sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-25 05:49:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Adds observability and fixes cross cases

Browse Source 
- strict-kem vs strict-rp said "Connected + Quantum resistance: true" but it is actually blocked
- perm-kem vs perm-rp "Connected + Quantum resistance: true" but it's a classic WG link, without PQ safety
This commit is contained in:
riccardom
2026-09-11 15:03:47 +02:00
parent 1ee012160b
commit 91f1a724e2
9 changed files with 137 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/peer/conn.go
+7 -1
View File
@@ -1187,7 +1187,13 @@ func isRosenpassEnabled(remoteRosenpassPubKey []byte) bool {
// the status "Quantum resistance" field: either Rosenpass (the remote advertised a
// Rosenpass key) or the ML-KEM exchange (a PQ PSK has been derived for this peer).
func (conn *Conn) quantumResistant(remoteRosenpassPubKey []byte, pqEstablished bool) bool {
return isRosenpassEnabled(remoteRosenpassPubKey) || pqEstablished
// Rosenpass protects the tunnel only when both sides run it: the local peer has a
// Rosenpass key AND the remote advertised one. Checking only the remote key would
// report a plain (or blocked) tunnel as quantum-resistant when the local side does
// not run Rosenpass — e.g. against a peer that merely advertises it in a mixed
// deployment. A homogeneous Rosenpass deployment (both sides on) is unaffected.
rosenpassActive := conn.config.RosenpassConfig.PubKey != nil && isRosenpassEnabled(remoteRosenpassPubKey)
return rosenpassActive || pqEstablished
}
func evalConnStatus(in connStatusInputs) guard.ConnStatus {