wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add more spoof method

Browse Source 
Signed-off-by: macronut <4027187+macronut@users.noreply.github.com>
This commit is contained in:
macronut
2026-04-29 19:24:49 +08:00
committed by 世界
parent ac900b1742
commit ef06e4c2c0
22 changed files with 360 additions and 1021 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/route/rule_action.md
+26 -2
View File
@@ -10,7 +10,9 @@ icon: material/new-box
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [resolve.disable_optimistic_cache](#disable_optimistic_cache)
:material-plus: [resolve.timeout](#timeout)
:material-plus: [resolve.timeout](#timeout)
:material-plus: [tls_spoof](#tls_spoof)
:material-plus: [tls_spoof_method](#tls_spoof_method)
!!! quote "Changes in sing-box 1.12.0"
@@ -149,7 +151,9 @@ Not available when `method` is set to drop.
"udp_timeout": "",
"tls_fragment": false,
"tls_fragment_fallback_delay": "",
"tls_record_fragment": ""
"tls_record_fragment": "",
"tls_spoof": "",
"tls_spoof_method": ""
}
```
@@ -248,6 +252,26 @@ The fallback value used when TLS segmentation cannot automatically determine the
Fragment TLS handshake into multiple TLS records to bypass firewalls.
#### tls_spoof
!!! question "Since sing-box 1.14.0"
==Linux/macOS/Windows only, requires elevated privileges==
Inject a forged TLS ClientHello carrying this SNI before the real one,
to fool SNI-filtering middleboxes that permit specific hostnames.
See outbound TLS [`spoof`](/configuration/shared/tls/#spoof) for details
and required privileges.
#### tls_spoof_method
!!! question "Since sing-box 1.14.0"
How the forged segment is rejected by the real server. See outbound TLS
[`spoof_method`](/configuration/shared/tls/#spoof_method) for the full table
of accepted values and platform notes.
### sniff
```json
docs/configuration/route/rule_action.zh.md
+24 -2
View File
@@ -10,7 +10,9 @@ icon: material/new-box
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [resolve.disable_optimistic_cache](#disable_optimistic_cache)
:material-plus: [resolve.timeout](#timeout)
:material-plus: [resolve.timeout](#timeout)
:material-plus: [tls_spoof](#tls_spoof)
:material-plus: [tls_spoof_method](#tls_spoof_method)
!!! quote "sing-box 1.12.0 中的更改"
@@ -142,7 +144,9 @@ icon: material/new-box
"udp_timeout": "",
"tls_fragment": false,
"tls_fragment_fallback_delay": "",
"tls_record_fragment": false
"tls_record_fragment": false,
"tls_spoof": "",
"tls_spoof_method": ""
}
```
@@ -240,6 +244,24 @@ UDP 连接超时时间。
通过分段 TLS 握手数据包到多个 TLS 记录来绕过防火墙检测。
#### tls_spoof
!!! question "自 sing-box 1.14.0 起"
==仅 Linux/macOS/Windows，需要管理员权限==
在真实 ClientHello 之前注入携带本字段所指定 SNI 的伪造 TLS ClientHello，
用于欺骗仅放行特定主机名的 SNI 过滤中间盒。
详情与所需权限参阅出站 TLS [`spoof`](/zh/configuration/shared/tls/#spoof)。
#### tls_spoof_method
!!! question "自 sing-box 1.14.0 起"
控制伪造报文被真实服务器拒绝的方式。完整取值表与平台说明参阅出站 TLS
[`spoof_method`](/zh/configuration/shared/tls/#spoof_method)。
### sniff
```json
docs/configuration/shared/tls.md
+7 -6
View File
@@ -702,12 +702,13 @@ driver on first use. Windows on ARM64 is not supported.
How the forged segment is rejected by the real server.
| Value | Behavior |
|----------------------------|----------------------------------------------------------------------------------------|
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
Conflict with `spoof` unset.
| Value | Behavior |
|----------------------------|----------------------------------------------------------------------------------------------------------------|
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
| `wrong-ack` | The forged segment's TCP acknowledgment number is placed before the server's send window. |
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option, which the server rejects since no MD5 key is negotiated. |
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp, which the server rejects as a PAWS replay. Linux/Windows only; not supported on macOS. |
### ACME Fields
docs/configuration/shared/tls.zh.md
+7 -6
View File
@@ -695,12 +695,13 @@ Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内
控制伪造报文被真实服务器拒绝的方式。
| 取值 | 行为 |
|----------------------------|------------------------------------------------|
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
与 `spoof` 未设置冲突。
| 取值 | 行为 |
|--------------------------|-------------------------------------------------------------------|
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
| `wrong-ack` | 伪造报文的 TCP 确认号位于服务器发送窗口之前。 |
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项，未协商 MD5 密钥的服务器将拒绝。 |
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳，服务器按 PAWS 规则视为重放并拒绝。仅支持 Linux/Windows，不支持 macOS。 |
### ACME 字段