v2ray crashes if tun device is used

[denisstrizhkin]

What version of V2Ray are you using?

V2Ray 5.21.0

What's your scenario of using V2Ray?

System's internet access through tun device.

What problems have you encountered?

V2Ray crashes.

What's your expectation?

V2Ray works.

Please attach your configuration here

Client configuration:

{
    "log": {
        "level": "debug"
    },
    "services": {
      "tun": {
          "name": "tun0",
          "mtu": 1500,
          "tag": "tun",
          "ips": [
              {
                  "ip": [192, 18, 0, 1],
                  "prefix": 24
              }
          ],
          "routes": [
              {
                  "ip": [0, 0, 0, 0],
                  "prefix": 0
              }
          ],
          "enablePromiscuousMode": true,
          "enableSpoofing": true
      }  
    },
    "outbounds": [
        {
            "protocol": "shadowsocks",
            "settings": {
                "servers": [
                    {
                        "method": "<method>",
                        "address": "<address>",
                        "port": 123456,
                        "password": "<password>"
                    }
                ]
            },
            "tag": "<tag>"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ]
}

Please attach error log here

2024/10/25 07:54:43 [Warning] app/dispatcher: default route for udp:<address>
panic: extending out of bound

goroutine 7743 [running]:
github.com/v2fly/v2ray-core/v5/common/buf.(*Buffer).Extend(...)
	github.com/v2fly/v2ray-core/v5/common/buf/buffer.go:111
github.com/v2fly/v2ray-core/v5/proxy/shadowsocks.(*AEADCipher).EncodePacket(0xc0051cf350?, {0xc000187680?, 0xc0051cf350?, 0x5786d56a1040?}, 0xc0051cf350)
	github.com/v2fly/v2ray-core/v5/proxy/shadowsocks/config.go:168 +0x232
github.com/v2fly/v2ray-core/v5/proxy/shadowsocks.EncodeUDPPacket(0xc0051cf230, {0xc004fef000, 0x7e4, 0xc0040d8fc0?})
	github.com/v2fly/v2ray-core/v5/proxy/shadowsocks/protocol.go:201 +0x1fb
github.com/v2fly/v2ray-core/v5/proxy/shadowsocks.(*UDPWriter).Write(0xc0051c5a88, {0xc004fef000?, 0x7e4, 0x0?})
	github.com/v2fly/v2ray-core/v5/proxy/shadowsocks/protocol.go:285 +0x2d
github.com/v2fly/v2ray-core/v5/common/buf.WriteMultiBuffer({0x5786d568c360, 0xc0051c5a88}, {0xc004fb65f0?, 0xc0054d3db8?, 0x5786d488857c?})
	github.com/v2fly/v2ray-core/v5/common/buf/multi_buffer.go:215 +0xf0
github.com/v2fly/v2ray-core/v5/common/buf.(*SequentialWriter).WriteMultiBuffer(0x1?, {0xc004fb65f0?, 0xc00519e628?, 0xc0054d3e60?})
	github.com/v2fly/v2ray-core/v5/common/buf/writer.go:222 +0x32
github.com/v2fly/v2ray-core/v5/common/buf.copyInternal({0x5786d568aee0, 0xc004edb5b0}, {0x5786d568bee0, 0xc00477cd60}, 0xc0051c5b78)
	github.com/v2fly/v2ray-core/v5/common/buf/copy.go:87 +0x15d
github.com/v2fly/v2ray-core/v5/common/buf.Copy({0x5786d568aee0, 0xc004edb5b0}, {0x5786d568bee0, 0xc00477cd60}, {0xc0054d3f60, 0x1, 0x7e0d8efc23f8?})
	github.com/v2fly/v2ray-core/v5/common/buf/copy.go:104 +0x98
github.com/v2fly/v2ray-core/v5/proxy/shadowsocks.(*Client).Process.func6()
	github.com/v2fly/v2ray-core/v5/proxy/shadowsocks/client.go:174 +0xc5
github.com/v2fly/v2ray-core/v5/common/task.Run.func1(0x3038a0438?)
	github.com/v2fly/v2ray-core/v5/common/task/task.go:28 +0x28
created by github.com/v2fly/v2ray-core/v5/common/task.Run in goroutine 7774
	github.com/v2fly/v2ray-core/v5/common/task/task.go:27 +0xdb

[dyhkwong]

The reason should be some applications send a UDP packet with size larger than buf.Size 2048. It seems that the code of v2ray shadowsocks will panic when handling UDP packets larger than buf.Size. You set TUN MTU 1500 but still encountered this, maybe v2ray TUN MTU also has some issues.