sing-box/patches.md

Upstream Changes

UserManager — External Authentication & Traffic Tracking

A new user_manager service that turns sing-box into a universal proxy server for external auth servers.

New files

• adapter/user_manager.go — UserManager interface: Authenticate, GetCredentials, ReportTraffic, GetTraffic, ListTraffic, KickUser
• option/user_manager.go — UserManagerOptions: auth_server, cache_ttl, refresh_interval, report_interval, report_traffic, api_secret, api_listen, timeout
• service/usermanager/manager.go — full implementation:
  • On-demand HTTPS auth (POST /api/auth) with in-memory TTL cache
  • Periodic credential sync (GET /api/credentials) populates per-protocol user lists
  • Per-user traffic counters (atomic.Int64) reported via POST /api/traffic
  • ConnectionTracker impl wrapping conns with byte counters (RoutedConnection/RoutedPacketConnection)
  • HTTP API on configurable api_listen:
    • GET /traffic — all users traffic
    • GET /traffic/{user} — single user
    • POST /kick/{user} — evict user from auth cache
  • Bearer token auth on all API endpoints via api_secret
• service/usermanager/registry.go — service registration
• include/usermanager.go — include build hook
• constant/proxy.go — TypeUserManager constant

Modified files — Protocol inbound integration

All 10 protocol inbounds detect the global user_manager from service context and use it when present:

Protocol	Type	Approach
hysteria2	Service-based	service.UpdateUsers with password credentials, 30s refresh loop
tuic	Service-based	service.UpdateUsers with UUID+password (format "uuid:password"), 30s refresh loop
vless	Service-based	service.UpdateUsers with UUID credentials, 30s refresh loop
vmess	Service-based	service.UpdateUsers with UUID credentials, 30s refresh loop
trojan	Service-based	service.UpdateUsers with password credentials, 30s refresh loop
shadowsocks (multi)	Service-based	service.UpdateUsersWithPasswords with password credentials, 30s refresh loop
http	Authenticator-based	*auth.Authenticator rebuilt from GetCredentials, 30s refresh loop
socks	Authenticator-based	*auth.Authenticator rebuilt from GetCredentials, 30s refresh loop
mixed	Authenticator-based	*auth.Authenticator rebuilt from GetCredentials, 30s refresh loop
naive	Authenticator-based	*auth.Authenticator rebuilt from GetCredentials, 30s refresh loop; skips "missing users" check when user_manager is configured

Each inbound falls back to its original static config when no user_manager service is registered.

Credential format per protocol

Protocol	UserInfo.Credential format
hysteria2	password
tuic	uuid:password
vless	uuid
vmess	uuid
trojan	password
shadowsocks	password (method from static config)
http	password (username from UserInfo.Username)
socks	password (username from UserInfo.Username)
mixed	password (username from UserInfo.Username)
naive	password (username from UserInfo.Username)

Auth server API contract

The auth server (auth_server) must implement:

• POST /api/auth — body {"protocol":"...", "credential":"...", "addr":"..."}, returns {"ok":true, "id":"username"}
• GET /api/credentials — returns {"credentials":[{"protocol":"...", "credential":"...", "username":"..."}]}
• POST /api/traffic (optional, when report_traffic=true) — body {"traffic":{"user1":{"tx":123,"rx":456}}}