starred/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:45:14 -04:00
Code Issues Packages Projects Releases Wiki Activity

Adds real callback setter for PSK on ready

Browse Source
This commit is contained in:
riccardom
2026-07-24 18:18:15 +02:00
parent bdd1683fed
commit a26aeeee47
2 changed files with 37 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
client/internal/engine.go
View File

@@ -577,8 +577,9 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
if pqkem.Enabled() {
log.Infof("ML-KEM post-quantum exchange enabled")
// TODO(NET-1406): wire the real tunnel-UDP transport + WG PSK callback handler.
e.pqkemManager = pqkem.NewManager(publicKey.String(), noopPQTransport{}, noopPQCallbackHandler{}, nil)
// TODO(NET-1406): replace noopPQTransport with the real dedicated UDP transport
// bound on the WG overlay IPv4.
e.pqkemManager = pqkem.NewManager(publicKey.String(), noopPQTransport{}, pqCallbackHandler{wg: e.wgInterface}, nil)
}
e.stateManager.Start()

50
client/internal/pqkem_adapter.go
View File

@@ -1,23 +1,41 @@
package internal
import "github.com/netbirdio/netbird/client/internal/pqkem"
import (
log "github.com/sirupsen/logrus"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
// No-op adapters wiring the engine to the ML-KEM manager's two seams. They are
// placeholders so the manager can be instantiated and its lifecycle managed while
// the real integration is built.
//
// TODO(NET-1406):
// - noopPQTransport -> real tunnel-UDP transport (send over the WG data path,
// feed inbound to Manager.OnDataPathMessage), analogue of go-rosenpass's Conn.
// - noopPQCallbackHandler -> program the derived PSK via iface/wgctrl on
// OnNewPSKReady, and tear the peer down / trigger ICE reconnect on OnRekeyFailed.
"github.com/netbirdio/netbird/client/internal/pqkem"
)
// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
type pqPresharedKeySetter interface {
SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
}
// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
// engine-side implementation of pqkem.CallbackHandler.
type pqCallbackHandler struct {
wg pqPresharedKeySetter
}
// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey.
func (h pqCallbackHandler) OnNewPSKReady(remoteID string, psk pqkem.PSK) error {
return h.wg.SetPresharedKey(remoteID, wgtypes.Key(psk), true)
}
// OnRekeyFailed reports a failed PQ (re)key convergence.
// TODO(NET-1406): tear the peer connection down / trigger ICE reconnect.
func (h pqCallbackHandler) OnRekeyFailed(remoteID string) error {
log.Warnf("pqkem: post-quantum rekey failed for peer %s", remoteID)
return nil
}
// noopPQTransport is a placeholder data-path transport for the ML-KEM manager.
// TODO(NET-1406): replace with the real dedicated UDP transport bound on the WG
// overlay IPv4 (send over the data path, feed inbound to Manager.OnDataPathMessage),
// analogue of go-rosenpass's Conn.
type noopPQTransport struct{}
func (noopPQTransport) SendDataPath(remoteID string, msg []byte) error { return nil }
type noopPQCallbackHandler struct{}
func (noopPQCallbackHandler) OnNewPSKReady(remoteID string, psk pqkem.PSK) error { return nil }
func (noopPQCallbackHandler) OnRekeyFailed(remoteID string) error { return nil }