Skip to content

Commit 7f1d024

Browse files
nekohasekainekohasekai
committed
Add cloudflared inbound
1 parent c40b2ba commit 7f1d024

18 files changed

Lines changed: 415 additions & 3 deletions

‎constant/proxy.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ const (
2525
TypeTUIC = "tuic"
2626
TypeHysteria2 = "hysteria2"
2727
TypeTailscale = "tailscale"
28+
TypeCloudflared = "cloudflared"
2829
TypeDERP = "derp"
2930
TypeResolved = "resolved"
3031
TypeSSMAPI = "ssm-api"
@@ -90,6 +91,8 @@ func ProxyDisplayName(proxyType string) string {
9091
return "AnyTLS"
9192
case TypeTailscale:
9293
return "Tailscale"
94+
case TypeCloudflared:
95+
return "Cloudflared"
9396
case TypeSelector:
9497
return "Selector"
9598
case TypeURLTest:

‎docs/configuration/inbound/cloudflared.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
icon: material/new-box
3+
---
4+
5+
!!! question "Since sing-box 1.14.0"
6+
7+
`cloudflared` inbound runs an embedded Cloudflare Tunnel client and routes all
8+
incoming tunnel traffic (TCP, UDP, ICMP) through sing-box's routing engine.
9+
10+
### Structure
11+
12+
```json
13+
{
14+
"type": "cloudflared",
15+
"tag": "",
16+
17+
"token": "",
18+
"ha_connections": 0,
19+
"protocol": "",
20+
"post_quantum": false,
21+
"edge_ip_version": 0,
22+
"datagram_version": "",
23+
"grace_period": "",
24+
"region": "",
25+
"control_dialer": {
26+
... // Dial Fields
27+
},
28+
"tunnel_dialer": {
29+
... // Dial Fields
30+
}
31+
}
32+
```
33+
34+
### Fields
35+
36+
#### token
37+
38+
==Required==
39+
40+
Base64-encoded tunnel token from the Cloudflare Zero Trust dashboard
41+
(`Networks → Tunnels → Install connector`).
42+
43+
#### ha_connections
44+
45+
Number of high-availability connections to the Cloudflare edge.
46+
47+
Capped by the number of discovered edge addresses.
48+
49+
#### protocol
50+
51+
Transport protocol for edge connections.
52+
53+
One of `quic` `http2`.
54+
55+
#### post_quantum
56+
57+
Enable post-quantum key exchange on the control connection.
58+
59+
#### edge_ip_version
60+
61+
IP version used when connecting to the Cloudflare edge.
62+
63+
One of `0` (automatic) `4` `6`.
64+
65+
#### datagram_version
66+
67+
Datagram protocol version used for UDP proxying over QUIC.
68+
69+
One of `v2` `v3`. Only meaningful when `protocol` is `quic`.
70+
71+
#### grace_period
72+
73+
Graceful shutdown window for in-flight edge connections.
74+
75+
#### region
76+
77+
Cloudflare edge region selector.
78+
79+
Conflict with endpoints embedded in `token`.
80+
81+
#### control_dialer
82+
83+
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
84+
Cloudflare control plane.
85+
86+
#### tunnel_dialer
87+
88+
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
89+
Cloudflare edge data plane.

‎docs/configuration/inbound/cloudflared.zh.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
icon: material/new-box
3+
---
4+
5+
!!! question "自 sing-box 1.14.0 起"
6+
7+
`cloudflared` 入站运行一个内嵌的 Cloudflare Tunnel 客户端，并将所有传入的隧道流量
8+
（TCP、UDP、ICMP）通过 sing-box 的路由引擎转发。
9+
10+
### 结构
11+
12+
```json
13+
{
14+
"type": "cloudflared",
15+
"tag": "",
16+
17+
"token": "",
18+
"ha_connections": 0,
19+
"protocol": "",
20+
"post_quantum": false,
21+
"edge_ip_version": 0,
22+
"datagram_version": "",
23+
"grace_period": "",
24+
"region": "",
25+
"control_dialer": {
26+
... // 拨号字段
27+
},
28+
"tunnel_dialer": {
29+
... // 拨号字段
30+
}
31+
}
32+
```
33+
34+
### 字段
35+
36+
#### token
37+
38+
==必填==
39+
40+
来自 Cloudflare Zero Trust 仪表板的 Base64 编码隧道令牌
41+
（`Networks → Tunnels → Install connector`）。
42+
43+
#### ha_connections
44+
45+
到 Cloudflare edge 的高可用连接数。
46+
47+
上限为已发现的 edge 地址数量。
48+
49+
#### protocol
50+
51+
edge 连接使用的传输协议。
52+
53+
`quic` `http2` 之一。
54+
55+
#### post_quantum
56+
57+
在控制连接上启用后量子密钥交换。
58+
59+
#### edge_ip_version
60+
61+
连接 Cloudflare edge 时使用的 IP 版本。
62+
63+
`0`（自动）`4` `6` 之一。
64+
65+
#### datagram_version
66+
67+
通过 QUIC 进行 UDP 代理时使用的数据报协议版本。
68+
69+
`v2` `v3` 之一。仅在 `protocol` 为 `quic` 时有效。
70+
71+
#### grace_period
72+
73+
正在处理的 edge 连接的优雅关闭窗口。
74+
75+
#### region
76+
77+
Cloudflare edge 区域选择器。
78+
79+
与 `token` 中嵌入的 endpoint 冲突。
80+
81+
#### control_dialer
82+
83+
隧道客户端拨向 Cloudflare 控制面时使用的
84+
[拨号字段](/zh/configuration/shared/dial/)。
85+
86+
#### tunnel_dialer
87+
88+
隧道客户端拨向 Cloudflare edge 数据面时使用的
89+
[拨号字段](/zh/configuration/shared/dial/)。

‎docs/configuration/inbound/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
| `tun` | [Tun](./tun/) | :material-close: |
3535
| `redirect` | [Redirect](./redirect/) | :material-close: |
3636
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
37+
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
3738

3839
#### tag
3940

‎docs/configuration/inbound/index.zh.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
| `tun` | [Tun](./tun/) | :material-close: |
3535
| `redirect` | [Redirect](./redirect/) | :material-close: |
3636
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
37+
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
3738

3839
#### tag
3940

‎docs/installation/build-from-source.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
6161
| `with_ccm` | :material-check: | Build with Claude Code Multiplexer service support. |
6262
| `with_ocm` | :material-check: | Build with OpenAI Codex Multiplexer service support. |
6363
| `with_naive_outbound` | :material-check: | Build with NaiveProxy outbound support, see [NaiveProxy outbound](/configuration/outbound/naive/). |
64+
| `with_cloudflared` | :material-check: | Build with Cloudflare Tunnel inbound support, see [Cloudflared inbound](/configuration/inbound/cloudflared/). |
6465
| `badlinkname` | :material-check: | Enable `go:linkname` access to internal standard library functions. Required because the Go standard library does not expose many low-level APIs needed by this project, and reimplementing them externally is impractical. Used for kTLS (kernel TLS offload) and raw TLS record manipulation. |
6566
| `tfogo_checklinkname0` | :material-check: | Companion to `badlinkname`. Go 1.23+ enforces `go:linkname` restrictions via the linker; this tag signals the build uses `-checklinkname=0` to bypass that enforcement. |
6667

‎docs/installation/build-from-source.zh.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
6565
| `with_ccm` | :material-check: | 构建 Claude Code Multiplexer 服务支持。 |
6666
| `with_ocm` | :material-check: | 构建 OpenAI Codex Multiplexer 服务支持。 |
6767
| `with_naive_outbound` | :material-check: | 构建 NaiveProxy 出站支持，参阅 [NaiveProxy 出站](/zh/configuration/outbound/naive/)。 |
68+
| `with_cloudflared` | :material-check: | 构建 Cloudflare Tunnel 入站支持，参阅 [Cloudflared 入站](/zh/configuration/inbound/cloudflared/)。 |
6869
| `badlinkname` | :material-check: | 启用 `go:linkname` 以访问标准库内部函数。Go 标准库未提供本项目需要的许多底层 API，且在外部重新实现不切实际。用于 kTLS（内核 TLS 卸载）和原始 TLS 记录操作。 |
6970
| `tfogo_checklinkname0` | :material-check: | `badlinkname` 的伴随标记。Go 1.23+ 链接器强制限制 `go:linkname` 使用；此标记表示构建使用 `-checklinkname=0` 以绕过该限制。 |
7071

‎go.mod‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ require (
3838
github.com/sagernet/gvisor v0.0.0-20250811.0-sing-box-mod.1
3939
github.com/sagernet/quic-go v0.59.0-sing-box-mod.4
4040
github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849
41+
github.com/sagernet/sing-cloudflared v0.0.0-20260407120610-7715dc2523fa
4142
github.com/sagernet/sing-mux v0.3.4
4243
github.com/sagernet/sing-quic v0.6.2-0.20260330152607-bf674c163212
4344
github.com/sagernet/sing-shadowsocks v0.2.8
@@ -73,6 +74,7 @@ require (
7374
github.com/andybalholm/brotli v1.1.0 // indirect
7475
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
7576
github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 // indirect
77+
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
7678
github.com/database64128/netx-go v0.1.1 // indirect
7779
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
7880
github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa // indirect
@@ -82,6 +84,7 @@ require (
8284
github.com/fsnotify/fsnotify v1.7.0 // indirect
8385
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
8486
github.com/gaissmai/bart v0.18.0 // indirect
87+
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
8588
github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced // indirect
8689
github.com/go-ole/go-ole v1.3.0 // indirect
8790
github.com/gobwas/httphead v0.1.0 // indirect
@@ -99,6 +102,7 @@ require (
99102
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
100103
github.com/mdlayher/socket v0.5.1 // indirect
101104
github.com/mitchellh/go-ps v1.0.0 // indirect
105+
github.com/philhofer/fwd v1.2.0 // indirect
102106
github.com/pierrec/lz4/v4 v4.1.21 // indirect
103107
github.com/pires/go-proxyproto v0.8.1 // indirect
104108
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -165,4 +169,5 @@ require (
165169
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
166170
gopkg.in/yaml.v3 v3.0.1 // indirect
167171
lukechampine.com/blake3 v1.3.0 // indirect
172+
zombiezen.com/go/capnproto2 v2.18.2+incompatible // indirect
168173
)

‎go.sum‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9
2828
github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
2929
github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 h1:8h5+bWd7R6AYUslN6c6iuZWTKsKxUFDlpnmilO6R2n0=
3030
github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
31+
github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
32+
github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
3133
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
3234
github.com/cretz/bine v0.2.0 h1:8GiDRGlTgz+o8H9DSnsl+5MeBK4HsExxgl6WgzOCuZo=
3335
github.com/cretz/bine v0.2.0/go.mod h1:WU4o9QR9wWp8AVKtTM1XD5vUHkEqnf2vVSo6dBqbetI=
@@ -110,6 +112,8 @@ github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zt
110112
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
111113
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
112114
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
115+
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
116+
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
113117
github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
114118
github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
115119
github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
@@ -142,6 +146,8 @@ github.com/openai/openai-go/v3 v3.26.0 h1:bRt6H/ozMNt/dDkN4gobnLqaEGrRGBzmbVs0xx
142146
github.com/openai/openai-go/v3 v3.26.0/go.mod h1:cdufnVK14cWcT9qA1rRtrXx4FTRsgbDPW7Ia7SS5cZo=
143147
github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
144148
github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
149+
github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
150+
github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
145151
github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
146152
github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
147153
github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
@@ -238,6 +244,8 @@ github.com/sagernet/quic-go v0.59.0-sing-box-mod.4 h1:6qvrUW79S+CrPwWz6cMePXohgj
238244
github.com/sagernet/quic-go v0.59.0-sing-box-mod.4/go.mod h1:OqILvS182CyOol5zNNo6bguvOGgXzV459+chpRaUC+4=
239245
github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849 h1:P8jaGN561IbHBxjlU8IGrFK65n1vDOrHo8FOMgHfn14=
240246
github.com/sagernet/sing v0.8.5-0.20260404181712-947827ec3849/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
247+
github.com/sagernet/sing-cloudflared v0.0.0-20260407120610-7715dc2523fa h1:165HiOfgfofJIirEp1NGSmsoJAi+++WhR29IhtAu4A4=
248+
github.com/sagernet/sing-cloudflared v0.0.0-20260407120610-7715dc2523fa/go.mod h1:bH2NKX+NpDTY1Zkxfboxw6MXB/ZywaNLmrDJYgKMJ2Y=
241249
github.com/sagernet/sing-mux v0.3.4 h1:ZQplKl8MNXutjzbMVtWvWG31fohhgOfCuUZR4dVQ8+s=
242250
github.com/sagernet/sing-mux v0.3.4/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
243251
github.com/sagernet/sing-quic v0.6.2-0.20260330152607-bf674c163212 h1:7mFOUqy+DyOj7qKGd1X54UMXbnbJiiMileK/tn17xYc=
@@ -294,6 +302,8 @@ github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
294302
github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
295303
github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
296304
github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
305+
github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
306+
github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
297307
github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM=
298308
github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
299309
github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
@@ -401,3 +411,5 @@ lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=
401411
lukechampine.com/blake3 v1.3.0/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
402412
software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
403413
software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
414+
zombiezen.com/go/capnproto2 v2.18.2+incompatible h1:v3BD1zbruvffn7zjJUU5Pn8nZAB11bhZSQC4W+YnnKo=
415+
zombiezen.com/go/capnproto2 v2.18.2+incompatible/go.mod h1:XO5Pr2SbXgqZwn0m0Ru54QBqpOf4K5AYBO+8LAOBQEQ=

‎include/cloudflared.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
//go:build with_cloudflared
2+
3+
package include
4+
5+
import (
6+
"github.com/sagernet/sing-box/adapter/inbound"
7+
"github.com/sagernet/sing-box/protocol/cloudflare"
8+
)
9+
10+
func registerCloudflaredInbound(registry *inbound.Registry) {
11+
cloudflare.RegisterInbound(registry)
12+
}

0 commit comments

Comments
 (0)