[PR #174] Android tun probing protection #183

New issue

Open

opened 2026-10-13 21:04:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:04:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-go/pull/174
Author: @makekryl
Created: 8/10/2026
Status: 🔄 Open

Base: master ← Head: tun-probing-prot

📝 Commits (1)

9d3b67b Android tun probing protection

📊 Changes

5 files changed (+325 additions, -0 deletions)

View changed files

📝 device/device.go (+2 -0)
📝 device/send.go (+4 -0)
➕ device/tunfilter_android.go (+291 -0)
➕ device/tunfilter_default.go (+23 -0)
📝 device/uapi.go (+5 -0)

📄 Description

This implements the necessary changes on the AWG client side to mitigate https://github.com/amnezia-vpn/amnezia-client/issues/2457

It's as non-invasive as possible and the added function call should be eliminated on platforms other than Android by the compiler. The new behavior on Android is also opt-in, and can be controlled by the actual client wrapper.

Corresponding basic patch for https://github.com/amnezia-vpn/amneziawg-android:
awg_client_tun_probing.patch

Since the stakes are high all unidentifiable packets are dropped so this mode should be opt-in of course

When enabled, performance impact should be negligible; the well-known NetGuard has been doing this for ages (well, without cgo overhead though)

Note: the tiny TCP/IP header parser is AI-assisted

Helpful insight: https://habr.com/ru/articles/1030930/

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-go/pull/174 **Author:** [@makekryl](https://github.com/makekryl) **Created:** 8/10/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `tun-probing-prot` --- ### 📝 Commits (1) - [`9d3b67b`](https://github.com/amnezia-vpn/amneziawg-go/commit/9d3b67b0985169e2b13e1e0d3ac183e63ae921f6) Android tun probing protection ### 📊 Changes **5 files changed** (+325 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `device/device.go` (+2 -0) 📝 `device/send.go` (+4 -0) ➕ `device/tunfilter_android.go` (+291 -0) ➕ `device/tunfilter_default.go` (+23 -0) 📝 `device/uapi.go` (+5 -0) </details> ### 📄 Description This implements the necessary changes on the AWG client side to mitigate https://github.com/amnezia-vpn/amnezia-client/issues/2457 It's as non-invasive as possible and the added function call should be eliminated on platforms other than Android by the compiler. The new behavior on Android is also opt-in, and can be controlled by the actual client wrapper. Corresponding basic patch for https://github.com/amnezia-vpn/amneziawg-android: [awg_client_tun_probing.patch](https://github.com/user-attachments/files/30887665/awg_client_tun_probing.patch) Since the stakes are high all unidentifiable packets are dropped so this mode should be opt-in of course When enabled, performance impact should be negligible; the well-known [NetGuard](https://github.com/m66b/netguard) has been doing this for ages (well, without cgo overhead though) Note: the tiny TCP/IP header parser is AI-assisted Helpful insight: https://habr.com/ru/articles/1030930/ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:04:22 +00:00

bsakaguchi referenced this issue

2026-10-13 21:04:26 +00:00

[PR #183] fix: random trailers cause ~3.5% of transport packets to be misclassified as handshakes #191