Comment on page
Surge Mac
- The implementation of RULE-SET and DOMAIN-SET has been completely rewritten. Now, Surge automatically preprocesses and indexes rule sets during resource updates, significantly increasing the matching speed.
- 1.There is no longer any difference in performance and memory usage between RULE-SET and DOMAIN-SET types of rule sets, allowing flexible usage.
- 2.There is no longer a restriction in DOMAIN-SET rule sets that prevents the use of eTLDs.
- 3.The matching speed for DOMAIN, DOMAIN-SUFFIX, IP-CIDR, and IP-CIDR6 rules in RULE-SET has been greatly improved.
- 4.A DOMAIN/DOMAIN-SUFFIX rule set with approximately 100,000 entries used to take 100ms for a single match in the old version; now, it only takes single-digit ms.
- 5.An IP-CIDR rule set with approximately 10,000 entries used to take about 0.1ms for a single match in the old version. The new version only needs 0.0002ms, an improvement of about 500 times. The performance improvement for IP-CIDR6 rules is even greater.
- Main ruleset matching efficiency has been slightly optimized.
- The efficiency of IP-CIDR6 rules has been significantly improved even in non-indexed situations.
- RULE-SET rules can now be configured directly with parameters no-resolve and extended-matching, which are equivalent to configuring all sub-rules with these parameters.
- DOMAIN-SET rule sets also support configuration with extended-matching.
- Now, when performing MITM, the certificate used for signing will be sent to the client together, to support using intermediate certificates for MITM.
- All comments (at the beginning and end of lines) can now use
#
,//
,;
three common comment symbols. - Profile error message prompt optimization, now it can give the exact line number where the error occurred more accurately.
- Optimize Surge Ponte error handling process, correct the issue where device information is not automatically updated under certain errors.
- Bug fixes.
- Protocol sniffingRequests to port 80 and 443 will wait for the client to send the first packet, then extract the SNI and other information for the rule system to judge.
DOMAIN
,DOMAIN-SUFFIX
,DOMAIN-KEYWORD
rules add an optional parameter calledextended-matching
. When this parameter is enabled, the rule will try to match both the SNI and the HTTP Host Header (or :authority).- Added a parameter called
always-raw-tcp-hosts
, used to forcibly turn off active protocol detection for specific hostnames.
- New proxy protocol support: Hysteria 2Hysteria 2 is a proxy protocol optimized for unstable and packet-loss-prone network environments, based on UDP/QUIC.
- Automatic QUIC blockingSince most proxy protocols are not suitable for forwarding QUIC traffic, Surge will now automatically block QUIC traffic to make it fallback to HTTPS/TCP protocol, ensuring performance. For QUIC traffic that hits the MITM hostname, it will also be automatically rejected.
- ECN (Explicit Congestion Notification) support for QUIC-based protocolsSignificantly improved the performance of the Vector(Surge Ponte)/TUIC/Hysteria 2 protocol.
- Reworked HTTP capture functionality
- The related settings are no longer stored in the configuration, the
[Replica]
section has been deprecated. - Added an automatic shut-off setting after turning on the capture switch, which can automatically stop capturing based on time, size, or the number of requests.
- Added automatic activation of MITM after turning on the capture switch, which can be additionally turned on for specific hostnames. (Even if the main MITM switch is off).
- Added an option to only save HTTP/HTTPS requests after turning on the capture switch.
- Improved compatibility with some non-standard protocols.
- When testing the Ponte policy, the test URL has been changed from
proxy-test-url
tointernet-test-url
. - Following the WireGuard protocol standard recommendation, WireGuard handshake packets will now be tagged with 0x88 (AF41) DSCP to increase the success rate.
- When forwarding UDP packets via WireGuard, it supports retaining the TOS(DSCP/ECN) tag of packets inside the tunnel.
- Based on the WireGuard protocol standard recommendation, Surge will copy the ECN tag from packets inside the tunnel to packets outside. When receiving packets with an ECN tag, they will be strictly merged according to RFC6040. (
ecn=true
must be set for the policy). - UDP NAT can close the UDP session early based on ICMP messages.
- Improved PMTU support for QUIC.
- Fixed the issue where the external resources of rule sets needed to be reloaded to take effect after updates.
- After a network switch, it will forcefully break the original long connection of DoH/DoQ/DoH3 to avoid obtaining results that are not suitable for the current network environment.
- Fixed the issue where invalid certificates might cause the key store interface to crash.
- When performing MITM on HTTPS requests that directly connect using an IP address, the IP address should not be sent as SNI, as this might cause compatibility issues.
- Other bug fixes.
- Surge Mac is now ready for macOS Sonoma.
- External resources can now be remotely managed and updated by Surge iOS.
- Fixed the issue where the location permission request could not be correctly triggered.
- Surge Web Dashboard upgraded to version 2.0.4.
- Other improvements.
https://dl.nssurge.com/mac/v5/Surge-5.3.2-2393-f4b3e5e9a7bc5b73106ace7b0776eefe.zip
- Surge Dashboard now can directly create temporary rules for local and remote Surge instances.
- Surge Web Dashboard now upgraded to version 2.0.
- Added Inline Ruleset, which allows the Ruleset to be written directly in the main profile
- Module enhanced. Modules can now operate [WireGuard *] and [Ruleset *] sections.
- Added an HTTP API for obtaining CA certificates (DER format): GET /v1/mitm/ca.
- Fixed that MITM failed records could not be correctly generated.
https://dl.nssurge.com/mac/v5/Surge-5.3.1-2383-066f883d96a472655c9ea7be50475b8b.zip
- You can now directly access the Remote Dashboard of registered devices through Surge Ponte.
- The Surge Dashboard can now operate the policy group and outbound options of remote devices.
- macOS Sonoma now requires location permissions to obtain the SSID. If related rules and subnet settings are used, Surge will prompt for location permissions.
- Fixed a bug that the override of a policy group cannot be canceled remotely.
- Corrected the compatibility issue between VIF and specific devices.
- Surge Ponte improvments.
- Minor bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.3.0-2375-bc1b4791973df9aba493c3190a7b0050.zip
- You can now create a new modifiable profile based on an existing profile. In this new profile, the selected sections will reference the corresponding content in the original profile and will automatically synchronize with the original profile. At the same time, unselected sections in the new profile can be modified freely without being affected by the original profile. (The UI for the detached profile feature.)
- The detached profile now can include the Enterprise profile.
- Fixed the issue that it was impossible to connect when the SSH server configured a banner.
- You can now use the UI to edit ShadowTLS parameters.
- Optimize performance in VIF v1 mode for ARM64 architecture. When the VIF mode is set to automatic, the new version will automatically use the v1 engine under M1/M2 processors, with a maximum performance of ~8Gbps, thereby avoiding compatibility and stability issues.
- Correct the issue where the opening position of the Dashboard main window may be incorrect.
https://dl.nssurge.com/mac/v5/Surge-5.2.3-2354-ce8606235be8df196c0e9619a9c8cbbd.zip
- Fixed the problem where there might be incorrect prompts about system proxy settings being modified by other applications when there is no valid network.
- Fixed some issues that may occur when using TUIC v5 as the underlying-proxy.
- Fixed the issue where if WebSocket is enabled, it cannot correctly construct a WebSocket request when directly using an IPv6 address as the vmess hostname.
- Provide clearer error prompts when the SOCKS5 server does not support UDP relay.
- Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.2.2-2340-74b1e55a52888040394976468a61d973.zip
- Surge Ponte now can work in LAN-only mode when NAT type doesn't meet the requirement. Devices on same LAN can still access.
- The connection limiter mechanism added in the previous version has been temporarily removed.
- Optimize the logic of setting as system proxy function.
- Fixed a memory leak issue.
- Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.2.1-2333-ef97cd79e935d838387dc99712fb38b3.zip
- Due to the fixed size of macOS network stack memory, when the network stack buffer is exhausted, the kernel will automatically close the program with the highest occupancy to release resources. This problem may occur when using Surge to take over P2P downloaders. This version will automatically check for this issue and enter safe mode automatically.
- Surge VIF engine has been upgraded to v3, no longer relying on Packet Filter (pf), solving compatibility issues with virtual machines and network sharing functions. At the same time, connection number limits have been added to avoid system resource exhaustion caused by excessive concurrent requests.
- Add a connection limiter for single processes and single devices to avoid consuming large amounts of resources for individual devices.
- Support for QUIC's PMTU discovery, which improves the performance of Surge Ponte and TUIC protocols.
- Optimize error handling logic of QUIC-based protocols.
- When forwarding UDP packets using TUIC v5, follow the DF flag of the IP packet. Avoid the issue that can occur when visiting the QUIC website with TUIC v5.
- Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.2.0-2302-721d7db5429609c5a54af922f045a509.zip
- Added support for TUIC v5 protocol.
- Optimized the performance of Surge Ponte/TUIC.
- Optimized the request Note recording when the strategy group is abnormal.
- Fixed the problem that connection reuse was not done correctly under MITM H2 mode.
- Fixed the problem that the request of $httpClient/DoH may sometimes be accidentally cancelled.
- Adjusted the traffic characteristics of Snell v4 protocol.
- Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.1.1-2264-6f04d8ac1bbf1c91178a09124e45e37e.zip
- Surge Ponte supports cross-iCloud account sharing.
- Fixed issues that might occur when accessing HTTP/1.0 servers via Surge Ponte or TUIC protocol. (e.g. ASUS router management page)
- Icon Library: You can now select icons for your device from a library of about 7000 icons.
- Fixed an issue that the reuse feature could not work properly under Snell V4.
- SSH protocol now supports server public key fingerprint pinning, see the manual for usage.
- $httpClient supports binary mode.
- The body of the request supports TypedArray.
- Passing in binary-mode: true in the request parameters allows the return result to be returned as TypedArray.
- Fixed the problem that
http-request
type scripts could not use binary data directly as response.
- Policy group adds parameter
external-policy-modifier
, which can be used to adjust external policies. - Optimized the request log system
- Added category marks to the logs.
- Rule system adds more output for DNS and rulesets.
- Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.1.0-2216-82115a08df678cfa87137a506f7df061.zip
- Added UDP relay support for the VMess protocol
- Since the VMess server-side supports UDP forwarding by default, there's no need to add extra parameters to use it.
- Due to design flaws in the VMess protocol, when using VMess to forward UDP traffic, P2P scenarios may not work, such as voice calls, online gaming, etc. Therefore, it is not recommended to use the VMess protocol.
- SSH protocol now supports specifying the server's public key fingerprint. Check the manual for more information.
- The external IP address is now obtained through the STUN protocol and no longer relies on api.my-ip.io.
- The DDNS now uses the secured IPv6 address instead if a temporary one, when IPv6 is selected.
- Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.3-2199-c241935acf37b3ec7f7fa4f5120e8690.zip
- Due to the new privacy restrictions on macOS, if the Wi-Fi BSSID-related features are used, Surge will request location service permissions to read the Wi-Fi BSSID.
- Shadow TLS v3 is now supported. Append
shadow-tls-version=3
to enable it. - Surge Mac now supports Adaptive TLS Fingerprint. For more information, please check the community thread.
- Supports a new parameter
external-policy-modifier
for groups to modify the parameters of external policies. - The new proxy client notification will only be prompted when a real request is received and will no longer be displayed when being port scanned.
- Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.2-2186-2ab1aba0dc49688683b2e4d43200e468.zip
- The registered Ponte device view is now available when the Ponte switch in off.
- Fixed a crash while using Surge Dashboard via USB.
- $httpClient now supports binary mode.
- Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.1-2162-22743a4d2f1e0aeb0b872e8f544c2e69.zip
Last modified 17d ago