From 304a95de0ae396279b60486ba3bcd2c6f6d5428d Mon Sep 17 00:00:00 2001 From: Dushnilin Date: Wed, 16 Sep 2026 17:20:14 +0300 Subject: [PATCH] fix(routing): broaden disable_quic to all inbounds and reject SVCB/HTTPS DNS queries --- tachyon/files/usr/lib/singbox/generator.uc | 2 +- tachyon/files/usr/lib/singbox/route.uc | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/tachyon/files/usr/lib/singbox/generator.uc b/tachyon/files/usr/lib/singbox/generator.uc index a428edc1..9748afbc 100644 --- a/tachyon/files/usr/lib/singbox/generator.uc +++ b/tachyon/files/usr/lib/singbox/generator.uc @@ -508,7 +508,7 @@ function base_config(settings, service_address, runtime_context) { for (let rule in dns_config.rules) push(dns_rules, rule); for (let rule in [ - { action: "reject", query_type: "HTTPS" }, + { action: "reject", query_type: [ "HTTPS", "SVCB" ] }, { action: "reject", domain_suffix: "use-application-dns.net" }, { action: "route", diff --git a/tachyon/files/usr/lib/singbox/route.uc b/tachyon/files/usr/lib/singbox/route.uc index 4fda8c82..24755990 100644 --- a/tachyon/files/usr/lib/singbox/route.uc +++ b/tachyon/files/usr/lib/singbox/route.uc @@ -97,8 +97,10 @@ function config(settings, runtime) { if (output_network_interface != "") result.default_interface = output_network_interface; - if (bool_option(settings, "disable_quic", false)) - push(result.rules, { action: "reject", inbound: runtime_constants.TPROXY_INBOUND_TAG, protocol: "quic" }); + if (bool_option(settings, "disable_quic", false)) { + push(result.rules, { action: "reject", network: "udp", port: [ 443 ] }); + push(result.rules, { action: "reject", protocol: "quic" }); + } if (bool_option(settings, "isolate_p2p", false)) { push(result.rules, { protocol: "bittorrent", action: "route", outbound: runtime_constants.DIRECT_OUTBOUND_TAG }); for (let rule in p2p_direct_rules(settings))