riccardom 95a976db88 [client] pqkem: leave a responder offer unanswered during an offer glare ...

When the controller's KEM offer and the responder's offer cross, the
controller used to answer the responder's offer without KEM. If the
responder read that answer before the KEM offer, it could bring WireGuard
up on no PSK and open a classical session. The responder's details still
reach the controller in its answer to the KEM offer.

2026-10-22 12:58:05 +02:00

..

acl

[client] Unify peer and route ACL filtering with multi-source rules (#6322)

2026-09-03 10:02:50 +02:00

auth

[client] Evaluate the session deadline against the wall clock (#7959)

2026-10-09 11:44:08 +02:00

certproof

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

daemonaddr

[client] Raise the daemon IPC receive limit above gRPC's 4 MB default (#7676)

2026-09-25 11:17:34 +02:00

debug

Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

2026-10-16 14:13:53 +02:00

dns

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

dnsfwd

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

elevate

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

expose

[client] Add Expose support to embed library (#5695)

2026-03-30 15:53:50 +02:00

getent

[client] Ask the OS for privileges when a guarded SSH setting is changed (#7066)

2026-08-25 20:15:16 +02:00

ipcauth

[client] Only treat LocalSystem as a privileged identity by SID on Windows (#7889)

2026-10-01 22:01:10 +09:00

lazyconn

[client] pqkem: install strict-mode keys on idle lazy peers

2026-10-19 17:02:15 +02:00

listener

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

localmetrics

[client] Add local Prometheus metrics endpoint (#6689)

2026-08-27 13:53:06 +02:00

metrics

[client] Clarify that metrics ingest X-Peer-ID is not a credential (#7363)

2026-09-02 12:36:47 +02:00

netflow

[client] fix flaky test around event aggregation (#6710)

2026-07-09 18:17:28 +02:00

networkmonitor

[client] Detect default route changes in the Linux network monitor (#8216)

2026-10-15 12:19:57 +02:00

peer

[client] pqkem: leave a responder offer unanswered during an offer glare

2026-10-22 12:58:05 +02:00

peerstore

[client] Reinject captured first packet on lazy connection activation (#6572)

2026-06-30 11:22:25 +02:00

pkcs11

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

portforward

[client] Move the PCP implementation to the go-nat fork (#7282)

2026-08-21 14:15:10 +02:00

pqkem

[client] pqkem: leave a responder offer unanswered during an offer glare

2026-10-22 12:58:05 +02:00

profilemanager

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

relay

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

rosenpass

[client,management] sync 0.74.4 changes (#6727)

2026-07-11 11:03:55 +02:00

routemanager

[client] Prolong HA routes on the current routing peer across relay and direct transitions (#8192)

2026-10-15 10:53:55 +02:00

routeselector

[client] Keep the route selection on an invalid request and apply it on a partial one (#7292)

2026-08-31 18:47:37 +02:00

sleep

[client] Fix staticcheck findings from the updated golangci-lint (#7266)

2026-08-20 16:50:50 +02:00

statemanager

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

stdnet

[client] Keep interface discovery out of the bind open path (#8226)

2026-10-16 02:16:45 +02:00

syncstore

[client] Persist sync response via pluggable store (disk on iOS) (#6331)

2026-06-03 14:18:50 +02:00

templates

Update client login success page (#4797)

2025-11-17 15:28:20 +01:00

tpm

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

tunnelnotifier

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

updater

[client] Keep the updater silent until management decides the mode (#7455)

2026-10-08 12:46:15 +02:00

wincmd

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

winregistry

[client] Clean up match domain reg entries between config changes (#4676)

2025-10-21 18:14:39 +02:00

conn_mgr_test.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

conn_mgr.go

[client] pqkem: install strict-mode keys on idle lazy peers

2026-10-19 17:02:15 +02:00

connect_android_default.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

connect_android_embed.go

[client] Support embed.Client on Android with netstack mode (#5623)

2026-04-01 16:19:34 +02:00

connect_certstore_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

connect_test.go

[client] Pick the probe port from the system in Test_freePort (#7404)

2026-09-03 10:03:24 +02:00

connect.go

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

dns_peer_activator_test.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_peer_activator.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_test.go

[management] network map from nmap data type (#6919)

2026-08-27 11:28:05 +02:00

dns.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

engine_authsession.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_bundle_test.go

[management,client] Gate remote jobs behind an admin opt-in with MDM support (#7153)

2026-09-01 17:53:41 +02:00

engine_certposture_test.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_certposture.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_generic.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_js.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_privileged_test.go

[management] remove ingress ports (#8062)

2026-10-06 16:35:31 +02:00

engine_session_deadline_test.go

[client] Keep session deadline visible across reconnects (#6847)

2026-07-22 15:22:16 +02:00

engine_sessionwatch_android.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_sessionwatch_js.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

engine_sessionwatch.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_ssh.go

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

engine_stdnet_android.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_stdnet.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_tunsettings.go

[client, android] Pull fresh TUN settings on Android rebuild (#6991)

2026-08-03 18:23:02 +02:00

engine.go

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

iface_common.go

[client] Replace the eBPF WireGuard proxy with loopback endpoint addressing (#7316)

2026-09-30 10:41:49 +02:00

iface_windows.go

Interface code cleaning (#3358)

2025-02-21 10:19:38 +01:00

iface.go

Revert "Revert "[relay] Update GO version and QUIC version (#4736)" (#5055)" (#5071)

2026-01-08 18:58:22 +01:00

mobile_dependency.go

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

pqkem_adapter_test.go

[client] pqkem: reprogram the latest PSK after a stale WireGuard configure

2026-10-22 12:17:49 +02:00

pqkem_adapter.go

[client] pqkem: leave a responder offer unanswered during an offer glare

2026-10-22 12:58:05 +02:00

pqkem_signal_test.go

[client] pqkem: cover the env flags, signal port, offer marker and status flag

2026-10-20 17:53:03 +02:00

pqkem_transport_test.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

pqkem_transport.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

session.go

Send terminal notification on peer session expiry (#1660)

2024-03-08 18:28:13 +01:00

state.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

wg_iface_monitor_linux.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor_other.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00