eburet-oss/sing-tun-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

redirect: Only hijack DNS requests from local addresses

Browse source
This commit is contained in:
世界 2025-04-02 15:44:43 +08:00
parent 35b5747b44
commit a8ce3838bc
No known key found for this signature in database
GPG key ID: CD109927C34A63C4
2 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
redirect_nftables.go
View file

@ -101,7 +101,9 @@ func (r *autoRedirect) setupNFTables() error {
} }
r.nftablesCreateUnreachable(nft, table, chainPreRouting) r.nftablesCreateUnreachable(nft, table, chainPreRouting)
r.nftablesCreateRedirect(nft, table, chainPreRouting) r.nftablesCreateRedirect(nft, table, chainPreRouting)
r.nftablesCreateMark(nft, table, chainPreRouting) if r.tunOptions.AutoRedirectMarkMode {
r.nftablesCreateMark(nft, table, chainPreRouting)
}
if r.tunOptions.AutoRedirectMarkMode { if r.tunOptions.AutoRedirectMarkMode {
chainPreRoutingUDP := nft.AddChain(&nftables.Chain{ chainPreRoutingUDP := nft.AddChain(&nftables.Chain{

33
redirect_nftables_rules.go
View file

@ -402,13 +402,13 @@ func (r *autoRedirect) nftablesCreateExcludeRules(nft *nftables.Conn, table *nft
if !r.tunOptions.EXP_DisableDNSHijack && ((chain.Hooknum == nftables.ChainHookPrerouting && chain.Type == nftables.ChainTypeNAT) || if !r.tunOptions.EXP_DisableDNSHijack && ((chain.Hooknum == nftables.ChainHookPrerouting && chain.Type == nftables.ChainTypeNAT) ||
(r.tunOptions.AutoRedirectMarkMode && chain.Hooknum == nftables.ChainHookOutput && chain.Type == nftables.ChainTypeNAT)) { (r.tunOptions.AutoRedirectMarkMode && chain.Hooknum == nftables.ChainHookOutput && chain.Type == nftables.ChainTypeNAT)) {
if r.enableIPv4 { if r.enableIPv4 {
err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv4) err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv4, 5, "inet4_local_address_set")
if err != nil { if err != nil {
return err return err
} }
} }
if r.enableIPv6 { if r.enableIPv6 {
err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv6) err := r.nftablesCreateDNSHijackRulesForFamily(nft, table, chain, nftables.TableFamilyIPv6, 6, "inet6_local_address_set")
if err != nil { if err != nil {
return err return err
} }
@ -553,7 +553,7 @@ func (r *autoRedirect) nftablesCreateRedirect(
func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily( func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
nft *nftables.Conn, table *nftables.Table, chain *nftables.Chain, nft *nftables.Conn, table *nftables.Table, chain *nftables.Chain,
family nftables.TableFamily, family nftables.TableFamily, setID uint32, setName string,
) error { ) error {
ipProto := &nftables.Set{ ipProto := &nftables.Set{
Table: table, Table: table,
@ -611,6 +611,33 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
Data: nftablesIfname("lo"), Data: nftablesIfname("lo"),
}, },
) )
} else {
if family == nftables.TableFamilyIPv4 {
exprs = append(exprs,
&expr.Payload{
OperationType: expr.PayloadLoad,
DestRegister: 1,
Base: expr.PayloadBaseNetworkHeader,
Offset: 12,
Len: 4,
},
)
} else {
exprs = append(exprs,
&expr.Payload{
OperationType: expr.PayloadLoad,
DestRegister: 1,
Base: expr.PayloadBaseNetworkHeader,
Offset: 8,
Len: 16,
},
)
}
exprs = append(exprs, &expr.Lookup{
SourceRegister: 1,
SetID: setID,
SetName: setName,
})
} }
exprs = append(exprs, exprs = append(exprs,
&expr.Meta{ &expr.Meta{