WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: Lonnie Abelbeck <lists@lonnie.abelbeck.com>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Luis Ressel <aranea@aixah.de>,
	WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: RFC: wg syncpeers wg0 wireguard.conf
Date: Tue, 11 Jun 2019 16:06:50 -0500
Message-ID: <F0312C89-85A4-4D69-9B94-A970A4681616@lonnie.abelbeck.com> (raw)
In-Reply-To: <CAHmME9r3QVVWRu=36Yx6wmfuHm5CCA3Dg+JdZknpnNAmnj=ATQ@mail.gmail.com>

> On Jun 11, 2019, at 12:28 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> I gave it a stab in this branch:
> https://git.zx2c4.com/WireGuard/commit/?h=jd/syncconf Try it out and
> let me know if it does what you had in mind?

Hi Jason,
This is *exactly* what I had in mind !  Impressive how little code it took you to add "syncconf", very elegant.

I spent over an hour testing this, trying to break it ... worked perfectly.  Active peers don't miss a beat and retain their counters.

> One of the things that always goes wrong with "sync" algorithms in
> software -- and the commit above at the moment is no exception -- is
> that they're kind of racey. In order to synchronize, we have to read
> the current state, compare it, and then set our new state. But in
> between, the state could have changed out from underneath us. One
> strategy for this is to just do nothing and put some notice in the man
> page. Another strategy is to read back the result at the end, compare
> it, and loop like this until we reach the stable state. This then
> requires implementing some equality function.

If "wg" does not offer "syncconf", users will be hacking together their own sync solution and it will no doubt be more racey than your tight code.

Just a simple mention in the man page stating something like:
Warning: unexpected results may occur with simultaneous background configuration changes during 'wg syncconf'

Possibly also add a hint on the command help... "(assume no background configuration changes)"
  syncconf: Synchronizes a configuration file to a WireGuard interface (assume no background configuration changes)

> The other thing I was wondering is: aside from performance and races
> as described above, why not just make this the functionality of
> `setconf`? Then there's be no need to introduce a new subcommand. In
> otherwords, the idea would be to make `setconf` not destroy existing
> peers if we're going to be re-adding them again.

I vote to keep "setconf" as is, with the addition of the "syncconf" subcommand.

This keeps "setconf" faster, and unchanged, typically used for initial configuration.

Then "syncconf" would typically be used for followup live updates.

Thanks again Jason!  Please merge syncconf -> master


WireGuard mailing list

  reply index

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-09 19:59 Lonnie Abelbeck
2019-06-10 12:34 ` Rene 'Renne' Bartsch, B.Sc. Informatics
2019-06-11 17:28 ` Jason A. Donenfeld
2019-06-11 21:06   ` Lonnie Abelbeck [this message]
2019-06-11 21:41     ` Kalin KOZHUHAROV
2019-06-12  0:22   ` Steven Honson
2019-06-12  0:25     ` Marc Fawzi
2019-06-14 18:01       ` Jason A. Donenfeld
2019-06-16 19:43         ` Marc Fawzi
2019-06-13 23:15   ` Lonnie Abelbeck
2019-06-14 18:09   ` Jason A. Donenfeld
2019-06-14 20:48     ` Lonnie Abelbeck
2019-06-14 21:14     ` Ivan Labáth

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=F0312C89-85A4-4D69-9B94-A970A4681616@lonnie.abelbeck.com \
    --to=lists@lonnie.abelbeck.com \
    --cc=Jason@zx2c4.com \
    --cc=aranea@aixah.de \
    --cc=wireguard@lists.zx2c4.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/ public-inbox