riccardom f669cba522 [client] pqkem: bind the data-path transport on the netstack in netstack mode ...

In netstack mode (js/wasm and embedded clients) the overlay IP lives only
inside the userspace stack, so binding it on the host failed with "cannot
assign requested address". The exchange was then disabled, and in strict
mode the engine refused to start at all. Reproduced in the lab with
NB_USE_NETSTACK_MODE=true.

Open the socket through the interface's netstack when there is one. Its
datagrams then ride the tunnel like any other overlay traffic (over the
relay's WebSocket in the browser). Host-TUN clients keep binding on the host.

2026-10-19 15:08:34 +02:00

..

acl

[client] Unify peer and route ACL filtering with multi-source rules (#6322)

2026-09-03 10:02:50 +02:00

auth

[client] Evaluate the session deadline against the wall clock (#7959)

2026-10-09 11:44:08 +02:00

certproof

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

daemonaddr

[client] Raise the daemon IPC receive limit above gRPC's 4 MB default (#7676)

2026-09-25 11:17:34 +02:00

debug

Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

2026-10-16 14:13:53 +02:00

dns

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

dnsfwd

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

elevate

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

expose

[client] Add Expose support to embed library (#5695)

2026-03-30 15:53:50 +02:00

getent

[client] Ask the OS for privileges when a guarded SSH setting is changed (#7066)

2026-08-25 20:15:16 +02:00

ipcauth

[client] Only treat LocalSystem as a privileged identity by SID on Windows (#7889)

2026-10-01 22:01:10 +09:00

lazyconn

[client] Reconcile routed allowed IPs when a lazy connection goes idle (#6863)

2026-07-23 18:40:54 +02:00

listener

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

localmetrics

[client] Add local Prometheus metrics endpoint (#6689)

2026-08-27 13:53:06 +02:00

metrics

[client] Clarify that metrics ingest X-Peer-ID is not a credential (#7363)

2026-09-02 12:36:47 +02:00

netflow

[client] fix flaky test around event aggregation (#6710)

2026-07-09 18:17:28 +02:00

networkmonitor

[client] Detect default route changes in the Linux network monitor (#8216)

2026-10-15 12:19:57 +02:00

peer

Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

2026-10-16 14:13:53 +02:00

peerstore

[client] Reinject captured first packet on lazy connection activation (#6572)

2026-06-30 11:22:25 +02:00

pkcs11

[client, management] Fix the edge cases left open in the certificate posture check (#8174)

2026-10-15 12:14:26 +02:00

portforward

[client] Move the PCP implementation to the go-nat fork (#7282)

2026-08-21 14:15:10 +02:00

pqkem

[client] pqkem: document SignalOffer's error-marker return contract

2026-10-09 18:16:41 +02:00

profilemanager

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

relay

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

rosenpass

[client,management] sync 0.74.4 changes (#6727)

2026-07-11 11:03:55 +02:00

routemanager

[client] Prolong HA routes on the current routing peer across relay and direct transitions (#8192)

2026-10-15 10:53:55 +02:00

routeselector

[client] Keep the route selection on an invalid request and apply it on a partial one (#7292)

2026-08-31 18:47:37 +02:00

sleep

[client] Fix staticcheck findings from the updated golangci-lint (#7266)

2026-08-20 16:50:50 +02:00

statemanager

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

stdnet

[client] Keep interface discovery out of the bind open path (#8226)

2026-10-16 02:16:45 +02:00

syncstore

[client] Persist sync response via pluggable store (disk on iOS) (#6331)

2026-06-03 14:18:50 +02:00

templates

Update client login success page (#4797)

2025-11-17 15:28:20 +01:00

tpm

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

tunnelnotifier

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

updater

[client] Keep the updater silent until management decides the mode (#7455)

2026-10-08 12:46:15 +02:00

wincmd

[client] Validate the saved service parameters and pin the netsh lookup (#7584)

2026-09-23 21:47:48 +02:00

winregistry

[client] Clean up match domain reg entries between config changes (#4676)

2025-10-21 18:14:39 +02:00

conn_mgr_test.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

conn_mgr.go

[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy (#6763)

2026-08-26 12:43:48 +02:00

connect_android_default.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

connect_android_embed.go

[client] Support embed.Client on Android with netstack mode (#5623)

2026-04-01 16:19:34 +02:00

connect_certstore_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

connect_test.go

[client] Pick the probe port from the system in Test_freePort (#7404)

2026-09-03 10:03:24 +02:00

connect.go

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00

dns_peer_activator_test.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_peer_activator.go

[client] warm lazy connections from the DNS resolver (#6854)

2026-07-22 18:47:48 +02:00

dns_test.go

[management] network map from nmap data type (#6919)

2026-08-27 11:28:05 +02:00

dns.go

[management, client] Add IPv6 overlay support (#5631)

2026-05-07 11:33:37 +02:00

engine_authsession.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_bundle_test.go

[management,client] Gate remote jobs behind an admin opt-in with MDM support (#7153)

2026-09-01 17:53:41 +02:00

engine_certposture_test.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_certposture.go

[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

2026-10-09 16:39:15 +02:00

engine_generic.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_js.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_privileged_test.go

[management] remove ingress ports (#8062)

2026-10-06 16:35:31 +02:00

engine_session_deadline_test.go

[client] Keep session deadline visible across reconnects (#6847)

2026-07-22 15:22:16 +02:00

engine_sessionwatch_android.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_sessionwatch_js.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

engine_sessionwatch.go

[client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)

2026-10-05 16:31:43 +02:00

engine_ssh.go

[client] Rebuild the overlay listeners when the TUN is renewed (#7397)

2026-09-03 12:22:00 +02:00

engine_stdnet_android.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_stdnet.go

[client] Cache the WireGuard interface check shared by ICE agents (#8001)

2026-10-09 11:03:34 +02:00

engine_test.go

[client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

2026-10-09 15:42:18 +02:00

engine_tunsettings.go

[client, android] Pull fresh TUN settings on Android rebuild (#6991)

2026-08-03 18:23:02 +02:00

engine.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

iface_common.go

[client] Replace the eBPF WireGuard proxy with loopback endpoint addressing (#7316)

2026-09-30 10:41:49 +02:00

iface_windows.go

Interface code cleaning (#3358)

2025-02-21 10:19:38 +01:00

iface.go

Revert "Revert "[relay] Update GO version and QUIC version (#4736)" (#5055)" (#5071)

2026-01-08 18:58:22 +01:00

mobile_dependency.go

[client] Serialize iOS tunnel reconfiguration callbacks (#6870)

2026-07-28 16:51:01 +02:00

pqkem_adapter_test.go

[client] pqkem: carry a generation on PSK callbacks to drop stale applies

2026-10-07 13:30:52 +02:00

pqkem_adapter.go

[client] pqkem: carry a generation on PSK callbacks to drop stale applies

2026-10-07 13:30:52 +02:00

pqkem_transport_test.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

pqkem_transport.go

[client] pqkem: bind the data-path transport on the netstack in netstack mode

2026-10-19 15:08:34 +02:00

session.go

Send terminal notification on peer session expiry (#1660)

2024-03-08 18:28:13 +01:00

state.go

[management,client] 0.75.0 release with new desktop UI (#6473)

2026-07-06 13:47:16 +02:00

wg_iface_monitor_linux.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor_other.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00

wg_iface_monitor.go

[client] Replace WG interface monitor polling with netlink subscription on Linux (#5857)

2026-05-04 18:49:39 +02:00