WireGuard Archive on lore.kernel.org
 help / Atom feed
* Could there be an error message on lack of entropy?
@ 2018-10-30 17:49 mike
  2018-11-04 17:33 ` Jason A. Donenfeld
  0 siblings, 1 reply; 2+ messages in thread
From: mike @ 2018-10-30 17:49 UTC (permalink / raw)
  To: wireguard

[-- Attachment #1.1: Type: text/plain, Size: 533 bytes --]

I've been trying to use wireguard on OpenWRT (using a Turris Omnia without
wireless.)

The wg interface would not send packets, but there was no indication of
why. I've been trying to debug this (intermittently) since May. Someone on
the OpenWRT mailing list today suggested that a lack of entropy might be
the problem. Adding "haveged " fixed the problem and the interface now
seems to work just fine.

It would be *very* helpful if wireguard reported in the system log that it
can't come up due to a lack of entropy.

Thanks.
Mike

[-- Attachment #1.2: Type: text/html, Size: 1505 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Could there be an error message on lack of entropy?
  2018-10-30 17:49 Could there be an error message on lack of entropy? mike
@ 2018-11-04 17:33 ` Jason A. Donenfeld
  0 siblings, 0 replies; 2+ messages in thread
From: Jason A. Donenfeld @ 2018-11-04 17:33 UTC (permalink / raw)
  To: mike; +Cc: wireguard

On Tue, Oct 30, 2018 at 10:49:30AM -0700, mike@farmwald.com wrote:
> I've been trying to use wireguard on OpenWRT (using a Turris Omnia without
> wireless.)
> 
> The wg interface would not send packets, but there was no indication of
> why. I've been trying to debug this (intermittently) since May. Someone on
> the OpenWRT mailing list today suggested that a lack of entropy might be
> the problem. Adding "haveged " fixed the problem and the interface now
> seems to work just fine.
> 
> It would be *very* helpful if wireguard reported in the system log that it
> can't come up due to a lack of entropy.

On the receiving end, we do this:

if (skb_queue_len(&wg->incoming_handshakes) > MAX_QUEUED_INCOMING_HANDSHAKES ||
    unlikely(!rng_is_initialized())) {
        net_dbg_skb_ratelimited("%s: Dropping handshake packet from %pISpfsc\n",
                                wg->dev->name, skb);
        goto err;
}

On the sending end, the packets queue up until the first handshake
completes, per usual. Meanwhile sending the handshake initiation packet
is blocked and is just waiting for the RNG to be initialized, and then
it sends, the handshake completes, and the queued up packets are
released. Arguably that blocking behavior is not ideal, though,
especially as it means removing a peer that is waiting for entropy will
wind up blocking rtnl. I'll take a look at this and see what can be
done.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-30 17:49 Could there be an error message on lack of entropy? mike
2018-11-04 17:33 ` Jason A. Donenfeld

WireGuard Archive on lore.kernel.org

Archives are clonable: git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox