UDP ASSOCIATE from 0.0.0.0:0

[yiguihai11]

流量通过tun2socks发送到sslocal发现TCP正常UDP无法正常使用

root@BoringClever-VM:~# /etc/ssmanager/usr/bin/sslocal --server-url "ss://[email protected]:1234" --log-config /root/log4rs.yaml --log-without-time --local-addr 127.0.0.1:1080 -U                          2022-04-19T12:33:13.605909847+08:00 DEBUG rlimit NOFILE adjusted rlimit { rlim_cur: 1048576, rlim_max: 1048576 }
2022-04-19T12:33:13.606384747+08:00 INFO  shadowsocks local 1.14.4 build 2022-04-18T16:11:18.857268533+00:00
2022-04-19T12:33:13.607750362+08:00 INFO  shadowsocks socks TCP listening on 127.0.0.1:1080
2022-04-19T12:33:13.607984666+08:00 INFO  shadowsocks socks5 UDP listening on 127.0.0.1:1080
2022-04-19T12:33:19.679767159+08:00 DEBUG CONNECT 104.16.132.229:443
2022-04-19T12:33:19.680252478+08:00 DEBUG established tcp tunnel 127.0.0.1:37140 <-> 104.16.132.229:443 through sever 172.245.8.20:1234 (outbound: 172.245.8.20:1234)
2022-04-19T12:33:24.084389379+08:00 DEBUG UDP ASSOCIATE from 0.0.0.0:0
2022-04-19T12:33:25.578859316+08:00 DEBUG UDP ASSOCIATE from 0.0.0.0:0

tun2socks和sslocal我不知道是哪个的问题，tun2socks作者也反馈了暂时没有回应。
Originally posted by @yiguihai11 in xjasonlyu/tun2socks#120

[zonyitoo]

UDP ASSOCIATE from 0.0.0.0:0

The client sent a UDP ASSOCIATE command with destination address 0.0.0.0:0. sslocal ignored this address, so it is not the root cause of your issue.

shadowsocks-rust/crates/shadowsocks-service/src/local/socks/server/socks5/udprelay.rs

Lines 142 to 146 in 50d2a01

	trace!(
	"UDP ASSOCIATE {} -> {}, {} bytes",
	peer_addr,
	header.address,
	payload.len()

If you couldn't see any logs like UDP ASSOCIATE xxx -> xxx, xx bytes, then sslocal doesn't receive any UDP packets from clients.

[xjasonlyu]

Hi, according to socks5 rfc 1928:

The UDP ASSOCIATE request is used to establish an association within
the UDP relay process to handle UDP datagrams.  The DST.ADDR and
DST.PORT fields contain the address and port that the client expects
to use to send UDP datagrams on for the association.  The server MAY
use this information to limit access to the association.  If the
client is not in possesion of the information at the time of the UDP
ASSOCIATE, the client MUST use a port number and address of all
zeros.

UDP is a connectionless protocol and it may send data to multiple destinations, so in this case, some clients may set their dest.addr to all zeros during UDP ASSOCIATE stage.

[zonyitoo]

Well yes. But since shadowsocks' UDP port is fixed, so clients can always send UDP ASSOCIATION Request to the UDP port.

In this project, sslocal will always respond the UDP's port when receiving UDP ASSOCIATION command, so it should work for any SOCKS5 clients that follow the RFC1928.

[yiguihai11]

找到原因了 xjasonlyu/tun2socks#120