Leadaxe：singbox-launcher 开发分支加入 Linux TUN auto_redirect，本机默认开启、远程默认关闭

Leadaxe 在 singbox-launcher #129 中说明，develop f928cab5 已加入“TUN auto redirect (Linux)”设置，并计划随下一次构建分发。该设置只在 Linux 且 TUN、auto-route 开启时显示，本机默认开启，远程机器默认关闭；生成配置也仅在 Linux 开启 auto-route 时写入 auto_redirect，关闭开关会显式写入 false。宿主机需有 nftables 或 iptables，缺少时内核可能无法启动，可在设置中关闭；system 仍为默认栈，既有防火墙规则与 gvisor 仍可作为替代方案。此项仅面向桌面且属于宿主机设置，不随备份迁移，也不传给 Android。作者说明待下一次构建发布后，再请原报告者在 openSUSE 确认。

作者原文@Leadaxe
Implementation details, for the record (develop f928cab5).
1. Settings variable — bin/wizard_template.json, declared right after strict_route:
{
  "name": "auto_redirect",
  "type": "bool",
  "wizard_ui": "edit",
  "title": "TUN auto redirect (Linux)",
  "default_value": {"default": {"#if": [{"@runtime.target": "local"}, "true", "false"]}},
  "#enable": ["@tun", "@auto_route", "{\"@runtime.platform\": \"linux\"}"]
}
default_value depends on the build target: @runtime.target is local for this computer and remote for machines managed from the Remote tab (routers, servers under lxd). So the switch is on by default locally and off by default for remote machines — existing router deployments keep their current behaviour, and auto_redirect needs nftables or iptables on the host, which is not a given there.
#enable gates the field itself: it exists only when TUN and auto-route are on and the platform is Linux. On macOS and Windows the setting is not shown and the variable is not resolved at all.
2. Emission — the tun inbound in params[], next to the existing interface_name condition:
"#if_auto_redirect": [{"#and": [{"@runtime.platform": "linux"}, "@auto_route"]}, {"auto_redirect": "@auto_redirect"}]
A named #if that spreads {"auto_redirect": <value>} into the inbound only on Linux and only when auto_route is on. Without auto_route sing-box rejects auto_redirect, and non-Linux cores do not know the key, so in those cases it is simply absent from config.json. The value is the boolean from the setting, so turning the switch off emits "auto_redirect": false explicitly rather than dropping the key.
3. Contract registry — contract/registry/vars.json, contract bumped to 1.1.133:
"auto_redirect": {"type": "bool", "portable": false, "in": "desktop"}
Desktop-only and non-portable: it describes the host (its firewall and netfilter), not the profile, so it is not carried in backups and the Android client never sees it.
4. Test — TestBundledTemplate_AutoRedirectLinuxOnly renders the bundled template and checks: Linux local → true; Linux remote → false; Linux remote with the switch on → true; Linux with auto-route off → key absent; macOS and Windows → key absent. The golden configs for the linux/amd64 remote scenarios gained "auto_redirect": false; the macOS and Windows goldens did not change by a byte.
Resulting inbound on a Linux desktop with defaults:
{
  "type": "tun",
  "tag": "tun-in",
  "auto_route": true,
  "strict_route": false,
  "stack": "system",
  "interface_name": "singbox-tun0",
  "auto_redirect": true,
  ...
}
If the core refuses to start with auto_redirect (no nftables and no iptables on the host), the switch is in Settings to turn it off; the firewall-cmd rule and gvisor from the troubleshooting entry remain as fallbacks.

返回动态列表查看原文