AmneziaWG v1.5 (#84)

device/awg/awg.go

@@ -0,0 +1,144 @@
+package awg
+
+import (
+	"bytes"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/tevino/abool"
+)
+
+type aSecCfgType struct {
+	IsSet                      bool
+	JunkPacketCount            int
+	JunkPacketMinSize          int
+	JunkPacketMaxSize          int
+	InitHeaderJunkSize         int
+	ResponseHeaderJunkSize     int
+	CookieReplyHeaderJunkSize  int
+	TransportHeaderJunkSize    int
+	InitPacketMagicHeader      uint32
+	ResponsePacketMagicHeader  uint32
+	UnderloadPacketMagicHeader uint32
+	TransportPacketMagicHeader uint32
+	// InitPacketMagicHeader      Limit
+	// ResponsePacketMagicHeader  Limit
+	// UnderloadPacketMagicHeader Limit
+	// TransportPacketMagicHeader Limit
+}
+
+type Limit struct {
+	Min        uint32
+	Max        uint32
+	HeaderType uint32
+}
+
+func NewLimit(min, max, headerType uint32) (Limit, error) {
+	if min > max {
+		return Limit{}, fmt.Errorf("min (%d) cannot be greater than max (%d)", min, max)
+	}
+
+	return Limit{
+		Min:        min,
+		Max:        max,
+		HeaderType: headerType,
+	}, nil
+}
+
+func ParseMagicHeader(key, value string, defaultHeaderType uint32) (Limit, error) {
+	// tempAwg.ASecCfg.InitPacketMagicHeader, err = awg.NewLimit(uint32(initPacketMagicHeaderMin), uint32(initPacketMagicHeaderMax), DNewLimit(min, max, headerType)efaultMessageInitiationType)
+	// var min, max, headerType uint32
+	// _, err := fmt.Sscanf(value, "%d-%d:%d", &min, &max, &headerType)
+	// if err != nil {
+	// 	return Limit{}, fmt.Errorf("invalid magic header format: %s", value)
+	// }
+
+	limits := strings.Split(value, "-")
+	if len(limits) != 2 {
+		return Limit{}, fmt.Errorf("invalid format for key: %s; %s", key, value)
+	}
+
+	min, err := strconv.ParseUint(limits[0], 10, 32)
+	if err != nil {
+		return Limit{}, fmt.Errorf("parse min key: %s; value: ; %w", key, limits[0], err)
+	}
+
+	max, err := strconv.ParseUint(limits[1], 10, 32)
+	if err != nil {
+		return Limit{}, fmt.Errorf("parse max key: %s; value: ; %w", key, limits[0], err)
+	}
+
+	limit, err := NewLimit(uint32(min), uint32(max), defaultHeaderType)
+	if err != nil {
+		return Limit{}, fmt.Errorf("new lmit key: %s; value: ; %w", key, limits[0], err)
+	}
+
+	return limit, nil
+}
+
+type Limits []Limit
+
+func NewLimits(limits []Limit) Limits {
+	slices.SortFunc(limits, func(a, b Limit) int {
+		if a.Min < b.Min {
+			return -1
+		} else if a.Min > b.Min {
+			return 1
+		}
+		return 0
+	})
+
+	return Limits(limits)
+}
+
+type Protocol struct {
+	IsASecOn abool.AtomicBool
+	// TODO: revision the need of the mutex
+	ASecMux     sync.RWMutex
+	ASecCfg     aSecCfgType
+	JunkCreator junkCreator
+
+	HandshakeHandler SpecialHandshakeHandler
+}
+
+func (protocol *Protocol) CreateInitHeaderJunk() ([]byte, error) {
+	return protocol.createHeaderJunk(protocol.ASecCfg.InitHeaderJunkSize)
+}
+
+func (protocol *Protocol) CreateResponseHeaderJunk() ([]byte, error) {
+	return protocol.createHeaderJunk(protocol.ASecCfg.ResponseHeaderJunkSize)
+}
+
+func (protocol *Protocol) CreateCookieReplyHeaderJunk() ([]byte, error) {
+	return protocol.createHeaderJunk(protocol.ASecCfg.CookieReplyHeaderJunkSize)
+}
+
+func (protocol *Protocol) CreateTransportHeaderJunk(packetSize int) ([]byte, error) {
+	return protocol.createHeaderJunk(protocol.ASecCfg.TransportHeaderJunkSize, packetSize)
+}
+
+func (protocol *Protocol) createHeaderJunk(junkSize int, optExtraSize ...int) ([]byte, error) {
+	extraSize := 0
+	if len(optExtraSize) == 1 {
+		extraSize = optExtraSize[0]
+	}
+
+	var junk []byte
+	protocol.ASecMux.RLock()
+	if junkSize != 0 {
+		buf := make([]byte, 0, junkSize+extraSize)
+		writer := bytes.NewBuffer(buf[:0])
+		err := protocol.JunkCreator.AppendJunk(writer, junkSize)
+		if err != nil {
+			protocol.ASecMux.RUnlock()
+			return nil, err
+		}
+		junk = writer.Bytes()
+	}
+	protocol.ASecMux.RUnlock()
+
+	return junk, nil
+}

device/awg/internal/mock.go

@@ -0,0 +1,37 @@
+package internal
+
+type mockGenerator struct {
+	size int
+}
+
+func NewMockGenerator(size int) mockGenerator {
+	return mockGenerator{size: size}
+}
+
+func (m mockGenerator) Generate() []byte {
+	return make([]byte, m.size)
+}
+
+func (m mockGenerator) Size() int {
+	return m.size
+}
+
+func (m mockGenerator) Name() string {
+	return "mock"
+}
+
+type mockByteGenerator struct {
+	data []byte
+}
+
+func NewMockByteGenerator(data []byte) mockByteGenerator {
+	return mockByteGenerator{data: data}
+}
+
+func (bg mockByteGenerator) Generate() []byte {
+	return bg.data
+}
+
+func (bg mockByteGenerator) Size() int {
+	return len(bg.data)
+}

device/awg/junk_creator.go

@@ -0,0 +1,70 @@
+package awg
+
+import (
+	"bytes"
+	crand "crypto/rand"
+	"fmt"
+	v2 "math/rand/v2"
+)
+
+type junkCreator struct {
+	aSecCfg  aSecCfgType
+	cha8Rand *v2.ChaCha8
+}
+
+// TODO: refactor param to only pass the junk related params
+func NewJunkCreator(aSecCfg aSecCfgType) (junkCreator, error) {
+	buf := make([]byte, 32)
+	_, err := crand.Read(buf)
+	if err != nil {
+		return junkCreator{}, err
+	}
+	return junkCreator{aSecCfg: aSecCfg, cha8Rand: v2.NewChaCha8([32]byte(buf))}, nil
+}
+
+// Should be called with aSecMux RLocked
+func (jc *junkCreator) CreateJunkPackets(junks *[][]byte) error {
+	if jc.aSecCfg.JunkPacketCount == 0 {
+		return nil
+	}
+
+	for range jc.aSecCfg.JunkPacketCount {
+		packetSize := jc.randomPacketSize()
+		junk, err := jc.randomJunkWithSize(packetSize)
+		if err != nil {
+			return fmt.Errorf("create junk packet: %v", err)
+		}
+		*junks = append(*junks, junk)
+	}
+	return nil
+}
+
+// Should be called with aSecMux RLocked
+func (jc *junkCreator) randomPacketSize() int {
+	return int(
+		jc.cha8Rand.Uint64()%uint64(
+			jc.aSecCfg.JunkPacketMaxSize-jc.aSecCfg.JunkPacketMinSize,
+		),
+	) + jc.aSecCfg.JunkPacketMinSize
+}
+
+// Should be called with aSecMux RLocked
+func (jc *junkCreator) AppendJunk(writer *bytes.Buffer, size int) error {
+	headerJunk, err := jc.randomJunkWithSize(size)
+	if err != nil {
+		return fmt.Errorf("create header junk: %v", err)
+	}
+	_, err = writer.Write(headerJunk)
+	if err != nil {
+		return fmt.Errorf("write header junk: %v", err)
+	}
+	return nil
+}
+
+// Should be called with aSecMux RLocked
+func (jc *junkCreator) randomJunkWithSize(size int) ([]byte, error) {
+	// TODO: use a memory pool to allocate
+	junk := make([]byte, size)
+	_, err := jc.cha8Rand.Read(junk)
+	return junk, err
+}

device/awg/junk_creator_test.go

@@ -0,0 +1,115 @@
+package awg
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+)
+
+func setUpJunkCreator(t *testing.T) (junkCreator, error) {
+	jc, err := NewJunkCreator(aSecCfgType{
+		IsSet:                      true,
+		JunkPacketCount:            5,
+		JunkPacketMinSize:          500,
+		JunkPacketMaxSize:          1000,
+		InitHeaderJunkSize:         30,
+		ResponseHeaderJunkSize:     40,
+		InitPacketMagicHeader:      123456,
+		ResponsePacketMagicHeader:  67543,
+		UnderloadPacketMagicHeader: 32345,
+		TransportPacketMagicHeader: 123123,
+	})
+
+	if err != nil {
+		t.Errorf("failed to create junk creator %v", err)
+		return junkCreator{}, err
+	}
+
+	return jc, nil
+}
+
+func Test_junkCreator_createJunkPackets(t *testing.T) {
+	jc, err := setUpJunkCreator(t)
+	if err != nil {
+		return
+	}
+	t.Run("valid", func(t *testing.T) {
+		got := make([][]byte, 0, jc.aSecCfg.JunkPacketCount)
+		err := jc.CreateJunkPackets(&got)
+		if err != nil {
+			t.Errorf(
+				"junkCreator.createJunkPackets() = %v; failed",
+				err,
+			)
+			return
+		}
+		seen := make(map[string]bool)
+		for _, junk := range got {
+			key := string(junk)
+			if seen[key] {
+				t.Errorf(
+					"junkCreator.createJunkPackets() = %v, duplicate key: %v",
+					got,
+					junk,
+				)
+				return
+			}
+			seen[key] = true
+		}
+	})
+}
+
+func Test_junkCreator_randomJunkWithSize(t *testing.T) {
+	t.Run("valid", func(t *testing.T) {
+		jc, err := setUpJunkCreator(t)
+		if err != nil {
+			return
+		}
+		r1, _ := jc.randomJunkWithSize(10)
+		r2, _ := jc.randomJunkWithSize(10)
+		fmt.Printf("%v\n%v\n", r1, r2)
+		if bytes.Equal(r1, r2) {
+			t.Errorf("same junks %v", err)
+			return
+		}
+	})
+}
+
+func Test_junkCreator_randomPacketSize(t *testing.T) {
+	jc, err := setUpJunkCreator(t)
+	if err != nil {
+		return
+	}
+	for range [30]struct{}{} {
+		t.Run("valid", func(t *testing.T) {
+			if got := jc.randomPacketSize(); jc.aSecCfg.JunkPacketMinSize > got ||
+				got > jc.aSecCfg.JunkPacketMaxSize {
+				t.Errorf(
+					"junkCreator.randomPacketSize() = %v, not between range [%v,%v]",
+					got,
+					jc.aSecCfg.JunkPacketMinSize,
+					jc.aSecCfg.JunkPacketMaxSize,
+				)
+			}
+		})
+	}
+}
+
+func Test_junkCreator_appendJunk(t *testing.T) {
+	jc, err := setUpJunkCreator(t)
+	if err != nil {
+		return
+	}
+	t.Run("valid", func(t *testing.T) {
+		s := "apple"
+		buffer := bytes.NewBuffer([]byte(s))
+		err := jc.AppendJunk(buffer, 30)
+		if err != nil &&
+			buffer.Len() != len(s)+30 {
+			t.Error("appendWithJunk() size don't match")
+		}
+		read := make([]byte, 50)
+		buffer.Read(read)
+		fmt.Println(string(read))
+	})
+}

device/awg/special_handshake_handler.go

@@ -0,0 +1,73 @@
+package awg
+
+import (
+	"errors"
+	"time"
+
+	"github.com/tevino/abool"
+	"go.uber.org/atomic"
+)
+
+// TODO: atomic?/ and better way to use this
+var PacketCounter *atomic.Uint64 = atomic.NewUint64(0)
+
+// TODO
+var WaitResponse = struct {
+	Channel    chan struct{}
+	ShouldWait *abool.AtomicBool
+}{
+	make(chan struct{}, 1),
+	abool.New(),
+}
+
+type SpecialHandshakeHandler struct {
+	isFirstDone    bool
+	SpecialJunk    TagJunkPacketGenerators
+	ControlledJunk TagJunkPacketGenerators
+
+	nextItime time.Time
+	ITimeout  time.Duration // seconds
+
+	IsSet bool
+}
+
+func (handler *SpecialHandshakeHandler) Validate() error {
+	var errs []error
+	if err := handler.SpecialJunk.Validate(); err != nil {
+		errs = append(errs, err)
+	}
+	if err := handler.ControlledJunk.Validate(); err != nil {
+		errs = append(errs, err)
+	}
+	return errors.Join(errs...)
+}
+
+func (handler *SpecialHandshakeHandler) GenerateSpecialJunk() [][]byte {
+	if !handler.SpecialJunk.IsDefined() {
+		return nil
+	}
+
+	// TODO: create tests
+	if !handler.isFirstDone {
+		handler.isFirstDone = true
+	} else if !handler.isTimeToSendSpecial() {
+		return nil
+	}
+
+	rv := handler.SpecialJunk.GeneratePackets()
+	handler.nextItime = time.Now().Add(handler.ITimeout)
+
+	return rv
+}
+
+func (handler *SpecialHandshakeHandler) isTimeToSendSpecial() bool {
+	return time.Now().After(handler.nextItime)
+}
+
+func (handler *SpecialHandshakeHandler) GenerateControlledJunk() [][]byte {
+	if !handler.ControlledJunk.IsDefined() {
+		return nil
+	}
+
+	return handler.ControlledJunk.GeneratePackets()
+}

device/awg/tag_generator.go

@@ -0,0 +1,190 @@
+package awg
+
+import (
+	crand "crypto/rand"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	v2 "math/rand/v2"
+	// "go.uber.org/atomic"
+)
+
+type Generator interface {
+	Generate() []byte
+	Size() int
+}
+
+type newGenerator func(string) (Generator, error)
+
+type BytesGenerator struct {
+	value []byte
+	size  int
+}
+
+func (bg *BytesGenerator) Generate() []byte {
+	return bg.value
+}
+
+func (bg *BytesGenerator) Size() int {
+	return bg.size
+}
+
+func newBytesGenerator(param string) (Generator, error) {
+	hasPrefix := strings.HasPrefix(param, "0x") || strings.HasPrefix(param, "0X")
+	if !hasPrefix {
+		return nil, fmt.Errorf("not correct hex: %s", param)
+	}
+
+	hex, err := hexToBytes(param)
+	if err != nil {
+		return nil, fmt.Errorf("hexToBytes: %w", err)
+	}
+
+	return &BytesGenerator{value: hex, size: len(hex)}, nil
+}
+
+func hexToBytes(hexStr string) ([]byte, error) {
+	hexStr = strings.TrimPrefix(hexStr, "0x")
+	hexStr = strings.TrimPrefix(hexStr, "0X")
+
+	// Ensure even length (pad with leading zero if needed)
+	if len(hexStr)%2 != 0 {
+		hexStr = "0" + hexStr
+	}
+
+	return hex.DecodeString(hexStr)
+}
+
+type RandomPacketGenerator struct {
+	cha8Rand *v2.ChaCha8
+	size     int
+}
+
+func (rpg *RandomPacketGenerator) Generate() []byte {
+	junk := make([]byte, rpg.size)
+	rpg.cha8Rand.Read(junk)
+	return junk
+}
+
+func (rpg *RandomPacketGenerator) Size() int {
+	return rpg.size
+}
+
+func newRandomPacketGenerator(param string) (Generator, error) {
+	size, err := strconv.Atoi(param)
+	if err != nil {
+		return nil, fmt.Errorf("random packet parse int: %w", err)
+	}
+
+	if size > 1000 {
+		return nil, fmt.Errorf("random packet size must be less than 1000")
+	}
+
+	buf := make([]byte, 32)
+	_, err = crand.Read(buf)
+	if err != nil {
+		return nil, fmt.Errorf("random packet crand read: %w", err)
+	}
+
+	return &RandomPacketGenerator{
+		cha8Rand: v2.NewChaCha8([32]byte(buf)),
+		size:     size,
+	}, nil
+}
+
+type TimestampGenerator struct {
+}
+
+func (tg *TimestampGenerator) Generate() []byte {
+	buf := make([]byte, 8)
+	binary.BigEndian.PutUint64(buf, uint64(time.Now().Unix()))
+	return buf
+}
+
+func (tg *TimestampGenerator) Size() int {
+	return 8
+}
+
+func newTimestampGenerator(param string) (Generator, error) {
+	if len(param) != 0 {
+		return nil, fmt.Errorf("timestamp param needs to be empty: %s", param)
+	}
+
+	return &TimestampGenerator{}, nil
+}
+
+type WaitTimeoutGenerator struct {
+	waitTimeout time.Duration
+}
+
+func (wtg *WaitTimeoutGenerator) Generate() []byte {
+	time.Sleep(wtg.waitTimeout)
+	return []byte{}
+}
+
+func (wtg *WaitTimeoutGenerator) Size() int {
+	return 0
+}
+
+func newWaitTimeoutGenerator(param string) (Generator, error) {
+	timeout, err := strconv.Atoi(param)
+	if err != nil {
+		return nil, fmt.Errorf("timeout parse int: %w", err)
+	}
+
+	if timeout > 5000 {
+		return nil, fmt.Errorf("timeout must be less than 5000ms")
+	}
+
+	return &WaitTimeoutGenerator{
+		waitTimeout: time.Duration(timeout) * time.Millisecond,
+	}, nil
+}
+
+type PacketCounterGenerator struct {
+}
+
+func (c *PacketCounterGenerator) Generate() []byte {
+	buf := make([]byte, 8)
+	// TODO: better way to handle counter tag
+	binary.BigEndian.PutUint64(buf, PacketCounter.Load())
+	return buf
+}
+
+func (c *PacketCounterGenerator) Size() int {
+	return 8
+}
+
+func newPacketCounterGenerator(param string) (Generator, error) {
+	if len(param) != 0 {
+		return nil, fmt.Errorf("packet counter param needs to be empty: %s", param)
+	}
+
+	return &PacketCounterGenerator{}, nil
+}
+
+type WaitResponseGenerator struct {
+}
+
+func (c *WaitResponseGenerator) Generate() []byte {
+	WaitResponse.ShouldWait.Set()
+	<-WaitResponse.Channel
+	WaitResponse.ShouldWait.UnSet()
+	return []byte{}
+}
+
+func (c *WaitResponseGenerator) Size() int {
+	return 0
+}
+
+func newWaitResponseGenerator(param string) (Generator, error) {
+	if len(param) != 0 {
+		return nil, fmt.Errorf("wait response param needs to be empty: %s", param)
+	}
+
+	return &WaitResponseGenerator{}, nil
+}

device/awg/tag_generator_test.go

@@ -0,0 +1,189 @@
+package awg
+
+import (
+	"encoding/binary"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_newBytesGenerator(t *testing.T) {
+	type args struct {
+		param string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    []byte
+		wantErr error
+	}{
+		{
+			name: "empty",
+			args: args{
+				param: "",
+			},
+			wantErr: fmt.Errorf("not correct hex"),
+		},
+		{
+			name: "wrong start",
+			args: args{
+				param: "123456",
+			},
+			wantErr: fmt.Errorf("not correct hex"),
+		},
+		{
+			name: "not only hex value with X",
+			args: args{
+				param: "0X12345q",
+			},
+			wantErr: fmt.Errorf("not correct hex"),
+		},
+		{
+			name: "not only hex value with x",
+			args: args{
+				param: "0x12345q",
+			},
+			wantErr: fmt.Errorf("not correct hex"),
+		},
+		{
+			name: "valid hex",
+			args: args{
+				param: "0xf6ab3267fa",
+			},
+			want: []byte{0xf6, 0xab, 0x32, 0x67, 0xfa},
+		},
+		{
+			name: "valid hex with odd length",
+			args: args{
+				param: "0xfab3267fa",
+			},
+			want: []byte{0xf, 0xab, 0x32, 0x67, 0xfa},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := newBytesGenerator(tt.args.param)
+
+			if tt.wantErr != nil {
+				require.ErrorAs(t, err, &tt.wantErr)
+				require.Nil(t, got)
+				return
+			}
+
+			require.Nil(t, err)
+			require.NotNil(t, got)
+
+			gotValues := got.Generate()
+			require.Equal(t, tt.want, gotValues)
+		})
+	}
+}
+
+func Test_newRandomPacketGenerator(t *testing.T) {
+	type args struct {
+		param string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr error
+	}{
+		{
+			name: "empty",
+			args: args{
+				param: "",
+			},
+			wantErr: fmt.Errorf("parse int"),
+		},
+		{
+			name: "not an int",
+			args: args{
+				param: "x",
+			},
+			wantErr: fmt.Errorf("parse int"),
+		},
+		{
+			name: "too large",
+			args: args{
+				param: "1001",
+			},
+			wantErr: fmt.Errorf("random packet size must be less than 1000"),
+		},
+		{
+			name: "valid",
+			args: args{
+				param: "12",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := newRandomPacketGenerator(tt.args.param)
+			if tt.wantErr != nil {
+				require.ErrorAs(t, err, &tt.wantErr)
+				require.Nil(t, got)
+				return
+			}
+
+			require.Nil(t, err)
+			require.NotNil(t, got)
+			first := got.Generate()
+
+			second := got.Generate()
+			require.NotEqual(t, first, second)
+		})
+	}
+}
+
+func TestPacketCounterGenerator(t *testing.T) {
+	tests := []struct {
+		name    string
+		param   string
+		wantErr bool
+	}{
+		{
+			name:    "Valid empty param",
+			param:   "",
+			wantErr: false,
+		},
+		{
+			name:    "Invalid non-empty param",
+			param:   "anything",
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc // capture range variable
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			gen, err := newPacketCounterGenerator(tc.param)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Equal(t, 8, gen.Size())
+
+			// Reset counter to known value for test
+			initialCount := uint64(42)
+			PacketCounter.Store(initialCount)
+
+			output := gen.Generate()
+			require.Equal(t, 8, len(output))
+
+			// Verify counter value in output
+			counterValue := binary.BigEndian.Uint64(output)
+			require.Equal(t, initialCount, counterValue)
+
+			// Increment counter and verify change
+			PacketCounter.Add(1)
+			output = gen.Generate()
+			counterValue = binary.BigEndian.Uint64(output)
+			require.Equal(t, initialCount+1, counterValue)
+		})
+	}
+}

device/awg/tag_junk_packet_generator.go

@@ -0,0 +1,59 @@
+package awg
+
+import (
+	"fmt"
+	"strconv"
+)
+
+type TagJunkPacketGenerator struct {
+	name     string
+	tagValue string
+
+	packetSize int
+	generators []Generator
+}
+
+func newTagJunkPacketGenerator(name, tagValue string, size int) TagJunkPacketGenerator {
+	return TagJunkPacketGenerator{
+		name:       name,
+		tagValue:   tagValue,
+		generators: make([]Generator, 0, size),
+	}
+}
+
+func (tg *TagJunkPacketGenerator) append(generator Generator) {
+	tg.generators = append(tg.generators, generator)
+	tg.packetSize += generator.Size()
+}
+
+func (tg *TagJunkPacketGenerator) generatePacket() []byte {
+	packet := make([]byte, 0, tg.packetSize)
+	for _, generator := range tg.generators {
+		packet = append(packet, generator.Generate()...)
+	}
+
+	return packet
+}
+
+func (tg *TagJunkPacketGenerator) Name() string {
+	return tg.name
+}
+
+func (tg *TagJunkPacketGenerator) nameIndex() (int, error) {
+	if len(tg.name) != 2 {
+		return 0, fmt.Errorf("name must be 2 character long: %s", tg.name)
+	}
+
+	index, err := strconv.Atoi(tg.name[1:2])
+	if err != nil {
+		return 0, fmt.Errorf("name 2 char should be an int %w", err)
+	}
+	return index, nil
+}
+
+func (tg *TagJunkPacketGenerator) IpcGetFields() IpcFields {
+	return IpcFields{
+		Key:   tg.name,
+		Value: tg.tagValue,
+	}
+}

device/awg/tag_junk_packet_generator_test.go

@@ -0,0 +1,210 @@
+package awg
+
+import (
+	"testing"
+
+	"github.com/amnezia-vpn/amneziawg-go/device/awg/internal"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewTagJunkGenerator(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name     string
+		genName  string
+		size     int
+		expected TagJunkPacketGenerator
+	}{
+		{
+			name:    "Create new generator with empty name",
+			genName: "",
+			size:    0,
+			expected: TagJunkPacketGenerator{
+				name:       "",
+				packetSize: 0,
+				generators: make([]Generator, 0),
+			},
+		},
+		{
+			name:    "Create new generator with valid name",
+			genName: "T1",
+			size:    0,
+			expected: TagJunkPacketGenerator{
+				name:       "T1",
+				packetSize: 0,
+				generators: make([]Generator, 0),
+			},
+		},
+		{
+			name:    "Create new generator with non-zero size",
+			genName: "T2",
+			size:    5,
+			expected: TagJunkPacketGenerator{
+				name:       "T2",
+				packetSize: 0,
+				generators: make([]Generator, 5),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc // capture range variable
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			result := newTagJunkPacketGenerator(tc.genName, "", tc.size)
+			require.Equal(t, tc.expected.name, result.name)
+			require.Equal(t, tc.expected.packetSize, result.packetSize)
+			require.Equal(t, cap(result.generators), len(tc.expected.generators))
+		})
+	}
+}
+
+func TestTagJunkGeneratorAppend(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name           string
+		initialState   TagJunkPacketGenerator
+		mockSize       int
+		expectedLength int
+		expectedSize   int
+	}{
+		{
+			name:           "Append to empty generator",
+			initialState:   newTagJunkPacketGenerator("T1", "", 0),
+			mockSize:       5,
+			expectedLength: 1,
+			expectedSize:   5,
+		},
+		{
+			name: "Append to non-empty generator",
+			initialState: TagJunkPacketGenerator{
+				name:       "T2",
+				packetSize: 10,
+				generators: make([]Generator, 2),
+			},
+			mockSize:       7,
+			expectedLength: 3,  // 2 existing + 1 new
+			expectedSize:   17, // 10 + 7
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc // capture range variable
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			tg := tc.initialState
+			mockGen := internal.NewMockGenerator(tc.mockSize)
+
+			tg.append(mockGen)
+
+			require.Equal(t, tc.expectedLength, len(tg.generators))
+			require.Equal(t, tc.expectedSize, tg.packetSize)
+		})
+	}
+}
+
+func TestTagJunkGeneratorGenerate(t *testing.T) {
+	t.Parallel()
+
+	// Create mock generators for testing
+	mockGen1 := internal.NewMockByteGenerator([]byte{0x01, 0x02})
+	mockGen2 := internal.NewMockByteGenerator([]byte{0x03, 0x04, 0x05})
+
+	testCases := []struct {
+		name           string
+		setupGenerator func() TagJunkPacketGenerator
+		expected       []byte
+	}{
+		{
+			name: "Generate with empty generators",
+			setupGenerator: func() TagJunkPacketGenerator {
+				return newTagJunkPacketGenerator("T1", "", 0)
+			},
+			expected: []byte{},
+		},
+		{
+			name: "Generate with single generator",
+			setupGenerator: func() TagJunkPacketGenerator {
+				tg := newTagJunkPacketGenerator("T2", "", 0)
+				tg.append(mockGen1)
+				return tg
+			},
+			expected: []byte{0x01, 0x02},
+		},
+		{
+			name: "Generate with multiple generators",
+			setupGenerator: func() TagJunkPacketGenerator {
+				tg := newTagJunkPacketGenerator("T3", "", 0)
+				tg.append(mockGen1)
+				tg.append(mockGen2)
+				return tg
+			},
+			expected: []byte{0x01, 0x02, 0x03, 0x04, 0x05},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc // capture range variable
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			tg := tc.setupGenerator()
+			result := tg.generatePacket()
+
+			require.Equal(t, tc.expected, result)
+		})
+	}
+}
+
+func TestTagJunkGeneratorNameIndex(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name          string
+		generatorName string
+		expectedIndex int
+		expectError   bool
+	}{
+		{
+			name:          "Valid name with digit",
+			generatorName: "T5",
+			expectedIndex: 5,
+			expectError:   false,
+		},
+		{
+			name:          "Invalid name - too short",
+			generatorName: "T",
+			expectError:   true,
+		},
+		{
+			name:          "Invalid name - too long",
+			generatorName: "T55",
+			expectError:   true,
+		},
+		{
+			name:          "Invalid name - non-digit second character",
+			generatorName: "TX",
+			expectError:   true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc // capture range variable
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			tg := TagJunkPacketGenerator{name: tc.generatorName}
+			index, err := tg.nameIndex()
+
+			if tc.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tc.expectedIndex, index)
+			}
+		})
+	}
+}

device/awg/tag_junk_packet_generators.go

@@ -0,0 +1,66 @@
+package awg
+
+import "fmt"
+
+type TagJunkPacketGenerators struct {
+	tagGenerators    []TagJunkPacketGenerator
+	length           int
+	DefaultJunkCount int // Jc
+}
+
+func (generators *TagJunkPacketGenerators) AppendGenerator(
+	generator TagJunkPacketGenerator,
+) {
+	generators.tagGenerators = append(generators.tagGenerators, generator)
+	generators.length++
+}
+
+func (generators *TagJunkPacketGenerators) IsDefined() bool {
+	return len(generators.tagGenerators) > 0
+}
+
+// validate that packets were defined consecutively
+func (generators *TagJunkPacketGenerators) Validate() error {
+	seen := make([]bool, len(generators.tagGenerators))
+	for _, generator := range generators.tagGenerators {
+		index, err := generator.nameIndex()
+		if index > len(generators.tagGenerators) {
+			return fmt.Errorf("junk packet index should be consecutive")
+		}
+		if err != nil {
+			return fmt.Errorf("name index: %w", err)
+		} else {
+			seen[index-1] = true
+		}
+	}
+
+	for _, found := range seen {
+		if !found {
+			return fmt.Errorf("junk packet index should be consecutive")
+		}
+	}
+
+	return nil
+}
+
+func (generators *TagJunkPacketGenerators) GeneratePackets() [][]byte {
+	var rv = make([][]byte, 0, generators.length+generators.DefaultJunkCount)
+
+	for i, tagGenerator := range generators.tagGenerators {
+		rv = append(rv, make([]byte, tagGenerator.packetSize))
+		copy(rv[i], tagGenerator.generatePacket())
+		PacketCounter.Inc()
+	}
+	PacketCounter.Add(uint64(generators.DefaultJunkCount))
+
+	return rv
+}
+
+func (tg *TagJunkPacketGenerators) IpcGetFields() []IpcFields {
+	rv := make([]IpcFields, 0, len(tg.tagGenerators))
+	for _, generator := range tg.tagGenerators {
+		rv = append(rv, generator.IpcGetFields())
+	}
+
+	return rv
+}

device/awg/tag_junk_packet_generators_test.go

@@ -0,0 +1,149 @@
+package awg
+
+import (
+	"testing"
+
+	"github.com/amnezia-vpn/amneziawg-go/device/awg/internal"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTagJunkGeneratorHandlerAppendGenerator(t *testing.T) {
+	tests := []struct {
+		name      string
+		generator TagJunkPacketGenerator
+	}{
+		{
+			name:      "append single generator",
+			generator: newTagJunkPacketGenerator("t1", "", 10),
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			generators := &TagJunkPacketGenerators{}
+
+			// Initial length should be 0
+			require.Equal(t, 0, generators.length)
+			require.Empty(t, generators.tagGenerators)
+
+			// After append, length should be 1 and generator should be added
+			generators.AppendGenerator(tt.generator)
+			require.Equal(t, 1, generators.length)
+			require.Len(t, generators.tagGenerators, 1)
+			require.Equal(t, tt.generator, generators.tagGenerators[0])
+		})
+	}
+}
+
+func TestTagJunkGeneratorHandlerValidate(t *testing.T) {
+	tests := []struct {
+		name       string
+		generators []TagJunkPacketGenerator
+		wantErr    bool
+		errMsg     string
+	}{
+		{
+			name: "bad start",
+			generators: []TagJunkPacketGenerator{
+				newTagJunkPacketGenerator("t3", "", 10),
+				newTagJunkPacketGenerator("t4", "", 10),
+			},
+			wantErr: true,
+			errMsg:  "junk packet index should be consecutive",
+		},
+		{
+			name: "non-consecutive indices",
+			generators: []TagJunkPacketGenerator{
+				newTagJunkPacketGenerator("t1", "", 10),
+				newTagJunkPacketGenerator("t3", "", 10), // Missing t2
+			},
+			wantErr: true,
+			errMsg:  "junk packet index should be consecutive",
+		},
+		{
+			name: "consecutive indices",
+			generators: []TagJunkPacketGenerator{
+				newTagJunkPacketGenerator("t1", "", 10),
+				newTagJunkPacketGenerator("t2", "", 10),
+				newTagJunkPacketGenerator("t3", "", 10),
+				newTagJunkPacketGenerator("t4", "", 10),
+				newTagJunkPacketGenerator("t5", "", 10),
+			},
+		},
+		{
+			name: "nameIndex error",
+			generators: []TagJunkPacketGenerator{
+				newTagJunkPacketGenerator("error", "", 10),
+			},
+			wantErr: true,
+			errMsg:  "name must be 2 character long",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			generators := &TagJunkPacketGenerators{}
+			for _, gen := range tt.generators {
+				generators.AppendGenerator(gen)
+			}
+
+			err := generators.Validate()
+			if tt.wantErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.errMsg)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestTagJunkGeneratorHandlerGenerate(t *testing.T) {
+	mockByte1 := []byte{0x01, 0x02}
+	mockByte2 := []byte{0x03, 0x04, 0x05}
+	mockGen1 := internal.NewMockByteGenerator(mockByte1)
+	mockGen2 := internal.NewMockByteGenerator(mockByte2)
+
+	tests := []struct {
+		name           string
+		setupGenerator func() []TagJunkPacketGenerator
+		expected       [][]byte
+	}{
+		{
+			name: "generate with no default junk",
+			setupGenerator: func() []TagJunkPacketGenerator {
+				tg1 := newTagJunkPacketGenerator("t1", "", 0)
+				tg1.append(mockGen1)
+				tg1.append(mockGen2)
+				tg2 := newTagJunkPacketGenerator("t2", "", 0)
+				tg2.append(mockGen2)
+				tg2.append(mockGen1)
+
+				return []TagJunkPacketGenerator{tg1, tg2}
+			},
+			expected: [][]byte{
+				append(mockByte1, mockByte2...),
+				append(mockByte2, mockByte1...),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			generators := &TagJunkPacketGenerators{}
+			tagGenerators := tt.setupGenerator()
+			for _, gen := range tagGenerators {
+				generators.AppendGenerator(gen)
+			}
+
+			result := generators.GeneratePackets()
+			require.Equal(t, result, tt.expected)
+		})
+	}
+}

device/awg/tag_parser.go

@@ -0,0 +1,112 @@
+package awg
+
+import (
+	"fmt"
+	"maps"
+	"regexp"
+	"strings"
+)
+
+type IpcFields struct{ Key, Value string }
+
+type EnumTag string
+
+const (
+	BytesEnumTag        EnumTag = "b"
+	CounterEnumTag      EnumTag = "c"
+	TimestampEnumTag    EnumTag = "t"
+	RandomBytesEnumTag  EnumTag = "r"
+	WaitTimeoutEnumTag  EnumTag = "wt"
+	WaitResponseEnumTag EnumTag = "wr"
+)
+
+var generatorCreator = map[EnumTag]newGenerator{
+	BytesEnumTag:       newBytesGenerator,
+	CounterEnumTag:     newPacketCounterGenerator,
+	TimestampEnumTag:   newTimestampGenerator,
+	RandomBytesEnumTag: newRandomPacketGenerator,
+	WaitTimeoutEnumTag: newWaitTimeoutGenerator,
+	// WaitResponseEnumTag: newWaitResponseGenerator,
+}
+
+// helper map to determine enumTags are unique
+var uniqueTags = map[EnumTag]bool{
+	CounterEnumTag:   false,
+	TimestampEnumTag: false,
+}
+
+type Tag struct {
+	Name  EnumTag
+	Param string
+}
+
+func parseTag(input string) (Tag, error) {
+	// Regular expression to match <tagname optional_param>
+	re := regexp.MustCompile(`([a-zA-Z]+)(?:\s+([^>]+))?>`)
+
+	match := re.FindStringSubmatch(input)
+	tag := Tag{
+		Name: EnumTag(match[1]),
+	}
+	if len(match) > 2 && match[2] != "" {
+		tag.Param = strings.TrimSpace(match[2])
+	}
+
+	return tag, nil
+}
+
+func Parse(name, input string) (TagJunkPacketGenerator, error) {
+	inputSlice := strings.Split(input, "<")
+	if len(inputSlice) <= 1 {
+		return TagJunkPacketGenerator{}, fmt.Errorf("empty input: %s", input)
+	}
+
+	uniqueTagCheck := make(map[EnumTag]bool, len(uniqueTags))
+	maps.Copy(uniqueTagCheck, uniqueTags)
+
+	// skip byproduct of split
+	inputSlice = inputSlice[1:]
+	rv := newTagJunkPacketGenerator(name, input, len(inputSlice))
+	for _, inputParam := range inputSlice {
+		if len(inputParam) <= 1 {
+			return TagJunkPacketGenerator{}, fmt.Errorf(
+				"empty tag in input: %s",
+				inputSlice,
+			)
+		} else if strings.Count(inputParam, ">") != 1 {
+			return TagJunkPacketGenerator{}, fmt.Errorf("ill formated input: %s", input)
+		}
+
+		tag, _ := parseTag(inputParam)
+		creator, ok := generatorCreator[tag.Name]
+		if !ok {
+			return TagJunkPacketGenerator{}, fmt.Errorf("invalid tag: %s", tag.Name)
+		}
+		if present, ok := uniqueTagCheck[tag.Name]; ok {
+			if present {
+				return TagJunkPacketGenerator{}, fmt.Errorf(
+					"tag %s needs to be unique",
+					tag.Name,
+				)
+			}
+			uniqueTagCheck[tag.Name] = true
+		}
+		generator, err := creator(tag.Param)
+		if err != nil {
+			return TagJunkPacketGenerator{}, fmt.Errorf("gen: %w", err)
+		}
+
+		// TODO: handle counter tag
+		// if tag.Name == CounterEnumTag {
+		// 	packetCounter, ok := generator.(*PacketCounterGenerator)
+		// 	if !ok {
+		// 		log.Fatalf("packet counter generator expected, got %T", generator)
+		// 	}
+		// 	PacketCounter = packetCounter.counter
+		// }
+
+		rv.append(generator)
+	}
+
+	return rv, nil
+}

device/awg/tag_parser_test.go

@@ -0,0 +1,77 @@
+package awg
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParse(t *testing.T) {
+	type args struct {
+		name  string
+		input string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr error
+	}{
+		{
+			name:    "invalid name",
+			args:    args{name: "apple", input: ""},
+			wantErr: fmt.Errorf("ill formated input"),
+		},
+		{
+			name:    "empty",
+			args:    args{name: "i1", input: ""},
+			wantErr: fmt.Errorf("ill formated input"),
+		},
+		{
+			name:    "extra >",
+			args:    args{name: "i1", input: "<b 0xf6ab3267fa><c>>"},
+			wantErr: fmt.Errorf("ill formated input"),
+		},
+		{
+			name:    "extra <",
+			args:    args{name: "i1", input: "<<b 0xf6ab3267fa><c>"},
+			wantErr: fmt.Errorf("empty tag in input"),
+		},
+		{
+			name:    "empty <>",
+			args:    args{name: "i1", input: "<><b 0xf6ab3267fa><c>"},
+			wantErr: fmt.Errorf("empty tag in input"),
+		},
+		{
+			name:    "invalid tag",
+			args:    args{name: "i1", input: "<q 0xf6ab3267fa>"},
+			wantErr: fmt.Errorf("invalid tag"),
+		},
+		{
+			name:    "counter uniqueness violation",
+			args:    args{name: "i1", input: "<c><c>"},
+			wantErr: fmt.Errorf("parse tag needs to be unique"),
+		},
+		{
+			name:    "timestamp uniqueness violation",
+			args:    args{name: "i1", input: "<t><t>"},
+			wantErr: fmt.Errorf("parse tag needs to be unique"),
+		},
+		{
+			name: "valid",
+			args: args{input: "<b 0xf6ab3267fa><c><b 0xf6ab><t><r 10><wt 10>"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := Parse(tt.args.name, tt.args.input)
+
+			// TODO:  ErrorAs doesn't work as you think
+			if tt.wantErr != nil {
+				require.ErrorAs(t, err, &tt.wantErr)
+				return
+			}
+			require.Nil(t, err)
+		})
+	}
+}