✔                  | Build with reality TLS server support,  see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                              |
+| `with_acme`                        | ✔                  | Build with ACME TLS certificate issuer support, see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                      |
+| `with_clash_api`                   | ✔                  | Build with Clash API support, see [Experimental](/configuration/experimental#clash-api-fields).                                                                                                                                                                                                                            |
+| `with_v2ray_api`                   | ✖️                 | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                            |
+| `with_gvisor`                      | ✔                  | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface).                                                                                                                                                               |
+| `with_embedded_tor` (CGO required) | ✖️                 | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor).                                                                                                                                                                                                                                          |
+| `with_lwip` (CGO required)         | ✖️                 | Build with LWIP Tun stack support, see [Tun inbound](/configuration/inbound/tun#stack).                                                                                                                                                                                                                                    |
+

 It is not recommended to change the default build tag list unless you really know what you are adding.
@@ -15,16 +15,6 @@ sing-box 1.4.0 前:
 * Go 1.18.5 - ~
 * Go 1.20.0 - ~ 如果启用构建标记 `with_quic`

-从 sing-box 1.5.0:
-
-* Go 1.18.5 - ~
-* Go 1.20.0 - ~ 如果启用构建标记 `with_quic` 或 `with_ech`
-
-从 sing-box 1.8.0:
-
-* Go 1.18.5 - ~
-* Go 1.20.0 - ~ 如果启用构建标记 `with_quic`、`with_ech` 或 `with_utls`
-
 您可以从 https://go.dev/doc/install 下载并安装 Go，推荐使用最新版本。

 ## :material-fast-forward: 快速开始
@@ -53,19 +43,21 @@ go build -tags "tag_a tag_b" ./cmd/sing-box

 ## :material-folder-settings: 构建标记

-| 构建标记                               | 默认启动              | 说明                                                                                                                                                                                                                                                                                                                         |
-|------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `with_quic`                        | :material-check:  | Build with QUIC support, see [QUIC and HTTP3 DNS transports](/configuration/dns/server/), [Naive inbound](/configuration/inbound/naive/), [Hysteria Inbound](/configuration/inbound/hysteria/), [Hysteria Outbound](/configuration/outbound/hysteria/) and [V2Ray Transport#QUIC](/configuration/shared/v2ray-transport#quic). |
-| `with_grpc`                        | :material-close:️ | Build with standard gRPC support, see [V2Ray Transport#gRPC](/configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                  |
-| `with_dhcp`                        | :material-check:  | Build with DHCP support, see [DHCP DNS transport](/configuration/dns/server/).                                                                                                                                                                                                                                              |
-| `with_wireguard`                   | :material-check:  | Build with WireGuard support, see [WireGuard outbound](/configuration/outbound/wireguard/).                                                                                                                                                                                                                                 |
-| `with_ech`                         | :material-check:  | Build with TLS ECH extension support for TLS outbound, see [TLS](/configuration/shared/tls#ech).                                                                                                                                                                                                                           |
-| `with_utls`                        | :material-check:  | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](/configuration/shared/tls#utls).                                                                                                                                                                                      |
-| `with_reality_server`              | :material-check:  | Build with reality TLS server support,  see [TLS](/configuration/shared/tls/).                                                                                                                                                                                                                                              |
-| `with_acme`                        | :material-check:  | Build with ACME TLS certificate issuer support, see [TLS](/configuration/shared/tls/).                                                                                                                                                                                                                                      |
-| `with_clash_api`                   | :material-check:  | Build with Clash API support, see [Experimental](/configuration/experimental#clash-api-fields).                                                                                                                                                                                                                            |
-| `with_v2ray_api`                   | :material-close:️ | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                            |
-| `with_gvisor`                      | :material-check:  | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface).                                                                                                                                                               |
-| `with_embedded_tor` (CGO required) | :material-close:️ | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor/).                                                                                                                                                                                                                                          |
+| 构建标记                               | 默认启动 | 说明                                                                                                                                                                                                                                                                                                                         |
+|------------------------------------|------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `with_quic`                        | ✔    | Build with QUIC support, see [QUIC and HTTP3 DNS transports](/configuration/dns/server), [Naive inbound](/configuration/inbound/naive), [Hysteria Inbound](/configuration/inbound/hysteria), [Hysteria Outbound](/configuration/outbound/hysteria) and [V2Ray Transport#QUIC](/configuration/shared/v2ray-transport#quic). |
+| `with_grpc`                        | ✖️   | Build with standard gRPC support, see [V2Ray Transport#gRPC](/configuration/shared/v2ray-transport#grpc).                                                                                                                                                                                                                  |
+| `with_dhcp`                        | ✔    | Build with DHCP support, see [DHCP DNS transport](/configuration/dns/server).                                                                                                                                                                                                                                              |
+| `with_wireguard`                   | ✔    | Build with WireGuard support, see [WireGuard outbound](/configuration/outbound/wireguard).                                                                                                                                                                                                                                 |
+| `with_ech`                         | ✔    | Build with TLS ECH extension support for TLS outbound, see [TLS](/configuration/shared/tls#ech).                                                                                                                                                                                                                           |
+| `with_utls`                        | ✔    | Build with [uTLS](https://github.com/refraction-networking/utls) support for TLS outbound, see [TLS](/configuration/shared/tls#utls).                                                                                                                                                                                      |
+| `with_reality_server`              | ✔    | Build with reality TLS server support,  see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                              |
+| `with_acme`                        | ✔    | Build with ACME TLS certificate issuer support, see [TLS](/configuration/shared/tls).                                                                                                                                                                                                                                      |
+| `with_clash_api`                   | ✔    | Build with Clash API support, see [Experimental](/configuration/experimental#clash-api-fields).                                                                                                                                                                                                                            |
+| `with_v2ray_api`                   | ✖️   | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields).                                                                                                                                                                                                                            |
+| `with_gvisor`                      | ✔    | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface).                                                                                                                                                               |
+| `with_embedded_tor` (CGO required) | ✖️   | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor).                                                                                                                                                                                                                                          |
+| `with_lwip` (CGO required)         | ✖️   | Build with LWIP Tun stack support, see [Tun inbound](/configuration/inbound/tun#stack).                                                                                                                                                                                                                                    |
+

 除非您确实知道您正在启用什么，否则不建议更改默认构建标签列表。
@@ -35,6 +35,10 @@ but only AEAD 2022 ciphers TCP with multiplexing is recommended.

 ## :material-server: Server Example

+!!! info ""
+
+    Password of cipher `2022-blake3-aes-128-gcm` can be generated by command `sing-box generate rand 16 --base64`
+
 === ":material-account: Single-user"

    ```json
@@ -12,8 +12,8 @@ icon: material/arrange-bring-forward

 !!! info "References"

-    [Clash API](/configuration/experimental/clash-api/) / 
-    [Cache File](/configuration/experimental/cache-file/)
+    [Clash API](/configuration/experimental/clash-api) / 
+    [Cache File](/configuration/experimental/cache-file)

 === ":material-card-remove: Deprecated"

@@ -50,11 +50,11 @@ icon: material/arrange-bring-forward

 !!! info "References"

-    [GeoIP](/configuration/route/geoip/) / 
-    [Route](/configuration/route/) / 
-    [Route Rule](/configuration/route/rule/) / 
-    [DNS Rule](/configuration/dns/rule/) / 
-    [Rule Set](/configuration/rule-set/)
+    [GeoIP](/configuration/route/geoip) / 
+    [Route](/configuration/route) / 
+    [Route Rule](/configuration/route/rule) / 
+    [DNS Rule](/configuration/dns/rule) / 
+    [Rule Set](/configuration/rule-set)

 !!! tip

@@ -135,11 +135,11 @@ icon: material/arrange-bring-forward

 !!! info "References"

-    [Geosite](/configuration/route/geosite/) / 
-    [Route](/configuration/route/) / 
-    [Route Rule](/configuration/route/rule/) / 
-    [DNS Rule](/configuration/dns/rule/) / 
-    [Rule Set](/configuration/rule-set/)
+    [Geosite](/configuration/route/geosite) / 
+    [Route](/configuration/route) / 
+    [Route Rule](/configuration/route/rule) / 
+    [DNS Rule](/configuration/dns/rule) / 
+    [Rule Set](/configuration/rule-set)

 !!! tip

@@ -12,8 +12,8 @@ icon: material/arrange-bring-forward

 !!! info "参考"

-    [Clash API](/zh/configuration/experimental/clash-api/) / 
-    [Cache File](/zh/configuration/experimental/cache-file/)
+    [Clash API](/zh/configuration/experimental/clash-api) / 
+    [Cache File](/zh/configuration/experimental/cache-file)

 === ":material-card-remove: 弃用的"

@@ -50,11 +50,11 @@ icon: material/arrange-bring-forward

 !!! info "参考"

-    [GeoIP](/zh/configuration/route/geoip/) / 
-    [路由](/zh/configuration/route/) / 
-    [路由规则](/zh/configuration/route/rule/) / 
-    [DNS 规则](/zh/configuration/dns/rule/) / 
-    [规则集](/zh/configuration/rule-set/)
+    [GeoIP](/zh/configuration/route/geoip) / 
+    [路由](/zh/configuration/route) / 
+    [路由规则](/zh/configuration/route/rule) / 
+    [DNS 规则](/zh/configuration/dns/rule) / 
+    [规则集](/zh/configuration/rule-set)

 !!! tip

@@ -135,11 +135,11 @@ icon: material/arrange-bring-forward

 !!! info "参考"

-    [Geosite](/zh/configuration/route/geosite/) / 
-    [路由](/zh/configuration/route/) / 
-    [路由规则](/zh/configuration/route/rule/) / 
-    [DNS 规则](/zh/configuration/dns/rule/) / 
-    [规则集](/zh/configuration/rule-set/)
+    [Geosite](/zh/configuration/route/geosite) / 
+    [路由](/zh/configuration/route) / 
+    [路由规则](/zh/configuration/route/rule) / 
+    [DNS 规则](/zh/configuration/dns/rule) / 
+    [规则集](/zh/configuration/rule-set)

 !!! tip

@@ -3,24 +3,16 @@ package libbox
 import (
 	"bytes"
 	"context"
-	"net/netip"
-	"os"
+	"encoding/json"

 	"github.com/sagernet/sing-box"
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/process"
-	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-tun"
-	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
-	"github.com/sagernet/sing/common/logger"
-	"github.com/sagernet/sing/common/x/list"
 )

 func parseConfig(configContent string) (option.Options, error) {
-	options, err := json.UnmarshalExtended[option.Options]([]byte(configContent))
+	var options option.Options
+	err := options.UnmarshalJSON([]byte(configContent))
 	if err != nil {
 		return option.Options{}, E.Cause(err, "decode config")
 	}
@@ -35,9 +27,8 @@ func CheckConfig(configContent string) error {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	instance, err := box.New(box.Options{
-		Context:           ctx,
-		Options:           options,
-		PlatformInterface: (*platformInterfaceStub)(nil),
+		Context: ctx,
+		Options: options,
 	})
 	if err == nil {
 		instance.Close()
@@ -45,92 +36,6 @@ func CheckConfig(configContent string) error {
 	return err
 }

-type platformInterfaceStub struct{}
-
-func (s *platformInterfaceStub) Initialize(ctx context.Context, router adapter.Router) error {
-	return nil
-}
-
-func (s *platformInterfaceStub) UsePlatformAutoDetectInterfaceControl() bool {
-	return true
-}
-
-func (s *platformInterfaceStub) AutoDetectInterfaceControl() control.Func {
-	return nil
-}
-
-func (s *platformInterfaceStub) OpenTun(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error) {
-	return nil, os.ErrInvalid
-}
-
-func (s *platformInterfaceStub) UsePlatformDefaultInterfaceMonitor() bool {
-	return true
-}
-
-func (s *platformInterfaceStub) CreateDefaultInterfaceMonitor(logger logger.Logger) tun.DefaultInterfaceMonitor {
-	return (*interfaceMonitorStub)(nil)
-}
-
-func (s *platformInterfaceStub) UsePlatformInterfaceGetter() bool {
-	return true
-}
-
-func (s *platformInterfaceStub) Interfaces() ([]platform.NetworkInterface, error) {
-	return nil, os.ErrInvalid
-}
-
-func (s *platformInterfaceStub) UnderNetworkExtension() bool {
-	return false
-}
-
-func (s *platformInterfaceStub) ClearDNSCache() {
-}
-
-func (s *platformInterfaceStub) ReadWIFIState() adapter.WIFIState {
-	return adapter.WIFIState{}
-}
-
-func (s *platformInterfaceStub) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*process.Info, error) {
-	return nil, os.ErrInvalid
-}
-
-type interfaceMonitorStub struct{}
-
-func (s *interfaceMonitorStub) Start() error {
-	return os.ErrInvalid
-}
-
-func (s *interfaceMonitorStub) Close() error {
-	return os.ErrInvalid
-}
-
-func (s *interfaceMonitorStub) DefaultInterfaceName(destination netip.Addr) string {
-	return ""
-}
-
-func (s *interfaceMonitorStub) DefaultInterfaceIndex(destination netip.Addr) int {
-	return -1
-}
-
-func (s *interfaceMonitorStub) DefaultInterface(destination netip.Addr) (string, int) {
-	return "", -1
-}
-
-func (s *interfaceMonitorStub) OverrideAndroidVPN() bool {
-	return false
-}
-
-func (s *interfaceMonitorStub) AndroidVPNEnabled() bool {
-	return false
-}
-
-func (s *interfaceMonitorStub) RegisterCallback(callback tun.DefaultInterfaceUpdateCallback) *list.Element[tun.DefaultInterfaceUpdateCallback] {
-	return nil
-}
-
-func (s *interfaceMonitorStub) UnregisterCallback(element *list.Element[tun.DefaultInterfaceUpdateCallback]) {
-}
-
 func FormatConfig(configContent string) (string, error) {
 	options, err := parseConfig(configContent)
 	if err != nil {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
世界	4af7bf9dcd	documentation: Bump version	2023-12-07 18:04:30 +08:00
世界	8be5ca0b17	Improve read waiter interface	2023-12-07 18:04:30 +08:00
世界	330a712be6	Make type check strict	2023-12-07 11:17:39 +08:00
世界	4bea4e3e2a	Remove comparable limit for Listable	2023-12-07 11:17:39 +08:00
世界	adb3c57c51	Avoid opening log output before start & Replace tracing logs with task monitor	2023-12-07 11:17:39 +08:00
世界	72f91dfe5d	Update documentation	2023-12-07 11:17:33 +08:00
世界	38608d138f	Add `idle_timeout` for URLTest outbound	2023-12-07 11:17:27 +08:00
世界	96b18f597d	Skip internal fake-ip queries	2023-12-07 11:17:27 +08:00
世界	d14c66058d	Migrate contentjson and badjson to library & Add omitempty in format	2023-12-07 11:17:27 +08:00
世界	71960374ff	Update documentation	2023-12-07 11:17:26 +08:00
世界	1f36575e75	Independent `source_ip_is_private` and `ip_is_private` rules	2023-12-07 11:17:26 +08:00
世界	be3367c11e	Add rule-set	2023-12-07 11:17:26 +08:00
世界	7c2ce9563a	Update buffer usage	2023-12-07 11:17:18 +08:00
世界	151fb26541	Allow nested logical rules	2023-12-07 11:15:26 +08:00
世界	b4825fa33a	Migrate to independent cache file	2023-12-07 11:15:26 +08:00