amnezia-vpn/amneziawg-linux-kernel-module

Fork 0

mirror of https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git synced 2026-10-14 05:41:56 +00:00

[GH-ISSUE #216] setconf fails with EINVAL when HeaderProtectionKey is set, even with valid S1-S4 (`4680320` / v3.1.20260812) #125

New issue

Closed

opened 2026-10-13 21:06:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:06:48 +00:00

Owner

Originally created by @VaisVaisov on GitHub (Aug 17, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/216

Environment

Server: Oracle Cloud ARM Ampere A1, Ubuntu 24.04, arm64
Package: amneziawg-dkms 1.0.0-0~202608140352+4680320~ubuntu24.04.1 (from ppa:amnezia/ppa)
amneziawg-tools 1.0.20210914-0~202608130144+ee0f0a9~ubuntu24.04.1 (same PPA)

Summary

awg setconf fails with Unable to modify interface: Invalid argument when HeaderProtectionKey is present, even though S1-S4 are all well above HEADER_PROTECTION_NONCE_SIZE (12) — so this doesn't look like the already-fixed #200/#203 case (missing/too-small S values).

Bisection

Config	Result
Jc/Jmin/Jmax + S1-S4 (all > 12) + H1-H4 + I1-I3, no HeaderProtectionKey	`awg-quick up` succeeds cleanly
same, + HeaderProtectionKey (fresh key from `awg genpsk`, verified 32 bytes after base64 decode)	`awg-quick up` fails: `Unable to modify interface: Invalid argument`
same, + HeaderProtectionKey + ContentPaddingAddition/RekeyAfterTime/RekeyTimeout/RejectAfterTime/KeepaliveTimeout/MaxHandshakeAttempts	fails the same way

Notable: userspace implementation is unaffected

Applying the exact same failing config (stripped of wg-quick-only fields) via amneziawg-go + awg setconf on a manually-created interface works without error (exit code 0), and awg show reflects the config correctly. This points to the bug being specific to the kernel module's netlink handling of WGDEVICE_A_HEADER_PROTECTION_KEY, not a config/tooling issue.

Debugging attempted

Enabled dynamic debug (echo "module amneziawg +p" > .../dynamic_debug/control) and re-ran the failing setconf. No net_dbg_ratelimited output appeared from netlink.c in dmesg (other files' pr_debug lines, e.g. cookie.c/socket.c/receive.c, do show up in dynamic_debug/control, so dynamic debug itself is working — netlink.c's debug lines simply never printed for this failure), so I wasn't able to pin down the exact failing branch from logs alone.

Not yet tested

Have not bisected against intermediate commits between ce16310 (last known-good for this server, 2026-08-05) and 4680320 (2026-08-14, tag v3.1.20260812) to narrow which commit introduced this — happy to help test if useful.

Originally created by @VaisVaisov on GitHub (Aug 17, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/216 ## Environment - Server: Oracle Cloud ARM Ampere A1, Ubuntu 24.04, arm64 - Package: amneziawg-dkms `1.0.0-0~202608140352+4680320~ubuntu24.04.1` (from ppa:amnezia/ppa) - amneziawg-tools `1.0.20210914-0~202608130144+ee0f0a9~ubuntu24.04.1` (same PPA) ## Summary `awg setconf` fails with `Unable to modify interface: Invalid argument` when `HeaderProtectionKey` is present, even though S1-S4 are all well above `HEADER_PROTECTION_NONCE_SIZE` (12) — so this doesn't look like the already-fixed #200/#203 case (missing/too-small S values). ## Bisection | Config | Result | |---|---| | Jc/Jmin/Jmax + S1-S4 (all > 12) + H1-H4 + I1-I3, no HeaderProtectionKey | `awg-quick up` succeeds cleanly | | same, + HeaderProtectionKey (fresh key from `awg genpsk`, verified 32 bytes after base64 decode) | `awg-quick up` fails: `Unable to modify interface: Invalid argument` | | same, + HeaderProtectionKey + ContentPaddingAddition/RekeyAfterTime/RekeyTimeout/RejectAfterTime/KeepaliveTimeout/MaxHandshakeAttempts | fails the same way | ## Notable: userspace implementation is unaffected Applying the exact same failing config (stripped of wg-quick-only fields) via `amneziawg-go` + `awg setconf` on a manually-created interface works without error (exit code 0), and `awg show` reflects the config correctly. This points to the bug being specific to the kernel module's netlink handling of `WGDEVICE_A_HEADER_PROTECTION_KEY`, not a config/tooling issue. ## Debugging attempted Enabled dynamic debug (`echo "module amneziawg +p" > .../dynamic_debug/control`) and re-ran the failing `setconf`. No `net_dbg_ratelimited` output appeared from `netlink.c` in `dmesg` (other files' pr_debug lines, e.g. `cookie.c`/`socket.c`/`receive.c`, do show up in `dynamic_debug/control`, so dynamic debug itself is working — `netlink.c`'s debug lines simply never printed for this failure), so I wasn't able to pin down the exact failing branch from logs alone. ## Not yet tested Have not bisected against intermediate commits between `ce16310` (last known-good for this server, 2026-08-05) and `4680320` (2026-08-14, tag v3.1.20260812) to narrow which commit introduced this — happy to help test if useful.

bsakaguchi closed this issue

2026-10-13 21:06:48 +00:00

bsakaguchi referenced this issue

2026-10-13 21:07:32 +00:00

[PR #130] [MERGED] compat: fix compilation on Ubuntu 20.04 with kernel 5.4.223 #198

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amneziawg-linux-kernel-module#125

No description provided.

Rows
Columns

[GH-ISSUE #216] setconf fails with EINVAL when HeaderProtectionKey is set, even with valid S1-S4 (4680320 / v3.1.20260812) #125