amnezia-vpn/amneziawg-linux-kernel-module

Fork 0

mirror of https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git synced 2026-10-13 21:34:34 +00:00

[PR #242] fix: preserve valid transport classification with random trailers #254

New issue

Open

opened 2026-10-13 21:08:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:08:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/242
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/random-trailer-transport-classification

📝 Commits (1)

179dc9f fix: preserve valid transport classification with random trailers

📊 Changes

1 file changed (+53 additions, -8 deletions)

View changed files

📝 src/receive.c (+53 -8)

📄 Description

Summary

When RandomTrailers is enabled, the receive classifier relaxes the handshake
size checks from exact-length matches to >=. A valid transport packet can
therefore match H1/H2/H3 first and be committed to the handshake path before H4
is considered.

This change keeps the existing branch order, but treats a handshake-range hit
as ambiguous when trailers are enabled. Before committing to that handshake
type, it checks whether the same datagram also looks like transport at S4/H4
and whether its decoded key_idx belongs to a currently known keypair.

If both checks succeed, the packet is classified as MESSAGE_DATA and
continues through the existing data AEAD/replay validation instead of being
sent to the handshake queue and dropped on MAC1.

The header-protection probe is extended from 4 to 8 keystream bytes so both the
candidate type and key_idx can be decoded without mutating the skb.

Fast-path impact

The extra key-index lookup is not performed for ordinary transport packets. It
only runs after a packet has already matched one of the H1-H3 handshake
candidates and then also matches H4, so the normal data path remains unchanged.

RandomTrailers = off is unchanged.

Scope

This addresses the valid transport packet loss described in #226 without
moving the transport branch ahead of handshakes globally.

Fixes #226

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/242 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/random-trailer-transport-classification` --- ### 📝 Commits (1) - [`179dc9f`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/179dc9f006f17b1c9a3ebb26bc6da2b810a26032) fix: preserve valid transport classification with random trailers ### 📊 Changes **1 file changed** (+53 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `src/receive.c` (+53 -8) </details> ### 📄 Description ## Summary When `RandomTrailers` is enabled, the receive classifier relaxes the handshake size checks from exact-length matches to `>=`. A valid transport packet can therefore match H1/H2/H3 first and be committed to the handshake path before H4 is considered. This change keeps the existing branch order, but treats a handshake-range hit as ambiguous when trailers are enabled. Before committing to that handshake type, it checks whether the same datagram also looks like transport at S4/H4 and whether its decoded `key_idx` belongs to a currently known keypair. If both checks succeed, the packet is classified as `MESSAGE_DATA` and continues through the existing data AEAD/replay validation instead of being sent to the handshake queue and dropped on MAC1. The header-protection probe is extended from 4 to 8 keystream bytes so both the candidate type and `key_idx` can be decoded without mutating the skb. ## Fast-path impact The extra key-index lookup is not performed for ordinary transport packets. It only runs after a packet has already matched one of the H1-H3 handshake candidates and then also matches H4, so the normal data path remains unchanged. `RandomTrailers = off` is unchanged. ## Scope This addresses the valid transport packet loss described in #226 without moving the transport branch ahead of handshakes globally. Fixes #226 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:08:03 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amneziawg-linux-kernel-module#254

No description provided.

Rows
Columns