[PR #136] [MERGED] Fallback + tuntests #159

New issue

Closed

opened 2026-10-13 21:04:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:04:08 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-go/pull/136
Author: @FrogRocky
Created: 5/7/2026
Status: ✅ Merged
Merged: 5/11/2026
Merged by: @ygurov

Base: experimental ← Head: experimental-fallback

📝 Commits (2)

5c71040 feat: add conceal fallback port proxying
90add63 fix(conn): route UDP conceal format errors to fallback

📊 Changes

20 files changed (+1316 additions, -80 deletions)

View changed files

📝 README.md (+7 -0)
📝 conceal/conn_framed.go (+22 -13)
📝 conceal/conn_prelude.go (+13 -0)
➕ conceal/errors.go (+45 -0)
➕ conceal/format_error_test.go (+44 -0)
📝 conceal/rule.go (+77 -12)
📝 conceal/udp_datagram_pipeline.go (+17 -4)
📝 conn/bind_std.go (+8 -0)
📝 conn/bind_stream.go (+24 -9)
📝 conn/conceal.go (+18 -0)
📝 conn/conceal_pipeline_test.go (+6 -18)
➕ conn/fallback.go (+336 -0)
➕ conn/fallback_test.go (+198 -0)
📝 conn/udp_conceal_bind.go (+142 -2)
📝 device/device.go (+5 -0)
📝 device/device_test.go (+213 -1)
📝 device/uapi.go (+20 -0)
➕ device/uapi_fallback_test.go (+35 -0)
📝 outline/fallback.go (+26 -21)
📝 tun/tuntest/tuntest.go (+60 -0)

📄 Description

Summary

This PR completes fallback coverage for both TCP and UDP conceal paths and fixes the missing UDP fallback behavior in the current default bind stack.

TCP fallback already existed in BindStream: when the TCP conceal pipeline returns conceal.ErrFormat, the stream is proxied to the configured fallback TCP port and data is copied both ways. This PR keeps that behavior and adds device-level coverage for it.

UDP fallback existed at the lower StdNetBind/conn wrapper level, but the current default UDP path decodes conceal traffic in ConcealBind. Invalid UDP conceal packets were decoded there and then silently dropped before the lower fallback wrapper could see the format error. This PR makes UDP datagram decoding preserve conceal.ErrFormat and teaches ConcealBind to route those invalid datagrams to the configured fallback UDP port.

Changes

Added DecodeInPlaceErr to UDPDatagramPipeline so UDP conceal decode failures can be surfaced as typed errors instead of only false.
Wrapped UDP masquerade/framing/classifier decode failures as conceal.ErrFormat where appropriate, preserving the original bytes for fallback forwarding.
Made ConcealBind implement Fallbackable.
Added UDP fallback session handling to ConcealBind:
- invalid incoming UDP conceal packets are forwarded to FallbackPort
- fallback UDP responses are sent back to the original remote endpoint through the raw inner bind
- fallback sessions are closed when the bind closes or the fallback port changes
Added endpoint-based fallback UDP address selection for IPv4/IPv6 loopback.
Added TCP and UDP packet generators to tun/tuntest.
Added device-level tuntest coverage for:
- UDP masquerade transporting TUN TCP and UDP payloads
- TCP masquerade transporting TUN TCP and UDP payloads
- TCP fallback through a real device path
- UDP fallback through a real device path

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-go/pull/136 **Author:** [@FrogRocky](https://github.com/FrogRocky) **Created:** 5/7/2026 **Status:** ✅ Merged **Merged:** 5/11/2026 **Merged by:** [@ygurov](https://github.com/ygurov) **Base:** `experimental` ← **Head:** `experimental-fallback` --- ### 📝 Commits (2) - [`5c71040`](https://github.com/amnezia-vpn/amneziawg-go/commit/5c710408de12f5d5edaca6e75347d9995dfff9d1) feat: add conceal fallback port proxying - [`90add63`](https://github.com/amnezia-vpn/amneziawg-go/commit/90add6338e38e2576c30e5b1e49c6222a972e044) fix(conn): route UDP conceal format errors to fallback ### 📊 Changes **20 files changed** (+1316 additions, -80 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+7 -0) 📝 `conceal/conn_framed.go` (+22 -13) 📝 `conceal/conn_prelude.go` (+13 -0) ➕ `conceal/errors.go` (+45 -0) ➕ `conceal/format_error_test.go` (+44 -0) 📝 `conceal/rule.go` (+77 -12) 📝 `conceal/udp_datagram_pipeline.go` (+17 -4) 📝 `conn/bind_std.go` (+8 -0) 📝 `conn/bind_stream.go` (+24 -9) 📝 `conn/conceal.go` (+18 -0) 📝 `conn/conceal_pipeline_test.go` (+6 -18) ➕ `conn/fallback.go` (+336 -0) ➕ `conn/fallback_test.go` (+198 -0) 📝 `conn/udp_conceal_bind.go` (+142 -2) 📝 `device/device.go` (+5 -0) 📝 `device/device_test.go` (+213 -1) 📝 `device/uapi.go` (+20 -0) ➕ `device/uapi_fallback_test.go` (+35 -0) 📝 `outline/fallback.go` (+26 -21) 📝 `tun/tuntest/tuntest.go` (+60 -0) </details> ### 📄 Description ## Summary This PR completes fallback coverage for both TCP and UDP conceal paths and fixes the missing UDP fallback behavior in the current default bind stack. TCP fallback already existed in `BindStream`: when the TCP conceal pipeline returns `conceal.ErrFormat`, the stream is proxied to the configured fallback TCP port and data is copied both ways. This PR keeps that behavior and adds device-level coverage for it. UDP fallback existed at the lower `StdNetBind`/conn wrapper level, but the current default UDP path decodes conceal traffic in `ConcealBind`. Invalid UDP conceal packets were decoded there and then silently dropped before the lower fallback wrapper could see the format error. This PR makes UDP datagram decoding preserve `conceal.ErrFormat` and teaches `ConcealBind` to route those invalid datagrams to the configured fallback UDP port. ## Changes - Added `DecodeInPlaceErr` to `UDPDatagramPipeline` so UDP conceal decode failures can be surfaced as typed errors instead of only `false`. - Wrapped UDP masquerade/framing/classifier decode failures as `conceal.ErrFormat` where appropriate, preserving the original bytes for fallback forwarding. - Made `ConcealBind` implement `Fallbackable`. - Added UDP fallback session handling to `ConcealBind`: - invalid incoming UDP conceal packets are forwarded to `FallbackPort` - fallback UDP responses are sent back to the original remote endpoint through the raw inner bind - fallback sessions are closed when the bind closes or the fallback port changes - Added endpoint-based fallback UDP address selection for IPv4/IPv6 loopback. - Added TCP and UDP packet generators to `tun/tuntest`. - Added device-level `tuntest` coverage for: - UDP masquerade transporting TUN TCP and UDP payloads - TCP masquerade transporting TUN TCP and UDP payloads - TCP fallback through a real device path - UDP fallback through a real device path --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 21:04:08 +00:00