0.9.7 (Router-generated traffic + large list import fixes)
• Fixed: traffic generated by the router itself (wget, opkg, some apps) was
not proxied and hung on proxied domains. dnsmasq hands the router its own
FakeIP answers (github.com -> 198.18.0.15), but mangle_output carried no
marking rules at all, so those connections were never tproxied and went
into a black hole. mangle_output now applies the same
destination-selective marking as the prerouting chain - proxied subnets,
the FakeIP range (IPv4 and IPv6) and DoH CIDRs when DoH blocking is on;
with a global_proxy section it marks all tcp/udp. The local/loopback and
sing-box-egress (0x00200000) returns stay FIRST, so sing-box's own traffic
never loops back into tproxy. Both chains are now generated by one shared
helper, so they can't drift apart again. Reported on 0.9.6.
✅ verified in the OpenWrt test container - a router-originated packet to
198.18.0.0/15 now gets marked (live counter proof), the tproxy inbound
accepts it, and sing-box egress escapes via the outbound mark.
• Fixed: importing large plain domain / subnet lists could fail with
"argument list too long". The chunked importers now patch the ruleset in
1000-element chunks instead of 5000 (ported from upstream podkop).
Run /etc/init.d/netshift restart after updating so the new nft rules are
installed (or just reboot).
