1.12.x 似乎无法探测 quic 流量的进程

[ReleTor]

操作系统

Windows

系统版本

24H2

安装类型

sing-box 原始命令行程序

如果您使用图形客户端程序，请提供该程序版本。

No response

版本

sing-box version 1.12.0-alpha.8

Environment: go1.24.0 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_ech,with_utls,with_reality_server,with_acme,with_clash_api,with_tailscale
Revision: d979e1e4922dee39e20321f75332ba247763a310
CGO: disabled

描述

1.12.x 似乎无法探测 quic 流量的进程。

重现方式

浏览器启用 quic (chrome://flags/#enable-quic) 访问 Youtube 在相同配置的情况下，1.11.3 可以探测到进程为 chrome 而 1.12.x 则无法获取。

{
  "log": {
    "disabled": false,
    "level": "debug",
    "output": "",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "tag": "google",
        "address": "https://8.8.8.8/dns-query",
        "detour": "proxy"
      }
    ],
    "rules": [
      {
        "outbound": "any",
        "server": "google",
        "client_subnet": "223.5.5.0/24"
      },
      {
        "rule_set": "geosite-geolocation-!cn",
        "server": "google"
      },
      {
        "rule_set": "geosite-geolocation-cn",
        "server": "google",
        "client_subnet": "223.5.5.0/24"
      },
      {
        "type": "logical",
        "mode": "and",
        "rules": [
          {
            "rule_set": "geosite-geolocation-!cn",
            "invert": true
          },
          {
            "rule_set": "geoip-cn"
          }
        ],
        "server": "google",
        "client_subnet": "223.5.5.0/24"
      }
    ],
    "final": "google",
    "strategy": "prefer_ipv4",
    "disable_cache": false,
    "disable_expire": false,
    "independent_cache": true
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun",
      "interface_name": "Tunnel",
      "address": ["192.168.12.1/30", "fdfe:12::1/126"],
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [
    {
      "type": "vmess",
      "tag": "proxy"
      // ...
    },
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "action": "hijack-dns",
        "protocol": "dns"
      },
      {
        "action": "route",
        "outbound": "direct",
        "ip_is_private": true
      },
      {
        "action": "route",
        "outbound": "proxy",
        "rule_set": "geosite-geolocation-!cn"
      },
      {
        "action": "route",
        "outbound": "direct",
        "rule_set": "geosite-geolocation-cn"
      },
      {
        "action": "resolve"
      },
      {
        "action": "route",
        "outbound": "direct",
        "rule_set": "geoip-cn"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geoip-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
        "download_detour": "proxy"
      },
      {
        "type": "remote",
        "tag": "geosite-geolocation-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-cn.srs",
        "download_detour": "proxy"
      },
      {
        "type": "remote",
        "tag": "geosite-geolocation-!cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
        "download_detour": "proxy"
      }
    ],
    "final": "proxy",
    "auto_detect_interface": true
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "store_rdrc": true
    },
    "clash_api": {
      "external_controller": "127.0.0.1:9090",
      "external_ui": "ui",
      "external_ui_download_detour": "proxy"
    }
  }
}

日志

INFO router: failed to search process: process not found for 192.168.12.1:62850

支持我们

• 我已经 赞助

完整性要求

• 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
• 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
• 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
• 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。

[ReleTor]

补充：在 1.11.3 版本中不能从 chrome 的 quic 流量中探测到 server name 但可以从 curl 的 quic 流量中探测到 server name。

通过 wireshark 可以获取浏览器 quic 流量的 server name 因此怀疑嗅探器存在一定程度的缺陷。

1.12.0-alpha.9 版本可以探测出 server name