Pass the app's log level into the elevated run

.github/workflows/release.yml

@@ -475,132 +475,6 @@ jobs:
           path: dist/
           retention-days: 3
 
-  release_ui_gtk3:
-    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
-    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
-    # the binary links against the oldest supported glibc.
-    runs-on: ubuntu-22.04
-    outputs:
-      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0 # It is required for GoReleaser to work properly
-          persist-credentials: false
-
-      - name: Parse semver string
-        id: semver_parser
-        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-
-      - name: Set snapshot flag
-        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          echo "flags=--snapshot" >> $GITHUB_ENV
-
-      - name: Set build vars
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
-          else
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-          fi
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Cache Go modules
-        # Restore-only from the release_ui cache written by trusted runs; the
-        # module cache is identical (same go.sum) and stale build-cache
-        # entries just miss.
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-ui-go-releaser-
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
-        with:
-          version: 11
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        env:
-          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
-          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
-
-      - name: Install wails3 CLI
-        # Version derived from go.mod so the binding generator always matches
-        # the wails runtime the binary links against.
-        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
-        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
-        # not exist on ubuntu-22.04.
-        run: |
-          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
-          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
-        with:
-          version: ${{ env.GORELEASER_VER }}
-          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
-          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
-          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
-      - name: Verify RPM signatures
-        run: |
-          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
-            dnf install -y -q rpm-sign curl >/dev/null 2>&1
-            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
-            rpm --import /tmp/rpm-pub.key
-            echo "=== Verifying RPM signatures ==="
-            for rpm_file in /dist/*.rpm; do
-              [ -f "$rpm_file" ] || continue
-              echo "--- $(basename $rpm_file) ---"
-              rpm -K "$rpm_file"
-            done
-          '
-      - name: Clean up GPG key
-        if: always()
-        run: rm -f /tmp/gpg-rpm-signing-key.asc
-      - name: upload non tags for debug purposes
-        id: upload_release_ui_gtk3
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
-        with:
-          name: release-ui-gtk3
-          path: dist/
-          retention-days: 3
-
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -814,7 +688,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
+    needs: [release, release_ui, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -826,14 +700,12 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
-          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
-          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -856,7 +728,6 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
-              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -913,7 +784,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines

.github/workflows/test-infrastructure-files.yml

@@ -257,15 +257,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Verify fresh-install session cookie key hardening
-        run: |
-          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
-          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
-          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
-
       - name: Verify Dex retirement notice
         run: |
           if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then

.goreleaser_ui.yaml

@@ -92,6 +92,11 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
+      # Names the polkit action for the elevation prompt the app raises when an
+      # unprivileged user changes a privileged setting; without it the dialog
+      # shows a raw command line.
+      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
+        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
       - netbird (>= 0.75.0)
       - libgtk-4-1 (>= 4.14)
@@ -115,6 +120,11 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
+      # Names the polkit action for the elevation prompt the app raises when an
+      # unprivileged user changes a privileged setting; without it the dialog
+      # shows a raw command line.
+      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
+        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
       - netbird >= 0.75.0
       - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)

.goreleaser_ui_gtk3.yaml

@@ -1,131 +0,0 @@
-version: 2
-env:
-  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
-project_name: netbird-ui
-
-before:
-  hooks:
-    # Bindings are gitignored; regenerate before the frontend build so
-    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
-    # build without them).
-    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
-    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
-    # not exist on ubuntu-22.04.
-    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
-    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
-
-builds:
-  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
-  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
-  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
-  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
-  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
-  - id: netbird-ui-gtk3
-    dir: client/ui
-    binary: netbird-ui
-    env:
-      - CGO_ENABLED=1
-    goos:
-      - linux
-    goarch:
-      - amd64
-    ldflags:
-      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
-    mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
-      - gtk3
-
-archives:
-  - id: linux-gtk3-arch
-    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-
-nfpms:
-  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
-  # alternatives served from separate repo paths (see uploads below); a given
-  # distro points at exactly one of them. The file names must still differ:
-  # the Debian pool is shared storage keyed by file name, so a default-named
-  # gtk3 .deb would overwrite the stable one.
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_deb_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - deb
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-3-0
-      - libwebkit2gtk-4.1-0
-
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - rpm
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird >= 0.75.0
-      - (gtk3 or libgtk-3-0)
-      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-
-    rpm:
-      signature:
-        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
-
-# The GTK4 UI job shares project_name, so the default checksum file name would
-# collide with it on the shared GitHub release.
-checksum:
-  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
-
-changelog:
-  disable: true
-
-uploads:
-  # The gtk3 packages reuse the netbird-ui package name, so they live in
-  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
-  # legacy distros point their repo config at.
-  - name: debian-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_deb_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
-    username: dev@wiretrustee.com
-    method: PUT
-
-  - name: yum-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_rpm_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
-    username: dev@wiretrustee.com
-    method: PUT

AGENTS.md

@@ -14,22 +14,20 @@ in this file, not duplicated there.
 
 ## Contents
 
-- [STOP and ask the user before](#stop-and-ask-the-user-before)
-- [Quick reference](#quick-reference)
-- [Structure](#structure)
-- [Where to look](#where-to-look)
-- [Security](#security)
-- [Agent conventions](#agent-conventions)
-- [Repo-wide principles](#repo-wide-principles)
-- [Type safety](#type-safety)
-- [Concurrency and lifecycle](#concurrency-and-lifecycle)
-- [Error handling](#error-handling)
-- [Comments](#comments)
-- [Testing](#testing)
-- [Pitfalls](#pitfalls)
-- [Commits, PRs, releases](#commits-prs-releases)
-- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
-- [Discussion and support](#discussion-and-support)
+- [NetBird Agent Guidelines](#netbird-agent-guidelines)
+  - [Contents](#contents)
+  - [STOP and ask the user before](#stop-and-ask-the-user-before)
+  - [Quick reference](#quick-reference)
+  - [Structure](#structure)
+  - [Where to look](#where-to-look)
+  - [Repo-wide principles](#repo-wide-principles)
+  - [Error handling](#error-handling)
+  - [Comments](#comments)
+  - [Testing](#testing)
+  - [Pitfalls](#pitfalls)
+  - [Commits, PRs, releases](#commits-prs-releases)
+  - [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
+  - [Discussion and support](#discussion-and-support)
 
 ## STOP and ask the user before
 
@@ -159,125 +157,11 @@ netbird/
 | LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
 | End-to-end tests            | `e2e/`                                                       |
 
-## Security
-
-### Never fail open
-
-When a security check — access control, an IP restriction, an auth decision —
-hits an error such as an unparseable value, an unavailable lookup, or a state it
-does not recognize, it must **deny**. Never skip the check or allow the request
-through because the check itself failed, and make the `default` and unknown cases
-of a security-related `switch` deny rather than fall through.
-
-### Daemon RPC input is untrusted
-
-The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
-privilege boundary: treat every field as untrusted input rather than as something
-the UI or CLI validated on the way in.
-
-When you add or change an RPC, ask what the handler does with caller input while
-running as root. If the answer touches a filesystem path, a URL or host, or a
-privileged state change, it needs a gate **in the handler** — a check in the client
-that normally calls it is not a check at all.
-
-- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
-  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
-  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
-  not own — so a symlink or hardlink aimed at a root-only file is rejected.
-- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
-  allow only known hosts for unprivileged callers. Prefer a lexical host
-  allowlist plus TLS verification over "resolve the host, then reject private
-  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
-  check time, attacker IP at connect time), while a name allowlist has no IP
-  check to race. Never accept `http://` where `https://` is expected.
-- **A privileged state change** (SSH root login, management URL, deregistration)
-  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
-
-Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
-named-pipe client token — and never from an RPC field. When
-`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
-do not fall back to treating the caller as the transport peer.
-
-## Agent conventions
-
-### Three networking modes
-
-Where packets actually flow depends on the mode the agent is running in. The
-three are not interchangeable, so establish which one a change applies to — and
-what it should do in the other two — before you write it.
-
-- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
-  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
-  client programs kernel facilities but never sees the traffic itself.
-- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
-  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
-  — exit nodes and network routes — goes through the userspace forwarder, which
-  terminates the connection and re-establishes it over OS sockets. Used on
-  platforms without kernel WireGuard® or when the user opts out.
-- **netstack mode**: wireguard-go in-process with no TUN and no kernel
-  networking. The forwarder does all routing by stitching userspace sockets, and
-  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
-  Used where the process cannot create a TUN device, such as the embedded client
-  (`client/embed/`) and the WASM build.
-
-### The overlay interface is not "WireGuard"
-
-Do not put "WireGuard" in identifiers or comments unless the code is genuinely
-coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
-kernel WireGuard® netlink attribute. For the interface, the host, peers, or
-traffic in general, say "the NetBird interface", "the interface", or "the overlay".
-Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
-reference there is simply inaccurate and rots as the transports change.
-
-### IPv6 is a soft feature
-
-The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
-it as soft rather than a requirement:
-
-- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
-  not on raw state fields, and skip the v6 path when the host has no v6 rather
-  than returning an error.
-- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
-  it, keeping the v4 path working.
-- Never let a missing v6 break v4. Fail-closed is for security checks; a
-  capability mismatch skips the v6 work and carries on.
-
-### Environment variables
-
-Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
-than comparing strings inline, so an unexpected value is logged instead of
-silently meaning false:
-
-```go
-const EnvDisableFeature = "NB_DISABLE_FEATURE"
-
-func isDisabledByEnv() bool {
-    val := os.Getenv(EnvDisableFeature)
-    if val == "" {
-        return false
-    }
-    disabled, err := strconv.ParseBool(val)
-    if err != nil {
-        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
-        return false
-    }
-    return disabled
-}
-```
-
-### Validating against protocol specs
-
-When a change depends on what a protocol actually mandates, read the specification
-text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
-summary, and check that you have the current RFC — the widely cited one for a
-protocol is often superseded. Cite the section, not just the document, so a
-reviewer can jump straight to the rule.
-
 ## Repo-wide principles
 
 1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
-2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
-   you touch, and delete imports, helpers, and parameters your refactor orphaned.
+2. **Zero unaddressed diagnostics.** Fix IDE and linter warnings on code you
+   touch, and delete imports, helpers, and parameters your refactor orphaned.
    Exception: unused parameters in shared code may be consumed by builds outside
    this repository — do not remove them, ask instead.
 3. **Function comments are mandatory for exported functions**, written as full
@@ -291,12 +175,9 @@ reviewer can jump straight to the rule.
 7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
    prose, trailing summaries. Defaults, not absolute bans. Applies to code,
    comments, commit messages, and PR descriptions alike.
-8. **Concurrency: do a two-pass race analysis after every change** that touches
-   shared state, including reads of existing maps and slices. Guard them with a
-   mutex (or an atomic or channel where that fits better), keep critical
-   sections short, and run `go test -race` on the touched packages. See
-   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
-   to check for.
+8. **Concurrency: do a two-pass race analysis after every change** that adds
+   shared state. Guard maps and slices with a mutex, keep critical sections
+   short, and run `go test -race` on the touched packages.
 9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
    Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
    add the counterpart or a build-tagged fallback for the others.
@@ -304,93 +185,6 @@ reviewer can jump straight to the rule.
 11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
     keep peer IPs and hostnames out of logs above debug level.
 
-## Type safety
-
-**No bare primitives for domain concepts.** A `string` parameter for an account
-ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
-because the compiler cannot catch the swap. Declare the type once and use it
-throughout, converting only at the boundaries where data enters or leaves —
-protobuf, gRPC, HTTP, an external library.
-
-```go
-type ServiceID string
-type AccountID string
-
-// Internal: typed all the way through
-func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
-
-// Proto boundary: convert once, on the way in and on the way out
-svcID := ServiceID(mapping.GetId())
-req.ServiceId = string(svcID)
-```
-
-- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
-  boundary and pass the typed value inward.
-- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
-  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
-  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
-  compared mapped address silently fails to match those rules.
-- **Ports are `uint16`** internally; use `int` only where a library forces it and
-  convert immediately.
-- **Enums are a typed string with constants**, so the valid set is discoverable
-  and a typo fails to compile.
-- **Map keys follow the same rule**, and must be a real type (`type ServiceID
-  string`) rather than an alias (`type serviceID = string`) — an alias silently
-  accepts bare strings.
-
-## Concurrency and lifecycle
-
-Beyond the mutex hygiene in the principles above, check for these failure
-modes.
-
-- **Never read a struct field inside a goroutine** when another goroutine may nil
-  or reassign it. Pass the value as a parameter, or capture it into a local before
-  launching. This matters most when `Stop()` nils a field without waiting for the
-  goroutine to finish.
-
-  ```go
-  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
-      m.Start(ctx, ifaceName)
-  }(iface.Name())
-  ```
-
-- **Never wait on a channel while holding a lock the sender needs.** Copy what you
-  need out from under the lock, release it, then wait.
-
-  ```go
-  func (m *Manager) Stop() {
-      m.mu.Lock()
-      cancel, done := m.cancel, m.done
-      m.mu.Unlock()
-      if cancel != nil {
-          cancel()
-          <-done
-      }
-  }
-  ```
-
-- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
-  nil cancel — and must release the state they guarded. Clear maps and caches;
-  a cancelled goroutine holding a live map still pins that memory. Note that a
-  nil map only panics on writes; reads and iteration behave like an empty map,
-  so where post-close use must be rejected, check the stopped flag explicitly.
-- **Publish coupled state only after every fallible step succeeds.** When several
-  fields form an invariant, build them into locals and assign them to the receiver
-  at the end. Assigning as you go leaves the object half-initialized when a later
-  step fails, so a readiness predicate reports ready while a coupled field is nil.
-  If an earlier step already had an external side effect — a created chain, an
-  opened handle, an inserted rule — roll it back before returning the error.
-- **Clean up what you own on constructor error paths.** Once a constructor has
-  started something, every later error path must undo it: cancel a goroutine and
-  wait for it to exit, stop a ticker, close a watcher. The object is never
-  returned, so its `Close` will never run.
-- **A failed `Start` must undo everything it started.** When a component brings up
-  several subsystems in sequence — connection manager, watchers, routing, DNS,
-  flow, persisted state — a failure partway through has to tear down the ones
-  already running, not just close the handle the error came from. Put the
-  already-started guard *before* that teardown path, so a rejected second `Start`
-  cannot dismantle the one that is running.
-
 ## Error handling
 
 Use single-assignment form when the error is only needed inside the `if`:
@@ -454,45 +248,6 @@ Log the errors you choose not to act on:
 - Close errors may be ignored for read-only operations; log them at debug for
   writes.
 
-**Do not log and return the same error.** It gets reported twice, from two places,
-and the second reader cannot tell whether it happened once or twice. Return it and
-let the caller decide. The exception is an API handler that has already written a
-response. Internal helpers return errors rather than logging and swallowing them.
-
-**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
-interface is not nil, so `err != nil` is true and callers take the failure path on
-success. Return the error only where it is actually set:
-
-```go
-if _, err := conn.Write(buf); err != nil {   // good
-    return err
-}
-return nil
-```
-
-**Accumulate with `multierror` when an operation should continue past individual
-failures** — teardown, cleanup, or setup where partial success is acceptable.
-`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
-still see a plain nil on full success:
-
-```go
-func (m *Manager) Cleanup() error {
-    var merr *multierror.Error
-    for _, r := range m.resources {
-        if err := r.Close(); err != nil {
-            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
-        }
-    }
-    return nberrors.FormatErrorOrNil(merr)
-}
-```
-
-| Scenario              | Approach              | Why                                       |
-| --------------------- | --------------------- | ----------------------------------------- |
-| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
-| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
-| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
-
 ## Comments
 
 Comment the **why**, never the **what**. Default to no comment, and add one only
@@ -514,14 +269,10 @@ checksum = updateChecksum(checksum, oldPort, newPort)
 
 ### Length budget
 
-Neither of these is linter-enforced, so they are conventions the surrounding code
-mostly follows rather than hard limits:
-
-- **Around 90 characters per line.** Wrap the comment rather than running well past
-  it.
-- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
-  on exported identifiers may exceed it when the API genuinely needs the
-  explanation; inline comments inside a function body rarely should.
+- **90 characters per line.** Wrap the comment, do not run past it.
+- **250 characters per comment**, roughly three wrapped lines. Doc comments on
+  exported identifiers may exceed it when the API genuinely needs the
+  explanation; inline comments inside a function body may not.
 
 The budget is a smell detector, not a rule to game. Do not compress a needed
 explanation into cryptic shorthand to fit — if a block of code needs more than
@@ -578,19 +329,6 @@ up, and the 250-character budget does not apply to them.
   otherwise.
 - **Message guidance:** optional for `NoError`/`Error`; always give context for
   comparison, boolean, and collection assertions.
-- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
-  reason you expect* — a test that fails for an unrelated reason proves nothing —
-  then apply the fix and confirm it passes. Add the thin surrounding cases while
-  you are there.
-- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
-  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
-  then `os.Unsetenv`.
-- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
-  parent function returns, running its `defer`s, while parallel subtests are
-  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
-  there, but `t.Cleanup` works in both cases.
-- **Explanatory comments in tests are welcome.** Describe the scenario being set
-  up; the comment budget below does not apply to them.
 
 ```go
 server, err := StartTestServer()
@@ -642,8 +380,7 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   than replacing it with your own summary: describe the change, link the issue,
   tick the checklist honestly (including "ran locally" and "single purpose"),
   and complete the documentation section. Do not tick a box you have not
-  verified, and do not delete rows that do not apply — the docs gate in CI reads
-  that section and fails when it is missing.
+  verified, and do not delete rows that do not apply.
 
 - **Keep the PR description short.** Under 1000 words on top of the template's
   own text, and usually far less — a few paragraphs. Reviewers read the diff;
@@ -702,12 +439,6 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   on their own. Propose that split to the user rather than opening one large PR
   and hoping.
 
-  Prefer GitHub's stacked pull requests for such a sequence, rather than
-  hand-managing base branches: open each PR against the branch below it instead of
-  `main`, so every PR's diff shows only its own change. Merging a layer retargets
-  the PRs above it, and branch protections and required checks on the base branch
-  still apply to each one.
-
 - **User-facing changes need a docs PR** in
   [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
   description.

client/firewall/firewalld/firewalld.go

@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. Trusting the interface makes firewalld itself add the
-// accept rules to its own chains instead.
+// rules into them. The workaround mirrors what Tailscale does: let firewalld
+// itself add the accept rules to its own chains by trusting the interface.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic

client/internal/daemonaddr/identity.go

@@ -0,0 +1,17 @@
+package daemonaddr
+
+import "strings"
+
+// CarriesIdentity reports whether the control channel at addr conveys the
+// connecting process's identity to the daemon. A Unix socket carries peer
+// credentials and a named pipe carries the client's token. Nothing else does, TCP
+// included, and there the daemon can authorize a privileged operation for nobody
+// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
+// Windows daemon on the address it served before it had a pipe.
+//
+// A client uses this to tell whether becoming privileged would get it anywhere.
+// It answers from the scheme and nothing else, so an address it does not
+// recognise counts as carrying no identity.
+func CarriesIdentity(addr string) bool {
+	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
+}

client/internal/daemonaddr/identity_test.go

@@ -0,0 +1,29 @@
+package daemonaddr
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCarriesIdentity(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"unix:///var/run/netbird.sock", true},
+		{"unix:///var/run/netbird/default.sock", true},
+		{"npipe://netbird", true},
+		{`npipe://\\.\pipe\ProtectedPrefix\Administrators\netbird`, true},
+		{"tcp://127.0.0.1:41731", false},
+		{"tcp://localhost:41731", false},
+		{"", false},
+		{"/var/run/netbird.sock", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.addr, func(t *testing.T) {
+			assert.Equal(t, tt.want, CarriesIdentity(tt.addr), "address %q", tt.addr)
+		})
+	}
+}

client/internal/elevate/elevate.go

@@ -0,0 +1,74 @@
+// Package elevate re-runs this very executable under the operating system's own
+// privilege-elevation mechanism and waits for it to finish.
+//
+// It exists so that a change the daemon restricts to root/administrator can be
+// authorized from the GUI, by the user, at the moment they ask for it: Windows
+// shows the UAC consent dialog, macOS the system authentication dialog, and
+// Linux/FreeBSD the session's polkit agent. The credentials, where any are
+// asked for, are collected by the operating system and never pass through
+// NetBird.
+//
+// What the elevated process then does is the caller's business: it is the same
+// binary, in a one-shot mode, and it is authorized by the daemon exactly like
+// any other privileged caller, from the identity the kernel reports on the
+// control channel. Nothing here grants privilege, and the daemon gains no new
+// way to be talked into something: elevation only changes who is calling it.
+package elevate
+
+import (
+	"context"
+	"errors"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// AppliedMarker is what the elevated process prints on standard output once it has
+// done what it was run for.
+//
+// macOS's AuthorizationExecuteWithPrivileges reports no exit status and does not
+// say which process it started, so there this line is the only evidence that the
+// change was applied. The other platforms have an exit code and ignore it.
+const AppliedMarker = "netbird-elevated: applied"
+
+var (
+	// ErrDeclined reports that the user dismissed the prompt or did not
+	// authenticate. Nothing happened and nothing is wrong: a caller undoes its
+	// optimistic update and stays quiet.
+	ErrDeclined = errors.New("authorization declined")
+
+	// ErrUnavailable reports that this host has no elevation mechanism we can
+	// drive: no polkit on a Unix desktop, or an executable we decline to run as
+	// root. A caller falls back to telling the user which command to run.
+	ErrUnavailable = errors.New("no privilege elevation mechanism available")
+)
+
+// Run runs this executable with args under the platform's elevation mechanism
+// and waits for it to exit. A non-zero exit is returned as an error, so the
+// caller can treat a completed Run as the operation having succeeded.
+//
+// The args are the caller's own command line, so they cross no privilege
+// boundary: only a user who has just authenticated as an administrator can get
+// them run at all.
+func Run(ctx context.Context, args ...string) error {
+	self, err := trustedSelf()
+	if err != nil {
+		return err
+	}
+	return run(ctx, self, args)
+}
+
+// Available reports whether Run has a mechanism to use on this host, so a caller
+// can offer the prompt only when there is one and otherwise fall back to
+// guidance the user can act on. It answers from what is installed, not from what
+// the user is allowed to do: an administrator's password may still be required
+// and may still not be given, which is ErrDeclined from Run.
+func Available() bool {
+	if _, err := trustedSelf(); err != nil {
+		// Worth a line: this is also what a build run from a group-writable
+		// directory hits, and there is nothing in the UI to say why the offer is
+		// missing.
+		log.Debugf("not offering privilege elevation: %v", err)
+		return false
+	}
+	return mechanismAvailable()
+}

client/internal/elevate/output.go

@@ -0,0 +1,18 @@
+package elevate
+
+import "strings"
+
+// noOutput stands in for a process that said nothing, so that a report of what it
+// said still reads as a sentence.
+const noOutput = "no output"
+
+func firstLine(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return noOutput
+	}
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		return s[:i]
+	}
+	return s
+}

client/internal/elevate/output_test.go

@@ -0,0 +1,21 @@
+package elevate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFirstLine(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{in: "", want: noOutput},
+		{in: "  \n ", want: noOutput},
+		{in: "one line", want: "one line"},
+		{in: "first\nsecond", want: "first"},
+		{in: "\nsecond\n", want: "second"},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, firstLine(tt.in), "input %q", tt.in)
+	}
+}

client/internal/elevate/run_darwin.go

@@ -0,0 +1,359 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+// Authorization Services, reached through purego rather than cgo so the released
+// binaries keep building with CGO_ENABLED=0.
+//
+// The prompt belongs to this process, which is what makes it carry the
+// application's name and our own explanation. Going through osascript instead puts
+// the very same trampoline behind a dialog attributed to osascript, and means
+// handing a shell a command line to re-parse.
+//
+// # On AuthorizationExecuteWithPrivileges
+//
+// It is deprecated, and Apple's guidance (Quinn, "BSD Privilege Escalation on
+// macOS", developer.apple.com/forums/thread/708765) is "while it still works, it's
+// been deprecated for many years. Do not use it in a widely distributed product."
+// It is used here anyway, knowingly, because the alternatives Apple offers are for
+// *obtaining* ongoing privileges — an installer package, SMAppService, SMJobBless —
+// and NetBird already has what they would install: a launchd daemon running as
+// root. What is missing is only a way for an unprivileged client to ask it to act.
+//
+// The way to that without a deprecated call is to authorize the client instead of
+// elevating one: the app takes the right with AuthorizationCreate, passes the
+// AuthorizationExternalForm to the daemon, and the daemon checks it with
+// AuthorizationCopyRights before acting — none of which is deprecated. It is the
+// better design and it is where this should end up. It also means the daemon
+// accepting an authorization over its control socket, which is a new way to be
+// asked for privileged work and wants reviewing as such, so it is deliberately not
+// bundled in with the rest of this.
+//
+// Until then, three things keep the deprecation from being a trap. Every symbol is
+// resolved with an error rather than a panic, so a macOS that has dropped this
+// function leaves the app offering the user a command instead of crashing on the
+// way to a prompt. A failure to run the tool is reported as ErrUnavailable, so the
+// fallback is the same one an agent-less Linux session gets. And the whole path
+// runs under guard, which turns a panic out of the FFI layer into that same
+// fallback.
+//
+// The trampoline passes on the environment it was given, so what it starts as root
+// must be an executable this user's peers cannot influence: that is what
+// trustedSelf refuses, and what signing the binary settles for the loader.
+
+const (
+	securityFramework = "/System/Library/Frameworks/Security.framework/Security"
+	libSystem         = "/usr/lib/libSystem.B.dylib"
+
+	// trampoline is what the framework hands the tool to. Present on every macOS,
+	// and worth confirming before offering a prompt rather than mid-prompt.
+	trampoline = "/usr/libexec/security_authtrampoline"
+)
+
+// rightExecute is the right an administrator holds, and what
+// AuthorizationExecuteWithPrivileges requires of us.
+const rightExecute = "system.privilege.admin"
+
+// promptKey is kAuthorizationEnvironmentPrompt, which puts a sentence of ours above
+// the system's in the dialog. It is about the change rather than the mechanism.
+const (
+	promptKey  = "prompt"
+	promptText = "NetBird needs to change a setting that grants SSH access to this computer."
+)
+
+// OSStatus values from SecBase.h that mean something to us; anything else is
+// reported as it comes.
+const (
+	errAuthorizationSuccess               = 0
+	errAuthorizationDenied                = -60005
+	errAuthorizationCanceled              = -60006
+	errAuthorizationInteractionNotAllowed = -60007
+	errAuthorizationToolExecuteFailure    = -60031
+	errAuthorizationToolEnvironmentError  = -60032
+)
+
+// AuthorizationFlags from Authorization.h.
+const (
+	flagDefaults           = 0
+	flagInteractionAllowed = 1 << 0
+	flagExtendRights       = 1 << 1
+	flagDestroyRights      = 1 << 3
+	flagPreAuthorize       = 1 << 4
+)
+
+// authorizationItem mirrors AuthorizationItem: a name, and a value the name gives
+// meaning to. 32 bytes on both amd64 and arm64.
+type authorizationItem struct {
+	name        *byte
+	valueLength uintptr
+	value       unsafe.Pointer
+	// flags is reserved by the API and always zero. Declared because the layout
+	// is the contract: without it the struct is 24 bytes where C reads 32.
+	flags uint32 //nolint:unused // part of the C layout
+}
+
+// authorizationItemSet mirrors AuthorizationItemSet, which serves as both an
+// AuthorizationRights and an AuthorizationEnvironment.
+type authorizationItemSet struct {
+	count uint32
+	items *authorizationItem
+}
+
+var (
+	authorizationCreate                func(rights, environment *authorizationItemSet, flags uint32, authorization *uintptr) int32
+	authorizationExecuteWithPrivileges func(authorization uintptr, pathToTool string, options uint32, arguments *uintptr, communicationsPipe *uintptr) int32
+	authorizationFree                  func(authorization uintptr, flags uint32) int32
+	fileno                             func(stream uintptr) int32
+	fclose                             func(stream uintptr) int32
+
+	loadOnce sync.Once
+	loadErr  error
+)
+
+// load resolves the functions once. A framework that cannot be opened, or a symbol
+// that is no longer there, leaves the host without a mechanism rather than taking
+// the process down with it: see the note on deprecation above.
+func load() error {
+	loadOnce.Do(func() { loadErr = guard("loading Security.framework", resolve) })
+	return loadErr
+}
+
+// guard turns a panic out of the FFI layer into an error, so an API that has
+// changed under us costs the user a prompt rather than the window they were
+// clicking in. purego panics on a signature it cannot map, and this is the one
+// place in the client that calls a deprecated system function.
+//
+// It catches Go panics, which is what purego raises. A fault inside the framework
+// itself is not a panic and not recoverable; the layout the tests pin down is what
+// stands between us and that.
+func guard(what string, fn func() error) (err error) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+		log.Errorf("%s panicked: %v", what, r)
+		err = fmt.Errorf("%w: %s: %v", ErrUnavailable, what, r)
+	}()
+	return fn()
+}
+
+func resolve() error {
+	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", securityFramework, err)
+	}
+	system, err := purego.Dlopen(libSystem, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", libSystem, err)
+	}
+
+	// purego.RegisterLibFunc panics on a symbol it cannot find, which is not how a
+	// deprecated function's disappearance should reach the user.
+	for _, fn := range []struct {
+		ptr    any
+		handle uintptr
+		name   string
+	}{
+		{&authorizationCreate, security, "AuthorizationCreate"},
+		{&authorizationExecuteWithPrivileges, security, "AuthorizationExecuteWithPrivileges"},
+		{&authorizationFree, security, "AuthorizationFree"},
+		{&fileno, system, "fileno"},
+		{&fclose, system, "fclose"},
+	} {
+		symbol, err := purego.Dlsym(fn.handle, fn.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", fn.name, err)
+		}
+		if symbol == 0 {
+			return fmt.Errorf("resolve %s: not present on this system", fn.name)
+		}
+		purego.RegisterFunc(fn.ptr, symbol)
+	}
+	return nil
+}
+
+// run asks the system to run self as root: first for the right, which is what puts
+// up the authentication dialog and collects the password or takes the Touch ID,
+// then for the tool. The credentials go to the system's authorization trampoline
+// and never to us.
+//
+// The context bounds only our own waiting; the dialog belongs to the system and
+// closes when the user answers it.
+func run(ctx context.Context, self string, args []string) error {
+	if err := load(); err != nil {
+		return fmt.Errorf("%w: %v", ErrUnavailable, err)
+	}
+
+	return guard("asking for privileges", func() error {
+		authorization, err := authorize()
+		if err != nil {
+			return err
+		}
+		defer authorizationFree(authorization, flagDestroyRights)
+
+		return execute(ctx, authorization, self, args)
+	})
+}
+
+func mechanismAvailable() bool {
+	if err := load(); err != nil {
+		return false
+	}
+	info, err := os.Stat(trampoline)
+	return err == nil && !info.IsDir()
+}
+
+// authorize obtains the right, prompting for it. A dismissed dialog comes back as
+// errAuthorizationCanceled and a password given up on as errAuthorizationDenied;
+// both are the user's answer rather than a failure.
+func authorize() (uintptr, error) {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment,
+		flagDefaults|flagInteractionAllowed|flagPreAuthorize|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		return authorization, nil
+	case errAuthorizationCanceled, errAuthorizationDenied:
+		return 0, ErrDeclined
+	case errAuthorizationInteractionNotAllowed:
+		// Nowhere to put a dialog, so there is nobody to ask: a launch daemon, or
+		// a session with no window server.
+		return 0, fmt.Errorf("%w: this session cannot show an authorization prompt", ErrUnavailable)
+	default:
+		return 0, fmt.Errorf("request %s: OSStatus %d", rightExecute, status)
+	}
+}
+
+// execute runs the tool with the right in hand and waits for it by reading the pipe
+// it is given until the tool closes it.
+//
+// AuthorizationExecuteWithPrivileges reports no exit status and does not say what
+// process it started, which is why the one-shot says so itself: what it prints is
+// the only evidence that the change was applied.
+func execute(ctx context.Context, authorization uintptr, self string, args []string) error {
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	argv := make([]uintptr, 0, len(args)+1)
+	for _, arg := range args {
+		argv = append(argv, uintptr(unsafe.Pointer(cString(&pinner, arg))))
+	}
+	argv = append(argv, 0)
+	pinner.Pin(&argv[0])
+
+	var pipe uintptr
+	status := authorizationExecuteWithPrivileges(authorization, self, flagDefaults, &argv[0], &pipe)
+	switch status {
+	case errAuthorizationSuccess:
+	case errAuthorizationCanceled:
+		return ErrDeclined
+	case errAuthorizationToolExecuteFailure, errAuthorizationToolEnvironmentError:
+		// The right was granted and the tool still did not start. Nothing the user
+		// can do about it from here, so point them at the command instead.
+		return fmt.Errorf("%w: the system would not run %s elevated (OSStatus %d)", ErrUnavailable, self, status)
+	default:
+		return fmt.Errorf("run %s elevated: OSStatus %d", self, status)
+	}
+
+	out, err := readPipe(ctx, pipe)
+	if err != nil {
+		return err
+	}
+	return checkApplied(out)
+}
+
+// checkApplied reads the one-shot's report, which stands in for the exit status
+// there is no way to ask for here. A run that said nothing did not apply the
+// change, whatever else went on.
+func checkApplied(out string) error {
+	if !strings.Contains(out, AppliedMarker) {
+		return fmt.Errorf("elevated netbird did not report the change as applied: %s", firstLine(out))
+	}
+	return nil
+}
+
+// readPipe drains the tool's output, which ends when the tool exits and is
+// therefore also how we wait for it.
+func readPipe(ctx context.Context, pipe uintptr) (string, error) {
+	if pipe == 0 {
+		return "", nil
+	}
+	defer fclose(pipe)
+
+	fd := int(fileno(pipe))
+	if fd < 0 {
+		return "", nil
+	}
+
+	var out strings.Builder
+	buf := make([]byte, 4096)
+	for {
+		if err := ctx.Err(); err != nil {
+			return out.String(), err
+		}
+		n, err := syscall.Read(fd, buf)
+		if n > 0 {
+			out.Write(buf[:n])
+		}
+		switch {
+		case errors.Is(err, syscall.EINTR):
+			// A signal landed mid-read, which says nothing about the tool.
+			continue
+		case err != nil:
+			log.Debugf("read the elevated process's output: %v", err)
+			return out.String(), nil
+		case n <= 0:
+			// End of file: the tool closed the pipe, which is how it exiting
+			// reaches us.
+			return out.String(), nil
+		}
+	}
+}
+
+// itemSet builds an AuthorizationItemSet over items, pinned for the call.
+func itemSet(pinner *runtime.Pinner, items ...authorizationItem) *authorizationItemSet {
+	pinner.Pin(&items[0])
+	set := &authorizationItemSet{count: uint32(len(items)), items: &items[0]}
+	pinner.Pin(set)
+	return set
+}
+
+// promptItem is the environment entry carrying our sentence for the dialog.
+func promptItem(pinner *runtime.Pinner) authorizationItem {
+	value := []byte(promptText)
+	pinner.Pin(&value[0])
+	return authorizationItem{
+		name:        cString(pinner, promptKey),
+		valueLength: uintptr(len(value)),
+		value:       unsafe.Pointer(&value[0]),
+	}
+}
+
+// cString returns a NUL-terminated copy of s, pinned so the C side may hold it for
+// the duration of the call.
+func cString(pinner *runtime.Pinner, s string) *byte {
+	b := append([]byte(s), 0)
+	pinner.Pin(&b[0])
+	return &b[0]
+}

client/internal/elevate/run_darwin_test.go

@@ -0,0 +1,111 @@
+package elevate
+
+import (
+	"errors"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The framework has to load and the symbols have to resolve, or nothing else here
+// means anything.
+func TestSecurityFrameworkLoads(t *testing.T) {
+	require.NoError(t, load(), "Security.framework must open")
+
+	for name, fn := range map[string]any{
+		"AuthorizationCreate":                authorizationCreate,
+		"AuthorizationExecuteWithPrivileges": authorizationExecuteWithPrivileges,
+		"AuthorizationFree":                  authorizationFree,
+		"fileno":                             fileno,
+		"fclose":                             fclose,
+	} {
+		assert.NotNil(t, fn, "%s must resolve", name)
+	}
+}
+
+// A request with no interaction allowed exercises the whole call — the rights and
+// environment structs, and the OSStatus that comes back — without a dialog anybody
+// has to answer. What the system decides is its business; that it decides at all is
+// what this asserts.
+func TestAuthorizationCreateWithoutInteraction(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
+	environment := itemSet(&pinner, promptItem(&pinner))
+	require.EqualValues(t, 1, rights.count, "the rights struct layout must match the C one")
+
+	var authorization uintptr
+	status := authorizationCreate(rights, environment, flagDefaults|flagExtendRights, &authorization)
+
+	switch status {
+	case errAuthorizationSuccess:
+		// Credentials were already cached for this session.
+		authorizationFree(authorization, flagDestroyRights)
+	case errAuthorizationDenied, errAuthorizationInteractionNotAllowed:
+		// The expected answers when nobody may be asked.
+	default:
+		require.Failf(t, "unknown OSStatus", "AuthorizationCreate returned %d, want a status we recognise", status)
+	}
+}
+
+// Asking with a right nobody has must not be mistaken for a declined prompt: the
+// caller would report nothing at all.
+func TestAuthorizeUnknownRightIsNotDeclined(t *testing.T) {
+	if err := load(); err != nil {
+		t.Skipf("Security.framework did not open: %v", err)
+	}
+
+	var pinner runtime.Pinner
+	defer pinner.Unpin()
+
+	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, "io.netbird.right.that.does.not.exist")})
+
+	var authorization uintptr
+	status := authorizationCreate(rights, nil, flagDefaults|flagExtendRights, &authorization)
+	if status == errAuthorizationSuccess {
+		authorizationFree(authorization, flagDestroyRights)
+	}
+	assert.NotEqual(t, int32(errAuthorizationSuccess), status, "a right that does not exist must not be granted")
+}
+
+func TestMechanismAvailable(t *testing.T) {
+	assert.True(t, mechanismAvailable(), "the trampoline exists on every macOS")
+}
+
+// The one-shot's report is what stands in for an exit status here, so a run that
+// says nothing must not read as success.
+func TestCheckApplied(t *testing.T) {
+	require.NoError(t, checkApplied(AppliedMarker+"\n"), "the report the one-shot prints")
+	require.NoError(t, checkApplied("some warning\n"+AppliedMarker+"\n"), "the report after other output")
+
+	assert.Error(t, checkApplied(""), "a run that printed nothing did not apply the change")
+	assert.Error(t, checkApplied("dyld: library not loaded\n"), "output that is not the report")
+}
+
+// A panic out of the FFI layer has to reach the caller as "no mechanism", which is
+// the outcome that offers the user the command instead of taking the window down.
+func TestGuardTurnsAPanicIntoUnavailable(t *testing.T) {
+	err := guard("pretending to call something", func() error {
+		panic("purego: signature it cannot map")
+	})
+
+	require.ErrorIs(t, err, ErrUnavailable, "a panic must read as a missing mechanism")
+	assert.Contains(t, err.Error(), "pretending to call something", "what panicked")
+}
+
+// guard wraps every darwin path, so what a caller switches on has to survive it.
+func TestGuardPassesErrorsThrough(t *testing.T) {
+	sentinel := errors.New("the call itself failed")
+	assert.ErrorIs(t, guard("calling", func() error { return sentinel }), sentinel,
+		"the error it was given")
+	assert.ErrorIs(t, guard("calling", func() error { return ErrDeclined }), ErrDeclined,
+		"a declined prompt stays declined")
+	assert.NoError(t, guard("calling", func() error { return nil }), "a call that worked")
+}

client/internal/elevate/run_unix.go

@@ -0,0 +1,117 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// pkexec exit codes that are about the authorization rather than about the program
+// we asked it to run. The manual page reserves both.
+const (
+	// exitDismissed is returned when the user dismissed the authentication
+	// dialog.
+	exitDismissed = 126
+	// exitNotAuthorized is returned when the authorization was not obtained. That
+	// covers the user saying no as well as pkexec having had nobody to ask: see
+	// noAgentMarkers.
+	exitNotAuthorized = 127
+)
+
+// exitNotAuthorized covers three different endings that only pkexec's own words
+// tell apart, so they are matched here. Read with LC_ALL=C so the words are the
+// ones written below.
+//
+// refusedMarker is a refusal: the user said no, gave up on the password, or holds
+// an account that may not elevate at all.
+const refusedMarker = "Not authorized"
+
+// noAgentMarkers say pkexec had no way to ask: no agent registered for the
+// session, and no controlling terminal for the textual agent it falls back to.
+var noAgentMarkers = []string{"authentication agent", "controlling terminal"}
+
+// run asks polkit to run self as root. pkexec hands the request to the session's
+// polkit agent, which is what prompts and what collects any password; we see only
+// its verdict.
+//
+// The environment is otherwise deliberately not passed through: pkexec clears it
+// bar a small allowlist, and the one-shot needs nothing from it.
+func run(ctx context.Context, self string, args []string) error {
+	pkexec, err := exec.LookPath("pkexec")
+	if err != nil {
+		return fmt.Errorf("%w: pkexec is not installed", ErrUnavailable)
+	}
+
+	cmd := exec.CommandContext(ctx, pkexec, append([]string{self}, args...)...)
+	// C locale so pkexec's own diagnostics are the ones noAgentMarkers knows.
+	cmd.Env = append(os.Environ(), "LC_ALL=C")
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	// The one-shot reports itself on stdout for macOS's sake, where there is no
+	// exit status to read. Here there is one, so that line is noise.
+	cmd.Stdout = io.Discard
+
+	err = cmd.Run()
+	if err == nil {
+		return nil
+	}
+
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		return fmt.Errorf("run pkexec: %w", err)
+	}
+
+	// Matched against everything pkexec said, reported as one line: a complaint
+	// that is not the first thing printed still has to be recognised, and reading
+	// it as a refusal would swallow it.
+	full := stderr.String()
+	out := firstLine(full)
+
+	switch exitErr.ExitCode() {
+	case exitDismissed:
+		return ErrDeclined
+	case exitNotAuthorized:
+		return notAuthorized(full, out)
+	default:
+		return fmt.Errorf("elevated netbird exited with %d: %s", exitErr.ExitCode(), out)
+	}
+}
+
+// notAuthorized sorts out the three endings pkexec reports as exitNotAuthorized.
+//
+// It also returns that code when the authorization succeeded and it then could
+// not run the program, so a refusal has to be recognised rather than assumed:
+// reading every one of these as "the user said no" would revert the control in
+// silence on a host where elevation is broken.
+func notAuthorized(full, out string) error {
+	switch {
+	case hasAny(full, noAgentMarkers):
+		return fmt.Errorf("%w: polkit had no way to ask: %s", ErrUnavailable, out)
+	case out == noOutput, strings.Contains(full, refusedMarker):
+		// The user said no, which needs no message; that an account barred from
+		// elevating altogether lands here too is why the reason is kept.
+		return fmt.Errorf("%w: %s", ErrDeclined, out)
+	default:
+		return fmt.Errorf("pkexec could not run elevated netbird: %s", out)
+	}
+}
+
+func hasAny(s string, markers []string) bool {
+	for _, marker := range markers {
+		if strings.Contains(s, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func mechanismAvailable() bool {
+	_, err := exec.LookPath("pkexec")
+	return err == nil
+}

client/internal/elevate/run_unix_test.go

@@ -0,0 +1,110 @@
+//go:build linux
+
+package elevate
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakePkexec puts a pkexec on PATH that exits with the given code, so the
+// mapping from polkit's exit codes onto our errors can be exercised without a
+// polkit agent.
+func fakePkexec(t *testing.T, exitCode int, stderr string) {
+	t.Helper()
+
+	dir := t.TempDir()
+	script := fmt.Sprintf("#!/bin/sh\necho %s >&2\nexit %d\n", shellQuote(stderr), exitCode)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pkexec"), []byte(script), 0o700), "write the fake pkexec")
+	t.Setenv("PATH", dir)
+}
+
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+func TestRunMapsPkexecExitCodes(t *testing.T) {
+	tests := []struct {
+		name     string
+		exitCode int
+		stderr   string
+		wantErr  error
+	}{
+		{name: "applied", exitCode: 0},
+		{
+			name:     "dialog dismissed",
+			exitCode: exitDismissed,
+			stderr:   "Error executing command as another user: Request dismissed",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// What a graphical agent reports for a cancelled prompt. Not a
+			// failure: the user was asked and answered.
+			name:     "prompt cancelled",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: Not authorized",
+			wantErr:  ErrDeclined,
+		},
+		{
+			// The same status, but pkexec never got to ask anybody.
+			name:     "no agent and no terminal to fall back on",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address",
+			wantErr:  ErrUnavailable,
+		},
+		{
+			// And the same status again once the authorization succeeded and
+			// pkexec could not run what it had been authorized to run. Reading
+			// that as a refusal would revert the control in silence on a host
+			// where elevation is broken.
+			name:     "authorized but not runnable",
+			exitCode: exitNotAuthorized,
+			stderr:   "Error executing command as another user: No such file or directory",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakePkexec(t, tt.exitCode, tt.stderr)
+
+			err := run(context.Background(), "/nonexistent/netbird-ui", []string{"--flag"})
+			switch {
+			case tt.wantErr != nil:
+				require.ErrorIs(t, err, tt.wantErr, "exit %d said %q", tt.exitCode, tt.stderr)
+			case tt.exitCode == 0:
+				require.NoError(t, err, "a pkexec that exited cleanly applied the change")
+			default:
+				require.Error(t, err, "exit %d said %q", tt.exitCode, tt.stderr)
+				assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+				assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+			}
+		})
+	}
+}
+
+// An exit code that is not polkit's is the one-shot's own failure, and has to
+// stay distinguishable from a declined prompt: the caller reports it.
+func TestRunReportsOneShotFailure(t *testing.T) {
+	fakePkexec(t, 3, "the one-shot said no")
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+
+	require.Error(t, err, "a one-shot that failed is not a prompt that was answered")
+	assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
+	assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
+}
+
+func TestRunWithoutPkexecIsUnavailable(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
+	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
+	require.ErrorIs(t, err, ErrUnavailable, "no pkexec means no mechanism")
+	assert.False(t, mechanismAvailable(), "mechanismAvailable without pkexec on PATH")
+}

client/internal/elevate/run_unsupported.go

@@ -0,0 +1,19 @@
+//go:build !windows && !darwin && !linux
+
+package elevate
+
+import "context"
+
+// run reports that this platform has no elevation prompt to drive.
+//
+// The desktop app is the only caller and is not built for any of these: mobile
+// and WASM have no local user to ask, and the FreeBSD client ships without a UI.
+// pkexec would be the mechanism there, and run_unix.go is what to widen if that
+// changes.
+func run(context.Context, string, []string) error {
+	return ErrUnavailable
+}
+
+func mechanismAvailable() bool {
+	return false
+}

client/internal/elevate/run_windows.go

@@ -0,0 +1,193 @@
+package elevate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// seeMaskNoCloseProcess keeps the started process's handle open in
+	// hProcess so we can wait for it.
+	seeMaskNoCloseProcess = 0x00000040
+	// seeMaskNoAsync makes ShellExecuteExW finish its work before returning,
+	// which it must when the calling thread does not pump messages.
+	seeMaskNoAsync = 0x00000100
+	// seeMaskFlagNoUI suppresses the shell's own error dialogs; the UAC consent
+	// dialog is not one of them and still appears.
+	seeMaskFlagNoUI = 0x00000400
+
+	// swHide: the one-shot has no window to show.
+	swHide = 0
+
+	// sFalse (S_FALSE) answers CoInitializeEx when COM is already up on this
+	// thread in the mode we asked for; rpcChangedMode (RPC_E_CHANGED_MODE) when
+	// it is up in the other one.
+	sFalse         = 1
+	rpcChangedMode = 0x80010106
+)
+
+// shellExecuteInfoW mirrors SHELLEXECUTEINFOW. The field order and Go's own
+// padding match the C layout on both 386 and amd64.
+type shellExecuteInfoW struct {
+	cbSize         uint32
+	fMask          uint32
+	hwnd           windows.HWND
+	lpVerb         *uint16
+	lpFile         *uint16
+	lpParameters   *uint16
+	lpDirectory    *uint16
+	nShow          int32
+	hInstApp       windows.Handle
+	lpIDList       uintptr
+	lpClass        *uint16
+	hkeyClass      windows.Handle
+	dwHotKey       uint32
+	hIconOrMonitor windows.Handle
+	hProcess       windows.Handle
+}
+
+var (
+	shell32            = windows.NewLazySystemDLL("shell32.dll")
+	procShellExecuteEx = shell32.NewProc("ShellExecuteExW")
+)
+
+// run starts self elevated with the "runas" verb, which is what raises the UAC
+// consent dialog, and waits for it to finish. Windows decides whether consent is
+// enough or an administrator's credentials are needed, and collects them itself.
+func run(ctx context.Context, self string, args []string) error {
+	verb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return fmt.Errorf("encode verb: %w", err)
+	}
+	file, err := windows.UTF16PtrFromString(self)
+	if err != nil {
+		return fmt.Errorf("encode %s: %w", self, err)
+	}
+	params, err := windows.UTF16PtrFromString(windows.ComposeCommandLine(args))
+	if err != nil {
+		return fmt.Errorf("encode arguments: %w", err)
+	}
+
+	info := shellExecuteInfoW{
+		fMask:        seeMaskNoCloseProcess | seeMaskNoAsync | seeMaskFlagNoUI,
+		hwnd:         ownerWindow(),
+		lpVerb:       verb,
+		lpFile:       file,
+		lpParameters: params,
+		nShow:        swHide,
+	}
+	info.cbSize = uint32(unsafe.Sizeof(info))
+
+	process, err := shellExecute(&info)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := windows.CloseHandle(process); err != nil {
+			log.Debugf("close elevated process handle: %v", err)
+		}
+	}()
+
+	return waitForProcess(ctx, process)
+}
+
+// shellExecute performs the call itself. ShellExecuteExW wants COM initialised on
+// the calling thread, so the goroutine is pinned to one for the duration and COM
+// is set up on it; an "already initialised, different mode" answer is fine,
+// because then somebody else has done it for us.
+func shellExecute(info *shellExecuteInfoW) (windows.Handle, error) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	switch err := windows.CoInitializeEx(0, windows.COINIT_APARTMENTTHREADED); {
+	case err == nil, isHResult(err, sFalse):
+		// Ours, or already initialised in the same mode: either way this call
+		// counts and has to be balanced.
+		defer windows.CoUninitialize()
+	case isHResult(err, rpcChangedMode):
+		// The thread is already in the other apartment model. ShellExecuteExW
+		// works there too, and there is nothing of ours to balance.
+	default:
+		return 0, fmt.Errorf("initialise COM: %w", err)
+	}
+
+	ret, _, lastErr := procShellExecuteEx.Call(uintptr(unsafe.Pointer(info)))
+	if ret != 0 {
+		return info.hProcess, nil
+	}
+
+	if errors.Is(lastErr, windows.ERROR_CANCELLED) {
+		return 0, ErrDeclined
+	}
+	return 0, fmt.Errorf("run elevated: %w", lastErr)
+}
+
+// ownerWindow returns this process's foreground window, and 0 when the window in
+// front belongs to somebody else or cannot be attributed. ShellExecuteExW takes it
+// as the parent for the UI it raises, which is what keeps the consent dialog in
+// front of the window the user was just clicking in instead of behind it. It is
+// also what a remote-desktop session needs to place the dialog at all when the
+// secure desktop is switched off.
+func ownerWindow() windows.HWND {
+	hwnd := windows.GetForegroundWindow()
+	if hwnd == 0 {
+		return 0
+	}
+
+	var pid uint32
+	if _, err := windows.GetWindowThreadProcessId(hwnd, &pid); err != nil {
+		log.Debugf("cannot attribute the foreground window, raising the prompt without an owner: %v", err)
+		return 0
+	}
+	if pid != windows.GetCurrentProcessId() {
+		return 0
+	}
+	return hwnd
+}
+
+// isHResult reports whether err carries the given HRESULT. CoInitializeEx
+// returns its HRESULT as an Errno, so the comparison is on the raw value.
+func isHResult(err error, hresult uintptr) bool {
+	var errno windows.Errno
+	return errors.As(err, &errno) && uintptr(errno) == hresult
+}
+
+func waitForProcess(ctx context.Context, process windows.Handle) error {
+	// The wait is interruptible so a cancelled context stops us waiting on a
+	// consent dialog nobody is going to answer. The elevated process is not
+	// ours to kill, and it either applies the change or does not.
+	for {
+		event, err := windows.WaitForSingleObject(process, 250)
+		if err != nil {
+			return fmt.Errorf("wait for the elevated process: %w", err)
+		}
+		if event == uint32(windows.WAIT_OBJECT_0) {
+			break
+		}
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+	}
+
+	var code uint32
+	if err := windows.GetExitCodeProcess(process, &code); err != nil {
+		return fmt.Errorf("read the elevated process's exit code: %w", err)
+	}
+	if code != 0 {
+		return fmt.Errorf("elevated netbird exited with %d", code)
+	}
+	return nil
+}
+
+// mechanismAvailable is true on Windows: UAC prompts for consent when the user
+// is an administrator and for an administrator's credentials when they are not,
+// so there is always something to ask.
+func mechanismAvailable() bool {
+	return true
+}

client/internal/elevate/trusted.go

@@ -0,0 +1,40 @@
+package elevate
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// trustedSelf returns the path of this executable, provided it is one we are
+// willing to have run as root.
+//
+// The check is what keeps elevation from becoming a way to launder someone
+// else's code into a root process: the user consents to NetBird being elevated,
+// having been shown NetBird's name, so what runs must be the file NetBird was
+// installed as and not something a third party could have swapped for it. An
+// executable only its owner can write is that; anything wider is refused, and
+// the caller falls back to showing the command instead.
+//
+// The owner writing to their own executable is not part of that threat: code
+// running as the user can already prompt them for anything, and could just as
+// well ask them to run the command by hand. What matters is that no *other*
+// unprivileged account can reach it.
+func trustedSelf() (string, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("locate this executable: %w", err)
+	}
+
+	// Resolve symlinks so the checks below apply to the file that would actually
+	// be executed, not to a link somebody else may control.
+	resolved, err := filepath.EvalSymlinks(exe)
+	if err != nil {
+		return "", fmt.Errorf("resolve %s: %w", exe, err)
+	}
+
+	if err := checkOnlyOwnerWritable(resolved); err != nil {
+		return "", fmt.Errorf("%w: %s cannot be trusted to run as root: %w", ErrUnavailable, resolved, err)
+	}
+	return resolved, nil
+}

client/internal/elevate/trusted_group_darwin.go

@@ -0,0 +1,10 @@
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it.
+//
+// macOS installs applications as root:admin, mode 0775, /Applications included,
+// so requiring owner-only write would reject every normal install. Group admin
+// (gid 80) is exactly the set of accounts that can answer the authentication
+// dialog, so its write access grants nothing the prompt would not.
+var adminWriteGIDs = []uint32{0, 80}

client/internal/elevate/trusted_group_unix.go

@@ -0,0 +1,9 @@
+//go:build !windows && !darwin
+
+package elevate
+
+// adminWriteGIDs are the groups whose write access to an executable does not
+// widen who could authorize elevating it. Only root's own group qualifies here:
+// a distribution installs into root-owned directories, and there is no
+// system-wide administrators group that both writes them and answers polkit.
+var adminWriteGIDs = []uint32{0}

client/internal/elevate/trusted_unix.go

@@ -0,0 +1,146 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// groupFile lists which accounts are in which group, for the membership a user
+// private group's name does not state: see groupHasOtherMembers.
+const groupFile = "/etc/group"
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory leading
+// to it, is owned by either root or this user and writable by nobody who could not
+// already act as its owner. A writable directory is as good as a writable file,
+// since anything in it can be replaced, so the whole chain is checked.
+func checkOnlyOwnerWritable(path string) error {
+	self := uint32(os.Getuid())
+
+	for dir := path; ; dir = filepath.Dir(dir) {
+		info, err := os.Lstat(dir)
+		if err != nil {
+			return fmt.Errorf("stat %s: %w", dir, err)
+		}
+
+		stat, ok := info.Sys().(*syscall.Stat_t)
+		if !ok {
+			return errors.New("file ownership is unavailable on this platform")
+		}
+		if stat.Uid != 0 && stat.Uid != self {
+			return fmt.Errorf("%s is owned by uid %d, neither root nor this user", dir, stat.Uid)
+		}
+
+		if err := checkWriteBits(dir, info, stat.Uid, stat.Gid); err != nil {
+			return err
+		}
+
+		if parent := filepath.Dir(dir); parent == dir {
+			return nil
+		}
+	}
+}
+
+func checkWriteBits(path string, info os.FileInfo, uid, gid uint32) error {
+	// On a directory the sticky bit stands in for the write bits: whoever may
+	// write there still cannot replace an entry they do not own, which is the
+	// only thing that would matter to us. /tmp is the usual example.
+	sticky := info.IsDir() && info.Mode()&os.ModeSticky != 0
+
+	return writeBitsAllow(path, info.Mode().Perm(), sticky, groupWriteAllowed(uid, gid))
+}
+
+// writeBitsAllow decides on the permission bits alone, given whether the group's
+// write access has been vouched for.
+func writeBitsAllow(path string, perm os.FileMode, sticky, groupAllowed bool) error {
+	if sticky {
+		return nil
+	}
+	if perm&0o020 != 0 && !groupAllowed {
+		return fmt.Errorf("%s is writable by a group with members other than its owner (%v)", path, perm)
+	}
+	if perm&0o002 != 0 {
+		return fmt.Errorf("%s is world-writable (%v)", path, perm)
+	}
+	return nil
+}
+
+// groupWriteAllowed reports whether a group's write access to a file owned by uid
+// puts it in reach of anyone who could not already act as that owner.
+//
+// Two ways it does not. A group in adminWriteGIDs holds the accounts that can
+// answer the elevation prompt anyway. And a user private group is how Debian,
+// Ubuntu and Fedora ship: their umask of 002 makes a home directory and
+// everything built in it group-writable, so refusing that would refuse every
+// build not installed from a package.
+func groupWriteAllowed(uid, gid uint32) bool {
+	if slices.Contains(adminWriteGIDs, gid) {
+		return true
+	}
+
+	group, err := user.LookupGroupId(strconv.FormatUint(uint64(gid), 10))
+	if err != nil {
+		log.Debugf("cannot look up group %d, treating it as shared: %v", gid, err)
+		return false
+	}
+	owner, err := user.LookupId(strconv.FormatUint(uint64(uid), 10))
+	if err != nil {
+		log.Debugf("cannot look up uid %d, treating its group as shared: %v", uid, err)
+		return false
+	}
+
+	if group.Name != owner.Username {
+		return false
+	}
+	return !groupHasOtherMembers(groupFile, group.Name, owner.Username)
+}
+
+// groupHasOtherMembers reports whether the group lists a member besides owner.
+//
+// Sharing the owner's name is what a user private group is recognised by, and it
+// says nothing about who is in it: a group that has since gained a member is
+// still named that way, and that member can write whatever the group can. So the
+// membership is read rather than assumed. A group this file does not describe,
+// because it comes from LDAP or another NSS source, cannot be answered here and
+// leaves the name as the only thing to go on.
+func groupHasOtherMembers(path, name, owner string) bool {
+	file, err := os.Open(path)
+	if err != nil {
+		log.Debugf("cannot read %s for the members of group %q: %v", path, name, err)
+		return false
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			log.Debugf("close %s: %v", path, err)
+		}
+	}()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		// name:password:gid:member,member
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) < 4 || fields[0] != name {
+			continue
+		}
+		for member := range strings.SplitSeq(fields[3], ",") {
+			if member != "" && member != owner {
+				return true
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		log.Debugf("read %s: %v", path, err)
+	}
+	return false
+}

client/internal/elevate/trusted_unix_test.go

@@ -0,0 +1,177 @@
+//go:build !windows
+
+package elevate
+
+import (
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ownerOnlyDir is t.TempDir() with the write bits tightened. testing creates its
+// numbered directory with 0777 minus the umask, so under the common 002 umask it
+// is group-writable and would fail the check under test on its own.
+func ownerOnlyDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o755), "tighten the temporary directory")
+	return dir
+}
+
+// writeExecutable creates a plain executable file, the shape trustedSelf checks.
+func writeExecutable(t *testing.T, dir string) string {
+	t.Helper()
+	path := filepath.Join(dir, "netbird-ui")
+	require.NoError(t, os.WriteFile(path, []byte("#!/bin/sh\n"), 0o755), "write the executable")
+	require.NoError(t, os.Chmod(path, 0o755), "set the executable's mode")
+	return path
+}
+
+func TestCheckOnlyOwnerWritableAcceptsOwnerOnly(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t, ownerOnlyDir(t)))
+	assert.NoError(t, err, "an owner-only writable executable is trustworthy")
+}
+
+func TestCheckOnlyOwnerWritableRejectsWorldWritableFile(t *testing.T) {
+	path := writeExecutable(t, ownerOnlyDir(t))
+	require.NoError(t, os.Chmod(path, 0o777), "make the executable world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "a world-writable executable must be refused")
+}
+
+// The permission policy on its own, without a filesystem to arrange: whether the
+// group has been vouched for is the only thing that makes group write acceptable.
+func TestWriteBitsAllow(t *testing.T) {
+	tests := []struct {
+		name         string
+		perm         os.FileMode
+		sticky       bool
+		groupAllowed bool
+		wantErr      bool
+	}{
+		{name: "owner only", perm: 0o755},
+		{name: "group write in a private group", perm: 0o775, groupAllowed: true},
+		{name: "group write in a shared group", perm: 0o775, wantErr: true},
+		{name: "world write", perm: 0o777, groupAllowed: true, wantErr: true},
+		{name: "world write on a sticky directory", perm: 0o777, sticky: true},
+		{name: "group write on a sticky directory", perm: 0o775, sticky: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := writeBitsAllow("/path", tt.perm, tt.sticky, tt.groupAllowed)
+			if tt.wantErr {
+				assert.Error(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+				return
+			}
+			assert.NoError(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
+		})
+	}
+}
+
+// A build under a home directory on a distribution with a 002 umask, which is what
+// a locally built or tarball-installed binary looks like. Its group has no members
+// but its owner, so it is as good as owner-only.
+//
+// Whether this host is such a distribution is read from the environment rather than
+// from groupWriteAllowed: asking the function under test whether to run would let
+// it skip its own coverage away if it regressed to refusing everything.
+func TestCheckOnlyOwnerWritableAcceptsOwnPrivateGroup(t *testing.T) {
+	requirePrivatePrimaryGroup(t)
+
+	dir := ownerOnlyDir(t)
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o775), "make the directory group-writable")
+	require.NoError(t, os.Chmod(path, 0o775), "make the executable group-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "group write in the owner's own private group reaches nobody else")
+}
+
+// A group that shares its owner's name but has gained another member is no longer
+// private, and its write access reaches an account that could not elevate.
+func TestGroupHasOtherMembers(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry string
+		want  bool
+	}{
+		{name: "no members", entry: "vma:x:1000:"},
+		{name: "only the owner", entry: "vma:x:1000:vma"},
+		{name: "another member", entry: "vma:x:1000:bob", want: true},
+		{name: "the owner and another", entry: "vma:x:1000:vma,bob", want: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "group")
+			body := "root:x:0:\n" + tt.entry + "\nsudo:x:27:vma\n"
+			require.NoError(t, os.WriteFile(path, []byte(body), 0o644), "write the group file")
+
+			assert.Equal(t, tt.want, groupHasOtherMembers(path, "vma", "vma"), "entry %q", tt.entry)
+		})
+	}
+}
+
+// A group file that says nothing about the group leaves the name as the only thing
+// to go on, so the private-group allowance stands rather than collapsing on every
+// host whose groups come from LDAP.
+func TestGroupHasOtherMembersTolerantOfAnUnknownGroup(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "group")
+	require.NoError(t, os.WriteFile(path, []byte("root:x:0:\n"), 0o644), "write the group file")
+
+	assert.False(t, groupHasOtherMembers(path, "vma", "vma"), "a group the file does not describe")
+	assert.False(t, groupHasOtherMembers(filepath.Join(t.TempDir(), "absent"), "vma", "vma"),
+		"no group file at all")
+}
+
+// A writable directory is as good as a writable file: whoever can write the
+// directory can put a different binary at the same path.
+func TestCheckOnlyOwnerWritableRejectsWritableDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "bin")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777), "make the directory world-writable")
+
+	assert.Error(t, checkOnlyOwnerWritable(path), "an executable in a world-writable directory must be refused")
+}
+
+// A sticky world-writable directory is exempt: the sticky bit is what stops one
+// user replacing another's entries. /tmp is why this matters.
+func TestCheckOnlyOwnerWritableAcceptsStickyDirectory(t *testing.T) {
+	dir := filepath.Join(ownerOnlyDir(t), "sticky")
+	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
+	path := writeExecutable(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777|os.ModeSticky), "make the directory sticky and world-writable")
+
+	err := checkOnlyOwnerWritable(path)
+	assert.NoError(t, err, "the sticky bit stops another user replacing the executable")
+}
+
+func TestCheckOnlyOwnerWritableRejectsMissingFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(filepath.Join(ownerOnlyDir(t), "absent"))
+	assert.Error(t, err, "an executable that is not there must be refused")
+}
+
+// requirePrivatePrimaryGroup skips unless this user's primary group is their own,
+// which is what the user-private-group allowance is about.
+func requirePrivatePrimaryGroup(t *testing.T) {
+	t.Helper()
+
+	self, err := user.Current()
+	require.NoError(t, err, "look up the test user")
+	group, err := user.LookupGroupId(strconv.Itoa(os.Getgid()))
+	require.NoError(t, err, "look up the test user's primary group")
+
+	if group.Name != self.Username {
+		t.Skipf("the test user's primary group is %q, not their own, so there is nothing to assert here", group.Name)
+	}
+	if groupHasOtherMembers(groupFile, group.Name, self.Username) {
+		t.Skipf("group %q has other members, so it is not a private group", group.Name)
+	}
+}

client/internal/elevate/trusted_windows.go

@@ -0,0 +1,215 @@
+package elevate
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// fileDeleteChild is FILE_DELETE_CHILD, which x/sys does not define: the
+	// right to delete an entry of a directory without holding DELETE on it.
+	fileDeleteChild = 0x00000040
+
+	// accessAllowedCallbackACEType is an allow ACE with a condition appended to
+	// the ACCESS_ALLOWED_ACE layout, so its trustee is still at SidStart.
+	accessAllowedCallbackACEType = 0x9
+
+	// The allow ACE types that carry object GUIDs ahead of the trustee, so the
+	// SID is not at SidStart. They occur on directory-service objects rather
+	// than files, and are refused rather than skipped: see aceTrustee.
+	accessAllowedObjectACEType         = 0x5
+	accessAllowedCallbackObjectACEType = 0xB
+)
+
+// fileWriteAccess are the rights that let a trustee rewrite or replace a file,
+// or take it over and then do so.
+const fileWriteAccess = windows.FILE_WRITE_DATA | windows.FILE_APPEND_DATA |
+	windows.DELETE | windows.WRITE_DAC | windows.WRITE_OWNER |
+	windows.GENERIC_WRITE | windows.GENERIC_ALL
+
+// dirWriteAccess are the rights over a directory that let a trustee replace an
+// entry somebody else owns. Creating a new entry is not one of them, which is
+// what the Unix sticky bit says in one bit: the root of every volume grants
+// BUILTIN\Users the right to add directories under it, and that reaches nothing
+// already there.
+const dirWriteAccess = fileDeleteChild | windows.DELETE |
+	windows.WRITE_DAC | windows.WRITE_OWNER | windows.GENERIC_ALL
+
+// trustedInstallerSID owns much of what Windows itself installs. x/sys has no
+// well-known constant for it.
+const trustedInstallerSID = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
+
+// checkOnlyOwnerWritable reports an error unless path, and every directory
+// leading to it, is owned by an account that can elevate (or by this user) and
+// grants write access to nobody else. A writable directory is as good as a
+// writable file, since an entry in it can be replaced, so the whole chain is
+// checked.
+func checkOnlyOwnerWritable(path string) error {
+	owners, err := trustedOwners()
+	if err != nil {
+		return err
+	}
+	writers, err := trustedWriters(owners)
+	if err != nil {
+		return err
+	}
+
+	writeAccess := windows.ACCESS_MASK(fileWriteAccess)
+	for target := path; ; target = filepath.Dir(target) {
+		if err := checkSecurity(target, writeAccess, owners, writers); err != nil {
+			return err
+		}
+		if parent := filepath.Dir(target); parent == target {
+			return nil
+		}
+		writeAccess = dirWriteAccess
+	}
+}
+
+// trustedOwners are the accounts we accept as the owner of the executable and of
+// the directories above it: the ones that can already answer the UAC prompt,
+// plus this user, whose own executable is theirs to write. Code running as the
+// user could prompt them for anything anyway; what matters is that no *other*
+// unprivileged account can reach it.
+func trustedOwners() ([]*windows.SID, error) {
+	self, err := currentUserSID()
+	if err != nil {
+		return nil, err
+	}
+
+	owners := []*windows.SID{self}
+	for _, wellKnown := range []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinBuiltinAdministratorsSid,
+	} {
+		sid, err := windows.CreateWellKnownSid(wellKnown)
+		if err != nil {
+			return nil, fmt.Errorf("build well-known SID %d: %w", wellKnown, err)
+		}
+		owners = append(owners, sid)
+	}
+
+	installer, err := windows.StringToSid(trustedInstallerSID)
+	if err != nil {
+		return nil, fmt.Errorf("parse TrustedInstaller SID: %w", err)
+	}
+	return append(owners, installer), nil
+}
+
+// trustedWriters are the trustees whose write access does not widen who could
+// decide what runs behind the prompt. The owners, and CREATOR OWNER, which
+// resolves to the object's owner and is therefore already vetted.
+func trustedWriters(owners []*windows.SID) ([]*windows.SID, error) {
+	creatorOwner, err := windows.CreateWellKnownSid(windows.WinCreatorOwnerSid)
+	if err != nil {
+		return nil, fmt.Errorf("build the CREATOR OWNER SID: %w", err)
+	}
+	return append(slices.Clone(owners), creatorOwner), nil
+}
+
+func checkSecurity(path string, writeAccess windows.ACCESS_MASK, owners, writers []*windows.SID) error {
+	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
+	if err != nil {
+		return fmt.Errorf("read security descriptor of %s: %w", path, err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return fmt.Errorf("read owner of %s: %w", path, err)
+	}
+	if !containsSID(owners, owner) {
+		return fmt.Errorf("%s is owned by %s, which is neither this user nor an account that can elevate", path, owner)
+	}
+
+	dacl, _, err := sd.DACL()
+	if err != nil {
+		return fmt.Errorf("read DACL of %s: %w", path, err)
+	}
+	// A NULL DACL grants everyone everything; only an absent security
+	// descriptor would have got us here without one, and neither is trustworthy.
+	if dacl == nil {
+		return fmt.Errorf("%s has no DACL, so it grants write access to everyone", path)
+	}
+
+	return checkDACL(path, dacl, writeAccess, writers)
+}
+
+// checkDACL refuses an ACL that grants write access to a trustee outside
+// writers.
+//
+// An allowlist, because the trustees that must not have it cannot be listed: an
+// ACE naming an ordinary user account hands that account the same power as one
+// naming Everyone, and only the accounts that may hold it are knowable.
+func checkDACL(path string, dacl *windows.ACL, writeAccess windows.ACCESS_MASK, writers []*windows.SID) error {
+	for i := uint32(0); i < uint32(dacl.AceCount); i++ {
+		var ace *windows.ACCESS_ALLOWED_ACE
+		if err := windows.GetAce(dacl, i, &ace); err != nil {
+			return fmt.Errorf("read ACE %d of %s: %w", i, path, err)
+		}
+		// An inherit-only ACE says what children of this object get, not what
+		// this object grants.
+		if ace.Header.AceFlags&windows.INHERIT_ONLY_ACE != 0 {
+			continue
+		}
+		if ace.Mask&writeAccess == 0 {
+			continue
+		}
+		// Only an allow ACE grants anything; a deny ACE narrows what one gave.
+		if !isAllowACE(ace.Header.AceType) {
+			continue
+		}
+
+		trustee, err := aceTrustee(ace)
+		if err != nil {
+			return fmt.Errorf("read the trustee of ACE %d of %s: %w", i, path, err)
+		}
+		if !containsSID(writers, trustee) {
+			return fmt.Errorf("%s grants write access to %s", path, trustee)
+		}
+	}
+	return nil
+}
+
+// isAllowACE reports whether an ACE type grants rights, rather than denying,
+// auditing or labelling them.
+func isAllowACE(aceType uint8) bool {
+	switch aceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType,
+		accessAllowedObjectACEType, accessAllowedCallbackObjectACEType:
+		return true
+	default:
+		return false
+	}
+}
+
+// aceTrustee returns who an allow ACE grants its rights to. An ACE whose trustee
+// cannot be located is an error rather than something to skip past: being unable
+// to read who is being given write access is a refusal.
+func aceTrustee(ace *windows.ACCESS_ALLOWED_ACE) (*windows.SID, error) {
+	switch ace.Header.AceType {
+	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType:
+		//nolint:gosec // SidStart is the first uint32 of the variable-length SID that follows the ACE header.
+		return (*windows.SID)(unsafe.Pointer(&ace.SidStart)), nil
+	default:
+		return nil, errors.New("an object-type allow ACE does not carry its trustee where we can read it")
+	}
+}
+
+func containsSID(sids []*windows.SID, sid *windows.SID) bool {
+	return slices.ContainsFunc(sids, sid.Equals)
+}
+
+func currentUserSID() (*windows.SID, error) {
+	token := windows.GetCurrentProcessToken()
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return nil, fmt.Errorf("read this process's user: %w", err)
+	}
+	return user.User.Sid, nil
+}

client/internal/elevate/trusted_windows_test.go

@@ -0,0 +1,126 @@
+package elevate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// A file the test user created under their own profile, which is what a per-user
+// install looks like. The whole chain up to the volume root is walked, so this is
+// also what says the walk does not refuse an ordinary Windows installation: the
+// root of every volume grants BUILTIN\Users rights that are not ours to worry
+// about.
+func TestCheckOnlyOwnerWritableAcceptsOwnFile(t *testing.T) {
+	err := checkOnlyOwnerWritable(writeExecutable(t))
+	assert.NoError(t, err, "a file the test user owns, under directories only administrators can write")
+}
+
+// Write access held by an account that cannot answer the UAC prompt means that
+// account decides what runs behind it, whoever the ACE names. The trustees that
+// must not have it cannot be listed, so the check names the ones that may.
+func TestCheckOnlyOwnerWritableRejectsUntrustedWriters(t *testing.T) {
+	tests := []struct {
+		name      string
+		wellKnown windows.WELL_KNOWN_SID_TYPE
+	}{
+		{name: "everyone", wellKnown: windows.WinWorldSid},
+		{name: "authenticated users", wellKnown: windows.WinAuthenticatedUserSid},
+		{name: "builtin users", wellKnown: windows.WinBuiltinUsersSid},
+		// A service account, which no denylist of the obvious groups would name
+		// and which cannot elevate any more than Everyone can.
+		{name: "local service", wellKnown: windows.WinLocalServiceSid},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := writeExecutable(t)
+			grantWrite(t, path, tt.wellKnown)
+
+			assert.Error(t, checkOnlyOwnerWritable(path),
+				"write access for %s must be refused", tt.name)
+		})
+	}
+}
+
+// The masks are the policy: on a file any write reaches its contents, while on a
+// directory only deleting or taking over an entry reaches something already
+// there. Adding an entry does not, which is why the walk survives a volume root.
+func TestWriteAccessMasks(t *testing.T) {
+	assert.NotZero(t, fileWriteAccess&windows.FILE_WRITE_DATA, "writing a file's data reaches its contents")
+	assert.NotZero(t, fileWriteAccess&windows.FILE_APPEND_DATA, "appending to a file reaches its contents")
+
+	assert.Zero(t, dirWriteAccess&windows.FILE_WRITE_DATA, "adding a file to a directory replaces nothing")
+	assert.Zero(t, dirWriteAccess&windows.FILE_APPEND_DATA, "adding a subdirectory replaces nothing")
+	assert.NotZero(t, dirWriteAccess&fileDeleteChild, "deleting an entry replaces it")
+	assert.NotZero(t, dirWriteAccess&windows.DELETE, "deleting the directory takes its entries with it")
+}
+
+func TestIsAllowACE(t *testing.T) {
+	tests := []struct {
+		name    string
+		aceType uint8
+		want    bool
+	}{
+		{name: "allowed", aceType: windows.ACCESS_ALLOWED_ACE_TYPE, want: true},
+		{name: "allowed callback", aceType: accessAllowedCallbackACEType, want: true},
+		{name: "allowed object", aceType: accessAllowedObjectACEType, want: true},
+		{name: "allowed callback object", aceType: accessAllowedCallbackObjectACEType, want: true},
+		{name: "denied", aceType: windows.ACCESS_DENIED_ACE_TYPE},
+		// SYSTEM_AUDIT_ACE_TYPE, which x/sys does not define: an ACE that records
+		// access rather than granting it.
+		{name: "audit", aceType: 0x2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isAllowACE(tt.aceType), "ACE type %#x", tt.aceType)
+		})
+	}
+}
+
+// writeExecutable creates a plain file under the test's own directory, the shape
+// trustedSelf checks.
+func writeExecutable(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "netbird-ui.exe")
+	require.NoError(t, os.WriteFile(path, []byte("MZ"), 0o755), "write the executable")
+	return path
+}
+
+// grantWrite replaces the file's DACL with one that grants a well-known trustee
+// everything, keeping the test user's own access so the file stays deletable.
+func grantWrite(t *testing.T, path string, wellKnown windows.WELL_KNOWN_SID_TYPE) {
+	t.Helper()
+
+	trustee, err := windows.CreateWellKnownSid(wellKnown)
+	require.NoError(t, err, "build the trustee SID")
+	self, err := currentUserSID()
+	require.NoError(t, err, "read the test user's SID")
+
+	acl, err := windows.ACLFromEntries([]windows.EXPLICIT_ACCESS{
+		fullControl(self, windows.TRUSTEE_IS_USER),
+		fullControl(trustee, windows.TRUSTEE_IS_WELL_KNOWN_GROUP),
+	}, nil)
+	require.NoError(t, err, "build the ACL")
+
+	require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, nil, acl, nil), "set the DACL")
+}
+
+func fullControl(sid *windows.SID, trusteeType uint32) windows.EXPLICIT_ACCESS {
+	return windows.EXPLICIT_ACCESS{
+		AccessPermissions: windows.GENERIC_ALL,
+		AccessMode:        windows.GRANT_ACCESS,
+		Trustee: windows.TRUSTEE{
+			TrusteeForm:  windows.TRUSTEE_IS_SID,
+			TrusteeType:  windows.TRUSTEE_TYPE(trusteeType),
+			TrusteeValue: windows.TrusteeValueFromSID(sid),
+		},
+	}
+}

client/internal/engine.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math"
 	"math/rand"
 	"net"
 	"net/netip"
@@ -51,7 +50,6 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
-	"github.com/netbirdio/netbird/client/internal/pqkem"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
@@ -199,10 +197,6 @@ type Engine struct {
 	// rpManager is a Rosenpass manager
 	rpManager *rosenpass.Manager
 
-	// pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM).
-	// It owns the data-path transport and peer endpoint routing.
-	pqkemManager *pqkem.Manager
-
 	// syncMsgMux is used to guarantee sequential Management Service message processing
 	syncMsgMux *sync.Mutex
 
@@ -561,11 +555,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	publicKey := e.config.WgPrivateKey.PublicKey()
 	e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder)
 
-	// Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence
-	if e.config.RosenpassEnabled && pqkem.Enabled() {
-		log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled")
-	}
-	if e.config.RosenpassEnabled && !pqkem.Enabled() {
+	if e.config.RosenpassEnabled {
 		log.Infof("rosenpass is enabled")
 		if e.config.RosenpassPermissive {
 			log.Infof("running rosenpass in permissive mode")
@@ -654,35 +644,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.rpManager.SetInterface(e.wgInterface)
 	}
 
-	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
-	// transport can bind on the WG overlay IP.
-	if pqkem.Enabled() {
-		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
-		if pqErr != nil {
-			// In strict mode the peer must fail closed; silently continuing without the PQ
-			// exchange would hand out classic tunnels, so treat the bind failure as fatal.
-			if pqkem.Strict() {
-				return fmt.Errorf("pqkem: strict mode enabled but transport bind failed: %w", pqErr)
-			}
-			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
-		} else {
-			cbHandler := pqCallbackHandler{
-				wg: e.wgInterface,
-				// On a persistent rekey failure, re-bootstrap the KEM over Signal: a
-				// fresh signalling offer starts a new exchange that overwrites the
-				// stalled PSK on both sides, recovering from a data-path desync.
-				reoffer: func(remoteKey string) {
-					if conn, ok := e.peerStore.PeerConn(remoteKey); ok {
-						conn.RequestReoffer()
-					}
-				},
-			}
-			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), cbHandler, pqkem.NewLogger())
-			e.pqkemManager.Start(tr)
-			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
-		}
-	}
-
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -946,10 +907,6 @@ func (e *Engine) removePeer(peerKey string) error {
 
 	e.connMgr.RemovePeerConn(peerKey)
 
-	if e.pqkemManager != nil {
-		e.pqkemManager.RemovePeer(pqkem.RemoteID(peerKey))
-	}
-
 	err := e.statusRecorder.RemovePeer(peerKey)
 	if err != nil {
 		log.Warnf("received error when removing peer %s from status recorder: %v", peerKey, err)
@@ -1936,10 +1893,6 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 		},
 		ICEConfig: e.createICEConfig(),
 	}
-	if e.pqkemManager != nil {
-		config.PQ = pqHandshaker{mgr: e.pqkemManager}
-		config.PQStrict = pqkem.Strict()
-	}
 
 	serviceDependencies := peer.ServiceDependencies{
 		StatusRecorder:     e.statusRecorder,
@@ -2123,10 +2076,6 @@ func (e *Engine) close() {
 		_ = e.rpManager.Close()
 	}
 
-	if e.pqkemManager != nil {
-		e.pqkemManager.Stop()
-	}
-
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	if err := e.portForwardManager.GracefullyStop(ctx); err != nil {
@@ -2894,13 +2843,6 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
-	// Ports are uint16 internally; the proto widens them to uint32, so validate the
-	// range before narrowing (a value that does not fit is a malformed message).
-	mlkemPort := msg.GetBody().GetMlkemPort()
-	if mlkemPort > math.MaxUint16 {
-		return nil, fmt.Errorf("invalid ML-KEM port %d in signalling message", mlkemPort)
-	}
-
 	offerAnswer := peer.OfferAnswer{
 		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
@@ -2910,8 +2852,6 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 		Version:         msg.GetBody().GetNetBirdVersion(),
 		RosenpassPubKey: rosenpassPubKey,
 		RosenpassAddr:   rosenpassAddr,
-		MlkemPayload:    msg.GetBody().GetMlkemPayload(),
-		MlkemPort:       uint16(mlkemPort),
 		RelaySrvAddress: msg.GetBody().GetRelayServerAddress(),
 		RelaySrvIP:      relayIP,
 		SessionID:       sessionID,

client/internal/ipcauth/privileged.go

@@ -91,6 +91,12 @@ func SelfDelegatesTo() (Identity, bool) {
 	return selfIdentity, true
 }
 
+// The values PrivilegedActorKey returns.
+const (
+	ActorKeyAdministrator = "administrator"
+	ActorKeyRoot          = "root"
+)
+
 // PrivilegedActor names the principal a privileged operation requires, for use
 // in messages shown to the user.
 func PrivilegedActor() string {
@@ -100,6 +106,16 @@ func PrivilegedActor() string {
 	return "root"
 }
 
+// PrivilegedActorKey identifies that principal without wording it, for a client
+// that writes its own message in the user's language. The words PrivilegedActor
+// returns are English, and a translated sentence cannot borrow them.
+func PrivilegedActorKey() string {
+	if runtime.GOOS == "windows" {
+		return ActorKeyAdministrator
+	}
+	return ActorKeyRoot
+}
+
 // ElevatedCommand renders a command so that running it grants the privileges the
 // operation needs. Windows has no in-line equivalent of sudo, so the command is
 // returned unchanged and the user is expected to run it from an elevated

client/internal/peer/conn.go

@@ -3,7 +3,6 @@ package peer
 import (
 	"context"
 	"fmt"
-	"math"
 	"net"
 	"net/netip"
 	"runtime"
@@ -27,7 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/monotime"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -76,39 +74,6 @@ type RosenpassConfig struct {
 	PermissiveMode bool
 }
 
-// PQHandshaker attaches post-quantum ML-KEM material to signalling offers/answers and
-// feeds received material back. It is implemented by the engine over the pqkem
-// manager and is nil when the PQ exchange is disabled. remoteKey is the peer's
-// WireGuard public key.
-type PQHandshaker interface {
-	// OfferPayload returns the KEM offer to embed in an outgoing offer (nil if this
-	// peer is not the KEM initiator) and the local PQ data-path port to announce.
-	OfferPayload(remoteKey string) (payload []byte, port uint16)
-	// ShouldSendBootstrapOffer reports whether, as the controller, we should reply to a
-	// received responder offer with our own KEM offer (true only when no exchange is
-	// already in flight — so we kick the KEM once and ignore further offers).
-	ShouldSendBootstrapOffer(remoteKey string) bool
-	// AnswerPayload processes a received KEM offer (nil if absent) and returns the KEM
-	// answer to embed in the outgoing answer (nil if none) and the local PQ port.
-	AnswerPayload(remoteKey string, recvOffer []byte) (payload []byte, port uint16)
-	// OnAnswer feeds a received KEM answer (nil if absent).
-	OnAnswer(remoteKey string, recvAnswer []byte)
-	// PSK returns the peer's latest derived post-quantum PSK to program at WG
-	// peer-config time (the pull path). ok is false until one has been derived.
-	PSK(remoteKey string) (wgtypes.Key, bool)
-	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
-	// its WG overlay IP with the announced pq UDP port (port 0 means the peer omitted
-	// it and is on the default port).
-	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
-	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
-	// next chained PSK rotation pushed over the data path. sinceActivity is how long
-	// ago the peer last exchanged real user data, so the rotation can be skipped for
-	// idle tunnels.
-	OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration)
-	// OnDataPathDown signals the peer's tunnel went down.
-	OnDataPathDown(remoteKey string)
-}
-
 // ConnConfig is a peer Connection configuration
 type ConnConfig struct {
 	// Key is a public key of a remote peer
@@ -126,12 +91,6 @@ type ConnConfig struct {
 
 	RosenpassConfig RosenpassConfig
 
-	// PQ carries post-quantum ML-KEM material on offers/answers; nil when disabled.
-	PQ PQHandshaker
-	// PQStrict fails closed: block peer traffic until the ML-KEM PSK is established,
-	// instead of letting the tunnel come up classically and upgrading to PQ later.
-	PQStrict bool
-
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 }
@@ -190,11 +149,6 @@ type Conn struct {
 	// pendingFirstPacket is the lazyconn-captured handshake init, replayed once the real
 	// transport is up.
 	pendingFirstPacket []byte
-
-	// pqStrictSentinelKey is a per-conn random sentinel PSK used in PQ strict mode to
-	// fail closed: it is programmed until the real ML-KEM PSK is derived, so no session
-	// can form on a non-PQ key. Per-conn random so two strict peers never match by chance.
-	pqStrictSentinelKey *wgtypes.Key
 }
 
 // injectPendingFirstPacket replays the captured handshake through the proxy if present, else
@@ -252,16 +206,6 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
-	if config.PQ != nil && config.PQStrict {
-		// The sentinel is what makes strict mode fail closed; if we cannot generate it we
-		// must not fall back to a usable key, so fail creating the conn instead.
-		k, err := wgtypes.GenerateKey()
-		if err != nil {
-			return nil, fmt.Errorf("generate pqkem strict-mode sentinel key: %w", err)
-		}
-		conn.pqStrictSentinelKey = &k
-	}
-
 	return conn, nil
 }
 
@@ -363,8 +307,6 @@ func (conn *Conn) Close(signalToRemote bool) {
 
 	if conn.wgWatcherCancel != nil {
 		conn.wgWatcherCancel()
-		conn.wgWatcher = nil
-		conn.wgWatcherCancel = nil
 	}
 	conn.workerRelay.CloseConn()
 	if conn.workerICE != nil {
@@ -463,9 +405,6 @@ func (conn *Conn) ConnID() id.ConnID {
 
 // configureConnection starts proxying traffic from/to local Wireguard and sets connection status to StatusConnected
 func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConnInfo ICEConnInfo) {
-	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
-	pqPSK, pqOK := conn.pqPSK()
-
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -483,7 +422,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 	if conn.currentConnPriority > priority {
 		conn.Log.Infof("current connection priority (%s) is higher than the new one (%s), do not upgrade connection", conn.currentConnPriority, priority)
 		conn.statusICE.SetConnected()
-		conn.updateIceState(iceConnInfo, pqOK, time.Now())
+		conn.updateIceState(iceConnInfo, time.Now())
 		return
 	}
 
@@ -526,7 +465,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 	updateTime := time.Now()
 	conn.enableWgWatcherIfNeeded(updateTime)
 
-	presharedKey := conn.presharedKey(iceConnInfo.RosenpassPubKey, pqPSK)
+	presharedKey := conn.presharedKey(iceConnInfo.RosenpassPubKey)
 	if err = conn.endpointUpdater.ConfigureWGEndpoint(ep, presharedKey); err != nil {
 		conn.handleConfigurationFailure(err, wgProxy)
 		return
@@ -542,14 +481,11 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 
 	conn.currentConnPriority = priority
 	conn.statusICE.SetConnected()
-	conn.updateIceState(iceConnInfo, pqOK, updateTime)
+	conn.updateIceState(iceConnInfo, updateTime)
 	conn.doOnConnected(iceConnInfo.RosenpassPubKey, iceConnInfo.RosenpassAddr, updateTime)
 }
 
 func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
-	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
-	pqPSK, _ := conn.pqPSK()
-
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -576,7 +512,7 @@ func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
 		// todo consider to move after the ConfigureWGEndpoint
 		conn.wgProxyRelay.Work()
 
-		presharedKey := conn.presharedKey(conn.rosenpassRemoteKey, pqPSK)
+		presharedKey := conn.presharedKey(conn.rosenpassRemoteKey)
 		if err := conn.endpointUpdater.SwitchWGEndpoint(conn.wgProxyRelay.EndpointAddr(), presharedKey); err != nil {
 			conn.Log.Errorf("failed to switch to relay conn: %v", err)
 		}
@@ -614,9 +550,6 @@ func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
 }
 
 func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
-	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
-	pqPSK, pqOK := conn.pqPSK()
-
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -645,7 +578,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 		conn.Log.Debugf("do not switch to relay because current priority is: %s", conn.currentConnPriority.String())
 		conn.setRelayedProxy(wgProxy)
 		conn.statusRelay.SetConnected()
-		conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, pqOK, time.Now())
+		conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, time.Now())
 		return
 	}
 
@@ -656,7 +589,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	}
 	updateTime := time.Now()
 	conn.enableWgWatcherIfNeeded(updateTime)
-	if err := conn.endpointUpdater.ConfigureWGEndpoint(wgProxy.EndpointAddr(), conn.presharedKey(rci.rosenpassPubKey, pqPSK)); err != nil {
+	if err := conn.endpointUpdater.ConfigureWGEndpoint(wgProxy.EndpointAddr(), conn.presharedKey(rci.rosenpassPubKey)); err != nil {
 		if err := wgProxy.CloseConn(); err != nil {
 			conn.Log.Warnf("Failed to close relay connection: %v", err)
 		}
@@ -675,7 +608,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	conn.currentConnPriority = conntype.Relay
 	conn.statusRelay.SetConnected()
 	conn.setRelayedProxy(wgProxy)
-	conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, pqOK, updateTime)
+	conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, updateTime)
 	conn.Log.Infof("start to communicate with peer via relay")
 	conn.doOnConnected(rci.rosenpassPubKey, rci.rosenpassAddr, updateTime)
 }
@@ -737,28 +670,12 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
-// RequestReoffer sends a fresh signalling offer for the peer, re-running the
-// post-quantum bootstrap over Signal. Used to recover from a persistent data-path
-// rekey failure: a new exchange overwrites the stalled PSK on both sides. No-op if the
-// connection is not open yet.
-func (conn *Conn) RequestReoffer() {
-	conn.mu.Lock()
-	h := conn.handshaker
-	conn.mu.Unlock()
-	if h == nil {
-		return
-	}
-	if err := h.SendOffer(); err != nil {
-		conn.Log.Debugf("pqkem: recovery re-offer failed: %v", err)
-	}
-}
-
 func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
+	defer conn.mu.Unlock()
 
 	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
 	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
-		conn.mu.Unlock()
 		return
 	}
 
@@ -776,15 +693,6 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	}
 
 	conn.escalateWGTimeoutLocked()
-	pq := conn.config.PQ
-	key := conn.config.Key
-	conn.mu.Unlock()
-
-	// Signal the PQ manager outside conn.mu: it may re-enter Conn (reoffer) under
-	// conn.mu, so calling it while holding the lock would invert the lock order.
-	if pq != nil {
-		pq.OnDataPathDown(key)
-	}
 }
 
 // escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
@@ -808,14 +716,14 @@ func (conn *Conn) escalateWGTimeoutLocked() {
 	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
-func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, pqEstablished bool, updateTime time.Time) {
+func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
 	peerState := State{
 		PubKey:             conn.config.Key,
 		ConnStatusUpdate:   updateTime,
 		ConnStatus:         conn.evalStatus(),
 		Relayed:            conn.isRelayed(),
 		RelayServerAddress: relayServerAddr,
-		RosenpassEnabled:   conn.quantumResistant(rosenpassPubKey, pqEstablished),
+		RosenpassEnabled:   isRosenpassEnabled(rosenpassPubKey),
 	}
 
 	err := conn.statusRecorder.UpdatePeerRelayedState(peerState)
@@ -824,7 +732,7 @@ func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []by
 	}
 }
 
-func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, pqEstablished bool, updateTime time.Time) {
+func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, updateTime time.Time) {
 	peerState := State{
 		PubKey:                     conn.config.Key,
 		ConnStatusUpdate:           updateTime,
@@ -834,7 +742,7 @@ func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, pqEstablished bool, up
 		RemoteIceCandidateType:     iceConnInfo.RemoteIceCandidateType,
 		LocalIceCandidateEndpoint:  iceConnInfo.LocalIceCandidateEndpoint,
 		RemoteIceCandidateEndpoint: iceConnInfo.RemoteIceCandidateEndpoint,
-		RosenpassEnabled:           conn.quantumResistant(iceConnInfo.RosenpassPubKey, pqEstablished),
+		RosenpassEnabled:           isRosenpassEnabled(iceConnInfo.RosenpassPubKey),
 	}
 
 	err := conn.statusRecorder.UpdatePeerICEState(peerState)
@@ -1038,35 +946,6 @@ func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
 	conn.mu.Unlock()
-
-	// A fresh WireGuard handshake clocks the post-quantum PSK rotation. Pass how long
-	// ago the peer last exchanged real user data (keepalives excluded) so the pqkem
-	// manager can skip rotation on idle tunnels — rotating then would push data-path
-	// traffic that keeps the lazy connection artificially active.
-	if conn.config.PQ != nil {
-		conn.config.PQ.OnDataPathRekeyed(conn.config.Key, conn.dataActivityAge())
-	}
-}
-
-// dataActivityAge returns how long ago the peer last exchanged real user data
-// (WireGuard keepalives excluded), per the same LastActivities signal the
-// lazy-connection inactivity monitor uses. It reports a very large duration when no
-// activity has ever been recorded, so the peer is treated as idle.
-//
-// In kernel mode there is no per-peer data-activity signal (LastActivities is
-// userspace-only), so we cannot tell active from idle. We report zero — always
-// "active" — so PSK rotation is not disabled in kernel mode. Lazy back-to-idle is
-// already limited there; the eBPF WG-activity detection (future) will supply a real
-// signal that excludes handshake/pqkem traffic.
-func (conn *Conn) dataActivityAge() time.Duration {
-	if !conn.config.WgConfig.WgInterface.IsUserspaceBind() {
-		return 0
-	}
-	last, ok := conn.config.WgConfig.WgInterface.LastActivities()[conn.config.WgConfig.RemoteKey]
-	if !ok {
-		return time.Duration(math.MaxInt64)
-	}
-	return monotime.Since(last)
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics
@@ -1107,42 +986,7 @@ func (conn *Conn) AgentVersionString() string {
 	return conn.config.AgentVersion
 }
 
-// pqPSK returns the post-quantum PSK derived for this peer, if the ML-KEM exchange has
-// produced one. It reads the manager WITHOUT conn.mu, so callers fetch it before taking
-// conn.mu: the lock order is always conn.mu -> manager, never the reverse (the manager's
-// reoffer callback re-enters Conn under conn.mu).
-func (conn *Conn) pqPSK() (*wgtypes.Key, bool) {
-	if conn.config.PQ == nil {
-		return nil, false
-	}
-	psk, ok := conn.config.PQ.PSK(conn.config.Key)
-	if !ok {
-		return nil, false
-	}
-	return &psk, true
-}
-
-// presharedKey resolves the WireGuard preshared key for the peer. pqPSK is the
-// post-quantum PSK looked up out of band via pqPSK (nil when none is derived yet), passed
-// in so the manager lock is never taken under conn.mu.
-func (conn *Conn) presharedKey(remoteRosenpassKey []byte, pqPSK *wgtypes.Key) *wgtypes.Key {
-	// Post-quantum: once the ML-KEM exchange has derived a PSK for this peer, program
-	// it here so the peer's next WireGuard handshake adopts it. Applied at peer-config
-	// time (bootstrap / reconnect); steady-state rotation is pushed separately.
-	if conn.config.PQ != nil {
-		if pqPSK != nil {
-			return pqPSK
-		}
-		if conn.config.PQStrict && conn.pqStrictSentinelKey != nil {
-			// Fail closed: program a non-matching sentinel so no session forms on a
-			// non-PQ key until the ML-KEM exchange derives the real PSK (pushed via
-			// SetPresharedKey once it converges). "pending" — turns into a "stuck"
-			// warning from the manager if the exchange keeps failing (see raiseFailure).
-			conn.Log.Debugf("pqkem: strict mode — no PQ PSK yet, blocking peer traffic until the ML-KEM exchange converges")
-			return conn.pqStrictSentinelKey
-		}
-	}
-
+func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
 	if conn.config.RosenpassConfig.PubKey == nil {
 		return conn.config.WgConfig.PreSharedKey
 	}
@@ -1182,13 +1026,6 @@ func isRosenpassEnabled(remoteRosenpassPubKey []byte) bool {
 	return remoteRosenpassPubKey != nil
 }
 
-// quantumResistant reports whether the peer's tunnel is post-quantum protected, for
-// the status "Quantum resistance" field: either Rosenpass (the remote advertised a
-// Rosenpass key) or the ML-KEM exchange (a PQ PSK has been derived for this peer).
-func (conn *Conn) quantumResistant(remoteRosenpassPubKey []byte, pqEstablished bool) bool {
-	return isRosenpassEnabled(remoteRosenpassPubKey) || pqEstablished
-}
-
 func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 	// "Relay up and needed" — the peer uses relay and the transport is connected.
 	relayUsedAndUp := in.peerUsesRelay && in.relayConnected

client/internal/peer/conn_pq_test.go

@@ -1,90 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// fakePQ is a minimal PQHandshaker: only PSK is exercised by presharedKey, the rest
-// are no-op stubs to satisfy the interface.
-type fakePQ struct {
-	psk wgtypes.Key
-	ok  bool
-}
-
-func (f fakePQ) OfferPayload(string) ([]byte, uint16)          { return nil, 0 }
-func (f fakePQ) ShouldSendBootstrapOffer(string) bool          { return false }
-func (f fakePQ) AnswerPayload(string, []byte) ([]byte, uint16) { return nil, 0 }
-func (f fakePQ) OnAnswer(string, []byte)                       {}
-func (f fakePQ) PSK(string) (wgtypes.Key, bool)                { return f.psk, f.ok }
-func (f fakePQ) SetRemoteAddr(string, netip.AddrPort)          {}
-func (f fakePQ) OnDataPathRekeyed(string, time.Duration)       {}
-func (f fakePQ) OnDataPathDown(string)                         {}
-
-// TestConn_presharedKey_PQ covers the post-quantum branch of presharedKey across the
-// three states that matter: a derived PSK is programmed, and — before one exists —
-// strict mode blocks with a sentinel while non-strict falls open to the ordinary key.
-func TestConn_presharedKey_PQ(t *testing.T) {
-	derivedPSK, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-	nbPSK, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-
-	newConn := func() *Conn {
-		return &Conn{
-			Log: log.WithField("peer", "pq-test"),
-			config: ConnConfig{
-				Key:             "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-				LocalKey:        "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-				WgConfig:        WgConfig{PreSharedKey: &nbPSK},
-				RosenpassConfig: RosenpassConfig{},
-			},
-		}
-	}
-
-	t.Run("derived PSK is programmed", func(t *testing.T) {
-		for _, strict := range []bool{false, true} {
-			c := newConn()
-			c.config.PQ = fakePQ{psk: derivedPSK, ok: true}
-			c.config.PQStrict = strict
-			if strict {
-				sentinel, err := wgtypes.GenerateKey()
-				require.NoError(t, err)
-				c.pqStrictSentinelKey = &sentinel
-			}
-			pqPSK, _ := c.pqPSK()
-			got := c.presharedKey(nil, pqPSK)
-			require.NotNil(t, got)
-			require.Equal(t, derivedPSK, *got, "the derived PQ PSK must win (strict=%v)", strict)
-		}
-	})
-
-	t.Run("non-strict falls open to the ordinary key before a PSK exists", func(t *testing.T) {
-		c := newConn()
-		c.config.PQ = fakePQ{ok: false}
-		c.config.PQStrict = false
-		pqPSK, _ := c.pqPSK()
-		got := c.presharedKey(nil, pqPSK)
-		require.NotNil(t, got, "non-strict must not block")
-		require.Equal(t, nbPSK, *got, "non-strict falls through to the NetBird PSK, not a sentinel")
-	})
-
-	t.Run("strict blocks with the per-conn sentinel before a PSK exists", func(t *testing.T) {
-		sentinel, err := wgtypes.GenerateKey()
-		require.NoError(t, err)
-		c := newConn()
-		c.config.PQ = fakePQ{ok: false}
-		c.config.PQStrict = true
-		c.pqStrictSentinelKey = &sentinel
-		pqPSK, _ := c.pqPSK()
-		got := c.presharedKey(nil, pqPSK)
-		require.NotNil(t, got)
-		require.Equal(t, sentinel, *got, "strict must return the blocking sentinel")
-		require.NotEqual(t, nbPSK, *got, "the sentinel must not be the ordinary key")
-	})
-}

client/internal/peer/conn_test.go

@@ -255,8 +255,8 @@ func TestConn_presharedKey(t *testing.T) {
 			}
 			conn2.config.RosenpassConfig.PermissiveMode = test.conn2Permissive
 
-			conn1PresharedKey := conn1.presharedKey(conn2.config.RosenpassConfig.PubKey, nil)
-			conn2PresharedKey := conn2.presharedKey(conn1.config.RosenpassConfig.PubKey, nil)
+			conn1PresharedKey := conn1.presharedKey(conn2.config.RosenpassConfig.PubKey)
+			conn2PresharedKey := conn2.presharedKey(conn1.config.RosenpassConfig.PubKey)
 
 			if test.conn1ExpectedInitialKey {
 				if conn1PresharedKey == nil {
@@ -294,14 +294,14 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 	// When Rosenpass has already initialized the PSK for this peer,
 	// presharedKey must return nil to avoid UpdatePeer overwriting it.
 	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return true }
-	if k := conn.presharedKey([]byte("remote"), nil); k != nil {
+	if k := conn.presharedKey([]byte("remote")); k != nil {
 		t.Fatalf("expected nil presharedKey when Rosenpass manages PSK, got %v", k)
 	}
 
 	// When Rosenpass hasn't taken over yet, presharedKey should provide
 	// a non-nil initial key (deterministic or from NetBird PSK).
 	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return false }
-	if k := conn.presharedKey([]byte("remote"), nil); k == nil {
+	if k := conn.presharedKey([]byte("remote")); k == nil {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }

client/internal/peer/endpoint.go

@@ -88,7 +88,7 @@ func (e *EndpointUpdater) configureAsResponder(addr *net.UDPAddr, presharedKey *
 	var ctx context.Context
 	ctx, e.cancelFunc = context.WithCancel(context.Background())
 	e.updateWg.Add(1)
-	go e.scheduleDelayedUpdate(ctx, addr)
+	go e.scheduleDelayedUpdate(ctx, addr, presharedKey)
 
 	if err := e.updateWireGuardPeer(nil, presharedKey); err != nil {
 		e.waitForCloseTheDelayedUpdate()
@@ -107,14 +107,8 @@ func (e *EndpointUpdater) waitForCloseTheDelayedUpdate() {
 	e.updateWg.Wait()
 }
 
-// scheduleDelayedUpdate waits for the fallback period, then sets the responder's real
-// endpoint. It deliberately passes a nil preshared key so it only updates the endpoint
-// and leaves the current PSK untouched: the PSK captured when this was scheduled may be
-// stale by now (e.g. the post-quantum bootstrap derived a fresher PSK within the
-// fallback window, applied via SetPresharedKey), and re-applying the captured one would
-// revert WireGuard to a key the remote peer no longer uses — a mismatch that stalls the
-// handshake until the next retry.
-func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.UDPAddr) {
+// scheduleDelayedUpdate waits for the fallback period before updating the endpoint
+func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.UDPAddr, presharedKey *wgtypes.Key) {
 	defer e.updateWg.Done()
 	t := time.NewTimer(fallbackDelay)
 	defer t.Stop()
@@ -123,7 +117,7 @@ func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.U
 	case <-ctx.Done():
 		return
 	case <-t.C:
-		if err := e.updateWireGuardPeer(addr, nil); err != nil {
+		if err := e.updateWireGuardPeer(addr, presharedKey); err != nil {
 			e.log.Errorf("failed to update WireGuard peer, address: %s, error: %v", addr, err)
 		}
 	}

client/internal/peer/handshaker.go

@@ -39,16 +39,6 @@ type OfferAnswer struct {
 	// This value is the local Rosenpass server address when sending the message
 	RosenpassAddr string
 
-	// MlkemPayload carries the post-quantum X25519MLKEM768 handshake message
-	// (pqkem-framed offer on an OFFER, answer on an ANSWER) that seeds the
-	// WireGuard PSK. Opaque here — the pqkem library frames and parses it. Nil
-	// when the peer does not run the ML-KEM PQ exchange.
-	MlkemPayload []byte
-
-	// MlkemPort is the peer's ML-KEM PQ service UDP port (bound on its WG overlay
-	// IP) where data-path rekey messages are sent. Zero when not running the exchange.
-	MlkemPort uint16
-
 	// relay server address
 	RelaySrvAddress string
 	// RelaySrvIP is the IP the remote peer is connected to on its
@@ -91,20 +81,14 @@ type Handshaker struct {
 
 func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
 	h := &Handshaker{
-		log:           log,
-		config:        config,
-		signaler:      signaler,
-		ice:           ice,
-		relay:         relay,
-		metricsStages: metricsStages,
-		// Buffered by 1: the single Listen goroutine can be busy handling an offer
-		// (sendAnswer does a blocking signal send) exactly when the matching answer
-		// arrives on the other channel. Unbuffered, that answer would hit the
-		// non-blocking send's default and be dropped — fatal for the post-quantum
-		// exchange, which needs the answer to converge. A 1-slot cushion lets it wait
-		// until Listen loops back, without ever blocking the signal receiver.
-		remoteOffersCh: make(chan OfferAnswer, 1),
-		remoteAnswerCh: make(chan OfferAnswer, 1),
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
 	}
 	// assume remote supports ICE until we learn otherwise from received offers
 	h.remoteICESupported.Store(ice != nil)
@@ -127,9 +111,44 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	for {
 		select {
 		case remoteOfferAnswer := <-h.remoteOffersCh:
-			h.handleRemoteOffer(remoteOfferAnswer)
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+
+			if err := h.sendAnswer(); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
 		case remoteOfferAnswer := <-h.remoteAnswerCh:
-			h.handleRemoteAnswer(remoteOfferAnswer)
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
 		case <-ctx.Done():
 			h.log.Infof("stop listening for remote offers and answers")
 			return
@@ -137,119 +156,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	}
 }
 
-// onSignalReceived runs the common preamble for a received offer/answer: record the
-// signalling metric, refresh the remote ICE state, and register the peer's post-quantum
-// data-path endpoint learned from the message.
-func (h *Handshaker) onSignalReceived(remoteOfferAnswer *OfferAnswer) {
-	if h.metricsStages != nil {
-		h.metricsStages.RecordSignalingReceived()
-	}
-	h.updateRemoteICEState(remoteOfferAnswer)
-	h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
-}
-
-// notifyListeners hands the offer/answer to the relay and ICE workers so they bring the
-// connection up.
-func (h *Handshaker) notifyListeners(remoteOfferAnswer *OfferAnswer) {
-	if h.relayListener != nil {
-		h.relayListener.Notify(remoteOfferAnswer)
-	}
-	if h.iceListener != nil && h.RemoteICESupported() {
-		h.iceListener(remoteOfferAnswer)
-	}
-}
-
-func (h *Handshaker) handleRemoteOffer(remoteOfferAnswer OfferAnswer) {
-	h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
-	h.onSignalReceived(&remoteOfferAnswer)
-
-	// If we are the controller running the KEM, a responder's offer is handled by
-	// replying with our own KEM offer, not by answering it (see pqControllerReoffer).
-	if h.pqControllerReoffer() {
-		return
-	}
-
-	// Derive+store the KEM PSK (inside sendAnswer's AnswerPayload) BEFORE bringing up the
-	// connection: the relay/ICE workers configure the WG endpoint, which pulls the PSK
-	// for the first handshake. Notifying them first would race the KEM exchange and hand
-	// the first handshake a not-yet-derived key.
-	if err := h.sendAnswer(&remoteOfferAnswer); err != nil {
-		h.log.Errorf("failed to send remote offer confirmation: %s", err)
-		return
-	}
-	h.notifyListeners(&remoteOfferAnswer)
-}
-
-func (h *Handshaker) handleRemoteAnswer(remoteOfferAnswer OfferAnswer) {
-	h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
-	h.onSignalReceived(&remoteOfferAnswer)
-
-	// Feed the KEM answer (derive+store PSK) BEFORE bringing up the connection so the WG
-	// endpoint config pulls the real PSK for the first handshake instead of racing ahead
-	// of the KEM exchange.
-	if h.config.PQ != nil {
-		h.config.PQ.OnAnswer(h.config.Key, remoteOfferAnswer.MlkemPayload)
-	}
-	h.notifyListeners(&remoteOfferAnswer)
-}
-
-// pqControllerReoffer handles a responder's offer when we are the controller running the
-// KEM. The KEM material rides only the controller's offer, so the two peers derive a
-// single shared PSK (a bidirectional KEM would yield two different PSKs and WireGuard
-// would pick misaligned ones). Rather than answer the responder's (KEM-less) offer —
-// which would bring WireGuard up on a pre-PQ key before the KEM completes — we reply with
-// our own KEM offer, so the only transaction that establishes the tunnel is the one that
-// also derives the PSK. It also guarantees a responder-initiated wake still triggers a
-// KEM offer (no stuck responder). Sent exactly once per exchange; further offers while
-// one is in flight are ignored (re-sending on every responder offer would be a runaway).
-// The re-offer reuses our stable ICE session id, so the peer dedups repeats.
-//
-// Returns true when it took ownership of the offer (the caller must not answer it).
-func (h *Handshaker) pqControllerReoffer() bool {
-	if h.config.PQ == nil || !isController(h.config) {
-		return false
-	}
-	if h.config.PQ.ShouldSendBootstrapOffer(h.config.Key) {
-		h.log.Debugf("pqkem: controller received a responder offer, replying with our KEM offer instead of an answer")
-		if err := h.sendOffer(); err != nil {
-			h.log.Errorf("failed to send KEM offer in response to peer offer: %s", err)
-		}
-	} else {
-		h.log.Debugf("pqkem: controller received a responder offer but a KEM exchange is already in flight, ignoring")
-	}
-	return true
-}
-
-// pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
-// (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
-func (h *Handshaker) pqRegisterEndpoint(remotePort uint16) {
-	if h.config.PQ == nil {
-		return
-	}
-	overlay, ok := h.pqPeerOverlayAddr()
-	if !ok {
-		return
-	}
-	// remotePort may be 0 (the peer omitted it, meaning the default port); the adapter
-	// resolves 0 to DefaultPort.
-	h.config.PQ.SetRemoteAddr(h.config.Key, netip.AddrPortFrom(overlay, remotePort))
-}
-
-// pqPeerOverlayAddr returns the peer's IPv4 overlay address for the pq data path. A
-// RemotePeerConfig carries only the peer overlay (v4 /32, optionally v6 /128) — served
-// routes are programmed on WireGuard separately and never land in WgConfig.AllowedIps —
-// so AllowedIps[0] is the v4 overlay, matching conn.AllowedIP(). The transport is v4
-// (the overlay always has v4; v6 is additive). Returns false when no v4 overlay exists.
-func (h *Handshaker) pqPeerOverlayAddr() (netip.Addr, bool) {
-	if len(h.config.WgConfig.AllowedIps) == 0 {
-		return netip.Addr{}, false
-	}
-	if a := h.config.WgConfig.AllowedIps[0].Addr().Unmap(); a.Is4() {
-		return a, true
-	}
-	return netip.Addr{}, false
-}
-
 func (h *Handshaker) SendOffer() error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -289,23 +195,13 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		offer.MlkemPayload, offer.MlkemPort = h.config.PQ.OfferPayload(h.config.Key)
-	}
 	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
-func (h *Handshaker) sendAnswer(remoteOffer *OfferAnswer) error {
+func (h *Handshaker) sendAnswer() error {
 	answer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		var recvOffer []byte
-		if remoteOffer != nil {
-			recvOffer = remoteOffer.MlkemPayload
-		}
-		answer.MlkemPayload, answer.MlkemPort = h.config.PQ.AnswerPayload(h.config.Key, recvOffer)
-	}
 	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)

client/internal/peer/iface.go

@@ -10,7 +10,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
-	"github.com/netbirdio/netbird/monotime"
 )
 
 type WGIface interface {
@@ -20,11 +19,4 @@ type WGIface interface {
 	GetProxy() wgproxy.Proxy
 	Address() wgaddr.Address
 	RemoveEndpointAddress(key string) error
-	// LastActivities returns the last real-data activity time per peer (WireGuard
-	// keepalives excluded), used to gate post-quantum PSK rotation on active tunnels.
-	LastActivities() map[string]monotime.Time
-	// IsUserspaceBind reports whether WireGuard runs in userspace. Only there does
-	// LastActivities track per-peer data activity; in kernel mode it is unavailable,
-	// so PSK rotation cannot be gated on activity.
-	IsUserspaceBind() bool
 }

client/internal/peer/signaler.go

@@ -63,8 +63,6 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 		},
 		RosenpassPubKey: offerAnswer.RosenpassPubKey,
 		RosenpassAddr:   offerAnswer.RosenpassAddr,
-		MlkemPayload:    offerAnswer.MlkemPayload,
-		MlkemPort:       int(offerAnswer.MlkemPort),
 		RelaySrvAddress: offerAnswer.RelaySrvAddress,
 		RelaySrvIP:      offerAnswer.RelaySrvIP,
 		SessionID:       sessionIDBytes,

client/internal/pqkem/bench_test.go

@@ -1,71 +0,0 @@
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/mlkem"
-	"crypto/rand"
-	"testing"
-)
-
-func BenchmarkX25519Keygen(b *testing.B) {
-	c := ecdh.X25519()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := c.GenerateKey(rand.Reader); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkX25519ECDH(b *testing.B) {
-	c := ecdh.X25519()
-	a, err := c.GenerateKey(rand.Reader)
-	if err != nil {
-		b.Fatal(err)
-	}
-	p, err := c.GenerateKey(rand.Reader)
-	if err != nil {
-		b.Fatal(err)
-	}
-	pub := p.PublicKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := a.ECDH(pub); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMKeygen(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		if _, err := mlkem.GenerateKey768(); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMEncaps(b *testing.B) {
-	dk, err := mlkem.GenerateKey768()
-	if err != nil {
-		b.Fatal(err)
-	}
-	ek := dk.EncapsulationKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ek.Encapsulate()
-	}
-}
-
-func BenchmarkMLKEMDecaps(b *testing.B) {
-	dk, err := mlkem.GenerateKey768()
-	if err != nil {
-		b.Fatal(err)
-	}
-	_, ct := dk.EncapsulationKey().Encapsulate()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := dk.Decapsulate(ct); err != nil {
-			b.Fatal(err)
-		}
-	}
-}

client/internal/pqkem/callbacks.go

@@ -1,18 +0,0 @@
-package pqkem
-
-// CallbackHandler is implemented by the host and invoked by the library. The
-// library only reports events; the host owns the reaction. Keeping this an
-// interface — rather than touching the transport or keying directly — is what lets
-// the KEM code be extracted as a standalone library.
-type CallbackHandler interface {
-	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a peer
-	// and must be programmed into the consumer's secure channel. It is invoked at
-	// the commit point of each side: the initiator on receiving the answer, the
-	// responder on receiving the confirm.
-	OnNewPSKReady(remoteID RemoteID, psk PSK) error
-
-	// OnRekeyFailed fires when an exchange fails to converge within the allotted
-	// time. The host should tear the peer connection down so it re-establishes, and
-	// log a WARN. The library reports the event; it does not dictate the reaction.
-	OnRekeyFailed(remoteID RemoteID) error
-}

client/internal/pqkem/capability_test.go

@@ -1,66 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestManager_NonCapablePeerNotOffered: a peer known not to run the KEM (it advertised
-// no PQ port over signalling) is never offered an exchange, and no failure is raised —
-// this is what stops the reoffer storm against non-PQ peers (e.g. Rosenpass peers).
-func TestManager_NonCapablePeerNotOffered(t *testing.T) {
-	wg := newFakeWG()
-	d := NewManager("bbbb", wg, nil) // initiator vs "aaaa"
-	d.Start(&loopback{ep: epB, sw: newSwitch()})
-	defer d.Stop()
-
-	d.MarkNonCapable("aaaa")
-
-	offer, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	assert.Nil(t, offer, "a non-capable peer must not be offered a KEM exchange")
-	assert.Empty(t, wg.failed, "a non-capable peer must not raise a rekey failure")
-}
-
-// TestManager_MarkNonCapableCancelsInFlight: if we start an exchange with a peer whose
-// capability is not yet known and then learn it does not run the KEM, the in-flight
-// exchange is cancelled and no further offer is produced (no timeout -> no failure).
-func TestManager_MarkNonCapableCancelsInFlight(t *testing.T) {
-	wg := newFakeWG()
-	d := NewManager("bbbb", wg, nil)
-	d.Start(&loopback{ep: epB, sw: newSwitch()})
-	defer d.Stop()
-
-	// Capability unknown -> the bootstrap offer goes out optimistically.
-	offer, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-
-	// Now we learn the peer is non-PQ: the exchange must be dropped.
-	d.MarkNonCapable("aaaa")
-
-	next, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	assert.Nil(t, next, "after learning non-capability the peer is no longer offered")
-	assert.Empty(t, wg.failed, "cancelling an in-flight exchange must not raise a failure")
-}
-
-// TestManager_EstablishedPeerNotDowngraded: a stray zero-port observation must not tear
-// down a peer we already have a working PQ session with.
-func TestManager_EstablishedPeerNotDowngraded(t *testing.T) {
-	dA, dB, _, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	require.NotEqual(t, PSK{}, wgB.psk("aaaa"), "established a PSK")
-
-	dB.MarkNonCapable("aaaa") // stray zero after establishment
-
-	// The peer keeps its derived PSK (MarkNonCapable is a no-op once established).
-	psk, ok := dB.PSK("aaaa")
-	assert.True(t, ok, "an established peer must keep its PSK despite a stray zero")
-	assert.NotEqual(t, PSK{}, psk)
-}

client/internal/pqkem/concurrency_test.go

@@ -1,77 +0,0 @@
-package pqkem
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestConcurrency_RecoversViaResignalAfterDataPathBreak exercises the A-light recovery:
-// a data-path rotation can no longer converge (OnRekeyFailed), and re-bootstrapping over
-// signalling resyncs both peers on a fresh PSK — even while the data path stays broken,
-// since the signal channel is independent of it.
-func TestConcurrency_RecoversViaResignalAfterDataPathBreak(t *testing.T) {
-	dA, dB, wgA, wgB, lbB := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	// Tighten B's timings and make a single rotation miss raise OnRekeyFailed. Set
-	// before any exchange loop spawns (the loop reads these fields).
-	dB.retryInterval = 5 * time.Millisecond
-	dB.maxRetries = 2
-	dB.maxRekeyFailures = 1
-
-	bootstrap(t, dA, dB)
-	dA.OnDataPathRekeyed("bbbb", 0)
-	dB.OnDataPathRekeyed("aaaa", 0)
-	psk1 := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, psk1)
-	require.Equal(t, psk1, wgA.psk("bbbb"), "converged on the same PSK after bootstrap+rotation")
-
-	// Data path breaks: the rotation can no longer converge -> OnRekeyFailed.
-	lbB.drop.Store(true)
-	_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
-	require.NoError(t, err)
-	require.Eventually(t, func() bool { return failedCount(wgB) >= 1 }, time.Second, 5*time.Millisecond)
-
-	// Recovery: re-bootstrap over signalling with the data path STILL broken. It must
-	// still converge (signal is independent of the data path) on a fresh PSK.
-	bootstrap(t, dA, dB)
-	psk2 := wgB.psk("aaaa")
-	require.NotEqual(t, psk1, psk2, "recovery derived a fresh PSK")
-	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides resync after recovery")
-}
-
-// TestConcurrency_ConcurrentRekeysNoRace hammers both managers with concurrent rotation
-// clocks from many goroutines. Its primary job (with -race) is to prove the single-lock
-// state machine has no data races or deadlocks under contention; a final deterministic
-// bootstrap then asserts there is no split-brain (both sides on the same PSK).
-func TestConcurrency_ConcurrentRekeysNoRace(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-
-	var wg sync.WaitGroup
-	for g := 0; g < 8; g++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for i := 0; i < 50; i++ {
-				dB.OnDataPathRekeyed("aaaa", 0) // initiator chains a rotation
-				dA.OnDataPathRekeyed("bbbb", 0) // responder side is a no-op, still stresses the lock
-			}
-		}()
-	}
-	wg.Wait()
-
-	// The storm may leave an exchange mid-flight (concurrent cancellation). Force a
-	// clean convergence over signalling, then assert no split-brain.
-	bootstrap(t, dA, dB)
-	a, b := wgA.psk("bbbb"), wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, b)
-	require.Equal(t, a, b, "both sides converge on the same PSK, no split-brain")
-}

client/internal/pqkem/convergence.go

@@ -1,291 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"time"
-)
-
-// idHex renders an exchange ID for logs.
-func idHex(id ExchangeID) string { return hex.EncodeToString(id[:]) }
-
-// pskFingerprint is a short, non-secret digest of a derived PSK: identical on both
-// peers iff they derived the same key. Logged instead of the raw PSK so debug logs
-// never carry the actual WireGuard preshared key.
-func pskFingerprint(psk PSK) string {
-	sum := sha256.Sum256(psk[:])
-	return hex.EncodeToString(sum[:8])
-}
-
-// startExchange creates a fresh initiator exchange (acknowledging ackID, zero for a
-// bootstrap) and returns the framed offer for the caller to send — pushed over the
-// data path for a chained rekey, or handed to the host for signalling when viaSignal
-// is set. Any previous in-flight exchange for the peer is cancelled.
-// startExchangeLocked must be called with m.mu held: the caller's idempotency check and
-// the exchange install stay under one lock acquisition so two concurrent starts for the
-// same peer cannot both create an exchange. It also refuses to start (and to Add to the
-// wait group) once the manager is stopping, so it never races Manager.Stop's Wait.
-func (m *Manager) startExchangeLocked(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
-	if m.rootCtx.Err() != nil {
-		return nil, fmt.Errorf("manager stopping")
-	}
-	init, err := NewInitiator()
-	if err != nil {
-		return nil, err
-	}
-	id, err := newExchangeID()
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&OfferMsg{ExchangeID: id, AckID: ackID, KEMOffer: init.Offer()}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithCancel(m.rootCtx)
-	if old := m.exchanges[remoteID]; old != nil && old.cancel != nil {
-		old.cancel()
-	}
-	m.exchanges[remoteID] = &exchangeCtl{
-		id:        id,
-		state:     stateAwaitingAnswer,
-		startedAt: time.Now(),
-		cancel:    cancel,
-		lastSent:  raw,
-		initiator: init,
-		viaSignal: viaSignal,
-	}
-
-	m.wait.Add(1)
-	go m.initiatorLoop(ctx, remoteID, id)
-
-	via := "data-path"
-	if viaSignal {
-		via = "signal"
-	}
-	m.trace("pqkem: offer sent", "peer", remoteID, "exchange", idHex(id), "acks", idHex(ackID), "via", via)
-	return raw, nil
-}
-
-// processOffer (responder) first acknowledges the previous exchange the offer names
-// (that offer riding the data path under the freshly adopted key proves it worked),
-// then derives the PSK for the new offer, commits it optimistically, and returns the
-// framed answer. A duplicate offer returns the cached answer without re-deriving.
-func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg) ([]byte, error) {
-	m.trace("pqkem: offer received", "peer", remoteID, "exchange", idHex(o.ExchangeID), "acks", idHex(o.AckID))
-
-	if o.AckID != (ExchangeID{}) {
-		m.ackConverged(remoteID, o.AckID)
-	}
-
-	m.mu.Lock()
-	if ex := m.exchanges[remoteID]; ex != nil && ex.id == o.ExchangeID {
-		state, last := ex.state, ex.lastSent
-		m.mu.Unlock()
-		if state == stateReserved {
-			return nil, nil
-		}
-		m.trace("pqkem: duplicate offer, resending cached answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-		return last, nil
-	}
-	// Reserve the slot so a concurrent duplicate offer bails.
-	m.exchanges[remoteID] = &exchangeCtl{id: o.ExchangeID, state: stateReserved, startedAt: time.Now()}
-	m.mu.Unlock()
-
-	answerBytes, psk, err := Respond(o.KEMOffer, m.binding(remoteID))
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&AnswerMsg{ExchangeID: o.ExchangeID, KEMAnswer: answerBytes}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != o.ExchangeID {
-		m.mu.Unlock()
-		m.trace("pqkem: exchange superseded during respond, dropping answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-		return nil, nil
-	}
-	ex.state = stateAwaitingAck
-	ex.lastSent = raw
-	ex.pendingPSK = psk
-	m.psks[remoteID] = psk
-	m.capable[remoteID] = true // a real KEM offer proves the peer runs the exchange
-	m.mu.Unlock()
-
-	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(o.ExchangeID), "role", "responder", "psk_fp", pskFingerprint(psk))
-
-	// Commit optimistically so our data path can rekey to the new PSK.
-	if err := m.cbHandler.OnNewPSKReady(remoteID, psk); err != nil {
-		return nil, err
-	}
-	m.trace("pqkem: answer sent", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-	return raw, nil
-}
-
-// processAnswer (initiator) derives and commits the PSK and parks in
-// stateAwaitingRekey; the next offer (chained from OnDataPathRekeyed) will acknowledge
-// this exchange. Only valid in stateAwaitingAnswer; advancing the state under the
-// lock makes a concurrent/duplicate answer bail.
-func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg) error {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != a.ExchangeID || ex.state != stateAwaitingAnswer {
-		haveID := "none"
-		if ex != nil {
-			haveID = idHex(ex.id)
-		}
-		m.mu.Unlock()
-		m.trace("pqkem: unexpected answer dropped (inconsistency)", "peer", remoteID, "answer_for", idHex(a.ExchangeID), "have_exchange", haveID)
-		return nil
-	}
-	ex.state = stateAwaitingRekey
-	init := ex.initiator
-	ex.initiator = nil
-	m.mu.Unlock()
-
-	m.trace("pqkem: answer received", "peer", remoteID, "exchange", idHex(a.ExchangeID))
-
-	psk, err := init.Finish(a.KEMAnswer, m.binding(remoteID))
-	if err != nil {
-		// The state already advanced to stateAwaitingRekey and the initiator was cleared,
-		// so initiatorLoop would exit its default branch without registering a failure —
-		// leaving the peer desynced (the responder committed its PSK in processOffer).
-		// Drop the exchange and raise the failure so recovery re-bootstraps.
-		m.mu.Lock()
-		if cur := m.exchanges[remoteID]; cur != nil && cur.id == a.ExchangeID {
-			delete(m.exchanges, remoteID)
-		}
-		initial := !m.established[remoteID]
-		fail := m.registerFailureLocked(remoteID)
-		m.mu.Unlock()
-		m.raiseFailure(remoteID, fail, initial)
-		return err
-	}
-
-	// The initiator has converged: the responder must have derived the key to answer.
-	m.mu.Lock()
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	m.psks[remoteID] = psk
-	m.capable[remoteID] = true // a real KEM answer proves the peer runs the exchange
-	m.mu.Unlock()
-
-	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(a.ExchangeID), "role", "initiator", "psk_fp", pskFingerprint(psk))
-
-	return m.cbHandler.OnNewPSKReady(remoteID, psk)
-}
-
-// ackConverged (responder) records convergence of the exchange named by ackID: a
-// later offer acknowledging it proves both sides operate on that exchange's key. Only
-// acts on a matching stateAwaitingAck exchange; anything else is ignored.
-func (m *Manager) ackConverged(remoteID RemoteID, ackID ExchangeID) {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != ackID || ex.state != stateAwaitingAck {
-		m.mu.Unlock()
-		m.trace("pqkem: ack for unknown/mismatched exchange, ignored (inconsistency)", "peer", remoteID, "acks", idHex(ackID))
-		return
-	}
-	delete(m.exchanges, remoteID)
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	_ = time.Since(ex.startedAt) // convergence latency (metrics hook, later step)
-	m.mu.Unlock()
-
-	m.trace("pqkem: previous exchange confirmed by ack", "peer", remoteID, "exchange", idHex(ackID))
-}
-
-// initiatorLoop enforces the offer->answer convergence deadline and retransmits the
-// initiator's outstanding data-path offer while awaiting the answer (a
-// signalling-bootstrapped offer is retransmitted by the host, so it is not resent
-// here). Exhausting the deadline before the answer arrives is a failure. Once the
-// answer is in (state past awaitingAnswer) the loop exits: the next rotation is driven
-// by OnDataPathRekeyed, and the idle wait for it has no deadline.
-func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id ExchangeID) {
-	defer m.wait.Done()
-	t := time.NewTicker(m.retryInterval)
-	defer t.Stop()
-
-	attempts := 0
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			m.mu.Lock()
-			ex := m.exchanges[remoteID]
-			if ex == nil || ex.id != id {
-				m.mu.Unlock()
-				return
-			}
-
-			switch ex.state {
-			case stateAwaitingAnswer:
-				if attempts >= m.maxRetries {
-					delete(m.exchanges, remoteID)
-					initial := !m.established[remoteID]
-					fail := m.registerFailureLocked(remoteID)
-					m.mu.Unlock()
-					m.raiseFailure(remoteID, fail, initial)
-					return
-				}
-				viaSignal := ex.viaSignal
-				msg := ex.lastSent
-				attempts++
-				m.mu.Unlock()
-				if !viaSignal {
-					if err := m.pushDataPath(remoteID, msg); err != nil {
-						m.logger.Warn("pqkem: offer retransmit failed", "peer", remoteID, "err", err)
-					}
-				}
-
-			default:
-				// Past awaiting the answer (converged) or superseded: the loop's job
-				// is done. The next rotation is driven externally by OnDataPathRekeyed,
-				// so there is no deadline while idle-waiting for it (that wait can be
-				// as long as the transport's natural rekey interval).
-				m.mu.Unlock()
-				return
-			}
-		}
-	}
-}
-
-// registerFailureLocked applies policy B and reports whether OnRekeyFailed is due:
-// an initial exchange (peer never established) fails immediately; a rekey tolerates
-// up to maxRekeyFailures consecutive misses (we stay on the still-valid previous
-// PSK) before failing. Assumes m.mu is held.
-func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
-	if !m.established[remoteID] {
-		return true
-	}
-	m.failures[remoteID]++
-	if m.failures[remoteID] >= m.maxRekeyFailures {
-		m.failures[remoteID] = 0
-		return true
-	}
-	return false
-}
-
-// raiseFailure reports a convergence failure. initial distinguishes a never-established
-// peer (bootstrap failed → no PQ PSK at all; in strict mode the peer stays blocked =
-// "stuck") from a rekey failure (a previous PSK is still in force and traffic continues).
-func (m *Manager) raiseFailure(remoteID RemoteID, fail, initial bool) {
-	if !fail {
-		m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
-		return
-	}
-	if initial {
-		m.logger.Warn("pqkem: initial exchange failed — no PQ PSK established for peer (strict mode keeps the peer blocked until it converges)", "peer", remoteID)
-	} else {
-		m.logger.Warn("pqkem: rekey failed after retries — staying on the previous PSK", "peer", remoteID)
-	}
-	if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
-		m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
-	}
-}

client/internal/pqkem/convergence_test.go

@@ -1,75 +0,0 @@
-package pqkem
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// dropTransport is a pqkem.Transport that silently discards everything.
-type dropTransport struct{}
-
-func (dropTransport) Send(netip.AddrPort, []byte) error { return nil }
-func (dropTransport) LocalPort() int                    { return 0 }
-func (dropTransport) Run(func(netip.AddrPort, []byte))  {}
-func (dropTransport) Close() error                      { return nil }
-
-func failedCount(f *fakeWG) int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.failed)
-}
-
-func TestManager_InitialTimeoutFailsImmediately(t *testing.T) {
-	wg := newFakeWG()
-	d := NewManager("bbbb", wg, nil) // bbbb > aaaa -> initiator
-	d.Start(dropTransport{})
-	d.retryInterval = 5 * time.Millisecond
-	d.maxRetries = 3
-	defer d.Stop()
-
-	// Bootstrap offer is produced for signalling; no answer ever comes back -> the
-	// initial exchange fails fast.
-	offer, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-
-	assert.Eventually(t, func() bool { return failedCount(wg) == 1 }, time.Second, 5*time.Millisecond)
-}
-
-func TestManager_RekeyToleratesKFailures(t *testing.T) {
-	dA, dB, _, wgB, lbB := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	// Tighten B's timings before any exchange loop spawns (the loop reads these
-	// fields, so writing them after a loop is running would race).
-	dB.retryInterval = 5 * time.Millisecond
-	dB.maxRetries = 2
-
-	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
-	// path is usable.
-	bootstrap(t, dA, dB)
-	dA.OnDataPathRekeyed("bbbb", 0)
-	dB.OnDataPathRekeyed("aaaa", 0)
-	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
-
-	// Drop B's outbound so rekeys can no longer converge.
-	lbB.drop.Store(true)
-
-	// K-1 data-path rekeys must NOT raise OnRekeyFailed.
-	for i := 0; i < DefaultMaxRekeyFailures-1; i++ {
-		_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
-		require.NoError(t, err)
-		time.Sleep(50 * time.Millisecond)
-	}
-	assert.Equal(t, 0, failedCount(wgB), "no failure before K attempts")
-
-	// The K-th failure raises it once.
-	_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
-	require.NoError(t, err)
-	assert.Eventually(t, func() bool { return failedCount(wgB) == 1 }, time.Second, 5*time.Millisecond)
-}

client/internal/pqkem/env.go

@@ -1,138 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"strconv"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// EnvEnabled is the environment variable that turns the ML-KEM post-quantum
-// exchange on for this client. Accepts on/off aliases plus anything
-// strconv.ParseBool understands (true/false/1/0).
-const EnvEnabled = "NB_ENABLE_PQ_MLKEM"
-
-// Enabled reports whether the ML-KEM PQ exchange is enabled via the environment.
-// An empty or unrecognized value is treated as disabled.
-func Enabled() bool {
-	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvEnabled)))
-	switch raw {
-	case "":
-		return false
-	case "on":
-		return true
-	case "off":
-		return false
-	}
-	enabled, err := strconv.ParseBool(raw)
-	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvEnabled, raw, err)
-		return false
-	}
-	return enabled
-}
-
-// EnvStrict enables strict (fail-closed) mode: block peer traffic until the ML-KEM
-// PSK has been established, instead of the default opportunistic behaviour that lets
-// the tunnel come up classically and upgrades to PQ once the exchange converges.
-const EnvStrict = "NB_PQ_MLKEM_STRICT"
-
-// Strict reports whether strict (fail-closed) mode is enabled via the environment.
-// An empty or unrecognized value is treated as disabled (opportunistic).
-func Strict() bool {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict))) {
-	case "on":
-		return true
-	case "", "off":
-		return false
-	}
-	enabled, err := strconv.ParseBool(strings.TrimSpace(os.Getenv(EnvStrict)))
-	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvStrict, os.Getenv(EnvStrict), err)
-		return false
-	}
-	return enabled
-}
-
-// EnvLogLevel overrides the ML-KEM manager's slog level (trace/debug/info/warn/error).
-// Defaults to info. The verbose per-exchange lifecycle logs are emitted at trace.
-const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
-
-// LevelTrace is a custom slog level below Debug for the verbose per-exchange lifecycle
-// logs, so they stay off unless NB_PQ_MLKEM_LOG_LEVEL=trace (and the daemon log level
-// is trace, since the records are forwarded to logrus).
-const LevelTrace = slog.LevelDebug - 4
-
-// NewLogger builds the slog logger for the ML-KEM manager. It forwards records to
-// logrus so PQ logs land in the same sink as the rest of the daemon (console +
-// client.log) rather than stdout. Verbosity is gated by EnvLogLevel.
-func NewLogger() *slog.Logger {
-	return slog.New(slogToLogrus{})
-}
-
-func logLevel() slog.Level {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
-	case "trace":
-		return LevelTrace
-	case "debug":
-		return slog.LevelDebug
-	case "warn":
-		return slog.LevelWarn
-	case "error":
-		return slog.LevelError
-	default:
-		return slog.LevelInfo
-	}
-}
-
-// slogToLogrus is a slog.Handler that forwards records to logrus, so the ML-KEM
-// manager's logs go wherever the daemon's logrus is configured (console + client.log)
-// instead of stdout. Verbosity is gated by EnvLogLevel via logLevel().
-type slogToLogrus struct {
-	fields log.Fields
-}
-
-func (h slogToLogrus) Enabled(_ context.Context, level slog.Level) bool {
-	return level >= logLevel()
-}
-
-func (h slogToLogrus) Handle(_ context.Context, r slog.Record) error {
-	fields := make(log.Fields, len(h.fields)+r.NumAttrs())
-	for k, v := range h.fields {
-		fields[k] = v
-	}
-	r.Attrs(func(a slog.Attr) bool {
-		fields[a.Key] = a.Value.Any()
-		return true
-	})
-	entry := log.WithFields(fields)
-	switch {
-	case r.Level >= slog.LevelError:
-		entry.Error(r.Message)
-	case r.Level >= slog.LevelWarn:
-		entry.Warn(r.Message)
-	case r.Level >= slog.LevelInfo:
-		entry.Info(r.Message)
-	case r.Level >= slog.LevelDebug:
-		entry.Debug(r.Message)
-	default:
-		entry.Trace(r.Message)
-	}
-	return nil
-}
-
-func (h slogToLogrus) WithAttrs(attrs []slog.Attr) slog.Handler {
-	fields := make(log.Fields, len(h.fields)+len(attrs))
-	for k, v := range h.fields {
-		fields[k] = v
-	}
-	for _, a := range attrs {
-		fields[a.Key] = a.Value.Any()
-	}
-	return slogToLogrus{fields: fields}
-}
-
-func (h slogToLogrus) WithGroup(_ string) slog.Handler { return h }

client/internal/pqkem/kem.go

@@ -1,183 +0,0 @@
-// Package pqkem is a spike (NET-1406) for a post-quantum pre-shared-key exchange
-// that could replace Rosenpass. It performs an X25519MLKEM768 hybrid key
-// encapsulation and derives a 32-byte pre-shared key (PSK).
-//
-// The exchange is a single round trip designed to ride the (already
-// authenticated) Signal offer/answer channel:
-//
-//	initiator --Offer(1216B)--> responder
-//	initiator <--Answer(1120B)-- responder
-//
-// Both sides then hold the same PSK, which is bound to the two peers' identities
-// (their peer identity keys) so the derived key cannot be transplanted
-// to a different peer pair even if the transport authentication were bypassed.
-//
-// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
-// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
-// this group), and ML-KEM_ss ‖ X25519_ss as the KDF input. The PSK is derived with
-// HKDF-SHA256 over that hybrid secret, salted with a domain-separation label and
-// bound (via the HKDF info) to the full transcript and the canonicalised peer
-// identities.
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/hkdf"
-	"crypto/mlkem"
-	"crypto/rand"
-	"crypto/sha256"
-	"fmt"
-)
-
-const (
-	// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
-	// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
-	OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
-	// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
-	AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
-
-	pskLabel = "netbird-pq-psk-v1"
-)
-
-// PSK is the 32-byte derived pre-shared key handed to the consumer to key its channel.
-type PSK [32]byte
-
-// Binding identifies the peer pair the PSK is derived for. Callers set both
-// peer identity keys; the order does not matter (it is canonicalised).
-type Binding struct {
-	LocalID  []byte
-	RemoteID []byte
-}
-
-// Initiator holds the ephemeral secrets between Offer and Finish.
-type Initiator struct {
-	x25519  *ecdh.PrivateKey
-	mlkemDK *mlkem.DecapsulationKey768
-	offer   []byte
-}
-
-// NewInitiator generates the ephemeral X25519 + ML-KEM-768 keypairs.
-func NewInitiator() (*Initiator, error) {
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	dk, err := mlkem.GenerateKey768()
-	if err != nil {
-		return nil, fmt.Errorf("ml-kem keygen: %w", err)
-	}
-
-	offer := make([]byte, 0, OfferSize)
-	offer = append(offer, dk.EncapsulationKey().Bytes()...)
-	offer = append(offer, x.PublicKey().Bytes()...)
-
-	return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
-}
-
-// Offer returns the initiator message to send over Signal.
-func (i *Initiator) Offer() []byte {
-	return i.offer
-}
-
-// Finish consumes the responder's answer and derives the PSK.
-func (i *Initiator) Finish(answer []byte, b Binding) (PSK, error) {
-	if len(answer) != AnswerSize {
-		return PSK{}, fmt.Errorf("answer: got %d bytes, want %d", len(answer), AnswerSize)
-	}
-	ct := answer[:mlkem.CiphertextSize768]
-	peerX := answer[mlkem.CiphertextSize768:]
-
-	ssMLKEM, err := i.mlkemDK.Decapsulate(ct)
-	if err != nil {
-		return PSK{}, fmt.Errorf("ml-kem decapsulate: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := i.x25519.ECDH(pub)
-	if err != nil {
-		return PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	return derivePSK(ssMLKEM, ssX, i.offer, answer, b)
-}
-
-// Respond consumes an initiator offer, produces the answer, and derives the PSK.
-func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
-	if len(offer) != OfferSize {
-		return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
-	}
-	peerEK := offer[:mlkem.EncapsulationKeySize768]
-	peerX := offer[mlkem.EncapsulationKeySize768:]
-
-	ek, err := mlkem.NewEncapsulationKey768(peerEK)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer ml-kem key: %w", err)
-	}
-	ssMLKEM, ct := ek.Encapsulate()
-
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := x.ECDH(pub)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	answer = make([]byte, 0, AnswerSize)
-	answer = append(answer, ct...)
-	answer = append(answer, x.PublicKey().Bytes()...)
-
-	// derivePSK uses the same argument order on both sides; the responder's local
-	// binding is the mirror of the initiator's, canonicalised inside derivePSK.
-	psk, err = derivePSK(ssMLKEM, ssX, offer, answer, b)
-	if err != nil {
-		return nil, PSK{}, err
-	}
-	return answer, psk, nil
-}
-
-// derivePSK runs HKDF-SHA256 over the hybrid shared secret (ML-KEM_ss ‖ X25519_ss,
-// per draft-ietf-tls-ecdhe-mlkem), salted with the domain-separation label, and binds
-// the result — via the HKDF info — to the full transcript (offer ‖ answer) and the
-// canonicalised peer identities, so the PSK cannot be transplanted to another peer
-// pair or a different exchange.
-func derivePSK(ssMLKEM, ssX, offer, answer []byte, b Binding) (PSK, error) {
-	// A PSK not bound to both peer identities could be transplanted to a different peer
-	// pair, so refuse to derive one from an empty binding.
-	if len(b.LocalID) == 0 || len(b.RemoteID) == 0 {
-		return PSK{}, fmt.Errorf("empty peer identity binding")
-	}
-	lo, hi := canonicalPair(b.LocalID, b.RemoteID)
-
-	ikm := make([]byte, 0, len(ssMLKEM)+len(ssX))
-	ikm = append(ikm, ssMLKEM...)
-	ikm = append(ikm, ssX...)
-
-	info := make([]byte, 0, len(offer)+len(answer)+len(lo)+len(hi))
-	info = append(info, offer...)
-	info = append(info, answer...)
-	info = append(info, lo...)
-	info = append(info, hi...)
-
-	var psk PSK
-	key, err := hkdf.Key(sha256.New, ikm, []byte(pskLabel), string(info), len(psk))
-	if err != nil {
-		return PSK{}, fmt.Errorf("hkdf derive psk: %w", err)
-	}
-	copy(psk[:], key)
-	return psk, nil
-}
-
-func canonicalPair(a, b []byte) (lo, hi []byte) {
-	if string(a) <= string(b) {
-		return a, b
-	}
-	return b, a
-}

client/internal/pqkem/kem_framing_test.go

@@ -1,105 +0,0 @@
-package pqkem
-
-import (
-	"crypto/mlkem"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestExchange_TamperedCiphertextFailsClosed verifies the core fail-closed
-// property: mutating the ML-KEM ciphertext in the answer does not error (ML-KEM
-// uses implicit rejection — Decapsulate always returns a value) but yields a
-// different shared secret, so the initiator derives a PSK that does NOT match the
-// responder's. A mismatched PSK means WireGuard passes no bytes: tamper => no data.
-func TestExchange_TamperedCiphertextFailsClosed(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	tampered := append([]byte(nil), answer...)
-	tampered[0] ^= 0xff // flip a bit in the ML-KEM ciphertext
-
-	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err, "implicit rejection: decapsulate still succeeds")
-	require.NotEqual(t, pskB, pskA, "tampered ciphertext must not yield the responder's PSK")
-}
-
-// TestExchange_TamperedX25519ShareDiverges flips a byte in the answer's X25519
-// share: the classical half of the hybrid secret changes, so the derived PSK
-// diverges from the responder's (fail-closed on the ECDH half too).
-func TestExchange_TamperedX25519ShareDiverges(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	tampered := append([]byte(nil), answer...)
-	tampered[mlkem.CiphertextSize768] ^= 0x01 // first byte of the X25519 public key
-
-	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
-	// Either the point is rejected (error) or the ECDH differs (different PSK);
-	// in both cases the honest PSK is never reproduced.
-	if err == nil {
-		require.NotEqual(t, pskB, pskA, "tampered X25519 share must not yield the responder's PSK")
-	}
-}
-
-// TestExchange_AllZeroX25519Rejected feeds an all-zero X25519 share (a low-order
-// point) in the answer. The stdlib ECDH must reject it, so Finish errors rather
-// than deriving a PSK from a degenerate secret.
-func TestExchange_AllZeroX25519Rejected(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	bad := append([]byte(nil), answer...)
-	for i := mlkem.CiphertextSize768; i < len(bad); i++ {
-		bad[i] = 0
-	}
-
-	_, err = init.Finish(bad, Binding{LocalID: wgA, RemoteID: wgB})
-	require.Error(t, err, "all-zero X25519 share (low-order point) must be rejected")
-}
-
-// TestExchange_SizeBoundaries locks the exact-length framing checks: one byte
-// short or long on either message is rejected, not silently truncated/padded.
-func TestExchange_SizeBoundaries(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-	offer := init.Offer()
-
-	_, _, err = Respond(offer[:OfferSize-1], Binding{})
-	require.Error(t, err, "offer one byte short")
-	_, _, err = Respond(append(append([]byte(nil), offer...), 0), Binding{})
-	require.Error(t, err, "offer one byte long")
-
-	answer, _, err := Respond(offer, Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	_, err = init.Finish(answer[:AnswerSize-1], Binding{LocalID: wgA, RemoteID: wgB})
-	require.Error(t, err, "answer one byte short")
-	_, err = init.Finish(append(append([]byte(nil), answer...), 0), Binding{LocalID: wgA, RemoteID: wgB})
-	require.Error(t, err, "answer one byte long")
-}
-
-// TestExchange_BindingIsSymmetric confirms the canonicalisation: the two peers
-// pass their identities in opposite (Local, Remote) order yet derive the same PSK,
-// so identity binding does not depend on who is initiator vs responder.
-func TestExchange_BindingIsSymmetric(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err)
-
-	require.Equal(t, pskB, pskA, "swapped Local/Remote order must canonicalise to the same PSK")
-}

client/internal/pqkem/kem_test.go

@@ -1,106 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	wgA = []byte("peer-A-wireguard-pubkey-32bytes!")
-	wgB = []byte("peer-B-wireguard-pubkey-32bytes!")
-)
-
-func TestExchange_DerivesMatchingPSK(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	require.Len(t, init.Offer(), OfferSize)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-	require.Len(t, answer, AnswerSize)
-
-	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err)
-
-	require.Equal(t, pskB, pskA, "both sides must derive the same PSK")
-	require.NotEqual(t, PSK{}, pskA, "PSK must not be zero")
-}
-
-func TestExchange_PSKBoundToPeerIdentities(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	// Finish twice over the SAME KEM material (same offer/answer/secrets), changing only
-	// the peer identity binding: the differing PSK is attributable to the binding alone.
-	pskHonest, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err)
-
-	wgC := []byte("peer-C-wireguard-pubkey-32bytes!")
-	pskWrong, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgC})
-	require.NoError(t, err)
-
-	require.NotEqual(t, pskHonest, pskWrong, "PSK must be bound to the peer pair")
-}
-
-func TestExchange_RejectsEmptyBinding(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	// A PSK not bound to both identities could be transplanted to another peer pair.
-	_, err = init.Finish(answer, Binding{})
-	require.Error(t, err, "empty binding must be rejected")
-	_, err = init.Finish(answer, Binding{LocalID: wgA})
-	require.Error(t, err, "missing RemoteID must be rejected")
-	_, _, err = Respond(init.Offer(), Binding{RemoteID: wgA})
-	require.Error(t, err, "missing LocalID must be rejected")
-}
-
-func TestExchange_RejectsMalformedMessages(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	_, _, err = Respond(init.Offer()[:10], Binding{})
-	require.Error(t, err)
-
-	_, err = init.Finish([]byte("too short"), Binding{})
-	require.Error(t, err)
-}
-
-// TestExchange_ReportSizesAndTiming is a spike measurement, not a pass/fail gate.
-// Run with: go test -run TestExchange_ReportSizesAndTiming -v ./client/internal/pqkem/
-func TestExchange_ReportSizesAndTiming(t *testing.T) {
-	const iters = 200
-
-	var tInit, tResp, tFinish time.Duration
-	for i := 0; i < iters; i++ {
-		s0 := time.Now()
-		init, err := NewInitiator()
-		require.NoError(t, err)
-		tInit += time.Since(s0)
-
-		s1 := time.Now()
-		answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-		require.NoError(t, err)
-		tResp += time.Since(s1)
-
-		s2 := time.Now()
-		_, err = init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-		require.NoError(t, err)
-		tFinish += time.Since(s2)
-	}
-
-	t.Logf("wire sizes:   offer=%d B   answer=%d B   (Rosenpass static pubkey ~524160 B)", OfferSize, AnswerSize)
-	t.Logf("total on-wire per handshake: %d B  (~%.0fx smaller than RP static key)", OfferSize+AnswerSize, 524160.0/float64(OfferSize+AnswerSize))
-	t.Logf("avg NewInitiator (keygen): %s", tInit/iters)
-	t.Logf("avg Respond (encaps+dh):   %s", tResp/iters)
-	t.Logf("avg Finish (decaps+dh):    %s", tFinish/iters)
-	t.Logf("avg full handshake CPU:    %s", (tInit+tResp+tFinish)/iters)
-}

client/internal/pqkem/manager.go

@@ -1,467 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"crypto/rand"
-	"fmt"
-	"log/slog"
-	"net/netip"
-	"sync"
-	"time"
-)
-
-const (
-	// DefaultRetryInterval is how often the initiator retransmits its outstanding
-	// data-path offer while awaiting the answer.
-	DefaultRetryInterval = 2 * time.Second
-	// DefaultMaxRetries bounds how many ticks an exchange may run before it is
-	// declared failed. The convergence deadline is thus MaxRetries * RetryInterval.
-	DefaultMaxRetries = 10
-	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
-	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
-	DefaultMaxRekeyFailures = 3
-
-	// rotationActivityWindow gates rotation on recent real-data activity: a rekey
-	// clocks a rotation only if the peer exchanged user data within this window. It
-	// must stay shorter than the data path's rekey interval (WireGuard
-	// REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the
-	// activity signal — ages out before the next rekey, letting an idle tunnel stop
-	// rotating instead of self-sustaining.
-	rotationActivityWindow = 90 * time.Second
-)
-
-// LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
-// distinct types so the local and a remote identity cannot be mixed up.
-type (
-	LocalID  string
-	RemoteID string
-)
-
-// Transport is the data-path socket the Manager drives (the analogue of
-// go-rosenpass's Conn). It is a dumb mover of bytes to/from endpoints: the Manager
-// owns the remoteID<->endpoint routing and hands the transport a resolved endpoint
-// to Send, and reverse-resolves the source of each inbound datagram. Its lifecycle
-// belongs to the Manager (Run at Start, Close at Stop).
-type Transport interface {
-	// Send delivers msg to the given data-path endpoint.
-	Send(endpoint netip.AddrPort, msg []byte) error
-	// LocalPort is the bound local UDP port, announced to peers so they know where
-	// to send data-path messages.
-	LocalPort() int
-	// Run starts delivering inbound datagrams as (source endpoint, msg) to onInbound
-	// and returns immediately; it runs until Close.
-	Run(onInbound func(src netip.AddrPort, msg []byte))
-	// Close stops delivery and releases the socket.
-	Close() error
-}
-
-// exchangeState is the single source of truth for an exchange's role and phase.
-type exchangeState uint8
-
-const (
-	stateReserved       exchangeState = iota // responder: deriving the answer
-	stateAwaitingAnswer                      // initiator: offer sent, awaiting the answer
-	stateAwaitingRekey                       // initiator: PSK derived+set, awaiting OnDataPathRekeyed to chain the next offer
-	stateAwaitingAck                         // responder: answer sent, awaiting the next offer that acks this exchange
-)
-
-// exchangeCtl holds all state for one in-flight exchange with a peer, under the
-// Manager's single lock. state drives every decision. lastSent is the current
-// data-path retransmit payload (the offer, for the initiator). initiator is the
-// ephemeral handle used at Finish; pendingPSK is the responder's derived key.
-// viaSignal records that the offer went to the host for the signalling channel, so
-// the loop does not retransmit it on the data path. Only the initiator runs a
-// retransmit loop, so only it sets cancel.
-type exchangeCtl struct {
-	id         ExchangeID
-	state      exchangeState
-	startedAt  time.Time
-	cancel     context.CancelFunc
-	lastSent   []byte
-	initiator  *Initiator
-	pendingPSK PSK
-	viaSignal  bool
-}
-
-// Manager is the stateful orchestrator — the analogue of go-rosenpass's Server. It
-// drives the X25519MLKEM768 exchange, owns the peer endpoint routing and the data-path
-// transport, and surfaces the derived PSK and convergence to the host via
-// CallbackHandler. It is event-driven: the bootstrap is triggered by the host
-// (SignalOffer) and each rotation is clocked by OnDataPathRekeyed. The cryptography is
-// the pure kem.go primitives; all state lives here under one lock.
-type Manager struct {
-	localID   LocalID
-	cbHandler CallbackHandler
-	logger    *slog.Logger
-
-	retryInterval    time.Duration
-	maxRetries       int
-	maxRekeyFailures int
-
-	rootCtx    context.Context
-	rootCancel context.CancelFunc
-
-	mu          sync.Mutex
-	transport   Transport
-	exchanges   map[RemoteID]*exchangeCtl   // in-flight exchange per peer
-	established map[RemoteID]bool           // peer has completed at least one exchange
-	failures    map[RemoteID]int            // consecutive rekey failures per peer
-	psks        map[RemoteID]PSK            // latest derived PSK per peer (pulled at WG peer-config time)
-	capable     map[RemoteID]bool           // peer runs the KEM (advertised a PQ port); false = known non-capable
-	peerAddrs   map[RemoteID]netip.AddrPort // remoteID -> data-path endpoint (send routing)
-	peersByAddr map[netip.AddrPort]RemoteID // reverse: source endpoint -> remoteID (inbound)
-	wait        sync.WaitGroup
-}
-
-// NewManager builds a manager for the local peer identified by its peer identity key
-// (used for the deterministic initiator role and the identity binding). A nil logger
-// falls back to slog.Default(). Install the data-path transport with Start.
-func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manager {
-	if logger == nil {
-		logger = slog.Default()
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	return &Manager{
-		localID:          localID,
-		cbHandler:        h,
-		logger:           logger,
-		retryInterval:    DefaultRetryInterval,
-		maxRetries:       DefaultMaxRetries,
-		maxRekeyFailures: DefaultMaxRekeyFailures,
-		rootCtx:          ctx,
-		rootCancel:       cancel,
-		exchanges:        make(map[RemoteID]*exchangeCtl),
-		established:      make(map[RemoteID]bool),
-		failures:         make(map[RemoteID]int),
-		psks:             make(map[RemoteID]PSK),
-		capable:          make(map[RemoteID]bool),
-		peerAddrs:        make(map[RemoteID]netip.AddrPort),
-		peersByAddr:      make(map[netip.AddrPort]RemoteID),
-	}
-}
-
-// Start installs the data-path transport and begins its inbound delivery. The Manager
-// owns it from here; Stop closes it.
-func (m *Manager) Start(t Transport) {
-	m.mu.Lock()
-	m.transport = t
-	m.mu.Unlock()
-	if t != nil {
-		t.Run(m.onDataPathInbound)
-	}
-}
-
-// LocalPort is the data-path transport's bound UDP port (0 if no transport), to be
-// announced to peers.
-func (m *Manager) LocalPort() int {
-	m.mu.Lock()
-	t := m.transport
-	m.mu.Unlock()
-	if t == nil {
-		return 0
-	}
-	return t.LocalPort()
-}
-
-// IsInitiator reports whether the local peer drives the exchange for this remote
-// peer. Roles are deterministic (lexicographic identity-key compare) so exactly one
-// side initiates, mirroring how Rosenpass picks its handshake initiator.
-func (m *Manager) IsInitiator(remoteID RemoteID) bool {
-	return string(m.localID) > string(remoteID)
-}
-
-// PSK returns the latest PSK derived for the peer, for the host to program at WG
-// peer-config time (the pull path). ok is false until an exchange has derived one.
-func (m *Manager) PSK(remoteID RemoteID) (PSK, bool) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	psk, ok := m.psks[remoteID]
-	return psk, ok
-}
-
-// trace logs at LevelTrace, the verbose per-exchange lifecycle level gated by
-// NB_PQ_MLKEM_LOG_LEVEL=trace.
-func (m *Manager) trace(msg string, args ...any) {
-	m.logger.Log(context.Background(), LevelTrace, msg, args...)
-}
-
-// AddPeer registers where a peer's data-path messages are sent and received: its
-// overlay endpoint (IP:port). This is pure routing and says nothing about capability —
-// PQ capability is decided solely from the peer's KEM payload (see processOffer /
-// processAnswer / MarkNonCapable), never from an endpoint or port.
-func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
-	if !endpoint.IsValid() {
-		return
-	}
-	m.mu.Lock()
-	if old, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, old)
-	}
-	m.peerAddrs[remoteID] = endpoint
-	m.peersByAddr[endpoint] = remoteID
-	m.mu.Unlock()
-}
-
-// MarkNonCapable records that a peer does not run the KEM: it answered our offer with
-// no KEM material over signalling (the capability signal is the peer's payload, not its
-// optional data-path port). Any in-flight exchange is cancelled and further offers are
-// suppressed (see SignalOffer), so a non-PQ peer never drives the rekey-recovery storm.
-// An already-established peer is left untouched — a stray empty answer must not tear
-// down a working PQ session.
-func (m *Manager) MarkNonCapable(remoteID RemoteID) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.established[remoteID] {
-		return
-	}
-	if prev, ok := m.capable[remoteID]; ok && !prev {
-		return // already known non-capable, nothing to do
-	}
-	m.capable[remoteID] = false
-	if ex := m.exchanges[remoteID]; ex != nil {
-		if ex.cancel != nil {
-			ex.cancel()
-		}
-		delete(m.exchanges, remoteID)
-	}
-	m.trace("pqkem: peer advertises no PQ service — treating as non-capable, no KEM attempted", "peer", remoteID)
-}
-
-// RemovePeer stops any in-flight exchange for a peer and drops its state and routing.
-func (m *Manager) RemovePeer(remoteID RemoteID) {
-	m.mu.Lock()
-	if ex, ok := m.exchanges[remoteID]; ok {
-		if ex.cancel != nil {
-			ex.cancel()
-		}
-		delete(m.exchanges, remoteID)
-	}
-	delete(m.established, remoteID)
-	delete(m.failures, remoteID)
-	delete(m.psks, remoteID)
-	delete(m.capable, remoteID)
-	if ep, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, ep)
-		delete(m.peerAddrs, remoteID)
-	}
-	m.mu.Unlock()
-}
-
-// Stop cancels all in-flight exchanges, closes the transport, and waits for the
-// exchange goroutines to exit.
-func (m *Manager) Stop() {
-	// Cancel the root context under the lock, before Wait: startExchangeLocked checks
-	// rootCtx.Err() under the same lock before it Adds to the wait group, so once Stop
-	// has cancelled here no new Add can race Wait.
-	m.mu.Lock()
-	m.rootCancel()
-	m.mu.Unlock()
-	m.wait.Wait()
-	m.mu.Lock()
-	t := m.transport
-	m.transport = nil
-	m.exchanges = make(map[RemoteID]*exchangeCtl)
-	m.psks = make(map[RemoteID]PSK)
-	m.mu.Unlock()
-	if t != nil {
-		if err := t.Close(); err != nil {
-			m.logger.Warn("pqkem: closing data-path transport", "err", err)
-		}
-	}
-}
-
-// ---- Signalling channel (host-driven; rides the host's negotiation) ----
-
-// SignalOffer returns the KEM offer for the host to embed in its outgoing offer to
-// remoteID (bootstrap). It returns (nil, nil) when the local peer is not the
-// initiator. It is idempotent for an in-flight bootstrap: a repeat call returns the
-// same offer rather than starting a new exchange.
-//
-// A signal re-negotiation always re-bootstraps (fresh exchange): the remote may have
-// restarted and lost its PSK, so reusing a locally frozen one would desync. The derived
-// PSK still survives idle in the manager (dropped only on account-level peer removal),
-// so a pure lazy wake with no re-negotiation reuses it via the conn's WG-config pull.
-func (m *Manager) SignalOffer(remoteID RemoteID) ([]byte, error) {
-	if !m.IsInitiator(remoteID) {
-		return nil, nil
-	}
-	m.mu.Lock()
-	if capable, ok := m.capable[remoteID]; ok && !capable {
-		m.mu.Unlock()
-		return nil, nil // peer does not run the KEM; do not offer (avoids a failure/reoffer loop)
-	}
-	// Idempotent while a signalling bootstrap is in flight OR already derived a PSK but
-	// not yet chained a rotation (awaitingRekey): return the SAME offer instead of
-	// starting a new exchange. This matters when the controller both offers on its own
-	// guard AND re-offers in response to the responder's offer — without this, the
-	// second call would start a fresh exchange (a different PSK) and desync the peers.
-	if ex := m.exchanges[remoteID]; ex != nil && ex.viaSignal &&
-		(ex.state == stateAwaitingAnswer || ex.state == stateAwaitingRekey) {
-		last := ex.lastSent
-		m.mu.Unlock()
-		return last, nil
-	}
-	// Hold the lock across the check above and the install so a concurrent SignalOffer
-	// for the same peer can't also start an exchange. bootstrap offer acks nothing.
-	raw, err := m.startExchangeLocked(remoteID, true, ExchangeID{})
-	m.mu.Unlock()
-	return raw, err
-}
-
-// ShouldSendBootstrapOffer reports whether we should emit a fresh KEM offer to kick a
-// bootstrap for this peer. True only if we are the initiator, the peer is not known
-// non-capable, and no exchange is already in flight. The host uses this when it (as the
-// controller) receives the responder's offer: it replies with a KEM offer exactly once
-// to start the exchange, and ignores further responder offers while one is in flight,
-// avoiding an offer-per-offer runaway.
-func (m *Manager) ShouldSendBootstrapOffer(remoteID RemoteID) bool {
-	if !m.IsInitiator(remoteID) {
-		return false
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if capable, ok := m.capable[remoteID]; ok && !capable {
-		return false
-	}
-	return m.exchanges[remoteID] == nil
-}
-
-// SignalOnOffer processes a KEM offer the host extracted from an incoming offer and
-// returns the KEM answer for the host to embed in its outgoing answer.
-func (m *Manager) SignalOnOffer(remoteID RemoteID, offer []byte) ([]byte, error) {
-	typ, msg, err := Decode(offer)
-	if err != nil {
-		return nil, fmt.Errorf("decode signal offer from %s: %w", remoteID, err)
-	}
-	if typ != MsgOffer {
-		return nil, fmt.Errorf("expected offer from %s, got type %d", remoteID, typ)
-	}
-	return m.processOffer(remoteID, msg.(*OfferMsg))
-}
-
-// SignalOnAnswer processes a KEM answer the host extracted from an incoming answer.
-// There is no reply: the next offer (over the data path) acknowledges this exchange.
-func (m *Manager) SignalOnAnswer(remoteID RemoteID, answer []byte) error {
-	typ, msg, err := Decode(answer)
-	if err != nil {
-		return fmt.Errorf("decode signal answer from %s: %w", remoteID, err)
-	}
-	if typ != MsgAnswer {
-		return fmt.Errorf("expected answer from %s, got type %d", remoteID, typ)
-	}
-	return m.processAnswer(remoteID, msg.(*AnswerMsg))
-}
-
-// ---- Data path ----
-
-// onDataPathInbound is the transport's inbound handler: it reverse-resolves the
-// source endpoint to a peer and dispatches. Unknown sources are dropped.
-func (m *Manager) onDataPathInbound(src netip.AddrPort, msg []byte) {
-	m.mu.Lock()
-	remoteID, ok := m.peersByAddr[src]
-	m.mu.Unlock()
-	if !ok {
-		return
-	}
-	if err := m.OnDataPathMessage(remoteID, msg); err != nil {
-		m.trace("pqkem: inbound", "peer", remoteID, "err", err)
-	}
-}
-
-// OnDataPathMessage handles a KEM message received over the data path from remoteID
-// and pushes any reply back over the data path.
-func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
-	typ, msg, err := Decode(raw)
-	if err != nil {
-		return fmt.Errorf("decode data-path msg from %s: %w", remoteID, err)
-	}
-	switch typ {
-	case MsgOffer:
-		answer, err := m.processOffer(remoteID, msg.(*OfferMsg))
-		if err != nil {
-			return err
-		}
-		if answer == nil {
-			return nil
-		}
-		return m.pushDataPath(remoteID, answer)
-	case MsgAnswer:
-		return m.processAnswer(remoteID, msg.(*AnswerMsg))
-	default:
-		return fmt.Errorf("unhandled data-path message type %d from %s", typ, remoteID)
-	}
-}
-
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey
-// (fired on first establishment AND every rekey). If we are the initiator that just
-// derived a PSK, it chains the next exchange: a fresh offer over the data path that
-// acknowledges the just-completed one (its arrival under the new key proves to the
-// responder the key works). sinceActivity is how long ago the peer last exchanged real
-// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is
-// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
-// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
-func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {
-	if sinceActivity >= rotationActivityWindow {
-		m.trace("pqkem: peer idle, skipping data-path rotation", "peer", remoteID, "since_activity", sinceActivity)
-		return
-	}
-
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	chain := ex != nil && ex.state == stateAwaitingRekey
-	if !chain {
-		m.mu.Unlock()
-		m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", false)
-		return
-	}
-	// Hold the lock across the awaitingRekey check and the install so two rekey clocks
-	// can't each start a chained exchange for the same peer.
-	offer, err := m.startExchangeLocked(remoteID, false, ex.id)
-	m.mu.Unlock()
-
-	m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", true)
-	if err != nil {
-		m.logger.Error("pqkem: chain offer failed to start", "peer", remoteID, "err", err)
-		return
-	}
-	if err := m.pushDataPath(remoteID, offer); err != nil {
-		m.logger.Warn("pqkem: send chain offer failed", "peer", remoteID, "err", err)
-		return
-	}
-	m.trace("pqkem: chain offer sent over data path", "peer", remoteID)
-}
-
-// OnDataPathDown notifies that the peer's data path went down. Rotations resume once
-// the host re-bootstraps over signalling on reconnect; in-flight data-path sends will
-// simply fail until then. Reserved as an explicit hook.
-func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
-
-// ---- internals ----
-
-// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
-// erroring if the peer is unknown or no transport is set.
-func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
-	m.mu.Lock()
-	ep, ok := m.peerAddrs[remoteID]
-	t := m.transport
-	m.mu.Unlock()
-	if !ok {
-		return fmt.Errorf("no data-path endpoint for peer %s", remoteID)
-	}
-	if t == nil {
-		return fmt.Errorf("no data-path transport")
-	}
-	return t.Send(ep, msg)
-}
-
-func (m *Manager) binding(remoteID RemoteID) Binding {
-	return Binding{LocalID: []byte(m.localID), RemoteID: []byte(remoteID)}
-}
-
-func newExchangeID() (ExchangeID, error) {
-	var id ExchangeID
-	if _, err := rand.Read(id[:]); err != nil {
-		return ExchangeID{}, fmt.Errorf("generate exchange id: %w", err)
-	}
-	return id, nil
-}

client/internal/pqkem/manager_test.go

@@ -1,201 +0,0 @@
-package pqkem
-
-import (
-	"fmt"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// netSwitch is an in-memory UDP fabric: transports register their endpoint and get
-// datagrams delivered to their inbound handler.
-type netSwitch struct {
-	mu sync.Mutex
-	h  map[netip.AddrPort]func(netip.AddrPort, []byte)
-}
-
-func newSwitch() *netSwitch {
-	return &netSwitch{h: map[netip.AddrPort]func(netip.AddrPort, []byte){}}
-}
-
-func (s *netSwitch) register(ep netip.AddrPort, fn func(netip.AddrPort, []byte)) {
-	s.mu.Lock()
-	s.h[ep] = fn
-	s.mu.Unlock()
-}
-
-func (s *netSwitch) deliver(dst, src netip.AddrPort, msg []byte) error {
-	s.mu.Lock()
-	fn := s.h[dst]
-	s.mu.Unlock()
-	if fn == nil {
-		return fmt.Errorf("no route to %s", dst)
-	}
-	fn(src, msg)
-	return nil
-}
-
-// loopback is an endpoint-based pqkem.Transport over a netSwitch, with a switchable
-// drop flag.
-type loopback struct {
-	ep   netip.AddrPort
-	sw   *netSwitch
-	drop atomic.Bool
-}
-
-func (l *loopback) Send(dst netip.AddrPort, msg []byte) error {
-	if l.drop.Load() {
-		return nil
-	}
-	return l.sw.deliver(dst, l.ep, append([]byte(nil), msg...))
-}
-
-func (l *loopback) LocalPort() int                             { return int(l.ep.Port()) }
-func (l *loopback) Run(onInbound func(netip.AddrPort, []byte)) { l.sw.register(l.ep, onInbound) }
-func (l *loopback) Close() error                               { return nil }
-
-type fakeWG struct {
-	mu     sync.Mutex
-	psks   map[RemoteID]PSK
-	failed []RemoteID
-}
-
-func newFakeWG() *fakeWG { return &fakeWG{psks: map[RemoteID]PSK{}} }
-
-// startExchangeTest drives startExchangeLocked with the lock held, for tests that kick an
-// exchange directly (production callers hold m.mu across their idempotency check).
-func (m *Manager) startExchangeTest(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.startExchangeLocked(remoteID, viaSignal, ackID)
-}
-
-func (f *fakeWG) OnNewPSKReady(remoteID RemoteID, psk PSK) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.psks[remoteID] = psk
-	return nil
-}
-
-func (f *fakeWG) OnRekeyFailed(remoteID RemoteID) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.failed = append(f.failed, remoteID)
-	return nil
-}
-
-func (f *fakeWG) psk(peer RemoteID) PSK {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.psks[peer]
-}
-
-var (
-	epA = netip.MustParseAddrPort("100.64.0.1:51833")
-	epB = netip.MustParseAddrPort("100.64.0.2:51833")
-)
-
-// pair builds two wired managers (B is the initiator, "bbbb" > "aaaa") sharing a
-// netSwitch, with each peer's data-path endpoint registered. lbB is B's loopback
-// (for toggling drop).
-func pair(t *testing.T) (dA, dB *Manager, wgA, wgB *fakeWG, lbB *loopback) {
-	t.Helper()
-	sw := newSwitch()
-	wgA = newFakeWG()
-	wgB = newFakeWG()
-	dA = NewManager("aaaa", wgA, nil)
-	dB = NewManager("bbbb", wgB, nil)
-	dA.Start(&loopback{ep: epA, sw: sw})
-	lbB = &loopback{ep: epB, sw: sw}
-	dB.Start(lbB)
-	dA.AddPeer("bbbb", epB)
-	dB.AddPeer("aaaa", epA)
-	return dA, dB, wgA, wgB, lbB
-}
-
-// bootstrap runs the signalling offer/answer (the test plays the host carrying bytes).
-func bootstrap(t *testing.T, dA, dB *Manager) {
-	t.Helper()
-	offer, err := dB.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-	answer, err := dA.SignalOnOffer("bbbb", offer)
-	require.NoError(t, err)
-	require.NotNil(t, answer)
-	require.NoError(t, dB.SignalOnAnswer("aaaa", answer))
-}
-
-func TestManager_BootstrapDerivesSamePSK(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-
-	pskA := wgA.psk("bbbb")
-	pskB := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, pskA)
-	require.Equal(t, pskB, pskA, "both sides derive the same PSK from the bootstrap exchange")
-}
-
-func TestManager_ChainRotatesAndAcks(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	psk1 := wgB.psk("aaaa")
-
-	// Data path up: B (initiator) chains the next offer over the data path, which
-	// rotates both to a fresh PSK and acknowledges A.
-	dA.OnDataPathRekeyed("bbbb", 0)
-	dB.OnDataPathRekeyed("aaaa", 0)
-
-	psk2A := wgA.psk("bbbb")
-	psk2B := wgB.psk("aaaa")
-	require.Equal(t, psk2B, psk2A, "both sides converge on the rotated PSK")
-	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
-}
-
-func TestManager_RotationSkippedWhenIdle(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	psk1 := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, psk1)
-
-	// Idle: the peer's last real-data activity is older than the window, so a rekey
-	// must NOT clock a rotation.
-	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow)
-	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow)
-	require.Equal(t, psk1, wgB.psk("aaaa"), "idle peer must not rotate the PSK")
-	require.Equal(t, psk1, wgA.psk("bbbb"), "idle peer must not rotate the PSK")
-
-	// Active: activity within the window clocks the rotation as usual.
-	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow-1)
-	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow-1)
-	psk2 := wgB.psk("aaaa")
-	require.NotEqual(t, psk1, psk2, "recent activity must clock a rotation")
-	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides converge on the rotated PSK")
-}
-
-func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	defer dA.Stop()
-
-	offer, err := dA.SignalOffer("bbbb") // not the initiator vs "bbbb"
-	require.NoError(t, err)
-	require.Nil(t, offer)
-}
-
-func TestManager_StopIsIdempotent(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	dA.Start(&loopback{ep: epA, sw: newSwitch()})
-	dA.Stop()
-	dA.Stop() // must not panic or hang
-}

client/internal/pqkem/message.go

@@ -1,121 +0,0 @@
-package pqkem
-
-import (
-	"crypto/mlkem"
-	"fmt"
-)
-
-// Wire framing for the PQ-KEM exchange. Messages are self-contained, versioned,
-// transport-agnostic byte blobs: the same bytes ride the signalling channel
-// (initial bootstrap) or a data-tunnel packet (rekey). The library only ever sees
-// opaque []byte at the transport seam.
-//
-// Layout (all messages): [type:1][version:1][exchangeID:16][payload...]
-//
-// There is no confirm message: an exchange is acknowledged by the NEXT offer, which
-// carries the acked exchange's id (see OfferMsg.AckID) and — riding the data path
-// under the freshly adopted key — proves that key works.
-
-const (
-	// ProtocolVersion is bumped on any wire-incompatible change; a peer rejects
-	// messages it does not understand rather than misparsing them.
-	ProtocolVersion uint8 = 1
-
-	// ExchangeIDSize identifies one exchange so answers/acks correlate and stale
-	// messages are dropped.
-	ExchangeIDSize = 16
-
-	headerSize = 1 + 1 + ExchangeIDSize
-)
-
-// MsgType tags the two message kinds of the exchange.
-type MsgType uint8
-
-const (
-	MsgOffer MsgType = iota + 1
-	MsgAnswer
-)
-
-// ExchangeID is the per-exchange correlator. The zero value means "none" (an offer
-// that acknowledges nothing, i.e. the first exchange of a connection).
-type ExchangeID [ExchangeIDSize]byte
-
-// OfferMsg carries the initiator's public material (ML-KEM encap key ‖ X25519 pub)
-// and AckID, the id of the previous exchange this offer acknowledges (zero if none).
-type OfferMsg struct {
-	ExchangeID ExchangeID
-	AckID      ExchangeID
-	// KEMOffer is the raw Initiator.Offer() blob (OfferSize bytes).
-	KEMOffer []byte
-}
-
-// AnswerMsg carries the responder's reply (ML-KEM ciphertext ‖ X25519 pub) for the
-// round identified by ExchangeID.
-type AnswerMsg struct {
-	ExchangeID ExchangeID
-	// KEMAnswer is the raw Respond() answer blob (AnswerSize bytes).
-	KEMAnswer []byte
-}
-
-// Encode serialises the offer with its framed header (payload = AckID ‖ KEMOffer).
-func (m *OfferMsg) Encode() ([]byte, error) {
-	if len(m.KEMOffer) != OfferSize {
-		return nil, fmt.Errorf("offer payload: got %d, want %d", len(m.KEMOffer), OfferSize)
-	}
-	payload := make([]byte, 0, ExchangeIDSize+OfferSize)
-	payload = append(payload, m.AckID[:]...)
-	payload = append(payload, m.KEMOffer...)
-	return frame(MsgOffer, m.ExchangeID, payload), nil
-}
-
-// Encode serialises the answer with its framed header.
-func (m *AnswerMsg) Encode() ([]byte, error) {
-	if len(m.KEMAnswer) != AnswerSize {
-		return nil, fmt.Errorf("answer payload: got %d, want %d", len(m.KEMAnswer), AnswerSize)
-	}
-	return frame(MsgAnswer, m.ExchangeID, m.KEMAnswer), nil
-}
-
-// Decode parses a framed message into one of *OfferMsg / *AnswerMsg.
-func Decode(buf []byte) (MsgType, any, error) {
-	if len(buf) < headerSize {
-		return 0, nil, fmt.Errorf("message too short: %d bytes", len(buf))
-	}
-	typ := MsgType(buf[0])
-	if ver := buf[1]; ver != ProtocolVersion {
-		return typ, nil, fmt.Errorf("unsupported protocol version %d (want %d)", ver, ProtocolVersion)
-	}
-
-	var id ExchangeID
-	copy(id[:], buf[2:headerSize])
-	payload := buf[headerSize:]
-
-	switch typ {
-	case MsgOffer:
-		if len(payload) != ExchangeIDSize+OfferSize {
-			return typ, nil, fmt.Errorf("offer payload: got %d, want %d", len(payload), ExchangeIDSize+OfferSize)
-		}
-		var ack ExchangeID
-		copy(ack[:], payload[:ExchangeIDSize])
-		return typ, &OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: payload[ExchangeIDSize:]}, nil
-	case MsgAnswer:
-		if len(payload) != AnswerSize {
-			return typ, nil, fmt.Errorf("answer payload: got %d, want %d", len(payload), AnswerSize)
-		}
-		return typ, &AnswerMsg{ExchangeID: id, KEMAnswer: payload}, nil
-	default:
-		return typ, nil, fmt.Errorf("unknown message type %d", typ)
-	}
-}
-
-func frame(typ MsgType, id ExchangeID, payload []byte) []byte {
-	buf := make([]byte, headerSize+len(payload))
-	buf[0] = byte(typ)
-	buf[1] = ProtocolVersion
-	copy(buf[2:], id[:])
-	copy(buf[headerSize:], payload)
-	return buf
-}
-
-// compile-time assurance the KEM blob sizes referenced here stay in sync with kem.go.
-var _ = [1]struct{}{}[OfferSize-(32+mlkem.EncapsulationKeySize768)]

client/internal/pqkem/message_test.go

@@ -1,57 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestMessageRoundTrip(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	id := ExchangeID{1, 2, 3, 4}
-	ack := ExchangeID{9, 9, 9}
-
-	offBytes, err := (&OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: init.Offer()}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err := Decode(offBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgOffer, typ)
-	require.Equal(t, id, decoded.(*OfferMsg).ExchangeID)
-	require.Equal(t, ack, decoded.(*OfferMsg).AckID)
-	require.Equal(t, init.Offer(), decoded.(*OfferMsg).KEMOffer)
-
-	ansBytes, err := (&AnswerMsg{ExchangeID: id, KEMAnswer: answer}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err = Decode(ansBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgAnswer, typ)
-	require.Equal(t, answer, decoded.(*AnswerMsg).KEMAnswer)
-}
-
-func TestDecodeRejects(t *testing.T) {
-	// too short
-	_, _, err := Decode([]byte{1, 1})
-	require.Error(t, err)
-
-	// wrong version
-	bad := make([]byte, headerSize+ExchangeIDSize+OfferSize)
-	bad[0] = byte(MsgOffer)
-	bad[1] = ProtocolVersion + 1
-	_, _, err = Decode(bad)
-	require.Error(t, err)
-
-	// unknown type
-	bad2 := make([]byte, headerSize)
-	bad2[0] = 99
-	bad2[1] = ProtocolVersion
-	_, _, err = Decode(bad2)
-	require.Error(t, err)
-
-	// offer with wrong payload size
-	_, err = (&OfferMsg{KEMOffer: []byte{1, 2, 3}}).Encode()
-	require.Error(t, err)
-}

client/internal/pqkem_adapter.go

@@ -1,160 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/internal/pqkem"
-)
-
-// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
-// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
-type pqPresharedKeySetter interface {
-	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
-}
-
-// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
-// engine-side implementation of pqkem.CallbackHandler.
-type pqCallbackHandler struct {
-	wg pqPresharedKeySetter
-	// reoffer re-bootstraps the KEM over Signal for a peer (a fresh signalling offer)
-	// to recover from a persistent data-path rekey failure. Nil disables recovery.
-	reoffer func(remoteKey string)
-}
-
-// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
-// if the peer is not present, mirroring Rosenpass).
-func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
-	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
-	// peer is not configured yet, so this is a no-op there and the PSK is instead
-	// pulled at peer-config time (pqHandshaker.PSK / conn.presharedKey).
-	log.Tracef("pqkem: programming PSK for peer %s", remoteID)
-	return h.wg.SetPresharedKey(string(remoteID), wgtypes.Key(psk), true)
-}
-
-// OnRekeyFailed reports a failed PQ (re)key convergence and re-bootstraps the KEM over
-// Signal to recover: a fresh signalling offer starts a new exchange that overwrites the
-// stalled PSK on both sides, resyncing after a persistent data-path desync. The tunnel
-// stays up on the previous PSK meanwhile (the Signal channel is independent of the
-// broken data path).
-func (h pqCallbackHandler) OnRekeyFailed(remoteID pqkem.RemoteID) error {
-	log.Warnf("pqkem: post-quantum rekey failed for peer %s, re-bootstrapping over signal", remoteID)
-	if h.reoffer != nil {
-		h.reoffer(string(remoteID))
-	}
-	return nil
-}
-
-// pqHandshaker adapts the pqkem manager to peer.PQHandshaker (string peer keys),
-// wiring the host's signalling offers/answers to the KEM exchange.
-type pqHandshaker struct {
-	mgr *pqkem.Manager
-}
-
-// announcedPort is the PQ data-path port to advertise to peers. It is omitted (0) when
-// the manager is on DefaultPort, since peers assume the default when no port is sent;
-// only a non-default (collision-forced) port is announced explicitly.
-func (p pqHandshaker) announcedPort() uint16 {
-	if port := p.mgr.LocalPort(); port != DefaultPort {
-		return uint16(port)
-	}
-	return 0
-}
-
-// OfferPayload builds the KEM offer to attach to an outgoing signalling offer for the
-// peer, plus the data-path port to announce (0 when on DefaultPort). Payload is nil when
-// this side has no offer to send.
-func (p pqHandshaker) OfferPayload(remoteKey string) ([]byte, uint16) {
-	payload, err := p.mgr.SignalOffer(pqkem.RemoteID(remoteKey))
-	if err != nil {
-		log.Warnf("pqkem: build offer for %s: %v", remoteKey, err)
-	}
-	return payload, p.announcedPort()
-}
-
-// ShouldSendBootstrapOffer reports whether the controller should reply to the peer's
-// KEM-less offer with its own bootstrap offer instead of an answer.
-func (p pqHandshaker) ShouldSendBootstrapOffer(remoteKey string) bool {
-	return p.mgr.ShouldSendBootstrapOffer(pqkem.RemoteID(remoteKey))
-}
-
-// AnswerPayload processes a received KEM offer (nil when absent) and returns the KEM
-// answer to attach to the outgoing signalling answer, plus the data-path port to announce
-// (0 when on DefaultPort). An empty offer is treated as a capability signal.
-func (p pqHandshaker) AnswerPayload(remoteKey string, recvOffer []byte) ([]byte, uint16) {
-	if len(recvOffer) == 0 {
-		// Capability signal (responder side): the KEM offer flows initiator->responder,
-		// so if we are the responder for this peer (it is the KEM initiator by role) an
-		// empty offer means it does not run the KEM. If we are the initiator, an empty
-		// offer is normal — the peer is the responder and puts its material in the
-		// answer — so we must not flag it.
-		if !p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
-			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
-		}
-		return nil, p.announcedPort()
-	}
-	payload, err := p.mgr.SignalOnOffer(pqkem.RemoteID(remoteKey), recvOffer)
-	if err != nil {
-		log.Warnf("pqkem: build answer for %s: %v", remoteKey, err)
-	}
-	return payload, p.announcedPort()
-}
-
-// OnAnswer feeds a received KEM answer (nil when absent) into the exchange. An empty
-// answer to our offer is treated as a capability signal on the initiator side.
-func (p pqHandshaker) OnAnswer(remoteKey string, recvAnswer []byte) {
-	if len(recvAnswer) == 0 {
-		// Capability signal (initiator side): the KEM answer flows responder->initiator,
-		// so an empty answer to our offer means the peer does not run the KEM — mark it
-		// non-capable to stop offering (no failure/reoffer storm). Only meaningful when
-		// we are the initiator: as the responder we also receive an (empty) answer to
-		// our own non-KEM offer from a perfectly capable peer, which must not be flagged.
-		if p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
-			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
-		}
-		return
-	}
-	if err := p.mgr.SignalOnAnswer(pqkem.RemoteID(remoteKey), recvAnswer); err != nil {
-		log.Warnf("pqkem: process answer from %s: %v", remoteKey, err)
-	}
-}
-
-// PSK exposes the peer's derived PSK for the conn to program at WG peer-config time.
-func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
-	psk, ok := p.mgr.PSK(pqkem.RemoteID(remoteKey))
-	if !ok {
-		return wgtypes.Key{}, false
-	}
-	return wgtypes.Key(psk), true
-}
-
-// SetRemoteAddr registers the peer's data-path endpoint learned from signalling. A
-// zero port means the peer omitted it (it is on DefaultPort), so we resolve it here —
-// DefaultPort lives in this package, not in peer. Sends only ever fire once the tunnel
-// is up (clocked by OnDataPathRekeyed), so registering here is safe even before
-// connection-up.
-func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
-	if !addr.Addr().IsValid() {
-		return
-	}
-	port := addr.Port()
-	if port == 0 {
-		port = DefaultPort
-	}
-	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), netip.AddrPortFrom(addr.Addr(), port))
-}
-
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.
-// sinceActivity is how long ago the peer last exchanged real user data; the manager
-// skips rotation for idle tunnels.
-func (p pqHandshaker) OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration) {
-	p.mgr.OnDataPathRekeyed(pqkem.RemoteID(remoteKey), sinceActivity)
-}
-
-// OnDataPathDown signals the peer's tunnel went down.
-func (p pqHandshaker) OnDataPathDown(remoteKey string) {
-	p.mgr.OnDataPathDown(pqkem.RemoteID(remoteKey))
-}

client/internal/pqkem_adapter_test.go

@@ -1,37 +0,0 @@
-package internal
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/pqkem"
-)
-
-type pqNoopHandler struct{}
-
-func (pqNoopHandler) OnNewPSKReady(pqkem.RemoteID, pqkem.PSK) error { return nil }
-func (pqNoopHandler) OnRekeyFailed(pqkem.RemoteID) error            { return nil }
-
-// TestPQAdapter_CapabilityRoleAware locks the role-aware capability signal: the KEM
-// payload only flows initiator-offer -> responder-answer, so an empty message in the
-// other direction comes from a perfectly capable peer and must NOT flag it. Only the
-// message that should carry material (the answer we receive as initiator) marks a peer
-// non-capable when empty.
-func TestPQAdapter_CapabilityRoleAware(t *testing.T) {
-	// localID "zzzz" > "aaaa" => this manager is the KEM initiator for peer "aaaa".
-	mgr := pqkem.NewManager("zzzz", pqNoopHandler{}, nil)
-	defer mgr.Stop()
-	h := pqHandshaker{mgr: mgr}
-
-	// An empty OFFER from our peer is normal here: as the initiator's responder it puts
-	// its material in the answer, not the offer. It must not disable our offering.
-	h.AnswerPayload("aaaa", nil)
-	payload, _ := h.OfferPayload("aaaa")
-	require.NotNil(t, payload, "an empty offer from a responder-role peer must not mark it non-capable")
-
-	// An empty ANSWER to our offer means the peer does not run the KEM -> stop offering.
-	h.OnAnswer("aaaa", nil)
-	payload2, _ := h.OfferPayload("aaaa")
-	require.Nil(t, payload2, "an empty answer to our offer marks the peer non-capable, so we stop offering")
-}

client/internal/pqkem_transport.go

@@ -1,76 +0,0 @@
-package internal
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
-// the WG overlay IP. Since each client owns a distinct overlay IP, this port is
-// almost always free, so it need not be announced (peers assume it). A peer only
-// announces Body.mlkemPort when a collision forced it onto a different port.
-const DefaultPort = 51833
-
-// pqTransport is the ML-KEM data-path transport: a dumb UDP socket bound on the WG
-// overlay IP. It implements pqkem.Transport — the manager owns the remoteID<->endpoint
-// routing and drives this socket's lifecycle (Run / Close).
-type pqTransport struct {
-	conn *net.UDPConn
-	port int
-}
-
-// newPQTransport binds a UDP socket on the WG overlay IP, preferring DefaultPort and
-// falling back to an OS-assigned ephemeral port if it is in use. Call it after the WG
-// interface is up so the overlay IP is assigned; when the bound port is not
-// DefaultPort it must be announced to peers via Body.mlkemPort.
-func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
-	if !overlayIP.IsValid() {
-		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
-	}
-	// The WG overlay always carries an IPv4 address (v6 is additive, never standalone),
-	// so the transport binds over IPv4. Unmap first so AsSlice() yields 4 bytes for an
-	// IPv4-mapped IPv6 address (a hardcoded "udp4" would otherwise fail on its 16 bytes).
-	overlayIP = overlayIP.Unmap()
-	ip := net.IP(overlayIP.AsSlice())
-	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
-	if err != nil {
-		log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
-		conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
-		if err != nil {
-			return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
-		}
-	}
-	return &pqTransport{conn: conn, port: conn.LocalAddr().(*net.UDPAddr).Port}, nil
-}
-
-// Send implements pqkem.Transport.
-func (t *pqTransport) Send(endpoint netip.AddrPort, msg []byte) error {
-	_, err := t.conn.WriteToUDPAddrPort(msg, endpoint)
-	return err
-}
-
-// LocalPort implements pqkem.Transport.
-func (t *pqTransport) LocalPort() int { return t.port }
-
-// Run implements pqkem.Transport: the receive loop, delivering each datagram as
-// (source endpoint, msg). Exits when the socket is closed.
-func (t *pqTransport) Run(onInbound func(src netip.AddrPort, msg []byte)) {
-	go func() {
-		buf := make([]byte, 2048)
-		for {
-			n, src, err := t.conn.ReadFromUDPAddrPort(buf)
-			if err != nil {
-				return
-			}
-			msg := make([]byte, n)
-			copy(msg, buf[:n])
-			onInbound(src, msg)
-		}
-	}()
-}
-
-// Close implements pqkem.Transport.
-func (t *pqTransport) Close() error { return t.conn.Close() }

client/ui/build/linux/netbird-ui.desktop

@@ -1,10 +1,11 @@
 [Desktop Entry]
 Type=Application
-Name=netbird-ui
+Name=NetBird
+Comment=NetBird desktop client
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 netbird-ui
 Icon=netbird-ui
-Categories=Development;
+Categories=Utility;Network;
 Terminal=false
-Keywords=wails
+Keywords=netbird;vpn;wireguard;
 Version=1.0
 StartupNotify=false

client/ui/build/linux/netbird.desktop

@@ -1,5 +1,6 @@
 [Desktop Entry]
-Name=Netbird
+Name=NetBird
+Comment=NetBird desktop client
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/netbird-ui
 Icon=netbird
 Type=Application

client/ui/build/linux/nfpm/nfpm.yaml

@@ -21,8 +21,17 @@ contents:
     dst: "/usr/local/bin/netbird-ui"
   - src: "./build/appicon.png"
     dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
+  # The name the polkit action's icon_name refers to, which the released packages
+  # install as /usr/share/pixmaps/netbird.png.
+  - src: "./build/appicon.png"
+    dst: "/usr/share/icons/hicolor/128x128/apps/netbird.png"
   - src: "./build/linux/netbird-ui.desktop"
     dst: "/usr/share/applications/netbird-ui.desktop"
+  # Names the polkit action for the elevation prompt the app raises when an
+  # unprivileged user changes a privileged setting; without it the dialog shows a
+  # raw command line.
+  - src: "./build/linux/polkit/io.netbird.settings.policy"
+    dst: "/usr/share/polkit-1/actions/io.netbird.settings.policy"
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:

client/ui/build/linux/polkit/io.netbird.settings.policy

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+
+<!--
+  Names the action behind the elevation prompt the desktop app raises for an SSH
+  setting the daemon restricts to root; without it pkexec's generic dialog offers
+  the raw command line instead. The argv1 annotation keeps this wording to the
+  one-shot mode that applies those settings.
+
+  auth_admin rather than auth_admin_keep: each of these settings is its own grant
+  of shell access, so a credential cache would let a second, unasked-for change
+  ride along on the authorization given the first.
+
+  exec.path takes no wildcard and the binary's location depends on the package,
+  hence one action per path.
+-->
+<policyconfig>
+  <vendor>NetBird</vendor>
+  <vendor_url>https://netbird.io</vendor_url>
+
+  <action id="io.netbird.settings.apply-privileged">
+    <description>Change privileged NetBird settings</description>
+    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
+    <icon_name>netbird</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/netbird-ui</annotate>
+    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
+  </action>
+
+  <action id="io.netbird.settings.apply-privileged-local">
+    <description>Change privileged NetBird settings</description>
+    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
+    <icon_name>netbird</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/netbird-ui</annotate>
+    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
+  </action>
+</policyconfig>

client/ui/frontend/src/contexts/SettingsContext.tsx

@@ -22,12 +22,18 @@ const logSaveError = (err: unknown) => console.error("[SettingsContext] save fai
 
 export type AutostartState = { supported: boolean; enabled: boolean };
 
+// GuardedField is a setting the daemon only accepts from root/administrator.
+// Turning one on goes through saveGuardedField, which asks the operating system
+// for the privileges rather than sending a request that would be refused.
+export type GuardedField = "serverSshAllowed" | "enableSshRoot" | "disableSshAuth";
+
 type SettingsContextValue = {
     config: Config;
     guiVersion: string;
     setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
     saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
     saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
+    saveGuardedField: (k: GuardedField, v: boolean) => Promise<void>;
     saveNow: () => Promise<void>;
 };
 
@@ -63,6 +69,12 @@ const useSettingsState = () => {
     const [guiVersion, setGuiVersion] = useState<string>("—");
     const saveTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
     const loadedRef = useRef<LoadedConfig | null>(null);
+    // Set when the daemon's config changed while a save was pending, so the read
+    // that was skipped to protect the pending edit happens once it is through.
+    // Without it the form keeps values the daemon no longer has and the next save
+    // submits them, which for a guarded setting means asking the user to authorize
+    // a change they never made.
+    const reloadOwed = useRef(false);
 
     useEffect(() => {
         loadedRef.current = loaded;
@@ -73,6 +85,7 @@ const useSettingsState = () => {
     // update the daemon then rejected.
     const reload = useCallback(
         async (profileName: string) => {
+            reloadOwed.current = false;
             try {
                 const data = await SettingsSvc.GetConfig({ profileName, username });
                 setLoaded({ profileName, data });
@@ -94,7 +107,12 @@ const useSettingsState = () => {
                     username,
                 });
                 if (cancelled) return;
-                if (saveTimer.current) return;
+                // A pending edit outranks the daemon's copy until it is saved, so
+                // the read is owed rather than dropped: see reloadOwed.
+                if (saveTimer.current) {
+                    reloadOwed.current = true;
+                    return;
+                }
                 setLoaded({ profileName: activeProfileId, data });
             } catch (e) {
                 if (cancelled || !showError) return;
@@ -141,12 +159,17 @@ const useSettingsState = () => {
         async (profileName: string, next: Config, preSharedKey?: string) => {
             const preSharedKeyWrite = preSharedKey === undefined ? {} : { preSharedKey };
             try {
-                await SettingsSvc.SetConfig({
+                const { declined } = await SettingsSvc.SetConfig({
                     ...next,
                     ...preSharedKeyWrite,
                     profileName,
                     username,
                 });
+                // The change needed authorization and the user said no, so the
+                // optimistic update is wrong. Nothing to report: they know.
+                if (declined || reloadOwed.current) {
+                    await reload(profileName);
+                }
             } catch (e) {
                 // The optimistic update is wrong now: the daemon refused it
                 // (a change that needs elevated privileges, an MDM-managed
@@ -206,6 +229,59 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
+    // saveGuardedField applies a setting the daemon restricts to
+    // root/administrator by having the Go side run the app again under the
+    // platform's elevation prompt (UAC, the macOS authentication dialog, polkit).
+    // The prompt is the user's, so the call is made straight from their gesture
+    // and never from the debounce.
+    const saveGuardedField = useCallback(
+        async (k: GuardedField, v: boolean) => {
+            const cur = loadedRef.current;
+            if (!cur) return;
+
+            // Flush what the debounce still owes, before the optimistic update
+            // below joins it: a later save carrying the guarded value would be
+            // refused, and its error dialog would be the second one for a change
+            // the user already authorized.
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+                await save(cur.profileName, cur.data);
+            }
+
+            const next: LoadedConfig = {
+                profileName: cur.profileName,
+                data: { ...cur.data, [k]: v },
+            };
+            loadedRef.current = next;
+            setLoaded(next);
+
+            try {
+                await SettingsSvc.SetGuardedSettings({
+                    profileName: cur.profileName,
+                    username,
+                    [k]: v,
+                });
+            } catch (e) {
+                // The daemon is authoritative either way, so re-read before
+                // reporting. A declined prompt is not an error and does not come
+                // through here at all; this is a prompt that could not be raised,
+                // which carries the command that would have done it.
+                await reload(cur.profileName);
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: errorMessage(e),
+                    Command: errorCommand(e),
+                });
+                return;
+            }
+            // Either the change went through or the user declined it. The daemon
+            // says which.
+            await reload(cur.profileName);
+        },
+        [username, save, reload],
+    );
+
     const saveFields = useCallback(
         async (partial: Partial<Config>, opts?: { preSharedKey?: string }) => {
             if (!loaded) return;
@@ -225,15 +301,27 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
-    return { config: loaded?.data ?? null, guiVersion, setField, saveField, saveFields, saveNow };
+    return {
+        config: loaded?.data ?? null,
+        guiVersion,
+        setField,
+        saveField,
+        saveFields,
+        saveGuardedField,
+        saveNow,
+    };
 };
 
 export const SettingsProvider = ({ children }: { children: ReactNode }) => {
-    const { config, guiVersion, setField, saveField, saveFields, saveNow } = useSettingsState();
+    const { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow } =
+        useSettingsState();
 
     const value = useMemo<SettingsContextValue | null>(
-        () => (config ? { config, guiVersion, setField, saveField, saveFields, saveNow } : null),
-        [config, guiVersion, setField, saveField, saveFields, saveNow],
+        () =>
+            config
+                ? { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow }
+                : null,
+        [config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow],
     );
 
     if (!value) {

client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts

@@ -1,35 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { Preferences } from "@bindings/services";
-
-export const useKeepConnectedOnQuit = () => {
-    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
-
-    useEffect(() => {
-        let cancelled = false;
-        Preferences.Get()
-            .then((prefs) => {
-                if (cancelled) return;
-                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
-            })
-            .catch((err: unknown) => {
-                if (cancelled) return;
-                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
-                setKeepConnected(false);
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, []);
-
-    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
-        setKeepConnected(keep);
-        try {
-            await Preferences.SetKeepConnectedOnQuit(keep);
-        } catch (err: unknown) {
-            setKeepConnected(!keep);
-            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
-        }
-    }, []);
-
-    return { keepConnected, setKeepConnectedOnQuit };
-};

client/ui/frontend/src/hooks/usePrivilege.ts

@@ -1,6 +1,6 @@
 import { useEffect, useState } from "react";
 import { Settings as SettingsSvc } from "@bindings/services";
-import { Privilege } from "@bindings/services/models.js";
+import { type Privilege } from "@bindings/services/models.js";
 
 // usePrivilege reports whether this UI process may perform the changes the daemon
 // restricts to root/administrator. It is answered in-process from our own token

client/ui/frontend/src/modules/settings/SettingsGeneral.tsx

@@ -11,7 +11,6 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
-import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
 export function SettingsGeneral() {
     const { t } = useTranslation();
@@ -20,7 +19,6 @@ export function SettingsGeneral() {
     const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
         useManagementUrl();
     const { mdm, features } = useRestrictions();
-    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
 
     const inputRef = useRef<HTMLInputElement>(null);
     const managementUrlId = useId();
@@ -59,15 +57,6 @@ export function SettingsGeneral() {
                         helpText={t("settings.general.autostart.help")}
                     />
                 )}
-                <FancyToggleSwitch
-                    value={keepConnected ?? false}
-                    onChange={(v) => {
-                        void setKeepConnectedOnQuit(v);
-                    }}
-                    loading={keepConnected === null}
-                    label={t("settings.general.keepConnectedOnQuit.label")}
-                    helpText={t("settings.general.keepConnectedOnQuit.help")}
-                />
             </SectionGroup>
 
             {!mdm.managementURL && !features.disableUpdateSettings && (

client/ui/frontend/src/modules/settings/SettingsSSH.tsx

@@ -1,3 +1,4 @@
+import { type TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
 import { CopyToClipboard } from "@/components/CopyToClipboard";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
@@ -6,51 +7,91 @@ import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { cn } from "@/lib/cn";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
-import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { type GuardedField, useSettings } from "@/contexts/SettingsContext.tsx";
 import { usePrivilege } from "@/hooks/usePrivilege.ts";
-import { Privilege } from "@bindings/services/models.js";
+import type { Privilege } from "@bindings/services/models.js";
 import { type ChangeEvent, type ReactNode, useEffect, useId, useState } from "react";
 
 export function SettingsSSH() {
     const { t } = useTranslation();
-    const { config, setField } = useSettings();
+    const { config, setField, saveGuardedField } = useSettings();
     const privilege = usePrivilege();
+    // The field whose elevation prompt is currently up, if any. The prompt is
+    // modal to the operating system, not to us, so the guarded controls are held
+    // still meanwhile rather than allowed to stack a second one behind it.
+    const [authorizing, setAuthorizing] = useState<GuardedField | null>(null);
     const isSSHServerEnabled = config.serverSshAllowed;
 
+    const authorize = async (field: GuardedField, value: boolean) => {
+        setAuthorizing(field);
+        try {
+            await saveGuardedField(field, value);
+        } finally {
+            setAuthorizing(null);
+        }
+    };
+
     // The daemon restricts only the direction that hands out shells from a process
-    // running as root. So for an unprivileged user a guarded control is either
-    // unavailable (it is off and only they could turn it on) or a one-way switch
-    // (it is on, they may turn it off, but not back on) — say which, either way.
+    // running as root: for all three settings that is switching the field on.
+    //
+    // An unprivileged user gets that direction routed through the platform's
+    // elevation prompt where there is one to raise, and otherwise the old
+    // arrangement, where the control is either unavailable (it is off and only a
+    // privileged caller could turn it on) or a one-way switch (it is on, they may
+    // turn it off but not back on) with the command that does it.
     //
     // A null privilege means we could not determine it: leave the control alone
     // rather than greying it out with nothing to explain why. The daemon enforces
     // this regardless, and a rejected save reports its own guidance.
     const guarded = (
-        guardedDirectionActive: boolean,
+        field: GuardedField,
         command: (p: Privilege) => string,
         // inverted marks a control whose guarded direction is switching it off, so
         // the one-way warning has to read the other way round.
         inverted = false,
     ) => {
+        const plain = (value: boolean) => setField(field, value);
         if (!privilege || privilege.privileged) {
-            return { disabled: false, hint: undefined };
+            return { apply: plain, disabled: false, hint: undefined };
         }
-        const hint = (
-            <PrivilegeHint
-                actor={privilege.actor}
-                command={command(privilege)}
+
+        const guardedDirectionActive = config[field];
+        const hint = (pending: boolean, command?: string) => (
+            <GuardedHint
+                actor={actorLabel(privilege, t)}
                 oneWay={guardedDirectionActive}
                 inverted={inverted}
+                pending={pending}
+                command={command}
             />
         );
-        return { disabled: !guardedDirectionActive, hint };
+
+        if (privilege.canElevate) {
+            return {
+                // Switching off is ours to do; only switching on is authorized.
+                apply: (value: boolean) => {
+                    if (!value) {
+                        plain(value);
+                        return;
+                    }
+                    void authorize(field, value);
+                },
+                disabled: authorizing !== null,
+                hint: hint(authorizing === field),
+            };
+        }
+        return {
+            apply: plain,
+            disabled: !guardedDirectionActive,
+            hint: hint(false, command(privilege)),
+        };
     };
 
-    const sshServer = guarded(config.serverSshAllowed, (p) => p.allowSshServer);
-    const sshRoot = guarded(config.enableSshRoot, (p) => p.enableSshRoot);
+    const sshServer = guarded("serverSshAllowed", (p) => p.allowSshServer);
+    const sshRoot = guarded("enableSshRoot", (p) => p.enableSshRoot);
     // Inverted control: the guarded direction is switching authentication off, so
     // it is the already-disabled state that is the one-way one.
-    const sshAuth = guarded(config.disableSshAuth, (p) => p.disableSshAuth, true);
+    const sshAuth = guarded("disableSshAuth", (p) => p.disableSshAuth, true);
     const jwtTtlId = useId();
     const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));
 
@@ -84,7 +125,7 @@ export function SettingsSSH() {
             <SectionGroup title={t("settings.ssh.section.server")}>
                 <FancyToggleSwitch
                     value={config.serverSshAllowed}
-                    onChange={(v) => setField("serverSshAllowed", v)}
+                    onChange={sshServer.apply}
                     disabled={sshServer.disabled}
                     label={t("settings.ssh.server.label")}
                     helpText={t("settings.ssh.server.help")}
@@ -98,7 +139,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={config.enableSshRoot}
-                    onChange={(v) => setField("enableSshRoot", v)}
+                    onChange={sshRoot.apply}
                     disabled={sshRoot.disabled}
                     label={t("settings.ssh.root.label")}
                     helpText={t("settings.ssh.root.help")}
@@ -130,7 +171,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={!config.disableSshAuth}
-                    onChange={(v) => setField("disableSshAuth", !v)}
+                    onChange={(v) => sshAuth.apply(!v)}
                     disabled={sshAuth.disabled}
                     label={t("settings.ssh.jwt.label")}
                     helpText={t("settings.ssh.jwt.help")}
@@ -163,41 +204,81 @@ export function SettingsSSH() {
     );
 }
 
-// PrivilegeHint explains what an unprivileged user can and cannot do with a
-// guarded control, and offers the command that does it with the privileges the
-// daemon requires. oneWay covers the control being in the guarded state already:
-// switching it back is the part that needs privileges.
-function PrivilegeHint({
+// actorLabel names the principal the daemon requires, in the user's language. The
+// Go side reports which one it is rather than wording it, because "administrator
+// privileges" is English and a translated sentence cannot borrow it.
+function actorLabel(privilege: Privilege, t: TFunction): string {
+    return privilege.actorKey === "administrator"
+        ? t("settings.ssh.privilege.actorAdministrator")
+        : t("settings.ssh.privilege.actorRoot");
+}
+
+// GuardedHint is what a control the daemon guards says to an unprivileged user.
+// There are three things worth saying, and it says at most one:
+//
+//   - A prompt is open. Worth a line because it can take a few seconds to appear,
+//     long enough that a control which merely went inert would read as a hang.
+//   - The setting is in its guarded state already (oneWay), so the user may switch
+//     it back as they please and it is switching it away again that will ask. No
+//     command either way: the direction they can take is theirs to take.
+//   - Only a privileged caller can move it at all, and there is no prompt to
+//     raise: the command that does it belongs here, and nothing else will do.
+//
+// Which leaves the case of a control whose guarded direction is still ahead of the
+// user and a prompt that can be raised for it: nothing to say, because clicking it
+// raises the prompt and the prompt explains itself.
+function GuardedHint({
     actor,
-    command,
     oneWay,
     inverted,
+    pending,
+    command,
 }: {
     actor: string;
-    command: string;
     oneWay: boolean;
     inverted: boolean;
+    pending: boolean;
+    command?: string;
 }): ReactNode {
     const { t } = useTranslation();
+
+    if (pending) {
+        return <HintBox>{t("settings.ssh.privilege.authorizePending")}</HintBox>;
+    }
+    if (oneWay) {
+        return (
+            <HintBox>
+                <span>
+                    {inverted
+                        ? t("settings.ssh.privilege.oneWayInverted", { actor })
+                        : t("settings.ssh.privilege.oneWay", { actor })}
+                </span>
+            </HintBox>
+        );
+    }
     if (!command) return null;
+    return (
+        <HintBox>
+            <span>{t("settings.ssh.privilege.hint", { actor })}</span>
+            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
+                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
+                    {command}
+                </code>
+            </CopyToClipboard>
+        </HintBox>
+    );
+}
+
+// HintBox is the box a guarded control puts its explanation in, directly under the
+// control it belongs to.
+function HintBox({ children }: { children: ReactNode }): ReactNode {
     return (
         <div
             className={
                 "-mt-2 flex flex-col gap-1 rounded-md bg-nb-gray-930 px-3 py-2 text-xs text-nb-gray-300"
             }
         >
-            <span>
-                {!oneWay
-                    ? t("settings.ssh.privilege.hint", { actor })
-                    : inverted
-                      ? t("settings.ssh.privilege.oneWayInverted", { actor })
-                      : t("settings.ssh.privilege.oneWay", { actor })}
-            </span>
-            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
-                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
-                    {command}
-                </code>
-            </CopyToClipboard>
+            {children}
         </div>
     );
 }

client/ui/i18n/locales/de/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Alle sichtbaren Ressourcen umschalten"
     },
-    "settings.nav.label": {
-        "message": "Einstellungsbereiche"
-    },
     "profile.switch.title": {
         "message": "Zu Profil \"{name}\" wechseln?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Debug-Paket fehlgeschlagen"
     },
+    "settings.nav.label": {
+        "message": "Einstellungsbereiche"
+    },
     "settings.tabs.general": {
         "message": "Allgemein"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Ändern des Autostarts fehlgeschlagen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Nach dem Beenden verbunden bleiben",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Anzeigesprache"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird konnte auf diesem System nicht die nötigen Rechte anfordern. Führen Sie stattdessen dies aus:"
+    },
+    "error.elevation_failed": {
+        "message": "Die Änderung konnte mit erhöhten Rechten nicht angewendet werden. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root-Rechte"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "Administratorrechte"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Sie können dies deaktivieren, zum erneuten Aktivieren sind {actor} erforderlich."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Sie können dies aktivieren, zum erneuten Deaktivieren sind {actor} erforderlich."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Warten auf Autorisierung…"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -735,14 +735,6 @@
         "message": "Autostart Change Failed",
         "description": "Error-dialog title when changing the autostart setting fails."
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Stay Connected After Quitting",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Display Language",
         "description": "Label for the display-language picker."
@@ -1783,16 +1775,36 @@
         "message": "Operation failed.",
         "description": "Generic fallback error message used when no specific error applies."
     },
+    "error.elevation_unavailable": {
+        "message": "NetBird could not ask this system for the privileges the change needs. Run this instead:",
+        "description": "Error: this computer has no way to prompt for elevated privileges. Followed by a copyable command that applies the setting from a terminal."
+    },
+    "error.elevation_failed": {
+        "message": "The change could not be applied with elevated privileges. Run this instead:",
+        "description": "Error: the authorization succeeded but applying the setting afterwards failed. Followed by a copyable command that applies the setting from a terminal."
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root",
+        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Linux, macOS and BSD, where the daemon requires the root account. 'root' is an account name and stays as it is; add the word for privileges or rights around it if the sentence needs one to read naturally."
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "administrator privileges",
+        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Windows, where the daemon requires an elevated administrator. The Windows term for the rights an account is asked to elevate to."
+    },
     "settings.ssh.privilege.hint": {
         "message": "Requires {actor}. Run this instead:",
         "description": "Help text under an SSH setting the user cannot change: it needs elevated privileges. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     },
     "settings.ssh.privilege.oneWay": {
-        "message": "You can switch this off, but switching it back on needs {actor}:",
-        "description": "Warning under an SSH setting an unprivileged user may disable but not re-enable. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
+        "message": "You can switch this off, but switching it back on needs {actor}.",
+        "description": "Help text under an SSH setting that is already on: an unprivileged user may switch it off freely, and switching it on again is what needs the privileges. No command follows, since the direction they can take is theirs to take. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows."
     },
     "settings.ssh.privilege.oneWayInverted": {
-        "message": "You can switch this on, but switching it back off needs {actor}:",
-        "description": "Warning under the SSH authentication setting, which an unprivileged user may re-enable but not disable again. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
+        "message": "You can switch this on, but switching it back off needs {actor}.",
+        "description": "Same as settings.ssh.privilege.oneWay, for the SSH authentication setting once it has been switched off: switching it off again is what needs the privileges."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Waiting for authorization…",
+        "description": "Replaces the help text under a guarded SSH setting while the authorization prompt is open, which can take a few seconds to appear. Keep the trailing ellipsis."
     }
 }

client/ui/i18n/locales/es/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Conmutar todos los recursos visibles"
     },
-    "settings.nav.label": {
-        "message": "Secciones de configuración"
-    },
     "profile.switch.title": {
         "message": "¿Cambiar el perfil a «{name}»?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Error en el paquete de diagnóstico"
     },
+    "settings.nav.label": {
+        "message": "Secciones de configuración"
+    },
     "settings.tabs.general": {
         "message": "General"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Error al cambiar el inicio automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado al salir",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de la interfaz"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "La operación falló."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird no pudo solicitar a este sistema los privilegios necesarios. Ejecute esto en su lugar:"
+    },
+    "error.elevation_failed": {
+        "message": "No se pudo aplicar el cambio con privilegios elevados. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "privilegios de root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilegios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requiere {actor}. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Esperando la autorización…"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Activer/désactiver toutes les ressources visibles"
     },
-    "settings.nav.label": {
-        "message": "Sections des paramètres"
-    },
     "profile.switch.title": {
         "message": "Basculer vers le profil « {name} » ?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Échec du lot de diagnostic"
     },
+    "settings.nav.label": {
+        "message": "Sections des paramètres"
+    },
     "settings.tabs.general": {
         "message": "Général"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Échec de la modification du démarrage automatique"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Rester connecté après la fermeture",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Langue d’affichage"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird n’a pas pu demander à ce système les privilèges nécessaires. Exécutez plutôt ceci :"
+    },
+    "error.elevation_failed": {
+        "message": "La modification n’a pas pu être appliquée avec des privilèges élevés. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "les privilèges root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "les privilèges administrateur"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "En attente de l’autorisation…"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Összes látható erőforrás be/ki"
     },
-    "settings.nav.label": {
-        "message": "Beállítások szakaszai"
-    },
     "profile.switch.title": {
         "message": "Váltás a(z) \"{name}\" profilra?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Hibakeresési csomag sikertelen"
     },
+    "settings.nav.label": {
+        "message": "Beállítások szakaszai"
+    },
     "settings.tabs.general": {
         "message": "Általános"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Az automatikus indítás módosítása sikertelen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Kapcsolat megtartása kilépéskor",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Megjelenítési nyelv"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
+    },
+    "error.elevation_unavailable": {
+        "message": "A NetBird nem tudta bekérni a rendszertől a szükséges jogosultságokat. Futtassa inkább ezt:"
+    },
+    "error.elevation_failed": {
+        "message": "A módosítást emelt szintű jogosultságokkal sem sikerült alkalmazni. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root jogosultság"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "rendszergazdai jogosultság"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Várakozás az engedélyezésre…"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Attiva/disattiva tutte le risorse visibili"
     },
-    "settings.nav.label": {
-        "message": "Sezioni delle impostazioni"
-    },
     "profile.switch.title": {
         "message": "Passare al profilo «{name}»?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Pacchetto di debug non riuscito"
     },
+    "settings.nav.label": {
+        "message": "Sezioni delle impostazioni"
+    },
     "settings.tabs.general": {
         "message": "Generale"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Modifica avvio automatico non riuscita"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Resta connesso dopo la chiusura",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Lingua dell'interfaccia"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird non ha potuto richiedere a questo sistema i privilegi necessari. Esegua invece questo:"
+    },
+    "error.elevation_failed": {
+        "message": "Non è stato possibile applicare la modifica con privilegi elevati. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "i privilegi di root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "i privilegi di amministratore"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Richiede {actor}. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "In attesa dell'autorizzazione…"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "自動起動の変更に失敗しました"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "終了後も接続を維持",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "表示言語"
     },
@@ -1312,6 +1304,9 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
+    "daemon.outdated.download": {
+        "message": "最新版をダウンロード"
+    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },
@@ -1335,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird はこのシステムに必要な権限を要求できませんでした。代わりに次のコマンドを実行してください:"
+    },
+    "error.elevation_failed": {
+        "message": "昇格した権限でも変更を適用できませんでした。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root 権限"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "管理者権限"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "無効にはできますが、再度有効にするには{actor}が必要です。"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "有効にはできますが、再度無効にするには{actor}が必要です。"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "承認を待っています…"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Alternar todos os recursos visíveis"
     },
-    "settings.nav.label": {
-        "message": "Seções das configurações"
-    },
     "profile.switch.title": {
         "message": "Alternar perfil para \"{name}\"?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Falha no pacote de depuração"
     },
+    "settings.nav.label": {
+        "message": "Seções das configurações"
+    },
     "settings.tabs.general": {
         "message": "Geral"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Falha ao alterar o início automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado ao sair",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de exibição"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
+    },
+    "error.elevation_unavailable": {
+        "message": "O NetBird não conseguiu solicitar a este sistema os privilégios necessários. Execute isto em vez disso:"
+    },
+    "error.elevation_failed": {
+        "message": "Não foi possível aplicar a alteração com privilégios elevados. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "privilégios de root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilégios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requer {actor}. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Você pode desativar isto, mas ativar novamente requer {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Você pode ativar isto, mas desativar novamente requer {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Aguardando a autorização…"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "Переключить все видимые ресурсы"
     },
-    "settings.nav.label": {
-        "message": "Разделы настроек"
-    },
     "profile.switch.title": {
         "message": "Переключиться на профиль «{name}»?"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "Не удалось создать отладочный пакет"
     },
+    "settings.nav.label": {
+        "message": "Разделы настроек"
+    },
     "settings.tabs.general": {
         "message": "Общие"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Не удалось изменить автозапуск"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Оставаться подключённым после выхода",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Язык интерфейса"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird не смог запросить у этой системы нужные права. Выполните вместо этого:"
+    },
+    "error.elevation_failed": {
+        "message": "Не удалось применить изменение с повышенными правами. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "права root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "права администратора"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Требуются {actor}. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Отключить можно, но чтобы включить снова, нужны {actor}."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Включить можно, но чтобы отключить снова, нужны {actor}."
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Ожидание авторизации…"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -401,9 +401,6 @@
     "networks.bulk.label": {
         "message": "切换所有可见资源"
     },
-    "settings.nav.label": {
-        "message": "设置部分"
-    },
     "profile.switch.title": {
         "message": "切换到配置文件“{name}”？"
     },
@@ -497,6 +494,9 @@
     "settings.error.debugBundleTitle": {
         "message": "创建调试包失败"
     },
+    "settings.nav.label": {
+        "message": "设置部分"
+    },
     "settings.tabs.general": {
         "message": "常规"
     },
@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "更改自启动设置失败"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "退出后保持连接",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "显示语言"
     },
@@ -1338,5 +1330,29 @@
     },
     "error.unknown": {
         "message": "操作失败。"
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird 无法向此系统请求所需的权限。请改为运行："
+    },
+    "error.elevation_failed": {
+        "message": "即使使用提升的权限也无法应用此更改。请改为运行："
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root 权限"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "管理员权限"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "需要{actor}。请改为运行："
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "您可以关闭此项，但重新开启需要{actor}。"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "您可以开启此项，但再次关闭需要{actor}。"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "正在等待授权…"
     }
 }

client/ui/main.go

@@ -8,6 +8,7 @@ import (
 	"flag"
 	"io/fs"
 	"log"
+	"os"
 	"runtime"
 	"strings"
 
@@ -79,6 +80,14 @@ func init() {
 }
 
 func main() {
+	// The one-shot that applies the settings the daemon restricts to
+	// root/administrator, which this binary runs itself as under the platform's
+	// elevation prompt. Handled before anything GUI so no window, tray or
+	// single-instance lock is involved.
+	if services.IsPrivilegedSettingsRun(os.Args[1:]) {
+		os.Exit(runPrivilegedSettings(os.Args[1:]))
+	}
+
 	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
 	conn := NewConn(daemonAddr)
 
@@ -180,7 +189,6 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
-		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)
 

client/ui/preferences/store.go

@@ -58,10 +58,6 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
-	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
-	// Its false zero value preserves the historical disconnect-on-quit
-	// behaviour for preference files written before the field existed.
-	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -187,26 +183,6 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }
 
-// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
-func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
-	s.mu.Lock()
-	if s.current.KeepConnectedOnQuit == keep {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.KeepConnectedOnQuit = keep
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {

client/ui/preferences/store_test.go

@@ -238,42 +238,6 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }
 
-func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
-
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
-}
-
-func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
-	withTempConfigDir(t)
-
-	// A preferences file written before the field existed must keep the
-	// historical disconnect-on-quit behaviour rather than silently opting out.
-	path, err := preferencesPath()
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
-
-	s, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
-	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
-}
-
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)
 

client/ui/privileged_settings.go

@@ -0,0 +1,27 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// The one-shot mode this binary runs itself in, elevated, to apply the settings the
+// daemon restricts to root/administrator. It is handled before anything GUI, so no
+// window, tray or single-instance lock is involved.
+//
+// Only the wiring is here: what the mode accepts and does lives beside the code
+// that asks for it, in services.RunPrivilegedSettings, so the settings it will
+// apply are declared once. There is nothing privileged about the mode itself; it
+// sends the same request the frontend would have sent, and the daemon authorizes it
+// from the identity the kernel reports on the control channel exactly as it does
+// for `sudo netbird up`.
+func runPrivilegedSettings(args []string) int {
+	return services.RunPrivilegedSettings(args, func(addr string) (proto.DaemonServiceClient, error) {
+		if addr == "" {
+			addr = DaemonAddr()
+		}
+		return NewConn(addr).Client()
+	})
+}

client/ui/services/cursor_linux.go

@@ -49,11 +49,5 @@ func getCursorPosition(app *application.App) (application.Point, bool) {
 	if app == nil || app.Screen == nil {
 		return p, true
 	}
-	// The wails GTK3 backend caches screens from the active window; a tray app
-	// has none at startup, so the cache is empty and PhysicalToDipPoint would
-	// dereference a nil nearest screen. Raw pixels are correct there anyway.
-	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
-		return p, true
-	}
 	return app.Screen.PhysicalToDipPoint(p), true
 }

client/ui/services/guarded.go

@@ -0,0 +1,231 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// The command line of the one-shot mode this binary runs itself in, elevated, to
+// apply a setting the daemon restricts to root/administrator. The setting flags
+// spell the same words as `netbird up`, so the command a user is shown and what
+// runs behind the prompt read alike. Parsed in oneshot.go.
+const (
+	FlagApplyPrivilegedSettings = "apply-privileged-settings"
+	FlagDaemonAddr              = "daemon-addr"
+	FlagProfile                 = "profile"
+	FlagUser                    = "user"
+	FlagLogLevel                = "log-level"
+	FlagManagementURL           = "management-url"
+	FlagAllowServerSSH          = "allow-server-ssh"
+	FlagEnableSSHRoot           = "enable-ssh-root"
+	FlagDisableSSHAuth          = "disable-ssh-auth"
+)
+
+// Error codes for the ways asking for privileges can fail.
+const (
+	CodeElevationUnavailable = "elevation_unavailable"
+	CodeElevationFailed      = "elevation_failed"
+)
+
+// elevationTimeout bounds the wait for a prompt and the change behind it, so a
+// dialog nobody answers does not leave its control disabled for the session. Long
+// enough to find a password manager, and no shorter than the platforms' own prompt
+// timeouts: Windows gives up on its consent dialog after two minutes by itself.
+//
+// It always ends our waiting, and not always the prompt: Security.framework offers
+// no way to withdraw a request, so on macOS the system's own timeout is what closes
+// the dialog.
+const elevationTimeout = 5 * time.Minute
+
+// elevator raises the platform's privilege prompt and runs the change behind it.
+// An interface so tests can answer without a prompt.
+type elevator interface {
+	// Run runs this binary again, elevated, with the given arguments.
+	Run(ctx context.Context, args ...string) error
+	// Available reports whether there is a prompt to raise on this host at all.
+	Available() bool
+}
+
+// osElevator is the real thing: see the elevate package.
+type osElevator struct{}
+
+func (osElevator) Run(ctx context.Context, args ...string) error {
+	return elevate.Run(ctx, args...)
+}
+
+func (osElevator) Available() bool {
+	return elevate.Available()
+}
+
+// SaveOutcome reports what became of a change that needed authorization.
+//
+// A declined prompt is a result, not an error: the user was asked and said no, so
+// nothing was applied and nothing went wrong. Reporting it as an error would have
+// every cancelled prompt logged as one.
+type SaveOutcome struct {
+	// Declined is set when the user dismissed the authorization prompt, or was
+	// refused by policy. Nothing was changed.
+	Declined bool `json:"declined"`
+}
+
+// GuardedSettings is the subset of the config the daemon restricts to
+// root/administrator. Only the fields that are set are changed: a nil pointer, or
+// an empty management URL, leaves that setting alone.
+//
+// The management URL is in here because pointing a host with the SSH server
+// running at another management identity hands the decision of who may open a
+// shell on it to whoever runs that server, which is the same power as enabling
+// the SSH server in the first place.
+type GuardedSettings struct {
+	ProfileName      string `json:"profileName"`
+	Username         string `json:"username"`
+	ManagementURL    string `json:"managementUrl,omitempty"`
+	ServerSSHAllowed *bool  `json:"serverSshAllowed,omitempty"`
+	EnableSSHRoot    *bool  `json:"enableSshRoot,omitempty"`
+	DisableSSHAuth   *bool  `json:"disableSshAuth,omitempty"`
+}
+
+// guardedSetting is one setting to change, in the two spellings this needs: the
+// one-shot's own flag, and the `netbird up` flag that does the same thing from a
+// terminal, for when there is no prompt to raise.
+type guardedSetting struct {
+	arg  string
+	flag string
+}
+
+// SetGuardedSettings applies settings the daemon refuses from an unprivileged
+// caller, by having the operating system run this binary again, elevated, to send
+// the same request the frontend would have sent itself.
+//
+// The user authorizes it at the platform's own prompt: the UAC consent dialog,
+// the macOS authentication dialog, or the polkit agent's. Any credentials are the
+// operating system's business; NetBird neither sees nor asks for them. Nothing
+// about the daemon's rules changes, and the elevated process is authorized like
+// any other privileged caller, from the identity the kernel reports for it.
+//
+// A declined prompt comes back as SaveOutcome.Declined with no error. When there is
+// no prompt to raise, or the elevated run failed, the error carries the command
+// that does the same thing from a terminal.
+func (s *Settings) SetGuardedSettings(ctx context.Context, p GuardedSettings) (SaveOutcome, error) {
+	settings := guardedSettings(p)
+	if len(settings) == 0 {
+		return SaveOutcome{}, &ClientError{
+			Code:  CodeElevationFailed,
+			Short: "no setting to apply",
+			Long:  "no setting to apply",
+		}
+	}
+
+	// The elevated run has no window and, on Linux, an environment pkexec has
+	// cleared, so what it writes to stderr is all there is to go on. It follows
+	// this process's level so that starting the app with --log-level debug says
+	// something about the run behind the prompt too.
+	args := append([]string{
+		"--" + FlagApplyPrivilegedSettings,
+		"--" + FlagDaemonAddr, s.daemonAddr,
+		"--" + FlagProfile, p.ProfileName,
+		"--" + FlagUser, p.Username,
+		"--" + FlagLogLevel, log.GetLevel().String(),
+	}, oneShotArgs(settings)...)
+
+	ctx, cancel := context.WithTimeout(ctx, elevationTimeout)
+	defer cancel()
+
+	// These changes hand out shells on this host, so both ends are logged: when the
+	// prompt went up, and what came of it. It is also the only account of a prompt
+	// that was slow to appear or never answered.
+	log.Infof("asking for privileges to apply %s", guardedSummary(p))
+
+	if err := s.elevator.Run(ctx, args...); err != nil {
+		return s.elevationOutcome(err, p)
+	}
+
+	log.Infof("applied %s with the privileges the user authorized", guardedSummary(p))
+	return SaveOutcome{}, nil
+}
+
+// elevationOutcome sorts what came back into the one normal ending and the two
+// that need reporting, with the command that does the same thing by hand.
+func (s *Settings) elevationOutcome(err error, p GuardedSettings) (SaveOutcome, error) {
+	switch {
+	case errors.Is(err, elevate.ErrDeclined):
+		// With the reason: an account that may not elevate at all lands here too,
+		// and the log is the only place that says which it was.
+		log.Infof("the elevation prompt for %s was declined: %v", guardedSummary(p), err)
+		return SaveOutcome{Declined: true}, nil
+	case errors.Is(err, elevate.ErrUnavailable):
+		log.Warnf("cannot ask for privileges to apply %s: %v", guardedSummary(p), err)
+		return SaveOutcome{}, &ClientError{
+			Code:    CodeElevationUnavailable,
+			Short:   s.classifier.translateShort(CodeElevationUnavailable),
+			Long:    err.Error(),
+			Command: guardedCommand(p),
+		}
+	default:
+		log.Errorf("applying %s with elevated privileges failed: %v", guardedSummary(p), err)
+		return SaveOutcome{}, &ClientError{
+			Code:    CodeElevationFailed,
+			Short:   s.classifier.translateShort(CodeElevationFailed),
+			Long:    err.Error(),
+			Command: guardedCommand(p),
+		}
+	}
+}
+
+// guardedSettings renders the settings that are actually being changed, from the
+// same table the one-shot parses them with: see oneshot.go.
+func guardedSettings(p GuardedSettings) []guardedSetting {
+	var settings []guardedSetting
+	for _, field := range guardedFields {
+		value, ok := field.read(p)
+		if !ok {
+			continue
+		}
+		settings = append(settings, guardedSetting{
+			arg:  "--" + field.flag + "=" + value,
+			flag: field.up(value),
+		})
+	}
+	return settings
+}
+
+func oneShotArgs(settings []guardedSetting) []string {
+	args := make([]string, 0, len(settings))
+	for _, setting := range settings {
+		args = append(args, setting.arg)
+	}
+	return args
+}
+
+func upFlags(settings []guardedSetting) []string {
+	flags := make([]string, 0, len(settings))
+	for _, setting := range settings {
+		flags = append(flags, setting.flag)
+	}
+	return flags
+}
+
+// guardedCommand is the elevated command line equivalent to the requested
+// change, the same shape the daemon names in its own refusals.
+func guardedCommand(p GuardedSettings) string {
+	settings := guardedSettings(p)
+	if len(settings) == 0 {
+		return ""
+	}
+	return ipcauth.UpCommand(strings.Join(upFlags(settings), " "))
+}
+
+// guardedSummary names the change for the log.
+func guardedSummary(p GuardedSettings) string {
+	return fmt.Sprintf("%v for profile %q", oneShotArgs(guardedSettings(p)), p.ProfileName)
+}

client/ui/services/guarded_test.go

@@ -0,0 +1,355 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A Unix socket, so the daemon address is one that carries a caller's identity and
+// elevation is worth offering at all: see Settings.canElevate.
+const testDaemonAddr = "unix:///var/run/netbird.sock"
+
+// storedManagementURL is what the stub daemon already holds, so that a request
+// naming a different one is a change: see Settings.guardedChanges.
+const storedManagementURL = "https://stored.example.com"
+
+// stubElevator stands in for the platform's prompt: it records what would have run
+// and answers with a fixed outcome.
+type stubElevator struct {
+	outcome   error
+	available bool
+	calls     [][]string
+}
+
+func (e *stubElevator) Run(_ context.Context, args ...string) error {
+	e.calls = append(e.calls, args)
+	return e.outcome
+}
+
+func (e *stubElevator) Available() bool { return e.available }
+
+// stubDaemon implements only the RPCs under test. The embedded interface is nil, so
+// any other call panics rather than passing quietly.
+type stubDaemon struct {
+	proto.DaemonServiceClient
+	setConfig func(*proto.SetConfigRequest) error
+	// stored is what GetConfig reports, which is what a refused request's guarded
+	// settings are compared against.
+	stored   *proto.GetConfigResponse
+	requests []*proto.SetConfigRequest
+}
+
+func (d *stubDaemon) SetConfig(_ context.Context, in *proto.SetConfigRequest, _ ...grpc.CallOption) (*proto.SetConfigResponse, error) {
+	d.requests = append(d.requests, in)
+	if err := d.setConfig(in); err != nil {
+		return nil, err
+	}
+	return &proto.SetConfigResponse{}, nil
+}
+
+func (d *stubDaemon) GetConfig(_ context.Context, _ *proto.GetConfigRequest, _ ...grpc.CallOption) (*proto.GetConfigResponse, error) {
+	return d.stored, nil
+}
+
+type stubConn struct{ client proto.DaemonServiceClient }
+
+func (c stubConn) Client() (proto.DaemonServiceClient, error) { return c.client, nil }
+
+// privilegeRefusal is the error the daemon raises for a change it restricts to
+// root, detail and all: see server.privilegeError.
+func privilegeRefusal(t *testing.T) error {
+	t.Helper()
+
+	st, err := gstatus.New(codes.PermissionDenied, "Changing the management URL requires root.").
+		WithDetails(&errdetails.ErrorInfo{
+			Reason: ipcauth.ErrorReasonPrivilegeRequired,
+			Domain: ipcauth.ErrorDomain,
+			Metadata: map[string]string{
+				ipcauth.ErrorMetaSummary: "Changing the management URL requires root.",
+				ipcauth.ErrorMetaCommand: "sudo netbird down; sudo netbird up -m https://mgmt.example.com",
+			},
+		})
+	require.NoError(t, err, "build the refusal detail")
+	return st.Err()
+}
+
+func settingsWithElevation(t *testing.T, outcome error) (*Settings, *stubElevator) {
+	t.Helper()
+
+	elev := &stubElevator{outcome: outcome, available: true}
+	return &Settings{daemonAddr: testDaemonAddr, elevator: elev}, elev
+}
+
+// settingsRefusingOnce returns a Settings whose daemon refuses the first SetConfig
+// for want of privileges and accepts anything after it. Its stored config holds
+// another management server and no SSH grants, so a request naming either is a
+// change rather than a restatement.
+func settingsRefusingOnce(t *testing.T, elev *stubElevator) (*Settings, *stubDaemon) {
+	t.Helper()
+
+	refusal := privilegeRefusal(t)
+	daemon := &stubDaemon{stored: &proto.GetConfigResponse{ManagementUrl: storedManagementURL}}
+	daemon.setConfig = func(*proto.SetConfigRequest) error {
+		if len(daemon.requests) == 1 {
+			return refusal
+		}
+		return nil
+	}
+	return &Settings{conn: stubConn{client: daemon}, daemonAddr: testDaemonAddr, elevator: elev}, daemon
+}
+
+func TestSetGuardedSettingsPassesOnlyTheChangedSettings(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	root := true
+	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "work",
+		Username:      "vma",
+		EnableSSHRoot: &root,
+	})
+	require.NoError(t, err)
+	assert.False(t, outcome.Declined, "the prompt was answered")
+
+	want := []string{
+		"--" + FlagApplyPrivilegedSettings,
+		"--" + FlagDaemonAddr, testDaemonAddr,
+		"--" + FlagProfile, "work",
+		"--" + FlagUser, "vma",
+		"--" + FlagLogLevel, log.GetLevel().String(),
+		"--" + FlagEnableSSHRoot + "=true",
+	}
+	require.Len(t, elev.calls, 1, "one prompt for one change")
+	assert.Equal(t, want, elev.calls[0], "elevated arguments")
+
+	// argv[1] is what the polkit action is pinned to, so the marker has to stay
+	// first however the rest of the line grows.
+	assert.Equal(t, "--"+FlagApplyPrivilegedSettings, elev.calls[0][0], "the flag polkit matches on")
+}
+
+// Turning a setting off has to be as explicit as turning it on: a bare flag would
+// read as "on" to the one-shot's parser.
+func TestSetGuardedSettingsSpellsOutFalse(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	off := false
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:      "default",
+		ServerSSHAllowed: &off,
+		DisableSSHAuth:   &off,
+	})
+	require.NoError(t, err)
+
+	args := elev.calls[0]
+	assert.Contains(t, args, "--"+FlagAllowServerSSH+"=false", "the setting being switched off")
+	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=false", "the setting being switched off")
+	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "no flag for a setting nobody touched")
+}
+
+func TestSetGuardedSettingsPassesTheManagementURL(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com:33073",
+	})
+	require.NoError(t, err)
+
+	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com:33073",
+		"the management URL to point the profile at")
+}
+
+func TestSetGuardedSettingsWithoutASettingDoesNotElevate(t *testing.T) {
+	s, elev := settingsWithElevation(t, nil)
+
+	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{ProfileName: "default"})
+
+	require.Error(t, err, "nothing to apply is not something to prompt for")
+	assert.Empty(t, elev.calls, "no prompt at all")
+}
+
+// A declined prompt is the one ending that is not an error: reporting it as one
+// would have every cancelled prompt logged as a failure.
+func TestSetGuardedSettingsReportsADeclinedPromptAsAnOutcome(t *testing.T) {
+	s, _ := settingsWithElevation(t, elevate.ErrDeclined)
+
+	root := true
+	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+		ProfileName:   "default",
+		EnableSSHRoot: &root,
+	})
+
+	require.NoError(t, err, "the user was asked and answered; nothing went wrong")
+	assert.True(t, outcome.Declined, "nothing was applied")
+}
+
+func TestSetGuardedSettingsMapsFailures(t *testing.T) {
+	tests := []struct {
+		name     string
+		outcome  error
+		wantCode string
+	}{
+		{
+			// Nothing to raise a prompt with: the user needs the command.
+			name:     "no mechanism falls back to the command",
+			outcome:  elevate.ErrUnavailable,
+			wantCode: CodeElevationUnavailable,
+		},
+		{
+			name:     "a failed run falls back to the command",
+			outcome:  errors.New("elevated netbird exited with 1"),
+			wantCode: CodeElevationFailed,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s, _ := settingsWithElevation(t, tt.outcome)
+
+			root := true
+			_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
+				ProfileName:   "default",
+				EnableSSHRoot: &root,
+			})
+
+			var clientErr *ClientError
+			require.ErrorAs(t, err, &clientErr, "the frontend needs a code to act on")
+			assert.Equal(t, tt.wantCode, clientErr.Code, "error code")
+			assert.Contains(t, clientErr.Command, "--"+FlagEnableSSHRoot+"=true",
+				"the setting in the fallback command")
+			assert.Contains(t, clientErr.Command, "netbird up", "the fallback command")
+		})
+	}
+}
+
+// Changing the management URL is only privileged while the host runs the SSH
+// server, which no control can know up front, so the refusal is what triggers the
+// prompt. The original request goes again afterwards, so the fields the one-shot
+// does not understand are applied too.
+func TestSetConfigElevatesAfterARefusalAndRetries(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, daemon := settingsRefusingOnce(t, elev)
+
+	mtu := int64(1280)
+	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+		MTU:           &mtu,
+	})
+	require.NoError(t, err)
+	assert.False(t, outcome.Declined, "the prompt was answered")
+
+	require.Len(t, elev.calls, 1, "one prompt")
+	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com",
+		"the guarded part of the request")
+	require.Len(t, daemon.requests, 2, "the refused request and the retry")
+	assert.Equal(t, mtu, daemon.requests[1].GetMtu(),
+		"the retry carries the rest of the request, which the one-shot does not understand")
+}
+
+func TestSetConfigDoesNotRetryWhenTheUserDeclines(t *testing.T) {
+	elev := &stubElevator{outcome: elevate.ErrDeclined, available: true}
+	s, daemon := settingsRefusingOnce(t, elev)
+
+	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+	})
+
+	require.NoError(t, err, "a declined prompt is not an error")
+	assert.True(t, outcome.Declined, "nothing was applied")
+	assert.Len(t, daemon.requests, 1, "only the refused request")
+}
+
+// With no prompt to raise, the refusal is reported as the daemon wrote it, which is
+// the guidance that was there before elevation existed.
+func TestSetConfigReportsTheRefusalWhenItCannotElevate(t *testing.T) {
+	elev := &stubElevator{available: false}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:   "default",
+		ManagementURL: "https://mgmt.example.com",
+	})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Contains(t, clientErr.Command, "netbird up -m https://mgmt.example.com",
+		"the daemon's own command")
+	assert.Empty(t, elev.calls, "no prompt where there is none to raise")
+}
+
+// One authorization must buy only the change the user made. A settings form
+// submits every field it holds, so most of a refused request restates what the
+// daemon already has, and elevating those too would apply a guarded setting the
+// user never touched — a value gone stale since the form loaded above all.
+func TestSetConfigElevatesOnlyTheGuardedSettingsThatChange(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	on, off := true, false
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:      "default",
+		ManagementURL:    storedManagementURL,
+		ServerSSHAllowed: &off,
+		EnableSSHRoot:    &off,
+		DisableSSHAuth:   &on,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, elev.calls, 1, "one prompt")
+	args := elev.calls[0]
+	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=true", "the setting that changes")
+	assert.NotContains(t, args, "--"+FlagManagementURL+"="+storedManagementURL,
+		"a management URL the daemon already holds")
+	assert.NotContains(t, args, "--"+FlagAllowServerSSH+"=false", "a setting already off")
+	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "a setting already off")
+}
+
+// A request that changes no guarded setting has nothing an elevated run could
+// apply, so the refusal must have come from somewhere a prompt cannot reach.
+func TestSetConfigDoesNotElevateWhenNoGuardedSettingChanges(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	off := false
+	_, err := s.SetConfig(context.Background(), SetConfigParams{
+		ProfileName:      "default",
+		ManagementURL:    storedManagementURL,
+		ServerSSHAllowed: &off,
+	})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Empty(t, elev.calls, "no prompt for a change nobody made")
+}
+
+// A refusal with nothing in the request the one-shot could apply: the daemon
+// cannot see who is calling, and being root would not help either.
+func TestSetConfigReportsARefusalWithNothingToElevate(t *testing.T) {
+	elev := &stubElevator{available: true}
+	s, _ := settingsRefusingOnce(t, elev)
+
+	_, err := s.SetConfig(context.Background(), SetConfigParams{ProfileName: "default"})
+
+	var clientErr *ClientError
+	require.ErrorAs(t, err, &clientErr)
+	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
+	assert.Empty(t, elev.calls, "no prompt")
+}

client/ui/services/oneshot.go

@@ -0,0 +1,239 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/elevate"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// The other end of SetGuardedSettings: the mode this binary runs itself in,
+// elevated, to apply the settings the daemon restricts to root/administrator.
+//
+// Both ends are here on purpose. What may be changed this way is an allowlist, and
+// an allowlist declared twice is one that will eventually disagree with itself, so
+// the arguments are rendered and parsed from a single table: guardedFields. Adding
+// a setting is one row; nothing generic passes through, and no field outside the
+// table can be reached with an elevated request no matter what lands on the command
+// line.
+
+// oneShotTimeout bounds the whole one-shot: connect, one RPC, exit. Generous
+// because the user has just waited for an authentication dialog, and a failure here
+// costs them the entire round trip.
+const oneShotTimeout = 30 * time.Second
+
+// Exit codes the parent reads where the platform gives it one.
+const (
+	exitOK      = 0
+	exitFailure = 1
+	exitUsage   = 2
+)
+
+// guardedField is one setting the one-shot understands, in the two spellings it
+// needs and with the two halves of its plumbing.
+type guardedField struct {
+	// flag names it on the one-shot's command line.
+	flag  string
+	usage string
+	// read returns the value to send and whether the caller asked for this setting
+	// at all.
+	read func(GuardedSettings) (string, bool)
+	// write parses a value from the command line onto the request. It is the only
+	// thing that validates the value, so it fails on anything it does not
+	// recognise rather than guessing.
+	write func(*proto.SetConfigRequest, string) error
+	// up renders the equivalent `netbird up` flag, for the fallback command shown
+	// when there is no prompt to raise.
+	up func(value string) string
+}
+
+var guardedFields = []guardedField{
+	{
+		flag:  FlagManagementURL,
+		usage: "Management server the profile registers with.",
+		read:  func(p GuardedSettings) (string, bool) { return p.ManagementURL, p.ManagementURL != "" },
+		write: func(req *proto.SetConfigRequest, value string) error {
+			// Parsed with the config layer's own parser, so what the elevated run
+			// accepts cannot drift from what the daemon would store.
+			if _, err := profilemanager.ParseServiceURL("Management URL", value); err != nil {
+				return err
+			}
+			req.ManagementUrl = value
+			return nil
+		},
+		// The daemon names this one as `-m <url>` in its own refusals.
+		up: func(value string) string { return "-m " + value },
+	},
+	boolField(FlagAllowServerSSH, "Run the NetBird SSH server.",
+		func(p GuardedSettings) *bool { return p.ServerSSHAllowed },
+		func(req *proto.SetConfigRequest, v *bool) { req.ServerSSHAllowed = v }),
+	boolField(FlagEnableSSHRoot, "Allow SSH sessions to privileged accounts.",
+		func(p GuardedSettings) *bool { return p.EnableSSHRoot },
+		func(req *proto.SetConfigRequest, v *bool) { req.EnableSSHRoot = v }),
+	boolField(FlagDisableSSHAuth, "Accept SSH sessions without authentication.",
+		func(p GuardedSettings) *bool { return p.DisableSSHAuth },
+		func(req *proto.SetConfigRequest, v *bool) { req.DisableSSHAuth = v }),
+}
+
+// fieldValue is a flag that remembers whether it was given, and requires a value:
+// the renderer always writes one, so a bare flag is a caller that got it wrong.
+type fieldValue struct {
+	set   bool
+	value string
+}
+
+func (v *fieldValue) String() string {
+	if v == nil {
+		return ""
+	}
+	return v.value
+}
+
+func (v *fieldValue) Set(value string) error {
+	v.set, v.value = true, value
+	return nil
+}
+
+// boolField describes a setting that is on or off. The value is always spelled out,
+// so that turning a setting off is as unambiguous as turning it on and a flag with
+// no value is a mistake rather than an "on".
+func boolField(
+	name, usage string,
+	read func(GuardedSettings) *bool,
+	write func(*proto.SetConfigRequest, *bool),
+) guardedField {
+	return guardedField{
+		flag:  name,
+		usage: usage,
+		read: func(p GuardedSettings) (string, bool) {
+			value := read(p)
+			if value == nil {
+				return "", false
+			}
+			return strconv.FormatBool(*value), true
+		},
+		write: func(req *proto.SetConfigRequest, value string) error {
+			parsed, err := strconv.ParseBool(value)
+			if err != nil {
+				return fmt.Errorf("parse %q as a boolean: %w", value, err)
+			}
+			write(req, &parsed)
+			return nil
+		},
+		up: func(value string) string { return "--" + name + "=" + value },
+	}
+}
+
+// IsPrivilegedSettingsRun reports whether this process was started as the one-shot.
+// The flag is a marker rather than a value, so only the bare forms count: reading a
+// value would mean "--flag=false" started it too.
+func IsPrivilegedSettingsRun(args []string) bool {
+	for _, arg := range args {
+		if arg == "--"+FlagApplyPrivilegedSettings || arg == "-"+FlagApplyPrivilegedSettings {
+			return true
+		}
+	}
+	return false
+}
+
+// RunPrivilegedSettings applies the requested settings and returns the process exit
+// code. connect dials the daemon, which is the caller's business because only it
+// knows how this build talks to it.
+//
+// Everything it reports goes to stderr, which is what the parent captures where the
+// platform lets it. On success it says so on standard output, because macOS gives
+// the parent no exit status to read: see elevate.AppliedMarker.
+func RunPrivilegedSettings(args []string, connect func(addr string) (proto.DaemonServiceClient, error)) int {
+	fs := flag.NewFlagSet("netbird-ui --"+FlagApplyPrivilegedSettings, flag.ContinueOnError)
+	fs.Bool(FlagApplyPrivilegedSettings, false, "Apply the settings the daemon restricts to root/administrator and exit.")
+	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port")
+	logLevel := fs.String(FlagLogLevel, "info", "Log level: trace|debug|info|warn|error.")
+	profile := fs.String(FlagProfile, "", "Profile to change.")
+	username := fs.String(FlagUser, "", "Owner of the profile.")
+
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		fs.Var(&values[i], field.flag, field.usage)
+	}
+
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+
+	if err := util.InitLog(*logLevel, "console"); err != nil {
+		fmt.Fprintf(os.Stderr, "init log: %v\n", err)
+		return exitFailure
+	}
+
+	req, err := privilegedRequest(*profile, *username, values)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		return exitUsage
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), oneShotTimeout)
+	defer cancel()
+
+	if err := applyPrivilegedSettings(ctx, *daemonAddr, req, connect); err != nil {
+		fmt.Fprintf(os.Stderr, "apply settings: %v\n", err)
+		return exitFailure
+	}
+
+	fmt.Fprintln(os.Stdout, elevate.AppliedMarker)
+	return exitOK
+}
+
+// privilegedRequest builds the request from the flags that were given, and refuses
+// one that asks for nothing.
+func privilegedRequest(profile, username string, values []fieldValue) (*proto.SetConfigRequest, error) {
+	req := &proto.SetConfigRequest{ProfileName: profile, Username: username}
+
+	given := 0
+	for i, field := range guardedFields {
+		if !values[i].set {
+			continue
+		}
+		if err := field.write(req, values[i].value); err != nil {
+			return nil, fmt.Errorf("--%s: %w", field.flag, err)
+		}
+		given++
+	}
+	if given == 0 {
+		return nil, errors.New("no setting to apply")
+	}
+	return req, nil
+}
+
+func applyPrivilegedSettings(
+	ctx context.Context,
+	daemonAddr string,
+	req *proto.SetConfigRequest,
+	connect func(addr string) (proto.DaemonServiceClient, error),
+) error {
+	client, err := connect(daemonAddr)
+	if err != nil {
+		return err
+	}
+	if _, err := client.SetConfig(ctx, req); err != nil {
+		// Unwrapped: the daemon's message is written for a person, and a refusal
+		// elevation cannot fix has to say so where the parent can read it off
+		// stderr.
+		return errors.New(gstatus.Convert(err).Message())
+	}
+	return nil
+}
+
+// interface guard: the one-shot's flags are flag.Value.
+var _ flag.Value = (*fieldValue)(nil)

client/ui/services/oneshot_test.go

@@ -0,0 +1,151 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"flag"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+func TestIsPrivilegedSettingsRun(t *testing.T) {
+	tests := []struct {
+		name string
+		args []string
+		want bool
+	}{
+		{name: "no arguments"},
+		{name: "double dash", args: []string{"--" + FlagApplyPrivilegedSettings}, want: true},
+		{name: "single dash", args: []string{"-" + FlagApplyPrivilegedSettings}, want: true},
+		{
+			name: "among other flags",
+			args: []string{"--daemon-addr", "unix:///tmp/x.sock", "--" + FlagApplyPrivilegedSettings},
+			want: true,
+		},
+		// A marker, not a value: the caller never passes one, and reading a value
+		// would mean "--flag=false" started the one-shot too.
+		{name: "with a value", args: []string{"--" + FlagApplyPrivilegedSettings + "=true"}},
+		{name: "unrelated flags", args: []string{"--log-level", "debug"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsPrivilegedSettingsRun(tt.args), "args %v", tt.args)
+		})
+	}
+}
+
+// What SetGuardedSettings renders has to be what the one-shot reads back, for every
+// setting in the table. This is the property that keeps the two ends of an allowlist
+// from drifting, so it is checked field by field rather than by example.
+func TestGuardedFieldsRoundTrip(t *testing.T) {
+	on, off := true, false
+	tests := []struct {
+		name     string
+		settings GuardedSettings
+		want     func(*testing.T, *proto.SetConfigRequest)
+	}{
+		{
+			name:     "management url",
+			settings: GuardedSettings{ManagementURL: "https://mgmt.example.com:33073"},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				assert.Equal(t, "https://mgmt.example.com:33073", req.GetManagementUrl())
+			},
+		},
+		{
+			name:     "ssh server on",
+			settings: GuardedSettings{ServerSSHAllowed: &on},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.ServerSSHAllowed)
+				assert.True(t, *req.ServerSSHAllowed)
+			},
+		},
+		{
+			name:     "ssh root off",
+			settings: GuardedSettings{EnableSSHRoot: &off},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.EnableSSHRoot, "an explicit false must survive, not read as absent")
+				assert.False(t, *req.EnableSSHRoot)
+			},
+		},
+		{
+			name:     "ssh auth off",
+			settings: GuardedSettings{DisableSSHAuth: &on},
+			want: func(t *testing.T, req *proto.SetConfigRequest) {
+				require.NotNil(t, req.DisableSSHAuth)
+				assert.True(t, *req.DisableSSHAuth)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := parseRendered(t, tt.settings)
+			tt.want(t, req)
+		})
+	}
+}
+
+// A setting nobody asked about must not arrive at the daemon at all: sending its
+// zero value would change it.
+func TestGuardedFieldsCarryOnlyWhatWasAsked(t *testing.T) {
+	on := true
+	req := parseRendered(t, GuardedSettings{ProfileName: "work", EnableSSHRoot: &on})
+
+	assert.Equal(t, "work", req.GetProfileName(), "profile")
+	require.NotNil(t, req.EnableSSHRoot)
+	assert.Nil(t, req.ServerSSHAllowed, "untouched setting")
+	assert.Nil(t, req.DisableSSHAuth, "untouched setting")
+	assert.Empty(t, req.GetManagementUrl(), "untouched setting")
+}
+
+func TestPrivilegedRequestRejectsAnEmptyChange(t *testing.T) {
+	_, err := privilegedRequest("default", "vma", make([]fieldValue, len(guardedFields)))
+	require.Error(t, err, "nothing to apply is not a request worth sending as root")
+}
+
+// A value the table cannot parse is refused rather than guessed at.
+func TestPrivilegedRequestRejectsAnUnparseableValue(t *testing.T) {
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		if field.flag != FlagEnableSSHRoot {
+			continue
+		}
+		require.NoError(t, values[i].Set("perhaps"))
+	}
+
+	_, err := privilegedRequest("default", "vma", values)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), FlagEnableSSHRoot, "which flag was wrong")
+}
+
+// parseRendered puts the settings through both ends: rendered as the arguments the
+// elevated process is given, then parsed by a flag set registered from the same
+// table, which is what the one-shot itself parses them with. Anything hand-rolled
+// here would pin down a parser nothing uses.
+func parseRendered(t *testing.T, p GuardedSettings) *proto.SetConfigRequest {
+	t.Helper()
+
+	rendered := guardedSettings(p)
+	require.NotEmpty(t, rendered, "nothing rendered for %+v", p)
+
+	args := make([]string, 0, len(rendered))
+	for _, setting := range rendered {
+		args = append(args, setting.arg)
+	}
+
+	fs := flag.NewFlagSet(t.Name(), flag.ContinueOnError)
+	values := make([]fieldValue, len(guardedFields))
+	for i, field := range guardedFields {
+		fs.Var(&values[i], field.flag, field.usage)
+	}
+	require.NoError(t, fs.Parse(args), "the one-shot's own flag set must accept %v", args)
+
+	req, err := privilegedRequest(p.ProfileName, p.Username, values)
+	require.NoError(t, err)
+	return req
+}

client/ui/services/preferences.go

@@ -34,7 +34,3 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
-
-func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
-	return s.store.SetKeepConnectedOnQuit(keep)
-}

client/ui/services/settings.go

@@ -44,12 +44,19 @@ type Restrictions struct {
 }
 
 // Privilege tells the frontend whether this process may perform the changes the
-// daemon restricts to root/administrator, and carries the command for each so a
-// disabled control can show the way to do it.
+// daemon restricts to root/administrator, whether it can ask the operating
+// system for the privileges instead, and the command for each so a control that
+// can do neither can still show the way.
 type Privilege struct {
 	Privileged bool `json:"privileged"`
-	// Actor names what the operation requires ("root", "administrator privileges").
-	Actor string `json:"actor"`
+	// ActorKey identifies the principal the operation requires without wording it,
+	// so the frontend can name it in the user's language: see
+	// ipcauth.PrivilegedActorKey. The words are not sent, because English ones
+	// cannot be dropped into a translated sentence.
+	ActorKey string `json:"actorKey"`
+	// CanElevate reports whether a guarded control can offer to authorize the
+	// change through the platform's own prompt: see SetGuardedSettings.
+	CanElevate bool `json:"canElevate"`
 	// Commands equivalent to the settings the daemon guards, ready to copy.
 	AllowSSHServer string `json:"allowSshServer"`
 	EnableSSHRoot  string `json:"enableSshRoot"`
@@ -128,6 +135,9 @@ type Settings struct {
 	// daemonAddr is where the daemon listens, used to tell whether it runs as
 	// this user and would therefore authorize us: see Privilege.
 	daemonAddr string
+	// elevator raises the platform's privilege prompt when a change needs more
+	// rights than this process has.
+	elevator elevator
 }
 
 func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
@@ -135,6 +145,7 @@ func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePref
 		conn:       conn,
 		classifier: errorClassifier{translator: translator, prefs: prefs},
 		daemonAddr: daemonAddr,
+		elevator:   osElevator{},
 	}
 }
 
@@ -180,10 +191,10 @@ func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error
 	}, nil
 }
 
-func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
+func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcome, error) {
 	cli, err := s.conn.Client()
 	if err != nil {
-		return err
+		return SaveOutcome{}, err
 	}
 	req := &proto.SetConfigRequest{
 		ProfileName:                   p.ProfileName,
@@ -215,19 +226,92 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
 	if _, err := cli.SetConfig(ctx, req); err != nil {
+		if _, refused := privilegeErrorInfo(err); refused {
+			return s.setConfigElevated(ctx, p, req, err)
+		}
 		// Classified so the frontend gets the daemon's guidance instead of the
-		// gRPC envelope, which is what a refused privileged change looks like.
-		return s.classifier.classify(err)
+		// gRPC envelope.
+		return SaveOutcome{}, s.classifier.classify(err)
 	}
-	return nil
+	return SaveOutcome{}, nil
+}
+
+// setConfigElevated answers a request the daemon refused for want of privileges by
+// asking the user to authorize it, and sending it again if they do. It is the same
+// offer the SSH settings make up front, for the changes a control cannot know are
+// guarded until it is told: repointing a profile at another management server is
+// only privileged while that host runs the SSH server.
+//
+// Two steps, because the elevated one-shot deliberately understands only the
+// settings the daemon guards: it applies those, and the original request then goes
+// through as this user, its privileged parts now asking for nothing that is not
+// already stored. Nothing was applied by the refused attempt — the daemon decides
+// before it writes — so there is no half-applied state to undo either way.
+func (s *Settings) setConfigElevated(ctx context.Context, p SetConfigParams, req *proto.SetConfigRequest, refusal error) (SaveOutcome, error) {
+	if !s.canElevate() {
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+
+	guarded, err := s.guardedChanges(ctx, p)
+	if err != nil {
+		log.Warnf("cannot tell which guarded settings this request changes: %v", err)
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+	if len(guardedSettings(guarded)) == 0 {
+		// Refused over something no prompt can settle, such as a control channel
+		// that carries no caller identity. Report the daemon's own guidance.
+		return SaveOutcome{}, s.classifier.classify(refusal)
+	}
+
+	outcome, err := s.SetGuardedSettings(ctx, guarded)
+	if err != nil || outcome.Declined {
+		return outcome, err
+	}
+
+	cli, err := s.conn.Client()
+	if err != nil {
+		return SaveOutcome{}, err
+	}
+	if _, err := cli.SetConfig(ctx, req); err != nil {
+		return SaveOutcome{}, s.classifier.classify(err)
+	}
+	return SaveOutcome{}, nil
+}
+
+// guardedChanges is the guarded part of a request, reduced to what it actually
+// changes.
+//
+// A settings form submits every field it holds, so a request restates values the
+// daemon already has. Carrying those into the elevated run would spend one
+// authorization on more than the user asked for, and a value that has gone stale
+// since the form was loaded would spend it on something they never asked about.
+func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (GuardedSettings, error) {
+	stored, err := s.GetConfig(ctx, ConfigParams{ProfileName: p.ProfileName, Username: p.Username})
+	if err != nil {
+		return GuardedSettings{}, fmt.Errorf("read the stored config: %w", err)
+	}
+
+	guarded := GuardedSettings{
+		ProfileName:      p.ProfileName,
+		Username:         p.Username,
+		ServerSSHAllowed: changedFlag(p.ServerSSHAllowed, stored.ServerSSHAllowed),
+		EnableSSHRoot:    changedFlag(p.EnableSSHRoot, stored.EnableSSHRoot),
+		DisableSSHAuth:   changedFlag(p.DisableSSHAuth, stored.DisableSSHAuth),
+	}
+	// An empty URL leaves the setting alone, which is the daemon's rule too.
+	if p.ManagementURL != "" && p.ManagementURL != stored.ManagementURL {
+		guarded.ManagementURL = p.ManagementURL
+	}
+	return guarded, nil
 }
 
 // Privilege reports whether this UI process could carry out the changes the
-// daemon restricts to root/administrator, and the command that performs the one
-// users hit in the SSH settings. It applies the daemon's own rule to what it can
-// see locally, so the frontend can present those controls as unavailable up front
-// instead of letting a save fail. No daemon round-trip, so it also works while the
-// daemon is down.
+// daemon restricts to root/administrator, whether it can instead ask the
+// operating system for the privileges when the user wants one of them, and the
+// command that performs the ones users hit in the SSH settings. It applies the
+// daemon's own rule to what it can see locally, so the frontend can decide up
+// front how to present those controls instead of letting a save fail. No daemon
+// round-trip, so it also works while the daemon is down.
 //
 // Being root or an elevated administrator is one way. The other is running as the
 // daemon's own user while the daemon is unprivileged, which the daemon accepts
@@ -237,26 +321,40 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 func (s *Settings) Privilege() Privilege {
 	id, err := ipcauth.CurrentProcessIdentity()
 	if err != nil {
-		// Fail closed: report unprivileged, which only ever disables controls.
+		// Fail closed: report unprivileged, which only ever asks for more.
 		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
-		return newPrivilege(false)
+		return s.newPrivilege(false)
 	}
 	if id.IsPrivileged() {
-		return newPrivilege(true)
+		return s.newPrivilege(true)
 	}
-	return newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+	return s.newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
 }
 
-func newPrivilege(privileged bool) Privilege {
+func (s *Settings) newPrivilege(privileged bool) Privilege {
 	return Privilege{
 		Privileged:     privileged,
-		Actor:          ipcauth.PrivilegedActor(),
+		ActorKey:       ipcauth.PrivilegedActorKey(),
+		CanElevate:     s.canElevate(),
 		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
 		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
 		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
 	}
 }
 
+// canElevate reports whether offering the platform's elevation prompt would get
+// the user anywhere. It needs a mechanism to raise the prompt with and a control
+// channel that tells the daemon who is calling: on loopback TCP the daemon
+// refuses these changes to everybody, root included, so a prompt there would
+// only waste the user's password.
+func (s *Settings) canElevate() bool {
+	if !daemonaddr.CarriesIdentity(s.daemonAddr) {
+		log.Debugf("not offering elevation: the daemon address %s carries no caller identity", s.daemonAddr)
+		return false
+	}
+	return s.elevator.Available()
+}
+
 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -289,6 +387,15 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	return r, nil
 }
 
+// changedFlag returns requested only when it differs from what is stored, so a
+// setting the request merely restates is left out of the elevated run.
+func changedFlag(requested *bool, stored bool) *bool {
+	if requested == nil || *requested == stored {
+		return nil
+	}
+	return requested
+}
+
 func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
 	managed := cfgResp.GetMDMManagedFields()
 	if len(managed) == 0 {

client/ui/tray.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -51,9 +50,8 @@ type TrayServices struct {
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session     *authsession.Session
-	Localizer   *Localizer
-	Preferences *preferences.Store
+	Session   *authsession.Session
+	Localizer *Localizer
 }
 
 type Tray struct {
@@ -463,12 +461,10 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()
 
-	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
-		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-		defer cancel()
-		if err := t.svc.Connection.Down(ctx); err != nil {
-			log.Errorf("disconnect on quit: %v", err)
-		}
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
 	}
 	t.app.Quit()
 }

client/ui/xembed_host_gtk3_linux.go

@@ -1,40 +0,0 @@
-//go:build linux && gtk3 && !(linux && 386)
-
-package main
-
-import (
-	"errors"
-
-	"github.com/godbus/dbus/v5"
-)
-
-// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
-// XEmbed StatusNotifierWatcher entirely. The real implementation
-// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
-// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
-// C layer we stub the host out on gtk3 builds. The tray still works on every
-// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
-// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
-// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
-
-// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
-// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
-// instantiated here because xembedTrayAvailable always reports false.
-type xembedHost struct{}
-
-// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
-// newXembedHost never returns a non-nil host.
-func (*xembedHost) run() {}
-
-// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
-// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
-// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
-func xembedTrayAvailable() bool {
-	return false
-}
-
-// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
-// it is unreachable because xembedTrayAvailable returns false on gtk3.
-func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
-	return nil, errors.New("xembed host unsupported on gtk3 build")
-}

client/ui/xembed_host_linux.go

@@ -1,4 +1,4 @@
-//go:build linux && !gtk3 && !(linux && 386)
+//go:build linux && !(linux && 386)
 
 package main
 

client/ui/xembed_tray_linux.c

@@ -1,5 +1,3 @@
-//go:build linux && !gtk3 && !(linux && 386)
-
 #include "xembed_tray_linux.h"
 
 #include <X11/Xatom.h>

infrastructure_files/getting-started-enterprise.sh

@@ -11,10 +11,6 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
-# Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only.
-TRAEFIK_IP="172.30.0.10"
-
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -84,7 +80,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -96,23 +92,6 @@ read_nb_domain() {
   echo "$value"
 }
 
-read_letsencrypt_email() {
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
-    echo "$NETBIRD_LETSENCRYPT_EMAIL"
-    return
-  fi
-  local value=""
-  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
-  echo -n "Email address: " > /dev/stderr
-  read -r value < /dev/tty
-  if [[ -z "$value" ]]; then
-    echo "Email is required for Let's Encrypt." > /dev/stderr
-    read_letsencrypt_email
-    return
-  fi
-  echo "$value"
-}
-
 read_required() {
   local prompt="$1"
   local value=""
@@ -225,11 +204,11 @@ init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml config.yaml"
+    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -251,9 +230,6 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
-  echo ""
-  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
-
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -262,7 +238,6 @@ init_environment() {
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
-  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -272,7 +247,6 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
-  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -282,6 +256,7 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
+  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -308,7 +283,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
 }
 
 # ------------------------------------------------------------------
@@ -331,11 +306,6 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
-# Reverse proxy (Traefik)
-NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
-NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
-
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -408,78 +378,26 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
-  # labels on the services below and picked up through the Docker provider.
-  traefik:
+  caddy:
     <<: *default
-    image: traefik:${NETBIRD_TRAEFIK_TAG}
-    container_name: netbird-traefik
-    networks:
-      netbird:
-        ipv4_address: ${NETBIRD_TRAEFIK_IP}
-    command:
-      # Logging
-      - "--log.level=INFO"
-      - "--accesslog=true"
-      # Docker provider
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
-      # Entrypoints
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.websecure.allowACMEByPass=true"
-      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
-      # never end one; idleTimeout would close the keep-alive connection they
-      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
-      # writeTimeout is left alone: it already defaults to 0.
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
-      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
-      # HTTP to HTTPS redirect
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      # Let's Encrypt ACME
-      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    image: caddy:2
+    container_name: netbird-caddy
+    networks: [netbird]
+    environment:
+      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
     ports:
       - '443:443'
+      - '443:443/udp'
       - '80:80'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - netbird_traefik_letsencrypt:/letsencrypt
-    labels:
-      - traefik.enable=true
-      # Shared security headers, referenced by every NetBird router below. A
-      # label-declared middleware only exists while its container runs, so this
-      # lives on Traefik itself: declaring it on an app container would drop
-      # every router referencing it whenever that container restarts.
-      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
-      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
-      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
-      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
-      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
-      # Empty value strips the header. Only the dashboard's nginx sets one; the
-      # server emits none. Do not quote it — "" would send a literal Server: "".
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
-    labels:
-      - traefik.enable=true
-      # Dashboard catch-all: lowest priority so every route below wins
-      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
-      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
-      - traefik.http.routers.netbird-dashboard.tls=true
-      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-dashboard.service=dashboard
-      - traefik.http.routers.netbird-dashboard.priority=1
-      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -517,28 +435,6 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
-    labels:
-      - traefik.enable=true
-      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
-      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      - traefik.http.routers.netbird-grpc.entrypoints=websecure
-      - traefik.http.routers.netbird-grpc.tls=true
-      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
-      - traefik.http.routers.netbird-grpc.priority=100
-      # Relay WebSocket, management API, and the embedded IdP
-      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      - traefik.http.routers.netbird-backend.entrypoints=websecure
-      - traefik.http.routers.netbird-backend.tls=true
-      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-backend.service=netbird-server
-      - traefik.http.routers.netbird-backend.priority=100
-      # Services
-      - traefik.http.services.netbird-server.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -601,18 +497,6 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
-    labels:
-      - traefik.enable=true
-      # Flow receiver gRPC (h2c backend)
-      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
-      - traefik.http.routers.netbird-flow.entrypoints=websecure
-      - traefik.http.routers.netbird-flow.tls=true
-      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
-      - traefik.http.routers.netbird-flow.priority=100
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -652,16 +536,61 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_traefik_letsencrypt:
+  netbird_caddy_data:
 
 networks:
   netbird:
-    name: netbird
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+EOF
+}
+
+render_caddyfile() {
+  cat <<'EOF'
+{
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80 {
+    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
+}
+
+{$CADDY_SECURE_DOMAIN}:443 {
+    import security_headers
+    # Signal (gRPC over h2c)
+    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
+    # Management (gRPC over h2c + HTTP)
+    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
+    reverse_proxy /api/* netbird-server:80
+    reverse_proxy /ws-proxy/* netbird-server:80
+    # Embedded IdP (OAuth2 endpoints served by netbird server)
+    reverse_proxy /oauth2/* netbird-server:80
+    # Relay (WebSocket multiplexed on the same port)
+    reverse_proxy /relay* netbird-server:80
+EOF
+
+  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    cat <<'EOF'
+    # Flow receiver (gRPC over h2c)
+    reverse_proxy /flow.FlowService/* h2c://receiver:80
+EOF
+  fi
+
+  cat <<'EOF'
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
 }
 
@@ -680,7 +609,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Traefik in front; leave this block empty.
+  # TLS is terminated by Caddy in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -697,23 +626,12 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
-    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
     cliRedirectURIs:
       - "http://localhost:53000/"
 
-  # Trust X-Forwarded-* only from the Traefik container's static address. Both
-  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
-  reverseProxy:
-    trustedPeers:
-      - "${TRAEFIK_IP}/32"
-    trustedHTTPProxies:
-      - "${TRAEFIK_IP}/32"
-
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/getting-started.sh

@@ -348,7 +348,6 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
-  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -528,8 +527,7 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  install -m 600 /dev/null config.yaml
-  render_combined_yaml >> config.yaml
+  render_combined_yaml > config.yaml
   return 0
 }
 
@@ -913,7 +911,6 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
-    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"

infrastructure_files/migrate-to-enterprise.sh

@@ -15,11 +15,7 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# If any step fails once the stack has been touched, the script rolls itself
-# back automatically: generated files are removed, the Postgres volume this run
-# created is dropped, and the original deployment is started again.
-#
-# To revert a successful migration:
+# To revert:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -29,15 +25,6 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
-# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
-# starts mutating the deployment, and back to "disarmed" once the migration has
-# completed successfully.
-ROLLBACK_STATE="disarmed"
-ENV_EXISTED="unknown"
-ENV_BACKUP=""
-PG_VOLUME_NAME=""
-BACKUP_DIR=""
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -374,77 +361,7 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-combined_container_id() {
-  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
-}
-
-container_data_mount() {
-  local container="$1"
-  [[ -n "$container" ]] || return 0
-  docker inspect "$container" --format \
-    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
-}
-
-# The name comes from the container, so `-v` cannot invent an empty volume here.
-# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
-# be reported as empty: that would abort a healthy migration over a pull error
-# or an unreadable bind mount.
-data_dir_state() {
-  local src="$1" out
-  if [[ "$src" == /* ]]; then
-    [[ -d "$src" ]] || return 2
-    out=$(ls -A "$src" 2>/dev/null) || return 2
-  else
-    docker volume inspect "$src" &> /dev/null || return 0
-    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
-  fi
-  [[ -z "$out" ]] && return 0
-  return 1
-}
-
-check_data_directory() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "" > /dev/stderr
-    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
-    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
-    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
-    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-    exit 1
-  fi
-
-  local src
-  src=$(container_data_mount "$container")
-  if [[ -z "$src" ]]; then
-    echo "" > /dev/stderr
-    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
-    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
-    exit 1
-  fi
-
-  local state=0
-  data_dir_state "$src" || state=$?
-  if [[ $state -eq 0 ]]; then
-    echo "" > /dev/stderr
-    echo "The NetBird data directory is empty:" > /dev/stderr
-    echo "  $src" > /dev/stderr
-    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
-    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
-    exit 1
-  fi
-  if [[ $state -eq 2 ]]; then
-    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
-    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
-  fi
-
-  echo "  Data directory:   $src"
-}
-
-# Only for the Postgres volume, which has no container to read it off yet.
-resolve_compose_volume() {
+resolve_data_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -474,21 +391,18 @@ resolve_compose_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
-    exit 1
-  fi
-
-  echo "Backing up the NetBird store to $BACKUP_DIR ..."
-  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
-
+  local data_volume_actual
+  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
+  docker run --rm \
+    -v "${data_volume_actual}:/var/lib/netbird:ro" \
+    -v "${BACKUP_DIR}:/backup" \
+    busybox \
+    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -500,135 +414,6 @@ run_migrate_store() {
   echo "  done"
 }
 
-# ---------------------------------------------------------------------------
-# Rollback — a failed run must not leave the operator with a stopped stack and
-# half-written artifacts.
-# ---------------------------------------------------------------------------
-
-# Resolve the name Compose would give the Postgres volume before the override
-# exists, so a leftover volume can be spotted up front.
-compose_project_name() {
-  local container project
-  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
-  if [[ -n "$container" ]]; then
-    project=$(docker inspect "$container" \
-      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
-    if [[ -n "$project" ]]; then
-      echo "$project"
-      return 0
-    fi
-  fi
-  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
-  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
-    echo "$project"
-  fi
-  return 0
-}
-
-postgres_volume_name() {
-  local project
-  project=$(compose_project_name)
-  if [[ -n "$project" ]]; then
-    echo "${project}_netbird_postgres"
-  fi
-  return 0
-}
-
-# Postgres skips initdb when its data directory is non-empty, so a volume left
-# behind by an interrupted run would keep the old password and old contents,
-# and migrate-store would fail against it.
-check_stale_postgres_volume() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  PG_VOLUME_NAME=$(postgres_volume_name)
-  if [[ -z "$PG_VOLUME_NAME" ]]; then
-    echo ""
-    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
-    echo "    left over from an earlier attempt cannot be checked for. If a"
-    echo "    previous run failed, remove it before continuing:"
-    echo "      docker volume ls | grep netbird_postgres"
-    return 0
-  fi
-  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
-
-  echo ""
-  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
-  echo "       $PG_VOLUME_NAME"
-  echo "     Postgres does not re-initialise a non-empty data directory, so the"
-  echo "     migration would run against stale credentials and stale data."
-  local remove
-  remove=$(read_yes_no "  Remove it and continue?" "y")
-  if [[ "$remove" != "yes" ]]; then
-    echo "" > /dev/stderr
-    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
-    exit 1
-  fi
-  docker volume rm "$PG_VOLUME_NAME" > /dev/null
-  echo "  Removed."
-}
-
-# Undo whatever this run changed and start the previous deployment again.
-rollback() {
-  ROLLBACK_STATE="done"
-
-  echo ""
-  echo "──────────────────────────────────────────────────────────────────────"
-  echo " Migration failed — restoring the previous deployment"
-  echo "──────────────────────────────────────────────────────────────────────"
-
-  # Resolve while the override is still present; without it Compose no longer
-  # knows about the Postgres volume.
-  local pg_volume="$PG_VOLUME_NAME"
-  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    pg_volume=$(postgres_volume_name)
-  fi
-
-  echo ""
-  echo "Stopping services ..."
-  $DOCKER_COMPOSE_COMMAND down || true
-
-  echo "Removing generated files ..."
-  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
-
-  # Restore .env to exactly what it was, or remove it if this run created it.
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    rm -f .env || true
-  fi
-
-  # Only ever the volume this run created — never the NetBird data volume.
-  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
-    echo "Removing Postgres volume $pg_volume ..."
-    docker volume rm "$pg_volume" &> /dev/null || true
-  fi
-
-  echo "Starting the previous deployment ..."
-  if ! $DOCKER_COMPOSE_COMMAND up -d; then
-    echo ""
-    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
-    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-  fi
-
-  echo ""
-  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
-  echo "volume were never modified."
-  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
-    echo "The SQLite backup taken during this run is kept at:"
-    echo "  $BACKUP_DIR"
-  fi
-  echo "──────────────────────────────────────────────────────────────────────"
-}
-
-on_exit() {
-  local code=$?
-  trap - EXIT
-  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
-    rollback
-  fi
-  exit $code
-}
-
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -756,15 +541,9 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
-
-  check_data_directory
-  check_stale_postgres_volume
 }
 
 apply_changes() {
-  # From here on a failure must roll the deployment back.
-  ROLLBACK_STATE="armed"
-
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -785,14 +564,6 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
-  # Snapshot the operator's .env so a rollback can restore it byte for byte.
-  if [[ -f "$ENV_FILE" ]]; then
-    ENV_EXISTED="yes"
-    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
-    cp -p "$ENV_FILE" "$ENV_BACKUP"
-  else
-    ENV_EXISTED="no"
-  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -821,16 +592,11 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    # Stop, but keep the containers: the backup reads the store out of one.
-    echo "Stopping services so the store is quiescent ..."
-    $DOCKER_COMPOSE_COMMAND stop
+    echo "Stopping existing services (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
 
     backup_sqlite
 
-    echo ""
-    echo "Removing stopped containers (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
-
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -860,9 +626,6 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
-
-  # Nothing left to undo.
-  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -880,7 +643,6 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
-  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -889,27 +651,19 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
+  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve the project-prefixed volume name now, before the override is gone.
-    local pg_volume
-    pg_volume=$(resolve_compose_volume "netbird_postgres")
-    echo "  # Stop, but keep the containers so the store can be copied back in:"
-    echo "  $DOCKER_COMPOSE_COMMAND stop"
-    echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    # Resolve project-prefixed volume names now (before override is removed).
+    local pg_volume data_volume_actual
+    pg_volume=$(resolve_data_volume "netbird_postgres")
+    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
     echo "  docker volume rm $pg_volume"
-  else
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  # Restore SQLite from the backup created during this run:"
+    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    echo "  rm -f .env   # created by this run"
-  else
-    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
-  fi
+  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -918,10 +672,6 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
-trap on_exit EXIT
-# Turn signals into a normal exit so the EXIT trap can roll back.
-trap 'exit 130' INT TERM
-
 init_migration
 apply_changes
 print_summary

release_files/darwin_pkg/preinstall

@@ -4,67 +4,9 @@ set -x
 
 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
-UI_PROCESS=netbird-ui
 
 mkdir -p /var/log/netbird/
 
-# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
-# process is left and 1 if one is still running when the time is up.
-wait_for_ui_exit() {
-    waited=0
-    while [ "$waited" -lt "$1" ]; do
-        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-        sleep 1
-        waited=$((waited + 1))
-    done
-    return 1
-}
-
-# request_ui_quit asks the UI to quit from inside the console user's session and
-# reports whether the request could be sent at all. The installer runs as root
-# outside that session, so a quit Apple event sent straight from here always
-# fails with -600.
-request_ui_quit() {
-    console_user=$(stat -f%Su /dev/console 2>/dev/null)
-    case "$console_user" in
-        ""|root|loginwindow|_mbsetupuser)
-            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
-            return 1
-            ;;
-    esac
-
-    uid=$(id -u "$console_user" 2>/dev/null)
-    if [ -z "$uid" ]; then
-        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
-        return 1
-    fi
-
-    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
-    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
-}
-
-# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
-# UI process that survives the install keeps serving the old binary until it is
-# quit by hand, so anything still running once the quit request is out of the
-# way is signalled. Waiting for a graceful exit only makes sense when a quit
-# request was actually sent.
-quit_ui() {
-    if request_ui_quit && wait_for_ui_exit 10; then
-        return 0
-    fi
-
-    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-
-    echo "NetBird UI still running; terminating it."
-    pkill -x "$UI_PROCESS" || true
-    if wait_for_ui_exit 3; then
-        return 0
-    fi
-
-    echo "NetBird UI ignored SIGTERM; killing it."
-    pkill -KILL -x "$UI_PROCESS" || true
-}
-
 {
     # check if it was installed with brew
     brew list --formula | grep netbird
@@ -73,9 +15,10 @@ quit_ui() {
         echo "NetBird has been installed with Brew. Please use Brew to update the package."
         exit 1
     fi
-    quit_ui
+    osascript -e 'quit app "Netbird"' || true
     $AGENT service stop || true
 
     echo "Preinstall complete"
     exit 0 # all good
 } &> $LOG_FILE
+

shared/relay/client/guard.go

@@ -156,11 +156,9 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		// Spreads the reconnects of every client that lost the same relay server.
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          2,
-		MaxInterval:         g.maxBackoffInterval,
-		Clock:               backoff.SystemClock,
+		Multiplier:      2,
+		MaxInterval:     g.maxBackoffInterval,
+		Clock:           backoff.SystemClock,
 	}, ctx)
 
 	return backoff.NewTicker(bo)

shared/signal/client/client.go

@@ -52,11 +52,6 @@ type CredentialPayload struct {
 	Credential      *Credential
 	RosenpassPubKey []byte
 	RosenpassAddr   string
-	// MlkemPayload is the opaque post-quantum KEM handshake message riding this
-	// OFFER/ANSWER (see Body.mlkemPayload). Nil when not running the PQ exchange.
-	MlkemPayload []byte
-	// MlkemPort is the sender's ML-KEM PQ service UDP port (0 when not running).
-	MlkemPort       int
 	RelaySrvAddress string
 	RelaySrvIP      netip.Addr
 	SessionID       []byte
@@ -94,13 +89,6 @@ func MarshalCredential(myKey wgtypes.Key, remoteKey string, p CredentialPayload)
 	if p.RelaySrvIP.IsValid() {
 		body.RelayServerIP = p.RelaySrvIP.Unmap().AsSlice()
 	}
-	if len(p.MlkemPayload) > 0 {
-		body.MlkemPayload = p.MlkemPayload
-	}
-	if p.MlkemPort > 0 {
-		port := uint32(p.MlkemPort)
-		body.MlkemPort = &port
-	}
 	return &proto.Message{
 		Key:       myKey.PublicKey().String(),
 		RemoteKey: remoteKey,

shared/signal/proto/signalexchange.pb.go

@@ -239,16 +239,6 @@ type Body struct {
 	// fallback dial target when DNS resolution of relayServerAddress fails.
 	// SNI/TLS verification still uses relayServerAddress.
 	RelayServerIP []byte `protobuf:"bytes,11,opt,name=relayServerIP,proto3,oneof" json:"relayServerIP,omitempty"`
-	// mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
-	// seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
-	// the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
-	// pqkem library frames and parses it. Absent when the sender does not run the
-	// ML-KEM PQ exchange; unknown to older clients, which ignore it.
-	MlkemPayload []byte `protobuf:"bytes,12,opt,name=mlkemPayload,proto3,oneof" json:"mlkemPayload,omitempty"`
-	// mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
-	// WireGuard overlay IP. Peers send subsequent rekey messages there over the
-	// data path. Zero/absent when the ML-KEM PQ exchange is not running.
-	MlkemPort *uint32 `protobuf:"varint,13,opt,name=mlkemPort,proto3,oneof" json:"mlkemPort,omitempty"`
 }
 
 func (x *Body) Reset() {
@@ -353,20 +343,6 @@ func (x *Body) GetRelayServerIP() []byte {
 	return nil
 }
 
-func (x *Body) GetMlkemPayload() []byte {
-	if x != nil {
-		return x.MlkemPayload
-	}
-	return nil
-}
-
-func (x *Body) GetMlkemPort() uint32 {
-	if x != nil && x.MlkemPort != nil {
-		return *x.MlkemPort
-	}
-	return 0
-}
-
 // Mode indicates a connection mode
 type Mode struct {
 	state         protoimpl.MessageState
@@ -490,7 +466,7 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x0a, 0x04, 0x62,
 	0x6f, 0x64, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x73, 0x69, 0x67, 0x6e,
 	0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f, 0x64, 0x79, 0x52,
-	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xbd, 0x05, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
+	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xd2, 0x04, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
 	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x73,
 	0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f,
 	0x64, 0x79, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
@@ -518,46 +494,39 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x29,
 	0x0a, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x18,
 	0x0b, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x02, 0x52, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x12, 0x27, 0x0a, 0x0c, 0x6d, 0x6c, 0x6b,
-	0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0c, 0x48,
-	0x03, 0x52, 0x0c, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x88,
-	0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x18,
-	0x0d, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x04, 0x52, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f,
-	0x72, 0x74, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x09, 0x0a,
-	0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x4e, 0x53, 0x57,
-	0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44, 0x49, 0x44, 0x41, 0x54,
-	0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10, 0x04, 0x12, 0x0b, 0x0a,
-	0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x45,
-	0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x72, 0x65,
-	0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x42, 0x10,
-	0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50,
-	0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61,
-	0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x4a,
-	0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a,
-	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52,
-	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x64,
-	0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61,
-	0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a, 0x0f, 0x72, 0x6f, 0x73, 0x65,
-	0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x45,
-	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04, 0x53, 0x65, 0x6e, 0x64, 0x12,
-	0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65,
-	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e,
-	0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06,
+	0x41, 0x4e, 0x53, 0x57, 0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44,
+	0x49, 0x44, 0x41, 0x54, 0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10,
+	0x04, 0x12, 0x0b, 0x0a, 0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d,
+	0x0a, 0x09, 0x48, 0x45, 0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a,
+	0x13, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x49, 0x64, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x49, 0x50, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f,
+	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x48, 0x00, 0x52, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42,
+	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f,
+	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a,
+	0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
+	0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
+	0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x45, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04,
+	0x53, 0x65, 0x6e, 0x64, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
 	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61,
-	0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
-	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01,
-	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e,
+	0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45,
+	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
+	0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

shared/signal/proto/signalexchange.proto

@@ -75,18 +75,6 @@ message Body {
   // fallback dial target when DNS resolution of relayServerAddress fails.
   // SNI/TLS verification still uses relayServerAddress.
   optional bytes relayServerIP = 11;
-
-  // mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
-  // seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
-  // the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
-  // pqkem library frames and parses it. Absent when the sender does not run the
-  // ML-KEM PQ exchange; unknown to older clients, which ignore it.
-  optional bytes mlkemPayload = 12;
-
-  // mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
-  // WireGuard overlay IP. Peers send subsequent rekey messages there over the
-  // data path. Zero/absent when the ML-KEM PQ exchange is not running.
-  optional uint32 mlkemPort = 13;
 }
 
 // Mode indicates a connection mode