From 2ca9504654e0bfc2fd6270d386a919e8f14800ab Mon Sep 17 00:00:00 2001 From: fscarmen <62703343+fscarmen@users.noreply.github.com> Date: Fri, 5 Jun 2026 15:02:14 +0000 Subject: [PATCH] feat: security upgrade for subscriptions, client output improvements MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - replace Nekobox with Throne for client output; generate independent Throne config - security upgrade: remove `insecure=true`, use TLS certificate fingerprint verification feat: 订阅链接安全升级，客户端输出优化 - 使用 Throne 替代 Nekobox 输出客户端配置，独立生成 Throne 配置 - 安全升级：移除 `insecure=true`，启用 TLS 证书指纹校验 --- README.md | 20 +++++++-------- docker_init.sh | 68 ++++++++++++++++++++++++++------------------------ sing-box.sh | 34 +++++++++++++++---------- 3 files changed, 66 insertions(+), 56 deletions(-) diff --git a/README.md b/README.md index d5bb661..e70a67f 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ - [7.使用 Cloudflare API 自动创建 Argo](README.md#7使用-cloudflare-api-自动创建-argo) - [8.Vmess / Vless 方案设置任意端口回源以使用 CDN](README.md#8vmess--vless-方案设置任意端口回源以使用-cdn) - [9.Docker 和 Docker compose 安装](README.md#9docker-和-docker-compose-安装) -- [10.Nekobox 设置 shadowTLS 方法](README.md#10nekobox-设置-shadowtls-方法) +- [10.Throne 设置 shadowTLS 方法](README.md#10throne-设置-shadowtls-方法) - [11.主体目录文件及说明](README.md#11主体目录文件及说明) - [12.自签证书在不同客户端中的处理方式对比](README.md#12自签证书在不同客户端中的处理方式对比) - [13.鸣谢下列作者的文章和项目](README.md#13鸣谢下列作者的文章和项目) @@ -150,7 +150,7 @@ * 一键部署多协议，可以单选、多选或全选 ShadowTLS v3 / XTLS Reality / Hysteria2 / Tuic V5 / ShadowSocks / Trojan / Vmess + ws / Vless + ws + tls / H2 Reality / gRPC Reality / AnyTLS / NaiveProxy, 总有一款适合你 * 所有协议均不需要域名，可选 Cloudflare Argo Tunnel 内网穿透以支持传统方式为 websocket 的协议 * Hysteria2 支持 Realm 模式，适用于回国、没有公网入口、住宅 NAT、CGNAT 等无法开放入站端口的机器；有公网入口时不建议使用，并可选 WARP 辅助打洞提高严格 NAT 环境下的成功率 -* 节点信息输出到 V2rayN / Clash Verge / 小火箭 / Nekobox / Sing-box (SFI, SFA, SFM)，订阅自动适配客户端，一个订阅 url 走天下 +* 节点信息输出到 V2rayN / Clash Verge / 小火箭 / Throne / Sing-box (SFI, SFA, SFM)，订阅自动适配客户端，一个订阅 url 走天下 * 自定义端口，适合有限开放端口的 nat 小鸡 * 内置 warp 链式代理解锁 chatGPT * 智能判断操作系统: Ubuntu 、Debian 、CentOS 、Alpine 、Armbian 和 Arch Linux,请务必选择 LTS 系统 @@ -573,8 +573,8 @@ services: | -e ARGO_AUTH | 否 | Argo 认证信息，可以是 Json， Token 或者 Cloudflare API，与 ARGO_DOMAIN 一并使用才能生效，不指定的话将使用临时隧道 | -## 10.Nekobox 设置 shadowTLS 方法 -1. 复制脚本输出的两个 Neko links 进去 +## 10.Throne 设置 shadowTLS 方法 +1. 复制脚本输出的两个 Throne links 进去 image 2. 设置链式代理，并启用 @@ -618,7 +618,7 @@ services: |-- logs | `-- box.log # sing-box 运行日志文件 |-- subscribe # sing-box server 配置文件目录 -| |-- qr # Nekoray / V2rayN / Shadowrock 订阅二维码 +| |-- qr # Throne / V2rayN / Shadowrock 订阅二维码 | |-- shadowrocket # Shadowrock 订阅文件 | |-- proxies # Clash proxy provider 订阅文件 | |-- clash # Clash 订阅文件1 @@ -627,7 +627,7 @@ services: | |-- sing-box-phone # SFI / SFA 订阅文件1 | |-- sing-box2 # SFI / SFA / SFM 订阅文件2 | |-- v2rayn # V2rayN 订阅文件 -| `-- neko # Nekoray 订阅文件 +| `-- throne # Throne 订阅文件 |-- cache.db # sing-box 缓存文件 |-- nginx.conf # 用于订阅服务的 nginx 配置文件 |-- language # 存放脚本语言文件，E 为英文，C 为中文 @@ -647,14 +647,14 @@ services: | 客户端 / 工具 | 使用的证书验证方式 | SNI 是否必须匹配 SAN | 是否依赖完整证书链 | 使用的 Hash / 指纹类型 | SNI 用途说明 | |---------------|---------------------|------------------------|------------------------|--------------------------|----------------------| | **V2RayN** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） | -| **NekoBox** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） | +| **Throne** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） | | **ShadowRocket** | 对证书 **DER 全内容** 做 SHA-256 | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(DER)** | 仅用于伪装，可为空或任意域名 | | **Clash Verge / Meta** | 对证书 **DER 全内容** 做 SHA-256 | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(DER)** | 仅用于伪装，可为空或任意域名 | | **Sing-box** | 仅验证 SPKI 公钥（SPKI pin） | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(SPKI Base64)** | 仅用于伪装，可为空或任意域名 | ### 结论： - - **V2RayN、NekoBox 必须要 SAN = SNI**，否则“x509: cannot validate certificate because it doesn't contain IP SAN”。 + - **V2RayN、Throne 必须要 SAN = SNI**，否则“x509: cannot validate certificate because it doesn't contain IP SAN”。 - **ShadowRocket、Clash、Sing-box、HY2、TUIC 完全不需要 SAN**，因为用的是指纹机制。 --- @@ -675,7 +675,7 @@ services: | EC 曲线参数 | ✔ | ✔ | ✔ | | Signature Algorithm | ✔ | ✔ | ✖ | | Signature Value | ✔ | ✔ | ✖ | -| 用途场景 | V2RayN / NekoBox | ShadowRocket / Clash | Sing-box / Hysteria2 / TUIC | +| 用途场景 | V2RayN / Throne | ShadowRocket / Clash | Sing-box / Hysteria2 / TUIC | --- @@ -685,7 +685,7 @@ services: - 完整验证 CA → Leaf 证书 - **必须要求：SNI = SAN 中的一个 DNS 名称** - 不允许 SAN 不匹配或缺失 -- 用于：**V2RayN / NekoBox** +- 用于：**V2RayN / Throne** #### **2. SHA-256(DER) 指纹** - 对证书 **整体 DER（二进制）内容** 计算 SHA-256 diff --git a/docker_init.sh b/docker_init.sh index af0a445..ea172c0 100644 --- a/docker_init.sh +++ b/docker_init.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# 脚本更新日期 2026.04.23 +# 脚本更新日期 2026.06.05 set -e WORK_DIR=/sing-box @@ -893,7 +893,8 @@ EOF # 获取自签证书指纹。argo 回源的是由 Google Trust Services（谷歌信任服务）作为中间 CA（CN=WE1）签发，受信任的证书（非自签名） local SELF_SIGNED_FINGERPRINT_SHA256=$(openssl x509 -fingerprint -noout -sha256 -in ${WORK_DIR}/cert/cert.pem | awk -F '=' '{print $NF}') local SELF_SIGNED_FINGERPRINT_BASE64=$(openssl x509 -in ${WORK_DIR}/cert/cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) - local CERT_URL=$(awk '{printf "%s\\r\\n", $0}' ${WORK_DIR}/cert/cert.pem) + local CERT_URL_1=$(awk '{printf "%s,", $0}' ${WORK_DIR}/cert/cert.pem | sed 's/ /%20/g; s/,$//') + local CERT_URL_2=$(awk '{printf "%s\\r\\n", $0}' ${WORK_DIR}/cert/cert.pem) # 生成 nginx 配置文件 local NGINX_CONF="user root; @@ -910,8 +911,9 @@ EOF http { map \$http_user_agent \$path { default /; # 默认路径 - ~*v2rayN|Neko|Throne /base64; # 匹配 V2rayN / NekoBox / Throne 客户端 + ~*v2rayN /v2rayn; # 匹配 V2rayN 客户端 ~*clash /clash; # 匹配 Clash 客户端 + ~*Throne|Neko /throne; # 匹配 Neko / Throne 客户端 ~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端 ~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端 # ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则 @@ -1102,11 +1104,11 @@ vless://${UUID}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?encryption=none&flow=xtls-rp [ "${HYSTERIA2}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -v2rayn://hysteria2/$(echo -n "{\"ConfigType\":7,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} hysteria2\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_HYSTERIA2},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL}\",\"ProtoExtraObj\":{\"UpMbps\":200,\"DownMbps\":1000}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" +v2rayn://hysteria2/$(echo -n "{\"ConfigType\":7,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} hysteria2\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_HYSTERIA2},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL_2}\",\"ProtoExtraObj\":{\"UpMbps\":200,\"DownMbps\":1000}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" [ "${TUIC}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -v2rayn://tuic/$(echo -n "{\"ConfigType\":8,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} tuic\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TUIC},\"Password\":\"${UUID}\",\"Username\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Alpn\":\"h3\",\"Cert\":\"${CERT_URL}\",\"ProtoExtraObj\":{\"CongestionControl\":\"bbr\"}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" +v2rayn://tuic/$(echo -n "{\"ConfigType\":8,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} tuic\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TUIC},\"Password\":\"${UUID}\",\"Username\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Alpn\":\"h3\",\"Cert\":\"${CERT_URL_2}\",\"ProtoExtraObj\":{\"CongestionControl\":\"bbr\"}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" [ "${SHADOWTLS}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- @@ -1165,7 +1167,7 @@ ss://$(echo -n "${SIP022_METHOD}:${SIP022_PASSWORD}@${SERVER_IP_1}:$PORT_SHADOWS [ "${TROJAN}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -trojan://${UUID}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&insecure=1&allowInsecure=1&pcs=${SELF_SIGNED_FINGERPRINT_SHA256//:/}&type=tcp&headerType=none#${NODE_NAME// /%20}%20trojan" +v2rayn://trojan/$(echo -n "{\"ConfigType\":6,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} trojan\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TROJAN},\"Password\":\"${UUID}\",\"Network\":\"raw\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" [ "${VMESS_WS}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- @@ -1177,7 +1179,7 @@ vless://${UUID}@${CDN}:443?encryption=none&security=tls&sni=${ARGO_DOMAIN}&type= [ "${H2_REALITY}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -vless://${UUID}@${SERVER_IP_1}:${PORT_H2_REALITY}?encryption=none&security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=http#${NODE_NAME// /%20}%20h2-reality" +v2rayn://vless/$(echo -n "{\"ConfigType\":5,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} h2-reality\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_H2_REALITY},\"Password\":\"${UUID}\",\"Network\":\"raw\",\"StreamSecurity\":\"reality\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"PublicKey\":\"${REALITY_PUBLIC}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" [ "${GRPC_REALITY}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- @@ -1185,60 +1187,60 @@ vless://${UUID}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?encryption=none&security=rea [ "${ANYTLS}" = 'true' ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -v2rayn://anytls/$(echo -n "{\"ConfigType\":11,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} anytls\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_ANYTLS},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"Cert\":\"${CERT_URL}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" +v2rayn://anytls/$(echo -n "{\"ConfigType\":11,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} anytls\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_ANYTLS},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" echo -n "$V2RAYN_SUBSCRIBE" | sed -E '/^[ ]*#|^[ ]+|^--|^\{|^\}/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/v2rayn - # 生成 NekoBox 订阅文件 - [ "${XTLS_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + # 生成 Throne 订阅文件 + [ "${XTLS_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- vless://${UUID}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=tcp&flow=xtls-rprx-vision&encryption=none#${NODE_NAME// /%20}%20xtls-reality" - [ "${HYSTERIA2}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${HYSTERIA2}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- -hy2://${UUID}@${SERVER_IP_1}:${PORT_HYSTERIA2}?insecure=1&sni=addons.mozilla.org#${NODE_NAME// /%20}%20hysteria2" +hysteria2://${UUID}@${SERVER_IP_1}:${PORT_HYSTERIA2}?allowInsecure=false&alpn&security=tls&sni=addons.mozilla.org&upmbps=200&downmbps=1000&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME// /%20}%20hysteria2" - [ "${TUIC}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${TUIC}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- -tuic://${UUID}:${UUID}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=bbr&alpn=h3&sni=addons.mozilla.org&udp_relay_mode=native&allow_insecure=1#${NODE_NAME// /%20}%20tuic" +tuic://${UUID}:${UUID}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=bbr&alpn=h3&sni=addons.mozilla.org&udp_relay_mode=native&allow_insecure=0&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME// /%20}%20tuic" - [ "${SHADOWTLS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${SHADOWTLS}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- -nekoray://custom#$(echo -n "{\"_v\":0,\"addr\":\"127.0.0.1\",\"cmd\":[\"\"],\"core\":\"internal\",\"cs\":\"{\n \\\"password\\\": \\\"${UUID}\\\",\n \\\"server\\\": \\\"${SERVER_IP_1}\\\",\n \\\"server_port\\\": ${PORT_SHADOWTLS},\n \\\"tag\\\": \\\"shadowtls-out\\\",\n \\\"tls\\\": {\n \\\"enabled\\\": true,\n \\\"server_name\\\": \\\"addons.mozilla.org\\\"\n },\n \\\"type\\\": \\\"shadowtls\\\",\n \\\"version\\\": 3\n}\n\",\"mapping_port\":0,\"name\":\"1-tls-not-use\",\"port\":1080,\"socks_port\":0}" | base64 -w0) +shadowtls://:${UUID}@${SERVER_IP_1}:${PORT_SHADOWTLS}?version=3&security=tls&sni=addons.mozilla.org&fp=chrome#1-tls-not-use -nekoray://shadowsocks#$(echo -n "{\"_v\":0,\"method\":\"${SIP022_METHOD}\",\"name\":\"2-ss-not-use\",\"pass\":\"${SIP022_PASSWORD}\",\"port\":0,\"stream\":{\"ed_len\":0,\"insecure\":false,\"mux_s\":0,\"net\":\"tcp\"},\"uot\":0}" | base64 -w0)" +ss://${SIP022_METHOD}:${SIP022_PASSWORD}@127.0.0.1:0#2-ss-not-use" - [ "${SHADOWSOCKS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${SHADOWSOCKS}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- ss://$(echo -n "${SIP022_METHOD}:${SIP022_PASSWORD}" | base64 -w0)@${SERVER_IP_1}:$PORT_SHADOWSOCKS#${NODE_NAME// /%20}%20shadowsocks" - [ "${TROJAN}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${TROJAN}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- -trojan://${UUID}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=addons.mozilla.org&allowInsecure=1&fp=firefox&type=tcp#${NODE_NAME// /%20}%20trojan" +trojan://${UUID}@${SERVER_IP_1}:${PORT_TROJAN}?security=tls&sni=addons.mozilla.org&allowInsecure=0&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME// /%20}%20trojan" - [ "${VMESS_WS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${VMESS_WS}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- vmess://$(echo -n "{\"add\":\"${CDN}\",\"aid\":\"0\",\"host\":\"${ARGO_DOMAIN}\",\"id\":\"${UUID}\",\"net\":\"ws\",\"path\":\"/${UUID}-vmess\",\"port\":\"80\",\"ps\":\"${NODE_NAME} vmess-ws\",\"scy\":\"auto\",\"sni\":\"\",\"tls\":\"\",\"type\":\"\",\"v\":\"2\"}" | base64 -w0) " - [ "${VLESS_WS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${VLESS_WS}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- vless://${UUID}@${CDN}:443?security=tls&sni=${ARGO_DOMAIN}&type=ws&path=/${UUID}-vless?ed%3D2560&host=${ARGO_DOMAIN}&encryption=none#${NODE_NAME// /%20}%20vless-ws-tls " - [ "${H2_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${H2_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- vless://${UUID}@${SERVER_IP_1}:${PORT_H2_REALITY}?security=reality&sni=addons.mozilla.org&alpn=h2&fp=firefox&pbk=${REALITY_PUBLIC}&type=http&encryption=none#${NODE_NAME// /%20}%20h2-reality" - [ "${GRPC_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${GRPC_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- vless://${UUID}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=grpc&serviceName=grpc&encryption=none#${NODE_NAME// /%20}%20grpc-reality" - [ "${ANYTLS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+=" + [ "${ANYTLS}" = 'true' ] && local THRONE_SUBSCRIBE+=" ---------------------------- -anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?security=tls&sni=addons.mozilla.org&insecure=1&fp=firefox#${NODE_NAME// /%20}%20anytls" +anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=0&security=tls&sni=addons.mozilla.org&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME// /%20}%20anytls" - echo -n "$NEKOBOX_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/neko + echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/throne # 生成 Sing-box 订阅文件 [ "${XTLS_REALITY}" = 'true' ] && @@ -1294,7 +1296,7 @@ anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?security=tls&sni=addons.mozilla.o # 生成二维码 url 文件 cat > ${WORK_DIR}/subscribe/qr << EOF -自适应 Clash / V2rayN / NekoBox / ShadowRocket / SFI / SFA / SFM 客户端: +自适应 Clash / V2rayN / Throne / ShadowRocket / SFI / SFA / SFM 客户端: 模版: https://${ARGO_DOMAIN}/${UUID}/auto @@ -1337,10 +1339,10 @@ $(info "$(sed '1d' <<< "${CLASH_SUBSCRIBE}")") ******************************************* ┌────────────────┐ │ │ -│ $(warning "NekoBox") │ +│ $(warning "Throne") │ │ │ └────────────────┘ -$(hint "${NEKOBOX_SUBSCRIBE}") +$(hint "${THRONE_SUBSCRIBE}") ******************************************* ┌────────────────┐ @@ -1368,8 +1370,8 @@ https://${ARGO_DOMAIN}/${UUID}/qr V2rayN 订阅: https://${ARGO_DOMAIN}/${UUID}/v2rayn") -$(hint "NekoBox 订阅: -https://${ARGO_DOMAIN}/${UUID}/neko") +$(hint "Throne 订阅: +https://${ARGO_DOMAIN}/${UUID}/throne") $(hint "Clash 订阅: https://${ARGO_DOMAIN}/${UUID}/clash @@ -1382,7 +1384,7 @@ https://${ARGO_DOMAIN}/${UUID}/shadowrocket") ******************************************* -$(info " 自适应 Clash / V2rayN / NekoBox / ShadowRocket / SFI / SFA / SFM 客户端: +$(info " 自适应 Clash / V2rayN / Throne / ShadowRocket / SFI / SFA / SFM 客户端: 模版: https://${ARGO_DOMAIN}/${UUID}/auto diff --git a/sing-box.sh b/sing-box.sh index 8120f20..3653590 100644 --- a/sing-box.sh +++ b/sing-box.sh @@ -3221,7 +3221,7 @@ http { default /; # 默认路径 ~*v2rayN /v2rayn; # 匹配 V2rayN 客户端 ~*clash /clash; # 匹配 Clash 客户端 - ~*Neko|Throne /neko; # 匹配 Neko / Throne 客户端 + ~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端 ~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端 ~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端 # ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则 @@ -3230,7 +3230,7 @@ http { default /; # 默认路径 ~*v2rayN /v2rayn; # 匹配 V2rayN 客户端 ~*clash /clash2; # 匹配 Clash 客户端 - ~*Neko|Throne /neko; # 匹配 Neko 客户端 + ~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端 ~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端 ~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端 # ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则 @@ -4730,9 +4730,9 @@ ss://$(echo -n "${SHADOWSOCKS_METHOD}:${SHADOWSOCKS_PASSWORD}@${SERVER_IP_1}:$PO [ -n "$PORT_TROJAN" ] && local V2RAYN_SUBSCRIBE+=" ---------------------------- -trojan://$TROJAN_PASSWORD@${SERVER_IP_1}:$PORT_TROJAN?security=tls&insecure=1&allowInsecure=1&pcs=${SELF_SIGNED_FINGERPRINT_SHA256//:/}&type=tcp&headerType=none#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}" +v2rayn://trojan/$(echo -n "{\"ConfigType\":6,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME[16]} ${NODE_TAG[5]}\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TROJAN},\"Password\":\"${TROJAN_PASSWORD}\",\"Network\":\"raw\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"${TLS_SERVER}\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')" - if [ -n "$PORT_VMESS_WS" ]; then + if [ -n "$PORT_VMESS_WS" ]; then local VMESS_CDN_PORT=${CDN_PORT[17]:-80} local VMESS_CDN_HOST=$(format_uri_host "${CDN[17]}") if [[ "${STATUS[1]}" =~ $(text 27)|$(text 28) ]] || [[ "$IS_ARGO" = 'is_argo' && "$NONINTERACTIVE_INSTALL" = 'noninteractive_install' ]]; then @@ -4798,7 +4798,7 @@ v2rayn://naive/$(echo -n "{\"ConfigType\":12,\"CoreType\":24,\"ConfigVersion\":4 vless://${UUID[11]}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?security=reality&sni=${TLS_SERVER}&fp=firefox&pbk=${REALITY_PUBLIC[11]}&type=tcp${VISION_FLOW}&encryption=none#${NODE_NAME[11]// /%20}%20${NODE_TAG[0]}" if [ -n "$PORT_HYSTERIA2" ]; then - local THRONE_PARAMS="allowInsecure=true&alpn&security=tls&sni=${TLS_SERVER}&upmbps=${HY2_UP}&downmbps=${HY2_DOWN}&security=tls&tls_certificate=${CERT_URL_1}" + local THRONE_PARAMS="allowInsecure=false&alpn&security=tls&sni=${TLS_SERVER}&upmbps=${HY2_UP}&downmbps=${HY2_DOWN}&security=tls&tls_certificate=${CERT_URL_1}" if [[ -n "$PORT_HOPPING_START" && -n "$PORT_HOPPING_END" ]]; then THRONE_PARAMS+="&mport=${PORT_HOPPING_START}-${PORT_HOPPING_END}&hop_interval=30s" fi @@ -4809,12 +4809,12 @@ hysteria2://${UUID[12]}@${SERVER_IP_1}:${PORT_HYSTERIA2}?${THRONE_PARAMS}#${NODE [ -n "$PORT_TUIC" ] && local THRONE_SUBSCRIBE+=" ---------------------------- -tuic://${TUIC_PASSWORD}:${UUID[13]}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=$TUIC_CONGESTION_CONTROL&alpn=h3&sni=${TLS_SERVER}&udp_relay_mode=native&allow_insecure=1&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME[13]// /%20}%20${NODE_TAG[2]}" +tuic://${TUIC_PASSWORD}:${UUID[13]}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=$TUIC_CONGESTION_CONTROL&alpn=h3&sni=${TLS_SERVER}&udp_relay_mode=native&allow_insecure=0&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME[13]// /%20}%20${NODE_TAG[2]}" [ -n "$PORT_SHADOWTLS" ] && local THRONE_SUBSCRIBE+=" ---------------------------- -nekoray://custom#$(echo -n "{\"_v\":0,\"addr\":\"127.0.0.1\",\"cmd\":[\"\"],\"core\":\"internal\",\"cs\":\"{\n \\\"password\\\": \\\"${UUID[14]}\\\",\n \\\"server\\\": \\\"${SERVER_IP_1}\\\",\n \\\"server_port\\\": ${PORT_SHADOWTLS},\n \\\"tag\\\": \\\"shadowtls-out\\\",\n \\\"tls\\\": {\n \\\"enabled\\\": true,\n \\\"server_name\\\": \\\"${TLS_SERVER}\\\"\n },\n \\\"type\\\": \\\"shadowtls\\\",\n \\\"version\\\": 3\n}\n\",\"mapping_port\":0,\"name\":\"1-tls-not-use\",\"port\":1080,\"socks_port\":0}" | base64 -w0) +shadowtls://:${UUID[14]}@${SERVER_IP_1}:${PORT_SHADOWTLS}?version=3&security=tls&sni=${TLS_SERVER}&fp=chrome#1-tls-not-use -nekoray://shadowsocks#$(echo -n "{\"_v\":0,\"method\":\"$SHADOWTLS_METHOD\",\"name\":\"2-ss-not-use\",\"pass\":\"$SHADOWTLS_PASSWORD\",\"port\":0,\"stream\":{\"ed_len\":0,\"insecure\":false,\"mux_s\":0,\"net\":\"tcp\"},\"uot\":0}" | base64 -w0)" +ss://${SHADOWTLS_METHOD}:${SHADOWTLS_PASSWORD}@127.0.0.1:0#2-ss-not-use" [ -n "$PORT_SHADOWSOCKS" ] && local THRONE_SUBSCRIBE+=" ---------------------------- @@ -4822,7 +4822,7 @@ ss://$(echo -n "${SHADOWSOCKS_METHOD}:${SHADOWSOCKS_PASSWORD}" | base64 -w0)@${S [ -n "$PORT_TROJAN" ] && local THRONE_SUBSCRIBE+=" ---------------------------- -trojan://${TROJAN_PASSWORD}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=${TLS_SERVER}&allowInsecure=1&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}" +trojan://${TROJAN_PASSWORD}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=${TLS_SERVER}&allowInsecure=0&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}" if [ -n "$PORT_VMESS_WS" ]; then if [[ "${STATUS[1]}" =~ $(text 27)|$(text 28) ]] || [[ "$IS_ARGO" = 'is_argo' && "$NONINTERACTIVE_INSTALL" = 'noninteractive_install' ]]; then @@ -4872,7 +4872,7 @@ vless://${UUID[20]}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?security=reality&sni=${T [ -n "$PORT_ANYTLS" ] && local THRONE_SUBSCRIBE+=" ---------------------------- -anytls://${UUID[21]}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=1&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME[21]// /%20}%20${NODE_TAG[10]}" +anytls://${UUID[21]}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=0&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME[21]// /%20}%20${NODE_TAG[10]}" [ -n "$PORT_NAIVE" ] && { local THRONE_SUBSCRIBE+=" @@ -4882,7 +4882,7 @@ naive+https://${UUID[22]}:${UUID[22]}@${SERVER_IP_1}:${PORT_NAIVE}?uot=1&securit naive+quic://${UUID[22]}:${UUID[22]}@${SERVER_IP_1}:${PORT_NAIVE}?congestion_control=bbr&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_200_URL_1}#${NODE_NAME[22]// /%20}%20${NODE_TAG[11]}%20quic" } - echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/neko + echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/throne # 生成 Sing-box 订阅文件 [ -n "$PORT_XTLS_REALITY" ] && @@ -5070,7 +5070,7 @@ V2rayN $(text 80): $SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/v2rayn") $(hint "Throne $(text 80): -$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/neko") +$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/throne") $(hint "Clash $(text 80): $SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/clash @@ -5223,7 +5223,7 @@ change_protocols() { fetch_nodes_value # 用于新节点的配置信息 - if [ "${#UUID[@]}" -gt 0 ]; then + if [ "${#UUID[@]}" -gt 0 ]; then UUID_CONFIRM="${UUID[0]}" elif grep -q '.' <<< "${TROJAN_PASSWORD}"; then UUID_CONFIRM="${TROJAN_PASSWORD}" @@ -5712,6 +5712,14 @@ menu() { check_cdn statistics_of_run_times update sing-box.sh 2>/dev/null +###### 为了把原来的 nekobox 换成 Throne 做的处理，将于 2026年9月30日移除 +if [ -s $WORK_DIR/nginx.conf ] && grep -q 'Neko|Throne' $WORK_DIR/nginx.conf; then + sed -i 's@~\*Neko|Throne.*@~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端@g' "$WORK_DIR/nginx.conf" + [ -s $WORK_DIR/subscribe/neko ] && rm -f $WORK_DIR/subscribe/neko + cmd_systemctl restart sing-box + export_list >/dev/null 2>&1 +fi + # 传参 [[ "${*^^}" =~ '-E'|'-K' ]] && L=E [[ "${*^^}" =~ '-C'|'-B'|'-L' ]] && L=C