Tun stack mixed unable to handle dns-out

[lux5am]

Operating system

Others

System version

openwrt 23.05.2

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.9.0-rc.3

Environment: go1.22.1 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_ech,with_utls,with_reality_server,with_acme,with_clash_api
Revision: cc8ae725c801419d9926951951816e9ac6ca67d0
CGO: disabled

Description

When using tun with mixed stack the DNS request always time out. Change it to stack system or gvisor is fine. Direct/tproxy inbound as dns-in also could be processed normally.

Reproduction

Config:

{
  "log": {
    "timestamp": true,
    "level": "trace"
  },
  "dns": {
    "servers": [
      {
        "tag": "dns-direct",
        "address": "8.8.8.8",
        "strategy": "ipv4_only",
        "detour": "direct"
      }
    ]
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "singtun",
      "inet4_address": "172.19.0.1/30",
      "inet6_address": "fdfe:dcba:9876::1/126",
      "mtu": 9000,
      "gso": true,
      "stack": "mixed",
      "auto_route": true,
      "strict_route": false
    },
    {
      "tag": "dns-in",
      "type": "direct",
      "listen": "::",
      "listen_port": 7874,
      "override_address": "8.8.8.8",
      "override_port": 53
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "dns",
      "tag": "dns-out"
    }
  ],
  "route": {
    "final": "direct",
    "rules": [
      {
        "type": "logical",
        "mode": "or",
        "rules": [
          {
            "protocol": "dns"
          },
          {
            "port": 53
          },
          {
            "inbound": "dns-in"
          }
        ],
        "outbound": "dns-out"
      }
    ]
  }
}

# dig google.com

; <<>> DiG 9.18.24 <<>> google.com
;; global options: +cmd
;; connection timed out; no servers could be reached


# dig google.com @9.9.9.9

; <<>> DiG 9.18.24 <<>> google.com @9.9.9.9
;; global options: +cmd
;; connection timed out; no servers could be reached

# dig google.com @127.0.0.1 -p 7874

; <<>> DiG 9.18.24 <<>> google.com @127.0.0.1 -p 7874
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62452
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x000e, udp: 512
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             14      IN      A       142.251.175.102
google.com.             14      IN      A       142.251.175.100                  google.com.             14      IN      A       142.251.175.138
google.com.             14      IN      A       142.251.175.101                  google.com.             14      IN      A       142.251.175.139
google.com.             14      IN      A       142.251.175.113

;; Query time: 79 msec
;; SERVER: 127.0.0.1#7874(127.0.0.1) (UDP)
;; WHEN: Thu Mar 28 02:58:03 WITA 2024
;; MSG SIZE  rcvd: 195

Logs

+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled                                              
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled                                              
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled                                              
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled                                              
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN A: context canceled                                                  
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled                                              
+0800 2024-03-28 03:04:46 ERROR dns: exchange failed for content-autofill.googleapis.com. IN HTTPS: context canceled

Supporter

• [ ] I am a sponsor

Integrity requirements

• [X] I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• [X] I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• [X] I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• [X] I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.