Merge pull request #216 from loss-and-quick/fix/desktop-root-traffic-bypasses-tun

fix(desktop): tunnel root traffic; escape the core by fwmark, not uid

Author: loss-and-quick

crates/kasumi-core/src/outbound_bind.rs

@@ -10,8 +10,10 @@
 //!     tun-engine-agnostic; the escape is on the core's socket, so swapping the tun
 //!     engine changes nothing here.
 //!   - **self-managed** (sing-box `auto_route`): the core owns the tun and escapes
-//!     via its own `auto_detect_interface` — do *not* call this there, an explicit
-//!     `bind_interface` would defeat the auto-detection and pin a stale interface.
+//!     via the egress fwmark (`route.default_mark` + the desktop's escape ip-rule;
+//!     see `SINGBOX_ESCAPE_MARK`) and its own `auto_detect_interface` — do *not*
+//!     call this there, an explicit `bind_interface` would defeat the
+//!     auto-detection and pin a stale interface.
 //!   - **Android**: a per-uid policy-routing model excludes root from marking, so the
 //!     core (run as root) escapes without an explicit bind. It doesn't call this
 //!     today, but the helper is shared so it can if a future need arises.

crates/kasumi-core/src/singbox_config.rs

@@ -25,6 +25,21 @@ pub const SINGBOX_MAIN_RULE_PRIO: u32 = 9000;
 pub const SINGBOX_FORCE_TABLE: u32 = 2023;
 pub const SINGBOX_FORCE_RULE_PRIO: u32 = 9010;
 
+/// fwmark the desktop native-tun core stamps on its own egress sockets
+/// (`route.default_mark`), and the ip-rule priority that diverts marked traffic to
+/// the system's main table ahead of every `auto_route` rule above — so the core's
+/// uplink and geo-`direct` dials escape the tun while unmarked traffic (any uid,
+/// root included) is captured. Distinct from sing-tun's own auto-redirect marks
+/// (0x2023–0x2025); the rule priority sits below `SINGBOX_MAIN_RULE_PRIO` so it is
+/// evaluated first. The escape rule is a `goto` to the main-table rule (32766);
+/// the backstop priority right behind it carries an `unreachable` rule for the
+/// same mark, catching hosts where 32766 was deleted (the kernel then skips the
+/// unresolved `goto`) so marked traffic hard-fails instead of falling through
+/// into the `auto_route` rules and looping.
+pub const SINGBOX_ESCAPE_MARK: u32 = 0x4b53;
+pub const SINGBOX_ESCAPE_RULE_PRIO: u32 = 8990;
+pub const SINGBOX_ESCAPE_BACKSTOP_RULE_PRIO: u32 = 8991;
+
 fn wire<T: serde::Serialize>(v: &T) -> String {
     serde_json::to_value(v)
         .ok()
@@ -985,14 +1000,20 @@ fn build_singbox_tun_inbounds(s: &AdvancedSettings) -> Vec<Value> {
     } else {
         json!([crate::tun::TUN_IPV4_CIDR])
     };
-    let mut exclude_uid = vec![0i64];
-    exclude_uid.extend(bypass_uids.iter().copied());
+    // Per-app bypass/force uids only (the Android app filter; empty elsewhere).
+    // Whether uid 0 also skips the tun is a platform decision, not the builder's:
+    // Android's root-binary model adds it in `tune_config` (the daemon and core run
+    // as root and must not be captured), while desktop tunnels root like any other
+    // uid and escapes the core's own traffic by fwmark (`SINGBOX_ESCAPE_MARK`).
+    let mut exclude_uid = bypass_uids;
     exclude_uid.extend(force_uids.iter().copied());
 
     let mut main_tun = singbox_tun_inbound("tun-in", None, main_addr, s.tun_mtu, &stack);
     main_tun["auto_route"] = json!(true);
     main_tun["strict_route"] = json!(s.strict_route);
-    main_tun["exclude_uid"] = json!(exclude_uid);
+    if !exclude_uid.is_empty() {
+        main_tun["exclude_uid"] = json!(exclude_uid);
+    }
     let mut inbounds = vec![main_tun];
     if !force_uids.is_empty() {
         let force_addr = if v6 {
@@ -1383,6 +1404,55 @@ mod tests {
         );
     }
 
+    #[test]
+    fn tun_uid_exclusion_is_app_filter_only() {
+        let p = crate::share::parse_share_link("tuic://u:pw@t.ex:443?sni=t.ex", None).unwrap();
+        // No app filter → no uid exclusion baked in; whether uid 0 skips the tun
+        // is layered per-platform (Android's tune_config), not builder policy.
+        let cfg = build_singbox_config(
+            &p,
+            &AdvancedSettings::default(),
+            &[],
+            std::slice::from_ref(&p),
+            SingboxBuildOpts::default(),
+        )
+        .unwrap();
+        let tun = cfg["inbounds"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|i| i["tag"] == "tun-in")
+            .expect("tun-in inbound present");
+        assert!(tun.get("exclude_uid").is_none());
+
+        // Bypass + force uids land in exclude_uid; force uids also get their own tun.
+        let mut s = AdvancedSettings::default();
+        s.app_filter
+            .insert("com.a:10001".into(), AppFilterMode::Bypass);
+        s.app_filter
+            .insert("com.b:10002".into(), AppFilterMode::ForceProxy);
+        let cfg = build_singbox_config(
+            &p,
+            &s,
+            &[],
+            std::slice::from_ref(&p),
+            SingboxBuildOpts::default(),
+        )
+        .unwrap();
+        let inbounds = cfg["inbounds"].as_array().unwrap();
+        let tun = inbounds.iter().find(|i| i["tag"] == "tun-in").unwrap();
+        let ex: Vec<i64> = tun["exclude_uid"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|v| v.as_i64().unwrap())
+            .collect();
+        assert!(ex.contains(&10001) && ex.contains(&10002));
+        assert!(!ex.contains(&0));
+        let force = inbounds.iter().find(|i| i["tag"] == "tun-force").unwrap();
+        assert_eq!(force["include_uid"][0], 10002);
+    }
+
     #[test]
     fn ech_raw_base64_is_wrapped_in_a_pem_block() {
         let cfg = ech_config_pem("AEX+DQBB...base64...");

crates/kasumi-daemon/src/android/platform.rs

@@ -670,18 +670,36 @@ impl Platform for AndroidPlatform {
         if engine != CoreEngine::SingBox {
             return;
         }
-        // The sing-box "system" stack can't grab tun connections in this root-binary
-        // data-path without sing-box's own nftables output redirect, which only
-        // catches network-bound sockets when strict_route is on. An Android specific,
-        // so it lives here, not the neutral builder. (gvisor needs neither.)
+        // Android specifics the neutral builder must not assume, so they live here:
+        // - The sing-box "system" stack can't grab tun connections in this
+        //   root-binary data-path without sing-box's own nftables output redirect,
+        //   which only catches network-bound sockets when strict_route is on.
+        //   (gvisor needs neither.)
+        // - Root (uid 0) must bypass the tun: the daemon and the core itself run as
+        //   root, and this per-uid policy model spares root instead of marking
+        //   sockets. Prepended to every capture-all tun (one with an `include_uid`
+        //   allowlist can't capture root in the first place). Idempotent — a
+        //   config that already excludes root is left as-is.
         if let Some(inbounds) = config.get_mut("inbounds").and_then(|v| v.as_array_mut()) {
             for ib in inbounds {
-                let is_system_tun = ib.get("type").and_then(Value::as_str) == Some("tun")
-                    && ib.get("stack").and_then(Value::as_str) == Some("system");
-                if is_system_tun {
+                if ib.get("type").and_then(Value::as_str) != Some("tun") {
+                    continue;
+                }
+                if ib.get("stack").and_then(Value::as_str) == Some("system") {
                     ib["auto_redirect"] = Value::Bool(true);
                     ib["strict_route"] = Value::Bool(true);
                 }
+                if ib.get("include_uid").is_none() {
+                    let mut uids = ib
+                        .get("exclude_uid")
+                        .and_then(Value::as_array)
+                        .cloned()
+                        .unwrap_or_default();
+                    if !uids.iter().any(|v| v.as_i64() == Some(0)) {
+                        uids.insert(0, Value::from(0i64));
+                        ib["exclude_uid"] = Value::Array(uids);
+                    }
+                }
             }
         }
     }
@@ -787,4 +805,54 @@ mod tests {
         assert_eq!(bin, SINGBOX_BIN);
         assert!(cfg.ends_with("singbox.json"));
     }
+
+    #[test]
+    fn tune_config_excludes_root_from_capture_all_tuns() {
+        let platform = AndroidPlatform::new();
+        // A neutral build: gvisor main tun with app-filter bypass uids, plus a
+        // force tun with an include_uid allowlist.
+        let mut cfg = serde_json::json!({ "inbounds": [
+            { "type": "tun", "tag": "tun-in", "stack": "gvisor",
+              "exclude_uid": [10001] },
+            { "type": "tun", "tag": "tun-force", "stack": "gvisor",
+              "include_uid": [10002] },
+            { "type": "mixed", "tag": "socks-in" },
+        ] });
+        platform.tune_config(CoreEngine::SingBox, &mut cfg);
+        // Root heads the exclusion of the capture-all tun (the daemon and core run
+        // as root); the allowlisted force tun and non-tun inbounds are untouched.
+        assert_eq!(
+            cfg["inbounds"][0]["exclude_uid"],
+            serde_json::json!([0, 10001])
+        );
+        assert!(cfg["inbounds"][1].get("exclude_uid").is_none());
+        assert!(cfg["inbounds"][2].get("exclude_uid").is_none());
+        // Tuning is idempotent: a second pass doesn't duplicate the root exclusion.
+        platform.tune_config(CoreEngine::SingBox, &mut cfg);
+        assert_eq!(
+            cfg["inbounds"][0]["exclude_uid"],
+            serde_json::json!([0, 10001])
+        );
+
+        // A capture-all tun without any app filter still gets the root exclusion.
+        let mut cfg = serde_json::json!({ "inbounds": [
+            { "type": "tun", "tag": "tun-in", "stack": "gvisor" },
+        ] });
+        platform.tune_config(CoreEngine::SingBox, &mut cfg);
+        assert_eq!(cfg["inbounds"][0]["exclude_uid"], serde_json::json!([0]));
+
+        // The system stack additionally needs sing-box's own output redirect.
+        let mut cfg = serde_json::json!({ "inbounds": [
+            { "type": "tun", "tag": "tun-in", "stack": "system" },
+        ] });
+        platform.tune_config(CoreEngine::SingBox, &mut cfg);
+        assert_eq!(cfg["inbounds"][0]["auto_redirect"], true);
+        assert_eq!(cfg["inbounds"][0]["strict_route"], true);
+        assert_eq!(cfg["inbounds"][0]["exclude_uid"], serde_json::json!([0]));
+
+        // Xray configs pass through untouched.
+        let mut cfg = serde_json::json!({ "inbounds": [{ "type": "tun" }] });
+        platform.tune_config(CoreEngine::Xray, &mut cfg);
+        assert!(cfg["inbounds"][0].get("exclude_uid").is_none());
+    }
 }

src-tauri/src/desktop/linux/routing.rs

@@ -122,6 +122,56 @@ pub async fn clear_external_tun_routing(route_state_file: &str) {
     kasumi_backend::fs::remove_file(route_state_file).await;
 }
 
+/// Install the fwmark escape rule for a native sing-box tun. The core stamps its
+/// own egress sockets with `SINGBOX_ESCAPE_MARK` (`route.default_mark`, injected by
+/// `prepare_singbox_config`); this rule — evaluated ahead of every `auto_route`
+/// rule — jumps marked traffic straight to the system's main-table rule (32766),
+/// so the core's uplink and geo-`direct` dials leave via the physical default
+/// route while everything unmarked (any uid, root included) is captured by the
+/// tun. `goto 32766` rather than `lookup main`: were the main lookup to fail
+/// (uplink flap), evaluation must not fall through into the auto_route rules
+/// below and loop the marked traffic. A host may lack the 32766 main rule
+/// altogether (some VPNs delete it), which leaves the `goto` unresolved and the
+/// kernel skips it — the `unreachable` backstop right behind then hard-fails
+/// marked traffic instead of letting it loop. Idempotent — sweeps the
+/// priorities first.
+pub async fn apply_singbox_escape_rule() {
+    use kasumi_core::singbox_config::{
+        SINGBOX_ESCAPE_BACKSTOP_RULE_PRIO, SINGBOX_ESCAPE_MARK, SINGBOX_ESCAPE_RULE_PRIO,
+    };
+
+    let prio = SINGBOX_ESCAPE_RULE_PRIO.to_string();
+    let backstop = SINGBOX_ESCAPE_BACKSTOP_RULE_PRIO.to_string();
+    let mark = format!("{SINGBOX_ESCAPE_MARK:#x}");
+    for v6 in [false, true] {
+        let mut base = vec![IP];
+        if v6 {
+            base.push("-6");
+        }
+        for p in [&prio, &backstop] {
+            let mut del = base.clone();
+            del.extend(["rule", "del", "priority", p]);
+            while silent(&del).await == 0 {}
+        }
+        let mut add = base.clone();
+        add.extend([
+            "rule", "add", "priority", &prio, "fwmark", &mark, "goto", "32766",
+        ]);
+        silent(&add).await;
+        let mut add = base;
+        add.extend([
+            "rule",
+            "add",
+            "priority",
+            &backstop,
+            "fwmark",
+            &mark,
+            "unreachable",
+        ]);
+        silent(&add).await;
+    }
+}
+
 /// Tear down orphaned native-sing-box `auto_route` artifacts (policy ip-rules, route
 /// tables, split-default) that a core left behind when it didn't exit cleanly — a
 /// crash or a SIGKILL after the graceful window. sing-box removes these itself on a
@@ -134,9 +184,19 @@ pub async fn clear_external_tun_routing(route_state_file: &str) {
 /// untouched. Safe to call in xray mode (no rules at these priorities exist there).
 pub async fn clear_singbox_autoroute(tun_iface_file: &str, tun2_iface_file: &str) {
     use kasumi_core::singbox_config::{
-        SINGBOX_FORCE_RULE_PRIO, SINGBOX_FORCE_TABLE, SINGBOX_MAIN_RULE_PRIO, SINGBOX_MAIN_TABLE,
+        SINGBOX_ESCAPE_BACKSTOP_RULE_PRIO, SINGBOX_ESCAPE_RULE_PRIO, SINGBOX_FORCE_RULE_PRIO,
+        SINGBOX_FORCE_TABLE, SINGBOX_MAIN_RULE_PRIO, SINGBOX_MAIN_TABLE,
     };
 
+    // The fwmark escape rules (goto + unreachable backstop) are ours, not
+    // sing-box's, but they orphan the same way when the data-path dies uncleanly
+    // (both families; v6 exists when installed).
+    for prio in [SINGBOX_ESCAPE_RULE_PRIO, SINGBOX_ESCAPE_BACKSTOP_RULE_PRIO] {
+        let p = prio.to_string();
+        while silent(&[IP, "rule", "del", "priority", &p]).await == 0 {}
+        while silent(&[IP, "-6", "rule", "del", "priority", &p]).await == 0 {}
+    }
+
     // Policy ip-rules: a single priority can carry more than one rule, so loop on
     // `del` until it reports there's nothing left at that priority.
     for prio in SINGBOX_MAIN_RULE_PRIO..=SINGBOX_FORCE_RULE_PRIO {

src-tauri/src/desktop/platform.rs

@@ -228,6 +228,12 @@ impl DesktopPlatform {
             // clears nothing on a clean start.
             routing::clear_singbox_autoroute(&self.p.tun_iface_file, &self.p.tun2_iface_file).await;
 
+            // The escape rule must exist before the core dials anything: its very
+            // first connections (DNS bring-up, the server uplink) already carry the
+            // egress mark. Everything unmarked — any uid, root included — stays
+            // captured by the tun.
+            routing::apply_singbox_escape_rule().await;
+
             self.spawn_core_verify(&core_bin, &cfg, &log).await?;
             return Ok(());
         }

src-tauri/src/desktop/singbox.rs

@@ -6,6 +6,13 @@
 //! captured by the tun and loops, causing timeouts. The fix is `route_exclude_address`
 //! on the tun inbound with the resolved server IPs (and literal DNS server IPs),
 //! which excludes them at the OS routing level regardless of fwmark.
+//!
+//! On Linux the core's `direct` outbound additionally dials arbitrary
+//! geo-`direct` hosts whose IPs can't be pre-resolved into that exclude list, so
+//! every egress socket is stamped with `route.default_mark` and a fwmark ip-rule
+//! installed above the `auto_route` rules diverts it to the main table (see
+//! `routing::apply_singbox_escape_rule`). Everything unmarked — any uid, root
+//! included — stays captured by the tun.
 
 use std::collections::HashSet;
 use std::path::Path;
@@ -50,8 +57,30 @@ fn collect_bypass_hosts(cfg: &Value) -> HashSet<String> {
     hosts
 }
 
-/// Inject tun interface names (persisted for traffic counters) and the proxy-server
-/// bypass into the on-disk sing-box config. Returns the main tun iface name.
+/// Stamp every egress socket of the core with the escape fwmark (Linux only; the
+/// option is rejected by sing-box elsewhere, and Windows needs no mark — its tun
+/// escape is route-based). The matching ip-rule is installed by
+/// `routing::apply_singbox_escape_rule`.
+#[cfg(target_os = "linux")]
+fn inject_escape_mark(cfg: &mut Value) -> bool {
+    let Some(route) = cfg.get_mut("route").and_then(Value::as_object_mut) else {
+        return false;
+    };
+    route.insert(
+        "default_mark".into(),
+        kasumi_core::singbox_config::SINGBOX_ESCAPE_MARK.into(),
+    );
+    true
+}
+
+#[cfg(not(target_os = "linux"))]
+fn inject_escape_mark(_cfg: &mut Value) -> bool {
+    false
+}
+
+/// Inject tun interface names (persisted for traffic counters), the proxy-server
+/// bypass and the egress fwmark into the on-disk sing-box config. Returns the main
+/// tun iface name.
 pub async fn prepare_singbox_config(
     cfg_path: &str,
     tun_iface_file: &str,
@@ -67,6 +96,8 @@ pub async fn prepare_singbox_config(
     let raw = read_text(cfg_path).await.unwrap_or_default();
     let mut cfg: Value = serde_json::from_str(&raw).unwrap_or(Value::Null);
 
+    let mut changed = inject_escape_mark(&mut cfg);
+
     let mut excludes = HashSet::new();
     for host in collect_bypass_hosts(&cfg) {
         for ip in resolve_ips(&host).await {
@@ -80,9 +111,12 @@ pub async fn prepare_singbox_config(
             for ib in inbounds {
                 if ib.get("type").and_then(Value::as_str) == Some("tun") {
                     ib["route_exclude_address"] = serde_json::to_value(&list)?;
+                    changed = true;
                 }
             }
         }
+    }
+    if changed {
         write_text(cfg_path, &serde_json::to_string_pretty(&cfg)?).await?;
     }
     Ok(tun)
@@ -111,4 +145,18 @@ mod tests {
         assert!(!hosts.contains("127.0.0.1"));
         assert!(!hosts.contains("dns.google"));
     }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn escape_mark_lands_in_route_on_linux() {
+        let mut cfg = serde_json::json!({ "route": { "auto_detect_interface": true } });
+        assert!(inject_escape_mark(&mut cfg));
+        assert_eq!(
+            cfg["route"]["default_mark"],
+            kasumi_core::singbox_config::SINGBOX_ESCAPE_MARK
+        );
+        // A config without a route section (not ours) is left alone.
+        let mut cfg = serde_json::json!({ "inbounds": [] });
+        assert!(!inject_escape_mark(&mut cfg));
+    }
 }