SFI-1.14.0，tls节点配置ech问题

操作系统

iOS

系统版本

ios27

安装类型

sing-box for iOS 图形客户端程序

如果您使用图形客户端程序，请提供该程序版本。

1.14.0

版本

描述

tls节点配置ech时，ech相关域名进行dns查询时会匹配dns规则，这会导致以下两个问题。
1:当规则集未下载，并且指定的是远程代理下载，dns规则中final选择的是 google (google dns 通过远程代理出站) dns时，规则集无法正常下载，singbox客户端无法启动，会卡在启动状态。ech相关域名会通过final dns 进行ech记录查询，但是此时的tls节点由于没有查询ech记录，是不可用的。临时解决方法是将final修改为直连出站的dns，或者通过直连的方法下载规则。
2:正常启动后，ech相关域名会去匹配dns规则，特别是dns规则有类似{"query_type": "HTTPS","action": "reject" }规则时，需要在该规则前新增{"domain": "cloudflare-ech.com","server": "alidns" }规则，tls出站节点才可用。
希望恢复为老版本模式，ech相关域名通过default_domain_resolver配置的dns查询，或者出站节点 拨号字段domain_resolver配置的dns进行查询。

重现方式

{
"log": {
"level": "info"
},
"dns": {
"servers": [
{
"type": "https",
"tag": "alidns",
"server": "223.5.5.5"
},
{
"type": "https",
"tag": "google",
"server": "8.8.8.8",
"detour": "Proxy"
}
],
"rules": [
{
"query_type": "HTTPS",
"action": "reject"
}
],
"final": "google",
"strategy": "ipv4_only",
"optimistic": true
},
"http_clients": [
{
"tag": "download",
"detour": "Proxy"
}
],
"inbounds": [
{
"type": "tun",
"tag": "tun",
"address": "172.18.0.1/30",
"auto_route": true
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct",
"domain_resolver": "alidns"
},
{
"type": "selector",
"tag": "Proxy",
"outbounds": ["test"],
"interrupt_exist_connections": true
},
{
"type": "trojan",
"tag": "test",
"server": "0.0.0.0",
"server_port": 443,
"password": "password",
"network": "tcp",
"tls": {
"enabled": true,
"server_name": "example.com",
"ech": {
"enabled": true,
"query_server_name": "cloudflare-ech.com"
}
}
}
],
"route": {
"rules": [
{
"port": 53,
"action": "hijack-dns"
},
{
"action": "sniff"
}
],
"rule_set": [
{
"type": "remote",
"tag": "chinese_mainland",
"url": "https://rule.ayama.cc.cd/{tag}.srs"
}
],
"final": "direct",
"auto_detect_interface": true,
"default_domain_resolver": "alidns"
}
}

日志

这是默认情况下，启动客户端下载规则集的日志
DEBUG[0000] dns: exchange cloudflare-ech.com. IN HTTPS
INFO[0000] outbound/vless[test]: outbound connection to 8.8.8.8:443
WARN[0010] router: initialize rule-set take too much time to finish!

这是修改为直连下载规则集后，正常启动测试节点延迟日志
INFO[0003] outbound/trojan[test]: outbound connection to www.gstatic.com:443
DEBUG[0003] dns: exchange cloudflare-ech.com. IN HTTPS
DEBUG[0003] dns: match[0] query_type=HTTPS => reject
DEBUG[0003] outbound test unavailable: fetch ECH config list: REFUSED

支持我们

• 我已经 赞助

完整性要求

• 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
• 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
• 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
• 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。

Start from the DNS exchange and ECH lookup shown in the logs, using the provided configuration to trace how cloudflare-ech.com is resolved during rule-set download and outbound connection setup. Compare the configured default_domain_resolver and outbound domain_resolver paths with DNS rule matching; done means ECH resolution follows the intended resolver without being rejected or blocking startup.