Before795d1c289, nested rule-set evaluation reused the parent rule match cache. In practice, this meant these fields leaked across nested evaluation: - SourceAddressMatch - SourcePortMatch - DestinationAddressMatch - DestinationPortMatch - DidMatch That leak had two opposite effects. First, it made included rule-sets partially behave like the docs' "merged" semantics. For example, if an outer route rule had: rule_set = ["geosite-additional-!cn"] ip_cidr = 104.26.10.0/24 and the inline rule-set matched `domain_suffix = speedtest.net`, the inner match could set `DestinationAddressMatch = true` and the outer rule would then pass its destination-address group check. This is why some `rule_set + ip_cidr` combinations used to work. But the same leak also polluted sibling rules and sibling rule-sets. A branch could partially match one group, then fail later, and still leave that group cache set for the next branch. This broke cases such as gh-3485: with `rule_set = [test1, test2]`, `test1` could touch destination-address cache before an AdGuard `@@` exclusion made the whole branch fail, and `test2` would then run against dirty state.795d1c289fixed that by cloning metadata for nested rule-set/rule evaluation and resetting the rule match cache for each branch. That stopped sibling pollution, but it also removed the only mechanism by which a successful nested branch could affect the parent rule's grouped matching state. As a result, nested rule-sets became pure boolean sub-items against the outer rule. The previous example stopped working: the inner `domain_suffix = speedtest.net` still matched, but the outer rule no longer observed any destination-address-group success, so it fell through to `final`. This change makes the semantics explicit instead of relying on cache side effects: - `rule_set: ["a", "b"]` is OR - rules inside one rule-set are OR - each nested branch is evaluated in isolation - failed branches contribute no grouped match state - a successful branch contributes its grouped match state back to the parent rule - grouped state from different rule-sets must not be combined together to satisfy one outer rule In other words, rule-sets now behave as "OR branches whose successful group matches merge into the outer rule", which matches the documented intent without reintroducing cross-branch cache leakage.
234 lines
7.9 KiB
Go
234 lines
7.9 KiB
Go
package rule
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/sagernet/sing-box/adapter"
|
|
C "github.com/sagernet/sing-box/constant"
|
|
"github.com/sagernet/sing-box/option"
|
|
"github.com/sagernet/sing/common"
|
|
E "github.com/sagernet/sing/common/exceptions"
|
|
"github.com/sagernet/sing/service"
|
|
)
|
|
|
|
func NewHeadlessRule(ctx context.Context, options option.HeadlessRule) (adapter.HeadlessRule, error) {
|
|
switch options.Type {
|
|
case "", C.RuleTypeDefault:
|
|
if !options.DefaultOptions.IsValid() {
|
|
return nil, E.New("missing conditions")
|
|
}
|
|
return NewDefaultHeadlessRule(ctx, options.DefaultOptions)
|
|
case C.RuleTypeLogical:
|
|
if !options.LogicalOptions.IsValid() {
|
|
return nil, E.New("missing conditions")
|
|
}
|
|
return NewLogicalHeadlessRule(ctx, options.LogicalOptions)
|
|
default:
|
|
return nil, E.New("unknown rule type: ", options.Type)
|
|
}
|
|
}
|
|
|
|
var _ adapter.HeadlessRule = (*DefaultHeadlessRule)(nil)
|
|
|
|
type DefaultHeadlessRule struct {
|
|
abstractDefaultRule
|
|
}
|
|
|
|
func (r *DefaultHeadlessRule) matchStates(metadata *adapter.InboundContext) ruleMatchStateSet {
|
|
return r.abstractDefaultRule.matchStates(metadata)
|
|
}
|
|
|
|
func NewDefaultHeadlessRule(ctx context.Context, options option.DefaultHeadlessRule) (*DefaultHeadlessRule, error) {
|
|
networkManager := service.FromContext[adapter.NetworkManager](ctx)
|
|
rule := &DefaultHeadlessRule{
|
|
abstractDefaultRule{
|
|
invert: options.Invert,
|
|
},
|
|
}
|
|
if len(options.Network) > 0 {
|
|
item := NewNetworkItem(options.Network)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.Domain) > 0 || len(options.DomainSuffix) > 0 {
|
|
item, err := NewDomainItem(options.Domain, options.DomainSuffix)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
} else if options.DomainMatcher != nil {
|
|
item := NewRawDomainItem(options.DomainMatcher)
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.DomainKeyword) > 0 {
|
|
item := NewDomainKeywordItem(options.DomainKeyword)
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.DomainRegex) > 0 {
|
|
item, err := NewDomainRegexItem(options.DomainRegex)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "domain_regex")
|
|
}
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.SourceIPCIDR) > 0 {
|
|
item, err := NewIPCIDRItem(true, options.SourceIPCIDR)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "source_ip_cidr")
|
|
}
|
|
rule.sourceAddressItems = append(rule.sourceAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
} else if options.SourceIPSet != nil {
|
|
item := NewRawIPCIDRItem(true, options.SourceIPSet)
|
|
rule.sourceAddressItems = append(rule.sourceAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.IPCIDR) > 0 {
|
|
item, err := NewIPCIDRItem(false, options.IPCIDR)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "ipcidr")
|
|
}
|
|
rule.destinationIPCIDRItems = append(rule.destinationIPCIDRItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
} else if options.IPSet != nil {
|
|
item := NewRawIPCIDRItem(false, options.IPSet)
|
|
rule.destinationIPCIDRItems = append(rule.destinationIPCIDRItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.SourcePort) > 0 {
|
|
item := NewPortItem(true, options.SourcePort)
|
|
rule.sourcePortItems = append(rule.sourcePortItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.SourcePortRange) > 0 {
|
|
item, err := NewPortRangeItem(true, options.SourcePortRange)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "source_port_range")
|
|
}
|
|
rule.sourcePortItems = append(rule.sourcePortItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.Port) > 0 {
|
|
item := NewPortItem(false, options.Port)
|
|
rule.destinationPortItems = append(rule.destinationPortItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.PortRange) > 0 {
|
|
item, err := NewPortRangeItem(false, options.PortRange)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "port_range")
|
|
}
|
|
rule.destinationPortItems = append(rule.destinationPortItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.ProcessName) > 0 {
|
|
item := NewProcessItem(options.ProcessName)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.ProcessPath) > 0 {
|
|
item := NewProcessPathItem(options.ProcessPath)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.ProcessPathRegex) > 0 {
|
|
item, err := NewProcessPathRegexItem(options.ProcessPathRegex)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "process_path_regex")
|
|
}
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.PackageName) > 0 {
|
|
item := NewPackageNameItem(options.PackageName)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if networkManager != nil {
|
|
if len(options.NetworkType) > 0 {
|
|
item := NewNetworkTypeItem(networkManager, common.Map(options.NetworkType, option.InterfaceType.Build))
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if options.NetworkIsExpensive {
|
|
item := NewNetworkIsExpensiveItem(networkManager)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if options.NetworkIsConstrained {
|
|
item := NewNetworkIsConstrainedItem(networkManager)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.WIFISSID) > 0 {
|
|
item := NewWIFISSIDItem(networkManager, options.WIFISSID)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.WIFIBSSID) > 0 {
|
|
item := NewWIFIBSSIDItem(networkManager, options.WIFIBSSID)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if options.NetworkInterfaceAddress != nil && options.NetworkInterfaceAddress.Size() > 0 {
|
|
item := NewNetworkInterfaceAddressItem(networkManager, options.NetworkInterfaceAddress)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
if len(options.DefaultInterfaceAddress) > 0 {
|
|
item := NewDefaultInterfaceAddressItem(networkManager, options.DefaultInterfaceAddress)
|
|
rule.items = append(rule.items, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
}
|
|
if len(options.AdGuardDomain) > 0 {
|
|
item := NewAdGuardDomainItem(options.AdGuardDomain)
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
} else if options.AdGuardDomainMatcher != nil {
|
|
item := NewRawAdGuardDomainItem(options.AdGuardDomainMatcher)
|
|
rule.destinationAddressItems = append(rule.destinationAddressItems, item)
|
|
rule.allItems = append(rule.allItems, item)
|
|
}
|
|
return rule, nil
|
|
}
|
|
|
|
var _ adapter.HeadlessRule = (*LogicalHeadlessRule)(nil)
|
|
|
|
type LogicalHeadlessRule struct {
|
|
abstractLogicalRule
|
|
}
|
|
|
|
func (r *LogicalHeadlessRule) matchStates(metadata *adapter.InboundContext) ruleMatchStateSet {
|
|
return r.abstractLogicalRule.matchStates(metadata)
|
|
}
|
|
|
|
func NewLogicalHeadlessRule(ctx context.Context, options option.LogicalHeadlessRule) (*LogicalHeadlessRule, error) {
|
|
r := &LogicalHeadlessRule{
|
|
abstractLogicalRule{
|
|
rules: make([]adapter.HeadlessRule, len(options.Rules)),
|
|
invert: options.Invert,
|
|
},
|
|
}
|
|
switch options.Mode {
|
|
case C.LogicalTypeAnd:
|
|
r.mode = C.LogicalTypeAnd
|
|
case C.LogicalTypeOr:
|
|
r.mode = C.LogicalTypeOr
|
|
default:
|
|
return nil, E.New("unknown logical mode: ", options.Mode)
|
|
}
|
|
for i, subRule := range options.Rules {
|
|
rule, err := NewHeadlessRule(ctx, subRule)
|
|
if err != nil {
|
|
return nil, E.Cause(err, "sub rule[", i, "]")
|
|
}
|
|
r.rules[i] = rule
|
|
}
|
|
return r, nil
|
|
}
|