eburet-oss/wireguard-go-awg2-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

device: add peer session state callback

Browse source 
Add a minimal callback API for observing WireGuard peer session state
changes.

Updates tailscale/corp#42874
This commit is contained in:
Brad Fitzpatrick 2026-06-04 21:19:50 +00:00 • committed by 世界
parent 09268b375c
commit 7c3a736cbe
No known key found for this signature in database
GPG key ID: CD109927C34A63C4
3 changed files with 126 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
device/timers.go
View file

@ -98,6 +98,7 @@ func expiredRetransmitHandshake(peer *Peer) {
if peer.timersActive() && !peer.timers.zeroKeyMaterial.IsPending() {
peer.timers.zeroKeyMaterial.Mod(RejectAfterTime * 3)
}
peer.noteSessionHandshakeStopped()
} else {
peer.timers.handshakeAttempts.Add(1)
peer.device.log.Verbosef("%s - Handshake did not complete after %d seconds, retrying (try %d)", peer, int(RekeyTimeout.Seconds()), peer.timers.handshakeAttempts.Load()+1)
@ -139,6 +140,15 @@ func expiredZeroKeyMaterial(peer *Peer) {
}
}
func expiredSession(peer *Peer) {
expires := peer.sessionExpiresNano.Load()
if expires == 0 || time.Now().UnixNano() < expires {
return
}
peer.device.log.Verbosef("%s - Session expired after %d seconds", peer, int(RejectAfterTime.Seconds()))
peer.noteSessionState(PeerSessionExpired)
}
func expiredPersistentKeepalive(peer *Peer) {
if peer.persistentKeepaliveInterval.Load() > 0 {
peer.SendKeepalive()
@ -182,6 +192,7 @@ func (peer *Peer) timersHandshakeInitiated() {
if peer.timersActive() {
peer.timers.retransmitHandshake.Mod(RekeyTimeout + time.Millisecond*time.Duration(fastrandn(RekeyTimeoutJitterMaxMs)))
}
peer.noteSessionHandshakeStarted()
}
/* Should be called after a handshake response message is received and processed or when getting key confirmation via the first data message. */
@ -197,8 +208,11 @@ func (peer *Peer) timersHandshakeComplete() {
/* Should be called after an ephemeral key is created, which is before sending a handshake response or after receiving a handshake response. */
func (peer *Peer) timersSessionDerived() {
if peer.timersActive() {
peer.sessionExpiresNano.Store(time.Now().Add(RejectAfterTime).UnixNano())
peer.timers.sessionExpired.Mod(RejectAfterTime)
peer.timers.zeroKeyMaterial.Mod(RejectAfterTime * 3)
}
peer.noteSessionState(PeerSessionEstablished)
}
/* Should be called before a packet with authentication -- keepalive, data, or handshake -- is sent, or after one is received. */
@ -213,6 +227,7 @@ func (peer *Peer) timersInit() {
peer.timers.retransmitHandshake = peer.NewTimer(expiredRetransmitHandshake)
peer.timers.sendKeepalive = peer.NewTimer(expiredSendKeepalive)
peer.timers.newHandshake = peer.NewTimer(expiredNewHandshake)
peer.timers.sessionExpired = peer.NewTimer(expiredSession)
peer.timers.zeroKeyMaterial = peer.NewTimer(expiredZeroKeyMaterial)
peer.timers.persistentKeepalive = peer.NewTimer(expiredPersistentKeepalive)
}
@ -227,6 +242,7 @@ func (peer *Peer) timersStop() {
peer.timers.retransmitHandshake.DelSync()
peer.timers.sendKeepalive.DelSync()
peer.timers.newHandshake.DelSync()
peer.timers.sessionExpired.DelSync()
peer.timers.zeroKeyMaterial.DelSync()
peer.timers.persistentKeepalive.DelSync()
}