Unexpected configuration in the nftables rules generated by auto-redirect
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go, linux
- Domain
- networking
Research direction
Start with the related commit and trace the auto-redirect code that generates the shown nftables chain. Determine whether the MPTCP drop rule is intentional in the UDP and ICMP context; done means the generated rules match the intended protocol behavior and the relevant project checks pass.
Written by the indexing model from the issue text.
Description
For the following nftables snippet generated by auto-redirect,
the rule tcp option mptcp exists counter packets 0 bytes 0 drop
maybe an unintended and unnecessary rule, considering the UDP and ICMP context.
chain output_udp_icmp {
type route hook output priority mangle; policy accept;
meta l4proto != { icmp, udp, ipv6-icmp } return
meta mark 0x00002024 counter packets 0 bytes 0 return
ct mark 0x00002024 counter packets 0 bytes 0 return
ip daddr @inet4_local_address_set counter packets 0 bytes 0 return
ip6 daddr @inet6_local_address_set counter packets 0 bytes 0 return
tcp option mptcp exists counter packets 0 bytes 0 drop
meta mark set 0x00002023 ct mark set meta mark counter packets 0 bytes 0 return
}
Related commit https://github.com/SagerNet/sing-tun/commit/b49e63f8efdbe7071ec0784829833010fbfb4567
- Dominant language
- Go
- Stars
- 240
- Forks
- 240
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from SagerNet/sing-tun
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
gvisor: LinkEndpointFilter.Attach never forwards nil, so GVisor.Close leaks all inbound dispatcher goroutines and fdsPossibly taken @arpitjain099 claimed this 45 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
TUN `mixed` stack: TCP never re-injected into tun0 on Linux kernel 7.1 (UDP works, `gvisor` works)Open
Difficulty 4/5 1-2 days Newbie friendliness 45/100
-
Difficulty 3/5 1-2 days Newbie friendliness 70/100
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
All issues in SagerNet/sing-tun
Similar issues
-
[Bug]: message-level cache_control on chat messages is dropped, so Anthropic prompt caching never triggersPossibly taken @Atharva-Kanherkar claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
Maintainers usually reply within 1 day
-
documentation good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
eugenioenko/ttt#1000 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Billionmail/BillionMail#389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Gentleman-Programming/gentle-ai#5603 ·
Maintainers usually reply within 1 day
-
good first issue help wanted v3
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
oras-project/oras-go#1621 ·
Maintainers usually reply within 1 day