[PR #232] [MERGED] fix: do not append random trailers to I1-I5 and dummy junk packets #246

New issue

Closed

opened 2026-10-13 21:07:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:07:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/232
Author: @v1l3nk4
Created: 9/6/2026
Status: ✅ Merged
Merged: 9/6/2026
Merged by: @ygurov

Base: master ← Head: fix/random-trailers-ipackets

📝 Commits (1)

90fee83 fix: do not append random trailers to I1-I5 and dummy junk packets

📊 Changes

3 files changed (+9 additions, -7 deletions)

View changed files

📝 src/send.c (+4 -4)
📝 src/socket.c (+4 -2)
📝 src/socket.h (+1 -1)

📄 Description

Fixes https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/231

What

Stop appending random trailers to the I1-I5 special junk packets and to the
Jc dummy junk. Handshake initiation, handshake response, cookie reply and
transport padding are unchanged.

Why

I1-I5 are operator-supplied byte-exact covers. A random tail does not
obscure their shape, it destroys it and replaces it with something the imitated
protocol can never produce: a valid prefix followed by bytes that protocol never
carries. For the dummy junk the trailer is simply redundant, its length is
already drawn from [Jmin, Jmax].

amneziawg-go already does this

Checked at b5928efb6ca19f0153958460c3d141f04abc5c2e: I-packets are queued as
make([]byte, ipacket.ObfuscatedLen(0)) with no trailer term
(device/send.go:139-144), and randomTrailer() is called only for handshake
init (:150), response (:200), cookie reply (:259) and transport padding
(:609). JunkPackets() is untouched too. So the same .conf currently gives
a different wire footprint depending on which implementation runs it. This makes
the kernel module match Go.

How

wg_socket_send_buffer_to_peer() gains a bool trailer argument. The four call
sites in send.c pass false for the ispec loop and the dummy junk, true for
the two handshake messages. +9 -7 across send.c, socket.c, socket.h.

No UAPI, netlink or wire-format change: I-packets and dummy junk are never
parsed by the receiver, so patched and unpatched ends interoperate unchanged.

Testing

Builds clean with no new warnings against 6.12.107+deb13-amd64.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/232 **Author:** [@v1l3nk4](https://github.com/v1l3nk4) **Created:** 9/6/2026 **Status:** ✅ Merged **Merged:** 9/6/2026 **Merged by:** [@ygurov](https://github.com/ygurov) **Base:** `master` ← **Head:** `fix/random-trailers-ipackets` --- ### 📝 Commits (1) - [`90fee83`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/90fee838e769562d96f82a9ac45f2a168892a453) fix: do not append random trailers to I1-I5 and dummy junk packets ### 📊 Changes **3 files changed** (+9 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/send.c` (+4 -4) 📝 `src/socket.c` (+4 -2) 📝 `src/socket.h` (+1 -1) </details> ### 📄 Description Fixes https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/231 ## What Stop appending random trailers to the `I1`-`I5` special junk packets and to the `Jc` dummy junk. Handshake initiation, handshake response, cookie reply and transport padding are unchanged. ## Why `I1`-`I5` are operator-supplied byte-exact covers. A random tail does not obscure their shape, it destroys it and replaces it with something the imitated protocol can never produce: a valid prefix followed by bytes that protocol never carries. For the dummy junk the trailer is simply redundant, its length is already drawn from `[Jmin, Jmax]`. ## amneziawg-go already does this Checked at `b5928efb6ca19f0153958460c3d141f04abc5c2e`: I-packets are queued as `make([]byte, ipacket.ObfuscatedLen(0))` with no trailer term (`device/send.go:139-144`), and `randomTrailer()` is called only for handshake init (`:150`), response (`:200`), cookie reply (`:259`) and transport padding (`:609`). `JunkPackets()` is untouched too. So the same `.conf` currently gives a different wire footprint depending on which implementation runs it. This makes the kernel module match Go. ## How `wg_socket_send_buffer_to_peer()` gains a `bool trailer` argument. The four call sites in `send.c` pass `false` for the ispec loop and the dummy junk, `true` for the two handshake messages. `+9 -7` across `send.c`, `socket.c`, `socket.h`. No UAPI, netlink or wire-format change: I-packets and dummy junk are never parsed by the receiver, so patched and unpatched ends interoperate unchanged. ## Testing Builds clean with no new warnings against `6.12.107+deb13-amd64`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 21:07:57 +00:00