Skip to content

socks握手时的bufio会吞掉客户端流水线发送的首段payload,进而导致UoT v2客户端的每条流都会失败 #113

Open

Description

@Snowy117

问题

SOCKS5客户端可以把首个payload和CONNECT请求放在同一个TCP段里发送,以此节省一个RTT。但是sing就会把这部分字节丢掉。

对UoT v2客户端来说,就表现为每一条UoT流都在请求头处失败:客户端把发往 sp.v2.udp-over-tcp.arpa 的 CONNECT、UoT请求头和第一个数据帧写在同一个缓冲区里一次发出,服务端日志为

INFO  inbound/socks[in]: inbound connection to sp.v2.udp-over-tcp.arpa:0
ERROR inbound/socks[in]: process connection from 127.0.0.1:58042: UoT read request: unknown address family: 152

复现

注意要一次性发出全部内容

import socket, struct, time

MAGIC = b'sp.v2.udp-over-tcp.arpa'
greeting = bytes([5, 1, 0])
connect = bytes([5, 1, 0, 3, len(MAGIC)]) + MAGIC + b'\x00\x00'
uot_request = bytes([1, 1, 192, 168, 1, 1, 0x75, 0x3A])   # isConnect, ATYP=IPv4, addr, port
frame = struct.pack('>H', 8) + b'WFE1\x00\x00\x00\x01'

s = socket.create_connection(('127.0.0.1', 1080))   # sing-box v1.14.2 SOCKS5 Listen
s.sendall(greeting + connect + uot_request + frame)
time.sleep(1)
s.close()

socks inbound + direct outbound:

客户端 sing侧结果
发 greeting、读回复;发 CONNECT、读回复;之后再发UoT请求 inbound UoT connect connection to 192.168.1.1:30001;OK没有问题
一次写完全部内容 UoT read request: EOF;之后还有数据帧的话就是unknown address family: N;失败了

原因

handshake.go里握手通过reader *std_bufio.Reader解析,bufio每次 fill都把整块缓冲读满,但CONNECT交给handler的是原始连接:

handler.NewConnectionEx(auth.ContextWithUser(ctx, request.Username), NewLazyConn(conn, version), source, request.Destination, onClose)

handler.NewConnectionEx(ctx, NewLazyConn(conn, version), source, request.Destination, onClose)

把流的中间当成了开头

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions