feat(dns): protect provider DNS from unconfirmed overrides (#7902)

Fixes #7292

src-tauri/src/cmd/clash.rs

@@ -127,6 +127,18 @@ pub async fn save_dns_config(dns_config: Mapping) -> CmdResult {
     Ok(())
 }
 
+#[tauri::command]
+pub fn take_dns_override_notice() -> bool {
+    crate::config::dns::take_dns_override_notice()
+}
+
+#[tauri::command]
+pub async fn set_dns_override(enabled: bool, confirmation: Option<String>) -> CmdResult<feat::DnsOverrideOutcome> {
+    feat::set_dns_override(enabled, confirmation)
+        .await
+        .map_err(|error| proxy_aware_coded_error(&error, "DNS_OVERRIDE_UPDATE_FAILED"))
+}
+
 #[tauri::command]
 pub async fn apply_dns_config(apply: bool) -> CmdResult {
     if apply {
@@ -169,6 +181,7 @@ pub async fn apply_dns_config(apply: bool) -> CmdResult {
         logging!(info, Type::Config, "Config regenerated successfully");
     }
 
+    logging_error!(Type::Config, Config::sync_dns_override().await);
     handle::Handle::refresh_clash();
     Ok(())
 }

src-tauri/src/cmd/profile.rs

@@ -180,6 +180,10 @@ pub async fn delete_profile(index: String) -> CmdResult {
     drop(config_update_guard);
     drop(profile_write_guard);
 
+    if should_update {
+        logging_error!(Type::Config, Config::sync_dns_override().await);
+    }
+
     if let Err(e) = Tray::global().update_tooltip().await {
         logging!(warn, Type::Cmd, "异步更新托盘提示失败: {e:#}");
     }
@@ -249,6 +253,7 @@ async fn handle_success(current_value: Option<&String>) -> CmdResult<ValidationO
         handle::Handle::notify_profile_changed(current);
     }
 
+    logging_error!(Type::Config, Config::sync_dns_override().await);
     Ok(ValidationOutcome::Valid)
 }
 

src-tauri/src/cmd/save_profile.rs

@@ -10,7 +10,7 @@ use crate::{
     module::auto_backup::{AutoBackupManager, AutoBackupTrigger},
     utils::dirs,
 };
-use clash_verge_logging::{Type, logging};
+use clash_verge_logging::{Type, logging, logging_error};
 use smartstring::alias::String;
 use tokio::fs;
 
@@ -162,6 +162,7 @@ async fn handle_saved_profile_file(
     );
     match CoreManager::global().update_config_forced().await {
         Ok(outcome) if outcome.is_valid() => {
+            logging_error!(Type::Config, Config::sync_dns_override().await);
             handle::Handle::refresh_clash();
             Ok(ValidationOutcome::Valid)
         }

src-tauri/src/config/config.rs

@@ -109,6 +109,7 @@ impl Config {
         }
 
         Self::runtime().await.apply();
+        logging_error!(Type::Config, Self::sync_dns_override().await);
 
         Ok(())
     }
@@ -212,7 +213,7 @@ impl Config {
     }
 
     pub(crate) async fn generate_with_profiles(profiles: &IProfiles) -> Result<()> {
-        let (mut config, exists_keys, logs) = enhance::enhance(profiles).await?;
+        let (mut config, exists_keys, logs, dns_override) = enhance::enhance(profiles).await?;
 
         sanitize_tunnels_proxy(&mut config);
         // Apply only to generated core config so the saved choice survives the next launch.
@@ -223,6 +224,7 @@ impl Config {
         Self::runtime().await.edit_draft(|d| {
             *d = IRuntime {
                 config: Some(config),
+                dns_override: Some(dns_override),
                 exists_keys,
                 chain_logs: logs,
             }

src-tauri/src/config/dns.rs

@@ -0,0 +1,211 @@
+use anyhow::Result;
+use clash_verge_draft::DraftTransaction;
+use serde_yaml_ng::{Mapping, Value};
+use sha2::{Digest as _, Sha256};
+use smartstring::alias::String;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use super::{Config, IVerge};
+use crate::core::handle::Handle;
+
+static PENDING_DNS_OVERRIDE_NOTICE: AtomicBool = AtomicBool::new(false);
+
+pub(crate) fn take_dns_override_notice() -> bool {
+    PENDING_DNS_OVERRIDE_NOTICE.swap(false, Ordering::Relaxed)
+}
+
+const PROVIDER_DNS_FIELDS: [&str; 3] = [
+    "proxy-server-nameserver",
+    "proxy-server-nameserver-policy",
+    "nameserver-policy",
+];
+
+pub(crate) fn dns_override_source(profile_uid: &str, config: &Mapping) -> Result<Option<String>> {
+    let Some(dns) = config.get("dns").and_then(Value::as_mapping) else {
+        return Ok(None);
+    };
+    let fields: Mapping = PROVIDER_DNS_FIELDS
+        .iter()
+        .filter_map(|key| {
+            let value = dns.get(*key)?;
+            let nonempty = match value {
+                Value::Sequence(values) => !values.is_empty(),
+                Value::Mapping(values) => !values.is_empty(),
+                Value::String(value) => !value.trim().is_empty(),
+                _ => false,
+            };
+            nonempty.then(|| (Value::from(*key), value.clone()))
+        })
+        .collect();
+    if fields.is_empty() {
+        return Ok(None);
+    }
+
+    let mut canonical = serde_json::to_value(fields)?;
+    canonical.sort_all_objects();
+    let mut digest = Sha256::new();
+    digest.update(profile_uid.as_bytes());
+    digest.update([0]);
+    digest.update(serde_json::to_vec(&canonical)?);
+    Ok(Some(
+        digest.finalize().iter().map(|byte| format!("{byte:02x}")).collect(),
+    ))
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct DnsOverrideState {
+    pub source: Option<String>,
+    pub enabled: bool,
+    requested: bool,
+    confirmation: Option<String>,
+}
+
+impl DnsOverrideState {
+    pub fn new(source: Option<String>, requested: bool, confirmation: Option<String>) -> Self {
+        let enabled = requested && (source.is_none() || source == confirmation);
+        Self {
+            source,
+            enabled,
+            requested,
+            confirmation,
+        }
+    }
+
+    fn apply_to(&self, verge: &mut IVerge) -> bool {
+        // A later settings write must not be overwritten by an earlier runtime generation.
+        if verge.enable_dns_settings.unwrap_or(false) != self.requested
+            || verge.dns_override_confirmation != self.confirmation
+        {
+            return false;
+        }
+        let clear_confirmation = self.confirmation.is_some() && self.source != self.confirmation;
+        if self.enabled == self.requested && !clear_confirmation {
+            return false;
+        }
+        verge.enable_dns_settings = Some(self.enabled);
+        if clear_confirmation {
+            verge.dns_override_confirmation = None;
+        }
+        true
+    }
+}
+
+impl Config {
+    pub(crate) async fn sync_dns_override() -> Result<()> {
+        let _config_write = Self::lock_config_write().await;
+        let state = Self::runtime().await.data_arc().dns_override.clone();
+        let Some(state) = state else {
+            return Ok(());
+        };
+        let verge = Self::verge().await;
+        let transaction = DraftTransaction::begin(vec![&verge])?;
+        if !verge.edit_draft(|draft| state.apply_to(draft)) {
+            return Ok(());
+        }
+        // The runtime is already committed; a disk failure cannot undo its effective settings.
+        transaction.commit();
+        Handle::refresh_verge();
+        if state.requested && !state.enabled {
+            PENDING_DNS_OVERRIDE_NOTICE.store(true, Ordering::Relaxed);
+            Handle::notice_message("dns_override::auto_disabled", "");
+        }
+        verge.data_arc().save_file().await
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, reason = "tests assert by panicking")]
+mod tests {
+    use super::{DnsOverrideState, dns_override_source};
+    use crate::config::IVerge;
+    use anyhow::Result;
+    use serde_yaml_ng::Mapping;
+
+    fn mapping(yaml: &str) -> Mapping {
+        serde_yaml_ng::from_str(yaml).expect("valid fixture")
+    }
+
+    #[test]
+    fn dns_override_detects_each_original_field_but_not_empty_placeholders() -> Result<()> {
+        for field in [
+            "proxy-server-nameserver: [https://doh.pub/dns-query]",
+            "proxy-server-nameserver-policy: {'www.yournode.com': '114.114.114.114'}",
+            "nameserver-policy: {'+.quandao.com': ['https://doh.dohcore.com:2096/dns-query/#skip-cert-verify=true']}",
+        ] {
+            assert!(dns_override_source("profile", &mapping(&format!("dns: {{{field}}}")))?.is_some());
+            assert!(dns_override_source("profile", &mapping(field))?.is_none());
+        }
+        for yaml in [
+            "{}",
+            "dns: {nameserver: [1.1.1.1]}",
+            "dns: {proxy-server-nameserver: [], proxy-server-nameserver-policy: null, nameserver-policy: {}}",
+        ] {
+            assert!(dns_override_source("profile", &mapping(yaml))?.is_none());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn dns_override_confirmation_survives_formatting_but_not_a_different_source() -> Result<()> {
+        let original = mapping("dns: {nameserver-policy: {a.example: 1.1.1.1, b.example: [8.8.8.8]}}");
+        let source = dns_override_source("one", &original)?;
+        let reordered =
+            mapping("dns:\n  nameserver-policy:\n    b.example: [8.8.8.8]\n    a.example: 1.1.1.1\nport: 7890");
+        assert_eq!(source, dns_override_source("one", &reordered)?);
+        assert!(DnsOverrideState::new(source.clone(), true, source.clone()).enabled);
+        assert!(!DnsOverrideState::new(dns_override_source("two", &original)?, true, source.clone()).enabled);
+        let changed = mapping("dns: {nameserver-policy: {a.example: 9.9.9.9, b.example: [8.8.8.8]}}");
+        assert!(!DnsOverrideState::new(dns_override_source("one", &changed)?, true, source).enabled);
+        Ok(())
+    }
+
+    #[test]
+    fn dns_override_confirmation_expires_on_restart() -> Result<()> {
+        let source = Some("provider-dns".into());
+        let confirmed = IVerge {
+            enable_dns_settings: Some(true),
+            dns_override_confirmation: source.clone(),
+            ..IVerge::default()
+        };
+        assert!(DnsOverrideState::new(source.clone(), true, confirmed.dns_override_confirmation.clone()).enabled);
+        for saved in [
+            serde_yaml_ng::to_string(&confirmed)?,
+            "enable_dns_settings: true\ndns_override_confirmation: provider-dns".to_owned(),
+        ] {
+            let mut restarted: IVerge = serde_yaml_ng::from_str(&saved)?;
+            let state = DnsOverrideState::new(
+                source.clone(),
+                restarted.enable_dns_settings.unwrap_or(false),
+                restarted.dns_override_confirmation.clone(),
+            );
+            assert!(!state.enabled, "a previous session must not bypass startup protection");
+            assert!(state.apply_to(&mut restarted));
+            assert_eq!(restarted.enable_dns_settings, Some(false));
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn dns_override_applies_only_to_current_preferences() {
+        let mut verge = IVerge {
+            enable_dns_settings: Some(true),
+            ..IVerge::default()
+        };
+        let state = DnsOverrideState::new(Some("provider-dns".into()), true, None);
+        assert!(state.apply_to(&mut verge));
+        assert_eq!(verge.enable_dns_settings, Some(false));
+        assert!(!state.apply_to(&mut verge));
+        let disabled = DnsOverrideState::new(None, false, None);
+        assert!(!disabled.apply_to(&mut verge));
+        assert!(!disabled.enabled);
+
+        verge.enable_dns_settings = Some(true);
+        verge.dns_override_confirmation = Some("provider-dns".into());
+        assert!(!state.apply_to(&mut verge));
+        assert_eq!(verge.enable_dns_settings, Some(true));
+        assert_eq!(verge.dns_override_confirmation.as_deref(), Some("provider-dns"));
+        let leaving = DnsOverrideState::new(None, true, verge.dns_override_confirmation.clone());
+        assert!(leaving.apply_to(&mut verge));
+        assert!(verge.dns_override_confirmation.is_none());
+    }
+}

src-tauri/src/config/mod.rs

@@ -1,6 +1,7 @@
 mod clash;
 #[allow(clippy::module_inception)]
 mod config;
+pub(crate) mod dns;
 mod encrypt;
 mod mixed_port;
 mod port;

src-tauri/src/config/runtime.rs

@@ -9,6 +9,7 @@ const PATCH_CONFIG_INNER: [&str; 5] = ["allow-lan", "ipv6", "log-level", "unifie
 #[derive(Default, Clone)]
 pub struct IRuntime {
     pub config: Option<Mapping>,
+    pub(crate) dns_override: Option<super::dns::DnsOverrideState>,
     // Keys seen in the profile pipeline, including merge and script output.
     pub exists_keys: HashSet<String>,
     // TODO 或许可以用 FixMap 来存储以提升效率

src-tauri/src/config/verge.rs

@@ -80,6 +80,10 @@ pub struct IVerge {
     /// enable dns settings - this controls whether dns_config.yaml is applied
     pub enable_dns_settings: Option<bool>,
 
+    // Force-enable confirmation is valid only for the current app session.
+    #[serde(skip)]
+    pub dns_override_confirmation: Option<String>,
+
     pub use_default_bypass: Option<bool>,
 
     pub system_proxy_bypass: Option<String>,

src-tauri/src/core/manager/config.rs

@@ -138,6 +138,7 @@ impl CoreManager {
         Config::runtime().await.edit_draft(|d| {
             *d = IRuntime {
                 config: Some(clash_config.to_owned()),
+                dns_override: None,
                 exists_keys: HashSet::new(),
                 chain_logs: Default::default(),
             }

src-tauri/src/enhance/mod.rs

@@ -13,6 +13,7 @@ use self::{
     seq::{SeqMap, use_seq},
     tun::use_tun,
 };
+use crate::config::dns::{DnsOverrideState, dns_override_source};
 use crate::utils::dirs;
 use crate::{
     config::{Config, IProfiles, IVerge, PrfItem},
@@ -36,6 +37,7 @@ struct ConfigValues {
     socks_enabled: bool,
     http_enabled: bool,
     enable_dns_settings: bool,
+    dns_override_confirmation: Option<String>,
     enable_external_controller: bool,
     #[cfg(not(target_os = "windows"))]
     redir_enabled: bool,
@@ -121,6 +123,7 @@ async fn get_config_values() -> ConfigValues {
         ..
     } = **verge_arc;
     let enable_external_controller = enable_external_controller.unwrap_or(false);
+    let dns_override_confirmation = verge_arc.dns_override_confirmation.clone();
 
     let (clash_core, enable_tun, enable_builtin, socks_enabled, http_enabled, enable_dns_settings) = (
         Some(verge_arc.get_valid_clash_core()),
@@ -148,6 +151,7 @@ async fn get_config_values() -> ConfigValues {
         socks_enabled,
         http_enabled,
         enable_dns_settings,
+        dns_override_confirmation,
         enable_external_controller,
         #[cfg(not(target_os = "windows"))]
         redir_enabled,
@@ -701,8 +705,10 @@ async fn apply_dns_settings(mut config: Mapping, enable_dns_settings: bool) -> M
     config
 }
 
-/// Returns the enhanced profile, its original keys, and script logs.
-pub async fn enhance(profiles: &IProfiles) -> Result<(Mapping, HashSet<String>, HashMap<String, ResultLog>)> {
+/// Returns the enhanced profile, its original keys, script logs, and DNS override decision.
+pub async fn enhance(
+    profiles: &IProfiles,
+) -> Result<(Mapping, HashSet<String>, HashMap<String, ResultLog>, DnsOverrideState)> {
     let cfg_vals = get_config_values().await;
     let ConfigValues {
         clash_config,
@@ -712,6 +718,7 @@ pub async fn enhance(profiles: &IProfiles) -> Result<(Mapping, HashSet<String>,
         socks_enabled,
         http_enabled,
         enable_dns_settings,
+        dns_override_confirmation,
         enable_external_controller,
         #[cfg(not(target_os = "windows"))]
         redir_enabled,
@@ -720,6 +727,12 @@ pub async fn enhance(profiles: &IProfiles) -> Result<(Mapping, HashSet<String>,
     } = cfg_vals;
 
     let profile = collect_profile_items(profiles).await?;
+    let dns_override = DnsOverrideState::new(
+        dns_override_source(profiles.current.as_deref().unwrap_or_default(), &profile.config)?,
+        enable_dns_settings,
+        dns_override_confirmation,
+    );
+    let enable_dns_settings = dns_override.enabled;
     let config = profile.config;
     let merge_item = profile.merge_item;
     let script_item = profile.script_item;
@@ -775,7 +788,7 @@ pub async fn enhance(profiles: &IProfiles) -> Result<(Mapping, HashSet<String>,
     let mut exists_keys_set = HashSet::new();
     exists_keys_set.extend(exists_keys);
 
-    Ok((config, exists_keys_set, result_map))
+    Ok((config, exists_keys_set, result_map, dns_override))
 }
 
 #[cfg(test)]

src-tauri/src/feat/backup.rs

@@ -9,7 +9,7 @@ use crate::{
 };
 use anyhow::{Result, anyhow};
 use chrono::Utc;
-use clash_verge_logging::{Type, logging};
+use clash_verge_logging::{Type, logging, logging_error};
 use reqwest_dav::list_cmd::ListFile;
 use serde::Serialize;
 use smartstring::alias::String;
@@ -85,6 +85,7 @@ async fn finalize_restored_verge_config(
             return Err(err);
         }
     }
+    logging_error!(Type::Config, Config::sync_dns_override().await);
     Ok(())
 }
 

src-tauri/src/feat/dns.rs

@@ -0,0 +1,63 @@
+use anyhow::Result;
+use clash_verge_draft::DraftTransaction;
+use serde::Serialize;
+use smartstring::alias::String;
+
+use crate::{
+    config::{Config, dns::dns_override_source, profiles::PROFILE_WRITE_LOCK},
+    constants::files::DNS_CONFIG,
+    core::{CoreManager, handle::Handle},
+    utils::dirs,
+};
+
+#[derive(Serialize)]
+#[serde(tag = "status", rename_all = "snake_case")]
+pub enum DnsOverrideOutcome {
+    Applied,
+    ConfirmationRequired { source: String },
+}
+
+pub async fn set_dns_override(enabled: bool, confirmation: Option<String>) -> Result<DnsOverrideOutcome> {
+    let _profile_write = PROFILE_WRITE_LOCK.lock().await;
+    let _config_write = Config::lock_config_write().await;
+    let profiles = Config::profiles().await.data_arc();
+    let source = dns_override_source(
+        profiles.current.as_deref().unwrap_or_default(),
+        &profiles.current_mapping().await?,
+    )?;
+    if enabled && let Some(source) = source.as_ref().filter(|source| Some(*source) != confirmation.as_ref()) {
+        return Ok(DnsOverrideOutcome::ConfirmationRequired { source: source.clone() });
+    }
+
+    if enabled {
+        let content = tokio::fs::read_to_string(dirs::app_home_dir()?.join(DNS_CONFIG)).await?;
+        serde_yaml_ng::from_str::<serde_yaml_ng::Mapping>(&content)?;
+    }
+
+    let verge = Config::verge().await;
+    let transaction = DraftTransaction::begin(vec![&verge])?;
+    verge.edit_draft(|draft| {
+        draft.enable_dns_settings = Some(enabled);
+        draft.dns_override_confirmation = if enabled { source } else { None };
+    });
+    CoreManager::global().update_config_checked().await?;
+
+    let state = Config::runtime().await.data_arc().dns_override.clone();
+    let mut outcome = DnsOverrideOutcome::Applied;
+    // A subscription update can replace the file while Mihomo is validating it.
+    if enabled && let Some(state) = state.filter(|state| !state.enabled) {
+        verge.edit_draft(|draft| {
+            draft.enable_dns_settings = Some(false);
+            draft.dns_override_confirmation = None;
+        });
+        if let Some(source) = state.source {
+            outcome = DnsOverrideOutcome::ConfirmationRequired { source };
+        }
+    }
+
+    transaction.commit();
+    Handle::refresh_verge();
+    Handle::refresh_clash();
+    verge.data_arc().save_file().await?;
+    Ok(outcome)
+}

src-tauri/src/feat/mod.rs

@@ -2,6 +2,7 @@ mod backup;
 mod clash;
 mod config;
 mod core_upgrade;
+mod dns;
 mod icon;
 mod listener;
 mod profile;
@@ -14,6 +15,7 @@ pub use backup::*;
 pub use clash::*;
 pub use config::*;
 pub use core_upgrade::*;
+pub use dns::*;
 pub use icon::*;
 pub use listener::*;
 pub use profile::*;

src-tauri/src/feat/profile.rs

@@ -5,7 +5,7 @@ use crate::{
     utils::help::{mask_err, mask_url},
 };
 use anyhow::{Result, bail};
-use clash_verge_logging::{Type, logging};
+use clash_verge_logging::{Type, logging, logging_error};
 use smartstring::alias::String;
 
 /// Toggle proxy profile
@@ -200,6 +200,7 @@ pub async fn update_profile(uid: &String, option: Option<&PrfOption>, is_mannual
         logging!(debug, Type::Config, "[订阅更新] 更新内核配置");
         match CoreManager::global().update_config_with_force(is_mannual_trigger).await {
             Ok(outcome) if outcome.is_valid() => {
+                logging_error!(Type::Config, Config::sync_dns_override().await);
                 handle::Handle::refresh_clash();
             }
             Ok(outcome @ (ValidationOutcome::Skipped { .. } | ValidationOutcome::Busy)) if !is_mannual_trigger => {
@@ -228,5 +229,9 @@ pub async fn update_profile(uid: &String, option: Option<&PrfOption>, is_mannual
 
 /// 增强配置
 pub async fn enhance_profiles() -> Result<ValidationOutcome> {
-    CoreManager::global().update_config_forced().await
+    let outcome = CoreManager::global().update_config_forced().await?;
+    if outcome.is_valid() {
+        logging_error!(Type::Config, Config::sync_dns_override().await);
+    }
+    Ok(outcome)
 }

src-tauri/src/lib.rs

@@ -160,6 +160,8 @@ mod app_init {
             cmd::forget_selected_node,
             cmd::save_dns_config,
             cmd::apply_dns_config,
+            cmd::set_dns_override,
+            cmd::take_dns_override_notice,
             cmd::get_dns_config_content,
             cmd::validate_dns_config,
             cmd::get_clash_logs,