firezone

mirror of https://github.com/outbackdingo/firezone.git synced 2026-03-21 18:41:38 +00:00

Files

Thomas Eizinger 00c7c42113 fix(snownet): don't allow duplicate server-reflexive candidates (#7334 )

In #7163, we introduced a shared cache of server-reflexive candidates
within a `snownet::Node`. What we unfortunately overlooked is that if a
node (i.e. a client or a gateway) is behind symmetric NAT, then we will
repeatedly create "new" server-reflexive candiates, thereby filling up
this cache.

This cache is used to initialise the agents with local candidates, which
manifests in us sending dozens if not hundreds of candidates to the
other party. Whilst not harmful in itself, it does create quite a lot of
spam. To fix this, we introduce a limit of only keeping around 1
server-reflexive candidate per IP version, i.e. only 1 IPv4 and IPv6
address.

At present, `connlib` only supports a single egress interface meaning
for now, we are fine with making this assumption.

In case we encounter a new candidate of the same kind and same IP
version, we evict the old one and replace it with the new one. Thus, for
subsequent connections, only the new candidate is used.

2024-11-14 00:14:29 +00:00