SagerNet / SagerNet/sing-box

Incorrect Wi-Fi SSID detection on the latest macOS

Open
#2,609 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
38.2k
Forks
4.6k
Avg merge
19d 15h
Merged PRs (30d)
1

Description

Operating system

macOS

System version

15.3.1 (24D70)

Installation type

sing-box for macOS Graphical Client

If you are using a graphical client, please provide the version of the client.

SFM Version 1.12.0-alpha.9

Version
Description

The SSID matching doesn't work in the latest SFM alpha app (in all the 1.12.0 alphas actually). I believe, the app sees only "" as SSID, so all the related rules do not work.

Reproduction

Client config:

{
  "inbounds": [
    {
      "type": "tun",
      "tag": "in-tun",
      "address": "172.16.0.1/30",
      "auto_route": true,
      "strict_route": false,
      "sniff": true,
      "sniff_override_destination": true,
    }
  ],
  "dns": {
    "servers": [
      {
        "tag": "dns-one",
        "type": "udp",
        "server": "8.8.8.8",
        "detour": "direct"
      },
      {
        "tag": "dns-two",
        "type": "udp",
        "server": "1.1.1.1",
        "detour": "direct"
      }
    ],
    "rules": [
      {
        "wifi_ssid": "MY_SSID",
        "invert": true,
        "action": "route",
        "server": "dns-one"
      }
    ],
    "final": "dns-two"
  },
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      }
    ]
  }
}
Expected behavior

When I'm not connected to MY_SSID Wi-Fi network, I expect all the DNS requests to be routed to dns-one DNS server, and to the dns-two server othervise.

Actual behavior

Even when I am connected to MY_SSID Wi-Fi network, all the requests are routed to the dns-one DNS server.

Logs
+0300 2025-02-18 20:34:47 INFO network: updated available networks: en0 (wifi)
+0300 2025-02-18 20:34:47 INFO network: updated default interface en0, index 11, type wifi
+0300 2025-02-18 20:34:48 INFO inbound/tun[in-tun]: started at utun4
+0300 2025-02-18 20:34:48 INFO [1092883874 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:59970
+0300 2025-02-18 20:34:48 INFO [3829112893 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:49878
+0300 2025-02-18 20:34:48 INFO [25880730 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:50361
+0300 2025-02-18 20:34:48 INFO [25880730 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [25880730 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [25880730 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [4027863450 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:59889
+0300 2025-02-18 20:34:48 INFO [4027863450 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [4027863450 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [4027863450 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1524605068 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:50868
+0300 2025-02-18 20:34:48 INFO [1524605068 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 INFO [3807424431 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:60548
+0300 2025-02-18 20:34:48 DEBUG [1524605068 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 INFO [3807424431 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 INFO [2660328071 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:64705
+0300 2025-02-18 20:34:48 INFO [2660328071 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [2660328071 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [2660328071 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [73375215 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:61976
+0300 2025-02-18 20:34:48 INFO [73375215 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [73375215 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [73375215 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1092883874 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1092883874 1ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1092883874 1ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 DEBUG [3807424431 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [3807424431 1ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 DEBUG [1524605068 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1875851802 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:52681
+0300 2025-02-18 20:34:48 INFO [1875851802 1ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1875851802 1ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1875851802 1ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [3829112893 1ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [3829112893 1ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [3829112893 1ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO sing-box started (0.122s)
+0300 2025-02-18 20:34:48 INFO [1553738614 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:60151
+0300 2025-02-18 20:34:48 INFO [1553738614 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1553738614 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1553738614 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [3694459768 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:56703
+0300 2025-02-18 20:34:48 INFO [3694459768 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [3694459768 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [3694459768 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [2087485650 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:51344
+0300 2025-02-18 20:34:48 INFO [2087485650 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [2087485650 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [2087485650 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [665108768 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:64026
+0300 2025-02-18 20:34:48 INFO [665108768 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [665108768 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [665108768 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1054520473 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:64852
+0300 2025-02-18 20:34:48 INFO [1054520473 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1054520473 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1054520473 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1938656667 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:61937
+0300 2025-02-18 20:34:48 INFO [1938656667 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1938656667 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1938656667 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [2340544013 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:50991
+0300 2025-02-18 20:34:48 INFO [2340544013 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [2340544013 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [2340544013 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [4285783007 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:60194
+0300 2025-02-18 20:34:48 INFO [4285783007 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [4285783007 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [4285783007 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 INFO [1552471544 0ms] inbound/tun[in-tun]: inbound packet connection from 172.16.0.1:64887
+0300 2025-02-18 20:34:48 INFO [1552471544 0ms] inbound/tun[in-tun]: inbound packet connection to 172.16.0.2:53
+0300 2025-02-18 20:34:48 DEBUG [1552471544 0ms] router: sniffed packet protocol: dns
+0300 2025-02-18 20:34:48 DEBUG [1552471544 0ms] router: match[0] => sniff
+0300 2025-02-18 20:34:48 DEBUG [2660328071 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [25880730 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [3829112893 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [1524605068 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [2660328071 301ms] dns: exchange 120.0.168.192.in-addr.arpa. IN PTR
+0300 2025-02-18 20:34:48 DEBUG [3807424431 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [4027863450 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [1875851802 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [3829112893 301ms] dns: exchange _dns.resolver.arpa. IN SVCB
+0300 2025-02-18 20:34:48 DEBUG [3807424431 301ms] dns: exchange b._dns-sd._udp.0.0.16.172.in-addr.arpa. IN PTR
+0300 2025-02-18 20:34:48 DEBUG [25880730 301ms] dns: exchange 1.0.16.172.in-addr.arpa. IN PTR
+0300 2025-02-18 20:34:48 DEBUG [1524605068 301ms] dns: exchange db._dns-sd._udp.0.0.16.172.in-addr.arpa. IN PTR
+0300 2025-02-18 20:34:48 DEBUG [1092883874 301ms] router: match[1] protocol=dns => hijack-dns
+0300 2025-02-18 20:34:48 DEBUG [2660328071 301ms] dns: match[1] !(wifi_ssid=MY_SSID) => route(dns-one)
Supporter
Integrity requirements
  • I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
  • I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
  • I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
  • I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the provided SFM Version 1.12.0-alpha.9 configuration and logs, then trace the wifi_ssid rule matching and macOS Wi-Fi detection path. Done means SSID matching distinguishes being connected to MY_SSID from being connected to another or no Wi-Fi network, routing DNS requests to the expected server in each case.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, macos
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.