fix: the overlay's MTU is set live, and an old handshake is drift (keel#139, keel#140) #143

Merged

marcos-mendez merged 1 commit from fix/overlay-mtu-live into main

2026-10-10 15:53:03 -03:00

marcos-mendez commented

2026-10-10 15:05:46 -03:00

(Migrated from github.com)

Fixes #139 and #140. Evidence: Keel-Linux/handbook#63, findings N7, N6 and N10.

#139 (N7)

After the upgrade to 0.23.13, wg0.conf had MTU = 1280 and the live wg0 kept 1420. Only wg-quick up reads the line, so apply planned nothing and diff had no MTU line.

keel/network/mtu.py (new): reads the live MTU (ip link show) and sets it with ip link set dev <iface> mtu N. This restarts nothing.
keel/network/switch.py (live_plan, mtu_line, wg_mtu): the live path sets the new file's MTU when the interface has another one. With no live MTU, a change of the MTU line is still a bounce, as is a file that drops it.
keel/system/overlay.py, keel/system/ovstate.py: a kept file whose interface has another MTU gets the ip link set action, said as drift.
keel network mtu (keel/cli.py, keel/commands.py) does it for each WireGuard interface that is up. The new debian/keel.postinst runs it on configure, so an upgrade needs no reboot. A failure is said and never fails the upgrade.
keel/diff/handshakes.py (mtu_fields): network.overlay.wireguard.mtu, the live MTU against the file's, on the live system.

#140 (N6, N10)

A last handshake older than 180 s is drift in keel diff and keel mesh status (WireGuard does a new handshake every 2 minutes while packets flow).
The drift says that the member does not answer and is unreachable. It no longer tells the operator to run keel mesh sync on that member.

Docs: docs/apply.md, docs/diff.md, docs/mesh.md. Version 0.23.15 (#136 holds 0.23.14).

Tests

Unit: tests/test_network_mtu.py (new), tests/test_system_overlay.py, tests/test_diff_handshakes.py, tests/test_mesh_create_status.py.
Bats: tests/postinst.bats (new), run from tests/test_hook_bats.py.
Real wg in a network namespace (tests/test_network_overlay_live_netns.py, in "mesh / trixie"): wg0 is set to 1420 under a file of MTU = 1280. A live change of the peers sets 1280 with no wg-quick, the same interface index and the same handshake. Then keel network mtu sets 1420 back to 1280.

CI

All 23 checks pass. vip-upgrade / trixie failed one time (run 38074400820, test_a_the_holder_restarted_as_an_upgrade_does: the VIP dropped for 4.47 s after the holder's try-restart). That test does not use the code of this PR, and the same job also failed one time on main. One rerun of the failed job passed.

Fixes #139 and #140. Evidence: Keel-Linux/handbook#63, findings N7, N6 and N10. ## #139 (N7) After the upgrade to 0.23.13, wg0.conf had `MTU = 1280` and the live wg0 kept 1420. Only `wg-quick up` reads the line, so apply planned nothing and diff had no MTU line. - `keel/network/mtu.py` (new): reads the live MTU (`ip link show`) and sets it with `ip link set dev <iface> mtu N`. This restarts nothing. - `keel/network/switch.py` (`live_plan`, `mtu_line`, `wg_mtu`): the live path sets the new file's MTU when the interface has another one. With no live MTU, a change of the MTU line is still a bounce, as is a file that drops it. - `keel/system/overlay.py`, `keel/system/ovstate.py`: a kept file whose interface has another MTU gets the `ip link set` action, said as drift. - `keel network mtu` (`keel/cli.py`, `keel/commands.py`) does it for each WireGuard interface that is up. The new `debian/keel.postinst` runs it on configure, so an upgrade needs no reboot. A failure is said and never fails the upgrade. - `keel/diff/handshakes.py` (`mtu_fields`): `network.overlay.wireguard.mtu`, the live MTU against the file's, on the live system. ## #140 (N6, N10) - A last handshake older than 180 s is drift in keel diff and keel mesh status (WireGuard does a new handshake every 2 minutes while packets flow). - The drift says that the member does not answer and is unreachable. It no longer tells the operator to run keel mesh sync on that member. Docs: `docs/apply.md`, `docs/diff.md`, `docs/mesh.md`. Version 0.23.15 (#136 holds 0.23.14). ## Tests - Unit: `tests/test_network_mtu.py` (new), `tests/test_system_overlay.py`, `tests/test_diff_handshakes.py`, `tests/test_mesh_create_status.py`. - Bats: `tests/postinst.bats` (new), run from `tests/test_hook_bats.py`. - Real wg in a network namespace (`tests/test_network_overlay_live_netns.py`, in "mesh / trixie"): wg0 is set to 1420 under a file of `MTU = 1280`. A live change of the peers sets 1280 with no wg-quick, the same interface index and the same handshake. Then `keel network mtu` sets 1420 back to 1280. ## CI All 23 checks pass. `vip-upgrade / trixie` failed one time (run 38074400820, `test_a_the_holder_restarted_as_an_upgrade_does`: the VIP dropped for 4.47 s after the holder's try-restart). That test does not use the code of this PR, and the same job also failed one time on main. One rerun of the failed job passed.