sing-snell UDP WriterMTU issues

Operating system

Windows

System version

Windows 11

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-beta.2

Environment: go1.26.5 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_purego,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0
Revision: 03c3bf4c01e7b1fd165d0c46ff376828fa878aab
CGO: disabled

Description

In Snell v6 default mode and Snell v4, large UDP packets (e.g. a quic-go handshake) can't go through the proxy. UDP WriterMTU seems to be the problem.
https://github.com/SagerNet/sing-snell/blob/c43fbee0e8399abb81e9954944fb63c076331aec/snellv4/packet.go#L219
https://github.com/SagerNet/sing-snell/blob/c43fbee0e8399abb81e9954944fb63c076331aec/snellv6/packet.go#L224

Reproduction

client 1

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "socks",
			"listen": "127.0.0.1",
			"listen_port": 1080
		}
	],
	"outbounds": [
		{
			"type": "snell",
			"server": "127.0.0.1",
			"server_port": 12345,
			"psk": "123456123456",
			"mode": "default",
			"version": 6
		}
	]
}

server 1

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "snell",
			"listen": "127.0.0.1",
			"listen_port": 12345,
			"psk": "123456123456",
			"mode": "default",
			"version": 6
		}
	],
	"outbounds": [
		{
			"type": "direct"
		}
	]
}

client 2

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "socks",
			"listen": "127.0.0.1",
			"listen_port": 1080
		}
	],
	"outbounds": [
		{
			"type": "snell",
			"server": "127.0.0.1",
			"server_port": 12345,
			"psk": "123456123456",
			"version": 4
		}
	]
}

server 2

{
	"log": {
		"level": "debug"
	},
	"inbounds": [
		{
			"type": "snell",
			"listen": "127.0.0.1",
			"listen_port": 12345,
			"psk": "123456123456",
			"version": 5
		}
	]
}

package main

import (
	"context"
	"crypto/tls"
	"fmt"
	"net"
	"net/netip"

	"github.com/quic-go/quic-go"
	"github.com/sagernet/sing/common/metadata"
	"github.com/sagernet/sing/common/network"
	"github.com/sagernet/sing/protocol/socks"
)

func main() {
	dialer := &network.DefaultDialer{
		Dialer:       net.Dialer{},
		ListenConfig: net.ListenConfig{},
	}
	client := socks.NewClient(dialer, metadata.Socksaddr{Addr: netip.MustParseAddr("127.0.0.1"), Port: 1080}, socks.Version5, "", "")
	conn, err := client.ListenPacket(context.Background(), metadata.Socksaddr{Addr: netip.AddrFrom4([4]byte{223, 5, 5, 5}), Port: 443})
	if err != nil {
		fmt.Println(err)
		return
	}
	defer conn.Close()
	quicConn, err := quic.Dial(context.Background(), conn, &net.UDPAddr{IP: []byte{223, 5, 5, 5}, Port: 443}, &tls.Config{
		ServerName: "223.5.5.5",
		NextProtos: []string{"h3"},
	}, nil)
	if err != nil {
		fmt.Println(err)
		return
	}
	defer quicConn.CloseWithError(0x00, "")
}

Logs

INFO[0000] network: updated default interface WLAN, index 17
INFO[0000] inbound/socks[0]: tcp server started at 127.0.0.1:1080
INFO[0000] sing-box started (0.03s)
INFO[0002] [3864239329 0ms] inbound/socks[0]: inbound connection from 127.0.0.1:55442
INFO[0002] [3864239329 10ms] inbound/socks[0]: inbound packet connection to 223.5.5.5:443
INFO[0002] [3864239329 10ms] outbound/snell[0]: outbound packet connection to 223.5.5.5:443
DEBUG[0002] [3864239329 12ms] connection: packet upload closed: raw read: A message sent on a datagram socket was larger than the internal message buffer or some other network limit, or the buffer used to receive a datagram into was smaller than the datagram itself.

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the failure with the supplied sing-box configurations and Go QUIC program. Then inspect sing-snell/snellv4/packet.go around line 219 and sing-snell/snellv6/packet.go around line 224, focusing on the UDP WriterMTU behavior. Done means large UDP packets, including a QUIC handshake, pass through both reported Snell configurations without the datagram buffer error.