Skip to content

Freedom: Fix UDP reply mismatch-address#4816

Merged
RPRX merged 4 commits intoXTLS:mainfrom
patterniha:fix-udp-reply
Jul 23, 2025
Merged

Freedom: Fix UDP reply mismatch-address#4816
RPRX merged 4 commits intoXTLS:mainfrom
patterniha:fix-udp-reply

Conversation

@patterniha
Copy link
Collaborator

@patterniha patterniha commented Jun 15, 2025

the problem:

the problem #4800 (comment) is because after browser sending UDP-data(quic initial packet) the packet correctly reaches to the final-target but the response-data does not reach to the browser, this problem happen when target-address is domain, let's explain why:

code-A (freedom.go > ReadMultiBuffer):

b.UDP = &net.Destination{
Address: net.IPAddress(d.(*net.UDPAddr).IP),
Port: net.Port(d.(*net.UDPAddr).Port),
Network: net.Network_UDP,
}

code-B (udp/dispatcher.go > handleInput):

callback(ctx, &udp.Packet{
Payload: b,
Source: dest,
})

code-C (socks/server.go):

if payload.UDP != nil {
request = &protocol.RequestHeader{
User: request.User,
Address: payload.UDP.Address,
Port: payload.UDP.Port,
}
}

suppose browser send UDP-socks-request(UDP-associate) and target is cloudflare-quic.com:443.

each request packet consists of header+payload and header is "cloudflare-quic:443".

the response packet is also consists header+payload, the response-header must also be "cloudflare-quic.com", otherwise browser does not accept the received data.

to sending packet to "cloudflare-quic.com", Xray-core must resolve it to IP, suppose resolved-IP is "188.114.98.0".
after sending data, ReadMultiBuffer function receive response-data and because packet received from "188.114.98.0", it set b.UDP(buffer-UDP) address to "188.114.98.0" ---> code-A

after udp-dispatcher call a "callback" and pass the buffer(b) to that ---> code-B

if for example inbound is socks-protocol the 'callback" is "udpServer" in "socks/server.go > handleUDPPayload".

because payload.UDP is not nil and is equal to "188.114.98.0:443", the response-header-address overridden by "188.114.98.0:443", but the request-header was "cloudflare-quic.com" so the browser reject the response. ---> code-C

In short:

in short, the request and response header must be same but if address is domain(or fakedns) Xray-core send resolved-IP as a response header and this causes the browser to reject the packet.

so if the address is domain or fakedns or changed by redirect settings, Xray-core should ignore response-IP-address and send request-header-address as a response-header-address.

@RPRX RPRX merged commit 050f596 into XTLS:main Jul 23, 2025
39 checks passed
@RPRX
Copy link
Member

RPRX commented Jul 23, 2025

这一天天的代码改得我都不认识了,先合了,新版有问题的话就找你们

@patterniha patterniha deleted the fix-udp-reply branch July 23, 2025 15:29
@Fangliding Fangliding mentioned this pull request Aug 9, 2025
4 tasks
maoxikun added a commit to maoxikun/Xray-core that referenced this pull request Aug 22, 2025
it2konst pushed a commit to it2konst/gametunnel-core that referenced this pull request Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants