feat(frontend): detect routing rules that match every connection

A rule with no domain, ip or protocol whose port range spans every port
matches all traffic, so sing-box stops there: the rules below it and the
resolve step the generator appends for IPIfNonMatch never run.

Author: loss-and-quick

frontend/src/features/settings/__tests__/isCatchAllRule.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest";
+import type { RoutingRule } from "../../../generated/bindings";
+import { isCatchAllRule } from "../helpers";
+
+const rule = (patch: Partial<RoutingRule>): RoutingRule => ({
+  id: "r1",
+  remarks: "",
+  enabled: true,
+  outboundTag: "proxy",
+  ...patch,
+});
+
+describe("isCatchAllRule", () => {
+  it("flags a full port range with no other match field", () => {
+    expect(isCatchAllRule(rule({ port: "0-65535" }))).toBe(true);
+    expect(isCatchAllRule(rule({ port: "1-65535" }))).toBe(true);
+  });
+
+  it("flags a full range assembled from several parts", () => {
+    expect(isCatchAllRule(rule({ port: "1-1000,1001-65535" }))).toBe(true);
+  });
+
+  it("ignores a range with a gap or a short tail", () => {
+    expect(isCatchAllRule(rule({ port: "1-1000,1002-65535" }))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "0-65534" }))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "443" }))).toBe(false);
+  });
+
+  it("ignores rules that also match on domain, ip or protocol", () => {
+    expect(isCatchAllRule(rule({ port: "0-65535", domain: ["geosite:private"] }))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "0-65535", ip: ["geoip:ru"] }))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "0-65535", protocol: ["bittorrent"] }))).toBe(false);
+  });
+
+  it("treats a single-network rule as narrower than catch-all", () => {
+    expect(isCatchAllRule(rule({ port: "0-65535", network: "udp" }))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "0-65535", network: "tcp,udp" }))).toBe(true);
+  });
+
+  it("ignores disabled rules and rules the backend drops for having no match field", () => {
+    expect(isCatchAllRule(rule({ port: "0-65535", enabled: false }))).toBe(false);
+    expect(isCatchAllRule(rule({}))).toBe(false);
+    expect(isCatchAllRule(rule({ port: "  " }))).toBe(false);
+  });
+
+  it("ignores a malformed port list", () => {
+    expect(isCatchAllRule(rule({ port: "0-abc" }))).toBe(false);
+  });
+});

frontend/src/features/settings/helpers.ts

@@ -63,6 +63,37 @@ export function ruleSummary(
   return parts.join(" · ");
 }
 
+const MAX_PORT = 65535;
+
+function portCoversEveryPort(port: string | null | undefined): boolean {
+  if (!port?.trim()) return false;
+  const ranges: [number, number][] = [];
+  for (const item of port.split(",")) {
+    const part = item.trim();
+    if (!part) continue;
+    const [lo, hi] = part.includes("-") ? part.split("-") : [part, part];
+    const from = Number(lo);
+    const to = Number(hi);
+    if (!Number.isInteger(from) || !Number.isInteger(to)) return false;
+    ranges.push([Math.min(from, to), Math.max(from, to)]);
+  }
+  ranges.sort((a, b) => a[0] - b[0]);
+  let reached = 0;
+  for (const [from, to] of ranges) {
+    if (from > reached + 1) break;
+    reached = Math.max(reached, to);
+  }
+  return reached >= MAX_PORT;
+}
+
+/** Whether the rule matches every connection, making the rules below it dead. */
+export function isCatchAllRule(rule: RoutingRule): boolean {
+  if (!rule.enabled) return false;
+  if (rule.domain?.length || rule.ip?.length || rule.protocol?.length) return false;
+  if (rule.network && rule.network !== "tcp,udp") return false;
+  return portCoversEveryPort(rule.port);
+}
+
 export function ruleIcon(rule: RoutingRule): string {
   if (rule.outboundTag === "direct") return "near_me";
   if (rule.outboundTag === "block") return "block";