TUN inbound: Rename to autoSystemWfpBlockLeak and autoSystemDnsToGateway

autoSystemWFP becomes autoSystemWfpBlockLeak, saying that the WFP filters
block leaks, and autoSystemDNS becomes autoSystemDnsToGateway, saying
where it points the system DNS, so that pointing the system DNS at the
gateway on Windows later would fit the same name. Their config fields
keep their numbers; neither was released.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
patterniha
2026-09-30 02:31:00 +03:30
co-authored by Claude Opus 5.5
parent 63de6135cb
commit 4ec4fb8aab
8 changed files with 40 additions and 34 deletions
+6 -5
View File
@@ -246,10 +246,11 @@ startOver:
}
}
// With autoSystemWFP, once the system routes lead to the TUN, keep DNS if
// dns is set, and IPv6 if the TUN cannot carry it (no IPv6 address, or no
// IPv6 route to it), from leaving through the other interfaces.
if blockDNS, blockIPv6 := len(dns) > 0, !address6 || !route6; t.options.AutoSystemWfp && (route4 || route6) && (blockDNS || blockIPv6) {
// With autoSystemWfpBlockLeak, once the system routes lead to the TUN,
// keep DNS if dns is set, and IPv6 if the TUN cannot carry it (no IPv6
// address, or no IPv6 route to it), from leaving through the other
// interfaces.
if blockDNS, blockIPv6 := len(dns) > 0, !address6 || !route6; t.options.AutoSystemWfpBlockLeak && (route4 || route6) && (blockDNS || blockIPv6) {
if t.wfp, err = blockLeaks(t.luid, blockDNS, blockIPv6); err != nil {
what := "DNS and IPv6"
if !blockIPv6 {
@@ -261,7 +262,7 @@ startOver:
// untested, and sing-box's broke its TUN there (SagerNet/sing-box#3659),
// so older versions only get a warning.
if major, _, _ := windows.RtlGetNtVersionNumbers(); major >= 10 {
return errors.New("unable to block ", what, " outside the TUN (set autoSystemWFP to false to run without)").Base(err)
return errors.New("unable to block ", what, " outside the TUN (set autoSystemWfpBlockLeak to false to run without)").Base(err)
}
errors.LogWarningInner(context.Background(), err, "[tun] unable to block ", what, " outside the TUN, leaks are possible")
} else {