Leadaxe：sing-box-lx 调整 AmneziaWG 经 detour 的伪装包处理

Leadaxe 表示，sing-box-lx 已在 c7f24d3f8 实现 lx.awg_masquerade 的 direct（默认）与 all 模式：默认情况下，经代理或隧道 detour 时去掉握手前的诱饵包、i1 至 i5 和 Jc 垃圾包，仅发送握手初始化包，保留 S1 至 S4、H1 至 H4、头部保护、填充和尾部内容。lx.quic_sniff_decoy 也扩展到 AmneziaWG，在所选路径的 QUIC 形状伪装包前加入单字节数据报。作者称单元测试和构建已通过；这条实现说明发布时，Xray 验证环境和设备运行尚未完成。

作者原文@Leadaxe
Implemented in c7f24d3f8 (fork gitlink Leadaxe/wireguard-go-awg2-lx@9115d90), SPEC 153.
lx.awg_masquerade: "direct" (default) / "all", boolean accepted and written back as the mode, anything else is a load error. Over a detour the whole burst (per-handshake decoy, i1…i5, Jc junk) is dropped and the initiation goes alone; S1–S4, H1–H4, header protection, padding and trailers are not touched.
lx.quic_sniff_decoy now reaches the AmneziaWG handshake: when a burst is sent and starts with a QUIC-shaped packet (ip=quic, or a static i1), the byte precedes it on the paths the mode selects. dns/stun/sip and junk get no byte.
Fork: one hook, SetHandshakeBurstFunc — SendHandshakeInitiation assembles the burst as bare payloads, offers it to the filter, and only what comes back gets the transport headroom. Policy lives in transport/wireguard/handshake_burst_lx.go; the path is classified by ClientBind on its own socket at connect (the same kernel-socket check SPEC 151 uses), StdNetBind is always kernel.
Units: fork burst order and filter semantics, every row of the interaction table, the bind path probe (system dialer vs a pipe-carried conn), option parsing. Build under LX_TAGS and without with_awg is green; sing-box check accepts "all"/true and rejects "detour".
Not done: the Xray stand from the Verification section (steps 1–7) and a device run. Leaving the issue open until that passes.

返回动态列表查看原文