diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 9f48f1da3..b999b132c 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -951,7 +951,7 @@ dependencies = [
[[package]]
name = "boringtun"
version = "0.6.1"
-source = "git+https://github.com/firezone/boringtun?branch=master#5cb8ec28749fe6a81a33471cb77565376bcf1d67"
+source = "git+https://github.com/firezone/boringtun?branch=master#b0fb537124d38d354647add1dfee5028b6cd811a"
dependencies = [
"aead",
"base64 0.22.1",
diff --git a/rust/connlib/snownet/src/node.rs b/rust/connlib/snownet/src/node.rs
index 6f07ba2f9..55e103a8b 100644
--- a/rust/connlib/snownet/src/node.rs
+++ b/rust/connlib/snownet/src/node.rs
@@ -247,15 +247,27 @@ where
return Ok(());
}
- // Compare the ICE credentials and public key.
- // Technically, just comparing the ICE credentials should be enough because the portal computes them deterministically based on Client/Gateway ID and their public keys.
- // But better be safe than sorry.
+ let preshared_key = *session_key.expose_secret();
+
+ // Check if we already have a connection with the exact same parameters.
+ // In order for the connection to be same, we need to compare:
+ // - Local ICE credentials
+ // - Remote ICE credentials
+ // - Remote public key
+ // - Preshared key
+ //
+ // Only if all of those things are the same, will:
+ // - ICE be able to establish a connection
+ // - boringtun be able to handshake a session
if let Some(c) = self.connections.get_established_mut(&cid)
&& c.agent.local_credentials() == &local_creds
&& c.agent
.remote_credentials()
.is_some_and(|c| c == &remote_creds)
&& c.tunnel.remote_static_public() == remote
+ && c.tunnel
+ .preshared_key()
+ .is_some_and(|key| key == preshared_key)
{
tracing::info!(local = ?local_creds, "Reusing existing connection");
@@ -295,15 +307,8 @@ where
self.seed_agent_with_local_candidates(cid, selected_relay, &mut agent);
- let connection = self.init_connection(
- cid,
- agent,
- remote,
- *session_key.expose_secret(),
- selected_relay,
- now,
- now,
- );
+ let connection =
+ self.init_connection(cid, agent, remote, preshared_key, selected_relay, now, now);
self.connections.established.insert(cid, connection);
diff --git a/website/src/components/Changelog/Android.tsx b/website/src/components/Changelog/Android.tsx
index b16d1245e..4ada021ad 100644
--- a/website/src/components/Changelog/Android.tsx
+++ b/website/src/components/Changelog/Android.tsx
@@ -38,6 +38,10 @@ export default function Android() {
Fixes an issue where connections in low-latency networks (between
Client and Gateway) would fail to establish reliably.
+
+ Decreases connection setup time on flaky Internet connections in
+ certain edge cases.
+
diff --git a/website/src/components/Changelog/Apple.tsx b/website/src/components/Changelog/Apple.tsx
index cb4e89660..d8b9e5240 100644
--- a/website/src/components/Changelog/Apple.tsx
+++ b/website/src/components/Changelog/Apple.tsx
@@ -46,6 +46,10 @@ export default function Apple() {
Fixes an issue where connections in low-latency networks (between
Client and Gateway) would fail to establish reliably.
+
+ Decreases connection setup time on flaky Internet connections in
+ certain edge cases.
+
diff --git a/website/src/components/Changelog/GUI.tsx b/website/src/components/Changelog/GUI.tsx
index 29c899493..fe6642acd 100644
--- a/website/src/components/Changelog/GUI.tsx
+++ b/website/src/components/Changelog/GUI.tsx
@@ -24,6 +24,10 @@ export default function GUI({ os }: { os: OS }) {
Fixes an issue where connections in low-latency networks (between
Client and Gateway) would fail to establish reliably.
+
+ Decreases connection setup time on flaky Internet connections in
+ certain edge cases.
+
Fixes a rare crash during sign-in.
diff --git a/website/src/components/Changelog/Headless.tsx b/website/src/components/Changelog/Headless.tsx
index 2ff40fd71..3dbf1ee4c 100644
--- a/website/src/components/Changelog/Headless.tsx
+++ b/website/src/components/Changelog/Headless.tsx
@@ -23,6 +23,10 @@ export default function Headless({ os }: { os: OS }) {
Fixes an issue where connections in low-latency networks (between
Client and Gateway) would fail to establish reliably.
+
+ Decreases connection setup time on flaky Internet connections in
+ certain edge cases.
+