tun.include_interface generates empty iifname rules

Operating system

Linux

System version

OpenWrt 24.10

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.13.0-rc.4

Environment: go1.25.7 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0,with_naive_outbound,with_musl
Revision: 804606042f75e593433db76cc43d31056823bbfc
CGO: enabled

Description

When using tun inbound with auto_route + auto_redirect, include_interface and exclude_interface works correctly if only one interface is specified, but generates invalid nftables rules when more than one interface is provided.

Reproduction

Configuration with a single interface:

{
  "type": "tun",
  "tag": "tun-in",
  "address": ["172.18.0.1/30", "fdfe:dcba:9876::1/126"],
  "include_interface": ["br-lan"],
  "auto_route": true,
  "strict_route": true,
  "auto_redirect": true,
  "stack": "system"
}

Generated nft rule:

root@OpenWrt:~# nft list chain inet sing-box prerouting
table inet sing-box {
	chain prerouting {
		...
		iifname != "br-lan" counter packets 0 bytes 0 return

Configuration with multiple interfaces:

{
  "type": "tun",
  "tag": "tun-in",
  "address": ["172.18.0.1/30", "fdfe:dcba:9876::1/126"],
  "include_interface": ["br-lan", "wg0"],
  "auto_route": true,
  "strict_route": true,
  "auto_redirect": true,
  "stack": "system"
}

Generated nft rule:

root@OpenWrt:~# nft list chain inet sing-box prerouting
table inet sing-box {
	chain prerouting {
		...
		iifname != { "", "" } counter packets 457 bytes 26768 return

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by tracing the tun inbound auto_redirect handling for include_interface and exclude_interface, then reproduce the two configurations from the issue on Linux and inspect the generated nftables rules. Done means multiple interface names produce valid iifname rules containing the supplied names, while the single-interface behavior remains correct.