Thomas Eizinger a6ffdd2654 feat(snownet): reduce rekey-attempt-time to 15s (#9891) ...

From Sentry reports and user-submitted logs, we know that it is possible
for Client and Gateway to de-sync in regards to what each other's public
key is. In such a scenario, ICE will succeed to make a connection but
`boringtun` will fail to handshake a tunnel. By default, `boringtun`
tries for 90s to handshake a session before it gives up and expires it.

In Firezone, the ICE agent takes care of establishing connectivity
whereas `boringtun` itself just encrypts and decrypts packets. As such,
if ICE is working, we know that packets aren't getting lost but instead,
there must be some other issue as to why we cannot establish a session.

To improve the UX in these error cases, we reduce the rekey-attempt-time
to 15s. This roughly matches our ICE timeout. Those 15s count from the
moment we send the first handshake which is just after ICE completes.
Thus we can be sure that after at most 15s, we either have a working
WireGuard session or the connection gets cleaned up.

Related: #9890
Related: #9850

2025-07-17 00:50:31 +00:00

..

src

feat(snownet): reduce rekey-attempt-time to 15s (#9891)

2025-07-17 00:50:31 +00:00

Cargo.toml

feat(gateway): allow exporting metrics to an OTEL collector (#9838)

2025-07-14 03:54:38 +00:00