[PR #44] fix: detect stale iOS WireGuard tunnels #44

New issue

Open

opened 2026-10-13 21:13:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:13:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/DefaultVPN/pull/44
Author: @ibotpafos
Created: 8/13/2026
Status: 🔄 Open

Base: dev ← Head: fix/ios-wireguard-liveness

📝 Commits (3)

d85db8f fix: detect stale iOS WireGuard tunnels
1b7139d fix: include WireGuard liveness Swift sources
121fbb1 test: enforce iOS liveness checks [skip ci]

📊 Changes

8 files changed (+134 additions, -10 deletions)

View changed files

📝 .github/workflows/deploy.yml (+8 -0)
📝 client/ios/networkextension/CMakeLists.txt (+2 -0)
📝 client/macos/networkextension/CMakeLists.txt (+2 -0)
📝 client/platforms/ios/ios_controller.h (+1 -0)
📝 client/platforms/ios/ios_controller.mm (+29 -10)
➕ client/platforms/ios/wireguard_liveness.h (+49 -0)
➕ client/platforms/ios/wireguard_liveness_test.cpp (+23 -0)
➕ client/platforms/ios/wireguard_swift_sources_test.sh (+20 -0)

📄 Description

What changes

Requires a handshake newer than the current connection attempt before reporting a new WireGuard/AWG tunnel as Connected.
Continues to treat advancing traffic counters as positive liveness evidence.
Marks an established tunnel Reconnecting when its handshake is older than 240 seconds and traffic has stopped advancing.
Keeps the last known state when the extension cannot provide valid handshake telemetry, avoiding a false disconnect from missing data alone.
Resets liveness state for every new tunnel start.
Runs the C++ liveness and Apple Swift-source membership guards in the iOS CI job.

Why

The previous check accepted any positive last_handshake_time_sec, including a timestamp from an earlier connection. After an iOS path transition this could leave the UI at Connected while the tunnel no longer passed traffic.

The 240-second stale window is intentionally conservative relative to WireGuard/AWG timers. The companion engine and bounded path-recovery changes are in amnezia-vpn/amneziawg-apple#40.

Validation

standalone C++17 liveness policy test with -Wall -Wextra -Werror
Apple Swift-source membership test
full generic unsigned iOS arm64 build against Apple head b17f0000e1a6e64e1087a14b64734ebc7a3a0d3b: https://github.com/ibotpafos/DefaultVPN/actions/runs/31755809362
git diff --check

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/DefaultVPN/pull/44 **Author:** [@ibotpafos](https://github.com/ibotpafos) **Created:** 8/13/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `fix/ios-wireguard-liveness` --- ### 📝 Commits (3) - [`d85db8f`](https://github.com/amnezia-vpn/DefaultVPN/commit/d85db8f9e5aa5816252670a67e237ae2e4a480cc) fix: detect stale iOS WireGuard tunnels - [`1b7139d`](https://github.com/amnezia-vpn/DefaultVPN/commit/1b7139dd790da13f27565572de163df9e162d507) fix: include WireGuard liveness Swift sources - [`121fbb1`](https://github.com/amnezia-vpn/DefaultVPN/commit/121fbb111fb59bf9ace934c4939b97a73a942f2a) test: enforce iOS liveness checks [skip ci] ### 📊 Changes **8 files changed** (+134 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/deploy.yml` (+8 -0) 📝 `client/ios/networkextension/CMakeLists.txt` (+2 -0) 📝 `client/macos/networkextension/CMakeLists.txt` (+2 -0) 📝 `client/platforms/ios/ios_controller.h` (+1 -0) 📝 `client/platforms/ios/ios_controller.mm` (+29 -10) ➕ `client/platforms/ios/wireguard_liveness.h` (+49 -0) ➕ `client/platforms/ios/wireguard_liveness_test.cpp` (+23 -0) ➕ `client/platforms/ios/wireguard_swift_sources_test.sh` (+20 -0) </details> ### 📄 Description ## What changes - Requires a handshake newer than the current connection attempt before reporting a new WireGuard/AWG tunnel as Connected. - Continues to treat advancing traffic counters as positive liveness evidence. - Marks an established tunnel Reconnecting when its handshake is older than 240 seconds and traffic has stopped advancing. - Keeps the last known state when the extension cannot provide valid handshake telemetry, avoiding a false disconnect from missing data alone. - Resets liveness state for every new tunnel start. - Runs the C++ liveness and Apple Swift-source membership guards in the iOS CI job. ## Why The previous check accepted any positive `last_handshake_time_sec`, including a timestamp from an earlier connection. After an iOS path transition this could leave the UI at Connected while the tunnel no longer passed traffic. The 240-second stale window is intentionally conservative relative to WireGuard/AWG timers. The companion engine and bounded path-recovery changes are in amnezia-vpn/amneziawg-apple#40. ## Validation - standalone C++17 liveness policy test with `-Wall -Wextra -Werror` - Apple Swift-source membership test - full generic unsigned iOS arm64 build against Apple head `b17f0000e1a6e64e1087a14b64734ebc7a3a0d3b`: https://github.com/ibotpafos/DefaultVPN/actions/runs/31755809362 - `git diff --check` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:13:57 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/DefaultVPN#44

No description provided.

Rows
Columns