SagerNet / SagerNet/sing-box

1.14.1 破坏了某些 shadowsocks + selector 出站

Open
#4,547 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
38.1k
Forks
4.6k
Avg merge
19d 15h
Merged PRs (30d)
1

Description

操作系统

Linux

系统版本

Debian GNU/Linux 13 (trixie) 13.6

安装类型

sing-box 原始命令行程序

如果您使用图形客户端程序，请提供该程序版本。

No response

版本
sing-box version 1.14.1

Environment: go1.26.8 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_purego
Revision: 1ac1a339cb1223e9c70eae14c44411c75033c02d
CGO: disabled
描述

selector 出站选中 shadowsocks 出站时，如果客户端连接后不先发送任何数据，而目标协议由服务端先发数据（例如 SSH banner），连接会一直卡住

  • 1.14.0 及更早版本的 selector 正常，1.14.1 失败。
  • 路由规则直接指向 shadowsocks 出站而不是 selector 可以绕过。
  • 实际场景：MobaXterm SSH，路由到 selector，连接一直卡住。
重现方式
客户端/服务端一体化配置：
{
    "log": {
        "disabled": false,
        "level": "trace",
        "timestamp": true
    },
    "dns": {
		"servers": [
			{
				"tag": "OUTDNS",
				"type": "https",
				"server": "223.5.5.5"
			}
		]
	},
    "inbounds": [
		{
			"tag": "MIXED-IN",
			"type": "mixed",
			"listen": "127.0.0.1",
			"listen_port": 7900
		},
        {
			"tag": "SS-IN",
			"type": "shadowsocks",
            "listen": "127.0.0.1",
            "listen_port": 1234,
            "method": "2022-blake3-chacha20-poly1305",
            "password": "NCjQfFCVVo02x8ONR3R1qMFWrODW8HeNc80QHIP6Ta4="
		}
    ],
    "outbounds": [
		{
            "tag": "DIRECT-OUT",
            "type": "direct"
        },
		{
			"tag": "SS-OUT",
			"type": "shadowsocks",
			"server": "127.0.0.1",
			"server_port": 1234,
			"method": "2022-blake3-chacha20-poly1305",
			"password": "NCjQfFCVVo02x8ONR3R1qMFWrODW8HeNc80QHIP6Ta4="
		},
		{
			"tag": "SELECTOR",
			"type": "selector",
			"outbounds": [
				"SS-OUT",
				"DIRECT-OUT"
			],
			"default": "SS-OUT"
		}
	],
    "route": {
		"rules": [
			{
				"action": "sniff"
			},
			{
				"inbound": "MIXED-IN",
				"outbound": "SELECTOR" 	  // 1.14.1 bad
				//"outbound": "SS-OUT"    // ok
			},
			{
				"inbound": "SS-IN",
				"outbound": "DIRECT-OUT"
			}
		],
		"final": "DIRECT-OUT",
		"default_domain_resolver": {
			"server": "OUTDNS",
			"strategy": "ipv4_only"
		},
		"auto_detect_interface": true
	}
}
1.14.0 测试：
root@debian:~/sbtest# ./sing-box-1.14.0 run -c sing-box.jsonc
+0800 2026-09-19 14:34:28 INFO network: updated default interface ens18, index 2
+0800 2026-09-19 14:34:28 INFO inbound/mixed[MIXED-IN]: tcp server started at 127.0.0.1:7900
+0800 2026-09-19 14:34:28 INFO inbound/shadowsocks[SS-IN]: tcp server started at 127.0.0.1:1234
+0800 2026-09-19 14:34:28 INFO inbound/shadowsocks[SS-IN]: udp server started at 127.0.0.1:1234
+0800 2026-09-19 14:34:28 INFO network: updated network environment: gateway 10.0.0.1, gateway_mac 88:c9:b3:bb:e1:34
+0800 2026-09-19 14:34:28 INFO sing-box started (0.00s)
+0800 2026-09-19 14:34:41 INFO [1921426326 0ms] inbound/mixed[MIXED-IN]: inbound connection from 127.0.0.1:54672
+0800 2026-09-19 14:34:41 INFO [1921426326 0ms] inbound/mixed[MIXED-IN]: inbound connection to 127.0.0.1:22
+0800 2026-09-19 14:34:41 DEBUG [1921426326 0ms] router: match[0] => sniff
+0800 2026-09-19 14:34:41 DEBUG [1921426326 300ms] router: match[1] inbound=MIXED-IN => route(SELECTOR)
+0800 2026-09-19 14:34:41 INFO [1921426326 300ms] outbound/shadowsocks[SS-OUT]: outbound connection to 127.0.0.1:22
+0800 2026-09-19 14:34:41 INFO [411242506 0ms] inbound/shadowsocks[SS-IN]: inbound connection from 127.0.0.1:48478
+0800 2026-09-19 14:34:41 INFO [411242506 0ms] inbound/shadowsocks[SS-IN]: inbound connection to 127.0.0.1:22
+0800 2026-09-19 14:34:41 DEBUG [411242506 0ms] router: match[0] => sniff
+0800 2026-09-19 14:34:41 DEBUG [411242506 300ms] router: match[2] inbound=SS-IN => route(DIRECT-OUT)
+0800 2026-09-19 14:34:41 INFO [411242506 300ms] outbound/direct[DIRECT-OUT]: outbound connection to 127.0.0.1:22
+0800 2026-09-19 14:34:46 TRACE [411242506 5.31s] connection: connection download closed
+0800 2026-09-19 14:34:46 DEBUG [411242506 5.31s] connection: connection upload finished
+0800 2026-09-19 14:34:46 TRACE [1921426326 5.61s] connection: connection download closed
+0800 2026-09-19 14:34:46 DEBUG [1921426326 5.61s] connection: connection upload finished


root@debian:~/sbtest# nc -v -w5 -X 5 -x 127.0.0.1:7900 127.0.0.1 22
Connection to 127.0.0.1 22 port [tcp/ssh] succeeded!
SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
root@debian:~/sbtest#
1.14.1 测试：
root@debian:~/sbtest# ./sing-box-1.14.1 run -c sing-box.jsonc
+0800 2026-09-19 14:34:59 INFO network: updated default interface ens18, index 2
+0800 2026-09-19 14:34:59 INFO inbound/mixed[MIXED-IN]: tcp server started at 127.0.0.1:7900
+0800 2026-09-19 14:34:59 INFO inbound/shadowsocks[SS-IN]: tcp server started at 127.0.0.1:1234
+0800 2026-09-19 14:34:59 INFO inbound/shadowsocks[SS-IN]: udp server started at 127.0.0.1:1234
+0800 2026-09-19 14:34:59 INFO network: updated network environment: gateway 10.0.0.1, gateway_mac 88:c9:b3:bb:e1:34
+0800 2026-09-19 14:34:59 INFO sing-box started (0.00s)
+0800 2026-09-19 14:35:09 INFO [3304352874 0ms] inbound/mixed[MIXED-IN]: inbound connection from 127.0.0.1:34086
+0800 2026-09-19 14:35:09 INFO [3304352874 0ms] inbound/mixed[MIXED-IN]: inbound connection to 127.0.0.1:22
+0800 2026-09-19 14:35:09 DEBUG [3304352874 0ms] router: match[0] => sniff
+0800 2026-09-19 14:35:09 DEBUG [3304352874 300ms] router: match[1] inbound=MIXED-IN => route(SELECTOR)
+0800 2026-09-19 14:35:09 INFO [3304352874 300ms] outbound/shadowsocks[SS-OUT]: outbound connection to 127.0.0.1:22
+0800 2026-09-19 14:35:09 INFO [701523413 0ms] inbound/shadowsocks[SS-IN]: inbound connection from 127.0.0.1:55320
+0800 2026-09-19 14:35:14 DEBUG [3304352874 5.0s] connection: connection upload finished
+0800 2026-09-19 14:35:14 DEBUG [701523413 4.70s] inbound/shadowsocks[SS-IN]: connection closed: shadowsocks: serve TCP from 127.0.0.1:55320: read header: EOF
+0800 2026-09-19 14:35:14 TRACE [3304352874 5.0s] connection: connection download closed


root@debian:~/sbtest# nc -v -w5 -X 5 -x 127.0.0.1:7900 127.0.0.1 22
Connection to 127.0.0.1 22 port [tcp/ssh] succeeded!
root@debian:~/sbtest#

预期收到SSH-2.0-OpenSSH...回复。但1.14.1没有收到。

版本 selector
1.12.25 正常
1.13.21 正常
1.14.0 正常
1.14.1 失败
日志
已包含在重现方式中
支持我们
完整性要求
  • 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
  • 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
  • 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
  • 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the supplied minimal configuration with sing-box 1.14.0 and 1.14.1, focusing on the selector-to-shadowsocks path and the server-first SSH banner. Compare selector and shadowsocks connection handling between those versions; done means the 1.14.1 configuration receives the SSH banner as it does in 1.14.0, with coverage for this regression.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
67/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.