Wayk and the Time
Today I had a problem connecting to a Wayk Agent on Windows (which luckily made it much easier to get logs) and apparently wayk really does not like a few seconds (in this case 48) of clock skew, and the biggest problem is that nobody knows the error until one sees the logs.
This was against the default Wayk Bastion, so den-side clock should be accurate enough.
This is majorly annoying as this is something really hard if not impossible to debug, maybe the wayk Agent should account for a little bit of clock skew, like 2 minutes in both directions.
2020-11-19 10:37:39 wayk_rust::utils [ERROR] - http signature error: signature is not yet valid (created: 1605778640, now: 1605778592)
All Comments (3)
Hello
Thanks for the feedback; we understand that this can be annoying. In fact we've just made some changes a couple of days ago (here is the relevant commit if you're interested).
Essentially, the Wayk Agent does allow a little bit of clock skew but as you've discovered, it's sometimes not enough. Moving forward, rather than try to account for the clock difference manually, certificates will be generated with their validity starting a few minutes in the past (effectively, your clock may be off by up to around 10 minutes). That is a backend change so I'm afraid we'll need to wait for a new Bastion release (and for the latest code to be deployed on den.wayk.net) to get the benefits.
I hope it helps!
Thanks and kind regards,
Richard Markievicz
also for cases that have a clear culprit like these, maybe tell that the clocks may be off instead of just saying "could not establish connection" as the person at the PC running the agent usually knows totally nothing, and no way for the user with the client to do or even KNOW what's wrong unless there's another path to the PC (which kinda makes wayk useless if one needs another way in, when wayk sometimes more, sometimes less frequently (at least comparing it to the not too many times I actually need to connect) not only doesnt work but doesnt provide any details.
although the quick log export is a good thing and certainly helpful, this is something I need to add.
Hello
We're aware of the issue, and I agree it would be better to surface this information to the user (since we know what the problem is, it's better not to have to dig into the log files). We have a ticket open already on that, I'd encourage other users that consider this important to add their voice here.
Thanks and kind regards,
Richard Markievicz