[client] Recover from rosenpass key desync

[lixmal]

Describe your changes

Recovers WireGuard tunnels that stay down after the rosenpass-managed preshared keys desync between two peers. Because the rosenpass renewal exchange runs over the tunnel that the preshared key itself secures, a desync cannot self-repair: the dead tunnel blocks the very exchange that would fix it. Two independent mechanisms restore convergence:

• On key expiry without a completed renewal, both ends derive an identical replacement key without communicating: first a ratchet step from the last shared key (preserving post-quantum secrecy against a renewal-blocking attacker), then a fall back to the rendezvous key (account preshared key, or the deterministic seed key) on repeated failure.
• After repeated consecutive WireGuard handshake timeouts, the peer's rosenpass state is reset so the next connection configuration reprograms the rendezvous key.
• The fallback key matches what a fresh connection programs for a not-yet-established peer, so a reconnect converges both ends.

Note: recovery requires both ends to run this change. A peer on an older version that latched a one-sided key cannot be recovered from the remote side until it restarts or upgrades. Expiry timers on the two ends are not synchronized, so there can be a brief window where the ends hold different keys before the next expiry converges them.

Issue ticket number and link

Stack

• 0.74.4-branch - ⚠️ No PR associated with branch
  • [client] Recover from rosenpass key desync #6714 👈

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Internal recovery behavior with no user-facing configuration or API surface.

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

Summary by CodeRabbit

• New Features

  • Improved connection recovery by automatically reacting to repeated handshake timeouts.
  • Added more resilient key handling during peer reconnection, including fallback behavior when synchronization is lost.

• Bug Fixes

  • Handshake monitoring now resets timeout tracking after a successful check, reducing unnecessary disconnects.
  • Peer state is preserved more reliably when peers are re-added or recover after expiry.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0d56f07e-8869-4e07-8f61-d828678b1f14

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rosenpass-desync-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Release artifacts

Built for PR head 90eefcc in workflow run #16591.

Artifact	Link
All release artifacts	Download
Linux packages	Download
Windows packages	Download
macOS packages	Download
UI artifacts	Download
UI macOS artifacts	Download

GHCR images (amd64)

• ghcr.io/netbirdio/management:pr-6714
• ghcr.io/netbirdio/netbird-server:pr-6714
• ghcr.io/netbirdio/netbird:pr-6714
• ghcr.io/netbirdio/relay:pr-6714
• ghcr.io/netbirdio/reverse-proxy:pr-6714
• ghcr.io/netbirdio/signal:pr-6714
• ghcr.io/netbirdio/upload:pr-6714

This comment is updated by the Release workflow. Artifact links expire according to the workflow retention policy.