Add configurable DNS strategy

tests/config_validator_runtime.sh

@@ -64,6 +64,7 @@ cat >"$WORK_DIR/valid.json" <<'JSON'
     "dns_check_interval": "10s",
     "dns_recovery_check_interval": "60s",
     "dns_check_timeout": "2s",
+    "dns_strategy": "prefer_ipv6",
     "dns_detour_enabled": "1",
     "dns_detour_section": "proxy",
     "download_lists_via_proxy": "1",
@@ -161,6 +162,18 @@ cat >"$WORK_DIR/bad-dns-server.json" <<'JSON'
 JSON
 assert_rejects "bad DNS server" "$WORK_DIR/bad-dns-server.json" "Invalid main DNS server"
 
+cat >"$WORK_DIR/bad-dns-strategy.json" <<'JSON'
+{
+  "settings": {
+    ".name": "settings",
+    ".type": "settings",
+    "dns_strategy": "auto"
+  },
+  "section": []
+}
+JSON
+assert_rejects "bad DNS strategy" "$WORK_DIR/bad-dns-strategy.json" "Unsupported DNS strategy 'auto'"
+
 cat >"$WORK_DIR/empty-main-dns.json" <<'JSON'
 {
   "settings": {

tests/runtime_state_predicates.sh

@@ -285,6 +285,7 @@ cat >"$WORK_DIR/sing-box-signature.json" <<'JSON'
 {
   "settings": {
     "dns_type": "tcp",
+    "dns_strategy": "prefer_ipv6",
     "dns_server": "9.9.9.9",
     "bootstrap_dns_server": "1.0.0.1",
     "dns_rewrite_ttl": "120",
@@ -404,6 +405,8 @@ JSON
 cat >"$WORK_DIR/sing-box-signature.expected" <<'EOF_SING_BOX_SIG'
 [settings.dns_type]
 tcp
+[settings.dns_strategy]
+prefer_ipv6
 [settings.dns_server]
 9.9.9.9
 [settings.bootstrap_dns_server]

tests/sing_box_runtime.sh

@@ -242,6 +242,7 @@ cat >"$WORK_DIR/runtime-matchers-fixture.json" <<'JSON'
     ".type": "settings",
     "config_path": "/tmp/sing-box/config.json",
     "dns_server": "1.1.1.1",
+    "dns_strategy": "prefer_ipv6",
     "service_listen_address": "127.0.0.1"
   },
   "section": [
@@ -784,6 +785,7 @@ assert(route_rule(disabled, r => r.action == "resolve" && r.server == "dns-serve
 
 let defaults = cfg("default");
 assert(first_remote_ruleset(defaults).update_interval == "1d", "default list update interval");
+assert(defaults.dns.strategy == "prefer_ipv4", "missing DNS strategy keeps the prefer_ipv4 default");
 
 let server = cfg("server");
 let socks = inbound(server, "server-edge-in");
@@ -792,10 +794,11 @@ assert(socks.users && socks.users[0].username == "tester", "server socks auth");
 assert(route_rule(server, r => r.inbound == "server-edge-in" && r.outbound == "direct-out") != null, "server direct route");
 
 let matchers = cfg("matchers");
-assert(matchers.dns.strategy == "prefer_ipv4", "DNS strategy allows IPv6 answers");
+assert(matchers.dns.strategy == "prefer_ipv6", "configured DNS strategy is generated");
 assert(dns_server(matchers, r => r.tag == "fakeip-server" && r.inet6_range == "fc00::/18") != null, "FakeIP IPv6 range");
 assert(inbound(matchers, "tproxy6-in") != null, "IPv6 TProxy inbound");
 assert(inbound(matchers, "tproxy6-in").listen == "::1", "IPv6 TProxy listen address");
+assert(route_rule(matchers, r => r.action == "reject" && r.ip_version == 6) == null, "IPv6 traffic is not rejected globally");
 assert(outbound(matchers, "bypass-out").type == "direct", "bypass fallback outbound");
 assert(outbound(matchers, "proxy-1-out").detour == "detour-out", "connection URL outbound detour");
 let mixed = inbound(matchers, "proxy-mixed-in");