mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-11 12:37:13 -04:00
97d99c9187
The idle-gate reads LastActivities, which only tracks per-peer data in userspace; in kernel mode it is empty, so the gate treated every kernel peer as idle and disabled data-path rotation entirely. Detect the bind via IsUserspaceBind and, in kernel mode, report zero activity age (always 'active') so rotation runs on every rekey. Lazy back-to-idle is already limited in kernel; the eBPF WG-activity detection will later supply a real signal that excludes handshake/pqkem traffic.
31 lines
1.1 KiB
Go
31 lines
1.1 KiB
Go
package peer
|
|
|
|
import (
|
|
"net"
|
|
"net/netip"
|
|
"time"
|
|
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
|
|
"github.com/netbirdio/netbird/client/iface/configurer"
|
|
"github.com/netbirdio/netbird/client/iface/wgaddr"
|
|
"github.com/netbirdio/netbird/client/iface/wgproxy"
|
|
"github.com/netbirdio/netbird/monotime"
|
|
)
|
|
|
|
type WGIface interface {
|
|
UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
|
|
RemovePeer(peerKey string) error
|
|
GetStats() (map[string]configurer.WGStats, error)
|
|
GetProxy() wgproxy.Proxy
|
|
Address() wgaddr.Address
|
|
RemoveEndpointAddress(key string) error
|
|
// LastActivities returns the last real-data activity time per peer (WireGuard
|
|
// keepalives excluded), used to gate post-quantum PSK rotation on active tunnels.
|
|
LastActivities() map[string]monotime.Time
|
|
// IsUserspaceBind reports whether WireGuard runs in userspace. Only there does
|
|
// LastActivities track per-peer data activity; in kernel mode it is unavailable,
|
|
// so PSK rotation cannot be gated on activity.
|
|
IsUserspaceBind() bool
|
|
}
|