default_domain_resolver 使 DNS rules 分流失效

[mkbka]

Operating system

Windows

System version

Windows 11 26200.7171

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.12.13

Environment: go1.25.5 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale
Revision: f0cd3422c11fb44e635d72a8d18ee81c26e78bad
CGO: disabled

Description

在 dns/router.go 处，options.Transport 总不为 nil ，一直使用默认 adapter.DNSTransport 进行请求，所以不会进入 dns.Router.matchDNS 进行分流。

sing-box/dns/router.go

Lines 351 to 375 in f56d9ab

	if options.Transport != nil {
	transport := options.Transport
	if legacyTransport, isLegacy := transport.(adapter.LegacyDNSTransport); isLegacy {
	if options.Strategy == C.DomainStrategyAsIS {
	options.Strategy = r.defaultDomainStrategy
	}
	if !options.ClientSubnet.IsValid() {
	options.ClientSubnet = legacyTransport.LegacyClientSubnet()
	}
	}
	if options.Strategy == C.DomainStrategyAsIS {
	options.Strategy = r.defaultDomainStrategy
	}
	responseAddrs, err = r.client.Lookup(ctx, transport, domain, options, nil)
	} else {
	var (
	transport adapter.DNSTransport
	rule adapter.DNSRule
	ruleIndex int
	)
	ruleIndex = -1
	for {
	dnsCtx := adapter.OverrideContext(ctx)
	dnsOptions := options
	transport, rule, ruleIndex = r.matchDNS(ctx, false, ruleIndex, true, &dnsOptions)

在 direct outbound 初始化时，

https://github.com/SagerNet/sing-box/blob/f56d9ab94569d46a48bfc2bcd97eea566ad365c8/common/dialer/dialer.go#L100-107

dnsQueryOptions 会被赋值默认的 transport ，因此上述 options.Transport 总不为 nil ，此 outbound 总会使用默认 dns 进行请求，而不是 match rule

Reproduction

1. sing-box run -c test.conf
2. env HTTPS_PROXY=http://127.1:10900 curl -v https://bilibili.com
3. 在日志中观察到对 1.1.1.1 的请求

test.conf:

{
  "log": {
    "level": "debug"
  },
  "dns": {
    "servers": [
      {
        "tag": "cf-dns",
        "type": "tcp",
        "server": "1.1.1.1",
        "detour": "proxy"
      },
      {
        "tag": "local",
        "type": "udp",
        "server": "223.5.5.5"
      }
    ],
    "rules": [
      {
        "rule_set": [
          "geosite-category-ads-all"
        ],
        "action": "reject"
      },
      {
        "rule_set": [
          "geosite-cn"
        ],
        "server": "local"
      }
    ],
    "final": "cf-dns",
    "client_subnet": "223.5.5.0/24"
  },
  "inbounds": [
    {
      "type": "mixed",
      "listen": "127.0.0.1",
      "listen_port": 10900
    }
  ],
  "outbounds": [
    {
      "type": "hysteria2",
      "tag": "proxy",
      "server": "example.com",
      "server_port": 443,
      "up_mbps": 100,
      "down_mbps": 100,
      "tls": {
        "enabled": true,
        "server_name": "example.com",
        "insecure": true
      },
      "password": "example.com"
    },
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geoip-cn",
          "geosite-private"
        ],
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-category-ads-all"
        ],
        "action": "reject"
      }
    ],
    "rule_set": [
      {
        "tag": "geosite-cn",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
        "download_detour": "proxy"
      },
      {
        "tag": "geoip-cn",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
        "download_detour": "proxy"
      },
      {
        "tag": "geosite-private",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-private.srs",
        "download_detour": "proxy"
      },
      {
        "tag": "geosite-category-ads-all",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs",
        "download_detour": "proxy"
      },
      {
        "tag": "geosite-cnbeta",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cnbeta.srs",
        "download_detour": "proxy"
      }
    ],
    "auto_detect_interface": true,
    "default_domain_resolver": {
      "server": "cf-dns",
      "client_subnet": "223.5.5.0/24"
    }
  },
  "experimental": {
    "cache_file": {
      "enabled": true
    }
  }
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

[daminit]

See: https://sing-box.sagernet.org/configuration/route/rule_action/#resolve

And #3596