sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-26 16:49:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Discriminate initial from rekey failure

Browse Source
This commit is contained in:
riccardom
2026-07-31 10:49:27 +02:00
parent 824055c1c7
commit cb2deee354
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/pqkem/convergence.go
+11 -2
View File
@@ -208,9 +208,10 @@ func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id Excha
case stateAwaitingAnswer: case stateAwaitingAnswer:
if attempts >= m.maxRetries { if attempts >= m.maxRetries {
delete(m.exchanges, remoteID) delete(m.exchanges, remoteID)
initial := !m.established[remoteID]
fail := m.registerFailureLocked(remoteID) fail := m.registerFailureLocked(remoteID)
m.mu.Unlock() m.mu.Unlock()
m.raiseFailure(remoteID, fail) m.raiseFailure(remoteID, fail, initial)
return return
} }
viaSignal := ex.viaSignal viaSignal := ex.viaSignal
@@ -251,11 +252,19 @@ func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
return false return false
} }
func (m *Manager) raiseFailure(remoteID RemoteID, fail bool) { // raiseFailure reports a convergence failure. initial distinguishes a never-established
// peer (bootstrap failed → no PQ PSK at all; in strict mode the peer stays blocked =
// "stuck") from a rekey failure (a previous PSK is still in force and traffic continues).
func (m *Manager) raiseFailure(remoteID RemoteID, fail, initial bool) {
if !fail { if !fail {
m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID) m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
return return
} }
if initial {
m.logger.Warn("pqkem: initial exchange failed — no PQ PSK established for peer (strict mode keeps the peer blocked until it converges)", "peer", remoteID)
} else {
m.logger.Warn("pqkem: rekey failed after retries — staying on the previous PSK", "peer", remoteID)
}
if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil { if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err) m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
} }