Repository navigation
Fix forwarding packets on flows closed on attach - #94
Open
chasylexus wants to merge 25 commits into
Open
chasylexus wants to merge 25 commits into
chasylexus wants to merge 25 commits into
Conversation
Apple M2, internal/checksum_test, median of 3 runs: length generic NEON 64 B 5.47 ns 3.76 ns 128 B 6.63 ns 4.96 ns 512 B 14.8 ns 8.46 ns 1460 B 52.4 ns 16.7 ns 8500 B 341 ns 85.4 ns 65535 B 2661 ns 609 ns
A FlowTracker may close its flow through the FlowHandle from AttachFlow. The forward dispatcher and the gVisor ICMP forwarder still wrote the packet that created the flow to the port after AttachFlow returned, so it went out on a flow that was already closed. For ICMP this happened to every echo request, because a closed cached flow is dropped and the next request installs a new one. Check the flow's closed state before that first write.
nekohasekai
force-pushed
the
dev
branch
2 times, most recently
from
October 9, 2026 03:10
7539c98 to
5c2edb1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FlowTracker.AttachFlowreceives the flow'sFlowHandle, so a tracker can close the flow right there, for example when it finds the judged route is no longer usable. None of the trackers in sing-box do this today; this covers trackers that do.ForwardStage.judgeAndInstallandICMPForwarder.installFlowstill wrote the flow's first packet to the port afterAttachFlowreturned, so that packet went out on a flow that was already closed.handleHit. In the ICMP forwarder,forwardCacheddrops the closed flow and the next echo request installs a new one, so every echo request went out while the tracker kept closing the flow.closedflag before that first write. The packet is dropped, and the closed flow is cleaned up the same way as before.Test plan
TestForwardFlowClosedOnAttach: a tracker that closes the flow inAttachFlow; no packet reaches the port afterFlush(fails without the fix)TestICMPForwarderClosedOnAttach(with_gvisor): the same check for the ICMP forwarder (fails without the fix)go build ./...andgo vetwith and withoutwith_gvisor;go test -racefor the new tests; the rest ofgo test -tags with_gvisor ./...fails the same way with and without this change (integration tests that need socket permissions)