From 45865ec80fb29dd2e63249f47a09c918a4c51901 Mon Sep 17 00:00:00 2001 From: riccardom Date: Tue, 4 Aug 2026 15:29:15 +0200 Subject: [PATCH] Remove obvious comments; leave only the why of things --- client/internal/engine.go | 9 ++------- client/internal/pqkem/manager.go | 18 ++++++++---------- client/internal/pqkem_adapter.go | 2 +- 3 files changed, 11 insertions(+), 18 deletions(-) diff --git a/client/internal/engine.go b/client/internal/engine.go index 95bbf0c73..96e1ee827 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -560,10 +560,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL) publicKey := e.config.WgPrivateKey.PublicKey() e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder) - // Rosenpass and ML-KEM are mutually exclusive post-quantum providers: both - // program the same WireGuard PSK, so running them together would race on - // SetPresharedKey. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence; when it is - // enabled Rosenpass is skipped even if configured on. + // Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence if e.config.RosenpassEnabled && pqkem.Enabled() { log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled") } @@ -657,9 +654,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL) } // Start the ML-KEM PQ manager after the interface is up so its dedicated UDP - // transport can bind on the WG overlay IP. ML-KEM takes precedence over - // Rosenpass (see the mutual-exclusion note at rosenpass startup above), so - // when it is enabled rosenpass has already been skipped. + // transport can bind on the WG overlay IP. if pqkem.Enabled() { tr, pqErr := newPQTransport(e.config.WgAddr.IP) if pqErr != nil { diff --git a/client/internal/pqkem/manager.go b/client/internal/pqkem/manager.go index bb3aae48d..8306433c7 100644 --- a/client/internal/pqkem/manager.go +++ b/client/internal/pqkem/manager.go @@ -139,7 +139,7 @@ func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manage } // Start installs the data-path transport and begins its inbound delivery. The Manager -// owns it from here; Stop closes it. Start/Stop are the transport lifecycle pair. +// owns it from here; Stop closes it. func (m *Manager) Start(t Transport) { m.mu.Lock() m.transport = t @@ -184,7 +184,7 @@ func (m *Manager) trace(msg string, args ...any) { } // AddPeer registers where a peer's data-path messages are sent and received: its -// overlay endpoint (IP:port). Re-adding updates the endpoint. +// overlay endpoint (IP:port). func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) { if !endpoint.IsValid() { return @@ -322,14 +322,12 @@ func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error { } } -// OnDataPathRekeyed notifies that the peer's data path is up and freshly keyed with -// the latest PSK (fired on first establishment AND every rekey). If we are the -// initiator that just derived a PSK, it chains the next exchange: a fresh offer over -// the data path that acknowledges the just-completed one (its arrival under the new -// key proves to the responder that the key works). -// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey. -// sinceActivity is how long ago the peer last exchanged real user data; when it -// exceeds rotationActivityWindow the tunnel is treated as idle and rotation is +// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey +// (fired on first establishment AND every rekey). If we are the initiator that just +// derived a PSK, it chains the next exchange: a fresh offer over the data path that +// acknowledges the just-completed one (its arrival under the new key proves to the +// responder the key works). sinceActivity is how long ago the peer last exchanged real +// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is // skipped — an idle tunnel has nothing to protect, and rotating would emit data-path // traffic that keeps the peer artificially active (see conn.onWGCheckSuccess). func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) { diff --git a/client/internal/pqkem_adapter.go b/client/internal/pqkem_adapter.go index 7a66c8a69..d99eb1b5d 100644 --- a/client/internal/pqkem_adapter.go +++ b/client/internal/pqkem_adapter.go @@ -26,7 +26,7 @@ type pqCallbackHandler struct { } // OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op -// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey. +// if the peer is not present, mirroring Rosenpass). func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error { // updateOnly: applies to an already-configured peer (rotation). At bootstrap the // peer is not configured yet, so this is a no-op there and the PSK is instead