From 171d22e4e86ae77066e5180ea77951b667a53b64 Mon Sep 17 00:00:00 2001 From: riccardom Date: Tue, 4 Aug 2026 15:30:15 +0200 Subject: [PATCH] Be more explicit on names that is a fake key to ensure we don't communicate with others in strict mode --- client/internal/peer/conn.go | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go index 1e0904bf3..c13d59051 100644 --- a/client/internal/peer/conn.go +++ b/client/internal/peer/conn.go @@ -186,10 +186,10 @@ type Conn struct { // transport is up. pendingFirstPacket []byte - // pqBlockingKey is a per-conn random sentinel PSK used in PQ strict mode to fail - // closed: it is programmed until the real ML-KEM PSK is derived, so no session can - // form on a non-PQ key. Per-conn random so two strict peers never match by chance. - pqBlockingKey *wgtypes.Key + // pqStrictSentinelKey is a per-conn random sentinel PSK used in PQ strict mode to + // fail closed: it is programmed until the real ML-KEM PSK is derived, so no session + // can form on a non-PQ key. Per-conn random so two strict peers never match by chance. + pqStrictSentinelKey *wgtypes.Key } // injectPendingFirstPacket replays the captured handshake through the proxy if present, else @@ -251,7 +251,7 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) { if k, err := wgtypes.GenerateKey(); err != nil { connLog.Errorf("pqkem: failed to generate strict-mode sentinel key, strict fail-closed disabled for this peer: %v", err) } else { - conn.pqBlockingKey = &k + conn.pqStrictSentinelKey = &k } } @@ -1092,13 +1092,13 @@ func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key { if psk, ok := conn.config.PQ.PSK(conn.config.Key); ok { return &psk } - if conn.config.PQStrict && conn.pqBlockingKey != nil { + if conn.config.PQStrict && conn.pqStrictSentinelKey != nil { // Fail closed: program a non-matching sentinel so no session forms on a // non-PQ key until the ML-KEM exchange derives the real PSK (pushed via // SetPresharedKey once it converges). "pending" — turns into a "stuck" // warning from the manager if the exchange keeps failing (see raiseFailure). conn.Log.Debugf("pqkem: strict mode — no PQ PSK yet, blocking peer traffic until the ML-KEM exchange converges") - return conn.pqBlockingKey + return conn.pqStrictSentinelKey } }