From a0aec4a713fada794c0753c2b08770534601f2fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zolt=C3=A1n=20Papp?= Date: Mon, 8 Jun 2026 22:58:52 +0200 Subject: [PATCH] [client] Preserve posture checks on config-only sync updates When management sends a MessageTypeControlConfig update (e.g. relay token rotation), the SyncResponse carries no NetworkMap and no Checks. Moving the updateChecksIfNew call after the nm == nil guard ensures posture checks are only updated when a full network map is present, preventing relay token rotation from silently clearing the previously applied posture check state. --- client/internal/engine.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/client/internal/engine.go b/client/internal/engine.go index 980326720..fa0516d4f 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -914,15 +914,17 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error { // todo update signal } - if err := e.updateChecksIfNew(update.Checks); err != nil { - return err - } - nm := update.GetNetworkMap() if nm == nil { + // config-only update (e.g. relay token rotation): posture checks and network map are intentionally absent, + // preserving the previously applied state return nil } + if err := e.updateChecksIfNew(update.Checks); err != nil { + return err + } + // Persist sync response under the dedicated lock (syncRespMux), not under syncMsgMux. // A non-nil syncStore is what marks persistence as enabled. Hold the lock for // the whole Set so the store cannot be cleared (disabled / engine close)