d454aa0fdf
Before795d1c289, nested rule-set evaluation reused the parent rule match cache. In practice, this meant these fields leaked across nested evaluation: - SourceAddressMatch - SourcePortMatch - DestinationAddressMatch - DestinationPortMatch - DidMatch That leak had two opposite effects. First, it made included rule-sets partially behave like the docs' "merged" semantics. For example, if an outer route rule had: rule_set = ["geosite-additional-!cn"] ip_cidr = 104.26.10.0/24 and the inline rule-set matched `domain_suffix = speedtest.net`, the inner match could set `DestinationAddressMatch = true` and the outer rule would then pass its destination-address group check. This is why some `rule_set + ip_cidr` combinations used to work. But the same leak also polluted sibling rules and sibling rule-sets. A branch could partially match one group, then fail later, and still leave that group cache set for the next branch. This broke cases such as gh-3485: with `rule_set = [test1, test2]`, `test1` could touch destination-address cache before an AdGuard `@@` exclusion made the whole branch fail, and `test2` would then run against dirty state.795d1c289fixed that by cloning metadata for nested rule-set/rule evaluation and resetting the rule match cache for each branch. That stopped sibling pollution, but it also removed the only mechanism by which a successful nested branch could affect the parent rule's grouped matching state. As a result, nested rule-sets became pure boolean sub-items against the outer rule. The previous example stopped working: the inner `domain_suffix = speedtest.net` still matched, but the outer rule no longer observed any destination-address-group success, so it fell through to `final`. This change makes the semantics explicit instead of relying on cache side effects: - `rule_set: ["a", "b"]` is OR - rules inside one rule-set are OR - each nested branch is evaluated in isolation - failed branches contribute no grouped match state - a successful branch contributes its grouped match state back to the parent rule - grouped state from different rule-sets must not be combined together to satisfy one outer rule In other words, rule-sets now behave as "OR branches whose successful group matches merge into the outer rule", which matches the documented intent without reintroducing cross-branch cache leakage.
75 lines
1.9 KiB
Go
75 lines
1.9 KiB
Go
package rule
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/sagernet/sing-box/adapter"
|
|
"github.com/sagernet/sing/common"
|
|
E "github.com/sagernet/sing/common/exceptions"
|
|
F "github.com/sagernet/sing/common/format"
|
|
)
|
|
|
|
var _ RuleItem = (*RuleSetItem)(nil)
|
|
|
|
type RuleSetItem struct {
|
|
router adapter.Router
|
|
tagList []string
|
|
setList []adapter.RuleSet
|
|
ipCidrMatchSource bool
|
|
ipCidrAcceptEmpty bool
|
|
}
|
|
|
|
func NewRuleSetItem(router adapter.Router, tagList []string, ipCIDRMatchSource bool, ipCidrAcceptEmpty bool) *RuleSetItem {
|
|
return &RuleSetItem{
|
|
router: router,
|
|
tagList: tagList,
|
|
ipCidrMatchSource: ipCIDRMatchSource,
|
|
ipCidrAcceptEmpty: ipCidrAcceptEmpty,
|
|
}
|
|
}
|
|
|
|
func (r *RuleSetItem) Start() error {
|
|
for _, tag := range r.tagList {
|
|
ruleSet, loaded := r.router.RuleSet(tag)
|
|
if !loaded {
|
|
return E.New("rule-set not found: ", tag)
|
|
}
|
|
ruleSet.IncRef()
|
|
r.setList = append(r.setList, ruleSet)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (r *RuleSetItem) Match(metadata *adapter.InboundContext) bool {
|
|
return !r.matchStates(metadata).isEmpty()
|
|
}
|
|
|
|
func (r *RuleSetItem) matchStates(metadata *adapter.InboundContext) ruleMatchStateSet {
|
|
var stateSet ruleMatchStateSet
|
|
for _, ruleSet := range r.setList {
|
|
nestedMetadata := *metadata
|
|
nestedMetadata.ResetRuleMatchCache()
|
|
nestedMetadata.IPCIDRMatchSource = r.ipCidrMatchSource
|
|
nestedMetadata.IPCIDRAcceptEmpty = r.ipCidrAcceptEmpty
|
|
stateSet = stateSet.merge(matchHeadlessRuleStates(ruleSet, &nestedMetadata))
|
|
}
|
|
return stateSet
|
|
}
|
|
|
|
func (r *RuleSetItem) ContainsDestinationIPCIDRRule() bool {
|
|
if r.ipCidrMatchSource {
|
|
return false
|
|
}
|
|
return common.Any(r.setList, func(ruleSet adapter.RuleSet) bool {
|
|
return ruleSet.Metadata().ContainsIPCIDRRule
|
|
})
|
|
}
|
|
|
|
func (r *RuleSetItem) String() string {
|
|
if len(r.tagList) == 1 {
|
|
return F.ToString("rule_set=", r.tagList[0])
|
|
} else {
|
|
return F.ToString("rule_set=[", strings.Join(r.tagList, " "), "]")
|
|
}
|
|
}
|