wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add more spoof method

Browse Source 
Signed-off-by: macronut <4027187+macronut@users.noreply.github.com>
This commit is contained in:
macronut
2026-04-29 19:24:49 +08:00
committed by 世界
parent ac900b1742
commit ef06e4c2c0
22 changed files with 360 additions and 1021 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/shared/tls.md
+7 -6
View File
@@ -702,12 +702,13 @@ driver on first use. Windows on ARM64 is not supported.
How the forged segment is rejected by the real server.
| Value | Behavior |
|----------------------------|----------------------------------------------------------------------------------------|
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
Conflict with `spoof` unset.
| Value | Behavior |
|----------------------------|----------------------------------------------------------------------------------------------------------------|
| `wrong-sequence` (default) | The forged segment's TCP sequence number is placed before the server's receive window. |
| `wrong-checksum` | The forged segment's TCP checksum is deliberately invalid. |
| `wrong-ack` | The forged segment's TCP acknowledgment number is placed before the server's send window. |
| `wrong-md5` | The forged segment carries a TCP-MD5 signature option, which the server rejects since no MD5 key is negotiated. |
| `wrong-timestamp` | The forged segment carries a backdated TCP timestamp, which the server rejects as a PAWS replay. Linux/Windows only; not supported on macOS. |
### ACME Fields
docs/configuration/shared/tls.zh.md
+7 -6
View File
@@ -695,12 +695,13 @@ Windows 上首次使用时需要 Administrator 以安装内嵌的 WinDivert 内
控制伪造报文被真实服务器拒绝的方式。
| 取值 | 行为 |
|----------------------------|------------------------------------------------|
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
与 `spoof` 未设置冲突。
| 取值 | 行为 |
|--------------------------|-------------------------------------------------------------------|
| `wrong-sequence`（默认） | 伪造报文的 TCP 序列号位于服务器接收窗口之前。 |
| `wrong-checksum` | 伪造报文的 TCP 校验和被故意设为无效。 |
| `wrong-ack` | 伪造报文的 TCP 确认号位于服务器发送窗口之前。 |
| `wrong-md5` | 伪造报文携带 TCP-MD5 签名选项，未协商 MD5 密钥的服务器将拒绝。 |
| `wrong-timestamp` | 伪造报文携带回退的 TCP 时间戳，服务器按 PAWS 规则视为重放并拒绝。仅支持 Linux/Windows，不支持 macOS。 |
### ACME 字段