DNS Rule "logical" Incompatible with "invert" Logic

Operating system

Linux

System version

OpenWrt 24.10.5

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.13.0-rc.3

Environment: go1.25.7 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0,with_naive_outbound,with_musl
Revision: 58ccf82e0bfc5e724421d2ba03157fe7f0fee537
CGO: enabled

Description

Attempts on utilizing "invert" logic within logical AND DNS rule (as NOT condition) failed being applied. Whereas logical OR being applied successfully, as well as independent usage of the "invert" logic.

I'd be appreciated if you kindly remind me whether there's a misunderstanding to the configuration, as well as the information I provided being incomplete.

Reproduction

Inapplicable/Insufficient rule (achieving logic as RULE_SET_A && !RULE_SET_B ):

"dns": {
    "servers": [], // Redacted
    "rules": [{
            "type": "logical",
            "mode": "and",
            "rules": [{
                    "rule_set": ["geosite-PasswordManager", "geosite-Forums", "geosite-Companies", "geosite-..."] // RULE_SET_A
                }, {
                    "rule_set": ["geosite-ads", "geosite-..."], // RULE_SET_B
                    "invert": true
                }
            ],
            "server": "dns_Server_1"
        }
    ],
    ... // Redacted
}

The combination as logical condition above is inoperable (the specific rule won't get hit), whereas each condition behaves normally (the specific rule gets hit) if configured separately, though desired logical condition is no longer introduced.

"dns": {
    "servers": [], // Redacted
    "rules": [{
            "type": "logical",
            "mode": "or", // Using "OR" to force both rules being applied
            "rules": [{
                    "rule_set": ["geosite-PasswordManager", "geosite-Forums", "geosite-Companies", "geosite-..."] // RULE_SET_A
                }, {
                    "rule_set": ["geosite-ads", "geosite-..."], // RULE_SET_B
                    "invert": true
                }
            ],
            "server": "dns_Server_1"
        }
    ],
    ... // Redacted
}

// Moreover, simply apply the rules twice:
"dns": {
    "servers": [], // Redacted
    "rules": [{
           "rule_set": ["geosite-PasswordManager", "geosite-Forums", "geosite-Companies", "geosite-..."], // RULE_SET_A
           "server": "dns_Server_1"
        }, {
           "rule_set": ["geosite-ads", "geosite-..."], // RULE_SET_B
           "invert": true,
           "server": "dns_Server_1"
        }
    ],
    ... // Redacted
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

No source file or test is named in the report. Start by reproducing the minimal DNS configuration with a logical AND combining RULE_SET_A and an inverted RULE_SET_B, then trace the DNS rule evaluation path. Done means the combined rule matches as RULE_SET_A && !RULE_SET_B while preserving the existing OR and independent-rule behavior.