From 0e30f2fe0e2313695df35b57e532a0196ddcecf0 Mon Sep 17 00:00:00 2001 From: Dylan Bargatze Date: Wed, 16 Sep 2026 13:07:36 -0400 Subject: [PATCH] ts_dataplane: fix incorrect reserved_zero field check, increase min pkt len `could_be_wireguard()` was expecting four bytes of zeroes in valid WireGuard packets starting at idx 1; the `reserved_zeroes` field in every WireGuard packet is _three_ bytes of zeroes, starting at idx 1. This was misclassifying any WireGuard packet with a non-zero byte at idx 4 (top byte of the receiver/sender index field, depending on message type) as not WireGuard. Impact was minimal, as we currently process `PacketType::Unknown` and `PacketType::WireGuard` identically anyway in `DataPlane::process_inbound()`. Also increases the min packet size to 16 bytes, since no valid WireGuard packet will be smaller. Signed-off-by: Dylan Bargatze --- ts_dataplane/src/packet_ident.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ts_dataplane/src/packet_ident.rs b/ts_dataplane/src/packet_ident.rs index 89f129e8..02093cc4 100644 --- a/ts_dataplane/src/packet_ident.rs +++ b/ts_dataplane/src/packet_ident.rs @@ -103,7 +103,8 @@ impl PacketIdent { /// Checks certain invariants that must be true if this is Wireguard; does not establish /// conclusive proof. pub fn could_be_wireguard(pkt: &[u8]) -> bool { - if pkt.len() < 5 { + // The smallest valid WireGuard packet is a `packet_data` message with a zero-byte payload. + if pkt.len() < 16 { return false; } @@ -112,7 +113,7 @@ impl PacketIdent { return false; } - [0u8; 4] == pkt[1..=4] + [0u8; 3] == pkt[1..=3] } }