omarandClaude Opus 5
daaa0fda41
The guard refused to start an AmneziaWG endpoint whose detour chain reached a WireGuard one, and refused silently: not an error, just started=false, after which every dial failed with "WireGuard is not ready yet". A selector hook went further and suspended an already-working node the moment its group switched to a WireGuard member. It existed because AmneziaWG inside WireGuard hung the kernel on Android. We do not ship Android, upstream dropped the guard once the cause was gone, and the cure landed here yesterday — the ClientBind reserved-gate plus the submodule pin that carries its twin. So the tree held both the cure and the prohibition on using it, and the configuration simply did not come up while looking like a node that "just does not work". Also takes the two fixes that belong with it. ClientBind.conn was read on a lock-free fast path and written under a mutex; upstream found that race with the same end-to-end test we wrote yesterday, so we had taken one half of a pair again. And the outer WireGuard UDP socket forced DF, unlike direct, hysteria and tuic — with encapsulation the datagram regularly exceeds the path MTU and the kernel drops it instead of fragmenting, a symptom indistinguishable from the bug we spent yesterday on. The race needed its own test: the existing e2e run did not flag it under -race even at -count=15. Eight goroutines over both connect branches reproduce it deterministically, naming the lock-free read and the guarded write. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
100 lines
3.7 KiB
Go
100 lines
3.7 KiB
Go
// lx: regression tests for the udp_fragment / UDPFragmentDefault
|
|
// plumbing. The WireGuard endpoint (and MASQUE outbound) rely on
|
|
// UDPFragmentDefault=true reaching the real UDP socket as "DF clear": with DF
|
|
// set, an outer datagram larger than the path MTU is silently dropped instead
|
|
// of fragmented, which blackholes nested tunnels (AWG-over-AWG, MASQUE-over-AWG)
|
|
// and AWG s4 transport junk. These tests assert the socket flag itself, on both
|
|
// paths a WireGuard bind can take: the dialer (ClientBind, detour case) and the
|
|
// listener control (StdNetBind via WireGuardControl, no-detour case).
|
|
package dialer
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"syscall"
|
|
"testing"
|
|
|
|
"github.com/sagernet/sing-box/option"
|
|
M "github.com/sagernet/sing/common/metadata"
|
|
N "github.com/sagernet/sing/common/network"
|
|
)
|
|
|
|
func dialUDPForDF(t *testing.T, options option.DialerOptions) syscall.Conn {
|
|
t.Helper()
|
|
d, err := NewDefault(context.Background(), options)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
conn, err := d.DialContext(context.Background(), N.NetworkUDP, M.ParseSocksaddr("127.0.0.1:9"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = conn.Close() })
|
|
sysConn, isSysConn := conn.(syscall.Conn)
|
|
if !isSysConn {
|
|
t.Fatalf("dialed UDP conn %T does not expose SyscallConn", conn)
|
|
}
|
|
return sysConn
|
|
}
|
|
|
|
func listenUDPForDF(t *testing.T, options option.DialerOptions) syscall.Conn {
|
|
t.Helper()
|
|
d, err := NewDefault(context.Background(), options)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// WireGuardControl() is the listener control conn.StdNetBind installs on the
|
|
// socket a no-detour WireGuard endpoint sends its outer datagrams from — the
|
|
// exact socket the DF default decides the fate of.
|
|
listenConfig := net.ListenConfig{Control: d.WireGuardControl()}
|
|
packetConn, err := listenConfig.ListenPacket(context.Background(), "udp4", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = packetConn.Close() })
|
|
sysConn, isSysConn := packetConn.(syscall.Conn)
|
|
if !isSysConn {
|
|
t.Fatalf("listened UDP conn %T does not expose SyscallConn", packetConn)
|
|
}
|
|
return sysConn
|
|
}
|
|
|
|
// Upstream default: no UDPFragmentDefault, no udp_fragment → DF is set on both
|
|
// the dial and listener paths. Pins the baseline the endpoint fix opts out of.
|
|
func TestUDPFragmentDFByDefault_LX(t *testing.T) {
|
|
if !udpSocketDFSet(t, dialUDPForDF(t, option.DialerOptions{})) {
|
|
t.Fatal("default dialer must set DF on dialed UDP sockets")
|
|
}
|
|
if !udpSocketDFSet(t, listenUDPForDF(t, option.DialerOptions{})) {
|
|
t.Fatal("default dialer must set DF on listener-control UDP sockets")
|
|
}
|
|
}
|
|
|
|
// UDPFragmentDefault=true (what the WireGuard endpoint and MASQUE outbound now
|
|
// set) → DF clear on both paths, so oversize outer datagrams fragment instead
|
|
// of vanishing.
|
|
func TestUDPFragmentDefaultClearsDF_LX(t *testing.T) {
|
|
options := option.DialerOptions{UDPFragmentDefault: true}
|
|
if udpSocketDFSet(t, dialUDPForDF(t, options)) {
|
|
t.Fatal("UDPFragmentDefault=true must leave DF clear on dialed UDP sockets")
|
|
}
|
|
if udpSocketDFSet(t, listenUDPForDF(t, options)) {
|
|
t.Fatal("UDPFragmentDefault=true must leave DF clear on listener-control UDP sockets")
|
|
}
|
|
}
|
|
|
|
// Explicit user config always wins over the protocol default, in both
|
|
// directions.
|
|
func TestUDPFragmentExplicitOverride_LX(t *testing.T) {
|
|
fragmentOff := false
|
|
options := option.DialerOptions{UDPFragment: &fragmentOff, UDPFragmentDefault: true}
|
|
if !udpSocketDFSet(t, dialUDPForDF(t, options)) {
|
|
t.Fatal("udp_fragment=false must set DF even when the protocol default allows fragmentation")
|
|
}
|
|
fragmentOn := true
|
|
options = option.DialerOptions{UDPFragment: &fragmentOn}
|
|
if udpSocketDFSet(t, dialUDPForDF(t, options)) {
|
|
t.Fatal("udp_fragment=true must leave DF clear even without a protocol default")
|
|
}
|
|
}
|