netbird

mirror of https://github.com/netbirdio/netbird.git synced 2026-10-09 06:59:08 +02:00

Files

T

riccardom 0747fa0398 [client] pqkem: signal a responder failure distinctly from "no KEM"

Capability is signalled in-band by an empty answer: a peer that does not run the
KEM answers with no payload. But a responder that runs the KEM and simply fails
to build the answer (crypto error, failed PSK program, a future protocol version
it cannot parse) also produced an empty payload, so the initiator read it as
"peer has no KEM" and marked it non-capable — permanently, since only peer
removal clears the flag; in strict mode the peer stayed blocked.

Add a payload-less MsgError marker. On a signalling-path failure the responder
returns the marker instead of an empty answer, and the initiator treats it as
"capable but failed this round": it leaves the exchange to time out and
re-bootstrap rather than marking the peer non-capable. A genuinely non-KEM peer
still sends no payload at all, so the empty-answer capability signal is unchanged.

Found in cubic review on #7098 (client/internal/pqkem_adapter.go:72).

2026-10-07 13:38:42 +02:00

bench_test.go

Addresses CI fixes

2026-09-11 14:48:54 +02:00

callbacks.go

[client] pqkem: carry a generation on PSK callbacks to drop stale applies

2026-10-07 13:30:52 +02:00

capability_test.go

[client] pqkem: signal a responder failure distinctly from "no KEM"

2026-10-07 13:38:42 +02:00

concurrency_test.go

Addresses CI fixes