Skip to content

Commit e326da3

Browse files
oschwartz10612oschwartz10612
committed
Merge branch 'dev' into jit
2 parents 22cd02a + 53def4e commit e326da3

9 files changed

Lines changed: 66 additions & 38 deletions

File tree

‎go.mod‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
module github.com/fosrl/olm
22

3-
go 1.25
3+
go 1.25.0
44

55
require (
66
github.com/Microsoft/go-winio v0.6.2
7-
github.com/fosrl/newt v1.9.0
7+
github.com/fosrl/newt v1.10.3
88
github.com/godbus/dbus/v5 v5.2.2
99
github.com/gorilla/websocket v1.5.3
1010
github.com/miekg/dns v1.1.70
11-
golang.org/x/sys v0.40.0
11+
golang.org/x/sys v0.41.0
1212
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
1313
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
1414
gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c
@@ -20,13 +20,13 @@ require (
2020
github.com/google/go-cmp v0.7.0 // indirect
2121
github.com/vishvananda/netlink v1.3.1 // indirect
2222
github.com/vishvananda/netns v0.0.5 // indirect
23-
golang.org/x/crypto v0.46.0 // indirect
23+
golang.org/x/crypto v0.48.0 // indirect
2424
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 // indirect
25-
golang.org/x/mod v0.31.0 // indirect
26-
golang.org/x/net v0.48.0 // indirect
25+
golang.org/x/mod v0.32.0 // indirect
26+
golang.org/x/net v0.51.0 // indirect
2727
golang.org/x/sync v0.19.0 // indirect
2828
golang.org/x/time v0.12.0 // indirect
29-
golang.org/x/tools v0.40.0 // indirect
29+
golang.org/x/tools v0.41.0 // indirect
3030
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
3131
golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
3232
)

‎go.sum‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
22
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
3-
github.com/fosrl/newt v1.9.0 h1:66eJMo6fA+YcBTbddxTfNJXNQo1WWKzmn6zPRP5kSDE=
4-
github.com/fosrl/newt v1.9.0/go.mod h1:d1+yYMnKqg4oLqAM9zdbjthjj2FQEVouiACjqU468ck=
3+
github.com/fosrl/newt v1.10.3 h1:JO9gFK9LP/w2EeDIn4wU+jKggAFPo06hX5hxFSETqcw=
4+
github.com/fosrl/newt v1.10.3/go.mod h1:iYuuCAG7iabheiogMOX87r61uQN31S39nKxMKRuLS+s=
55
github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
66
github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
77
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
@@ -16,24 +16,24 @@ github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW
1616
github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
1717
github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
1818
github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
19-
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
20-
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
19+
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
20+
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
2121
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 h1:zfMcR1Cs4KNuomFFgGefv5N0czO2XZpUbxGUy8i8ug0=
2222
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6/go.mod h1:46edojNIoXTNOhySWIWdix628clX9ODXwPsQuG6hsK0=
23-
golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
24-
golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
25-
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
26-
golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
23+
golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
24+
golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
25+
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
26+
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
2727
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
2828
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
2929
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
3030
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
31-
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
32-
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
31+
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
32+
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
3333
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
3434
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
35-
golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
36-
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
35+
golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
36+
golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
3737
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
3838
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
3939
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=

‎olm/connect.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,10 +169,17 @@ func (o *Olm) handleConnect(msg websocket.WSMessage) {
169169
SharedBind: o.sharedBind,
170170
WSClient: o.websocket,
171171
APIServer: o.apiServer,
172+
PublicDNS: o.tunnelConfig.PublicDNS,
172173
})
173174

174175
for i := range wgData.Sites {
175176
site := wgData.Sites[i]
177+
178+
if site.PublicKey == "" {
179+
logger.Warn("Skipping site %d (%s): no public key available (site may not be connected)", site.SiteId, site.Name)
180+
continue
181+
}
182+
176183
var siteEndpoint string
177184
// here we are going to take the relay endpoint if it exists which means we requested a relay for this peer
178185
if site.RelayEndpoint != "" {

‎olm/olm.go‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ type Olm struct {
3333
privateKey wgtypes.Key
3434
logFile *os.File
3535

36-
registered bool
36+
registered bool
3737
tunnelRunning bool
3838

3939
uapiListener net.Listener
@@ -116,7 +116,7 @@ func (o *Olm) initTunnelInfo(clientID string) error {
116116
logger.Info("Created shared UDP socket on port %d (refcount: %d)", sourcePort, sharedBind.GetRefCount())
117117

118118
// Create the holepunch manager
119-
o.holePunchManager = holepunch.NewManager(sharedBind, clientID, "olm", privateKey.PublicKey().String())
119+
o.holePunchManager = holepunch.NewManager(sharedBind, clientID, "olm", privateKey.PublicKey().String(), o.tunnelConfig.PublicDNS)
120120

121121
return nil
122122
}
@@ -237,7 +237,7 @@ func (o *Olm) registerAPICallbacks() {
237237
tunnelConfig.MTU = 1420
238238
}
239239
if req.DNS == "" {
240-
tunnelConfig.DNS = "9.9.9.9"
240+
tunnelConfig.DNS = "8.8.8.8"
241241
}
242242
// DNSProxyIP has no default - it must be provided if DNS proxy is desired
243243
// UpstreamDNS defaults to 8.8.8.8 if not provided
@@ -322,16 +322,23 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
322322
logger.Info("Tunnel already running")
323323
return
324324
}
325-
325+
326326
// debug print out the whole config
327327
logger.Debug("Starting tunnel with config: %+v", config)
328328

329329
o.tunnelRunning = true // Also set it here in case it is called externally
330330
o.tunnelConfig = config
331331

332+
// TODO: we are hardcoding this for now but we should really pull it from the current config of the system
333+
if o.tunnelConfig.DNS != "" {
334+
o.tunnelConfig.PublicDNS = []string{o.tunnelConfig.DNS + ":53"}
335+
} else {
336+
o.tunnelConfig.PublicDNS = []string{"8.8.8.8:53"}
337+
}
338+
332339
// Reset terminated status when tunnel starts
333340
o.apiServer.SetTerminated(false)
334-
341+
335342
fingerprint := config.InitialFingerprint
336343
if fingerprint == nil {
337344
fingerprint = make(map[string]any)
@@ -343,7 +350,7 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
343350
}
344351

345352
o.SetFingerprint(fingerprint)
346-
o.SetPostures(postures)
353+
o.SetPostures(postures)
347354

348355
// Create a cancellable context for this tunnel process
349356
tunnelCtx, cancel := context.WithCancel(o.olmCtx)
@@ -418,7 +425,7 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
418425

419426
if o.registered {
420427
o.websocket.StartPingMonitor()
421-
428+
422429
logger.Debug("Already registered, skipping registration")
423430
return nil
424431
}

‎olm/peer.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ func (o *Olm) handleWgPeerAdd(msg websocket.WSMessage) {
4343
}
4444
o.peerSendMu.Unlock()
4545
}
46+
47+
if siteConfigMsg.PublicKey == "" {
48+
logger.Warn("Skipping add-peer for site %d (%s): no public key available (site may not be connected)", siteConfigMsg.SiteId, siteConfigMsg.Name)
49+
return
50+
}
4651

4752
_ = o.holePunchManager.TriggerHolePunch() // Trigger immediate hole punch attempt so that if the peer decides to relay we have already punched close to when we need it
4853

@@ -184,7 +189,8 @@ func (o *Olm) handleWgPeerRelay(msg websocket.WSMessage) {
184189
monitor.CancelRelaySend(relayData.ChainId)
185190
}
186191

187-
primaryRelay, err := util.ResolveDomain(relayData.RelayEndpoint)
192+
primaryRelay, err := util.ResolveDomainUpstream(relayData.RelayEndpoint, o.tunnelConfig.PublicDNS)
193+
188194
if err != nil {
189195
logger.Error("Failed to resolve primary relay endpoint: %v", err)
190196
return
@@ -224,7 +230,8 @@ func (o *Olm) handleWgPeerUnrelay(msg websocket.WSMessage) {
224230
monitor.CancelRelaySend(relayData.ChainId)
225231
}
226232

227-
primaryRelay, err := util.ResolveDomain(relayData.Endpoint)
233+
primaryRelay, err := util.ResolveDomainUpstream(relayData.Endpoint, o.tunnelConfig.PublicDNS)
234+
228235
if err != nil {
229236
logger.Warn("Failed to resolve primary relay endpoint: %v", err)
230237
}

‎olm/types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ type TunnelConfig struct {
6161
MTU int
6262
DNS string
6363
UpstreamDNS []string
64+
PublicDNS []string
6465
InterfaceName string
6566

6667
// Advanced

‎peers/manager.go‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ type PeerManagerConfig struct {
3232
SharedBind *bind.SharedBind
3333
// WSClient is optional - if nil, relay messages won't be sent
3434
WSClient *websocket.Client
35-
APIServer *api.API
35+
APIServer *api.API
36+
PublicDNS []string
3637
}
3738

3839
type PeerManager struct {
@@ -50,7 +51,8 @@ type PeerManager struct {
5051
// key is the CIDR string, value is a set of siteIds that want this IP
5152
allowedIPClaims map[string]map[int]bool
5253
APIServer *api.API
53-
54+
publicDNS []string
55+
5456
PersistentKeepalive int
5557
}
5658

@@ -65,6 +67,7 @@ func NewPeerManager(config PeerManagerConfig) *PeerManager {
6567
allowedIPOwners: make(map[string]int),
6668
allowedIPClaims: make(map[string]map[int]bool),
6769
APIServer: config.APIServer,
70+
publicDNS: config.PublicDNS,
6871
}
6972

7073
// Create the peer monitor
@@ -74,6 +77,7 @@ func NewPeerManager(config PeerManagerConfig) *PeerManager {
7477
config.LocalIP,
7578
config.SharedBind,
7679
config.APIServer,
80+
config.PublicDNS,
7781
)
7882

7983
return pm
@@ -129,7 +133,7 @@ func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
129133
wgConfig := siteConfig
130134
wgConfig.AllowedIps = ownedIPs
131135

132-
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(siteConfig.SiteId), pm.PersistentKeepalive); err != nil {
136+
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(siteConfig.SiteId), pm.PersistentKeepalive, pm.publicDNS); err != nil {
133137
return err
134138
}
135139

@@ -270,7 +274,7 @@ func (pm *PeerManager) RemovePeer(siteId int) error {
270274
ownedIPs := pm.getOwnedAllowedIPs(promotedPeerId)
271275
wgConfig := promotedPeer
272276
wgConfig.AllowedIps = ownedIPs
273-
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(promotedPeerId), pm.PersistentKeepalive); err != nil {
277+
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(promotedPeerId), pm.PersistentKeepalive, pm.publicDNS); err != nil {
274278
logger.Error("Failed to update promoted peer %d: %v", promotedPeerId, err)
275279
}
276280
}
@@ -346,7 +350,7 @@ func (pm *PeerManager) UpdatePeer(siteConfig SiteConfig) error {
346350
wgConfig := siteConfig
347351
wgConfig.AllowedIps = ownedIPs
348352

349-
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(siteConfig.SiteId), pm.PersistentKeepalive); err != nil {
353+
if err := ConfigurePeer(pm.device, wgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(siteConfig.SiteId), pm.PersistentKeepalive, pm.publicDNS); err != nil {
350354
return err
351355
}
352356

@@ -356,7 +360,7 @@ func (pm *PeerManager) UpdatePeer(siteConfig SiteConfig) error {
356360
promotedOwnedIPs := pm.getOwnedAllowedIPs(promotedPeerId)
357361
promotedWgConfig := promotedPeer
358362
promotedWgConfig.AllowedIps = promotedOwnedIPs
359-
if err := ConfigurePeer(pm.device, promotedWgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(promotedPeerId), pm.PersistentKeepalive); err != nil {
363+
if err := ConfigurePeer(pm.device, promotedWgConfig, pm.privateKey, pm.peerMonitor.IsPeerRelayed(promotedPeerId), pm.PersistentKeepalive, pm.publicDNS); err != nil {
360364
logger.Error("Failed to update promoted peer %d: %v", promotedPeerId, err)
361365
}
362366
}

‎peers/monitor/monitor.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ type PeerMonitor struct {
3636
timeout time.Duration
3737
maxAttempts int
3838
wsClient *websocket.Client
39+
publicDNS []string
3940

4041
// Relay sender tracking
4142
relaySends map[string]func()
@@ -94,7 +95,7 @@ func generateChainId() string {
9495
return hex.EncodeToString(b)
9596
}
9697

97-
func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDevice, localIP string, sharedBind *bind.SharedBind, apiServer *api.API) *PeerMonitor {
98+
func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDevice, localIP string, sharedBind *bind.SharedBind, apiServer *api.API, publicDNS []string) *PeerMonitor {
9899
ctx, cancel := context.WithCancel(context.Background())
99100
pm := &PeerMonitor{
100101
monitors: make(map[int]*Client),
@@ -103,6 +104,7 @@ func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDe
103104
wsClient: wsClient,
104105
middleDev: middleDev,
105106
localIP: localIP,
107+
publicDNS: publicDNS,
106108
activePorts: make(map[uint16]bool),
107109
nsCtx: ctx,
108110
nsCancel: cancel,
@@ -137,7 +139,7 @@ func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDe
137139

138140
// Initialize holepunch tester if sharedBind is available
139141
if sharedBind != nil {
140-
pm.holepunchTester = holepunch.NewHolepunchTester(sharedBind)
142+
pm.holepunchTester = holepunch.NewHolepunchTester(sharedBind, publicDNS)
141143
}
142144

143145
return pm

‎peers/peer.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,14 @@ import (
1111
)
1212

1313
// ConfigurePeer sets up or updates a peer within the WireGuard device
14-
func ConfigurePeer(dev *device.Device, siteConfig SiteConfig, privateKey wgtypes.Key, relay bool, persistentKeepalive int) error {
14+
func ConfigurePeer(dev *device.Device, siteConfig SiteConfig, privateKey wgtypes.Key, relay bool, persistentKeepalive int, publicDNS []string) error {
1515
var endpoint string
1616
if relay && siteConfig.RelayEndpoint != "" {
1717
endpoint = formatEndpoint(siteConfig.RelayEndpoint)
1818
} else {
1919
endpoint = formatEndpoint(siteConfig.Endpoint)
2020
}
21-
siteHost, err := util.ResolveDomain(endpoint)
21+
siteHost, err := util.ResolveDomainUpstream(endpoint, publicDNS)
2222
if err != nil {
2323
return fmt.Errorf("failed to resolve endpoint for site %d: %v", siteConfig.SiteId, err)
2424
}

0 commit comments

Comments
 (0)