[PR #145] [MERGED] compat: fix compilation on kernels >= 6.19 (blake2s API change) #205

New issue

Closed

opened 2026-10-13 21:07:37 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:37 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/145
Author: @noctuum
Created: 3/5/2026
Status: ✅ Merged
Merged: 3/22/2026
Merged by: @pokamest

Base: master ← Head: fix/kernel-6.19-blake2s-compat

📝 Commits (3)

6006d44 compat: fix compilation on kernels >= 6.19 (blake2s API change)
47b21c8 compat: use new blake2s API as default, add fallback for old kernels
1a4fed7 fix: add blake2s inclusion before using its internal method for compat

📊 Changes

3 files changed (+17 additions, -9 deletions)

View changed files

📝 src/compat/compat.h (+8 -0)
📝 src/cookie.c (+4 -4)
📝 src/noise.c (+5 -5)

📄 Description

Fixes #143
Fixes #149

Problem

AmneziaWG fails to build on Linux kernel 6.19+ due to the blake2s API refactor by Eric Biggers that landed in kernel 6.19.

DKMS build errors on kernel 6.19.6-zen1-1-zen (Arch Linux):

noise.c: In function 'wg_noise_init':
noise.c:39:30: error: storage size of 'blake' isn't known
   39 |         struct blake2s_state blake;

noise.c:41:46: error: passing argument 2 of 'blake2s' makes integer from pointer without a cast
   41 |         blake2s(handshake_init_chaining_key, handshake_name, NULL,
   42 |                 NOISE_HASH_LEN, sizeof(handshake_name), 0);

noise.c: In function 'hmac':
noise.c:310:30: error: storage size of 'state' isn't known

noise.c: In function 'mix_hash':
noise.c:437:30: error: storage size of 'blake' isn't known

Same errors in cookie.c (lines 36, 80, 88, 94).

Root Cause

Kernel 6.19 refactored include/crypto/blake2s.h:

1. Struct renamed: struct blake2s_state → struct blake2s_ctx

2. blake2s() argument order changed:

// OLD (kernel < 6.19)
blake2s(out, in, key, outlen, inlen, keylen);

// NEW (kernel >= 6.19)
blake2s(key, keylen, in, inlen, out, outlen);

3. blake2s_init/update/final signatures unchanged — only the context struct name changed.

Fix

This follows the existing compat layer patterns in the codebase:

`src/compat/compat.h`

#define blake2s_state blake2s_ctx for kernels >= 6.19 (handles all 5 struct declaration sites across noise.c and cookie.c)
#define COMPAT_BLAKE2S_NEW_API flag for call-site guards

`src/noise.c`

Guard the blake2s() call in wg_noise_init() with #ifdef COMPAT_BLAKE2S_NEW_API

`src/cookie.c`

Guard blake2s() calls in compute_mac1() and compute_mac2() with #ifdef COMPAT_BLAKE2S_NEW_API

Why AmneziaWG is affected (but not upstream WireGuard)

The upstream wireguard-linux-compat targets kernels 3.10–5.5 only, since WireGuard was merged into mainline in Linux 5.6. Users on 6.19+ use the in-kernel WireGuard and don't need the out-of-tree module.

AmneziaWG, however, adds traffic obfuscation features (junk packets, magic headers) that are not in mainline — so the out-of-tree module must compile on all kernel versions, including 6.19+. On kernels >= 5.6 where include/crypto/blake2s.h exists, the module uses the kernel's blake2s rather than its bundled copy (see Kbuild.include line 111), which means it's directly affected by API changes in that header.

Testing

make build: Compiled successfully on kernel 6.19.6-zen1-1-zen (Arch Linux, x86_64)
DKMS build: dkms build amneziawg/1.0.0 succeeded
Module load: modprobe amneziawg loaded successfully, lsmod confirms module active
VPN test: AmneziaWG VPN tunnel established and working after fix

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/145 **Author:** [@noctuum](https://github.com/noctuum) **Created:** 3/5/2026 **Status:** ✅ Merged **Merged:** 3/22/2026 **Merged by:** [@pokamest](https://github.com/pokamest) **Base:** `master` ← **Head:** `fix/kernel-6.19-blake2s-compat` --- ### 📝 Commits (3) - [`6006d44`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/6006d4467471ed5893cfb2bd27ca054ac8351705) compat: fix compilation on kernels >= 6.19 (blake2s API change) - [`47b21c8`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/47b21c8058653893d2206bb65292966a451678f1) compat: use new blake2s API as default, add fallback for old kernels - [`1a4fed7`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/1a4fed7819a07229f435d8cc301de8bf27d9f994) fix: add blake2s inclusion before using its internal method for compat ### 📊 Changes **3 files changed** (+17 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `src/compat/compat.h` (+8 -0) 📝 `src/cookie.c` (+4 -4) 📝 `src/noise.c` (+5 -5) </details> ### 📄 Description Fixes #143 Fixes #149 ## Problem AmneziaWG fails to build on Linux kernel 6.19+ due to the blake2s API refactor by Eric Biggers that landed in kernel 6.19. DKMS build errors on kernel `6.19.6-zen1-1-zen` (Arch Linux): ``` noise.c: In function 'wg_noise_init': noise.c:39:30: error: storage size of 'blake' isn't known 39 | struct blake2s_state blake; noise.c:41:46: error: passing argument 2 of 'blake2s' makes integer from pointer without a cast 41 | blake2s(handshake_init_chaining_key, handshake_name, NULL, 42 | NOISE_HASH_LEN, sizeof(handshake_name), 0); noise.c: In function 'hmac': noise.c:310:30: error: storage size of 'state' isn't known noise.c: In function 'mix_hash': noise.c:437:30: error: storage size of 'blake' isn't known ``` Same errors in `cookie.c` (lines 36, 80, 88, 94). ## Root Cause Kernel 6.19 refactored `include/crypto/blake2s.h`: **1. Struct renamed:** `struct blake2s_state` → `struct blake2s_ctx` **2. `blake2s()` argument order changed:** ```c // OLD (kernel < 6.19) blake2s(out, in, key, outlen, inlen, keylen); // NEW (kernel >= 6.19) blake2s(key, keylen, in, inlen, out, outlen); ``` **3. `blake2s_init/update/final` signatures unchanged** — only the context struct name changed. ## Fix This follows the existing compat layer patterns in the codebase: ### `src/compat/compat.h` - `#define blake2s_state blake2s_ctx` for kernels >= 6.19 (handles all 5 struct declaration sites across noise.c and cookie.c) - `#define COMPAT_BLAKE2S_NEW_API` flag for call-site guards ### `src/noise.c` - Guard the `blake2s()` call in `wg_noise_init()` with `#ifdef COMPAT_BLAKE2S_NEW_API` ### `src/cookie.c` - Guard `blake2s()` calls in `compute_mac1()` and `compute_mac2()` with `#ifdef COMPAT_BLAKE2S_NEW_API` ## Why AmneziaWG is affected (but not upstream WireGuard) The upstream `wireguard-linux-compat` targets kernels 3.10–5.5 only, since WireGuard was merged into mainline in Linux 5.6. Users on 6.19+ use the in-kernel WireGuard and don't need the out-of-tree module. AmneziaWG, however, adds traffic obfuscation features (junk packets, magic headers) that are not in mainline — so the out-of-tree module must compile on **all** kernel versions, including 6.19+. On kernels >= 5.6 where `include/crypto/blake2s.h` exists, the module uses the kernel's blake2s rather than its bundled copy (see `Kbuild.include` line 111), which means it's directly affected by API changes in that header. ## Testing - **`make` build:** Compiled successfully on kernel `6.19.6-zen1-1-zen` (Arch Linux, x86_64) - **DKMS build:** `dkms build amneziawg/1.0.0` succeeded - **Module load:** `modprobe amneziawg` loaded successfully, `lsmod` confirms module active - **VPN test:** AmneziaWG VPN tunnel established and working after fix --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 21:07:37 +00:00