WireGuard NAT hole punching - #1522
Merged
Merged
Conversation
anjmao
requested review from
soffokl,
tadovas,
vkuznecovas and
zolia
as code owners
January 15, 2020 15:34
vkuznecovas
approved these changes
Jan 16, 2020
soffokl
reviewed
Jan 17, 2020
zolia
reviewed
Jan 17, 2020
anjmao
force-pushed
the
wg-nat-punching
branch
5 times, most recently
from
January 20, 2020 13:56
898cdc3 to
8b9886c
Compare
Codecov Report
@@ Coverage Diff @@
## master #1522 +/- ##
==========================================
- Coverage 47.97% 47.42% -0.56%
==========================================
Files 284 285 +1
Lines 10888 11007 +119
==========================================
- Hits 5224 5220 -4
- Misses 5282 5413 +131
+ Partials 382 374 -8
Continue to review full report at Codecov.
|
soffokl
approved these changes
Jan 20, 2020
| } | ||
|
|
||
| func waitUDPPortReadyFor(port int, timeout time.Duration) error { | ||
| timeoutChan := time.After(timeout) |
Member
There was a problem hiding this comment.
This can be smaller, not sure if it's better, but smaller. 😂
done := time.Now().Add(timeout)
for t := time.NewTicker(500 * time.Millisecond); time.Now().Before(done); <-t.C {
p, err := net.ListenPacket("udp", fmt.Sprintf(":%d", port))
if err == nil {
p.Close()
return nil
}
log.Err(err).Msgf("Port %d is in use. Trying to check again...", port)
}
return fmt.Errorf("timeout waiting for UDP port %d", port)
zolia
approved these changes
Jan 20, 2020
zolia
left a comment
zolia
left a comment
Contributor
There was a problem hiding this comment.
Nice work!
Will need a lot of testing in various platforms / network envs.
tadaskay
approved these changes
Jan 21, 2020
Building node for mobile could take a lot of time when building in docker using xgo. When openvpn is not needed it is possible to build it locally on MacOS. Need to look if it is possible to cross compile OpenVPN C++ bridge on MacOS too.
Before port mapping was using service type as a key but now WireGuard need to start new proxy instance for each new consumser connection.
Remove unneeded traversal.Params which instance was created in different places and modified in many strange ways. When provider provides traversal params it already knows how to form them.
Port is assigned at provider side.
There is no need to start proxy for multiple client connections as they will still reuse the same DNS proxy port.
Implement NAT hole punching the same way as it is done for OpenVPN service by reusing NAT pinger and UDP Proxy. One difference is that for mobile consumser side separate UDP proxy is now not needed as because WireGuard does not change source port for outgoing packets.
anjmao
force-pushed
the
wg-nat-punching
branch
from
January 21, 2020 16:19
8b9886c to
0fbd9dc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implement NAT hole punching the same way as it is done for OpenVPN service by reusing NAT pinger and UDP Proxy. One difference is that for mobile consumser side separate UDP proxy is now not needed as because WireGuard does not change source port for outgoing packets.
TODO: