Fix: GSO is incompatible with quic.ObfuscatedPacketConn

go.mod

@@ -40,7 +40,7 @@ require (
 	github.com/Psiphon-Labs/consistent v0.0.0-20240322131436-20aaa4e05737
 	github.com/Psiphon-Labs/goptlib v0.0.0-20200406165125-c0e32a7a3464
 	github.com/Psiphon-Labs/psiphon-tls v0.0.0-20250318183125-2a2fae2db378
-	github.com/Psiphon-Labs/quic-go v0.0.0-20250325201346-c58235406399
+	github.com/Psiphon-Labs/quic-go v0.0.0-20250527153145-79fe45fb83b1
 	github.com/Psiphon-Labs/utls v0.0.0-20250429162420-6dbd45ae7ceb
 	github.com/armon/go-proxyproto v0.0.0-20180202201750-5b7edb60ff5f
 	github.com/bifurcation/mint v0.0.0-20180306135233-198357931e61

go.sum

@@ -26,6 +26,8 @@ github.com/Psiphon-Labs/psiphon-tls v0.0.0-20250318183125-2a2fae2db378 h1:LqI8cx
 github.com/Psiphon-Labs/psiphon-tls v0.0.0-20250318183125-2a2fae2db378/go.mod h1:7ZUnPnWT5z8J8hxfsVjKHYK77Zme/Y0If1b/zeziiJs=
 github.com/Psiphon-Labs/quic-go v0.0.0-20250325201346-c58235406399 h1:FuT4mr/LzJC0KVgTDnFCKgWdkftqIHxjb75B39M2Rbg=
 github.com/Psiphon-Labs/quic-go v0.0.0-20250325201346-c58235406399/go.mod h1:rONdWgPMbFjyyBai7gB1IBF4pT9r4l0GyiDst5XR1SY=
+github.com/Psiphon-Labs/quic-go v0.0.0-20250527153145-79fe45fb83b1 h1:zD7JvZCV8gjvtI0AZmE81Ffc/v7A+qwU1/YfUmN/Flk=
+github.com/Psiphon-Labs/quic-go v0.0.0-20250527153145-79fe45fb83b1/go.mod h1:rONdWgPMbFjyyBai7gB1IBF4pT9r4l0GyiDst5XR1SY=
 github.com/Psiphon-Labs/utls v0.0.0-20250429162420-6dbd45ae7ceb h1:6q4bNLmVD8WtgwqR6w2VPW9dJIMT4yhbez/XuLT+7ac=
 github.com/Psiphon-Labs/utls v0.0.0-20250429162420-6dbd45ae7ceb/go.mod h1:1vv0gVAzq9e2XYkW8HAKrmtuuZrBdDixQFx5H22KAjI=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=

psiphon/common/quic/obfuscator.go

@@ -759,6 +759,13 @@ func (conn *ObfuscatedPacketConn) writePacket(
 		// There's no special case for legacy gQUIC, even though it lacks
 		// packet size adjustments, since gQUIC has a hard max packet size of
 		// 1280 bytes, less than the limit checked here.
+
+		// Limitation: on Linux, with GSO enabled, standard quic-go can call
+		// WriteTo with oversized packets which are then split in the kernel.
+		// These oversized writes would exceed the MAX_PACKET_SIZE length
+		// check. Furthermore, writePacket doesn't handle obfuscating GSO
+		// writes. Psiphon-Labs/quic-go currently disables GSO.
+
 		if n > MAX_PACKET_SIZE-OBFUSCATED_MAX_PACKET_SIZE_ADJUSTMENT {
 			return 0, 0, newTemporaryNetError(errors.Tracef(
 				"unexpected QUIC packet length: %d", n))

vendor/github.com/Psiphon-Labs/quic-go/sys_conn_helper_linux.go

@@ -64,6 +64,11 @@ func parseIPv4PktInfo(body []byte) (ip netip.Addr, ifIndex uint32, ok bool) {
 // isGSOEnabled tests if the kernel supports GSO.
 // Sending with GSO might still fail later on, if the interface doesn't support it (see isGSOError).
 func isGSOEnabled(conn syscall.RawConn) bool {
+
+	// [Psiphon]
+	// GSO is incompatible with ObfuscatedPacketConn
+	return false
+
 	if kernelVersionMajor < 5 {
 		return false
 	}

vendor/modules.txt

@@ -40,7 +40,7 @@ github.com/Psiphon-Labs/psiphon-tls/byteorder
 github.com/Psiphon-Labs/psiphon-tls/internal/boring
 github.com/Psiphon-Labs/psiphon-tls/internal/hpke
 github.com/Psiphon-Labs/psiphon-tls/internal/mlkem768
-# github.com/Psiphon-Labs/quic-go v0.0.0-20250325201346-c58235406399
+# github.com/Psiphon-Labs/quic-go v0.0.0-20250527153145-79fe45fb83b1
 ## explicit; go 1.23
 github.com/Psiphon-Labs/quic-go
 github.com/Psiphon-Labs/quic-go/http3