Add UoT support to egress SOCKS5 server#335
Merged
noahlevenson merged 5 commits intomainfrom Mar 1, 2026
Merged
Conversation
The sing-box UoT protocol tunnels UDP packets over TCP using a magic FQDN (sp.v2.udp-over-tcp.arpa). The egress SOCKS5 server now intercepts these addresses and relays framed UDP packets between the TCP stream and a real UDP socket. Key components: - UoTResolver: passes UoT magic addresses through without DNS resolution, fixing go-socks5's default behavior of resolving FQDNs before Dial - UoTDialer: intercepts UoT addresses in the SOCKS5 Dial function and sets up the UDP relay via net.Pipe - tcpPipeConn: wraps net.Pipe to return *net.TCPAddr for go-socks5 compatibility Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds UDP-over-TCP (UoT) handling to the egress SOCKS5 server so sing-box clients can tunnel UDP traffic through the existing TCP-based egress flow.
Changes:
- Introduces
egress/uot.goimplementingUoTResolver(magic address pass-through) andUoTDialer(UoT TCP interception + UDP relay). - Wires the new dialer and resolver into the standalone egress SOCKS5 server config.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
egress/uot.go |
Implements UoT request parsing and bidirectional TCP↔UDP framing/relay, plus resolver/dialer hooks for go-socks5. |
egress/cmd/socks5/egress_socks5.go |
Configures go-socks5 to use UoTDialer and UoTResolver. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Use net.DefaultResolver.LookupIPAddr with context for cancellation-aware DNS - Normalize UoT magic address matching (case-insensitive, trailing dot) - Add max UDP payload size check (65507) with oversized frame discard - Tie UoT pipe lifecycle to dialing context via ctx.Done() goroutine Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Log errors in relay goroutines instead of silently discarding - Close both TCP and UDP connections when either relay direction exits, preventing goroutine leaks - Use maxUDPPayload-sized buffers instead of 65535 for consistency - Validate UDP read size fits uint16 before casting - Block loopback destinations to prevent local network access - Use context-aware DNS with 10s timeout in readSocksAddr - Fix context cancellation goroutine leak by selecting on connDone channel so the goroutine exits when handleUoT completes naturally - Log CopyN errors when discarding oversized frames Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…er to its own home
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
UoTResolverto bypass go-socks5's default DNS resolution for UoT magic addresses (sp.v2.udp-over-tcp.arpa)UoTDialerthat intercepts UoT connections and relays framed UDP packets to real UDP socketsTest plan
🤖 Generated with Claude Code