From ed8dcf598fd6c70ae39a7913f3c87579669116d2 Mon Sep 17 00:00:00 2001
From: pascal <pascal@netbird.io>
Date: Thu, 18 Jun 2026 00:29:33 +0200
Subject: [PATCH] revert meta

---
 management/server/peer.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/management/server/peer.go b/management/server/peer.go
index bc5e9a4fb..f5e5baffb 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1125,6 +1125,7 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.Peer
 
 	var peer *nbpeer.Peer
 	var shouldStorePeer bool
+	var ipv6CapabilityChanged bool
 	var peerGroupIDs []string
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
@@ -1159,6 +1160,17 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.Peer
 			return err
 		}
 
+		// Persist updated peer metadata (WireGuard version, OS, capabilities) on login.
+		// The stored version drives firewall feature selection (e.g. native SSH) and a
+		// metadata change must refresh remote peers.
+		oldHasIPv6Cap := peer.HasCapability(nbpeer.PeerCapabilityIPv6Overlay)
+		isPeerUpdated, _ := peer.UpdateMetaIfNew(login.Meta)
+		if isPeerUpdated {
+			am.metrics.AccountManagerMetrics().CountPeerMetUpdate()
+			shouldStorePeer = true
+		}
+		ipv6CapabilityChanged = oldHasIPv6Cap != peer.HasCapability(nbpeer.PeerCapabilityIPv6Overlay)
+
 		if peer.SSHKey != login.SSHKey {
 			peer.SSHKey = login.SSHKey
 			shouldStorePeer = true
@@ -1190,7 +1202,7 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.Peer
 		return nil, nil, nil, false, err
 	}
 
-	if isStatusChanged || shouldStorePeer {
+	if isStatusChanged || shouldStorePeer || ipv6CapabilityChanged {
 		changedPeerIDs := []string{peer.ID}
 		affectedPeerIDs := am.resolveAffectedPeersForPeerChanges(ctx, am.Store, accountID, changedPeerIDs)
 		if err = am.networkMapController.OnPeersUpdated(ctx, accountID, changedPeerIDs, affectedPeerIDs); err != nil {