[PR #40] fix: harden iOS tunnel recovery and handshake freshness #39

New issue

Open

opened 2026-10-13 21:08:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:08:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-apple/pull/40
Author: @ibotpafos
Created: 8/12/2026
Status: 🔄 Open

Base: master ← Head: codex/retain-backend-on-transient-path-loss

📝 Commits (6)

af0e02b fix: retain iOS backend on transient path loss
3690f4c fix: refresh handshake liveness and engine
2aa9d1c fix: include path policy in Xcode targets
850cdbe fix: pause backend after genuine offline grace
0441d09 Merge upstream master into stability fix
b17f000 fix: bound unsatisfied path and handshake freshness

📊 Changes

7 files changed (+212 additions, -42 deletions)

View changed files

📝 Sources/WireGuardKit/HandshakeFreshnessEvaluator.swift (+7 -3)
➕ Sources/WireGuardKit/NetworkPathRetentionPolicy.swift (+38 -0)
📝 Sources/WireGuardKit/WireGuardAdapter.swift (+59 -37)
📝 Tests/WireGuardKitTests/HandshakeFreshnessEvaluatorTests.swift (+13 -2)
➕ Tests/WireGuardKitTests/NetworkPathRetentionPolicyTests.swift (+72 -0)
➕ Tests/project_source_membership_test.sh (+17 -0)
📝 WireGuard.xcodeproj/project.pbxproj (+6 -0)

📄 Description

What changes

Keeps the iOS WireGuard backend running through a bounded transient NWPath.unsatisfied route flip.
Re-evaluates an unsatisfied path after the 12-second grace period even when NetworkExtension emits no second path event, then pauses the backend for a genuine offline path.
Treats Wi-Fi, cellular, and wired Ethernet as physical interfaces during transition detection.
Rejects historical and future handshake timestamps when waiting for the current connection.
Follows current upstream amneziawg-go/v3 v3.1.20260813 and preserves AWG 3.1 support.

Why

A transient NetworkExtension path event could stop the backend during a route change. The earlier retention version could also stay alive indefinitely if an offline path still enumerated a physical interface. Separately, stale or future handshake telemetry could be accepted as proof of the current connection.

Validation

make -B -C Sources/WireGuardKitGo build ARCHS=arm64
go test ./... in Sources/WireGuardKitGo
swift test: 12 tests, 0 failures
Xcode project listing and source-membership test
independent code review after the AWG 3.1 merge and edge-case fixes
full DefaultVPN generic unsigned iOS arm64 build: https://github.com/ibotpafos/DefaultVPN/actions/runs/31755809362
git diff --check

The branch is merged with current upstream master; final head: b17f0000e1a6e64e1087a14b64734ebc7a3a0d3b.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-apple/pull/40 **Author:** [@ibotpafos](https://github.com/ibotpafos) **Created:** 8/12/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `codex/retain-backend-on-transient-path-loss` --- ### 📝 Commits (6) - [`af0e02b`](https://github.com/amnezia-vpn/amneziawg-apple/commit/af0e02bf027ca6230f73c9524308cf1f04682015) fix: retain iOS backend on transient path loss - [`3690f4c`](https://github.com/amnezia-vpn/amneziawg-apple/commit/3690f4c95d4350cc2bc373b3a7badaecee206a41) fix: refresh handshake liveness and engine - [`2aa9d1c`](https://github.com/amnezia-vpn/amneziawg-apple/commit/2aa9d1c508ea23b31e729610129e54bcfa7d5e5e) fix: include path policy in Xcode targets - [`850cdbe`](https://github.com/amnezia-vpn/amneziawg-apple/commit/850cdbe42c2ed1278529cf370ad2dad2c970bf64) fix: pause backend after genuine offline grace - [`0441d09`](https://github.com/amnezia-vpn/amneziawg-apple/commit/0441d09f2db6b764481969b33578f9c5d3e60c25) Merge upstream master into stability fix - [`b17f000`](https://github.com/amnezia-vpn/amneziawg-apple/commit/b17f0000e1a6e64e1087a14b64734ebc7a3a0d3b) fix: bound unsatisfied path and handshake freshness ### 📊 Changes **7 files changed** (+212 additions, -42 deletions) <details> <summary>View changed files</summary> 📝 `Sources/WireGuardKit/HandshakeFreshnessEvaluator.swift` (+7 -3) ➕ `Sources/WireGuardKit/NetworkPathRetentionPolicy.swift` (+38 -0) 📝 `Sources/WireGuardKit/WireGuardAdapter.swift` (+59 -37) 📝 `Tests/WireGuardKitTests/HandshakeFreshnessEvaluatorTests.swift` (+13 -2) ➕ `Tests/WireGuardKitTests/NetworkPathRetentionPolicyTests.swift` (+72 -0) ➕ `Tests/project_source_membership_test.sh` (+17 -0) 📝 `WireGuard.xcodeproj/project.pbxproj` (+6 -0) </details> ### 📄 Description ## What changes - Keeps the iOS WireGuard backend running through a bounded transient `NWPath.unsatisfied` route flip. - Re-evaluates an unsatisfied path after the 12-second grace period even when NetworkExtension emits no second path event, then pauses the backend for a genuine offline path. - Treats Wi-Fi, cellular, and wired Ethernet as physical interfaces during transition detection. - Rejects historical and future handshake timestamps when waiting for the current connection. - Follows current upstream `amneziawg-go/v3` `v3.1.20260813` and preserves AWG 3.1 support. ## Why A transient NetworkExtension path event could stop the backend during a route change. The earlier retention version could also stay alive indefinitely if an offline path still enumerated a physical interface. Separately, stale or future handshake telemetry could be accepted as proof of the current connection. ## Validation - `make -B -C Sources/WireGuardKitGo build ARCHS=arm64` - `go test ./...` in `Sources/WireGuardKitGo` - `swift test`: 12 tests, 0 failures - Xcode project listing and source-membership test - independent code review after the AWG 3.1 merge and edge-case fixes - full DefaultVPN generic unsigned iOS arm64 build: https://github.com/ibotpafos/DefaultVPN/actions/runs/31755809362 - `git diff --check` The branch is merged with current upstream `master`; final head: `b17f0000e1a6e64e1087a14b64734ebc7a3a0d3b`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:08:49 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:50 +00:00

[PR #39] Refactor: Use folders instead of groups. #40