使用 tun 的 `system` stack 时 safari 与 iOS 上使用 webkit 核的浏览器无法连接某些网站

[poscat0x04]

Operating system

iOS

System version

18.3.2

Installation type

sing-box for iOS Graphical Client

If you are using a graphical client, please provide the version of the client.

1.12-alpha.18

Description

在使用 tun 作为入站且使用 system stack 时 safari 与使用 webkit 核的 iOS Firefox, Chrome 无法连接某些网站（目前只观察到有 wiki.archlinux.org，但是不排除有其他网站）。当使用 mixed 或 gvisor stack 时症状消失。而且无论是在手机端还是路由器上（sing-box 版本 1.12-alpha.16, linux 版本 6.12.18）运行 sing-box，都会导致流量经过 sing-box tun 接口的 safari 出现此问题。

此问题在 macos 下也可以复现，但是 macos 下 safari 不停 spam reload 有概率能成功连接（iPhone 上成功连接概率比较小）。比较诡异的是我尝试用 wireshark 抓 utun 上的包但是开开 wireshark 后症状就消失了。

Reproduction

最小可复现配置，在两个平台上均可以使用：

{
  "log": {
    "level": "debug",
    "timestamp": false
  },
  "dns": {
    "final": "223",
    "strategy": "ipv4_only",
    "servers": [
      {
        "type": "udp",
        "server": "223.5.5.5",
        "detour": "direct",
        "tag": "223"
      }
    ]
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun",
      "auto_route": true,
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "interface_name": "tun0",
      "mtu": 1500,
      "stack": "system"
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "auto_detect_interface": true,
    "default_domain_resolver": "223",
    "final": "direct",
    "rules": [
      {
        "ip_cidr": [
          "172.19.0.2/32"
        ],
        "action": "hijack-dns"
      }
    ]
  }
}

启动 sing-box 后访问 https://wiki.archlinux.org

Logs

No significant log is seen, even with the debug level enabled.

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

[poscat0x04]

由 system stack 有问题但 mixed stack 没问题猜测和 HTTP3/QUIC 有关，但是使用 curl 做 http3 客户端（通过 http3-only flag）可以正常访问 archwiki。因此不确定是 safari 实现有 bug 还是 system stack 有 bug 还是两者都有。

[nekohasekai]

你能确认屏蔽 quic 之后是否还存在这个问题吗？

[poscat0x04]

safari 似乎没有提供直接关闭 quic 的办法，但是如果我直接通过

{
  "network": "udp",
  "port": 443,
  "action": "reject"
}

reject 掉所有 quic 流量之后是可以正常访问的.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days