Anticipates PSK before WG does handshake so it finds it to set it

- RecoversViaResignalAfterDataPathBreak: a data-path rotation that can no longer
  converge raises OnRekeyFailed, and re-bootstrapping over signalling resyncs both
  peers on a fresh PSK even while the data path stays broken.
- ConcurrentRekeysNoRace: hammers the single-lock state machine with concurrent
  rotation clocks from many goroutines (run with -race) and asserts no split-brain
  via a final deterministic bootstrap.

.goreleaser_ui.yaml

@@ -92,11 +92,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-      # Names the polkit action for the elevation prompt the app raises when an
-      # unprivileged user changes a privileged setting; without it the dialog
-      # shows a raw command line.
-      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
-        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
       - netbird (>= 0.75.0)
       - libgtk-4-1 (>= 4.14)
@@ -120,11 +115,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-      # Names the polkit action for the elevation prompt the app raises when an
-      # unprivileged user changes a privileged setting; without it the dialog
-      # shows a raw command line.
-      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
-        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
       - netbird >= 0.75.0
       - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)

client/internal/daemonaddr/identity.go

@@ -1,17 +0,0 @@
-package daemonaddr
-
-import "strings"
-
-// CarriesIdentity reports whether the control channel at addr conveys the
-// connecting process's identity to the daemon. A Unix socket carries peer
-// credentials and a named pipe carries the client's token. Nothing else does, TCP
-// included, and there the daemon can authorize a privileged operation for nobody
-// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
-// Windows daemon on the address it served before it had a pipe.
-//
-// A client uses this to tell whether becoming privileged would get it anywhere.
-// It answers from the scheme and nothing else, so an address it does not
-// recognise counts as carrying no identity.
-func CarriesIdentity(addr string) bool {
-	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
-}

client/internal/daemonaddr/identity_test.go

@@ -1,29 +0,0 @@
-package daemonaddr
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCarriesIdentity(t *testing.T) {
-	tests := []struct {
-		addr string
-		want bool
-	}{
-		{"unix:///var/run/netbird.sock", true},
-		{"unix:///var/run/netbird/default.sock", true},
-		{"npipe://netbird", true},
-		{`npipe://\\.\pipe\ProtectedPrefix\Administrators\netbird`, true},
-		{"tcp://127.0.0.1:41731", false},
-		{"tcp://localhost:41731", false},
-		{"", false},
-		{"/var/run/netbird.sock", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.addr, func(t *testing.T) {
-			assert.Equal(t, tt.want, CarriesIdentity(tt.addr), "address %q", tt.addr)
-		})
-	}
-}

client/internal/elevate/elevate.go

@@ -1,74 +0,0 @@
-// Package elevate re-runs this very executable under the operating system's own
-// privilege-elevation mechanism and waits for it to finish.
-//
-// It exists so that a change the daemon restricts to root/administrator can be
-// authorized from the GUI, by the user, at the moment they ask for it: Windows
-// shows the UAC consent dialog, macOS the system authentication dialog, and
-// Linux/FreeBSD the session's polkit agent. The credentials, where any are
-// asked for, are collected by the operating system and never pass through
-// NetBird.
-//
-// What the elevated process then does is the caller's business: it is the same
-// binary, in a one-shot mode, and it is authorized by the daemon exactly like
-// any other privileged caller, from the identity the kernel reports on the
-// control channel. Nothing here grants privilege, and the daemon gains no new
-// way to be talked into something: elevation only changes who is calling it.
-package elevate
-
-import (
-	"context"
-	"errors"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// AppliedMarker is what the elevated process prints on standard output once it has
-// done what it was run for.
-//
-// macOS's AuthorizationExecuteWithPrivileges reports no exit status and does not
-// say which process it started, so there this line is the only evidence that the
-// change was applied. The other platforms have an exit code and ignore it.
-const AppliedMarker = "netbird-elevated: applied"
-
-var (
-	// ErrDeclined reports that the user dismissed the prompt or did not
-	// authenticate. Nothing happened and nothing is wrong: a caller undoes its
-	// optimistic update and stays quiet.
-	ErrDeclined = errors.New("authorization declined")
-
-	// ErrUnavailable reports that this host has no elevation mechanism we can
-	// drive: no polkit on a Unix desktop, or an executable we decline to run as
-	// root. A caller falls back to telling the user which command to run.
-	ErrUnavailable = errors.New("no privilege elevation mechanism available")
-)
-
-// Run runs this executable with args under the platform's elevation mechanism
-// and waits for it to exit. A non-zero exit is returned as an error, so the
-// caller can treat a completed Run as the operation having succeeded.
-//
-// The args are the caller's own command line, so they cross no privilege
-// boundary: only a user who has just authenticated as an administrator can get
-// them run at all.
-func Run(ctx context.Context, args ...string) error {
-	self, err := trustedSelf()
-	if err != nil {
-		return err
-	}
-	return run(ctx, self, args)
-}
-
-// Available reports whether Run has a mechanism to use on this host, so a caller
-// can offer the prompt only when there is one and otherwise fall back to
-// guidance the user can act on. It answers from what is installed, not from what
-// the user is allowed to do: an administrator's password may still be required
-// and may still not be given, which is ErrDeclined from Run.
-func Available() bool {
-	if _, err := trustedSelf(); err != nil {
-		// Worth a line: this is also what a build run from a group-writable
-		// directory hits, and there is nothing in the UI to say why the offer is
-		// missing.
-		log.Debugf("not offering privilege elevation: %v", err)
-		return false
-	}
-	return mechanismAvailable()
-}

client/internal/elevate/output.go

@@ -1,18 +0,0 @@
-package elevate
-
-import "strings"
-
-// noOutput stands in for a process that said nothing, so that a report of what it
-// said still reads as a sentence.
-const noOutput = "no output"
-
-func firstLine(s string) string {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return noOutput
-	}
-	if i := strings.IndexByte(s, '\n'); i >= 0 {
-		return s[:i]
-	}
-	return s
-}

client/internal/elevate/output_test.go

@@ -1,21 +0,0 @@
-package elevate
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestFirstLine(t *testing.T) {
-	tests := []struct{ in, want string }{
-		{in: "", want: noOutput},
-		{in: "  \n ", want: noOutput},
-		{in: "one line", want: "one line"},
-		{in: "first\nsecond", want: "first"},
-		{in: "\nsecond\n", want: "second"},
-	}
-
-	for _, tt := range tests {
-		assert.Equal(t, tt.want, firstLine(tt.in), "input %q", tt.in)
-	}
-}

client/internal/elevate/run_darwin.go

@@ -1,359 +0,0 @@
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-	"syscall"
-	"unsafe"
-
-	"github.com/ebitengine/purego"
-	log "github.com/sirupsen/logrus"
-)
-
-// Authorization Services, reached through purego rather than cgo so the released
-// binaries keep building with CGO_ENABLED=0.
-//
-// The prompt belongs to this process, which is what makes it carry the
-// application's name and our own explanation. Going through osascript instead puts
-// the very same trampoline behind a dialog attributed to osascript, and means
-// handing a shell a command line to re-parse.
-//
-// # On AuthorizationExecuteWithPrivileges
-//
-// It is deprecated, and Apple's guidance (Quinn, "BSD Privilege Escalation on
-// macOS", developer.apple.com/forums/thread/708765) is "while it still works, it's
-// been deprecated for many years. Do not use it in a widely distributed product."
-// It is used here anyway, knowingly, because the alternatives Apple offers are for
-// *obtaining* ongoing privileges — an installer package, SMAppService, SMJobBless —
-// and NetBird already has what they would install: a launchd daemon running as
-// root. What is missing is only a way for an unprivileged client to ask it to act.
-//
-// The way to that without a deprecated call is to authorize the client instead of
-// elevating one: the app takes the right with AuthorizationCreate, passes the
-// AuthorizationExternalForm to the daemon, and the daemon checks it with
-// AuthorizationCopyRights before acting — none of which is deprecated. It is the
-// better design and it is where this should end up. It also means the daemon
-// accepting an authorization over its control socket, which is a new way to be
-// asked for privileged work and wants reviewing as such, so it is deliberately not
-// bundled in with the rest of this.
-//
-// Until then, three things keep the deprecation from being a trap. Every symbol is
-// resolved with an error rather than a panic, so a macOS that has dropped this
-// function leaves the app offering the user a command instead of crashing on the
-// way to a prompt. A failure to run the tool is reported as ErrUnavailable, so the
-// fallback is the same one an agent-less Linux session gets. And the whole path
-// runs under guard, which turns a panic out of the FFI layer into that same
-// fallback.
-//
-// The trampoline passes on the environment it was given, so what it starts as root
-// must be an executable this user's peers cannot influence: that is what
-// trustedSelf refuses, and what signing the binary settles for the loader.
-
-const (
-	securityFramework = "/System/Library/Frameworks/Security.framework/Security"
-	libSystem         = "/usr/lib/libSystem.B.dylib"
-
-	// trampoline is what the framework hands the tool to. Present on every macOS,
-	// and worth confirming before offering a prompt rather than mid-prompt.
-	trampoline = "/usr/libexec/security_authtrampoline"
-)
-
-// rightExecute is the right an administrator holds, and what
-// AuthorizationExecuteWithPrivileges requires of us.
-const rightExecute = "system.privilege.admin"
-
-// promptKey is kAuthorizationEnvironmentPrompt, which puts a sentence of ours above
-// the system's in the dialog. It is about the change rather than the mechanism.
-const (
-	promptKey  = "prompt"
-	promptText = "NetBird needs to change a setting that grants SSH access to this computer."
-)
-
-// OSStatus values from SecBase.h that mean something to us; anything else is
-// reported as it comes.
-const (
-	errAuthorizationSuccess               = 0
-	errAuthorizationDenied                = -60005
-	errAuthorizationCanceled              = -60006
-	errAuthorizationInteractionNotAllowed = -60007
-	errAuthorizationToolExecuteFailure    = -60031
-	errAuthorizationToolEnvironmentError  = -60032
-)
-
-// AuthorizationFlags from Authorization.h.
-const (
-	flagDefaults           = 0
-	flagInteractionAllowed = 1 << 0
-	flagExtendRights       = 1 << 1
-	flagDestroyRights      = 1 << 3
-	flagPreAuthorize       = 1 << 4
-)
-
-// authorizationItem mirrors AuthorizationItem: a name, and a value the name gives
-// meaning to. 32 bytes on both amd64 and arm64.
-type authorizationItem struct {
-	name        *byte
-	valueLength uintptr
-	value       unsafe.Pointer
-	// flags is reserved by the API and always zero. Declared because the layout
-	// is the contract: without it the struct is 24 bytes where C reads 32.
-	flags uint32 //nolint:unused // part of the C layout
-}
-
-// authorizationItemSet mirrors AuthorizationItemSet, which serves as both an
-// AuthorizationRights and an AuthorizationEnvironment.
-type authorizationItemSet struct {
-	count uint32
-	items *authorizationItem
-}
-
-var (
-	authorizationCreate                func(rights, environment *authorizationItemSet, flags uint32, authorization *uintptr) int32
-	authorizationExecuteWithPrivileges func(authorization uintptr, pathToTool string, options uint32, arguments *uintptr, communicationsPipe *uintptr) int32
-	authorizationFree                  func(authorization uintptr, flags uint32) int32
-	fileno                             func(stream uintptr) int32
-	fclose                             func(stream uintptr) int32
-
-	loadOnce sync.Once
-	loadErr  error
-)
-
-// load resolves the functions once. A framework that cannot be opened, or a symbol
-// that is no longer there, leaves the host without a mechanism rather than taking
-// the process down with it: see the note on deprecation above.
-func load() error {
-	loadOnce.Do(func() { loadErr = guard("loading Security.framework", resolve) })
-	return loadErr
-}
-
-// guard turns a panic out of the FFI layer into an error, so an API that has
-// changed under us costs the user a prompt rather than the window they were
-// clicking in. purego panics on a signature it cannot map, and this is the one
-// place in the client that calls a deprecated system function.
-//
-// It catches Go panics, which is what purego raises. A fault inside the framework
-// itself is not a panic and not recoverable; the layout the tests pin down is what
-// stands between us and that.
-func guard(what string, fn func() error) (err error) {
-	defer func() {
-		r := recover()
-		if r == nil {
-			return
-		}
-		log.Errorf("%s panicked: %v", what, r)
-		err = fmt.Errorf("%w: %s: %v", ErrUnavailable, what, r)
-	}()
-	return fn()
-}
-
-func resolve() error {
-	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
-	if err != nil {
-		return fmt.Errorf("open %s: %w", securityFramework, err)
-	}
-	system, err := purego.Dlopen(libSystem, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
-	if err != nil {
-		return fmt.Errorf("open %s: %w", libSystem, err)
-	}
-
-	// purego.RegisterLibFunc panics on a symbol it cannot find, which is not how a
-	// deprecated function's disappearance should reach the user.
-	for _, fn := range []struct {
-		ptr    any
-		handle uintptr
-		name   string
-	}{
-		{&authorizationCreate, security, "AuthorizationCreate"},
-		{&authorizationExecuteWithPrivileges, security, "AuthorizationExecuteWithPrivileges"},
-		{&authorizationFree, security, "AuthorizationFree"},
-		{&fileno, system, "fileno"},
-		{&fclose, system, "fclose"},
-	} {
-		symbol, err := purego.Dlsym(fn.handle, fn.name)
-		if err != nil {
-			return fmt.Errorf("resolve %s: %w", fn.name, err)
-		}
-		if symbol == 0 {
-			return fmt.Errorf("resolve %s: not present on this system", fn.name)
-		}
-		purego.RegisterFunc(fn.ptr, symbol)
-	}
-	return nil
-}
-
-// run asks the system to run self as root: first for the right, which is what puts
-// up the authentication dialog and collects the password or takes the Touch ID,
-// then for the tool. The credentials go to the system's authorization trampoline
-// and never to us.
-//
-// The context bounds only our own waiting; the dialog belongs to the system and
-// closes when the user answers it.
-func run(ctx context.Context, self string, args []string) error {
-	if err := load(); err != nil {
-		return fmt.Errorf("%w: %v", ErrUnavailable, err)
-	}
-
-	return guard("asking for privileges", func() error {
-		authorization, err := authorize()
-		if err != nil {
-			return err
-		}
-		defer authorizationFree(authorization, flagDestroyRights)
-
-		return execute(ctx, authorization, self, args)
-	})
-}
-
-func mechanismAvailable() bool {
-	if err := load(); err != nil {
-		return false
-	}
-	info, err := os.Stat(trampoline)
-	return err == nil && !info.IsDir()
-}
-
-// authorize obtains the right, prompting for it. A dismissed dialog comes back as
-// errAuthorizationCanceled and a password given up on as errAuthorizationDenied;
-// both are the user's answer rather than a failure.
-func authorize() (uintptr, error) {
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
-	environment := itemSet(&pinner, promptItem(&pinner))
-
-	var authorization uintptr
-	status := authorizationCreate(rights, environment,
-		flagDefaults|flagInteractionAllowed|flagPreAuthorize|flagExtendRights, &authorization)
-
-	switch status {
-	case errAuthorizationSuccess:
-		return authorization, nil
-	case errAuthorizationCanceled, errAuthorizationDenied:
-		return 0, ErrDeclined
-	case errAuthorizationInteractionNotAllowed:
-		// Nowhere to put a dialog, so there is nobody to ask: a launch daemon, or
-		// a session with no window server.
-		return 0, fmt.Errorf("%w: this session cannot show an authorization prompt", ErrUnavailable)
-	default:
-		return 0, fmt.Errorf("request %s: OSStatus %d", rightExecute, status)
-	}
-}
-
-// execute runs the tool with the right in hand and waits for it by reading the pipe
-// it is given until the tool closes it.
-//
-// AuthorizationExecuteWithPrivileges reports no exit status and does not say what
-// process it started, which is why the one-shot says so itself: what it prints is
-// the only evidence that the change was applied.
-func execute(ctx context.Context, authorization uintptr, self string, args []string) error {
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	argv := make([]uintptr, 0, len(args)+1)
-	for _, arg := range args {
-		argv = append(argv, uintptr(unsafe.Pointer(cString(&pinner, arg))))
-	}
-	argv = append(argv, 0)
-	pinner.Pin(&argv[0])
-
-	var pipe uintptr
-	status := authorizationExecuteWithPrivileges(authorization, self, flagDefaults, &argv[0], &pipe)
-	switch status {
-	case errAuthorizationSuccess:
-	case errAuthorizationCanceled:
-		return ErrDeclined
-	case errAuthorizationToolExecuteFailure, errAuthorizationToolEnvironmentError:
-		// The right was granted and the tool still did not start. Nothing the user
-		// can do about it from here, so point them at the command instead.
-		return fmt.Errorf("%w: the system would not run %s elevated (OSStatus %d)", ErrUnavailable, self, status)
-	default:
-		return fmt.Errorf("run %s elevated: OSStatus %d", self, status)
-	}
-
-	out, err := readPipe(ctx, pipe)
-	if err != nil {
-		return err
-	}
-	return checkApplied(out)
-}
-
-// checkApplied reads the one-shot's report, which stands in for the exit status
-// there is no way to ask for here. A run that said nothing did not apply the
-// change, whatever else went on.
-func checkApplied(out string) error {
-	if !strings.Contains(out, AppliedMarker) {
-		return fmt.Errorf("elevated netbird did not report the change as applied: %s", firstLine(out))
-	}
-	return nil
-}
-
-// readPipe drains the tool's output, which ends when the tool exits and is
-// therefore also how we wait for it.
-func readPipe(ctx context.Context, pipe uintptr) (string, error) {
-	if pipe == 0 {
-		return "", nil
-	}
-	defer fclose(pipe)
-
-	fd := int(fileno(pipe))
-	if fd < 0 {
-		return "", nil
-	}
-
-	var out strings.Builder
-	buf := make([]byte, 4096)
-	for {
-		if err := ctx.Err(); err != nil {
-			return out.String(), err
-		}
-		n, err := syscall.Read(fd, buf)
-		if n > 0 {
-			out.Write(buf[:n])
-		}
-		switch {
-		case errors.Is(err, syscall.EINTR):
-			// A signal landed mid-read, which says nothing about the tool.
-			continue
-		case err != nil:
-			log.Debugf("read the elevated process's output: %v", err)
-			return out.String(), nil
-		case n <= 0:
-			// End of file: the tool closed the pipe, which is how it exiting
-			// reaches us.
-			return out.String(), nil
-		}
-	}
-}
-
-// itemSet builds an AuthorizationItemSet over items, pinned for the call.
-func itemSet(pinner *runtime.Pinner, items ...authorizationItem) *authorizationItemSet {
-	pinner.Pin(&items[0])
-	set := &authorizationItemSet{count: uint32(len(items)), items: &items[0]}
-	pinner.Pin(set)
-	return set
-}
-
-// promptItem is the environment entry carrying our sentence for the dialog.
-func promptItem(pinner *runtime.Pinner) authorizationItem {
-	value := []byte(promptText)
-	pinner.Pin(&value[0])
-	return authorizationItem{
-		name:        cString(pinner, promptKey),
-		valueLength: uintptr(len(value)),
-		value:       unsafe.Pointer(&value[0]),
-	}
-}
-
-// cString returns a NUL-terminated copy of s, pinned so the C side may hold it for
-// the duration of the call.
-func cString(pinner *runtime.Pinner, s string) *byte {
-	b := append([]byte(s), 0)
-	pinner.Pin(&b[0])
-	return &b[0]
-}

client/internal/elevate/run_darwin_test.go

@@ -1,111 +0,0 @@
-package elevate
-
-import (
-	"errors"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The framework has to load and the symbols have to resolve, or nothing else here
-// means anything.
-func TestSecurityFrameworkLoads(t *testing.T) {
-	require.NoError(t, load(), "Security.framework must open")
-
-	for name, fn := range map[string]any{
-		"AuthorizationCreate":                authorizationCreate,
-		"AuthorizationExecuteWithPrivileges": authorizationExecuteWithPrivileges,
-		"AuthorizationFree":                  authorizationFree,
-		"fileno":                             fileno,
-		"fclose":                             fclose,
-	} {
-		assert.NotNil(t, fn, "%s must resolve", name)
-	}
-}
-
-// A request with no interaction allowed exercises the whole call — the rights and
-// environment structs, and the OSStatus that comes back — without a dialog anybody
-// has to answer. What the system decides is its business; that it decides at all is
-// what this asserts.
-func TestAuthorizationCreateWithoutInteraction(t *testing.T) {
-	if err := load(); err != nil {
-		t.Skipf("Security.framework did not open: %v", err)
-	}
-
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
-	environment := itemSet(&pinner, promptItem(&pinner))
-	require.EqualValues(t, 1, rights.count, "the rights struct layout must match the C one")
-
-	var authorization uintptr
-	status := authorizationCreate(rights, environment, flagDefaults|flagExtendRights, &authorization)
-
-	switch status {
-	case errAuthorizationSuccess:
-		// Credentials were already cached for this session.
-		authorizationFree(authorization, flagDestroyRights)
-	case errAuthorizationDenied, errAuthorizationInteractionNotAllowed:
-		// The expected answers when nobody may be asked.
-	default:
-		require.Failf(t, "unknown OSStatus", "AuthorizationCreate returned %d, want a status we recognise", status)
-	}
-}
-
-// Asking with a right nobody has must not be mistaken for a declined prompt: the
-// caller would report nothing at all.
-func TestAuthorizeUnknownRightIsNotDeclined(t *testing.T) {
-	if err := load(); err != nil {
-		t.Skipf("Security.framework did not open: %v", err)
-	}
-
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, "io.netbird.right.that.does.not.exist")})
-
-	var authorization uintptr
-	status := authorizationCreate(rights, nil, flagDefaults|flagExtendRights, &authorization)
-	if status == errAuthorizationSuccess {
-		authorizationFree(authorization, flagDestroyRights)
-	}
-	assert.NotEqual(t, int32(errAuthorizationSuccess), status, "a right that does not exist must not be granted")
-}
-
-func TestMechanismAvailable(t *testing.T) {
-	assert.True(t, mechanismAvailable(), "the trampoline exists on every macOS")
-}
-
-// The one-shot's report is what stands in for an exit status here, so a run that
-// says nothing must not read as success.
-func TestCheckApplied(t *testing.T) {
-	require.NoError(t, checkApplied(AppliedMarker+"\n"), "the report the one-shot prints")
-	require.NoError(t, checkApplied("some warning\n"+AppliedMarker+"\n"), "the report after other output")
-
-	assert.Error(t, checkApplied(""), "a run that printed nothing did not apply the change")
-	assert.Error(t, checkApplied("dyld: library not loaded\n"), "output that is not the report")
-}
-
-// A panic out of the FFI layer has to reach the caller as "no mechanism", which is
-// the outcome that offers the user the command instead of taking the window down.
-func TestGuardTurnsAPanicIntoUnavailable(t *testing.T) {
-	err := guard("pretending to call something", func() error {
-		panic("purego: signature it cannot map")
-	})
-
-	require.ErrorIs(t, err, ErrUnavailable, "a panic must read as a missing mechanism")
-	assert.Contains(t, err.Error(), "pretending to call something", "what panicked")
-}
-
-// guard wraps every darwin path, so what a caller switches on has to survive it.
-func TestGuardPassesErrorsThrough(t *testing.T) {
-	sentinel := errors.New("the call itself failed")
-	assert.ErrorIs(t, guard("calling", func() error { return sentinel }), sentinel,
-		"the error it was given")
-	assert.ErrorIs(t, guard("calling", func() error { return ErrDeclined }), ErrDeclined,
-		"a declined prompt stays declined")
-	assert.NoError(t, guard("calling", func() error { return nil }), "a call that worked")
-}

client/internal/elevate/run_unix.go

@@ -1,117 +0,0 @@
-//go:build linux
-
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-// pkexec exit codes that are about the authorization rather than about the program
-// we asked it to run. The manual page reserves both.
-const (
-	// exitDismissed is returned when the user dismissed the authentication
-	// dialog.
-	exitDismissed = 126
-	// exitNotAuthorized is returned when the authorization was not obtained. That
-	// covers the user saying no as well as pkexec having had nobody to ask: see
-	// noAgentMarkers.
-	exitNotAuthorized = 127
-)
-
-// exitNotAuthorized covers three different endings that only pkexec's own words
-// tell apart, so they are matched here. Read with LC_ALL=C so the words are the
-// ones written below.
-//
-// refusedMarker is a refusal: the user said no, gave up on the password, or holds
-// an account that may not elevate at all.
-const refusedMarker = "Not authorized"
-
-// noAgentMarkers say pkexec had no way to ask: no agent registered for the
-// session, and no controlling terminal for the textual agent it falls back to.
-var noAgentMarkers = []string{"authentication agent", "controlling terminal"}
-
-// run asks polkit to run self as root. pkexec hands the request to the session's
-// polkit agent, which is what prompts and what collects any password; we see only
-// its verdict.
-//
-// The environment is otherwise deliberately not passed through: pkexec clears it
-// bar a small allowlist, and the one-shot needs nothing from it.
-func run(ctx context.Context, self string, args []string) error {
-	pkexec, err := exec.LookPath("pkexec")
-	if err != nil {
-		return fmt.Errorf("%w: pkexec is not installed", ErrUnavailable)
-	}
-
-	cmd := exec.CommandContext(ctx, pkexec, append([]string{self}, args...)...)
-	// C locale so pkexec's own diagnostics are the ones noAgentMarkers knows.
-	cmd.Env = append(os.Environ(), "LC_ALL=C")
-	var stderr strings.Builder
-	cmd.Stderr = &stderr
-	// The one-shot reports itself on stdout for macOS's sake, where there is no
-	// exit status to read. Here there is one, so that line is noise.
-	cmd.Stdout = io.Discard
-
-	err = cmd.Run()
-	if err == nil {
-		return nil
-	}
-
-	var exitErr *exec.ExitError
-	if !errors.As(err, &exitErr) {
-		return fmt.Errorf("run pkexec: %w", err)
-	}
-
-	// Matched against everything pkexec said, reported as one line: a complaint
-	// that is not the first thing printed still has to be recognised, and reading
-	// it as a refusal would swallow it.
-	full := stderr.String()
-	out := firstLine(full)
-
-	switch exitErr.ExitCode() {
-	case exitDismissed:
-		return ErrDeclined
-	case exitNotAuthorized:
-		return notAuthorized(full, out)
-	default:
-		return fmt.Errorf("elevated netbird exited with %d: %s", exitErr.ExitCode(), out)
-	}
-}
-
-// notAuthorized sorts out the three endings pkexec reports as exitNotAuthorized.
-//
-// It also returns that code when the authorization succeeded and it then could
-// not run the program, so a refusal has to be recognised rather than assumed:
-// reading every one of these as "the user said no" would revert the control in
-// silence on a host where elevation is broken.
-func notAuthorized(full, out string) error {
-	switch {
-	case hasAny(full, noAgentMarkers):
-		return fmt.Errorf("%w: polkit had no way to ask: %s", ErrUnavailable, out)
-	case out == noOutput, strings.Contains(full, refusedMarker):
-		// The user said no, which needs no message; that an account barred from
-		// elevating altogether lands here too is why the reason is kept.
-		return fmt.Errorf("%w: %s", ErrDeclined, out)
-	default:
-		return fmt.Errorf("pkexec could not run elevated netbird: %s", out)
-	}
-}
-
-func hasAny(s string, markers []string) bool {
-	for _, marker := range markers {
-		if strings.Contains(s, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func mechanismAvailable() bool {
-	_, err := exec.LookPath("pkexec")
-	return err == nil
-}

client/internal/elevate/run_unix_test.go

@@ -1,110 +0,0 @@
-//go:build linux
-
-package elevate
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// fakePkexec puts a pkexec on PATH that exits with the given code, so the
-// mapping from polkit's exit codes onto our errors can be exercised without a
-// polkit agent.
-func fakePkexec(t *testing.T, exitCode int, stderr string) {
-	t.Helper()
-
-	dir := t.TempDir()
-	script := fmt.Sprintf("#!/bin/sh\necho %s >&2\nexit %d\n", shellQuote(stderr), exitCode)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "pkexec"), []byte(script), 0o700), "write the fake pkexec")
-	t.Setenv("PATH", dir)
-}
-
-func shellQuote(s string) string {
-	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
-}
-
-func TestRunMapsPkexecExitCodes(t *testing.T) {
-	tests := []struct {
-		name     string
-		exitCode int
-		stderr   string
-		wantErr  error
-	}{
-		{name: "applied", exitCode: 0},
-		{
-			name:     "dialog dismissed",
-			exitCode: exitDismissed,
-			stderr:   "Error executing command as another user: Request dismissed",
-			wantErr:  ErrDeclined,
-		},
-		{
-			// What a graphical agent reports for a cancelled prompt. Not a
-			// failure: the user was asked and answered.
-			name:     "prompt cancelled",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error executing command as another user: Not authorized",
-			wantErr:  ErrDeclined,
-		},
-		{
-			// The same status, but pkexec never got to ask anybody.
-			name:     "no agent and no terminal to fall back on",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address",
-			wantErr:  ErrUnavailable,
-		},
-		{
-			// And the same status again once the authorization succeeded and
-			// pkexec could not run what it had been authorized to run. Reading
-			// that as a refusal would revert the control in silence on a host
-			// where elevation is broken.
-			name:     "authorized but not runnable",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error executing command as another user: No such file or directory",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakePkexec(t, tt.exitCode, tt.stderr)
-
-			err := run(context.Background(), "/nonexistent/netbird-ui", []string{"--flag"})
-			switch {
-			case tt.wantErr != nil:
-				require.ErrorIs(t, err, tt.wantErr, "exit %d said %q", tt.exitCode, tt.stderr)
-			case tt.exitCode == 0:
-				require.NoError(t, err, "a pkexec that exited cleanly applied the change")
-			default:
-				require.Error(t, err, "exit %d said %q", tt.exitCode, tt.stderr)
-				assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
-				assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
-			}
-		})
-	}
-}
-
-// An exit code that is not polkit's is the one-shot's own failure, and has to
-// stay distinguishable from a declined prompt: the caller reports it.
-func TestRunReportsOneShotFailure(t *testing.T) {
-	fakePkexec(t, 3, "the one-shot said no")
-
-	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
-
-	require.Error(t, err, "a one-shot that failed is not a prompt that was answered")
-	assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
-	assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
-}
-
-func TestRunWithoutPkexecIsUnavailable(t *testing.T) {
-	t.Setenv("PATH", t.TempDir())
-
-	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
-	require.ErrorIs(t, err, ErrUnavailable, "no pkexec means no mechanism")
-	assert.False(t, mechanismAvailable(), "mechanismAvailable without pkexec on PATH")
-}

client/internal/elevate/run_unsupported.go

@@ -1,19 +0,0 @@
-//go:build !windows && !darwin && !linux
-
-package elevate
-
-import "context"
-
-// run reports that this platform has no elevation prompt to drive.
-//
-// The desktop app is the only caller and is not built for any of these: mobile
-// and WASM have no local user to ask, and the FreeBSD client ships without a UI.
-// pkexec would be the mechanism there, and run_unix.go is what to widen if that
-// changes.
-func run(context.Context, string, []string) error {
-	return ErrUnavailable
-}
-
-func mechanismAvailable() bool {
-	return false
-}

client/internal/elevate/run_windows.go

@@ -1,193 +0,0 @@
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"runtime"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-const (
-	// seeMaskNoCloseProcess keeps the started process's handle open in
-	// hProcess so we can wait for it.
-	seeMaskNoCloseProcess = 0x00000040
-	// seeMaskNoAsync makes ShellExecuteExW finish its work before returning,
-	// which it must when the calling thread does not pump messages.
-	seeMaskNoAsync = 0x00000100
-	// seeMaskFlagNoUI suppresses the shell's own error dialogs; the UAC consent
-	// dialog is not one of them and still appears.
-	seeMaskFlagNoUI = 0x00000400
-
-	// swHide: the one-shot has no window to show.
-	swHide = 0
-
-	// sFalse (S_FALSE) answers CoInitializeEx when COM is already up on this
-	// thread in the mode we asked for; rpcChangedMode (RPC_E_CHANGED_MODE) when
-	// it is up in the other one.
-	sFalse         = 1
-	rpcChangedMode = 0x80010106
-)
-
-// shellExecuteInfoW mirrors SHELLEXECUTEINFOW. The field order and Go's own
-// padding match the C layout on both 386 and amd64.
-type shellExecuteInfoW struct {
-	cbSize         uint32
-	fMask          uint32
-	hwnd           windows.HWND
-	lpVerb         *uint16
-	lpFile         *uint16
-	lpParameters   *uint16
-	lpDirectory    *uint16
-	nShow          int32
-	hInstApp       windows.Handle
-	lpIDList       uintptr
-	lpClass        *uint16
-	hkeyClass      windows.Handle
-	dwHotKey       uint32
-	hIconOrMonitor windows.Handle
-	hProcess       windows.Handle
-}
-
-var (
-	shell32            = windows.NewLazySystemDLL("shell32.dll")
-	procShellExecuteEx = shell32.NewProc("ShellExecuteExW")
-)
-
-// run starts self elevated with the "runas" verb, which is what raises the UAC
-// consent dialog, and waits for it to finish. Windows decides whether consent is
-// enough or an administrator's credentials are needed, and collects them itself.
-func run(ctx context.Context, self string, args []string) error {
-	verb, err := windows.UTF16PtrFromString("runas")
-	if err != nil {
-		return fmt.Errorf("encode verb: %w", err)
-	}
-	file, err := windows.UTF16PtrFromString(self)
-	if err != nil {
-		return fmt.Errorf("encode %s: %w", self, err)
-	}
-	params, err := windows.UTF16PtrFromString(windows.ComposeCommandLine(args))
-	if err != nil {
-		return fmt.Errorf("encode arguments: %w", err)
-	}
-
-	info := shellExecuteInfoW{
-		fMask:        seeMaskNoCloseProcess | seeMaskNoAsync | seeMaskFlagNoUI,
-		hwnd:         ownerWindow(),
-		lpVerb:       verb,
-		lpFile:       file,
-		lpParameters: params,
-		nShow:        swHide,
-	}
-	info.cbSize = uint32(unsafe.Sizeof(info))
-
-	process, err := shellExecute(&info)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err := windows.CloseHandle(process); err != nil {
-			log.Debugf("close elevated process handle: %v", err)
-		}
-	}()
-
-	return waitForProcess(ctx, process)
-}
-
-// shellExecute performs the call itself. ShellExecuteExW wants COM initialised on
-// the calling thread, so the goroutine is pinned to one for the duration and COM
-// is set up on it; an "already initialised, different mode" answer is fine,
-// because then somebody else has done it for us.
-func shellExecute(info *shellExecuteInfoW) (windows.Handle, error) {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	switch err := windows.CoInitializeEx(0, windows.COINIT_APARTMENTTHREADED); {
-	case err == nil, isHResult(err, sFalse):
-		// Ours, or already initialised in the same mode: either way this call
-		// counts and has to be balanced.
-		defer windows.CoUninitialize()
-	case isHResult(err, rpcChangedMode):
-		// The thread is already in the other apartment model. ShellExecuteExW
-		// works there too, and there is nothing of ours to balance.
-	default:
-		return 0, fmt.Errorf("initialise COM: %w", err)
-	}
-
-	ret, _, lastErr := procShellExecuteEx.Call(uintptr(unsafe.Pointer(info)))
-	if ret != 0 {
-		return info.hProcess, nil
-	}
-
-	if errors.Is(lastErr, windows.ERROR_CANCELLED) {
-		return 0, ErrDeclined
-	}
-	return 0, fmt.Errorf("run elevated: %w", lastErr)
-}
-
-// ownerWindow returns this process's foreground window, and 0 when the window in
-// front belongs to somebody else or cannot be attributed. ShellExecuteExW takes it
-// as the parent for the UI it raises, which is what keeps the consent dialog in
-// front of the window the user was just clicking in instead of behind it. It is
-// also what a remote-desktop session needs to place the dialog at all when the
-// secure desktop is switched off.
-func ownerWindow() windows.HWND {
-	hwnd := windows.GetForegroundWindow()
-	if hwnd == 0 {
-		return 0
-	}
-
-	var pid uint32
-	if _, err := windows.GetWindowThreadProcessId(hwnd, &pid); err != nil {
-		log.Debugf("cannot attribute the foreground window, raising the prompt without an owner: %v", err)
-		return 0
-	}
-	if pid != windows.GetCurrentProcessId() {
-		return 0
-	}
-	return hwnd
-}
-
-// isHResult reports whether err carries the given HRESULT. CoInitializeEx
-// returns its HRESULT as an Errno, so the comparison is on the raw value.
-func isHResult(err error, hresult uintptr) bool {
-	var errno windows.Errno
-	return errors.As(err, &errno) && uintptr(errno) == hresult
-}
-
-func waitForProcess(ctx context.Context, process windows.Handle) error {
-	// The wait is interruptible so a cancelled context stops us waiting on a
-	// consent dialog nobody is going to answer. The elevated process is not
-	// ours to kill, and it either applies the change or does not.
-	for {
-		event, err := windows.WaitForSingleObject(process, 250)
-		if err != nil {
-			return fmt.Errorf("wait for the elevated process: %w", err)
-		}
-		if event == uint32(windows.WAIT_OBJECT_0) {
-			break
-		}
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-	}
-
-	var code uint32
-	if err := windows.GetExitCodeProcess(process, &code); err != nil {
-		return fmt.Errorf("read the elevated process's exit code: %w", err)
-	}
-	if code != 0 {
-		return fmt.Errorf("elevated netbird exited with %d", code)
-	}
-	return nil
-}
-
-// mechanismAvailable is true on Windows: UAC prompts for consent when the user
-// is an administrator and for an administrator's credentials when they are not,
-// so there is always something to ask.
-func mechanismAvailable() bool {
-	return true
-}

client/internal/elevate/trusted.go

@@ -1,40 +0,0 @@
-package elevate
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// trustedSelf returns the path of this executable, provided it is one we are
-// willing to have run as root.
-//
-// The check is what keeps elevation from becoming a way to launder someone
-// else's code into a root process: the user consents to NetBird being elevated,
-// having been shown NetBird's name, so what runs must be the file NetBird was
-// installed as and not something a third party could have swapped for it. An
-// executable only its owner can write is that; anything wider is refused, and
-// the caller falls back to showing the command instead.
-//
-// The owner writing to their own executable is not part of that threat: code
-// running as the user can already prompt them for anything, and could just as
-// well ask them to run the command by hand. What matters is that no *other*
-// unprivileged account can reach it.
-func trustedSelf() (string, error) {
-	exe, err := os.Executable()
-	if err != nil {
-		return "", fmt.Errorf("locate this executable: %w", err)
-	}
-
-	// Resolve symlinks so the checks below apply to the file that would actually
-	// be executed, not to a link somebody else may control.
-	resolved, err := filepath.EvalSymlinks(exe)
-	if err != nil {
-		return "", fmt.Errorf("resolve %s: %w", exe, err)
-	}
-
-	if err := checkOnlyOwnerWritable(resolved); err != nil {
-		return "", fmt.Errorf("%w: %s cannot be trusted to run as root: %w", ErrUnavailable, resolved, err)
-	}
-	return resolved, nil
-}

client/internal/elevate/trusted_group_darwin.go

@@ -1,10 +0,0 @@
-package elevate
-
-// adminWriteGIDs are the groups whose write access to an executable does not
-// widen who could authorize elevating it.
-//
-// macOS installs applications as root:admin, mode 0775, /Applications included,
-// so requiring owner-only write would reject every normal install. Group admin
-// (gid 80) is exactly the set of accounts that can answer the authentication
-// dialog, so its write access grants nothing the prompt would not.
-var adminWriteGIDs = []uint32{0, 80}

client/internal/elevate/trusted_group_unix.go

@@ -1,9 +0,0 @@
-//go:build !windows && !darwin
-
-package elevate
-
-// adminWriteGIDs are the groups whose write access to an executable does not
-// widen who could authorize elevating it. Only root's own group qualifies here:
-// a distribution installs into root-owned directories, and there is no
-// system-wide administrators group that both writes them and answers polkit.
-var adminWriteGIDs = []uint32{0}

client/internal/elevate/trusted_unix.go

@@ -1,146 +0,0 @@
-//go:build !windows
-
-package elevate
-
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"strings"
-	"syscall"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// groupFile lists which accounts are in which group, for the membership a user
-// private group's name does not state: see groupHasOtherMembers.
-const groupFile = "/etc/group"
-
-// checkOnlyOwnerWritable reports an error unless path, and every directory leading
-// to it, is owned by either root or this user and writable by nobody who could not
-// already act as its owner. A writable directory is as good as a writable file,
-// since anything in it can be replaced, so the whole chain is checked.
-func checkOnlyOwnerWritable(path string) error {
-	self := uint32(os.Getuid())
-
-	for dir := path; ; dir = filepath.Dir(dir) {
-		info, err := os.Lstat(dir)
-		if err != nil {
-			return fmt.Errorf("stat %s: %w", dir, err)
-		}
-
-		stat, ok := info.Sys().(*syscall.Stat_t)
-		if !ok {
-			return errors.New("file ownership is unavailable on this platform")
-		}
-		if stat.Uid != 0 && stat.Uid != self {
-			return fmt.Errorf("%s is owned by uid %d, neither root nor this user", dir, stat.Uid)
-		}
-
-		if err := checkWriteBits(dir, info, stat.Uid, stat.Gid); err != nil {
-			return err
-		}
-
-		if parent := filepath.Dir(dir); parent == dir {
-			return nil
-		}
-	}
-}
-
-func checkWriteBits(path string, info os.FileInfo, uid, gid uint32) error {
-	// On a directory the sticky bit stands in for the write bits: whoever may
-	// write there still cannot replace an entry they do not own, which is the
-	// only thing that would matter to us. /tmp is the usual example.
-	sticky := info.IsDir() && info.Mode()&os.ModeSticky != 0
-
-	return writeBitsAllow(path, info.Mode().Perm(), sticky, groupWriteAllowed(uid, gid))
-}
-
-// writeBitsAllow decides on the permission bits alone, given whether the group's
-// write access has been vouched for.
-func writeBitsAllow(path string, perm os.FileMode, sticky, groupAllowed bool) error {
-	if sticky {
-		return nil
-	}
-	if perm&0o020 != 0 && !groupAllowed {
-		return fmt.Errorf("%s is writable by a group with members other than its owner (%v)", path, perm)
-	}
-	if perm&0o002 != 0 {
-		return fmt.Errorf("%s is world-writable (%v)", path, perm)
-	}
-	return nil
-}
-
-// groupWriteAllowed reports whether a group's write access to a file owned by uid
-// puts it in reach of anyone who could not already act as that owner.
-//
-// Two ways it does not. A group in adminWriteGIDs holds the accounts that can
-// answer the elevation prompt anyway. And a user private group is how Debian,
-// Ubuntu and Fedora ship: their umask of 002 makes a home directory and
-// everything built in it group-writable, so refusing that would refuse every
-// build not installed from a package.
-func groupWriteAllowed(uid, gid uint32) bool {
-	if slices.Contains(adminWriteGIDs, gid) {
-		return true
-	}
-
-	group, err := user.LookupGroupId(strconv.FormatUint(uint64(gid), 10))
-	if err != nil {
-		log.Debugf("cannot look up group %d, treating it as shared: %v", gid, err)
-		return false
-	}
-	owner, err := user.LookupId(strconv.FormatUint(uint64(uid), 10))
-	if err != nil {
-		log.Debugf("cannot look up uid %d, treating its group as shared: %v", uid, err)
-		return false
-	}
-
-	if group.Name != owner.Username {
-		return false
-	}
-	return !groupHasOtherMembers(groupFile, group.Name, owner.Username)
-}
-
-// groupHasOtherMembers reports whether the group lists a member besides owner.
-//
-// Sharing the owner's name is what a user private group is recognised by, and it
-// says nothing about who is in it: a group that has since gained a member is
-// still named that way, and that member can write whatever the group can. So the
-// membership is read rather than assumed. A group this file does not describe,
-// because it comes from LDAP or another NSS source, cannot be answered here and
-// leaves the name as the only thing to go on.
-func groupHasOtherMembers(path, name, owner string) bool {
-	file, err := os.Open(path)
-	if err != nil {
-		log.Debugf("cannot read %s for the members of group %q: %v", path, name, err)
-		return false
-	}
-	defer func() {
-		if err := file.Close(); err != nil {
-			log.Debugf("close %s: %v", path, err)
-		}
-	}()
-
-	scanner := bufio.NewScanner(file)
-	for scanner.Scan() {
-		// name:password:gid:member,member
-		fields := strings.Split(scanner.Text(), ":")
-		if len(fields) < 4 || fields[0] != name {
-			continue
-		}
-		for member := range strings.SplitSeq(fields[3], ",") {
-			if member != "" && member != owner {
-				return true
-			}
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		log.Debugf("read %s: %v", path, err)
-	}
-	return false
-}

client/internal/elevate/trusted_unix_test.go

@@ -1,177 +0,0 @@
-//go:build !windows
-
-package elevate
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// ownerOnlyDir is t.TempDir() with the write bits tightened. testing creates its
-// numbered directory with 0777 minus the umask, so under the common 002 umask it
-// is group-writable and would fail the check under test on its own.
-func ownerOnlyDir(t *testing.T) string {
-	t.Helper()
-	dir := t.TempDir()
-	require.NoError(t, os.Chmod(dir, 0o755), "tighten the temporary directory")
-	return dir
-}
-
-// writeExecutable creates a plain executable file, the shape trustedSelf checks.
-func writeExecutable(t *testing.T, dir string) string {
-	t.Helper()
-	path := filepath.Join(dir, "netbird-ui")
-	require.NoError(t, os.WriteFile(path, []byte("#!/bin/sh\n"), 0o755), "write the executable")
-	require.NoError(t, os.Chmod(path, 0o755), "set the executable's mode")
-	return path
-}
-
-func TestCheckOnlyOwnerWritableAcceptsOwnerOnly(t *testing.T) {
-	err := checkOnlyOwnerWritable(writeExecutable(t, ownerOnlyDir(t)))
-	assert.NoError(t, err, "an owner-only writable executable is trustworthy")
-}
-
-func TestCheckOnlyOwnerWritableRejectsWorldWritableFile(t *testing.T) {
-	path := writeExecutable(t, ownerOnlyDir(t))
-	require.NoError(t, os.Chmod(path, 0o777), "make the executable world-writable")
-
-	assert.Error(t, checkOnlyOwnerWritable(path), "a world-writable executable must be refused")
-}
-
-// The permission policy on its own, without a filesystem to arrange: whether the
-// group has been vouched for is the only thing that makes group write acceptable.
-func TestWriteBitsAllow(t *testing.T) {
-	tests := []struct {
-		name         string
-		perm         os.FileMode
-		sticky       bool
-		groupAllowed bool
-		wantErr      bool
-	}{
-		{name: "owner only", perm: 0o755},
-		{name: "group write in a private group", perm: 0o775, groupAllowed: true},
-		{name: "group write in a shared group", perm: 0o775, wantErr: true},
-		{name: "world write", perm: 0o777, groupAllowed: true, wantErr: true},
-		{name: "world write on a sticky directory", perm: 0o777, sticky: true},
-		{name: "group write on a sticky directory", perm: 0o775, sticky: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := writeBitsAllow("/path", tt.perm, tt.sticky, tt.groupAllowed)
-			if tt.wantErr {
-				assert.Error(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
-				return
-			}
-			assert.NoError(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
-		})
-	}
-}
-
-// A build under a home directory on a distribution with a 002 umask, which is what
-// a locally built or tarball-installed binary looks like. Its group has no members
-// but its owner, so it is as good as owner-only.
-//
-// Whether this host is such a distribution is read from the environment rather than
-// from groupWriteAllowed: asking the function under test whether to run would let
-// it skip its own coverage away if it regressed to refusing everything.
-func TestCheckOnlyOwnerWritableAcceptsOwnPrivateGroup(t *testing.T) {
-	requirePrivatePrimaryGroup(t)
-
-	dir := ownerOnlyDir(t)
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o775), "make the directory group-writable")
-	require.NoError(t, os.Chmod(path, 0o775), "make the executable group-writable")
-
-	err := checkOnlyOwnerWritable(path)
-	assert.NoError(t, err, "group write in the owner's own private group reaches nobody else")
-}
-
-// A group that shares its owner's name but has gained another member is no longer
-// private, and its write access reaches an account that could not elevate.
-func TestGroupHasOtherMembers(t *testing.T) {
-	tests := []struct {
-		name  string
-		entry string
-		want  bool
-	}{
-		{name: "no members", entry: "vma:x:1000:"},
-		{name: "only the owner", entry: "vma:x:1000:vma"},
-		{name: "another member", entry: "vma:x:1000:bob", want: true},
-		{name: "the owner and another", entry: "vma:x:1000:vma,bob", want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "group")
-			body := "root:x:0:\n" + tt.entry + "\nsudo:x:27:vma\n"
-			require.NoError(t, os.WriteFile(path, []byte(body), 0o644), "write the group file")
-
-			assert.Equal(t, tt.want, groupHasOtherMembers(path, "vma", "vma"), "entry %q", tt.entry)
-		})
-	}
-}
-
-// A group file that says nothing about the group leaves the name as the only thing
-// to go on, so the private-group allowance stands rather than collapsing on every
-// host whose groups come from LDAP.
-func TestGroupHasOtherMembersTolerantOfAnUnknownGroup(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "group")
-	require.NoError(t, os.WriteFile(path, []byte("root:x:0:\n"), 0o644), "write the group file")
-
-	assert.False(t, groupHasOtherMembers(path, "vma", "vma"), "a group the file does not describe")
-	assert.False(t, groupHasOtherMembers(filepath.Join(t.TempDir(), "absent"), "vma", "vma"),
-		"no group file at all")
-}
-
-// A writable directory is as good as a writable file: whoever can write the
-// directory can put a different binary at the same path.
-func TestCheckOnlyOwnerWritableRejectsWritableDirectory(t *testing.T) {
-	dir := filepath.Join(ownerOnlyDir(t), "bin")
-	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o777), "make the directory world-writable")
-
-	assert.Error(t, checkOnlyOwnerWritable(path), "an executable in a world-writable directory must be refused")
-}
-
-// A sticky world-writable directory is exempt: the sticky bit is what stops one
-// user replacing another's entries. /tmp is why this matters.
-func TestCheckOnlyOwnerWritableAcceptsStickyDirectory(t *testing.T) {
-	dir := filepath.Join(ownerOnlyDir(t), "sticky")
-	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o777|os.ModeSticky), "make the directory sticky and world-writable")
-
-	err := checkOnlyOwnerWritable(path)
-	assert.NoError(t, err, "the sticky bit stops another user replacing the executable")
-}
-
-func TestCheckOnlyOwnerWritableRejectsMissingFile(t *testing.T) {
-	err := checkOnlyOwnerWritable(filepath.Join(ownerOnlyDir(t), "absent"))
-	assert.Error(t, err, "an executable that is not there must be refused")
-}
-
-// requirePrivatePrimaryGroup skips unless this user's primary group is their own,
-// which is what the user-private-group allowance is about.
-func requirePrivatePrimaryGroup(t *testing.T) {
-	t.Helper()
-
-	self, err := user.Current()
-	require.NoError(t, err, "look up the test user")
-	group, err := user.LookupGroupId(strconv.Itoa(os.Getgid()))
-	require.NoError(t, err, "look up the test user's primary group")
-
-	if group.Name != self.Username {
-		t.Skipf("the test user's primary group is %q, not their own, so there is nothing to assert here", group.Name)
-	}
-	if groupHasOtherMembers(groupFile, group.Name, self.Username) {
-		t.Skipf("group %q has other members, so it is not a private group", group.Name)
-	}
-}

client/internal/elevate/trusted_windows.go

@@ -1,215 +0,0 @@
-package elevate
-
-import (
-	"errors"
-	"fmt"
-	"path/filepath"
-	"slices"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-const (
-	// fileDeleteChild is FILE_DELETE_CHILD, which x/sys does not define: the
-	// right to delete an entry of a directory without holding DELETE on it.
-	fileDeleteChild = 0x00000040
-
-	// accessAllowedCallbackACEType is an allow ACE with a condition appended to
-	// the ACCESS_ALLOWED_ACE layout, so its trustee is still at SidStart.
-	accessAllowedCallbackACEType = 0x9
-
-	// The allow ACE types that carry object GUIDs ahead of the trustee, so the
-	// SID is not at SidStart. They occur on directory-service objects rather
-	// than files, and are refused rather than skipped: see aceTrustee.
-	accessAllowedObjectACEType         = 0x5
-	accessAllowedCallbackObjectACEType = 0xB
-)
-
-// fileWriteAccess are the rights that let a trustee rewrite or replace a file,
-// or take it over and then do so.
-const fileWriteAccess = windows.FILE_WRITE_DATA | windows.FILE_APPEND_DATA |
-	windows.DELETE | windows.WRITE_DAC | windows.WRITE_OWNER |
-	windows.GENERIC_WRITE | windows.GENERIC_ALL
-
-// dirWriteAccess are the rights over a directory that let a trustee replace an
-// entry somebody else owns. Creating a new entry is not one of them, which is
-// what the Unix sticky bit says in one bit: the root of every volume grants
-// BUILTIN\Users the right to add directories under it, and that reaches nothing
-// already there.
-const dirWriteAccess = fileDeleteChild | windows.DELETE |
-	windows.WRITE_DAC | windows.WRITE_OWNER | windows.GENERIC_ALL
-
-// trustedInstallerSID owns much of what Windows itself installs. x/sys has no
-// well-known constant for it.
-const trustedInstallerSID = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
-
-// checkOnlyOwnerWritable reports an error unless path, and every directory
-// leading to it, is owned by an account that can elevate (or by this user) and
-// grants write access to nobody else. A writable directory is as good as a
-// writable file, since an entry in it can be replaced, so the whole chain is
-// checked.
-func checkOnlyOwnerWritable(path string) error {
-	owners, err := trustedOwners()
-	if err != nil {
-		return err
-	}
-	writers, err := trustedWriters(owners)
-	if err != nil {
-		return err
-	}
-
-	writeAccess := windows.ACCESS_MASK(fileWriteAccess)
-	for target := path; ; target = filepath.Dir(target) {
-		if err := checkSecurity(target, writeAccess, owners, writers); err != nil {
-			return err
-		}
-		if parent := filepath.Dir(target); parent == target {
-			return nil
-		}
-		writeAccess = dirWriteAccess
-	}
-}
-
-// trustedOwners are the accounts we accept as the owner of the executable and of
-// the directories above it: the ones that can already answer the UAC prompt,
-// plus this user, whose own executable is theirs to write. Code running as the
-// user could prompt them for anything anyway; what matters is that no *other*
-// unprivileged account can reach it.
-func trustedOwners() ([]*windows.SID, error) {
-	self, err := currentUserSID()
-	if err != nil {
-		return nil, err
-	}
-
-	owners := []*windows.SID{self}
-	for _, wellKnown := range []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinBuiltinAdministratorsSid,
-	} {
-		sid, err := windows.CreateWellKnownSid(wellKnown)
-		if err != nil {
-			return nil, fmt.Errorf("build well-known SID %d: %w", wellKnown, err)
-		}
-		owners = append(owners, sid)
-	}
-
-	installer, err := windows.StringToSid(trustedInstallerSID)
-	if err != nil {
-		return nil, fmt.Errorf("parse TrustedInstaller SID: %w", err)
-	}
-	return append(owners, installer), nil
-}
-
-// trustedWriters are the trustees whose write access does not widen who could
-// decide what runs behind the prompt. The owners, and CREATOR OWNER, which
-// resolves to the object's owner and is therefore already vetted.
-func trustedWriters(owners []*windows.SID) ([]*windows.SID, error) {
-	creatorOwner, err := windows.CreateWellKnownSid(windows.WinCreatorOwnerSid)
-	if err != nil {
-		return nil, fmt.Errorf("build the CREATOR OWNER SID: %w", err)
-	}
-	return append(slices.Clone(owners), creatorOwner), nil
-}
-
-func checkSecurity(path string, writeAccess windows.ACCESS_MASK, owners, writers []*windows.SID) error {
-	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
-		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
-	if err != nil {
-		return fmt.Errorf("read security descriptor of %s: %w", path, err)
-	}
-
-	owner, _, err := sd.Owner()
-	if err != nil {
-		return fmt.Errorf("read owner of %s: %w", path, err)
-	}
-	if !containsSID(owners, owner) {
-		return fmt.Errorf("%s is owned by %s, which is neither this user nor an account that can elevate", path, owner)
-	}
-
-	dacl, _, err := sd.DACL()
-	if err != nil {
-		return fmt.Errorf("read DACL of %s: %w", path, err)
-	}
-	// A NULL DACL grants everyone everything; only an absent security
-	// descriptor would have got us here without one, and neither is trustworthy.
-	if dacl == nil {
-		return fmt.Errorf("%s has no DACL, so it grants write access to everyone", path)
-	}
-
-	return checkDACL(path, dacl, writeAccess, writers)
-}
-
-// checkDACL refuses an ACL that grants write access to a trustee outside
-// writers.
-//
-// An allowlist, because the trustees that must not have it cannot be listed: an
-// ACE naming an ordinary user account hands that account the same power as one
-// naming Everyone, and only the accounts that may hold it are knowable.
-func checkDACL(path string, dacl *windows.ACL, writeAccess windows.ACCESS_MASK, writers []*windows.SID) error {
-	for i := uint32(0); i < uint32(dacl.AceCount); i++ {
-		var ace *windows.ACCESS_ALLOWED_ACE
-		if err := windows.GetAce(dacl, i, &ace); err != nil {
-			return fmt.Errorf("read ACE %d of %s: %w", i, path, err)
-		}
-		// An inherit-only ACE says what children of this object get, not what
-		// this object grants.
-		if ace.Header.AceFlags&windows.INHERIT_ONLY_ACE != 0 {
-			continue
-		}
-		if ace.Mask&writeAccess == 0 {
-			continue
-		}
-		// Only an allow ACE grants anything; a deny ACE narrows what one gave.
-		if !isAllowACE(ace.Header.AceType) {
-			continue
-		}
-
-		trustee, err := aceTrustee(ace)
-		if err != nil {
-			return fmt.Errorf("read the trustee of ACE %d of %s: %w", i, path, err)
-		}
-		if !containsSID(writers, trustee) {
-			return fmt.Errorf("%s grants write access to %s", path, trustee)
-		}
-	}
-	return nil
-}
-
-// isAllowACE reports whether an ACE type grants rights, rather than denying,
-// auditing or labelling them.
-func isAllowACE(aceType uint8) bool {
-	switch aceType {
-	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType,
-		accessAllowedObjectACEType, accessAllowedCallbackObjectACEType:
-		return true
-	default:
-		return false
-	}
-}
-
-// aceTrustee returns who an allow ACE grants its rights to. An ACE whose trustee
-// cannot be located is an error rather than something to skip past: being unable
-// to read who is being given write access is a refusal.
-func aceTrustee(ace *windows.ACCESS_ALLOWED_ACE) (*windows.SID, error) {
-	switch ace.Header.AceType {
-	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType:
-		//nolint:gosec // SidStart is the first uint32 of the variable-length SID that follows the ACE header.
-		return (*windows.SID)(unsafe.Pointer(&ace.SidStart)), nil
-	default:
-		return nil, errors.New("an object-type allow ACE does not carry its trustee where we can read it")
-	}
-}
-
-func containsSID(sids []*windows.SID, sid *windows.SID) bool {
-	return slices.ContainsFunc(sids, sid.Equals)
-}
-
-func currentUserSID() (*windows.SID, error) {
-	token := windows.GetCurrentProcessToken()
-	user, err := token.GetTokenUser()
-	if err != nil {
-		return nil, fmt.Errorf("read this process's user: %w", err)
-	}
-	return user.User.Sid, nil
-}

client/internal/elevate/trusted_windows_test.go

@@ -1,126 +0,0 @@
-package elevate
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// A file the test user created under their own profile, which is what a per-user
-// install looks like. The whole chain up to the volume root is walked, so this is
-// also what says the walk does not refuse an ordinary Windows installation: the
-// root of every volume grants BUILTIN\Users rights that are not ours to worry
-// about.
-func TestCheckOnlyOwnerWritableAcceptsOwnFile(t *testing.T) {
-	err := checkOnlyOwnerWritable(writeExecutable(t))
-	assert.NoError(t, err, "a file the test user owns, under directories only administrators can write")
-}
-
-// Write access held by an account that cannot answer the UAC prompt means that
-// account decides what runs behind it, whoever the ACE names. The trustees that
-// must not have it cannot be listed, so the check names the ones that may.
-func TestCheckOnlyOwnerWritableRejectsUntrustedWriters(t *testing.T) {
-	tests := []struct {
-		name      string
-		wellKnown windows.WELL_KNOWN_SID_TYPE
-	}{
-		{name: "everyone", wellKnown: windows.WinWorldSid},
-		{name: "authenticated users", wellKnown: windows.WinAuthenticatedUserSid},
-		{name: "builtin users", wellKnown: windows.WinBuiltinUsersSid},
-		// A service account, which no denylist of the obvious groups would name
-		// and which cannot elevate any more than Everyone can.
-		{name: "local service", wellKnown: windows.WinLocalServiceSid},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			path := writeExecutable(t)
-			grantWrite(t, path, tt.wellKnown)
-
-			assert.Error(t, checkOnlyOwnerWritable(path),
-				"write access for %s must be refused", tt.name)
-		})
-	}
-}
-
-// The masks are the policy: on a file any write reaches its contents, while on a
-// directory only deleting or taking over an entry reaches something already
-// there. Adding an entry does not, which is why the walk survives a volume root.
-func TestWriteAccessMasks(t *testing.T) {
-	assert.NotZero(t, fileWriteAccess&windows.FILE_WRITE_DATA, "writing a file's data reaches its contents")
-	assert.NotZero(t, fileWriteAccess&windows.FILE_APPEND_DATA, "appending to a file reaches its contents")
-
-	assert.Zero(t, dirWriteAccess&windows.FILE_WRITE_DATA, "adding a file to a directory replaces nothing")
-	assert.Zero(t, dirWriteAccess&windows.FILE_APPEND_DATA, "adding a subdirectory replaces nothing")
-	assert.NotZero(t, dirWriteAccess&fileDeleteChild, "deleting an entry replaces it")
-	assert.NotZero(t, dirWriteAccess&windows.DELETE, "deleting the directory takes its entries with it")
-}
-
-func TestIsAllowACE(t *testing.T) {
-	tests := []struct {
-		name    string
-		aceType uint8
-		want    bool
-	}{
-		{name: "allowed", aceType: windows.ACCESS_ALLOWED_ACE_TYPE, want: true},
-		{name: "allowed callback", aceType: accessAllowedCallbackACEType, want: true},
-		{name: "allowed object", aceType: accessAllowedObjectACEType, want: true},
-		{name: "allowed callback object", aceType: accessAllowedCallbackObjectACEType, want: true},
-		{name: "denied", aceType: windows.ACCESS_DENIED_ACE_TYPE},
-		// SYSTEM_AUDIT_ACE_TYPE, which x/sys does not define: an ACE that records
-		// access rather than granting it.
-		{name: "audit", aceType: 0x2},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, isAllowACE(tt.aceType), "ACE type %#x", tt.aceType)
-		})
-	}
-}
-
-// writeExecutable creates a plain file under the test's own directory, the shape
-// trustedSelf checks.
-func writeExecutable(t *testing.T) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "netbird-ui.exe")
-	require.NoError(t, os.WriteFile(path, []byte("MZ"), 0o755), "write the executable")
-	return path
-}
-
-// grantWrite replaces the file's DACL with one that grants a well-known trustee
-// everything, keeping the test user's own access so the file stays deletable.
-func grantWrite(t *testing.T, path string, wellKnown windows.WELL_KNOWN_SID_TYPE) {
-	t.Helper()
-
-	trustee, err := windows.CreateWellKnownSid(wellKnown)
-	require.NoError(t, err, "build the trustee SID")
-	self, err := currentUserSID()
-	require.NoError(t, err, "read the test user's SID")
-
-	acl, err := windows.ACLFromEntries([]windows.EXPLICIT_ACCESS{
-		fullControl(self, windows.TRUSTEE_IS_USER),
-		fullControl(trustee, windows.TRUSTEE_IS_WELL_KNOWN_GROUP),
-	}, nil)
-	require.NoError(t, err, "build the ACL")
-
-	require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
-		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
-		nil, nil, acl, nil), "set the DACL")
-}
-
-func fullControl(sid *windows.SID, trusteeType uint32) windows.EXPLICIT_ACCESS {
-	return windows.EXPLICIT_ACCESS{
-		AccessPermissions: windows.GENERIC_ALL,
-		AccessMode:        windows.GRANT_ACCESS,
-		Trustee: windows.TRUSTEE{
-			TrusteeForm:  windows.TRUSTEE_IS_SID,
-			TrusteeType:  windows.TRUSTEE_TYPE(trusteeType),
-			TrusteeValue: windows.TrusteeValueFromSID(sid),
-		},
-	}
-}

client/internal/engine.go

@@ -50,6 +50,7 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
+	"github.com/netbirdio/netbird/client/internal/pqkem"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
@@ -197,6 +198,10 @@ type Engine struct {
 	// rpManager is a Rosenpass manager
 	rpManager *rosenpass.Manager
 
+	// pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM).
+	// It owns the data-path transport and peer endpoint routing.
+	pqkemManager *pqkem.Manager
+
 	// syncMsgMux is used to guarantee sequential Management Service message processing
 	syncMsgMux *sync.Mutex
 
@@ -555,7 +560,11 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	publicKey := e.config.WgPrivateKey.PublicKey()
 	e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder)
 
-	if e.config.RosenpassEnabled {
+	// Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence
+	if e.config.RosenpassEnabled && pqkem.Enabled() {
+		log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled")
+	}
+	if e.config.RosenpassEnabled && !pqkem.Enabled() {
 		log.Infof("rosenpass is enabled")
 		if e.config.RosenpassPermissive {
 			log.Infof("running rosenpass in permissive mode")
@@ -644,6 +653,30 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.rpManager.SetInterface(e.wgInterface)
 	}
 
+	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
+	// transport can bind on the WG overlay IP.
+	if pqkem.Enabled() {
+		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
+		if pqErr != nil {
+			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
+		} else {
+			cbHandler := pqCallbackHandler{
+				wg: e.wgInterface,
+				// On a persistent rekey failure, re-bootstrap the KEM over Signal: a
+				// fresh signalling offer starts a new exchange that overwrites the
+				// stalled PSK on both sides, recovering from a data-path desync.
+				reoffer: func(remoteKey string) {
+					if conn, ok := e.peerStore.PeerConn(remoteKey); ok {
+						conn.RequestReoffer()
+					}
+				},
+			}
+			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), cbHandler, pqkem.NewLogger())
+			e.pqkemManager.Start(tr)
+			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
+		}
+	}
+
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -907,6 +940,10 @@ func (e *Engine) removePeer(peerKey string) error {
 
 	e.connMgr.RemovePeerConn(peerKey)
 
+	if e.pqkemManager != nil {
+		e.pqkemManager.RemovePeer(pqkem.RemoteID(peerKey))
+	}
+
 	err := e.statusRecorder.RemovePeer(peerKey)
 	if err != nil {
 		log.Warnf("received error when removing peer %s from status recorder: %v", peerKey, err)
@@ -1893,6 +1930,10 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 		},
 		ICEConfig: e.createICEConfig(),
 	}
+	if e.pqkemManager != nil {
+		config.PQ = pqHandshaker{mgr: e.pqkemManager}
+		config.PQStrict = pqkem.Strict()
+	}
 
 	serviceDependencies := peer.ServiceDependencies{
 		StatusRecorder:     e.statusRecorder,
@@ -2076,6 +2117,10 @@ func (e *Engine) close() {
 		_ = e.rpManager.Close()
 	}
 
+	if e.pqkemManager != nil {
+		e.pqkemManager.Stop()
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	if err := e.portForwardManager.GracefullyStop(ctx); err != nil {
@@ -2852,6 +2897,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 		Version:         msg.GetBody().GetNetBirdVersion(),
 		RosenpassPubKey: rosenpassPubKey,
 		RosenpassAddr:   rosenpassAddr,
+		MlkemPayload:    msg.GetBody().GetMlkemPayload(),
+		MlkemPort:       int(msg.GetBody().GetMlkemPort()),
 		RelaySrvAddress: msg.GetBody().GetRelayServerAddress(),
 		RelaySrvIP:      relayIP,
 		SessionID:       sessionID,

client/internal/ipcauth/privileged.go

@@ -91,12 +91,6 @@ func SelfDelegatesTo() (Identity, bool) {
 	return selfIdentity, true
 }
 
-// The values PrivilegedActorKey returns.
-const (
-	ActorKeyAdministrator = "administrator"
-	ActorKeyRoot          = "root"
-)
-
 // PrivilegedActor names the principal a privileged operation requires, for use
 // in messages shown to the user.
 func PrivilegedActor() string {
@@ -106,16 +100,6 @@ func PrivilegedActor() string {
 	return "root"
 }
 
-// PrivilegedActorKey identifies that principal without wording it, for a client
-// that writes its own message in the user's language. The words PrivilegedActor
-// returns are English, and a translated sentence cannot borrow them.
-func PrivilegedActorKey() string {
-	if runtime.GOOS == "windows" {
-		return ActorKeyAdministrator
-	}
-	return ActorKeyRoot
-}
-
 // ElevatedCommand renders a command so that running it grants the privileges the
 // operation needs. Windows has no in-line equivalent of sudo, so the command is
 // returned unchanged and the user is expected to run it from an elevated

client/internal/peer/conn.go

@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"math"
 	"net"
 	"net/netip"
 	"runtime"
@@ -26,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/monotime"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -74,6 +76,35 @@ type RosenpassConfig struct {
 	PermissiveMode bool
 }
 
+// PQHandshaker attaches post-quantum ML-KEM material to signalling offers/answers and
+// feeds received material back. It is implemented by the engine over the pqkem
+// manager and is nil when the PQ exchange is disabled. remoteKey is the peer's
+// WireGuard public key.
+type PQHandshaker interface {
+	// OfferPayload returns the KEM offer to embed in an outgoing offer (nil if this
+	// peer is not the KEM initiator) and the local PQ data-path port to announce.
+	OfferPayload(remoteKey string) (payload []byte, port int)
+	// AnswerPayload processes a received KEM offer (nil if absent) and returns the KEM
+	// answer to embed in the outgoing answer (nil if none) and the local PQ port.
+	AnswerPayload(remoteKey string, recvOffer []byte) (payload []byte, port int)
+	// OnAnswer feeds a received KEM answer (nil if absent).
+	OnAnswer(remoteKey string, recvAnswer []byte)
+	// PSK returns the peer's latest derived post-quantum PSK to program at WG
+	// peer-config time (the pull path). ok is false until one has been derived.
+	PSK(remoteKey string) (wgtypes.Key, bool)
+	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
+	// its WG overlay IP with the announced pq UDP port (port 0 means the peer omitted
+	// it and is on the default port).
+	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
+	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
+	// next chained PSK rotation pushed over the data path. sinceActivity is how long
+	// ago the peer last exchanged real user data, so the rotation can be skipped for
+	// idle tunnels.
+	OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration)
+	// OnDataPathDown signals the peer's tunnel went down.
+	OnDataPathDown(remoteKey string)
+}
+
 // ConnConfig is a peer Connection configuration
 type ConnConfig struct {
 	// Key is a public key of a remote peer
@@ -91,6 +122,12 @@ type ConnConfig struct {
 
 	RosenpassConfig RosenpassConfig
 
+	// PQ carries post-quantum ML-KEM material on offers/answers; nil when disabled.
+	PQ PQHandshaker
+	// PQStrict fails closed: block peer traffic until the ML-KEM PSK is established,
+	// instead of letting the tunnel come up classically and upgrading to PQ later.
+	PQStrict bool
+
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 }
@@ -149,6 +186,11 @@ type Conn struct {
 	// pendingFirstPacket is the lazyconn-captured handshake init, replayed once the real
 	// transport is up.
 	pendingFirstPacket []byte
+
+	// pqStrictSentinelKey is a per-conn random sentinel PSK used in PQ strict mode to
+	// fail closed: it is programmed until the real ML-KEM PSK is derived, so no session
+	// can form on a non-PQ key. Per-conn random so two strict peers never match by chance.
+	pqStrictSentinelKey *wgtypes.Key
 }
 
 // injectPendingFirstPacket replays the captured handshake through the proxy if present, else
@@ -206,6 +248,14 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
+	if config.PQ != nil && config.PQStrict {
+		if k, err := wgtypes.GenerateKey(); err != nil {
+			connLog.Errorf("pqkem: failed to generate strict-mode sentinel key, strict fail-closed disabled for this peer: %v", err)
+		} else {
+			conn.pqStrictSentinelKey = &k
+		}
+	}
+
 	return conn, nil
 }
 
@@ -670,6 +720,22 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
+// RequestReoffer sends a fresh signalling offer for the peer, re-running the
+// post-quantum bootstrap over Signal. Used to recover from a persistent data-path
+// rekey failure: a new exchange overwrites the stalled PSK on both sides. No-op if the
+// connection is not open yet.
+func (conn *Conn) RequestReoffer() {
+	conn.mu.Lock()
+	h := conn.handshaker
+	conn.mu.Unlock()
+	if h == nil {
+		return
+	}
+	if err := h.SendOffer(); err != nil {
+		conn.Log.Debugf("pqkem: recovery re-offer failed: %v", err)
+	}
+}
+
 func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
@@ -681,6 +747,10 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 
 	conn.Log.Warnf("WireGuard handshake timeout detected, closing current connection")
 
+	if conn.config.PQ != nil {
+		conn.config.PQ.OnDataPathDown(conn.config.Key)
+	}
+
 	// Close the active connection based on current priority
 	switch conn.currentConnPriority {
 	case conntype.Relay:
@@ -723,7 +793,7 @@ func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []by
 		ConnStatus:         conn.evalStatus(),
 		Relayed:            conn.isRelayed(),
 		RelayServerAddress: relayServerAddr,
-		RosenpassEnabled:   isRosenpassEnabled(rosenpassPubKey),
+		RosenpassEnabled:   conn.quantumResistant(rosenpassPubKey),
 	}
 
 	err := conn.statusRecorder.UpdatePeerRelayedState(peerState)
@@ -742,7 +812,7 @@ func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, updateTime time.Time)
 		RemoteIceCandidateType:     iceConnInfo.RemoteIceCandidateType,
 		LocalIceCandidateEndpoint:  iceConnInfo.LocalIceCandidateEndpoint,
 		RemoteIceCandidateEndpoint: iceConnInfo.RemoteIceCandidateEndpoint,
-		RosenpassEnabled:           isRosenpassEnabled(iceConnInfo.RosenpassPubKey),
+		RosenpassEnabled:           conn.quantumResistant(iceConnInfo.RosenpassPubKey),
 	}
 
 	err := conn.statusRecorder.UpdatePeerICEState(peerState)
@@ -946,6 +1016,35 @@ func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
 	conn.mu.Unlock()
+
+	// A fresh WireGuard handshake clocks the post-quantum PSK rotation. Pass how long
+	// ago the peer last exchanged real user data (keepalives excluded) so the pqkem
+	// manager can skip rotation on idle tunnels — rotating then would push data-path
+	// traffic that keeps the lazy connection artificially active.
+	if conn.config.PQ != nil {
+		conn.config.PQ.OnDataPathRekeyed(conn.config.Key, conn.dataActivityAge())
+	}
+}
+
+// dataActivityAge returns how long ago the peer last exchanged real user data
+// (WireGuard keepalives excluded), per the same LastActivities signal the
+// lazy-connection inactivity monitor uses. It reports a very large duration when no
+// activity has ever been recorded, so the peer is treated as idle.
+//
+// In kernel mode there is no per-peer data-activity signal (LastActivities is
+// userspace-only), so we cannot tell active from idle. We report zero — always
+// "active" — so PSK rotation is not disabled in kernel mode. Lazy back-to-idle is
+// already limited there; the eBPF WG-activity detection (future) will supply a real
+// signal that excludes handshake/pqkem traffic.
+func (conn *Conn) dataActivityAge() time.Duration {
+	if !conn.config.WgConfig.WgInterface.IsUserspaceBind() {
+		return 0
+	}
+	last, ok := conn.config.WgConfig.WgInterface.LastActivities()[conn.config.WgConfig.RemoteKey]
+	if !ok {
+		return time.Duration(math.MaxInt64)
+	}
+	return monotime.Since(last)
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics
@@ -987,6 +1086,23 @@ func (conn *Conn) AgentVersionString() string {
 }
 
 func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
+	// Post-quantum: once the ML-KEM exchange has derived a PSK for this peer, program
+	// it here so the peer's next WireGuard handshake adopts it. Applied at peer-config
+	// time (bootstrap / reconnect); steady-state rotation is pushed separately.
+	if conn.config.PQ != nil {
+		if psk, ok := conn.config.PQ.PSK(conn.config.Key); ok {
+			return &psk
+		}
+		if conn.config.PQStrict && conn.pqStrictSentinelKey != nil {
+			// Fail closed: program a non-matching sentinel so no session forms on a
+			// non-PQ key until the ML-KEM exchange derives the real PSK (pushed via
+			// SetPresharedKey once it converges). "pending" — turns into a "stuck"
+			// warning from the manager if the exchange keeps failing (see raiseFailure).
+			conn.Log.Debugf("pqkem: strict mode — no PQ PSK yet, blocking peer traffic until the ML-KEM exchange converges")
+			return conn.pqStrictSentinelKey
+		}
+	}
+
 	if conn.config.RosenpassConfig.PubKey == nil {
 		return conn.config.WgConfig.PreSharedKey
 	}
@@ -1026,6 +1142,21 @@ func isRosenpassEnabled(remoteRosenpassPubKey []byte) bool {
 	return remoteRosenpassPubKey != nil
 }
 
+// quantumResistant reports whether the peer's tunnel is post-quantum protected, for
+// the status "Quantum resistance" field: either Rosenpass (the remote advertised a
+// Rosenpass key) or the ML-KEM exchange (a PQ PSK has been derived for this peer).
+func (conn *Conn) quantumResistant(remoteRosenpassPubKey []byte) bool {
+	if isRosenpassEnabled(remoteRosenpassPubKey) {
+		return true
+	}
+	if conn.config.PQ != nil {
+		if _, ok := conn.config.PQ.PSK(conn.config.Key); ok {
+			return true
+		}
+	}
+	return false
+}
+
 func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 	// "Relay up and needed" — the peer uses relay and the transport is connected.
 	relayUsedAndUp := in.peerUsesRelay && in.relayConnected

client/internal/peer/conn_pq_test.go

@@ -0,0 +1,85 @@
+package peer
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// fakePQ is a minimal PQHandshaker: only PSK is exercised by presharedKey, the rest
+// are no-op stubs to satisfy the interface.
+type fakePQ struct {
+	psk wgtypes.Key
+	ok  bool
+}
+
+func (f fakePQ) OfferPayload(string) ([]byte, int)          { return nil, 0 }
+func (f fakePQ) AnswerPayload(string, []byte) ([]byte, int) { return nil, 0 }
+func (f fakePQ) OnAnswer(string, []byte)                    {}
+func (f fakePQ) PSK(string) (wgtypes.Key, bool)             { return f.psk, f.ok }
+func (f fakePQ) SetRemoteAddr(string, netip.AddrPort)       {}
+func (f fakePQ) OnDataPathRekeyed(string, time.Duration)    {}
+func (f fakePQ) OnDataPathDown(string)                      {}
+
+// TestConn_presharedKey_PQ covers the post-quantum branch of presharedKey across the
+// three states that matter: a derived PSK is programmed, and — before one exists —
+// strict mode blocks with a sentinel while non-strict falls open to the ordinary key.
+func TestConn_presharedKey_PQ(t *testing.T) {
+	derivedPSK, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+	nbPSK, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	newConn := func() *Conn {
+		return &Conn{
+			Log: log.WithField("peer", "pq-test"),
+			config: ConnConfig{
+				Key:             "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+				LocalKey:        "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+				WgConfig:        WgConfig{PreSharedKey: &nbPSK},
+				RosenpassConfig: RosenpassConfig{},
+			},
+		}
+	}
+
+	t.Run("derived PSK is programmed", func(t *testing.T) {
+		for _, strict := range []bool{false, true} {
+			c := newConn()
+			c.config.PQ = fakePQ{psk: derivedPSK, ok: true}
+			c.config.PQStrict = strict
+			if strict {
+				sentinel, _ := wgtypes.GenerateKey()
+				c.pqStrictSentinelKey = &sentinel
+			}
+			got := c.presharedKey(nil)
+			require.NotNil(t, got)
+			require.Equal(t, derivedPSK, *got, "the derived PQ PSK must win (strict=%v)", strict)
+		}
+	})
+
+	t.Run("non-strict falls open to the ordinary key before a PSK exists", func(t *testing.T) {
+		c := newConn()
+		c.config.PQ = fakePQ{ok: false}
+		c.config.PQStrict = false
+		got := c.presharedKey(nil)
+		require.NotNil(t, got, "non-strict must not block")
+		require.Equal(t, nbPSK, *got, "non-strict falls through to the NetBird PSK, not a sentinel")
+	})
+
+	t.Run("strict blocks with the per-conn sentinel before a PSK exists", func(t *testing.T) {
+		sentinel, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		c := newConn()
+		c.config.PQ = fakePQ{ok: false}
+		c.config.PQStrict = true
+		c.pqStrictSentinelKey = &sentinel
+		got := c.presharedKey(nil)
+		require.NotNil(t, got)
+		require.Equal(t, sentinel, *got, "strict must return the blocking sentinel")
+		require.NotEqual(t, nbPSK, *got, "the sentinel must not be the ordinary key")
+	})
+}

client/internal/peer/handshaker.go

@@ -39,6 +39,16 @@ type OfferAnswer struct {
 	// This value is the local Rosenpass server address when sending the message
 	RosenpassAddr string
 
+	// MlkemPayload carries the post-quantum X25519MLKEM768 handshake message
+	// (pqkem-framed offer on an OFFER, answer on an ANSWER) that seeds the
+	// WireGuard PSK. Opaque here — the pqkem library frames and parses it. Nil
+	// when the peer does not run the ML-KEM PQ exchange.
+	MlkemPayload []byte
+
+	// MlkemPort is the peer's ML-KEM PQ service UDP port (bound on its WG overlay
+	// IP) where data-path rekey messages are sent. Zero when not running the exchange.
+	MlkemPort int
+
 	// relay server address
 	RelaySrvAddress string
 	// RelaySrvIP is the IP the remote peer is connected to on its
@@ -81,14 +91,20 @@ type Handshaker struct {
 
 func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
 	h := &Handshaker{
-		log:            log,
-		config:         config,
-		signaler:       signaler,
-		ice:            ice,
-		relay:          relay,
-		metricsStages:  metricsStages,
-		remoteOffersCh: make(chan OfferAnswer),
-		remoteAnswerCh: make(chan OfferAnswer),
+		log:           log,
+		config:        config,
+		signaler:      signaler,
+		ice:           ice,
+		relay:         relay,
+		metricsStages: metricsStages,
+		// Buffered by 1: the single Listen goroutine can be busy handling an offer
+		// (sendAnswer does a blocking signal send) exactly when the matching answer
+		// arrives on the other channel. Unbuffered, that answer would hit the
+		// non-blocking send's default and be dropped — fatal for the post-quantum
+		// exchange, which needs the answer to converge. A 1-slot cushion lets it wait
+		// until Listen loops back, without ever blocking the signal receiver.
+		remoteOffersCh: make(chan OfferAnswer, 1),
+		remoteAnswerCh: make(chan OfferAnswer, 1),
 	}
 	// assume remote supports ICE until we learn otherwise from received offers
 	h.remoteICESupported.Store(ice != nil)
@@ -120,6 +136,17 @@ func (h *Handshaker) Listen(ctx context.Context) {
 
 			h.updateRemoteICEState(&remoteOfferAnswer)
 
+			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
+
+			// Derive+store the KEM PSK (inside sendAnswer's AnswerPayload) BEFORE bringing
+			// up the connection: the relay/ICE workers configure the WG endpoint, which
+			// pulls the PSK for the first handshake. Notifying them first would race the
+			// KEM exchange and hand the first handshake a not-yet-derived key.
+			if err := h.sendAnswer(&remoteOfferAnswer); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
+
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -127,11 +154,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 			if h.iceListener != nil && h.RemoteICESupported() {
 				h.iceListener(&remoteOfferAnswer)
 			}
-
-			if err := h.sendAnswer(); err != nil {
-				h.log.Errorf("failed to send remote offer confirmation: %s", err)
-				continue
-			}
 		case remoteOfferAnswer := <-h.remoteAnswerCh:
 			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
 
@@ -142,6 +164,15 @@ func (h *Handshaker) Listen(ctx context.Context) {
 
 			h.updateRemoteICEState(&remoteOfferAnswer)
 
+			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
+
+			// Feed the KEM answer (derive+store PSK) BEFORE bringing up the connection so
+			// the WG endpoint config pulls the real PSK for the first handshake instead of
+			// racing ahead of the KEM exchange.
+			if h.config.PQ != nil {
+				h.config.PQ.OnAnswer(h.config.Key, remoteOfferAnswer.MlkemPayload)
+			}
+
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -156,6 +187,18 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	}
 }
 
+// pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
+// (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
+func (h *Handshaker) pqRegisterEndpoint(remotePort int) {
+	if h.config.PQ == nil || remotePort < 0 || remotePort > 65535 || len(h.config.WgConfig.AllowedIps) == 0 {
+		return
+	}
+	// remotePort may be 0 (the peer omitted it, meaning the default port); the adapter
+	// resolves 0 to DefaultPort.
+	addr := netip.AddrPortFrom(h.config.WgConfig.AllowedIps[0].Addr(), uint16(remotePort))
+	h.config.PQ.SetRemoteAddr(h.config.Key, addr)
+}
+
 func (h *Handshaker) SendOffer() error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -195,13 +238,23 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
+	if h.config.PQ != nil {
+		offer.MlkemPayload, offer.MlkemPort = h.config.PQ.OfferPayload(h.config.Key)
+	}
 	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
-func (h *Handshaker) sendAnswer() error {
+func (h *Handshaker) sendAnswer(remoteOffer *OfferAnswer) error {
 	answer := h.buildOfferAnswer()
+	if h.config.PQ != nil {
+		var recvOffer []byte
+		if remoteOffer != nil {
+			recvOffer = remoteOffer.MlkemPayload
+		}
+		answer.MlkemPayload, answer.MlkemPort = h.config.PQ.AnswerPayload(h.config.Key, recvOffer)
+	}
 	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)

client/internal/peer/iface.go

@@ -10,6 +10,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
+	"github.com/netbirdio/netbird/monotime"
 )
 
 type WGIface interface {
@@ -19,4 +20,11 @@ type WGIface interface {
 	GetProxy() wgproxy.Proxy
 	Address() wgaddr.Address
 	RemoveEndpointAddress(key string) error
+	// LastActivities returns the last real-data activity time per peer (WireGuard
+	// keepalives excluded), used to gate post-quantum PSK rotation on active tunnels.
+	LastActivities() map[string]monotime.Time
+	// IsUserspaceBind reports whether WireGuard runs in userspace. Only there does
+	// LastActivities track per-peer data activity; in kernel mode it is unavailable,
+	// so PSK rotation cannot be gated on activity.
+	IsUserspaceBind() bool
 }

client/internal/peer/signaler.go

@@ -63,6 +63,8 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 		},
 		RosenpassPubKey: offerAnswer.RosenpassPubKey,
 		RosenpassAddr:   offerAnswer.RosenpassAddr,
+		MlkemPayload:    offerAnswer.MlkemPayload,
+		MlkemPort:       offerAnswer.MlkemPort,
 		RelaySrvAddress: offerAnswer.RelaySrvAddress,
 		RelaySrvIP:      offerAnswer.RelaySrvIP,
 		SessionID:       sessionIDBytes,

client/internal/pqkem/bench_test.go

@@ -0,0 +1,59 @@
+package pqkem
+
+import (
+	"crypto/ecdh"
+	"crypto/mlkem"
+	"crypto/rand"
+	"testing"
+)
+
+func BenchmarkX25519Keygen(b *testing.B) {
+	c := ecdh.X25519()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := c.GenerateKey(rand.Reader); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkX25519ECDH(b *testing.B) {
+	c := ecdh.X25519()
+	a, _ := c.GenerateKey(rand.Reader)
+	p, _ := c.GenerateKey(rand.Reader)
+	pub := p.PublicKey()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := a.ECDH(pub); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkMLKEMKeygen(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		if _, err := mlkem.GenerateKey768(); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkMLKEMEncaps(b *testing.B) {
+	dk, _ := mlkem.GenerateKey768()
+	ek := dk.EncapsulationKey()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, _ = ek.Encapsulate()
+	}
+}
+
+func BenchmarkMLKEMDecaps(b *testing.B) {
+	dk, _ := mlkem.GenerateKey768()
+	_, ct := dk.EncapsulationKey().Encapsulate()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := dk.Decapsulate(ct); err != nil {
+			b.Fatal(err)
+		}
+	}
+}

client/internal/pqkem/callbacks.go

@@ -0,0 +1,18 @@
+package pqkem
+
+// CallbackHandler is implemented by the host and invoked by the library. The
+// library only reports events; the host owns the reaction. Keeping this an
+// interface — rather than touching the transport or keying directly — is what lets
+// the KEM code be extracted as a standalone library.
+type CallbackHandler interface {
+	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a peer
+	// and must be programmed into the consumer's secure channel. It is invoked at
+	// the commit point of each side: the initiator on receiving the answer, the
+	// responder on receiving the confirm.
+	OnNewPSKReady(remoteID RemoteID, psk PSK) error
+
+	// OnRekeyFailed fires when an exchange fails to converge within the allotted
+	// time. The host should tear the peer connection down so it re-establishes, and
+	// log a WARN. The library reports the event; it does not dictate the reaction.
+	OnRekeyFailed(remoteID RemoteID) error
+}

client/internal/pqkem/capability_test.go

@@ -0,0 +1,65 @@
+package pqkem
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestManager_NonCapablePeerNotOffered: a peer known not to run the KEM (it advertised
+// no PQ port over signalling) is never offered an exchange, and no failure is raised —
+// this is what stops the reoffer storm against non-PQ peers (e.g. Rosenpass peers).
+func TestManager_NonCapablePeerNotOffered(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil) // initiator vs "aaaa"
+	d.Start(&loopback{ep: epB, sw: newSwitch()})
+	defer d.Stop()
+
+	d.MarkNonCapable("aaaa")
+
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.Nil(t, offer, "a non-capable peer must not be offered a KEM exchange")
+	require.Empty(t, wg.failed, "a non-capable peer must not raise a rekey failure")
+}
+
+// TestManager_MarkNonCapableCancelsInFlight: if we start an exchange with a peer whose
+// capability is not yet known and then learn it does not run the KEM, the in-flight
+// exchange is cancelled and no further offer is produced (no timeout -> no failure).
+func TestManager_MarkNonCapableCancelsInFlight(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil)
+	d.Start(&loopback{ep: epB, sw: newSwitch()})
+	defer d.Stop()
+
+	// Capability unknown -> the bootstrap offer goes out optimistically.
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+
+	// Now we learn the peer is non-PQ: the exchange must be dropped.
+	d.MarkNonCapable("aaaa")
+
+	next, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.Nil(t, next, "after learning non-capability the peer is no longer offered")
+	require.Empty(t, wg.failed, "cancelling an in-flight exchange must not raise a failure")
+}
+
+// TestManager_EstablishedPeerNotDowngraded: a stray zero-port observation must not tear
+// down a peer we already have a working PQ session with.
+func TestManager_EstablishedPeerNotDowngraded(t *testing.T) {
+	dA, dB, _, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	require.NotEqual(t, PSK{}, wgB.psk("aaaa"), "established a PSK")
+
+	dB.MarkNonCapable("aaaa") // stray zero after establishment
+
+	// The peer keeps its derived PSK (MarkNonCapable is a no-op once established).
+	psk, ok := dB.PSK("aaaa")
+	require.True(t, ok, "an established peer must keep its PSK despite a stray zero")
+	require.NotEqual(t, PSK{}, psk)
+}

client/internal/pqkem/concurrency_test.go

@@ -0,0 +1,77 @@
+package pqkem
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestConcurrency_RecoversViaResignalAfterDataPathBreak exercises the A-light recovery:
+// a data-path rotation can no longer converge (OnRekeyFailed), and re-bootstrapping over
+// signalling resyncs both peers on a fresh PSK — even while the data path stays broken,
+// since the signal channel is independent of it.
+func TestConcurrency_RecoversViaResignalAfterDataPathBreak(t *testing.T) {
+	dA, dB, wgA, wgB, lbB := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	// Tighten B's timings and make a single rotation miss raise OnRekeyFailed. Set
+	// before any exchange loop spawns (the loop reads these fields).
+	dB.retryInterval = 5 * time.Millisecond
+	dB.maxRetries = 2
+	dB.maxRekeyFailures = 1
+
+	bootstrap(t, dA, dB)
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+	psk1 := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, psk1)
+	require.Equal(t, psk1, wgA.psk("bbbb"), "converged on the same PSK after bootstrap+rotation")
+
+	// Data path breaks: the rotation can no longer converge -> OnRekeyFailed.
+	lbB.drop.Store(true)
+	_, err := dB.startExchange("aaaa", false, ExchangeID{})
+	require.NoError(t, err)
+	require.Eventually(t, func() bool { return failedCount(wgB) >= 1 }, time.Second, 5*time.Millisecond)
+
+	// Recovery: re-bootstrap over signalling with the data path STILL broken. It must
+	// still converge (signal is independent of the data path) on a fresh PSK.
+	bootstrap(t, dA, dB)
+	psk2 := wgB.psk("aaaa")
+	require.NotEqual(t, psk1, psk2, "recovery derived a fresh PSK")
+	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides resync after recovery")
+}
+
+// TestConcurrency_ConcurrentRekeysNoRace hammers both managers with concurrent rotation
+// clocks from many goroutines. Its primary job (with -race) is to prove the single-lock
+// state machine has no data races or deadlocks under contention; a final deterministic
+// bootstrap then asserts there is no split-brain (both sides on the same PSK).
+func TestConcurrency_ConcurrentRekeysNoRace(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+
+	var wg sync.WaitGroup
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 50; i++ {
+				dB.OnDataPathRekeyed("aaaa", 0) // initiator chains a rotation
+				dA.OnDataPathRekeyed("bbbb", 0) // responder side is a no-op, still stresses the lock
+			}
+		}()
+	}
+	wg.Wait()
+
+	// The storm may leave an exchange mid-flight (concurrent cancellation). Force a
+	// clean convergence over signalling, then assert no split-brain.
+	bootstrap(t, dA, dB)
+	a, b := wgA.psk("bbbb"), wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, b)
+	require.Equal(t, a, b, "both sides converge on the same PSK, no split-brain")
+}

client/internal/pqkem/convergence.go

@@ -0,0 +1,273 @@
+package pqkem
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"time"
+)
+
+// idHex renders an exchange ID for logs.
+func idHex(id ExchangeID) string { return hex.EncodeToString(id[:]) }
+
+// pskFingerprint is a short, non-secret digest of a derived PSK: identical on both
+// peers iff they derived the same key. Logged instead of the raw PSK so debug logs
+// never carry the actual WireGuard preshared key.
+func pskFingerprint(psk PSK) string {
+	sum := sha256.Sum256(psk[:])
+	return hex.EncodeToString(sum[:8])
+}
+
+// startExchange creates a fresh initiator exchange (acknowledging ackID, zero for a
+// bootstrap) and returns the framed offer for the caller to send — pushed over the
+// data path for a chained rekey, or handed to the host for signalling when viaSignal
+// is set. Any previous in-flight exchange for the peer is cancelled.
+func (m *Manager) startExchange(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
+	init, err := NewInitiator()
+	if err != nil {
+		return nil, err
+	}
+	id, err := newExchangeID()
+	if err != nil {
+		return nil, err
+	}
+	raw, err := (&OfferMsg{ExchangeID: id, AckID: ackID, KEMOffer: init.Offer()}).Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	ctx, cancel := context.WithCancel(m.rootCtx)
+	m.mu.Lock()
+	if old := m.exchanges[remoteID]; old != nil && old.cancel != nil {
+		old.cancel()
+	}
+	m.exchanges[remoteID] = &exchangeCtl{
+		id:        id,
+		state:     stateAwaitingAnswer,
+		startedAt: time.Now(),
+		cancel:    cancel,
+		lastSent:  raw,
+		initiator: init,
+		viaSignal: viaSignal,
+	}
+	m.mu.Unlock()
+
+	m.wait.Add(1)
+	go m.initiatorLoop(ctx, remoteID, id)
+
+	via := "data-path"
+	if viaSignal {
+		via = "signal"
+	}
+	m.trace("pqkem: offer sent", "peer", remoteID, "exchange", idHex(id), "acks", idHex(ackID), "via", via)
+	return raw, nil
+}
+
+// processOffer (responder) first acknowledges the previous exchange the offer names
+// (that offer riding the data path under the freshly adopted key proves it worked),
+// then derives the PSK for the new offer, commits it optimistically, and returns the
+// framed answer. A duplicate offer returns the cached answer without re-deriving.
+func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg) ([]byte, error) {
+	m.trace("pqkem: offer received", "peer", remoteID, "exchange", idHex(o.ExchangeID), "acks", idHex(o.AckID))
+
+	if o.AckID != (ExchangeID{}) {
+		m.ackConverged(remoteID, o.AckID)
+	}
+
+	m.mu.Lock()
+	if ex := m.exchanges[remoteID]; ex != nil && ex.id == o.ExchangeID {
+		state, last := ex.state, ex.lastSent
+		m.mu.Unlock()
+		if state == stateReserved {
+			return nil, nil
+		}
+		m.trace("pqkem: duplicate offer, resending cached answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+		return last, nil
+	}
+	// Reserve the slot so a concurrent duplicate offer bails.
+	m.exchanges[remoteID] = &exchangeCtl{id: o.ExchangeID, state: stateReserved, startedAt: time.Now()}
+	m.mu.Unlock()
+
+	answerBytes, psk, err := Respond(o.KEMOffer, m.binding(remoteID))
+	if err != nil {
+		return nil, err
+	}
+	raw, err := (&AnswerMsg{ExchangeID: o.ExchangeID, KEMAnswer: answerBytes}).Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != o.ExchangeID {
+		m.mu.Unlock()
+		m.trace("pqkem: exchange superseded during respond, dropping answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+		return nil, nil
+	}
+	ex.state = stateAwaitingAck
+	ex.lastSent = raw
+	ex.pendingPSK = psk
+	m.psks[remoteID] = psk
+	m.capable[remoteID] = true // a real KEM offer proves the peer runs the exchange
+	m.mu.Unlock()
+
+	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(o.ExchangeID), "role", "responder", "psk_fp", pskFingerprint(psk))
+
+	// Commit optimistically so our data path can rekey to the new PSK.
+	if err := m.cbHandler.OnNewPSKReady(remoteID, psk); err != nil {
+		return nil, err
+	}
+	m.trace("pqkem: answer sent", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+	return raw, nil
+}
+
+// processAnswer (initiator) derives and commits the PSK and parks in
+// stateAwaitingRekey; the next offer (chained from OnDataPathRekeyed) will acknowledge
+// this exchange. Only valid in stateAwaitingAnswer; advancing the state under the
+// lock makes a concurrent/duplicate answer bail.
+func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg) error {
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != a.ExchangeID || ex.state != stateAwaitingAnswer {
+		haveID := "none"
+		if ex != nil {
+			haveID = idHex(ex.id)
+		}
+		m.mu.Unlock()
+		m.trace("pqkem: unexpected answer dropped (inconsistency)", "peer", remoteID, "answer_for", idHex(a.ExchangeID), "have_exchange", haveID)
+		return nil
+	}
+	ex.state = stateAwaitingRekey
+	init := ex.initiator
+	ex.initiator = nil
+	m.mu.Unlock()
+
+	m.trace("pqkem: answer received", "peer", remoteID, "exchange", idHex(a.ExchangeID))
+
+	psk, err := init.Finish(a.KEMAnswer, m.binding(remoteID))
+	if err != nil {
+		return err
+	}
+
+	// The initiator has converged: the responder must have derived the key to answer.
+	m.mu.Lock()
+	m.established[remoteID] = true
+	m.failures[remoteID] = 0
+	m.psks[remoteID] = psk
+	m.capable[remoteID] = true // a real KEM answer proves the peer runs the exchange
+	m.mu.Unlock()
+
+	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(a.ExchangeID), "role", "initiator", "psk_fp", pskFingerprint(psk))
+
+	return m.cbHandler.OnNewPSKReady(remoteID, psk)
+}
+
+// ackConverged (responder) records convergence of the exchange named by ackID: a
+// later offer acknowledging it proves both sides operate on that exchange's key. Only
+// acts on a matching stateAwaitingAck exchange; anything else is ignored.
+func (m *Manager) ackConverged(remoteID RemoteID, ackID ExchangeID) {
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != ackID || ex.state != stateAwaitingAck {
+		m.mu.Unlock()
+		m.trace("pqkem: ack for unknown/mismatched exchange, ignored (inconsistency)", "peer", remoteID, "acks", idHex(ackID))
+		return
+	}
+	delete(m.exchanges, remoteID)
+	m.established[remoteID] = true
+	m.failures[remoteID] = 0
+	_ = time.Since(ex.startedAt) // convergence latency (metrics hook, later step)
+	m.mu.Unlock()
+
+	m.trace("pqkem: previous exchange confirmed by ack", "peer", remoteID, "exchange", idHex(ackID))
+}
+
+// initiatorLoop enforces the offer->answer convergence deadline and retransmits the
+// initiator's outstanding data-path offer while awaiting the answer (a
+// signalling-bootstrapped offer is retransmitted by the host, so it is not resent
+// here). Exhausting the deadline before the answer arrives is a failure. Once the
+// answer is in (state past awaitingAnswer) the loop exits: the next rotation is driven
+// by OnDataPathRekeyed, and the idle wait for it has no deadline.
+func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id ExchangeID) {
+	defer m.wait.Done()
+	t := time.NewTicker(m.retryInterval)
+	defer t.Stop()
+
+	attempts := 0
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			m.mu.Lock()
+			ex := m.exchanges[remoteID]
+			if ex == nil || ex.id != id {
+				m.mu.Unlock()
+				return
+			}
+
+			switch ex.state {
+			case stateAwaitingAnswer:
+				if attempts >= m.maxRetries {
+					delete(m.exchanges, remoteID)
+					initial := !m.established[remoteID]
+					fail := m.registerFailureLocked(remoteID)
+					m.mu.Unlock()
+					m.raiseFailure(remoteID, fail, initial)
+					return
+				}
+				viaSignal := ex.viaSignal
+				msg := ex.lastSent
+				attempts++
+				m.mu.Unlock()
+				if !viaSignal {
+					if err := m.pushDataPath(remoteID, msg); err != nil {
+						m.logger.Warn("pqkem: offer retransmit failed", "peer", remoteID, "err", err)
+					}
+				}
+
+			default:
+				// Past awaiting the answer (converged) or superseded: the loop's job
+				// is done. The next rotation is driven externally by OnDataPathRekeyed,
+				// so there is no deadline while idle-waiting for it (that wait can be
+				// as long as the transport's natural rekey interval).
+				m.mu.Unlock()
+				return
+			}
+		}
+	}
+}
+
+// registerFailureLocked applies policy B and reports whether OnRekeyFailed is due:
+// an initial exchange (peer never established) fails immediately; a rekey tolerates
+// up to maxRekeyFailures consecutive misses (we stay on the still-valid previous
+// PSK) before failing. Assumes m.mu is held.
+func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
+	if !m.established[remoteID] {
+		return true
+	}
+	m.failures[remoteID]++
+	if m.failures[remoteID] >= m.maxRekeyFailures {
+		m.failures[remoteID] = 0
+		return true
+	}
+	return false
+}
+
+// raiseFailure reports a convergence failure. initial distinguishes a never-established
+// peer (bootstrap failed → no PQ PSK at all; in strict mode the peer stays blocked =
+// "stuck") from a rekey failure (a previous PSK is still in force and traffic continues).
+func (m *Manager) raiseFailure(remoteID RemoteID, fail, initial bool) {
+	if !fail {
+		m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
+		return
+	}
+	if initial {
+		m.logger.Warn("pqkem: initial exchange failed — no PQ PSK established for peer (strict mode keeps the peer blocked until it converges)", "peer", remoteID)
+	} else {
+		m.logger.Warn("pqkem: rekey failed after retries — staying on the previous PSK", "peer", remoteID)
+	}
+	if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
+		m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
+	}
+}

client/internal/pqkem/convergence_test.go

@@ -0,0 +1,74 @@
+package pqkem
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// dropTransport is a pqkem.Transport that silently discards everything.
+type dropTransport struct{}
+
+func (dropTransport) Send(netip.AddrPort, []byte) error { return nil }
+func (dropTransport) LocalPort() int                    { return 0 }
+func (dropTransport) Run(func(netip.AddrPort, []byte))  {}
+func (dropTransport) Close() error                      { return nil }
+
+func failedCount(f *fakeWG) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.failed)
+}
+
+func TestManager_InitialTimeoutFailsImmediately(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil) // bbbb > aaaa -> initiator
+	d.Start(dropTransport{})
+	d.retryInterval = 5 * time.Millisecond
+	d.maxRetries = 3
+	defer d.Stop()
+
+	// Bootstrap offer is produced for signalling; no answer ever comes back -> the
+	// initial exchange fails fast.
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+
+	require.Eventually(t, func() bool { return failedCount(wg) == 1 }, time.Second, 5*time.Millisecond)
+}
+
+func TestManager_RekeyToleratesKFailures(t *testing.T) {
+	dA, dB, _, wgB, lbB := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	// Tighten B's timings before any exchange loop spawns (the loop reads these
+	// fields, so writing them after a loop is running would race).
+	dB.retryInterval = 5 * time.Millisecond
+	dB.maxRetries = 2
+
+	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
+	// path is usable.
+	bootstrap(t, dA, dB)
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
+
+	// Drop B's outbound so rekeys can no longer converge.
+	lbB.drop.Store(true)
+
+	// K-1 data-path rekeys must NOT raise OnRekeyFailed.
+	for i := 0; i < DefaultMaxRekeyFailures-1; i++ {
+		_, err := dB.startExchange("aaaa", false, ExchangeID{})
+		require.NoError(t, err)
+		time.Sleep(50 * time.Millisecond)
+	}
+	require.Equal(t, 0, failedCount(wgB), "no failure before K attempts")
+
+	// The K-th failure raises it once.
+	_, err := dB.startExchange("aaaa", false, ExchangeID{})
+	require.NoError(t, err)
+	require.Eventually(t, func() bool { return failedCount(wgB) == 1 }, time.Second, 5*time.Millisecond)
+}

client/internal/pqkem/env.go

@@ -0,0 +1,138 @@
+package pqkem
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// EnvEnabled is the environment variable that turns the ML-KEM post-quantum
+// exchange on for this client. Accepts on/off aliases plus anything
+// strconv.ParseBool understands (true/false/1/0).
+const EnvEnabled = "NB_ENABLE_PQ_MLKEM"
+
+// Enabled reports whether the ML-KEM PQ exchange is enabled via the environment.
+// An empty or unrecognized value is treated as disabled.
+func Enabled() bool {
+	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvEnabled)))
+	switch raw {
+	case "":
+		return false
+	case "on":
+		return true
+	case "off":
+		return false
+	}
+	enabled, err := strconv.ParseBool(raw)
+	if err != nil {
+		log.Warnf("failed to parse %s value %q: %v", EnvEnabled, raw, err)
+		return false
+	}
+	return enabled
+}
+
+// EnvStrict enables strict (fail-closed) mode: block peer traffic until the ML-KEM
+// PSK has been established, instead of the default opportunistic behaviour that lets
+// the tunnel come up classically and upgrades to PQ once the exchange converges.
+const EnvStrict = "NB_PQ_MLKEM_STRICT"
+
+// Strict reports whether strict (fail-closed) mode is enabled via the environment.
+// An empty or unrecognized value is treated as disabled (opportunistic).
+func Strict() bool {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict))) {
+	case "on":
+		return true
+	case "", "off":
+		return false
+	}
+	enabled, err := strconv.ParseBool(strings.TrimSpace(os.Getenv(EnvStrict)))
+	if err != nil {
+		log.Warnf("failed to parse %s value %q: %v", EnvStrict, os.Getenv(EnvStrict), err)
+		return false
+	}
+	return enabled
+}
+
+// EnvLogLevel overrides the ML-KEM manager's slog level (trace/debug/info/warn/error).
+// Defaults to info. The verbose per-exchange lifecycle logs are emitted at trace.
+const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
+
+// LevelTrace is a custom slog level below Debug for the verbose per-exchange lifecycle
+// logs, so they stay off unless NB_PQ_MLKEM_LOG_LEVEL=trace (and the daemon log level
+// is trace, since the records are forwarded to logrus).
+const LevelTrace = slog.LevelDebug - 4
+
+// NewLogger builds the slog logger for the ML-KEM manager. It forwards records to
+// logrus so PQ logs land in the same sink as the rest of the daemon (console +
+// client.log) rather than stdout. Verbosity is gated by EnvLogLevel.
+func NewLogger() *slog.Logger {
+	return slog.New(slogToLogrus{})
+}
+
+func logLevel() slog.Level {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
+	case "trace":
+		return LevelTrace
+	case "debug":
+		return slog.LevelDebug
+	case "warn":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	default:
+		return slog.LevelInfo
+	}
+}
+
+// slogToLogrus is a slog.Handler that forwards records to logrus, so the ML-KEM
+// manager's logs go wherever the daemon's logrus is configured (console + client.log)
+// instead of stdout. Verbosity is gated by EnvLogLevel via logLevel().
+type slogToLogrus struct {
+	fields log.Fields
+}
+
+func (h slogToLogrus) Enabled(_ context.Context, level slog.Level) bool {
+	return level >= logLevel()
+}
+
+func (h slogToLogrus) Handle(_ context.Context, r slog.Record) error {
+	fields := make(log.Fields, len(h.fields)+r.NumAttrs())
+	for k, v := range h.fields {
+		fields[k] = v
+	}
+	r.Attrs(func(a slog.Attr) bool {
+		fields[a.Key] = a.Value.Any()
+		return true
+	})
+	entry := log.WithFields(fields)
+	switch {
+	case r.Level >= slog.LevelError:
+		entry.Error(r.Message)
+	case r.Level >= slog.LevelWarn:
+		entry.Warn(r.Message)
+	case r.Level >= slog.LevelInfo:
+		entry.Info(r.Message)
+	case r.Level >= slog.LevelDebug:
+		entry.Debug(r.Message)
+	default:
+		entry.Trace(r.Message)
+	}
+	return nil
+}
+
+func (h slogToLogrus) WithAttrs(attrs []slog.Attr) slog.Handler {
+	fields := make(log.Fields, len(h.fields)+len(attrs))
+	for k, v := range h.fields {
+		fields[k] = v
+	}
+	for _, a := range attrs {
+		fields[a.Key] = a.Value.Any()
+	}
+	return slogToLogrus{fields: fields}
+}
+
+func (h slogToLogrus) WithGroup(_ string) slog.Handler { return h }

client/internal/pqkem/kem.go

@@ -0,0 +1,178 @@
+// Package pqkem is a spike (NET-1406) for a post-quantum pre-shared-key exchange
+// that could replace Rosenpass. It performs an X25519MLKEM768 hybrid key
+// encapsulation and derives a 32-byte pre-shared key (PSK).
+//
+// The exchange is a single round trip designed to ride the (already
+// authenticated) Signal offer/answer channel:
+//
+//	initiator --Offer(1216B)--> responder
+//	initiator <--Answer(1120B)-- responder
+//
+// Both sides then hold the same PSK, which is bound to the two peers' identities
+// (their peer identity keys) so the derived key cannot be transplanted
+// to a different peer pair even if the transport authentication were bypassed.
+//
+// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
+// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
+// this group), and ML-KEM_ss ‖ X25519_ss as the KDF input. The PSK is derived with
+// HKDF-SHA256 over that hybrid secret, salted with a domain-separation label and
+// bound (via the HKDF info) to the full transcript and the canonicalised peer
+// identities.
+package pqkem
+
+import (
+	"crypto/ecdh"
+	"crypto/hkdf"
+	"crypto/mlkem"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+)
+
+const (
+	// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
+	// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
+	OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
+	// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
+	AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
+
+	pskLabel = "netbird-pq-psk-v1"
+)
+
+// PSK is the 32-byte derived pre-shared key handed to the consumer to key its channel.
+type PSK [32]byte
+
+// Binding identifies the peer pair the PSK is derived for. Callers set both
+// peer identity keys; the order does not matter (it is canonicalised).
+type Binding struct {
+	LocalID  []byte
+	RemoteID []byte
+}
+
+// Initiator holds the ephemeral secrets between Offer and Finish.
+type Initiator struct {
+	x25519  *ecdh.PrivateKey
+	mlkemDK *mlkem.DecapsulationKey768
+	offer   []byte
+}
+
+// NewInitiator generates the ephemeral X25519 + ML-KEM-768 keypairs.
+func NewInitiator() (*Initiator, error) {
+	x, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("x25519 keygen: %w", err)
+	}
+	dk, err := mlkem.GenerateKey768()
+	if err != nil {
+		return nil, fmt.Errorf("ml-kem keygen: %w", err)
+	}
+
+	offer := make([]byte, 0, OfferSize)
+	offer = append(offer, dk.EncapsulationKey().Bytes()...)
+	offer = append(offer, x.PublicKey().Bytes()...)
+
+	return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
+}
+
+// Offer returns the initiator message to send over Signal.
+func (i *Initiator) Offer() []byte {
+	return i.offer
+}
+
+// Finish consumes the responder's answer and derives the PSK.
+func (i *Initiator) Finish(answer []byte, b Binding) (PSK, error) {
+	if len(answer) != AnswerSize {
+		return PSK{}, fmt.Errorf("answer: got %d bytes, want %d", len(answer), AnswerSize)
+	}
+	ct := answer[:mlkem.CiphertextSize768]
+	peerX := answer[mlkem.CiphertextSize768:]
+
+	ssMLKEM, err := i.mlkemDK.Decapsulate(ct)
+	if err != nil {
+		return PSK{}, fmt.Errorf("ml-kem decapsulate: %w", err)
+	}
+	pub, err := ecdh.X25519().NewPublicKey(peerX)
+	if err != nil {
+		return PSK{}, fmt.Errorf("parse peer x25519: %w", err)
+	}
+	ssX, err := i.x25519.ECDH(pub)
+	if err != nil {
+		return PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
+	}
+
+	return derivePSK(ssMLKEM, ssX, i.offer, answer, b)
+}
+
+// Respond consumes an initiator offer, produces the answer, and derives the PSK.
+func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
+	if len(offer) != OfferSize {
+		return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
+	}
+	peerEK := offer[:mlkem.EncapsulationKeySize768]
+	peerX := offer[mlkem.EncapsulationKeySize768:]
+
+	ek, err := mlkem.NewEncapsulationKey768(peerEK)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("parse peer ml-kem key: %w", err)
+	}
+	ssMLKEM, ct := ek.Encapsulate()
+
+	x, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("x25519 keygen: %w", err)
+	}
+	pub, err := ecdh.X25519().NewPublicKey(peerX)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("parse peer x25519: %w", err)
+	}
+	ssX, err := x.ECDH(pub)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
+	}
+
+	answer = make([]byte, 0, AnswerSize)
+	answer = append(answer, ct...)
+	answer = append(answer, x.PublicKey().Bytes()...)
+
+	// derivePSK uses the same argument order on both sides; the responder's local
+	// binding is the mirror of the initiator's, canonicalised inside derivePSK.
+	psk, err = derivePSK(ssMLKEM, ssX, offer, answer, b)
+	if err != nil {
+		return nil, PSK{}, err
+	}
+	return answer, psk, nil
+}
+
+// derivePSK runs HKDF-SHA256 over the hybrid shared secret (ML-KEM_ss ‖ X25519_ss,
+// per draft-ietf-tls-ecdhe-mlkem), salted with the domain-separation label, and binds
+// the result — via the HKDF info — to the full transcript (offer ‖ answer) and the
+// canonicalised peer identities, so the PSK cannot be transplanted to another peer
+// pair or a different exchange.
+func derivePSK(ssMLKEM, ssX, offer, answer []byte, b Binding) (PSK, error) {
+	lo, hi := canonicalPair(b.LocalID, b.RemoteID)
+
+	ikm := make([]byte, 0, len(ssMLKEM)+len(ssX))
+	ikm = append(ikm, ssMLKEM...)
+	ikm = append(ikm, ssX...)
+
+	info := make([]byte, 0, len(offer)+len(answer)+len(lo)+len(hi))
+	info = append(info, offer...)
+	info = append(info, answer...)
+	info = append(info, lo...)
+	info = append(info, hi...)
+
+	var psk PSK
+	key, err := hkdf.Key(sha256.New, ikm, []byte(pskLabel), string(info), len(psk))
+	if err != nil {
+		return PSK{}, fmt.Errorf("hkdf derive psk: %w", err)
+	}
+	copy(psk[:], key)
+	return psk, nil
+}
+
+func canonicalPair(a, b []byte) (lo, hi []byte) {
+	if string(a) <= string(b) {
+		return a, b
+	}
+	return b, a
+}

client/internal/pqkem/kem_framing_test.go

@@ -0,0 +1,105 @@
+package pqkem
+
+import (
+	"crypto/mlkem"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestExchange_TamperedCiphertextFailsClosed verifies the core fail-closed
+// property: mutating the ML-KEM ciphertext in the answer does not error (ML-KEM
+// uses implicit rejection — Decapsulate always returns a value) but yields a
+// different shared secret, so the initiator derives a PSK that does NOT match the
+// responder's. A mismatched PSK means WireGuard passes no bytes: tamper => no data.
+func TestExchange_TamperedCiphertextFailsClosed(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	tampered := append([]byte(nil), answer...)
+	tampered[0] ^= 0xff // flip a bit in the ML-KEM ciphertext
+
+	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err, "implicit rejection: decapsulate still succeeds")
+	require.NotEqual(t, pskB, pskA, "tampered ciphertext must not yield the responder's PSK")
+}
+
+// TestExchange_TamperedX25519ShareDiverges flips a byte in the answer's X25519
+// share: the classical half of the hybrid secret changes, so the derived PSK
+// diverges from the responder's (fail-closed on the ECDH half too).
+func TestExchange_TamperedX25519ShareDiverges(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	tampered := append([]byte(nil), answer...)
+	tampered[mlkem.CiphertextSize768] ^= 0x01 // first byte of the X25519 public key
+
+	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
+	// Either the point is rejected (error) or the ECDH differs (different PSK);
+	// in both cases the honest PSK is never reproduced.
+	if err == nil {
+		require.NotEqual(t, pskB, pskA, "tampered X25519 share must not yield the responder's PSK")
+	}
+}
+
+// TestExchange_AllZeroX25519Rejected feeds an all-zero X25519 share (a low-order
+// point) in the answer. The stdlib ECDH must reject it, so Finish errors rather
+// than deriving a PSK from a degenerate secret.
+func TestExchange_AllZeroX25519Rejected(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	bad := append([]byte(nil), answer...)
+	for i := mlkem.CiphertextSize768; i < len(bad); i++ {
+		bad[i] = 0
+	}
+
+	_, err = init.Finish(bad, Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "all-zero X25519 share (low-order point) must be rejected")
+}
+
+// TestExchange_SizeBoundaries locks the exact-length framing checks: one byte
+// short or long on either message is rejected, not silently truncated/padded.
+func TestExchange_SizeBoundaries(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+	offer := init.Offer()
+
+	_, _, err = Respond(offer[:OfferSize-1], Binding{})
+	require.Error(t, err, "offer one byte short")
+	_, _, err = Respond(append(append([]byte(nil), offer...), 0), Binding{})
+	require.Error(t, err, "offer one byte long")
+
+	answer, _, err := Respond(offer, Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	_, err = init.Finish(answer[:AnswerSize-1], Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "answer one byte short")
+	_, err = init.Finish(append(append([]byte(nil), answer...), 0), Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "answer one byte long")
+}
+
+// TestExchange_BindingIsSymmetric confirms the canonicalisation: the two peers
+// pass their identities in opposite (Local, Remote) order yet derive the same PSK,
+// so identity binding does not depend on who is initiator vs responder.
+func TestExchange_BindingIsSymmetric(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err)
+
+	require.Equal(t, pskB, pskA, "swapped Local/Remote order must canonicalise to the same PSK")
+}

client/internal/pqkem/kem_test.go

@@ -0,0 +1,89 @@
+package pqkem
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	wgA = []byte("peer-A-wireguard-pubkey-32bytes!")
+	wgB = []byte("peer-B-wireguard-pubkey-32bytes!")
+)
+
+func TestExchange_DerivesMatchingPSK(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	require.Len(t, init.Offer(), OfferSize)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+	require.Len(t, answer, AnswerSize)
+
+	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err)
+
+	require.Equal(t, pskB, pskA, "both sides must derive the same PSK")
+	require.NotEqual(t, PSK{}, pskA, "PSK must not be zero")
+}
+
+func TestExchange_PSKBoundToPeerIdentities(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	// responder computes with the honest pair...
+	_, pskHonest, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	// ...a second responder run with a different peer identity yields a different PSK,
+	// even though the KEM material would otherwise combine identically.
+	wgC := []byte("peer-C-wireguard-pubkey-32bytes!")
+	_, pskWrong, err := Respond(init.Offer(), Binding{LocalID: wgC, RemoteID: wgA})
+	require.NoError(t, err)
+
+	require.NotEqual(t, pskHonest, pskWrong, "PSK must be bound to the peer pair")
+}
+
+func TestExchange_RejectsMalformedMessages(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	_, _, err = Respond(init.Offer()[:10], Binding{})
+	require.Error(t, err)
+
+	_, err = init.Finish([]byte("too short"), Binding{})
+	require.Error(t, err)
+}
+
+// TestExchange_ReportSizesAndTiming is a spike measurement, not a pass/fail gate.
+// Run with: go test -run TestExchange_ReportSizesAndTiming -v ./client/internal/pqkem/
+func TestExchange_ReportSizesAndTiming(t *testing.T) {
+	const iters = 200
+
+	var tInit, tResp, tFinish time.Duration
+	for i := 0; i < iters; i++ {
+		s0 := time.Now()
+		init, err := NewInitiator()
+		require.NoError(t, err)
+		tInit += time.Since(s0)
+
+		s1 := time.Now()
+		answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+		require.NoError(t, err)
+		tResp += time.Since(s1)
+
+		s2 := time.Now()
+		_, err = init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+		require.NoError(t, err)
+		tFinish += time.Since(s2)
+	}
+
+	t.Logf("wire sizes:   offer=%d B   answer=%d B   (Rosenpass static pubkey ~524160 B)", OfferSize, AnswerSize)
+	t.Logf("total on-wire per handshake: %d B  (~%.0fx smaller than RP static key)", OfferSize+AnswerSize, 524160.0/float64(OfferSize+AnswerSize))
+	t.Logf("avg NewInitiator (keygen): %s", tInit/iters)
+	t.Logf("avg Respond (encaps+dh):   %s", tResp/iters)
+	t.Logf("avg Finish (decaps+dh):    %s", tFinish/iters)
+	t.Logf("avg full handshake CPU:    %s", (tInit+tResp+tFinish)/iters)
+}

client/internal/pqkem/manager.go

@@ -0,0 +1,436 @@
+package pqkem
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"log/slog"
+	"net/netip"
+	"sync"
+	"time"
+)
+
+const (
+	// DefaultRetryInterval is how often the initiator retransmits its outstanding
+	// data-path offer while awaiting the answer.
+	DefaultRetryInterval = 2 * time.Second
+	// DefaultMaxRetries bounds how many ticks an exchange may run before it is
+	// declared failed. The convergence deadline is thus MaxRetries * RetryInterval.
+	DefaultMaxRetries = 10
+	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
+	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
+	DefaultMaxRekeyFailures = 3
+
+	// rotationActivityWindow gates rotation on recent real-data activity: a rekey
+	// clocks a rotation only if the peer exchanged user data within this window. It
+	// must stay shorter than the data path's rekey interval (WireGuard
+	// REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the
+	// activity signal — ages out before the next rekey, letting an idle tunnel stop
+	// rotating instead of self-sustaining.
+	rotationActivityWindow = 90 * time.Second
+)
+
+// LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
+// distinct types so the local and a remote identity cannot be mixed up.
+type (
+	LocalID  string
+	RemoteID string
+)
+
+// Transport is the data-path socket the Manager drives (the analogue of
+// go-rosenpass's Conn). It is a dumb mover of bytes to/from endpoints: the Manager
+// owns the remoteID<->endpoint routing and hands the transport a resolved endpoint
+// to Send, and reverse-resolves the source of each inbound datagram. Its lifecycle
+// belongs to the Manager (Run at Start, Close at Stop).
+type Transport interface {
+	// Send delivers msg to the given data-path endpoint.
+	Send(endpoint netip.AddrPort, msg []byte) error
+	// LocalPort is the bound local UDP port, announced to peers so they know where
+	// to send data-path messages.
+	LocalPort() int
+	// Run starts delivering inbound datagrams as (source endpoint, msg) to onInbound
+	// and returns immediately; it runs until Close.
+	Run(onInbound func(src netip.AddrPort, msg []byte))
+	// Close stops delivery and releases the socket.
+	Close() error
+}
+
+// exchangeState is the single source of truth for an exchange's role and phase.
+type exchangeState uint8
+
+const (
+	stateReserved       exchangeState = iota // responder: deriving the answer
+	stateAwaitingAnswer                      // initiator: offer sent, awaiting the answer
+	stateAwaitingRekey                       // initiator: PSK derived+set, awaiting OnDataPathRekeyed to chain the next offer
+	stateAwaitingAck                         // responder: answer sent, awaiting the next offer that acks this exchange
+)
+
+// exchangeCtl holds all state for one in-flight exchange with a peer, under the
+// Manager's single lock. state drives every decision. lastSent is the current
+// data-path retransmit payload (the offer, for the initiator). initiator is the
+// ephemeral handle used at Finish; pendingPSK is the responder's derived key.
+// viaSignal records that the offer went to the host for the signalling channel, so
+// the loop does not retransmit it on the data path. Only the initiator runs a
+// retransmit loop, so only it sets cancel.
+type exchangeCtl struct {
+	id         ExchangeID
+	state      exchangeState
+	startedAt  time.Time
+	cancel     context.CancelFunc
+	lastSent   []byte
+	initiator  *Initiator
+	pendingPSK PSK
+	viaSignal  bool
+}
+
+// Manager is the stateful orchestrator — the analogue of go-rosenpass's Server. It
+// drives the X25519MLKEM768 exchange, owns the peer endpoint routing and the data-path
+// transport, and surfaces the derived PSK and convergence to the host via
+// CallbackHandler. It is event-driven: the bootstrap is triggered by the host
+// (SignalOffer) and each rotation is clocked by OnDataPathRekeyed. The cryptography is
+// the pure kem.go primitives; all state lives here under one lock.
+type Manager struct {
+	localID   LocalID
+	cbHandler CallbackHandler
+	logger    *slog.Logger
+
+	retryInterval    time.Duration
+	maxRetries       int
+	maxRekeyFailures int
+
+	rootCtx    context.Context
+	rootCancel context.CancelFunc
+
+	mu          sync.Mutex
+	transport   Transport
+	exchanges   map[RemoteID]*exchangeCtl   // in-flight exchange per peer
+	established map[RemoteID]bool           // peer has completed at least one exchange
+	failures    map[RemoteID]int            // consecutive rekey failures per peer
+	psks        map[RemoteID]PSK            // latest derived PSK per peer (pulled at WG peer-config time)
+	capable     map[RemoteID]bool           // peer runs the KEM (advertised a PQ port); false = known non-capable
+	peerAddrs   map[RemoteID]netip.AddrPort // remoteID -> data-path endpoint (send routing)
+	peersByAddr map[netip.AddrPort]RemoteID // reverse: source endpoint -> remoteID (inbound)
+	wait        sync.WaitGroup
+}
+
+// NewManager builds a manager for the local peer identified by its peer identity key
+// (used for the deterministic initiator role and the identity binding). A nil logger
+// falls back to slog.Default(). Install the data-path transport with Start.
+func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manager {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	return &Manager{
+		localID:          localID,
+		cbHandler:        h,
+		logger:           logger,
+		retryInterval:    DefaultRetryInterval,
+		maxRetries:       DefaultMaxRetries,
+		maxRekeyFailures: DefaultMaxRekeyFailures,
+		rootCtx:          ctx,
+		rootCancel:       cancel,
+		exchanges:        make(map[RemoteID]*exchangeCtl),
+		established:      make(map[RemoteID]bool),
+		failures:         make(map[RemoteID]int),
+		psks:             make(map[RemoteID]PSK),
+		capable:          make(map[RemoteID]bool),
+		peerAddrs:        make(map[RemoteID]netip.AddrPort),
+		peersByAddr:      make(map[netip.AddrPort]RemoteID),
+	}
+}
+
+// Start installs the data-path transport and begins its inbound delivery. The Manager
+// owns it from here; Stop closes it.
+func (m *Manager) Start(t Transport) {
+	m.mu.Lock()
+	m.transport = t
+	m.mu.Unlock()
+	if t != nil {
+		t.Run(m.onDataPathInbound)
+	}
+}
+
+// LocalPort is the data-path transport's bound UDP port (0 if no transport), to be
+// announced to peers.
+func (m *Manager) LocalPort() int {
+	m.mu.Lock()
+	t := m.transport
+	m.mu.Unlock()
+	if t == nil {
+		return 0
+	}
+	return t.LocalPort()
+}
+
+// IsInitiator reports whether the local peer drives the exchange for this remote
+// peer. Roles are deterministic (lexicographic identity-key compare) so exactly one
+// side initiates, mirroring how Rosenpass picks its handshake initiator.
+func (m *Manager) IsInitiator(remoteID RemoteID) bool {
+	return string(m.localID) > string(remoteID)
+}
+
+// PSK returns the latest PSK derived for the peer, for the host to program at WG
+// peer-config time (the pull path). ok is false until an exchange has derived one.
+func (m *Manager) PSK(remoteID RemoteID) (PSK, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	psk, ok := m.psks[remoteID]
+	return psk, ok
+}
+
+// trace logs at LevelTrace, the verbose per-exchange lifecycle level gated by
+// NB_PQ_MLKEM_LOG_LEVEL=trace.
+func (m *Manager) trace(msg string, args ...any) {
+	m.logger.Log(context.Background(), LevelTrace, msg, args...)
+}
+
+// AddPeer registers where a peer's data-path messages are sent and received: its
+// overlay endpoint (IP:port). This is pure routing and says nothing about capability —
+// PQ capability is decided solely from the peer's KEM payload (see processOffer /
+// processAnswer / MarkNonCapable), never from an endpoint or port.
+func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
+	if !endpoint.IsValid() {
+		return
+	}
+	m.mu.Lock()
+	if old, ok := m.peerAddrs[remoteID]; ok {
+		delete(m.peersByAddr, old)
+	}
+	m.peerAddrs[remoteID] = endpoint
+	m.peersByAddr[endpoint] = remoteID
+	m.mu.Unlock()
+}
+
+// MarkNonCapable records that a peer does not run the KEM: it answered our offer with
+// no KEM material over signalling (the capability signal is the peer's payload, not its
+// optional data-path port). Any in-flight exchange is cancelled and further offers are
+// suppressed (see SignalOffer), so a non-PQ peer never drives the rekey-recovery storm.
+// An already-established peer is left untouched — a stray empty answer must not tear
+// down a working PQ session.
+func (m *Manager) MarkNonCapable(remoteID RemoteID) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.established[remoteID] {
+		return
+	}
+	if prev, ok := m.capable[remoteID]; ok && !prev {
+		return // already known non-capable, nothing to do
+	}
+	m.capable[remoteID] = false
+	if ex := m.exchanges[remoteID]; ex != nil {
+		if ex.cancel != nil {
+			ex.cancel()
+		}
+		delete(m.exchanges, remoteID)
+	}
+	m.trace("pqkem: peer advertises no PQ service — treating as non-capable, no KEM attempted", "peer", remoteID)
+}
+
+// RemovePeer stops any in-flight exchange for a peer and drops its state and routing.
+func (m *Manager) RemovePeer(remoteID RemoteID) {
+	m.mu.Lock()
+	if ex, ok := m.exchanges[remoteID]; ok {
+		if ex.cancel != nil {
+			ex.cancel()
+		}
+		delete(m.exchanges, remoteID)
+	}
+	delete(m.established, remoteID)
+	delete(m.failures, remoteID)
+	delete(m.psks, remoteID)
+	delete(m.capable, remoteID)
+	if ep, ok := m.peerAddrs[remoteID]; ok {
+		delete(m.peersByAddr, ep)
+		delete(m.peerAddrs, remoteID)
+	}
+	m.mu.Unlock()
+}
+
+// Stop cancels all in-flight exchanges, closes the transport, and waits for the
+// exchange goroutines to exit.
+func (m *Manager) Stop() {
+	m.rootCancel()
+	m.wait.Wait()
+	m.mu.Lock()
+	t := m.transport
+	m.transport = nil
+	m.exchanges = make(map[RemoteID]*exchangeCtl)
+	m.psks = make(map[RemoteID]PSK)
+	m.mu.Unlock()
+	if t != nil {
+		if err := t.Close(); err != nil {
+			m.logger.Warn("pqkem: closing data-path transport", "err", err)
+		}
+	}
+}
+
+// ---- Signalling channel (host-driven; rides the host's negotiation) ----
+
+// SignalOffer returns the KEM offer for the host to embed in its outgoing offer to
+// remoteID (bootstrap). It returns (nil, nil) when the local peer is not the
+// initiator. It is idempotent for an in-flight bootstrap: a repeat call returns the
+// same offer rather than starting a new exchange.
+//
+// A signal re-negotiation always re-bootstraps (fresh exchange): the remote may have
+// restarted and lost its PSK, so reusing a locally frozen one would desync. The derived
+// PSK still survives idle in the manager (dropped only on account-level peer removal),
+// so a pure lazy wake with no re-negotiation reuses it via the conn's WG-config pull.
+func (m *Manager) SignalOffer(remoteID RemoteID) ([]byte, error) {
+	if !m.IsInitiator(remoteID) {
+		return nil, nil
+	}
+	m.mu.Lock()
+	if capable, ok := m.capable[remoteID]; ok && !capable {
+		m.mu.Unlock()
+		return nil, nil // peer does not run the KEM; do not offer (avoids a failure/reoffer loop)
+	}
+	if ex := m.exchanges[remoteID]; ex != nil && ex.viaSignal && ex.state == stateAwaitingAnswer {
+		last := ex.lastSent
+		m.mu.Unlock()
+		return last, nil
+	}
+	m.mu.Unlock()
+	// bootstrap offer acknowledges nothing (zero AckID).
+	return m.startExchange(remoteID, true, ExchangeID{})
+}
+
+// SignalOnOffer processes a KEM offer the host extracted from an incoming offer and
+// returns the KEM answer for the host to embed in its outgoing answer.
+func (m *Manager) SignalOnOffer(remoteID RemoteID, offer []byte) ([]byte, error) {
+	typ, msg, err := Decode(offer)
+	if err != nil {
+		return nil, fmt.Errorf("decode signal offer from %s: %w", remoteID, err)
+	}
+	if typ != MsgOffer {
+		return nil, fmt.Errorf("expected offer from %s, got type %d", remoteID, typ)
+	}
+	return m.processOffer(remoteID, msg.(*OfferMsg))
+}
+
+// SignalOnAnswer processes a KEM answer the host extracted from an incoming answer.
+// There is no reply: the next offer (over the data path) acknowledges this exchange.
+func (m *Manager) SignalOnAnswer(remoteID RemoteID, answer []byte) error {
+	typ, msg, err := Decode(answer)
+	if err != nil {
+		return fmt.Errorf("decode signal answer from %s: %w", remoteID, err)
+	}
+	if typ != MsgAnswer {
+		return fmt.Errorf("expected answer from %s, got type %d", remoteID, typ)
+	}
+	return m.processAnswer(remoteID, msg.(*AnswerMsg))
+}
+
+// ---- Data path ----
+
+// onDataPathInbound is the transport's inbound handler: it reverse-resolves the
+// source endpoint to a peer and dispatches. Unknown sources are dropped.
+func (m *Manager) onDataPathInbound(src netip.AddrPort, msg []byte) {
+	m.mu.Lock()
+	remoteID, ok := m.peersByAddr[src]
+	m.mu.Unlock()
+	if !ok {
+		return
+	}
+	if err := m.OnDataPathMessage(remoteID, msg); err != nil {
+		m.trace("pqkem: inbound", "peer", remoteID, "err", err)
+	}
+}
+
+// OnDataPathMessage handles a KEM message received over the data path from remoteID
+// and pushes any reply back over the data path.
+func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
+	typ, msg, err := Decode(raw)
+	if err != nil {
+		return fmt.Errorf("decode data-path msg from %s: %w", remoteID, err)
+	}
+	switch typ {
+	case MsgOffer:
+		answer, err := m.processOffer(remoteID, msg.(*OfferMsg))
+		if err != nil {
+			return err
+		}
+		if answer == nil {
+			return nil
+		}
+		return m.pushDataPath(remoteID, answer)
+	case MsgAnswer:
+		return m.processAnswer(remoteID, msg.(*AnswerMsg))
+	default:
+		return fmt.Errorf("unhandled data-path message type %d from %s", typ, remoteID)
+	}
+}
+
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey
+// (fired on first establishment AND every rekey). If we are the initiator that just
+// derived a PSK, it chains the next exchange: a fresh offer over the data path that
+// acknowledges the just-completed one (its arrival under the new key proves to the
+// responder the key works). sinceActivity is how long ago the peer last exchanged real
+// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is
+// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
+// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
+func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {
+	if sinceActivity >= rotationActivityWindow {
+		m.trace("pqkem: peer idle, skipping data-path rotation", "peer", remoteID, "since_activity", sinceActivity)
+		return
+	}
+
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	chain := ex != nil && ex.state == stateAwaitingRekey
+	var ackID ExchangeID
+	if chain {
+		ackID = ex.id
+	}
+	m.mu.Unlock()
+
+	m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", chain)
+	if !chain {
+		return
+	}
+	offer, err := m.startExchange(remoteID, false, ackID)
+	if err != nil {
+		m.logger.Error("pqkem: chain offer failed to start", "peer", remoteID, "err", err)
+		return
+	}
+	if err := m.pushDataPath(remoteID, offer); err != nil {
+		m.logger.Warn("pqkem: send chain offer failed", "peer", remoteID, "err", err)
+		return
+	}
+	m.trace("pqkem: chain offer sent over data path", "peer", remoteID)
+}
+
+// OnDataPathDown notifies that the peer's data path went down. Rotations resume once
+// the host re-bootstraps over signalling on reconnect; in-flight data-path sends will
+// simply fail until then. Reserved as an explicit hook.
+func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
+
+// ---- internals ----
+
+// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
+// erroring if the peer is unknown or no transport is set.
+func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
+	m.mu.Lock()
+	ep, ok := m.peerAddrs[remoteID]
+	t := m.transport
+	m.mu.Unlock()
+	if !ok {
+		return fmt.Errorf("no data-path endpoint for peer %s", remoteID)
+	}
+	if t == nil {
+		return fmt.Errorf("no data-path transport")
+	}
+	return t.Send(ep, msg)
+}
+
+func (m *Manager) binding(remoteID RemoteID) Binding {
+	return Binding{LocalID: []byte(m.localID), RemoteID: []byte(remoteID)}
+}
+
+func newExchangeID() (ExchangeID, error) {
+	var id ExchangeID
+	if _, err := rand.Read(id[:]); err != nil {
+		return ExchangeID{}, fmt.Errorf("generate exchange id: %w", err)
+	}
+	return id, nil
+}

client/internal/pqkem/manager_test.go

@@ -0,0 +1,193 @@
+package pqkem
+
+import (
+	"fmt"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// netSwitch is an in-memory UDP fabric: transports register their endpoint and get
+// datagrams delivered to their inbound handler.
+type netSwitch struct {
+	mu sync.Mutex
+	h  map[netip.AddrPort]func(netip.AddrPort, []byte)
+}
+
+func newSwitch() *netSwitch {
+	return &netSwitch{h: map[netip.AddrPort]func(netip.AddrPort, []byte){}}
+}
+
+func (s *netSwitch) register(ep netip.AddrPort, fn func(netip.AddrPort, []byte)) {
+	s.mu.Lock()
+	s.h[ep] = fn
+	s.mu.Unlock()
+}
+
+func (s *netSwitch) deliver(dst, src netip.AddrPort, msg []byte) error {
+	s.mu.Lock()
+	fn := s.h[dst]
+	s.mu.Unlock()
+	if fn == nil {
+		return fmt.Errorf("no route to %s", dst)
+	}
+	fn(src, msg)
+	return nil
+}
+
+// loopback is an endpoint-based pqkem.Transport over a netSwitch, with a switchable
+// drop flag.
+type loopback struct {
+	ep   netip.AddrPort
+	sw   *netSwitch
+	drop atomic.Bool
+}
+
+func (l *loopback) Send(dst netip.AddrPort, msg []byte) error {
+	if l.drop.Load() {
+		return nil
+	}
+	return l.sw.deliver(dst, l.ep, append([]byte(nil), msg...))
+}
+
+func (l *loopback) LocalPort() int                             { return int(l.ep.Port()) }
+func (l *loopback) Run(onInbound func(netip.AddrPort, []byte)) { l.sw.register(l.ep, onInbound) }
+func (l *loopback) Close() error                               { return nil }
+
+type fakeWG struct {
+	mu     sync.Mutex
+	psks   map[RemoteID]PSK
+	failed []RemoteID
+}
+
+func newFakeWG() *fakeWG { return &fakeWG{psks: map[RemoteID]PSK{}} }
+
+func (f *fakeWG) OnNewPSKReady(remoteID RemoteID, psk PSK) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.psks[remoteID] = psk
+	return nil
+}
+
+func (f *fakeWG) OnRekeyFailed(remoteID RemoteID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.failed = append(f.failed, remoteID)
+	return nil
+}
+
+func (f *fakeWG) psk(peer RemoteID) PSK {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.psks[peer]
+}
+
+var (
+	epA = netip.MustParseAddrPort("100.64.0.1:51833")
+	epB = netip.MustParseAddrPort("100.64.0.2:51833")
+)
+
+// pair builds two wired managers (B is the initiator, "bbbb" > "aaaa") sharing a
+// netSwitch, with each peer's data-path endpoint registered. lbB is B's loopback
+// (for toggling drop).
+func pair(t *testing.T) (dA, dB *Manager, wgA, wgB *fakeWG, lbB *loopback) {
+	t.Helper()
+	sw := newSwitch()
+	wgA = newFakeWG()
+	wgB = newFakeWG()
+	dA = NewManager("aaaa", wgA, nil)
+	dB = NewManager("bbbb", wgB, nil)
+	dA.Start(&loopback{ep: epA, sw: sw})
+	lbB = &loopback{ep: epB, sw: sw}
+	dB.Start(lbB)
+	dA.AddPeer("bbbb", epB)
+	dB.AddPeer("aaaa", epA)
+	return dA, dB, wgA, wgB, lbB
+}
+
+// bootstrap runs the signalling offer/answer (the test plays the host carrying bytes).
+func bootstrap(t *testing.T, dA, dB *Manager) {
+	t.Helper()
+	offer, err := dB.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+	answer, err := dA.SignalOnOffer("bbbb", offer)
+	require.NoError(t, err)
+	require.NotNil(t, answer)
+	require.NoError(t, dB.SignalOnAnswer("aaaa", answer))
+}
+
+func TestManager_BootstrapDerivesSamePSK(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+
+	pskA := wgA.psk("bbbb")
+	pskB := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, pskA)
+	require.Equal(t, pskB, pskA, "both sides derive the same PSK from the bootstrap exchange")
+}
+
+func TestManager_ChainRotatesAndAcks(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	psk1 := wgB.psk("aaaa")
+
+	// Data path up: B (initiator) chains the next offer over the data path, which
+	// rotates both to a fresh PSK and acknowledges A.
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+
+	psk2A := wgA.psk("bbbb")
+	psk2B := wgB.psk("aaaa")
+	require.Equal(t, psk2B, psk2A, "both sides converge on the rotated PSK")
+	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
+}
+
+func TestManager_RotationSkippedWhenIdle(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	psk1 := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, psk1)
+
+	// Idle: the peer's last real-data activity is older than the window, so a rekey
+	// must NOT clock a rotation.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow)
+	require.Equal(t, psk1, wgB.psk("aaaa"), "idle peer must not rotate the PSK")
+	require.Equal(t, psk1, wgA.psk("bbbb"), "idle peer must not rotate the PSK")
+
+	// Active: activity within the window clocks the rotation as usual.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow-1)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow-1)
+	psk2 := wgB.psk("aaaa")
+	require.NotEqual(t, psk1, psk2, "recent activity must clock a rotation")
+	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides converge on the rotated PSK")
+}
+
+func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
+	dA := NewManager("aaaa", newFakeWG(), nil)
+	defer dA.Stop()
+
+	offer, err := dA.SignalOffer("bbbb") // not the initiator vs "bbbb"
+	require.NoError(t, err)
+	require.Nil(t, offer)
+}
+
+func TestManager_StopIsIdempotent(t *testing.T) {
+	dA := NewManager("aaaa", newFakeWG(), nil)
+	dA.Start(&loopback{ep: epA, sw: newSwitch()})
+	dA.Stop()
+	dA.Stop() // must not panic or hang
+}

client/internal/pqkem/message.go

@@ -0,0 +1,121 @@
+package pqkem
+
+import (
+	"crypto/mlkem"
+	"fmt"
+)
+
+// Wire framing for the PQ-KEM exchange. Messages are self-contained, versioned,
+// transport-agnostic byte blobs: the same bytes ride the signalling channel
+// (initial bootstrap) or a data-tunnel packet (rekey). The library only ever sees
+// opaque []byte at the transport seam.
+//
+// Layout (all messages): [type:1][version:1][exchangeID:16][payload...]
+//
+// There is no confirm message: an exchange is acknowledged by the NEXT offer, which
+// carries the acked exchange's id (see OfferMsg.AckID) and — riding the data path
+// under the freshly adopted key — proves that key works.
+
+const (
+	// ProtocolVersion is bumped on any wire-incompatible change; a peer rejects
+	// messages it does not understand rather than misparsing them.
+	ProtocolVersion uint8 = 1
+
+	// ExchangeIDSize identifies one exchange so answers/acks correlate and stale
+	// messages are dropped.
+	ExchangeIDSize = 16
+
+	headerSize = 1 + 1 + ExchangeIDSize
+)
+
+// MsgType tags the two message kinds of the exchange.
+type MsgType uint8
+
+const (
+	MsgOffer MsgType = iota + 1
+	MsgAnswer
+)
+
+// ExchangeID is the per-exchange correlator. The zero value means "none" (an offer
+// that acknowledges nothing, i.e. the first exchange of a connection).
+type ExchangeID [ExchangeIDSize]byte
+
+// OfferMsg carries the initiator's public material (X25519 pub ‖ ML-KEM encap key)
+// and AckID, the id of the previous exchange this offer acknowledges (zero if none).
+type OfferMsg struct {
+	ExchangeID ExchangeID
+	AckID      ExchangeID
+	// KEMOffer is the raw Initiator.Offer() blob (OfferSize bytes).
+	KEMOffer []byte
+}
+
+// AnswerMsg carries the responder's reply (ML-KEM ciphertext ‖ X25519 pub) for the
+// round identified by ExchangeID.
+type AnswerMsg struct {
+	ExchangeID ExchangeID
+	// KEMAnswer is the raw Respond() answer blob (AnswerSize bytes).
+	KEMAnswer []byte
+}
+
+// Encode serialises the offer with its framed header (payload = AckID ‖ KEMOffer).
+func (m *OfferMsg) Encode() ([]byte, error) {
+	if len(m.KEMOffer) != OfferSize {
+		return nil, fmt.Errorf("offer payload: got %d, want %d", len(m.KEMOffer), OfferSize)
+	}
+	payload := make([]byte, 0, ExchangeIDSize+OfferSize)
+	payload = append(payload, m.AckID[:]...)
+	payload = append(payload, m.KEMOffer...)
+	return frame(MsgOffer, m.ExchangeID, payload), nil
+}
+
+// Encode serialises the answer with its framed header.
+func (m *AnswerMsg) Encode() ([]byte, error) {
+	if len(m.KEMAnswer) != AnswerSize {
+		return nil, fmt.Errorf("answer payload: got %d, want %d", len(m.KEMAnswer), AnswerSize)
+	}
+	return frame(MsgAnswer, m.ExchangeID, m.KEMAnswer), nil
+}
+
+// Decode parses a framed message into one of *OfferMsg / *AnswerMsg.
+func Decode(buf []byte) (MsgType, any, error) {
+	if len(buf) < headerSize {
+		return 0, nil, fmt.Errorf("message too short: %d bytes", len(buf))
+	}
+	typ := MsgType(buf[0])
+	if ver := buf[1]; ver != ProtocolVersion {
+		return typ, nil, fmt.Errorf("unsupported protocol version %d (want %d)", ver, ProtocolVersion)
+	}
+
+	var id ExchangeID
+	copy(id[:], buf[2:headerSize])
+	payload := buf[headerSize:]
+
+	switch typ {
+	case MsgOffer:
+		if len(payload) != ExchangeIDSize+OfferSize {
+			return typ, nil, fmt.Errorf("offer payload: got %d, want %d", len(payload), ExchangeIDSize+OfferSize)
+		}
+		var ack ExchangeID
+		copy(ack[:], payload[:ExchangeIDSize])
+		return typ, &OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: payload[ExchangeIDSize:]}, nil
+	case MsgAnswer:
+		if len(payload) != AnswerSize {
+			return typ, nil, fmt.Errorf("answer payload: got %d, want %d", len(payload), AnswerSize)
+		}
+		return typ, &AnswerMsg{ExchangeID: id, KEMAnswer: payload}, nil
+	default:
+		return typ, nil, fmt.Errorf("unknown message type %d", typ)
+	}
+}
+
+func frame(typ MsgType, id ExchangeID, payload []byte) []byte {
+	buf := make([]byte, headerSize+len(payload))
+	buf[0] = byte(typ)
+	buf[1] = ProtocolVersion
+	copy(buf[2:], id[:])
+	copy(buf[headerSize:], payload)
+	return buf
+}
+
+// compile-time assurance the KEM blob sizes referenced here stay in sync with kem.go.
+var _ = [1]struct{}{}[OfferSize-(32+mlkem.EncapsulationKeySize768)]

client/internal/pqkem/message_test.go

@@ -0,0 +1,57 @@
+package pqkem
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMessageRoundTrip(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	id := ExchangeID{1, 2, 3, 4}
+	ack := ExchangeID{9, 9, 9}
+
+	offBytes, err := (&OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: init.Offer()}).Encode()
+	require.NoError(t, err)
+	typ, decoded, err := Decode(offBytes)
+	require.NoError(t, err)
+	require.Equal(t, MsgOffer, typ)
+	require.Equal(t, id, decoded.(*OfferMsg).ExchangeID)
+	require.Equal(t, ack, decoded.(*OfferMsg).AckID)
+	require.Equal(t, init.Offer(), decoded.(*OfferMsg).KEMOffer)
+
+	ansBytes, err := (&AnswerMsg{ExchangeID: id, KEMAnswer: answer}).Encode()
+	require.NoError(t, err)
+	typ, decoded, err = Decode(ansBytes)
+	require.NoError(t, err)
+	require.Equal(t, MsgAnswer, typ)
+	require.Equal(t, answer, decoded.(*AnswerMsg).KEMAnswer)
+}
+
+func TestDecodeRejects(t *testing.T) {
+	// too short
+	_, _, err := Decode([]byte{1, 1})
+	require.Error(t, err)
+
+	// wrong version
+	bad := make([]byte, headerSize+ExchangeIDSize+OfferSize)
+	bad[0] = byte(MsgOffer)
+	bad[1] = ProtocolVersion + 1
+	_, _, err = Decode(bad)
+	require.Error(t, err)
+
+	// unknown type
+	bad2 := make([]byte, headerSize)
+	bad2[0] = 99
+	bad2[1] = ProtocolVersion
+	_, _, err = Decode(bad2)
+	require.Error(t, err)
+
+	// offer with wrong payload size
+	_, err = (&OfferMsg{KEMOffer: []byte{1, 2, 3}}).Encode()
+	require.Error(t, err)
+}

client/internal/pqkem_adapter.go

@@ -0,0 +1,146 @@
+package internal
+
+import (
+	"net/netip"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/internal/pqkem"
+)
+
+// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
+// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
+type pqPresharedKeySetter interface {
+	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
+}
+
+// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
+// engine-side implementation of pqkem.CallbackHandler.
+type pqCallbackHandler struct {
+	wg pqPresharedKeySetter
+	// reoffer re-bootstraps the KEM over Signal for a peer (a fresh signalling offer)
+	// to recover from a persistent data-path rekey failure. Nil disables recovery.
+	reoffer func(remoteKey string)
+}
+
+// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
+// if the peer is not present, mirroring Rosenpass).
+func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
+	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
+	// peer is not configured yet, so this is a no-op there and the PSK is instead
+	// pulled at peer-config time (pqHandshaker.PSK / conn.presharedKey).
+	log.Tracef("pqkem: programming PSK for peer %s", remoteID)
+	return h.wg.SetPresharedKey(string(remoteID), wgtypes.Key(psk), true)
+}
+
+// OnRekeyFailed reports a failed PQ (re)key convergence and re-bootstraps the KEM over
+// Signal to recover: a fresh signalling offer starts a new exchange that overwrites the
+// stalled PSK on both sides, resyncing after a persistent data-path desync. The tunnel
+// stays up on the previous PSK meanwhile (the Signal channel is independent of the
+// broken data path).
+func (h pqCallbackHandler) OnRekeyFailed(remoteID pqkem.RemoteID) error {
+	log.Warnf("pqkem: post-quantum rekey failed for peer %s, re-bootstrapping over signal", remoteID)
+	if h.reoffer != nil {
+		h.reoffer(string(remoteID))
+	}
+	return nil
+}
+
+// pqHandshaker adapts the pqkem manager to peer.PQHandshaker (string peer keys),
+// wiring the host's signalling offers/answers to the KEM exchange.
+type pqHandshaker struct {
+	mgr *pqkem.Manager
+}
+
+// announcedPort is the PQ data-path port to advertise to peers. It is omitted (0) when
+// the manager is on DefaultPort, since peers assume the default when no port is sent;
+// only a non-default (collision-forced) port is announced explicitly.
+func (p pqHandshaker) announcedPort() int {
+	if port := p.mgr.LocalPort(); port != DefaultPort {
+		return port
+	}
+	return 0
+}
+
+func (p pqHandshaker) OfferPayload(remoteKey string) ([]byte, int) {
+	payload, err := p.mgr.SignalOffer(pqkem.RemoteID(remoteKey))
+	if err != nil {
+		log.Warnf("pqkem: build offer for %s: %v", remoteKey, err)
+	}
+	return payload, p.announcedPort()
+}
+
+func (p pqHandshaker) AnswerPayload(remoteKey string, recvOffer []byte) ([]byte, int) {
+	if len(recvOffer) == 0 {
+		// Capability signal (responder side): the KEM offer flows initiator->responder,
+		// so if we are the responder for this peer (it is the KEM initiator by role) an
+		// empty offer means it does not run the KEM. If we are the initiator, an empty
+		// offer is normal — the peer is the responder and puts its material in the
+		// answer — so we must not flag it.
+		if !p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
+			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
+		}
+		return nil, p.announcedPort()
+	}
+	payload, err := p.mgr.SignalOnOffer(pqkem.RemoteID(remoteKey), recvOffer)
+	if err != nil {
+		log.Warnf("pqkem: build answer for %s: %v", remoteKey, err)
+	}
+	return payload, p.announcedPort()
+}
+
+func (p pqHandshaker) OnAnswer(remoteKey string, recvAnswer []byte) {
+	if len(recvAnswer) == 0 {
+		// Capability signal (initiator side): the KEM answer flows responder->initiator,
+		// so an empty answer to our offer means the peer does not run the KEM — mark it
+		// non-capable to stop offering (no failure/reoffer storm). Only meaningful when
+		// we are the initiator: as the responder we also receive an (empty) answer to
+		// our own non-KEM offer from a perfectly capable peer, which must not be flagged.
+		if p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
+			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
+		}
+		return
+	}
+	if err := p.mgr.SignalOnAnswer(pqkem.RemoteID(remoteKey), recvAnswer); err != nil {
+		log.Warnf("pqkem: process answer from %s: %v", remoteKey, err)
+	}
+}
+
+// PSK exposes the peer's derived PSK for the conn to program at WG peer-config time.
+func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
+	psk, ok := p.mgr.PSK(pqkem.RemoteID(remoteKey))
+	if !ok {
+		return wgtypes.Key{}, false
+	}
+	return wgtypes.Key(psk), true
+}
+
+// SetRemoteAddr registers the peer's data-path endpoint learned from signalling. A
+// zero port means the peer omitted it (it is on DefaultPort), so we resolve it here —
+// DefaultPort lives in this package, not in peer. Sends only ever fire once the tunnel
+// is up (clocked by OnDataPathRekeyed), so registering here is safe even before
+// connection-up.
+func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
+	if !addr.Addr().IsValid() {
+		return
+	}
+	port := addr.Port()
+	if port == 0 {
+		port = DefaultPort
+	}
+	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), netip.AddrPortFrom(addr.Addr(), port))
+}
+
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.
+// sinceActivity is how long ago the peer last exchanged real user data; the manager
+// skips rotation for idle tunnels.
+func (p pqHandshaker) OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration) {
+	p.mgr.OnDataPathRekeyed(pqkem.RemoteID(remoteKey), sinceActivity)
+}
+
+// OnDataPathDown signals the peer's tunnel went down.
+func (p pqHandshaker) OnDataPathDown(remoteKey string) {
+	p.mgr.OnDataPathDown(pqkem.RemoteID(remoteKey))
+}

client/internal/pqkem_adapter_test.go

@@ -0,0 +1,37 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pqkem"
+)
+
+type pqNoopHandler struct{}
+
+func (pqNoopHandler) OnNewPSKReady(pqkem.RemoteID, pqkem.PSK) error { return nil }
+func (pqNoopHandler) OnRekeyFailed(pqkem.RemoteID) error            { return nil }
+
+// TestPQAdapter_CapabilityRoleAware locks the role-aware capability signal: the KEM
+// payload only flows initiator-offer -> responder-answer, so an empty message in the
+// other direction comes from a perfectly capable peer and must NOT flag it. Only the
+// message that should carry material (the answer we receive as initiator) marks a peer
+// non-capable when empty.
+func TestPQAdapter_CapabilityRoleAware(t *testing.T) {
+	// localID "zzzz" > "aaaa" => this manager is the KEM initiator for peer "aaaa".
+	mgr := pqkem.NewManager("zzzz", pqNoopHandler{}, nil)
+	defer mgr.Stop()
+	h := pqHandshaker{mgr: mgr}
+
+	// An empty OFFER from our peer is normal here: as the initiator's responder it puts
+	// its material in the answer, not the offer. It must not disable our offering.
+	h.AnswerPayload("aaaa", nil)
+	payload, _ := h.OfferPayload("aaaa")
+	require.NotNil(t, payload, "an empty offer from a responder-role peer must not mark it non-capable")
+
+	// An empty ANSWER to our offer means the peer does not run the KEM -> stop offering.
+	h.OnAnswer("aaaa", nil)
+	payload2, _ := h.OfferPayload("aaaa")
+	require.Nil(t, payload2, "an empty answer to our offer marks the peer non-capable, so we stop offering")
+}

client/internal/pqkem_transport.go

@@ -0,0 +1,72 @@
+package internal
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
+// the WG overlay IP. Since each client owns a distinct overlay IP, this port is
+// almost always free, so it need not be announced (peers assume it). A peer only
+// announces Body.mlkemPort when a collision forced it onto a different port.
+const DefaultPort = 51833
+
+// pqTransport is the ML-KEM data-path transport: a dumb UDP socket bound on the WG
+// overlay IP. It implements pqkem.Transport — the manager owns the remoteID<->endpoint
+// routing and drives this socket's lifecycle (Run / Close).
+type pqTransport struct {
+	conn *net.UDPConn
+	port int
+}
+
+// newPQTransport binds a UDP socket on the WG overlay IP, preferring DefaultPort and
+// falling back to an OS-assigned ephemeral port if it is in use. Call it after the WG
+// interface is up so the overlay IP is assigned; when the bound port is not
+// DefaultPort it must be announced to peers via Body.mlkemPort.
+func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
+	if !overlayIP.IsValid() {
+		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
+	}
+	ip := net.IP(overlayIP.AsSlice())
+	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
+	if err != nil {
+		log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
+		conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
+		if err != nil {
+			return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
+		}
+	}
+	return &pqTransport{conn: conn, port: conn.LocalAddr().(*net.UDPAddr).Port}, nil
+}
+
+// Send implements pqkem.Transport.
+func (t *pqTransport) Send(endpoint netip.AddrPort, msg []byte) error {
+	_, err := t.conn.WriteToUDPAddrPort(msg, endpoint)
+	return err
+}
+
+// LocalPort implements pqkem.Transport.
+func (t *pqTransport) LocalPort() int { return t.port }
+
+// Run implements pqkem.Transport: the receive loop, delivering each datagram as
+// (source endpoint, msg). Exits when the socket is closed.
+func (t *pqTransport) Run(onInbound func(src netip.AddrPort, msg []byte)) {
+	go func() {
+		buf := make([]byte, 2048)
+		for {
+			n, src, err := t.conn.ReadFromUDPAddrPort(buf)
+			if err != nil {
+				return
+			}
+			msg := make([]byte, n)
+			copy(msg, buf[:n])
+			onInbound(src, msg)
+		}
+	}()
+}
+
+// Close implements pqkem.Transport.
+func (t *pqTransport) Close() error { return t.conn.Close() }

client/ui/build/linux/netbird-ui.desktop

@@ -1,11 +1,10 @@
 [Desktop Entry]
 Type=Application
-Name=NetBird
-Comment=NetBird desktop client
+Name=netbird-ui
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 netbird-ui
 Icon=netbird-ui
-Categories=Utility;Network;
+Categories=Development;
 Terminal=false
-Keywords=netbird;vpn;wireguard;
+Keywords=wails
 Version=1.0
 StartupNotify=false

client/ui/build/linux/netbird.desktop

@@ -1,6 +1,5 @@
 [Desktop Entry]
-Name=NetBird
-Comment=NetBird desktop client
+Name=Netbird
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/netbird-ui
 Icon=netbird
 Type=Application

client/ui/build/linux/nfpm/nfpm.yaml

@@ -21,17 +21,8 @@ contents:
     dst: "/usr/local/bin/netbird-ui"
   - src: "./build/appicon.png"
     dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
-  # The name the polkit action's icon_name refers to, which the released packages
-  # install as /usr/share/pixmaps/netbird.png.
-  - src: "./build/appicon.png"
-    dst: "/usr/share/icons/hicolor/128x128/apps/netbird.png"
   - src: "./build/linux/netbird-ui.desktop"
     dst: "/usr/share/applications/netbird-ui.desktop"
-  # Names the polkit action for the elevation prompt the app raises when an
-  # unprivileged user changes a privileged setting; without it the dialog shows a
-  # raw command line.
-  - src: "./build/linux/polkit/io.netbird.settings.policy"
-    dst: "/usr/share/polkit-1/actions/io.netbird.settings.policy"
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:

client/ui/build/linux/polkit/io.netbird.settings.policy

@@ -1,47 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
-
-<!--
-  Names the action behind the elevation prompt the desktop app raises for an SSH
-  setting the daemon restricts to root; without it pkexec's generic dialog offers
-  the raw command line instead. The argv1 annotation keeps this wording to the
-  one-shot mode that applies those settings.
-
-  auth_admin rather than auth_admin_keep: each of these settings is its own grant
-  of shell access, so a credential cache would let a second, unasked-for change
-  ride along on the authorization given the first.
-
-  exec.path takes no wildcard and the binary's location depends on the package,
-  hence one action per path.
--->
-<policyconfig>
-  <vendor>NetBird</vendor>
-  <vendor_url>https://netbird.io</vendor_url>
-
-  <action id="io.netbird.settings.apply-privileged">
-    <description>Change privileged NetBird settings</description>
-    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird</icon_name>
-    <defaults>
-      <allow_any>auth_admin</allow_any>
-      <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/netbird-ui</annotate>
-    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
-  </action>
-
-  <action id="io.netbird.settings.apply-privileged-local">
-    <description>Change privileged NetBird settings</description>
-    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird</icon_name>
-    <defaults>
-      <allow_any>auth_admin</allow_any>
-      <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/netbird-ui</annotate>
-    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
-  </action>
-</policyconfig>

client/ui/frontend/src/contexts/SettingsContext.tsx

@@ -22,18 +22,12 @@ const logSaveError = (err: unknown) => console.error("[SettingsContext] save fai
 
 export type AutostartState = { supported: boolean; enabled: boolean };
 
-// GuardedField is a setting the daemon only accepts from root/administrator.
-// Turning one on goes through saveGuardedField, which asks the operating system
-// for the privileges rather than sending a request that would be refused.
-export type GuardedField = "serverSshAllowed" | "enableSshRoot" | "disableSshAuth";
-
 type SettingsContextValue = {
     config: Config;
     guiVersion: string;
     setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
     saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
     saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
-    saveGuardedField: (k: GuardedField, v: boolean) => Promise<void>;
     saveNow: () => Promise<void>;
 };
 
@@ -69,12 +63,6 @@ const useSettingsState = () => {
     const [guiVersion, setGuiVersion] = useState<string>("—");
     const saveTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
     const loadedRef = useRef<LoadedConfig | null>(null);
-    // Set when the daemon's config changed while a save was pending, so the read
-    // that was skipped to protect the pending edit happens once it is through.
-    // Without it the form keeps values the daemon no longer has and the next save
-    // submits them, which for a guarded setting means asking the user to authorize
-    // a change they never made.
-    const reloadOwed = useRef(false);
 
     useEffect(() => {
         loadedRef.current = loaded;
@@ -85,7 +73,6 @@ const useSettingsState = () => {
     // update the daemon then rejected.
     const reload = useCallback(
         async (profileName: string) => {
-            reloadOwed.current = false;
             try {
                 const data = await SettingsSvc.GetConfig({ profileName, username });
                 setLoaded({ profileName, data });
@@ -107,12 +94,7 @@ const useSettingsState = () => {
                     username,
                 });
                 if (cancelled) return;
-                // A pending edit outranks the daemon's copy until it is saved, so
-                // the read is owed rather than dropped: see reloadOwed.
-                if (saveTimer.current) {
-                    reloadOwed.current = true;
-                    return;
-                }
+                if (saveTimer.current) return;
                 setLoaded({ profileName: activeProfileId, data });
             } catch (e) {
                 if (cancelled || !showError) return;
@@ -159,17 +141,12 @@ const useSettingsState = () => {
         async (profileName: string, next: Config, preSharedKey?: string) => {
             const preSharedKeyWrite = preSharedKey === undefined ? {} : { preSharedKey };
             try {
-                const { declined } = await SettingsSvc.SetConfig({
+                await SettingsSvc.SetConfig({
                     ...next,
                     ...preSharedKeyWrite,
                     profileName,
                     username,
                 });
-                // The change needed authorization and the user said no, so the
-                // optimistic update is wrong. Nothing to report: they know.
-                if (declined || reloadOwed.current) {
-                    await reload(profileName);
-                }
             } catch (e) {
                 // The optimistic update is wrong now: the daemon refused it
                 // (a change that needs elevated privileges, an MDM-managed
@@ -229,59 +206,6 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
-    // saveGuardedField applies a setting the daemon restricts to
-    // root/administrator by having the Go side run the app again under the
-    // platform's elevation prompt (UAC, the macOS authentication dialog, polkit).
-    // The prompt is the user's, so the call is made straight from their gesture
-    // and never from the debounce.
-    const saveGuardedField = useCallback(
-        async (k: GuardedField, v: boolean) => {
-            const cur = loadedRef.current;
-            if (!cur) return;
-
-            // Flush what the debounce still owes, before the optimistic update
-            // below joins it: a later save carrying the guarded value would be
-            // refused, and its error dialog would be the second one for a change
-            // the user already authorized.
-            if (saveTimer.current) {
-                clearTimeout(saveTimer.current);
-                saveTimer.current = null;
-                await save(cur.profileName, cur.data);
-            }
-
-            const next: LoadedConfig = {
-                profileName: cur.profileName,
-                data: { ...cur.data, [k]: v },
-            };
-            loadedRef.current = next;
-            setLoaded(next);
-
-            try {
-                await SettingsSvc.SetGuardedSettings({
-                    profileName: cur.profileName,
-                    username,
-                    [k]: v,
-                });
-            } catch (e) {
-                // The daemon is authoritative either way, so re-read before
-                // reporting. A declined prompt is not an error and does not come
-                // through here at all; this is a prompt that could not be raised,
-                // which carries the command that would have done it.
-                await reload(cur.profileName);
-                await errorDialog({
-                    Title: i18next.t("settings.error.saveTitle"),
-                    Message: errorMessage(e),
-                    Command: errorCommand(e),
-                });
-                return;
-            }
-            // Either the change went through or the user declined it. The daemon
-            // says which.
-            await reload(cur.profileName);
-        },
-        [username, save, reload],
-    );
-
     const saveFields = useCallback(
         async (partial: Partial<Config>, opts?: { preSharedKey?: string }) => {
             if (!loaded) return;
@@ -301,27 +225,15 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
-    return {
-        config: loaded?.data ?? null,
-        guiVersion,
-        setField,
-        saveField,
-        saveFields,
-        saveGuardedField,
-        saveNow,
-    };
+    return { config: loaded?.data ?? null, guiVersion, setField, saveField, saveFields, saveNow };
 };
 
 export const SettingsProvider = ({ children }: { children: ReactNode }) => {
-    const { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow } =
-        useSettingsState();
+    const { config, guiVersion, setField, saveField, saveFields, saveNow } = useSettingsState();
 
     const value = useMemo<SettingsContextValue | null>(
-        () =>
-            config
-                ? { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow }
-                : null,
-        [config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow],
+        () => (config ? { config, guiVersion, setField, saveField, saveFields, saveNow } : null),
+        [config, guiVersion, setField, saveField, saveFields, saveNow],
     );
 
     if (!value) {

client/ui/frontend/src/hooks/usePrivilege.ts

@@ -1,6 +1,6 @@
 import { useEffect, useState } from "react";
 import { Settings as SettingsSvc } from "@bindings/services";
-import { type Privilege } from "@bindings/services/models.js";
+import { Privilege } from "@bindings/services/models.js";
 
 // usePrivilege reports whether this UI process may perform the changes the daemon
 // restricts to root/administrator. It is answered in-process from our own token

client/ui/frontend/src/modules/settings/SettingsSSH.tsx

@@ -1,4 +1,3 @@
-import { type TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
 import { CopyToClipboard } from "@/components/CopyToClipboard";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
@@ -7,91 +6,51 @@ import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { cn } from "@/lib/cn";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
-import { type GuardedField, useSettings } from "@/contexts/SettingsContext.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
 import { usePrivilege } from "@/hooks/usePrivilege.ts";
-import type { Privilege } from "@bindings/services/models.js";
+import { Privilege } from "@bindings/services/models.js";
 import { type ChangeEvent, type ReactNode, useEffect, useId, useState } from "react";
 
 export function SettingsSSH() {
     const { t } = useTranslation();
-    const { config, setField, saveGuardedField } = useSettings();
+    const { config, setField } = useSettings();
     const privilege = usePrivilege();
-    // The field whose elevation prompt is currently up, if any. The prompt is
-    // modal to the operating system, not to us, so the guarded controls are held
-    // still meanwhile rather than allowed to stack a second one behind it.
-    const [authorizing, setAuthorizing] = useState<GuardedField | null>(null);
     const isSSHServerEnabled = config.serverSshAllowed;
 
-    const authorize = async (field: GuardedField, value: boolean) => {
-        setAuthorizing(field);
-        try {
-            await saveGuardedField(field, value);
-        } finally {
-            setAuthorizing(null);
-        }
-    };
-
     // The daemon restricts only the direction that hands out shells from a process
-    // running as root: for all three settings that is switching the field on.
-    //
-    // An unprivileged user gets that direction routed through the platform's
-    // elevation prompt where there is one to raise, and otherwise the old
-    // arrangement, where the control is either unavailable (it is off and only a
-    // privileged caller could turn it on) or a one-way switch (it is on, they may
-    // turn it off but not back on) with the command that does it.
+    // running as root. So for an unprivileged user a guarded control is either
+    // unavailable (it is off and only they could turn it on) or a one-way switch
+    // (it is on, they may turn it off, but not back on) — say which, either way.
     //
     // A null privilege means we could not determine it: leave the control alone
     // rather than greying it out with nothing to explain why. The daemon enforces
     // this regardless, and a rejected save reports its own guidance.
     const guarded = (
-        field: GuardedField,
+        guardedDirectionActive: boolean,
         command: (p: Privilege) => string,
         // inverted marks a control whose guarded direction is switching it off, so
         // the one-way warning has to read the other way round.
         inverted = false,
     ) => {
-        const plain = (value: boolean) => setField(field, value);
         if (!privilege || privilege.privileged) {
-            return { apply: plain, disabled: false, hint: undefined };
+            return { disabled: false, hint: undefined };
         }
-
-        const guardedDirectionActive = config[field];
-        const hint = (pending: boolean, command?: string) => (
-            <GuardedHint
-                actor={actorLabel(privilege, t)}
+        const hint = (
+            <PrivilegeHint
+                actor={privilege.actor}
+                command={command(privilege)}
                 oneWay={guardedDirectionActive}
                 inverted={inverted}
-                pending={pending}
-                command={command}
             />
         );
-
-        if (privilege.canElevate) {
-            return {
-                // Switching off is ours to do; only switching on is authorized.
-                apply: (value: boolean) => {
-                    if (!value) {
-                        plain(value);
-                        return;
-                    }
-                    void authorize(field, value);
-                },
-                disabled: authorizing !== null,
-                hint: hint(authorizing === field),
-            };
-        }
-        return {
-            apply: plain,
-            disabled: !guardedDirectionActive,
-            hint: hint(false, command(privilege)),
-        };
+        return { disabled: !guardedDirectionActive, hint };
     };
 
-    const sshServer = guarded("serverSshAllowed", (p) => p.allowSshServer);
-    const sshRoot = guarded("enableSshRoot", (p) => p.enableSshRoot);
+    const sshServer = guarded(config.serverSshAllowed, (p) => p.allowSshServer);
+    const sshRoot = guarded(config.enableSshRoot, (p) => p.enableSshRoot);
     // Inverted control: the guarded direction is switching authentication off, so
     // it is the already-disabled state that is the one-way one.
-    const sshAuth = guarded("disableSshAuth", (p) => p.disableSshAuth, true);
+    const sshAuth = guarded(config.disableSshAuth, (p) => p.disableSshAuth, true);
     const jwtTtlId = useId();
     const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));
 
@@ -125,7 +84,7 @@ export function SettingsSSH() {
             <SectionGroup title={t("settings.ssh.section.server")}>
                 <FancyToggleSwitch
                     value={config.serverSshAllowed}
-                    onChange={sshServer.apply}
+                    onChange={(v) => setField("serverSshAllowed", v)}
                     disabled={sshServer.disabled}
                     label={t("settings.ssh.server.label")}
                     helpText={t("settings.ssh.server.help")}
@@ -139,7 +98,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={config.enableSshRoot}
-                    onChange={sshRoot.apply}
+                    onChange={(v) => setField("enableSshRoot", v)}
                     disabled={sshRoot.disabled}
                     label={t("settings.ssh.root.label")}
                     helpText={t("settings.ssh.root.help")}
@@ -171,7 +130,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={!config.disableSshAuth}
-                    onChange={(v) => sshAuth.apply(!v)}
+                    onChange={(v) => setField("disableSshAuth", !v)}
                     disabled={sshAuth.disabled}
                     label={t("settings.ssh.jwt.label")}
                     helpText={t("settings.ssh.jwt.help")}
@@ -204,81 +163,41 @@ export function SettingsSSH() {
     );
 }
 
-// actorLabel names the principal the daemon requires, in the user's language. The
-// Go side reports which one it is rather than wording it, because "administrator
-// privileges" is English and a translated sentence cannot borrow it.
-function actorLabel(privilege: Privilege, t: TFunction): string {
-    return privilege.actorKey === "administrator"
-        ? t("settings.ssh.privilege.actorAdministrator")
-        : t("settings.ssh.privilege.actorRoot");
-}
-
-// GuardedHint is what a control the daemon guards says to an unprivileged user.
-// There are three things worth saying, and it says at most one:
-//
-//   - A prompt is open. Worth a line because it can take a few seconds to appear,
-//     long enough that a control which merely went inert would read as a hang.
-//   - The setting is in its guarded state already (oneWay), so the user may switch
-//     it back as they please and it is switching it away again that will ask. No
-//     command either way: the direction they can take is theirs to take.
-//   - Only a privileged caller can move it at all, and there is no prompt to
-//     raise: the command that does it belongs here, and nothing else will do.
-//
-// Which leaves the case of a control whose guarded direction is still ahead of the
-// user and a prompt that can be raised for it: nothing to say, because clicking it
-// raises the prompt and the prompt explains itself.
-function GuardedHint({
+// PrivilegeHint explains what an unprivileged user can and cannot do with a
+// guarded control, and offers the command that does it with the privileges the
+// daemon requires. oneWay covers the control being in the guarded state already:
+// switching it back is the part that needs privileges.
+function PrivilegeHint({
     actor,
+    command,
     oneWay,
     inverted,
-    pending,
-    command,
 }: {
     actor: string;
+    command: string;
     oneWay: boolean;
     inverted: boolean;
-    pending: boolean;
-    command?: string;
 }): ReactNode {
     const { t } = useTranslation();
-
-    if (pending) {
-        return <HintBox>{t("settings.ssh.privilege.authorizePending")}</HintBox>;
-    }
-    if (oneWay) {
-        return (
-            <HintBox>
-                <span>
-                    {inverted
-                        ? t("settings.ssh.privilege.oneWayInverted", { actor })
-                        : t("settings.ssh.privilege.oneWay", { actor })}
-                </span>
-            </HintBox>
-        );
-    }
     if (!command) return null;
-    return (
-        <HintBox>
-            <span>{t("settings.ssh.privilege.hint", { actor })}</span>
-            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
-                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
-                    {command}
-                </code>
-            </CopyToClipboard>
-        </HintBox>
-    );
-}
-
-// HintBox is the box a guarded control puts its explanation in, directly under the
-// control it belongs to.
-function HintBox({ children }: { children: ReactNode }): ReactNode {
     return (
         <div
             className={
                 "-mt-2 flex flex-col gap-1 rounded-md bg-nb-gray-930 px-3 py-2 text-xs text-nb-gray-300"
             }
         >
-            {children}
+            <span>
+                {!oneWay
+                    ? t("settings.ssh.privilege.hint", { actor })
+                    : inverted
+                      ? t("settings.ssh.privilege.oneWayInverted", { actor })
+                      : t("settings.ssh.privilege.oneWay", { actor })}
+            </span>
+            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
+                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
+                    {command}
+                </code>
+            </CopyToClipboard>
         </div>
     );
 }

client/ui/i18n/locales/de/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Alle sichtbaren Ressourcen umschalten"
     },
+    "settings.nav.label": {
+        "message": "Einstellungsbereiche"
+    },
     "profile.switch.title": {
         "message": "Zu Profil \"{name}\" wechseln?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Debug-Paket fehlgeschlagen"
     },
-    "settings.nav.label": {
-        "message": "Einstellungsbereiche"
-    },
     "settings.tabs.general": {
         "message": "Allgemein"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird konnte auf diesem System nicht die nötigen Rechte anfordern. Führen Sie stattdessen dies aus:"
-    },
-    "error.elevation_failed": {
-        "message": "Die Änderung konnte mit erhöhten Rechten nicht angewendet werden. Führen Sie stattdessen dies aus:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root-Rechte"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "Administratorrechte"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Sie können dies deaktivieren, zum erneuten Aktivieren sind {actor} erforderlich."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Sie können dies aktivieren, zum erneuten Deaktivieren sind {actor} erforderlich."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Warten auf Autorisierung…"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -1775,36 +1775,16 @@
         "message": "Operation failed.",
         "description": "Generic fallback error message used when no specific error applies."
     },
-    "error.elevation_unavailable": {
-        "message": "NetBird could not ask this system for the privileges the change needs. Run this instead:",
-        "description": "Error: this computer has no way to prompt for elevated privileges. Followed by a copyable command that applies the setting from a terminal."
-    },
-    "error.elevation_failed": {
-        "message": "The change could not be applied with elevated privileges. Run this instead:",
-        "description": "Error: the authorization succeeded but applying the setting afterwards failed. Followed by a copyable command that applies the setting from a terminal."
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root",
-        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Linux, macOS and BSD, where the daemon requires the root account. 'root' is an account name and stays as it is; add the word for privileges or rights around it if the sentence needs one to read naturally."
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "administrator privileges",
-        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Windows, where the daemon requires an elevated administrator. The Windows term for the rights an account is asked to elevate to."
-    },
     "settings.ssh.privilege.hint": {
         "message": "Requires {actor}. Run this instead:",
         "description": "Help text under an SSH setting the user cannot change: it needs elevated privileges. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     },
     "settings.ssh.privilege.oneWay": {
-        "message": "You can switch this off, but switching it back on needs {actor}.",
-        "description": "Help text under an SSH setting that is already on: an unprivileged user may switch it off freely, and switching it on again is what needs the privileges. No command follows, since the direction they can take is theirs to take. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows."
+        "message": "You can switch this off, but switching it back on needs {actor}:",
+        "description": "Warning under an SSH setting an unprivileged user may disable but not re-enable. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     },
     "settings.ssh.privilege.oneWayInverted": {
-        "message": "You can switch this on, but switching it back off needs {actor}.",
-        "description": "Same as settings.ssh.privilege.oneWay, for the SSH authentication setting once it has been switched off: switching it off again is what needs the privileges."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Waiting for authorization…",
-        "description": "Replaces the help text under a guarded SSH setting while the authorization prompt is open, which can take a few seconds to appear. Keep the trailing ellipsis."
+        "message": "You can switch this on, but switching it back off needs {actor}:",
+        "description": "Warning under the SSH authentication setting, which an unprivileged user may re-enable but not disable again. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     }
 }

client/ui/i18n/locales/es/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Conmutar todos los recursos visibles"
     },
+    "settings.nav.label": {
+        "message": "Secciones de configuración"
+    },
     "profile.switch.title": {
         "message": "¿Cambiar el perfil a «{name}»?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Error en el paquete de diagnóstico"
     },
-    "settings.nav.label": {
-        "message": "Secciones de configuración"
-    },
     "settings.tabs.general": {
         "message": "General"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "La operación falló."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird no pudo solicitar a este sistema los privilegios necesarios. Ejecute esto en su lugar:"
-    },
-    "error.elevation_failed": {
-        "message": "No se pudo aplicar el cambio con privilegios elevados. Ejecute esto en su lugar:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "privilegios de root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "privilegios de administrador"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requiere {actor}. Ejecute esto en su lugar:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Esperando la autorización…"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Activer/désactiver toutes les ressources visibles"
     },
+    "settings.nav.label": {
+        "message": "Sections des paramètres"
+    },
     "profile.switch.title": {
         "message": "Basculer vers le profil « {name} » ?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Échec du lot de diagnostic"
     },
-    "settings.nav.label": {
-        "message": "Sections des paramètres"
-    },
     "settings.tabs.general": {
         "message": "Général"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird n’a pas pu demander à ce système les privilèges nécessaires. Exécutez plutôt ceci :"
-    },
-    "error.elevation_failed": {
-        "message": "La modification n’a pas pu être appliquée avec des privilèges élevés. Exécutez plutôt ceci :"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "les privilèges root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "les privilèges administrateur"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "En attente de l’autorisation…"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Összes látható erőforrás be/ki"
     },
+    "settings.nav.label": {
+        "message": "Beállítások szakaszai"
+    },
     "profile.switch.title": {
         "message": "Váltás a(z) \"{name}\" profilra?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Hibakeresési csomag sikertelen"
     },
-    "settings.nav.label": {
-        "message": "Beállítások szakaszai"
-    },
     "settings.tabs.general": {
         "message": "Általános"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
-    },
-    "error.elevation_unavailable": {
-        "message": "A NetBird nem tudta bekérni a rendszertől a szükséges jogosultságokat. Futtassa inkább ezt:"
-    },
-    "error.elevation_failed": {
-        "message": "A módosítást emelt szintű jogosultságokkal sem sikerült alkalmazni. Futtassa inkább ezt:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root jogosultság"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "rendszergazdai jogosultság"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Várakozás az engedélyezésre…"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Attiva/disattiva tutte le risorse visibili"
     },
+    "settings.nav.label": {
+        "message": "Sezioni delle impostazioni"
+    },
     "profile.switch.title": {
         "message": "Passare al profilo «{name}»?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Pacchetto di debug non riuscito"
     },
-    "settings.nav.label": {
-        "message": "Sezioni delle impostazioni"
-    },
     "settings.tabs.general": {
         "message": "Generale"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird non ha potuto richiedere a questo sistema i privilegi necessari. Esegua invece questo:"
-    },
-    "error.elevation_failed": {
-        "message": "Non è stato possibile applicare la modifica con privilegi elevati. Esegua invece questo:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "i privilegi di root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "i privilegi di amministratore"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Richiede {actor}. Esegua invece questo:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "In attesa dell'autorizzazione…"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -1304,9 +1304,6 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
-    "daemon.outdated.download": {
-        "message": "最新版をダウンロード"
-    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },
@@ -1330,29 +1327,5 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird はこのシステムに必要な権限を要求できませんでした。代わりに次のコマンドを実行してください:"
-    },
-    "error.elevation_failed": {
-        "message": "昇格した権限でも変更を適用できませんでした。代わりに次のコマンドを実行してください:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root 権限"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "管理者権限"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "無効にはできますが、再度有効にするには{actor}が必要です。"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "有効にはできますが、再度無効にするには{actor}が必要です。"
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "承認を待っています…"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Alternar todos os recursos visíveis"
     },
+    "settings.nav.label": {
+        "message": "Seções das configurações"
+    },
     "profile.switch.title": {
         "message": "Alternar perfil para \"{name}\"?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Falha no pacote de depuração"
     },
-    "settings.nav.label": {
-        "message": "Seções das configurações"
-    },
     "settings.tabs.general": {
         "message": "Geral"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
-    },
-    "error.elevation_unavailable": {
-        "message": "O NetBird não conseguiu solicitar a este sistema os privilégios necessários. Execute isto em vez disso:"
-    },
-    "error.elevation_failed": {
-        "message": "Não foi possível aplicar a alteração com privilégios elevados. Execute isto em vez disso:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "privilégios de root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "privilégios de administrador"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requer {actor}. Execute isto em vez disso:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Você pode desativar isto, mas ativar novamente requer {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Você pode ativar isto, mas desativar novamente requer {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Aguardando a autorização…"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "Переключить все видимые ресурсы"
     },
+    "settings.nav.label": {
+        "message": "Разделы настроек"
+    },
     "profile.switch.title": {
         "message": "Переключиться на профиль «{name}»?"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Не удалось создать отладочный пакет"
     },
-    "settings.nav.label": {
-        "message": "Разделы настроек"
-    },
     "settings.tabs.general": {
         "message": "Общие"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird не смог запросить у этой системы нужные права. Выполните вместо этого:"
-    },
-    "error.elevation_failed": {
-        "message": "Не удалось применить изменение с повышенными правами. Выполните вместо этого:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "права root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "права администратора"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Требуются {actor}. Выполните вместо этого:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Отключить можно, но чтобы включить снова, нужны {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Включить можно, но чтобы отключить снова, нужны {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Ожидание авторизации…"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -401,6 +401,9 @@
     "networks.bulk.label": {
         "message": "切换所有可见资源"
     },
+    "settings.nav.label": {
+        "message": "设置部分"
+    },
     "profile.switch.title": {
         "message": "切换到配置文件“{name}”？"
     },
@@ -494,9 +497,6 @@
     "settings.error.debugBundleTitle": {
         "message": "创建调试包失败"
     },
-    "settings.nav.label": {
-        "message": "设置部分"
-    },
     "settings.tabs.general": {
         "message": "常规"
     },
@@ -1330,29 +1330,5 @@
     },
     "error.unknown": {
         "message": "操作失败。"
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird 无法向此系统请求所需的权限。请改为运行："
-    },
-    "error.elevation_failed": {
-        "message": "即使使用提升的权限也无法应用此更改。请改为运行："
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root 权限"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "管理员权限"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "需要{actor}。请改为运行："
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "您可以关闭此项，但重新开启需要{actor}。"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "您可以开启此项，但再次关闭需要{actor}。"
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "正在等待授权…"
     }
 }

client/ui/main.go

@@ -8,7 +8,6 @@ import (
 	"flag"
 	"io/fs"
 	"log"
-	"os"
 	"runtime"
 	"strings"
 
@@ -80,14 +79,6 @@ func init() {
 }
 
 func main() {
-	// The one-shot that applies the settings the daemon restricts to
-	// root/administrator, which this binary runs itself as under the platform's
-	// elevation prompt. Handled before anything GUI so no window, tray or
-	// single-instance lock is involved.
-	if services.IsPrivilegedSettingsRun(os.Args[1:]) {
-		os.Exit(runPrivilegedSettings(os.Args[1:]))
-	}
-
 	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
 	conn := NewConn(daemonAddr)
 

client/ui/privileged_settings.go

@@ -1,27 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// The one-shot mode this binary runs itself in, elevated, to apply the settings the
-// daemon restricts to root/administrator. It is handled before anything GUI, so no
-// window, tray or single-instance lock is involved.
-//
-// Only the wiring is here: what the mode accepts and does lives beside the code
-// that asks for it, in services.RunPrivilegedSettings, so the settings it will
-// apply are declared once. There is nothing privileged about the mode itself; it
-// sends the same request the frontend would have sent, and the daemon authorizes it
-// from the identity the kernel reports on the control channel exactly as it does
-// for `sudo netbird up`.
-func runPrivilegedSettings(args []string) int {
-	return services.RunPrivilegedSettings(args, func(addr string) (proto.DaemonServiceClient, error) {
-		if addr == "" {
-			addr = DaemonAddr()
-		}
-		return NewConn(addr).Client()
-	})
-}

client/ui/services/guarded.go

@@ -1,231 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-)
-
-// The command line of the one-shot mode this binary runs itself in, elevated, to
-// apply a setting the daemon restricts to root/administrator. The setting flags
-// spell the same words as `netbird up`, so the command a user is shown and what
-// runs behind the prompt read alike. Parsed in oneshot.go.
-const (
-	FlagApplyPrivilegedSettings = "apply-privileged-settings"
-	FlagDaemonAddr              = "daemon-addr"
-	FlagProfile                 = "profile"
-	FlagUser                    = "user"
-	FlagLogLevel                = "log-level"
-	FlagManagementURL           = "management-url"
-	FlagAllowServerSSH          = "allow-server-ssh"
-	FlagEnableSSHRoot           = "enable-ssh-root"
-	FlagDisableSSHAuth          = "disable-ssh-auth"
-)
-
-// Error codes for the ways asking for privileges can fail.
-const (
-	CodeElevationUnavailable = "elevation_unavailable"
-	CodeElevationFailed      = "elevation_failed"
-)
-
-// elevationTimeout bounds the wait for a prompt and the change behind it, so a
-// dialog nobody answers does not leave its control disabled for the session. Long
-// enough to find a password manager, and no shorter than the platforms' own prompt
-// timeouts: Windows gives up on its consent dialog after two minutes by itself.
-//
-// It always ends our waiting, and not always the prompt: Security.framework offers
-// no way to withdraw a request, so on macOS the system's own timeout is what closes
-// the dialog.
-const elevationTimeout = 5 * time.Minute
-
-// elevator raises the platform's privilege prompt and runs the change behind it.
-// An interface so tests can answer without a prompt.
-type elevator interface {
-	// Run runs this binary again, elevated, with the given arguments.
-	Run(ctx context.Context, args ...string) error
-	// Available reports whether there is a prompt to raise on this host at all.
-	Available() bool
-}
-
-// osElevator is the real thing: see the elevate package.
-type osElevator struct{}
-
-func (osElevator) Run(ctx context.Context, args ...string) error {
-	return elevate.Run(ctx, args...)
-}
-
-func (osElevator) Available() bool {
-	return elevate.Available()
-}
-
-// SaveOutcome reports what became of a change that needed authorization.
-//
-// A declined prompt is a result, not an error: the user was asked and said no, so
-// nothing was applied and nothing went wrong. Reporting it as an error would have
-// every cancelled prompt logged as one.
-type SaveOutcome struct {
-	// Declined is set when the user dismissed the authorization prompt, or was
-	// refused by policy. Nothing was changed.
-	Declined bool `json:"declined"`
-}
-
-// GuardedSettings is the subset of the config the daemon restricts to
-// root/administrator. Only the fields that are set are changed: a nil pointer, or
-// an empty management URL, leaves that setting alone.
-//
-// The management URL is in here because pointing a host with the SSH server
-// running at another management identity hands the decision of who may open a
-// shell on it to whoever runs that server, which is the same power as enabling
-// the SSH server in the first place.
-type GuardedSettings struct {
-	ProfileName      string `json:"profileName"`
-	Username         string `json:"username"`
-	ManagementURL    string `json:"managementUrl,omitempty"`
-	ServerSSHAllowed *bool  `json:"serverSshAllowed,omitempty"`
-	EnableSSHRoot    *bool  `json:"enableSshRoot,omitempty"`
-	DisableSSHAuth   *bool  `json:"disableSshAuth,omitempty"`
-}
-
-// guardedSetting is one setting to change, in the two spellings this needs: the
-// one-shot's own flag, and the `netbird up` flag that does the same thing from a
-// terminal, for when there is no prompt to raise.
-type guardedSetting struct {
-	arg  string
-	flag string
-}
-
-// SetGuardedSettings applies settings the daemon refuses from an unprivileged
-// caller, by having the operating system run this binary again, elevated, to send
-// the same request the frontend would have sent itself.
-//
-// The user authorizes it at the platform's own prompt: the UAC consent dialog,
-// the macOS authentication dialog, or the polkit agent's. Any credentials are the
-// operating system's business; NetBird neither sees nor asks for them. Nothing
-// about the daemon's rules changes, and the elevated process is authorized like
-// any other privileged caller, from the identity the kernel reports for it.
-//
-// A declined prompt comes back as SaveOutcome.Declined with no error. When there is
-// no prompt to raise, or the elevated run failed, the error carries the command
-// that does the same thing from a terminal.
-func (s *Settings) SetGuardedSettings(ctx context.Context, p GuardedSettings) (SaveOutcome, error) {
-	settings := guardedSettings(p)
-	if len(settings) == 0 {
-		return SaveOutcome{}, &ClientError{
-			Code:  CodeElevationFailed,
-			Short: "no setting to apply",
-			Long:  "no setting to apply",
-		}
-	}
-
-	// The elevated run has no window and, on Linux, an environment pkexec has
-	// cleared, so what it writes to stderr is all there is to go on. It follows
-	// this process's level so that starting the app with --log-level debug says
-	// something about the run behind the prompt too.
-	args := append([]string{
-		"--" + FlagApplyPrivilegedSettings,
-		"--" + FlagDaemonAddr, s.daemonAddr,
-		"--" + FlagProfile, p.ProfileName,
-		"--" + FlagUser, p.Username,
-		"--" + FlagLogLevel, log.GetLevel().String(),
-	}, oneShotArgs(settings)...)
-
-	ctx, cancel := context.WithTimeout(ctx, elevationTimeout)
-	defer cancel()
-
-	// These changes hand out shells on this host, so both ends are logged: when the
-	// prompt went up, and what came of it. It is also the only account of a prompt
-	// that was slow to appear or never answered.
-	log.Infof("asking for privileges to apply %s", guardedSummary(p))
-
-	if err := s.elevator.Run(ctx, args...); err != nil {
-		return s.elevationOutcome(err, p)
-	}
-
-	log.Infof("applied %s with the privileges the user authorized", guardedSummary(p))
-	return SaveOutcome{}, nil
-}
-
-// elevationOutcome sorts what came back into the one normal ending and the two
-// that need reporting, with the command that does the same thing by hand.
-func (s *Settings) elevationOutcome(err error, p GuardedSettings) (SaveOutcome, error) {
-	switch {
-	case errors.Is(err, elevate.ErrDeclined):
-		// With the reason: an account that may not elevate at all lands here too,
-		// and the log is the only place that says which it was.
-		log.Infof("the elevation prompt for %s was declined: %v", guardedSummary(p), err)
-		return SaveOutcome{Declined: true}, nil
-	case errors.Is(err, elevate.ErrUnavailable):
-		log.Warnf("cannot ask for privileges to apply %s: %v", guardedSummary(p), err)
-		return SaveOutcome{}, &ClientError{
-			Code:    CodeElevationUnavailable,
-			Short:   s.classifier.translateShort(CodeElevationUnavailable),
-			Long:    err.Error(),
-			Command: guardedCommand(p),
-		}
-	default:
-		log.Errorf("applying %s with elevated privileges failed: %v", guardedSummary(p), err)
-		return SaveOutcome{}, &ClientError{
-			Code:    CodeElevationFailed,
-			Short:   s.classifier.translateShort(CodeElevationFailed),
-			Long:    err.Error(),
-			Command: guardedCommand(p),
-		}
-	}
-}
-
-// guardedSettings renders the settings that are actually being changed, from the
-// same table the one-shot parses them with: see oneshot.go.
-func guardedSettings(p GuardedSettings) []guardedSetting {
-	var settings []guardedSetting
-	for _, field := range guardedFields {
-		value, ok := field.read(p)
-		if !ok {
-			continue
-		}
-		settings = append(settings, guardedSetting{
-			arg:  "--" + field.flag + "=" + value,
-			flag: field.up(value),
-		})
-	}
-	return settings
-}
-
-func oneShotArgs(settings []guardedSetting) []string {
-	args := make([]string, 0, len(settings))
-	for _, setting := range settings {
-		args = append(args, setting.arg)
-	}
-	return args
-}
-
-func upFlags(settings []guardedSetting) []string {
-	flags := make([]string, 0, len(settings))
-	for _, setting := range settings {
-		flags = append(flags, setting.flag)
-	}
-	return flags
-}
-
-// guardedCommand is the elevated command line equivalent to the requested
-// change, the same shape the daemon names in its own refusals.
-func guardedCommand(p GuardedSettings) string {
-	settings := guardedSettings(p)
-	if len(settings) == 0 {
-		return ""
-	}
-	return ipcauth.UpCommand(strings.Join(upFlags(settings), " "))
-}
-
-// guardedSummary names the change for the log.
-func guardedSummary(p GuardedSettings) string {
-	return fmt.Sprintf("%v for profile %q", oneShotArgs(guardedSettings(p)), p.ProfileName)
-}

client/ui/services/guarded_test.go

@@ -1,355 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/genproto/googleapis/rpc/errdetails"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A Unix socket, so the daemon address is one that carries a caller's identity and
-// elevation is worth offering at all: see Settings.canElevate.
-const testDaemonAddr = "unix:///var/run/netbird.sock"
-
-// storedManagementURL is what the stub daemon already holds, so that a request
-// naming a different one is a change: see Settings.guardedChanges.
-const storedManagementURL = "https://stored.example.com"
-
-// stubElevator stands in for the platform's prompt: it records what would have run
-// and answers with a fixed outcome.
-type stubElevator struct {
-	outcome   error
-	available bool
-	calls     [][]string
-}
-
-func (e *stubElevator) Run(_ context.Context, args ...string) error {
-	e.calls = append(e.calls, args)
-	return e.outcome
-}
-
-func (e *stubElevator) Available() bool { return e.available }
-
-// stubDaemon implements only the RPCs under test. The embedded interface is nil, so
-// any other call panics rather than passing quietly.
-type stubDaemon struct {
-	proto.DaemonServiceClient
-	setConfig func(*proto.SetConfigRequest) error
-	// stored is what GetConfig reports, which is what a refused request's guarded
-	// settings are compared against.
-	stored   *proto.GetConfigResponse
-	requests []*proto.SetConfigRequest
-}
-
-func (d *stubDaemon) SetConfig(_ context.Context, in *proto.SetConfigRequest, _ ...grpc.CallOption) (*proto.SetConfigResponse, error) {
-	d.requests = append(d.requests, in)
-	if err := d.setConfig(in); err != nil {
-		return nil, err
-	}
-	return &proto.SetConfigResponse{}, nil
-}
-
-func (d *stubDaemon) GetConfig(_ context.Context, _ *proto.GetConfigRequest, _ ...grpc.CallOption) (*proto.GetConfigResponse, error) {
-	return d.stored, nil
-}
-
-type stubConn struct{ client proto.DaemonServiceClient }
-
-func (c stubConn) Client() (proto.DaemonServiceClient, error) { return c.client, nil }
-
-// privilegeRefusal is the error the daemon raises for a change it restricts to
-// root, detail and all: see server.privilegeError.
-func privilegeRefusal(t *testing.T) error {
-	t.Helper()
-
-	st, err := gstatus.New(codes.PermissionDenied, "Changing the management URL requires root.").
-		WithDetails(&errdetails.ErrorInfo{
-			Reason: ipcauth.ErrorReasonPrivilegeRequired,
-			Domain: ipcauth.ErrorDomain,
-			Metadata: map[string]string{
-				ipcauth.ErrorMetaSummary: "Changing the management URL requires root.",
-				ipcauth.ErrorMetaCommand: "sudo netbird down; sudo netbird up -m https://mgmt.example.com",
-			},
-		})
-	require.NoError(t, err, "build the refusal detail")
-	return st.Err()
-}
-
-func settingsWithElevation(t *testing.T, outcome error) (*Settings, *stubElevator) {
-	t.Helper()
-
-	elev := &stubElevator{outcome: outcome, available: true}
-	return &Settings{daemonAddr: testDaemonAddr, elevator: elev}, elev
-}
-
-// settingsRefusingOnce returns a Settings whose daemon refuses the first SetConfig
-// for want of privileges and accepts anything after it. Its stored config holds
-// another management server and no SSH grants, so a request naming either is a
-// change rather than a restatement.
-func settingsRefusingOnce(t *testing.T, elev *stubElevator) (*Settings, *stubDaemon) {
-	t.Helper()
-
-	refusal := privilegeRefusal(t)
-	daemon := &stubDaemon{stored: &proto.GetConfigResponse{ManagementUrl: storedManagementURL}}
-	daemon.setConfig = func(*proto.SetConfigRequest) error {
-		if len(daemon.requests) == 1 {
-			return refusal
-		}
-		return nil
-	}
-	return &Settings{conn: stubConn{client: daemon}, daemonAddr: testDaemonAddr, elevator: elev}, daemon
-}
-
-func TestSetGuardedSettingsPassesOnlyTheChangedSettings(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	root := true
-	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "work",
-		Username:      "vma",
-		EnableSSHRoot: &root,
-	})
-	require.NoError(t, err)
-	assert.False(t, outcome.Declined, "the prompt was answered")
-
-	want := []string{
-		"--" + FlagApplyPrivilegedSettings,
-		"--" + FlagDaemonAddr, testDaemonAddr,
-		"--" + FlagProfile, "work",
-		"--" + FlagUser, "vma",
-		"--" + FlagLogLevel, log.GetLevel().String(),
-		"--" + FlagEnableSSHRoot + "=true",
-	}
-	require.Len(t, elev.calls, 1, "one prompt for one change")
-	assert.Equal(t, want, elev.calls[0], "elevated arguments")
-
-	// argv[1] is what the polkit action is pinned to, so the marker has to stay
-	// first however the rest of the line grows.
-	assert.Equal(t, "--"+FlagApplyPrivilegedSettings, elev.calls[0][0], "the flag polkit matches on")
-}
-
-// Turning a setting off has to be as explicit as turning it on: a bare flag would
-// read as "on" to the one-shot's parser.
-func TestSetGuardedSettingsSpellsOutFalse(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	off := false
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:      "default",
-		ServerSSHAllowed: &off,
-		DisableSSHAuth:   &off,
-	})
-	require.NoError(t, err)
-
-	args := elev.calls[0]
-	assert.Contains(t, args, "--"+FlagAllowServerSSH+"=false", "the setting being switched off")
-	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=false", "the setting being switched off")
-	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "no flag for a setting nobody touched")
-}
-
-func TestSetGuardedSettingsPassesTheManagementURL(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com:33073",
-	})
-	require.NoError(t, err)
-
-	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com:33073",
-		"the management URL to point the profile at")
-}
-
-func TestSetGuardedSettingsWithoutASettingDoesNotElevate(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{ProfileName: "default"})
-
-	require.Error(t, err, "nothing to apply is not something to prompt for")
-	assert.Empty(t, elev.calls, "no prompt at all")
-}
-
-// A declined prompt is the one ending that is not an error: reporting it as one
-// would have every cancelled prompt logged as a failure.
-func TestSetGuardedSettingsReportsADeclinedPromptAsAnOutcome(t *testing.T) {
-	s, _ := settingsWithElevation(t, elevate.ErrDeclined)
-
-	root := true
-	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "default",
-		EnableSSHRoot: &root,
-	})
-
-	require.NoError(t, err, "the user was asked and answered; nothing went wrong")
-	assert.True(t, outcome.Declined, "nothing was applied")
-}
-
-func TestSetGuardedSettingsMapsFailures(t *testing.T) {
-	tests := []struct {
-		name     string
-		outcome  error
-		wantCode string
-	}{
-		{
-			// Nothing to raise a prompt with: the user needs the command.
-			name:     "no mechanism falls back to the command",
-			outcome:  elevate.ErrUnavailable,
-			wantCode: CodeElevationUnavailable,
-		},
-		{
-			name:     "a failed run falls back to the command",
-			outcome:  errors.New("elevated netbird exited with 1"),
-			wantCode: CodeElevationFailed,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			s, _ := settingsWithElevation(t, tt.outcome)
-
-			root := true
-			_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-				ProfileName:   "default",
-				EnableSSHRoot: &root,
-			})
-
-			var clientErr *ClientError
-			require.ErrorAs(t, err, &clientErr, "the frontend needs a code to act on")
-			assert.Equal(t, tt.wantCode, clientErr.Code, "error code")
-			assert.Contains(t, clientErr.Command, "--"+FlagEnableSSHRoot+"=true",
-				"the setting in the fallback command")
-			assert.Contains(t, clientErr.Command, "netbird up", "the fallback command")
-		})
-	}
-}
-
-// Changing the management URL is only privileged while the host runs the SSH
-// server, which no control can know up front, so the refusal is what triggers the
-// prompt. The original request goes again afterwards, so the fields the one-shot
-// does not understand are applied too.
-func TestSetConfigElevatesAfterARefusalAndRetries(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, daemon := settingsRefusingOnce(t, elev)
-
-	mtu := int64(1280)
-	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-		MTU:           &mtu,
-	})
-	require.NoError(t, err)
-	assert.False(t, outcome.Declined, "the prompt was answered")
-
-	require.Len(t, elev.calls, 1, "one prompt")
-	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com",
-		"the guarded part of the request")
-	require.Len(t, daemon.requests, 2, "the refused request and the retry")
-	assert.Equal(t, mtu, daemon.requests[1].GetMtu(),
-		"the retry carries the rest of the request, which the one-shot does not understand")
-}
-
-func TestSetConfigDoesNotRetryWhenTheUserDeclines(t *testing.T) {
-	elev := &stubElevator{outcome: elevate.ErrDeclined, available: true}
-	s, daemon := settingsRefusingOnce(t, elev)
-
-	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-	})
-
-	require.NoError(t, err, "a declined prompt is not an error")
-	assert.True(t, outcome.Declined, "nothing was applied")
-	assert.Len(t, daemon.requests, 1, "only the refused request")
-}
-
-// With no prompt to raise, the refusal is reported as the daemon wrote it, which is
-// the guidance that was there before elevation existed.
-func TestSetConfigReportsTheRefusalWhenItCannotElevate(t *testing.T) {
-	elev := &stubElevator{available: false}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-	})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Contains(t, clientErr.Command, "netbird up -m https://mgmt.example.com",
-		"the daemon's own command")
-	assert.Empty(t, elev.calls, "no prompt where there is none to raise")
-}
-
-// One authorization must buy only the change the user made. A settings form
-// submits every field it holds, so most of a refused request restates what the
-// daemon already has, and elevating those too would apply a guarded setting the
-// user never touched — a value gone stale since the form loaded above all.
-func TestSetConfigElevatesOnlyTheGuardedSettingsThatChange(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	on, off := true, false
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:      "default",
-		ManagementURL:    storedManagementURL,
-		ServerSSHAllowed: &off,
-		EnableSSHRoot:    &off,
-		DisableSSHAuth:   &on,
-	})
-	require.NoError(t, err)
-
-	require.Len(t, elev.calls, 1, "one prompt")
-	args := elev.calls[0]
-	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=true", "the setting that changes")
-	assert.NotContains(t, args, "--"+FlagManagementURL+"="+storedManagementURL,
-		"a management URL the daemon already holds")
-	assert.NotContains(t, args, "--"+FlagAllowServerSSH+"=false", "a setting already off")
-	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "a setting already off")
-}
-
-// A request that changes no guarded setting has nothing an elevated run could
-// apply, so the refusal must have come from somewhere a prompt cannot reach.
-func TestSetConfigDoesNotElevateWhenNoGuardedSettingChanges(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	off := false
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:      "default",
-		ManagementURL:    storedManagementURL,
-		ServerSSHAllowed: &off,
-	})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Empty(t, elev.calls, "no prompt for a change nobody made")
-}
-
-// A refusal with nothing in the request the one-shot could apply: the daemon
-// cannot see who is calling, and being root would not help either.
-func TestSetConfigReportsARefusalWithNothingToElevate(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	_, err := s.SetConfig(context.Background(), SetConfigParams{ProfileName: "default"})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Empty(t, elev.calls, "no prompt")
-}

client/ui/services/oneshot.go

@@ -1,239 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/util"
-)
-
-// The other end of SetGuardedSettings: the mode this binary runs itself in,
-// elevated, to apply the settings the daemon restricts to root/administrator.
-//
-// Both ends are here on purpose. What may be changed this way is an allowlist, and
-// an allowlist declared twice is one that will eventually disagree with itself, so
-// the arguments are rendered and parsed from a single table: guardedFields. Adding
-// a setting is one row; nothing generic passes through, and no field outside the
-// table can be reached with an elevated request no matter what lands on the command
-// line.
-
-// oneShotTimeout bounds the whole one-shot: connect, one RPC, exit. Generous
-// because the user has just waited for an authentication dialog, and a failure here
-// costs them the entire round trip.
-const oneShotTimeout = 30 * time.Second
-
-// Exit codes the parent reads where the platform gives it one.
-const (
-	exitOK      = 0
-	exitFailure = 1
-	exitUsage   = 2
-)
-
-// guardedField is one setting the one-shot understands, in the two spellings it
-// needs and with the two halves of its plumbing.
-type guardedField struct {
-	// flag names it on the one-shot's command line.
-	flag  string
-	usage string
-	// read returns the value to send and whether the caller asked for this setting
-	// at all.
-	read func(GuardedSettings) (string, bool)
-	// write parses a value from the command line onto the request. It is the only
-	// thing that validates the value, so it fails on anything it does not
-	// recognise rather than guessing.
-	write func(*proto.SetConfigRequest, string) error
-	// up renders the equivalent `netbird up` flag, for the fallback command shown
-	// when there is no prompt to raise.
-	up func(value string) string
-}
-
-var guardedFields = []guardedField{
-	{
-		flag:  FlagManagementURL,
-		usage: "Management server the profile registers with.",
-		read:  func(p GuardedSettings) (string, bool) { return p.ManagementURL, p.ManagementURL != "" },
-		write: func(req *proto.SetConfigRequest, value string) error {
-			// Parsed with the config layer's own parser, so what the elevated run
-			// accepts cannot drift from what the daemon would store.
-			if _, err := profilemanager.ParseServiceURL("Management URL", value); err != nil {
-				return err
-			}
-			req.ManagementUrl = value
-			return nil
-		},
-		// The daemon names this one as `-m <url>` in its own refusals.
-		up: func(value string) string { return "-m " + value },
-	},
-	boolField(FlagAllowServerSSH, "Run the NetBird SSH server.",
-		func(p GuardedSettings) *bool { return p.ServerSSHAllowed },
-		func(req *proto.SetConfigRequest, v *bool) { req.ServerSSHAllowed = v }),
-	boolField(FlagEnableSSHRoot, "Allow SSH sessions to privileged accounts.",
-		func(p GuardedSettings) *bool { return p.EnableSSHRoot },
-		func(req *proto.SetConfigRequest, v *bool) { req.EnableSSHRoot = v }),
-	boolField(FlagDisableSSHAuth, "Accept SSH sessions without authentication.",
-		func(p GuardedSettings) *bool { return p.DisableSSHAuth },
-		func(req *proto.SetConfigRequest, v *bool) { req.DisableSSHAuth = v }),
-}
-
-// fieldValue is a flag that remembers whether it was given, and requires a value:
-// the renderer always writes one, so a bare flag is a caller that got it wrong.
-type fieldValue struct {
-	set   bool
-	value string
-}
-
-func (v *fieldValue) String() string {
-	if v == nil {
-		return ""
-	}
-	return v.value
-}
-
-func (v *fieldValue) Set(value string) error {
-	v.set, v.value = true, value
-	return nil
-}
-
-// boolField describes a setting that is on or off. The value is always spelled out,
-// so that turning a setting off is as unambiguous as turning it on and a flag with
-// no value is a mistake rather than an "on".
-func boolField(
-	name, usage string,
-	read func(GuardedSettings) *bool,
-	write func(*proto.SetConfigRequest, *bool),
-) guardedField {
-	return guardedField{
-		flag:  name,
-		usage: usage,
-		read: func(p GuardedSettings) (string, bool) {
-			value := read(p)
-			if value == nil {
-				return "", false
-			}
-			return strconv.FormatBool(*value), true
-		},
-		write: func(req *proto.SetConfigRequest, value string) error {
-			parsed, err := strconv.ParseBool(value)
-			if err != nil {
-				return fmt.Errorf("parse %q as a boolean: %w", value, err)
-			}
-			write(req, &parsed)
-			return nil
-		},
-		up: func(value string) string { return "--" + name + "=" + value },
-	}
-}
-
-// IsPrivilegedSettingsRun reports whether this process was started as the one-shot.
-// The flag is a marker rather than a value, so only the bare forms count: reading a
-// value would mean "--flag=false" started it too.
-func IsPrivilegedSettingsRun(args []string) bool {
-	for _, arg := range args {
-		if arg == "--"+FlagApplyPrivilegedSettings || arg == "-"+FlagApplyPrivilegedSettings {
-			return true
-		}
-	}
-	return false
-}
-
-// RunPrivilegedSettings applies the requested settings and returns the process exit
-// code. connect dials the daemon, which is the caller's business because only it
-// knows how this build talks to it.
-//
-// Everything it reports goes to stderr, which is what the parent captures where the
-// platform lets it. On success it says so on standard output, because macOS gives
-// the parent no exit status to read: see elevate.AppliedMarker.
-func RunPrivilegedSettings(args []string, connect func(addr string) (proto.DaemonServiceClient, error)) int {
-	fs := flag.NewFlagSet("netbird-ui --"+FlagApplyPrivilegedSettings, flag.ContinueOnError)
-	fs.Bool(FlagApplyPrivilegedSettings, false, "Apply the settings the daemon restricts to root/administrator and exit.")
-	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port")
-	logLevel := fs.String(FlagLogLevel, "info", "Log level: trace|debug|info|warn|error.")
-	profile := fs.String(FlagProfile, "", "Profile to change.")
-	username := fs.String(FlagUser, "", "Owner of the profile.")
-
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		fs.Var(&values[i], field.flag, field.usage)
-	}
-
-	if err := fs.Parse(args); err != nil {
-		return exitUsage
-	}
-
-	if err := util.InitLog(*logLevel, "console"); err != nil {
-		fmt.Fprintf(os.Stderr, "init log: %v\n", err)
-		return exitFailure
-	}
-
-	req, err := privilegedRequest(*profile, *username, values)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%v\n", err)
-		return exitUsage
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), oneShotTimeout)
-	defer cancel()
-
-	if err := applyPrivilegedSettings(ctx, *daemonAddr, req, connect); err != nil {
-		fmt.Fprintf(os.Stderr, "apply settings: %v\n", err)
-		return exitFailure
-	}
-
-	fmt.Fprintln(os.Stdout, elevate.AppliedMarker)
-	return exitOK
-}
-
-// privilegedRequest builds the request from the flags that were given, and refuses
-// one that asks for nothing.
-func privilegedRequest(profile, username string, values []fieldValue) (*proto.SetConfigRequest, error) {
-	req := &proto.SetConfigRequest{ProfileName: profile, Username: username}
-
-	given := 0
-	for i, field := range guardedFields {
-		if !values[i].set {
-			continue
-		}
-		if err := field.write(req, values[i].value); err != nil {
-			return nil, fmt.Errorf("--%s: %w", field.flag, err)
-		}
-		given++
-	}
-	if given == 0 {
-		return nil, errors.New("no setting to apply")
-	}
-	return req, nil
-}
-
-func applyPrivilegedSettings(
-	ctx context.Context,
-	daemonAddr string,
-	req *proto.SetConfigRequest,
-	connect func(addr string) (proto.DaemonServiceClient, error),
-) error {
-	client, err := connect(daemonAddr)
-	if err != nil {
-		return err
-	}
-	if _, err := client.SetConfig(ctx, req); err != nil {
-		// Unwrapped: the daemon's message is written for a person, and a refusal
-		// elevation cannot fix has to say so where the parent can read it off
-		// stderr.
-		return errors.New(gstatus.Convert(err).Message())
-	}
-	return nil
-}
-
-// interface guard: the one-shot's flags are flag.Value.
-var _ flag.Value = (*fieldValue)(nil)

client/ui/services/oneshot_test.go

@@ -1,151 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"flag"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func TestIsPrivilegedSettingsRun(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want bool
-	}{
-		{name: "no arguments"},
-		{name: "double dash", args: []string{"--" + FlagApplyPrivilegedSettings}, want: true},
-		{name: "single dash", args: []string{"-" + FlagApplyPrivilegedSettings}, want: true},
-		{
-			name: "among other flags",
-			args: []string{"--daemon-addr", "unix:///tmp/x.sock", "--" + FlagApplyPrivilegedSettings},
-			want: true,
-		},
-		// A marker, not a value: the caller never passes one, and reading a value
-		// would mean "--flag=false" started the one-shot too.
-		{name: "with a value", args: []string{"--" + FlagApplyPrivilegedSettings + "=true"}},
-		{name: "unrelated flags", args: []string{"--log-level", "debug"}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsPrivilegedSettingsRun(tt.args), "args %v", tt.args)
-		})
-	}
-}
-
-// What SetGuardedSettings renders has to be what the one-shot reads back, for every
-// setting in the table. This is the property that keeps the two ends of an allowlist
-// from drifting, so it is checked field by field rather than by example.
-func TestGuardedFieldsRoundTrip(t *testing.T) {
-	on, off := true, false
-	tests := []struct {
-		name     string
-		settings GuardedSettings
-		want     func(*testing.T, *proto.SetConfigRequest)
-	}{
-		{
-			name:     "management url",
-			settings: GuardedSettings{ManagementURL: "https://mgmt.example.com:33073"},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				assert.Equal(t, "https://mgmt.example.com:33073", req.GetManagementUrl())
-			},
-		},
-		{
-			name:     "ssh server on",
-			settings: GuardedSettings{ServerSSHAllowed: &on},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.ServerSSHAllowed)
-				assert.True(t, *req.ServerSSHAllowed)
-			},
-		},
-		{
-			name:     "ssh root off",
-			settings: GuardedSettings{EnableSSHRoot: &off},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.EnableSSHRoot, "an explicit false must survive, not read as absent")
-				assert.False(t, *req.EnableSSHRoot)
-			},
-		},
-		{
-			name:     "ssh auth off",
-			settings: GuardedSettings{DisableSSHAuth: &on},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.DisableSSHAuth)
-				assert.True(t, *req.DisableSSHAuth)
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req := parseRendered(t, tt.settings)
-			tt.want(t, req)
-		})
-	}
-}
-
-// A setting nobody asked about must not arrive at the daemon at all: sending its
-// zero value would change it.
-func TestGuardedFieldsCarryOnlyWhatWasAsked(t *testing.T) {
-	on := true
-	req := parseRendered(t, GuardedSettings{ProfileName: "work", EnableSSHRoot: &on})
-
-	assert.Equal(t, "work", req.GetProfileName(), "profile")
-	require.NotNil(t, req.EnableSSHRoot)
-	assert.Nil(t, req.ServerSSHAllowed, "untouched setting")
-	assert.Nil(t, req.DisableSSHAuth, "untouched setting")
-	assert.Empty(t, req.GetManagementUrl(), "untouched setting")
-}
-
-func TestPrivilegedRequestRejectsAnEmptyChange(t *testing.T) {
-	_, err := privilegedRequest("default", "vma", make([]fieldValue, len(guardedFields)))
-	require.Error(t, err, "nothing to apply is not a request worth sending as root")
-}
-
-// A value the table cannot parse is refused rather than guessed at.
-func TestPrivilegedRequestRejectsAnUnparseableValue(t *testing.T) {
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		if field.flag != FlagEnableSSHRoot {
-			continue
-		}
-		require.NoError(t, values[i].Set("perhaps"))
-	}
-
-	_, err := privilegedRequest("default", "vma", values)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), FlagEnableSSHRoot, "which flag was wrong")
-}
-
-// parseRendered puts the settings through both ends: rendered as the arguments the
-// elevated process is given, then parsed by a flag set registered from the same
-// table, which is what the one-shot itself parses them with. Anything hand-rolled
-// here would pin down a parser nothing uses.
-func parseRendered(t *testing.T, p GuardedSettings) *proto.SetConfigRequest {
-	t.Helper()
-
-	rendered := guardedSettings(p)
-	require.NotEmpty(t, rendered, "nothing rendered for %+v", p)
-
-	args := make([]string, 0, len(rendered))
-	for _, setting := range rendered {
-		args = append(args, setting.arg)
-	}
-
-	fs := flag.NewFlagSet(t.Name(), flag.ContinueOnError)
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		fs.Var(&values[i], field.flag, field.usage)
-	}
-	require.NoError(t, fs.Parse(args), "the one-shot's own flag set must accept %v", args)
-
-	req, err := privilegedRequest(p.ProfileName, p.Username, values)
-	require.NoError(t, err)
-	return req
-}

client/ui/services/settings.go

@@ -44,19 +44,12 @@ type Restrictions struct {
 }
 
 // Privilege tells the frontend whether this process may perform the changes the
-// daemon restricts to root/administrator, whether it can ask the operating
-// system for the privileges instead, and the command for each so a control that
-// can do neither can still show the way.
+// daemon restricts to root/administrator, and carries the command for each so a
+// disabled control can show the way to do it.
 type Privilege struct {
 	Privileged bool `json:"privileged"`
-	// ActorKey identifies the principal the operation requires without wording it,
-	// so the frontend can name it in the user's language: see
-	// ipcauth.PrivilegedActorKey. The words are not sent, because English ones
-	// cannot be dropped into a translated sentence.
-	ActorKey string `json:"actorKey"`
-	// CanElevate reports whether a guarded control can offer to authorize the
-	// change through the platform's own prompt: see SetGuardedSettings.
-	CanElevate bool `json:"canElevate"`
+	// Actor names what the operation requires ("root", "administrator privileges").
+	Actor string `json:"actor"`
 	// Commands equivalent to the settings the daemon guards, ready to copy.
 	AllowSSHServer string `json:"allowSshServer"`
 	EnableSSHRoot  string `json:"enableSshRoot"`
@@ -135,9 +128,6 @@ type Settings struct {
 	// daemonAddr is where the daemon listens, used to tell whether it runs as
 	// this user and would therefore authorize us: see Privilege.
 	daemonAddr string
-	// elevator raises the platform's privilege prompt when a change needs more
-	// rights than this process has.
-	elevator elevator
 }
 
 func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
@@ -145,7 +135,6 @@ func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePref
 		conn:       conn,
 		classifier: errorClassifier{translator: translator, prefs: prefs},
 		daemonAddr: daemonAddr,
-		elevator:   osElevator{},
 	}
 }
 
@@ -191,10 +180,10 @@ func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error
 	}, nil
 }
 
-func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcome, error) {
+func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
-		return SaveOutcome{}, err
+		return err
 	}
 	req := &proto.SetConfigRequest{
 		ProfileName:                   p.ProfileName,
@@ -226,92 +215,19 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcom
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
 	if _, err := cli.SetConfig(ctx, req); err != nil {
-		if _, refused := privilegeErrorInfo(err); refused {
-			return s.setConfigElevated(ctx, p, req, err)
-		}
 		// Classified so the frontend gets the daemon's guidance instead of the
-		// gRPC envelope.
-		return SaveOutcome{}, s.classifier.classify(err)
+		// gRPC envelope, which is what a refused privileged change looks like.
+		return s.classifier.classify(err)
 	}
-	return SaveOutcome{}, nil
-}
-
-// setConfigElevated answers a request the daemon refused for want of privileges by
-// asking the user to authorize it, and sending it again if they do. It is the same
-// offer the SSH settings make up front, for the changes a control cannot know are
-// guarded until it is told: repointing a profile at another management server is
-// only privileged while that host runs the SSH server.
-//
-// Two steps, because the elevated one-shot deliberately understands only the
-// settings the daemon guards: it applies those, and the original request then goes
-// through as this user, its privileged parts now asking for nothing that is not
-// already stored. Nothing was applied by the refused attempt — the daemon decides
-// before it writes — so there is no half-applied state to undo either way.
-func (s *Settings) setConfigElevated(ctx context.Context, p SetConfigParams, req *proto.SetConfigRequest, refusal error) (SaveOutcome, error) {
-	if !s.canElevate() {
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-
-	guarded, err := s.guardedChanges(ctx, p)
-	if err != nil {
-		log.Warnf("cannot tell which guarded settings this request changes: %v", err)
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-	if len(guardedSettings(guarded)) == 0 {
-		// Refused over something no prompt can settle, such as a control channel
-		// that carries no caller identity. Report the daemon's own guidance.
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-
-	outcome, err := s.SetGuardedSettings(ctx, guarded)
-	if err != nil || outcome.Declined {
-		return outcome, err
-	}
-
-	cli, err := s.conn.Client()
-	if err != nil {
-		return SaveOutcome{}, err
-	}
-	if _, err := cli.SetConfig(ctx, req); err != nil {
-		return SaveOutcome{}, s.classifier.classify(err)
-	}
-	return SaveOutcome{}, nil
-}
-
-// guardedChanges is the guarded part of a request, reduced to what it actually
-// changes.
-//
-// A settings form submits every field it holds, so a request restates values the
-// daemon already has. Carrying those into the elevated run would spend one
-// authorization on more than the user asked for, and a value that has gone stale
-// since the form was loaded would spend it on something they never asked about.
-func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (GuardedSettings, error) {
-	stored, err := s.GetConfig(ctx, ConfigParams{ProfileName: p.ProfileName, Username: p.Username})
-	if err != nil {
-		return GuardedSettings{}, fmt.Errorf("read the stored config: %w", err)
-	}
-
-	guarded := GuardedSettings{
-		ProfileName:      p.ProfileName,
-		Username:         p.Username,
-		ServerSSHAllowed: changedFlag(p.ServerSSHAllowed, stored.ServerSSHAllowed),
-		EnableSSHRoot:    changedFlag(p.EnableSSHRoot, stored.EnableSSHRoot),
-		DisableSSHAuth:   changedFlag(p.DisableSSHAuth, stored.DisableSSHAuth),
-	}
-	// An empty URL leaves the setting alone, which is the daemon's rule too.
-	if p.ManagementURL != "" && p.ManagementURL != stored.ManagementURL {
-		guarded.ManagementURL = p.ManagementURL
-	}
-	return guarded, nil
+	return nil
 }
 
 // Privilege reports whether this UI process could carry out the changes the
-// daemon restricts to root/administrator, whether it can instead ask the
-// operating system for the privileges when the user wants one of them, and the
-// command that performs the ones users hit in the SSH settings. It applies the
-// daemon's own rule to what it can see locally, so the frontend can decide up
-// front how to present those controls instead of letting a save fail. No daemon
-// round-trip, so it also works while the daemon is down.
+// daemon restricts to root/administrator, and the command that performs the one
+// users hit in the SSH settings. It applies the daemon's own rule to what it can
+// see locally, so the frontend can present those controls as unavailable up front
+// instead of letting a save fail. No daemon round-trip, so it also works while the
+// daemon is down.
 //
 // Being root or an elevated administrator is one way. The other is running as the
 // daemon's own user while the daemon is unprivileged, which the daemon accepts
@@ -321,40 +237,26 @@ func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (Guard
 func (s *Settings) Privilege() Privilege {
 	id, err := ipcauth.CurrentProcessIdentity()
 	if err != nil {
-		// Fail closed: report unprivileged, which only ever asks for more.
+		// Fail closed: report unprivileged, which only ever disables controls.
 		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
-		return s.newPrivilege(false)
+		return newPrivilege(false)
 	}
 	if id.IsPrivileged() {
-		return s.newPrivilege(true)
+		return newPrivilege(true)
 	}
-	return s.newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+	return newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
 }
 
-func (s *Settings) newPrivilege(privileged bool) Privilege {
+func newPrivilege(privileged bool) Privilege {
 	return Privilege{
 		Privileged:     privileged,
-		ActorKey:       ipcauth.PrivilegedActorKey(),
-		CanElevate:     s.canElevate(),
+		Actor:          ipcauth.PrivilegedActor(),
 		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
 		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
 		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
 	}
 }
 
-// canElevate reports whether offering the platform's elevation prompt would get
-// the user anywhere. It needs a mechanism to raise the prompt with and a control
-// channel that tells the daemon who is calling: on loopback TCP the daemon
-// refuses these changes to everybody, root included, so a prompt there would
-// only waste the user's password.
-func (s *Settings) canElevate() bool {
-	if !daemonaddr.CarriesIdentity(s.daemonAddr) {
-		log.Debugf("not offering elevation: the daemon address %s carries no caller identity", s.daemonAddr)
-		return false
-	}
-	return s.elevator.Available()
-}
-
 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -387,15 +289,6 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	return r, nil
 }
 
-// changedFlag returns requested only when it differs from what is stored, so a
-// setting the request merely restates is left out of the elevated run.
-func changedFlag(requested *bool, stored bool) *bool {
-	if requested == nil || *requested == stored {
-		return nil
-	}
-	return requested
-}
-
 func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
 	managed := cfgResp.GetMDMManagedFields()
 	if len(managed) == 0 {

management/server/group.go

@@ -7,7 +7,6 @@ import (
 	"slices"
 
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -746,10 +745,6 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
-	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
-	}
-
 	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
 		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
 	}
@@ -885,26 +880,6 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
-// isGroupLinkedToReverseProxyService checks if a group is used as an access group
-// of a private reverse proxy service or as a bearer-auth distribution group.
-func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
-	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, svc := range services {
-		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
-			return true, svc
-		}
-		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
-			return true, svc
-		}
-	}
-	return false, nil
-}
-
 // isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
 // agent network policy in the account.
 func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {

management/server/group_test.go

@@ -19,7 +19,6 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -132,16 +131,6 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-agent-network-policy",
 			"agent network policy",
 		},
-		{
-			"reverse proxy private service access group",
-			"grp-for-rp-private",
-			"reverse proxy service",
-		},
-		{
-			"reverse proxy bearer distribution group",
-			"grp-for-rp-bearer",
-			"reverse proxy service",
-		},
 	}
 
 	for _, testCase := range testCases {
@@ -240,12 +229,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-agent-network-policy"},
 			expectedReasons: []string{"agent network policy"},
 		},
-		{
-			name:               "reverse proxy services",
-			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
-			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -313,65 +296,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
-func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err, "Failed to create account manager")
-
-	_, account, err := initTestGroupAccount(am)
-	require.NoError(t, err, "Failed to init testing account")
-
-	deletableGroups := []*types.Group{
-		{
-			ID:        "grp-rp-bearer-disabled",
-			AccountID: account.Id,
-			Name:      "Group only in a disabled bearer auth",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-		{
-			ID:        "grp-rp-nonprivate-access",
-			AccountID: account.Id,
-			Name:      "Group only in a non-private service's access groups",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-	}
-	for _, group := range deletableGroups {
-		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
-	}
-
-	// Disabled bearer auth and stale access groups on a non-private service
-	// are inert configuration and must not block group deletion.
-	services := []*rpservice.Service{
-		{
-			ID:        "rp-svc-bearer-disabled",
-			AccountID: account.Id,
-			Domain:    "bearer-disabled.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            false,
-					DistributionGroups: []string{"grp-rp-bearer-disabled"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-nonprivate-access",
-			AccountID:    account.Id,
-			Domain:       "nonprivate.services.example.com",
-			Private:      false,
-			AccessGroups: []string{"grp-rp-nonprivate-access"},
-		},
-	}
-	for _, svc := range services {
-		require.NoError(t, am.Store.CreateService(context.Background(), svc))
-	}
-
-	for _, group := range deletableGroups {
-		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
-		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
-	}
-}
-
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -501,22 +425,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
-	groupForRPPrivate := &types.Group{
-		ID:        "grp-for-rp-private",
-		AccountID: "account-id",
-		Name:      "Group for private reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPBearer := &types.Group{
-		ID:        "grp-for-rp-bearer",
-		AccountID: "account-id",
-		Name:      "Group for bearer reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -573,8 +481,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
 
 	agentNetworkPolicy := &agentNetworkTypes.Policy{
 		ID:           "example agent network policy",
@@ -587,52 +493,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		return nil, nil, err
 	}
 
-	// The decoy services are created first so the linkage check has to scan
-	// past services that do not reference the groups under test.
-	rpServices := []*rpservice.Service{
-		{
-			ID:           "rp-svc-private-decoy",
-			AccountID:    accountID,
-			Domain:       "private-decoy.services.example.com",
-			Private:      true,
-			AccessGroups: []string{"unrelated-group"},
-		},
-		{
-			ID:        "rp-svc-bearer-decoy",
-			AccountID: accountID,
-			Domain:    "bearer-decoy.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{"unrelated-group"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-private",
-			AccountID:    accountID,
-			Domain:       "private.services.example.com",
-			Private:      true,
-			AccessGroups: []string{groupForRPPrivate.ID},
-		},
-		{
-			ID:        "rp-svc-bearer",
-			AccountID: accountID,
-			Domain:    "bearer.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{groupForRPBearer.ID},
-				},
-			},
-		},
-	}
-	for _, svc := range rpServices {
-		if err := am.Store.CreateService(context.Background(), svc); err != nil {
-			return nil, nil, err
-		}
-	}
-
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {
 		return nil, nil, err

shared/signal/client/client.go

@@ -52,6 +52,11 @@ type CredentialPayload struct {
 	Credential      *Credential
 	RosenpassPubKey []byte
 	RosenpassAddr   string
+	// MlkemPayload is the opaque post-quantum KEM handshake message riding this
+	// OFFER/ANSWER (see Body.mlkemPayload). Nil when not running the PQ exchange.
+	MlkemPayload []byte
+	// MlkemPort is the sender's ML-KEM PQ service UDP port (0 when not running).
+	MlkemPort       int
 	RelaySrvAddress string
 	RelaySrvIP      netip.Addr
 	SessionID       []byte
@@ -89,6 +94,13 @@ func MarshalCredential(myKey wgtypes.Key, remoteKey string, p CredentialPayload)
 	if p.RelaySrvIP.IsValid() {
 		body.RelayServerIP = p.RelaySrvIP.Unmap().AsSlice()
 	}
+	if len(p.MlkemPayload) > 0 {
+		body.MlkemPayload = p.MlkemPayload
+	}
+	if p.MlkemPort > 0 {
+		port := uint32(p.MlkemPort)
+		body.MlkemPort = &port
+	}
 	return &proto.Message{
 		Key:       myKey.PublicKey().String(),
 		RemoteKey: remoteKey,

shared/signal/proto/signalexchange.pb.go

@@ -239,6 +239,16 @@ type Body struct {
 	// fallback dial target when DNS resolution of relayServerAddress fails.
 	// SNI/TLS verification still uses relayServerAddress.
 	RelayServerIP []byte `protobuf:"bytes,11,opt,name=relayServerIP,proto3,oneof" json:"relayServerIP,omitempty"`
+	// mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
+	// seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
+	// the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
+	// pqkem library frames and parses it. Absent when the sender does not run the
+	// ML-KEM PQ exchange; unknown to older clients, which ignore it.
+	MlkemPayload []byte `protobuf:"bytes,12,opt,name=mlkemPayload,proto3,oneof" json:"mlkemPayload,omitempty"`
+	// mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
+	// WireGuard overlay IP. Peers send subsequent rekey messages there over the
+	// data path. Zero/absent when the ML-KEM PQ exchange is not running.
+	MlkemPort *uint32 `protobuf:"varint,13,opt,name=mlkemPort,proto3,oneof" json:"mlkemPort,omitempty"`
 }
 
 func (x *Body) Reset() {
@@ -343,6 +353,20 @@ func (x *Body) GetRelayServerIP() []byte {
 	return nil
 }
 
+func (x *Body) GetMlkemPayload() []byte {
+	if x != nil {
+		return x.MlkemPayload
+	}
+	return nil
+}
+
+func (x *Body) GetMlkemPort() uint32 {
+	if x != nil && x.MlkemPort != nil {
+		return *x.MlkemPort
+	}
+	return 0
+}
+
 // Mode indicates a connection mode
 type Mode struct {
 	state         protoimpl.MessageState
@@ -466,7 +490,7 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x0a, 0x04, 0x62,
 	0x6f, 0x64, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x73, 0x69, 0x67, 0x6e,
 	0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f, 0x64, 0x79, 0x52,
-	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xd2, 0x04, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
+	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xbd, 0x05, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
 	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x73,
 	0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f,
 	0x64, 0x79, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
@@ -494,39 +518,46 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x29,
 	0x0a, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x18,
 	0x0b, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x02, 0x52, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70,
-	0x65, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06,
-	0x41, 0x4e, 0x53, 0x57, 0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44,
-	0x49, 0x44, 0x41, 0x54, 0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10,
-	0x04, 0x12, 0x0b, 0x0a, 0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d,
-	0x0a, 0x09, 0x48, 0x45, 0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a,
-	0x13, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64,
-	0x72, 0x65, 0x73, 0x73, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x49, 0x64, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x49, 0x50, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f,
-	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x48, 0x00, 0x52, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42,
-	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f,
-	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a,
-	0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
-	0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
-	0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69,
-	0x67, 0x6e, 0x61, 0x6c, 0x45, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04,
-	0x53, 0x65, 0x6e, 0x64, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63,
-	0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x12, 0x27, 0x0a, 0x0c, 0x6d, 0x6c, 0x6b,
+	0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0c, 0x48,
+	0x03, 0x52, 0x0c, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x88,
+	0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x04, 0x52, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f,
+	0x72, 0x74, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x09, 0x0a,
+	0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x4e, 0x53, 0x57,
+	0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44, 0x49, 0x44, 0x41, 0x54,
+	0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10, 0x04, 0x12, 0x0b, 0x0a,
+	0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x45,
+	0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x72, 0x65,
+	0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
+	0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x42, 0x10,
+	0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50,
+	0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61,
+	0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x4a,
+	0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a,
+	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52,
+	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x64,
+	0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61,
+	0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a, 0x0f, 0x72, 0x6f, 0x73, 0x65,
+	0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x45,
+	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04, 0x53, 0x65, 0x6e, 0x64, 0x12,
+	0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65,
+	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
 	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69,
-	0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63,
-	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e,
-	0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
-	0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61,
+	0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01,
+	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (

shared/signal/proto/signalexchange.proto

@@ -75,6 +75,18 @@ message Body {
   // fallback dial target when DNS resolution of relayServerAddress fails.
   // SNI/TLS verification still uses relayServerAddress.
   optional bytes relayServerIP = 11;
+
+  // mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
+  // seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
+  // the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
+  // pqkem library frames and parses it. Absent when the sender does not run the
+  // ML-KEM PQ exchange; unknown to older clients, which ignore it.
+  optional bytes mlkemPayload = 12;
+
+  // mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
+  // WireGuard overlay IP. Peers send subsequent rekey messages there over the
+  // data path. Zero/absent when the ML-KEM PQ exchange is not running.
+  optional uint32 mlkemPort = 13;
 }
 
 // Mode indicates a connection mode