[PR #132] [MERGED] win missing obfs layers #160

New issue

Closed

opened 2026-10-13 21:04:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:04:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-go/pull/132
Author: @FrogRocky
Created: 4/13/2026
Status: ✅ Merged
Merged: 4/27/2026
Merged by: @ygurov

Base: experimental ← Head: experimental-win-missing-layers

📝 Commits (10+)

4875f14 fix(conn): honor Windows UDP conceal settings in the default bind
7e0d630 fix(tests): aligning tests for windows
426c4eb fix(tests): added smoke tests for win
248a7cc fix(tests): compatibility fixes
b22b0c5 fix(tests): compatibility fixes
0bbe760 fix(tests): compatibility fixes
10695b8 fix(tests): compatibility fixes
b364b9b fix(tests): compatibility fixes
f6ac82a fix(tests): compatibility fixes
b85b822 fix(tests): compatibility fixes

📊 Changes

14 files changed (+1936 additions, -97 deletions)

View changed files

📝 conceal/conn_masquarade.go (+24 -47)
📝 conceal/conn_prelude.go (+23 -39)
➕ conceal/udp_datagram_pipeline.go (+272 -0)
📝 conn/conceal.go (+12 -4)
📝 conn/default.go (+1 -1)
📝 conn/default_windows.go (+1 -1)
➕ conn/udp_conceal_bind.go (+230 -0)
➕ conn/udp_conceal_bind_android.go (+23 -0)
➕ conn/udp_conceal_bind_test.go (+605 -0)
➕ conn/udp_conceal_bind_windows.go (+21 -0)
📝 ipc/uapi_windows.go (+13 -1)
➕ tests/cmd/awg-keygen/main.go (+62 -0)
➕ tests/windows_single_vm_conceal_smoke.ps1 (+645 -0)
📝 tun/checksum_test.go (+4 -4)

📄 Description

Summary

This PR brings Windows closer to feature parity for conceal/obfuscation flows and adds a practical Windows smoke-test harness for validating them.

The main functional change is that the Windows default UDP bind now honors conceal settings instead of always going through the plain fast path. In addition, this PR adds a single-VM Windows smoke test for both UDP and TCP conceal scenarios, plus a few Windows-specific compatibility fixes needed to make the test path usable in practice.

What changed

Windows UDP conceal-aware bind selection

route the Windows default UDP path through a conceal-aware wrapper
keep the WinRing fast path for plain UDP
automatically fall back to StdNetBind when any conceal layer is enabled:
- framed headers/padding
- prelude/junk/decoys
- masquerade format rules
normalize endpoint handling so peer state stays stable when the active bind implementation changes

Windows conceal smoke harness

add tests/windows_single_vm_conceal_smoke.ps1
add tests/cmd/awg-keygen to generate keypairs and PSKs for the harness
validate both:
- network=udp
- network=tcp
run two local peers on one Windows host, configure them through UAPI, trigger handshake, capture traffic with pktmon, and verify the active conceal configuration through UAPI state plus handshake behavior

The smoke harness confirms that the conceal configuration is applied and that handshakes succeed on Windows. On the tested setup, pktmon loopback capture did not reliably expose raw payload markers, so capture-byte assertions remain best-effort rather than the source of truth.

Notes

This PR intentionally favors correctness and testability over forcing the Windows fast path in conceal-enabled UDP scenarios. Plain UDP keeps the fast path; conceal-enabled UDP now uses the conceal-capable bind path.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-go/pull/132 **Author:** [@FrogRocky](https://github.com/FrogRocky) **Created:** 4/13/2026 **Status:** ✅ Merged **Merged:** 4/27/2026 **Merged by:** [@ygurov](https://github.com/ygurov) **Base:** `experimental` ← **Head:** `experimental-win-missing-layers` --- ### 📝 Commits (10+) - [`4875f14`](https://github.com/amnezia-vpn/amneziawg-go/commit/4875f14e4a26aaf96fd284f86e38f836905b0af4) fix(conn): honor Windows UDP conceal settings in the default bind - [`7e0d630`](https://github.com/amnezia-vpn/amneziawg-go/commit/7e0d63076332e4bd43bf1328bd12a3d19013d243) fix(tests): aligning tests for windows - [`426c4eb`](https://github.com/amnezia-vpn/amneziawg-go/commit/426c4ebacda4b599ba7ec9e20c512fb426e8b0e0) fix(tests): added smoke tests for win - [`248a7cc`](https://github.com/amnezia-vpn/amneziawg-go/commit/248a7cca1763d945a91431602d1857a7ec732abf) fix(tests): compatibility fixes - [`b22b0c5`](https://github.com/amnezia-vpn/amneziawg-go/commit/b22b0c5e939d6e93687ffd783c2c50a3cc35607e) fix(tests): compatibility fixes - [`0bbe760`](https://github.com/amnezia-vpn/amneziawg-go/commit/0bbe760c0ae427971f38a21463ff94afc0a60ba3) fix(tests): compatibility fixes - [`10695b8`](https://github.com/amnezia-vpn/amneziawg-go/commit/10695b829b591b11d0212cc79852b185fdd67c3a) fix(tests): compatibility fixes - [`b364b9b`](https://github.com/amnezia-vpn/amneziawg-go/commit/b364b9ba1dee4505ba068b0f2c7c85d83ca49a57) fix(tests): compatibility fixes - [`f6ac82a`](https://github.com/amnezia-vpn/amneziawg-go/commit/f6ac82ae01f8e04468f1342af50992d57fb806e0) fix(tests): compatibility fixes - [`b85b822`](https://github.com/amnezia-vpn/amneziawg-go/commit/b85b822a1f507b025d568069e08143d03afaa1ce) fix(tests): compatibility fixes ### 📊 Changes **14 files changed** (+1936 additions, -97 deletions) <details> <summary>View changed files</summary> 📝 `conceal/conn_masquarade.go` (+24 -47) 📝 `conceal/conn_prelude.go` (+23 -39) ➕ `conceal/udp_datagram_pipeline.go` (+272 -0) 📝 `conn/conceal.go` (+12 -4) 📝 `conn/default.go` (+1 -1) 📝 `conn/default_windows.go` (+1 -1) ➕ `conn/udp_conceal_bind.go` (+230 -0) ➕ `conn/udp_conceal_bind_android.go` (+23 -0) ➕ `conn/udp_conceal_bind_test.go` (+605 -0) ➕ `conn/udp_conceal_bind_windows.go` (+21 -0) 📝 `ipc/uapi_windows.go` (+13 -1) ➕ `tests/cmd/awg-keygen/main.go` (+62 -0) ➕ `tests/windows_single_vm_conceal_smoke.ps1` (+645 -0) 📝 `tun/checksum_test.go` (+4 -4) </details> ### 📄 Description ## Summary This PR brings Windows closer to feature parity for conceal/obfuscation flows and adds a practical Windows smoke-test harness for validating them. The main functional change is that the Windows default UDP bind now honors conceal settings instead of always going through the plain fast path. In addition, this PR adds a single-VM Windows smoke test for both UDP and TCP conceal scenarios, plus a few Windows-specific compatibility fixes needed to make the test path usable in practice. ## What changed ### Windows UDP conceal-aware bind selection - route the Windows default UDP path through a conceal-aware wrapper - keep the WinRing fast path for plain UDP - automatically fall back to `StdNetBind` when any conceal layer is enabled: - framed headers/padding - prelude/junk/decoys - masquerade format rules - normalize endpoint handling so peer state stays stable when the active bind implementation changes ### Windows conceal smoke harness - add `tests/windows_single_vm_conceal_smoke.ps1` - add `tests/cmd/awg-keygen` to generate keypairs and PSKs for the harness - validate both: - `network=udp` - `network=tcp` - run two local peers on one Windows host, configure them through UAPI, trigger handshake, capture traffic with `pktmon`, and verify the active conceal configuration through UAPI state plus handshake behavior The smoke harness confirms that the conceal configuration is applied and that handshakes succeed on Windows. On the tested setup, `pktmon` loopback capture did not reliably expose raw payload markers, so capture-byte assertions remain best-effort rather than the source of truth. ## Notes This PR intentionally favors correctness and testability over forcing the Windows fast path in conceal-enabled UDP scenarios. Plain UDP keeps the fast path; conceal-enabled UDP now uses the conceal-capable bind path. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 21:04:09 +00:00