From aa4fcb6be1d00cf38eae0121c51240cb39ff80bd Mon Sep 17 00:00:00 2001 From: riccardom Date: Fri, 24 Jul 2026 18:09:20 +0200 Subject: [PATCH] Initializes PQ ML-KEM manager --- client/internal/engine.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/client/internal/engine.go b/client/internal/engine.go index 0e0fabbf6..99f5c22a7 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -50,6 +50,7 @@ import ( icemaker "github.com/netbirdio/netbird/client/internal/peer/ice" "github.com/netbirdio/netbird/client/internal/peerstore" "github.com/netbirdio/netbird/client/internal/portforward" + "github.com/netbirdio/netbird/client/internal/pqkem" "github.com/netbirdio/netbird/client/internal/profilemanager" "github.com/netbirdio/netbird/client/internal/relay" "github.com/netbirdio/netbird/client/internal/rosenpass" @@ -197,6 +198,9 @@ type Engine struct { // rpManager is a Rosenpass manager rpManager *rosenpass.Manager + // pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM). + pqkemManager *pqkem.Manager + // syncMsgMux is used to guarantee sequential Management Service message processing syncMsgMux *sync.Mutex @@ -570,6 +574,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL) return fmt.Errorf("run rosenpass manager: %w", err) } } + + if pqkem.Enabled() { + log.Infof("ML-KEM post-quantum exchange enabled") + // TODO(NET-1406): wire the real tunnel-UDP transport + WG PSK callback handler. + e.pqkemManager = pqkem.NewManager(publicKey.String(), noopPQTransport{}, noopPQCallbackHandler{}, nil) + } e.stateManager.Start() dnsServer, err := e.newDnsServer() @@ -2076,6 +2086,10 @@ func (e *Engine) close() { _ = e.rpManager.Close() } + if e.pqkemManager != nil { + e.pqkemManager.Stop() + } + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() if err := e.portForwardManager.GracefullyStop(ctx); err != nil {