eburet-oss/wireguard-go-awg2-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

lx: gate reserved-byte clear on receive so AmneziaWG magic survives

Browse source 
The Cloudflare "reserved" bytes (1-3) were zeroed unconditionally on
every received datagram across all StdNetBind/WinRingBind receive paths.
AmneziaWG reads its magic header as LittleEndian.Uint32(packet[padding:])
where padding is s1/s2/s4; with small padding (0-3) the magic overlaps
bytes 1-3, so clearing them collapses it out of the ranged h1-h4 window
and every packet is dropped (handshake included) — the AWG endpoint
never comes up. Plain WG (types 1-4, bytes 1-3 already zero) and large
padding are unaffected, which is why it went unnoticed.

Gate all five receive clears (bind_std receiveIP, msgx_darwin
receiveSingle + makeReceiveMsgX, bind_windows receiveIPv4/v6) behind a
new hasReserved() so bytes 1-3 are only touched when a WARP reserved
value is actually configured. Send paths already gate on a per-endpoint
loaded/non-zero check, so they are left unchanged. The reserved map is
populated before the receive goroutines start and never mutated after,
so the lock-free read is safe.

Tests: awg_stdnetbind_reserved_lx_test.go brings up two Devices over
StdNetBind with zero padding (magic in bytes 0-3) and asserts delivery
(red before the fix, green after); reserved_gate_lx_test.go pins the
hasReserved() gate.
This commit is contained in:
Leadaxe 2026-07-17 01:32:40 +02:00
parent ee7ff1b77f
commit 1e787bb3e0
7 changed files with 283 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

16
conn/bind_windows.go
View file

@ -461,7 +461,7 @@ func (bind *WinRingBind) receiveIPv4(bufs [][]byte, sizes []int, eps []Endpoint)
bind.mu.RLock()
defer bind.mu.RUnlock()
n, ep, err := bind.v4.Receive(bufs[0], &bind.isOpen)
if n > 3 {
if n > 3 && bind.hasReserved() { // lx: only strip reserved bytes for WARP (see hasReserved)
common.ClearArray(bufs[0][1:4])
}
sizes[0] = n
@ -473,7 +473,7 @@ func (bind *WinRingBind) receiveIPv6(bufs [][]byte, sizes []int, eps []Endpoint)
bind.mu.RLock()
defer bind.mu.RUnlock()
n, ep, err := bind.v6.Receive(bufs[0], &bind.isOpen)
if n > 3 {
if n > 3 && bind.hasReserved() { // lx: only strip reserved bytes for WARP (see hasReserved)
common.ClearArray(bufs[0][1:4])
}
sizes[0] = n
@ -576,6 +576,18 @@ func (bind *WinRingBind) SetReservedForEndpoint(destination netip.AddrPort, rese
bind.reservedForEndpoint[*endpoint.(*WinRingEndpoint)] = reserved
}
// lx: hasReserved reports whether any Cloudflare "reserved" value is set. See
// the StdNetBind.hasReserved comment — the unconditional receive clear would
// corrupt an AmneziaWG magic header sitting in bytes 1-3 (small padding).
func (bind *WinRingBind) hasReserved() bool {
for _, reserved := range bind.reservedForEndpoint {
if reserved != [3]uint8{} {
return true
}
}
return false
}
func (s *StdNetBind) BindSocketToInterface4(interfaceIndex uint32, blackhole bool) error {
s.mu.Lock()
defer s.mu.Unlock()