firezone
firezone copied to clipboard
DNS Resource mappings break if query happens while portal is redeploying
@conectado and I found a peculiar bug:
- DNS Resource of *.google.com
- Client queries
account.google.com, triggering connection to Gateway - Deploy is started
- Client requests
meet.google.comwhile it's connected to the Gateway (and portal) but the Gateway is not connected to the portal at that point in time meet.google.comnow gets mapped to a dummy IP, but the Gateway the client is connected to never receives thereuse_connectionmessage- Further DNS queries and packets to the mapped IP in the Client never re-trigger the
request_connectionmessage - Can only be fixed with a client sign out and sign in
This is also an issue for CIDR Resources
cc @thomaseizinger @AndrewDryga
Note to @AndrewDryga @bmanifold this means deploys can/will break access to the second and thereafter Resources on the same Gateway for any currently signed-in Clients if the resources are attempted while the deploy is happening.
This will be fixed by https://github.com/firezone/firezone/issues/6461, just noting this here to be very careful with deploys until that is implemented.