riccardom 70e6ce1095 [client] pqkem: reprogram the latest PSK after a stale WireGuard configure ...

The conn reads the PSK before configuring WireGuard. A rotation committed
in between pushes its key first, and the configure then overwrites it with
the old one, splitting the keys until the next reconnect.

2026-10-22 12:17:49 +02:00

..

acl

[client] Unify peer and route ACL filtering with multi-source rules (#6322)

2026-09-03 10:02:50 +02:00

auth

[client] Evaluate the session deadline against the wall clock (#7959)

2026-10-09 11:44:08 +02:00

certproof

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

daemonaddr

[client] Raise the daemon IPC receive limit above gRPC's 4 MB default (#7676)

2026-09-25 11:17:34 +02:00

debug

Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

2026-10-16 14:13:53 +02:00

dns

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

dnsfwd

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

elevate

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

expose

[client] Add Expose support to embed library (#5695)

2026-03-30 15:53:50 +02:00

getent

[client] Ask the OS for privileges when a guarded SSH setting is changed (#7066)

2026-08-25 20:15:16 +02:00

ipcauth

[client] Only treat LocalSystem as a privileged identity by SID on Windows (#7889)

2026-10-01 22:01:10 +09:00

lazyconn

[client] pqkem: install strict-mode keys on idle lazy peers

2026-10-19 17:02:15 +02:00

listener

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

localmetrics

[client] Add local Prometheus metrics endpoint (#6689)

2026-08-27 13:53:06 +02:00

metrics

[client] Clarify that metrics ingest X-Peer-ID is not a credential (#7363)

2026-09-02 12:36:47 +02:00

netflow

[client] fix flaky test around event aggregation (#6710)

2026-07-09 18:17:28 +02:00

networkmonitor

[client] Detect default route changes in the Linux network monitor (#8216)

2026-10-15 12:19:57 +02:00

peer

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

peerstore

[client] Reinject captured first packet on lazy connection activation (#6572)

2026-06-30 11:22:25 +02:00

pkcs11

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

portforward

[client] Move the PCP implementation to the go-nat fork (#7282)

2026-08-21 14:15:10 +02:00

pqkem

[client] pqkem: answer an unreadable offer with an error marker

2026-10-22 12:14:21 +02:00

profilemanager

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

relay

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

rosenpass

[client,management] sync 0.74.4 changes (#6727)

2026-07-11 11:03:55 +02:00

routemanager

[client] Prolong HA routes on the current routing peer across relay and direct transitions (#8192)

2026-10-15 10:53:55 +02:00

routeselector

[client] Keep the route selection on an invalid request and apply it on a partial one (#7292)

2026-08-31 18:47:37 +02:00

sleep

[client] Fix staticcheck findings from the updated golangci-lint (#7266)

2026-08-20 16:50:50 +02:00

statemanager

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

stdnet

[client] Keep interface discovery out of the bind open path (#8226)

2026-10-16 02:16:45 +02:00

syncstore

[client] Persist sync response via pluggable store (disk on iOS) (#6331)

2026-06-03 14:18:50 +02:00

templates

Update client login success page (#4797)

2025-11-17 15:28:20 +01:00

tpm

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

tunnelnotifier

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

updater

[client] Keep the updater silent until management decides the mode (#7455)

2026-10-08 12:46:15 +02:00

wincmd

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

winregistry

[client] Clean up match domain reg entries between config changes (#4676)

2025-10-21 18:14:39 +02:00

conn_mgr_test.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

conn_mgr.go

[client] pqkem: install strict-mode keys on idle lazy peers

2026-10-19 17:02:15 +02:00

connect_android_default.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

connect_android_embed.go

[client] Support embed.Client on Android with netstack mode (#5623)

2026-04-01 16:19:34 +02:00

connect_certstore_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

connect_test.go

[client] Pick the probe port from the system in Test_freePort (#7404)

2026-09-03 10:03:24 +02:00

connect.go

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

dns_peer_activator_test.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_peer_activator.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_test.go

[management] network map from nmap data type (#6919)

2026-08-27 11:28:05 +02:00

dns.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

engine_authsession.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_bundle_test.go

[management,client] Gate remote jobs behind an admin opt-in with MDM support (#7153)

2026-09-01 17:53:41 +02:00

engine_certposture_test.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_certposture.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_generic.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_js.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_privileged_test.go

[management] remove ingress ports (#8062)

2026-10-06 16:35:31 +02:00

engine_session_deadline_test.go

[client] Keep session deadline visible across reconnects (#6847)

2026-07-22 15:22:16 +02:00

engine_sessionwatch_android.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_sessionwatch_js.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

engine_sessionwatch.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_ssh.go

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

engine_stdnet_android.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_stdnet.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_tunsettings.go

[client, android] Pull fresh TUN settings on Android rebuild (#6991)

2026-08-03 18:23:02 +02:00

engine.go

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

iface_common.go

[client] Replace the eBPF WireGuard proxy with loopback endpoint addressing (#7316)

2026-09-30 10:41:49 +02:00

iface_windows.go

Interface code cleaning (#3358)

2025-02-21 10:19:38 +01:00

iface.go

Revert "Revert "[relay] Update GO version and QUIC version (#4736)" (#5055)" (#5071)

2026-01-08 18:58:22 +01:00

mobile_dependency.go

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

pqkem_adapter_test.go

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

pqkem_adapter.go

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

pqkem_signal_test.go

[client] pqkem: cover the env flags, signal port, offer marker and status flag

2026-10-20 17:53:03 +02:00

pqkem_transport_test.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

pqkem_transport.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

session.go

Send terminal notification on peer session expiry (#1660)

2024-03-08 18:28:13 +01:00

state.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

wg_iface_monitor_linux.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor_other.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00