Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wgpeerselector: add wgkex support #255

Open
lemoer opened this issue Feb 8, 2022 · 0 comments
Open

wgpeerselector: add wgkex support #255

lemoer opened this issue Feb 8, 2022 · 0 comments

Comments

@lemoer
Copy link
Member

lemoer commented Feb 8, 2022

As discussed in the gluon meetup today, we want to allow using wgpeerselector in combination with wgkex.

The only (big) missing piece is an HTTPS request to the broker as done here.

I would suggest to add the request here (after the NTP check):

if not time_synchronized then
-- WireGuard requires time to be monotonic (always increasing). If
-- there was a handshake with a peer once, where we had a higher time
-- than our current time, this peer will not accept our handshakes
-- until our current time rises above the we had time when the peer had
-- the last handshake with us. This usually happens on devices without
-- real time clock, like embedded routers. When we rebooted and therefore
-- reset our time, the time is lower and handshakes with our last peer
-- will fail. Therefore we try to synchronize time by calling ntp.
--
-- Another possibility, if a boot counter is implemented is outlined here:
-- https://lists.zx2c4.com/pipermail/wireguard/2019-February/003850.html
time_synchronized = self:sync_ntp()
end
if #self.queued_peers < 1 then
self:queue_all_peers()

However, the wgkex broker currently expects requests that include {"domain": "'"$SEGMENT"'", "public_key": "'"$PUBLICKEY"'"} in the http body. From the context of the wgpeerselector this information is not tangible. As of now, the wgpeerselector does not know about "domains", as it does not contain gluon code. So this problem needs to be addressed in some way.

@goligo wants to take a look at this. I am open to discuss this here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant