[PR #77] Feature/awg 3.1 freebsd #77

New issue

Open

opened 2026-10-13 21:03:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:03:02 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-tools/pull/77
Author: @vgrebenschikov
Created: 9/27/2026
Status: 🔄 Open

Base: master ← Head: feature/awg-3.1-freebsd

📝 Commits (2)

25e5260 feat: support AmneziaWG 3.1 on FreeBSD and incremental AllowedIPs
426b0a1 minor formatting fixes

📊 Changes

5 files changed (+222 additions, -68 deletions)

View changed files

📝 src/config.c (+27 -0)
📝 src/containers.h (+5 -0)
📝 src/ipc-freebsd.h (+180 -61)
📝 src/show.c (+7 -7)
📝 src/uapi/freebsd/dev/wg/if_wg.h (+3 -0)

📄 Description

feat: support AmneziaWG 3.1 on FreeBSD and incremental AllowedIPs

Wire up the FreeBSD ioctl/nvlist IPC to the kernel's AWG version so
userspace can talk to both AWG 2.x and AWG 3.x kmods without breaking
older interfaces.

New AWG 3.1 device parameters (get/set via nvlist; rejected with EOPNOTSUPP on an AWG 2 kmod):
- header-protection-key
- content-padding-addition
- rekey-after-time
- rekey-timeout
- reject-after-time
- keepalive-timeout
- max-handshake-attempts
- random-trailers
- disable-cookies

On AWG 3.1, H1–H4 are exchanged as numbers (u32 ranges). AWG 2 still
uses binary strings. PersistentKeepalive is a range on AWG 3.1 and a
single u16 on older kernels. Kernel Hx=0 is mapped to the default
WireGuard message types expected by shared UI code.
AllowedIPs on FreeBSD can be changed incrementally: a leading '+' adds
a prefix without replacing the peer's list, and '-' removes one
(WGALLOWEDIP_REMOVE_ME).

Junk strings from the kernel are accepted only when NUL-terminated and within the FreeBSD size limit.
Also fix awg show max-handshake-attempts (typo / underscore in usage) and print empty I1–I5 instead of crashing on a NULL pointer.

Examples:

      # AWG 3.1 device params (ranges and booleans)
      awg set awg0 \
        header-protection-key /etc/amnezia/awg0.hpk \
        content-padding-addition 0-64 \
        rekey-after-time 120 \
        rekey-timeout 5 \
        reject-after-time 180 \
        keepalive-timeout 10 \
        max-handshake-attempts 18-25 \
        random-trailers on \
        disable-cookies off

      # H1–H4 as numeric ranges on AWG 3.1
      awg set awg0 h1 1 h2 2 h3 3-5 h4 7

      # PersistentKeepalive as a range on AWG 3.1
      awg set awg0 peer <pubkey> persistent-keepalive 15-25

      # Incremental AllowedIPs on FreeBSD (do not replace the full list)
      awg set awg0 peer <pubkey> allowed-ips +10.0.0.2/32,-192.168.1.0/24
      awg show awg0 header-protection-key
      awg show awg0 max-handshake-attempts

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-tools/pull/77 **Author:** [@vgrebenschikov](https://github.com/vgrebenschikov) **Created:** 9/27/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `feature/awg-3.1-freebsd` --- ### 📝 Commits (2) - [`25e5260`](https://github.com/amnezia-vpn/amneziawg-tools/commit/25e52607ba6f758d085d22affc3e0c87fa76edeb) feat: support AmneziaWG 3.1 on FreeBSD and incremental AllowedIPs - [`426b0a1`](https://github.com/amnezia-vpn/amneziawg-tools/commit/426b0a17e4931d6de5df1c450ae847ea748068b1) minor formatting fixes ### 📊 Changes **5 files changed** (+222 additions, -68 deletions) <details> <summary>View changed files</summary> 📝 `src/config.c` (+27 -0) 📝 `src/containers.h` (+5 -0) 📝 `src/ipc-freebsd.h` (+180 -61) 📝 `src/show.c` (+7 -7) 📝 `src/uapi/freebsd/dev/wg/if_wg.h` (+3 -0) </details> ### 📄 Description feat: support AmneziaWG 3.1 on FreeBSD and incremental AllowedIPs Wire up the FreeBSD ioctl/nvlist IPC to the kernel's AWG version so userspace can talk to both AWG 2.x and AWG 3.x kmods without breaking older interfaces. New AWG 3.1 device parameters (get/set via nvlist; rejected with EOPNOTSUPP on an AWG 2 kmod): - header-protection-key - content-padding-addition - rekey-after-time - rekey-timeout - reject-after-time - keepalive-timeout - max-handshake-attempts - random-trailers - disable-cookies On AWG 3.1, H1–H4 are exchanged as numbers (u32 ranges). AWG 2 still uses binary strings. PersistentKeepalive is a range on AWG 3.1 and a single u16 on older kernels. Kernel Hx=0 is mapped to the default WireGuard message types expected by shared UI code. AllowedIPs on FreeBSD can be changed incrementally: a leading '+' adds a prefix without replacing the peer's list, and '-' removes one (WGALLOWEDIP_REMOVE_ME). Junk strings from the kernel are accepted only when NUL-terminated and within the FreeBSD size limit. Also fix `awg show max-handshake-attempts` (typo / underscore in usage) and print empty I1–I5 instead of crashing on a NULL pointer. Examples: ``` # AWG 3.1 device params (ranges and booleans) awg set awg0 \ header-protection-key /etc/amnezia/awg0.hpk \ content-padding-addition 0-64 \ rekey-after-time 120 \ rekey-timeout 5 \ reject-after-time 180 \ keepalive-timeout 10 \ max-handshake-attempts 18-25 \ random-trailers on \ disable-cookies off # H1–H4 as numeric ranges on AWG 3.1 awg set awg0 h1 1 h2 2 h3 3-5 h4 7 # PersistentKeepalive as a range on AWG 3.1 awg set awg0 peer <pubkey> persistent-keepalive 15-25 # Incremental AllowedIPs on FreeBSD (do not replace the full list) awg set awg0 peer <pubkey> allowed-ips +10.0.0.2/32,-192.168.1.0/24 awg show awg0 header-protection-key awg show awg0 max-handshake-attempts ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:03:02 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amneziawg-tools#77

No description provided.

Rows
Columns