geoip-cn.srs incorrectly classifies Google anycast IPs (142.251.x.x) as China, causing false rejects

[Mr-QTFeng]

Problem

The geoip-cn rule set contains Google anycast IP ranges (e.g. 142.251.32.163), which are not Chinese IPs. This causes any domain resolving to these Google IPs to be falsely matched by geoip-cn and rejected.

Affected file

geoip-cn.srs (path: /rule-set/geoip-cn.srs)

Reproduction

Using sing-box with this rule in routing:

{
  "action": "reject",
  "rule_set": ["geoip-cn", "geosite-cn"]
}

Request https://www.gstatic.com/generate_204 → connection rejected.

sing-box debug log:

dns: lookup succeed for www.gstatic.com: 142.251.32.163 2607:f8b0:4007:805::2003
router: match[4] rule_set=[geoip-cn geosite-cn] => reject
router: connection closed: rejected

Evidence that 142.251.32.163 is a Google (not CN) IP

$ dig www.gstatic.com @1.1.1.1 +short
142.251.32.163

$ curl -4 -I https://www.gstatic.com/generate_204   # direct, works
HTTP/2 204

$ whois 142.251.32.163
NetOrg: GOGL  →  OrgName: Google LLC

The IP belongs to Google LLC (AS15169), not any Chinese network.

Impact

Any Google domain that resolves to a 142.251.x.x anycast IP (www.gstatic.com, ssl.gstatic.com, etc.) gets rejected when users enable the geoip-cn block rule. Meanwhile other Google domains (e.g. www.google.com) work because they resolve to different IPs not (yet) in the set — making the bug look random/intermittent.

Expected behavior

Google's IP ranges (142.250.0.0/15, 172.217.0.0/16, 142.251.32.163, etc.) should not be part of geoip-cn.

Suggested fix

Exclude Google's global anycast ranges from the CN geoip build, or cross-check against AS15169 before adding IPs to geoip-cn.

Environment

• Rule source: https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-cn.srs
• sing-box version: hiddify-sing-box 1.13.1 (hiddify-core v4.0.4)
• Hiddify Manager: 12.3.3