trombik / esp_wireguard

WireGuard Implementation for ESP-IDF.
Other
193 stars 34 forks source link

Change TAI64N timestamp source to gettimeofday #37

Closed Pecius closed 1 year ago

Pecius commented 1 year ago

This pull request fixes the behaviour which prevents the ESP32 device from reconnecting after reset (as reported in #29) by supplying time from source which can be synchronized with a SNTP service or an external RTC device. As mentioned here, WireGuard implements timestamps as a countermeasure for replay attacks. Which means handshakes with timestamps lower than previously encountered will be discarded. And since the current implementation uses _sysnow, the supplied time is being reset along with the device.

limpens commented 1 year ago

I've tested this change. Without the modification, I was not able to get the wireguard connection working, when switching between 2 devices (same code/build). Most of the time, a test with the second device failed to get the wireguard connection up.

With the suggested modification, I can switch between two devices (same keys/code etc) and every single time, the connection is setup correctly. This looks like an improvement.

amaldo commented 1 year ago

I can confirm that this change is meaningful. I also had done tests switching to gettimeofday to get a valid global time, and it had improved reconnections.

To make sure that the VPN server will continue talking to the clients, it is advisable to first synchronize the time using NTP, and then start the wireguard connection.