sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-28 10:31:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Addresses CI fixes

Browse Source
This commit is contained in:
riccardom
2026-08-07 16:27:31 +02:00
parent 5f90751c49
commit 47e6aaec0a
3 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
client/internal/engine.go
View File

@@ -668,6 +668,11 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
if pqkem.Enabled() {
tr, pqErr := newPQTransport(e.config.WgAddr.IP)
if pqErr != nil {
// In strict mode the peer must fail closed; silently continuing without the PQ
// exchange would hand out classic tunnels, so treat the bind failure as fatal.
if pqkem.Strict() {
return fmt.Errorf("pqkem: strict mode enabled but transport bind failed: %w", pqErr)
}
log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
} else {
cbHandler := pqCallbackHandler{

10
client/internal/peer/conn.go
View File

@@ -258,11 +258,13 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
}
if config.PQ != nil && config.PQStrict {
if k, err := wgtypes.GenerateKey(); err != nil {
connLog.Errorf("pqkem: failed to generate strict-mode sentinel key, strict fail-closed disabled for this peer: %v", err)
} else {
conn.pqStrictSentinelKey = &k
// The sentinel is what makes strict mode fail closed; if we cannot generate it we
// must not fall back to a usable key, so fail creating the conn instead.
k, err := wgtypes.GenerateKey()
if err != nil {
return nil, fmt.Errorf("generate pqkem strict-mode sentinel key: %w", err)
}
conn.pqStrictSentinelKey = &k
}
return conn, nil

12
client/internal/pqkem_transport.go
View File

@@ -30,11 +30,19 @@ func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
if !overlayIP.IsValid() {
return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
}
// Unmap an IPv4-mapped IPv6 address so AsSlice() yields 4 bytes, and pick the UDP
// network matching the overlay family (a hardcoded "udp4" fails on a v6 overlay and
// on a mapped v4 whose AsSlice() is 16 bytes).
overlayIP = overlayIP.Unmap()
network := "udp6"
if overlayIP.Is4() {
network = "udp4"
}
ip := net.IP(overlayIP.AsSlice())
conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
conn, err := net.ListenUDP(network, &net.UDPAddr{IP: ip, Port: DefaultPort})
if err != nil {
log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
conn, err = net.ListenUDP(network, &net.UDPAddr{IP: ip, Port: 0})
if err != nil {
return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
}