From a8ce3838bc56f0e733f70582b56403856fa3b5cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= <i@sekai.icu>
Date: Wed, 2 Apr 2025 15:44:43 +0800
Subject: [PATCH] redirect: Only hijack DNS requests from local addresses

---
 redirect_nftables.go       |  4 +++-
 redirect_nftables_rules.go | 33 ++++++++++++++++++++++++++++++---
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/redirect_nftables.go b/redirect_nftables.go
index 02a9ca8..2f3adea 100644
--- a/redirect_nftables.go
+++ b/redirect_nftables.go
@@ -101,7 +101,9 @@ func (r *autoRedirect) setupNFTables() error {
 	}
 	r.nftablesCreateUnreachable(nft, table, chainPreRouting)
 	r.nftablesCreateRedirect(nft, table, chainPreRouting)
-	r.nftablesCreateMark(nft, table, chainPreRouting)
+	if r.tunOptions.AutoRedirectMarkMode {
+		r.nftablesCreateMark(nft, table, chainPreRouting)
+	}
 
 	if r.tunOptions.AutoRedirectMarkMode {
 		chainPreRoutingUDP := nft.AddChain(&nftables.Chain{
diff --git a/redirect_nftables_rules.go b/redirect_nftables_rules.go
index a5840dc..cc694c6 100644
--- a/redirect_nftables_rules.go
+++ b/redirect_nftables_rules.go
@@ -402,13 +402,13 @@ func (r *autoRedirect) nftablesCreateExcludeRules(nft *nftables.Conn, table *nft
 	if !r.tunOptions.EXP_DisableDNSHijack && ((chain.Hooknum == nftables.ChainHookPrerouting && chain.Type == nftables.ChainTypeNAT) ||
 		(r.tunOptions.AutoRedirectMarkMode && chain.Hooknum == nftables.ChainHookOutput && chain.Type == nftables.ChainTypeNAT)) {
 		if r.enableIPv4 {
-			err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv4)
+			err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv4, 5, "inet4_local_address_set")
 			if err != nil {
 				return err
 			}
 		}
 		if r.enableIPv6 {
-			err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv6)
+			err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv6, 6, "inet6_local_address_set")
 			if err != nil {
 				return err
 			}
@@ -553,7 +553,7 @@ func (r *autoRedirect) nftablesCreateRedirect(
 
 func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 	nft *nftables.Conn, table *nftables.Table, chain *nftables.Chain,
-	family nftables.TableFamily,
+	family nftables.TableFamily, setID uint32, setName string,
 ) error {
 	ipProto := &nftables.Set{
 		Table:     table,
@@ -611,6 +611,33 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 				Data:     nftablesIfname("lo"),
 			},
 		)
+	} else {
+		if family == nftables.TableFamilyIPv4 {
+			exprs = append(exprs,
+				&expr.Payload{
+					OperationType: expr.PayloadLoad,
+					DestRegister:  1,
+					Base:          expr.PayloadBaseNetworkHeader,
+					Offset:        12,
+					Len:           4,
+				},
+			)
+		} else {
+			exprs = append(exprs,
+				&expr.Payload{
+					OperationType: expr.PayloadLoad,
+					DestRegister:  1,
+					Base:          expr.PayloadBaseNetworkHeader,
+					Offset:        8,
+					Len:           16,
+				},
+			)
+		}
+		exprs = append(exprs, &expr.Lookup{
+			SourceRegister: 1,
+			SetID:          setID,
+			SetName:        setName,
+		})
 	}
 	exprs = append(exprs,
 		&expr.Meta{