fix(routing): broaden disable_quic to all inbounds and reject SVCB/HTTPS DNS queries

This commit is contained in:
Dushnilin
2026-09-16 17:20:14 +03:00
parent e10509033c
commit 304a95de0a
2 changed files with 5 additions and 3 deletions
+1 -1
View File
@@ -508,7 +508,7 @@ function base_config(settings, service_address, runtime_context) {
for (let rule in dns_config.rules) for (let rule in dns_config.rules)
push(dns_rules, rule); push(dns_rules, rule);
for (let rule in [ for (let rule in [
{ action: "reject", query_type: "HTTPS" }, { action: "reject", query_type: [ "HTTPS", "SVCB" ] },
{ action: "reject", domain_suffix: "use-application-dns.net" }, { action: "reject", domain_suffix: "use-application-dns.net" },
{ {
action: "route", action: "route",
+4 -2
View File
@@ -97,8 +97,10 @@ function config(settings, runtime) {
if (output_network_interface != "") if (output_network_interface != "")
result.default_interface = output_network_interface; result.default_interface = output_network_interface;
if (bool_option(settings, "disable_quic", false)) if (bool_option(settings, "disable_quic", false)) {
push(result.rules, { action: "reject", inbound: runtime_constants.TPROXY_INBOUND_TAG, protocol: "quic" }); push(result.rules, { action: "reject", network: "udp", port: [ 443 ] });
push(result.rules, { action: "reject", protocol: "quic" });
}
if (bool_option(settings, "isolate_p2p", false)) { if (bool_option(settings, "isolate_p2p", false)) {
push(result.rules, { protocol: "bittorrent", action: "route", outbound: runtime_constants.DIRECT_OUTBOUND_TAG }); push(result.rules, { protocol: "bittorrent", action: "route", outbound: runtime_constants.DIRECT_OUTBOUND_TAG });
for (let rule in p2p_direct_rules(settings)) for (let rule in p2p_direct_rules(settings))