Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: simplify passive keepalive #70

Merged
merged 5 commits into from
Jan 24, 2025
Merged

Conversation

thomaseizinger
Copy link
Member

@thomaseizinger thomaseizinger commented Jan 24, 2025

WireGuard has a passive keepalive mechanism. To quote the spec:

If a peer has received a validly-authenticated transport data message (section 5.4.6), but does not have any packets
itself to send back for Keepalive-Timeout seconds, it sends a keepalive message.

This is currently implemented correctly in boringtun but it is somewhat convoluted.

  1. On various parts in the code, the internal timers are ticked over. For example, when we receive keepalive messages or data messages.
  2. Whether or not we should send a passive keepalive is tracked in the want_keepalive boolean.
  3. This boolean is set whenever we receive any packet (including keepalives). This is a bug.
  4. The above bug is mitigated because of an additional condition that the last received data packet must be after the last sent packet.
  5. Lastly, the want_keepalive boolean is checked and directly set to false as part of our timer code. Combining these two things makes the code hard to reason about.

We can simplify this greatly by directly tracking the timestamp, when a keepalive is due. The new want_keepalive_at timer is set every time we receive a data packet and cleared every time we send a packet. In update_timers_at, we simply check if now has surpassed that timer and send a keepalive if that is the case.

As a bonus, this functionality is now also unit-tested.

Instead of checking whether we have received a data packet after sending
an authenticated one, we can simplify only set `want_keepalive` when we
actually receive a data packet.
Instead of modifying the `want_passive_keepalive` variable as we are
reading it, we only check it here.

It will get modified when we actually send a packet.
Copy link
Member

@jamilbk jamilbk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

timestamps > booleans

LGTM

@thomaseizinger thomaseizinger added this pull request to the merge queue Jan 24, 2025
Merged via the queue into master with commit 98efc13 Jan 24, 2025
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants