wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Imrpove flow tracking & sniff action

Browse Source
This commit is contained in:
世界
2026-07-06 23:40:48 +08:00
parent 1541f1bd71
commit c808a1618d
15 changed files with 371 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/shared/pre-match.md
+19 -5
View File
@@ -6,7 +6,8 @@ icon: material/new-box
!!! quote "Changes in sing-box 1.14.0"
:material-alert: [route](#route)
:material-alert: [route](#route)
:material-plus: [sniff](#sniff)
!!! quote "Changes in sing-box 1.13.0"
@@ -16,11 +17,11 @@ Pre-match is rule matching that runs before the connection is established.
### How it works
When an L3 inbound (TUN, WireGuard, or Tailscale) receives a connection request, the connection has not yet been established,
so no connection data can be read. In this phase, sing-box runs the routing rules in pre-match mode.
When an L3 inbound (TUN, WireGuard, or Tailscale) receives a connection request, the connection has not yet been established:
for TCP connections no connection data is available, while for UDP connections only the first packet is available.
In this phase, sing-box runs the routing rules in pre-match mode.
Since connection data is unavailable, only actions that do not require connection data can be executed.
When a rule matches an action that requires an established connection, pre-match stops at that rule.
When a rule matches an action that requires more connection data than available, pre-match stops at that rule.
### Supported actions
@@ -53,6 +54,19 @@ otherwise connections will be rejected.
See [route](/configuration/route/rule_action/#route) for details.
#### sniff
!!! question "Since sing-box 1.14.0"
For UDP connections, the first packet is available in pre-match,
so protocol sniffing runs on it directly and rule matching continues with the sniffed metadata.
When sniffers require more data (like a fragmented QUIC Client Hello), pre-match stops at that rule.
For TCP connections, pre-match always stops at that rule.
See [sniff](/configuration/route/rule_action/#sniff) for details.
#### bypass
!!! question "Since sing-box 1.13.0"
docs/configuration/shared/pre-match.zh.md
+16 -3
View File
@@ -6,7 +6,8 @@ icon: material/new-box
!!! quote "sing-box 1.14.0 中的更改"
:material-alert: [route](#route)
:material-alert: [route](#route)
:material-plus: [sniff](#sniff)
!!! quote "sing-box 1.13.0 中的更改"
@@ -16,9 +17,9 @@ icon: material/new-box
### 工作原理
当 L3 入站（TUN、WireGuard 或 Tailscale）收到连接请求时，连接尚未建立，因此无法读取连接数据。在此阶段，sing-box 在预匹配模式下运行路由规则。
当 L3 入站（TUN、WireGuard 或 Tailscale）收到连接请求时，连接尚未建立：对于 TCP 连接，无连接数据可用；对于 UDP 连接，仅首个数据包可用。在此阶段，sing-box 在预匹配模式下运行路由规则。
由于连接数据不可用，只有不需要连接数据的动作才能执行。当规则匹配到需要已建立连接的动作时，预匹配将在该规则处停止。
当规则匹配到需要比当前可用数据更多连接数据的动作时，预匹配将在该规则处停止。
### 支持的动作
@@ -47,6 +48,18 @@ FakeIP 目标需要在预匹配中先执行 `resolve` 动作，否则连接将
详情参阅 [route](/zh/configuration/route/rule_action/#route)。
#### sniff
!!! question "自 sing-box 1.14.0 起"
对于 UDP 连接，首个数据包在预匹配中可用，因此协议探测将直接在其上运行，随后规则匹配将携带探测结果继续。
当探测器需要更多数据时（如分片的 QUIC Client Hello），预匹配将在该规则处停止。
对于 TCP 连接，预匹配总是在该规则处停止。
详情参阅 [sniff](/zh/configuration/route/rule_action/#sniff)。
#### bypass
!!! question "自 sing-box 1.13.0 起"