From c1118f6a781b92d0ccc07590e190454186ee4123 Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Mon, 19 Oct 2026 16:43:00 +0200
Subject: [PATCH] [client] build the lazy peer config in one place

Preparation for installing idle peers with ML-KEM strict-mode key material
(security review of #7098, finding F-002). The lazy connection manager
receives a peer description from two call sites that each spell out the
same struct literal; the new field should be added once, not kept in sync in
two places.

Pure refactor, no behaviour change: both sites call newLazyPeerConfig.
---
 client/internal/conn_mgr.go | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/client/internal/conn_mgr.go b/client/internal/conn_mgr.go
index 8b01eabcf..9a5d744af 100644
--- a/client/internal/conn_mgr.go
+++ b/client/internal/conn_mgr.go
@@ -163,13 +163,7 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 			continue
 		}
 
-		lazyPeerCfg := lazyconn.PeerConfig{
-			PublicKey:  peerID,
-			AllowedIPs: peerConn.WgConfig().AllowedIps,
-			PeerConnID: peerConn.ConnID(),
-			Log:        peerConn.Log,
-		}
-		excludedPeers = append(excludedPeers, lazyPeerCfg)
+		excludedPeers = append(excludedPeers, newLazyPeerConfig(peerID, peerConn))
 	}
 
 	added := e.lazyConnMgr.ExcludePeer(excludedPeers)
@@ -188,6 +182,16 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }
 
+// newLazyPeerConfig describes a peer connection to the lazy connection manager.
+func newLazyPeerConfig(peerKey string, conn *peer.Conn) lazyconn.PeerConfig {
+	return lazyconn.PeerConfig{
+		PublicKey:  peerKey,
+		AllowedIPs: conn.WgConfig().AllowedIps,
+		PeerConnID: conn.ConnID(),
+		Log:        conn.Log,
+	}
+}
+
 // AddPeerConn registers a peer connection. permanent requests an always-active connection
 // (the peer belongs to the exclude set: a forwarder, or a peer that is not lazy by policy).
 // Non-permanent peers are handed to the lazy manager. The subsequent SetExcludeList call
@@ -212,13 +216,7 @@ func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Co
 		return
 	}
 
-	lazyPeerCfg := lazyconn.PeerConfig{
-		PublicKey:  peerKey,
-		AllowedIPs: conn.WgConfig().AllowedIps,
-		PeerConnID: conn.ConnID(),
-		Log:        conn.Log,
-	}
-	excluded, err := e.lazyConnMgr.AddPeer(lazyPeerCfg)
+	excluded, err := e.lazyConnMgr.AddPeer(newLazyPeerConfig(peerKey, conn))
 	if err != nil {
 		conn.Log.Errorf("failed to add peer to lazyconn manager: %v", err)
 		if err := conn.Open(ctx); err != nil {