Fix auto_redirect fallback rule

The filter condition `IsGlobalUnicast() && !IsPrivate()` incorrectly
excluded ULA addresses (fc00::/7) from inet6_local_address_set,
causing DNS hijack to fail for IPv6 ULA addresses.

Fixes: sagernet/sing-box#3698

redirect_nftables.go

@@ -182,6 +182,25 @@ func (r *autoRedirect) setupNFTables() error {
 				},
 			},
 		})
+		nft.AddRule(&nftables.Rule{
+			Table: table,
+			Chain: chainPreRoutingUDP,
+			Exprs: []expr.Any{
+				&expr.Meta{
+					Key:      expr.MetaKeyIIFNAME,
+					Register: 1,
+				},
+				&expr.Cmp{
+					Op:       expr.CmpOpEq,
+					Register: 1,
+					Data:     nftablesIfname(r.tunOptions.Name),
+				},
+				&expr.Counter{},
+				&expr.Verdict{
+					Kind: expr.VerdictReturn,
+				},
+			},
+		})
 		nft.AddRule(&nftables.Rule{
 			Table: table,
 			Chain: chainPreRoutingUDP,

redirect_nftables_rules.go

@@ -103,10 +103,6 @@ func (r *autoRedirect) nftablesCreateLocalAddressSets(
 				update = true
 			}
 		}
-		localAddresses6 = common.Filter(localAddresses6, func(it netip.Prefix) bool {
-			address := it.Addr()
-			return address.IsLoopback() || address.IsGlobalUnicast() && !address.IsPrivate()
-		})
 		if len(lastAddresses) == 0 || update {
 			_, err := nftablesCreateIPSet(nft, table, 6, "inet6_local_address_set", nftables.TableFamilyIPv6, nil, localAddresses6, false, update)
 			if err != nil {

tun.go

@@ -52,44 +52,46 @@ type DarwinTUN interface {
 }
 
 const (
-	DefaultIPRoute2TableIndex = 2022
-	DefaultIPRoute2RuleIndex  = 9000
+	DefaultIPRoute2TableIndex                    = 2022
+	DefaultIPRoute2RuleIndex                     = 9000
+	DefaultIPRoute2AutoRedirectFallbackRuleIndex = 32768
 )
 
 type Options struct {
-	Name                     string
-	Inet4Address             []netip.Prefix
-	Inet6Address             []netip.Prefix
-	MTU                      uint32
-	GSO                      bool
-	AutoRoute                bool
-	InterfaceScope           bool
-	Inet4Gateway             netip.Addr
-	Inet6Gateway             netip.Addr
-	DNSServers               []netip.Addr
-	IPRoute2TableIndex       int
-	IPRoute2RuleIndex        int
-	AutoRedirectMarkMode     bool
-	AutoRedirectInputMark    uint32
-	AutoRedirectOutputMark   uint32
-	Inet4LoopbackAddress     []netip.Addr
-	Inet6LoopbackAddress     []netip.Addr
-	StrictRoute              bool
-	Inet4RouteAddress        []netip.Prefix
-	Inet6RouteAddress        []netip.Prefix
-	Inet4RouteExcludeAddress []netip.Prefix
-	Inet6RouteExcludeAddress []netip.Prefix
-	IncludeInterface         []string
-	ExcludeInterface         []string
-	IncludeUID               []ranges.Range[uint32]
-	ExcludeUID               []ranges.Range[uint32]
-	IncludeAndroidUser       []int
-	IncludePackage           []string
-	ExcludePackage           []string
-	InterfaceFinder          control.InterfaceFinder
-	InterfaceMonitor         DefaultInterfaceMonitor
-	FileDescriptor           int
-	Logger                   logger.Logger
+	Name                                  string
+	Inet4Address                          []netip.Prefix
+	Inet6Address                          []netip.Prefix
+	MTU                                   uint32
+	GSO                                   bool
+	AutoRoute                             bool
+	InterfaceScope                        bool
+	Inet4Gateway                          netip.Addr
+	Inet6Gateway                          netip.Addr
+	DNSServers                            []netip.Addr
+	IPRoute2TableIndex                    int
+	IPRoute2RuleIndex                     int
+	IPRoute2AutoRedirectFallbackRuleIndex int
+	AutoRedirectMarkMode                  bool
+	AutoRedirectInputMark                 uint32
+	AutoRedirectOutputMark                uint32
+	Inet4LoopbackAddress                  []netip.Addr
+	Inet6LoopbackAddress                  []netip.Addr
+	StrictRoute                           bool
+	Inet4RouteAddress                     []netip.Prefix
+	Inet6RouteAddress                     []netip.Prefix
+	Inet4RouteExcludeAddress              []netip.Prefix
+	Inet6RouteExcludeAddress              []netip.Prefix
+	IncludeInterface                      []string
+	ExcludeInterface                      []string
+	IncludeUID                            []ranges.Range[uint32]
+	ExcludeUID                            []ranges.Range[uint32]
+	IncludeAndroidUser                    []int
+	IncludePackage                        []string
+	ExcludePackage                        []string
+	InterfaceFinder                       control.InterfaceFinder
+	InterfaceMonitor                      DefaultInterfaceMonitor
+	FileDescriptor                        int
+	Logger                                logger.Logger
 
 	// No work for TCP, do not use.
 	_TXChecksumOffload bool

tun_linux.go

@@ -3,7 +3,6 @@ package tun
 import (
 	"errors"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"os"
@@ -277,16 +276,6 @@ func (t *NativeTun) Start() error {
 		}
 	}
 
-	if t.options.IPRoute2TableIndex == 0 {
-		for {
-			t.options.IPRoute2TableIndex = int(rand.Uint32())
-			routeList, fErr := netlink.RouteListFiltered(netlink.FAMILY_ALL, &netlink.Route{Table: t.options.IPRoute2TableIndex}, netlink.RT_FILTER_TABLE)
-			if len(routeList) == 0 || fErr != nil {
-				break
-			}
-		}
-	}
-
 	err = t.setRoute(tunLink)
 	if err != nil {
 		_ = t.unsetRoute0(tunLink)
@@ -617,6 +606,22 @@ func (t *NativeTun) rules() []*netlink.Rule {
 			it.Family = unix.AF_INET6
 			rules = append(rules, it)
 		}
+		// Fallback rules after system default rules (32766: main, 32767: default)
+		// Only reached when main and default tables have no route
+		if p4 {
+			it = netlink.NewRule()
+			it.Priority = t.options.IPRoute2AutoRedirectFallbackRuleIndex
+			it.Table = t.options.IPRoute2TableIndex
+			it.Family = unix.AF_INET
+			rules = append(rules, it)
+		}
+		if p6 {
+			it = netlink.NewRule()
+			it.Priority = t.options.IPRoute2AutoRedirectFallbackRuleIndex
+			it.Table = t.options.IPRoute2TableIndex
+			it.Family = unix.AF_INET6
+			rules = append(rules, it)
+		}
 		return rules
 	}
 
@@ -990,7 +995,7 @@ func (t *NativeTun) unsetRules() error {
 		for _, rule := range ruleList {
 			ruleStart := t.options.IPRoute2RuleIndex
 			ruleEnd := ruleStart + 10
-			if rule.Priority >= ruleStart && rule.Priority <= ruleEnd {
+			if rule.Priority >= ruleStart && rule.Priority <= ruleEnd || (t.options.AutoRedirectMarkMode && rule.Priority == t.options.IPRoute2AutoRedirectFallbackRuleIndex) {
 				ruleToDel := netlink.NewRule()
 				ruleToDel.Family = rule.Family
 				ruleToDel.Priority = rule.Priority