mirror of
https://github.com/2dust/v2rayN.git
synced 2026-09-22 22:38:10 +03:00
Tylerrrkd
e1e6c5ddb0
* Restore the silently dropped embedded TUN routing rules tun_singbox_rules declares "network": "udp" as a bare string, but Rule4Sbox.network is a List<string>. System.Text.Json therefore throws on the very first rule, and JsonUtils.Deserialize swallows it and returns default. GenRouting only checks for null before AddRange, so the whole embedded rule set is dropped without a trace. Both rules it carries have thus never reached a generated config: the NetBIOS/mDNS reject and the multicast reject. The mismatch predates the sing-box 1.12 migration - the template has used the string form since the rules file was introduced. - declare network as an array so the template matches Rule4Sbox * Drop traffic addressed to the TUN's own addresses With auto_route the TUN steals the default route, so a packet whose destination is the TUN interface's own address is handed to sing-box instead of being looped back by the kernel. Routing then matches ip_is_private and sends it to `direct`, whose interface is auto-detected as the TUN again, so the packet is written straight back into the TUN and re-enters routing. The loop never terminates and pins a CPU core. Seen in the wild on macOS: a WebRTC client offered the TUN's own fc00::172:18:0:1 ULA as an ICE candidate and the resulting STUN connectivity checks sustained ~8k packets/s out of the interface at 800% CPU, 21 GB written to the TUN over five hours - against 3 GB read, the asymmetry that gives the loop away. Nothing legitimate is addressed to those addresses, so reject them before any outbound rule can match. Use method "drop" rather than the default ICMP unreachable, whose destination would be the looping address itself. - reject the TUN inbound's own addresses, taken from the generated inbound so the two cannot drift apart
22 lines
240 B
Plaintext
22 lines
240 B
Plaintext
[
|
|
{
|
|
"network": [
|
|
"udp"
|
|
],
|
|
"port": [
|
|
135,
|
|
137,
|
|
138,
|
|
139,
|
|
5353
|
|
],
|
|
"action": "reject"
|
|
},
|
|
{
|
|
"ip_cidr": [
|
|
"224.0.0.0/3",
|
|
"ff00::/8"
|
|
],
|
|
"action": "reject"
|
|
}
|
|
] |