chore: release v0.4.5-beta.8 on beta

Adds a socket-level TTL desync: before the UDP handshake, the client fires a
few decoy datagrams with a lowered IP TTL, then restores the socket's TTL and
sends the real handshake. The decoys are meant to reach an on-path DPI box and
expire before the server, so the box classifies the flow on the decoys while
the server never sees them. Each decoy carries the key's junk marker, so any
that does reach the server is dropped there silently.

UDP only. On UoT the carrier is a single TCP stream, so a socket-level TTL
change would apply to the real traffic too; proper TCP desync needs injected
packets via a driver (WinDivert/NFQUEUE), which this deliberately does not
attempt — it stays a no-op there rather than pretending to work.

Off by default, and configurable under transport: ttl_desync (bool),
ttl_desync_ttl (u8, default 8), ttl_desync_count (u8, default 2). The right TTL
is the injector hop distance the prober's ttl_injector_probe reports, plus a
hop or two so decoys die just past the DPI; the wrong value is simply inert,
which is why this ships opt-in. Plumbed through the engine, the CLI, and the
GUI config mapping; new fields default so existing configs are unaffected.

Its actual DPI-evasion effect cannot be verified here — it needs a real
censored path — so this is the mechanism, to be tuned against the prober.

.github/workflows/release.yml

@@ -417,6 +417,29 @@ jobs:
 
           Compress-Archive -Path "$dir/*" -DestinationPath "ostp-windows-gui-${{ matrix.arch }}.zip" -Force
 
+      # The installer is what removes the per-connect consent prompt: it runs
+      # elevated, so its hook can register the helper's Scheduled Task once.
+      # The portable zip above cannot, and falls back to asking on first connect.
+      # The sidecar and its config are confined to this step: declaring
+      # externalBin in an auto-merged tauri.windows.conf.json would force every
+      # Windows build, down to a bare `cargo check`, to have the helper staged
+      # first, and fail the build script when it is not.
+      - name: Build NSIS Installer
+        working-directory: ostp-gui
+        # Chained, not two lines: pwsh does not abort a run block when a native
+        # command fails, so a staging failure would otherwise be reported far
+        # downstream as a missing sidecar rather than as itself.
+        run: node stage-sidecar.cjs --release --target ${{ matrix.target }} && npx tauri build --bundles nsis --target ${{ matrix.target }} --config src-tauri/tauri.installer.conf.json
+
+      - name: Collect installer
+        shell: pwsh
+        run: |
+          $nsis = Get-ChildItem -Path "ostp-gui/src-tauri/target/${{ matrix.target }}/release/bundle/nsis" -Filter *-setup.exe -ErrorAction SilentlyContinue |
+                  Select-Object -First 1
+          if (-not $nsis) { Write-Error "NSIS installer was not produced"; exit 1 }
+          Copy-Item $nsis.FullName "ostp-windows-gui-${{ matrix.arch }}-setup.exe"
+          Write-Host "installer: $($nsis.Name) -> ostp-windows-gui-${{ matrix.arch }}-setup.exe"
+
       - name: Upload to GitHub Release
         uses: softprops/action-gh-release@v2
         with:
@@ -426,7 +449,9 @@ jobs:
           # real stable release.
           tag_name: ${{ needs.resolve-channel.outputs.tag_name }}
           prerelease: ${{ needs.resolve-channel.outputs.prerelease }}
-          files: ostp-windows-gui-${{ matrix.arch }}.zip
+          files: |
+            ostp-windows-gui-${{ matrix.arch }}.zip
+            ostp-windows-gui-${{ matrix.arch }}-setup.exe
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.gitignore

@@ -57,3 +57,6 @@ ostp-control/
 netstack-smoltcp/
 dnstt/
 ostp-web/
+
+# Tauri sidecar staging area (copied from target/ at build time)
+ostp-gui/src-tauri/binaries/

.release-state.json

@@ -1,6 +1,6 @@
 {
-  "target_version": "0.4.4",
+  "target_version": "0.4.5",
-  "branch": "master",
+  "branch": "beta",
   "alpha_iteration": 0,
-  "beta_iteration": 0
+  "beta_iteration": 8
 }

Cargo.lock

@@ -1386,7 +1386,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "ostp"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "base64",
@@ -1409,7 +1409,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "base64",
@@ -1440,7 +1440,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1474,7 +1474,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-server"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "axum",
@@ -1507,7 +1507,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "libc",
@@ -1519,7 +1519,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun-helper"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "chrono",

Cargo.toml

@@ -12,7 +12,7 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 license = "AGPL-3.0"
-version = "0.4.4"
+version = "0.4.5"
 
 [workspace.dependencies]
 anyhow = "1.0"

ostp-client/src/bridge.rs

@@ -133,6 +133,9 @@ pub struct Bridge {
     pub frag_sleep: u64,
     pub junk_pc: [usize; 2],
     pub junk_ps: [usize; 2],
+    pub ttl_desync: bool,
+    pub ttl_desync_ttl: u8,
+    pub ttl_desync_count: u8,
     pub mtu: usize,
     pub kill_switch: bool,
     pub reload_tx: Option<watch::Sender<crate::config::ExclusionConfig>>,
@@ -184,6 +187,9 @@ impl Bridge {
             frag_sleep: config.transport.frag_sleep,
             junk_pc: config.transport.junk_pc,
             junk_ps: config.transport.junk_ps,
+            ttl_desync: config.transport.ttl_desync,
+            ttl_desync_ttl: config.transport.ttl_desync_ttl,
+            ttl_desync_count: config.transport.ttl_desync_count,
             mtu: config.ostp.mtu,
             kill_switch: config.kill_switch,
             reload_tx: None,
@@ -1108,6 +1114,34 @@ impl Bridge {
             let is_uot = matches!(socket, crate::transport::Transport::Uot { .. });
             let (attempt_limit, attempt_timeout_ms) = if is_uot { (1, 8000) } else { (4, 1200) };
 
+            // TTL-desync (UDP only, opt-in): fire decoy datagrams that reach an
+            // on-path DPI box but expire before the server, so the box classifies
+            // the flow on the decoys rather than the real handshake that follows.
+            // Each carries the key's junk marker, so any decoy that does reach
+            // the server is dropped there silently.
+            if self.ttl_desync && !is_uot && self.ttl_desync_count > 0 {
+                let marker = ostp_core::crypto::derive_junk_marker(
+                    &self.access_key,
+                    ostp_core::crypto::current_junk_window(),
+                );
+                let decoys: Vec<bytes::Bytes> = {
+                    let mut rng = rand::thread_rng();
+                    let [min_s, max_s] = self.junk_ps;
+                    let min_s = min_s.max(4);
+                    let max_s = max_s.max(min_s);
+                    (0..self.ttl_desync_count)
+                        .map(|_| {
+                            let len = rng.gen_range(min_s..=max_s);
+                            let mut b = vec![0u8; len];
+                            rng.fill(&mut b[..]);
+                            b[..4].copy_from_slice(&marker);
+                            bytes::Bytes::from(b)
+                        })
+                        .collect()
+                };
+                socket.send_ttl_decoys(&decoys, self.ttl_desync_ttl).await;
+            }
+
             for attempt in 0..attempt_limit {
                 if attempt > 0 {
                     tx.send(UiEvent::Log(format!("Handshake attempt {} lost. Retransmitting...", attempt))).await.ok();
@@ -1205,6 +1239,9 @@ impl Bridge {
         self.frag_sleep = cfg.transport.frag_sleep;
         self.junk_pc = cfg.transport.junk_pc;
         self.junk_ps = cfg.transport.junk_ps;
+        self.ttl_desync = cfg.transport.ttl_desync;
+        self.ttl_desync_ttl = cfg.transport.ttl_desync_ttl;
+        self.ttl_desync_count = cfg.transport.ttl_desync_count;
         self.mtu = cfg.ostp.mtu;
         self.keepalive_interval_sec = cfg.ostp.keepalive_interval_sec;
         self.kill_switch = cfg.kill_switch;

ostp-client/src/config.rs

@@ -92,6 +92,19 @@ pub struct TransportConfig {
     /// [min, max] junk packet size in bytes
     #[serde(default = "default_junk_size")]
     pub junk_ps: [usize; 2],
+    /// TTL-desync (UDP only): before the handshake, send decoy datagrams with a
+    /// lowered IP TTL so they reach an on-path DPI box but expire before the
+    /// server, poisoning the box's classification of the flow. Off by default —
+    /// it needs the TTL calibrated to the network, and the wrong value is inert.
+    #[serde(default)]
+    pub ttl_desync: bool,
+    /// TTL the decoy datagrams are sent with. Set it to one or two hops past the
+    /// injector distance the prober reports, so decoys die just beyond the DPI.
+    #[serde(default = "default_ttl_desync_ttl")]
+    pub ttl_desync_ttl: u8,
+    /// How many decoy datagrams to send per handshake.
+    #[serde(default = "default_ttl_desync_count")]
+    pub ttl_desync_count: u8,
 }
 
 fn default_transport_mode() -> String { "udp".to_string() }
@@ -99,6 +112,8 @@ fn default_frag_chunk() -> usize { 2 }
 fn default_frag_sleep() -> u64 { 2 }
 fn default_junk_count() -> [usize; 2] { [2, 5] }
 fn default_junk_size() -> [usize; 2] { [100, 1000] }
+fn default_ttl_desync_ttl() -> u8 { 8 }
+fn default_ttl_desync_count() -> u8 { 2 }
 
 impl Default for TransportConfig {
     fn default() -> Self {
@@ -109,6 +124,9 @@ impl Default for TransportConfig {
             frag_sleep: default_frag_sleep(),
             junk_pc: default_junk_count(),
             junk_ps: default_junk_size(),
+            ttl_desync: false,
+            ttl_desync_ttl: default_ttl_desync_ttl(),
+            ttl_desync_count: default_ttl_desync_count(),
         }
     }
 }
@@ -194,6 +212,9 @@ struct RawTransportSection {
     frag_sleep: Option<u64>,
     junk_pc: Option<[usize; 2]>,
     junk_ps: Option<[usize; 2]>,
+    ttl_desync: Option<bool>,
+    ttl_desync_ttl: Option<u8>,
+    ttl_desync_count: Option<u8>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -271,6 +292,9 @@ impl ClientConfig {
                 frag_sleep: raw.transport.as_ref().and_then(|t| t.frag_sleep).unwrap_or_else(default_frag_sleep),
                 junk_pc: raw.transport.as_ref().and_then(|t| t.junk_pc).unwrap_or_else(default_junk_count),
                 junk_ps: raw.transport.as_ref().and_then(|t| t.junk_ps).unwrap_or_else(default_junk_size),
+                ttl_desync: raw.transport.as_ref().and_then(|t| t.ttl_desync).unwrap_or(false),
+                ttl_desync_ttl: raw.transport.as_ref().and_then(|t| t.ttl_desync_ttl).unwrap_or_else(default_ttl_desync_ttl),
+                ttl_desync_count: raw.transport.as_ref().and_then(|t| t.ttl_desync_count).unwrap_or_else(default_ttl_desync_count),
             },
             exclusions: ExclusionConfig {
                 domains: exclusions.domains.unwrap_or_default(),
@@ -349,11 +373,18 @@ impl UnifiedConfig {
                 }
             }
             AppMode::Relay(cfg) => {
+                // The relay forwards to a fixed next hop on both carriers, so it
+                // needs both upstream addresses. It does NOT need upstream_api_url:
+                // that field belonged to the old design where the relay
+                // authenticated clients itself, which it no longer does. Requiring
+                // it here was the bug that made every generated relay config
+                // (wizard and template alike write no api_url) fail to load with
+                // "must specify upstream_api_url" — a relay that could never start.
                 if cfg.upstream_tcp.is_empty() {
-                    anyhow::bail!("Relay configuration must specify upstream_tcp address.");
+                    anyhow::bail!("Relay configuration must specify upstream_tcp (the next hop's TCP/UoT address).");
                 }
-                if cfg.upstream_api_url.is_empty() {
+                if cfg.upstream_udp.is_empty() {
-                    anyhow::bail!("Relay configuration must specify upstream_api_url.");
+                    anyhow::bail!("Relay configuration must specify upstream_udp (the next hop's UDP address).");
                 }
             }
         }
@@ -536,3 +567,76 @@ pub struct MuxConfig {
     pub enabled: Option<bool>,
     pub sessions: Option<usize>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Loads a config.json exactly as the daemon does: parse the JSON into the
+    /// canonical `UnifiedConfig`, then validate. This is the real drift-catcher —
+    /// if the wizard/template and the validator ever disagree on required fields,
+    /// this fails instead of a user's relay refusing to start.
+    fn load(json: &str) -> Result<UnifiedConfig> {
+        let cfg: UnifiedConfig = serde_json::from_str(json)?;
+        cfg.validate()?;
+        Ok(cfg)
+    }
+
+    /// Regression: the relay used to authenticate clients and so its config
+    /// carried `upstream_api_url`. The relay is a transparent pipe now and both
+    /// the wizard and the `init` template write NO api_url — yet validation kept
+    /// demanding it, so every generated relay config failed to load with
+    /// "must specify upstream_api_url". A relay that could never start.
+    #[test]
+    fn relay_config_without_api_url_loads() {
+        // Byte-for-byte the shape the wizard (main.rs) emits.
+        let json = r#"{
+            "mode": "relay",
+            "listen": "0.0.0.0:50000",
+            "upstream_tcp": "203.0.113.10:50000",
+            "upstream_udp": "203.0.113.10:50000",
+            "debug": false
+        }"#;
+        load(json).expect("a transparent-relay config must load without upstream_api_url");
+    }
+
+    /// A relay still needs somewhere to forward to on both carriers, so an
+    /// incomplete relay config must fail loudly at load, not connect-to-empty
+    /// per session at runtime.
+    #[test]
+    fn relay_config_missing_upstream_udp_is_rejected() {
+        let json = r#"{
+            "mode": "relay",
+            "listen": "0.0.0.0:50000",
+            "upstream_tcp": "203.0.113.10:50000",
+            "upstream_udp": "",
+            "debug": false
+        }"#;
+        assert!(load(json).is_err(), "a relay with no UDP upstream must be rejected");
+    }
+
+    /// A deprecated api_url left in an OLD config must not break loading — it is
+    /// ignored, not required and not forbidden.
+    #[test]
+    fn relay_config_with_leftover_api_url_still_loads() {
+        let json = r#"{
+            "mode": "relay",
+            "listen": "0.0.0.0:50000",
+            "upstream_tcp": "203.0.113.10:50000",
+            "upstream_udp": "203.0.113.10:50000",
+            "upstream_api_url": "http://old.example:8080",
+            "debug": false
+        }"#;
+        load(json).expect("a stale api_url must be tolerated, not rejected");
+    }
+
+    /// The minimal client and server shapes the template emits must also load,
+    /// so this test guards all three modes against generator/validator drift.
+    #[test]
+    fn minimal_client_and_server_configs_load() {
+        load(r#"{"mode":"client","server":"127.0.0.1:50000","access_key":"k"}"#)
+            .expect("minimal client config must load");
+        load(r#"{"mode":"server","listen":"0.0.0.0:50000","access_keys":["k"]}"#)
+            .expect("minimal server config must load");
+    }
+}

ostp-client/src/transport/mod.rs

@@ -53,4 +53,29 @@ impl Transport {
             Self::Uot { .. } => Ok("0.0.0.0:0".parse().unwrap()),
         }
     }
+
+    /// TTL-desync: send `decoys` as datagrams with the IP TTL lowered to `ttl`,
+    /// then restore the socket's original TTL. The decoys are meant to reach an
+    /// on-path DPI box and expire before the server — poisoning the box's view
+    /// of the flow (it classifies on the decoy) while the server never sees
+    /// them. Calibrate `ttl` to the injector hop distance the prober reports.
+    ///
+    /// UDP only: this manipulates individual datagrams' TTL. On UoT the carrier
+    /// is one TCP stream, so a socket-level TTL change would apply to the real
+    /// traffic too — proper TCP desync needs injected packets (a driver), which
+    /// this deliberately does not attempt. No-op there.
+    pub async fn send_ttl_decoys(&self, decoys: &[Bytes], ttl: u8) {
+        let Self::Udp(sock) = self else { return };
+        if decoys.is_empty() {
+            return;
+        }
+        let restore = sock.ttl().unwrap_or(128);
+        if sock.set_ttl(ttl as u32).is_err() {
+            return;
+        }
+        for d in decoys {
+            let _ = sock.send(d).await;
+        }
+        let _ = sock.set_ttl(restore);
+    }
 }

ostp-client/src/tunnel/ip_reasm.rs

@@ -0,0 +1,307 @@
+//! IPv4 fragment reassembly for the TUN → netstack path.
+//!
+//! Why this exists: the userspace netstack (netstack-smoltcp) parses each IP
+//! packet it receives and, for UDP, runs `UdpPacket::new_checked` on the IP
+//! payload. An IP *fragment* passes the IP-level check but fails the UDP one —
+//! the UDP length field describes the whole datagram while the fragment carries
+//! only a slice — so the netstack drops it with `wire::Error` and the datagram
+//! never reaches the tunnel. Large UDP datagrams (game traffic, e.g. Roblox
+//! sending >MTU packets that the OS fragments on the way to the TUN) therefore
+//! vanish entirely, and the app times out.
+//!
+//! smoltcp 0.2.2 does no reassembly of its own, so we do it here, between the
+//! TUN read and the netstack: fragments are buffered by (src, dst, id, proto),
+//! and only a fully reassembled datagram is handed on. Non-fragmented packets
+//! pass straight through untouched.
+
+use std::collections::{BTreeMap, HashMap};
+use std::time::{Duration, Instant};
+
+/// A fragment group is discarded if not completed within this window, matching
+/// the usual IP reassembly timeout. Prevents a lost tail fragment from pinning
+/// memory forever.
+const REASM_TIMEOUT: Duration = Duration::from_secs(3);
+/// Cap on concurrently tracked fragment groups, so a flood of first-fragments
+/// with no tail cannot grow memory without bound.
+const MAX_GROUPS: usize = 4096;
+/// A reassembled IPv4 datagram cannot exceed this (total-length is 16-bit).
+const MAX_DATAGRAM: usize = 65_535;
+
+type Key = (u32, u32, u16, u8); // src, dst, identification, protocol
+
+struct Group {
+    /// fragment_offset (bytes) → that fragment's IP payload.
+    parts: BTreeMap<usize, Vec<u8>>,
+    /// IP header of the offset-0 fragment, reused for the reassembled packet.
+    header: Option<Vec<u8>>,
+    /// Total payload length, known once the last fragment (MF=0) is seen.
+    total_len: Option<usize>,
+    first_seen: Instant,
+}
+
+pub struct Reassembler {
+    groups: HashMap<Key, Group>,
+    last_sweep: Instant,
+}
+
+impl Reassembler {
+    pub fn new() -> Self {
+        Self { groups: HashMap::new(), last_sweep: Instant::now() }
+    }
+
+    /// Feed one frame read from the TUN. Returns the packet(s) to forward to the
+    /// netstack: the frame itself when it is not a fragment, a single fully
+    /// reassembled datagram when this frame completes one, or nothing when the
+    /// frame was buffered as an incomplete fragment.
+    pub fn process(&mut self, frame: &[u8]) -> Option<Vec<u8>> {
+        self.maybe_sweep();
+
+        let Some(v4) = Ipv4View::parse(frame) else {
+            // Not a parseable IPv4 packet (e.g. IPv6) — pass through unchanged;
+            // reassembly is not our job for it.
+            return Some(frame.to_vec());
+        };
+
+        // A packet is fragmented iff MF is set or it carries a non-zero offset.
+        if !v4.more_fragments && v4.frag_offset == 0 {
+            return Some(frame.to_vec());
+        }
+
+        let key = (v4.src, v4.dst, v4.id, v4.protocol);
+        let now = Instant::now();
+
+        if self.groups.len() >= MAX_GROUPS && !self.groups.contains_key(&key) {
+            // Under pressure, drop the oldest incomplete group to make room
+            // rather than refusing the new one outright.
+            if let Some(oldest) = self
+                .groups
+                .iter()
+                .min_by_key(|(_, g)| g.first_seen)
+                .map(|(k, _)| *k)
+            {
+                self.groups.remove(&oldest);
+            }
+        }
+
+        let group = self.groups.entry(key).or_insert_with(|| Group {
+            parts: BTreeMap::new(),
+            header: None,
+            total_len: None,
+            first_seen: now,
+        });
+
+        // Ignore a payload that would push the datagram past the legal maximum.
+        if v4.frag_offset + v4.payload.len() > MAX_DATAGRAM {
+            self.groups.remove(&key);
+            return None;
+        }
+
+        group.parts.insert(v4.frag_offset, v4.payload.to_vec());
+        if v4.frag_offset == 0 {
+            group.header = Some(v4.header.to_vec());
+        }
+        if !v4.more_fragments {
+            // The last fragment fixes the total length.
+            group.total_len = Some(v4.frag_offset + v4.payload.len());
+        }
+
+        // Complete? Walk fragments from offset 0 and require they tile the whole
+        // datagram with no hole. Overlaps are tolerated as long as coverage is
+        // contiguous (BTreeMap keeps them offset-ordered).
+        let (Some(total), Some(header)) = (group.total_len, group.header.clone()) else {
+            return None;
+        };
+        let mut expected = 0usize;
+        for (&off, part) in &group.parts {
+            if off > expected {
+                return None; // hole before this fragment
+            }
+            let end = off + part.len();
+            if end > expected {
+                expected = end;
+            }
+        }
+        if expected < total {
+            return None; // not fully covered yet
+        }
+
+        // Reassemble: header + payload bytes [0, total), then fix the header so
+        // it describes a single unfragmented datagram.
+        let mut payload = vec![0u8; total];
+        for (&off, part) in &group.parts {
+            let end = (off + part.len()).min(total);
+            if off < total {
+                payload[off..end].copy_from_slice(&part[..end - off]);
+            }
+        }
+        self.groups.remove(&key);
+        Some(build_reassembled(&header, &payload))
+    }
+
+    fn maybe_sweep(&mut self) {
+        let now = Instant::now();
+        if now.duration_since(self.last_sweep) < Duration::from_secs(1) {
+            return;
+        }
+        self.last_sweep = now;
+        self.groups.retain(|_, g| now.duration_since(g.first_seen) < REASM_TIMEOUT);
+    }
+}
+
+/// A read-only view over an IPv4 header and its payload.
+struct Ipv4View<'a> {
+    header: &'a [u8],
+    payload: &'a [u8],
+    src: u32,
+    dst: u32,
+    id: u16,
+    protocol: u8,
+    more_fragments: bool,
+    frag_offset: usize,
+}
+
+impl<'a> Ipv4View<'a> {
+    fn parse(frame: &'a [u8]) -> Option<Self> {
+        if frame.len() < 20 {
+            return None;
+        }
+        if frame[0] >> 4 != 4 {
+            return None; // not IPv4
+        }
+        let ihl = ((frame[0] & 0x0f) as usize) * 4;
+        if ihl < 20 || frame.len() < ihl {
+            return None;
+        }
+        let total_len = u16::from_be_bytes([frame[2], frame[3]]) as usize;
+        // Trust the smaller of declared length and what we actually read.
+        let total_len = total_len.min(frame.len()).max(ihl);
+        let id = u16::from_be_bytes([frame[4], frame[5]]);
+        let flags_frag = u16::from_be_bytes([frame[6], frame[7]]);
+        let more_fragments = flags_frag & 0x2000 != 0;
+        let frag_offset = ((flags_frag & 0x1fff) as usize) * 8;
+        let protocol = frame[9];
+        let src = u32::from_be_bytes([frame[12], frame[13], frame[14], frame[15]]);
+        let dst = u32::from_be_bytes([frame[16], frame[17], frame[18], frame[19]]);
+        Some(Ipv4View {
+            header: &frame[..ihl],
+            payload: &frame[ihl..total_len],
+            src,
+            dst,
+            id,
+            protocol,
+            more_fragments,
+            frag_offset,
+        })
+    }
+}
+
+/// Stitch the offset-0 header onto a full payload, clearing the fragment fields
+/// and fixing total-length and header checksum so the netstack sees one clean
+/// datagram.
+fn build_reassembled(header0: &[u8], payload: &[u8]) -> Vec<u8> {
+    let ihl = header0.len();
+    let mut out = Vec::with_capacity(ihl + payload.len());
+    out.extend_from_slice(header0);
+    out.extend_from_slice(payload);
+
+    let total = (ihl + payload.len()) as u16;
+    out[2..4].copy_from_slice(&total.to_be_bytes());
+    // Clear flags (except keep DF? no — a reassembled datagram is not a
+    // fragment and DF is irrelevant here) and the fragment offset.
+    out[6] = 0;
+    out[7] = 0;
+    // Recompute the IPv4 header checksum over the (possibly options-bearing)
+    // header only.
+    out[10] = 0;
+    out[11] = 0;
+    let cksum = ipv4_checksum(&out[..ihl]);
+    out[10..12].copy_from_slice(&cksum.to_be_bytes());
+    out
+}
+
+fn ipv4_checksum(header: &[u8]) -> u16 {
+    let mut sum: u32 = 0;
+    let mut i = 0;
+    while i + 1 < header.len() {
+        sum += u16::from_be_bytes([header[i], header[i + 1]]) as u32;
+        i += 2;
+    }
+    if i < header.len() {
+        sum += (header[i] as u32) << 8;
+    }
+    while sum >> 16 != 0 {
+        sum = (sum & 0xffff) + (sum >> 16);
+    }
+    !(sum as u16)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Build a minimal IPv4 header for tests. `mf` = more-fragments, `offset`
+    // in bytes (must be /8), `payload_len` fills total_length.
+    fn ipv4(id: u16, mf: bool, offset: usize, payload: &[u8]) -> Vec<u8> {
+        let total = 20 + payload.len();
+        let mut h = vec![0u8; 20];
+        h[0] = 0x45; // v4, ihl 5
+        h[2..4].copy_from_slice(&(total as u16).to_be_bytes());
+        h[4..6].copy_from_slice(&id.to_be_bytes());
+        let flags_frag = (if mf { 0x2000u16 } else { 0 }) | ((offset / 8) as u16 & 0x1fff);
+        h[6..8].copy_from_slice(&flags_frag.to_be_bytes());
+        h[9] = 17; // UDP
+        h[12..16].copy_from_slice(&[10, 1, 0, 2]);
+        h[16..20].copy_from_slice(&[13, 249, 8, 109]);
+        h.extend_from_slice(payload);
+        h
+    }
+
+    #[test]
+    fn passes_non_fragmented_through() {
+        let mut r = Reassembler::new();
+        let pkt = ipv4(1, false, 0, &[1, 2, 3, 4]);
+        assert_eq!(r.process(&pkt), Some(pkt));
+    }
+
+    #[test]
+    fn reassembles_two_fragments() {
+        let mut r = Reassembler::new();
+        // 16 bytes of "UDP" payload split as 8 + 8.
+        let first = ipv4(42, true, 0, &[0, 1, 2, 3, 4, 5, 6, 7]);
+        let second = ipv4(42, false, 8, &[8, 9, 10, 11, 12, 13, 14, 15]);
+
+        assert_eq!(r.process(&first), None, "first fragment must be buffered");
+        let whole = r.process(&second).expect("second fragment completes it");
+
+        // Header says unfragmented, total length 36, payload is the full 16.
+        assert_eq!(whole[0] >> 4, 4);
+        assert_eq!(u16::from_be_bytes([whole[2], whole[3]]), 36);
+        assert_eq!(whole[6] & 0x20, 0, "MF must be cleared");
+        assert_eq!(u16::from_be_bytes([whole[6], whole[7]]) & 0x1fff, 0, "offset cleared");
+        assert_eq!(&whole[20..], &(0u8..16).collect::<Vec<_>>()[..]);
+        // A correctly checksummed header sums to zero when the check field is
+        // included in the computation.
+        assert_eq!(ipv4_checksum(&whole[..20]), 0, "header checksum must verify");
+    }
+
+    #[test]
+    fn out_of_order_fragments_reassemble() {
+        let mut r = Reassembler::new();
+        let first = ipv4(7, true, 0, &[0, 1, 2, 3, 4, 5, 6, 7]);
+        let last = ipv4(7, false, 16, &[16, 17, 18, 19]);
+        let mid = ipv4(7, true, 8, &[8, 9, 10, 11, 12, 13, 14, 15]);
+
+        assert_eq!(r.process(&last), None);
+        assert_eq!(r.process(&first), None);
+        let whole = r.process(&mid).expect("last piece completes it");
+        assert_eq!(&whole[20..], &(0u8..20).collect::<Vec<_>>()[..]);
+    }
+
+    #[test]
+    fn incomplete_group_yields_nothing() {
+        let mut r = Reassembler::new();
+        let first = ipv4(9, true, 0, &[0; 8]);
+        // Tail never arrives.
+        assert_eq!(r.process(&first), None);
+    }
+}

ostp-client/src/tunnel/mod.rs

@@ -1,4 +1,5 @@
 mod proxy;
+mod ip_reasm;
 pub mod native_handler;
 
 mod udp_nat;

ostp-client/src/tunnel/native_handler.rs

@@ -123,12 +123,18 @@ pub async fn run_native_tunnel(
     let (mut tun_read, mut tun_write) = tokio::io::split(dev);
 
     let mut tun_to_stack = tokio::spawn(async move {
+        // Reassemble IPv4 fragments before the netstack sees them: smoltcp drops
+        // UDP fragments with a wire::Error, which silently kills any >MTU UDP
+        // datagram (game traffic in particular). See ip_reasm for the details.
+        let mut reasm = super::ip_reasm::Reassembler::new();
         let mut buf = vec![0u8; 65536];
         loop {
             match tun_read.read(&mut buf).await {
                 Ok(0) => break,
                 Ok(n) => {
-                    let frame = buf[..n].to_vec();
+                    let Some(frame) = reasm.process(&buf[..n]) else {
+                        continue; // fragment buffered; nothing to forward yet
+                    };
                     if let Err(e) = stack_sink.send(frame).await {
                         if e.kind() == std::io::ErrorKind::BrokenPipe {
                             break;
@@ -471,6 +477,9 @@ pub async fn run_native_tunnel_from_fd(
     let (mut stack_sink, mut stack_stream) = stack.split();
 
     let _tun_to_stack = tokio::spawn(async move {
+        // See the Windows path above: reassemble IPv4 fragments so smoltcp does
+        // not drop >MTU UDP datagrams.
+        let mut reasm = super::ip_reasm::Reassembler::new();
         let mut buf = vec![0u8; 65536];
         loop {
             let mut guard = match tun_stream.readable().await {
@@ -502,7 +511,9 @@ pub async fn run_native_tunnel_from_fd(
                 Err(_) => continue,
             };
 
-            let frame = buf[..n].to_vec();
+            let Some(frame) = reasm.process(&buf[..n]) else {
+                continue; // fragment buffered; nothing to forward yet
+            };
             if let Err(e) = stack_sink.send(frame).await {
                 if e.kind() == std::io::ErrorKind::BrokenPipe {
                     break;

ostp-flutter/pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.4.4+31
+version: 0.4.5+39
 
 environment:
   sdk: ^3.11.4

ostp-gui/package.json

@@ -1,14 +1,15 @@
 {
   "name": "ostp-gui",
   "private": true,
-  "version": "0.4.4",
+  "version": "0.4.5",
   "type": "module",
   "scripts": {
     "tauri": "tauri",
     "dev": "cargo build -p ostp-tun-helper && npx tauri dev",
     "build": "cargo build -p ostp-tun-helper --release && npx tauri build --no-bundle",
-    "build:installer": "cargo build -p ostp-tun-helper --release && npx tauri build",
+    "build:installer": "cargo build -p ostp-tun-helper --release && node stage-sidecar.cjs --release && npx tauri build --bundles nsis --config src-tauri/tauri.installer.conf.json",
-    "build:dist": "npm run build && node build_dist.js"
+    "build:dist": "npm run build && node build_dist.js",
+    "sidecar": "node stage-sidecar.cjs"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2"

ostp-gui/src-tauri/Cargo.lock

@@ -2665,7 +2665,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -2696,7 +2696,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2713,7 +2713,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-gui"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "json_comments",
@@ -2733,7 +2733,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "libc",

ostp-gui/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ostp-gui"
-version = "0.4.4"
+version = "0.4.5"
 description = "OSTP desktop GUI"
 authors = ["ospab"]
 edition = "2021"

ostp-gui/src-tauri/src/lib.rs

@@ -61,6 +61,9 @@ struct TransportConfigRaw {
     frag_sleep: Option<u64>,
     junk_pc: Option<[usize; 2]>,
     junk_ps: Option<[usize; 2]>,
+    ttl_desync: Option<bool>,
+    ttl_desync_ttl: Option<u8>,
+    ttl_desync_count: Option<u8>,
 }
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
@@ -134,16 +137,84 @@ struct AppState(Mutex<AppStateInner>);
 
 // ── Config helpers ────────────────────────────────────────────────────────────
 
+/// Per-user config location, used whenever the config cannot live next to the
+/// executable.
+fn user_config_path() -> PathBuf {
+    let base = std::env::var_os(if cfg!(windows) { "APPDATA" } else { "HOME" })
+        .map(PathBuf::from)
+        .unwrap_or_else(std::env::temp_dir);
+    let dir = if cfg!(windows) { base.join("OSTP") } else { base.join(".config").join("ostp") };
+    dir.join("config.json")
+}
+
+/// Where the GUI reads and writes its configuration.
+///
+/// Portable installs keep the config beside the executable, which is what the
+/// zip has always done, and that is preserved wherever the directory is
+/// actually writable.
+///
+/// What it must never do again is fall back to a bare relative `config.json`.
+/// That resolves against the process working directory, which for a Start Menu
+/// shortcut is whatever Windows chose — often `C:\Windows\System32`. Reading
+/// and saving settings then failed with "Access is denied" (os error 5), and on
+/// a writable working directory it would have been worse still: settings would
+/// silently persist somewhere unrelated and appear to vanish.
+///
+/// Writability is measured rather than inferred from the install location. An
+/// installer can put the app anywhere — a per-machine install onto a data drive
+/// may well be writable, while Program Files is not — so the location alone
+/// says nothing.
 fn get_config_path() -> PathBuf {
     if let Ok(exe_path) = std::env::current_exe() {
         if let Some(parent) = exe_path.parent() {
-            let path = parent.join("config.json");
+            let portable = parent.join("config.json");
-            if path.exists() {
+            if portable.exists() {
-                return path;
+                if is_file_writable(&portable) {
+                    return portable;
+                }
+                // Read-only beside the exe: unusable as the live file, but its
+                // contents are still worth carrying over once.
+                let user = user_config_path();
+                if !user.exists() {
+                    if let Some(dir) = user.parent() {
+                        let _ = std::fs::create_dir_all(dir);
+                    }
+                    let _ = std::fs::copy(&portable, &user);
+                }
+            } else if is_dir_writable(parent) {
+                // No config yet and the directory takes writes: a portable
+                // unzip, so keep the config travelling with the folder.
+                return portable;
             }
         }
     }
-    PathBuf::from("config.json")
+
+    let path = user_config_path();
+    if let Some(dir) = path.parent() {
+        let _ = std::fs::create_dir_all(dir);
+    }
+    path
+}
+
+/// Whether an existing file can actually be written to.
+///
+/// Answered by opening it, not by reading permission bits: on Windows the
+/// effective answer depends on the ACL and on virtualization, and `readonly()`
+/// reflects neither.
+fn is_file_writable(path: &std::path::Path) -> bool {
+    std::fs::OpenOptions::new().append(true).open(path).is_ok()
+}
+
+/// Whether new files can be created in a directory, tested by doing it.
+fn is_dir_writable(dir: &std::path::Path) -> bool {
+    let probe = dir.join(format!(".ostp-write-test-{}", std::process::id()));
+    match std::fs::File::create(&probe) {
+        Ok(_) => {
+            let _ = std::fs::remove_file(&probe);
+            true
+        }
+        Err(_) => false,
+    }
 }
 
 fn map_to_client_config(raw: &ClientConfigRaw, mode: &str) -> ostp_client::config::ClientConfig {
@@ -171,6 +242,9 @@ fn map_to_client_config(raw: &ClientConfigRaw, mode: &str) -> ostp_client::confi
             frag_sleep: raw.transport.as_ref().and_then(|t| t.frag_sleep).unwrap_or(2),
             junk_pc: raw.transport.as_ref().and_then(|t| t.junk_pc).unwrap_or([2, 5]),
             junk_ps: raw.transport.as_ref().and_then(|t| t.junk_ps).unwrap_or([100, 1000]),
+            ttl_desync: raw.transport.as_ref().and_then(|t| t.ttl_desync).unwrap_or(false),
+            ttl_desync_ttl: raw.transport.as_ref().and_then(|t| t.ttl_desync_ttl).unwrap_or(8),
+            ttl_desync_count: raw.transport.as_ref().and_then(|t| t.ttl_desync_count).unwrap_or(2),
         },
         exclusions: ostp_client::config::ExclusionConfig {
             domains: raw.exclude.as_ref().and_then(|e| e.domains.clone()).unwrap_or_default(),
@@ -836,21 +910,8 @@ fn helper_args_file() -> PathBuf {
     base.join("OSTP").join("helper-args.json")
 }
 
-/// Minimal XML text escaping for the values interpolated into the task
+/// Undoes XML entity escaping. `&amp;` must be handled last, or `&amp;lt;`
-/// definition. Paths and usernames are attacker-irrelevant here but can easily
+/// would come back as `<`.
-/// contain `&`, which would otherwise produce invalid XML and a confusing
-/// schtasks parse failure.
-#[cfg(target_os = "windows")]
-fn xml_escape(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-        .replace('"', "&quot;")
-        .replace('\'', "&apos;")
-}
-
-/// Reverse of [`xml_escape`]. `&amp;` must be undone last or `&amp;lt;` would
-/// come back as `<`.
 #[cfg(target_os = "windows")]
 fn xml_unescape(s: &str) -> String {
     s.replace("&quot;", "\"")
@@ -864,8 +925,12 @@ fn xml_unescape(s: &str) -> String {
 ///
 /// Queried as XML rather than `/FO LIST /V`: the list format's field labels are
 /// localized (on a Russian Windows "Task To Run" is "Задача для запуска"),
-/// whereas XML tag names are fixed. schtasks writes UTF-16LE with a BOM here,
+/// whereas XML tag names are fixed.
-/// but tolerate UTF-8 in case that ever changes.
+///
+/// Encoding depends on where the output goes, which is measured rather than
+/// assumed: to a console schtasks writes UTF-16LE with a BOM, but into a
+/// redirected pipe — our case — it writes UTF-8 with no BOM. Both are handled,
+/// keyed off the BOM, so this keeps working if that ever flips.
 #[cfg(target_os = "windows")]
 fn helper_task_command() -> Option<String> {
     let out = quiet_command("schtasks")
@@ -903,140 +968,48 @@ fn helper_task_command() -> Option<String> {
 #[cfg(target_os = "windows")]
 fn helper_task_matches(exe: &std::path::Path) -> bool {
     let Some(registered) = helper_task_command() else {
+        diag_log("task: schtasks /Query returned nothing usable — no task, or its XML had no <Command>");
         return false;
     };
     let registered = registered.trim().trim_matches('"');
+    let path = std::path::Path::new(registered);
 
-    // Canonicalize both sides when possible so `..`, short 8.3 names and
+    // Requiring the registered path to equal the helper we would have launched
-    // casing differences do not read as a mismatch. A missing file cannot be
+    // was too strict, and bought nothing. What the check exists to catch is a
-    // canonicalized — which is itself a mismatch worth re-registering over.
+    // task left pointing at a binary that is gone — `schtasks /Run` reports
-    match (
+    // success merely for accepting such a request, so the app would then wait
-        std::fs::canonicalize(registered),
+    // on a helper that never starts. Testing that the file exists catches
-        std::fs::canonicalize(exe),
+    // exactly that, while a task registered by the installer against an
-    ) {
+    // equivalent copy of the helper no longer costs the user a prompt.
-        (Ok(a), Ok(b)) => a == b,
+    let same_program = path
-        _ => registered.eq_ignore_ascii_case(&exe.display().to_string()),
+        .file_name()
-    }
+        .map(|n| n.eq_ignore_ascii_case(HELPER_EXE_NAME))
+        .unwrap_or(false);
+    let exists = path.is_file();
+
+    diag_log(&format!(
+        "task: registered={registered:?} exists={exists} same_program={same_program} wanted={:?}",
+        exe.display().to_string()
+    ));
+    exists && same_program
 }
 
-/// Register the Scheduled Task. This is the ONLY step that needs elevation, and
+/// Appends a line to a small log beside the helper's argument file.
-/// it happens once per machine; every later tunnel start reuses the task.
 ///
-/// RunLevel=HIGHEST makes the task run elevated, and because a task launch is
+/// The GUI is a windowed binary with no console, so every `eprintln!` on this
-/// not an elevation request, Windows shows no consent dialog for it.
+/// path went nowhere — which left the one decision that matters, whether the
+/// scheduled task gets used or the user gets a consent prompt, completely
+/// unobservable from a user's machine.
 #[cfg(target_os = "windows")]
-fn install_helper_task(exe: &std::path::Path) -> anyhow::Result<()> {
+fn diag_log(msg: &str) {
-    let args_file = helper_args_file();
+    let path = helper_args_file().with_file_name("helper-launch.log");
-    if let Some(dir) = args_file.parent() {
+    if let Some(dir) = path.parent() {
-        std::fs::create_dir_all(dir)?;
+        let _ = std::fs::create_dir_all(dir);
     }
-
+    if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(&path) {
-    // Register from an XML definition rather than /TR. The command line would
+        use std::io::Write;
-    // otherwise need the exe path and the args path quoted INSIDE an already
+        let _ = writeln!(f, "{msg}");
-    // quoted /TR value, escaped again through ShellExecuteW — a notoriously
-    // brittle chain when either path contains a space, which both of these do
-    // by default (Program Files, and usernames with spaces). XML also lets the
-    // battery and time-limit settings below be stated explicitly.
-    let user = format!(
-        "{}\\{}",
-        std::env::var("USERDOMAIN").unwrap_or_else(|_| "%COMPUTERNAME%".into()),
-        std::env::var("USERNAME").unwrap_or_default()
-    );
-    let xml = format!(
-        r#"<?xml version="1.0" encoding="UTF-16"?>
-<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
-  <RegistrationInfo>
-    <Description>Runs the OSTP TUN helper elevated so enabling the tunnel does not prompt for consent every time.</Description>
-  </RegistrationInfo>
-  <Principals>
-    <Principal id="Author">
-      <UserId>{user}</UserId>
-      <LogonType>InteractiveToken</LogonType>
-      <RunLevel>HighestAvailable</RunLevel>
-    </Principal>
-  </Principals>
-  <Settings>
-    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
-    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
-    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
-    <StartWhenAvailable>false</StartWhenAvailable>
-    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
-    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
-    <Enabled>true</Enabled>
-    <Hidden>false</Hidden>
-    <AllowHardTerminate>true</AllowHardTerminate>
-  </Settings>
-  <Actions Context="Author">
-    <Exec>
-      <Command>{exe}</Command>
-      <Arguments>--args-file "{args}"</Arguments>
-    </Exec>
-  </Actions>
-</Task>
-"#,
-        user = xml_escape(&user),
-        exe = xml_escape(&exe.display().to_string()),
-        args = xml_escape(&args_file.display().to_string()),
-    );
-
-    // schtasks /Create /XML expects UTF-16LE with a BOM.
-    let xml_path = std::env::temp_dir().join(format!("ostp_task_{}.xml", rand::random::<u32>()));
-    let mut utf16: Vec<u8> = vec![0xFF, 0xFE];
-    for unit in xml.encode_utf16() {
-        utf16.extend_from_slice(&unit.to_le_bytes());
     }
-    std::fs::write(&xml_path, &utf16)?;
-
-    // Registering a HighestAvailable task is itself privileged: this is the one
-    // prompt, and it happens once per machine.
-    //
-    // Elevate through PowerShell's Start-Process -Wait rather than
-    // ShellExecuteW. ShellExecuteW returns as soon as the elevated process is
-    // LAUNCHED, so the XML below was being deleted while schtasks was still
-    // starting up — registration then failed, leaving the user with a consent
-    // prompt that accomplished nothing, followed by a second prompt from the
-    // fallback path. -Wait makes the deletion safe and lets the exit code be
-    // checked instead of guessed at by polling.
-    //
-    // ArgumentList takes an array, so the task name and XML path never need
-    // quoting or escaping through a command line, only PowerShell's own
-    // single-quote doubling.
-    let ps = format!(
-        "$p = Start-Process -FilePath 'schtasks.exe' -Verb RunAs -Wait -PassThru \
-         -WindowStyle Hidden -ArgumentList @('/Create','/TN','{}','/XML','{}','/F'); \
-         exit $p.ExitCode",
-        ps_quote(HELPER_TASK_NAME),
-        ps_quote(&xml_path.display().to_string()),
-    );
-
-    let status = quiet_command("powershell")
-        .args(["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", &ps])
-        .status();
-
-    // schtasks has exited by now, so this is safe.
-    let _ = std::fs::remove_file(&xml_path);
-
-    match status {
-        Ok(s) if s.success() => {}
-        Ok(s) => anyhow::bail!(
-            "registering the scheduled task failed (exit code {:?}). A declined consent prompt \
-             reports 1223.",
-            s.code()
-        ),
-        Err(e) => anyhow::bail!("could not run powershell to register the task: {e}"),
-    }
-
-    if helper_task_matches(exe) {
-        Ok(())
-    } else {
-        anyhow::bail!("schtasks reported success but the task does not point at {}", exe.display())
-    }
-}
-
-/// Escape a value for embedding in a PowerShell single-quoted string.
-#[cfg(target_os = "windows")]
-fn ps_quote(s: &str) -> String {
-    s.replace('\'', "''")
 }
 
 #[cfg(target_os = "windows")]
@@ -1054,28 +1027,35 @@ fn launch_as_admin(exe: &std::path::PathBuf, token: &str, port: u16) -> anyhow::
     let wrote_args = std::fs::write(&args_file, payload.to_string()).is_ok();
 
     if wrote_args {
-        if !helper_task_matches(exe) {
+        // Deliberately does NOT create the task when it is missing. Registering
-            if let Err(e) = install_helper_task(exe) {
+        // one is privileged, so the app could only do it by raising the very
-                eprintln!("[OSTP] could not register the helper task ({e}); falling back to a direct elevated launch");
+        // prompt this exists to avoid — and it would then charge the user two
-            }
+        // prompts for the privilege. Creating it belongs to the installer,
-        }
+        // which is already elevated. Without it we simply fall through to the
+        // direct elevated launch, which prompts once per connect as before.
         if helper_task_matches(exe) {
             let run = quiet_command("schtasks")
                 .args(["/Run", "/TN", HELPER_TASK_NAME])
                 .output();
             match run {
-                Ok(o) if o.status.success() => return Ok(()),
+                Ok(o) if o.status.success() => {
-                Ok(o) => eprintln!(
+                    diag_log("run: schtasks /Run accepted — no consent prompt");
-                    "[OSTP] schtasks /Run failed: {}",
+                    return Ok(());
+                }
+                Ok(o) => diag_log(&format!(
+                    "run: schtasks /Run failed ({:?}): {} {}",
+                    o.status.code(),
+                    String::from_utf8_lossy(&o.stdout).trim(),
                     String::from_utf8_lossy(&o.stderr).trim()
-                ),
+                )),
-                Err(e) => eprintln!("[OSTP] schtasks /Run could not start: {e}"),
+                Err(e) => diag_log(&format!("run: schtasks /Run could not start: {e}")),
             }
         }
         // Falling through: remove the file so a stale token is not left behind.
         let _ = std::fs::remove_file(&args_file);
     }
 
+    diag_log("falling back to a direct elevated launch — this is the consent prompt");
     launch_as_admin_direct(exe, token, port)
 }
 

ostp-gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ostp-gui",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "identifier": "com.ospab.ostp",
   "build": {
     "frontendDist": "../src"

ostp-gui/src-tauri/tauri.installer.conf.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "bundle": {
+    "externalBin": ["binaries/ostp-tun-helper"],
+    "resources": { "binaries/wintun.dll": "wintun.dll" },
+    "windows": {
+      "nsis": {
+        "installMode": "perMachine",
+        "installerHooks": "./windows/hooks.nsh"
+      }
+    }
+  }
+}

ostp-gui/src-tauri/windows/hooks.nsh

@@ -0,0 +1,93 @@
+; Registers the Scheduled Task that lets the GUI start the TUN helper elevated
+; without a consent prompt.
+;
+; This belongs in the installer, not in the app. Registering a task that runs
+; elevated is itself a privileged operation, so an unprivileged GUI could only
+; obtain one by raising the very prompt we are trying to remove. The installer
+; already runs elevated (installMode is perMachine), so here it costs nothing:
+; the user consents once, to the install, and never again per connect.
+;
+; The task carries no trigger at all — it exists solely to be started on demand.
+
+!macro NSIS_HOOK_POSTINSTALL
+  ; Bundled resources land in $INSTDIR\resources, but the helper loads wintun
+  ; with a plain LoadLibrary, which searches its own directory — so put a copy
+  ; beside the executables. The destination is the directory, not a file path:
+  ; CopyFiles takes a target directory, and naming the file made it fail.
+  ${If} ${FileExists} "$INSTDIR\resources\wintun.dll"
+    DetailPrint "Placing wintun.dll next to the helper..."
+    CopyFiles /SILENT "$INSTDIR\resources\wintun.dll" "$INSTDIR"
+  ${Else}
+    DetailPrint "WARNING: resources\wintun.dll is missing; TUN mode will not start."
+  ${EndIf}
+
+  ; Registered through PowerShell's ScheduledTasks module rather than
+  ; `schtasks /XML`. Generating the XML from NSIS wrote a UTF-16 byte-order mark
+  ; ahead of content whose encoding depended on whether makensis was built in
+  ; Unicode mode, and schtasks rejected the result outright:
+  ;   "The task XML is malformed. (1,2)::ERROR: incorrect document syntax"
+  ; The cmdlets take the same settings as arguments, so no file is written and
+  ; there is no encoding to get wrong.
+  ;
+  ; The command is delimited with backticks, NSIS's third quote character, so
+  ; that PowerShell's own single quotes and the shell's double quotes can both
+  ; appear literally — inside a single-quoted NSIS string the first PowerShell
+  ; quote would have terminated the argument early.
+  ;
+  ; $$ is an escaped literal dollar for PowerShell's variables; a bare $ would
+  ; be read by NSIS as one of its own. The helper argument is assembled with
+  ; [char]34 instead of nested quotes so that a username containing a space
+  ; still yields a correctly quoted path, without three levels of escaping.
+  ;
+  ; The principal is the SID S-1-5-32-545 (BUILTIN\Users) rather than the
+  ; installing user, so a per-machine install serves every account instead of
+  ; only whoever ran the installer. The SID is used because the name is
+  ; localized and would not resolve. %LOCALAPPDATA% is likewise left unexpanded
+  ; for Task Scheduler to resolve per running user.
+  DetailPrint "Registering the OSTP TUN helper task..."
+  nsExec::ExecToLog `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$$act = New-ScheduledTaskAction -Execute '$INSTDIR\ostp-tun-helper.exe' -Argument ('--args-file ' + [char]34 + '%LOCALAPPDATA%\OSTP\helper-args.json' + [char]34); $$prn = New-ScheduledTaskPrincipal -GroupId 'S-1-5-32-545' -RunLevel Highest; $$set = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances Parallel; Register-ScheduledTask -TaskName 'OSTP TUN Helper' -Action $$act -Principal $$prn -Settings $$set -Force | Out-Null"`
+  Pop $R0
+
+  ${If} $R0 == 0
+    ; Registering the task is not enough to make it usable. The principal above
+    ; decides WHO THE TASK RUNS AS; the task's security descriptor decides who
+    ; is allowed to START it, and they are not the same thing. A task created by
+    ; an elevated installer defaults to a DACL granting execution to
+    ; Administrators only, so the unprivileged GUI got
+    ;   schtasks /Run -> ERROR: Access is denied
+    ; and fell back to prompting on every single connect. Running it by hand
+    ; from an elevated console worked, which is what made this look for a while
+    ; like the app was at fault.
+    ;
+    ; Register-ScheduledTask cannot set a descriptor, so this goes through the
+    ; Task Scheduler COM object. GA for Administrators and SYSTEM, GR+GX —
+    ; read and execute — for BUILTIN\Users (BU), which is what lets a normal
+    ; user start it without being elevated.
+    DetailPrint "Granting users permission to start the task..."
+    nsExec::ExecToLog `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$$svc = New-Object -ComObject Schedule.Service; $$svc.Connect(); $$t = $$svc.GetFolder('\').GetTask('OSTP TUN Helper'); $$t.SetSecurityDescriptor('D:(A;;GA;;;BA)(A;;GA;;;SY)(A;;GRGX;;;BU)', 0)"`
+    Pop $R1
+    ${If} $R1 == 0
+      DetailPrint "Helper task registered; connecting will not ask for consent."
+    ${Else}
+      DetailPrint "Task registered but its permissions could not be set (exit $R1)."
+      DetailPrint "Every connect will ask for consent."
+    ${EndIf}
+  ${Else}
+    ; Not fatal: the app still works, it just falls back to an elevated launch
+    ; that asks for consent on each connect.
+    DetailPrint "Could not register the helper task (exit $R0)."
+    DetailPrint "OSTP will still work, but every connect will ask for consent."
+  ${EndIf}
+!macroend
+
+!macro NSIS_HOOK_PREUNINSTALL
+  ; Leaving the task behind would point it at a deleted executable, and
+  ; `schtasks /Run` reports success for merely accepting such a request — the
+  ; app would wait on a helper that never starts.
+  DetailPrint "Removing the OSTP TUN helper task..."
+  nsExec::ExecToLog 'schtasks.exe /Delete /TN "OSTP TUN Helper" /F'
+  Pop $R0
+
+  ; Copied by the install hook, so the uninstaller has no record of it.
+  Delete "$INSTDIR\wintun.dll"
+!macroend

ostp-gui/stage-sidecar.cjs

@@ -0,0 +1,73 @@
+// Stages ostp-tun-helper where Tauri expects a sidecar.
+//
+// tauri.installer.conf.json declares `externalBin: ["binaries/ostp-tun-helper"]`,
+// and Tauri resolves that to `binaries/ostp-tun-helper-<target-triple>.exe` at
+// build time, failing the build outright when the file is absent. Cargo writes
+// the plain name instead, so it has to be copied across first.
+//
+// Only the installer build needs this. That config is passed explicitly with
+// --config rather than being named tauri.windows.conf.json, which Tauri would
+// merge into every Windows build automatically — and then even a bare
+// `cargo check` would fail on the missing sidecar.
+//
+// A no-op off Windows: the Linux and macOS GUI builds have no helper sidecar.
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+if (process.platform !== 'win32') {
+  process.exit(0);
+}
+
+// --target may be passed through; fall back to the host triple rustc reports.
+const targetFlag = process.argv.indexOf('--target');
+const triple =
+  targetFlag !== -1 && process.argv[targetFlag + 1]
+    ? process.argv[targetFlag + 1]
+    : execFileSync('rustc', ['-vV'], { encoding: 'utf8' })
+        .split('\n')
+        .find((l) => l.startsWith('host:'))
+        .slice('host:'.length)
+        .trim();
+
+const profile = process.argv.includes('--release') ? 'release' : 'debug';
+const repoRoot = path.resolve(__dirname, '..');
+
+// Cargo drops a --target build under target/<triple>/, and a host build
+// straight into target/. CI always passes --target; local builds usually do not.
+const candidates = [
+  path.join(repoRoot, 'target', triple, profile, 'ostp-tun-helper.exe'),
+  path.join(repoRoot, 'target', profile, 'ostp-tun-helper.exe'),
+];
+const src = candidates.find((p) => fs.existsSync(p));
+if (!src) {
+  console.error(
+    'stage-sidecar: ostp-tun-helper.exe not found. Looked in:\n  ' +
+      candidates.join('\n  ') +
+      `\nBuild it first: cargo build -p ostp-tun-helper${profile === 'release' ? ' --release' : ''}`
+  );
+  process.exit(1);
+}
+
+const destDir = path.join(__dirname, 'src-tauri', 'binaries');
+fs.mkdirSync(destDir, { recursive: true });
+const dest = path.join(destDir, `ostp-tun-helper-${triple}.exe`);
+fs.copyFileSync(src, dest);
+console.log(`stage-sidecar: ${path.relative(repoRoot, src)} -> ${path.relative(repoRoot, dest)}`);
+
+// wintun.dll rides along as a bundled resource. It is only fetched by the
+// release workflow, so a local build without it should warn rather than fail —
+// the installer just ends up unable to bring a tunnel up.
+const dllSrc = [
+  path.join(repoRoot, 'target', triple, profile, 'wintun.dll'),
+  path.join(repoRoot, 'target', profile, 'wintun.dll'),
+].find((p) => fs.existsSync(p));
+if (dllSrc) {
+  fs.copyFileSync(dllSrc, path.join(destDir, 'wintun.dll'));
+  console.log(`stage-sidecar: ${path.relative(repoRoot, dllSrc)} -> binaries/wintun.dll`);
+} else if (fs.existsSync(path.join(destDir, 'wintun.dll'))) {
+  console.log('stage-sidecar: reusing the previously staged binaries/wintun.dll');
+} else {
+  console.warn('stage-sidecar: WARNING wintun.dll not found; a bundle build will fail on the missing resource');
+}

ostp-tun/src/windows.rs

@@ -99,18 +99,34 @@ pub async fn create(opts: OstpTunOptions) -> Result<OstpTunInterface> {
 
     let current_exe = std::env::current_exe()?.to_string_lossy().into_owned();
 
-    // A freshly created WinTun adapter can take several seconds to appear in
+    // Take the interface index straight from the adapter WinTun just created,
-    // GetAdaptersAddresses (it only shows up once it has an operational IPv4
+    // via the tun crate. The old code looked it up by FriendlyName == "ostp_tun"
-    // binding). The default route via the TUN is what actually captures
+    // through GetAdaptersAddresses — but WinTun does NOT set the FriendlyName to
-    // traffic, so this lookup is critical — give it a generous window (~15s).
+    // the adapter name, so that match never succeeded: on every single connect
-    let mut tun_index = None;
+    // it spun the full 15s and then gave up with "traffic will NOT be captured",
+    // leaving the default route (and, above, the server-IP bypass) uninstalled.
+    // get_adapter_index() is instant and correct.
+    use tun::AbstractDevice;
+    let tun_index = match dev.tun_index() {
+        Ok(idx) if idx > 0 => Some(idx as u32),
+        Ok(idx) => {
+            tracing::error!("WinTun reported a non-positive interface index ({idx})");
+            None
+        }
+        Err(e) => {
+            // Fall back to the old name lookup rather than fail outright.
+            tracing::warn!("Could not read TUN index from the adapter ({e}); falling back to name lookup");
+            let mut idx = None;
             for _ in 0..75 {
-        if let Some(idx) = windows_route::sys::get_interface_index("ostp_tun") {
+                if let Some(i) = windows_route::sys::get_interface_index("ostp_tun") {
-            tun_index = Some(idx);
+                    idx = Some(i);
                     break;
                 }
                 tokio::time::sleep(std::time::Duration::from_millis(200)).await;
             }
+            idx
+        }
+    };
 
     if let Some(idx) = tun_index {
         match windows_route::sys::add_ipv4_route(

ostp-tun/src/windows_route.rs

@@ -17,7 +17,7 @@ pub mod sys {
     use winapi::shared::minwindef::{DWORD, ULONG};
     use winapi::shared::winerror::{ERROR_INSUFFICIENT_BUFFER, NO_ERROR};
     use winapi::um::iphlpapi::{
-        CreateIpForwardEntry, DeleteIpForwardEntry, GetAdaptersAddresses, GetIpForwardTable,
+        DeleteIpForwardEntry, GetAdaptersAddresses, GetIpForwardTable,
     };
     use winapi::um::iptypes::{
         GAA_FLAG_SKIP_ANYCAST, GAA_FLAG_SKIP_DNS_SERVER, GAA_FLAG_SKIP_MULTICAST, IP_ADAPTER_ADDRESSES,
@@ -88,20 +88,47 @@ pub mod sys {
         if_index: u32,
         metric: u32,
     ) -> Result<(), String> {
-        let mut row: MIB_IPFORWARDROW = unsafe { mem::zeroed() };
+        // Installed through route.exe rather than CreateIpForwardEntry.
-        row.dwForwardDest = ipv4_to_dword(dest);
+        //
-        row.dwForwardMask = ipv4_to_dword(mask);
+        // The legacy CreateIpForwardEntry API was failing here with error 160
-        row.dwForwardNextHop = ipv4_to_dword(nexthop);
+        // (ERROR_BAD_ARGUMENTS) on every single route — server-IP bypass and TUN
-        row.dwForwardIfIndex = if_index;
+        // default route alike — which left the server IP routed INTO the tunnel
-        row.ForwardType = if nexthop == Ipv4Addr::UNSPECIFIED || dest == nexthop { 3 } else { 4 };
+        // (a loop that froze the link for seconds under load) and the default
-        row.ForwardProto = 3; // MIB_IPPROTO_NETMGMT
+        // route uninstalled. route.exe resolves the interface and validates the
-        row.dwForwardMetric1 = metric;
+        // gateway itself, and is what the teardown path already uses, so it
+        // succeeds where the hand-built MIB_IPFORWARDROW did not.
+        use std::os::windows::process::CommandExt;
+        use std::process::Command;
+        const CREATE_NO_WINDOW: u32 = 0x0800_0000;
 
-        let ret = unsafe { CreateIpForwardEntry(&mut row) };
+        // route add <dest> mask <mask> <gateway> metric <m> if <ifindex>
-        if ret == NO_ERROR {
+        let out = Command::new("route")
+            .args([
+                "add",
+                &dest.to_string(),
+                "mask",
+                &mask.to_string(),
+                &nexthop.to_string(),
+                "metric",
+                &metric.to_string(),
+                "if",
+                &if_index.to_string(),
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output()
+            .map_err(|e| format!("could not run route.exe: {e}"))?;
+
+        if out.status.success() {
             Ok(())
         } else {
-            Err(format!("CreateIpForwardEntry failed: {}", ret))
+            // route.exe prints its diagnostics to stdout, not stderr.
+            let msg = String::from_utf8_lossy(&out.stdout);
+            let msg = msg.trim();
+            Err(format!(
+                "route add failed (exit {:?}): {}",
+                out.status.code(),
+                if msg.is_empty() { "no output" } else { msg }
+            ))
         }
     }
 

ostp/src/main.rs

@@ -1713,6 +1713,9 @@ async fn run_client_directly(client_cfg: ClientConfig) -> Result<()> {
             frag_sleep: 2,
             junk_pc: [2, 5],
             junk_ps: [100, 1000],
+            ttl_desync: false,
+            ttl_desync_ttl: 8,
+            ttl_desync_count: 2,
         },
         dns_server: client_cfg.tun.as_ref().and_then(|t| t.dns.clone()),
         kill_switch: client_cfg.tun.as_ref().and_then(|t| t.kill_switch).unwrap_or(false),