Compare commits

..

96 Commits

Author SHA1 Message Date
renovate[bot]
c70bf269b6
[dependencies] Update golangci/golangci-lint-action action to v8 2025-05-27 06:15:38 +00:00
世界
2af4882275
documentation: Bump version 2025-05-27 14:14:52 +08:00
世界
253f225abd
Fix tailscale forward 2025-05-27 14:14:19 +08:00
世界
2202bbdb3d
Minor fixes 2025-05-27 14:14:19 +08:00
世界
20268e4a87
Update quic-go to v0.52.0 2025-05-27 14:14:19 +08:00
世界
57b1d5ca3a
Add SSM API service 2025-05-27 14:14:09 +08:00
世界
685241dedf
Add resolved service and DNS server 2025-05-27 14:14:09 +08:00
世界
9cba09ccc5
Add DERP service 2025-05-27 14:14:09 +08:00
世界
2fc3f12edf
Add service component type 2025-05-27 14:14:09 +08:00
世界
c688a9b92e
Fix tproxy tcp control 2025-05-27 14:14:09 +08:00
愚者
4d2ace40c4
release: Fix build tags for android
Signed-off-by: 愚者 <11926619+FansChou@users.noreply.github.com>
2025-05-27 14:14:09 +08:00
世界
8419088475
prevent creation of bind and mark controls on unsupported platforms 2025-05-27 14:14:09 +08:00
PuerNya
fed96eb252
documentation: Fix description of reject DNS action behavior 2025-05-27 14:14:09 +08:00
Restia-Ashbell
fd8c6a9ee4
Fix TLS record fragment 2025-05-27 14:14:09 +08:00
世界
449b486138
Add missing accept_routes option for Tailscale 2025-05-27 14:14:08 +08:00
世界
03eab6951f
Add TLS record fragment support 2025-05-27 14:14:08 +08:00
世界
e1d9afc1ed
release: Update Go to 1.24.3 2025-05-27 14:14:08 +08:00
世界
1cb22abc07
Fix set edns0 client subnet 2025-05-27 14:14:08 +08:00
世界
22695b7d63
Update minor dependencies 2025-05-27 14:14:08 +08:00
世界
ec0f414668
Update certmagic and providers 2025-05-27 14:14:08 +08:00
世界
55ac578082
Update protobuf and grpc 2025-05-27 14:14:08 +08:00
世界
df751c7973
Add control options for listeners 2025-05-27 14:14:08 +08:00
世界
190a359dea
Update quic-go to v0.51.0 2025-05-27 14:14:08 +08:00
世界
11d9a5e9c2
Update utls to v1.7.2 2025-05-27 14:13:59 +08:00
世界
879303f8e6
Handle EDNS version downgrade 2025-05-27 14:13:30 +08:00
世界
7d149a1d3d
documentation: Fix anytls padding scheme description 2025-05-27 14:13:30 +08:00
安容
368f530dbb
Report invalid DNS address early 2025-05-27 14:13:29 +08:00
世界
4eb32b8a36
Fix wireguard listen_port 2025-05-27 14:13:29 +08:00
世界
f936691a1e
clash-api: Add more meta api 2025-05-27 14:13:29 +08:00
世界
00d45aaf2a
Fix DNS lookup 2025-05-27 14:13:29 +08:00
世界
2e58c8bfec
Fix fetch ECH configs 2025-05-27 14:13:28 +08:00
reletor
1c9e166e75
documentation: Minor fixes 2025-05-27 14:13:28 +08:00
caelansar
2eed6d48db
Fix callback deletion in UDP transport 2025-05-27 14:13:28 +08:00
世界
6632a09768
documentation: Try to make the play review happy 2025-05-27 14:13:28 +08:00
世界
5df05814d6
Fix missing handling of legacy domain_strategy options 2025-05-27 14:13:28 +08:00
世界
ffed1a4146
Improve local DNS server 2025-05-27 14:13:27 +08:00
anytls
e3cb295dc9
Update anytls
Co-authored-by: anytls <anytls>
2025-05-27 14:13:17 +08:00
世界
2ca21439f2
Fix DNS dialer 2025-05-27 14:13:17 +08:00
世界
d8e10c662d
release: Skip override version for iOS 2025-05-27 14:13:16 +08:00
iikira
33606be587
Fix UDP DNS server crash
Signed-off-by: iikira <i2@mail.iikira.com>
2025-05-27 14:13:16 +08:00
ReleTor
65518412cc
Fix fetch ECH configs 2025-05-27 14:13:16 +08:00
世界
903f80aa0d
Allow direct outbounds without domain_resolver 2025-05-27 14:13:16 +08:00
世界
7a92ededcc
Fix Tailscale dialer 2025-05-27 14:13:16 +08:00
dyhkwong
97611f62b7
Fix DNS over QUIC stream close 2025-05-27 14:13:15 +08:00
anytls
e116651e8c
Update anytls
Co-authored-by: anytls <anytls>
2025-05-27 14:13:15 +08:00
Rambling2076
4fac90e801
Fix missing with_tailscale in Dockerfile
Signed-off-by: Rambling2076 <Rambling2076@proton.me>
2025-05-27 14:13:15 +08:00
世界
819636ea01
Fail when default DNS server not found 2025-05-27 14:13:15 +08:00
世界
31a312c421
Update gVisor to 20250319.0 2025-05-27 14:13:15 +08:00
世界
de7900aea7
Explicitly reject detour to empty direct outbounds 2025-05-27 14:13:14 +08:00
世界
0b6737da3d
Add netns support 2025-05-27 14:13:13 +08:00
世界
25d9e62b65
Add wildcard name support for predefined records 2025-05-27 14:13:13 +08:00
世界
25081f6c14
Remove map usage in options 2025-05-27 14:13:13 +08:00
世界
1d8fa0a0d4
Fix unhandled DNS loop 2025-05-27 14:13:13 +08:00
世界
81d518f91f
Add wildcard-sni support for shadow-tls inbound 2025-05-27 14:13:13 +08:00
世界
be0d544118
option: Fix marshal legacy DNS options 2025-05-27 14:13:12 +08:00
世界
83ca910712
Make domain_resolver optional when only one DNS server is configured 2025-05-27 14:13:12 +08:00
世界
57e54958d8
Fix DNS lookup context pollution 2025-05-27 14:13:11 +08:00
世界
09039f423d
Fix http3 DNS server connecting to wrong address 2025-05-27 14:13:11 +08:00
Restia-Ashbell
cd8e8fcab2
documentation: Fix typo 2025-05-27 14:13:11 +08:00
anytls
57a8466abd
Update sing-anytls
Co-authored-by: anytls <anytls>
2025-05-27 14:13:10 +08:00
k9982874
037b953ab9
Fix hosts DNS server 2025-05-27 14:13:10 +08:00
世界
7cb918961b
Fix UDP DNS server crash 2025-05-27 14:13:10 +08:00
世界
d25ca4c5e5
documentation: Fix missing ip_accept_any DNS rule option 2025-05-27 14:13:10 +08:00
世界
355504ada1
Fix anytls dialer usage 2025-05-27 14:13:09 +08:00
世界
f27de457fc
Move predefined DNS server to rule action 2025-05-27 14:13:08 +08:00
世界
d8bed740da
Fix domain resolver on direct outbound 2025-05-27 14:13:08 +08:00
Zephyruso
4039dd2b5a
Fix missing AnyTLS display name 2025-05-27 14:13:08 +08:00
anytls
0d8f2aa698
Update sing-anytls
Co-authored-by: anytls <anytls>
2025-05-27 14:13:07 +08:00
Estel
bd08267e13
documentation: Fix typo
Signed-off-by: Estel <callmebedrockdigger@gmail.com>
2025-05-27 14:13:07 +08:00
TargetLocked
4273d86999
Fix parsing legacy DNS options 2025-05-27 14:13:07 +08:00
世界
380edfde64
Fix DNS fallback 2025-05-27 14:13:07 +08:00
世界
cd9ddd681f
documentation: Fix missing hosts DNS server 2025-05-27 14:13:06 +08:00
anytls
d6f0f711d4
Add MinIdleSession option to AnyTLS outbound
Co-authored-by: anytls <anytls>
2025-05-27 14:13:06 +08:00
ReleTor
6beb5904ab
documentation: Minor fixes 2025-05-27 14:13:06 +08:00
libtry486
e04ca64762
documentation: Fix typo
fix typo

Signed-off-by: libtry486 <89328481+libtry486@users.noreply.github.com>
2025-05-27 14:13:05 +08:00
Alireza Ahmadi
ec852544ed
Fix Outbound deadlock 2025-05-27 14:13:05 +08:00
世界
40a5e03450
documentation: Fix AnyTLS doc 2025-05-27 14:13:05 +08:00
anytls
1be10c37f0
Add AnyTLS protocol 2025-05-27 14:13:05 +08:00
世界
328476c0c9
Migrate to stdlib ECH support 2025-05-27 14:13:04 +08:00
世界
d3fc706099
Add fallback local DNS server for iOS 2025-05-27 14:13:04 +08:00
世界
aa08f9217f
Get darwin local DNS server from libresolv 2025-05-27 14:13:04 +08:00
世界
a5d7f9ab8b
Improve resolve action 2025-05-27 14:13:04 +08:00
世界
41ea4f999a
Add back port hopping to hysteria 1 2025-05-27 14:13:03 +08:00
xchacha20-poly1305
06c782d150
Remove single quotes of raw Moziila certs 2025-05-27 14:13:02 +08:00
世界
4811a2fc11
Add Tailscale endpoint 2025-05-27 14:13:02 +08:00
世界
f491a8aa8a
Build legacy binaries with latest Go 2025-05-27 14:13:02 +08:00
世界
1ef095f617
documentation: Remove outdated icons 2025-05-27 14:13:02 +08:00
世界
22fa3e22b9
documentation: Certificate store 2025-05-27 14:13:02 +08:00
世界
e3a2435798
documentation: TLS fragment 2025-05-27 14:13:02 +08:00
世界
78a6b65962
documentation: Outbound domain resolver 2025-05-27 14:13:01 +08:00
世界
b8a5559af1
documentation: Refactor DNS 2025-05-27 14:13:01 +08:00
世界
e11198ab06
Add certificate store 2025-05-27 14:13:00 +08:00
世界
2a3f95fe8e
Add TLS fragment support 2025-05-27 14:13:00 +08:00
世界
2fdf97cf14
refactor: Outbound domain resolver 2025-05-27 14:13:00 +08:00
世界
191d30cad5
refactor: DNS 2025-05-27 14:13:00 +08:00
世界
4efa3e0868
Bump version 2025-05-27 14:11:37 +08:00
11 changed files with 15 additions and 148 deletions

View File

@ -1,58 +0,0 @@
package sniff
import (
"context"
"encoding/binary"
"os"
"github.com/sagernet/sing-box/adapter"
C "github.com/sagernet/sing-box/constant"
)
func NTP(ctx context.Context, metadata *adapter.InboundContext, packet []byte) error {
// NTP packets must be at least 48 bytes long (standard NTP header size).
pLen := len(packet)
if pLen < 48 {
return os.ErrInvalid
}
// Check the LI (Leap Indicator) and Version Number (VN) in the first byte.
// We'll primarily focus on ensuring the version is valid for NTP.
// Many NTP versions are used, but let's check for generally accepted ones (3 & 4 for IPv4, plus potential extensions/customizations)
firstByte := packet[0]
li := (firstByte >> 6) & 0x03 // Extract LI
vn := (firstByte >> 3) & 0x07 // Extract VN
mode := firstByte & 0x07 // Extract Mode
// Leap Indicator should be a valid value (0-3).
if li > 3 {
return os.ErrInvalid
}
// Version Check (common NTP versions are 3 and 4)
if vn != 3 && vn != 4 {
return os.ErrInvalid
}
// Check the Mode field for a client request (Mode 3). This validates it *is* a request.
if mode != 3 {
return os.ErrInvalid
}
// Check Root Delay and Root Dispersion. While not strictly *required* for a request,
// we can check if they appear to be reasonable values (not excessively large).
rootDelay := binary.BigEndian.Uint32(packet[4:8])
rootDispersion := binary.BigEndian.Uint32(packet[8:12])
// Check for unreasonably large root delay and dispersion. NTP RFC specifies max values of approximately 16 seconds.
// Convert to milliseconds for easy comparison. Each unit is 1/2^16 seconds.
if float64(rootDelay)/65536.0 > 16.0 {
return os.ErrInvalid
}
if float64(rootDispersion)/65536.0 > 16.0 {
return os.ErrInvalid
}
metadata.Protocol = C.ProtocolNTP
return nil
}

View File

@ -1,33 +0,0 @@
package sniff_test
import (
"context"
"encoding/hex"
"os"
"testing"
"github.com/sagernet/sing-box/adapter"
"github.com/sagernet/sing-box/common/sniff"
C "github.com/sagernet/sing-box/constant"
"github.com/stretchr/testify/require"
)
func TestSniffNTP(t *testing.T) {
t.Parallel()
packet, err := hex.DecodeString("1b0006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
require.NoError(t, err)
var metadata adapter.InboundContext
err = sniff.NTP(context.Background(), &metadata, packet)
require.NoError(t, err)
require.Equal(t, metadata.Protocol, C.ProtocolNTP)
}
func TestSniffNTPFailed(t *testing.T) {
t.Parallel()
packet, err := hex.DecodeString("400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
require.NoError(t, err)
var metadata adapter.InboundContext
err = sniff.NTP(context.Background(), &metadata, packet)
require.ErrorIs(t, err, os.ErrInvalid)
}

View File

@ -34,7 +34,6 @@ type Client struct {
disableCache bool disableCache bool
disableExpire bool disableExpire bool
independentCache bool independentCache bool
clientSubnet netip.Prefix
rdrc adapter.RDRCStore rdrc adapter.RDRCStore
initRDRCFunc func() adapter.RDRCStore initRDRCFunc func() adapter.RDRCStore
logger logger.ContextLogger logger logger.ContextLogger
@ -48,7 +47,6 @@ type ClientOptions struct {
DisableExpire bool DisableExpire bool
IndependentCache bool IndependentCache bool
CacheCapacity uint32 CacheCapacity uint32
ClientSubnet netip.Prefix
RDRC func() adapter.RDRCStore RDRC func() adapter.RDRCStore
Logger logger.ContextLogger Logger logger.ContextLogger
} }
@ -59,7 +57,6 @@ func NewClient(options ClientOptions) *Client {
disableCache: options.DisableCache, disableCache: options.DisableCache,
disableExpire: options.DisableExpire, disableExpire: options.DisableExpire,
independentCache: options.IndependentCache, independentCache: options.IndependentCache,
clientSubnet: options.ClientSubnet,
initRDRCFunc: options.RDRC, initRDRCFunc: options.RDRC,
logger: options.Logger, logger: options.Logger,
} }
@ -107,12 +104,8 @@ func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, m
return &responseMessage, nil return &responseMessage, nil
} }
question := message.Question[0] question := message.Question[0]
clientSubnet := options.ClientSubnet if options.ClientSubnet.IsValid() {
if !clientSubnet.IsValid() { message = SetClientSubnet(message, options.ClientSubnet)
clientSubnet = c.clientSubnet
}
if clientSubnet.IsValid() {
message = SetClientSubnet(message, clientSubnet)
} }
isSimpleRequest := len(message.Question) == 1 && isSimpleRequest := len(message.Question) == 1 &&
len(message.Ns) == 0 && len(message.Ns) == 0 &&

View File

@ -55,7 +55,6 @@ func NewRouter(ctx context.Context, logFactory log.Factory, options option.DNSOp
DisableExpire: options.DNSClientOptions.DisableExpire, DisableExpire: options.DNSClientOptions.DisableExpire,
IndependentCache: options.DNSClientOptions.IndependentCache, IndependentCache: options.DNSClientOptions.IndependentCache,
CacheCapacity: options.DNSClientOptions.CacheCapacity, CacheCapacity: options.DNSClientOptions.CacheCapacity,
ClientSubnet: options.DNSClientOptions.ClientSubnet.Build(netip.Prefix{}),
RDRC: func() adapter.RDRCStore { RDRC: func() adapter.RDRCStore {
cacheFile := service.FromContext[adapter.CacheFile](ctx) cacheFile := service.FromContext[adapter.CacheFile](ctx)
if cacheFile == nil { if cacheFile == nil {

View File

@ -1,11 +1,7 @@
--- ---
icon: material/alert-decagram icon: material/new-box
--- ---
!!! quote "Changes in sing-box 1.12.0"
:material-decagram: [servers](#servers)
!!! quote "Changes in sing-box 1.11.0" !!! quote "Changes in sing-box 1.11.0"
:material-plus: [cache_capacity](#cache_capacity) :material-plus: [cache_capacity](#cache_capacity)

View File

@ -1,11 +1,7 @@
--- ---
icon: material/alert-decagram icon: material/new-box
--- ---
!!! quote "sing-box 1.12.0 中的更改"
:material-decagram: [servers](#servers)
!!! quote "sing-box 1.11.0 中的更改" !!! quote "sing-box 1.11.0 中的更改"
:material-plus: [cache_capacity](#cache_capacity) :material-plus: [cache_capacity](#cache_capacity)

View File

@ -22,7 +22,6 @@ If enabled in the inbound, the protocol and domain name (if present) of by the c
| UDP | `dtls` | / | / | | UDP | `dtls` | / | / |
| TCP | `ssh` | / | SSH Client Name | | TCP | `ssh` | / | SSH Client Name |
| TCP | `rdp` | / | / | | TCP | `rdp` | / | / |
| UDP | `ntp` | / | / |
| QUIC Client | Type | | QUIC Client | Type |
|:------------------------:|:----------:| |:------------------------:|:----------:|

View File

@ -22,7 +22,6 @@
| UDP | `dtls` | / | / | | UDP | `dtls` | / | / |
| TCP | `ssh` | / | SSH 客户端名称 | | TCP | `ssh` | / | SSH 客户端名称 |
| TCP | `rdp` | / | / | | TCP | `rdp` | / | / |
| UDP | `ntp` | / | / |
| QUIC 客户端 | 类型 | | QUIC 客户端 | 类型 |
|:------------------------:|:----------:| |:------------------------:|:----------:|

View File

@ -564,7 +564,6 @@ func (r *Router) actionSniff(
sniff.UTP, sniff.UTP,
sniff.UDPTracker, sniff.UDPTracker,
sniff.DTLSRecord, sniff.DTLSRecord,
sniff.NTP,
} }
} }
for { for {

View File

@ -379,8 +379,6 @@ func (r *RuleActionSniff) build() error {
r.StreamSniffers = append(r.StreamSniffers, sniff.SSH) r.StreamSniffers = append(r.StreamSniffers, sniff.SSH)
case C.ProtocolRDP: case C.ProtocolRDP:
r.StreamSniffers = append(r.StreamSniffers, sniff.RDP) r.StreamSniffers = append(r.StreamSniffers, sniff.RDP)
case C.ProtocolNTP:
r.PacketSniffers = append(r.PacketSniffers, sniff.NTP)
default: default:
return E.New("unknown sniffer: ", name) return E.New("unknown sniffer: ", name)
} }

View File

@ -3,7 +3,6 @@ package v2raywebsocket
import ( import (
"context" "context"
"encoding/base64" "encoding/base64"
"errors"
"io" "io"
"net" "net"
"os" "os"
@ -62,7 +61,7 @@ func (c *WebsocketConn) Close() error {
func (c *WebsocketConn) Read(b []byte) (n int, err error) { func (c *WebsocketConn) Read(b []byte) (n int, err error) {
var header ws.Header var header ws.Header
for { for {
n, err = wrapWsError0(c.reader.Read(b)) n, err = c.reader.Read(b)
if n > 0 { if n > 0 {
err = nil err = nil
return return
@ -96,7 +95,7 @@ func (c *WebsocketConn) Read(b []byte) (n int, err error) {
} }
func (c *WebsocketConn) Write(p []byte) (n int, err error) { func (c *WebsocketConn) Write(p []byte) (n int, err error) {
err = wrapWsError(wsutil.WriteMessage(c.Conn, c.state, ws.OpBinary, p)) err = wsutil.WriteMessage(c.Conn, c.state, ws.OpBinary, p)
if err != nil { if err != nil {
return return
} }
@ -147,7 +146,7 @@ func (c *EarlyWebsocketConn) Read(b []byte) (n int, err error) {
return 0, c.err return 0, c.err
} }
} }
return wrapWsError0(c.conn.Read(b)) return c.conn.Read(b)
} }
func (c *EarlyWebsocketConn) writeRequest(content []byte) error { func (c *EarlyWebsocketConn) writeRequest(content []byte) error {
@ -178,12 +177,12 @@ func (c *EarlyWebsocketConn) writeRequest(content []byte) error {
conn, err = c.dialContext(c.ctx, &c.requestURL, c.headers) conn, err = c.dialContext(c.ctx, &c.requestURL, c.headers)
} }
if err != nil { if err != nil {
return wrapWsError(err) return err
} }
if len(lateData) > 0 { if len(lateData) > 0 {
_, err = conn.Write(lateData) _, err = conn.Write(lateData)
if err != nil { if err != nil {
return wrapWsError(err) return err
} }
} }
c.conn = conn c.conn = conn
@ -192,7 +191,7 @@ func (c *EarlyWebsocketConn) writeRequest(content []byte) error {
func (c *EarlyWebsocketConn) Write(b []byte) (n int, err error) { func (c *EarlyWebsocketConn) Write(b []byte) (n int, err error) {
if c.conn != nil { if c.conn != nil {
return wrapWsError0(c.conn.Write(b)) return c.conn.Write(b)
} }
c.access.Lock() c.access.Lock()
defer c.access.Unlock() defer c.access.Unlock()
@ -200,9 +199,9 @@ func (c *EarlyWebsocketConn) Write(b []byte) (n int, err error) {
return 0, c.err return 0, c.err
} }
if c.conn != nil { if c.conn != nil {
return wrapWsError0(c.conn.Write(b)) return c.conn.Write(b)
} }
err = wrapWsError(c.writeRequest(b)) err = c.writeRequest(b)
c.err = err c.err = err
close(c.create) close(c.create)
if err != nil { if err != nil {
@ -213,17 +212,17 @@ func (c *EarlyWebsocketConn) Write(b []byte) (n int, err error) {
func (c *EarlyWebsocketConn) WriteBuffer(buffer *buf.Buffer) error { func (c *EarlyWebsocketConn) WriteBuffer(buffer *buf.Buffer) error {
if c.conn != nil { if c.conn != nil {
return wrapWsError(c.conn.WriteBuffer(buffer)) return c.conn.WriteBuffer(buffer)
} }
c.access.Lock() c.access.Lock()
defer c.access.Unlock() defer c.access.Unlock()
if c.conn != nil { if c.conn != nil {
return wrapWsError(c.conn.WriteBuffer(buffer)) return c.conn.WriteBuffer(buffer)
} }
if c.err != nil { if c.err != nil {
return c.err return c.err
} }
err := wrapWsError(c.writeRequest(buffer.Bytes())) err := c.writeRequest(buffer.Bytes())
c.err = err c.err = err
close(c.create) close(c.create)
return err return err
@ -273,23 +272,3 @@ func (c *EarlyWebsocketConn) Upstream() any {
func (c *EarlyWebsocketConn) LazyHeadroom() bool { func (c *EarlyWebsocketConn) LazyHeadroom() bool {
return c.conn == nil return c.conn == nil
} }
func wrapWsError(err error) error {
if err == nil {
return nil
}
var closedErr *wsutil.ClosedError
if errors.As(err, &closedErr) {
if closedErr.Code == ws.StatusNormalClosure {
err = io.EOF
}
}
return err
}
func wrapWsError0[T any](value T, err error) (T, error) {
if err == nil {
return value, nil
}
return common.DefaultValue[T](), wrapWsError(err)
}