[client] Remove the replace directives from the embedded client (#8280)

client/embed/embed.go

@@ -12,11 +12,10 @@ import (
 	"sync"
 
 	"github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	wgnetstack "golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -256,10 +255,10 @@ func New(opts Options) (*Client, error) {
 	}
 
 	if opts.Performance.PreallocatedBuffersPerPool != nil {
-		wgdevice.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
+		wgbackend.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
 	}
 	if opts.Performance.MaxBatchSize != nil {
-		wgdevice.SetMaxBatchSizeOverride(*opts.Performance.MaxBatchSize)
+		wgbackend.SetMaxBatchSizeOverride(*opts.Performance.MaxBatchSize)
 	}
 
 	return &Client{
@@ -651,7 +650,7 @@ func (c *Client) getEngine() (*internal.Engine, error) {
 	return engine, nil
 }
 
-func (c *Client) getNet() (*wgnetstack.Net, netip.Addr, error) {
+func (c *Client) getNet() (*wgbackend.NetstackNet, netip.Addr, error) {
 	engine, err := c.getEngine()
 	if err != nil {
 		return nil, netip.Addr{}, err

client/firewall/iface.go

@@ -1,10 +1,9 @@
 package firewall
 
 import (
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // EnvForceUserspaceFirewall forces the use of the userspace packet filter even when
@@ -20,5 +19,5 @@ type IFaceMapper interface {
 	IsUserspaceBind() bool
 	SetFilter(device.PacketFilter) error
 	GetDevice() *device.FilteredDevice
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 }

client/firewall/uspfilter/filter.go

@@ -19,7 +19,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -31,6 +30,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -121,7 +121,7 @@ type Iface interface {
 	Name() string
 	Address() wgaddr.Address
 	SetFilter(device.PacketFilter) error
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 }
 
 // InterfaceAllower opens the NetBird interface in the host firewall so it

client/firewall/uspfilter/filter_filter_test.go

@@ -5,17 +5,17 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
+	"go.uber.org/mock/gomock"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/mocks"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
@@ -791,10 +791,10 @@ func setupRoutedManager(tb testing.TB, network string) *Manager {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 

client/firewall/uspfilter/filter_routeacl_test.go

@@ -4,17 +4,17 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
+	"go.uber.org/mock/gomock"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/mocks"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // TestAddRouteFilteringReturnsExistingRule verifies that adding the same route
@@ -180,10 +180,10 @@ func TestBlockInvalidRoutedDualStack(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -228,10 +228,10 @@ func TestBlockInvalidRoutedIdempotent(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -291,10 +291,10 @@ func TestBlockRuleNotAccumulatedOnRepeatedEnableRouting(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -410,10 +410,10 @@ func setupTestManager(t *testing.T) *Manager {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 

client/firewall/uspfilter/filter_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
@@ -22,6 +21,7 @@ import (
 	nbiface "github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/netflow"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -34,7 +34,7 @@ type IFaceMock struct {
 	NameFunc        func() string
 	SetFilterFunc   func(device.PacketFilter) error
 	AddressFunc     func() wgaddr.Address
-	GetWGDeviceFunc func() *wgdevice.Device
+	GetWGDeviceFunc func() *wgbackend.Device
 	GetDeviceFunc   func() *device.FilteredDevice
 }
 
@@ -45,7 +45,7 @@ func (i *IFaceMock) Name() string {
 	return i.NameFunc()
 }
 
-func (i *IFaceMock) GetWGDevice() *wgdevice.Device {
+func (i *IFaceMock) GetWGDevice() *wgbackend.Device {
 	if i.GetWGDeviceFunc == nil {
 		return nil
 	}

client/firewall/uspfilter/forwarder/endpoint.go

@@ -5,12 +5,12 @@ import (
 	"strconv"
 	"sync/atomic"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // PacketCapture captures raw packets for debugging. Implementations must be
@@ -23,7 +23,7 @@ type PacketCapture interface {
 type endpoint struct {
 	logger     *nblog.Logger
 	dispatcher stack.NetworkDispatcher
-	device     *wgdevice.Device
+	device     *wgbackend.Device
 	mtu        atomic.Uint32
 	capture    atomic.Pointer[PacketCapture]
 }

client/firewall/uspfilter/forwarder/forwarder.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -26,6 +25,7 @@ import (
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -43,7 +43,7 @@ const (
 
 // IFace provides the WireGuard device and overlay addresses the forwarder needs.
 type IFace interface {
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 	Address() wgaddr.Address
 }
 

client/iface/bind/control.go

@@ -1,8 +1,7 @@
 package bind
 
 import (
-	wireguard "golang.zx2c4.com/wireguard/conn"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
-
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
@@ -10,6 +9,6 @@ import (
 func init() {
 	listener := nbnet.NewListener()
 	if listener.ListenConfig.Control != nil {
-		*wireguard.ControlFns = append(*wireguard.ControlFns, listener.ListenConfig.Control)
+		*wgbackend.ControlFns = append(*wgbackend.ControlFns, listener.ListenConfig.Control)
 	}
 }

client/iface/bind/endpoint.go

@@ -3,10 +3,10 @@ package bind
 import (
 	"net"
 
-	wgConn "golang.zx2c4.com/wireguard/conn"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
-type Endpoint = wgConn.StdNetEndpoint
+type Endpoint = wgbackend.StdNetEndpoint
 
 func EndpointToUDPAddr(e Endpoint) *net.UDPAddr {
 	return &net.UDPAddr{

client/iface/bind/ice_bind.go

@@ -15,10 +15,10 @@ import (
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/net/ipv6"
-	wgConn "golang.zx2c4.com/wireguard/conn"
 
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
@@ -36,7 +36,7 @@ type receiverCreator struct {
 	iceBind *ICEBind
 }
 
-func (rc receiverCreator) CreateReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgConn.ReceiveFunc {
+func (rc receiverCreator) CreateReceiverFn(pc wgbackend.BatchReader, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgbackend.ReceiveFunc {
 	return rc.iceBind.createReceiverFn(pc, conn, rxOffload, msgPool)
 }
 
@@ -48,7 +48,7 @@ func (rc receiverCreator) CreateReceiverFn(pc wgConn.BatchReader, conn *net.UDPC
 // without port, in the format of 127.1.x.x where x.x is the last two octets of the peer address. We try to avoid to
 // use the port because in the Send function the wgConn.Endpoint the port info is not exported.
 type ICEBind struct {
-	*wgConn.StdNetBind
+	*wgbackend.StdNetBind
 
 	transportNet transport.Net
 	address      wgaddr.Address
@@ -74,7 +74,7 @@ type ICEBind struct {
 }
 
 func NewICEBind(transportNet transport.Net, address wgaddr.Address, mtu uint16) *ICEBind {
-	b, _ := wgConn.NewStdNetBind().(*wgConn.StdNetBind)
+	b, _ := wgbackend.NewStdNetBind().(*wgbackend.StdNetBind)
 	ib := &ICEBind{
 		StdNetBind:       b,
 		transportNet:     transportNet,
@@ -90,11 +90,11 @@ func NewICEBind(transportNet transport.Net, address wgaddr.Address, mtu uint16)
 	rc := receiverCreator{
 		ib,
 	}
-	ib.StdNetBind = wgConn.NewStdNetBindWithReceiverCreator(rc)
+	ib.StdNetBind = wgbackend.NewStdNetBindWithReceiverCreator(rc)
 	return ib
 }
 
-func (s *ICEBind) Open(uport uint16) ([]wgConn.ReceiveFunc, uint16, error) {
+func (s *ICEBind) Open(uport uint16) ([]wgbackend.ReceiveFunc, uint16, error) {
 	s.closedChanMu.Lock()
 	defer s.closedChanMu.Unlock()
 
@@ -190,7 +190,7 @@ func (b *ICEBind) ReceiveFromEndpoint(ctx context.Context, ep *Endpoint, buf []b
 	}
 }
 
-func (b *ICEBind) Send(bufs [][]byte, ep wgConn.Endpoint) error {
+func (b *ICEBind) Send(bufs [][]byte, ep wgbackend.Endpoint) error {
 	b.endpointsMu.Lock()
 	conn, ok := b.endpoints[ep.DstIP()]
 	b.endpointsMu.Unlock()
@@ -206,7 +206,7 @@ func (b *ICEBind) Send(bufs [][]byte, ep wgConn.Endpoint) error {
 	return nil
 }
 
-func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgConn.ReceiveFunc {
+func (s *ICEBind) createReceiverFn(pc wgbackend.BatchReader, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgbackend.ReceiveFunc {
 	s.muUDPMux.Lock()
 	defer s.muUDPMux.Unlock()
 
@@ -218,7 +218,7 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 	}
 	s.createOrUpdateMux()
 
-	return func(bufs [][]byte, sizes []int, eps []wgConn.Endpoint) (n int, err error) {
+	return func(bufs [][]byte, sizes []int, eps []wgbackend.Endpoint) (n int, err error) {
 		msgs := getMessages(msgsPool)
 		for i := range bufs {
 			(*msgs)[i].Buffers[0] = bufs[i]
@@ -229,13 +229,13 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		var numMsgs int
 		if runtime.GOOS == "linux" || runtime.GOOS == "android" {
 			if rxOffload {
-				readAt := len(*msgs) - (wgConn.IdealBatchSize / wgConn.UdpSegmentMaxDatagrams)
+				readAt := len(*msgs) - (wgbackend.IdealBatchSize / wgbackend.UdpSegmentMaxDatagrams)
 				//nolint:staticcheck
 				_, err = pc.ReadBatch((*msgs)[readAt:], 0)
 				if err != nil {
 					return 0, err
 				}
-				numMsgs, err = wgConn.SplitCoalescedMessages(*msgs, readAt, wgConn.GetGSOSize)
+				numMsgs, err = wgbackend.SplitCoalescedMessages(*msgs, readAt, wgbackend.GetGSOSize)
 				if err != nil {
 					return 0, err
 				}
@@ -278,8 +278,8 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 				s.activityRecorder.record(addrPort)
 			}
 
-			ep := &wgConn.StdNetEndpoint{AddrPort: addrPort} // TODO: remove allocation
+			ep := &wgbackend.StdNetEndpoint{AddrPort: addrPort} // TODO: remove allocation
-			wgConn.GetSrcFromControl(msg.OOB[:msg.NN], ep)
+			wgbackend.GetSrcFromControl(msg.OOB[:msg.NN], ep)
 			eps[i] = ep
 		}
 		return numMsgs, nil
@@ -363,7 +363,7 @@ func (s *ICEBind) parseSTUNMessage(raw []byte) (*stun.Message, error) {
 
 // receiveRelayed is a receive function that is used to receive packets from the relayed connection and forward to the
 // WireGuard. Critical part is do not block if the Closed() has been called.
-func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgConn.Endpoint) (int, error) {
+func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgbackend.Endpoint) (int, error) {
 	closedChan := c.currentClosedChan()
 
 	select {
@@ -375,7 +375,7 @@ func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgConn.Endpo
 		}
 		copy(buffs[0], msg.Buffer)
 		sizes[0] = len(msg.Buffer)
-		eps[0] = wgConn.Endpoint(msg.Endpoint)
+		eps[0] = wgbackend.Endpoint(msg.Endpoint)
 
 		if isTransportPkg(buffs, sizes[0]) {
 			if ep, ok := eps[0].(*Endpoint); ok {

client/iface/bind/ice_bind_close_test.go

@@ -6,7 +6,8 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-	wgConn "golang.zx2c4.com/wireguard/conn"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // startReceivers runs every receive function the way wireguard-go's device
@@ -14,7 +15,7 @@ import (
 // calling Bind.Close, closeBindLocked waits on exactly that WaitGroup while
 // holding device.net, so a receive function that never returns wedges the
 // device and every goroutine that needs the same lock.
-func startReceivers(fns []wgConn.ReceiveFunc) *sync.WaitGroup {
+func startReceivers(fns []wgbackend.ReceiveFunc) *sync.WaitGroup {
 	wg, _ := startReceiversEntered(fns)
 	return wg
 }
@@ -23,18 +24,18 @@ func startReceivers(fns []wgConn.ReceiveFunc) *sync.WaitGroup {
 // function has been called at least once. A receive function that has been
 // entered is either inside its blocking receive or about to be, which is a
 // stronger signal to synchronise on than a bare sleep.
-func startReceiversEntered(fns []wgConn.ReceiveFunc) (*sync.WaitGroup, <-chan struct{}) {
+func startReceiversEntered(fns []wgbackend.ReceiveFunc) (*sync.WaitGroup, <-chan struct{}) {
 	var wg sync.WaitGroup
 	var entered sync.WaitGroup
 	wg.Add(len(fns))
 	entered.Add(len(fns))
 
 	for i := range fns {
-		go func(fn wgConn.ReceiveFunc) {
+		go func(fn wgbackend.ReceiveFunc) {
 			defer wg.Done()
 			buffs := [][]byte{make([]byte, 1500)}
 			sizes := make([]int, 1)
-			eps := make([]wgConn.Endpoint, 1)
+			eps := make([]wgbackend.Endpoint, 1)
 			first := true
 			for {
 				if first {

client/iface/bind/ice_bind_test.go

@@ -16,10 +16,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func TestICEBind_CreatesReceiverForBothIPv4AndIPv6(t *testing.T) {
@@ -370,16 +369,16 @@ func TestICEBind_OpenDoesNotDiscoverInterfaces(t *testing.T) {
 }
 
 func TestICEBind_DeviceUpDoesNotWaitOnInterfaceDiscovery(t *testing.T) {
-	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
+	tunDev, _, err := wgbackend.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
 	require.NoError(t, err)
 
-	var dev *device.Device
+	var dev *wgbackend.Device
 	n := newCountingNet()
 	n.before = func() {
 		_ = dev.IpcGetOperation(io.Discard)
 	}
 	iceBind := NewICEBind(n, testAddress(), 1280)
-	dev = device.NewDevice(tunDev, iceBind, device.NewLogger(device.LogLevelSilent, ""))
+	dev = wgbackend.NewDevice(tunDev, iceBind, wgbackend.NewLogger(wgbackend.LogLevelSilent, ""))
 
 	upDone := make(chan error, 1)
 	go func() {

client/iface/bind/relay_bind.go

@@ -7,15 +7,15 @@ import (
 	"sync"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/conn"
 
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // RelayBindJS is a conn.Bind implementation for WebAssembly environments.
 // Do not limit to build only js, because we want to be able to run tests
 type RelayBindJS struct {
-	*conn.StdNetBind
+	*wgbackend.StdNetBind
 
 	recvChan         chan recvMessage
 	endpoints        map[netip.Addr]net.Conn
@@ -34,12 +34,12 @@ func NewRelayBindJS() *RelayBindJS {
 }
 
 // Open creates a receive function for handling relay packets in WASM.
-func (s *RelayBindJS) Open(uport uint16) ([]conn.ReceiveFunc, uint16, error) {
+func (s *RelayBindJS) Open(uport uint16) ([]wgbackend.ReceiveFunc, uint16, error) {
 	log.Debugf("Open: creating receive function for port %d", uport)
 
 	s.ctx, s.cancel = context.WithCancel(context.Background())
 
-	receiveFn := func(bufs [][]byte, sizes []int, eps []conn.Endpoint) (int, error) {
+	receiveFn := func(bufs [][]byte, sizes []int, eps []wgbackend.Endpoint) (int, error) {
 		select {
 		case <-s.ctx.Done():
 			return 0, net.ErrClosed
@@ -49,13 +49,13 @@ func (s *RelayBindJS) Open(uport uint16) ([]conn.ReceiveFunc, uint16, error) {
 			}
 			copy(bufs[0], msg.Buffer)
 			sizes[0] = len(msg.Buffer)
-			eps[0] = conn.Endpoint(msg.Endpoint)
+			eps[0] = wgbackend.Endpoint(msg.Endpoint)
 			return 1, nil
 		}
 	}
 
 	log.Debugf("Open: receive function created, returning port %d", uport)
-	return []conn.ReceiveFunc{receiveFn}, uport, nil
+	return []wgbackend.ReceiveFunc{receiveFn}, uport, nil
 }
 
 func (s *RelayBindJS) Close() error {
@@ -78,7 +78,7 @@ func (s *RelayBindJS) ReceiveFromEndpoint(ctx context.Context, ep *Endpoint, buf
 }
 
 // Send forwards packets through the relay connection for WASM.
-func (s *RelayBindJS) Send(bufs [][]byte, ep conn.Endpoint) error {
+func (s *RelayBindJS) Send(bufs [][]byte, ep wgbackend.Endpoint) error {
 	if ep == nil {
 		return nil
 	}

client/iface/bind/stun_filter_test.go

@@ -12,7 +12,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
-	wgConn "golang.zx2c4.com/wireguard/conn"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
@@ -165,7 +166,7 @@ func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
 	// A leftover size from an earlier read, which is what makes the missing reset
 	// observable.
 	sizes := []int{148}
-	eps := make([]wgConn.Endpoint, 1)
+	eps := make([]wgbackend.Endpoint, 1)
 
 	n, err := recvFn(bufs, sizes, eps)
 	require.NoError(t, err)

client/iface/configurer/uapi.go

@@ -5,16 +5,16 @@ package configurer
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/ipc"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func openUAPI(deviceName string) (net.Listener, error) {
-	uapiSock, err := ipc.UAPIOpen(deviceName)
+	uapiSock, err := wgbackend.UAPIOpen(deviceName)
 	if err != nil {
 		return nil, err
 	}
 
-	listener, err := ipc.UAPIListen(deviceName, uapiSock)
+	listener, err := wgbackend.UAPIListen(deviceName, uapiSock)
 	if err != nil {
 		_ = uapiSock.Close()
 		return nil, err

client/iface/configurer/uapi_windows.go

@@ -3,9 +3,9 @@ package configurer
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/ipc"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func openUAPI(deviceName string) (net.Listener, error) {
-	return ipc.UAPIListen(deviceName)
+	return wgbackend.UAPIListen(deviceName)
 }

client/iface/configurer/usp.go

@@ -10,11 +10,10 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	wgconn "golang.zx2c4.com/wireguard/conn"
-	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -22,7 +21,7 @@ import (
 var ErrAllowedIPNotFound = fmt.Errorf("allowed IP not found")
 
 type WGUSPConfigurer struct {
-	device           *device.Device
+	device           *wgbackend.Device
 	deviceName       string
 	activityRecorder *bind.ActivityRecorder
 	statsCache       *statsCache
@@ -31,14 +30,14 @@ type WGUSPConfigurer struct {
 }
 
 // NewUSPConfigurer creates a userspace configurer and starts its UAPI listener.
-func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
+func NewUSPConfigurer(device *wgbackend.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
 	wgCfg := NewUSPConfigurerNoUAPI(device, deviceName, activityRecorder)
 	wgCfg.startUAPI()
 	return wgCfg
 }
 
 // NewUSPConfigurerNoUAPI creates a userspace configurer without a UAPI listener.
-func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
+func NewUSPConfigurerNoUAPI(device *wgbackend.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
 	wgCfg := &WGUSPConfigurer{
 		device:           device,
 		deviceName:       deviceName,
@@ -59,7 +58,7 @@ func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error
 		return fmt.Errorf("invalid listen port %d", port)
 	}
 
-	if err := c.device.SetPrivateKey(device.NoisePrivateKey(key)); err != nil {
+	if err := c.device.SetPrivateKey(wgbackend.NoisePrivateKey(key)); err != nil {
 		return fmt.Errorf("set private key: %w", err)
 	}
 	if err := c.device.SetListenPort(uint16(port)); err != nil {
@@ -80,8 +79,8 @@ func (c *WGUSPConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updat
 		return err
 	}
 
-	presharedKey := device.NoisePresharedKey(psk)
+	presharedKey := wgbackend.NoisePresharedKey(psk)
-	return c.device.ConfigurePeer(device.NoisePublicKey(parsedPeerKey), device.PeerConfig{
+	return c.device.ConfigurePeer(wgbackend.NoisePublicKey(parsedPeerKey), wgbackend.PeerConfig{
 		PresharedKey: &presharedKey,
 		UpdateOnly:   updateOnly,
 	})
@@ -99,7 +98,7 @@ func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix,
 		return err
 	}
 
-	cfg := device.PeerConfig{
+	cfg := wgbackend.PeerConfig{
 		PersistentKeepalive: &keepAlive,
 		AllowedIPs:          prefixes,
 	}
@@ -116,11 +115,11 @@ func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix,
 	}
 
 	if preSharedKey != nil {
-		psk := device.NoisePresharedKey(*preSharedKey)
+		psk := wgbackend.NoisePresharedKey(*preSharedKey)
 		cfg.PresharedKey = &psk
 	}
 
-	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), cfg); err != nil {
+	if err := c.device.ConfigurePeer(wgbackend.NoisePublicKey(peerKeyParsed), cfg); err != nil {
 		return fmt.Errorf("configure peer: %w", err)
 	}
 
@@ -138,7 +137,7 @@ func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return ErrPeerNotFound
 	}
@@ -147,7 +146,7 @@ func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 	peer.ZeroAndFlushAll()
 
 	var noKeepAlive time.Duration
-	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), device.PeerConfig{
+	if err := c.device.ConfigurePeer(wgbackend.NoisePublicKey(peerKeyParsed), wgbackend.PeerConfig{
 		PersistentKeepalive: &noKeepAlive,
 		UpdateOnly:          true,
 	}); err != nil {
@@ -163,7 +162,7 @@ func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 		return err
 	}
 
-	c.device.RemovePeer(device.NoisePublicKey(peerKeyParsed))
+	c.device.RemovePeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	c.activityRecorder.Remove(peerKey)
 	return nil
 }
@@ -178,7 +177,7 @@ func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) e
 		return fmt.Errorf("invalid allowed IP %v", allowedIP)
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return nil
 	}
@@ -198,7 +197,7 @@ func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix
 		return ErrAllowedIPNotFound
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return ErrPeerNotFound
 	}
@@ -284,7 +283,7 @@ func (c *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
 	return stats, nil
 }
 
-func peerStats(peer *device.Peer) Peer {
+func peerStats(peer *wgbackend.Peer) Peer {
 	stats := Peer{
 		PublicKey:     wgtypes.Key(peer.PublicKey()).String(),
 		AllowedIPs:    prefixesToIPNets(peer.AllowedIPs()),
@@ -299,7 +298,7 @@ func peerStats(peer *device.Peer) Peer {
 	return stats
 }
 
-func endpointAddrPort(endpoint wgconn.Endpoint) (netip.AddrPort, bool) {
+func endpointAddrPort(endpoint wgbackend.Endpoint) (netip.AddrPort, bool) {
 	if endpoint == nil {
 		return netip.AddrPort{}, false
 	}

client/iface/configurer/usp_allowedips_test.go

@@ -8,11 +8,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgconn "golang.zx2c4.com/wireguard/conn"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // newTestUSPConfigurer builds a configurer over a real wireguard-go device backed by an
@@ -20,7 +19,7 @@ import (
 func newTestUSPConfigurer(t *testing.T) *WGUSPConfigurer {
 	t.Helper()
 
-	dev := wgdevice.NewDevice(newIdleTUN(), wgconn.NewDefaultBind(), wgdevice.NewLogger(wgdevice.LogLevelSilent, ""))
+	dev := wgbackend.NewDevice(newIdleTUN(), wgbackend.NewDefaultBind(), wgbackend.NewLogger(wgbackend.LogLevelSilent, ""))
 	t.Cleanup(dev.Close)
 
 	c := NewUSPConfigurerNoUAPI(dev, "wgtest0", bind.NewActivityRecorder())

client/iface/configurer/usp_test.go

@@ -11,20 +11,20 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // idleTUN never reports an up event, so the wireguard-go device stays down: no socket is
 // opened, no peer goroutine starts, and the configuration state is all the tests observe.
 type idleTUN struct {
-	events chan tun.Event
+	events chan wgbackend.TUNEvent
 	closed chan struct{}
 }
 
 func newIdleTUN() *idleTUN {
-	return &idleTUN{events: make(chan tun.Event), closed: make(chan struct{})}
+	return &idleTUN{events: make(chan wgbackend.TUNEvent), closed: make(chan struct{})}
 }
 
 func (t *idleTUN) File() *os.File { return nil }
@@ -40,7 +40,7 @@ func (t *idleTUN) MTU() (int, error) { return 1420, nil }
 
 func (t *idleTUN) Name() (string, error) { return "idle", nil }
 
-func (t *idleTUN) Events() <-chan tun.Event { return t.events }
+func (t *idleTUN) Events() <-chan wgbackend.TUNEvent { return t.events }
 
 func (t *idleTUN) Close() error {
 	close(t.closed)
@@ -142,12 +142,12 @@ func TestRemoveEndpointAddressKeepsThePeerAndStopsTheKeepalive(t *testing.T) {
 	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
 	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
 	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
-	before := c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey()))
+	before := c.device.LookupPeer(wgbackend.NoisePublicKey(priv.PublicKey()))
 	require.NotNil(t, before, "the peer must be on the device")
 
 	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
 
-	assert.Same(t, before, c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey())),
+	assert.Same(t, before, c.device.LookupPeer(wgbackend.NoisePublicKey(priv.PublicKey())),
 		"the peer object must survive the endpoint removal")
 	stats, err := c.FullStats()
 	require.NoError(t, err, "read device stats")

client/iface/device.go

@@ -3,13 +3,10 @@
 package iface
 
 import (
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type WGTunDevice interface {
@@ -21,7 +18,7 @@ type WGTunDevice interface {
 	DeviceName() string
 	Close() error
 	FilteredDevice() *device.FilteredDevice
-	Device() *wgdevice.Device
+	Device() *wgbackend.Device
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	GetICEBind() device.EndpointManager
 }

client/iface/device/device_android.go

@@ -8,14 +8,12 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGTunDevice ignore the WGTunDevice interface on Android because the creation of the tun device is different on this platform
@@ -30,7 +28,7 @@ type WGTunDevice struct {
 	disableDNS bool
 
 	name           string
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -74,7 +72,7 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 		return nil, err
 	}
 
-	unmonitoredTUN, name, err := tun.CreateUnmonitoredTUNFromFD(fd)
+	unmonitoredTUN, name, err := wgbackend.CreateUnmonitoredTUNFromFD(fd)
 	if err != nil {
 		_ = unix.Close(fd)
 		log.Errorf("failed to create Android interface: %s", err)
@@ -87,7 +85,7 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 	t.filteredDevice = newDeviceFilter(t.renewableTun)
 
 	log.Debugf("attaching to interface %v", name)
-	t.device = device.NewDevice(t.filteredDevice, t.iceBind, device.NewLogger(wgLogLevel(), "[netbird] "))
+	t.device = wgbackend.NewDevice(t.filteredDevice, t.iceBind, wgbackend.NewLogger(wgLogLevel(), "[netbird] "))
 	// without this property mobile devices can discover remote endpoints if the configured one was wrong.
 	// this helps with support for the older NetBird clients that had a hardcoded direct mode
 	// t.device.DisableSomeRoamingForBrokenMobileSemantics()
@@ -121,7 +119,7 @@ func (t *WGTunDevice) RenewTun(fd int) error {
 		return fmt.Errorf("device not initialized")
 	}
 
-	unmonitoredTUN, _, err := tun.CreateUnmonitoredTUNFromFD(fd)
+	unmonitoredTUN, _, err := wgbackend.CreateUnmonitoredTUNFromFD(fd)
 	if err != nil {
 		_ = unix.Close(fd)
 		log.Errorf("failed to renew Android interface: %s", err)
@@ -155,7 +153,7 @@ func (t *WGTunDevice) Close() error {
 	return nil
 }
 
-func (t *WGTunDevice) Device() *device.Device {
+func (t *WGTunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -175,7 +173,7 @@ func (t *WGTunDevice) FilteredDevice() *FilteredDevice {
 	return t.filteredDevice
 }
 
-func (t *WGTunDevice) GetNet() *netstack.Net {
+func (t *WGTunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_darwin.go

@@ -7,14 +7,12 @@ import (
 	"os/exec"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -25,7 +23,7 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -43,17 +41,17 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 }
 
 func (t *TunDevice) Create() (WGConfigurer, error) {
-	tunDevice, err := tun.CreateTUN(t.name, int(t.mtu))
+	tunDevice, err := wgbackend.CreateTUN(t.name, int(t.mtu))
 	if err != nil {
 		return nil, fmt.Errorf("error creating tun device: %s", err)
 	}
 	t.filteredDevice = newDeviceFilter(tunDevice)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	err = t.assignAddr()
@@ -125,7 +123,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -160,7 +158,7 @@ func (t *TunDevice) assignAddr() error {
 	return nil
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_filter.go

@@ -8,7 +8,8 @@ import (
 	"sync/atomic"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // PacketFilter interface for firewall abilities
@@ -42,7 +43,7 @@ type PacketCapture interface {
 
 // FilteredDevice to override Read or Write of packets
 type FilteredDevice struct {
-	tun.Device
+	wgbackend.TUN
 
 	filter  PacketFilter
 	capture atomic.Pointer[PacketCapture]
@@ -54,9 +55,9 @@ type FilteredDevice struct {
 }
 
 // newDeviceFilter constructor function
-func newDeviceFilter(device tun.Device) *FilteredDevice {
+func newDeviceFilter(device wgbackend.TUN) *FilteredDevice {
 	return &FilteredDevice{
-		Device: device,
+		TUN: device,
 	}
 }
 
@@ -66,7 +67,7 @@ func newDeviceFilter(device tun.Device) *FilteredDevice {
 func (d *FilteredDevice) Close() error {
 	var err error
 	d.closeOnce.Do(func() {
-		err = d.Device.Close()
+		err = d.TUN.Close()
 	})
 	if err != nil {
 		return err
@@ -142,14 +143,14 @@ func (d *FilteredDevice) Write(bufs [][]byte, offset int) (int, error) {
 // wintun read path and converting them into errors.
 func (d *FilteredDevice) deviceRead(bufs [][]byte, sizes []int, offset int) (n int, err error) {
 	defer d.recoverFromPanic("read", &n, &err)
-	return d.Device.Read(bufs, sizes, offset)
+	return d.TUN.Read(bufs, sizes, offset)
 }
 
 // deviceWrite calls the underlying device Write, recovering from panics in the
 // wintun write path and converting them into errors.
 func (d *FilteredDevice) deviceWrite(bufs [][]byte, offset int) (n int, err error) {
 	defer d.recoverFromPanic("write", &n, &err)
-	return d.Device.Write(bufs, offset)
+	return d.TUN.Write(bufs, offset)
 }
 
 // recoverFromPanic converts a panic in the underlying device into a regular

client/iface/device/device_ios.go

@@ -6,14 +6,12 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -25,7 +23,7 @@ type TunDevice struct {
 	iceBind *bind.ICEBind
 	tunFd   int
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -50,7 +48,7 @@ var ErrInvalidTunnelFD = fmt.Errorf("invalid tunnel file descriptor: fd is 0 (Sw
 func (t *TunDevice) Create() (WGConfigurer, error) {
 	log.Infof("create tun interface")
 
-	var tunDevice tun.Device
+	var tunDevice wgbackend.TUN
 	var err error
 
 	// Validate the tunnel file descriptor.
@@ -79,7 +77,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 		_ = unix.Close(dupTunFd)
 		return nil, err
 	}
-	tunDevice, err = tun.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
+	tunDevice, err = wgbackend.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
 	if err != nil {
 		log.Errorf("Unable to create new tun device from fd: %v", err)
 		_ = unix.Close(dupTunFd)
@@ -88,7 +86,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 
 	t.filteredDevice = newDeviceFilter(tunDevice)
 	log.Debug("Attaching to interface")
-	t.device = device.NewDevice(t.filteredDevice, t.iceBind, device.NewLogger(wgLogLevel(), "[netbird] "))
+	t.device = wgbackend.NewDevice(t.filteredDevice, t.iceBind, wgbackend.NewLogger(wgLogLevel(), "[netbird] "))
 	// without this property mobile devices can discover remote endpoints if the configured one was wrong.
 	// this helps with support for the older NetBird clients that had a hardcoded direct mode
 	// t.device.DisableSomeRoamingForBrokenMobileSemantics()
@@ -118,7 +116,7 @@ func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return udpMux, nil
 }
 
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -163,7 +161,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 	return t.filteredDevice
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_kernel_unix.go

@@ -9,12 +9,11 @@ import (
 
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/sharedsock"
 )
@@ -170,7 +169,7 @@ func (t *TunKernelDevice) DeviceName() string {
 }
 
 // Device returns the wireguard device, not applicable for kernel devices
-func (t *TunKernelDevice) Device() *device.Device {
+func (t *TunKernelDevice) Device() *wgbackend.Device {
 	return nil
 }
 
@@ -183,7 +182,7 @@ func (t *TunKernelDevice) assignAddr() error {
 	return t.link.assignAddr(&t.address)
 }
 
-func (t *TunKernelDevice) GetNet() *netstack.Net {
+func (t *TunKernelDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_netstack.go

@@ -6,20 +6,18 @@ import (
 	"net/netip"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/conn"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
 type Bind interface {
-	conn.Bind
+	wgbackend.Bind
 	GetICEMux() (*udpmux.UniversalUDPMuxDefault, error)
 	ActivityRecorder() *bind.ActivityRecorder
 	EndpointManager
@@ -34,13 +32,13 @@ type TunNetstackDevice struct {
 	listenAddress string
 	bind          Bind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	nsTun          *nbnetstack.NetStackTun
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 
-	net *netstack.Net
+	net *wgbackend.NetstackNet
 }
 
 func NewNetstackDevice(name string, address wgaddr.Address, wgPort int, key string, mtu uint16, bind Bind, listenAddress string) *TunNetstackDevice {
@@ -78,10 +76,10 @@ func (t *TunNetstackDevice) create() (WGConfigurer, error) {
 	t.filteredDevice = newDeviceFilter(tunIface)
 	t.net = net
 
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.bind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	t.configurer = configurer.NewUSPConfigurerNoUAPI(t.device, t.name, t.bind.ActivityRecorder())
@@ -156,11 +154,11 @@ func (t *TunNetstackDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunNetstackDevice) Device() *device.Device {
+func (t *TunNetstackDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
-func (t *TunNetstackDevice) GetNet() *netstack.Net {
+func (t *TunNetstackDevice) GetNet() *wgbackend.NetstackNet {
 	return t.net
 }
 

client/iface/device/device_usp_unix.go

@@ -6,14 +6,12 @@ import (
 	"fmt"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -24,7 +22,7 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -45,7 +43,7 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 
 func (t *TunDevice) Create() (WGConfigurer, error) {
 	log.Info("create tun interface")
-	tunIface, err := tun.CreateTUN(t.name, int(t.mtu))
+	tunIface, err := wgbackend.CreateTUN(t.name, int(t.mtu))
 	if err != nil {
 		log.Debugf("failed to create tun interface (%s, %d): %s", t.name, int(t.mtu), err)
 		return nil, fmt.Errorf("error creating tun device: %s", err)
@@ -53,10 +51,10 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	t.filteredDevice = newDeviceFilter(tunIface)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	err = t.assignAddr()
@@ -132,7 +130,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -143,7 +141,7 @@ func (t *TunDevice) assignAddr() error {
 	return link.assignAddr(&t.address)
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_windows.go

@@ -6,15 +6,13 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/windows"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const defaultWindowsGUIDSTring = "{f2f29e61-d91f-4d76-8151-119b20c4bdeb}"
@@ -27,8 +25,8 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device          *device.Device
+	device          *wgbackend.Device
-	nativeTunDevice *tun.NativeTun
+	nativeTunDevice *wgbackend.NativeTUN
 	filteredDevice  *FilteredDevice
 	udpMux          *udpmux.UniversalUDPMuxDefault
 	configurer      WGConfigurer
@@ -60,18 +58,18 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 		return nil, err
 	}
 	log.Info("create tun interface")
-	tunDevice, err := tun.CreateTUNWithRequestedGUID(t.name, &guid, int(t.mtu))
+	tunDevice, err := wgbackend.CreateTUNWithRequestedGUID(t.name, &guid, int(t.mtu))
 	if err != nil {
 		return nil, fmt.Errorf("error creating tun device: %s", err)
 	}
-	t.nativeTunDevice = tunDevice.(*tun.NativeTun)
+	t.nativeTunDevice = tunDevice.(*wgbackend.NativeTUN)
 	t.filteredDevice = newDeviceFilter(tunDevice)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	luid := winipcfg.LUID(t.nativeTunDevice.LUID())
@@ -172,7 +170,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -209,7 +207,7 @@ func (t *TunDevice) assignAddr() error {
 	return luid.SetIPAddresses([]netip.Prefix{v4Prefix})
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/renewable_tun.go

@@ -10,7 +10,8 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // closeAwareDevice wraps a tun.Device along with a flag
@@ -23,15 +24,15 @@ import (
 // goroutine is awaited and closed only once.
 type closeAwareDevice struct {
 	isClosed atomic.Bool
-	tun.Device
+	wgbackend.TUN
 	closeEventCh chan struct{}
 	wg           sync.WaitGroup
 	closeOnce    sync.Once
 }
 
-func newClosableDevice(tunDevice tun.Device) *closeAwareDevice {
+func newClosableDevice(tunDevice wgbackend.TUN) *closeAwareDevice {
 	return &closeAwareDevice{
-		Device:       tunDevice,
+		TUN:          tunDevice,
 		isClosed:     atomic.Bool{},
 		closeEventCh: make(chan struct{}),
 	}
@@ -39,18 +40,18 @@ func newClosableDevice(tunDevice tun.Device) *closeAwareDevice {
 
 // redirectEvents redirects the Events() method of the underlying tun.Device
 // to the given channel (RenewableTUN's events channel).
-func (c *closeAwareDevice) redirectEvents(out chan tun.Event) {
+func (c *closeAwareDevice) redirectEvents(out chan wgbackend.TUNEvent) {
 	c.wg.Add(1)
 	go func() {
 		defer c.wg.Done()
 		for {
 			select {
-			case ev, ok := <-c.Device.Events():
+			case ev, ok := <-c.TUN.Events():
 				if !ok {
 					return
 				}
 
-				if ev == tun.EventDown {
+				if ev == wgbackend.TUNEventDown {
 					continue
 				}
 
@@ -72,7 +73,7 @@ func (c *closeAwareDevice) Close() (err error) {
 	c.closeOnce.Do(func() {
 		c.isClosed.Store(true)
 		close(c.closeEventCh)
-		err = c.Device.Close()
+		err = c.TUN.Close()
 		c.wg.Wait()
 	})
 
@@ -87,7 +88,7 @@ type RenewableTUN struct {
 	devices []*closeAwareDevice
 	mu      sync.Mutex
 	cond    *sync.Cond
-	events  chan tun.Event
+	events  chan wgbackend.TUNEvent
 	closed  atomic.Bool
 }
 
@@ -95,7 +96,7 @@ func NewRenewableTUN() *RenewableTUN {
 	r := &RenewableTUN{
 		devices: make([]*closeAwareDevice, 0),
 		mu:      sync.Mutex{},
-		events:  make(chan tun.Event, 16),
+		events:  make(chan wgbackend.TUNEvent, 16),
 	}
 	r.cond = sync.NewCond(&r.mu)
 	return r
@@ -225,7 +226,7 @@ func (r *RenewableTUN) Name() (string, error) {
 
 // Events returns a channel that is fed events from the underlying tun.Device's events channel
 // once it is added.
-func (r *RenewableTUN) Events() <-chan tun.Event {
+func (r *RenewableTUN) Events() <-chan wgbackend.TUNEvent {
 	return r.events
 }
 
@@ -259,7 +260,7 @@ func (r *RenewableTUN) BatchSize() int {
 	return 1
 }
 
-func (r *RenewableTUN) AddDevice(device tun.Device) {
+func (r *RenewableTUN) AddDevice(device wgbackend.TUN) {
 	r.mu.Lock()
 	if r.closed.Load() {
 		r.mu.Unlock()

client/iface/device/wg_log.go

@@ -3,13 +3,13 @@ package device
 import (
 	"os"
 
-	"golang.zx2c4.com/wireguard/device"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func wgLogLevel() int {
 	if os.Getenv("NB_WG_DEBUG") == "true" {
-		return device.LogLevelVerbose
+		return wgbackend.LogLevelVerbose
 	} else {
-		return device.LogLevelSilent
+		return wgbackend.LogLevelSilent
 	}
 }

client/iface/device_android.go

@@ -1,13 +1,10 @@
 package iface
 
 import (
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type WGTunDevice interface {
@@ -19,8 +16,8 @@ type WGTunDevice interface {
 	DeviceName() string
 	Close() error
 	FilteredDevice() *device.FilteredDevice
-	Device() *wgdevice.Device
+	Device() *wgbackend.Device
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	RenewTun(fd int) error
 	GetICEBind() device.EndpointManager
 }

client/iface/iface.go

@@ -10,17 +10,15 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -271,7 +269,7 @@ func (w *WGIface) GetDevice() *device.FilteredDevice {
 }
 
 // GetWGDevice returns the WireGuard device
-func (w *WGIface) GetWGDevice() *wgdevice.Device {
+func (w *WGIface) GetWGDevice() *wgbackend.Device {
 	return w.tun.Device()
 }
 
@@ -344,7 +342,7 @@ func (w *WGIface) waitUntilRemoved() error {
 }
 
 // GetNet returns the netstack.Net for the netstack device
-func (w *WGIface) GetNet() *netstack.Net {
+func (w *WGIface) GetNet() *wgbackend.NetstackNet {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 

client/iface/iface_close_test.go

@@ -8,13 +8,11 @@ import (
 	"testing"
 	"time"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
@@ -40,8 +38,8 @@ func (f *fakeTunDevice) WgAddress() wgaddr.Address              { return wgaddr.
 func (f *fakeTunDevice) MTU() uint16                            { return DefaultMTU }
 func (f *fakeTunDevice) DeviceName() string                     { return "nb-close-test" }
 func (f *fakeTunDevice) FilteredDevice() *device.FilteredDevice { return nil }
-func (f *fakeTunDevice) Device() *wgdevice.Device               { return nil }
+func (f *fakeTunDevice) Device() *wgbackend.Device              { return nil }
-func (f *fakeTunDevice) GetNet() *netstack.Net                  { return nil }
+func (f *fakeTunDevice) GetNet() *wgbackend.NetstackNet         { return nil }
 func (f *fakeTunDevice) GetICEBind() device.EndpointManager     { return nil }
 
 func (f *fakeTunDevice) Close() error {

client/iface/mocks/tun.go

@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: golang.zx2c4.com/wireguard/tun (interfaces: Device)
+// Source: github.com/netbirdio/wireguard-go/tun (interfaces: Device)
 
 // Package mocks is a generated GoMock package.
 package mocks
@@ -8,8 +8,8 @@ import (
 	os "os"
 	reflect "reflect"
 
+	tun "github.com/netbirdio/wireguard-go/tun"
 	gomock "go.uber.org/mock/gomock"
-	tun "golang.zx2c4.com/wireguard/tun"
 )
 
 // MockDevice is a mock of Device interface.

client/iface/netstack/dialer.go

@@ -5,7 +5,8 @@ import (
 	"net"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type Dialer interface {
@@ -13,10 +14,10 @@ type Dialer interface {
 }
 
 type NSDialer struct {
-	net *netstack.Net
+	net *wgbackend.NetstackNet
 }
 
-func NewNSDialer(net *netstack.Net) *NSDialer {
+func NewNSDialer(net *wgbackend.NetstackNet) *NSDialer {
 	return &NSDialer{
 		net: net,
 	}

client/iface/netstack/tun.go

@@ -6,8 +6,8 @@ import (
 	"strconv"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
-	"golang.zx2c4.com/wireguard/tun/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const EnvSkipProxy = "NB_NETSTACK_SKIP_PROXY"
@@ -19,7 +19,7 @@ type NetStackTun struct { //nolint:revive
 	listenAddress string
 
 	proxy  *Proxy
-	tundev tun.Device
+	tundev wgbackend.TUN
 }
 
 func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress netip.Addr, mtu int) *NetStackTun {
@@ -31,8 +31,8 @@ func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress net
 	}
 }
 
-func (t *NetStackTun) Create() (tun.Device, *netstack.Net, error) {
+func (t *NetStackTun) Create() (wgbackend.TUN, *wgbackend.NetstackNet, error) {
-	nsTunDev, tunNet, err := netstack.CreateNetTUN(
+	nsTunDev, tunNet, err := wgbackend.CreateNetTUN(
 		t.addresses,
 		[]netip.Addr{t.dnsAddress},
 		t.mtu)

client/iface/udpmux/mux.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/logging"
 	"github.com/pion/stun/v3"
 	"github.com/pion/transport/v3"

client/iface/wgbackend/conn.go

@@ -0,0 +1,27 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/conn"
+
+type (
+	BatchReader    = conn.BatchReader
+	Bind           = conn.Bind
+	Endpoint       = conn.Endpoint
+	ReceiveFunc    = conn.ReceiveFunc
+	StdNetBind     = conn.StdNetBind
+	StdNetEndpoint = conn.StdNetEndpoint
+)
+
+const (
+	IdealBatchSize         = conn.IdealBatchSize
+	UdpSegmentMaxDatagrams = conn.UdpSegmentMaxDatagrams
+)
+
+var (
+	ControlFns                       = conn.ControlFns
+	GetGSOSize                       = conn.GetGSOSize
+	GetSrcFromControl                = conn.GetSrcFromControl
+	NewDefaultBind                   = conn.NewDefaultBind
+	NewStdNetBind                    = conn.NewStdNetBind
+	NewStdNetBindWithReceiverCreator = conn.NewStdNetBindWithReceiverCreator
+	SplitCoalescedMessages           = conn.SplitCoalescedMessages
+)

client/iface/wgbackend/device.go

@@ -0,0 +1,24 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/device"
+
+type (
+	Device            = device.Device
+	NoisePresharedKey = device.NoisePresharedKey
+	NoisePrivateKey   = device.NoisePrivateKey
+	NoisePublicKey    = device.NoisePublicKey
+	Peer              = device.Peer
+	PeerConfig        = device.PeerConfig
+)
+
+const (
+	LogLevelSilent  = device.LogLevelSilent
+	LogLevelVerbose = device.LogLevelVerbose
+)
+
+var (
+	NewDevice                     = device.NewDevice
+	NewLogger                     = device.NewLogger
+	SetMaxBatchSizeOverride       = device.SetMaxBatchSizeOverride
+	SetPreallocatedBuffersPerPool = device.SetPreallocatedBuffersPerPool
+)

client/iface/wgbackend/doc.go

@@ -0,0 +1,5 @@
+// Package wgbackend is the single place in the client's hand-written code that names
+// the WireGuard implementation. Other packages import it instead of the wireguard-go
+// packages, so swapping the implementation only touches the aliases here and the
+// generated mocks.
+package wgbackend

client/iface/wgbackend/ipc_unix.go

@@ -0,0 +1,10 @@
+//go:build linux || darwin || freebsd || openbsd
+
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/ipc"
+
+var (
+	UAPIListen = ipc.UAPIListen
+	UAPIOpen   = ipc.UAPIOpen
+)

client/iface/wgbackend/ipc_windows.go

@@ -0,0 +1,5 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/ipc"
+
+var UAPIListen = ipc.UAPIListen

client/iface/wgbackend/tun.go

@@ -0,0 +1,19 @@
+package wgbackend
+
+import (
+	"github.com/netbirdio/wireguard-go/tun"
+	"github.com/netbirdio/wireguard-go/tun/netstack"
+)
+
+type (
+	// TUN is the packet device the WireGuard device reads from and writes to.
+	TUN = tun.Device
+	// TUNEvent is a status change reported by a TUN.
+	TUNEvent = tun.Event
+	// NetstackNet is the userspace network stack a netstack TUN is attached to.
+	NetstackNet = netstack.Net
+)
+
+const TUNEventDown = tun.EventDown
+
+var CreateNetTUN = netstack.CreateNetTUN

client/iface/wgbackend/tun_linux.go

@@ -0,0 +1,5 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+var CreateUnmonitoredTUNFromFD = tun.CreateUnmonitoredTUNFromFD

client/iface/wgbackend/tun_unix.go

@@ -0,0 +1,10 @@
+//go:build linux || darwin || freebsd || openbsd
+
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+var (
+	CreateTUN         = tun.CreateTUN
+	CreateTUNFromFile = tun.CreateTUNFromFile
+)

client/iface/wgbackend/tun_windows.go

@@ -0,0 +1,7 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+type NativeTUN = tun.NativeTun
+
+var CreateTUNWithRequestedGUID = tun.CreateTUNWithRequestedGUID

client/internal/acl/mocks/iface_mapper.go

@@ -8,10 +8,10 @@ import (
 	reflect "reflect"
 
 	gomock "go.uber.org/mock/gomock"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // MockIFaceMapper is a mock of IFaceMapper interface.
@@ -108,10 +108,10 @@ func (mr *MockIFaceMapperMockRecorder) GetDevice() *gomock.Call {
 }
 
 // GetWGDevice mocks base method.
-func (m *MockIFaceMapper) GetWGDevice() *wgdevice.Device {
+func (m *MockIFaceMapper) GetWGDevice() *wgbackend.Device {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetWGDevice")
-	ret0, _ := ret[0].(*wgdevice.Device)
+	ret0, _ := ret[0].(*wgbackend.Device)
 	return ret0
 }
 

client/internal/dns/response_writer.go

@@ -7,14 +7,15 @@ import (
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type responseWriter struct {
 	local  net.Addr
 	remote net.Addr
 	packet gopacket.Packet
-	device tun.Device
+	device wgbackend.TUN
 }
 
 // LocalAddr returns the net.Addr of the server

client/internal/dns/server_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/firewall/uspfilter"
@@ -23,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/local"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
@@ -83,7 +83,7 @@ func (w *mocWGIface) GetStats(_ string) (configurer.WGStats, error) {
 	return configurer.WGStats{}, nil
 }
 
-func (w *mocWGIface) GetNet() *netstack.Net {
+func (w *mocWGIface) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/internal/dns/service_memory.go

@@ -108,7 +108,7 @@ func (s *ServiceViaMemory) filterDNSTraffic() error {
 	if s.tcpDNS == nil {
 		if dev := s.wgInterface.GetDevice(); dev != nil {
 			// MTU only affects TCP segment sizing; DNS messages are small so this has no practical impact.
-			s.tcpDNS = newTCPDNSServer(s.dnsMux, dev.Device, s.runtimeIP, uint16(s.runtimePort), iface.DefaultMTU)
+			s.tcpDNS = newTCPDNSServer(s.dnsMux, dev.TUN, s.runtimeIP, uint16(s.runtimePort), iface.DefaultMTU)
 		}
 	}
 
@@ -143,7 +143,7 @@ func (s *ServiceViaMemory) filterDNSTraffic() error {
 		writer := &responseWriter{
 			remote: remoteAddrFromPacket(packet),
 			packet: packet,
-			device: dev.Device,
+			device: dev.TUN,
 		}
 		go s.dnsMux.ServeDNS(writer, msg)
 		return true

client/internal/dns/tcpstack.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
@@ -21,6 +20,8 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const (
@@ -38,7 +39,7 @@ type tcpDNSServer struct {
 	s      *stack.Stack
 	ep     *dnsEndpoint
 	mux    *dns.ServeMux
-	tunDev tun.Device
+	tunDev wgbackend.TUN
 	ip     netip.Addr
 	port   uint16
 	mtu    uint16
@@ -49,7 +50,7 @@ type tcpDNSServer struct {
 	timer   *time.Timer
 }
 
-func newTCPDNSServer(mux *dns.ServeMux, tunDev tun.Device, ip netip.Addr, port uint16, mtu uint16) *tcpDNSServer {
+func newTCPDNSServer(mux *dns.ServeMux, tunDev wgbackend.TUN, ip netip.Addr, port uint16, mtu uint16) *tcpDNSServer {
 	return &tcpDNSServer{
 		mux:    mux,
 		tunDev: tunDev,
@@ -270,7 +271,7 @@ func (t *tcpDNSServer) handleTCPDNS(r *tcp.ForwarderRequest) {
 // dnsEndpoint implements stack.LinkEndpoint for writing packets back via the tun device.
 type dnsEndpoint struct {
 	dispatcher stack.NetworkDispatcher
-	tunDev     tun.Device
+	tunDev     wgbackend.TUN
 	mtu        atomic.Uint32
 }
 

client/internal/dns/upstream.go

@@ -44,10 +44,10 @@ import (
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -714,7 +714,7 @@ func toTCPClient(c *dns.Client) *dns.Client {
 
 // ExchangeWithNetstack performs a DNS exchange using netstack for dialing.
 // This is needed when netstack is enabled to reach peer IPs through the tunnel.
-func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream string) (*dns.Msg, error) {
+func ExchangeWithNetstack(ctx context.Context, nsNet *wgbackend.NetstackNet, r *dns.Msg, upstream string) (*dns.Msg, error) {
 	// If request came in over TCP, go straight to TCP upstream
 	if dnsProtocolFromContext(ctx) == protoTCP {
 		rm, err := netstackExchange(ctx, nsNet, r, upstream, protoTCP)
@@ -758,7 +758,7 @@ func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg,
 	return reply, nil
 }
 
-func netstackExchange(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream, network string) (*dns.Msg, error) {
+func netstackExchange(ctx context.Context, nsNet *wgbackend.NetstackNet, r *dns.Msg, upstream, network string) (*dns.Msg, error) {
 	conn, err := nsNet.DialContext(ctx, network, upstream)
 	if err != nil {
 		return nil, fmt.Errorf("with %s: %w", network, err)

client/internal/dns/upstream_general.go

@@ -9,15 +9,15 @@ import (
 	"time"
 
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 type upstreamResolver struct {
 	*upstreamResolverBase
-	nsNet *netstack.Net
+	nsNet *wgbackend.NetstackNet
 }
 
 func newUpstreamResolver(

client/internal/dns/upstream_test.go

@@ -13,10 +13,10 @@ import (
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 )
 
@@ -128,7 +128,7 @@ func (m *mockNetstackProvider) ToInterface() *net.Interface       { return nil }
 func (m *mockNetstackProvider) IsUserspaceBind() bool             { return false }
 func (m *mockNetstackProvider) GetFilter() device.PacketFilter    { return nil }
 func (m *mockNetstackProvider) GetDevice() *device.FilteredDevice { return nil }
-func (m *mockNetstackProvider) GetNet() *netstack.Net             { return nil }
+func (m *mockNetstackProvider) GetNet() *wgbackend.NetstackNet    { return nil }
 func (m *mockNetstackProvider) GetInterfaceGUIDString() (string, error) {
 	return "", nil
 }

client/internal/dns/wgiface.go

@@ -5,10 +5,9 @@ package dns
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGIface defines subset methods of interface required for manager
@@ -19,5 +18,5 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 }

client/internal/dns/wgiface_windows.go

@@ -1,10 +1,9 @@
 package dns
 
 import (
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGIface defines subset methods of interface required for manager
@@ -14,6 +13,6 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	GetInterfaceGUIDString() (string, error)
 }

client/internal/dnsfwd/forwarder.go

@@ -14,10 +14,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/route"
@@ -90,7 +90,7 @@ func NewDNSForwarder(listenAddress netip.AddrPort, ttl uint32, firewall firewall
 }
 
 func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
-	var netstackNet *netstack.Net
+	var netstackNet *wgbackend.NetstackNet
 	if f.wgIface != nil {
 		netstackNet = f.wgIface.GetNet()
 	}
@@ -153,7 +153,7 @@ func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
 	return <-errCh
 }
 
-func (f *DNSForwarder) createUDPListener(netstackNet *netstack.Net) (net.PacketConn, error) {
+func (f *DNSForwarder) createUDPListener(netstackNet *wgbackend.NetstackNet) (net.PacketConn, error) {
 	if netstackNet != nil {
 		return netstackNet.ListenUDPAddrPort(f.listenAddress)
 	}
@@ -161,7 +161,7 @@ func (f *DNSForwarder) createUDPListener(netstackNet *netstack.Net) (net.PacketC
 	return net.ListenUDP("udp", net.UDPAddrFromAddrPort(f.listenAddress))
 }
 
-func (f *DNSForwarder) createTCPListener(netstackNet *netstack.Net) (net.Listener, error) {
+func (f *DNSForwarder) createTCPListener(netstackNet *wgbackend.NetstackNet) (net.Listener, error) {
 	if netstackNet != nil {
 		return netstackNet.ListenTCPAddrPort(f.listenAddress)
 	}

client/internal/dnsfwd/manager.go

@@ -9,11 +9,11 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -28,7 +28,7 @@ const (
 
 // wgIface defines the interface for WireGuard interface operations needed by the DNS forwarder.
 type wgIface interface {
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	Address() wgaddr.Address
 }
 

client/internal/engine.go

@@ -18,11 +18,9 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-multierror"
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/stun/v3"
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/anonymize"
@@ -36,6 +34,7 @@ import (
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/acl"
 	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -245,7 +244,7 @@ type Engine struct {
 	// wgInterface. Reaching the device through wgInterface requires
 	// syncMsgMux, which handleSync holds while it adds and removes peers;
 	// SetPerformance must stay reachable exactly when that work is stuck.
-	wgDevice atomic.Pointer[wgdevice.Device]
+	wgDevice atomic.Pointer[wgbackend.Device]
 
 	udpMux *udpmux.UniversalUDPMuxDefault
 
@@ -2703,7 +2702,7 @@ func (e *Engine) stopDNSForwarder() {
 	e.dnsForwardMgr = nil
 }
 
-func (e *Engine) GetNet() (*netstack.Net, error) {
+func (e *Engine) GetNet() (*wgbackend.NetstackNet, error) {
 	e.syncMsgMux.Lock()
 	intf := e.wgInterface
 	e.syncMsgMux.Unlock()

client/internal/engine_test.go

@@ -14,10 +14,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -61,11 +60,11 @@ type MockWGIface struct {
 	SetFilterFunc              func(filter device.PacketFilter) error
 	GetFilterFunc              func() device.PacketFilter
 	GetDeviceFunc              func() *device.FilteredDevice
-	GetWGDeviceFunc            func() *wgdevice.Device
+	GetWGDeviceFunc            func() *wgbackend.Device
 	GetStatsFunc               func() (map[string]configurer.WGStats, error)
 	GetInterfaceGUIDStringFunc func() (string, error)
 	GetProxyFunc               func() wgproxy.Proxy
-	GetNetFunc                 func() *netstack.Net
+	GetNetFunc                 func() *wgbackend.NetstackNet
 	LastActivitiesFunc         func() map[string]monotime.Time
 }
 
@@ -149,7 +148,7 @@ func (m *MockWGIface) GetDevice() *device.FilteredDevice {
 	return m.GetDeviceFunc()
 }
 
-func (m *MockWGIface) GetWGDevice() *wgdevice.Device {
+func (m *MockWGIface) GetWGDevice() *wgbackend.Device {
 	return m.GetWGDeviceFunc()
 }
 
@@ -161,7 +160,7 @@ func (m *MockWGIface) GetProxy() wgproxy.Proxy {
 	return m.GetProxyFunc()
 }
 
-func (m *MockWGIface) GetNet() *netstack.Net {
+func (m *MockWGIface) GetNet() *wgbackend.NetstackNet {
 	return m.GetNetFunc()
 }
 

client/internal/iface_common.go

@@ -5,14 +5,13 @@ import (
 	"net/netip"
 	"time"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -37,9 +36,9 @@ type wgIfaceBase interface {
 	SetFilter(filter device.PacketFilter) error
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 	GetStats() (map[string]configurer.WGStats, error)
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	FullStats() (*configurer.Stats, error)
 	LastActivities() map[string]monotime.Time
 	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error

client/internal/peer/conn.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 

client/internal/peer/guard/ice_monitor.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"

client/internal/peer/ice/agent.go

@@ -6,7 +6,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/logging"
 	"github.com/pion/randutil"
 	log "github.com/sirupsen/logrus"

client/internal/peer/ice/config.go

@@ -1,7 +1,7 @@
 package ice
 
 import (
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )

client/internal/peer/signaler.go

@@ -1,7 +1,7 @@
 package peer
 
 import (
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 

client/internal/peer/worker_ice.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface"

client/internal/peer/worker_ice_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

client/internal/routemanager/iface/iface_common.go

@@ -4,10 +4,9 @@ import (
 	"net"
 	"net/netip"
 
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type wgIfaceBase interface {
@@ -20,5 +19,5 @@ type wgIfaceBase interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 }

client/internal/routemanager/reconcile_test.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
 )
 
@@ -48,7 +48,7 @@ func (m *reconcileWGMock) ToInterface() *net.Interface                { return n
 func (m *reconcileWGMock) IsUserspaceBind() bool                      { return false }
 func (m *reconcileWGMock) GetFilter() device.PacketFilter             { return nil }
 func (m *reconcileWGMock) GetDevice() *device.FilteredDevice          { return nil }
-func (m *reconcileWGMock) GetNet() *netstack.Net                      { return nil }
+func (m *reconcileWGMock) GetNet() *wgbackend.NetstackNet             { return nil }
 
 // TestReconcilePeerAllowedIPs verifies the declarative reconcile re-applies every routed prefix
 // tracked for the peer (self-heal, independent of refcount level) and stays scoped to that peer.

client/ssh/server/server.go

@@ -20,9 +20,9 @@ import (
 	log "github.com/sirupsen/logrus"
 	cryptossh "golang.org/x/crypto/ssh"
 	"golang.org/x/exp/maps"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/shared/auth"
@@ -167,7 +167,7 @@ type Server struct {
 	allowSFTP                 bool
 	jwtEnabled                bool
 
-	netstackNet *netstack.Net
+	netstackNet *wgbackend.NetstackNet
 
 	wgAddress wgaddr.Address
 
@@ -445,7 +445,7 @@ func (s *Server) buildSessionInfo(state *sessionState) SessionInfo {
 }
 
 // SetNetstackNet sets the netstack network for userspace networking
-func (s *Server) SetNetstackNet(net *netstack.Net) {
+func (s *Server) SetNetstackNet(net *wgbackend.NetstackNet) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.netstackNet = net

combined/cmd/admin.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/golang/protobuf v1.5.4
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
-	github.com/kardianos/service v1.2.3-0.20240613133416-becf2eb62b83
+	github.com/kardianos/service v1.3.0
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.34.1
 	github.com/rs/cors v1.8.0
@@ -23,7 +23,6 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	golang.org/x/crypto v0.55.0
 	golang.org/x/sys v0.47.0
-	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	golang.zx2c4.com/wireguard/windows v0.5.3
 	google.golang.org/grpc v1.80.0
@@ -48,8 +47,6 @@ require (
 	github.com/creack/pty v1.1.24
 	github.com/crowdsecurity/crowdsec v1.7.7
 	github.com/crowdsecurity/go-cs-bouncer v0.0.21
-	github.com/dexidp/dex v2.13.0+incompatible
-	github.com/dexidp/dex/api/v2 v2.4.0
 	github.com/docker/docker v28.0.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/ebitengine/purego v0.9.1
@@ -85,16 +82,19 @@ require (
 	github.com/miekg/dns v1.1.72
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/moby/api v1.54.1
+	github.com/netbirdio/dex v0.244.1-0.20261021152327-0319b501f1a6
+	github.com/netbirdio/dex/api/v2 v2.0.0-20261021115841-9f3e6d4c2ce3
 	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e
+	github.com/netbirdio/ice/v4 v4.0.0-20261021152109-d0e5dfacb548
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20261021190039-6c1585eb11de
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
+	github.com/netbirdio/wireguard-go v0.0.0-20261021152105-0de46b309cdb
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/ory/dockertest/v4 v4.0.0
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203
-	github.com/pion/ice/v4 v4.0.0-00010101000000-000000000000
 	github.com/pion/logging v0.2.4
 	github.com/pion/randutil v0.1.0
 	github.com/pion/stun/v2 v2.0.0
@@ -148,6 +148,8 @@ require (
 	howett.net/plist v1.0.2-0.20250314012144-ee69052608d9
 )
 
+require golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
+
 require (
 	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
@@ -363,20 +365,8 @@ require (
 	rsc.io/qr v0.2.0 // indirect
 )
 
-replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502
-
-replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949
-
-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0
-
 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 
-replace github.com/pion/ice/v4 => github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51
-
-replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5
-
-replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
-
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
 replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d

go.sum

@@ -424,6 +424,8 @@ github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/u
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
+github.com/kardianos/service v1.3.0 h1:/LGy+xPP2TM+GLTiCZ2di7cy0Jd/qrawlTUfqKYFdTI=
+github.com/kardianos/service v1.3.0/go.mod h1:E4V9ufUuY82F7Ztlu1eN9VXWIQxg8NoLQlmFe0MtrXc=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kevinburke/ssh_config v1.4.0 h1:6xxtP5bZ2E4NF5tuQulISpTO2z8XbtH8cg1PWkxoFkQ=
@@ -522,26 +524,24 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5 h1:3PwQv8aR46qN2u16+Dv6udnH3sbVKX5KrGwF35CKSI0=
+github.com/netbirdio/dex v0.244.1-0.20261021152327-0319b501f1a6 h1:DVyt4qYA79/4eVdw7BNKDCmR9wti2YT3iHvIdPiV4UI=
-github.com/netbirdio/dex v0.244.1-0.20260716205454-a163de3129e5/go.mod h1:IHH+H8vK2GfqtIt5u/5OdPh18yk0oDHuj2vz5+Goetg=
+github.com/netbirdio/dex v0.244.1-0.20261021152327-0319b501f1a6/go.mod h1:98h6OBd3fEU5lyQ5dhLWtSna5IUGjBz5awC0NmtS6s4=
-github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1 h1:neE7z+FPUkldl3faK/Jt+hJK2L+1XfQ1W33TQhU9m88=
+github.com/netbirdio/dex/api/v2 v2.0.0-20261021115841-9f3e6d4c2ce3 h1:5yuaucSBsXe/wcXTdjo2UKmY352xK3ESWzbwfOyuQvw=
-github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1/go.mod h1:awuTyT29CYALpEyET0S307EgNlPWrc7fFKRAyhsO45M=
+github.com/netbirdio/dex/api/v2 v2.0.0-20261021115841-9f3e6d4c2ce3/go.mod h1:SnT8viXNefO9j0z9gdfZ8vk7t1TJ2CmbJZkIL4fuDus=
 github.com/netbirdio/easyjson v0.9.0 h1:6Nw2lghSVuy8RSkAYDhDv1thBVEmfVbKZnV7T7Z6Aus=
 github.com/netbirdio/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8 h1:pBxXEsxcsO3qVUND//5j1kelYlO57x5IrRviNF0+0iA=
 github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8/go.mod h1:mFViabv4PpnoDw9w7W21a7xux6APA4q7KQZRsv4BCl8=
-github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
+github.com/netbirdio/ice/v4 v4.0.0-20261021152109-d0e5dfacb548 h1:dMRtLZZm7qpyfuw2uRKmCYySYz51wihEWY3JUYMpuK4=
-github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
+github.com/netbirdio/ice/v4 v4.0.0-20261021152109-d0e5dfacb548/go.mod h1:UsaaFHJPfIMNzvOybklN9AO3v/4YGj6bCC1vpmYA0vo=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e h1:SnDCreUnY+QDxKPueUoNrniMALCu2VFkXTCr/RIZjdg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261021190039-6c1585eb11de h1:aCmxkLAjH3pF/88eUAXp9yMOwGtcvNTC5Mqszm9xuo0=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261021190039-6c1585eb11de/go.mod h1:LLvpw/iWbXX9+7HF7ueqkyE7SoFaeqoCmbskOQL9gbs=
-github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
-github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d h1:DV0FHFhNAaU69JHXKclYQWr/ZJoc2BA/ZpqlnX8l22U=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d/go.mod h1:62UsqQRqanuCbFi6xElIw3/2X+yGF+TKlyiWImA5taU=
-github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0 h1:nCK1YzDybjbAfrx+C2QPmcQ+7jYj4Rcb3FskqTNZEXo=
+github.com/netbirdio/wireguard-go v0.0.0-20261021152105-0de46b309cdb h1:3X7pVeZeneq4MK7hvvqeSGi1ir6OElgIqHd6cI4KsXo=
-github.com/netbirdio/wireguard-go v0.0.0-20261016113635-bd0cb75a3df0/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+github.com/netbirdio/wireguard-go v0.0.0-20261021152105-0de46b309cdb/go.mod h1:Vk/c438m8FV2hHcT/6Efp8xe/JhHTzf3eUcuaohKKkw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
@@ -889,7 +889,6 @@ golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -969,6 +968,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=

idp/dex/config.go

@@ -14,9 +14,9 @@ import (
 	"golang.org/x/crypto/bcrypt"
 	"gopkg.in/yaml.v3"
 
-	"github.com/dexidp/dex/server"
+	"github.com/netbirdio/dex/server"
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
-	"github.com/dexidp/dex/storage/sql"
+	"github.com/netbirdio/dex/storage/sql"
 
 	"github.com/netbirdio/netbird/idp/dex/web"
 )

idp/dex/connector.go

@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 )
 
 // ConnectorConfig represents the configuration for an identity provider connector

idp/dex/connector_test.go

@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
-	"github.com/dexidp/dex/storage/sql"
+	"github.com/netbirdio/dex/storage/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

idp/dex/provider.go

@@ -16,12 +16,12 @@ import (
 	"sync"
 	"time"
 
-	dexapi "github.com/dexidp/dex/api/v2"
-	"github.com/dexidp/dex/server"
-	"github.com/dexidp/dex/server/signer"
-	"github.com/dexidp/dex/storage"
 	"github.com/go-jose/go-jose/v4"
 	"github.com/google/uuid"
+	dexapi "github.com/netbirdio/dex/api/v2"
+	"github.com/netbirdio/dex/server"
+	"github.com/netbirdio/dex/server/signer"
+	"github.com/netbirdio/dex/storage"
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/crypto/bcrypt"
 	"google.golang.org/grpc"

idp/dex/provider_test.go

@@ -12,9 +12,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
-	"github.com/dexidp/dex/storage/memory"
+	"github.com/netbirdio/dex/storage/memory"
-	sqllib "github.com/dexidp/dex/storage/sql"
+	sqllib "github.com/netbirdio/dex/storage/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

idp/dex/sqlite_cgo.go

@@ -3,7 +3,7 @@
 package dex
 
 import (
-	sql "github.com/dexidp/dex/storage/sql"
+	sql "github.com/netbirdio/dex/storage/sql"
 )
 
 // newSQLite3 builds the dex SQLite3 config. CGO builds use the upstream

idp/dex/sqlite_nocgo.go

@@ -3,7 +3,7 @@
 package dex
 
 import (
-	sql "github.com/dexidp/dex/storage/sql"
+	sql "github.com/netbirdio/dex/storage/sql"
 )
 
 // newSQLite3 for non-CGO builds. The dex SQLite3 stub has no fields and its

idp/sdk/sdk.go

@@ -4,7 +4,7 @@ package sdk
 import (
 	"context"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 
 	"github.com/netbirdio/netbird/idp/dex"
 )

management/cmd/admin.go

@@ -6,7 +6,7 @@ import (
 	"path"
 	"path/filepath"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 

management/cmd/admin/admin.go

@@ -13,7 +13,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/bcrypt"

management/cmd/admin/admin_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
-	"github.com/dexidp/dex/storage/memory"
+	"github.com/netbirdio/dex/storage/memory"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/bcrypt"

management/server/identity_provider.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 

management/server/idp/dex.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/dexidp/dex/api/v2"
+	"github.com/netbirdio/dex/api/v2"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/bcrypt"
 	"google.golang.org/grpc"

management/server/idp/embedded.go

@@ -11,8 +11,8 @@ import (
 	"path"
 	"strings"
 
-	"github.com/dexidp/dex/storage"
 	"github.com/google/uuid"
+	"github.com/netbirdio/dex/storage"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/idp/dex"

management/server/instance/manager.go

@@ -12,8 +12,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/dexidp/dex/storage"
 	goversion "github.com/hashicorp/go-version"
+	"github.com/netbirdio/dex/storage"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/server/idp"

management/server/instance/manager_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dexidp/dex/storage"
+	"github.com/netbirdio/dex/storage"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"