Share kernel Wireguard port with raw socket #826
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- rename mutex - add comment
This is initial changes to support shared port between stun (ICE agent) and the kernel wireguard
pappz
requested changes
Apr 26, 2023
# Conflicts: # go.mod # go.sum
add exported function comment
mlsmaycon
changed the title
pappz
requested changes
Apr 28, 2023
pappz
requested changes
Apr 29, 2023
| select { | ||
| case <-s.ctx.Done(): | ||
| return | ||
| case s.packetDemux <- rcvdPacket{n, addr, buf[:], err}: |
There was a problem hiding this comment.
Make no sense to create a new buf slice with the same content. Just pass the buf variable.
pappz
requested changes
Apr 29, 2023
braginini
previously approved these changes
May 3, 2023
pappz
reviewed
May 3, 2023
|
|
||
| decodedLayers := make([]gopacket.LayerType, 0, 3) | ||
|
|
||
| err = parser.DecodeLayers(pkt.buf[:], &decodedLayers) |
There was a problem hiding this comment.
At this point the buf is may half empty. Maybe we should handle the N variable to reduca the len of the slice.
pappz
approved these changes
May 3, 2023
pulsastrix
pushed a commit
to pulsastrix/netbird
that referenced
this pull request
Dec 24, 2023
This PR brings support of a shared port between stun (ICE agent) and the kernel WireGuard It implements a single port mode for execution with kernel WireGuard interface using a raw socket listener. BPF filters ensure that only STUN packets hit the NetBird userspace app Removed a lot of the proxy logic and direct mode exchange. Now we are doing an extra hole punch to the remote WireGuard port for best-effort cases and support to old client's direct mode.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Describe your changes
This is initial changes to support shared port between stun (ICE agent) and
the kernel Wireguard
Implement single port mode for execution with kernel Wireguard interfaces using a raw socket listener.
BPF filters ensure that only stun packets hit the raw socket
Removed a lot of the proxy logic and direct mode exchange
now we are doing an extra hole punch to the remote wireguard port for best-effort cases and support to old client's direct mode.
Issue ticket number and link
Checklist