FIx error handling for netlink banned in Android

go.mod

@@ -6,16 +6,17 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/go-ole/go-ole v1.3.0
 	github.com/sagernet/go-tun2socks v1.16.12-0.20220818015926-16cb67876a61
-	github.com/sagernet/gvisor v0.0.0-20230930141345-5fef6f2e17ab
+	github.com/sagernet/gvisor v0.0.0-20231119034329-07cfb6aaf930
 	github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97
-	github.com/sagernet/sing v0.2.17
+	github.com/sagernet/sing v0.2.19
 	github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9
-	golang.org/x/net v0.18.0
-	golang.org/x/sys v0.14.0
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
+	golang.org/x/net v0.19.0
+	golang.org/x/sys v0.15.0
 )
 
 require (
 	github.com/google/btree v1.1.2 // indirect
 	github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/time v0.4.0 // indirect
 )

go.sum

@@ -6,23 +6,25 @@ github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/sagernet/go-tun2socks v1.16.12-0.20220818015926-16cb67876a61 h1:5+m7c6AkmAylhauulqN/c5dnh8/KssrE9c93TQrXldA=
 github.com/sagernet/go-tun2socks v1.16.12-0.20220818015926-16cb67876a61/go.mod h1:QUQ4RRHD6hGGHdFMEtR8T2P6GS6R3D/CXKdaYHKKXms=
-github.com/sagernet/gvisor v0.0.0-20230930141345-5fef6f2e17ab h1:u+xQoi/Yc6bNUvTfrDD6HhGRybn2lzrhf5vmS+wb4Ho=
-github.com/sagernet/gvisor v0.0.0-20230930141345-5fef6f2e17ab/go.mod h1:3akUhSHSVtLuJaYcW5JPepUraBOW06Ibz2HKwaK5rOk=
+github.com/sagernet/gvisor v0.0.0-20231119034329-07cfb6aaf930 h1:dSPgjIw0CT6ISLeEh8Q20dZMBMFCcEceo23+LncRcNQ=
+github.com/sagernet/gvisor v0.0.0-20231119034329-07cfb6aaf930/go.mod h1:JpKHkOYgh4wLwrX2BhH3ZIvCvazCkTnPeEcmigZJfHY=
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97 h1:iL5gZI3uFp0X6EslacyapiRz7LLSJyr4RajF/BhMVyE=
 github.com/sagernet/netlink v0.0.0-20220905062125-8043b4a9aa97/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
 github.com/sagernet/sing v0.0.0-20220817130738-ce854cda8522/go.mod h1:QVsS5L/ZA2Q5UhQwLrn0Trw+msNd/NPGEhBKR/ioWiY=
-github.com/sagernet/sing v0.2.17 h1:vMPKb3MV0Aa5ws4dCJkRI8XEjrsUcDn810czd0FwmzI=
-github.com/sagernet/sing v0.2.17/go.mod h1:OL6k2F0vHmEzXz2KW19qQzu172FDgSbUSODylighuVo=
+github.com/sagernet/sing v0.2.19 h1:Mdj/YJ5TtEyG+eIZaAlvX8j2cHxMN6eW4RF6Xh9iWyg=
+github.com/sagernet/sing v0.2.19/go.mod h1:Ce5LNojQOgOiWhiD8pPD6E9H7e2KgtOe3Zxx4Ou5u80=
 github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9 h1:rc/CcqLH3lh8n+csdOuDfP+NuykE0U6AeYSJJHKDgSg=
 github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9/go.mod h1:a/83NAfUXvEuLpmxDssAXxgUgrEy12MId3Wd7OTs76s=
 github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
 github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
-golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220731174439-a90be440212d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
-golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/time v0.4.0 h1:Z81tqI5ddIoXDPvVQ7/7CC9TnLM7ubaFG2qXYd5BbYY=
+golang.org/x/time v0.4.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=

monitor_linux.go

@@ -6,6 +6,7 @@ import (
 	"sync"
 
 	"github.com/sagernet/netlink"
+	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/logger"
 	"github.com/sagernet/sing/common/x/list"
 
@@ -22,6 +23,12 @@ type networkUpdateMonitor struct {
 	logger    logger.Logger
 }
 
+var ErrNetlinkBanned = E.New(
+	"netlink socket in Android is banned by Google, " +
+		"use the root or system (ADB) user to run sing-box, " +
+		"or switch to the sing-box Adnroid graphical interface client",
+)
+
 func NewNetworkUpdateMonitor(logger logger.Logger) (NetworkUpdateMonitor, error) {
 	monitor := &networkUpdateMonitor{
 		routeUpdate: make(chan netlink.RouteUpdate, 2),
@@ -33,14 +40,14 @@ func NewNetworkUpdateMonitor(logger logger.Logger) (NetworkUpdateMonitor, error)
 	if runtime.GOOS == "android" {
 		netlinkSocket, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_DGRAM, unix.NETLINK_ROUTE)
 		if err != nil {
-			return nil, os.ErrInvalid
+			return nil, ErrNetlinkBanned
 		}
 		err = unix.Bind(netlinkSocket, &unix.SockaddrNetlink{
 			Family: unix.AF_NETLINK,
 		})
 		unix.Close(netlinkSocket)
 		if err != nil {
-			return nil, os.ErrInvalid
+			return nil, ErrNetlinkBanned
 		}
 	}
 	return monitor, nil

tun.go

@@ -33,25 +33,27 @@ type WinTun interface {
 }
 
 type Options struct {
-	Name               string
-	Inet4Address       []netip.Prefix
-	Inet6Address       []netip.Prefix
-	MTU                uint32
-	AutoRoute          bool
-	StrictRoute        bool
-	Inet4RouteAddress  []netip.Prefix
-	Inet6RouteAddress  []netip.Prefix
-	IncludeInterface   []string
-	ExcludeInterface   []string
-	IncludeUID         []ranges.Range[uint32]
-	ExcludeUID         []ranges.Range[uint32]
-	IncludeAndroidUser []int
-	IncludePackage     []string
-	ExcludePackage     []string
-	InterfaceMonitor   DefaultInterfaceMonitor
-	TableIndex         int
-	FileDescriptor     int
-	Logger             logger.Logger
+	Name                     string
+	Inet4Address             []netip.Prefix
+	Inet6Address             []netip.Prefix
+	MTU                      uint32
+	AutoRoute                bool
+	StrictRoute              bool
+	Inet4RouteAddress        []netip.Prefix
+	Inet6RouteAddress        []netip.Prefix
+	Inet4RouteExcludeAddress []netip.Prefix
+	Inet6RouteExcludeAddress []netip.Prefix
+	IncludeInterface         []string
+	ExcludeInterface         []string
+	IncludeUID               []ranges.Range[uint32]
+	ExcludeUID               []ranges.Range[uint32]
+	IncludeAndroidUser       []int
+	IncludePackage           []string
+	ExcludePackage           []string
+	InterfaceMonitor         DefaultInterfaceMonitor
+	TableIndex               int
+	FileDescriptor           int
+	Logger                   logger.Logger
 }
 
 func CalculateInterfaceName(name string) (tunName string) {

tun_darwin.go

@@ -263,43 +263,16 @@ func configure(tunFd int, ifIndex int, name string, options Options) error {
 		}
 	}
 	if options.AutoRoute {
-		if len(options.Inet4Address) > 0 {
-			var routes []netip.Prefix
-			if len(options.Inet4RouteAddress) > 0 {
-				routes = append(options.Inet4RouteAddress, netip.PrefixFrom(options.Inet4Address[0].Addr().Next(), 32))
+		var routeRanges []netip.Prefix
+		routeRanges, err = options.BuildAutoRouteRanges(false)
+		for _, routeRange := range routeRanges {
+			if routeRange.Addr().Is4() {
+				err = addRoute(routeRange, options.Inet4Address[0].Addr())
 			} else {
-				routes = []netip.Prefix{
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{1, 0, 0, 0}), 8),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{2, 0, 0, 0}), 7),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{4, 0, 0, 0}), 6),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{8, 0, 0, 0}), 5),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{16, 0, 0, 0}), 4),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{32, 0, 0, 0}), 3),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{64, 0, 0, 0}), 2),
-					netip.PrefixFrom(netip.AddrFrom4([4]byte{128, 0, 0, 0}), 1),
-				}
+				err = addRoute(routeRange, options.Inet6Address[0].Addr())
 			}
-			for _, subnet := range routes {
-				err = addRoute(subnet, options.Inet4Address[0].Addr())
-				if err != nil {
-					return E.Cause(err, "add ipv4 route ", subnet)
-				}
-			}
-		}
-		if len(options.Inet6Address) > 0 {
-			var routes []netip.Prefix
-			if len(options.Inet6RouteAddress) > 0 {
-				routes = append(options.Inet6RouteAddress, netip.PrefixFrom(options.Inet6Address[0].Addr().Next(), 128))
-			} else {
-				routes = []netip.Prefix{
-					netip.PrefixFrom(netip.AddrFrom16([16]byte{32, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}), 3),
-				}
-			}
-			for _, subnet := range routes {
-				err = addRoute(subnet, options.Inet6Address[0].Addr())
-				if err != nil {
-					return E.Cause(err, "add ipv6 route ", subnet)
-				}
+			if err != nil {
+				return E.Cause(err, "add route: ", routeRange)
 			}
 		}
 		flushDNSCache()

tun_linux.go

@@ -188,57 +188,25 @@ func (t *NativeTun) Close() error {
 	return E.Errors(t.unsetRoute(), t.unsetRules(), common.Close(common.PtrOrNil(t.tunFile)))
 }
 
-func (t *NativeTun) routes(tunLink netlink.Link) []netlink.Route {
-	var routes []netlink.Route
-	if len(t.options.Inet4Address) > 0 {
-		if t.options.AutoRoute {
-			if len(t.options.Inet4RouteAddress) > 0 {
-				for _, addr := range t.options.Inet4RouteAddress {
-					routes = append(routes, netlink.Route{
-						Dst: &net.IPNet{
-							IP:   addr.Addr().AsSlice(),
-							Mask: net.CIDRMask(addr.Bits(), 32),
-						},
-						LinkIndex: tunLink.Attrs().Index,
-						Table:     t.options.TableIndex,
-					})
-				}
-			} else {
-				routes = append(routes, netlink.Route{
-					Dst: &net.IPNet{
-						IP:   net.IPv4zero,
-						Mask: net.CIDRMask(0, 32),
-					},
-					LinkIndex: tunLink.Attrs().Index,
-					Table:     t.options.TableIndex,
-				})
-			}
-		}
+func prefixToIPNet(prefix netip.Prefix) *net.IPNet {
+	return &net.IPNet{
+		IP:   prefix.Addr().AsSlice(),
+		Mask: net.CIDRMask(prefix.Bits(), prefix.Addr().BitLen()),
 	}
-	if len(t.options.Inet6Address) > 0 {
-		if len(t.options.Inet6RouteAddress) > 0 {
-			for _, addr := range t.options.Inet6RouteAddress {
-				routes = append(routes, netlink.Route{
-					Dst: &net.IPNet{
-						IP:   addr.Addr().AsSlice(),
-						Mask: net.CIDRMask(addr.Bits(), 128),
-					},
-					LinkIndex: tunLink.Attrs().Index,
-					Table:     t.options.TableIndex,
-				})
-			}
-		} else {
-			routes = append(routes, netlink.Route{
-				Dst: &net.IPNet{
-					IP:   net.IPv6zero,
-					Mask: net.CIDRMask(0, 128),
-				},
-				LinkIndex: tunLink.Attrs().Index,
-				Table:     t.options.TableIndex,
-			})
-		}
+}
+
+func (t *NativeTun) routes(tunLink netlink.Link) ([]netlink.Route, error) {
+	routeRanges, err := t.options.BuildAutoRouteRanges(false)
+	if err != nil {
+		return nil, err
 	}
-	return routes
+	return common.Map(routeRanges, func(it netip.Prefix) netlink.Route {
+		return netlink.Route{
+			Dst:       prefixToIPNet(it),
+			LinkIndex: tunLink.Attrs().Index,
+			Table:     t.options.TableIndex,
+		}
+	}), nil
 }
 
 const (
@@ -626,7 +594,11 @@ func (t *NativeTun) rules() []*netlink.Rule {
 }
 
 func (t *NativeTun) setRoute(tunLink netlink.Link) error {
-	for i, route := range t.routes(tunLink) {
+	routes, err := t.routes(tunLink)
+	if err != nil {
+		return err
+	}
+	for i, route := range routes {
 		err := netlink.RouteAdd(&route)
 		if err != nil {
 			return E.Cause(err, "add route ", i)
@@ -657,8 +629,10 @@ func (t *NativeTun) unsetRoute() error {
 }
 
 func (t *NativeTun) unsetRoute0(tunLink netlink.Link) error {
-	for _, route := range t.routes(tunLink) {
-		_ = netlink.RouteDel(&route)
+	if routes, err := t.routes(tunLink); err == nil {
+		for _, route := range routes {
+			_ = netlink.RouteDel(&route)
+		}
 	}
 	return nil
 }

tun_rules.go

@@ -2,13 +2,17 @@ package tun
 
 import (
 	"context"
+	"net/netip"
 	"os"
+	"runtime"
 	"sort"
 	"strconv"
 
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/ranges"
+
+	"go4.org/netipx"
 )
 
 const (
@@ -96,3 +100,80 @@ func buildExcludedRanges(includeRanges []ranges.Range[uint32], excludeRanges []r
 	}
 	return ranges.Merge(uidRanges)
 }
+
+const autoRouteUseSubRanges = runtime.GOOS == "darwin"
+
+func (o *Options) BuildAutoRouteRanges(underNetworkExtension bool) ([]netip.Prefix, error) {
+	var routeRanges []netip.Prefix
+	if o.AutoRoute && len(o.Inet4Address) > 0 {
+		var inet4Ranges []netip.Prefix
+		if len(o.Inet4RouteAddress) > 0 {
+			inet4Ranges = o.Inet4RouteAddress
+		} else if autoRouteUseSubRanges && !underNetworkExtension {
+			inet4Ranges = []netip.Prefix{
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 1}), 8),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 2}), 7),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 4}), 6),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 8}), 5),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 16}), 4),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 32}), 3),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 64}), 2),
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{0: 128}), 1),
+			}
+		} else {
+			inet4Ranges = []netip.Prefix{netip.PrefixFrom(netip.IPv4Unspecified(), 0)}
+		}
+		if len(o.Inet4RouteExcludeAddress) == 0 {
+			routeRanges = append(routeRanges, inet4Ranges...)
+		} else {
+			var builder netipx.IPSetBuilder
+			for _, inet4Range := range inet4Ranges {
+				builder.AddPrefix(inet4Range)
+			}
+			for _, prefix := range o.Inet4RouteExcludeAddress {
+				builder.RemovePrefix(prefix)
+			}
+			resultSet, err := builder.IPSet()
+			if err != nil {
+				return nil, E.Cause(err, "build IPv4 route address")
+			}
+			routeRanges = append(routeRanges, resultSet.Prefixes()...)
+		}
+	}
+	if len(o.Inet6Address) > 0 {
+		var inet6Ranges []netip.Prefix
+		if len(o.Inet6RouteAddress) > 0 {
+			inet6Ranges = o.Inet6RouteAddress
+		} else if autoRouteUseSubRanges && !underNetworkExtension {
+			inet6Ranges = []netip.Prefix{
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 1}), 8),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 2}), 7),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 4}), 6),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 8}), 5),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 16}), 4),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 32}), 3),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 64}), 2),
+				netip.PrefixFrom(netip.AddrFrom16([16]byte{0: 128}), 1),
+			}
+		} else {
+			inet6Ranges = []netip.Prefix{netip.PrefixFrom(netip.IPv6Unspecified(), 0)}
+		}
+		if len(o.Inet6RouteExcludeAddress) == 0 {
+			routeRanges = append(routeRanges, inet6Ranges...)
+		} else {
+			var builder netipx.IPSetBuilder
+			for _, inet6Range := range inet6Ranges {
+				builder.AddPrefix(inet6Range)
+			}
+			for _, prefix := range o.Inet6RouteExcludeAddress {
+				builder.RemovePrefix(prefix)
+			}
+			resultSet, err := builder.IPSet()
+			if err != nil {
+				return nil, E.Cause(err, "build IPv6 route address")
+			}
+			routeRanges = append(routeRanges, resultSet.Prefixes()...)
+		}
+	}
+	return routeRanges, nil
+}

tun_windows.go

@@ -92,37 +92,18 @@ func (t *NativeTun) configure() error {
 		_ = luid.DisableDNSRegistration()
 	}
 	if t.options.AutoRoute {
-		if len(t.options.Inet4Address) > 0 {
-			if len(t.options.Inet4RouteAddress) > 0 {
-				for _, addr := range t.options.Inet4RouteAddress {
-					err := luid.AddRoute(addr, netip.IPv4Unspecified(), 0)
-					if err != nil {
-						return E.Cause(err, "add ipv4 route: ", addr)
-					}
-				}
+		routeRanges, err := t.options.BuildAutoRouteRanges(false)
+		if err != nil {
+			return err
+		}
+		for _, routeRange := range routeRanges {
+			if routeRange.Addr().Is4() {
+				err = luid.AddRoute(routeRange, netip.IPv4Unspecified(), 0)
 			} else {
-				err := luid.AddRoute(netip.PrefixFrom(netip.IPv4Unspecified(), 0), netip.IPv4Unspecified(), 0)
-				if err != nil {
-					return E.Cause(err, "set ipv4 route")
-				}
+				err = luid.AddRoute(routeRange, netip.IPv6Unspecified(), 0)
 			}
 		}
-		if len(t.options.Inet6Address) > 0 {
-			if len(t.options.Inet6RouteAddress) > 0 {
-				for _, addr := range t.options.Inet6RouteAddress {
-					err := luid.AddRoute(addr, netip.IPv6Unspecified(), 0)
-					if err != nil {
-						return E.Cause(err, "add ipv6 route: ", addr)
-					}
-				}
-			} else {
-				err := luid.AddRoute(netip.PrefixFrom(netip.IPv6Unspecified(), 0), netip.IPv6Unspecified(), 0)
-				if err != nil {
-					return E.Cause(err, "set ipv6 route")
-				}
-			}
-		}
-		err := windnsapi.FlushResolverCache()
+		err = windnsapi.FlushResolverCache()
 		if err != nil {
 			return err
 		}