[client] Discover interfaces lazily in stdnet instead of at construction (#7346)

* [client] Discover interfaces lazily in stdnet instead of at construction

stdnet.NewNet and NewNetWithDiscover ended with

    return n, n.UpdateInterfaces()

handing back a non-nil *Net together with the discovery error. Three of the
five call sites (Engine.newWgIface, ice.NewAgent, SingleSocketUDPMux) logged
the error and kept using the instance, which is only safe as long as the
instance still works after a failed discovery.

That stopped being true when Interfaces() gained a lazily refreshed cache:
updateInterfaces sets lastUpdate only on success, so after a failed
construction the 30s cache guard never holds and Interfaces() returns an
error rather than the empty list it used to return. Feeding such an instance
to pion is worse than passing nothing at all - ice.NewAgent falls back to its
own stdnet when Net is nil, and the interface blacklist is applied separately
through AgentConfig.InterfaceFilter, so the fallback loses nothing. Instead,
a transient discovery failure (the Android bridge at boot, or an interface
disappearing between net.Interfaces() and Interface.Addrs()) turned into a
hard "error getting local interfaces" from ice.NewAgent, and aborted the STUN
and TURN probes, which never even need the interface list.

Since the accessors already refresh a stale cache on demand, the eager
discovery in the constructors is redundant: drop it, make both constructors
infallible, and let the discovery error surface at the call that actually
needs the interfaces. UpdateInterfaces had no callers left and is not part of
transport.Net, so it is removed along with it.

InterfaceByIndex and InterfaceByName read the cached slice directly and never
refreshed it, so they would have kept reporting ErrInterfaceNotFound forever
on an instance whose first discovery failed. They now go through the same
refresh path as Interfaces().

* [client] Warm the stdnet interface cache at construction

Moving discovery to first use regressed the privileged suites on the three
platforms that always build an ICE bind: Darwin, FreeBSD and Windows time out
in TestWGIface_UpdateAddr, TestRecreation, TestEngine_SSH and
TestEngine_MultiplePeers, while Linux stays green because a host with the
WireGuard kernel module takes the kernel-device branch and never drives the
mux that asks for interfaces.

interfaceFilter probes with wgctrl every interface the disallow list does not
already exclude. Discovering at construction ran that probe before the caller
had an overlay interface of its own; discovering at first use runs it after,
so on a userspace WireGuard platform the probe reaches the UAPI socket of the
same process. The tests reach it because they construct with a nil disallow
list, where the client passes DefaultInterfaceBlacklist and its own interface
is excluded by prefix.

Restore the original timing with an explicit warm-up. The constructors stay
infallible and the error is still reported by the accessor that needs the
interfaces, so the contract this branch is about is unchanged.

* Revert "[client] Warm the stdnet interface cache at construction"

This reverts commit 947e25288f.

* [client] Give the privileged tests the interface blacklist the client uses

The suites that create a WireGuard interface construct stdnet with a nil
disallow list, which the client never does: Engine passes
profilemanager.DefaultInterfaceBlacklist, whose "wt" and "utun" prefixes
exclude the overlay interface before the filter reaches its wgctrl probe.

With an empty list every interface reaches that probe, the one the test has
just created included, and on a userspace WireGuard platform the probe talks
to the UAPI socket of the same process. That is why Darwin, FreeBSD and
Windows timed out here while Linux, which takes the kernel-device branch on a
host with the module loaded, stayed green.

Pass the blacklist in both suites so they exercise the configuration the
client ships. client/iface declares the prefixes locally because
profilemanager imports it.

Also cover the constructors directly: the existing tests build the struct
literal, so nothing asserted that NewNet and NewNetWithDiscover leave the
cache cold.

* [client] Pass the blacklist in the remaining tests that build an interface

Same reason as the previous commit, four call sites it missed: engine_test,
the route manager and systemops suites, and the privileged DNS server suite
all construct stdnet with a nil disallow list and then create a WireGuard
interface. TestAddVPNRoute surfaced it on FreeBSD once the earlier two files
stopped timing out first.

client/internal/dns declares the prefixes locally; profilemanager imports
that package, so it cannot import profilemanager back.

client/internal/dns/server_privileged_test.go

@@ -9,9 +9,9 @@ import (
 	"os"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -24,6 +24,10 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 )
 
+// testIFaceBlackList mirrors the overlay prefixes profilemanager.DefaultInterfaceBlacklist
+// carries. Declared here rather than imported because profilemanager imports this package.
+var testIFaceBlackList = []string{"wt", "utun", "tun0"}
+
 func TestUpdateDNSServer(t *testing.T) {
 
 	nameServers := []nbdns.NameServer{
@@ -243,10 +247,7 @@ func TestUpdateDNSServer(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			privKey, _ := wgtypes.GenerateKey()
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun230%d", n),
@@ -348,11 +349,7 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet, err := stdnet.NewNet(context.Background(), []string{"utun2301"})
-	if err != nil {
-		t.Errorf("create stdnet: %v", err)
-		return
-	}
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"})
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 	opts := iface.WGIFaceOpts{

client/internal/dns/server_test.go

@@ -394,11 +394,7 @@ func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet, err := stdnet.NewNet(context.Background(), []string{"utun2301"})
-	if err != nil {
-		t.Fatalf("create stdnet: %v", err)
-		return nil, err
-	}
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"})
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 

client/internal/engine.go

@@ -2178,10 +2178,7 @@ func (e *Engine) close() {
 }
 
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
-	transportNet, err := e.newStdNet()
-	if err != nil {
-		log.Errorf("failed to create pion's stdnet: %s", err)
-	}
+	transportNet := e.newStdNet()
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    e.config.WgIfaceName,

client/internal/engine_privileged_test.go

@@ -12,12 +12,12 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/keepalive"
@@ -27,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	nbssh "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -81,6 +82,7 @@ func TestEngine_SSH(t *testing.T) {
 			WgAddr:           wgaddr.MustParseWGAddress("100.64.0.1/24"),
 			WgPrivateKey:     key,
 			WgPort:           33100,
+			IFaceBlackList:   profilemanager.DefaultInterfaceBlacklist,
 			ServerSSHAllowed: true,
 			MTU:              iface.DefaultMTU,
 			SSHKey:           sshKey,
@@ -204,11 +206,12 @@ func TestEngine_Sync(t *testing.T) {
 	}
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 	engine := NewEngine(ctx, cancel, &EngineConfig{
-		WgIfaceName:  "utun103",
-		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
-		WgPrivateKey: key,
-		WgPort:       33100,
-		MTU:          iface.DefaultMTU,
+		WgIfaceName:    "utun103",
+		WgAddr:         wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey:   key,
+		WgPort:         33100,
+		IFaceBlackList: profilemanager.DefaultInterfaceBlacklist,
+		MTU:            iface.DefaultMTU,
 	}, EngineServices{
 		SignalClient:   &signal.MockClient{},
 		MgmClient:      &mgmt.MockClient{SyncFunc: syncFunc},
@@ -412,11 +415,12 @@ func createEngine(ctx context.Context, cancel context.CancelFunc, setupKey strin
 
 	wgPort := 33100 + i
 	conf := &EngineConfig{
-		WgIfaceName:  ifaceName,
-		WgAddr:       wgaddr.MustParseWGAddress(resp.PeerConfig.Address),
-		WgPrivateKey: key,
-		WgPort:       wgPort,
-		MTU:          iface.DefaultMTU,
+		WgIfaceName:    ifaceName,
+		WgAddr:         wgaddr.MustParseWGAddress(resp.PeerConfig.Address),
+		WgPrivateKey:   key,
+		WgPort:         wgPort,
+		IFaceBlackList: profilemanager.DefaultInterfaceBlacklist,
+		MTU:            iface.DefaultMTU,
 	}
 
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)

client/internal/engine_stdnet.go

@@ -6,6 +6,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func (e *Engine) newStdNet() (*stdnet.Net, error) {
+func (e *Engine) newStdNet() *stdnet.Net {
 	return stdnet.NewNet(e.clientCtx, e.config.IFaceBlackList)
 }

client/internal/engine_stdnet_android.go

@@ -2,6 +2,6 @@ package internal
 
 import "github.com/netbirdio/netbird/client/internal/stdnet"
 
-func (e *Engine) newStdNet() (*stdnet.Net, error) {
+func (e *Engine) newStdNet() *stdnet.Net {
 	return stdnet.NewNetWithDiscover(e.clientCtx, e.mobileDep.IFaceDiscover, e.config.IFaceBlackList)
 }

client/internal/engine_test.go

@@ -161,7 +161,6 @@ func (m *MockWGIface) GetProxy() wgproxy.Proxy {
 	return m.GetProxyFunc()
 }
 
-
 func (m *MockWGIface) GetNet() *netstack.Net {
 	return m.GetNetFunc()
 }
@@ -689,10 +688,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 				StatusRecorder: peer.NewRecorder("https://mgm"),
 			}, MobileDependency{})
 			engine.ctx = ctx
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
@@ -897,10 +893,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 			}, MobileDependency{})
 			engine.ctx = ctx
 
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
 				Address:      wgaddr.MustParseWGAddress(wgAddr),

client/internal/peer/ice/agent.go

@@ -39,10 +39,7 @@ func NewAgent(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, c
 	iceFailedTimeout := iceFailedTimeout()
 	iceRelayAcceptanceMinWait := iceRelayAcceptanceMinWait()
 
-	transportNet, err := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList)
-	if err != nil {
-		log.Errorf("failed to create pion's stdnet: %s", err)
-	}
+	transportNet := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList)
 
 	fac := logging.NewDefaultLoggerFactory()
 

client/internal/peer/ice/stdnet.go

@@ -8,6 +8,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) (*stdnet.Net, error) {
+func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) *stdnet.Net {
 	return stdnet.NewNet(ctx, ifaceBlacklist)
 }

client/internal/peer/ice/stdnet_android.go

@@ -6,6 +6,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) (*stdnet.Net, error) {
+func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) *stdnet.Net {
 	return stdnet.NewNetWithDiscover(ctx, iFaceDiscover, ifaceBlacklist)
 }

client/internal/relay/relay.go

@@ -201,11 +201,7 @@ func (p *StunTurnProbe) probeSTUN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net, err := stdnet.NewNet(ctx, nil)
-	if err != nil {
-		probeErr = fmt.Errorf("new net: %w", err)
-		return
-	}
+	net := stdnet.NewNet(ctx, nil)
 
 	client, err := stun.DialURI(uri, &stun.DialConfig{
 		Net: net,
@@ -290,11 +286,7 @@ func (p *StunTurnProbe) probeTURN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net, err := stdnet.NewNet(ctx, nil)
-	if err != nil {
-		probeErr = fmt.Errorf("new net: %w", err)
-		return
-	}
+	net := stdnet.NewNet(ctx, nil)
 	cfg := &turn.ClientConfig{
 		STUNServerAddr: turnServerAddr,
 		TURNServerAddr: turnServerAddr,

client/internal/routemanager/manager_test.go

@@ -8,6 +8,7 @@ import (
 	"net/netip"
 	"testing"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -406,10 +407,7 @@ func TestManagerUpdateRoutes(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			peerPrivateKey, _ := wgtypes.GeneratePrivateKey()
-			newNet, err := stdnet.NewNet(context.Background(), nil)
-			if err != nil {
-				t.Fatal(err)
-			}
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun43%d", n),
 				Address:      wgaddr.MustParseWGAddress("100.65.65.2/24"),

client/internal/routemanager/systemops/systemops_generic_test.go

@@ -15,6 +15,7 @@ import (
 	"syscall"
 	"testing"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -436,8 +437,7 @@ func createWGInterface(t *testing.T, interfaceName, ipAddressCIDR string, listen
 	peerPrivateKey, err := wgtypes.GeneratePrivateKey()
 	require.NoError(t, err)
 
-	newNet, err := stdnet.NewNet(context.Background(), nil)
-	require.NoError(t, err)
+	newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    interfaceName,

client/internal/stdnet/stdnet.go

@@ -45,7 +45,7 @@ type Net struct {
 }
 
 // NewNetWithDiscover creates a new StdNet instance.
-func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string) (*Net, error) {
+func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
@@ -60,20 +60,19 @@ func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover
 	} else {
 		n.iFaceDiscover = newMobileIFaceDiscover(iFaceDiscover)
 	}
-	return n, n.UpdateInterfaces()
+	return n
 }
 
 // NewNet creates a new StdNet instance.
-func NewNet(ctx context.Context, disallowList []string) (*Net, error) {
+func NewNet(ctx context.Context, disallowList []string) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
-	n := &Net{
+	return &Net{
 		iFaceDiscover:   pionDiscover{},
 		interfaceFilter: InterfaceFilter(disallowList),
 		ctx:             ctx,
 	}
-	return n, n.UpdateInterfaces()
 }
 
 // resolveAddr performs DNS resolution with context support and timeout.
@@ -122,45 +121,18 @@ func (n *Net) resolveAddr(network, address string) (netip.AddrPort, error) {
 	return netip.AddrPortFrom(addrs[0], uint16(port)), nil
 }
 
-// UpdateInterfaces updates the internal list of network interfaces
-// and associated addresses filtering them by name.
-// The interfaces are discovered by an external iFaceDiscover function or by a default discoverer if the external one
-// wasn't specified.
-func (n *Net) UpdateInterfaces() (err error) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-
-	return n.updateInterfaces()
-}
-
-func (n *Net) updateInterfaces() (err error) {
-	allIfaces, err := n.iFaceDiscover.iFaces()
-	if err != nil {
-		return err
-	}
-
-	n.interfaces = n.filterInterfaces(allIfaces)
-
-	n.lastUpdate = time.Now()
-
-	return nil
-}
-
 // Interfaces returns a slice of interfaces which are available on the
 // system
 func (n *Net) Interfaces() ([]*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
 
-	if time.Since(n.lastUpdate) < updateInterval {
-		return slices.Clone(n.interfaces), nil
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
 	}
 
-	if err := n.updateInterfaces(); err != nil {
-		return nil, fmt.Errorf("update interfaces: %w", err)
-	}
-
-	return slices.Clone(n.interfaces), nil
+	return slices.Clone(iFaces), nil
 }
 
 // InterfaceByIndex returns the interface specified by index.
@@ -171,7 +143,13 @@ func (n *Net) Interfaces() ([]*transport.Interface, error) {
 func (n *Net) InterfaceByIndex(index int) (*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
-	for _, ifc := range n.interfaces {
+
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, ifc := range iFaces {
 		if ifc.Index == index {
 			return ifc, nil
 		}
@@ -184,7 +162,13 @@ func (n *Net) InterfaceByIndex(index int) (*transport.Interface, error) {
 func (n *Net) InterfaceByName(name string) (*transport.Interface, error) {
 	n.mu.Lock()
 	defer n.mu.Unlock()
-	for _, ifc := range n.interfaces {
+
+	iFaces, err := n.freshInterfacesLocked()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, ifc := range iFaces {
 		if ifc.Name == name {
 			return ifc, nil
 		}
@@ -193,6 +177,31 @@ func (n *Net) InterfaceByName(name string) (*transport.Interface, error) {
 	return nil, fmt.Errorf("%w: %s", transport.ErrInterfaceNotFound, name)
 }
 
+func (n *Net) freshInterfacesLocked() ([]*transport.Interface, error) {
+	if time.Since(n.lastUpdate) < updateInterval {
+		return n.interfaces, nil
+	}
+
+	if err := n.updateInterfacesLocked(); err != nil {
+		return nil, fmt.Errorf("update interfaces: %w", err)
+	}
+
+	return n.interfaces, nil
+}
+
+func (n *Net) updateInterfacesLocked() error {
+	allIFaces, err := n.iFaceDiscover.iFaces()
+	if err != nil {
+		return err
+	}
+
+	n.interfaces = n.filterInterfaces(allIFaces)
+
+	n.lastUpdate = time.Now()
+
+	return nil
+}
+
 func (n *Net) filterInterfaces(interfaces []*transport.Interface) []*transport.Interface {
 	if n.interfaceFilter == nil {
 		return interfaces

client/internal/stdnet/stdnet_test.go

@@ -0,0 +1,136 @@
+package stdnet
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+
+	"github.com/pion/transport/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type countingDiscover struct {
+	calls int
+	list  []*transport.Interface
+	err   error
+}
+
+func (d *countingDiscover) iFaces() ([]*transport.Interface, error) {
+	d.calls++
+	if d.err != nil {
+		return nil, d.err
+	}
+	return d.list, nil
+}
+
+func newTestNet(t *testing.T, d iFaceDiscover) *Net {
+	t.Helper()
+	return &Net{
+		iFaceDiscover: d,
+		ctx:           context.Background(),
+	}
+}
+
+func testIFace(index int, name string) *transport.Interface {
+	return transport.NewInterface(net.Interface{Index: index, Name: name})
+}
+
+func TestNet_InterfacesDiscoversLazilyAndCaches(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(1, "eth0")}}
+	n := newTestNet(t, d)
+
+	require.Zero(t, d.calls, "construction must not discover interfaces")
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.Interfaces()
+	require.NoError(t, err)
+	assert.Equal(t, 1, d.calls)
+}
+
+func TestNewNet_DoesNotDiscoverAtConstruction(t *testing.T) {
+	n := NewNet(context.Background(), nil)
+	require.NotNil(t, n)
+	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
+}
+
+func TestNewNetWithDiscover_DoesNotDiscoverAtConstruction(t *testing.T) {
+	n := NewNetWithDiscover(context.Background(), nil, nil)
+	require.NotNil(t, n)
+	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
+}
+
+func TestNet_InterfacesRetryAfterDiscoveryFailure(t *testing.T) {
+	discoverErr := errors.New("discover failed")
+	d := &countingDiscover{err: discoverErr}
+	n := newTestNet(t, d)
+
+	_, err := n.Interfaces()
+	require.ErrorIs(t, err, discoverErr)
+
+	d.err = nil
+	d.list = []*transport.Interface{testIFace(1, "eth0")}
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, 2, d.calls)
+}
+
+func TestNet_InterfaceByNameRefreshes(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(3, "eth0")}}
+	n := newTestNet(t, d)
+
+	ifc, err := n.InterfaceByName("eth0")
+	require.NoError(t, err)
+	assert.Equal(t, "eth0", ifc.Name)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.InterfaceByName("nope")
+	require.ErrorIs(t, err, transport.ErrInterfaceNotFound)
+}
+
+func TestNet_InterfaceByIndexRefreshes(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(3, "eth0")}}
+	n := newTestNet(t, d)
+
+	ifc, err := n.InterfaceByIndex(3)
+	require.NoError(t, err)
+	assert.Equal(t, "eth0", ifc.Name)
+	assert.Equal(t, 1, d.calls)
+
+	_, err = n.InterfaceByIndex(99)
+	require.ErrorIs(t, err, transport.ErrInterfaceNotFound)
+}
+
+func TestNet_InterfaceLookupPropagatesDiscoveryError(t *testing.T) {
+	discoverErr := errors.New("discover failed")
+	n := newTestNet(t, &countingDiscover{err: discoverErr})
+
+	_, err := n.InterfaceByName("eth0")
+	require.ErrorIs(t, err, discoverErr)
+
+	_, err = n.InterfaceByIndex(1)
+	require.ErrorIs(t, err, discoverErr)
+}
+
+func TestNet_InterfacesReturnsCopy(t *testing.T) {
+	d := &countingDiscover{list: []*transport.Interface{testIFace(1, "eth0")}}
+	n := newTestNet(t, d)
+
+	iFaces, err := n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+
+	iFaces[0] = testIFace(2, "tampered")
+
+	iFaces, err = n.Interfaces()
+	require.NoError(t, err)
+	require.Len(t, iFaces, 1)
+	assert.Equal(t, "eth0", iFaces[0].Name)
+}