Connection Failure: "Client last hole punch is too old" on Android and CLI due to SQLITE_CONSTRAINT_FOREIGNKEY #331

New Issue

MrUnknownDE · 2026-04-05T17:06:25+02:00

MrUnknownDE commented

2026-04-05 17:06:25 +02:00

Originally created by @r3nor on 1/24/2026

Describe the Bug

I am unable to establish a connection from Android or CLI after the first successful attempt. The server appears unable to clear the previous session, leaving the client in a broken state where it constantly fails with "Client last hole punch is too old."

I observed a FOREIGN KEY constraint failed error in the logs immediately preceding the connection issues. It appears the server fails to clean up expired sessions, preventing new connections from registering correctly.

Root Cause Log (Pangolin Container):

The server crashes when trying to clear expired sessions:

pangolin  | 2026-01-24T18:11:28+00:00 [warn]: Error clearing expired sessions: FOREIGN KEY constraint failed
pangolin  | Stack: SqliteError: FOREIGN KEY constraint failed
pangolin  |     at PreparedQuery.run (/app/node_modules/src/better-sqlite3/session.ts:132:20)
pangolin  |     at QueryPromise.resultCb (/app/node_modules/src/sqlite-core/session.ts:185:61)
pangolin  |     at QueryPromise.execute (/app/node_modules/src/sqlite-core/session.ts:31:15)
pangolin  |     at QueryPromise.then (/app/node_modules/src/query-promise.ts:31:15) {"code":"SQLITE_CONSTRAINT_FOREIGNKEY"}

Symptom Log (Connection Attempt):

Following the SQL error, the client attempts to connect but gets rejected due to key mismatches and stale hole punch data:

pangolin  | 2026-01-24T18:19:00+00:00 [info]: WebSocket connection established - OLM ID: 3xxrgre3mlg57ia
pangolin  | 2026-01-24T18:19:01+00:00 [info]: Handling register olm message!
pangolin  | 2026-01-24T18:19:01+00:00 [info]: Public key mismatch. Updating public key and clearing session info...
pangolin  | 2026-01-24T18:19:01+00:00 [warn]: Client last hole punch is too old and we have sites to send; skipping this register
...

Observations:

The log shows a Public key mismatch followed by repeatedClient last hole punch is too old warnings.
This occurs on both platforms (Android and Linux).

Environment

OS Type & Version: (e.g., Ubuntu 22.04): Linux Debian 13 Trixie
Pangolin Version: latest tag
Gerbil Version: latest tag
Traefik Version: v3.1 tag
Newt Version: latest tag
Olm Version: (if applicable)

To Reproduce

Connect a client (CLI or Android) successfully.
Disconnect.
Attempt to reconnect.
Connection fails indefinitely.

Expected Behavior

Reconnections work normally

*Originally created by @r3nor on 1/24/2026* ### Describe the Bug I am unable to establish a connection from Android or CLI after the first successful attempt. The server appears unable to clear the previous session, leaving the client in a broken state where it constantly fails with "Client last hole punch is too old." I observed a FOREIGN KEY constraint failed error in the logs immediately preceding the connection issues. It appears the server fails to clean up expired sessions, preventing new connections from registering correctly. **Root Cause Log (Pangolin Container):** The server crashes when trying to clear expired sessions: ``` pangolin | 2026-01-24T18:11:28+00:00 [warn]: Error clearing expired sessions: FOREIGN KEY constraint failed pangolin | Stack: SqliteError: FOREIGN KEY constraint failed pangolin | at PreparedQuery.run (/app/node_modules/src/better-sqlite3/session.ts:132:20) pangolin | at QueryPromise.resultCb (/app/node_modules/src/sqlite-core/session.ts:185:61) pangolin | at QueryPromise.execute (/app/node_modules/src/sqlite-core/session.ts:31:15) pangolin | at QueryPromise.then (/app/node_modules/src/query-promise.ts:31:15) {"code":"SQLITE_CONSTRAINT_FOREIGNKEY"} ``` **Symptom Log (Connection Attempt):** Following the SQL error, the client attempts to connect but gets rejected due to key mismatches and stale hole punch data: ``` pangolin | 2026-01-24T18:19:00+00:00 [info]: WebSocket connection established - OLM ID: 3xxrgre3mlg57ia pangolin | 2026-01-24T18:19:01+00:00 [info]: Handling register olm message! pangolin | 2026-01-24T18:19:01+00:00 [info]: Public key mismatch. Updating public key and clearing session info... pangolin | 2026-01-24T18:19:01+00:00 [warn]: Client last hole punch is too old and we have sites to send; skipping this register ... ``` **Observations**: - The log shows a Public key mismatch followed by repeatedClient last hole punch is too old warnings. - This occurs on both platforms (Android and Linux). ### Environment - OS Type & Version: (e.g., Ubuntu 22.04): Linux Debian 13 Trixie - Pangolin Version: latest tag - Gerbil Version: latest tag - Traefik Version: v3.1 tag - Newt Version: latest tag - Olm Version: (if applicable) ### To Reproduce 1. Connect a client (CLI or Android) successfully. 2. Disconnect. 3. Attempt to reconnect. 4. Connection fails indefinitely. ### Expected Behavior Reconnections work normally

MrUnknownDE closed this issue

2026-04-05 17:06:25 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#331