Skip to content

Address overriding not working with resolve action and domain destinations #2895

Closed
Closed
Address overriding not working with resolve action and domain destinations#2895
Labels
bugSomething isn't working
Milestone
1.11 Next

Description

@mazzz1y
mazzz1y
opened on Apr 21, 2025

Operating system

Linux

System version

Linux xxx 6.14.3-arch1-1 #1 SMP PREEMPT_DYNAMIC Sun, 20 Apr 2025 12:38:52 +0000 x86_64 GNU/Linux

Installation type

Original sing-box Command Line

Version

sing-box version 1.11.8

Environment: go1.24.2 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_ech,with_utls,with_reality_server,with_acme,with_clash_api
Revision: 49498f643926c6f109f918f148c533298b4c8352
CGO: disabled

Description

Address overriding is not working after resolve action if the origin destination is a domain.

This causes a connection leak to the non-overridden address, which isn't expected.

I expect the destination will be overwritten regardless of whether the origin destination is a domain or an IP.

In 1.10, everything works as expected with direct detours.

Reproduction

config.json 
{
"log": {
  "disabled": false,
  "level": "debug"
},
"dns": {
  "servers": [
    {
      "address": "1.1.1.1"
    }
  ]
},
"inbounds": [
  {
    "type": "mixed",
    "tag": "mixed-in",
    "listen": "::",
    "listen_port": 10888
  }
],
"outbounds": [
  {
    "type": "direct",
    "tag": "direct-out"
  }
],
"route": {
  "auto_detect_interface": true,
  "final": "direct-out",
  "rules": [
    {
      "action": "resolve",
      "strategy": "prefer_ipv4"
    },
    {
      "override_address": "127.0.0.1",
      "outbound": "direct-out"
    }
  ]
}
}
~ docker run --net=host -v $PWD/config.json:/config.json -it ghcr.io/sagernet/sing-box:v1.11.8 -c /config.json run
~ curl -x 127.0.0.1:10888 http://example.com # destination should be overwritten to 127.0.0.1, but connection goes direct to example.com

<!doctype html>
<html>
<head>
    <title>Example Domain</title>
...

Logs

INFO[0000] network: updated default interface wlp1s0, index 2
INFO[0000] inbound/mixed[mixed-in]: tcp server started at [::]:10888
INFO[0000] sing-box started (0.00s)
INFO[0002] [734407884 0ms] inbound/mixed[mixed-in]: inbound connection from 127.0.0.1:39400
INFO[0002] [734407884 0ms] inbound/mixed[mixed-in]: inbound connection to example.com:80
DEBUG[0002] [734407884 0ms] router: match[0] => resolve(prefer_ipv4)
DEBUG[0002] [734407884 0ms] dns: lookup domain example.com
INFO[0002] [734407884 0ms] outbound/direct[direct-out]: outbound packet connection to 1.1.1.1:53
DEBUG[0002] [734407884 48ms] dns: exchanged example.com NOERROR 136
DEBUG[0002] [734407884 48ms] dns: exchanged example.com NOERROR 159
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 23.192.228.84
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 23.215.0.136
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 23.192.228.80
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 23.215.0.138
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 96.7.128.175
INFO[0002] [734407884 48ms] dns: exchanged A example.com. 159 IN A 96.7.128.198
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1408:ec00:36::1736:7f24
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1406:3a00:21::173e:2e65
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1406:bc00:53::b81e:94ce
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1408:ec00:36::1736:7f31
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1406:bc00:53::b81e:94c8
INFO[0002] [734407884 48ms] dns: exchanged AAAA example.com. 136 IN AAAA 2600:1406:3a00:21::173e:2e66
INFO[0002] [734407884 48ms] dns: lookup succeed for example.com: 23.192.228.84 23.215.0.136 23.192.228.80 23.215.0.138 96.7.128.175 96.7.128.198 2600:1408:ec00:36::1736:7f24 2600:1406:3a00:21::173e:2e65 2600:1406:bc00:53::b81e:94ce 2600:1408:ec00:36::1736:7f31 2600:1406:bc00:53::b81e:94c8 2600:1406:3a00:21::173e:2e66
DEBUG[0002] [734407884 48ms] dns: resolved [23.192.228.84 23.215.0.136 23.192.228.80 23.215.0.138 96.7.128.175 96.7.128.198 2600:1408:ec00:36::1736:7f24 2600:1406:3a00:21::173e:2e65 2600:1406:bc00:53::b81e:94ce 2600:1408:ec00:36::1736:7f31 2600:1406:bc00:53::b81e:94c8 2600:1406:3a00:21::173e:2e66]
DEBUG[0002] [734407884 48ms] router: match[1] => route(direct-out)
INFO[0002] [734407884 48ms] outbound/direct[direct-out]: outbound connection to 127.0.0.1:80
DEBUG[0002] [734407884 508ms] connection: connection upload finished
DEBUG[0002] [734407884 508ms] inbound/mixed[mixed-in]: connection closed: read http request: EOF
DEBUG[0002] [734407884 735ms] connection: connection download finished

Supporter

Integrity requirements

  • I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
  • I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
  • I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
  • I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions