mirror of
https://github.com/fscarmen/sing-box.git
synced 2026-08-10 17:55:16 +08:00
feat: security upgrade for subscriptions, client output improvements
- replace Nekobox with Throne for client output; generate independent Throne config - security upgrade: remove `insecure=true`, use TLS certificate fingerprint verification feat: 订阅链接安全升级，客户端输出优化 - 使用 Throne 替代 Nekobox 输出客户端配置，独立生成 Throne 配置 - 安全升级：移除 `insecure=true`，启用 TLS 证书指纹校验
This commit is contained in:
fscarmen
@@ -13,7 +13,7 @@
|
||||
- [7.使用 Cloudflare API 自动创建 Argo](README.md#7使用-cloudflare-api-自动创建-argo)
|
||||
- [8.Vmess / Vless 方案设置任意端口回源以使用 CDN](README.md#8vmess--vless-方案设置任意端口回源以使用-cdn)
|
||||
- [9.Docker 和 Docker compose 安装](README.md#9docker-和-docker-compose-安装)
|
||||
- [10.Nekobox 设置 shadowTLS 方法](README.md#10nekobox-设置-shadowtls-方法)
|
||||
- [10.Throne 设置 shadowTLS 方法](README.md#10throne-设置-shadowtls-方法)
|
||||
- [11.主体目录文件及说明](README.md#11主体目录文件及说明)
|
||||
- [12.自签证书在不同客户端中的处理方式对比](README.md#12自签证书在不同客户端中的处理方式对比)
|
||||
- [13.鸣谢下列作者的文章和项目](README.md#13鸣谢下列作者的文章和项目)
|
||||
@@ -150,7 +150,7 @@
|
||||
* 一键部署多协议，可以单选、多选或全选 ShadowTLS v3 / XTLS Reality / Hysteria2 / Tuic V5 / ShadowSocks / Trojan / Vmess + ws / Vless + ws + tls / H2 Reality / gRPC Reality / AnyTLS / NaiveProxy, 总有一款适合你
|
||||
* 所有协议均不需要域名，可选 Cloudflare Argo Tunnel 内网穿透以支持传统方式为 websocket 的协议
|
||||
* Hysteria2 支持 Realm 模式，适用于回国、没有公网入口、住宅 NAT、CGNAT 等无法开放入站端口的机器；有公网入口时不建议使用，并可选 WARP 辅助打洞提高严格 NAT 环境下的成功率
|
||||
* 节点信息输出到 V2rayN / Clash Verge / 小火箭 / Nekobox / Sing-box (SFI, SFA, SFM)，订阅自动适配客户端，一个订阅 url 走天下
|
||||
* 节点信息输出到 V2rayN / Clash Verge / 小火箭 / Throne / Sing-box (SFI, SFA, SFM)，订阅自动适配客户端，一个订阅 url 走天下
|
||||
* 自定义端口，适合有限开放端口的 nat 小鸡
|
||||
* 内置 warp 链式代理解锁 chatGPT
|
||||
* 智能判断操作系统: Ubuntu 、Debian 、CentOS 、Alpine 、Armbian 和 Arch Linux,请务必选择 LTS 系统
|
||||
@@ -573,8 +573,8 @@ services:
|
||||
| -e ARGO_AUTH | 否 | Argo 认证信息，可以是 Json， Token 或者 Cloudflare API，与 ARGO_DOMAIN 一并使用才能生效，不指定的话将使用临时隧道 |
|
||||
|
||||
|
||||
## 10.Nekobox 设置 shadowTLS 方法
|
||||
1. 复制脚本输出的两个 Neko links 进去
|
||||
## 10.Throne 设置 shadowTLS 方法
|
||||
1. 复制脚本输出的两个 Throne links 进去
|
||||
<img width="630" alt="image" src="https://github.com/fscarmen/sing-box/assets/62703343/db5960f3-63b1-4145-90a5-b01066dd39be">
|
||||
|
||||
2. 设置链式代理，并启用
|
||||
@@ -618,7 +618,7 @@ services:
|
||||
|-- logs
|
||||
| `-- box.log # sing-box 运行日志文件
|
||||
|-- subscribe # sing-box server 配置文件目录
|
||||
| |-- qr # Nekoray / V2rayN / Shadowrock 订阅二维码
|
||||
| |-- qr # Throne / V2rayN / Shadowrock 订阅二维码
|
||||
| |-- shadowrocket # Shadowrock 订阅文件
|
||||
| |-- proxies # Clash proxy provider 订阅文件
|
||||
| |-- clash # Clash 订阅文件1
|
||||
@@ -627,7 +627,7 @@ services:
|
||||
| |-- sing-box-phone # SFI / SFA 订阅文件1
|
||||
| |-- sing-box2 # SFI / SFA / SFM 订阅文件2
|
||||
| |-- v2rayn # V2rayN 订阅文件
|
||||
| `-- neko # Nekoray 订阅文件
|
||||
| `-- throne # Throne 订阅文件
|
||||
|-- cache.db # sing-box 缓存文件
|
||||
|-- nginx.conf # 用于订阅服务的 nginx 配置文件
|
||||
|-- language # 存放脚本语言文件，E 为英文，C 为中文
|
||||
@@ -647,14 +647,14 @@ services:
|
||||
| 客户端 / 工具 | 使用的证书验证方式 | SNI 是否必须匹配 SAN | 是否依赖完整证书链 | 使用的 Hash / 指纹类型 | SNI 用途说明 |
|
||||
|---------------|---------------------|------------------------|------------------------|--------------------------|----------------------|
|
||||
| **V2RayN** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） |
|
||||
| **NekoBox** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） |
|
||||
| **Throne** | 标准 X.509 证书链验证 | **是**（必须匹配） | ✔ 是 | 不使用指纹 | 用于 TLS Hostname 验证（必须与 SAN 一致） |
|
||||
| **ShadowRocket** | 对证书 **DER 全内容** 做 SHA-256 | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(DER)** | 仅用于伪装，可为空或任意域名 |
|
||||
| **Clash Verge / Meta** | 对证书 **DER 全内容** 做 SHA-256 | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(DER)** | 仅用于伪装，可为空或任意域名 |
|
||||
| **Sing-box** | 仅验证 SPKI 公钥（SPKI pin） | ✖ 不需要匹配 | ✖ 不依赖证书链 | **SHA-256(SPKI Base64)** | 仅用于伪装，可为空或任意域名 |
|
||||
|
||||
|
||||
### 结论：
|
||||
- **V2RayN、NekoBox 必须要 SAN = SNI**，否则“x509: cannot validate certificate because it doesn't contain IP SAN”。
|
||||
- **V2RayN、Throne 必须要 SAN = SNI**，否则“x509: cannot validate certificate because it doesn't contain IP SAN”。
|
||||
- **ShadowRocket、Clash、Sing-box、HY2、TUIC 完全不需要 SAN**，因为用的是指纹机制。
|
||||
|
||||
---
|
||||
@@ -675,7 +675,7 @@ services:
|
||||
| EC 曲线参数 | ✔ | ✔ | ✔ |
|
||||
| Signature Algorithm | ✔ | ✔ | ✖ |
|
||||
| Signature Value | ✔ | ✔ | ✖ |
|
||||
| 用途场景 | V2RayN / NekoBox | ShadowRocket / Clash | Sing-box / Hysteria2 / TUIC |
|
||||
| 用途场景 | V2RayN / Throne | ShadowRocket / Clash | Sing-box / Hysteria2 / TUIC |
|
||||
|
||||
---
|
||||
|
||||
@@ -685,7 +685,7 @@ services:
|
||||
- 完整验证 CA → Leaf 证书
|
||||
- **必须要求：SNI = SAN 中的一个 DNS 名称**
|
||||
- 不允许 SAN 不匹配或缺失
|
||||
- 用于：**V2RayN / NekoBox**
|
||||
- 用于：**V2RayN / Throne**
|
||||
|
||||
#### **2. SHA-256(DER) 指纹**
|
||||
- 对证书 **整体 DER（二进制）内容** 计算 SHA-256
|
||||
|
||||
+35
-33
@@ -1,5 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
# 脚本更新日期 2026.04.23
|
||||
# 脚本更新日期 2026.06.05
|
||||
set -e
|
||||
|
||||
WORK_DIR=/sing-box
|
||||
@@ -893,7 +893,8 @@ EOF
|
||||
# 获取自签证书指纹。argo 回源的是由 Google Trust Services（谷歌信任服务）作为中间 CA（CN=WE1）签发，受信任的证书（非自签名）
|
||||
local SELF_SIGNED_FINGERPRINT_SHA256=$(openssl x509 -fingerprint -noout -sha256 -in ${WORK_DIR}/cert/cert.pem | awk -F '=' '{print $NF}')
|
||||
local SELF_SIGNED_FINGERPRINT_BASE64=$(openssl x509 -in ${WORK_DIR}/cert/cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64)
|
||||
local CERT_URL=$(awk '{printf "%s\\r\\n", $0}' ${WORK_DIR}/cert/cert.pem)
|
||||
local CERT_URL_1=$(awk '{printf "%s,", $0}' ${WORK_DIR}/cert/cert.pem | sed 's/ /%20/g; s/,$//')
|
||||
local CERT_URL_2=$(awk '{printf "%s\\r\\n", $0}' ${WORK_DIR}/cert/cert.pem)
|
||||
|
||||
# 生成 nginx 配置文件
|
||||
local NGINX_CONF="user root;
|
||||
@@ -910,8 +911,9 @@ EOF
|
||||
http {
|
||||
map \$http_user_agent \$path {
|
||||
default /; # 默认路径
|
||||
~*v2rayN|Neko|Throne /base64; # 匹配 V2rayN / NekoBox / Throne 客户端
|
||||
~*v2rayN /v2rayn; # 匹配 V2rayN 客户端
|
||||
~*clash /clash; # 匹配 Clash 客户端
|
||||
~*Throne|Neko /throne; # 匹配 Neko / Throne 客户端
|
||||
~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端
|
||||
~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端
|
||||
# ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则
|
||||
@@ -1102,11 +1104,11 @@ vless://${UUID}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?encryption=none&flow=xtls-rp
|
||||
|
||||
[ "${HYSTERIA2}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
v2rayn://hysteria2/$(echo -n "{\"ConfigType\":7,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} hysteria2\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_HYSTERIA2},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL}\",\"ProtoExtraObj\":{\"UpMbps\":200,\"DownMbps\":1000}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
v2rayn://hysteria2/$(echo -n "{\"ConfigType\":7,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} hysteria2\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_HYSTERIA2},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL_2}\",\"ProtoExtraObj\":{\"UpMbps\":200,\"DownMbps\":1000}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
[ "${TUIC}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
v2rayn://tuic/$(echo -n "{\"ConfigType\":8,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} tuic\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TUIC},\"Password\":\"${UUID}\",\"Username\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Alpn\":\"h3\",\"Cert\":\"${CERT_URL}\",\"ProtoExtraObj\":{\"CongestionControl\":\"bbr\"}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
v2rayn://tuic/$(echo -n "{\"ConfigType\":8,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} tuic\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TUIC},\"Password\":\"${UUID}\",\"Username\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Alpn\":\"h3\",\"Cert\":\"${CERT_URL_2}\",\"ProtoExtraObj\":{\"CongestionControl\":\"bbr\"}}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
[ "${SHADOWTLS}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
@@ -1165,7 +1167,7 @@ ss://$(echo -n "${SIP022_METHOD}:${SIP022_PASSWORD}@${SERVER_IP_1}:$PORT_SHADOWS
|
||||
|
||||
[ "${TROJAN}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
trojan://${UUID}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&insecure=1&allowInsecure=1&pcs=${SELF_SIGNED_FINGERPRINT_SHA256//:/}&type=tcp&headerType=none#${NODE_NAME// /%20}%20trojan"
|
||||
v2rayn://trojan/$(echo -n "{\"ConfigType\":6,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} trojan\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TROJAN},\"Password\":\"${UUID}\",\"Network\":\"raw\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
[ "${VMESS_WS}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
@@ -1177,7 +1179,7 @@ vless://${UUID}@${CDN}:443?encryption=none&security=tls&sni=${ARGO_DOMAIN}&type=
|
||||
|
||||
[ "${H2_REALITY}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vless://${UUID}@${SERVER_IP_1}:${PORT_H2_REALITY}?encryption=none&security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=http#${NODE_NAME// /%20}%20h2-reality"
|
||||
v2rayn://vless/$(echo -n "{\"ConfigType\":5,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} h2-reality\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_H2_REALITY},\"Password\":\"${UUID}\",\"Network\":\"raw\",\"StreamSecurity\":\"reality\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"PublicKey\":\"${REALITY_PUBLIC}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
[ "${GRPC_REALITY}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
@@ -1185,60 +1187,60 @@ vless://${UUID}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?encryption=none&security=rea
|
||||
|
||||
[ "${ANYTLS}" = 'true' ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
v2rayn://anytls/$(echo -n "{\"ConfigType\":11,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} anytls\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_ANYTLS},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"Cert\":\"${CERT_URL}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
v2rayn://anytls/$(echo -n "{\"ConfigType\":11,\"CoreType\":24,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME} anytls\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_ANYTLS},\"Password\":\"${UUID}\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"addons.mozilla.org\",\"Fingerprint\":\"firefox\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
echo -n "$V2RAYN_SUBSCRIBE" | sed -E '/^[ ]*#|^[ ]+|^--|^\{|^\}/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/v2rayn
|
||||
|
||||
# 生成 NekoBox 订阅文件
|
||||
[ "${XTLS_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
# 生成 Throne 订阅文件
|
||||
[ "${XTLS_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vless://${UUID}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=tcp&flow=xtls-rprx-vision&encryption=none#${NODE_NAME// /%20}%20xtls-reality"
|
||||
|
||||
[ "${HYSTERIA2}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${HYSTERIA2}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
hy2://${UUID}@${SERVER_IP_1}:${PORT_HYSTERIA2}?insecure=1&sni=addons.mozilla.org#${NODE_NAME// /%20}%20hysteria2"
|
||||
hysteria2://${UUID}@${SERVER_IP_1}:${PORT_HYSTERIA2}?allowInsecure=false&alpn&security=tls&sni=addons.mozilla.org&upmbps=200&downmbps=1000&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME// /%20}%20hysteria2"
|
||||
|
||||
[ "${TUIC}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${TUIC}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
tuic://${UUID}:${UUID}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=bbr&alpn=h3&sni=addons.mozilla.org&udp_relay_mode=native&allow_insecure=1#${NODE_NAME// /%20}%20tuic"
|
||||
tuic://${UUID}:${UUID}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=bbr&alpn=h3&sni=addons.mozilla.org&udp_relay_mode=native&allow_insecure=0&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME// /%20}%20tuic"
|
||||
|
||||
[ "${SHADOWTLS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${SHADOWTLS}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
nekoray://custom#$(echo -n "{\"_v\":0,\"addr\":\"127.0.0.1\",\"cmd\":[\"\"],\"core\":\"internal\",\"cs\":\"{\n \\\"password\\\": \\\"${UUID}\\\",\n \\\"server\\\": \\\"${SERVER_IP_1}\\\",\n \\\"server_port\\\": ${PORT_SHADOWTLS},\n \\\"tag\\\": \\\"shadowtls-out\\\",\n \\\"tls\\\": {\n \\\"enabled\\\": true,\n \\\"server_name\\\": \\\"addons.mozilla.org\\\"\n },\n \\\"type\\\": \\\"shadowtls\\\",\n \\\"version\\\": 3\n}\n\",\"mapping_port\":0,\"name\":\"1-tls-not-use\",\"port\":1080,\"socks_port\":0}" | base64 -w0)
|
||||
shadowtls://:${UUID}@${SERVER_IP_1}:${PORT_SHADOWTLS}?version=3&security=tls&sni=addons.mozilla.org&fp=chrome#1-tls-not-use
|
||||
|
||||
nekoray://shadowsocks#$(echo -n "{\"_v\":0,\"method\":\"${SIP022_METHOD}\",\"name\":\"2-ss-not-use\",\"pass\":\"${SIP022_PASSWORD}\",\"port\":0,\"stream\":{\"ed_len\":0,\"insecure\":false,\"mux_s\":0,\"net\":\"tcp\"},\"uot\":0}" | base64 -w0)"
|
||||
ss://${SIP022_METHOD}:${SIP022_PASSWORD}@127.0.0.1:0#2-ss-not-use"
|
||||
|
||||
[ "${SHADOWSOCKS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${SHADOWSOCKS}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
ss://$(echo -n "${SIP022_METHOD}:${SIP022_PASSWORD}" | base64 -w0)@${SERVER_IP_1}:$PORT_SHADOWSOCKS#${NODE_NAME// /%20}%20shadowsocks"
|
||||
|
||||
[ "${TROJAN}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${TROJAN}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
trojan://${UUID}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=addons.mozilla.org&allowInsecure=1&fp=firefox&type=tcp#${NODE_NAME// /%20}%20trojan"
|
||||
trojan://${UUID}@${SERVER_IP_1}:${PORT_TROJAN}?security=tls&sni=addons.mozilla.org&allowInsecure=0&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME// /%20}%20trojan"
|
||||
|
||||
[ "${VMESS_WS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${VMESS_WS}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vmess://$(echo -n "{\"add\":\"${CDN}\",\"aid\":\"0\",\"host\":\"${ARGO_DOMAIN}\",\"id\":\"${UUID}\",\"net\":\"ws\",\"path\":\"/${UUID}-vmess\",\"port\":\"80\",\"ps\":\"${NODE_NAME} vmess-ws\",\"scy\":\"auto\",\"sni\":\"\",\"tls\":\"\",\"type\":\"\",\"v\":\"2\"}" | base64 -w0)
|
||||
"
|
||||
|
||||
[ "${VLESS_WS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${VLESS_WS}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vless://${UUID}@${CDN}:443?security=tls&sni=${ARGO_DOMAIN}&type=ws&path=/${UUID}-vless?ed%3D2560&host=${ARGO_DOMAIN}&encryption=none#${NODE_NAME// /%20}%20vless-ws-tls
|
||||
"
|
||||
|
||||
[ "${H2_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${H2_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vless://${UUID}@${SERVER_IP_1}:${PORT_H2_REALITY}?security=reality&sni=addons.mozilla.org&alpn=h2&fp=firefox&pbk=${REALITY_PUBLIC}&type=http&encryption=none#${NODE_NAME// /%20}%20h2-reality"
|
||||
|
||||
[ "${GRPC_REALITY}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${GRPC_REALITY}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
vless://${UUID}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?security=reality&sni=addons.mozilla.org&fp=firefox&pbk=${REALITY_PUBLIC}&type=grpc&serviceName=grpc&encryption=none#${NODE_NAME// /%20}%20grpc-reality"
|
||||
|
||||
[ "${ANYTLS}" = 'true' ] && local NEKOBOX_SUBSCRIBE+="
|
||||
[ "${ANYTLS}" = 'true' ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?security=tls&sni=addons.mozilla.org&insecure=1&fp=firefox#${NODE_NAME// /%20}%20anytls"
|
||||
anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=0&security=tls&sni=addons.mozilla.org&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME// /%20}%20anytls"
|
||||
|
||||
echo -n "$NEKOBOX_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/neko
|
||||
echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/throne
|
||||
|
||||
# 生成 Sing-box 订阅文件
|
||||
[ "${XTLS_REALITY}" = 'true' ] &&
|
||||
@@ -1294,7 +1296,7 @@ anytls://${UUID}@${SERVER_IP_1}:${PORT_ANYTLS}?security=tls&sni=addons.mozilla.o
|
||||
|
||||
# 生成二维码 url 文件
|
||||
cat > ${WORK_DIR}/subscribe/qr << EOF
|
||||
自适应 Clash / V2rayN / NekoBox / ShadowRocket / SFI / SFA / SFM 客户端:
|
||||
自适应 Clash / V2rayN / Throne / ShadowRocket / SFI / SFA / SFM 客户端:
|
||||
模版:
|
||||
https://${ARGO_DOMAIN}/${UUID}/auto
|
||||
|
||||
@@ -1337,10 +1339,10 @@ $(info "$(sed '1d' <<< "${CLASH_SUBSCRIBE}")")
|
||||
*******************************************
|
||||
┌────────────────┐
|
||||
│ │
|
||||
│ $(warning "NekoBox") │
|
||||
│ $(warning "Throne") │
|
||||
│ │
|
||||
└────────────────┘
|
||||
$(hint "${NEKOBOX_SUBSCRIBE}")
|
||||
$(hint "${THRONE_SUBSCRIBE}")
|
||||
|
||||
*******************************************
|
||||
┌────────────────┐
|
||||
@@ -1368,8 +1370,8 @@ https://${ARGO_DOMAIN}/${UUID}/qr
|
||||
V2rayN 订阅:
|
||||
https://${ARGO_DOMAIN}/${UUID}/v2rayn")
|
||||
|
||||
$(hint "NekoBox 订阅:
|
||||
https://${ARGO_DOMAIN}/${UUID}/neko")
|
||||
$(hint "Throne 订阅:
|
||||
https://${ARGO_DOMAIN}/${UUID}/throne")
|
||||
|
||||
$(hint "Clash 订阅:
|
||||
https://${ARGO_DOMAIN}/${UUID}/clash
|
||||
@@ -1382,7 +1384,7 @@ https://${ARGO_DOMAIN}/${UUID}/shadowrocket")
|
||||
|
||||
*******************************************
|
||||
|
||||
$(info " 自适应 Clash / V2rayN / NekoBox / ShadowRocket / SFI / SFA / SFM 客户端:
|
||||
$(info " 自适应 Clash / V2rayN / Throne / ShadowRocket / SFI / SFA / SFM 客户端:
|
||||
模版:
|
||||
https://${ARGO_DOMAIN}/${UUID}/auto
|
||||
|
||||
|
||||
+19
-11
@@ -3221,7 +3221,7 @@ http {
|
||||
default /; # 默认路径
|
||||
~*v2rayN /v2rayn; # 匹配 V2rayN 客户端
|
||||
~*clash /clash; # 匹配 Clash 客户端
|
||||
~*Neko|Throne /neko; # 匹配 Neko / Throne 客户端
|
||||
~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端
|
||||
~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端
|
||||
~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端
|
||||
# ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则
|
||||
@@ -3230,7 +3230,7 @@ http {
|
||||
default /; # 默认路径
|
||||
~*v2rayN /v2rayn; # 匹配 V2rayN 客户端
|
||||
~*clash /clash2; # 匹配 Clash 客户端
|
||||
~*Neko|Throne /neko; # 匹配 Neko 客户端
|
||||
~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端
|
||||
~*ShadowRocket /shadowrocket; # 匹配 ShadowRocket 客户端
|
||||
~*SFM|SFI|SFA /sing-box; # 匹配 Sing-box 官方客户端
|
||||
# ~*Chrome|Firefox|Mozilla /; # 添加更多的分流规则
|
||||
@@ -4730,7 +4730,7 @@ ss://$(echo -n "${SHADOWSOCKS_METHOD}:${SHADOWSOCKS_PASSWORD}@${SERVER_IP_1}:$PO
|
||||
|
||||
[ -n "$PORT_TROJAN" ] && local V2RAYN_SUBSCRIBE+="
|
||||
----------------------------
|
||||
trojan://$TROJAN_PASSWORD@${SERVER_IP_1}:$PORT_TROJAN?security=tls&insecure=1&allowInsecure=1&pcs=${SELF_SIGNED_FINGERPRINT_SHA256//:/}&type=tcp&headerType=none#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}"
|
||||
v2rayn://trojan/$(echo -n "{\"ConfigType\":6,\"ConfigVersion\":4,\"Remarks\":\"${NODE_NAME[16]} ${NODE_TAG[5]}\",\"Address\":\"${SERVER_IP}\",\"Port\":${PORT_TROJAN},\"Password\":\"${TROJAN_PASSWORD}\",\"Network\":\"raw\",\"StreamSecurity\":\"tls\",\"AllowInsecure\":\"false\",\"Sni\":\"${TLS_SERVER}\",\"Cert\":\"${CERT_URL_2}\"}" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
|
||||
|
||||
if [ -n "$PORT_VMESS_WS" ]; then
|
||||
local VMESS_CDN_PORT=${CDN_PORT[17]:-80}
|
||||
@@ -4798,7 +4798,7 @@ v2rayn://naive/$(echo -n "{\"ConfigType\":12,\"CoreType\":24,\"ConfigVersion\":4
|
||||
vless://${UUID[11]}@${SERVER_IP_1}:${PORT_XTLS_REALITY}?security=reality&sni=${TLS_SERVER}&fp=firefox&pbk=${REALITY_PUBLIC[11]}&type=tcp${VISION_FLOW}&encryption=none#${NODE_NAME[11]// /%20}%20${NODE_TAG[0]}"
|
||||
|
||||
if [ -n "$PORT_HYSTERIA2" ]; then
|
||||
local THRONE_PARAMS="allowInsecure=true&alpn&security=tls&sni=${TLS_SERVER}&upmbps=${HY2_UP}&downmbps=${HY2_DOWN}&security=tls&tls_certificate=${CERT_URL_1}"
|
||||
local THRONE_PARAMS="allowInsecure=false&alpn&security=tls&sni=${TLS_SERVER}&upmbps=${HY2_UP}&downmbps=${HY2_DOWN}&security=tls&tls_certificate=${CERT_URL_1}"
|
||||
if [[ -n "$PORT_HOPPING_START" && -n "$PORT_HOPPING_END" ]]; then
|
||||
THRONE_PARAMS+="&mport=${PORT_HOPPING_START}-${PORT_HOPPING_END}&hop_interval=30s"
|
||||
fi
|
||||
@@ -4809,12 +4809,12 @@ hysteria2://${UUID[12]}@${SERVER_IP_1}:${PORT_HYSTERIA2}?${THRONE_PARAMS}#${NODE
|
||||
|
||||
[ -n "$PORT_TUIC" ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
tuic://${TUIC_PASSWORD}:${UUID[13]}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=$TUIC_CONGESTION_CONTROL&alpn=h3&sni=${TLS_SERVER}&udp_relay_mode=native&allow_insecure=1&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME[13]// /%20}%20${NODE_TAG[2]}"
|
||||
tuic://${TUIC_PASSWORD}:${UUID[13]}@${SERVER_IP_1}:${PORT_TUIC}?congestion_control=$TUIC_CONGESTION_CONTROL&alpn=h3&sni=${TLS_SERVER}&udp_relay_mode=native&allow_insecure=0&security=tls&tls_certificate=${CERT_URL_1}#${NODE_NAME[13]// /%20}%20${NODE_TAG[2]}"
|
||||
[ -n "$PORT_SHADOWTLS" ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
nekoray://custom#$(echo -n "{\"_v\":0,\"addr\":\"127.0.0.1\",\"cmd\":[\"\"],\"core\":\"internal\",\"cs\":\"{\n \\\"password\\\": \\\"${UUID[14]}\\\",\n \\\"server\\\": \\\"${SERVER_IP_1}\\\",\n \\\"server_port\\\": ${PORT_SHADOWTLS},\n \\\"tag\\\": \\\"shadowtls-out\\\",\n \\\"tls\\\": {\n \\\"enabled\\\": true,\n \\\"server_name\\\": \\\"${TLS_SERVER}\\\"\n },\n \\\"type\\\": \\\"shadowtls\\\",\n \\\"version\\\": 3\n}\n\",\"mapping_port\":0,\"name\":\"1-tls-not-use\",\"port\":1080,\"socks_port\":0}" | base64 -w0)
|
||||
shadowtls://:${UUID[14]}@${SERVER_IP_1}:${PORT_SHADOWTLS}?version=3&security=tls&sni=${TLS_SERVER}&fp=chrome#1-tls-not-use
|
||||
|
||||
nekoray://shadowsocks#$(echo -n "{\"_v\":0,\"method\":\"$SHADOWTLS_METHOD\",\"name\":\"2-ss-not-use\",\"pass\":\"$SHADOWTLS_PASSWORD\",\"port\":0,\"stream\":{\"ed_len\":0,\"insecure\":false,\"mux_s\":0,\"net\":\"tcp\"},\"uot\":0}" | base64 -w0)"
|
||||
ss://${SHADOWTLS_METHOD}:${SHADOWTLS_PASSWORD}@127.0.0.1:0#2-ss-not-use"
|
||||
|
||||
[ -n "$PORT_SHADOWSOCKS" ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
@@ -4822,7 +4822,7 @@ ss://$(echo -n "${SHADOWSOCKS_METHOD}:${SHADOWSOCKS_PASSWORD}" | base64 -w0)@${S
|
||||
|
||||
[ -n "$PORT_TROJAN" ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
trojan://${TROJAN_PASSWORD}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=${TLS_SERVER}&allowInsecure=1&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}"
|
||||
trojan://${TROJAN_PASSWORD}@${SERVER_IP_1}:$PORT_TROJAN?security=tls&sni=${TLS_SERVER}&allowInsecure=0&tls_certificate=${CERT_URL_1}&fp=firefox&type=tcp#${NODE_NAME[16]// /%20}%20${NODE_TAG[5]}"
|
||||
|
||||
if [ -n "$PORT_VMESS_WS" ]; then
|
||||
if [[ "${STATUS[1]}" =~ $(text 27)|$(text 28) ]] || [[ "$IS_ARGO" = 'is_argo' && "$NONINTERACTIVE_INSTALL" = 'noninteractive_install' ]]; then
|
||||
@@ -4872,7 +4872,7 @@ vless://${UUID[20]}@${SERVER_IP_1}:${PORT_GRPC_REALITY}?security=reality&sni=${T
|
||||
|
||||
[ -n "$PORT_ANYTLS" ] && local THRONE_SUBSCRIBE+="
|
||||
----------------------------
|
||||
anytls://${UUID[21]}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=1&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME[21]// /%20}%20${NODE_TAG[10]}"
|
||||
anytls://${UUID[21]}@${SERVER_IP_1}:${PORT_ANYTLS}?idle_session_check_interval=30s&idle_session_timeout=30s&min_idle_session=5&insecure=0&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_URL_1}&fp=firefox#${NODE_NAME[21]// /%20}%20${NODE_TAG[10]}"
|
||||
|
||||
[ -n "$PORT_NAIVE" ] && {
|
||||
local THRONE_SUBSCRIBE+="
|
||||
@@ -4882,7 +4882,7 @@ naive+https://${UUID[22]}:${UUID[22]}@${SERVER_IP_1}:${PORT_NAIVE}?uot=1&securit
|
||||
naive+quic://${UUID[22]}:${UUID[22]}@${SERVER_IP_1}:${PORT_NAIVE}?congestion_control=bbr&security=tls&sni=${TLS_SERVER}&tls_certificate=${CERT_200_URL_1}#${NODE_NAME[22]// /%20}%20${NODE_TAG[11]}%20quic"
|
||||
}
|
||||
|
||||
echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/neko
|
||||
echo -n "$THRONE_SUBSCRIBE" | sed -E '/^[ ]*#|^--/d' | sed '/^$/d' | base64 -w0 > ${WORK_DIR}/subscribe/throne
|
||||
|
||||
# 生成 Sing-box 订阅文件
|
||||
[ -n "$PORT_XTLS_REALITY" ] &&
|
||||
@@ -5070,7 +5070,7 @@ V2rayN $(text 80):
|
||||
$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/v2rayn")
|
||||
|
||||
$(hint "Throne $(text 80):
|
||||
$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/neko")
|
||||
$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/throne")
|
||||
|
||||
$(hint "Clash $(text 80):
|
||||
$SUBSCRIBE_ADDRESS/${UUID_CONFIRM}/clash
|
||||
@@ -5712,6 +5712,14 @@ menu() {
|
||||
check_cdn
|
||||
statistics_of_run_times update sing-box.sh 2>/dev/null
|
||||
|
||||
###### 为了把原来的 nekobox 换成 Throne 做的处理，将于 2026年9月30日移除
|
||||
if [ -s $WORK_DIR/nginx.conf ] && grep -q 'Neko|Throne' $WORK_DIR/nginx.conf; then
|
||||
sed -i 's@~\*Neko|Throne.*@~*Throne|Neko /throne; # 匹配 Throne / Neko 客户端@g' "$WORK_DIR/nginx.conf"
|
||||
[ -s $WORK_DIR/subscribe/neko ] && rm -f $WORK_DIR/subscribe/neko
|
||||
cmd_systemctl restart sing-box
|
||||
export_list >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
# 传参
|
||||
[[ "${*^^}" =~ '-E'|'-K' ]] && L=E
|
||||
[[ "${*^^}" =~ '-C'|'-B'|'-L' ]] && L=C
|
||||
|
||||
Reference in New Issue
Block a user