SagerNet / SagerNet/sing-box

DNS detour 到 gRPC-based 协议出现响应超时

Open
#4,468 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
38.2k
Forks
4.6k
Avg merge
19d 15h
Merged PRs (30d)
1

Description

操作系统

macOS

系统版本

Tahoe 26.6.2

安装类型

sing-box 原始命令行程序

如果您使用图形客户端程序，请提供该程序版本。

No response

版本
sing-box version 1.13.21

Environment: go1.26.7 darwin/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_naive_outbound,badlinkname,tfogo_checklinkname0
CGO: enabled
描述

我看了一下 issue 发现以前就有类似的问题了：
https://github.com/SagerNet/sing-box/pull/3856
https://github.com/SagerNet/sing-box/pull/3860

也看到在这个 commit 中得到了修复
https://github.com/SagerNet/sing-box/commit/27c5b0b1aff2cd77ac367982e7f308377eab42b5

最初的修复版本是 1.13.2

但是不知道从哪个版本开始 dns detour to gRPC 超时这个 bug 又突然出现了
我测试下来正式版 1.13.19 ~ 1.13.21 测试版 1.14.0-beta.17 ~ 1.14.0-rc.5 均出现这个问题

行为大概是 dig 输出 timed out; sing-box 日志输出 io: read/write on closed pipe

重现方式
  1. 编辑尽可能小的配置文件：
{
  "dns": {
    "servers": [
      {
        "tag": "proxy-dns",
        "type": "udp",
        "server": "8.8.8.8",
        "server_port": 53,
        "detour": "proxy-out"
      },
      {
        "tag": "local-dns",
        "type": "local"
      }
    ],
    "final": "proxy-dns"
  },
  "inbounds": [
    {
      "tag": "dns-in",
      "type": "direct",
      "listen": "127.0.0.1",
      "listen_port": 10053,
      "override_address": "8.8.8.8",
      "override_port": 53
    },
    {
      "tag": "mixed-in",
      "type": "mixed",
      "listen": "127.0.0.1",
      "listen_port": 10000
    }
  ],
  "outbounds": [
    {
      "tag": "proxy-out",
      "type": "vless",
      "server": "114.5.1.4",
      "server_port": 443,
      "uuid": "uuiduuid-uuid-uuid-uuid-uuiduuiduuid",
      "transport": {
        "type": "grpc",
        "service_name": "myServiceName"
      },
      "tls": {
        "enabled": true,
        "server_name": "mydomain.tld",
        "alpn": ["h2", "http/1.1"],
        "utls": {
          "enabled": true,
          "fingerprint": "firefox"
        }
      }
    }
  ],
  "route": {
    "default_domain_resolver": "local-dns",
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      }
    ],
    "final": "proxy-out"
  }
}
  1. 用命令启动 sing-box ：
sing-box -c ./config.json run
  1. 使用 dig 命令进行测试：
dig google.com @127.0.0.1 -p 10053
  1. 使用 curl 命令进行测试（确保并非节点本身问题）：
curl https://cp.cloudflare.com/generate_204 -x socks5://127.0.0.1:10000
结论：
  1. dig 测试的确出现了 timed out
reyreyy@ReMacbook-Pro ~ % dig google.com @127.0.0.1 -p 10053
;; communications error to 127.0.0.1#10053: timed out
;; communications error to 127.0.0.1#10053: timed out
;; communications error to 127.0.0.1#10053: timed out

; <<>> DiG 9.20.24 <<>> google.com @127.0.0.1 -p 10053
;; global options: +cmd
;; no servers could be reached
  1. curl 测试显示返回 204 ，确认排除节点问题
reyreyy@ReMacbook-Pro ~ % curl https://cp.cloudflare.com/generate_204 -x socks5://127.0.0.1:10000 -v
...
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 204 
...
日志
reyreyy@Mac ~ % sing-box -c ./config.json run
INFO[0000] network: updated default interface en0, index 14
INFO[0000] inbound/direct[dns-in]: tcp server started at 127.0.0.1:10053
INFO[0000] inbound/direct[dns-in]: udp server started at 127.0.0.1:10053
INFO[0000] inbound/mixed[mixed-in]: tcp server started at 127.0.0.1:10000
INFO[0000] sing-box started (0.00s)
INFO[0010] [1604582847 0ms] inbound/direct[dns-in]: inbound packet connection from 127.0.0.1:60431
INFO[0010] [1604582847 0ms] inbound/direct[dns-in]: inbound packet connection to 8.8.8.8:53
DEBUG[0010] [1604582847 0ms] router: match[0] => sniff
DEBUG[0010] [1604582847 0ms] router: sniffed packet protocol: dns
DEBUG[0010] [1604582847 0ms] router: match[1] protocol=dns => hijack-dns
DEBUG[0010] [1604582847 0ms] dns: exchange google.com. IN A
INFO[0010] [1604582847 0ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
INFO[0010] [1604582847 0ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
ERROR[0010] [1604582847 146ms] dns: exchange failed for google.com. IN A: write request: io: read/write on closed pipe
INFO[0015] [2224973206 0ms] inbound/direct[dns-in]: inbound packet connection from 127.0.0.1:52415
INFO[0015] [2224973206 0ms] inbound/direct[dns-in]: inbound packet connection to 8.8.8.8:53
DEBUG[0015] [2224973206 0ms] router: match[0] => sniff
DEBUG[0015] [2224973206 0ms] router: sniffed packet protocol: dns
DEBUG[0015] [2224973206 0ms] router: match[1] protocol=dns => hijack-dns
DEBUG[0015] [2224973206 0ms] dns: exchange google.com. IN A
INFO[0015] [2224973206 0ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
INFO[0015] [2224973206 0ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
ERROR[0015] [2224973206 1ms] dns: exchange failed for google.com. IN A: write request: io: read/write on closed pipe
INFO[0020] [1810318767 0ms] inbound/direct[dns-in]: inbound packet connection from 127.0.0.1:58266
INFO[0020] [1810318767 0ms] inbound/direct[dns-in]: inbound packet connection to 8.8.8.8:53
DEBUG[0020] [1810318767 0ms] router: match[0] => sniff
DEBUG[0020] [1810318767 0ms] router: sniffed packet protocol: dns
DEBUG[0020] [1810318767 0ms] router: match[1] protocol=dns => hijack-dns
DEBUG[0020] [1810318767 1ms] dns: exchange google.com. IN A
INFO[0020] [1810318767 1ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
INFO[0020] [1810318767 1ms] outbound/vless[proxy-out]: outbound packet connection to 8.8.8.8:53
ERROR[0020] [1810318767 2ms] dns: exchange failed for google.com. IN A: write request: io: read/write on closed pipe
INFO[0039] [2837353816 0ms] inbound/mixed[mixed-in]: inbound connection from 127.0.0.1:56163
INFO[0039] [2837353816 7ms] inbound/mixed[mixed-in]: inbound connection to [2606:4700::6810:84e5]:443
DEBUG[0039] [2837353816 7ms] router: match[0] => sniff
DEBUG[0039] [2837353816 8ms] router: sniffed protocol: tls, domain: cp.cloudflare.com
INFO[0039] [2837353816 8ms] outbound/vless[proxy-out]: outbound connection to [2606:4700::6810:84e5]:443
INFO[0039] [2837353816 8ms] outbound/vless[proxy-out]: outbound connection to [2606:4700::6810:84e5]:443
DEBUG[0039] [2837353816 170ms] connection: connection upload finished
TRACE[0039] [2837353816 170ms] connection: connection download closed
^C
支持我们
完整性要求
  • 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
  • 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
  • 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
  • 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the minimal configuration with the DNS inbound, hijack-dns rule, and VLESS gRPC outbound, then follow the logged DNS exchange and io: read/write on closed pipe failure. Compare the affected 1.13.19–1.13.21 and 1.14.0 beta/RC versions with the cited PRs and commit; done means dig google.com @127.0.0.1 -p 10053 succeeds while the existing curl check remains successful.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, grpc
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.