$ show SagerNet/sing-box
sing-box is a universal proxy platform written in Go, serving as both a client and server for a wide range of proxy protocols including Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC, WireGuard, Tailscale, OpenVPN, OpenConnect, and many more. It features a modular architecture with pluggable inbounds, outbounds, services, and endpoints, all managed through a central routing engine with rule-based traffic steering, DNS resolution, and traffic sniffing. The system is designed for cross-platform deployment, with native support for Linux, macOS, Windows, Android, iOS, and tvOS, and includes a daemon mode with gRPC API for remote management, a Clash-compatible REST API, and mobile library bindings via gomobile. The architecture is built around adapter interfaces and generic registries, allowing easy extension with new protocols and services. The codebase demonstrates high craftsmanship in areas such as multi-engine TLS abstraction (supporting standard Go TLS, uTLS for fingerprinting, Apple's SecureTransport, Windows SChannel, and kernel TLS), parallel happy-eyeballs dialing, binary rule-set serialization, HTTP transport fallback with broken-authority tracking, and platform-specific packet manipulation (WinDivert on Windows, pf on macOS, netfilter on Linux). The project is actively maintained with frequent commits, extensive integration tests, and a comprehensive documentation site. While the codebase is large and contains experimental features, the core abstractions are clean and well-isolated, making many components genuinely reusable in other network-oriented Go projects.
The LLM identified 5 files worth highlighting for reuse:
Implements parallel address resolution and connection attempts (RFC 8305 Happy Eyeballs) with configurable strategies (default, hybrid, fallback). Reusable for any Go network dialer needing robust multi-address connection establishment.
Provides a unified TLS client interface that delegates to standard Go TLS, uTLS (for client hello fingerprinting), Apple SecureTransport, Windows SChannel, and custom Reality/ECH implementations. Demonstrates non-obvious skill in platform-specific TLS integration and fingerprint spoofing.
Implements a compact binary format for rule sets with versioning, efficient encoding/decoding, and support for IP CIDR, domain, and other rule types. Reusable for any system needing fast, memory-mappable rule storage.
Manages HTTP/1.1, HTTP/2, and HTTP/3 transports with automatic fallback, broken-authority tracking with backoff, and shared connection pools. Reusable for any Go HTTP client requiring robust multi-protocol transport.
Implements kernel TLS (kTLS) offload for Linux using the kTLS socket option, including cipher suite negotiation, key update, and read/write operations. Demonstrates deep kernel integration and is reusable for any Go application needing TLS acceleration on Linux.