From 4e7cbe2ef8a634c02e757fcfc4484f2456cf112f Mon Sep 17 00:00:00 2001 From: riccardom Date: Fri, 24 Jul 2026 18:28:43 +0200 Subject: [PATCH] Ensure iface is up and with overlay ip assigned to get a valid UDP port --- client/internal/engine.go | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/client/internal/engine.go b/client/internal/engine.go index 9cde5a8f6..f1715830f 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -574,13 +574,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL) return fmt.Errorf("run rosenpass manager: %w", err) } } - - if pqkem.Enabled() { - log.Infof("ML-KEM post-quantum exchange enabled") - // TODO(NET-1406): replace noopPQTransport with the real dedicated UDP transport - // bound on the WG overlay IPv4. - e.pqkemManager = pqkem.NewManager(publicKey.String(), noopPQTransport{}, pqCallbackHandler{wg: e.wgInterface}, nil) - } e.stateManager.Start() initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings() @@ -662,6 +655,14 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL) e.rpManager.SetInterface(e.wgInterface) } + // Start the ML-KEM PQ manager after the interface is up so its (dedicated UDP) + // transport can bind on the WG overlay IP. TODO(NET-1406): replace noopPQTransport + // with the real transport bound on e.config.WgAddr.IP. + if pqkem.Enabled() { + log.Infof("ML-KEM post-quantum exchange enabled") + e.pqkemManager = pqkem.NewManager(publicKey.String(), noopPQTransport{}, pqCallbackHandler{wg: e.wgInterface}, nil) + } + // if inbound conns are blocked there is no need to create the ACL manager if e.firewall != nil && !e.config.BlockInbound { e.acl = acl.NewDefaultManager(e.firewall) @@ -2911,6 +2912,7 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) { RosenpassPubKey: rosenpassPubKey, RosenpassAddr: rosenpassAddr, MlkemPayload: msg.GetBody().GetMlkemPayload(), + MlkemPort: int(msg.GetBody().GetMlkemPort()), RelaySrvAddress: msg.GetBody().GetRelayServerAddress(), RelaySrvIP: relayIP, SessionID: sessionID,