T4930: Allow WireGuard peers via DNS hostname #4200
Conversation
sskaje
requested review from
dmbaturin,
sarthurdev,
zdc,
jestabro,
sever-sever and
nicolas-fort
|
👍 |
|
Build package fails (based on CI) |
Updated. My IDE was set python3.12, that syntax is acceptable in 3.12 but not in 3.11 XD |
Sorry, I don't understand your question. WG_ENDPOINT_RESOLUTION_RETRIES is an environment variable use in
By default, BTW, the |
That's what I was concerned by, we want to avoid long boot/commit time because of DNS resolution not being available. |
Yes, that's why I set it to 5 and I still feel it costs too much time. How about 3x? Or 3x by default and let user can customize it in somewhere like |
|
|
|
Hi reviewers, Still need help:
|
|
The current design seems promising, we'll get back to you with comments about implementation if we find anything that we think we can improve. |
|
Hi @sskaje, thanks for the PR! I did a testdrive with this implementation and in general it works for me. Please also rebase your work on |
|
I'm trying to build and run tests, but I see Any Idea how I build and run tests? Revert code in T6746 or just update ============= Updated: I modified |
|
FRR 10.2 is part of the official VyOS repositories now. You do not need to build it on your own. You could grab a fresh build from e.g. https://github.com/vyos/vyos-nightly-build/actions/runs/12521976266/artifacts/2367044381 It contains some minor smoketest issues but would be fine for your development. If you're uncertain ant would rather NOT rebase that would work, too - we can rebase in the end after all changes got applied. |
|
@sskaje you can also force package installation and omit the FRR 10.2 dependency dpkg --install --force-all *.deb |
In you example vyos-domain-resolver is started again after you |
|
This branch has conflicts that must be resolved
|
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
|
Another thing, 'disable' is defined in wireguard interfaces but not checked when creating interfaces. Should I also fix this? |
This is actually expected behavior. The interface is always created, and e.g. This is handle here: vyos-1x/python/vyos/ifconfig/interface.py Lines 1832 to 1840 in 99d0c7a I will re-review and test the changes until end of this week. |
|
@sskaje I've added a discrete smoketest In addition I did some small refactorings and added a comment about the last handshake/rekey time.
This behavior raises a small question - is there a possibility to find out when the last byte/message was transmitted? |
* set interfaces wireguard wgXX peer YY hostname <fqdn>
WireGuard performs a handshake every WIREGUARD_REKEY_AFTER_TIME if data is being transmitted between the peers. If no data is transmitted, the handshake will not be initiated unless new data begins to flow. Each handshake generates a new session key, and the key is rotated at least every 120 seconds or upon data transmission after a prolonged silence.
Retrieving the config dict sets key_mangling(), thus we need to look for host_name instead of host-name.
… queries
Extend ConfigTreeQuery().get_config_dict() with arguments to read in default
CLI values, too. This removes the need for hardcoded default values at
multiple places like:
if max_dns_retry is None:
max_dns_retry = 3
in this case.
… method Method is not referenced in the code base, remove dead code.
|
CI integration 👍 passed! Details
|
I don't find anything related to 'when the last byte/message was transmitted' in both kernel and wg-tool, only WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL. |
We could add the following logic: If See |
For the rekey time part, I tested on my router, one of my WG interface got rekey in about every 120-140 seconds. For the DNS part, in fact, resetting peers do reset both address and port of peer endpoint. I don't think you need to do resolve by python, just let wg do everything, otherwise you need to do domain resolve check, port check, too much work. For port changing, I have two cases: Case A: bad case, one of my friend's network, pppoe, he asked ISP for Internet IP, IP changes when pppoe reconnects. He asked me to set up connection between his network and his cloud server. His ISP may have some rule like QoS for UDP traffics. I have to periodically change His router pppoe gets disconnected randomly every few weeks and Internet IP changes. <= ip change I connect my router to his network, but I don't need a always online connection, in this case, I need to reset peer if my connection lost. Case B: similar to case A, port changing policy was also used to "bypass" national firewall's ip+port traffic censorship, but both side have public ip and my ISP behaviors well. |
Change Summary
T4930: Allow WireGuard peers via DNS hostname + new script resetting peer
T4930: Ensure peer is created even if dns not working
T4930: limit wg retry times by using environment variable
T4930: make wg dns retry configurable through interfaces wireguard wgX max-dns-retry
Types of changes
Related Task(s)
https://vyos.dev/T4930
Related PR(s)
Component(s) name
wireguard
Proposed changes
wgretries for dns resolution no more than 5 times;reset wireguard, if user want to usewg setto force wireguard redo dns resolution;How to test
config mode
op mode
vyos without working dns
I've provided screenshots in task's comments.
configure max dns resolution retry times
Smoketest result
Checklist: