From 12b4672addc61128ac38aacec5d35db16c0ad6d1 Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Thu, 22 Apr 2021 08:29:20 -0700 Subject: [PATCH] wgengine: quiet connection failure diagnostics for exit nodes The connection failure diagnostic code was never updated enough for exit nodes, so disable its misleading output when the node it picks (incorrectly) to diagnose is only an exit node. Fixes #1754 Signed-off-by: Brad Fitzpatrick --- wgengine/pendopen.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/wgengine/pendopen.go b/wgengine/pendopen.go index 2951a0c7e..0903a2d10 100644 --- a/wgengine/pendopen.go +++ b/wgengine/pendopen.go @@ -190,6 +190,25 @@ func (e *userspaceEngine) onOpenTimeout(flow flowtrack.Tuple) { return } if ps == nil { + onlyZeroRoute := true // whether peerForIP returned n only because its /0 route matched + for _, r := range n.AllowedIPs { + if r.Bits != 0 && r.Contains(flow.Dst.IP) { + onlyZeroRoute = false + break + } + } + if onlyZeroRoute { + // This node was returned by peerForIP because + // its exit node /0 route(s) matched, but this + // might not be the exit node that's currently + // selected. Rather than log misleading + // errors, just don't log at all for now. + // TODO(bradfitz): update this code to be + // exit-node-aware and make peerForIP return + // the node of the currently selected exit + // node. + return + } e.logf("open-conn-track: timeout opening %v; target node %v in netmap but unknown to wireguard", flow, n.Key.ShortString()) return }