世界
9b97a0de6f
DNS rules referencing rule-sets that contain only ip_cidr predicates silently stopped matching when legacy DNS mode was disabled, because the IP-CIDR branch cannot match against an in-flight DNS query. The existing validation intentionally let every rule_set through on the premise that mixed sets still work via their non-IP branches, which is only true when such a branch exists. Track whether a rule-set carries any non-IP-CIDR predicate and reject pure-IP references the same way bare ip_cidr fields are already rejected.
105 lines
3.2 KiB
Go
105 lines
3.2 KiB
Go
package rule
|
|
|
|
import (
|
|
"context"
|
|
"reflect"
|
|
|
|
"github.com/sagernet/sing-box/adapter"
|
|
C "github.com/sagernet/sing-box/constant"
|
|
"github.com/sagernet/sing-box/option"
|
|
"github.com/sagernet/sing/common"
|
|
E "github.com/sagernet/sing/common/exceptions"
|
|
"github.com/sagernet/sing/common/logger"
|
|
"github.com/sagernet/sing/service"
|
|
|
|
"go4.org/netipx"
|
|
)
|
|
|
|
func NewRuleSet(ctx context.Context, logger logger.ContextLogger, options option.RuleSet) (adapter.RuleSet, error) {
|
|
switch options.Type {
|
|
case C.RuleSetTypeInline, C.RuleSetTypeLocal, "":
|
|
return NewLocalRuleSet(ctx, logger, options)
|
|
case C.RuleSetTypeRemote:
|
|
return NewRemoteRuleSet(ctx, logger, options)
|
|
default:
|
|
return nil, E.New("unknown rule-set type: ", options.Type)
|
|
}
|
|
}
|
|
|
|
func extractIPSetFromRule(rawRule adapter.HeadlessRule) []*netipx.IPSet {
|
|
switch rule := rawRule.(type) {
|
|
case *DefaultHeadlessRule:
|
|
return common.FlatMap(rule.destinationIPCIDRItems, func(rawItem RuleItem) []*netipx.IPSet {
|
|
switch item := rawItem.(type) {
|
|
case *IPCIDRItem:
|
|
return []*netipx.IPSet{item.ipSet}
|
|
default:
|
|
return nil
|
|
}
|
|
})
|
|
case *LogicalHeadlessRule:
|
|
return common.FlatMap(rule.rules, extractIPSetFromRule)
|
|
default:
|
|
panic("unexpected rule type")
|
|
}
|
|
}
|
|
|
|
func HasHeadlessRule(rules []option.HeadlessRule, cond func(rule option.DefaultHeadlessRule) bool) bool {
|
|
for _, rule := range rules {
|
|
switch rule.Type {
|
|
case C.RuleTypeDefault:
|
|
if cond(rule.DefaultOptions) {
|
|
return true
|
|
}
|
|
case C.RuleTypeLogical:
|
|
if HasHeadlessRule(rule.LogicalOptions.Rules, cond) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func isProcessHeadlessRule(rule option.DefaultHeadlessRule) bool {
|
|
return len(rule.ProcessName) > 0 || len(rule.ProcessPath) > 0 || len(rule.ProcessPathRegex) > 0 || len(rule.PackageName) > 0 || len(rule.PackageNameRegex) > 0
|
|
}
|
|
|
|
func isWIFIHeadlessRule(rule option.DefaultHeadlessRule) bool {
|
|
return len(rule.WIFISSID) > 0 || len(rule.WIFIBSSID) > 0
|
|
}
|
|
|
|
func isIPCIDRHeadlessRule(rule option.DefaultHeadlessRule) bool {
|
|
return len(rule.IPCIDR) > 0 || rule.IPSet != nil
|
|
}
|
|
|
|
func isDNSQueryTypeHeadlessRule(rule option.DefaultHeadlessRule) bool {
|
|
return len(rule.QueryType) > 0
|
|
}
|
|
|
|
func isNonIPCIDRHeadlessRule(rule option.DefaultHeadlessRule) bool {
|
|
ipOnly := option.DefaultHeadlessRule{
|
|
IPCIDR: rule.IPCIDR,
|
|
IPSet: rule.IPSet,
|
|
Invert: rule.Invert,
|
|
}
|
|
return !reflect.DeepEqual(rule, ipOnly)
|
|
}
|
|
|
|
func buildRuleSetMetadata(headlessRules []option.HeadlessRule) adapter.RuleSetMetadata {
|
|
return adapter.RuleSetMetadata{
|
|
ContainsProcessRule: HasHeadlessRule(headlessRules, isProcessHeadlessRule),
|
|
ContainsWIFIRule: HasHeadlessRule(headlessRules, isWIFIHeadlessRule),
|
|
ContainsIPCIDRRule: HasHeadlessRule(headlessRules, isIPCIDRHeadlessRule),
|
|
ContainsDNSQueryTypeRule: HasHeadlessRule(headlessRules, isDNSQueryTypeHeadlessRule),
|
|
ContainsNonIPCIDRRule: HasHeadlessRule(headlessRules, isNonIPCIDRHeadlessRule),
|
|
}
|
|
}
|
|
|
|
func validateRuleSetMetadataUpdate(ctx context.Context, tag string, metadata adapter.RuleSetMetadata) error {
|
|
validator := service.FromContext[adapter.DNSRuleSetUpdateValidator](ctx)
|
|
if validator == nil {
|
|
return nil
|
|
}
|
|
return validator.ValidateRuleSetMetadataUpdate(tag, metadata)
|
|
}
|