Android power save mode changes terminating all TCP connections

Operating system

Android

System version

16

Installation type

sing-box for Android Graphical Client

If you are using a graphical client, please provide the version of the client.

effects multiple versions, more clarification in description

Version

Description

First of all thank you all for such a flexible proxy/vpn solution that satisfies such diverse needs.

I noticed that TCP connections are being terminated due to power saving mode change of the Android device. So far identified two instances:

• When device is locked and screen is turned off. After a few minutes (2-5 minutes), all TCP connections are terminated, regardless if the connections are idle or not.
• If the app that has its TCP connection terminated above, re-establishes another TCP in the background, while the device still locked, the connection is stable with no issues until device is unlocked again. When device is unlocked, all TCP connections are closed again immediately.

Reproduction

I have a complex json config but confirmed that the issue can be reproduced on below simplest config:

{
  "dns": {
    "servers": [
      {
        "type": "udp",
        "tag": "google",
        "server": "8.8.8.8"
      }
    ]
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "intun",
      "address": "172.19.0.1/30",
      "auto_route": true
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "outbound": "direct"
      }
    ],
    "auto_detect_interface": true
  }
}

On termux android app, start a netcat TCP fifo loop towards a netcat server:

• On server: # nc -l -p $serverport
• On Android termux:

# mkfifo fifo
# while true; do sleep 1; cat fifo | nc $serverip $serverport > fifo; done

• optionally, run tcpdump on remote netcat server like tcpdump -i any -nl port $serverport to observe that TCP reset is being initiated from Android device.

• It doesn't matter much but we can also type in some messages on the netcat server to keep the connection active.

A non-technical reproduction of the issue is via a WhatsApp video call:

• Lock the android device, turn off the screen and wait 10 minutes. This will trigger the issue and whatsapp will reconnect to its server in the background within 10 minutes.
• Initiate a video call to the Android device from another mobile and start a video call. Start observing the video streaming on both devices.
• Responding to a video call doesn't seem to cause a Wake() call and there will be no issues until the android device is unlocked, while the video call is ongoing.
• As soon as the android device is unlocked, the video streaming will stop (easier to monitor on the calling mobile device), and it will reconnect afterwards in 5-10 seconds.

I checked multiple release versions and found out that the issue first appears on release 1.12.0-beta.15. Issue does not happen on version 1.12.0-beta.14. Latest release also has the problem so it is not fixed yet.

Checking the git changes, I suspect it is related to the commit enabling with_conntrack build tag below:
https://github.com/SagerNet/sing-box/commit/f83abb5cd63821fde5231710d7ad7cf1d5bba7a9

And the path seems to be (did not confirm, just looking at the code) :

Pause()/Wake() @ service_pause.go ->
s.instance.Router().ResetNetwork() ->
ResetNetwork() @ route/router.go ->
r.network.ResetNetwork() ->
ResetNetwork() @ route/network.go ->
conntrack.Close()

Which terminates all TCP connections on device Pause and Wake events.

Is there any concrete reasons to close all TCP connections on such power save mode changes? All seem to work fine on 1.12.0-beta.14, so I am currently sticking with it.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start with service_pause.go and trace Pause()/Wake() through route/router.go and route/network.go to conntrack.Close(), as described in the issue. Reproduce with the minimal TUN configuration and Termux netcat loop, comparing Android 1.12.0-beta.14 with beta.15 or later. Done means power-save transitions no longer terminate existing TCP connections, with relevant tests or reproduction evidence.