starred/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 11:35:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

Remove obvious comments; leave only the why of things

Browse Source
This commit is contained in:
riccardom
2026-08-04 15:29:15 +02:00
parent decb081d01
commit 60d35d86c9
3 changed files with 11 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
client/internal/engine.go
View File

@@ -560,10 +560,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
publicKey := e.config.WgPrivateKey.PublicKey()
e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder)
// Rosenpass and ML-KEM are mutually exclusive post-quantum providers: both
// program the same WireGuard PSK, so running them together would race on
// SetPresharedKey. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence; when it is
// enabled Rosenpass is skipped even if configured on.
// Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence
if e.config.RosenpassEnabled && pqkem.Enabled() {
log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled")
}
@@ -657,9 +654,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
}
// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
// transport can bind on the WG overlay IP. ML-KEM takes precedence over
// Rosenpass (see the mutual-exclusion note at rosenpass startup above), so
// when it is enabled rosenpass has already been skipped.
// transport can bind on the WG overlay IP.
if pqkem.Enabled() {
tr, pqErr := newPQTransport(e.config.WgAddr.IP)
if pqErr != nil {

18
client/internal/pqkem/manager.go
View File

@@ -139,7 +139,7 @@ func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manage
}
// Start installs the data-path transport and begins its inbound delivery. The Manager
// owns it from here; Stop closes it. Start/Stop are the transport lifecycle pair.
// owns it from here; Stop closes it.
func (m *Manager) Start(t Transport) {
m.mu.Lock()
m.transport = t
@@ -184,7 +184,7 @@ func (m *Manager) trace(msg string, args ...any) {
}
// AddPeer registers where a peer's data-path messages are sent and received: its
// overlay endpoint (IP:port). Re-adding updates the endpoint.
// overlay endpoint (IP:port).
func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
if !endpoint.IsValid() {
return
@@ -322,14 +322,12 @@ func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
}
}
// OnDataPathRekeyed notifies that the peer's data path is up and freshly keyed with
// the latest PSK (fired on first establishment AND every rekey). If we are the
// initiator that just derived a PSK, it chains the next exchange: a fresh offer over
// the data path that acknowledges the just-completed one (its arrival under the new
// key proves to the responder that the key works).
// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey.
// sinceActivity is how long ago the peer last exchanged real user data; when it
// exceeds rotationActivityWindow the tunnel is treated as idle and rotation is
// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey
// (fired on first establishment AND every rekey). If we are the initiator that just
// derived a PSK, it chains the next exchange: a fresh offer over the data path that
// acknowledges the just-completed one (its arrival under the new key proves to the
// responder the key works). sinceActivity is how long ago the peer last exchanged real
// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is
// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {

2
client/internal/pqkem_adapter.go
View File

@@ -26,7 +26,7 @@ type pqCallbackHandler struct {
}
// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey.
// if the peer is not present, mirroring Rosenpass).
func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
// peer is not configured yet, so this is a no-op there and the PSK is instead