mirror of
https://github.com/fosrl/gerbil.git
synced 2026-09-07 22:51:28 +02:00
Compare commits
52 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
551eb18e61 | ||
|
|
2eb4090c20 | ||
|
|
5d70c76bfc | ||
|
|
c63be17369 | ||
|
|
939fbd5d2c | ||
|
|
94594f40a5 | ||
|
|
e1b47b69aa | ||
|
|
654a3c777a | ||
|
|
6f1851639a | ||
|
|
74629a97f7 | ||
|
|
5c697afcac | ||
|
|
6a26078f9e | ||
|
|
e25e5766df | ||
|
|
2264c1c7b4 | ||
|
|
904199121d | ||
|
|
5b92bdeb1c | ||
|
|
daecacbd8e | ||
|
|
8efce78d94 | ||
|
|
c29e6ec535 | ||
|
|
0a1496e8de | ||
|
|
4f325dd92f | ||
|
|
8328a4751a | ||
|
|
860ba69a88 | ||
|
|
e1c9836dc1 | ||
|
|
4f457db7b5 | ||
|
|
6d548ea166 | ||
|
|
d611eb2022 | ||
|
|
4d8f5923c3 | ||
|
|
6af41f2a6e | ||
|
|
c638090ef7 | ||
|
|
cde79b5c50 | ||
|
|
af42ae3448 | ||
|
|
f7d874cd78 | ||
|
|
f3f70fff14 | ||
|
|
95e83da5c1 | ||
|
|
19a71e7c0a | ||
|
|
cf863702a0 | ||
|
|
b8bb1249c9 | ||
|
|
18078e0e06 | ||
|
|
44622a883f | ||
|
|
3926dcc6be | ||
|
|
65bb3fc101 | ||
|
|
8683a62b4b | ||
|
|
7d1f963820 | ||
|
|
775def1a97 | ||
|
|
180b5fe768 | ||
|
|
e5241751fc | ||
|
|
34f8abfd37 | ||
|
|
65e599f833 | ||
|
|
cae46757dd | ||
|
|
4b575016f3 | ||
|
|
9e5539a5ba |
5
.github/ISSUE_TEMPLATE/1.bug_report.yml
vendored
5
.github/ISSUE_TEMPLATE/1.bug_report.yml
vendored
@@ -14,12 +14,13 @@ body:
|
||||
label: Environment
|
||||
description: Please fill out the relevant details below for your environment.
|
||||
value: |
|
||||
- OS Type & Version: (e.g., Ubuntu 22.04)
|
||||
- OS Type & Version:
|
||||
- Pangolin Version:
|
||||
- Edition (Community or Enterprise):
|
||||
- Gerbil Version:
|
||||
- Traefik Version:
|
||||
- Newt Version:
|
||||
- Olm Version: (if applicable)
|
||||
- Client Version:
|
||||
validations:
|
||||
required: true
|
||||
|
||||
|
||||
36
.github/dependabot.yml
vendored
36
.github/dependabot.yml
vendored
@@ -1,40 +1,32 @@
|
||||
version: 2
|
||||
|
||||
updates:
|
||||
- package-ecosystem: "gomod"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
dev-patch-updates:
|
||||
dependency-type: "development"
|
||||
update-types:
|
||||
- "patch"
|
||||
dev-minor-updates:
|
||||
dependency-type: "development"
|
||||
update-types:
|
||||
- "minor"
|
||||
prod-patch-updates:
|
||||
dependency-type: "production"
|
||||
update-types:
|
||||
- "patch"
|
||||
prod-minor-updates:
|
||||
dependency-type: "production"
|
||||
update-types:
|
||||
- "minor"
|
||||
go-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
patch-updates:
|
||||
update-types:
|
||||
- "patch"
|
||||
minor-updates:
|
||||
update-types:
|
||||
- "minor"
|
||||
docker-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
|
||||
- package-ecosystem: "github-actions"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
github-actions-dependencies:
|
||||
patterns:
|
||||
- "*"
|
||||
|
||||
21
.github/workflows/cicd.yml
vendored
21
.github/workflows/cicd.yml
vendored
@@ -36,16 +36,16 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
||||
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
|
||||
uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
|
||||
with:
|
||||
registry: docker.io
|
||||
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
||||
@@ -57,9 +57,9 @@ jobs:
|
||||
shell: bash
|
||||
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
||||
with:
|
||||
go-version: 1.25
|
||||
go-version: 1.26
|
||||
|
||||
- name: Update version in main.go
|
||||
run: |
|
||||
@@ -80,7 +80,7 @@ jobs:
|
||||
shell: bash
|
||||
|
||||
- name: Login in to GHCR
|
||||
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
|
||||
uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
@@ -107,8 +107,9 @@ jobs:
|
||||
shell: bash
|
||||
|
||||
- name: Install cosign
|
||||
# cosign is used to sign and verify container images (key and keyless)
|
||||
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
with:
|
||||
cosign-release: v3.0.6
|
||||
|
||||
- name: Dual-sign and verify (GHCR & Docker Hub)
|
||||
# Sign each image by digest using keyless (OIDC) and key-based signing,
|
||||
@@ -155,7 +156,7 @@ jobs:
|
||||
shell: bash
|
||||
|
||||
- name: Upload artifacts from /bin
|
||||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
with:
|
||||
name: binaries
|
||||
path: bin/
|
||||
|
||||
2
.github/workflows/mirror.yaml
vendored
2
.github/workflows/mirror.yaml
vendored
@@ -23,7 +23,7 @@ jobs:
|
||||
skopeo --version
|
||||
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
|
||||
- name: Input check
|
||||
run: |
|
||||
|
||||
10
.github/workflows/test.yml
vendored
10
.github/workflows/test.yml
vendored
@@ -14,12 +14,16 @@ jobs:
|
||||
runs-on: amd64-runner
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
|
||||
- name: Read go version
|
||||
id: goversion
|
||||
run: echo "version=$(cat .go-version)" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
||||
with:
|
||||
go-version: 1.26
|
||||
go-version: ${{ steps.goversion.outputs.version }}
|
||||
|
||||
- name: Build go
|
||||
run: go build
|
||||
|
||||
@@ -1 +1 @@
|
||||
1.25
|
||||
1.26
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
FROM golang:1.26-alpine AS builder
|
||||
ARG GO_VERSION=1.26
|
||||
FROM golang:${GO_VERSION}-alpine AS builder
|
||||
|
||||
# Set the working directory inside the container
|
||||
WORKDIR /app
|
||||
@@ -16,7 +17,7 @@ COPY . .
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -o /gerbil
|
||||
|
||||
# Start a new stage from scratch
|
||||
FROM alpine:3.23 AS runner
|
||||
FROM alpine:3.24 AS runner
|
||||
|
||||
RUN apk add --no-cache iptables iproute2
|
||||
|
||||
@@ -25,4 +26,4 @@ COPY entrypoint.sh /
|
||||
|
||||
RUN chmod +x /entrypoint.sh
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
CMD ["gerbil"]
|
||||
CMD ["gerbil"]
|
||||
|
||||
6
Makefile
6
Makefile
@@ -1,4 +1,6 @@
|
||||
|
||||
GO_VERSION := $(shell cat .go-version 2>/dev/null)
|
||||
|
||||
all: build push
|
||||
|
||||
docker-build-release:
|
||||
@@ -7,10 +9,10 @@ docker-build-release:
|
||||
exit 1; \
|
||||
fi
|
||||
docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:latest -f Dockerfile --push .
|
||||
docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:$(tag) -f Dockerfile --push .
|
||||
docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:$(tag) -f Dockerfile --build-arg GO_VERSION=$(GO_VERSION) --push .
|
||||
|
||||
build:
|
||||
docker build -t fosrl/gerbil:latest .
|
||||
docker build -t fosrl/gerbil:latest --build-arg GO_VERSION=$(GO_VERSION) .
|
||||
|
||||
push:
|
||||
docker push fosrl/gerbil:latest
|
||||
|
||||
45
go.mod
45
go.mod
@@ -4,16 +4,16 @@ go 1.26.0
|
||||
|
||||
require (
|
||||
github.com/patrickmn/go-cache v2.1.0+incompatible
|
||||
github.com/prometheus/client_golang v1.20.5
|
||||
github.com/prometheus/client_golang v1.24.1
|
||||
github.com/vishvananda/netlink v1.3.1
|
||||
go.opentelemetry.io/otel v1.43.0
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0
|
||||
go.opentelemetry.io/otel/metric v1.43.0
|
||||
go.opentelemetry.io/otel/sdk v1.43.0
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0
|
||||
golang.org/x/crypto v0.49.0
|
||||
golang.org/x/sync v0.20.0
|
||||
go.opentelemetry.io/otel v1.45.0
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0
|
||||
go.opentelemetry.io/otel/metric v1.45.0
|
||||
go.opentelemetry.io/otel/sdk v1.45.0
|
||||
go.opentelemetry.io/otel/sdk/metric v1.45.0
|
||||
golang.org/x/crypto v0.54.0
|
||||
golang.org/x/sync v0.22.0
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
|
||||
)
|
||||
|
||||
@@ -21,30 +21,29 @@ require (
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
||||
github.com/go-logr/logr v1.4.3 // indirect
|
||||
github.com/go-logr/logr v1.4.4 // indirect
|
||||
github.com/go-logr/stdr v1.2.2 // indirect
|
||||
github.com/google/go-cmp v0.7.0 // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
||||
github.com/josharian/native v1.1.0 // indirect
|
||||
github.com/klauspost/compress v1.17.9 // indirect
|
||||
github.com/mdlayher/genetlink v1.3.2 // indirect
|
||||
github.com/mdlayher/netlink v1.7.2 // indirect
|
||||
github.com/mdlayher/socket v0.4.1 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
github.com/prometheus/client_model v0.6.1 // indirect
|
||||
github.com/prometheus/common v0.61.0 // indirect
|
||||
github.com/prometheus/procfs v0.15.1 // indirect
|
||||
github.com/prometheus/client_model v0.6.2 // indirect
|
||||
github.com/prometheus/common v0.70.1 // indirect
|
||||
github.com/prometheus/procfs v0.21.1 // indirect
|
||||
github.com/vishvananda/netns v0.0.5 // indirect
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
||||
golang.org/x/net v0.52.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/text v0.35.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.45.0 // indirect
|
||||
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
||||
golang.org/x/net v0.57.0 // indirect
|
||||
golang.org/x/sys v0.47.0 // indirect
|
||||
golang.org/x/text v0.40.0 // indirect
|
||||
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
google.golang.org/grpc v1.80.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
||||
google.golang.org/grpc v1.83.0 // indirect
|
||||
google.golang.org/protobuf v1.36.11 // indirect
|
||||
)
|
||||
|
||||
98
go.sum
98
go.sum
@@ -7,8 +7,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
|
||||
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
|
||||
@@ -17,12 +17,12 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
|
||||
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
|
||||
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
|
||||
github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
|
||||
github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
|
||||
github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
|
||||
github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
|
||||
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
|
||||
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
|
||||
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
|
||||
@@ -39,14 +39,14 @@ github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaR
|
||||
github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
|
||||
github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
|
||||
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||
github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
|
||||
github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
|
||||
github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
|
||||
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
|
||||
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
|
||||
github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
|
||||
github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
|
||||
github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
|
||||
github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
|
||||
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
|
||||
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
|
||||
github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
|
||||
@@ -55,46 +55,52 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
|
||||
github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
|
||||
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
|
||||
go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
|
||||
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
|
||||
go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
|
||||
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
|
||||
go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
|
||||
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
|
||||
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
|
||||
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
|
||||
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
|
||||
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
|
||||
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
|
||||
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
|
||||
go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0 h1:klTViGcsvLCd1xN3rZzfZ12NslC/OimbmR+k+A006RI=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0/go.mod h1:jRsK04CWmXuY8A0O+wMpSf+t90RHZ53o5Qmxn2PQPfk=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0 h1:pnxy6c/kvNBWdNNFzqpjuJLm9Hjhgk/Q0nY221rwuk0=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0/go.mod h1:qw6YsFapotRwoDhXRZvljzaOvCQB7UfnafEJagpN2TA=
|
||||
go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
|
||||
go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
|
||||
go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
|
||||
go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
|
||||
go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
|
||||
go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
|
||||
go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
|
||||
go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
|
||||
go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
|
||||
go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
|
||||
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
|
||||
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
|
||||
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
|
||||
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
|
||||
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
|
||||
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
|
||||
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
|
||||
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
|
||||
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
|
||||
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
|
||||
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
|
||||
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
|
||||
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
|
||||
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
|
||||
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
|
||||
google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
|
||||
google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
|
||||
google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
|
||||
google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
|
||||
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
|
||||
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
|
||||
@@ -58,6 +58,7 @@ var (
|
||||
udpPacketSizeBytes observability.Histogram
|
||||
holePunchEventsTotal observability.Counter
|
||||
proxyMappingActive observability.UpDownCounter
|
||||
relayUDPConnectionsActive observability.UpDownCounter
|
||||
sessionRebuiltTotal observability.Counter
|
||||
commPatternActive observability.UpDownCounter
|
||||
proxyCleanupRemovedTotal observability.Counter
|
||||
@@ -342,6 +343,11 @@ func createInstruments() error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
relayUDPConnectionsActive, err = newUpDownCounter("gerbil_relay_udp_connections_active",
|
||||
"Number of open per-peer outbound UDP sockets held by the relay connection pool", "ifname")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
sessionRebuiltTotal, err = newCounter("gerbil_session_rebuilt_total",
|
||||
"Count of sessions rebuilt from communication patterns", "ifname")
|
||||
if err != nil {
|
||||
@@ -711,6 +717,13 @@ func RecordSession(ifname string, delta int64) {
|
||||
activeSessions.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
|
||||
}
|
||||
|
||||
func RecordUDPConnection(ifname string, delta int64) {
|
||||
if relayUDPConnectionsActive == nil {
|
||||
return
|
||||
}
|
||||
relayUDPConnectionsActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
|
||||
}
|
||||
|
||||
func RecordSessionRebuilt(ifname string) {
|
||||
if sessionRebuiltTotal == nil {
|
||||
return
|
||||
|
||||
263
main.go
263
main.go
@@ -3,6 +3,7 @@ package main
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"flag"
|
||||
@@ -11,10 +12,12 @@ import (
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
_ "net/http/pprof"
|
||||
"os"
|
||||
"os/exec"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"runtime/pprof"
|
||||
"strconv"
|
||||
@@ -46,6 +49,7 @@ var (
|
||||
doTrafficShaping bool
|
||||
bandwidthLimit string
|
||||
ifbName string // IFB device name for ingress traffic shaping
|
||||
disableFirewall bool
|
||||
)
|
||||
|
||||
type WgConfig struct {
|
||||
@@ -102,6 +106,144 @@ type UpdateDestinationsRequest struct {
|
||||
Destinations []relay.PeerDestination `json:"destinations"`
|
||||
}
|
||||
|
||||
// pangolinDestHeader carries the downstream host:port (reachable over the
|
||||
// WireGuard interface) that a /router request should be rewritten to,
|
||||
// optionally prefixed with a scheme (e.g. "https://100.96.128.1:443"). It is
|
||||
// stripped before the request is forwarded.
|
||||
const pangolinDestHeader = "p-dest-header"
|
||||
|
||||
// pangolinHostHeader optionally carries the Host header value that should be
|
||||
// sent to the destination, when it differs from pangolinDestHeader (e.g. the
|
||||
// target's configured IP/hostname rather than the WireGuard routing
|
||||
// address). It is stripped before the request is forwarded. When absent,
|
||||
// the destination from pangolinDestHeader is used as the Host header, same
|
||||
// as before.
|
||||
const pangolinHostHeader = "p-dest-host-header"
|
||||
|
||||
// splitDestHeader separates an optional "scheme://" prefix from a
|
||||
// pangolinDestHeader value, defaulting to "http" when none is present.
|
||||
func splitDestHeader(dest string) (scheme, host string) {
|
||||
if s, rest, ok := strings.Cut(dest, "://"); ok {
|
||||
return s, rest
|
||||
}
|
||||
return "http", dest
|
||||
}
|
||||
|
||||
// hostname strips an optional ":port" suffix from a host header value.
|
||||
func hostname(hostport string) string {
|
||||
if h, _, err := net.SplitHostPort(hostport); err == nil {
|
||||
return h
|
||||
}
|
||||
return hostport
|
||||
}
|
||||
|
||||
// routerSNIContextKey carries the TLS ServerName (SNI) that
|
||||
// routerTransport's DialTLSContext should present, since we dial the
|
||||
// WireGuard destination IP but the remote end typically terminates TLS
|
||||
// based on the original hostname (pangolinHostHeader), not that IP.
|
||||
type routerSNIContextKey struct{}
|
||||
|
||||
// routerTransport is routerProxy's RoundTripper. It mirrors
|
||||
// http.DefaultTransport except for TLS dials, where it sets the SNI from
|
||||
// routerSNIContextKey instead of letting it default to the dial address
|
||||
// (the WireGuard IP), which the destination's TLS termination won't have a
|
||||
// matching certificate/route for.
|
||||
var routerTransport = &http.Transport{
|
||||
Proxy: http.ProxyFromEnvironment,
|
||||
DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
serverName := hostname(addr)
|
||||
if sni, ok := ctx.Value(routerSNIContextKey{}).(string); ok && sni != "" {
|
||||
serverName = sni
|
||||
}
|
||||
dialer := &tls.Dialer{Config: &tls.Config{ServerName: serverName}}
|
||||
return dialer.DialContext(ctx, network, addr)
|
||||
},
|
||||
}
|
||||
|
||||
// logDebugRequest dumps a request's destination, headers, and body at debug
|
||||
// level for troubleshooting (e.g. verifying an auth header made it through
|
||||
// the proxy chain intact). It reads and restores req.Body so the request can
|
||||
// still be sent afterward. Header values (including secrets like API keys)
|
||||
// are logged as-is - only intended to be enabled for local troubleshooting.
|
||||
func logDebugRequest(label string, req *http.Request) {
|
||||
var headerLines strings.Builder
|
||||
for name, values := range req.Header {
|
||||
for _, v := range values {
|
||||
fmt.Fprintf(&headerLines, "\n %s: %s", name, v)
|
||||
}
|
||||
}
|
||||
|
||||
body := []byte("<empty>")
|
||||
if req.Body != nil {
|
||||
data, err := io.ReadAll(req.Body)
|
||||
req.Body.Close()
|
||||
if err != nil {
|
||||
logger.Error("%s: failed to read body for logging: %v", label, err)
|
||||
} else {
|
||||
body = data
|
||||
}
|
||||
req.Body = io.NopCloser(bytes.NewReader(data))
|
||||
}
|
||||
|
||||
logger.Debug("%s: %s %s://%s%s headers:%s\nbody: %s", label, req.Method, req.URL.Scheme, req.Host, req.URL.RequestURI(), headerLines.String(), body)
|
||||
}
|
||||
|
||||
// routerProxy forwards /router/* requests from the Pangolin AI gateway to a
|
||||
// destination on the WireGuard network, as named by pangolinDestHeader.
|
||||
// Used for proxying AI chat completion requests (incl. streaming) to
|
||||
// providers reachable only from a site.
|
||||
var routerProxy = &httputil.ReverseProxy{
|
||||
Rewrite: func(pr *httputil.ProxyRequest) {
|
||||
scheme, dest := splitDestHeader(pr.In.Header.Get(pangolinDestHeader))
|
||||
|
||||
pr.Out.URL.Scheme = scheme
|
||||
pr.Out.URL.Host = dest
|
||||
pr.Out.URL.Path = strings.TrimPrefix(pr.In.URL.Path, "/router")
|
||||
if !strings.HasPrefix(pr.Out.URL.Path, "/") {
|
||||
pr.Out.URL.Path = "/" + pr.Out.URL.Path
|
||||
}
|
||||
pr.Out.URL.RawPath = ""
|
||||
pr.Out.Host = dest
|
||||
if hostOverride := pr.In.Header.Get(pangolinHostHeader); hostOverride != "" {
|
||||
pr.Out.Host = hostOverride
|
||||
ctx := context.WithValue(pr.Out.Context(), routerSNIContextKey{}, hostname(hostOverride))
|
||||
pr.Out = pr.Out.WithContext(ctx)
|
||||
}
|
||||
|
||||
pr.Out.Header.Del(pangolinDestHeader)
|
||||
pr.Out.Header.Del(pangolinHostHeader)
|
||||
|
||||
logger.Debug("Router proxy: %s %s -> %s (Host: %s)", pr.In.Method, pr.In.URL.Path, pr.Out.URL.String(), pr.Out.Host)
|
||||
logDebugRequest("Router outbound request", pr.Out)
|
||||
},
|
||||
Transport: routerTransport,
|
||||
// Flush written bytes to the client immediately rather than buffering,
|
||||
// which is required for SSE-based streaming chat completions.
|
||||
FlushInterval: -1,
|
||||
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
|
||||
logger.Error("Router proxy error for %s: %v", r.URL.Path, err)
|
||||
http.Error(w, "Bad gateway", http.StatusBadGateway)
|
||||
},
|
||||
}
|
||||
|
||||
func handleRouter(w http.ResponseWriter, r *http.Request) {
|
||||
dest := r.Header.Get(pangolinDestHeader)
|
||||
hostOverride := r.Header.Get(pangolinHostHeader)
|
||||
logger.Debug("Router request received: %s %s dest=%s host=%s remote=%s", r.Method, r.URL.Path, dest, hostOverride, r.RemoteAddr)
|
||||
|
||||
if dest == "" {
|
||||
http.Error(w, fmt.Sprintf("Missing %s header", pangolinDestHeader), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
_, host := splitDestHeader(dest)
|
||||
if _, _, err := net.SplitHostPort(host); err != nil {
|
||||
http.Error(w, "Invalid destination", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
routerProxy.ServeHTTP(w, r)
|
||||
}
|
||||
|
||||
// httpMetricsMiddleware wraps HTTP handlers with metrics tracking
|
||||
func httpMetricsMiddleware(endpoint string, handler http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -131,6 +273,16 @@ func (w *responseWriterWrapper) WriteHeader(statusCode int) {
|
||||
w.ResponseWriter.WriteHeader(statusCode)
|
||||
}
|
||||
|
||||
// Unwrap exposes the underlying ResponseWriter so http.ResponseController
|
||||
// (used by httputil.ReverseProxy's streaming Flush, and by Hijack/Push
|
||||
// callers) can see through this wrapper to the real http.Flusher etc.
|
||||
// Without this, ReverseProxy's flushes on /router/* silently no-op and
|
||||
// streamed responses (e.g. SSE) get buffered until the response completes
|
||||
// instead of being forwarded incrementally.
|
||||
func (w *responseWriterWrapper) Unwrap() http.ResponseWriter {
|
||||
return w.ResponseWriter
|
||||
}
|
||||
|
||||
func parseLogLevel(level string) logger.LogLevel {
|
||||
switch strings.ToUpper(level) {
|
||||
case "DEBUG":
|
||||
@@ -149,8 +301,6 @@ func parseLogLevel(level string) logger.LogLevel {
|
||||
}
|
||||
|
||||
func main() {
|
||||
go monitorMemory(1024 * 1024 * 512) // trigger if memory usage exceeds 512MB
|
||||
|
||||
var (
|
||||
err error
|
||||
wgconfig WgConfig
|
||||
@@ -196,6 +346,7 @@ func main() {
|
||||
proxyProtocolStr := os.Getenv("PROXY_PROTOCOL")
|
||||
doTrafficShapingStr := os.Getenv("DO_TRAFFIC_SHAPING")
|
||||
bandwidthLimitStr := os.Getenv("BANDWIDTH_LIMIT")
|
||||
disableFirewallStr := os.Getenv("DISABLE_FIREWALL")
|
||||
|
||||
// Read metrics env vars (defaults applied by DefaultMetricsConfig; these override defaults).
|
||||
metricsEnabled = true // default
|
||||
@@ -316,6 +467,13 @@ func main() {
|
||||
flag.BoolVar(&doTrafficShaping, "do-traffic-shaping", false, "Whether to set up traffic shaping rules for peers (requires tc command and root privileges)")
|
||||
}
|
||||
|
||||
if disableFirewallStr != "" {
|
||||
disableFirewall = strings.ToLower(disableFirewallStr) == "true"
|
||||
}
|
||||
if disableFirewallStr == "" {
|
||||
flag.BoolVar(&disableFirewall, "disable-firewall", false, "Disable WireGuard firewall rules to allow all inbound traffic on the interface")
|
||||
}
|
||||
|
||||
if bandwidthLimitStr != "" {
|
||||
bandwidthLimit = bandwidthLimitStr
|
||||
}
|
||||
@@ -335,6 +493,15 @@ func main() {
|
||||
|
||||
flag.Parse()
|
||||
|
||||
// Heap profiles are dumped into the configured config directory (the same
|
||||
// directory as the config file, or /var/config as a fallback for remote-config
|
||||
// setups) so they land on the volume the operator actually has mounted.
|
||||
heapDir := "/var/config/heap"
|
||||
if configFile != "" {
|
||||
heapDir = filepath.Join(filepath.Dir(configFile), "heap")
|
||||
}
|
||||
go monitorMemory(1024*1024*512, heapDir) // trigger if memory usage exceeds 512MB
|
||||
|
||||
// Derive IFB device name from the WireGuard interface name (Linux limit: 15 chars)
|
||||
ifbName = "ifb_" + interfaceName
|
||||
if len(ifbName) > 15 {
|
||||
@@ -551,6 +718,7 @@ func main() {
|
||||
http.HandleFunc("/update-destinations", httpMetricsMiddleware("update_destinations", handleUpdateDestinations))
|
||||
http.HandleFunc("/update-local-snis", httpMetricsMiddleware("update_local_snis", handleUpdateLocalSNIs))
|
||||
http.HandleFunc("/healthz", httpMetricsMiddleware("healthz", handleHealthz))
|
||||
http.HandleFunc("/router/", httpMetricsMiddleware("router", handleRouter))
|
||||
|
||||
// Register metrics endpoint only for Prometheus backend.
|
||||
// OTel backend pushes to a collector; no /metrics endpoint needed.
|
||||
@@ -732,7 +900,9 @@ func ensureWireguardInterface(wgconfig WgConfig) error {
|
||||
logger.Warn("Failed to ensure MSS clamping: %v", err)
|
||||
}
|
||||
|
||||
if err := ensureWireguardFirewall(); err != nil {
|
||||
if disableFirewall {
|
||||
logger.Warn("Firewall disabled: all inbound traffic on %s will be allowed", interfaceName)
|
||||
} else if err := ensureWireguardFirewall(wgconfig.IpAddress); err != nil {
|
||||
logger.Warn("Failed to ensure WireGuard firewall rules: %v", err)
|
||||
}
|
||||
|
||||
@@ -908,11 +1078,18 @@ func ensureMSSClamping() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureWireguardFirewall() error {
|
||||
func ensureWireguardFirewall(localIpAddress string) error {
|
||||
// Rules to enforce:
|
||||
// 1. Allow established/related connections (responses to our outbound traffic)
|
||||
// 2. Allow ICMP ping packets
|
||||
// 3. Drop all other inbound traffic from peers
|
||||
// 3. Allow inbound traffic to ports 80/443 on the local IP only (for Traefik)
|
||||
// 4. Drop all other inbound traffic from peers
|
||||
|
||||
// Strip any CIDR suffix so we're left with just the host IP
|
||||
localIp := localIpAddress
|
||||
if ip, _, err := net.ParseCIDR(localIpAddress); err == nil {
|
||||
localIp = ip.String()
|
||||
}
|
||||
|
||||
// Define the rules we want to ensure exist
|
||||
rules := [][]string{
|
||||
@@ -932,6 +1109,24 @@ func ensureWireguardFirewall() error {
|
||||
"--icmp-type", "8",
|
||||
"-j", "ACCEPT",
|
||||
},
|
||||
// Allow inbound HTTP to the local IP only (for Traefik)
|
||||
{
|
||||
"-A", "INPUT",
|
||||
"-i", interfaceName,
|
||||
"-p", "tcp",
|
||||
"--dport", "80",
|
||||
"-d", localIp,
|
||||
"-j", "ACCEPT",
|
||||
},
|
||||
// Allow inbound HTTPS to the local IP only (for Traefik)
|
||||
{
|
||||
"-A", "INPUT",
|
||||
"-i", interfaceName,
|
||||
"-p", "tcp",
|
||||
"--dport", "443",
|
||||
"-d", localIp,
|
||||
"-j", "ACCEPT",
|
||||
},
|
||||
// Drop all other inbound traffic from WireGuard interface
|
||||
{
|
||||
"-A", "INPUT",
|
||||
@@ -1493,6 +1688,24 @@ func calculatePeerBandwidth() ([]PeerBandwidth, error) {
|
||||
return peerBandwidths, nil
|
||||
}
|
||||
|
||||
// defaultBandwidthReportBatchSize caps how many peer bandwidth readings are
|
||||
// sent in a single POST. Reporting every peer in one request grows unbounded
|
||||
// with fleet size and can exceed the remote server's request body limit,
|
||||
// which surfaces as "413 Payload Too Large" and silently drops that whole
|
||||
// report cycle. Overridable via GERBIL_BANDWIDTH_BATCH_SIZE.
|
||||
const defaultBandwidthReportBatchSize = 250
|
||||
|
||||
var bandwidthReportBatchSize = loadBandwidthReportBatchSize()
|
||||
|
||||
func loadBandwidthReportBatchSize() int {
|
||||
if v := os.Getenv("GERBIL_BANDWIDTH_BATCH_SIZE"); v != "" {
|
||||
if n, err := strconv.Atoi(v); err == nil && n > 0 {
|
||||
return n
|
||||
}
|
||||
}
|
||||
return defaultBandwidthReportBatchSize
|
||||
}
|
||||
|
||||
func reportPeerBandwidth(apiURL string) error {
|
||||
bandwidths, err := calculatePeerBandwidth()
|
||||
if err != nil {
|
||||
@@ -1501,26 +1714,47 @@ func reportPeerBandwidth(apiURL string) error {
|
||||
return fmt.Errorf("failed to calculate peer bandwidth: %v", err)
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(bandwidths)
|
||||
if len(bandwidths) == 0 {
|
||||
return nil
|
||||
}
|
||||
|
||||
var batchErrs []error
|
||||
for start := 0; start < len(bandwidths); start += bandwidthReportBatchSize {
|
||||
end := start + bandwidthReportBatchSize
|
||||
if end > len(bandwidths) {
|
||||
end = len(bandwidths)
|
||||
}
|
||||
|
||||
if err := sendPeerBandwidthBatch(apiURL, bandwidths[start:end]); err != nil {
|
||||
metrics.RecordBandwidthReport("error")
|
||||
batchErrs = append(batchErrs, err)
|
||||
continue
|
||||
}
|
||||
metrics.RecordBandwidthReport("success")
|
||||
}
|
||||
|
||||
if len(batchErrs) > 0 {
|
||||
return fmt.Errorf("failed to report %d bandwidth batch(es): %w", len(batchErrs), errors.Join(batchErrs...))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func sendPeerBandwidthBatch(apiURL string, batch []PeerBandwidth) error {
|
||||
jsonData, err := json.Marshal(batch)
|
||||
if err != nil {
|
||||
metrics.RecordBandwidthReport("error")
|
||||
return fmt.Errorf("failed to marshal bandwidth data: %v", err)
|
||||
}
|
||||
|
||||
resp, err := http.Post(apiURL, "application/json", bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
metrics.RecordBandwidthReport("error")
|
||||
return fmt.Errorf("failed to send bandwidth data: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
metrics.RecordBandwidthReport("error")
|
||||
return fmt.Errorf("API returned non-OK status: %s", resp.Status)
|
||||
}
|
||||
|
||||
// Record successful bandwidth report
|
||||
metrics.RecordBandwidthReport("success")
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -1549,7 +1783,7 @@ func notifyPeerChange(action, publicKey string) {
|
||||
}
|
||||
}
|
||||
|
||||
func monitorMemory(limit uint64) {
|
||||
func monitorMemory(limit uint64, heapDir string) {
|
||||
var m runtime.MemStats
|
||||
for {
|
||||
runtime.ReadMemStats(&m)
|
||||
@@ -1565,8 +1799,9 @@ func monitorMemory(limit uint64) {
|
||||
// Record memory spike metric
|
||||
metrics.RecordMemorySpike(severity)
|
||||
|
||||
f, err := os.Create(fmt.Sprintf("/var/config/heap/heap-spike-%d.pprof", time.Now().Unix()))
|
||||
if err != nil {
|
||||
if err := os.MkdirAll(heapDir, 0o755); err != nil {
|
||||
log.Println("could not create heap profile directory:", err)
|
||||
} else if f, err := os.Create(filepath.Join(heapDir, fmt.Sprintf("heap-spike-%d.pprof", time.Now().Unix()))); err != nil {
|
||||
log.Println("could not create profile:", err)
|
||||
} else {
|
||||
pprof.WriteHeapProfile(f)
|
||||
|
||||
119
proxy/proxy.go
119
proxy/proxy.go
@@ -11,9 +11,11 @@ import (
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/fosrl/gerbil/internal/metrics"
|
||||
@@ -21,6 +23,46 @@ import (
|
||||
"github.com/patrickmn/go-cache"
|
||||
)
|
||||
|
||||
// defaultMaxSNIConnections caps the number of concurrent client connections
|
||||
// the SNI proxy will accept. Without a cap, a burst of connections (a
|
||||
// scanner sweep, a client reconnect storm) spawns unbounded goroutines each
|
||||
// holding copy buffers and sockets, exhausting container memory faster than
|
||||
// GC/backpressure can catch up.
|
||||
// Sized conservatively since each connection now holds up to two pooled
|
||||
// 32KB copy buffers once the buffer pool is actually honored (see
|
||||
// bufferedReader/bufferedWriter below). Overridable via
|
||||
// GERBIL_MAX_SNI_CONNECTIONS.
|
||||
const defaultMaxSNIConnections = 4096
|
||||
|
||||
var maxSNIConnections = loadMaxSNIConnections()
|
||||
|
||||
func loadMaxSNIConnections() int64 {
|
||||
if v := os.Getenv("GERBIL_MAX_SNI_CONNECTIONS"); v != "" {
|
||||
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
|
||||
return n
|
||||
}
|
||||
}
|
||||
return defaultMaxSNIConnections
|
||||
}
|
||||
|
||||
// defaultMaxSNIConnectionsPerIP caps concurrent connections from a single
|
||||
// source IP, independent of the global maxSNIConnections budget. Without
|
||||
// this, one noisy/misbehaving client (or a single scanning host) can
|
||||
// consume the entire global budget and lock out every other customer
|
||||
// sharing this proxy. Overridable via GERBIL_MAX_SNI_CONNECTIONS_PER_IP.
|
||||
const defaultMaxSNIConnectionsPerIP = 256
|
||||
|
||||
var maxSNIConnectionsPerIP = loadMaxSNIConnectionsPerIP()
|
||||
|
||||
func loadMaxSNIConnectionsPerIP() int64 {
|
||||
if v := os.Getenv("GERBIL_MAX_SNI_CONNECTIONS_PER_IP"); v != "" {
|
||||
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
|
||||
return n
|
||||
}
|
||||
}
|
||||
return defaultMaxSNIConnectionsPerIP
|
||||
}
|
||||
|
||||
// RouteRecord represents a routing configuration
|
||||
type RouteRecord struct {
|
||||
Hostname string
|
||||
@@ -76,6 +118,18 @@ type SNIProxy struct {
|
||||
|
||||
// Buffer pool for connection piping
|
||||
bufferPool *sync.Pool
|
||||
|
||||
// activeConnections tracks concurrent client connections so
|
||||
// acceptConnections can enforce maxSNIConnections.
|
||||
activeConnections atomic.Int64
|
||||
|
||||
// perIPConnections tracks concurrent connections per source IP (map[string]*atomic.Int64)
|
||||
// so acceptConnections can enforce maxSNIConnectionsPerIP and stop one
|
||||
// client from starving the rest. Entries are removed once a given IP's
|
||||
// count returns to zero, so this stays bounded by currently-connected
|
||||
// distinct IPs (itself bounded by maxSNIConnections) rather than growing
|
||||
// with every IP ever seen.
|
||||
perIPConnections sync.Map
|
||||
}
|
||||
|
||||
type activeTunnel struct {
|
||||
@@ -458,8 +512,46 @@ func (p *SNIProxy) acceptConnections() {
|
||||
}
|
||||
}
|
||||
|
||||
if p.activeConnections.Load() >= maxSNIConnections {
|
||||
logger.Debug("Max concurrent SNI connections (%d) reached, rejecting connection from %s", maxSNIConnections, conn.RemoteAddr())
|
||||
metrics.RecordSNIConnection("rejected_max_connections")
|
||||
conn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
remoteHost, _, err := net.SplitHostPort(conn.RemoteAddr().String())
|
||||
if err != nil {
|
||||
remoteHost = conn.RemoteAddr().String()
|
||||
}
|
||||
|
||||
counterVal, _ := p.perIPConnections.LoadOrStore(remoteHost, new(atomic.Int64))
|
||||
perIPCounter := counterVal.(*atomic.Int64)
|
||||
if perIPCounter.Load() >= maxSNIConnectionsPerIP {
|
||||
logger.Debug("Max concurrent SNI connections per IP (%d) reached for %s, rejecting connection", maxSNIConnectionsPerIP, remoteHost)
|
||||
metrics.RecordSNIConnection("rejected_per_ip_limit")
|
||||
conn.Close()
|
||||
continue
|
||||
}
|
||||
perIPCounter.Add(1)
|
||||
|
||||
p.activeConnections.Add(1)
|
||||
metrics.RecordSNIActiveConnection(1)
|
||||
p.wg.Add(1)
|
||||
go p.handleConnection(conn)
|
||||
go func() {
|
||||
defer func() {
|
||||
if perIPCounter.Add(-1) == 0 {
|
||||
// Best-effort cleanup: only remove the map entry if it
|
||||
// still holds this exact counter (a concurrent new
|
||||
// connection from the same IP may have already bumped
|
||||
// it back up via LoadOrStore, or replaced it after a
|
||||
// prior race). Undercounting in that narrow race window
|
||||
// just means one connection isn't rate-limited briefly,
|
||||
// never unbounded growth.
|
||||
p.perIPConnections.CompareAndDelete(remoteHost, counterVal)
|
||||
}
|
||||
}()
|
||||
p.handleConnection(conn)
|
||||
}()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -507,6 +599,10 @@ func (p *SNIProxy) extractSNI(conn net.Conn) (string, io.Reader, error) {
|
||||
func (p *SNIProxy) handleConnection(clientConn net.Conn) {
|
||||
defer p.wg.Done()
|
||||
defer clientConn.Close()
|
||||
defer func() {
|
||||
p.activeConnections.Add(-1)
|
||||
metrics.RecordSNIActiveConnection(-1)
|
||||
}()
|
||||
|
||||
metrics.RecordSNIConnection("accepted")
|
||||
|
||||
@@ -793,6 +889,23 @@ func (p *SNIProxy) selectStickyEndpoint(clientAddr string, endpoints []string) s
|
||||
return endpoints[index]
|
||||
}
|
||||
|
||||
// bufferedReader hides any io.WriterTo the wrapped reader implements (e.g.
|
||||
// io.MultiReader, used by peekClientHello to replay the buffered
|
||||
// ClientHello ahead of the raw connection). Without this, io.CopyBuffer
|
||||
// bypasses the caller-supplied buffer entirely and lets WriteTo drive its
|
||||
// own, uncapped allocations - defeating the point of bufferPool.
|
||||
type bufferedReader struct {
|
||||
io.Reader
|
||||
}
|
||||
|
||||
// bufferedWriter hides any io.ReaderFrom the wrapped writer implements (e.g.
|
||||
// *net.TCPConn's splice/sendfile fast path). Without this, io.CopyBuffer
|
||||
// bypasses the caller-supplied buffer here too, so each copy allocates and
|
||||
// manages its own buffer regardless of what's pooled.
|
||||
type bufferedWriter struct {
|
||||
io.Writer
|
||||
}
|
||||
|
||||
// pipe handles bidirectional data transfer between connections
|
||||
func (p *SNIProxy) pipe(hostname string, clientConn, targetConn net.Conn, clientReader io.Reader) {
|
||||
var wg sync.WaitGroup
|
||||
@@ -821,7 +934,7 @@ func (p *SNIProxy) pipe(hostname string, clientConn, targetConn net.Conn, client
|
||||
p.bufferPool.Put(bufPtr)
|
||||
}()
|
||||
|
||||
bytesCopied, err := io.CopyBuffer(targetConn, clientReader, *bufPtr)
|
||||
bytesCopied, err := io.CopyBuffer(bufferedWriter{targetConn}, bufferedReader{clientReader}, *bufPtr)
|
||||
metrics.RecordProxyBytesTransmitted("client_to_target", bytesCopied)
|
||||
if err != nil && err != io.EOF {
|
||||
logger.Debug("Copy client->target error: %v", err)
|
||||
@@ -841,7 +954,7 @@ func (p *SNIProxy) pipe(hostname string, clientConn, targetConn net.Conn, client
|
||||
p.bufferPool.Put(bufPtr)
|
||||
}()
|
||||
|
||||
bytesCopied, err := io.CopyBuffer(clientConn, targetConn, *bufPtr)
|
||||
bytesCopied, err := io.CopyBuffer(bufferedWriter{clientConn}, bufferedReader{targetConn}, *bufPtr)
|
||||
metrics.RecordProxyBytesTransmitted("target_to_client", bytesCopied)
|
||||
if err != nil && err != io.EOF {
|
||||
logger.Debug("Copy target->client error: %v", err)
|
||||
|
||||
365
relay/relay.go
365
relay/relay.go
@@ -1,6 +1,7 @@
|
||||
package relay
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/binary"
|
||||
@@ -9,8 +10,11 @@ import (
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/fosrl/gerbil/internal/metrics"
|
||||
@@ -59,8 +63,31 @@ type PeerDestination struct {
|
||||
}
|
||||
|
||||
type DestinationConn struct {
|
||||
conn *net.UDPConn
|
||||
lastUsed time.Time
|
||||
conn *net.UDPConn
|
||||
// lastUsed is unix nanoseconds, read/written via atomic ops since it's
|
||||
// touched from packet workers and the response goroutine concurrently
|
||||
// with no lock, and is also scanned for LRU eviction below.
|
||||
lastUsed atomic.Int64
|
||||
}
|
||||
|
||||
// defaultMaxUDPConnections caps the number of concurrent per-peer outbound
|
||||
// UDP sockets the relay will keep open in s.connections. Without a cap, a
|
||||
// burst of peer churn creates sockets faster than the 5-minute idle cleanup
|
||||
// can reap them, exhausting the host's ephemeral port range or fd ulimit.
|
||||
// That surfaces as "dial udp ...: resource temporarily unavailable" on every
|
||||
// subsequent packet and pegs the CPU logging the flood (outage 2026-07-03,
|
||||
// recurrence 2026-07-05). Overridable via GERBIL_MAX_UDP_CONNECTIONS.
|
||||
const defaultMaxUDPConnections = 8192
|
||||
|
||||
var maxUDPConnections = loadMaxUDPConnections()
|
||||
|
||||
func loadMaxUDPConnections() int64 {
|
||||
if v := os.Getenv("GERBIL_MAX_UDP_CONNECTIONS"); v != "" {
|
||||
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
|
||||
return n
|
||||
}
|
||||
}
|
||||
return defaultMaxUDPConnections
|
||||
}
|
||||
|
||||
// Type for storing WireGuard handshake information
|
||||
@@ -137,6 +164,24 @@ const (
|
||||
WireGuardMessageTypeTransportData = 4
|
||||
)
|
||||
|
||||
// cachedEndpointState holds the last-known endpoint fields used for change detection.
|
||||
// Timestamp is intentionally excluded since it always changes.
|
||||
type cachedEndpointState struct {
|
||||
OlmID string
|
||||
NewtID string
|
||||
Token string
|
||||
IP string
|
||||
Port int
|
||||
PublicKey string
|
||||
}
|
||||
|
||||
// cachedEndpointEntry wraps cachedEndpointState with a timestamp so the cache
|
||||
// can be expired after a short TTL even when the endpoint fields are unchanged.
|
||||
type cachedEndpointEntry struct {
|
||||
state cachedEndpointState
|
||||
cachedAt time.Time
|
||||
}
|
||||
|
||||
// --- End Types ---
|
||||
|
||||
// bufferPool allows reusing buffers to reduce allocations.
|
||||
@@ -153,10 +198,13 @@ type UDPProxyServer struct {
|
||||
conn *net.UDPConn
|
||||
proxyMappings sync.Map // map[string]ProxyMapping where key is "ip:port"
|
||||
connections sync.Map // map[string]*DestinationConn where key is destination "ip:port"
|
||||
privateKey wgtypes.Key
|
||||
packetChan chan Packet
|
||||
ctx context.Context
|
||||
cancel context.CancelFunc
|
||||
// connectionCount mirrors len(connections) without an O(n) sync.Map walk,
|
||||
// so the cap check in getOrCreateConnection is cheap on the hot path.
|
||||
connectionCount atomic.Int64
|
||||
privateKey wgtypes.Key
|
||||
packetChan chan Packet
|
||||
ctx context.Context
|
||||
cancel context.CancelFunc
|
||||
|
||||
// Session tracking for WireGuard peers
|
||||
// Key format: "senderIndex:receiverIndex"
|
||||
@@ -172,6 +220,12 @@ type UDPProxyServer struct {
|
||||
// Cache for resolved UDP addresses to avoid per-packet DNS lookups
|
||||
// Key: "ip:port" string, Value: *net.UDPAddr
|
||||
addrCache sync.Map
|
||||
// lastEndpointCache stores the last-known endpoint state per client (key: olmId:newtId)
|
||||
// used to skip redundant HTTP notifications when nothing has changed.
|
||||
lastEndpointCache sync.Map
|
||||
// notifyChan is the async queue for hole-punch endpoint notifications.
|
||||
// Dedicated notifier workers drain this channel and perform the HTTP call.
|
||||
notifyChan chan ClientEndpoint
|
||||
// ReachableAt is the URL where this server can be reached
|
||||
ReachableAt string
|
||||
}
|
||||
@@ -184,6 +238,7 @@ func NewUDPProxyServer(parentCtx context.Context, addr, serverURL string, privat
|
||||
serverURL: serverURL,
|
||||
privateKey: privateKey,
|
||||
packetChan: make(chan Packet, 50000), // Increased from 1000 to handle high throughput
|
||||
notifyChan: make(chan ClientEndpoint, 1000),
|
||||
ReachableAt: reachableAt,
|
||||
ctx: ctx,
|
||||
cancel: cancel,
|
||||
@@ -192,10 +247,15 @@ func NewUDPProxyServer(parentCtx context.Context, addr, serverURL string, privat
|
||||
|
||||
// Start sets up the UDP listener, worker pool, and begins reading packets.
|
||||
func (s *UDPProxyServer) Start() error {
|
||||
// Fetch initial mappings.
|
||||
if err := s.fetchInitialMappings(); err != nil {
|
||||
return fmt.Errorf("failed to fetch initial mappings: %v", err)
|
||||
}
|
||||
// Fetch initial mappings asynchronously so a large (potentially 100MB+)
|
||||
// response does not block the UDP listener from coming up. Any packets
|
||||
// arriving for unknown mappings before the load completes will simply
|
||||
// log and be repopulated via the hole-punch path.
|
||||
go func() {
|
||||
if err := s.fetchInitialMappings(); err != nil {
|
||||
logger.Error("Failed to fetch initial mappings: %v", err)
|
||||
}
|
||||
}()
|
||||
|
||||
udpAddr, err := net.ResolveUDPAddr("udp", s.addr)
|
||||
if err != nil {
|
||||
@@ -237,6 +297,11 @@ func (s *UDPProxyServer) Start() error {
|
||||
// Start the hole punch rate limiter cleanup routine
|
||||
go s.cleanupHolePunchRateLimiter()
|
||||
|
||||
// Start async endpoint notifier workers (HTTP calls off the hot path)
|
||||
for i := 0; i < 5; i++ {
|
||||
go s.endpointNotifierWorker()
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -375,7 +440,43 @@ func (s *UDPProxyServer) packetWorker() {
|
||||
ClientPublicKey: msg.PublicKey,
|
||||
}
|
||||
logger.Debug("Created endpoint from packet remoteAddr %s: IP=%s, Port=%d", packet.remoteAddr.String(), endpoint.IP, endpoint.Port)
|
||||
s.notifyServer(endpoint)
|
||||
|
||||
// Check if anything meaningful changed before queuing an HTTP notification.
|
||||
// The cache expires after 2.5 s so the server always receives a fresh
|
||||
// timestamp within its 5-second staleness window.
|
||||
const endpointCacheTTL = 2500 * time.Millisecond
|
||||
cacheKey := endpoint.OlmID + ":" + endpoint.NewtID
|
||||
newState := cachedEndpointState{
|
||||
OlmID: endpoint.OlmID,
|
||||
NewtID: endpoint.NewtID,
|
||||
Token: endpoint.Token,
|
||||
IP: endpoint.IP,
|
||||
Port: endpoint.Port,
|
||||
PublicKey: endpoint.ClientPublicKey,
|
||||
}
|
||||
if cached, ok := s.lastEndpointCache.Load(cacheKey); ok {
|
||||
entry := cached.(cachedEndpointEntry)
|
||||
if entry.state == newState && time.Since(entry.cachedAt) < endpointCacheTTL {
|
||||
// Endpoint unchanged and cache still fresh - skip the HTTP call.
|
||||
logger.Debug("Endpoint unchanged for %s, skipping notification", cacheKey)
|
||||
metrics.RecordHolePunchEvent(relayIfname, "deduplicated")
|
||||
s.clearSessionsForIP(endpoint.IP)
|
||||
metrics.RecordHolePunchEvent(relayIfname, "success")
|
||||
bufferPool.Put(packet.data[:1500])
|
||||
continue
|
||||
}
|
||||
}
|
||||
s.lastEndpointCache.Store(cacheKey, cachedEndpointEntry{state: newState, cachedAt: time.Now()})
|
||||
|
||||
// Queue the notification asynchronously so the hot path is not blocked by HTTP.
|
||||
select {
|
||||
case s.notifyChan <- endpoint:
|
||||
case <-s.ctx.Done():
|
||||
// shutting down
|
||||
default:
|
||||
logger.Debug("Notification queue full, dropping hole punch notification for %s:%d", endpoint.IP, endpoint.Port)
|
||||
metrics.RecordHolePunchEvent(relayIfname, "queue_full")
|
||||
}
|
||||
s.clearSessionsForIP(endpoint.IP) // Clear sessions for this IP to allow re-establishment
|
||||
metrics.RecordHolePunchEvent(relayIfname, "success")
|
||||
}
|
||||
@@ -384,6 +485,22 @@ func (s *UDPProxyServer) packetWorker() {
|
||||
}
|
||||
}
|
||||
|
||||
// endpointNotifierWorker drains the notifyChan and performs the HTTP notification for each
|
||||
// hole-punch endpoint. Running several of these keeps latency low even when the server is slow.
|
||||
func (s *UDPProxyServer) endpointNotifierWorker() {
|
||||
for {
|
||||
select {
|
||||
case endpoint, ok := <-s.notifyChan:
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
s.notifyServer(endpoint)
|
||||
case <-s.ctx.Done():
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// decryptMessage decrypts the message using the server's private key
|
||||
func (s *UDPProxyServer) decryptMessage(encMsg EncryptedHolePunchMessage) ([]byte, error) {
|
||||
// Parse the ephemeral public key
|
||||
@@ -419,6 +536,7 @@ func (s *UDPProxyServer) decryptMessage(encMsg EncryptedHolePunchMessage) ([]byt
|
||||
}
|
||||
|
||||
func (s *UDPProxyServer) fetchInitialMappings() error {
|
||||
logger.Info("Requesting initial proxy mappings")
|
||||
body := bytes.NewBuffer([]byte(fmt.Sprintf(`{"publicKey": "%s"}`, s.privateKey.PublicKey().String())))
|
||||
resp, err := http.Post(s.serverURL+"/gerbil/get-all-relays", "application/json", body)
|
||||
if err != nil {
|
||||
@@ -430,24 +548,82 @@ func (s *UDPProxyServer) fetchInitialMappings() error {
|
||||
return fmt.Errorf("server returned non-OK status: %d, body: %s",
|
||||
resp.StatusCode, string(body))
|
||||
}
|
||||
data, err := io.ReadAll(resp.Body)
|
||||
logger.Info("Received initial mappings, streaming decode")
|
||||
|
||||
// Stream-decode the response instead of buffering the entire body
|
||||
// (which can be 100MB+) and then re-walking it with json.Unmarshal.
|
||||
// This both lowers peak memory and lets us start populating the
|
||||
// sync.Map as entries arrive.
|
||||
dec := json.NewDecoder(bufio.NewReaderSize(resp.Body, 1<<20))
|
||||
|
||||
// Expect opening '{' of the top-level object.
|
||||
tok, err := dec.Token()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read response body: %v", err)
|
||||
return fmt.Errorf("failed to read opening token: %v", err)
|
||||
}
|
||||
logger.Info("Received initial mappings: %s", string(data))
|
||||
var initialMappings InitialMappings
|
||||
if err := json.Unmarshal(data, &initialMappings); err != nil {
|
||||
return fmt.Errorf("failed to unmarshal initial mappings: %v", err)
|
||||
if d, ok := tok.(json.Delim); !ok || d != '{' {
|
||||
return fmt.Errorf("expected '{' at top level, got %v", tok)
|
||||
}
|
||||
// Store mappings in our sync.Map.
|
||||
for key, mapping := range initialMappings.Mappings {
|
||||
// Initialize LastUsed timestamp for initial mappings
|
||||
mapping.LastUsed = time.Now()
|
||||
s.proxyMappings.Store(key, mapping)
|
||||
|
||||
count := 0
|
||||
now := time.Now()
|
||||
|
||||
for dec.More() {
|
||||
keyTok, err := dec.Token()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read top-level key: %v", err)
|
||||
}
|
||||
key, ok := keyTok.(string)
|
||||
if !ok {
|
||||
return fmt.Errorf("expected string key at top level, got %T", keyTok)
|
||||
}
|
||||
|
||||
if key != "mappings" {
|
||||
// Skip unknown top-level fields without materializing them.
|
||||
var skip json.RawMessage
|
||||
if err := dec.Decode(&skip); err != nil {
|
||||
return fmt.Errorf("failed to skip field %q: %v", key, err)
|
||||
}
|
||||
continue
|
||||
}
|
||||
|
||||
// Expect opening '{' of the mappings object.
|
||||
tok, err := dec.Token()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read mappings open: %v", err)
|
||||
}
|
||||
if d, ok := tok.(json.Delim); !ok || d != '{' {
|
||||
return fmt.Errorf("expected '{' for mappings, got %v", tok)
|
||||
}
|
||||
|
||||
for dec.More() {
|
||||
mapKeyTok, err := dec.Token()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to read mapping key: %v", err)
|
||||
}
|
||||
mapKey, ok := mapKeyTok.(string)
|
||||
if !ok {
|
||||
return fmt.Errorf("expected string mapping key, got %T", mapKeyTok)
|
||||
}
|
||||
|
||||
var mapping ProxyMapping
|
||||
if err := dec.Decode(&mapping); err != nil {
|
||||
return fmt.Errorf("failed to decode mapping %q: %v", mapKey, err)
|
||||
}
|
||||
mapping.LastUsed = now
|
||||
s.proxyMappings.Store(mapKey, mapping)
|
||||
count++
|
||||
}
|
||||
|
||||
// Consume closing '}' of mappings object.
|
||||
if _, err := dec.Token(); err != nil {
|
||||
return fmt.Errorf("failed to read mappings close: %v", err)
|
||||
}
|
||||
}
|
||||
metrics.RecordProxyInitialMappings(relayIfname, int64(len(initialMappings.Mappings)))
|
||||
metrics.RecordProxyMapping(relayIfname, int64(len(initialMappings.Mappings)))
|
||||
logger.Info("Loaded %d initial proxy mappings", len(initialMappings.Mappings))
|
||||
|
||||
metrics.RecordProxyInitialMappings(relayIfname, int64(count))
|
||||
metrics.RecordProxyMapping(relayIfname, int64(count))
|
||||
logger.Info("Loaded %d initial proxy mappings", count)
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -715,10 +891,17 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
|
||||
// Check if we have an existing connection
|
||||
if conn, ok := s.connections.Load(key); ok {
|
||||
destConn := conn.(*DestinationConn)
|
||||
destConn.lastUsed = time.Now()
|
||||
destConn.lastUsed.Store(time.Now().UnixNano())
|
||||
return destConn.conn, nil
|
||||
}
|
||||
|
||||
// Enforce a hard cap on concurrent sockets so a burst of peer churn can't
|
||||
// exhaust the host's ephemeral ports/fds. Evict the least-recently-used
|
||||
// connection to make room instead of growing unbounded.
|
||||
if s.connectionCount.Load() >= maxUDPConnections {
|
||||
s.evictLRUConnection()
|
||||
}
|
||||
|
||||
// Create new connection
|
||||
newConn, err := net.DialUDP("udp", nil, destAddr)
|
||||
if err != nil {
|
||||
@@ -726,11 +909,17 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
|
||||
return nil, fmt.Errorf("failed to create UDP connection: %v", err)
|
||||
}
|
||||
|
||||
// Store the new connection
|
||||
s.connections.Store(key, &DestinationConn{
|
||||
conn: newConn,
|
||||
lastUsed: time.Now(),
|
||||
})
|
||||
destConn := &DestinationConn{conn: newConn}
|
||||
destConn.lastUsed.Store(time.Now().UnixNano())
|
||||
|
||||
// Store the new connection. If another goroutine raced us and already
|
||||
// created one for this key, close ours and use theirs instead.
|
||||
if existing, loaded := s.connections.LoadOrStore(key, destConn); loaded {
|
||||
newConn.Close()
|
||||
return existing.(*DestinationConn).conn, nil
|
||||
}
|
||||
s.connectionCount.Add(1)
|
||||
metrics.RecordUDPConnection(relayIfname, 1)
|
||||
|
||||
// Start a goroutine to handle responses
|
||||
go s.handleResponses(newConn, destAddr, remoteAddr)
|
||||
@@ -738,6 +927,33 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
|
||||
return newConn, nil
|
||||
}
|
||||
|
||||
// evictLRUConnection closes and removes the least-recently-used destination
|
||||
// connection so a new one can be created under the concurrent connection cap.
|
||||
func (s *UDPProxyServer) evictLRUConnection() {
|
||||
var oldestKey interface{}
|
||||
var oldestConn *DestinationConn
|
||||
var oldestTime int64
|
||||
|
||||
s.connections.Range(func(key, value interface{}) bool {
|
||||
destConn := value.(*DestinationConn)
|
||||
lu := destConn.lastUsed.Load()
|
||||
if oldestKey == nil || lu < oldestTime {
|
||||
oldestKey = key
|
||||
oldestConn = destConn
|
||||
oldestTime = lu
|
||||
}
|
||||
return true
|
||||
})
|
||||
|
||||
if oldestKey != nil {
|
||||
s.connections.Delete(oldestKey)
|
||||
oldestConn.conn.Close()
|
||||
s.connectionCount.Add(-1)
|
||||
metrics.RecordUDPConnection(relayIfname, -1)
|
||||
metrics.RecordProxyCleanupRemoved(relayIfname, "conn_evicted", 1)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *UDPProxyServer) handleResponses(conn *net.UDPConn, destAddr *net.UDPAddr, remoteAddr *net.UDPAddr) {
|
||||
buffer := make([]byte, 1500)
|
||||
for {
|
||||
@@ -789,22 +1005,32 @@ func (s *UDPProxyServer) handleResponses(conn *net.UDPConn, destAddr *net.UDPAdd
|
||||
|
||||
// Add a cleanup method to periodically remove idle connections
|
||||
func (s *UDPProxyServer) cleanupIdleConnections() {
|
||||
ticker := time.NewTicker(5 * time.Minute)
|
||||
// Ticker interval and idle threshold were previously 5min/10min, meaning
|
||||
// a socket could sit open for up to 15 minutes after going idle. Under a
|
||||
// reconnect/churn burst that lag is enough to exhaust ephemeral ports
|
||||
// before cleanup catches up, so both are tightened here.
|
||||
ticker := time.NewTicker(1 * time.Minute)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ticker.C:
|
||||
cleanupStart := time.Now()
|
||||
now := time.Now()
|
||||
now := time.Now().UnixNano()
|
||||
removed := int64(0)
|
||||
s.connections.Range(func(key, value interface{}) bool {
|
||||
destConn := value.(*DestinationConn)
|
||||
if now.Sub(destConn.lastUsed) > 10*time.Minute {
|
||||
if now-destConn.lastUsed.Load() > int64(5*time.Minute) {
|
||||
destConn.conn.Close()
|
||||
s.connections.Delete(key)
|
||||
metrics.RecordProxyCleanupRemoved(relayIfname, "conn", 1)
|
||||
removed++
|
||||
}
|
||||
return true
|
||||
})
|
||||
if removed > 0 {
|
||||
s.connectionCount.Add(-removed)
|
||||
metrics.RecordUDPConnection(relayIfname, -removed)
|
||||
metrics.RecordProxyCleanupRemoved(relayIfname, "conn", removed)
|
||||
}
|
||||
metrics.RecordProxyIdleCleanupDuration(relayIfname, "conn", time.Since(cleanupStart).Seconds())
|
||||
case <-s.ctx.Done():
|
||||
return
|
||||
@@ -966,6 +1192,10 @@ func (s *UDPProxyServer) clearConnectionsForWGIP(wgIP string) {
|
||||
for _, key := range keysToDelete {
|
||||
s.connections.Delete(key)
|
||||
}
|
||||
if len(keysToDelete) > 0 {
|
||||
s.connectionCount.Add(-int64(len(keysToDelete)))
|
||||
metrics.RecordUDPConnection(relayIfname, -int64(len(keysToDelete)))
|
||||
}
|
||||
|
||||
logger.Info("Cleared %d connections for WG IP: %s", len(keysToDelete), wgIP)
|
||||
}
|
||||
@@ -1163,33 +1393,56 @@ func (s *UDPProxyServer) trackCommunicationPattern(fromAddr, toAddr *net.UDPAddr
|
||||
|
||||
// tryRebuildSession attempts to rebuild a WireGuard session from communication patterns
|
||||
func (s *UDPProxyServer) tryRebuildSession(pattern *CommunicationPattern) {
|
||||
// Require both indices and a minimum amount of bidirectional traffic
|
||||
if pattern.ClientIndex == 0 || pattern.DestIndex == 0 || pattern.PacketCount < 4 {
|
||||
return
|
||||
}
|
||||
|
||||
// Check if we have bidirectional communication within a reasonable time window
|
||||
timeDiff := pattern.LastFromClient.Sub(pattern.LastFromDest)
|
||||
if timeDiff < 0 {
|
||||
timeDiff = -timeDiff
|
||||
}
|
||||
|
||||
// Only rebuild if we have recent bidirectional communication and both indices
|
||||
if timeDiff < 30*time.Second && pattern.ClientIndex != 0 && pattern.DestIndex != 0 && pattern.PacketCount >= 4 {
|
||||
// Create session mapping: client's index maps to destination
|
||||
sessionKey := fmt.Sprintf("%d:%d", pattern.DestIndex, pattern.ClientIndex)
|
||||
|
||||
// Check if we already have this session
|
||||
session := &WireGuardSession{
|
||||
ReceiverIndex: pattern.DestIndex,
|
||||
SenderIndex: pattern.ClientIndex,
|
||||
DestAddr: pattern.ToDestination,
|
||||
LastSeen: time.Now(),
|
||||
}
|
||||
if _, loaded := s.wgSessions.LoadOrStore(sessionKey, session); loaded {
|
||||
s.wgSessions.Store(sessionKey, session)
|
||||
} else {
|
||||
metrics.RecordSession(relayIfname, 1)
|
||||
metrics.RecordSessionRebuilt(relayIfname)
|
||||
}
|
||||
logger.Info("Rebuilt WireGuard session from communication pattern: %s -> %s (packets: %d)",
|
||||
sessionKey, pattern.ToDestination.String(), pattern.PacketCount)
|
||||
if timeDiff >= 30*time.Second {
|
||||
return
|
||||
}
|
||||
|
||||
sessionKey := fmt.Sprintf("%d:%d", pattern.DestIndex, pattern.ClientIndex)
|
||||
destStr := pattern.ToDestination.String()
|
||||
|
||||
// Fast path: if a matching session already exists, just refresh LastSeen and bail out.
|
||||
// This prevents log spam and repeated work for every packet of an established flow.
|
||||
if existing, ok := s.wgSessions.Load(sessionKey); ok {
|
||||
sess := existing.(*WireGuardSession)
|
||||
if da := sess.GetDestAddr(); da != nil && da.String() == destStr {
|
||||
sess.UpdateLastSeen()
|
||||
// Make sure the receiver-index fast-path is populated so future packets
|
||||
// don't keep falling back to broadcast + pattern tracking.
|
||||
if _, indexed := s.sessionsByReceiverIndex.Load(pattern.ClientIndex); !indexed {
|
||||
s.sessionsByReceiverIndex.Store(pattern.ClientIndex, sess)
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Create or replace the session mapping
|
||||
session := &WireGuardSession{
|
||||
ReceiverIndex: pattern.DestIndex,
|
||||
SenderIndex: pattern.ClientIndex,
|
||||
DestAddr: pattern.ToDestination,
|
||||
LastSeen: time.Now(),
|
||||
}
|
||||
if _, loaded := s.wgSessions.LoadOrStore(sessionKey, session); loaded {
|
||||
s.wgSessions.Store(sessionKey, session)
|
||||
} else {
|
||||
metrics.RecordSession(relayIfname, 1)
|
||||
metrics.RecordSessionRebuilt(relayIfname)
|
||||
}
|
||||
// Index by client receiver index so the transport-data fast path can find it.
|
||||
s.sessionsByReceiverIndex.Store(pattern.ClientIndex, session)
|
||||
|
||||
logger.Info("Rebuilt WireGuard session from communication pattern: %s -> %s (packets: %d)",
|
||||
sessionKey, destStr, pattern.PacketCount)
|
||||
}
|
||||
|
||||
// cleanupIdleCommunicationPatterns periodically removes idle communication patterns
|
||||
|
||||
Reference in New Issue
Block a user