[PR #249] fix: preserve non-byte-aligned IPv6 bogus endpoint prefixes #262

New issue

Open

opened 2026-10-13 21:08:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:08:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/249
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/bogus-endpoints-ipv6-prefix-bits

📝 Commits (1)

c55d5ab fix: preserve partial IPv6 bogus endpoint prefix

📊 Changes

1 file changed (+11 additions, -11 deletions)

View changed files

📝 src/netlink.c (+11 -11)

📄 Description

Summary

Preserve the configured IPv6 prefix when generating obfuscated peer endpoints for non-byte-aligned prefixes.

generate_ipv6_address_with_prefix() currently randomizes the suffix starting at prefix_bytes before handling a partial prefix byte.

For prefixes that are not multiples of 8, such as /65, /73, or /127, this overwrites the byte that still contains part of the network prefix. The subsequent mask therefore preserves random bits instead of the configured prefix bits, allowing the generated address to fall outside the requested IPv6 prefix.

This change handles the partial byte first:

preserve the prefix bits from the configured address;
randomize only the host bits in that byte;
advance to the next byte;
randomize the remaining suffix bytes.

Byte-aligned prefixes keep their existing behavior. /0 still randomizes the full address, and /128 remains unchanged.

Scope

Only the optional IPv6 bogus_endpoints address generator changes.

The feature remains disabled by default.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/pull/249 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/bogus-endpoints-ipv6-prefix-bits` --- ### 📝 Commits (1) - [`c55d5ab`](https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/commit/c55d5abab4d30da7ab46784156ae08086c16203c) fix: preserve partial IPv6 bogus endpoint prefix ### 📊 Changes **1 file changed** (+11 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `src/netlink.c` (+11 -11) </details> ### 📄 Description Summary Preserve the configured IPv6 prefix when generating obfuscated peer endpoints for non-byte-aligned prefixes. generate_ipv6_address_with_prefix() currently randomizes the suffix starting at prefix_bytes before handling a partial prefix byte. For prefixes that are not multiples of 8, such as /65, /73, or /127, this overwrites the byte that still contains part of the network prefix. The subsequent mask therefore preserves random bits instead of the configured prefix bits, allowing the generated address to fall outside the requested IPv6 prefix. This change handles the partial byte first: preserve the prefix bits from the configured address; randomize only the host bits in that byte; advance to the next byte; randomize the remaining suffix bytes. Byte-aligned prefixes keep their existing behavior. /0 still randomizes the full address, and /128 remains unchanged. Scope Only the optional IPv6 bogus_endpoints address generator changes. The feature remains disabled by default. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:08:05 +00:00

bsakaguchi referenced this issue

2026-10-13 21:08:07 +00:00

[PR #262] fix(compat): add support for Linux kernel 7.0.0-38 #264

bsakaguchi referenced this issue

2026-10-13 21:08:08 +00:00

[PR #265] compat: detect udp_tunnel sock/socket signatures instead of gating on kernel version (#259) #267