firezone / boringtun / 35053455098

39%

Build Type

push

github

Committed by web-flow

Commit Message

fix: expire the tunnel when its current session expires (#245)

A session's lifetime is derived from the handshake that created it, so
both peers discard it at the same instant. Reaching `REJECT_AFTER_TIME`
on the current session therefore means the re-key that should have
replaced it never landed, and there is no state left on either side for
a fresh handshake to reach. We nevertheless started one and only
surfaced `ConnectionExpired` a further `REKEY_ATTEMPT_TIME` later, so a
peer that was unreachable across the re-key window spent 90s handshaking
into nothing before its caller was told to rebuild.

This does change what happens to a tunnel that goes genuinely idle: a
session that simply ages out with no traffic on it used to be renewed in
place, and now the tunnel expires and the caller re-establishes on the
next packet. Callers that keep traffic on the session within
`REKEY_AFTER_TIME`, which is how connlib uses this, never reach that
state.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

12 of 12 new or added lines in 1 file covered. (100.0%)

5 existing lines in 1 file now uncovered.

1657 of 4245 relevant lines covered (39.03%)

800.98 hits per line