From 6c81ddd00ff3891809d66916db1cfd6147b60c8e Mon Sep 17 00:00:00 2001
From: Shtorm <108103062+shtorm-7@users.noreply.github.com>
Date: Sat, 8 Aug 2026 10:11:01 +0300
Subject: [PATCH] Fix Wireguard options

---
 examples/amnezia/client.json            | 11 +++---
 examples/unified_delay/client.json      |  6 +---
 examples/warp/client.json               | 18 ++++------
 option/warp.go                          | 19 ++++++++++-
 option/wireguard.go                     | 43 ++++++++++++-----------
 protocol/warp/endpoint.go               | 21 +++++++++++-
 protocol/wireguard/endpoint.go          | 43 ++++++++++++-----------
 transport/wireguard/endpoint.go         | 29 +++++++++++-----
 transport/wireguard/endpoint_options.go | 45 +++++++++++++------------
 9 files changed, 143 insertions(+), 92 deletions(-)

diff --git a/examples/amnezia/client.json b/examples/amnezia/client.json
index 2d5994d4..35e3de3e 100644
--- a/examples/amnezia/client.json
+++ b/examples/amnezia/client.json
@@ -44,10 +44,13 @@
         "i3": "<b 0xc70000000108...",
         "i4": "<b 0xc70000000108...",
         "i5": "<b 0xc70000000108...",
-        "j1": "<b 0xc70000000108...",
-        "j2": "<b 0xc70000000108...",
-        "j3": "<b 0xc70000000108...",
-        "itime": 50,
+        "header_protection_key": "QGg8AFRn6qKfTB7cT3FWH1WGx3np+OKzlNuQUrqIBmI=",
+        "content_padding_addition": "50-100",
+        "rekey_after_time": 120,
+        "rekey_timeout": 5,
+        "reject_after_time": 180,
+        "keepalive_timeout": 10,
+        "max_handshake_attempts": 20
       }
     }
   ],
diff --git a/examples/unified_delay/client.json b/examples/unified_delay/client.json
index e408441e..1540b2ca 100644
--- a/examples/unified_delay/client.json
+++ b/examples/unified_delay/client.json
@@ -19,11 +19,7 @@
       "amnezia": {
         "jc": 120,
         "jmin": 23,
-        "jmax": 911,
-        "h1": 1,
-        "h2": 2,
-        "h3": 3,
-        "h4": 4
+        "jmax": 911
       },
       "profile": {
         "detour": "direct"
diff --git a/examples/warp/client.json b/examples/warp/client.json
index 467da408..cfcdc528 100644
--- a/examples/warp/client.json
+++ b/examples/warp/client.json
@@ -26,23 +26,17 @@
         "jc": 120,
         "jmin": 23,
         "jmax": 911,
-        "s1": 1,
-        "s2": 2,
-        "s3": 3,
-        "s4": 4,
-        "h1": 1,
-        "h2": 2,
-        "h3": 3,
-        "h4": 4,
         "i1": "<b 0xc70000000108...",
         "i2": "<b 0xc70000000108...",
         "i3": "<b 0xc70000000108...",
         "i4": "<b 0xc70000000108...",
         "i5": "<b 0xc70000000108...",
-        "j1": "<b 0xc70000000108...",
-        "j2": "<b 0xc70000000108...",
-        "j3": "<b 0xc70000000108...",
-        "itime": 50
+        "content_padding_addition": "50-100",
+        "rekey_after_time": 120,
+        "rekey_timeout": 5,
+        "reject_after_time": 180,
+        "keepalive_timeout": 10,
+        "max_handshake_attempts": 20
       },
       "profile": {
         "detour": "direct",
diff --git a/option/warp.go b/option/warp.go
index 4a1245f7..399e944e 100644
--- a/option/warp.go
+++ b/option/warp.go
@@ -11,7 +11,24 @@ type WARPEndpointOptions struct {
 	Workers                     int                `json:"workers,omitempty"`
 	PreallocatedBuffersPerPool  uint32             `json:"preallocated_buffers_per_pool,omitempty"`
 	DisablePauses               bool               `json:"disable_pauses,omitempty"`
-	Amnezia                     *WireGuardAmnezia  `json:"amnezia,omitempty"`
+	Amnezia                     *WARPAmnezia       `json:"amnezia,omitempty"`
 	Profile                     CloudflareProfile  `json:"profile,omitempty"`
 	DialerOptions
 }
+
+type WARPAmnezia struct {
+	JC                     int                      `json:"jc,omitempty"`
+	JMin                   int                      `json:"jmin,omitempty"`
+	JMax                   int                      `json:"jmax,omitempty"`
+	I1                     string                   `json:"i1,omitempty"`
+	I2                     string                   `json:"i2,omitempty"`
+	I3                     string                   `json:"i3,omitempty"`
+	I4                     string                   `json:"i4,omitempty"`
+	I5                     string                   `json:"i5,omitempty"`
+	ContentPaddingAddition *badoption.Range[uint32] `json:"content_padding_addition,omitempty"`
+	RekeyAfterTime         *badoption.Range[uint32] `json:"rekey_after_time,omitempty"`
+	RekeyTimeout           *badoption.Range[uint32] `json:"rekey_timeout,omitempty"`
+	RejectAfterTime        *badoption.Range[uint32] `json:"reject_after_time,omitempty"`
+	KeepaliveTimeout       *badoption.Range[uint32] `json:"keepalive_timeout,omitempty"`
+	MaxHandshakeAttempts   *badoption.Range[uint32] `json:"max_handshake_attempts,omitempty"`
+}
diff --git a/option/wireguard.go b/option/wireguard.go
index d32e6eb2..cf003f2e 100644
--- a/option/wireguard.go
+++ b/option/wireguard.go
@@ -32,24 +32,27 @@ type WireGuardPeer struct {
 }
 
 type WireGuardAmnezia struct {
-	JC    int               `json:"jc,omitempty"`
-	JMin  int               `json:"jmin,omitempty"`
-	JMax  int               `json:"jmax,omitempty"`
-	S1    int               `json:"s1,omitempty"`
-	S2    int               `json:"s2,omitempty"`
-	S3    int               `json:"s3,omitempty"`
-	S4    int               `json:"s4,omitempty"`
-	H1    *badoption.Range[uint32] `json:"h1,omitempty"`
-	H2    *badoption.Range[uint32] `json:"h2,omitempty"`
-	H3    *badoption.Range[uint32] `json:"h3,omitempty"`
-	H4    *badoption.Range[uint32] `json:"h4,omitempty"`
-	I1    string            `json:"i1,omitempty"`
-	I2    string            `json:"i2,omitempty"`
-	I3    string            `json:"i3,omitempty"`
-	I4    string            `json:"i4,omitempty"`
-	I5    string            `json:"i5,omitempty"`
-	J1    string            `json:"j1,omitempty"`
-	J2    string            `json:"j2,omitempty"`
-	J3    string            `json:"j3,omitempty"`
-	ITime int64             `json:"itime,omitempty"`
+	JC                     int                      `json:"jc,omitempty"`
+	JMin                   int                      `json:"jmin,omitempty"`
+	JMax                   int                      `json:"jmax,omitempty"`
+	S1                     int                      `json:"s1,omitempty"`
+	S2                     int                      `json:"s2,omitempty"`
+	S3                     int                      `json:"s3,omitempty"`
+	S4                     int                      `json:"s4,omitempty"`
+	H1                     *badoption.Range[uint32] `json:"h1,omitempty"`
+	H2                     *badoption.Range[uint32] `json:"h2,omitempty"`
+	H3                     *badoption.Range[uint32] `json:"h3,omitempty"`
+	H4                     *badoption.Range[uint32] `json:"h4,omitempty"`
+	I1                     string                   `json:"i1,omitempty"`
+	I2                     string                   `json:"i2,omitempty"`
+	I3                     string                   `json:"i3,omitempty"`
+	I4                     string                   `json:"i4,omitempty"`
+	I5                     string                   `json:"i5,omitempty"`
+	HeaderProtectionKey    string                   `json:"header_protection_key,omitempty"`
+	ContentPaddingAddition *badoption.Range[uint32] `json:"content_padding_addition,omitempty"`
+	RekeyAfterTime         *badoption.Range[uint32] `json:"rekey_after_time,omitempty"`
+	RekeyTimeout           *badoption.Range[uint32] `json:"rekey_timeout,omitempty"`
+	RejectAfterTime        *badoption.Range[uint32] `json:"reject_after_time,omitempty"`
+	KeepaliveTimeout       *badoption.Range[uint32] `json:"keepalive_timeout,omitempty"`
+	MaxHandshakeAttempts   *badoption.Range[uint32] `json:"max_handshake_attempts,omitempty"`
 }
diff --git a/protocol/warp/endpoint.go b/protocol/warp/endpoint.go
index 10cdf2c3..997ace68 100644
--- a/protocol/warp/endpoint.go
+++ b/protocol/warp/endpoint.go
@@ -88,6 +88,25 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 		}
 		peer := config.Peers[0]
 		hostParts := strings.Split(peer.Endpoint.Host, ":")
+		var amnezia *option.WireGuardAmnezia
+		if options.Amnezia != nil {
+			amnezia = &option.WireGuardAmnezia{
+				JC:                     options.Amnezia.JC,
+				JMin:                   options.Amnezia.JMin,
+				JMax:                   options.Amnezia.JMax,
+				I1:                     options.Amnezia.I1,
+				I2:                     options.Amnezia.I2,
+				I3:                     options.Amnezia.I3,
+				I4:                     options.Amnezia.I4,
+				I5:                     options.Amnezia.I5,
+				ContentPaddingAddition: options.Amnezia.ContentPaddingAddition,
+				RekeyAfterTime:         options.Amnezia.RekeyAfterTime,
+				RekeyTimeout:           options.Amnezia.RekeyTimeout,
+				RejectAfterTime:        options.Amnezia.RejectAfterTime,
+				KeepaliveTimeout:       options.Amnezia.KeepaliveTimeout,
+				MaxHandshakeAttempts:   options.Amnezia.MaxHandshakeAttempts,
+			}
+		}
 		endpoint.endpoint, err = wireguard.NewEndpoint(
 			ctx,
 			router,
@@ -101,7 +120,7 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 				Workers:                    options.Workers,
 				PreallocatedBuffersPerPool: options.PreallocatedBuffersPerPool,
 				DisablePauses:              options.DisablePauses,
-				Amnezia:                    options.Amnezia,
+				Amnezia:                    amnezia,
 				DialerOptions:              options.DialerOptions,
 
 				Address: badoption.Listable[netip.Prefix]{
diff --git a/protocol/wireguard/endpoint.go b/protocol/wireguard/endpoint.go
index b20f4580..9a4a7d9d 100644
--- a/protocol/wireguard/endpoint.go
+++ b/protocol/wireguard/endpoint.go
@@ -77,26 +77,29 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 	var amnezia *wireguard.AmneziaOptions
 	if options.Amnezia != nil {
 		amnezia = &wireguard.AmneziaOptions{
-			JC:    options.Amnezia.JC,
-			JMin:  options.Amnezia.JMin,
-			JMax:  options.Amnezia.JMax,
-			S1:    options.Amnezia.S1,
-			S2:    options.Amnezia.S2,
-			S3:    options.Amnezia.S3,
-			S4:    options.Amnezia.S4,
-			H1:    options.Amnezia.H1,
-			H2:    options.Amnezia.H2,
-			H3:    options.Amnezia.H3,
-			H4:    options.Amnezia.H4,
-			I1:    options.Amnezia.I1,
-			I2:    options.Amnezia.I2,
-			I3:    options.Amnezia.I3,
-			I4:    options.Amnezia.I4,
-			I5:    options.Amnezia.I5,
-			J1:    options.Amnezia.J1,
-			J2:    options.Amnezia.J2,
-			J3:    options.Amnezia.J3,
-			ITime: options.Amnezia.ITime,
+			JC:                     options.Amnezia.JC,
+			JMin:                   options.Amnezia.JMin,
+			JMax:                   options.Amnezia.JMax,
+			S1:                     options.Amnezia.S1,
+			S2:                     options.Amnezia.S2,
+			S3:                     options.Amnezia.S3,
+			S4:                     options.Amnezia.S4,
+			H1:                     options.Amnezia.H1,
+			H2:                     options.Amnezia.H2,
+			H3:                     options.Amnezia.H3,
+			H4:                     options.Amnezia.H4,
+			I1:                     options.Amnezia.I1,
+			I2:                     options.Amnezia.I2,
+			I3:                     options.Amnezia.I3,
+			I4:                     options.Amnezia.I4,
+			I5:                     options.Amnezia.I5,
+			HeaderProtectionKey:    options.Amnezia.HeaderProtectionKey,
+			ContentPaddingAddition: options.Amnezia.ContentPaddingAddition,
+			RekeyAfterTime:         options.Amnezia.RekeyAfterTime,
+			RekeyTimeout:           options.Amnezia.RekeyTimeout,
+			RejectAfterTime:        options.Amnezia.RejectAfterTime,
+			KeepaliveTimeout:       options.Amnezia.KeepaliveTimeout,
+			MaxHandshakeAttempts:   options.Amnezia.MaxHandshakeAttempts,
 		}
 	}
 	wgEndpoint, err := wireguard.NewEndpoint(wireguard.EndpointOptions{
diff --git a/transport/wireguard/endpoint.go b/transport/wireguard/endpoint.go
index a875cf64..648d73f2 100644
--- a/transport/wireguard/endpoint.go
+++ b/transport/wireguard/endpoint.go
@@ -235,17 +235,30 @@ func (e *Endpoint) Start(resolve bool) error {
 		if e.options.Amnezia.I5 != "" {
 			ipcConf.WriteString("\ni5=" + e.options.Amnezia.I5)
 		}
-		if e.options.Amnezia.J1 != "" {
-			ipcConf.WriteString("\nj1=" + e.options.Amnezia.J1)
+		if e.options.Amnezia.HeaderProtectionKey != "" {
+			headerProtectionKeyBytes, err := base64.StdEncoding.DecodeString(e.options.Amnezia.HeaderProtectionKey)
+			if err != nil {
+				return E.Cause(err, "decode header protection key")
+			}
+			ipcConf.WriteString("\nheader_protection_key=" + hex.EncodeToString(headerProtectionKeyBytes))
 		}
-		if e.options.Amnezia.J2 != "" {
-			ipcConf.WriteString("\nj2=" + e.options.Amnezia.J2)
+		if e.options.Amnezia.ContentPaddingAddition != nil {
+			ipcConf.WriteString("\ncontent_padding_addition=" + e.options.Amnezia.ContentPaddingAddition.String())
 		}
-		if e.options.Amnezia.J3 != "" {
-			ipcConf.WriteString("\nj3=" + e.options.Amnezia.J3)
+		if e.options.Amnezia.RekeyAfterTime != nil {
+			ipcConf.WriteString("\nrekey_after_time=" + e.options.Amnezia.RekeyAfterTime.String())
 		}
-		if e.options.Amnezia.ITime > 0 {
-			ipcConf.WriteString("\nitime=" + strconv.FormatInt(e.options.Amnezia.ITime, 10))
+		if e.options.Amnezia.RekeyTimeout != nil {
+			ipcConf.WriteString("\nrekey_timeout=" + e.options.Amnezia.RekeyTimeout.String())
+		}
+		if e.options.Amnezia.RejectAfterTime != nil {
+			ipcConf.WriteString("\nreject_after_time=" + e.options.Amnezia.RejectAfterTime.String())
+		}
+		if e.options.Amnezia.KeepaliveTimeout != nil {
+			ipcConf.WriteString("\nkeepalive_timeout=" + e.options.Amnezia.KeepaliveTimeout.String())
+		}
+		if e.options.Amnezia.MaxHandshakeAttempts != nil {
+			ipcConf.WriteString("\nmax_handshake_attempts=" + e.options.Amnezia.MaxHandshakeAttempts.String())
 		}
 	}
 	for _, peer := range e.peers {
diff --git a/transport/wireguard/endpoint_options.go b/transport/wireguard/endpoint_options.go
index cc9c7ffb..03066324 100644
--- a/transport/wireguard/endpoint_options.go
+++ b/transport/wireguard/endpoint_options.go
@@ -5,8 +5,8 @@ import (
 	"net/netip"
 	"time"
 
-	"github.com/sagernet/sing/common/json/badoption"
 	tun "github.com/sagernet/sing-tun"
+	"github.com/sagernet/sing/common/json/badoption"
 	"github.com/sagernet/sing/common/logger"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
@@ -43,24 +43,27 @@ type PeerOptions struct {
 }
 
 type AmneziaOptions struct {
-	JC    int
-	JMin  int
-	JMax  int
-	S1    int
-	S2    int
-	S3    int
-	S4    int
-	H1    *badoption.Range[uint32]
-	H2    *badoption.Range[uint32]
-	H3    *badoption.Range[uint32]
-	H4    *badoption.Range[uint32]
-	I1    string
-	I2    string
-	I3    string
-	I4    string
-	I5    string
-	J1    string
-	J2    string
-	J3    string
-	ITime int64
+	JC                     int
+	JMin                   int
+	JMax                   int
+	S1                     int
+	S2                     int
+	S3                     int
+	S4                     int
+	H1                     *badoption.Range[uint32]
+	H2                     *badoption.Range[uint32]
+	H3                     *badoption.Range[uint32]
+	H4                     *badoption.Range[uint32]
+	I1                     string
+	I2                     string
+	I3                     string
+	I4                     string
+	I5                     string
+	HeaderProtectionKey    string
+	ContentPaddingAddition *badoption.Range[uint32]
+	RekeyAfterTime         *badoption.Range[uint32]
+	RekeyTimeout           *badoption.Range[uint32]
+	RejectAfterTime        *badoption.Range[uint32]
+	KeepaliveTimeout       *badoption.Range[uint32]
+	MaxHandshakeAttempts   *badoption.Range[uint32]
 }