From 71b35d5a249f215b70f87ae023e0445479438d31 Mon Sep 17 00:00:00 2001 From: im0o <0ojixueseno0@gmail.com> Date: Mon, 10 Aug 2026 03:14:56 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BB=8E=E5=86=85=E6=A0=B8=E6=BA=90=E7=A0=81?= =?UTF-8?q?=E6=8F=90=E5=8F=96=E5=85=A5=E7=AB=99=E7=B1=BB=E5=9E=8B=E7=9A=84?= =?UTF-8?q?=E5=AD=97=E6=AE=B5=E8=A1=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 20 种类型、6 个公共字段、398 个专有字段，用来驱动界面表单。 类型清单取自 listener/parse.go 的 ParseListener switch 而不是文件名： listener/inbound/ 下 24 个非测试文件里有 11 个只是被内嵌的选项组（TLS 伪装、多路复用这类）， 不能单独当 type 写；hysteria2-realm 的类型名带中划线而文件名带下划线，靠文件名猜会错。 --- shared/listener-fields.json | 584 ++++++++++++++++++++++++++++++++++++ 1 file changed, 584 insertions(+) create mode 100644 shared/listener-fields.json diff --git a/shared/listener-fields.json b/shared/listener-fields.json new file mode 100644 index 0000000..356ba76 --- /dev/null +++ b/shared/listener-fields.json @@ -0,0 +1,584 @@ +{ + "_meta": { + "source": "mihomo Meta 分支 ~v1.19.29，源码见工作区 pkgs/mihomo", + "dispatcher": "listener/parse.go 的 ParseListener()，按 mapping[\"type\"] 分发，共 20 个 case", + "typeCount": 20, + "typeVocabulary": ["string", "number", "boolean", "string[]", "number[]", "object", "object[]"], + "nesting": "嵌套字段用点号路径表示，例如 reality-config.limit-fallback-upload.after-bytes", + "requiredRule": "结构体标签里没有 omitempty 即为必填。嵌套组只在该组出现在配置里时才校验其必填项，所以 shadow-tls.enable 标 required 的意思是「一旦写了 shadow-tls: 这个键，enable 就必须出现」，不是「每个入站都得有 shadow-tls」", + "keyMatching": "解码器大小写不敏感，且会把下划线替换成中划线（common/structure/structure.go:22）", + "caveats": [ + "shadowsocks.cipher 的枚举取自内核仓库的 docs/config.yaml，不是从源码穷举的（加密算法列表在未下载的依赖模块里），可能不完全精确", + "shadowquic.congestion-controller 的默认值源码给的是 bbr，内核文档注释写的是 cubic，此处以源码为准", + "sudoku 的几个默认值以源码 DefaultConfig() 为准，内核文档里的示例值与之不同；这些字段在源码里是指针类型，只要显式填了值就不受默认值影响" + ] + }, + + "common": [ + { "key": "name", "type": "string", "required": true, "default": null, "enum": null, "note": "这个入站的名字，用来在日志和管理接口里区分不同入站，必须填且建议唯一" }, + { "key": "listen", "type": "string", "required": false, "default": "0.0.0.0", "enum": null, "note": "监听在本机哪个 IP 上。0.0.0.0 表示所有网卡都监听，127.0.0.1 表示只允许本机连接" }, + { "key": "port", "type": "string", "required": false, "default": null, "enum": null, "note": "监听端口。支持单个端口 \"7890\"、多个端口 \"200,302\"、端口区间 \"401-429\"，也可以混写" }, + { "key": "rule", "type": "string", "required": false, "default": null, "enum": null, "note": "指定这个入站的流量走哪一组 sub-rules 子规则；留空就走全局 rules" }, + { "key": "proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "填了之后这个入站的流量直接交给指定的线路或策略组，不再做规则匹配。填的名字必须在名字表里真实存在——注意 mihomo -t 不检查这一条，只有运行时才会报错" }, + { "key": "routing-mark", "type": "number", "required": false, "default": 0, "enum": null, "note": "给监听用的 socket 打上 Linux 路由标记（SO_MARK），配合策略路由用；只在 Linux 上有效" } + ], + + "commonExcluded": [ + { "key": "ListenConfigForAPI", "reason": "结构体上标了 inbound:\"-\"，解码器会跳过。这是内核内部给管理接口用的，不能也不该写进配置文件" } + ], + + "types": { + "mixed": { + "note": "HTTP 和 SOCKS5 共用一个端口，客户端连上来自动识别协议。日常最常用", + "file": "listener/inbound/mixed.go", + "fields": [ + { "key": "udp", "type": "boolean", "required": false, "default": true, "enum": null, "note": "是否同时开 SOCKS5 的 UDP 转发。关掉后游戏、部分语音会走不通" }, + { "key": "users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "这个入站单独的账号密码列表。不写=沿用全局 authentication；写成空数组 [] = 免密码" }, + { "key": "users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书，可以直接贴 PEM 内容也可以填文件路径。要和 private-key 一起填才会开启 TLS" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书对应的私钥，PEM 内容或文件路径" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书。选后两项时必须同时填 client-auth-cert" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "用来校验客户端证书的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH（加密 TLS 握手里的域名）私钥，用 `mihomo generate ech-keypair <域名>` 生成。填了就开启 ECH" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装配置，子字段见 socks 的 reality-config.*。开了它就不要再填 certificate/private-key" } + ] + }, + + "socks": { + "note": "SOCKS5 代理入站", + "file": "listener/inbound/socks.go", + "fields": [ + { "key": "udp", "type": "boolean", "required": false, "default": true, "enum": null, "note": "是否同时开 UDP 转发（SOCKS5 UDP ASSOCIATE）" }, + { "key": "users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "这个入站单独的账号密码列表。不写=沿用全局 authentication；空数组 [] = 免密码" }, + { "key": "users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径）" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥，填了就开启 ECH" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装：认证不通过的连接会被透明转发到一个真实网站，让主动探测看不出破绽" }, + { "key": "reality-config.dest", "type": "string", "required": true, "default": null, "enum": null, "note": "要伪装成的真实网站地址，形如 test.com:443" }, + { "key": "reality-config.private-key", "type": "string", "required": true, "default": null, "enum": null, "note": "REALITY 私钥，用 `mihomo generate reality-keypair` 生成" }, + { "key": "reality-config.short-id", "type": "string[]", "required": true, "default": null, "enum": null, "note": "短 ID 列表，十六进制字符串，客户端要填其中之一" }, + { "key": "reality-config.server-names", "type": "string[]", "required": true, "default": null, "enum": null, "note": "允许客户端使用的伪装域名列表，一般和 dest 的域名一致" }, + { "key": "reality-config.max-time-difference", "type": "number", "required": false, "default": 0, "enum": null, "note": "允许的客户端与服务端时间误差（毫秒），0 表示不检查" }, + { "key": "reality-config.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "回落到 dest 时经过哪个出站" }, + { "key": "reality-config.limit-fallback-upload.after-bytes", "type": "number", "required": false, "default": 0, "enum": null, "note": "回落连接上传超过这么多字节后才开始限速" }, + { "key": "reality-config.limit-fallback-upload.bytes-per-sec", "type": "number", "required": false, "default": 0, "enum": null, "note": "回落连接上传限速（字节/秒），0 表示不限速" }, + { "key": "reality-config.limit-fallback-upload.burst-bytes-per-sec", "type": "number", "required": false, "default": 0, "enum": null, "note": "上传突发速率（字节/秒）" }, + { "key": "reality-config.limit-fallback-download.after-bytes", "type": "number", "required": false, "default": 0, "enum": null, "note": "回落连接下载超过这么多字节后才开始限速" }, + { "key": "reality-config.limit-fallback-download.bytes-per-sec", "type": "number", "required": false, "default": 0, "enum": null, "note": "回落连接下载限速（字节/秒），0 表示不限速" }, + { "key": "reality-config.limit-fallback-download.burst-bytes-per-sec", "type": "number", "required": false, "default": 0, "enum": null, "note": "下载突发速率（字节/秒）" } + ] + }, + + "http": { + "note": "HTTP/HTTPS 代理入站", + "file": "listener/inbound/http.go", + "fields": [ + { "key": "users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "这个入站单独的账号密码列表。不写=沿用全局 authentication；空数组 [] = 免密码" }, + { "key": "users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径），和 private-key 一起填才开启 HTTPS 代理" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装配置，子字段同 socks 的 reality-config.*" } + ] + }, + + "redir": { + "note": "透明代理（REDIRECT 模式），只支持 TCP，需要配合 Linux/macOS 防火墙规则把流量重定向过来", + "file": "listener/inbound/redir.go", + "fields": [] + }, + + "tproxy": { + "note": "透明代理（TPROXY 模式），TCP/UDP 都支持，仅 Linux，需要配合 iptables/nftables 规则", + "file": "listener/inbound/tproxy.go", + "fields": [ + { "key": "udp", "type": "boolean", "required": false, "default": true, "enum": null, "note": "是否同时接管 UDP 流量" } + ] + }, + + "tunnel": { + "note": "端口转发。监听一个本地端口，所有连进来的流量原封不动送到固定的目标地址", + "file": "listener/inbound/tunnel.go", + "fields": [ + { "key": "network", "type": "string[]", "required": true, "default": null, "enum": ["tcp", "udp"], "note": "要转发哪些协议，可以同时写 [tcp, udp]。写别的值会被忽略并打一条警告" }, + { "key": "target", "type": "string", "required": true, "default": null, "enum": null, "note": "转发到哪里，形如 example.com:443" } + ] + }, + + "tun": { + "note": "虚拟网卡入站，系统全局接管，所有程序的流量都会进来。写在 listeners 里的 tun 是给高级用户用的，普通场景应该用配置文件顶层的 tun 段", + "file": "listener/inbound/tun.go", + "fields": [ + { "key": "device", "type": "string", "required": false, "default": null, "enum": null, "note": "虚拟网卡的名字，比如 utun0 / Meta。留空由内核自动取名" }, + { "key": "stack", "type": "string", "required": false, "default": "gVisor", "enum": ["gvisor", "system", "mixed"], "note": "网络栈实现方式。gvisor 兼容性最好，system 性能更高，mixed 两者混用。大小写不敏感" }, + { "key": "dns-hijack", "type": "string[]", "required": false, "default": ["0.0.0.0:53"], "enum": null, "note": "要劫持的 DNS 地址。写 0.0.0.0:53 表示劫持所有发往 53 端口的 DNS 查询，交给 mihomo 自己解析" }, + { "key": "auto-route", "type": "boolean", "required": false, "default": false, "enum": null, "note": "自动往系统路由表里加规则，把流量导进虚拟网卡。不开的话要自己配路由" }, + { "key": "auto-detect-interface", "type": "boolean", "required": false, "default": false, "enum": null, "note": "自动识别真正的出网网卡，网络切换时能跟着变" }, + { "key": "mtu", "type": "number", "required": false, "default": 0, "enum": null, "note": "最大传输单元，一个网络包最多多少字节。常见值 1500 或 9000，0 表示用默认值" }, + { "key": "gso", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启通用分段卸载，让网卡批量处理大包以提升吞吐" }, + { "key": "gso-max-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "GSO 单批最大字节数" }, + { "key": "inet4-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "给虚拟网卡分配的 IPv4 地址段，如 198.19.0.1/30" }, + { "key": "inet6-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "给虚拟网卡分配的 IPv6 地址段" }, + { "key": "iproute2-table-index", "type": "number", "required": false, "default": 0, "enum": null, "note": "Linux 策略路由用的路由表编号" }, + { "key": "iproute2-rule-index", "type": "number", "required": false, "default": 0, "enum": null, "note": "Linux 策略路由用的规则优先级编号" }, + { "key": "auto-redirect", "type": "boolean", "required": false, "default": false, "enum": null, "note": "Linux 上自动配置 nftables 重定向规则，让 TCP 走更高效的路径" }, + { "key": "auto-redirect-input-mark", "type": "number", "required": false, "default": 0, "enum": null, "note": "auto-redirect 给入向包打的标记值" }, + { "key": "auto-redirect-output-mark", "type": "number", "required": false, "default": 0, "enum": null, "note": "auto-redirect 给出向包打的标记值" }, + { "key": "auto-redirect-iproute2-fallback-rule-index", "type": "number", "required": false, "default": 0, "enum": null, "note": "auto-redirect 回退方案使用的策略路由规则编号" }, + { "key": "loopback-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "额外声明为本机地址的 IP 列表，发往这些地址的流量不进代理" }, + { "key": "strict-route", "type": "boolean", "required": false, "default": false, "enum": null, "note": "严格路由：把所有连接强行导进虚拟网卡防止漏流量，代价是同局域网其它设备访问不到本机" }, + { "key": "route-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "开启 auto-route 时只接管这些网段" }, + { "key": "route-address-set", "type": "string[]", "required": false, "default": null, "enum": null, "note": "引用 rule-provider 里的地址集合作为要接管的网段" }, + { "key": "route-exclude-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "这些网段不接管，走系统原来的路由" }, + { "key": "route-exclude-address-set", "type": "string[]", "required": false, "default": null, "enum": null, "note": "引用 rule-provider 地址集合，这些网段不接管" }, + { "key": "include-interface", "type": "string[]", "required": false, "default": null, "enum": null, "note": "只接管来自这些网卡的流量" }, + { "key": "exclude-interface", "type": "string[]", "required": false, "default": null, "enum": null, "note": "不接管来自这些网卡的流量" }, + { "key": "include-uid", "type": "number[]", "required": false, "default": null, "enum": null, "note": "只接管这些 Linux 用户 ID 的流量。仅 Linux，且需要 auto-route" }, + { "key": "include-uid-range", "type": "string[]", "required": false, "default": null, "enum": null, "note": "只接管这些 UID 区间的流量，写法如 \"1000:99999\"" }, + { "key": "exclude-uid", "type": "number[]", "required": false, "default": null, "enum": null, "note": "不接管这些 UID 的流量" }, + { "key": "exclude-uid-range", "type": "string[]", "required": false, "default": null, "enum": null, "note": "不接管这些 UID 区间的流量" }, + { "key": "exclude-src-port", "type": "number[]", "required": false, "default": null, "enum": null, "note": "源端口是这些的流量不接管" }, + { "key": "exclude-src-port-range", "type": "string[]", "required": false, "default": null, "enum": null, "note": "源端口在这些区间的流量不接管，写法如 \"1000:2000\"" }, + { "key": "exclude-dst-port", "type": "number[]", "required": false, "default": null, "enum": null, "note": "目标端口是这些的流量不接管" }, + { "key": "exclude-dst-port-range", "type": "string[]", "required": false, "default": null, "enum": null, "note": "目标端口在这些区间的流量不接管" }, + { "key": "include-android-user", "type": "number[]", "required": false, "default": null, "enum": null, "note": "只接管这些 Android 用户（主用户是 0，工作资料一般是 10）" }, + { "key": "include-package", "type": "string[]", "required": false, "default": null, "enum": null, "note": "只接管这些 Android 应用的流量，填包名如 com.android.chrome" }, + { "key": "exclude-package", "type": "string[]", "required": false, "default": null, "enum": null, "note": "不接管这些 Android 应用的流量" }, + { "key": "include-mac-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "只接管来自这些 MAC 地址设备的流量" }, + { "key": "exclude-mac-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "不接管来自这些 MAC 地址设备的流量" }, + { "key": "endpoint-independent-nat", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启完全锥形 NAT，对 P2P 和联机游戏更友好，但更吃内存" }, + { "key": "udp-timeout", "type": "number", "required": false, "default": 0, "enum": null, "note": "UDP 会话多久没数据就回收（秒）" }, + { "key": "icmp-timeout", "type": "number", "required": false, "default": 0, "enum": null, "note": "ICMP（ping）会话多久没数据就回收（秒）" }, + { "key": "disable-icmp-forwarding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "不转发 ICMP。能避免某些环境下 ping 回环的问题，代价是 ping 出来的延迟不真实" }, + { "key": "file-descriptor", "type": "number", "required": false, "default": 0, "enum": null, "note": "直接复用一个已经打开的 tun 文件描述符，通常由 Android/iOS 外壳程序传进来" }, + { "key": "inet4-route-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "开启 auto-route 时用这些自定义 IPv4 路由代替默认路由" }, + { "key": "inet6-route-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "开启 auto-route 时用这些自定义 IPv6 路由代替默认路由" }, + { "key": "inet4-route-exclude-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "这些 IPv4 网段排除在自动路由之外" }, + { "key": "inet6-route-exclude-address", "type": "string[]", "required": false, "default": null, "enum": null, "note": "这些 IPv6 网段排除在自动路由之外" }, + { "key": "recvmsgx", "type": "boolean", "required": false, "default": false, "enum": null, "note": "macOS 专用：用 recvmsg_x 批量收包提升性能" }, + { "key": "sendmsgx", "type": "boolean", "required": false, "default": false, "enum": null, "note": "macOS 专用：用 sendmsg_x 批量发包提升性能" } + ] + }, + + "shadowsocks": { + "note": "Shadowsocks 服务端入站", + "file": "listener/inbound/shadowsocks.go", + "fields": [ + { "key": "password", "type": "string", "required": true, "default": null, "enum": null, "note": "连接密码。用 2022-blake3-* 加密时必须是对应长度的 base64 字符串" }, + { "key": "cipher", "type": "string", "required": true, "default": null, "enum": ["none", "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "rc4-md5", "chacha20-ietf", "xchacha20"], "note": "加密方式。新部署推荐 2022-blake3-aes-256-gcm；后面那批 cfb/ctr/rc4 是老式流加密，不安全，只为兼容旧客户端保留" }, + { "key": "udp", "type": "boolean", "required": false, "default": true, "enum": null, "note": "是否开启 UDP 转发" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时给数据包加随机填充，让流量特征更难识别" }, + { "key": "mux-option.brutal.enabled", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启 Brutal 拥塞控制：按你指定的带宽硬发，不管丢包" }, + { "key": "mux-option.brutal.up", "type": "string", "required": false, "default": null, "enum": null, "note": "上行带宽上限，如 \"100 Mbps\"" }, + { "key": "mux-option.brutal.down", "type": "string", "required": false, "default": null, "enum": null, "note": "下行带宽上限，如 \"100 Mbps\"" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装（把流量包装成访问某个真实 HTTPS 网站的样子）。写了 shadow-tls 这一组就必须填这个字段" }, + { "key": "shadow-tls.version", "type": "number", "required": false, "default": null, "enum": [1, 2, 3], "note": "ShadowTLS 协议版本，v3 最安全" }, + { "key": "shadow-tls.password", "type": "string", "required": false, "default": null, "enum": null, "note": "v2 用的密码。v3 请改用 users 列表" }, + { "key": "shadow-tls.users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "v3 用的用户列表" }, + { "key": "shadow-tls.users[].name", "type": "string", "required": false, "default": null, "enum": null, "note": "用户名" }, + { "key": "shadow-tls.users[].password", "type": "string", "required": false, "default": null, "enum": null, "note": "密码" }, + { "key": "shadow-tls.handshake.dest", "type": "string", "required": true, "default": null, "enum": null, "note": "伪装握手的真实网站地址，如 www.example.com:443" }, + { "key": "shadow-tls.handshake.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "连伪装网站时走哪个出站" }, + { "key": "shadow-tls.handshake-for-server-name", "type": "object", "required": false, "default": null, "enum": null, "note": "按客户端请求的域名分别指定伪装目标。键是域名，值是 {dest, proxy}" }, + { "key": "shadow-tls.strict-mode", "type": "boolean", "required": false, "default": false, "enum": null, "note": "严格模式，对不合规的握手更早断开，抗主动探测更强" }, + { "key": "shadow-tls.wildcard-sni", "type": "string", "required": false, "default": "", "enum": ["", "authed", "all"], "note": "允许客户端用任意域名伪装：留空=关闭，authed=只对已认证连接放开，all=全放开" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。写了 res-tls 这一组就必须填" }, + { "key": "res-tls.dest", "type": "string", "required": true, "default": null, "enum": null, "note": "伪装的真实网站地址" }, + { "key": "res-tls.password", "type": "string", "required": true, "default": null, "enum": null, "note": "Restls 密码" }, + { "key": "res-tls.restls-script", "type": "string", "required": false, "default": null, "enum": null, "note": "Restls 行为脚本，用来模仿特定网站的收发包节奏" }, + { "key": "res-tls.min-record-len", "type": "number", "required": false, "default": 0, "enum": null, "note": "TLS 记录最小长度，用来消除小包特征" }, + { "key": "res-tls.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "连伪装网站时走哪个出站" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。写了 jls-config 这一组就必须填" }, + { "key": "jls-config.users", "type": "object[]", "required": true, "default": null, "enum": null, "note": "JLS 用户列表" }, + { "key": "jls-config.users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "jls-config.users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "jls-config.dest", "type": "string", "required": true, "default": null, "enum": null, "note": "认证失败时透明回落到的真实网站" }, + { "key": "jls-config.sni", "type": "string", "required": false, "default": null, "enum": null, "note": "伪装用的域名，留空会自动从 dest 里取" }, + { "key": "jls-config.alpn", "type": "string[]", "required": false, "default": null, "enum": null, "note": "TLS 协商的应用层协议列表，如 [h2, http/1.1]" }, + { "key": "jls-config.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "回落时走哪个出站" }, + { "key": "jls-config.rate-limit", "type": "number", "required": false, "default": 0, "enum": null, "note": "回落转发的限速，单位 bit/s，0 表示不限速" }, + { "key": "kcp-tun.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否用 KCPTun 把 TCP 流量转成 UDP 传输（丢包高的线路能提速）。写了 kcp-tun 这一组就必须填" }, + { "key": "kcp-tun.key", "type": "string", "required": false, "default": "it's a secrect", "enum": null, "note": "KCPTun 的预共享密钥，客户端服务端要一致" }, + { "key": "kcp-tun.crypt", "type": "string", "required": false, "default": "aes", "enum": ["aes", "aes-128", "aes-192", "aes-128-gcm", "salsa20", "blowfish", "twofish", "cast5", "3des", "tea", "xtea", "xor", "none", "null"], "note": "KCPTun 自己那层的加密算法。填错会被静默改成 aes" }, + { "key": "kcp-tun.mode", "type": "string", "required": false, "default": "fast", "enum": ["fast3", "fast2", "fast", "normal", "manual"], "note": "预设档位，越靠前越激进（更低延迟、更费流量）。选 manual 才会用下面的手动参数" }, + { "key": "kcp-tun.conn", "type": "number", "required": false, "default": 1, "enum": null, "note": "到服务端建立几条 UDP 连接" }, + { "key": "kcp-tun.autoexpire", "type": "number", "required": false, "default": 0, "enum": null, "note": "单条 UDP 连接多少秒后自动过期重建，0 表示不过期" }, + { "key": "kcp-tun.scavengettl", "type": "number", "required": false, "default": 600, "enum": null, "note": "已过期的连接还能存活多久（秒），给未完成的传输留时间" }, + { "key": "kcp-tun.mtu", "type": "number", "required": false, "default": 1350, "enum": null, "note": "UDP 包的最大字节数" }, + { "key": "kcp-tun.ratelimit", "type": "number", "required": false, "default": 0, "enum": null, "note": "单条 KCP 连接的发送速率上限（字节/秒），0 表示不限" }, + { "key": "kcp-tun.sndwnd", "type": "number", "required": false, "default": 128, "enum": null, "note": "发送窗口大小（包数），调大能提速但更吃内存和带宽" }, + { "key": "kcp-tun.rcvwnd", "type": "number", "required": false, "default": 512, "enum": null, "note": "接收窗口大小（包数）" }, + { "key": "kcp-tun.datashard", "type": "number", "required": false, "default": 10, "enum": null, "note": "前向纠错：每多少个数据包为一组" }, + { "key": "kcp-tun.parityshard", "type": "number", "required": false, "default": 3, "enum": null, "note": "前向纠错：每组额外发几个校验包，丢包时不用重传就能恢复" }, + { "key": "kcp-tun.dscp", "type": "number", "required": false, "default": 0, "enum": null, "note": "IP 头里的 DSCP 服务质量标记" }, + { "key": "kcp-tun.nocomp", "type": "boolean", "required": false, "default": false, "enum": null, "note": "关闭压缩" }, + { "key": "kcp-tun.acknodelay", "type": "boolean", "required": false, "default": false, "enum": null, "note": "收到包就立刻回确认，不攒批" }, + { "key": "kcp-tun.nodelay", "type": "number", "required": false, "default": 0, "enum": null, "note": "手动模式参数：0=普通，1=启用快速重传" }, + { "key": "kcp-tun.interval", "type": "number", "required": false, "default": 50, "enum": null, "note": "手动模式参数：内部时钟间隔（毫秒），越小越及时越费 CPU" }, + { "key": "kcp-tun.resend", "type": "number", "required": false, "default": 0, "enum": null, "note": "手动模式参数：跳过几次确认就触发快速重传，0=关闭" }, + { "key": "kcp-tun.nc", "type": "number", "required": false, "default": 0, "enum": null, "note": "手动模式参数：1=关闭拥塞控制（更快但更占带宽）" }, + { "key": "kcp-tun.sockbuf", "type": "number", "required": false, "default": 4194304, "enum": null, "note": "每个 socket 的缓冲区字节数" }, + { "key": "kcp-tun.smuxver", "type": "number", "required": false, "default": 1, "enum": [1, 2], "note": "多路复用协议版本，最大 2，填大了会被降到 2 并打警告" }, + { "key": "kcp-tun.smuxbuf", "type": "number", "required": false, "default": 4194304, "enum": null, "note": "多路复用总缓冲区字节数" }, + { "key": "kcp-tun.framesize", "type": "number", "required": false, "default": 8192, "enum": null, "note": "多路复用单帧最大字节数" }, + { "key": "kcp-tun.streambuf", "type": "number", "required": false, "default": 2097152, "enum": null, "note": "每条流的接收缓冲字节数，多路复用协议 v2 及以上有效" }, + { "key": "kcp-tun.keepalive", "type": "number", "required": false, "default": 10, "enum": null, "note": "心跳间隔（秒）" }, + { "key": "simple-obfs.enable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "是否启用 simple-obfs 混淆（把流量伪装成普通 HTTP 或 TLS）" }, + { "key": "simple-obfs.mode", "type": "string", "required": false, "default": null, "enum": ["http", "tls"], "note": "混淆方式。启用后填错值会直接启动失败" } + ] + }, + + "snell": { + "note": "Snell 服务端入站", + "file": "listener/inbound/snell.go", + "fields": [ + { "key": "psk", "type": "string", "required": true, "default": null, "enum": null, "note": "预共享密钥，相当于密码，客户端要填一样的" }, + { "key": "version", "type": "number", "required": false, "default": 4, "enum": [1, 2, 3, 4, 5], "note": "Snell 协议版本。填 0 或不填按 4 处理；超出 1~5 直接启动失败" }, + { "key": "udp", "type": "boolean", "required": false, "default": true, "enum": null, "note": "是否开启 UDP over TCP 隧道" }, + { "key": "obfs-opts.mode", "type": "string", "required": true, "default": null, "enum": ["", "http", "tls"], "note": "混淆方式，把流量伪装成 HTTP 或 TLS。注意源码这里的标签写成了 obfs 而不是 inbound，导致 omitempty 失效——只要写了 obfs-opts 这一组，mode 和 host 两个都必须出现，否则启动报 has unset fields" }, + { "key": "obfs-opts.host", "type": "string", "required": true, "default": null, "enum": null, "note": "混淆时伪装的域名，如 bing.com。同上，写了 obfs-opts 就必须出现" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装。子字段同 shadowsocks 的 shadow-tls.*" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。子字段同 shadowsocks 的 res-tls.*" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。子字段同 shadowsocks 的 jls-config.*。这三种伪装三选一，不能同时开" } + ] + }, + + "vmess": { + "note": "VMess 服务端入站", + "file": "listener/inbound/vmess.go", + "fields": [ + { "key": "users", "type": "object[]", "required": true, "default": null, "enum": null, "note": "用户列表，必填" }, + { "key": "users[].uuid", "type": "string", "required": true, "default": null, "enum": null, "note": "用户的 UUID，客户端凭它认证" }, + { "key": "users[].username", "type": "string", "required": false, "default": null, "enum": null, "note": "给这个用户起的名字，只影响日志和统计" }, + { "key": "users[].alterId", "type": "number", "required": false, "default": 0, "enum": null, "note": "旧版 VMess 的额外 ID 数量，新部署一律填 0" }, + { "key": "ws-path", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 WebSocket 传输，值是路径如 \"/\"。方便套 CDN 或 nginx 反代" }, + { "key": "grpc-service-name", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 gRPC 传输，值是服务名" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径）" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装。子字段同 shadowsocks 的 shadow-tls.*" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。子字段同 shadowsocks 的 res-tls.*" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。子字段同 shadowsocks 的 jls-config.*" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装配置，子字段同 socks 的 reality-config.*。不能和 certificate/private-key 同时填" }, + { "key": "tlsmirror-config.primary-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLSMirror 主密钥，32 字节的 base64 编码" }, + { "key": "tlsmirror-config.dest", "type": "string", "required": false, "default": null, "enum": null, "note": "要镜像的真实网站地址" }, + { "key": "tlsmirror-config.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "连接镜像目标时走哪个出站" }, + { "key": "tlsmirror-config.explicit-nonce-ciphersuites", "type": "number[]", "required": false, "default": null, "enum": null, "note": "哪些 TLS 1.2 加密套件使用显式 nonce，填套件编号列表" }, + { "key": "tlsmirror-config.defer-instance-derived-write-time.base-nanoseconds", "type": "number", "required": false, "default": 0, "enum": null, "note": "首次写数据前固定等待的纳秒数，用来模仿真实服务的响应时间" }, + { "key": "tlsmirror-config.defer-instance-derived-write-time.uniform-random-multiplier-nanoseconds", "type": "number", "required": false, "default": 0, "enum": null, "note": "在固定等待之外再随机等待 0 到这个纳秒数" }, + { "key": "tlsmirror-config.transport-layer-padding.enabled", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启传输层填充，打乱包长特征" }, + { "key": "tlsmirror-config.connection-enrolment.primary-ingress-outbound", "type": "string", "required": false, "default": null, "enum": null, "note": "连接登记：入向控制出站的标签，要和对端路由配置一致" }, + { "key": "tlsmirror-config.connection-enrolment.primary-egress-outbound", "type": "string", "required": false, "default": null, "enum": null, "note": "连接登记：出向控制出站的标签" }, + { "key": "tlsmirror-config.sequence-watermarking-enabled", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启序列水印" }, + { "key": "mekya-config.enable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "启用 Mekya 传输（走 HTTP/2 + KCP）。不能和 mkcp/ws/grpc 同时用" }, + { "key": "mekya-config.url", "type": "string", "required": false, "default": null, "enum": null, "note": "Mekya 的 HTTP 端点地址" }, + { "key": "mekya-config.h2-pool-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "HTTP/2 连接池大小" }, + { "key": "mekya-config.max-write-delay", "type": "number", "required": false, "default": 0, "enum": null, "note": "写数据最大延迟，用来攒批" }, + { "key": "mekya-config.max-request-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "单个请求的最大字节数" }, + { "key": "mekya-config.polling-interval-initial", "type": "number", "required": false, "default": 0, "enum": null, "note": "轮询的初始间隔（毫秒）" }, + { "key": "mekya-config.max-write-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "单次响应回写的最大字节数，参考值 10485760" }, + { "key": "mekya-config.max-write-duration-ms", "type": "number", "required": false, "default": 0, "enum": null, "note": "单次响应回写的最长持续时间（毫秒），参考值 5000" }, + { "key": "mekya-config.max-simultaneous-write-connection", "type": "number", "required": false, "default": 0, "enum": null, "note": "同一会话允许同时挂着的写回请求数，参考值 128" }, + { "key": "mekya-config.packet-writing-buffer", "type": "number", "required": false, "default": 0, "enum": null, "note": "写包缓冲区字节数，参考值 65536" }, + { "key": "mekya-config.kcp.enable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "Mekya 内层 KCP 的开关，子字段与 mkcp-config.* 同名同义" }, + { "key": "mkcp-config.enable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "启用 mKCP 传输（基于 UDP，丢包高的线路更稳）" }, + { "key": "mkcp-config.mtu", "type": "number", "required": false, "default": 0, "enum": null, "note": "最大传输单元，一个 UDP 包最多多少字节，参考值 1350" }, + { "key": "mkcp-config.tti", "type": "number", "required": false, "default": 0, "enum": null, "note": "发包时间间隔（毫秒），越小越及时越费 CPU，参考值 50" }, + { "key": "mkcp-config.uplink-capacity", "type": "number", "required": false, "default": 0, "enum": null, "note": "上行容量（MB/s），按实际带宽填" }, + { "key": "mkcp-config.downlink-capacity", "type": "number", "required": false, "default": 0, "enum": null, "note": "下行容量（MB/s）" }, + { "key": "mkcp-config.congestion", "type": "boolean", "required": false, "default": false, "enum": null, "note": "是否开启拥塞控制（丢包时主动降速）" }, + { "key": "mkcp-config.write-buffer", "type": "number", "required": false, "default": 0, "enum": null, "note": "写缓冲区字节数，参考值 2097152" }, + { "key": "mkcp-config.read-buffer", "type": "number", "required": false, "default": 0, "enum": null, "note": "读缓冲区字节数，参考值 2097152" }, + { "key": "mkcp-config.seed", "type": "string", "required": false, "default": null, "enum": null, "note": "开启 AES-GCM 认证用的种子，客户端要填一样的" }, + { "key": "mkcp-config.header", "type": "string", "required": false, "default": "", "enum": ["", "none", "srtp", "utp", "wechat-video", "wechat", "dtls", "wireguard"], "note": "伪装包头，把 UDP 包头装成视频通话、BT 或游戏流量的样子" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" } + ] + }, + + "vless": { + "note": "VLESS 服务端入站。allow-insecure 不为 true 时，certificate+private-key / shadow-tls / res-tls / jls-config / reality-config / decryption 至少要有一项", + "file": "listener/inbound/vless.go", + "fields": [ + { "key": "users", "type": "object[]", "required": true, "default": null, "enum": null, "note": "用户列表，必填" }, + { "key": "users[].uuid", "type": "string", "required": true, "default": null, "enum": null, "note": "用户的 UUID，客户端凭它认证" }, + { "key": "users[].username", "type": "string", "required": false, "default": null, "enum": null, "note": "给这个用户起的名字，只影响日志和统计" }, + { "key": "users[].flow", "type": "string", "required": false, "default": "", "enum": ["", "xtls-rprx-vision"], "note": "流控方式。xtls-rprx-vision 能减少 TLS 套 TLS 的特征，但不支持 UDP" }, + { "key": "decryption", "type": "string", "required": false, "default": null, "enum": null, "note": "VLESS Encryption 的服务端配置串（后量子握手加密），用 `mihomo generate vless-x25519` 和 `vless-mlkem768` 生成" }, + { "key": "ws-path", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 WebSocket 传输，值是路径如 \"/\"" }, + { "key": "grpc-service-name", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 gRPC 传输，值是服务名" }, + { "key": "xhttp-config.path", "type": "string", "required": false, "default": null, "enum": null, "note": "启用 XHTTP 传输并指定路径" }, + { "key": "xhttp-config.host", "type": "string", "required": false, "default": null, "enum": null, "note": "XHTTP 请求里的 Host 头" }, + { "key": "xhttp-config.mode", "type": "string", "required": false, "default": null, "enum": ["auto", "stream-one", "stream-up", "packet-up"], "note": "XHTTP 工作模式：stream-one 单连接双向流，stream-up 上行流式，packet-up 上行分包，auto 自动选" }, + { "key": "xhttp-config.no-sse-header", "type": "boolean", "required": false, "default": false, "enum": null, "note": "不发送服务器推送事件的响应头" }, + { "key": "xhttp-config.x-padding-bytes", "type": "string", "required": false, "default": null, "enum": null, "note": "填充字节数范围，如 \"100-1000\"，用来打乱请求长度特征" }, + { "key": "xhttp-config.x-padding-obfs-mode", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启填充混淆模式" }, + { "key": "xhttp-config.x-padding-key", "type": "string", "required": false, "default": null, "enum": null, "note": "承载填充内容的参数名" }, + { "key": "xhttp-config.x-padding-header", "type": "string", "required": false, "default": null, "enum": null, "note": "承载填充内容的 HTTP 头名" }, + { "key": "xhttp-config.x-padding-placement", "type": "string", "required": false, "default": null, "enum": ["queryInHeader", "cookie", "header", "query"], "note": "填充内容放在哪儿" }, + { "key": "xhttp-config.x-padding-method", "type": "string", "required": false, "default": null, "enum": ["repeat-x", "tokenish"], "note": "填充内容长什么样：重复的 x，还是像随机 token" }, + { "key": "xhttp-config.uplink-http-method", "type": "string", "required": false, "default": null, "enum": ["POST", "PUT", "PATCH", "DELETE"], "note": "上行数据用哪个 HTTP 方法发" }, + { "key": "xhttp-config.session-placement", "type": "string", "required": false, "default": null, "enum": ["path", "query", "cookie", "header"], "note": "会话 ID 放在请求的哪个位置" }, + { "key": "xhttp-config.session-key", "type": "string", "required": false, "default": null, "enum": null, "note": "承载会话 ID 的参数名或头名" }, + { "key": "xhttp-config.seq-placement", "type": "string", "required": false, "default": null, "enum": ["path", "query", "cookie", "header"], "note": "包序号放在请求的哪个位置" }, + { "key": "xhttp-config.seq-key", "type": "string", "required": false, "default": null, "enum": null, "note": "承载包序号的参数名或头名" }, + { "key": "xhttp-config.uplink-data-placement", "type": "string", "required": false, "default": null, "enum": ["body", "cookie", "header"], "note": "上行数据本身放在哪儿" }, + { "key": "xhttp-config.uplink-data-key", "type": "string", "required": false, "default": null, "enum": null, "note": "上行数据不放请求体时用的参数名或头名" }, + { "key": "xhttp-config.uplink-chunk-size", "type": "string", "required": false, "default": null, "enum": null, "note": "上行分块大小，仅当上行数据不放请求体时有意义" }, + { "key": "xhttp-config.sc-stream-up-server-secs", "type": "string", "required": false, "default": null, "enum": null, "note": "服务端保持上行流的秒数范围，如 \"20-80\"" }, + { "key": "xhttp-config.sc-max-buffered-posts", "type": "string", "required": false, "default": null, "enum": null, "note": "最多缓存多少个乱序到达的 POST，参考值 30" }, + { "key": "xhttp-config.sc-max-each-post-bytes", "type": "string", "required": false, "default": null, "enum": null, "note": "单个 POST 最大字节数，参考值 1000000" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径）" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "allow-insecure", "type": "boolean", "required": false, "default": false, "enum": null, "note": "允许完全不开 TLS 明文跑。只在前面有 nginx/caddy 帮你做 TLS 时才可以开" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装。子字段同 shadowsocks 的 shadow-tls.*" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。子字段同 shadowsocks 的 res-tls.*" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。子字段同 shadowsocks 的 jls-config.*" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装配置，子字段同 socks 的 reality-config.*。不能和 certificate/private-key 同时填" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" } + ] + }, + + "trojan": { + "note": "Trojan 服务端入站。allow-insecure 不为 true 时，certificate+private-key / shadow-tls / res-tls / jls-config / reality-config / ss-option 至少要有一项", + "file": "listener/inbound/trojan.go", + "fields": [ + { "key": "users", "type": "object[]", "required": true, "default": null, "enum": null, "note": "用户列表，必填" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "用户密码，客户端凭它认证" }, + { "key": "users[].username", "type": "string", "required": false, "default": null, "enum": null, "note": "给这个用户起的名字，只影响日志和统计" }, + { "key": "ws-path", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 WebSocket 传输，值是路径如 \"/\"" }, + { "key": "grpc-service-name", "type": "string", "required": false, "default": null, "enum": null, "note": "填了就启用 gRPC 传输，值是服务名" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径）" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "allow-insecure", "type": "boolean", "required": false, "default": false, "enum": null, "note": "允许不开 TLS 明文跑，只在有 nginx/caddy 前置时使用" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装。子字段同 shadowsocks 的 shadow-tls.*" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。子字段同 shadowsocks 的 res-tls.*" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。子字段同 shadowsocks 的 jls-config.*" }, + { "key": "reality-config", "type": "object", "required": false, "default": null, "enum": null, "note": "REALITY 伪装配置，子字段同 socks 的 reality-config.*" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" }, + { "key": "ss-option.enabled", "type": "boolean", "required": false, "default": false, "enum": null, "note": "在 Trojan 之上再套一层 Shadowsocks 加密，前置 nginx 时能防主动探测" }, + { "key": "ss-option.method", "type": "string", "required": false, "default": null, "enum": ["aes-128-gcm", "aes-256-gcm", "chacha20-ietf-poly1305"], "note": "这层 Shadowsocks 用的加密方式" }, + { "key": "ss-option.password", "type": "string", "required": false, "default": null, "enum": null, "note": "这层 Shadowsocks 的密码" } + ] + }, + + "hysteria2": { + "note": "Hysteria2 服务端入站，基于 QUIC/UDP，高丢包线路上表现好", + "file": "listener/inbound/hysteria2.go", + "fields": [ + { "key": "certificate", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径），必填" }, + { "key": "private-key", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径），必填" }, + { "key": "users", "type": "object", "required": false, "default": null, "enum": null, "note": "用户表，键是用户名或 UUID，值是密码" }, + { "key": "obfs", "type": "string", "required": false, "default": "", "enum": ["", "salamander", "gecko"], "note": "在 QUIC 外面再套一层混淆，防止运营商识别 QUIC 特征" }, + { "key": "obfs-password", "type": "string", "required": false, "default": null, "enum": null, "note": "混淆密码，客户端要填一样的" }, + { "key": "obfs-min-packet-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "线上数据包最小字节数，仅 gecko 混淆有效，参考值 512" }, + { "key": "obfs-max-packet-size", "type": "number", "required": false, "default": 0, "enum": null, "note": "线上数据包最大字节数，仅 gecko 混淆有效，参考值 1200" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "max-idle-time", "type": "number", "required": false, "default": 0, "enum": null, "note": "连接空闲多久就关掉（毫秒），参考值 15000" }, + { "key": "alpn", "type": "string[]", "required": false, "default": null, "enum": null, "note": "TLS 协商的应用层协议列表，一般填 [h3]" }, + { "key": "up", "type": "string", "required": false, "default": null, "enum": null, "note": "服务端上行带宽，如 \"200 Mbps\"。up 和 down 都不填就改用 BBR 自适应" }, + { "key": "down", "type": "string", "required": false, "default": null, "enum": null, "note": "服务端下行带宽，如 \"30 Mbps\"" }, + { "key": "ignore-client-bandwidth", "type": "boolean", "required": false, "default": false, "enum": null, "note": "忽略客户端声明的带宽，强制用服务端这边的设置" }, + { "key": "masquerade", "type": "string", "required": false, "default": null, "enum": null, "note": "认证失败时怎么伪装：file:///var/www 当文件服务器，http://127.0.0.1:8080 当反向代理。不填就返回 404 页" }, + { "key": "cwnd", "type": "number", "required": false, "default": 32, "enum": null, "note": "拥塞窗口初始大小（包数），调大能加速慢启动" }, + { "key": "bbr-profile", "type": "string", "required": false, "default": "standard", "enum": ["", "standard", "conservative", "aggressive"], "note": "BBR 拥塞控制的激进程度：conservative 更礼让，aggressive 更抢带宽" }, + { "key": "udp-mtu", "type": "number", "required": false, "default": 0, "enum": null, "note": "转发 UDP 时单个包最大字节数，太大会被分片" }, + { "key": "initial-stream-receive-window", "type": "number", "required": false, "default": 0, "enum": null, "note": "QUIC 单条流的初始接收窗口字节数" }, + { "key": "max-stream-receive-window", "type": "number", "required": false, "default": 0, "enum": null, "note": "QUIC 单条流的最大接收窗口字节数" }, + { "key": "initial-connection-receive-window", "type": "number", "required": false, "default": 0, "enum": null, "note": "QUIC 整条连接的初始接收窗口字节数" }, + { "key": "max-connection-receive-window", "type": "number", "required": false, "default": 0, "enum": null, "note": "QUIC 整条连接的最大接收窗口字节数" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" }, + { "key": "realm-opts.enable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "启用 Realm 打洞：向一台登记服务器注册自己，让客户端能穿透 NAT 找到你" }, + { "key": "realm-opts.server-url", "type": "string", "required": false, "default": null, "enum": null, "note": "登记服务器地址" }, + { "key": "realm-opts.token", "type": "string", "required": false, "default": null, "enum": null, "note": "访问登记服务器用的令牌" }, + { "key": "realm-opts.realm-id", "type": "string", "required": false, "default": null, "enum": null, "note": "在登记服务器上注册的房间名，客户端靠它找到你" }, + { "key": "realm-opts.stun-servers", "type": "string[]", "required": false, "default": null, "enum": null, "note": "用来探测自己公网地址的 STUN 服务器列表" }, + { "key": "realm-opts.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "连登记服务器时走哪个出站" }, + { "key": "realm-opts.sni", "type": "string", "required": false, "default": null, "enum": null, "note": "连登记服务器时 TLS 用的域名" }, + { "key": "realm-opts.skip-cert-verify", "type": "boolean", "required": false, "default": false, "enum": null, "note": "连登记服务器时跳过证书校验，不安全，仅自签名时用" }, + { "key": "realm-opts.name-cert-verify", "type": "string", "required": false, "default": null, "enum": null, "note": "只改证书里域名校验的目标，不改实际发出去的域名" }, + { "key": "realm-opts.fingerprint", "type": "string", "required": false, "default": null, "enum": null, "note": "锁定登记服务器证书的指纹" }, + { "key": "realm-opts.certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "连登记服务器时用的客户端证书" }, + { "key": "realm-opts.private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "连登记服务器时用的客户端私钥" }, + { "key": "realm-opts.alpn", "type": "string[]", "required": false, "default": null, "enum": null, "note": "连登记服务器时 TLS 协商的协议列表" } + ] + }, + + "hysteria2-realm": { + "note": "Realm 登记服务器。它本身不代理任何流量，是给 hysteria2 的 realm-opts.server-url 用的注册中心，别和 hysteria2 搞混", + "file": "listener/inbound/hysteria2_realm.go", + "fields": [ + { "key": "token", "type": "string", "required": true, "default": null, "enum": null, "note": "访问令牌，hysteria2 那边会用 Authorization: Bearer 带上它。必填" }, + { "key": "max-realms", "type": "number", "required": false, "default": 65536, "enum": null, "note": "总共最多允许注册多少个房间，0 表示不限" }, + { "key": "max-realms-per-ip", "type": "number", "required": false, "default": 4, "enum": null, "note": "同一个客户端 IP 最多注册几个房间，0 表示不限" }, + { "key": "trusted-proxy-header", "type": "string", "required": false, "default": "", "enum": null, "note": "从哪个 HTTP 头里读真实客户端 IP，放在 nginx 后面时填 X-Forwarded-For" }, + { "key": "realm-name-pattern", "type": "string", "required": false, "default": "^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$", "enum": null, "note": "房间名必须匹配的正则表达式" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书。填了就提供 HTTPS，不填就是明文 HTTP" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "alpn", "type": "string[]", "required": false, "default": ["h2", "http/1.1"], "enum": null, "note": "TLS 协商的应用层协议列表" } + ] + }, + + "tuic": { + "note": "TUIC 服务端入站，基于 QUIC/UDP", + "file": "listener/inbound/tuic.go", + "fields": [ + { "key": "certificate", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径），必填" }, + { "key": "private-key", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径），必填" }, + { "key": "token", "type": "string[]", "required": false, "default": null, "enum": null, "note": "TUIC v4 用的令牌列表。可以和 users 同时填，同时支持新旧客户端" }, + { "key": "users", "type": "object", "required": false, "default": null, "enum": null, "note": "TUIC v5 用的用户表，键是 UUID，值是密码" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "congestion-controller", "type": "string", "required": false, "default": "bbr", "enum": ["cubic", "new_reno", "bbr", "bbr_meta_v1", "bbr_meta_v2"], "note": "拥塞控制算法，决定网络拥堵时怎么调速。bbr 一般最快。填列表外的值等于不设置任何算法" }, + { "key": "max-idle-time", "type": "number", "required": false, "default": 15000, "enum": null, "note": "连接空闲多久就关掉（毫秒）" }, + { "key": "authentication-timeout", "type": "number", "required": false, "default": 1000, "enum": null, "note": "客户端连上来后多久内必须完成认证（毫秒）" }, + { "key": "alpn", "type": "string[]", "required": false, "default": ["h3"], "enum": null, "note": "TLS 协商的应用层协议列表" }, + { "key": "max-udp-relay-packet-size", "type": "number", "required": false, "default": 1500, "enum": null, "note": "转发 UDP 时单个包最大字节数" }, + { "key": "cwnd", "type": "number", "required": false, "default": 32, "enum": null, "note": "拥塞窗口初始大小（包数）" }, + { "key": "bbr-profile", "type": "string", "required": false, "default": "standard", "enum": ["", "standard", "conservative", "aggressive"], "note": "BBR 的激进程度，只在拥塞控制选 bbr 系列时有效" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" } + ] + }, + + "shadowquic": { + "note": "ShadowQuic 服务端入站。用 JLS 把 QUIC 伪装成访问真实网站，认证失败的连接会被转发到伪装上游", + "file": "listener/inbound/shadowquic.go", + "fields": [ + { "key": "jls-upstream", "type": "object", "required": true, "default": null, "enum": null, "note": "JLS 伪装上游配置，必填" }, + { "key": "jls-upstream.addr", "type": "string", "required": true, "default": null, "enum": null, "note": "伪装成的真实网站地址。没通过认证的连接会被转发到这里" }, + { "key": "jls-upstream.sni", "type": "string", "required": false, "default": null, "enum": null, "note": "伪装用的域名，留空会自动从 addr 里取" }, + { "key": "jls-upstream.proxy", "type": "string", "required": false, "default": null, "enum": null, "note": "连伪装上游时走哪个出站" }, + { "key": "jls-upstream.rate-limit", "type": "number", "required": false, "default": 0, "enum": null, "note": "转发到伪装上游的限速，单位 bit/s，0 表示不限速" }, + { "key": "jls-upstream.quic-version-probe", "type": "boolean", "required": false, "default": false, "enum": null, "note": "首次连接时主动探测伪装上游支持哪些 QUIC 版本，让伪装更像" }, + { "key": "users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "用户列表" }, + { "key": "users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "alpn", "type": "string[]", "required": false, "default": ["h3"], "enum": null, "note": "TLS 协商的应用层协议列表" }, + { "key": "quic-versions", "type": "string[]", "required": false, "default": ["v1"], "enum": ["v1", "1", "rfc9000", "rfc-9000", "v2", "2", "rfc9369", "rfc-9369"], "note": "手动指定支持的 QUIC 版本。大小写不敏感，下划线会当成中划线" }, + { "key": "zero-rtt", "type": "boolean", "required": false, "default": true, "enum": null, "note": "允许 0-RTT 快速握手，第一个包就能带数据，代价是有重放风险" }, + { "key": "congestion-controller", "type": "string", "required": false, "default": "bbr", "enum": ["cubic", "new_reno", "bbr", "bbr_meta_v1", "bbr_meta_v2"], "note": "拥塞控制算法。内核文档注释写默认 cubic，但源码实际给的是 bbr" }, + { "key": "up", "type": "string", "required": false, "default": null, "enum": null, "note": "上行带宽上限，填了会尝试协商 Brutal 拥塞控制；对端不支持就退回上面那个算法" }, + { "key": "down", "type": "string", "required": false, "default": null, "enum": null, "note": "下行带宽上限，同上" }, + { "key": "ignore-client-bandwidth", "type": "boolean", "required": false, "default": false, "enum": null, "note": "忽略客户端声明的带宽" }, + { "key": "max-idle-time", "type": "number", "required": false, "default": 30000, "enum": null, "note": "连接空闲多久就关掉（毫秒）" }, + { "key": "max-datagram-frame-size", "type": "number", "required": false, "default": 1400, "enum": null, "note": "QUIC 数据报帧的最大字节数，影响 UDP 转发的单包上限" }, + { "key": "recv-window-conn", "type": "number", "required": false, "default": 0, "enum": null, "note": "单条流的接收窗口字节数，0 表示用默认值" }, + { "key": "recv-window", "type": "number", "required": false, "default": 0, "enum": null, "note": "整条连接的接收窗口字节数，0 表示用默认值" }, + { "key": "disable-mtu-discovery", "type": "boolean", "required": false, "default": false, "enum": null, "note": "关闭路径 MTU 探测。某些网络上探测会导致丢包，可以关掉" }, + { "key": "cwnd", "type": "number", "required": false, "default": 32, "enum": null, "note": "拥塞窗口初始大小（包数）" }, + { "key": "bbr-profile", "type": "string", "required": false, "default": "standard", "enum": ["", "standard", "conservative", "aggressive"], "note": "BBR 的激进程度" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充，子字段同 shadowsocks 的 mux-option.*" } + ] + }, + + "anytls": { + "note": "AnyTLS 服务端入站。allow-insecure 不为 true 时，certificate+private-key / shadow-tls / res-tls / jls-config 至少要有一项", + "file": "listener/inbound/anytls.go", + "fields": [ + { "key": "users", "type": "object", "required": false, "default": null, "enum": null, "note": "用户表，键是用户名，值是密码" }, + { "key": "certificate", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径）" }, + { "key": "private-key", "type": "string", "required": false, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径）" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "shadow-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 ShadowTLS 伪装。子字段同 shadowsocks 的 shadow-tls.*" }, + { "key": "res-tls.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 Restls 伪装。子字段同 shadowsocks 的 res-tls.*" }, + { "key": "jls-config.enable", "type": "boolean", "required": true, "default": null, "enum": null, "note": "是否启用 JLS 伪装。子字段同 shadowsocks 的 jls-config.*" }, + { "key": "allow-insecure", "type": "boolean", "required": false, "default": false, "enum": null, "note": "允许不开 TLS 明文跑，只在有 nginx/caddy 前置时使用" }, + { "key": "padding-scheme", "type": "string", "required": false, "default": null, "enum": null, "note": "填充方案字符串，控制包长伪装规则" } + ] + }, + + "mieru": { + "note": "Mieru 服务端入站", + "file": "listener/inbound/mieru.go", + "fields": [ + { "key": "transport", "type": "string", "required": true, "default": null, "enum": ["TCP", "UDP"], "note": "底层用 TCP 还是 UDP 传输。必填，且区分大小写，必须全大写" }, + { "key": "users", "type": "object", "required": true, "default": null, "enum": null, "note": "用户表，键是用户名值是密码。必填且不能为空，用户名密码都不能是空字符串" }, + { "key": "traffic-pattern", "type": "string", "required": false, "default": null, "enum": null, "note": "一个 base64 字符串，用来微调发包节奏和大小分布，让流量更像正常网页浏览。填错格式会直接启动失败" }, + { "key": "user-hint-is-mandatory", "type": "boolean", "required": false, "default": false, "enum": null, "note": "开启后，客户端不发用户提示就直接拒绝连接" } + ] + }, + + "sudoku": { + "note": "Sudoku 服务端入站。只支持单个端口", + "file": "listener/inbound/sudoku.go", + "fields": [ + { "key": "key", "type": "string", "required": true, "default": null, "enum": null, "note": "服务端密钥。可以用 sudoku 生成的 ED25519 公钥，也可以随便用一个 UUID。必填且不能为空" }, + { "key": "aead-method", "type": "string", "required": false, "default": "chacha20-poly1305", "enum": ["chacha20-poly1305", "aes-128-gcm", "none"], "note": "数据加密方式。none 不做加密保护，不推荐" }, + { "key": "padding-min", "type": "number", "required": false, "default": 10, "enum": null, "note": "最小填充率（0~100），往数据包里塞多少无用字节来打乱长度特征" }, + { "key": "padding-max", "type": "number", "required": false, "default": 30, "enum": null, "note": "最大填充率（0~100），必须大于等于 padding-min" }, + { "key": "table-type", "type": "string", "required": false, "default": null, "enum": ["prefer_ascii", "prefer_entropy", "up_ascii_down_entropy", "up_entropy_down_ascii"], "note": "字节编码表倾向：prefer_ascii 让流量看起来像文本，prefer_entropy 看起来像随机加密数据，带 up/down 的可以上下行分别设" }, + { "key": "handshake-timeout", "type": "number", "required": false, "default": 5, "enum": null, "note": "握手超时秒数，必须大于等于 0" }, + { "key": "enable-pure-downlink", "type": "boolean", "required": false, "default": true, "enum": null, "note": "true=下行也走完整编码（伪装更好但更慢），false=下行走带宽优化路径" }, + { "key": "custom-table", "type": "string", "required": false, "default": null, "enum": null, "note": "自定义字节布局，如 xpxvvpvv，必须正好 2 个 x、2 个 p、4 个 v，顺序随意" }, + { "key": "custom-tables", "type": "string[]", "required": false, "default": null, "enum": null, "note": "自定义字节布局列表，用于多表轮换。非空时会覆盖 custom-table" }, + { "key": "disable-http-mask", "type": "boolean", "required": false, "default": false, "enum": null, "note": "关闭所有 HTTP 伪装和隧道。旧写法，推荐改用 httpmask.disable" }, + { "key": "http-mask-mode", "type": "string", "required": false, "default": "legacy", "enum": ["", "legacy", "stream", "poll", "auto", "ws"], "note": "HTTP 伪装方式。旧写法，推荐改用 httpmask.mode" }, + { "key": "path-root", "type": "string", "required": false, "default": "", "enum": null, "note": "HTTP 隧道端点的一级路径前缀。旧写法，推荐改用 httpmask.path-root" }, + { "key": "httpmask", "type": "object", "required": false, "default": null, "enum": null, "note": "推荐用这个对象统一管理 HTTP 伪装设置。填了它就会覆盖上面三个旧字段" }, + { "key": "httpmask.disable", "type": "boolean", "required": false, "default": false, "enum": null, "note": "true 就完全关掉 HTTP 伪装和隧道" }, + { "key": "httpmask.mode", "type": "string", "required": false, "default": "legacy", "enum": ["", "legacy", "stream", "poll", "auto", "ws"], "note": "HTTP 伪装方式：legacy 默认，stream 分离上下行流，poll 轮询，auto 先试 stream 再退回 poll，ws 用 WebSocket 隧道" }, + { "key": "httpmask.path-root", "type": "string", "required": false, "default": "", "enum": null, "note": "HTTP 隧道端点的一级路径前缀，客户端和服务端要一致。只能是单段路径，且只能用字母数字下划线和中划线" }, + { "key": "fallback", "type": "string", "required": false, "default": "", "enum": null, "note": "回落地址，如 127.0.0.1:80。认不出来的请求会转发过去，可以和别的服务共用同一个端口" }, + { "key": "mux-option.padding", "type": "boolean", "required": false, "default": false, "enum": null, "note": "多路复用时加随机填充。这是 mihomo 的私有扩展，不是 Sudoku 标准协议的一部分" } + ] + }, + + "trusttunnel": { + "note": "TrustTunnel 服务端入站，走 HTTP/2（TCP）和 HTTP/3（UDP）", + "file": "listener/inbound/trusttunnel.go", + "fields": [ + { "key": "certificate", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 证书（PEM 内容或路径），必填" }, + { "key": "private-key", "type": "string", "required": true, "default": null, "enum": null, "note": "TLS 私钥（PEM 内容或路径），必填" }, + { "key": "users", "type": "object[]", "required": false, "default": null, "enum": null, "note": "用户列表" }, + { "key": "users[].username", "type": "string", "required": true, "default": null, "enum": null, "note": "用户名" }, + { "key": "users[].password", "type": "string", "required": true, "default": null, "enum": null, "note": "密码" }, + { "key": "client-auth-type", "type": "string", "required": false, "default": "", "enum": ["", "request", "require-any", "verify-if-given", "require-and-verify"], "note": "双向 TLS：要不要验证客户端证书" }, + { "key": "client-auth-cert", "type": "string", "required": false, "default": null, "enum": null, "note": "校验客户端证书用的 CA 证书" }, + { "key": "ech-key", "type": "string", "required": false, "default": null, "enum": null, "note": "ECH 私钥" }, + { "key": "network", "type": "string[]", "required": false, "default": ["tcp"], "enum": ["tcp", "udp"], "note": "监听哪些协议：tcp 对应 HTTP/2，udp 对应 HTTP/3。用前缀匹配，所以 tcp4/udp6 这类写法也认" }, + { "key": "congestion-controller", "type": "string", "required": false, "default": null, "enum": ["cubic", "new_reno", "bbr", "bbr_meta_v1", "bbr_meta_v2"], "note": "QUIC 的拥塞控制算法，只对 udp 那条路有意义" }, + { "key": "cwnd", "type": "number", "required": false, "default": 32, "enum": null, "note": "拥塞窗口初始大小（包数）" }, + { "key": "bbr-profile", "type": "string", "required": false, "default": "standard", "enum": ["", "standard", "conservative", "aggressive"], "note": "BBR 的激进程度" } + ] + } + }, + + "notListenerTypes": [ + { "file": "base.go", "reason": "定义公共字段和基类，被每个入站类型内嵌。ParseListener 里没有对应的 case" }, + { "file": "auth.go", "reason": "只定义用户名密码结构，被 socks / http / mixed / trusttunnel 的 users 字段引用" }, + { "file": "mux.go", "reason": "只定义多路复用选项组，被多个类型的 mux-option 字段内嵌" }, + { "file": "reality.go", "reason": "只定义 REALITY 选项组，被 socks / http / mixed / vmess / vless / trojan 的 reality-config 内嵌" }, + { "file": "restls.go", "reason": "只定义 Restls 选项组，被多个类型的 res-tls 字段内嵌" }, + { "file": "shadowtls.go", "reason": "只定义 ShadowTLS 选项组，被多个类型的 shadow-tls 字段内嵌" }, + { "file": "jls.go", "reason": "只定义 JLS 选项组，被多个类型的 jls-config 字段内嵌" }, + { "file": "tlsmirror.go", "reason": "只定义 TLSMirror 选项组，目前只被 vmess 的 tlsmirror-config 内嵌" }, + { "file": "mekya.go", "reason": "只定义 Mekya 选项组，被 vmess 的 mekya-config 内嵌" }, + { "file": "mkcp.go", "reason": "只定义 mKCP 选项组，被 vmess 的 mkcp-config 和 mekya-config.kcp 内嵌" }, + { "file": "kcptun.go", "reason": "只定义 KCPTun 选项组，目前只被 shadowsocks 的 kcp-tun 内嵌" } + ], + + "judgementCriteria": "判定为真正的入站类型需要三条同时成立：(1) listener/parse.go 的 ParseListener switch 里有对应的 case 字符串；(2) 文件里有构造函数并返回实现了 C.InboundListener 的类型，文件末尾通常有 var _ C.InboundListener = (*Xxx)(nil) 断言；(3) 该 Option 结构体内嵌了 BaseOption。notListenerTypes 里的文件三条都不满足，只有 Build() 之类的转换方法。" +}