New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LLT-5884: PQ VPN breaks after some time of nonet #1049

Merged

mathiaspeters merged 1 commit into main from LLT-5884_pq_break_after_nonet

Jan 13, 2025

Contributor

mathiaspeters commented Jan 7, 2025 •

edited

Loading

Problem

If a client is connected to PQ VPN and then doesn't do a new handshake within wireguard's 180s reject connection timeout (can happen for example during nonet), the client would not be able to establish a new handshake since it's supplying a preshared key even though the server doesn't expect one, leading to a broken VPN connection

Solution

If postquantum is active and time since last handshake exceeds wireguards reject threshold (in uapi::Peer::time_since_last_handshake this is represented as None), restart postquantum

☑️ Definition of Done checklist

Commit history is clean (requirements)
README.md is updated
Functionality is covered by unit or integration tests

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from c91ac67 to 5a8397f Compare

January 7, 2025 15:14

mathiaspeters temporarily deployed to Internal

January 7, 2025 15:14

— with

GitHub Actions Inactive

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from 5a8397f to c809a39 Compare

January 7, 2025 15:56

mathiaspeters temporarily deployed to Internal

January 7, 2025 15:56

— with

GitHub Actions Inactive

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from c809a39 to 1a950f6 Compare

January 9, 2025 14:22

mathiaspeters temporarily deployed to Internal

January 9, 2025 14:23

— with

GitHub Actions Inactive

mathiaspeters commented

View reviewed changes

nat-lab/tests/test_pq.py Show resolved Hide resolved

mathiaspeters commented

View reviewed changes

nat-lab/tests/test_pq.py Show resolved Hide resolved

mathiaspeters commented

View reviewed changes

crates/telio-pq/src/entity.rs Show resolved Hide resolved

mathiaspeters commented

View reviewed changes

crates/telio-pq/src/entity.rs Show resolved Hide resolved

mathiaspeters commented

View reviewed changes

crates/telio-pq/src/entity.rs Outdated Show resolved Hide resolved

mathiaspeters commented

View reviewed changes

nat-lab/tests/test_pq.py Show resolved Hide resolved

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from 1a950f6 to 1596ec0 Compare

January 9, 2025 15:05

mathiaspeters temporarily deployed to Internal

January 9, 2025 15:05

— with

GitHub Actions Inactive

mathiaspeters marked this pull request as ready for review

January 9, 2025 15:09

mathiaspeters requested a review from a team as a code owner

January 9, 2025 15:09

Jauler reviewed

View reviewed changes

src/device/wg_controller.rs Outdated Show resolved Hide resolved

Jauler reviewed

View reviewed changes

nat-lab/tests/test_pq.py Outdated Show resolved Hide resolved

Jauler reviewed

View reviewed changes

nat-lab/tests/test_pq.py Show resolved Hide resolved

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from 1596ec0 to ae35584 Compare

January 9, 2025 15:47

mathiaspeters temporarily deployed to Internal

January 9, 2025 15:47

— with

GitHub Actions Inactive

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch 2 times, most recently from 86ed40e to 85cdabc Compare

January 10, 2025 15:20

mathiaspeters temporarily deployed to Internal

January 10, 2025 15:20

— with

GitHub Actions Inactive

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from 85cdabc to 4b25c25 Compare

January 10, 2025 15:51

mathiaspeters temporarily deployed to Internal

January 10, 2025 15:51

— with

GitHub Actions Inactive

LukasPukenis previously approved these changes

View reviewed changes

Contributor

LukasPukenis left a comment

+2 Android confirmed the events are fixed as well and connectivity is restored.

For the time fast-forwarding I suggest creating a ticket but it should be a generic one as other testcases also use some sleep :)

mathiaspeters dismissed LukasPukenis’s stale review via

d0e91bb

January 13, 2025 10:36

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from 4b25c25 to d0e91bb Compare

January 13, 2025 10:36

mathiaspeters temporarily deployed to Internal

January 13, 2025 10:36

— with

GitHub Actions Inactive


          Restart PQ after nonet

f9e3e38

There was a bug where after some time of nonet the handshake to the VPN
server would expire and then when the device came back online it would
not be able to re-establish a new handshake because it was trying to
include a preshared key the server no longer knew about. To fix it,
during wg state consolidation, if postquantum is active and the latest
handshake was more than 180 seconds ago (how long after a handshake
wireguard is hardcoded to reject a connection if no new handshake is
established), restart postquantum.

mathiaspeters force-pushed the LLT-5884_pq_break_after_nonet branch from d0e91bb to f9e3e38 Compare

January 13, 2025 12:19

mathiaspeters temporarily deployed to Internal

January 13, 2025 12:19

— with

GitHub Actions Inactive

LukasPukenis approved these changes

View reviewed changes

mathiaspeters merged commit 9d60ac0 into main

62 of 63 checks passed

mathiaspeters deleted the LLT-5884_pq_break_after_nonet branch

January 13, 2025 14:17

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet