mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-24 14:29:07 +02:00
Zoltan Papp
13433af4a5
When a peer went idle under lazy connections, the WireGuard peer was removed and the wake endpoint re-armed with only the overlay allowed IPs, dropping routed prefixes installed by the route manager. The asynchronous route-watcher re-add uses update_only, which is a silent no-op while the peer is absent, so routed subnets stayed black-holed until the peer was woken by other means. Split the idle transition from the full close: Conn.Idle tears down transports, cancels pending delayed endpoint updates and updates the status without touching the WireGuard peer. The activity listener then arms the wake endpoint via the new IdlePeerEndpoint operation, which removes and re-creates the peer in a single transaction: handshake state is dropped (keeping the handshake-first wake semantics of packet staging and first-packet capture/reinjection) while the currently installed allowed IPs are preserved. The read-modify-write runs under the interface mutex, serializing it against concurrent allowed IP updates from the route manager. Conn.Close no longer takes signalToRemote: the idle transition is the only path that signals GOAWAY to the remote peer.
131 lines
2.7 KiB
Go
131 lines
2.7 KiB
Go
package peerstore
|
|
|
|
import (
|
|
"context"
|
|
"net/netip"
|
|
"sync"
|
|
|
|
"golang.org/x/exp/maps"
|
|
|
|
"github.com/netbirdio/netbird/client/internal/peer"
|
|
)
|
|
|
|
// Store is a thread-safe store for peer connections.
|
|
type Store struct {
|
|
peerConns map[string]*peer.Conn
|
|
peerConnsMu sync.RWMutex
|
|
}
|
|
|
|
func NewConnStore() *Store {
|
|
return &Store{
|
|
peerConns: make(map[string]*peer.Conn),
|
|
}
|
|
}
|
|
|
|
func (s *Store) AddPeerConn(pubKey string, conn *peer.Conn) bool {
|
|
s.peerConnsMu.Lock()
|
|
defer s.peerConnsMu.Unlock()
|
|
|
|
_, ok := s.peerConns[pubKey]
|
|
if ok {
|
|
return false
|
|
}
|
|
|
|
s.peerConns[pubKey] = conn
|
|
return true
|
|
}
|
|
|
|
func (s *Store) Remove(pubKey string) (*peer.Conn, bool) {
|
|
s.peerConnsMu.Lock()
|
|
defer s.peerConnsMu.Unlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
delete(s.peerConns, pubKey)
|
|
return p, true
|
|
}
|
|
|
|
func (s *Store) AllowedIPs(pubKey string) ([]netip.Prefix, bool) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
return p.WgConfig().AllowedIps, true
|
|
}
|
|
|
|
func (s *Store) AllowedIP(pubKey string) (netip.Addr, bool) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return netip.Addr{}, false
|
|
}
|
|
return p.AllowedIP(), true
|
|
}
|
|
|
|
func (s *Store) PeerConn(pubKey string) (*peer.Conn, bool) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
return p, true
|
|
}
|
|
|
|
func (s *Store) PeerConnOpen(ctx context.Context, pubKey string) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := p.Open(ctx); err != nil {
|
|
p.Log.Errorf("failed to open peer connection: %v", err)
|
|
}
|
|
}
|
|
|
|
// PeerConnOpenWithFirstPacket opens the peer connection and stashes a first packet to be
|
|
// reinjected once the real transport is established.
|
|
func (s *Store) PeerConnOpenWithFirstPacket(ctx context.Context, pubKey string, firstPacket []byte) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := p.OpenWithFirstPacket(ctx, firstPacket); err != nil {
|
|
p.Log.Errorf("failed to open peer connection: %v", err)
|
|
}
|
|
}
|
|
|
|
// PeerConnIdle transitions the peer connection to the lazy idle state, keeping the
|
|
// WireGuard peer and its AllowedIPs in place. signalToRemote indicates whether the
|
|
// remote peer should be notified (false when the remote initiated the idle via GOAWAY).
|
|
func (s *Store) PeerConnIdle(pubKey string, signalToRemote bool) {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
p, ok := s.peerConns[pubKey]
|
|
if !ok {
|
|
return
|
|
}
|
|
p.Idle(signalToRemote)
|
|
}
|
|
|
|
func (s *Store) PeersPubKey() []string {
|
|
s.peerConnsMu.RLock()
|
|
defer s.peerConnsMu.RUnlock()
|
|
|
|
return maps.Keys(s.peerConns)
|
|
}
|