SagerNet / SagerNet/sing-tun

Unexpected configuration in the nftables rules generated by auto-redirect

Open
#79 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
237
Forks
228
PR merge metrics
No merged PRs in 30d

Description

For the following nftables snippet generated by auto-redirect,
the rule tcp option mptcp exists counter packets 0 bytes 0 drop
maybe an unintended and unnecessary rule, considering the UDP and ICMP context.

        chain output_udp_icmp {
                type route hook output priority mangle; policy accept;
                meta l4proto != { icmp, udp, ipv6-icmp } return
                meta mark 0x00002024 counter packets 0 bytes 0 return
                ct mark 0x00002024 counter packets 0 bytes 0 return
                ip daddr @inet4_local_address_set counter packets 0 bytes 0 return
                ip6 daddr @inet6_local_address_set counter packets 0 bytes 0 return
                tcp option mptcp exists counter packets 0 bytes 0 drop
                meta mark set 0x00002023 ct mark set meta mark counter packets 0 bytes 0 return
        }

Related commit https://github.com/SagerNet/sing-tun/commit/b49e63f8efdbe7071ec0784829833010fbfb4567

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the related commit and trace the auto-redirect code that generates the shown nftables chain. Determine whether the MPTCP drop rule is intentional in the UDP and ICMP context; done means the generated rules match the intended protocol behavior and the relevant project checks pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.