hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(singbox): fix p2p isolation rule matching for transport network and port directions

Browse Source
This commit is contained in:
Dushnilin
2026-09-17 18:17:44 +03:00
parent b556f2539b
commit e2c90ed6ea
8 changed files with 707 additions and 659 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fe-app-tachyon/locales/calls.json
+208 -208
View File
File diff suppressed because it is too large Load Diff
fe-app-tachyon/locales/tachyon.pot
+210 -210
View File
File diff suppressed because it is too large Load Diff
fe-app-tachyon/locales/tachyon.ru.po
+2 -2
View File
@@ -7,8 +7,8 @@ msgid ""
msgstr ""
"Project-Id-Version: TACHYON\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2026-09-17 18:04+0300\n"
"PO-Revision-Date: 2026-09-17 18:04+0300\n"
"POT-Creation-Date: 2026-09-17 18:17+0300\n"
"PO-Revision-Date: 2026-09-17 18:17+0300\n"
"Last-Translator: Dushnilin\n"
"Language-Team: none\n"
"Language: ru\n"
luci-app-tachyon/htdocs/luci-static/resources/view/tachyon/settings.js
+5 -2
View File
@@ -2175,13 +2175,16 @@ function createSettingsContent(section, capabilities) {
const entries = value.split(",");
for (const entry of entries) {
if (!/^(tcp|udp)(:[0-9]{1,5}(-[0-9]{1,5})?)?$/.test(entry.trim())) {
const trimmed = entry.trim();
if (!/^((tcp|udp):)?[0-9]{1,5}(-[0-9]{1,5})?$|^(tcp|udp)$/.test(trimmed)) {
return _(
'Each entry must be "proto", "proto:port" or "proto:port-port" (tcp/udp), e.g. tcp:6881,udp:6881-6889',
);
}
const portSpec = entry.split(":")[1];
const portSpec = trimmed.includes(":")
? trimmed.split(":")[1]
: (/^[0-9]/.test(trimmed) ? trimmed : null);
if (!portSpec) {
continue;
}
luci-app-tachyon/po/ru/tachyon.po
+2 -2
View File
@@ -7,8 +7,8 @@ msgid ""
msgstr ""
"Project-Id-Version: TACHYON\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2026-09-17 18:04+0300\n"
"PO-Revision-Date: 2026-09-17 18:04+0300\n"
"POT-Creation-Date: 2026-09-17 18:17+0300\n"
"PO-Revision-Date: 2026-09-17 18:17+0300\n"
"Last-Translator: Dushnilin\n"
"Language-Team: none\n"
"Language: ru\n"
luci-app-tachyon/po/templates/tachyon.pot
+210 -210
View File
File diff suppressed because it is too large Load Diff
tachyon/files/usr/lib/singbox/route.uc
+59 -19
View File
@@ -18,45 +18,83 @@ function normalize_port_entry(value) {
}
// P2P leak protection can be pinned down to the torrent client's own ports so
// nothing sneaks past the protocol sniffer. Each entry is "proto" or
// "proto:port" or "proto:port-port" (tcp/udp, comma separated). Without a
// port the whole protocol is routed direct.
// nothing sneaks past the protocol sniffer. Each entry is:
// "port", "port-port", "proto", "proto:port" or "proto:port-port" (tcp/udp, comma separated).
// Without a port the whole protocol is routed direct.
function p2p_direct_rules(settings) {
let rules = [];
for (let entry in split(option(settings, "p2p_ports", ""), ",")) {
entry = trim(entry);
if (entry == "")
continue;
let proto = "tcp";
let proto = "both";
let port_spec = "";
let colon = index(entry, ":");
if (colon >= 0) {
proto = trim(substr(entry, 0, colon));
let p = lc(trim(substr(entry, 0, colon)));
if (p == "tcp" || p == "udp") {
proto = p;
port_spec = trim(substr(entry, colon + 1));
} else {
proto = entry;
}
if (proto != "tcp" && proto != "udp")
continue;
let rule = { protocol: [ proto ], action: "route", outbound: runtime_constants.DIRECT_OUTBOUND_TAG };
}
} else {
let p = lc(entry);
if (p == "tcp" || p == "udp") {
proto = p;
port_spec = "";
} else {
proto = "both";
port_spec = entry;
}
}
let networks = proto == "both" ? [ "tcp", "udp" ] : [ proto ];
if (port_spec != "") {
let dash = index(port_spec, "-");
if (dash >= 0) {
let start = normalize_port_entry(substr(port_spec, 0, dash));
let end = normalize_port_entry(substr(port_spec, dash + 1));
if (start != null && end != null && start <= end)
rule.source_port_range = [ sprintf("%d:%d", start, end) ];
else
continue;
if (start != null && end != null && start <= end) {
let range_str = sprintf("%d:%d", start, end);
push(rules, {
network: networks,
source_port_range: [ range_str ],
action: "route",
outbound: runtime_constants.DIRECT_OUTBOUND_TAG
});
push(rules, {
network: networks,
port_range: [ range_str ],
action: "route",
outbound: runtime_constants.DIRECT_OUTBOUND_TAG
});
}
} else {
let port = normalize_port_entry(port_spec);
if (port != null)
rule.source_port = port;
else
continue;
if (port != null) {
push(rules, {
network: networks,
source_port: port,
action: "route",
outbound: runtime_constants.DIRECT_OUTBOUND_TAG
});
push(rules, {
network: networks,
port: [ port ],
action: "route",
outbound: runtime_constants.DIRECT_OUTBOUND_TAG
});
}
}
push(rules, rule);
} else {
push(rules, {
network: networks,
action: "route",
outbound: runtime_constants.DIRECT_OUTBOUND_TAG
});
}
}
return rules;
}
@@ -175,5 +213,7 @@ return {
config,
target,
has_resolve_matchers,
resolve_rule_for_section
resolve_rule_for_section,
p2p_direct_rules,
normalize_port_entry
};
tests/sing_box_runtime.sh
+10 -5
View File
@@ -653,7 +653,7 @@ cat >"$WORK_DIR/p2p-isolate-fixture.json" <<'JSON'
"dns_server": "1.1.1.1",
"service_listen_address": "127.0.0.1",
"isolate_p2p": "1",
"p2p_ports": "tcp:6881,udp:6881-6889,udp"
"p2p_ports": "tcp:6881,udp:6881-6889,udp,51413"
},
"section": [
{
@@ -662,7 +662,8 @@ cat >"$WORK_DIR/p2p-isolate-fixture.json" <<'JSON'
"enabled": "1",
"action": "outbound",
"outbound_json": "{\"type\":\"direct\"}",
"domain_suffix": [ "example.org" ]
"domain_suffix": [ "example.org" ],
"excluded_protocol": [ "bittorrent" ]
}
]
}
@@ -1413,9 +1414,13 @@ assert(mwan3_pinned.route.default_interface == "wan2", "mwan3 pinned interface i
let p2p_isolate = cfg("p2p-isolate");
assert(route_rule(p2p_isolate, r => contains(r.protocol, "bittorrent") && r.outbound == "direct-out") != null, "p2p isolation sniffer rule");
assert(route_rule(p2p_isolate, r => contains(r.protocol, "tcp") && r.source_port == 6881 && r.outbound == "direct-out") != null, "p2p client tcp port rule");
assert(route_rule(p2p_isolate, r => contains(r.protocol, "udp") && contains(r.source_port_range, "6881:6889") && r.outbound == "direct-out") != null, "p2p client udp port range rule");
assert(route_rule(p2p_isolate, r => contains(r.protocol, "udp") && r.source_port == null && r.source_port_range == null && r.outbound == "direct-out") != null, "p2p protocol-wide direct rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "tcp") && r.source_port == 6881 && r.outbound == "direct-out") != null, "p2p client tcp source port rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "tcp") && contains(r.port, 6881) && r.outbound == "direct-out") != null, "p2p client tcp dest port rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "udp") && contains(r.source_port_range, "6881:6889") && r.outbound == "direct-out") != null, "p2p client udp source port range rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "udp") && contains(r.port_range, "6881:6889") && r.outbound == "direct-out") != null, "p2p client udp dest port range rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "udp") && r.source_port == null && r.port == null && r.source_port_range == null && r.port_range == null && r.outbound == "direct-out") != null, "p2p protocol-wide direct rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "tcp") && contains(r.network, "udp") && r.source_port == 51413 && r.outbound == "direct-out") != null, "p2p plain port source rule");
assert(route_rule(p2p_isolate, r => contains(r.network, "tcp") && contains(r.network, "udp") && contains(r.port, 51413) && r.outbound == "direct-out") != null, "p2p plain port dest rule");
let lists = cfg("domain-ip-rulesets");
assert(no_internal_fields(lists), "internal runtime fields stripped from generated config");