riccardom b10fc220f3 [client] pqkem: route PSK commits and data-path sends through helpers ...

Preparation for authenticating data-path messages (security review of
#7098, finding F-003). The authentication needs the existing PSK while a
new one is being derived, to produce a MAC attached to the offers and their
answers that proves they are authentic. So committing a new PSK must keep
the previous one, and a reply must be sealed with the PSK that verified the
offer rather than the one just committed. Today both operations are inlined
at their call sites.

Pure refactor, no behaviour change: the two PSK commit sites call
commitPSKLocked, and pushDataPath delegates the endpoint lookup and send to
sendDataPath.

2026-10-19 17:02:15 +02:00

..

acl

[client] Unify peer and route ACL filtering with multi-source rules (#6322)

2026-09-03 10:02:50 +02:00

auth

[client] Evaluate the session deadline against the wall clock (#7959)

2026-10-09 11:44:08 +02:00

certproof

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

daemonaddr

[client] Raise the daemon IPC receive limit above gRPC's 4 MB default (#7676)

2026-09-25 11:17:34 +02:00

debug

Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

2026-10-16 14:13:53 +02:00

dns

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

dnsfwd

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

elevate

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

expose

[client] Add Expose support to embed library (#5695)

2026-03-30 15:53:50 +02:00

getent

[client] Ask the OS for privileges when a guarded SSH setting is changed (#7066)

2026-08-25 20:15:16 +02:00

ipcauth

[client] Only treat LocalSystem as a privileged identity by SID on Windows (#7889)

2026-10-01 22:01:10 +09:00

lazyconn

[client] Reconcile routed allowed IPs when a lazy connection goes idle (#6863)

2026-07-23 18:40:54 +02:00

listener

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

localmetrics

[client] Add local Prometheus metrics endpoint (#6689)

2026-08-27 13:53:06 +02:00

metrics

[client] Clarify that metrics ingest X-Peer-ID is not a credential (#7363)

2026-09-02 12:36:47 +02:00

netflow

[client] fix flaky test around event aggregation (#6710)

2026-07-09 18:17:28 +02:00

networkmonitor

[client] Detect default route changes in the Linux network monitor (#8216)

2026-10-15 12:19:57 +02:00

peer

[client] pqkem: report a peer as quantum resistant once its PSK lands

2026-10-19 15:08:34 +02:00

peerstore

[client] Reinject captured first packet on lazy connection activation (#6572)

2026-06-30 11:22:25 +02:00

pkcs11

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

portforward

[client] Move the PCP implementation to the go-nat fork (#7282)

2026-08-21 14:15:10 +02:00

pqkem

[client] pqkem: route PSK commits and data-path sends through helpers

2026-10-19 17:02:15 +02:00

profilemanager

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

relay

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

rosenpass

[client,management] sync 0.74.4 changes (#6727)

2026-07-11 11:03:55 +02:00

routemanager

[client] Prolong HA routes on the current routing peer across relay and direct transitions (#8192)

2026-10-15 10:53:55 +02:00

routeselector

[client] Keep the route selection on an invalid request and apply it on a partial one (#7292)

2026-08-31 18:47:37 +02:00

sleep

[client] Fix staticcheck findings from the updated golangci-lint (#7266)

2026-08-20 16:50:50 +02:00

statemanager

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

stdnet

[client] Keep interface discovery out of the bind open path (#8226)

2026-10-16 02:16:45 +02:00

syncstore

[client] Persist sync response via pluggable store (disk on iOS) (#6331)

2026-06-03 14:18:50 +02:00

templates

Update client login success page (#4797)

2025-11-17 15:28:20 +01:00

tpm

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

tunnelnotifier

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

updater

[client] Keep the updater silent until management decides the mode (#7455)

2026-10-08 12:46:15 +02:00

wincmd

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

winregistry

[client] Clean up match domain reg entries between config changes (#4676)

2025-10-21 18:14:39 +02:00

conn_mgr_test.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

conn_mgr.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

connect_android_default.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

connect_android_embed.go

[client] Support embed.Client on Android with netstack mode (#5623)

2026-04-01 16:19:34 +02:00

connect_certstore_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

connect_test.go

[client] Pick the probe port from the system in Test_freePort (#7404)

2026-09-03 10:03:24 +02:00

connect.go

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

dns_peer_activator_test.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_peer_activator.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_test.go

[management] network map from nmap data type (#6919)

2026-08-27 11:28:05 +02:00

dns.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

engine_authsession.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_bundle_test.go

[management,client] Gate remote jobs behind an admin opt-in with MDM support (#7153)

2026-09-01 17:53:41 +02:00

engine_certposture_test.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_certposture.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_generic.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_js.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_privileged_test.go

[management] remove ingress ports (#8062)

2026-10-06 16:35:31 +02:00

engine_session_deadline_test.go

[client] Keep session deadline visible across reconnects (#6847)

2026-07-22 15:22:16 +02:00

engine_sessionwatch_android.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_sessionwatch_js.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

engine_sessionwatch.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_ssh.go

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

engine_stdnet_android.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_stdnet.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_tunsettings.go

[client, android] Pull fresh TUN settings on Android rebuild (#6991)

2026-08-03 18:23:02 +02:00

engine.go

[client] pqkem: bind the configured pre-shared key into the PQ PSK

2026-10-19 16:37:25 +02:00

iface_common.go

[client] Replace the eBPF WireGuard proxy with loopback endpoint addressing (#7316)

2026-09-30 10:41:49 +02:00

iface_windows.go

Interface code cleaning (#3358)

2025-02-21 10:19:38 +01:00

iface.go

Revert "Revert "[relay] Update GO version and QUIC version (#4736)" (#5055)" (#5071)

2026-01-08 18:58:22 +01:00

mobile_dependency.go

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

pqkem_adapter_test.go

[client] pqkem: report a peer as quantum resistant once its PSK lands

2026-10-19 15:08:34 +02:00

pqkem_adapter.go

[client] pqkem: report a peer as quantum resistant once its PSK lands

2026-10-19 15:08:34 +02:00

pqkem_transport_test.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

pqkem_transport.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

session.go

Send terminal notification on peer session expiry (#1660)

2024-03-08 18:28:13 +01:00

state.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

wg_iface_monitor_linux.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor_other.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00