feat: Surge HTTP/2 CONNECT 和 TrustTunnel 支持 max-streams

xream · xream · commit 0111766a2e4b · 2026-05-18T17:24:37.000+08:00
diff --git a/backend/package.json b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.23.13",
+  "version": "2.23.14",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "packageManager": "pnpm@11.0.9",
diff --git a/backend/src/core/proxy-utils/parsers/peggy/surge.js b/backend/src/core/proxy-utils/parsers/peggy/surge.js
@@ -348,7 +348,7 @@ https = tag equals "https" address (username password)? (usernamek passwordk)? (
     proxy.tls = true;
     handleShadowTLS();
 }
-h2_connect = tag equals "h2-connect" address (username password)? (usernamek passwordk)? (headers/sni/tls_fingerprint/tls_verification/client_cert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
+h2_connect = tag equals "h2-connect" address (username password)? (usernamek passwordk)? (headers/max_streams/sni/tls_fingerprint/tls_verification/client_cert/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/fast_open/tfo/shadow_tls_version/shadow_tls_sni/shadow_tls_password/block_quic/others)* {
     proxy.type = "h2-connect";
     proxy.tls = true;
     handleShadowTLS();
@@ -401,7 +401,7 @@ anytls = tag equals "anytls" address (passwordk/reuse/ip_version/underlying_prox
     proxy.type = "anytls";
     proxy.tls = true;
 }
-trust_tunnel = tag equals "trust-tunnel" address (usernamek/passwordk/headers/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/block_quic/others)* {
+trust_tunnel = tag equals "trust-tunnel" address (usernamek/passwordk/headers/max_streams/reuse/ip_version/underlying_proxy/tos/allow_other_interface/interface/test_url/test_udp/test_timeout/hybrid/no_error_alert/tls_fingerprint/tls_verification/client_cert/sni/fast_open/tfo/block_quic/others)* {
     proxy.type = "trusttunnel";
     proxy.tls = true;
 }
@@ -533,6 +533,8 @@ download_bandwidth = comma "download-bandwidth" equals match:[^,]+ { proxy.down
 test_url = comma "test-url" equals match:[^,]+ { proxy["test-url"] = match.join(""); }
 test_udp = comma "test-udp" equals match:[^,]+ { proxy["test-udp"] = match.join(""); }
 test_timeout = comma "test-timeout" equals match:$[0-9]+ { proxy["test-timeout"] = parseInt(match.trim()); }
+max_streams = comma "max-streams" equals match:quoted_integer { proxy["max-streams"] = match; }
+quoted_integer = '"' match:$[0-9]+ '"' { return parseInt(match.trim()); } / "'" match:$[0-9]+ "'" { return parseInt(match.trim()); } / match:$[0-9]+ { return parseInt(match.trim()); }
 tos = comma "tos" equals match:$[0-9]+ { proxy.tos = parseInt(match.trim()); }
 interface = comma "interface" equals match:[^,]+ { proxy.interface = match.join(""); }
 allow_other_interface = comma "allow-other-interface" equals flag:bool { proxy["allow-other-interface"] = flag; }
diff --git a/backend/src/core/proxy-utils/producers/surge.js b/backend/src/core/proxy-utils/producers/surge.js
@@ -68,6 +68,17 @@ function appendSshPrivateKey(result, proxy) {
     }
 }
 
+function warnMaxStreamsIfNeeded(proxy) {
+    if (!isPresent(proxy, 'max-streams')) return;
+
+    const maxStreams = Number(stripSurgeQuotes(proxy['max-streams']));
+    if (!Number.isInteger(maxStreams) || maxStreams <= 3) return;
+
+    $.warn(
+        `Surge ${proxy.type} proxy ${proxy.name}: max-streams=${maxStreams} is greater than 3. Too many streams sharing one TCP connection may hurt performance.`,
+    );
+}
+
 export default function Surge_Producer() {
     const produce = (proxy, type, opts = {}) => {
         if (
@@ -434,6 +445,11 @@ function trusttunnel(proxy) {
     result.appendIfPresent(`,username="${proxy.username}"`, 'username');
     result.appendIfPresent(`,password="${proxy.password}"`, 'password');
     appendHeaders(result, proxy);
+    warnMaxStreamsIfNeeded(proxy);
+    result.appendIfPresent(
+        `,max-streams=${proxy['max-streams']}`,
+        'max-streams',
+    );
 
     const ip_version = ipVersions[proxy['ip-version']] || proxy['ip-version'];
     result.appendIfPresent(`,ip-version=${ip_version}`, 'ip-version');
@@ -502,6 +518,11 @@ function h2Connect(proxy) {
     result.appendIfPresent(`,username="${proxy.username}"`, 'username');
     result.appendIfPresent(`,password="${proxy.password}"`, 'password');
     appendHeaders(result, proxy);
+    warnMaxStreamsIfNeeded(proxy);
+    result.appendIfPresent(
+        `,max-streams=${proxy['max-streams']}`,
+        'max-streams',
+    );
 
     const ip_version = ipVersions[proxy['ip-version']] || proxy['ip-version'];
     result.appendIfPresent(`,ip-version=${ip_version}`, 'ip-version');
diff --git a/backend/src/test/proxy-parsers/v2ray-and-platforms.spec.js b/backend/src/test/proxy-parsers/v2ray-and-platforms.spec.js
@@ -2877,6 +2877,38 @@ describe('Platform raw-format parser coverage', function () {
                     reuse: true,
                 },
             },
+            {
+                title: 'parses trust-tunnel lines with double-quoted max-streams',
+                input: 'Surge TrustTunnel Max Streams = trust-tunnel,surge-trust.example.com,443,username=user,password=secret,headers=X-Client:Surge,max-streams="3",sni=sni.example.com,skip-cert-verify=true,reuse=true',
+                expected: {
+                    type: 'trusttunnel',
+                    name: 'Surge TrustTunnel Max Streams',
+                    server: 'surge-trust.example.com',
+                    port: 443,
+                    username: 'user',
+                    password: 'secret',
+                    tls: true,
+                    headers: {
+                        'X-Client': 'Surge',
+                    },
+                    'max-streams': 3,
+                    sni: 'sni.example.com',
+                    'skip-cert-verify': true,
+                    reuse: true,
+                },
+            },
+            {
+                title: 'parses trust-tunnel lines with single-quoted max-streams',
+                input: "Surge TrustTunnel Single Max Streams = trust-tunnel,surge-trust-single.example.com,443,max-streams='2'",
+                expected: {
+                    type: 'trusttunnel',
+                    name: 'Surge TrustTunnel Single Max Streams',
+                    server: 'surge-trust-single.example.com',
+                    port: 443,
+                    tls: true,
+                    'max-streams': 2,
+                },
+            },
             {
                 title: 'parses h2-connect lines with dynamic headers',
                 input: 'Surge H2 = h2-connect,h2.example.com,443,headers=X-Padding:<random-string(16-32)>,sni=sni.example.com,skip-cert-verify=true',
@@ -2893,6 +2925,23 @@ describe('Platform raw-format parser coverage', function () {
                     'skip-cert-verify': true,
                 },
             },
+            {
+                title: 'parses h2-connect lines with max-streams',
+                input: 'Surge H2 Max Streams = h2-connect,h2.example.com,443,headers=X-Padding:<random-string(16-32)>,max-streams=1,sni=sni.example.com,skip-cert-verify=true',
+                expected: {
+                    type: 'h2-connect',
+                    name: 'Surge H2 Max Streams',
+                    server: 'h2.example.com',
+                    port: 443,
+                    tls: true,
+                    headers: {
+                        'X-Padding': '<random-string(16-32)>',
+                    },
+                    'max-streams': 1,
+                    sni: 'sni.example.com',
+                    'skip-cert-verify': true,
+                },
+            },
             {
                 title: 'keeps quoted Surge headers with semicolons inside User-Agent values',
                 input: '1=http,163.177.17.6,443,headers="Host:153.3.236.22:443;X-T5-Auth:683556433;Connection:Keep-Alive;User-Agent:okhttp/3.11.0 Dalvik/2.1.0 (Linux; U; Android 11; Redmi K30 5G Build/RKQ1.200826.002) baiduboxapp/11.0.5.12 (Baidu; P1 11)"',
diff --git a/backend/src/test/proxy-producers/text.spec.js b/backend/src/test/proxy-producers/text.spec.js
@@ -545,6 +545,99 @@ describe('Proxy text producers', function () {
         ]);
     });
 
+    it('produces Surge max-streams for HTTP/2 CONNECT and TrustTunnel', function () {
+        const output = ProxyUtils.produce(
+            [
+                {
+                    type: 'h2-connect',
+                    name: 'Surge H2 Max Streams',
+                    server: 'h2.example.com',
+                    port: 443,
+                    tls: true,
+                    sni: 'sni.example.com',
+                    headers: {
+                        'X-Padding': '<random-string(16-32)>',
+                    },
+                    'max-streams': 1,
+                },
+                {
+                    type: 'trusttunnel',
+                    name: 'Surge Trust Max Streams',
+                    server: 'trust.example.com',
+                    port: 443,
+                    username: 'user',
+                    password: 'pass',
+                    headers: {
+                        'X-Client': 'Surge',
+                    },
+                    'max-streams': 3,
+                    sni: 'sni.example.com',
+                },
+            ],
+            'Surge',
+            'external',
+        );
+
+        expect(output.split('\n')).to.deep.equal([
+            'Surge H2 Max Streams=h2-connect,h2.example.com,443,headers="X-Padding:"<random-string(16-32)>"",max-streams=1,sni="sni.example.com"',
+            'Surge Trust Max Streams=trust-tunnel,trust.example.com,443,username="user",password="pass",headers="X-Client:"Surge"",max-streams=3,sni="sni.example.com"',
+        ]);
+    });
+
+    it('warns when Surge max-streams is greater than 3', function () {
+        const { result: output, warnings } = captureWarns(() =>
+            ProxyUtils.produce(
+                [
+                    {
+                        type: 'h2-connect',
+                        name: 'Surge H2 High Max Streams',
+                        server: 'h2.example.com',
+                        port: 443,
+                        tls: true,
+                        'max-streams': 4,
+                    },
+                    {
+                        type: 'trusttunnel',
+                        name: 'Surge Trust High Max Streams',
+                        server: 'trust.example.com',
+                        port: 443,
+                        tls: true,
+                        'max-streams': 5,
+                    },
+                ],
+                'Surge',
+                'external',
+            ),
+        );
+
+        expect(output.split('\n')).to.deep.equal([
+            'Surge H2 High Max Streams=h2-connect,h2.example.com,443,max-streams=4',
+            'Surge Trust High Max Streams=trust-tunnel,trust.example.com,443,max-streams=5',
+        ]);
+        expect(warnings).to.have.length(2);
+        expect(warnings[0]).to.include('max-streams=4');
+        expect(warnings[0]).to.include('greater than 3');
+        expect(warnings[0]).to.include('performance');
+        expect(warnings[1]).to.include('max-streams=5');
+        expect(warnings[1]).to.include('greater than 3');
+        expect(warnings[1]).to.include('performance');
+    });
+
+    it('round-trips Surge max-streams for HTTP/2 CONNECT and TrustTunnel', function () {
+        const proxies = ProxyUtils.parse(
+            [
+                'Surge H2 Round Trip = h2-connect,h2.example.com,443,headers=X-Padding:<random-string(16-32)>,max-streams=1,sni=sni.example.com',
+                'Surge Trust Round Trip = trust-tunnel,trust.example.com,443,username=user,password=pass,headers=X-Client:Surge,max-streams="3",sni=sni.example.com',
+            ].join('\n'),
+        );
+        const output = ProxyUtils.produce(proxies, 'Surge', 'external');
+
+        expect(output.split('\n')).to.deep.equal([
+            'Surge H2 Round Trip=h2-connect,h2.example.com,443,headers="X-Padding:"<random-string(16-32)>"",max-streams=1,sni="sni.example.com"',
+            'Surge Trust Round Trip=trust-tunnel,trust.example.com,443,username="user",password="pass",headers="X-Client:"Surge"",max-streams=3,sni="sni.example.com"',
+        ]);
+    });
+
     it('round-trips Surge root headers with nested quotes and separators', function () {
         const output = ProxyUtils.produce(
             [

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "sub-store",`
`3`		`- "version": "2.23.13",`
	`3`	`+ "version": "2.23.14",`
`4`	`4`	`"description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",`
`5`	`5`	`"main": "src/main.js",`
`6`	`6`	`"packageManager": "pnpm@11.0.9",`