From 588182693644067bebe8b28cf5169b8424a871da Mon Sep 17 00:00:00 2001 From: Julien Viard de Galbert Date: Wed, 21 Apr 2021 16:45:30 +0200 Subject: [PATCH] mesh: use LatestHandshake to validate NAT Endpoints --- pkg/mesh/mesh.go | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/pkg/mesh/mesh.go b/pkg/mesh/mesh.go index ee01895..ecbc762 100644 --- a/pkg/mesh/mesh.go +++ b/pkg/mesh/mesh.go @@ -454,13 +454,13 @@ func (m *Mesh) applyTopology() { return } // Find the old configuration. - oldConfRaw, err := wireguard.ShowConf(link.Attrs().Name) + oldConfDump, err := wireguard.ShowDump(link.Attrs().Name) if err != nil { level.Error(m.logger).Log("error", err) m.errorCounter.WithLabelValues("apply").Inc() return } - oldConf := wireguard.Parse(oldConfRaw) + oldConf := wireguard.ParseDump(oldConfDump) natEndpoints := discoverNATEndpoints(nodes, peers, oldConf, m.logger) nodes[m.hostname].DiscoveredEndpoints = natEndpoints t, err := NewTopology(nodes, peers, m.granularity, m.hostname, nodes[m.hostname].Endpoint.Port, m.priv, m.subnet, nodes[m.hostname].PersistentKeepalive, m.logger) @@ -782,17 +782,15 @@ func discoverNATEndpoints(nodes map[string]*Node, peers map[string]*Peer, conf * } for _, n := range nodes { if peer, ok := keys[string(n.Key)]; ok && n.PersistentKeepalive > 0 { - level.Debug(logger).Log("msg", "WireGuard Update NAT Endpoint", "node", n.Name, "endpoint", peer.Endpoint, "former-endpoint", n.Endpoint, "same", n.Endpoint.Equal(peer.Endpoint, false)) - // Should check location leader but only available in topology ... or have topology handle that list - // Better check wg latest-handshake - if !n.Endpoint.Equal(peer.Endpoint, false) { + level.Debug(logger).Log("msg", "WireGuard Update NAT Endpoint", "node", n.Name, "endpoint", peer.Endpoint, "former-endpoint", n.Endpoint, "same", n.Endpoint.Equal(peer.Endpoint, false), "latest-handshake", peer.LatestHandshake) + if (peer.LatestHandshake != time.Time{}) { natEndpoints[string(n.Key)] = peer.Endpoint } } } for _, p := range peers { if peer, ok := keys[string(p.PublicKey)]; ok && p.PersistentKeepalive > 0 { - if !p.Endpoint.Equal(peer.Endpoint, false) { + if (peer.LatestHandshake != time.Time{}) { natEndpoints[string(p.PublicKey)] = peer.Endpoint } }