feat: awg4

* feat: ranged H1-H4
* feat: S3, S4 support
* chore: updated awg-tools version

---------

Co-authored-by: Yaroslav Gurov <ygurov@proton.me>

Dockerfile

@@ -6,7 +6,7 @@ RUN go mod download && \
     go build -ldflags '-linkmode external -extldflags "-fno-PIC -static"' -v -o /usr/bin
 
 FROM alpine:3.19
-ARG AWGTOOLS_RELEASE="1.0.20241018"
+ARG AWGTOOLS_RELEASE="1.0.20250901"
 
 RUN apk --no-cache add iproute2 iptables bash && \
     cd /usr/bin/ && \

device/awg/awg.go

@@ -1,144 +0,0 @@
-package awg
-
-import (
-	"bytes"
-	"fmt"
-	"slices"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/tevino/abool"
-)
-
-type aSecCfgType struct {
-	IsSet                      bool
-	JunkPacketCount            int
-	JunkPacketMinSize          int
-	JunkPacketMaxSize          int
-	InitHeaderJunkSize         int
-	ResponseHeaderJunkSize     int
-	CookieReplyHeaderJunkSize  int
-	TransportHeaderJunkSize    int
-	InitPacketMagicHeader      uint32
-	ResponsePacketMagicHeader  uint32
-	UnderloadPacketMagicHeader uint32
-	TransportPacketMagicHeader uint32
-	// InitPacketMagicHeader      Limit
-	// ResponsePacketMagicHeader  Limit
-	// UnderloadPacketMagicHeader Limit
-	// TransportPacketMagicHeader Limit
-}
-
-type Limit struct {
-	Min        uint32
-	Max        uint32
-	HeaderType uint32
-}
-
-func NewLimit(min, max, headerType uint32) (Limit, error) {
-	if min > max {
-		return Limit{}, fmt.Errorf("min (%d) cannot be greater than max (%d)", min, max)
-	}
-
-	return Limit{
-		Min:        min,
-		Max:        max,
-		HeaderType: headerType,
-	}, nil
-}
-
-func ParseMagicHeader(key, value string, defaultHeaderType uint32) (Limit, error) {
-	// tempAwg.ASecCfg.InitPacketMagicHeader, err = awg.NewLimit(uint32(initPacketMagicHeaderMin), uint32(initPacketMagicHeaderMax), DNewLimit(min, max, headerType)efaultMessageInitiationType)
-	// var min, max, headerType uint32
-	// _, err := fmt.Sscanf(value, "%d-%d:%d", &min, &max, &headerType)
-	// if err != nil {
-	// 	return Limit{}, fmt.Errorf("invalid magic header format: %s", value)
-	// }
-
-	limits := strings.Split(value, "-")
-	if len(limits) != 2 {
-		return Limit{}, fmt.Errorf("invalid format for key: %s; %s", key, value)
-	}
-
-	min, err := strconv.ParseUint(limits[0], 10, 32)
-	if err != nil {
-		return Limit{}, fmt.Errorf("parse min key: %s; value: ; %w", key, limits[0], err)
-	}
-
-	max, err := strconv.ParseUint(limits[1], 10, 32)
-	if err != nil {
-		return Limit{}, fmt.Errorf("parse max key: %s; value: ; %w", key, limits[0], err)
-	}
-
-	limit, err := NewLimit(uint32(min), uint32(max), defaultHeaderType)
-	if err != nil {
-		return Limit{}, fmt.Errorf("new lmit key: %s; value: ; %w", key, limits[0], err)
-	}
-
-	return limit, nil
-}
-
-type Limits []Limit
-
-func NewLimits(limits []Limit) Limits {
-	slices.SortFunc(limits, func(a, b Limit) int {
-		if a.Min < b.Min {
-			return -1
-		} else if a.Min > b.Min {
-			return 1
-		}
-		return 0
-	})
-
-	return Limits(limits)
-}
-
-type Protocol struct {
-	IsASecOn abool.AtomicBool
-	// TODO: revision the need of the mutex
-	ASecMux     sync.RWMutex
-	ASecCfg     aSecCfgType
-	JunkCreator junkCreator
-
-	HandshakeHandler SpecialHandshakeHandler
-}
-
-func (protocol *Protocol) CreateInitHeaderJunk() ([]byte, error) {
-	return protocol.createHeaderJunk(protocol.ASecCfg.InitHeaderJunkSize)
-}
-
-func (protocol *Protocol) CreateResponseHeaderJunk() ([]byte, error) {
-	return protocol.createHeaderJunk(protocol.ASecCfg.ResponseHeaderJunkSize)
-}
-
-func (protocol *Protocol) CreateCookieReplyHeaderJunk() ([]byte, error) {
-	return protocol.createHeaderJunk(protocol.ASecCfg.CookieReplyHeaderJunkSize)
-}
-
-func (protocol *Protocol) CreateTransportHeaderJunk(packetSize int) ([]byte, error) {
-	return protocol.createHeaderJunk(protocol.ASecCfg.TransportHeaderJunkSize, packetSize)
-}
-
-func (protocol *Protocol) createHeaderJunk(junkSize int, optExtraSize ...int) ([]byte, error) {
-	extraSize := 0
-	if len(optExtraSize) == 1 {
-		extraSize = optExtraSize[0]
-	}
-
-	var junk []byte
-	protocol.ASecMux.RLock()
-	if junkSize != 0 {
-		buf := make([]byte, 0, junkSize+extraSize)
-		writer := bytes.NewBuffer(buf[:0])
-		err := protocol.JunkCreator.AppendJunk(writer, junkSize)
-		if err != nil {
-			protocol.ASecMux.RUnlock()
-			return nil, err
-		}
-		junk = writer.Bytes()
-	}
-	protocol.ASecMux.RUnlock()
-
-	return junk, nil
-}

device/awg/internal/mock.go

@@ -1,37 +0,0 @@
-package internal
-
-type mockGenerator struct {
-	size int
-}
-
-func NewMockGenerator(size int) mockGenerator {
-	return mockGenerator{size: size}
-}
-
-func (m mockGenerator) Generate() []byte {
-	return make([]byte, m.size)
-}
-
-func (m mockGenerator) Size() int {
-	return m.size
-}
-
-func (m mockGenerator) Name() string {
-	return "mock"
-}
-
-type mockByteGenerator struct {
-	data []byte
-}
-
-func NewMockByteGenerator(data []byte) mockByteGenerator {
-	return mockByteGenerator{data: data}
-}
-
-func (bg mockByteGenerator) Generate() []byte {
-	return bg.data
-}
-
-func (bg mockByteGenerator) Size() int {
-	return len(bg.data)
-}

device/awg/junk_creator.go

@@ -1,70 +0,0 @@
-package awg
-
-import (
-	"bytes"
-	crand "crypto/rand"
-	"fmt"
-	v2 "math/rand/v2"
-)
-
-type junkCreator struct {
-	aSecCfg  aSecCfgType
-	cha8Rand *v2.ChaCha8
-}
-
-// TODO: refactor param to only pass the junk related params
-func NewJunkCreator(aSecCfg aSecCfgType) (junkCreator, error) {
-	buf := make([]byte, 32)
-	_, err := crand.Read(buf)
-	if err != nil {
-		return junkCreator{}, err
-	}
-	return junkCreator{aSecCfg: aSecCfg, cha8Rand: v2.NewChaCha8([32]byte(buf))}, nil
-}
-
-// Should be called with aSecMux RLocked
-func (jc *junkCreator) CreateJunkPackets(junks *[][]byte) error {
-	if jc.aSecCfg.JunkPacketCount == 0 {
-		return nil
-	}
-
-	for range jc.aSecCfg.JunkPacketCount {
-		packetSize := jc.randomPacketSize()
-		junk, err := jc.randomJunkWithSize(packetSize)
-		if err != nil {
-			return fmt.Errorf("create junk packet: %v", err)
-		}
-		*junks = append(*junks, junk)
-	}
-	return nil
-}
-
-// Should be called with aSecMux RLocked
-func (jc *junkCreator) randomPacketSize() int {
-	return int(
-		jc.cha8Rand.Uint64()%uint64(
-			jc.aSecCfg.JunkPacketMaxSize-jc.aSecCfg.JunkPacketMinSize,
-		),
-	) + jc.aSecCfg.JunkPacketMinSize
-}
-
-// Should be called with aSecMux RLocked
-func (jc *junkCreator) AppendJunk(writer *bytes.Buffer, size int) error {
-	headerJunk, err := jc.randomJunkWithSize(size)
-	if err != nil {
-		return fmt.Errorf("create header junk: %v", err)
-	}
-	_, err = writer.Write(headerJunk)
-	if err != nil {
-		return fmt.Errorf("write header junk: %v", err)
-	}
-	return nil
-}
-
-// Should be called with aSecMux RLocked
-func (jc *junkCreator) randomJunkWithSize(size int) ([]byte, error) {
-	// TODO: use a memory pool to allocate
-	junk := make([]byte, size)
-	_, err := jc.cha8Rand.Read(junk)
-	return junk, err
-}

device/awg/junk_creator_test.go

@@ -1,115 +0,0 @@
-package awg
-
-import (
-	"bytes"
-	"fmt"
-	"testing"
-)
-
-func setUpJunkCreator(t *testing.T) (junkCreator, error) {
-	jc, err := NewJunkCreator(aSecCfgType{
-		IsSet:                      true,
-		JunkPacketCount:            5,
-		JunkPacketMinSize:          500,
-		JunkPacketMaxSize:          1000,
-		InitHeaderJunkSize:         30,
-		ResponseHeaderJunkSize:     40,
-		InitPacketMagicHeader:      123456,
-		ResponsePacketMagicHeader:  67543,
-		UnderloadPacketMagicHeader: 32345,
-		TransportPacketMagicHeader: 123123,
-	})
-
-	if err != nil {
-		t.Errorf("failed to create junk creator %v", err)
-		return junkCreator{}, err
-	}
-
-	return jc, nil
-}
-
-func Test_junkCreator_createJunkPackets(t *testing.T) {
-	jc, err := setUpJunkCreator(t)
-	if err != nil {
-		return
-	}
-	t.Run("valid", func(t *testing.T) {
-		got := make([][]byte, 0, jc.aSecCfg.JunkPacketCount)
-		err := jc.CreateJunkPackets(&got)
-		if err != nil {
-			t.Errorf(
-				"junkCreator.createJunkPackets() = %v; failed",
-				err,
-			)
-			return
-		}
-		seen := make(map[string]bool)
-		for _, junk := range got {
-			key := string(junk)
-			if seen[key] {
-				t.Errorf(
-					"junkCreator.createJunkPackets() = %v, duplicate key: %v",
-					got,
-					junk,
-				)
-				return
-			}
-			seen[key] = true
-		}
-	})
-}
-
-func Test_junkCreator_randomJunkWithSize(t *testing.T) {
-	t.Run("valid", func(t *testing.T) {
-		jc, err := setUpJunkCreator(t)
-		if err != nil {
-			return
-		}
-		r1, _ := jc.randomJunkWithSize(10)
-		r2, _ := jc.randomJunkWithSize(10)
-		fmt.Printf("%v\n%v\n", r1, r2)
-		if bytes.Equal(r1, r2) {
-			t.Errorf("same junks %v", err)
-			return
-		}
-	})
-}
-
-func Test_junkCreator_randomPacketSize(t *testing.T) {
-	jc, err := setUpJunkCreator(t)
-	if err != nil {
-		return
-	}
-	for range [30]struct{}{} {
-		t.Run("valid", func(t *testing.T) {
-			if got := jc.randomPacketSize(); jc.aSecCfg.JunkPacketMinSize > got ||
-				got > jc.aSecCfg.JunkPacketMaxSize {
-				t.Errorf(
-					"junkCreator.randomPacketSize() = %v, not between range [%v,%v]",
-					got,
-					jc.aSecCfg.JunkPacketMinSize,
-					jc.aSecCfg.JunkPacketMaxSize,
-				)
-			}
-		})
-	}
-}
-
-func Test_junkCreator_appendJunk(t *testing.T) {
-	jc, err := setUpJunkCreator(t)
-	if err != nil {
-		return
-	}
-	t.Run("valid", func(t *testing.T) {
-		s := "apple"
-		buffer := bytes.NewBuffer([]byte(s))
-		err := jc.AppendJunk(buffer, 30)
-		if err != nil &&
-			buffer.Len() != len(s)+30 {
-			t.Error("appendWithJunk() size don't match")
-		}
-		read := make([]byte, 50)
-		buffer.Read(read)
-		fmt.Println(string(read))
-	})
-}

device/awg/special_handshake_handler.go

@@ -1,73 +0,0 @@
-package awg
-
-import (
-	"errors"
-	"time"
-
-	"github.com/tevino/abool"
-	"go.uber.org/atomic"
-)
-
-// TODO: atomic?/ and better way to use this
-var PacketCounter *atomic.Uint64 = atomic.NewUint64(0)
-
-// TODO
-var WaitResponse = struct {
-	Channel    chan struct{}
-	ShouldWait *abool.AtomicBool
-}{
-	make(chan struct{}, 1),
-	abool.New(),
-}
-
-type SpecialHandshakeHandler struct {
-	isFirstDone    bool
-	SpecialJunk    TagJunkPacketGenerators
-	ControlledJunk TagJunkPacketGenerators
-
-	nextItime time.Time
-	ITimeout  time.Duration // seconds
-
-	IsSet bool
-}
-
-func (handler *SpecialHandshakeHandler) Validate() error {
-	var errs []error
-	if err := handler.SpecialJunk.Validate(); err != nil {
-		errs = append(errs, err)
-	}
-	if err := handler.ControlledJunk.Validate(); err != nil {
-		errs = append(errs, err)
-	}
-	return errors.Join(errs...)
-}
-
-func (handler *SpecialHandshakeHandler) GenerateSpecialJunk() [][]byte {
-	if !handler.SpecialJunk.IsDefined() {
-		return nil
-	}
-
-	// TODO: create tests
-	if !handler.isFirstDone {
-		handler.isFirstDone = true
-	} else if !handler.isTimeToSendSpecial() {
-		return nil
-	}
-
-	rv := handler.SpecialJunk.GeneratePackets()
-	handler.nextItime = time.Now().Add(handler.ITimeout)
-
-	return rv
-}
-
-func (handler *SpecialHandshakeHandler) isTimeToSendSpecial() bool {
-	return time.Now().After(handler.nextItime)
-}
-
-func (handler *SpecialHandshakeHandler) GenerateControlledJunk() [][]byte {
-	if !handler.ControlledJunk.IsDefined() {
-		return nil
-	}
-
-	return handler.ControlledJunk.GeneratePackets()
-}

device/awg/tag_generator.go

@@ -1,190 +0,0 @@
-package awg
-
-import (
-	crand "crypto/rand"
-	"encoding/binary"
-	"encoding/hex"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	v2 "math/rand/v2"
-	// "go.uber.org/atomic"
-)
-
-type Generator interface {
-	Generate() []byte
-	Size() int
-}
-
-type newGenerator func(string) (Generator, error)
-
-type BytesGenerator struct {
-	value []byte
-	size  int
-}
-
-func (bg *BytesGenerator) Generate() []byte {
-	return bg.value
-}
-
-func (bg *BytesGenerator) Size() int {
-	return bg.size
-}
-
-func newBytesGenerator(param string) (Generator, error) {
-	hasPrefix := strings.HasPrefix(param, "0x") || strings.HasPrefix(param, "0X")
-	if !hasPrefix {
-		return nil, fmt.Errorf("not correct hex: %s", param)
-	}
-
-	hex, err := hexToBytes(param)
-	if err != nil {
-		return nil, fmt.Errorf("hexToBytes: %w", err)
-	}
-
-	return &BytesGenerator{value: hex, size: len(hex)}, nil
-}
-
-func hexToBytes(hexStr string) ([]byte, error) {
-	hexStr = strings.TrimPrefix(hexStr, "0x")
-	hexStr = strings.TrimPrefix(hexStr, "0X")
-
-	// Ensure even length (pad with leading zero if needed)
-	if len(hexStr)%2 != 0 {
-		hexStr = "0" + hexStr
-	}
-
-	return hex.DecodeString(hexStr)
-}
-
-type RandomPacketGenerator struct {
-	cha8Rand *v2.ChaCha8
-	size     int
-}
-
-func (rpg *RandomPacketGenerator) Generate() []byte {
-	junk := make([]byte, rpg.size)
-	rpg.cha8Rand.Read(junk)
-	return junk
-}
-
-func (rpg *RandomPacketGenerator) Size() int {
-	return rpg.size
-}
-
-func newRandomPacketGenerator(param string) (Generator, error) {
-	size, err := strconv.Atoi(param)
-	if err != nil {
-		return nil, fmt.Errorf("random packet parse int: %w", err)
-	}
-
-	if size > 1000 {
-		return nil, fmt.Errorf("random packet size must be less than 1000")
-	}
-
-	buf := make([]byte, 32)
-	_, err = crand.Read(buf)
-	if err != nil {
-		return nil, fmt.Errorf("random packet crand read: %w", err)
-	}
-
-	return &RandomPacketGenerator{
-		cha8Rand: v2.NewChaCha8([32]byte(buf)),
-		size:     size,
-	}, nil
-}
-
-type TimestampGenerator struct {
-}
-
-func (tg *TimestampGenerator) Generate() []byte {
-	buf := make([]byte, 8)
-	binary.BigEndian.PutUint64(buf, uint64(time.Now().Unix()))
-	return buf
-}
-
-func (tg *TimestampGenerator) Size() int {
-	return 8
-}
-
-func newTimestampGenerator(param string) (Generator, error) {
-	if len(param) != 0 {
-		return nil, fmt.Errorf("timestamp param needs to be empty: %s", param)
-	}
-
-	return &TimestampGenerator{}, nil
-}
-
-type WaitTimeoutGenerator struct {
-	waitTimeout time.Duration
-}
-
-func (wtg *WaitTimeoutGenerator) Generate() []byte {
-	time.Sleep(wtg.waitTimeout)
-	return []byte{}
-}
-
-func (wtg *WaitTimeoutGenerator) Size() int {
-	return 0
-}
-
-func newWaitTimeoutGenerator(param string) (Generator, error) {
-	timeout, err := strconv.Atoi(param)
-	if err != nil {
-		return nil, fmt.Errorf("timeout parse int: %w", err)
-	}
-
-	if timeout > 5000 {
-		return nil, fmt.Errorf("timeout must be less than 5000ms")
-	}
-
-	return &WaitTimeoutGenerator{
-		waitTimeout: time.Duration(timeout) * time.Millisecond,
-	}, nil
-}
-
-type PacketCounterGenerator struct {
-}
-
-func (c *PacketCounterGenerator) Generate() []byte {
-	buf := make([]byte, 8)
-	// TODO: better way to handle counter tag
-	binary.BigEndian.PutUint64(buf, PacketCounter.Load())
-	return buf
-}
-
-func (c *PacketCounterGenerator) Size() int {
-	return 8
-}
-
-func newPacketCounterGenerator(param string) (Generator, error) {
-	if len(param) != 0 {
-		return nil, fmt.Errorf("packet counter param needs to be empty: %s", param)
-	}
-
-	return &PacketCounterGenerator{}, nil
-}
-
-type WaitResponseGenerator struct {
-}
-
-func (c *WaitResponseGenerator) Generate() []byte {
-	WaitResponse.ShouldWait.Set()
-	<-WaitResponse.Channel
-	WaitResponse.ShouldWait.UnSet()
-	return []byte{}
-}
-
-func (c *WaitResponseGenerator) Size() int {
-	return 0
-}
-
-func newWaitResponseGenerator(param string) (Generator, error) {
-	if len(param) != 0 {
-		return nil, fmt.Errorf("wait response param needs to be empty: %s", param)
-	}
-
-	return &WaitResponseGenerator{}, nil
-}

device/awg/tag_generator_test.go

@@ -1,189 +0,0 @@
-package awg
-
-import (
-	"encoding/binary"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func Test_newBytesGenerator(t *testing.T) {
-	type args struct {
-		param string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    []byte
-		wantErr error
-	}{
-		{
-			name: "empty",
-			args: args{
-				param: "",
-			},
-			wantErr: fmt.Errorf("not correct hex"),
-		},
-		{
-			name: "wrong start",
-			args: args{
-				param: "123456",
-			},
-			wantErr: fmt.Errorf("not correct hex"),
-		},
-		{
-			name: "not only hex value with X",
-			args: args{
-				param: "0X12345q",
-			},
-			wantErr: fmt.Errorf("not correct hex"),
-		},
-		{
-			name: "not only hex value with x",
-			args: args{
-				param: "0x12345q",
-			},
-			wantErr: fmt.Errorf("not correct hex"),
-		},
-		{
-			name: "valid hex",
-			args: args{
-				param: "0xf6ab3267fa",
-			},
-			want: []byte{0xf6, 0xab, 0x32, 0x67, 0xfa},
-		},
-		{
-			name: "valid hex with odd length",
-			args: args{
-				param: "0xfab3267fa",
-			},
-			want: []byte{0xf, 0xab, 0x32, 0x67, 0xfa},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := newBytesGenerator(tt.args.param)
-
-			if tt.wantErr != nil {
-				require.ErrorAs(t, err, &tt.wantErr)
-				require.Nil(t, got)
-				return
-			}
-
-			require.Nil(t, err)
-			require.NotNil(t, got)
-
-			gotValues := got.Generate()
-			require.Equal(t, tt.want, gotValues)
-		})
-	}
-}
-
-func Test_newRandomPacketGenerator(t *testing.T) {
-	type args struct {
-		param string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		wantErr error
-	}{
-		{
-			name: "empty",
-			args: args{
-				param: "",
-			},
-			wantErr: fmt.Errorf("parse int"),
-		},
-		{
-			name: "not an int",
-			args: args{
-				param: "x",
-			},
-			wantErr: fmt.Errorf("parse int"),
-		},
-		{
-			name: "too large",
-			args: args{
-				param: "1001",
-			},
-			wantErr: fmt.Errorf("random packet size must be less than 1000"),
-		},
-		{
-			name: "valid",
-			args: args{
-				param: "12",
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := newRandomPacketGenerator(tt.args.param)
-			if tt.wantErr != nil {
-				require.ErrorAs(t, err, &tt.wantErr)
-				require.Nil(t, got)
-				return
-			}
-
-			require.Nil(t, err)
-			require.NotNil(t, got)
-			first := got.Generate()
-
-			second := got.Generate()
-			require.NotEqual(t, first, second)
-		})
-	}
-}
-
-func TestPacketCounterGenerator(t *testing.T) {
-	tests := []struct {
-		name    string
-		param   string
-		wantErr bool
-	}{
-		{
-			name:    "Valid empty param",
-			param:   "",
-			wantErr: false,
-		},
-		{
-			name:    "Invalid non-empty param",
-			param:   "anything",
-			wantErr: true,
-		},
-	}
-
-	for _, tc := range tests {
-		tc := tc // capture range variable
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			gen, err := newPacketCounterGenerator(tc.param)
-			if tc.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			require.Equal(t, 8, gen.Size())
-
-			// Reset counter to known value for test
-			initialCount := uint64(42)
-			PacketCounter.Store(initialCount)
-
-			output := gen.Generate()
-			require.Equal(t, 8, len(output))
-
-			// Verify counter value in output
-			counterValue := binary.BigEndian.Uint64(output)
-			require.Equal(t, initialCount, counterValue)
-
-			// Increment counter and verify change
-			PacketCounter.Add(1)
-			output = gen.Generate()
-			counterValue = binary.BigEndian.Uint64(output)
-			require.Equal(t, initialCount+1, counterValue)
-		})
-	}
-}

device/awg/tag_junk_packet_generator.go

@@ -1,59 +0,0 @@
-package awg
-
-import (
-	"fmt"
-	"strconv"
-)
-
-type TagJunkPacketGenerator struct {
-	name     string
-	tagValue string
-
-	packetSize int
-	generators []Generator
-}
-
-func newTagJunkPacketGenerator(name, tagValue string, size int) TagJunkPacketGenerator {
-	return TagJunkPacketGenerator{
-		name:       name,
-		tagValue:   tagValue,
-		generators: make([]Generator, 0, size),
-	}
-}
-
-func (tg *TagJunkPacketGenerator) append(generator Generator) {
-	tg.generators = append(tg.generators, generator)
-	tg.packetSize += generator.Size()
-}
-
-func (tg *TagJunkPacketGenerator) generatePacket() []byte {
-	packet := make([]byte, 0, tg.packetSize)
-	for _, generator := range tg.generators {
-		packet = append(packet, generator.Generate()...)
-	}
-
-	return packet
-}
-
-func (tg *TagJunkPacketGenerator) Name() string {
-	return tg.name
-}
-
-func (tg *TagJunkPacketGenerator) nameIndex() (int, error) {
-	if len(tg.name) != 2 {
-		return 0, fmt.Errorf("name must be 2 character long: %s", tg.name)
-	}
-
-	index, err := strconv.Atoi(tg.name[1:2])
-	if err != nil {
-		return 0, fmt.Errorf("name 2 char should be an int %w", err)
-	}
-	return index, nil
-}
-
-func (tg *TagJunkPacketGenerator) IpcGetFields() IpcFields {
-	return IpcFields{
-		Key:   tg.name,
-		Value: tg.tagValue,
-	}
-}

device/awg/tag_junk_packet_generator_test.go

@@ -1,210 +0,0 @@
-package awg
-
-import (
-	"testing"
-
-	"github.com/amnezia-vpn/amneziawg-go/device/awg/internal"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewTagJunkGenerator(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name     string
-		genName  string
-		size     int
-		expected TagJunkPacketGenerator
-	}{
-		{
-			name:    "Create new generator with empty name",
-			genName: "",
-			size:    0,
-			expected: TagJunkPacketGenerator{
-				name:       "",
-				packetSize: 0,
-				generators: make([]Generator, 0),
-			},
-		},
-		{
-			name:    "Create new generator with valid name",
-			genName: "T1",
-			size:    0,
-			expected: TagJunkPacketGenerator{
-				name:       "T1",
-				packetSize: 0,
-				generators: make([]Generator, 0),
-			},
-		},
-		{
-			name:    "Create new generator with non-zero size",
-			genName: "T2",
-			size:    5,
-			expected: TagJunkPacketGenerator{
-				name:       "T2",
-				packetSize: 0,
-				generators: make([]Generator, 5),
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc // capture range variable
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			result := newTagJunkPacketGenerator(tc.genName, "", tc.size)
-			require.Equal(t, tc.expected.name, result.name)
-			require.Equal(t, tc.expected.packetSize, result.packetSize)
-			require.Equal(t, cap(result.generators), len(tc.expected.generators))
-		})
-	}
-}
-
-func TestTagJunkGeneratorAppend(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name           string
-		initialState   TagJunkPacketGenerator
-		mockSize       int
-		expectedLength int
-		expectedSize   int
-	}{
-		{
-			name:           "Append to empty generator",
-			initialState:   newTagJunkPacketGenerator("T1", "", 0),
-			mockSize:       5,
-			expectedLength: 1,
-			expectedSize:   5,
-		},
-		{
-			name: "Append to non-empty generator",
-			initialState: TagJunkPacketGenerator{
-				name:       "T2",
-				packetSize: 10,
-				generators: make([]Generator, 2),
-			},
-			mockSize:       7,
-			expectedLength: 3,  // 2 existing + 1 new
-			expectedSize:   17, // 10 + 7
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc // capture range variable
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			tg := tc.initialState
-			mockGen := internal.NewMockGenerator(tc.mockSize)
-
-			tg.append(mockGen)
-
-			require.Equal(t, tc.expectedLength, len(tg.generators))
-			require.Equal(t, tc.expectedSize, tg.packetSize)
-		})
-	}
-}
-
-func TestTagJunkGeneratorGenerate(t *testing.T) {
-	t.Parallel()
-
-	// Create mock generators for testing
-	mockGen1 := internal.NewMockByteGenerator([]byte{0x01, 0x02})
-	mockGen2 := internal.NewMockByteGenerator([]byte{0x03, 0x04, 0x05})
-
-	testCases := []struct {
-		name           string
-		setupGenerator func() TagJunkPacketGenerator
-		expected       []byte
-	}{
-		{
-			name: "Generate with empty generators",
-			setupGenerator: func() TagJunkPacketGenerator {
-				return newTagJunkPacketGenerator("T1", "", 0)
-			},
-			expected: []byte{},
-		},
-		{
-			name: "Generate with single generator",
-			setupGenerator: func() TagJunkPacketGenerator {
-				tg := newTagJunkPacketGenerator("T2", "", 0)
-				tg.append(mockGen1)
-				return tg
-			},
-			expected: []byte{0x01, 0x02},
-		},
-		{
-			name: "Generate with multiple generators",
-			setupGenerator: func() TagJunkPacketGenerator {
-				tg := newTagJunkPacketGenerator("T3", "", 0)
-				tg.append(mockGen1)
-				tg.append(mockGen2)
-				return tg
-			},
-			expected: []byte{0x01, 0x02, 0x03, 0x04, 0x05},
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc // capture range variable
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			tg := tc.setupGenerator()
-			result := tg.generatePacket()
-
-			require.Equal(t, tc.expected, result)
-		})
-	}
-}
-
-func TestTagJunkGeneratorNameIndex(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name          string
-		generatorName string
-		expectedIndex int
-		expectError   bool
-	}{
-		{
-			name:          "Valid name with digit",
-			generatorName: "T5",
-			expectedIndex: 5,
-			expectError:   false,
-		},
-		{
-			name:          "Invalid name - too short",
-			generatorName: "T",
-			expectError:   true,
-		},
-		{
-			name:          "Invalid name - too long",
-			generatorName: "T55",
-			expectError:   true,
-		},
-		{
-			name:          "Invalid name - non-digit second character",
-			generatorName: "TX",
-			expectError:   true,
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc // capture range variable
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			tg := TagJunkPacketGenerator{name: tc.generatorName}
-			index, err := tg.nameIndex()
-
-			if tc.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-				require.Equal(t, tc.expectedIndex, index)
-			}
-		})
-	}
-}

device/awg/tag_junk_packet_generators.go

@@ -1,66 +0,0 @@
-package awg
-
-import "fmt"
-
-type TagJunkPacketGenerators struct {
-	tagGenerators    []TagJunkPacketGenerator
-	length           int
-	DefaultJunkCount int // Jc
-}
-
-func (generators *TagJunkPacketGenerators) AppendGenerator(
-	generator TagJunkPacketGenerator,
-) {
-	generators.tagGenerators = append(generators.tagGenerators, generator)
-	generators.length++
-}
-
-func (generators *TagJunkPacketGenerators) IsDefined() bool {
-	return len(generators.tagGenerators) > 0
-}
-
-// validate that packets were defined consecutively
-func (generators *TagJunkPacketGenerators) Validate() error {
-	seen := make([]bool, len(generators.tagGenerators))
-	for _, generator := range generators.tagGenerators {
-		index, err := generator.nameIndex()
-		if index > len(generators.tagGenerators) {
-			return fmt.Errorf("junk packet index should be consecutive")
-		}
-		if err != nil {
-			return fmt.Errorf("name index: %w", err)
-		} else {
-			seen[index-1] = true
-		}
-	}
-
-	for _, found := range seen {
-		if !found {
-			return fmt.Errorf("junk packet index should be consecutive")
-		}
-	}
-
-	return nil
-}
-
-func (generators *TagJunkPacketGenerators) GeneratePackets() [][]byte {
-	var rv = make([][]byte, 0, generators.length+generators.DefaultJunkCount)
-
-	for i, tagGenerator := range generators.tagGenerators {
-		rv = append(rv, make([]byte, tagGenerator.packetSize))
-		copy(rv[i], tagGenerator.generatePacket())
-		PacketCounter.Inc()
-	}
-	PacketCounter.Add(uint64(generators.DefaultJunkCount))
-
-	return rv
-}
-
-func (tg *TagJunkPacketGenerators) IpcGetFields() []IpcFields {
-	rv := make([]IpcFields, 0, len(tg.tagGenerators))
-	for _, generator := range tg.tagGenerators {
-		rv = append(rv, generator.IpcGetFields())
-	}
-
-	return rv
-}

device/awg/tag_junk_packet_generators_test.go

@@ -1,149 +0,0 @@
-package awg
-
-import (
-	"testing"
-
-	"github.com/amnezia-vpn/amneziawg-go/device/awg/internal"
-	"github.com/stretchr/testify/require"
-)
-
-func TestTagJunkGeneratorHandlerAppendGenerator(t *testing.T) {
-	tests := []struct {
-		name      string
-		generator TagJunkPacketGenerator
-	}{
-		{
-			name:      "append single generator",
-			generator: newTagJunkPacketGenerator("t1", "", 10),
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			generators := &TagJunkPacketGenerators{}
-
-			// Initial length should be 0
-			require.Equal(t, 0, generators.length)
-			require.Empty(t, generators.tagGenerators)
-
-			// After append, length should be 1 and generator should be added
-			generators.AppendGenerator(tt.generator)
-			require.Equal(t, 1, generators.length)
-			require.Len(t, generators.tagGenerators, 1)
-			require.Equal(t, tt.generator, generators.tagGenerators[0])
-		})
-	}
-}
-
-func TestTagJunkGeneratorHandlerValidate(t *testing.T) {
-	tests := []struct {
-		name       string
-		generators []TagJunkPacketGenerator
-		wantErr    bool
-		errMsg     string
-	}{
-		{
-			name: "bad start",
-			generators: []TagJunkPacketGenerator{
-				newTagJunkPacketGenerator("t3", "", 10),
-				newTagJunkPacketGenerator("t4", "", 10),
-			},
-			wantErr: true,
-			errMsg:  "junk packet index should be consecutive",
-		},
-		{
-			name: "non-consecutive indices",
-			generators: []TagJunkPacketGenerator{
-				newTagJunkPacketGenerator("t1", "", 10),
-				newTagJunkPacketGenerator("t3", "", 10), // Missing t2
-			},
-			wantErr: true,
-			errMsg:  "junk packet index should be consecutive",
-		},
-		{
-			name: "consecutive indices",
-			generators: []TagJunkPacketGenerator{
-				newTagJunkPacketGenerator("t1", "", 10),
-				newTagJunkPacketGenerator("t2", "", 10),
-				newTagJunkPacketGenerator("t3", "", 10),
-				newTagJunkPacketGenerator("t4", "", 10),
-				newTagJunkPacketGenerator("t5", "", 10),
-			},
-		},
-		{
-			name: "nameIndex error",
-			generators: []TagJunkPacketGenerator{
-				newTagJunkPacketGenerator("error", "", 10),
-			},
-			wantErr: true,
-			errMsg:  "name must be 2 character long",
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			generators := &TagJunkPacketGenerators{}
-			for _, gen := range tt.generators {
-				generators.AppendGenerator(gen)
-			}
-
-			err := generators.Validate()
-			if tt.wantErr {
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tt.errMsg)
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}
-
-func TestTagJunkGeneratorHandlerGenerate(t *testing.T) {
-	mockByte1 := []byte{0x01, 0x02}
-	mockByte2 := []byte{0x03, 0x04, 0x05}
-	mockGen1 := internal.NewMockByteGenerator(mockByte1)
-	mockGen2 := internal.NewMockByteGenerator(mockByte2)
-
-	tests := []struct {
-		name           string
-		setupGenerator func() []TagJunkPacketGenerator
-		expected       [][]byte
-	}{
-		{
-			name: "generate with no default junk",
-			setupGenerator: func() []TagJunkPacketGenerator {
-				tg1 := newTagJunkPacketGenerator("t1", "", 0)
-				tg1.append(mockGen1)
-				tg1.append(mockGen2)
-				tg2 := newTagJunkPacketGenerator("t2", "", 0)
-				tg2.append(mockGen2)
-				tg2.append(mockGen1)
-
-				return []TagJunkPacketGenerator{tg1, tg2}
-			},
-			expected: [][]byte{
-				append(mockByte1, mockByte2...),
-				append(mockByte2, mockByte1...),
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			generators := &TagJunkPacketGenerators{}
-			tagGenerators := tt.setupGenerator()
-			for _, gen := range tagGenerators {
-				generators.AppendGenerator(gen)
-			}
-
-			result := generators.GeneratePackets()
-			require.Equal(t, result, tt.expected)
-		})
-	}
-}

device/awg/tag_parser.go

@@ -1,112 +0,0 @@
-package awg
-
-import (
-	"fmt"
-	"maps"
-	"regexp"
-	"strings"
-)
-
-type IpcFields struct{ Key, Value string }
-
-type EnumTag string
-
-const (
-	BytesEnumTag        EnumTag = "b"
-	CounterEnumTag      EnumTag = "c"
-	TimestampEnumTag    EnumTag = "t"
-	RandomBytesEnumTag  EnumTag = "r"
-	WaitTimeoutEnumTag  EnumTag = "wt"
-	WaitResponseEnumTag EnumTag = "wr"
-)
-
-var generatorCreator = map[EnumTag]newGenerator{
-	BytesEnumTag:       newBytesGenerator,
-	CounterEnumTag:     newPacketCounterGenerator,
-	TimestampEnumTag:   newTimestampGenerator,
-	RandomBytesEnumTag: newRandomPacketGenerator,
-	WaitTimeoutEnumTag: newWaitTimeoutGenerator,
-	// WaitResponseEnumTag: newWaitResponseGenerator,
-}
-
-// helper map to determine enumTags are unique
-var uniqueTags = map[EnumTag]bool{
-	CounterEnumTag:   false,
-	TimestampEnumTag: false,
-}
-
-type Tag struct {
-	Name  EnumTag
-	Param string
-}
-
-func parseTag(input string) (Tag, error) {
-	// Regular expression to match <tagname optional_param>
-	re := regexp.MustCompile(`([a-zA-Z]+)(?:\s+([^>]+))?>`)
-
-	match := re.FindStringSubmatch(input)
-	tag := Tag{
-		Name: EnumTag(match[1]),
-	}
-	if len(match) > 2 && match[2] != "" {
-		tag.Param = strings.TrimSpace(match[2])
-	}
-
-	return tag, nil
-}
-
-func Parse(name, input string) (TagJunkPacketGenerator, error) {
-	inputSlice := strings.Split(input, "<")
-	if len(inputSlice) <= 1 {
-		return TagJunkPacketGenerator{}, fmt.Errorf("empty input: %s", input)
-	}
-
-	uniqueTagCheck := make(map[EnumTag]bool, len(uniqueTags))
-	maps.Copy(uniqueTagCheck, uniqueTags)
-
-	// skip byproduct of split
-	inputSlice = inputSlice[1:]
-	rv := newTagJunkPacketGenerator(name, input, len(inputSlice))
-	for _, inputParam := range inputSlice {
-		if len(inputParam) <= 1 {
-			return TagJunkPacketGenerator{}, fmt.Errorf(
-				"empty tag in input: %s",
-				inputSlice,
-			)
-		} else if strings.Count(inputParam, ">") != 1 {
-			return TagJunkPacketGenerator{}, fmt.Errorf("ill formated input: %s", input)
-		}
-
-		tag, _ := parseTag(inputParam)
-		creator, ok := generatorCreator[tag.Name]
-		if !ok {
-			return TagJunkPacketGenerator{}, fmt.Errorf("invalid tag: %s", tag.Name)
-		}
-		if present, ok := uniqueTagCheck[tag.Name]; ok {
-			if present {
-				return TagJunkPacketGenerator{}, fmt.Errorf(
-					"tag %s needs to be unique",
-					tag.Name,
-				)
-			}
-			uniqueTagCheck[tag.Name] = true
-		}
-		generator, err := creator(tag.Param)
-		if err != nil {
-			return TagJunkPacketGenerator{}, fmt.Errorf("gen: %w", err)
-		}
-
-		// TODO: handle counter tag
-		// if tag.Name == CounterEnumTag {
-		// 	packetCounter, ok := generator.(*PacketCounterGenerator)
-		// 	if !ok {
-		// 		log.Fatalf("packet counter generator expected, got %T", generator)
-		// 	}
-		// 	PacketCounter = packetCounter.counter
-		// }
-
-		rv.append(generator)
-	}
-
-	return rv, nil
-}

device/awg/tag_parser_test.go

@@ -1,77 +0,0 @@
-package awg
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestParse(t *testing.T) {
-	type args struct {
-		name  string
-		input string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		wantErr error
-	}{
-		{
-			name:    "invalid name",
-			args:    args{name: "apple", input: ""},
-			wantErr: fmt.Errorf("ill formated input"),
-		},
-		{
-			name:    "empty",
-			args:    args{name: "i1", input: ""},
-			wantErr: fmt.Errorf("ill formated input"),
-		},
-		{
-			name:    "extra >",
-			args:    args{name: "i1", input: "<b 0xf6ab3267fa><c>>"},
-			wantErr: fmt.Errorf("ill formated input"),
-		},
-		{
-			name:    "extra <",
-			args:    args{name: "i1", input: "<<b 0xf6ab3267fa><c>"},
-			wantErr: fmt.Errorf("empty tag in input"),
-		},
-		{
-			name:    "empty <>",
-			args:    args{name: "i1", input: "<><b 0xf6ab3267fa><c>"},
-			wantErr: fmt.Errorf("empty tag in input"),
-		},
-		{
-			name:    "invalid tag",
-			args:    args{name: "i1", input: "<q 0xf6ab3267fa>"},
-			wantErr: fmt.Errorf("invalid tag"),
-		},
-		{
-			name:    "counter uniqueness violation",
-			args:    args{name: "i1", input: "<c><c>"},
-			wantErr: fmt.Errorf("parse tag needs to be unique"),
-		},
-		{
-			name:    "timestamp uniqueness violation",
-			args:    args{name: "i1", input: "<t><t>"},
-			wantErr: fmt.Errorf("parse tag needs to be unique"),
-		},
-		{
-			name: "valid",
-			args: args{input: "<b 0xf6ab3267fa><c><b 0xf6ab><t><r 10><wt 10>"},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, err := Parse(tt.args.name, tt.args.input)
-
-			// TODO:  ErrorAs doesn't work as you think
-			if tt.wantErr != nil {
-				require.ErrorAs(t, err, &tt.wantErr)
-				return
-			}
-			require.Nil(t, err)
-		})
-	}
-}

device/cookie.go

@@ -118,6 +118,7 @@ func (st *CookieChecker) CreateReply(
 	msg []byte,
 	recv uint32,
 	src []byte,
+	msgType uint32,
 ) (*MessageCookieReply, error) {
 	st.RLock()
 
@@ -153,7 +154,7 @@ func (st *CookieChecker) CreateReply(
 	smac1 := smac2 - blake2s.Size128
 
 	reply := new(MessageCookieReply)
-	reply.Type = MessageCookieReplyType
+	reply.Type = msgType
 	reply.Receiver = recv
 
 	_, err := rand.Read(reply.Nonce[:])

device/cookie_test.go

@@ -99,7 +99,7 @@ func TestCookieMAC1(t *testing.T) {
 			0x8c, 0xe1, 0xe8, 0xfa, 0x67, 0x20, 0x80, 0x6d,
 		}
 		generator.AddMacs(msg)
-		reply, err := checker.CreateReply(msg, 1377, src)
+		reply, err := checker.CreateReply(msg, 1377, src, MessageCookieReplyType)
 		if err != nil {
 			t.Fatal("Failed to create cookie reply:", err)
 		}

device/device.go

@@ -6,55 +6,17 @@
 package device
 
 import (
-	"errors"
 	"runtime"
 	"sync"
 	"sync/atomic"
 	"time"
 
 	"github.com/amnezia-vpn/amneziawg-go/conn"
-	"github.com/amnezia-vpn/amneziawg-go/device/awg"
-	"github.com/amnezia-vpn/amneziawg-go/ipc"
 	"github.com/amnezia-vpn/amneziawg-go/ratelimiter"
 	"github.com/amnezia-vpn/amneziawg-go/rwcancel"
 	"github.com/amnezia-vpn/amneziawg-go/tun"
 )
 
-type Version uint8
-
-const (
-	VersionDefault Version = iota
-	VersionAwg
-	VersionAwgSpecialHandshake
-)
-
-// TODO:
-type AtomicVersion struct {
-	value atomic.Uint32
-}
-
-func NewAtomicVersion(v Version) *AtomicVersion {
-	av := &AtomicVersion{}
-	av.Store(v)
-	return av
-}
-
-func (av *AtomicVersion) Load() Version {
-	return Version(av.value.Load())
-}
-
-func (av *AtomicVersion) Store(v Version) {
-	av.value.Store(uint32(v))
-}
-
-func (av *AtomicVersion) CompareAndSwap(old, new Version) bool {
-	return av.value.CompareAndSwap(uint32(old), uint32(new))
-}
-
-func (av *AtomicVersion) Swap(new Version) Version {
-	return Version(av.value.Swap(uint32(new)))
-}
-
 type Device struct {
 	state struct {
 		// state holds the device's state. It is accessed atomically.
@@ -128,8 +90,34 @@ type Device struct {
 	closed   chan struct{}
 	log      *Logger
 
-	version Version
-	awg     awg.Protocol
+	junk struct {
+		min   int
+		max   int
+		count int
+	}
+
+	headers struct {
+		init      *magicHeader
+		cookie    *magicHeader
+		response  *magicHeader
+		transport *magicHeader
+	}
+
+	paddings struct {
+		init      int
+		response  int
+		cookie    int
+		transport int
+	}
+
+	ipackets [5]*obfChain
+
+	dpackets struct {
+		init      *obfChain
+		cookie    *obfChain
+		response  *obfChain
+		transport *obfChain
+	}
 }
 
 // deviceState represents the state of a Device.
@@ -340,6 +328,11 @@ func NewDevice(tunDevice tun.Device, bind conn.Bind, logger *Logger) *Device {
 	device.rate.limiter.Init()
 	device.indexTable.Init()
 
+	device.headers.init = &magicHeader{start: MessageInitiationType, end: MessageInitiationType}
+	device.headers.response = &magicHeader{start: MessageResponseType, end: MessageResponseType}
+	device.headers.cookie = &magicHeader{start: MessageCookieReplyType, end: MessageCookieReplyType}
+	device.headers.transport = &magicHeader{start: MessageTransportType, end: MessageTransportType}
+
 	device.PopulatePools()
 
 	// create queues
@@ -437,8 +430,6 @@ func (device *Device) Close() {
 
 	device.rate.limiter.Close()
 
-	device.resetProtocol()
-
 	device.log.Verbosef("Device closed")
 	close(device.closed)
 }
@@ -578,261 +569,3 @@ func (device *Device) BindClose() error {
 	device.net.Unlock()
 	return err
 }
-func (device *Device) isAWG() bool {
-	return device.version >= VersionAwg
-}
-
-func (device *Device) resetProtocol() {
-	// restore default message type values
-	MessageInitiationType = DefaultMessageInitiationType
-	MessageResponseType = DefaultMessageResponseType
-	MessageCookieReplyType = DefaultMessageCookieReplyType
-	MessageTransportType = DefaultMessageTransportType
-}
-
-func (device *Device) handlePostConfig(tempAwg *awg.Protocol) error {
-	if !tempAwg.ASecCfg.IsSet && !tempAwg.HandshakeHandler.IsSet {
-		return nil
-	}
-
-	var errs []error
-
-	isASecOn := false
-	device.awg.ASecMux.Lock()
-	if tempAwg.ASecCfg.JunkPacketCount < 0 {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			"JunkPacketCount should be non negative",
-		),
-		)
-	}
-	device.awg.ASecCfg.JunkPacketCount = tempAwg.ASecCfg.JunkPacketCount
-	if tempAwg.ASecCfg.JunkPacketCount != 0 {
-		isASecOn = true
-	}
-
-	device.awg.ASecCfg.JunkPacketMinSize = tempAwg.ASecCfg.JunkPacketMinSize
-	if tempAwg.ASecCfg.JunkPacketMinSize != 0 {
-		isASecOn = true
-	}
-
-	if device.awg.ASecCfg.JunkPacketCount > 0 &&
-		tempAwg.ASecCfg.JunkPacketMaxSize == tempAwg.ASecCfg.JunkPacketMinSize {
-
-		tempAwg.ASecCfg.JunkPacketMaxSize++ // to make rand gen work
-	}
-
-	if tempAwg.ASecCfg.JunkPacketMaxSize >= MaxSegmentSize {
-		device.awg.ASecCfg.JunkPacketMinSize = 0
-		device.awg.ASecCfg.JunkPacketMaxSize = 1
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			"JunkPacketMaxSize: %d; should be smaller than maxSegmentSize: %d",
-			tempAwg.ASecCfg.JunkPacketMaxSize,
-			MaxSegmentSize,
-		))
-	} else if tempAwg.ASecCfg.JunkPacketMaxSize < tempAwg.ASecCfg.JunkPacketMinSize {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			"maxSize: %d; should be greater than minSize: %d",
-			tempAwg.ASecCfg.JunkPacketMaxSize,
-			tempAwg.ASecCfg.JunkPacketMinSize,
-		))
-	} else {
-		device.awg.ASecCfg.JunkPacketMaxSize = tempAwg.ASecCfg.JunkPacketMaxSize
-	}
-
-	if tempAwg.ASecCfg.JunkPacketMaxSize != 0 {
-		isASecOn = true
-	}
-
-	newInitSize := MessageInitiationSize + tempAwg.ASecCfg.InitHeaderJunkSize
-
-	if newInitSize >= MaxSegmentSize {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`init header size(148) + junkSize:%d; should be smaller than maxSegmentSize: %d`,
-			tempAwg.ASecCfg.InitHeaderJunkSize,
-			MaxSegmentSize,
-		),
-		)
-	} else {
-		device.awg.ASecCfg.InitHeaderJunkSize = tempAwg.ASecCfg.InitHeaderJunkSize
-	}
-
-	if tempAwg.ASecCfg.InitHeaderJunkSize != 0 {
-		isASecOn = true
-	}
-
-	newResponseSize := MessageResponseSize + tempAwg.ASecCfg.ResponseHeaderJunkSize
-
-	if newResponseSize >= MaxSegmentSize {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`response header size(92) + junkSize:%d; should be smaller than maxSegmentSize: %d`,
-			tempAwg.ASecCfg.ResponseHeaderJunkSize,
-			MaxSegmentSize,
-		),
-		)
-	} else {
-		device.awg.ASecCfg.ResponseHeaderJunkSize = tempAwg.ASecCfg.ResponseHeaderJunkSize
-	}
-
-	if tempAwg.ASecCfg.ResponseHeaderJunkSize != 0 {
-		isASecOn = true
-	}
-
-	newCookieSize := MessageCookieReplySize + tempAwg.ASecCfg.CookieReplyHeaderJunkSize
-
-	if newCookieSize >= MaxSegmentSize {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`cookie reply size(92) + junkSize:%d; should be smaller than maxSegmentSize: %d`,
-			tempAwg.ASecCfg.CookieReplyHeaderJunkSize,
-			MaxSegmentSize,
-		),
-		)
-	} else {
-		device.awg.ASecCfg.CookieReplyHeaderJunkSize = tempAwg.ASecCfg.CookieReplyHeaderJunkSize
-	}
-
-	if tempAwg.ASecCfg.CookieReplyHeaderJunkSize != 0 {
-		isASecOn = true
-	}
-
-	newTransportSize := MessageTransportSize + tempAwg.ASecCfg.TransportHeaderJunkSize
-
-	if newTransportSize >= MaxSegmentSize {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`transport size(92) + junkSize:%d; should be smaller than maxSegmentSize: %d`,
-			tempAwg.ASecCfg.TransportHeaderJunkSize,
-			MaxSegmentSize,
-		),
-		)
-	} else {
-		device.awg.ASecCfg.TransportHeaderJunkSize = tempAwg.ASecCfg.TransportHeaderJunkSize
-	}
-
-	if tempAwg.ASecCfg.TransportHeaderJunkSize != 0 {
-		isASecOn = true
-	}
-
-	if tempAwg.ASecCfg.InitPacketMagicHeader > 4 {
-		isASecOn = true
-		device.log.Verbosef("UAPI: Updating init_packet_magic_header")
-		device.awg.ASecCfg.InitPacketMagicHeader = tempAwg.ASecCfg.InitPacketMagicHeader
-		MessageInitiationType = device.awg.ASecCfg.InitPacketMagicHeader
-	} else {
-		device.log.Verbosef("UAPI: Using default init type")
-		MessageInitiationType = DefaultMessageInitiationType
-	}
-
-	if tempAwg.ASecCfg.ResponsePacketMagicHeader > 4 {
-		isASecOn = true
-		device.log.Verbosef("UAPI: Updating response_packet_magic_header")
-		device.awg.ASecCfg.ResponsePacketMagicHeader = tempAwg.ASecCfg.ResponsePacketMagicHeader
-		MessageResponseType = device.awg.ASecCfg.ResponsePacketMagicHeader
-	} else {
-		device.log.Verbosef("UAPI: Using default response type")
-		MessageResponseType = DefaultMessageResponseType
-	}
-
-	if tempAwg.ASecCfg.UnderloadPacketMagicHeader > 4 {
-		isASecOn = true
-		device.log.Verbosef("UAPI: Updating underload_packet_magic_header")
-		device.awg.ASecCfg.UnderloadPacketMagicHeader = tempAwg.ASecCfg.UnderloadPacketMagicHeader
-		MessageCookieReplyType = device.awg.ASecCfg.UnderloadPacketMagicHeader
-	} else {
-		device.log.Verbosef("UAPI: Using default underload type")
-		MessageCookieReplyType = DefaultMessageCookieReplyType
-	}
-
-	if tempAwg.ASecCfg.TransportPacketMagicHeader > 4 {
-		isASecOn = true
-		device.log.Verbosef("UAPI: Updating transport_packet_magic_header")
-		device.awg.ASecCfg.TransportPacketMagicHeader = tempAwg.ASecCfg.TransportPacketMagicHeader
-		MessageTransportType = device.awg.ASecCfg.TransportPacketMagicHeader
-	} else {
-		device.log.Verbosef("UAPI: Using default transport type")
-		MessageTransportType = DefaultMessageTransportType
-	}
-
-	isSameHeaderMap := map[uint32]struct{}{
-		MessageInitiationType:  {},
-		MessageResponseType:    {},
-		MessageCookieReplyType: {},
-		MessageTransportType:   {},
-	}
-
-	// size will be different if same values
-	if len(isSameHeaderMap) != 4 {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`magic headers should differ; got: init:%d; recv:%d; unde:%d; tran:%d`,
-			MessageInitiationType,
-			MessageResponseType,
-			MessageCookieReplyType,
-			MessageTransportType,
-		),
-		)
-	}
-
-	isSameSizeMap := map[int]struct{}{
-		newInitSize:      {},
-		newResponseSize:  {},
-		newCookieSize:    {},
-		newTransportSize: {},
-	}
-
-	if len(isSameSizeMap) != 4 {
-		errs = append(errs, ipcErrorf(
-			ipc.IpcErrorInvalid,
-			`new sizes should differ; init: %d; response: %d; cookie: %d; trans: %d`,
-			newInitSize,
-			newResponseSize,
-			newCookieSize,
-			newTransportSize,
-		),
-		)
-	} else {
-		msgTypeToJunkSize = map[uint32]int{
-			MessageInitiationType:  device.awg.ASecCfg.InitHeaderJunkSize,
-			MessageResponseType:    device.awg.ASecCfg.ResponseHeaderJunkSize,
-			MessageCookieReplyType: device.awg.ASecCfg.CookieReplyHeaderJunkSize,
-			MessageTransportType:   device.awg.ASecCfg.TransportHeaderJunkSize,
-		}
-
-		packetSizeToMsgType = map[int]uint32{
-			newInitSize:      MessageInitiationType,
-			newResponseSize:  MessageResponseType,
-			newCookieSize:    MessageCookieReplyType,
-			newTransportSize: MessageTransportType,
-		}
-	}
-
-	device.awg.IsASecOn.SetTo(isASecOn)
-	var err error
-	device.awg.JunkCreator, err = awg.NewJunkCreator(device.awg.ASecCfg)
-	if err != nil {
-		errs = append(errs, err)
-	}
-
-	if tempAwg.HandshakeHandler.IsSet {
-		if err := tempAwg.HandshakeHandler.Validate(); err != nil {
-			errs = append(errs, ipcErrorf(
-				ipc.IpcErrorInvalid, "handshake handler validate: %w", err))
-		} else {
-			device.awg.HandshakeHandler = tempAwg.HandshakeHandler
-			device.awg.HandshakeHandler.ControlledJunk.DefaultJunkCount = tempAwg.ASecCfg.JunkPacketCount
-			device.awg.HandshakeHandler.SpecialJunk.DefaultJunkCount = tempAwg.ASecCfg.JunkPacketCount
-			device.version = VersionAwgSpecialHandshake
-		}
-	} else {
-		device.version = VersionAwg
-	}
-
-	device.awg.ASecMux.Unlock()
-
-	return errors.Join(errs...)
-}

device/device_test.go

@@ -227,19 +227,18 @@ func TestTwoDevicePing(t *testing.T) {
 // Run test with -race=false to avoid the race for setting the default msgTypes 2 times
 func TestAWGDevicePing(t *testing.T) {
 	goroutineLeakCheck(t)
-
 	pair := genTestPair(t, true,
 		"jc", "5",
 		"jmin", "500",
 		"jmax", "1000",
-		"s1", "30",
-		"s2", "40",
-		"s3", "50",
-		"s4", "5",
-		"h1", "123456",
-		"h2", "67543",
-		"h3", "123123",
-		"h4", "32345",
+		"s1", "15",
+		"s2", "18",
+		"s3", "20",
+		"s4", "25",
+		"h1", "123456-123500",
+		"h2", "67543-67550",
+		"h3", "123123-123200",
+		"h4", "32345-32350",
 	)
 	t.Run("ping 1.0.0.1", func(t *testing.T) {
 		pair.Send(t, Ping, nil)
@@ -264,12 +263,10 @@ func TestAWGHandshakeDevicePing(t *testing.T) {
 
 	goroutineLeakCheck(t)
 	pair := genTestPair(t, true,
-		"i1", "<b 0xf6ab3267fa><c><b 0xf6ab><t><r 10><wt 10>",
-		"i2", "<b 0xf6ab3267fa><r 100>",
-		"j1", "<b 0xffffffff><c><b 0xf6ab><t><r 10>",
-		"j2", "<c><b 0xf6ab><t><wt 1000>",
-		"j3", "<t><b 0xf6ab><c><r 10>",
-		"itime", "60",
+		"i1", "<b 0xf6ab3267fa><c><b 0xf6ab><t><r 10>",
+		"i2", "<b 0xf6ab3267fa><c><b 0xf6ab><t><rc 10>",
+		"i3", "<b 0xf6ab3267fa><c><b 0xf6ab><t><rd 10>",
+		"i4", "<b 0xf6ab3267fa><r 100>",
 		// "jc", "1",
 		// "jmin", "500",
 		// "jmax", "1000",
@@ -294,6 +291,30 @@ func TestAWGHandshakeDevicePing(t *testing.T) {
 	})
 }
 
+func TestAWGObfuscatedDevicePing(t *testing.T) {
+	goroutineLeakCheck(t)
+	pair := genTestPair(t, true,
+		"s1", "10",
+		"s2", "10",
+		"s3", "10",
+		"s4", "10",
+		"h1", "12-34",
+		"h2", "56-78",
+		"h3", "9998-12345",
+		"h4", "123123-123456",
+		"di", "<b 0x123401000001000000000001056d757369630679616e64657802727500001c0001000001000112345678><dz 2><d>",
+		"dr", "<b 0x1234><d><t><r 10><rc 10><rd 10><dz 8>",
+		"dc", "<b 0x1234><d>",
+		"dt", "<b 0x2345><ds>",
+	)
+	t.Run("ping 1.0.0.1", func(t *testing.T) {
+		pair.Send(t, Ping, nil)
+	})
+	t.Run("ping 1.0.0.2", func(t *testing.T) {
+		pair.Send(t, Pong, nil)
+	})
+}
+
 func TestUpDown(t *testing.T) {
 	goroutineLeakCheck(t)
 	const itrials = 50

device/magic-header.go

@@ -0,0 +1,63 @@
+package device
+
+import (
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"math/big"
+	"strconv"
+	"strings"
+)
+
+type magicHeader struct {
+	start uint32
+	end   uint32
+}
+
+func newMagicHeader(spec string) (*magicHeader, error) {
+	parts := strings.Split(spec, "-")
+	if len(parts) < 1 || len(parts) > 2 {
+		return nil, errors.New("bad format")
+	}
+
+	start, err := strconv.ParseUint(parts[0], 10, 32)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", parts[0], err)
+	}
+
+	var end uint64
+	if len(parts) > 1 {
+		end, err = strconv.ParseUint(parts[1], 10, 32)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse %s: %w", parts[1], err)
+		}
+	} else {
+		end = start
+	}
+
+	if end < start {
+		return nil, errors.New("wrong range specified")
+	}
+
+	return &magicHeader{
+		start: uint32(start),
+		end:   uint32(end),
+	}, nil
+}
+
+func (h *magicHeader) GenSpec() string {
+	if h.start == h.end {
+		return fmt.Sprintf("%d", h.start)
+	}
+	return fmt.Sprintf("%d-%d", h.start, h.end)
+}
+
+func (h *magicHeader) Validate(val uint32) bool {
+	return h.start <= val && val <= h.end
+}
+
+func (h *magicHeader) Generate() uint32 {
+	high := int64(h.end - h.start + 1)
+	r, _ := rand.Int(rand.Reader, big.NewInt(high))
+	return h.start + uint32(r.Int64())
+}

device/noise-protocol.go

@@ -53,17 +53,11 @@ const (
 )
 
 const (
-	DefaultMessageInitiationType  uint32 = 1
-	DefaultMessageResponseType    uint32 = 2
-	DefaultMessageCookieReplyType uint32 = 3
-	DefaultMessageTransportType   uint32 = 4
-)
-
-var (
-	MessageInitiationType  uint32 = DefaultMessageInitiationType
-	MessageResponseType    uint32 = DefaultMessageResponseType
-	MessageCookieReplyType uint32 = DefaultMessageCookieReplyType
-	MessageTransportType   uint32 = DefaultMessageTransportType
+	MessageUnknownType     uint32 = 0
+	MessageInitiationType  uint32 = 1
+	MessageResponseType    uint32 = 2
+	MessageCookieReplyType uint32 = 3
+	MessageTransportType   uint32 = 4
 )
 
 const (
@@ -82,11 +76,6 @@ const (
 	MessageTransportOffsetContent  = 16
 )
 
-var (
-	packetSizeToMsgType map[int]uint32
-	msgTypeToJunkSize   map[uint32]int
-)
-
 /* Type is an 8-bit field, followed by 3 nul bytes,
  * by marshalling the messages in little-endian byteorder
  * we can treat these as a 32-bit unsigned int (for now)
@@ -205,12 +194,12 @@ func (device *Device) CreateMessageInitiation(peer *Peer) (*MessageInitiation, e
 
 	handshake.mixHash(handshake.remoteStatic[:])
 
-	device.awg.ASecMux.RLock()
+	msgType := device.headers.init.Generate()
+
 	msg := MessageInitiation{
-		Type:      MessageInitiationType,
+		Type:      msgType,
 		Ephemeral: handshake.localEphemeral.publicKey(),
 	}
-	device.awg.ASecMux.RUnlock()
 
 	handshake.mixKey(msg.Ephemeral[:])
 	handshake.mixHash(msg.Ephemeral[:])
@@ -264,12 +253,9 @@ func (device *Device) ConsumeMessageInitiation(msg *MessageInitiation) *Peer {
 		chainKey [blake2s.Size]byte
 	)
 
-	device.awg.ASecMux.RLock()
 	if msg.Type != MessageInitiationType {
-		device.awg.ASecMux.RUnlock()
 		return nil
 	}
-	device.awg.ASecMux.RUnlock()
 
 	device.staticIdentity.RLock()
 	defer device.staticIdentity.RUnlock()
@@ -384,9 +370,7 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
 	}
 
 	var msg MessageResponse
-	device.awg.ASecMux.RLock()
-	msg.Type = MessageResponseType
-	device.awg.ASecMux.RUnlock()
+	msg.Type = device.headers.response.Generate()
 	msg.Sender = handshake.localIndex
 	msg.Receiver = handshake.remoteIndex
 
@@ -436,12 +420,9 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
 }
 
 func (device *Device) ConsumeMessageResponse(msg *MessageResponse) *Peer {
-	device.awg.ASecMux.RLock()
 	if msg.Type != MessageResponseType {
-		device.awg.ASecMux.RUnlock()
 		return nil
 	}
-	device.awg.ASecMux.RUnlock()
 
 	// lookup handshake by receiver
 

device/obf.go

@@ -0,0 +1,140 @@
+package device
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+type obfBuilder func(val string) (obf, error)
+
+var obfBuilders = map[string]obfBuilder{
+	"b":  newBytesObf,
+	"t":  newTimestampObf,
+	"r":  newRandObf,
+	"rc": newRandCharObf,
+	"rd": newRandDigitsObf,
+	"d":  newDataObf,
+	"ds": newDataStringObf,
+	"dz": newDataSizeObf,
+}
+
+type obf interface {
+	Obfuscate(dst, src []byte)
+	Deobfuscate(dst, src []byte) bool
+	ObfuscatedLen(srcLen int) int
+	DeobfuscatedLen(srcLen int) int
+}
+
+type obfChain struct {
+	Spec string
+	obfs []obf
+}
+
+func newObfChain(spec string) (*obfChain, error) {
+	var (
+		obfs []obf
+		errs []error
+	)
+
+	remaining := spec[:]
+	for {
+		start := strings.IndexByte(remaining, '<')
+		if start == -1 {
+			break
+		}
+
+		end := strings.IndexByte(remaining[start:], '>')
+		if end == -1 {
+			return nil, errors.New("missing enclosing >")
+		}
+		end += start
+
+		tag := remaining[start+1 : end]
+		parts := strings.Fields(tag)
+		if len(parts) == 0 {
+			errs = append(errs, errors.New("empty tag"))
+			remaining = remaining[end+1:]
+			continue
+		}
+
+		key := parts[0]
+		builder, ok := obfBuilders[key]
+		if !ok {
+			errs = append(errs, fmt.Errorf("unknown tag <%s>", key))
+			remaining = remaining[end+1:]
+			continue
+		}
+
+		val := ""
+		if len(parts) > 1 {
+			val = parts[1]
+		}
+
+		o, err := builder(val)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("failed to build <%s>: %w", key, err))
+			remaining = remaining[end+1:]
+			continue
+		}
+
+		obfs = append(obfs, o)
+		remaining = remaining[end+1:]
+	}
+
+	if len(errs) > 0 {
+		return nil, errors.Join(errs...)
+	}
+
+	return &obfChain{
+		Spec: spec,
+		obfs: obfs,
+	}, nil
+}
+
+func (c *obfChain) Obfuscate(dst, src []byte) {
+	written := 0
+	for _, o := range c.obfs {
+		obfLen := o.ObfuscatedLen(len(src))
+		o.Obfuscate(dst[written:written+obfLen], src)
+		written += obfLen
+	}
+}
+
+func (c *obfChain) Deobfuscate(dst, src []byte) bool {
+	dynamicLen := len(src) - c.ObfuscatedLen(0)
+
+	written, read := 0, 0
+
+	for _, o := range c.obfs {
+		deobfLen := o.DeobfuscatedLen(dynamicLen)
+		obfLen := o.ObfuscatedLen(deobfLen)
+
+		if !o.Deobfuscate(dst[written:written+deobfLen], src[read:read+obfLen]) {
+			return false
+		}
+
+		written += deobfLen
+		read += obfLen
+	}
+
+	return true
+}
+
+func (c *obfChain) ObfuscatedLen(n int) int {
+	total := 0
+	for _, o := range c.obfs {
+		total += o.ObfuscatedLen(n)
+	}
+	return total
+}
+
+func (c *obfChain) DeobfuscatedLen(n int) int {
+	dynamicLen := n - c.ObfuscatedLen(0)
+
+	total := 0
+	for _, o := range c.obfs {
+		total += o.DeobfuscatedLen(dynamicLen)
+	}
+	return total
+}

device/obf_bytes.go

@@ -0,0 +1,47 @@
+package device
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"strings"
+)
+
+func newBytesObf(val string) (obf, error) {
+	val = strings.TrimPrefix(val, "0x")
+
+	if len(val) == 0 {
+		return nil, errors.New("empty argument")
+	}
+
+	if len(val)%2 != 0 {
+		return nil, errors.New("odd amount of symbols")
+	}
+
+	bytes, err := hex.DecodeString(val)
+	if err != nil {
+		return nil, err
+	}
+
+	return &bytesObf{data: bytes}, nil
+}
+
+type bytesObf struct {
+	data []byte
+}
+
+func (o *bytesObf) Obfuscate(dst, src []byte) {
+	copy(dst, o.data)
+}
+
+func (o *bytesObf) Deobfuscate(dst, src []byte) bool {
+	return bytes.Equal(o.data, src[:o.ObfuscatedLen(0)])
+}
+
+func (o *bytesObf) ObfuscatedLen(srcLen int) int {
+	return len(o.data)
+}
+
+func (o *bytesObf) DeobfuscatedLen(srcLen int) int {
+	return 0
+}

device/obf_data.go

@@ -0,0 +1,25 @@
+package device
+
+func newDataObf(val string) (obf, error) {
+	return &dataObf{}, nil
+}
+
+type dataObf struct {
+}
+
+func (obf *dataObf) Obfuscate(dst, src []byte) {
+	copy(dst, src)
+}
+
+func (obf *dataObf) Deobfuscate(dst, src []byte) bool {
+	copy(dst, src)
+	return true
+}
+
+func (o *dataObf) ObfuscatedLen(n int) int {
+	return n
+}
+
+func (o *dataObf) DeobfuscatedLen(n int) int {
+	return n
+}

device/obf_datasize.go

@@ -0,0 +1,38 @@
+package device
+
+import "strconv"
+
+func newDataSizeObf(val string) (obf, error) {
+	length, err := strconv.Atoi(val)
+	if err != nil {
+		return nil, err
+	}
+
+	return &dataSizeObf{
+		length: length,
+	}, nil
+}
+
+type dataSizeObf struct {
+	length int
+}
+
+func (o *dataSizeObf) Obfuscate(dst, src []byte) {
+	srcLen := len(src)
+	for i := o.length - 1; i >= 0; i-- {
+		dst[i] = byte(srcLen & 0xFF)
+		srcLen >>= 8
+	}
+}
+
+func (o *dataSizeObf) Deobfuscate(dst, src []byte) bool {
+	return true
+}
+
+func (o *dataSizeObf) ObfuscatedLen(srcLen int) int {
+	return o.length
+}
+
+func (o *dataSizeObf) DeobfuscatedLen(srcLen int) int {
+	return 0
+}

device/obf_datastring.go

@@ -0,0 +1,29 @@
+package device
+
+import (
+	"encoding/base64"
+)
+
+func newDataStringObf(val string) (obf, error) {
+	return &dataStringObf{}, nil
+}
+
+type dataStringObf struct {
+}
+
+func (o *dataStringObf) Obfuscate(dst, src []byte) {
+	base64.RawStdEncoding.Encode(dst, src)
+}
+
+func (o *dataStringObf) Deobfuscate(dst, src []byte) bool {
+	base64.RawStdEncoding.Decode(dst, src)
+	return true
+}
+
+func (o *dataStringObf) ObfuscatedLen(n int) int {
+	return base64.RawStdEncoding.EncodedLen(n)
+}
+
+func (o *dataStringObf) DeobfuscatedLen(n int) int {
+	return base64.RawStdEncoding.DecodedLen(n)
+}

device/obf_rand.go

@@ -0,0 +1,39 @@
+package device
+
+import (
+	"crypto/rand"
+	"strconv"
+)
+
+func newRandObf(val string) (obf, error) {
+	length, err := strconv.Atoi(val)
+	if err != nil {
+		return nil, err
+	}
+
+	return &randObf{
+		length: length,
+	}, nil
+}
+
+type randObf struct {
+	length int
+}
+
+func (o *randObf) Obfuscate(dst, src []byte) {
+	rand.Read(dst[:o.length])
+}
+
+func (o *randObf) Deobfuscate(dst, src []byte) bool {
+	// there is no way to validate randomness :)
+	// assume that it is always true
+	return true
+}
+
+func (o *randObf) ObfuscatedLen(n int) int {
+	return o.length
+}
+
+func (o *randObf) DeobfuscatedLen(n int) int {
+	return 0
+}

device/obf_randchars.go

@@ -0,0 +1,48 @@
+package device
+
+import (
+	"crypto/rand"
+	"strconv"
+	"unicode"
+)
+
+const chars52 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+func newRandCharObf(val string) (obf, error) {
+	length, err := strconv.Atoi(val)
+	if err != nil {
+		return nil, err
+	}
+
+	return &randCharObf{
+		length: length,
+	}, nil
+}
+
+type randCharObf struct {
+	length int
+}
+
+func (o *randCharObf) Obfuscate(dst, src []byte) {
+	rand.Read(dst[:o.length])
+	for i := range dst[:o.length] {
+		dst[i] = chars52[dst[i]%52]
+	}
+}
+
+func (o *randCharObf) Deobfuscate(dst, src []byte) bool {
+	for _, b := range src[:o.length] {
+		if !unicode.IsLetter(rune(b)) {
+			return false
+		}
+	}
+	return true
+}
+
+func (o *randCharObf) ObfuscatedLen(n int) int {
+	return o.length
+}
+
+func (o *randCharObf) DeobfuscatedLen(n int) int {
+	return 0
+}

device/obf_randdigits.go

@@ -0,0 +1,48 @@
+package device
+
+import (
+	"crypto/rand"
+	"strconv"
+	"unicode"
+)
+
+const digits10 = "0123456789"
+
+func newRandDigitsObf(val string) (obf, error) {
+	length, err := strconv.Atoi(val)
+	if err != nil {
+		return nil, err
+	}
+
+	return &randDigitObf{
+		length: length,
+	}, nil
+}
+
+type randDigitObf struct {
+	length int
+}
+
+func (o *randDigitObf) Obfuscate(dst, src []byte) {
+	rand.Read(dst[:o.length])
+	for i := range dst[:o.length] {
+		dst[i] = digits10[dst[i]%10]
+	}
+}
+
+func (o *randDigitObf) Deobfuscate(dst, src []byte) bool {
+	for _, b := range src[:o.length] {
+		if !unicode.IsDigit(rune(b)) {
+			return false
+		}
+	}
+	return true
+}
+
+func (o *randDigitObf) ObfuscatedLen(n int) int {
+	return o.length
+}
+
+func (o *randDigitObf) DeobfuscatedLen(n int) int {
+	return 0
+}

device/obf_timestamp.go

@@ -0,0 +1,31 @@
+package device
+
+import (
+	"encoding/binary"
+	"time"
+)
+
+func newTimestampObf(_ string) (obf, error) {
+	return &timestampObf{}, nil
+}
+
+type timestampObf struct{}
+
+func (o *timestampObf) Obfuscate(dst, src []byte) {
+	t := uint32(time.Now().Unix())
+	binary.BigEndian.PutUint32(dst, t)
+}
+
+func (o *timestampObf) Deobfuscate(dst, src []byte) bool {
+	// replay attack check?
+	// requires time to be always synchronized
+	return true
+}
+
+func (o *timestampObf) ObfuscatedLen(n int) int {
+	return 4
+}
+
+func (o *timestampObf) DeobfuscatedLen(n int) int {
+	return 0
+}

device/peer.go

@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/amnezia-vpn/amneziawg-go/conn"
-	"github.com/amnezia-vpn/amneziawg-go/device/awg"
 )
 
 type Peer struct {
@@ -114,16 +113,6 @@ func (device *Device) NewPeer(pk NoisePublicKey) (*Peer, error) {
 	return peer, nil
 }
 
-func (peer *Peer) SendAndCountBuffers(buffers [][]byte) error {
-	err := peer.SendBuffers(buffers)
-	if err == nil {
-		awg.PacketCounter.Add(uint64(len(buffers)))
-		return nil
-	}
-
-	return err
-}
-
 func (peer *Peer) SendBuffers(buffers [][]byte) error {
 	peer.device.net.RLock()
 	defer peer.device.net.RUnlock()

device/receive.go

@@ -97,13 +97,13 @@ func (device *Device) RoutineReceiveIncoming(
 		elemsByPeer = make(map[*Peer]*QueueInboundElementsContainer, maxBatchSize)
 	)
 
-	for i := range bufsArrs {
+	for i := range maxBatchSize {
 		bufsArrs[i] = device.GetMessageBuffer()
 		bufs[i] = bufsArrs[i][:]
 	}
 
 	defer func() {
-		for i := 0; i < maxBatchSize; i++ {
+		for i := range maxBatchSize {
 			if bufsArrs[i] != nil {
 				device.PutMessageBuffer(bufsArrs[i])
 			}
@@ -129,7 +129,6 @@ func (device *Device) RoutineReceiveIncoming(
 		}
 		deathSpiral = 0
 
-		device.awg.ASecMux.RLock()
 		// handle each packet in the batch
 		for i, size := range sizes[:count] {
 			if size < MinMessageSize {
@@ -138,42 +137,23 @@ func (device *Device) RoutineReceiveIncoming(
 
 			// check size of packet
 			packet := bufsArrs[i][:size]
-			var msgType uint32
-			if device.isAWG() {
-				// TODO:
-				// if awg.WaitResponse.ShouldWait.IsSet() {
-				// 	awg.WaitResponse.Channel <- struct{}{}
-				// }
 
-				if assumedMsgType, ok := packetSizeToMsgType[size]; ok {
-					junkSize := msgTypeToJunkSize[assumedMsgType]
-					// transport size can align with other header types;
-					// making sure we have the right msgType
-					msgType = binary.LittleEndian.Uint32(packet[junkSize : junkSize+4])
-					if msgType == assumedMsgType {
-						packet = packet[junkSize:]
-					} else {
-						device.log.Verbosef("transport packet lined up with another msg type")
-						msgType = binary.LittleEndian.Uint32(packet[:4])
-					}
-				} else {
-					transportJunkSize := device.awg.ASecCfg.TransportHeaderJunkSize
-					msgType = binary.LittleEndian.Uint32(packet[transportJunkSize : transportJunkSize+4])
-					if msgType != MessageTransportType {
-						// probably a junk packet
-						device.log.Verbosef("aSec: Received message with unknown type: %d", msgType)
-						continue
-					}
-
-					// remove junk from bufsArrs by shifting the packet
-					// this buffer is also used for decryption, so it needs to be corrected
-					copy(bufsArrs[i][:size], packet[transportJunkSize:])
-					size -= transportJunkSize
-					// need to reinitialize packet as well
-					packet = packet[:size]
-				}
+			// decode D1-D4
+			deobfBuf := device.GetMessageBuffer()
+			n, _ := device.DeobfuscatePacket(deobfBuf[:], packet)
+			if n > 0 {
+				device.PutMessageBuffer(bufsArrs[i])
+				bufsArrs[i] = deobfBuf
+				packet = deobfBuf[:n]
 			} else {
-				msgType = binary.LittleEndian.Uint32(packet[:4])
+				device.PutMessageBuffer(deobfBuf)
+			}
+
+			// get message padding and type based on information from S1-S4 and H1-H4
+			msgType, padding := device.DeterminePacketTypeAndPadding(packet, MessageUnknownType)
+			if padding > 0 {
+				copy(packet, packet[padding:])
+				packet = packet[:len(packet)-padding]
 			}
 
 			switch msgType {
@@ -259,7 +239,6 @@ func (device *Device) RoutineReceiveIncoming(
 			default:
 			}
 		}
-		device.awg.ASecMux.RUnlock()
 		for peer, elemsContainer := range elemsByPeer {
 			if peer.isRunning.Load() {
 				peer.queue.inbound.c <- elemsContainer
@@ -317,9 +296,6 @@ func (device *Device) RoutineHandshake(id int) {
 	device.log.Verbosef("Routine: handshake worker %d - started", id)
 
 	for elem := range device.queue.handshake.c {
-
-		device.awg.ASecMux.RLock()
-
 		// handle cookie fields and ratelimiting
 
 		switch elem.msgType {
@@ -405,6 +381,9 @@ func (device *Device) RoutineHandshake(id int) {
 				goto skip
 			}
 
+			// have to reassign msgType for ranged msgType to work
+			msg.Type = elem.msgType
+
 			// consume initiation
 			peer := device.ConsumeMessageInitiation(&msg)
 			if peer == nil {
@@ -437,6 +416,9 @@ func (device *Device) RoutineHandshake(id int) {
 				goto skip
 			}
 
+			// have to reassign msgType for ranged msgType to work
+			msg.Type = elem.msgType
+
 			// consume response
 
 			peer := device.ConsumeMessageResponse(&msg)
@@ -470,7 +452,6 @@ func (device *Device) RoutineHandshake(id int) {
 			peer.SendKeepalive()
 		}
 	skip:
-		device.awg.ASecMux.RUnlock()
 		device.PutMessageBuffer(elem.buffer)
 	}
 }
@@ -589,3 +570,77 @@ func (peer *Peer) RoutineSequentialReceiver(maxBatchSize int) {
 		device.PutInboundElementsContainer(elemsContainer)
 	}
 }
+
+func (device *Device) DeobfuscatePacket(dst, src []byte) (n int, expectedType uint32) {
+	if chain := device.dpackets.init; chain != nil && chain.Deobfuscate(dst, src) {
+		return chain.DeobfuscatedLen(len(src)), MessageInitiationType
+	}
+
+	if chain := device.dpackets.response; chain != nil && chain.Deobfuscate(dst, src) {
+		return chain.DeobfuscatedLen(len(src)), MessageResponseType
+	}
+
+	if chain := device.dpackets.cookie; chain != nil && chain.Deobfuscate(dst, src) {
+		return chain.DeobfuscatedLen(len(src)), MessageCookieReplyType
+	}
+
+	if chain := device.dpackets.transport; chain != nil && chain.Deobfuscate(dst, src) {
+		return chain.DeobfuscatedLen(len(src)), MessageTransportType
+	}
+
+	return 0, MessageUnknownType
+}
+
+func (device *Device) DeterminePacketTypeAndPadding(packet []byte, expectedType uint32) (uint32, int) {
+	size := len(packet)
+
+	if expectedType == MessageUnknownType || expectedType == MessageInitiationType {
+		padding := device.paddings.init
+		header := device.headers.init
+
+		if size == padding+MessageInitiationSize {
+			data := packet[padding:]
+			if header.Validate(binary.LittleEndian.Uint32(data)) {
+				return MessageInitiationType, padding
+			}
+		}
+	}
+
+	if expectedType == MessageUnknownType || expectedType == MessageResponseType {
+		padding := device.paddings.response
+		header := device.headers.response
+
+		if size == padding+MessageResponseSize {
+			data := packet[padding:]
+			if header.Validate(binary.LittleEndian.Uint32(data)) {
+				return MessageResponseType, padding
+			}
+		}
+	}
+
+	if expectedType == MessageUnknownType || expectedType == MessageCookieReplyType {
+		padding := device.paddings.cookie
+		header := device.headers.cookie
+
+		if size == padding+MessageCookieReplySize {
+			data := packet[padding:]
+			if header.Validate(binary.LittleEndian.Uint32(data)) {
+				return MessageCookieReplyType, padding
+			}
+		}
+	}
+
+	if expectedType == MessageUnknownType || expectedType == MessageTransportType {
+		padding := device.paddings.transport
+		header := device.headers.transport
+
+		if size >= padding+MessageTransportHeaderSize {
+			data := packet[padding:]
+			if header.Validate(binary.LittleEndian.Uint32(data)) {
+				return MessageTransportType, padding
+			}
+		}
+	}
+
+	return MessageUnknownType, 0
+}

device/send.go

@@ -7,8 +7,10 @@ package device
 
 import (
 	"bytes"
+	"crypto/rand"
 	"encoding/binary"
 	"errors"
+	"math/big"
 	"net"
 	"os"
 	"sync"
@@ -123,51 +125,28 @@ func (peer *Peer) SendHandshakeInitiation(isRetry bool) error {
 		peer.device.log.Errorf("%v - Failed to create initiation message: %v", peer, err)
 		return err
 	}
+
 	var sendBuffer [][]byte
 
-	// so only packet processed for cookie generation
-	var junkedHeader []byte
-	if peer.device.version >= VersionAwg {
-		var junks [][]byte
-		if peer.device.version == VersionAwgSpecialHandshake {
-			peer.device.awg.ASecMux.RLock()
-			// set junks depending on packet type
-			junks = peer.device.awg.HandshakeHandler.GenerateSpecialJunk()
-			if junks == nil {
-				junks = peer.device.awg.HandshakeHandler.GenerateControlledJunk()
-				if junks != nil {
-					peer.device.log.Verbosef("%v - Controlled junks sent", peer)
-				}
-			} else {
-				peer.device.log.Verbosef("%v - Special junks sent", peer)
-			}
-			peer.device.awg.ASecMux.RUnlock()
-		} else {
-			junks = make([][]byte, 0, peer.device.awg.ASecCfg.JunkPacketCount)
+	for _, ipacket := range peer.device.ipackets {
+		if ipacket != nil {
+			buf := make([]byte, ipacket.ObfuscatedLen(0))
+			ipacket.Obfuscate(buf, nil)
+			sendBuffer = append(sendBuffer, buf)
 		}
-		peer.device.awg.ASecMux.RLock()
-		err := peer.device.awg.JunkCreator.CreateJunkPackets(&junks)
-		peer.device.awg.ASecMux.RUnlock()
+	}
 
-		if err != nil {
-			peer.device.log.Errorf("%v - %v", peer, err)
-			return err
-		}
+	jc := peer.device.junk.count
+	jmin := peer.device.junk.min
+	jmax := peer.device.junk.max
 
-		if len(junks) > 0 {
-			err = peer.SendBuffers(junks)
+	for i := 0; i < jc; i++ {
+		nBig, _ := rand.Int(rand.Reader, big.NewInt(int64(jmax-jmin+1)))
+		n := int(nBig.Int64()) + jmin
 
-			if err != nil {
-				peer.device.log.Errorf("%v - Failed to send junk packets: %v", peer, err)
-				return err
-			}
-		}
-
-		junkedHeader, err = peer.device.awg.CreateInitHeaderJunk()
-		if err != nil {
-			peer.device.log.Errorf("%v - %v", peer, err)
-			return err
-		}
+		buf := make([]byte, n)
+		rand.Read(buf)
+		sendBuffer = append(sendBuffer, buf)
 	}
 
 	var buf [MessageInitiationSize]byte
@@ -175,14 +154,26 @@ func (peer *Peer) SendHandshakeInitiation(isRetry bool) error {
 	binary.Write(writer, binary.LittleEndian, msg)
 	packet := writer.Bytes()
 	peer.cookieGenerator.AddMacs(packet)
-	junkedHeader = append(junkedHeader, packet...)
 
 	peer.timersAnyAuthenticatedPacketTraversal()
 	peer.timersAnyAuthenticatedPacketSent()
 
-	sendBuffer = append(sendBuffer, junkedHeader)
+	if padding := peer.device.paddings.init; padding > 0 {
+		buf := make([]byte, padding+len(packet))
+		rand.Read(buf[:padding])
+		copy(buf[padding:], packet)
+		packet = buf
+	}
 
-	err = peer.SendAndCountBuffers(sendBuffer)
+	if chain := peer.device.dpackets.init; chain != nil {
+		buf := make([]byte, chain.ObfuscatedLen(len(packet)))
+		chain.Obfuscate(buf, packet)
+		packet = buf
+	}
+
+	sendBuffer = append(sendBuffer, packet)
+
+	err = peer.SendBuffers(sendBuffer)
 	if err != nil {
 		peer.device.log.Errorf("%v - Failed to send handshake initiation: %v", peer, err)
 	}
@@ -204,19 +195,12 @@ func (peer *Peer) SendHandshakeResponse() error {
 		return err
 	}
 
-	junkedHeader, err := peer.device.awg.CreateResponseHeaderJunk()
-	if err != nil {
-		peer.device.log.Errorf("%v - %v", peer, err)
-		return err
-	}
-
 	var buf [MessageResponseSize]byte
 	writer := bytes.NewBuffer(buf[:0])
 
 	binary.Write(writer, binary.LittleEndian, response)
 	packet := writer.Bytes()
 	peer.cookieGenerator.AddMacs(packet)
-	junkedHeader = append(junkedHeader, packet...)
 
 	err = peer.BeginSymmetricSession()
 	if err != nil {
@@ -228,43 +212,63 @@ func (peer *Peer) SendHandshakeResponse() error {
 	peer.timersAnyAuthenticatedPacketTraversal()
 	peer.timersAnyAuthenticatedPacketSent()
 
+	if padding := peer.device.paddings.response; padding > 0 {
+		buf := make([]byte, padding+len(packet))
+		rand.Read(buf[:padding])
+		copy(buf[padding:], packet)
+		packet = buf
+	}
+
+	if chain := peer.device.dpackets.response; chain != nil {
+		buf := make([]byte, chain.ObfuscatedLen(len(packet)))
+		chain.Obfuscate(buf, packet)
+		packet = buf
+	}
+
 	// TODO: allocation could be avoided
-	err = peer.SendAndCountBuffers([][]byte{junkedHeader})
+	err = peer.SendBuffers([][]byte{packet})
 	if err != nil {
 		peer.device.log.Errorf("%v - Failed to send handshake response: %v", peer, err)
 	}
 	return err
 }
 
-func (device *Device) SendHandshakeCookie(
-	initiatingElem *QueueHandshakeElement,
-) error {
+func (device *Device) SendHandshakeCookie(initiatingElem *QueueHandshakeElement) error {
 	device.log.Verbosef("Sending cookie response for denied handshake message for %v", initiatingElem.endpoint.DstToString())
 
 	sender := binary.LittleEndian.Uint32(initiatingElem.packet[4:8])
+	msgType := device.headers.cookie.Generate()
+
 	reply, err := device.cookieChecker.CreateReply(
 		initiatingElem.packet,
 		sender,
 		initiatingElem.endpoint.DstToBytes(),
+		msgType,
 	)
 	if err != nil {
 		device.log.Errorf("Failed to create cookie reply: %v", err)
 		return err
 	}
 
-	junkedHeader, err := device.awg.CreateCookieReplyHeaderJunk()
-	if err != nil {
-		device.log.Errorf("%v - %v", device, err)
-		return err
-	}
-
 	var buf [MessageCookieReplySize]byte
 	writer := bytes.NewBuffer(buf[:0])
 	binary.Write(writer, binary.LittleEndian, reply)
+	packet := writer.Bytes()
 
-	junkedHeader = append(junkedHeader, writer.Bytes()...)
+	if padding := device.paddings.cookie; padding > 0 {
+		buf := make([]byte, padding+len(packet))
+		rand.Read(buf[:padding])
+		copy(buf[padding:], packet)
+		packet = buf
+	}
+
+	if chain := device.dpackets.cookie; chain != nil {
+		buf := make([]byte, chain.ObfuscatedLen(len(packet)))
+		chain.Obfuscate(buf, packet)
+		packet = buf
+	}
 	// TODO: allocation could be avoided
-	device.net.bind.Send([][]byte{junkedHeader}, initiatingElem.endpoint)
+	device.net.bind.Send([][]byte{packet}, initiatingElem.endpoint)
 	return nil
 }
 
@@ -528,7 +532,9 @@ func (device *Device) RoutineEncryption(id int) {
 			fieldReceiver := header[4:8]
 			fieldNonce := header[8:16]
 
-			binary.LittleEndian.PutUint32(fieldType, MessageTransportType)
+			msgType := device.headers.transport.Generate()
+
+			binary.LittleEndian.PutUint32(fieldType, msgType)
 			binary.LittleEndian.PutUint32(fieldReceiver, elem.keypair.remoteIndex)
 			binary.LittleEndian.PutUint64(fieldNonce, elem.nonce)
 
@@ -586,13 +592,24 @@ func (peer *Peer) RoutineSequentialSender(maxBatchSize int) {
 			if len(elem.packet) != MessageKeepaliveSize {
 				dataSent = true
 
-				junkedHeader, err := device.awg.CreateTransportHeaderJunk(len(elem.packet))
-				if err != nil {
-					device.log.Errorf("%v - %v", device, err)
-					continue
+				if padding := device.paddings.transport; padding > 0 {
+					// elem.packet is stored at the start of elem.buffer
+					// with zero padding
+					for i := len(elem.packet) - 1; i >= 0; i-- {
+						elem.buffer[i+padding] = elem.buffer[i]
+					}
+					rand.Read(elem.buffer[:padding])
+					elem.packet = elem.buffer[:padding+len(elem.packet)]
 				}
 
-				elem.packet = append(junkedHeader, elem.packet...)
+				if chain := peer.device.dpackets.transport; chain != nil {
+					buf := device.GetMessageBuffer()
+					len := chain.ObfuscatedLen(len(elem.packet))
+					chain.Obfuscate(buf[:], elem.packet)
+					device.PutMessageBuffer(elem.buffer)
+					elem.packet = buf[:len]
+					elem.buffer = buf
+				}
 			}
 			bufs = append(bufs, elem.packet)
 		}
@@ -600,7 +617,7 @@ func (peer *Peer) RoutineSequentialSender(maxBatchSize int) {
 		peer.timersAnyAuthenticatedPacketTraversal()
 		peer.timersAnyAuthenticatedPacketSent()
 
-		err := peer.SendAndCountBuffers(bufs)
+		err := peer.SendBuffers(bufs)
 		if dataSent {
 			peer.timersDataSent()
 		}

device/uapi.go

@@ -18,7 +18,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/amnezia-vpn/amneziawg-go/device/awg"
 	"github.com/amnezia-vpn/amneziawg-go/ipc"
 )
 
@@ -98,54 +97,72 @@ func (device *Device) IpcGetOperation(w io.Writer) error {
 			sendf("fwmark=%d", device.net.fwmark)
 		}
 
-		if device.isAWG() {
-			if device.awg.ASecCfg.JunkPacketCount != 0 {
-				sendf("jc=%d", device.awg.ASecCfg.JunkPacketCount)
-			}
-			if device.awg.ASecCfg.JunkPacketMinSize != 0 {
-				sendf("jmin=%d", device.awg.ASecCfg.JunkPacketMinSize)
-			}
-			if device.awg.ASecCfg.JunkPacketMaxSize != 0 {
-				sendf("jmax=%d", device.awg.ASecCfg.JunkPacketMaxSize)
-			}
-			if device.awg.ASecCfg.InitHeaderJunkSize != 0 {
-				sendf("s1=%d", device.awg.ASecCfg.InitHeaderJunkSize)
-			}
-			if device.awg.ASecCfg.ResponseHeaderJunkSize != 0 {
-				sendf("s2=%d", device.awg.ASecCfg.ResponseHeaderJunkSize)
-			}
-			if device.awg.ASecCfg.CookieReplyHeaderJunkSize != 0 {
-				sendf("s3=%d", device.awg.ASecCfg.CookieReplyHeaderJunkSize)
-			}
-			if device.awg.ASecCfg.TransportHeaderJunkSize != 0 {
-				sendf("s4=%d", device.awg.ASecCfg.TransportHeaderJunkSize)
-			}
-			if device.awg.ASecCfg.InitPacketMagicHeader != 0 {
-				sendf("h1=%d", device.awg.ASecCfg.InitPacketMagicHeader)
-			}
-			if device.awg.ASecCfg.ResponsePacketMagicHeader != 0 {
-				sendf("h2=%d", device.awg.ASecCfg.ResponsePacketMagicHeader)
-			}
-			if device.awg.ASecCfg.UnderloadPacketMagicHeader != 0 {
-				sendf("h3=%d", device.awg.ASecCfg.UnderloadPacketMagicHeader)
-			}
-			if device.awg.ASecCfg.TransportPacketMagicHeader != 0 {
-				sendf("h4=%d", device.awg.ASecCfg.TransportPacketMagicHeader)
-			}
+		if device.junk.count != 0 {
+			sendf("jc=%d", device.junk.count)
+		}
 
-			specialJunkIpcFields := device.awg.HandshakeHandler.SpecialJunk.IpcGetFields()
-			for _, field := range specialJunkIpcFields {
-				sendf("%s=%s", field.Key, field.Value)
-			}
-			controlledJunkIpcFields := device.awg.HandshakeHandler.ControlledJunk.IpcGetFields()
-			for _, field := range controlledJunkIpcFields {
-				sendf("%s=%s", field.Key, field.Value)
-			}
-			if device.awg.HandshakeHandler.ITimeout != 0 {
-				sendf("itime=%d", device.awg.HandshakeHandler.ITimeout/time.Second)
+		if device.junk.min != 0 {
+			sendf("jmin=%d", device.junk.min)
+		}
+
+		if device.junk.max != 0 {
+			sendf("jmax=%d", device.junk.max)
+		}
+
+		if device.paddings.init != 0 {
+			sendf("s1=%d", device.paddings.init)
+		}
+
+		if device.paddings.response != 0 {
+			sendf("s2=%d", device.paddings.response)
+		}
+
+		if device.paddings.cookie != 0 {
+			sendf("s3=%d", device.paddings.cookie)
+		}
+
+		if device.paddings.transport != 0 {
+			sendf("s4=%d", device.paddings.transport)
+		}
+
+		if device.headers.init != nil {
+			sendf("h1=%s", device.headers.init.GenSpec())
+		}
+
+		if device.headers.response != nil {
+			sendf("h2=%s", device.headers.response.GenSpec())
+		}
+
+		if device.headers.cookie != nil {
+			sendf("h3=%s", device.headers.cookie.GenSpec())
+		}
+
+		if device.headers.transport != nil {
+			sendf("h4=%s", device.headers.transport.GenSpec())
+		}
+
+		for i, ipacket := range device.ipackets {
+			if ipacket != nil {
+				sendf("i%d=%s", i+1, ipacket.Spec)
 			}
 		}
 
+		if device.dpackets.init != nil {
+			sendf("di=%s", device.dpackets.init.Spec)
+		}
+
+		if device.dpackets.response != nil {
+			sendf("dr=%s", device.dpackets.response.Spec)
+		}
+
+		if device.dpackets.cookie != nil {
+			sendf("dc=%s", device.dpackets.cookie.Spec)
+		}
+
+		if device.dpackets.transport != nil {
+			sendf("dt=%s", device.dpackets.transport.Spec)
+		}
+
 		for _, peer := range device.peers.keyMap {
 			// Serialize peer state.
 			peer.handshake.mutex.RLock()
@@ -196,16 +213,16 @@ func (device *Device) IpcSetOperation(r io.Reader) (err error) {
 		}
 	}()
 
+	ipcDev := new(ipcSetDevice)
 	peer := new(ipcSetPeer)
 	deviceConfig := true
 
-	tempAwg := awg.Protocol{}
 	scanner := bufio.NewScanner(r)
 	for scanner.Scan() {
 		line := scanner.Text()
 		if line == "" {
 			// Blank line means terminate operation.
-			err := device.handlePostConfig(&tempAwg)
+			err := ipcDev.mergeWithDevice(device)
 			if err != nil {
 				return err
 			}
@@ -236,7 +253,7 @@ func (device *Device) IpcSetOperation(r io.Reader) (err error) {
 
 		var err error
 		if deviceConfig {
-			err = device.handleDeviceLine(key, value, &tempAwg)
+			err = device.handleDeviceLine(key, value)
 		} else {
 			err = device.handlePeerLine(peer, key, value)
 		}
@@ -244,7 +261,7 @@ func (device *Device) IpcSetOperation(r io.Reader) (err error) {
 			return err
 		}
 	}
-	err = device.handlePostConfig(&tempAwg)
+	err = ipcDev.mergeWithDevice(device)
 	if err != nil {
 		return err
 	}
@@ -256,7 +273,7 @@ func (device *Device) IpcSetOperation(r io.Reader) (err error) {
 	return nil
 }
 
-func (device *Device) handleDeviceLine(key, value string, tempAwg *awg.Protocol) error {
+func (device *Device) handleDeviceLine(key, value string) error {
 	switch key {
 	case "private_key":
 		var sk NoisePrivateKey
@@ -307,140 +324,177 @@ func (device *Device) handleDeviceLine(key, value string, tempAwg *awg.Protocol)
 		device.RemoveAllPeers()
 
 	case "jc":
-		junkPacketCount, err := strconv.Atoi(value)
+		jc, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse junk_packet_count %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse jc: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating junk_packet_count")
-		tempAwg.ASecCfg.JunkPacketCount = junkPacketCount
-		tempAwg.ASecCfg.IsSet = true
+		if jc <= 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "jc must be a positive value")
+		}
+		device.log.Verbosef("UAPI: Updating junk count")
+		device.junk.count = jc
 
 	case "jmin":
-		junkPacketMinSize, err := strconv.Atoi(value)
+		jmin, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse junk_packet_min_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse jmin: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating junk_packet_min_size")
-		tempAwg.ASecCfg.JunkPacketMinSize = junkPacketMinSize
-		tempAwg.ASecCfg.IsSet = true
+		if jmin <= 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "jmin must be a positive value")
+		}
+		device.log.Verbosef("UAPI: Updating junk min")
+		device.junk.min = jmin
 
 	case "jmax":
-		junkPacketMaxSize, err := strconv.Atoi(value)
+		jmax, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse junk_packet_max_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse jmax: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating junk_packet_max_size")
-		tempAwg.ASecCfg.JunkPacketMaxSize = junkPacketMaxSize
-		tempAwg.ASecCfg.IsSet = true
+		if jmax <= 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "jmax must be a positive value")
+		}
+		device.log.Verbosef("UAPI: Updating junk max")
+		device.junk.max = jmax
 
 	case "s1":
-		initPacketJunkSize, err := strconv.Atoi(value)
+		padding, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse init_packet_junk_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse s1: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating init_packet_junk_size")
-		tempAwg.ASecCfg.InitHeaderJunkSize = initPacketJunkSize
-		tempAwg.ASecCfg.IsSet = true
+		if padding < 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "s1 must be non-negative")
+		}
+		device.log.Verbosef("UAPI: Updating s1 padding")
+		device.paddings.init = padding
 
 	case "s2":
-		responsePacketJunkSize, err := strconv.Atoi(value)
+		padding, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse response_packet_junk_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse s2: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating response_packet_junk_size")
-		tempAwg.ASecCfg.ResponseHeaderJunkSize = responsePacketJunkSize
-		tempAwg.ASecCfg.IsSet = true
+		if padding < 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "s2 must be non-negative")
+		}
+		device.log.Verbosef("UAPI: Updating s2 padding")
+		device.paddings.response = padding
 
 	case "s3":
-		cookieReplyPacketJunkSize, err := strconv.Atoi(value)
+		padding, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse cookie_reply_packet_junk_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse s3: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating cookie_reply_packet_junk_size")
-		tempAwg.ASecCfg.CookieReplyHeaderJunkSize = cookieReplyPacketJunkSize
-		tempAwg.ASecCfg.IsSet = true
+		if padding < 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "s3 must be non-negative")
+		}
+		device.log.Verbosef("UAPI: Updating s3 padding")
+		device.paddings.cookie = padding
 
 	case "s4":
-		transportPacketJunkSize, err := strconv.Atoi(value)
+		padding, err := strconv.Atoi(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse transport_packet_junk_size %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse s4: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating transport_packet_junk_size")
-		tempAwg.ASecCfg.TransportHeaderJunkSize = transportPacketJunkSize
-		tempAwg.ASecCfg.IsSet = true
+		if padding < 0 {
+			return ipcErrorf(ipc.IpcErrorInvalid, "s4 must be non-negative")
+		}
+		device.log.Verbosef("UAPI: Updating s4 padding")
+		device.paddings.transport = padding
 
 	case "h1":
-		initPacketMagicHeader, err := strconv.ParseUint(value, 10, 32)
+		header, err := newMagicHeader(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse init_packet_magic_header %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse H1: %w", err)
 		}
-		tempAwg.ASecCfg.InitPacketMagicHeader = uint32(initPacketMagicHeader)
-		tempAwg.ASecCfg.IsSet = true
+		device.headers.init = header
 
 	case "h2":
-		responsePacketMagicHeader, err := strconv.ParseUint(value, 10, 32)
+		header, err := newMagicHeader(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse response_packet_magic_header %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse H2: %w", err)
 		}
-		tempAwg.ASecCfg.ResponsePacketMagicHeader = uint32(responsePacketMagicHeader)
-		tempAwg.ASecCfg.IsSet = true
+		device.headers.response = header
 
 	case "h3":
-		underloadPacketMagicHeader, err := strconv.ParseUint(value, 10, 32)
+		header, err := newMagicHeader(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse underload_packet_magic_header %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse H3: %w", err)
 		}
-		tempAwg.ASecCfg.UnderloadPacketMagicHeader = uint32(underloadPacketMagicHeader)
-		tempAwg.ASecCfg.IsSet = true
+		device.headers.cookie = header
 
 	case "h4":
-		transportPacketMagicHeader, err := strconv.ParseUint(value, 10, 32)
+		header, err := newMagicHeader(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse transport_packet_magic_header %w", err)
-		}
-		tempAwg.ASecCfg.TransportPacketMagicHeader = uint32(transportPacketMagicHeader)
-		tempAwg.ASecCfg.IsSet = true
-	case "i1", "i2", "i3", "i4", "i5":
-		if len(value) == 0 {
-			device.log.Verbosef("UAPI: received empty %s", key)
-			return nil
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse H4: %w", err)
 		}
+		device.headers.transport = header
 
-		generators, err := awg.Parse(key, value)
+	case "i1":
+		chain, err := newObfChain(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "invalid %s: %w", key, err)
-		}
-		device.log.Verbosef("UAPI: Updating %s", key)
-		tempAwg.HandshakeHandler.SpecialJunk.AppendGenerator(generators)
-		tempAwg.HandshakeHandler.IsSet = true
-	case "j1", "j2", "j3":
-		if len(value) == 0 {
-			device.log.Verbosef("UAPI: received empty %s", key)
-			return nil
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse I1: %w", err)
 		}
+		device.ipackets[0] = chain
 
-		generators, err := awg.Parse(key, value)
+	case "i2":
+		chain, err := newObfChain(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "invalid %s: %w", key, err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse I2: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating %s", key)
+		device.ipackets[1] = chain
 
-		tempAwg.HandshakeHandler.ControlledJunk.AppendGenerator(generators)
-		tempAwg.HandshakeHandler.IsSet = true
-	case "itime":
-		if len(value) == 0 {
-			device.log.Verbosef("UAPI: received empty itime")
-			return nil
-		}
-
-		itime, err := strconv.ParseInt(value, 10, 64)
+	case "i3":
+		chain, err := newObfChain(value)
 		if err != nil {
-			return ipcErrorf(ipc.IpcErrorInvalid, "parse itime %w", err)
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse I3: %w", err)
 		}
-		device.log.Verbosef("UAPI: Updating itime")
+		device.ipackets[2] = chain
+
+	case "i4":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse I4: %w", err)
+		}
+		device.ipackets[3] = chain
+
+	case "i5":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse I5: %w", err)
+		}
+		device.ipackets[4] = chain
+
+	case "di":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse DI: %w", err)
+		}
+		device.log.Verbosef("UAPI: Set DI format")
+		device.dpackets.init = chain
+
+	case "dr":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse DR: %w", err)
+		}
+		device.log.Verbosef("UAPI: Set DR format")
+		device.dpackets.response = chain
+
+	case "dc":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse DC: %w", err)
+		}
+		device.log.Verbosef("UAPI: Set DC format")
+		device.dpackets.cookie = chain
+
+	case "dt":
+		chain, err := newObfChain(value)
+		if err != nil {
+			return ipcErrorf(ipc.IpcErrorInvalid, "failed to parse DT: %w", err)
+		}
+		device.log.Verbosef("UAPI: Set DT format")
+		device.dpackets.transport = chain
 
-		tempAwg.HandshakeHandler.ITimeout = time.Duration(itime) * time.Second
-		tempAwg.HandshakeHandler.IsSet = true
 	default:
 		return ipcErrorf(ipc.IpcErrorInvalid, "invalid UAPI device key: %v", key)
 	}
@@ -689,3 +743,49 @@ func (device *Device) IpcHandle(socket net.Conn) {
 		buffered.Flush()
 	}
 }
+
+type ipcSetDevice struct {
+	headers struct {
+		init      *magicHeader
+		response  *magicHeader
+		cookie    *magicHeader
+		transport *magicHeader
+	}
+}
+
+func (d *ipcSetDevice) mergeWithDevice(device *Device) error {
+	if d.headers.init == nil {
+		d.headers.init = device.headers.init
+	}
+
+	if d.headers.response == nil {
+		d.headers.response = device.headers.response
+	}
+
+	if d.headers.cookie == nil {
+		d.headers.cookie = device.headers.cookie
+	}
+
+	if d.headers.transport == nil {
+		d.headers.transport = device.headers.transport
+	}
+
+	headers := []*magicHeader{d.headers.init, d.headers.response, d.headers.cookie, d.headers.transport}
+	for i := 0; i < len(headers); i++ {
+		for j := i + 1; j < len(headers); j++ {
+			left := headers[i]
+			right := headers[j]
+
+			if left.start <= right.end && right.start <= left.end {
+				return errors.New("headers must not overlap")
+			}
+		}
+	}
+
+	device.headers.init = d.headers.init
+	device.headers.response = d.headers.response
+	device.headers.cookie = d.headers.cookie
+	device.headers.transport = d.headers.transport
+
+	return nil
+}

go.mod

@@ -5,9 +5,9 @@ go 1.24.4
 require (
 	github.com/stretchr/testify v1.10.0
 	github.com/tevino/abool v1.2.0
-	github.com/tevino/abool/v2 v2.1.0
 	go.uber.org/atomic v1.11.0
 	golang.org/x/crypto v0.39.0
+	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
 	golang.org/x/net v0.41.0
 	golang.org/x/sys v0.33.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2

go.sum

@@ -2,24 +2,18 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tevino/abool v1.2.0 h1:heAkClL8H6w+mK5md9dzsuohKeXHUpY7Vw0ZCKW+huA=
 github.com/tevino/abool v1.2.0/go.mod h1:qc66Pna1RiIsPa7O4Egxxs9OqkuxDX55zznh9K07Tzg=
-github.com/tevino/abool/v2 v2.1.0 h1:7w+Vf9f/5gmKT4m4qkayb33/92M+Um45F2BkHOR+L/c=
-github.com/tevino/abool/v2 v2.1.0/go.mod h1:+Lmlqk6bHDWHqN1cbxqhwEAwMPXgc8I1SDEamtseuXY=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
 golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
-golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
+golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
 golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
@@ -34,7 +28,3 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gvisor.dev/gvisor v0.0.0-20231202080848-1f7806d17489 h1:ze1vwAdliUAr68RQ5NtufWaXaOg8WUO2OACzEV+TNdE=
 gvisor.dev/gvisor v0.0.0-20231202080848-1f7806d17489/go.mod h1:10sU+Uh5KKNv1+2x2A0Gvzt8FjD3ASIhorV3YsauXhk=
-gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5 h1:sfK5nHuG7lRFZ2FdTT3RimOqWBg8IrVm+/Vko1FVOsk=
-gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
-gvisor.dev/gvisor v0.0.0-20250606233247-e3c4c4cad86f h1:zmc4cHEcCudRt2O8VsCW7nYLfAsbVY2i910/DAop1TM=
-gvisor.dev/gvisor v0.0.0-20250606233247-e3c4c4cad86f/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=