fix: linux tun, add tests for tun

Co-authored-by: Copilot <copilot@github.com>

Author: nichind

.github/workflows/build.yml

@@ -41,4 +41,17 @@ jobs:
           python -m pip install -e .
       - name: Run Tests
         run: |
-          python -m pytest tests/ --tb=short --disable-warnings
+          python -m pytest tests/ --tb=short --disable-warnings --ignore=tests/tun_test.py
+      - name: Run TUN config tests
+        run: |
+          python -m pytest tests/tun_test.py::TestTunConfig --tb=short --disable-warnings -v
+      - name: Run TUN live test (Linux)
+        if: runner.os == 'Linux' && env.TEST_SINGBOX_LINK != ''
+        run: |
+          sudo -E env "PATH=$PATH" "TEST_SINGBOX_LINK=$TEST_SINGBOX_LINK" "$pythonLocation/bin/python" -m pytest tests/tun_test.py::TestTunLiveSystemVpn --tb=short --disable-warnings -v
+        continue-on-error: true
+      - name: Run TUN live test (Windows)
+        if: runner.os == 'Windows' && env.TEST_SINGBOX_LINK != ''
+        run: |
+          python -m pytest tests/tun_test.py::TestTunLiveSystemVpn --tb=short --disable-warnings -v
+        continue-on-error: true

singbox2proxy/base.py

@@ -1443,6 +1443,7 @@ def __init__(
         tun_stack: str = "system",
         tun_mtu: int = 9000,
         tun_auto_route: bool = True,
+        tun_auto_redirect: bool | None = None,
         set_system_proxy: bool = False,
         route: dict = None,
         relay_protocol: str = None,
@@ -1541,6 +1542,9 @@ def __init__(
         self.tun_stack = tun_stack
         self.tun_mtu = tun_mtu
         self.tun_auto_route = tun_auto_route
+        if tun_auto_redirect is None:
+            tun_auto_redirect = sys.platform.startswith("linux")
+        self.tun_auto_redirect = tun_auto_redirect
         self.set_system_proxy = set_system_proxy
         self.route = route
 
@@ -2321,6 +2325,13 @@ def generate_config(self, chain_proxy=_SENTINEL):
                     "strict_route": True,
                     "stack": self.tun_stack,
                 }
+                if (
+                    self.tun_auto_redirect
+                    and self.tun_auto_route
+                    and sys.platform.startswith("linux")
+                    and core_version >= (1, 10, 0)
+                ):
+                    tun_inbound["auto_redirect"] = True
                 # sniff on inbound: works <1.13
                 if core_version < (1, 13, 0):
                     tun_inbound["sniff"] = True

singbox2proxy/cli.py

@@ -270,6 +270,10 @@ def main():
     tun_group.add_argument("--tun-mtu", type=int, default=9000, help="TUN MTU (default: 9000)")
     tun_group.add_argument("--tun-auto-route", action="store_true", default=True, help="Auto-configure routes (default: on)")
     tun_group.add_argument("--no-tun-auto-route", dest="tun_auto_route", action="store_false", help="Disable auto routing")
+    tun_group.add_argument("--tun-auto-redirect", dest="tun_auto_redirect", action="store_true", default=None,
+                           help="Enable Linux nftables auto_redirect (default: on for Linux)")
+    tun_group.add_argument("--no-tun-auto-redirect", dest="tun_auto_redirect", action="store_false",
+                           help="Disable auto_redirect")
 
     relay_group = parser.add_argument_group("relay")
     relay_group.add_argument("--relay-host", help="Host/IP for relay URL (default: auto-detect)")
@@ -375,6 +379,7 @@ def main():
                     tun_stack=args.tun_stack,
                     tun_mtu=args.tun_mtu,
                     tun_auto_route=args.tun_auto_route,
+                    tun_auto_redirect=args.tun_auto_redirect,
                     set_system_proxy=args.set_system_proxy if is_last else False,
                 )
                 proxies.append(proxy)
@@ -394,6 +399,7 @@ def main():
                 tun_stack=args.tun_stack,
                 tun_mtu=args.tun_mtu,
                 tun_auto_route=args.tun_auto_route,
+                tun_auto_redirect=args.tun_auto_redirect,
                 set_system_proxy=args.set_system_proxy,
                 relay_protocol=args.relay,
                 relay_host=args.relay_host,

tests/tun_test.py

@@ -0,0 +1,132 @@
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+import unittest
+from unittest import mock
+
+from singbox2proxy import SingBoxProxy
+
+
+TEST_LINK = os.environ.get("TEST_SINGBOX_LINK")
+
+
+def _read_config(proxy: SingBoxProxy) -> dict:
+    path = proxy.create_config_file()
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return json.load(f)
+    finally:
+        if os.path.exists(path):
+            os.remove(path)
+
+
+def _find_tun_inbound(config: dict) -> dict | None:
+    for inbound in config.get("inbounds", []):
+        if inbound.get("type") == "tun":
+            return inbound
+    return None
+
+
+class TestTunConfig(unittest.TestCase):
+    def test_tun_disabled_by_default(self):
+        proxy = SingBoxProxy("socks://127.0.0.1:1080", config_only=True)
+        config = _read_config(proxy)
+        self.assertIsNone(_find_tun_inbound(config))
+
+    def test_tun_basic_fields(self):
+        proxy = SingBoxProxy("socks://127.0.0.1:1080", config_only=True, tun_enabled=True)
+        config = _read_config(proxy)
+        tun = _find_tun_inbound(config)
+        self.assertIsNotNone(tun)
+        self.assertEqual(tun["type"], "tun")
+        self.assertTrue(tun["auto_route"])
+        self.assertTrue(tun["strict_route"])
+        self.assertEqual(tun["stack"], "system")
+        self.assertEqual(tun["address"], ["172.19.0.1/30"])
+
+    def test_tun_auto_redirect_on_linux(self):
+        with mock.patch.object(sys, "platform", "linux"):
+            proxy = SingBoxProxy("socks://127.0.0.1:1080", config_only=True, tun_enabled=True)
+            with mock.patch.object(SingBoxProxy, "_parse_core_version", return_value=(1, 13, 0)):
+                config = _read_config(proxy)
+        self.assertTrue(_find_tun_inbound(config).get("auto_redirect"))
+
+    def test_tun_no_auto_redirect_on_windows(self):
+        with mock.patch.object(sys, "platform", "win32"):
+            proxy = SingBoxProxy("socks://127.0.0.1:1080", config_only=True, tun_enabled=True)
+            with mock.patch.object(SingBoxProxy, "_parse_core_version", return_value=(1, 13, 0)):
+                config = _read_config(proxy)
+        self.assertNotIn("auto_redirect", _find_tun_inbound(config))
+
+    def test_tun_auto_redirect_skipped_for_old_core(self):
+        with mock.patch.object(sys, "platform", "linux"):
+            proxy = SingBoxProxy("socks://127.0.0.1:1080", config_only=True, tun_enabled=True)
+            with mock.patch.object(SingBoxProxy, "_parse_core_version", return_value=(1, 9, 0)):
+                config = _read_config(proxy)
+        self.assertNotIn("auto_redirect", _find_tun_inbound(config))
+
+    def test_tun_auto_redirect_explicit_off(self):
+        with mock.patch.object(sys, "platform", "linux"):
+            proxy = SingBoxProxy(
+                "socks://127.0.0.1:1080",
+                config_only=True,
+                tun_enabled=True,
+                tun_auto_redirect=False,
+            )
+            with mock.patch.object(SingBoxProxy, "_parse_core_version", return_value=(1, 13, 0)):
+                config = _read_config(proxy)
+        self.assertNotIn("auto_redirect", _find_tun_inbound(config))
+
+
+def _has_privileges() -> bool:
+    if sys.platform.startswith("win"):
+        try:
+            import ctypes
+
+            return bool(ctypes.windll.shell32.IsUserAnAdmin())
+        except Exception:
+            return False
+    return hasattr(os, "geteuid") and os.geteuid() == 0
+
+
+@unittest.skipUnless(
+    TEST_LINK
+    and (sys.platform.startswith("linux") or sys.platform.startswith("win"))
+    and _has_privileges(),
+    "Live TUN test requires Linux/Windows + root/admin + TEST_SINGBOX_LINK",
+)
+class TestTunLiveSystemVpn(unittest.TestCase):
+    IP_URL = "https://api.ipify.org?format=json"
+
+    def _fetch_proxy_ip(self) -> str:
+        proxy = SingBoxProxy(TEST_LINK)
+        try:
+            return proxy.get(self.IP_URL, timeout=15).json()["ip"]
+        finally:
+            proxy.stop()
+
+    def _fetch_system_ip(self) -> str:
+        import requests
+
+        return requests.get(self.IP_URL, timeout=15).json()["ip"]
+
+    def test_tun_captures_system_traffic(self):
+        proxy_ip = self._fetch_proxy_ip()
+        baseline_ip = self._fetch_system_ip()
+        self.assertNotEqual(proxy_ip, baseline_ip)
+
+        tun_proxy = SingBoxProxy(TEST_LINK, tun_enabled=True)
+        try:
+            time.sleep(5)
+            observed = self._fetch_system_ip()
+        finally:
+            tun_proxy.stop()
+
+        self.assertEqual(observed, proxy_ip)
+
+
+if __name__ == "__main__":
+    unittest.main()