[client] Create the WireGuard peer before the peer becomes routable

Split peer setup into a prepare and a start phase. AddPeerConn now only
registers the conn in the peer store and, in lazy mode, arms the wake
endpoint (creating the WireGuard peer) without starting any event
source. The peer is then registered in the status recorder, and
StartPeerConn starts the activity listener, opens the connection or
applies HA activation afterwards.

This closes the cold-start race where the route watcher, reacting to
the freshly registered idle peer, pushed routed allowed IPs before the
WireGuard peer existed: the update_only add was silently dropped while
the allowed-IP refcounter recorded the prefix as installed, so nothing
retried and traffic to the routed subnet stayed black-holed until the
peer was woken by other means.

Packets arriving on the armed wake endpoint before the listener starts
queue in the socket buffer, and no status write can land before the
recorder entry exists because no event source runs in between.

client/cmd/root.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"net"
 	"os"
 	"os/signal"
 	"path"
@@ -80,8 +79,6 @@ var (
 	updateSettingsDisabled bool
 	captureEnabled         bool
 	networksDisabled       bool
-	socketOwner            string
-	strictSocketDisabled   bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -146,12 +143,10 @@ func init() {
 
 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		// Named pipe (not loopback TCP): the pipe SDDL gates who may connect and
-		// the pipe client token carries the caller's SID for per-RPC authorization.
-		defaultDaemonAddr = "npipe://netbird"
+		defaultDaemonAddr = "tcp://127.0.0.1:41731"
 	}
 
-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -270,31 +265,16 @@ func FlagNameToEnvVar(cmdFlag string, prefix string) string {
 }
 
 // DialClientGRPCServer returns client connection to the daemon server.
-//
-// The daemon reads the caller's kernel identity from the transport (SO_PEERCRED
-// on a Unix socket, the client token on a Windows named pipe), so the client
-// side uses insecure (plaintext) credentials — it needs no cooperation to be
-// identified. For npipe addresses we install a context dialer since gRPC's
-// resolver does not understand Windows named pipes.
 func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, error) {
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()
 
-	opts := []grpc.DialOption{
+	return grpc.DialContext(
+		ctx,
+		strings.TrimPrefix(addr, "tcp://"),
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 		grpc.WithBlock(),
-	}
-
-	target := strings.TrimPrefix(addr, "tcp://")
-	if strings.HasPrefix(addr, "npipe://") {
-		path := pipePath(strings.TrimPrefix(addr, "npipe://"))
-		opts = append(opts, grpc.WithContextDialer(func(dialCtx context.Context, _ string) (net.Conn, error) {
-			return dialNamedPipe(dialCtx, path)
-		}))
-		target = "passthrough:///netbird-daemon-pipe"
-	}
-
-	return grpc.DialContext(ctx, target, opts...)
+	)
 }
 
 // WithBackOff execute function in backoff cycle.

client/cmd/service.go

@@ -56,9 +56,6 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
 	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
-	serviceCmd.PersistentFlags().StringVar(&socketOwner, "socket-owner", "", "user to own the daemon control socket; restricts it to that user plus the netbird group (0660). If unset, the first client to connect claims ownership (trust-on-first-use). Persisted via: netbird service install --socket-owner")
-	serviceCmd.PersistentFlags().BoolVar(&strictSocketDisabled, "disable-strict-socket", false, "leave the daemon control socket world-writable (0666) instead of restricting it (root-only, discouraged). Persisted via: netbird service install --disable-strict-socket")
-
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
 		`You can specify a comma-separated list of KEY=VALUE pairs. ` +

client/cmd/service_controller.go

@@ -5,7 +5,6 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"runtime"
 	"time"
 
 	"github.com/kardianos/service"
@@ -14,31 +13,12 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
 
-// daemonServerOptions returns the gRPC server options that install peer-identity
-// transport credentials on the daemon control channel. Identity extraction is
-// only possible over a Unix socket (SO_PEERCRED) or Windows named pipe (client
-// token); over TCP, or on platforms without a peer-credential primitive, the
-// daemon runs without per-caller authorization and logs a warning.
-func daemonServerOptions(network string) []grpc.ServerOption {
-	creds := ipcauth.NewTransportCredentials()
-	if creds == nil {
-		log.Warnf("daemon control channel has no peer-identity primitive on %s; per-caller authorization is disabled", runtime.GOOS)
-		return nil
-	}
-	if network == "tcp" {
-		log.Warnf("daemon is listening on TCP (%s); peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
-		return nil
-	}
-	return []grpc.ServerOption{grpc.Creds(creds)}
-}
-
 func validateJSONSocketFlags() error {
 	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
 		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
@@ -57,13 +37,8 @@ func (p *program) Start(svc service.Service) error {
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
-	network, _, err := parseListenAddress(daemonAddr)
-	if err != nil {
-		return fmt.Errorf("parse daemon address: %w", err)
-	}
-
-	// in any case, even if configuration does not exist we run daemon to serve the CLI gRPC API.
-	p.serv = grpc.NewServer(daemonServerOptions(network)...)
+	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
+	p.serv = grpc.NewServer()
 
 	daemonListener, err := listenOnAddress(daemonAddr)
 	if err != nil {
@@ -87,8 +62,7 @@ func (p *program) Start(svc service.Service) error {
 			defer jsonListener.Close()
 		}
 
-		serveListener, err := secureDaemonListener(daemonListener)
-		if err != nil {
+		if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
 			log.Error(err)
 			return
 		}
@@ -110,7 +84,6 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstanceMu.Unlock()
 
 		if jsonListener != nil {
-			log.Warnf("JSON gateway (--enable-json-socket) re-dials the daemon locally as the daemon's own identity and BYPASSES per-caller authorization; restrict access to %s separately", jsonSocket)
 			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
 				log.Fatalf("failed to start daemon JSON server: %v", err)
 			}
@@ -119,7 +92,7 @@ func (p *program) Start(svc service.Service) error {
 		}
 
 		log.Printf("started daemon server: %v", daemonListener.address)
-		if err := p.serv.Serve(serveListener); err != nil {
+		if err := p.serv.Serve(daemonListener.Listener); err != nil {
 			log.Errorf("failed to serve daemon requests: %v", err)
 		}
 	}()

client/cmd/service_installer.go

@@ -71,14 +71,6 @@ func buildServiceArguments() []string {
 		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
 	}
 
-	if socketOwner != "" {
-		args = append(args, "--socket-owner", socketOwner)
-	}
-
-	if strictSocketDisabled {
-		args = append(args, "--disable-strict-socket")
-	}
-
 	return args
 }
 

client/cmd/service_params.go

@@ -32,8 +32,6 @@ type serviceParams struct {
 	EnableCapture         bool              `json:"enable_capture,omitempty"`
 	DisableNetworks       bool              `json:"disable_networks,omitempty"`
 	EnableJSONSocket      bool              `json:"enable_json_socket,omitempty"`
-	SocketOwner           string            `json:"socket_owner,omitempty"`
-	DisableStrictSocket   bool              `json:"disable_strict_socket,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -88,8 +86,6 @@ func currentServiceParams() *serviceParams {
 		EnableCapture:         captureEnabled,
 		DisableNetworks:       networksDisabled,
 		EnableJSONSocket:      enableJSONSocket,
-		SocketOwner:           socketOwner,
-		DisableStrictSocket:   strictSocketDisabled,
 	}
 
 	if len(serviceEnvVars) > 0 {
@@ -169,14 +165,6 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		networksDisabled = params.DisableNetworks
 	}
 
-	if !serviceCmd.PersistentFlags().Changed("socket-owner") {
-		socketOwner = params.SocketOwner
-	}
-
-	if !serviceCmd.PersistentFlags().Changed("disable-strict-socket") {
-		strictSocketDisabled = params.DisableStrictSocket
-	}
-
 	applyServiceEnvParams(cmd, params)
 }
 

client/cmd/service_pipe_other.go

@@ -1,20 +0,0 @@
-//go:build !windows
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"runtime"
-)
-
-// listenNamedPipe is unsupported off Windows; named pipes are a Windows-only transport.
-func listenNamedPipe(string) (net.Listener, error) {
-	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
-}
-
-// dialNamedPipe is unsupported off Windows.
-func dialNamedPipe(context.Context, string) (net.Conn, error) {
-	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
-}

client/cmd/service_pipe_windows.go

@@ -1,32 +0,0 @@
-//go:build windows
-
-package cmd
-
-import (
-	"context"
-	"net"
-	"time"
-
-	"github.com/Microsoft/go-winio"
-
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-)
-
-// listenNamedPipe creates the daemon control named pipe with a tight SDDL
-// (SYSTEM + Administrators + interactive users). ListenPipe fails if the pipe
-// already exists (first-instance semantics), which prevents a squatting process
-// from pre-creating it — we surface that error loudly rather than falling back.
-func listenNamedPipe(path string) (net.Listener, error) {
-	return winio.ListenPipe(path, &winio.PipeConfig{
-		SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
-	})
-}
-
-// dialNamedPipe connects to the daemon control named pipe.
-func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
-	if deadline, ok := ctx.Deadline(); ok {
-		timeout := time.Until(deadline)
-		return winio.DialPipe(path, &timeout)
-	}
-	return winio.DialPipeContext(ctx, path)
-}

client/cmd/service_socket.go

@@ -26,15 +26,6 @@ func listenOnAddress(addr string) (*socketListener, error) {
 		return nil, err
 	}
 
-	if network == "npipe" {
-		path := pipePath(address)
-		listener, err := listenNamedPipe(path)
-		if err != nil {
-			return nil, err
-		}
-		return &socketListener{Listener: listener, network: network, address: path}, nil
-	}
-
 	if network == "unix" {
 		removeStaleUnixSocket(address)
 	}
@@ -54,23 +45,13 @@ func parseListenAddress(addr string) (string, string, error) {
 	}
 
 	switch network {
-	case "unix", "tcp", "npipe":
+	case "unix", "tcp":
 		return network, address, nil
 	default:
 		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
 	}
 }
 
-// pipePath maps a daemon-addr npipe name (e.g. "netbird" from "npipe://netbird")
-// to a Windows named-pipe path (\\.\pipe\netbird). A caller may also pass a full
-// \\.\pipe\ path, which is returned unchanged.
-func pipePath(name string) string {
-	if strings.HasPrefix(name, `\\`) {
-		return name
-	}
-	return `\\.\pipe\` + name
-}
-
 func removeStaleUnixSocket(path string) {
 	stat, err := os.Lstat(path)
 	if err != nil {

client/cmd/service_socket_perms_other.go

@@ -1,11 +0,0 @@
-//go:build windows
-
-package cmd
-
-import "net"
-
-// secureDaemonListener is a no-op on Windows: the named-pipe SDDL gates who may
-// connect (Layer 1), and the pipe client token supplies per-RPC identity.
-func secureDaemonListener(l *socketListener) (net.Listener, error) {
-	return l.Listener, nil
-}

client/cmd/service_socket_perms_unix.go

@@ -1,225 +0,0 @@
-//go:build !windows && !ios && !android
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"os/user"
-	"strconv"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/client/internal/shell"
-)
-
-// secureDaemonListener applies the Layer-1 access control to the daemon control
-// socket and returns the listener to serve on. For a Unix socket this restricts
-// the socket to an owner (plus the netbird group); for anything else it is a
-// no-op (TCP is legacy/unauthenticated; named pipes are gated by their SDDL).
-func secureDaemonListener(l *socketListener) (net.Listener, error) {
-	if l.network != "unix" {
-		return l.Listener, nil
-	}
-
-	owner := effectiveSocketOwner()
-	switch {
-	case strictSocketDisabled:
-		// Root-only opt-out (via service.json): leave it world-writable.
-		if err := os.Chmod(l.address, 0666); err != nil {
-			return nil, fmt.Errorf("set daemon socket permissions: %w", err)
-		}
-		log.Warnf("daemon control socket left world-writable (0666) by --disable-strict-socket")
-		return l.Listener, nil
-
-	case owner != "":
-		// Seeded owner (flag, MDM, or persisted TOFU result): restrict before
-		// serving so there is no open window.
-		uid, err := lookupUser(owner)
-		if err != nil {
-			return nil, fmt.Errorf("lookup socket owner %q: %w", owner, err)
-		}
-		if err := restrictSocket(l.address, uid); err != nil {
-			return nil, fmt.Errorf("restrict socket to %q: %w", owner, err)
-		}
-		return l.Listener, nil
-
-	default:
-		// Trust-on-first-use: open the socket now; tofuListener locks it to the
-		// first caller's uid on the first connection.
-		if err := os.Chmod(l.address, 0666); err != nil {
-			return nil, fmt.Errorf("set daemon socket permissions: %w", err)
-		}
-		return &tofuListener{Listener: l.Listener, path: l.address, owner: -1}, nil
-	}
-}
-
-func lookupUser(username string) (int, error) {
-	u, err := shell.LookupWithGetent(username)
-	if err != nil {
-		return -1, fmt.Errorf("lookup user %s: %w", username, err)
-	}
-	uid, err := strconv.Atoi(u.Uid)
-	if err != nil {
-		return -1, fmt.Errorf("parse uid %s: %w", u.Uid, err)
-	}
-	return uid, nil
-}
-
-// addGroup creates a system group if it doesn't already exist and returns the gid.
-// Must run as root.
-func addGroup(name string) (int, error) {
-	group, err := shell.LookupGroupWithGetent(name)
-	if err == nil {
-		gid, err := strconv.ParseInt(group.Gid, 10, 64)
-		return int(gid), err
-	}
-
-	groupadd, err := exec.LookPath("groupadd")
-	if err != nil {
-		// Fallback for Alpine/BusyBox systems.
-		if groupadd, err = exec.LookPath("addgroup"); err != nil {
-			return -1, errors.New("neither groupadd nor addgroup found")
-		}
-	}
-
-	// Use --system for a service/daemon group (no login, low GID).
-	out, err := exec.Command(groupadd, "--system", name).CombinedOutput()
-	if err != nil {
-		return -1, fmt.Errorf("create group %q: %w: %s", name, err, out)
-	}
-	if group, err := shell.LookupGroupWithGetent(name); err == nil {
-		gid, err := strconv.ParseInt(group.Gid, 10, 64)
-		return int(gid), err
-	}
-	return -1, fmt.Errorf("lookup group %q: %w", name, err)
-}
-
-// restrictSocket locks the unix socket down to the owner uid plus the netbird
-// group (0660). If the group cannot be created or applied, it fails closed to
-// owner-only 0600 — it never leaves the socket world-writable.
-func restrictSocket(path string, uid int) error {
-	gid, err := addGroup("netbird")
-	if err != nil {
-		log.Errorf("create netbird group, failing closed to owner-only 0600: %v", err)
-		return chownChmod(path, uid, -1, 0600)
-	}
-	if err := chownChmod(path, uid, gid, 0660); err != nil {
-		log.Errorf("apply netbird group to socket, failing closed to owner-only 0600: %v", err)
-		return chownChmod(path, uid, -1, 0600)
-	}
-	return nil
-}
-
-// chownChmod sets ownership and mode on the socket. A gid of -1 leaves the
-// group unchanged.
-func chownChmod(path string, uid, gid int, mode os.FileMode) error {
-	if err := os.Chown(path, uid, gid); err != nil {
-		return fmt.Errorf("chown socket %s: %w", path, err)
-	}
-	if err := os.Chmod(path, mode); err != nil {
-		return fmt.Errorf("chmod socket %s: %w", path, err)
-	}
-	return nil
-}
-
-// tofuListener implements trust-on-first-use for the daemon control socket.
-// The socket starts world-writable; the first caller's uid (read via SO_PEERCRED)
-// becomes the owner. On that first connection the socket is restricted and the
-// owner persisted so the open window never reopens on later starts. Connections
-// that raced in during the open window and are neither the owner nor root are
-// dropped. Changing the socket mode does not disturb the already-open
-// connection, so the first caller's request is served normally.
-type tofuListener struct {
-	net.Listener
-	path  string
-	mu    sync.Mutex
-	owner int // -1 until claimed
-}
-
-func (l *tofuListener) Accept() (net.Conn, error) {
-	for {
-		c, err := l.Listener.Accept()
-		if err != nil {
-			return nil, err
-		}
-
-		id, err := ipcauth.PeerIdentity(c)
-		if err != nil {
-			log.Errorf("read peer credentials, dropping connection: %v", err)
-			_ = c.Close()
-			continue
-		}
-		uid := int(id.UID)
-
-		l.mu.Lock()
-		if l.owner == -1 {
-			if err := restrictSocket(l.path, uid); err != nil {
-				l.mu.Unlock()
-				_ = c.Close()
-				// Refuse to serve on a socket we could not lock down.
-				return nil, fmt.Errorf("restrict socket on first connection: %w", err)
-			}
-			l.owner = uid
-			persistSocketOwner(uid)
-			log.Infof("control socket restricted to first caller (uid %d)", uid)
-			l.mu.Unlock()
-			return c, nil
-		}
-		owner := l.owner
-		l.mu.Unlock()
-
-		// New connects are already gated by the 0660 perms set above; this only
-		// drops anything that slipped in during the brief open window.
-		if uid != owner && uid != 0 {
-			log.Warnf("dropping non-owner connection (uid %d) during socket bootstrap", uid)
-			_ = c.Close()
-			continue
-		}
-		return c, nil
-	}
-}
-
-// effectiveSocketOwner returns the configured socket owner: the --socket-owner
-// flag when set, otherwise the owner persisted by a previous TOFU migration.
-func effectiveSocketOwner() string {
-	if socketOwner != "" {
-		return socketOwner
-	}
-	params, err := loadServiceParams()
-	if err != nil {
-		log.Errorf("load service params for socket owner: %v", err)
-		return ""
-	}
-	if params != nil {
-		return params.SocketOwner
-	}
-	return ""
-}
-
-// persistSocketOwner records the TOFU-selected owner (by username) so the next
-// daemon start restricts the socket immediately, with no open window.
-func persistSocketOwner(uid int) {
-	u, err := user.LookupId(strconv.Itoa(uid))
-	if err != nil {
-		log.Errorf("resolve uid %d to username for persistence: %v", uid, err)
-		return
-	}
-	params, err := loadServiceParams()
-	if err != nil {
-		log.Errorf("load service params to persist socket owner: %v", err)
-		return
-	}
-	if params == nil {
-		params = currentServiceParams()
-	}
-	params.SocketOwner = u.Username
-	if err := saveServiceParams(params); err != nil {
-		log.Errorf("persist socket owner: %v", err)
-	}
-}

client/iface/configurer/common.go

@@ -3,6 +3,7 @@ package configurer
 import (
 	"net"
 	"net/netip"
+	"time"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -19,6 +20,43 @@ func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bo
 	}
 }
 
+// buildIdlePeerEndpointConfig creates a config that removes and re-creates a peer in a
+// single transaction with the given allowed IPs, endpoint and disabled keepalive.
+func buildIdlePeerEndpointConfig(peerKey wgtypes.Key, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) wgtypes.Config {
+	keepAlive := time.Duration(0)
+	return wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{
+			{
+				PublicKey: peerKey,
+				Remove:    true,
+			},
+			{
+				PublicKey:                   peerKey,
+				AllowedIPs:                  prefixesToIPNets(allowedIPs),
+				Endpoint:                    endpoint,
+				PersistentKeepaliveInterval: &keepAlive,
+			},
+		},
+	}
+}
+
+// mergePrefixes returns the union of the two prefix lists, keeping the original order and
+// dropping duplicates.
+func mergePrefixes(current, base []netip.Prefix) []netip.Prefix {
+	merged := make([]netip.Prefix, 0, len(current)+len(base))
+	seen := make(map[netip.Prefix]struct{}, len(current)+len(base))
+	for _, group := range [][]netip.Prefix{current, base} {
+		for _, prefix := range group {
+			if _, ok := seen[prefix]; ok {
+				continue
+			}
+			seen[prefix] = struct{}{}
+			merged = append(merged, prefix)
+		}
+	}
+	return merged
+}
+
 func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
 	ipNets := make([]net.IPNet, len(prefixes))
 	for i, prefix := range prefixes {

client/iface/configurer/kernel_unix.go

@@ -3,6 +3,7 @@
 package configurer
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -145,6 +146,39 @@ func (c *KernelConfigurer) RemovePeer(peerKey string) error {
 	return nil
 }
 
+// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
+// handshake state while preserving the peer's currently installed allowed IPs.
+func (c *KernelConfigurer) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+
+	var current []netip.Prefix
+	existing, err := c.getPeer(c.deviceName, peerKey)
+	switch {
+	case errors.Is(err, ErrPeerNotFound):
+	case err != nil:
+		return fmt.Errorf("get peer: %w", err)
+	default:
+		for _, ipNet := range existing.AllowedIPs {
+			addr, ok := netip.AddrFromSlice(ipNet.IP)
+			if !ok {
+				log.Warnf("failed to convert allowed IP %s of peer %s", ipNet.String(), peerKey)
+				continue
+			}
+			ones, _ := ipNet.Mask.Size()
+			current = append(current, netip.PrefixFrom(addr.Unmap(), ones))
+		}
+	}
+
+	config := buildIdlePeerEndpointConfig(peerKeyParsed, mergePrefixes(current, allowedIPs), endpoint)
+	if err := c.configure(config); err != nil {
+		return fmt.Errorf(`received error "%w" while setting idle endpoint for peer %s on interface %s`, err, peerKey, c.deviceName)
+	}
+	return nil
+}
+
 func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	ipNet := net.IPNet{
 		IP:   allowedIP.Addr().AsSlice(),

client/iface/configurer/usp.go

@@ -210,6 +210,64 @@ func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 	return ipcErr
 }
 
+// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
+// handshake state while preserving the peer's currently installed allowed IPs.
+func (c *WGUSPConfigurer) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+
+	current, err := c.currentAllowedIPs(hex.EncodeToString(peerKeyParsed[:]))
+	if err != nil {
+		return fmt.Errorf("get current allowed IPs: %w", err)
+	}
+
+	config := buildIdlePeerEndpointConfig(peerKeyParsed, mergePrefixes(current, allowedIPs), endpoint)
+	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
+		return fmt.Errorf("set idle peer endpoint: %w", err)
+	}
+
+	if endpoint != nil {
+		addr, err := netip.ParseAddr(endpoint.IP.String())
+		if err != nil {
+			return fmt.Errorf("parse endpoint address: %w", err)
+		}
+		c.activityRecorder.UpsertAddress(peerKey, netip.AddrPortFrom(addr.Unmap(), uint16(endpoint.Port)))
+	}
+	return nil
+}
+
+// currentAllowedIPs returns the allowed IPs currently installed for the peer identified by
+// its hex-encoded public key. It returns an empty list when the peer does not exist.
+func (c *WGUSPConfigurer) currentAllowedIPs(hexKey string) ([]netip.Prefix, error) {
+	ipc, err := c.device.IpcGet()
+	if err != nil {
+		return nil, err
+	}
+
+	var prefixes []netip.Prefix
+	foundPeer := false
+	for _, line := range strings.Split(ipc, "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "public_key=") {
+			foundPeer = line == "public_key="+hexKey
+			continue
+		}
+		if !foundPeer || !strings.HasPrefix(line, "allowed_ip=") {
+			continue
+		}
+
+		prefix, err := netip.ParsePrefix(strings.TrimPrefix(line, "allowed_ip="))
+		if err != nil {
+			log.Warnf("failed to parse allowed IP %q: %v", line, err)
+			continue
+		}
+		prefixes = append(prefixes, prefix)
+	}
+	return prefixes, nil
+}
+
 func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	ipNet := net.IPNet{
 		IP:   allowedIP.Addr().AsSlice(),

client/iface/configurer/usp_idle_test.go

@@ -0,0 +1,158 @@
+package configurer
+
+import (
+	"encoding/hex"
+	"net"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	wgconn "golang.zx2c4.com/wireguard/conn"
+	"golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/tun/netstack"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/bind"
+)
+
+// newTestConfigurer creates a configurer backed by an in-memory wireguard-go device.
+func newTestConfigurer(t *testing.T) *WGUSPConfigurer {
+	t.Helper()
+
+	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, []netip.Addr{}, 1280)
+	require.NoError(t, err)
+
+	wgDev := device.NewDevice(tunDev, wgconn.NewDefaultBind(), device.NewLogger(device.LogLevelSilent, "[test] "))
+	t.Cleanup(wgDev.Close)
+
+	c := NewUSPConfigurerNoUAPI(wgDev, "utun-test", bind.NewActivityRecorder())
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	require.NoError(t, c.ConfigureInterface(key.String(), 0))
+
+	return c
+}
+
+// peerAllowedIPs returns the allowed IPs currently installed for the given peer.
+func peerAllowedIPs(t *testing.T, c *WGUSPConfigurer, pubKey string) []string {
+	t.Helper()
+
+	var ips []string
+	for _, line := range peerIpcLines(t, c, pubKey) {
+		if strings.HasPrefix(line, "allowed_ip=") {
+			ips = append(ips, strings.TrimPrefix(line, "allowed_ip="))
+		}
+	}
+	return ips
+}
+
+// peerEndpoint returns the endpoint currently installed for the given peer.
+func peerEndpoint(t *testing.T, c *WGUSPConfigurer, pubKey string) string {
+	t.Helper()
+
+	for _, line := range peerIpcLines(t, c, pubKey) {
+		if strings.HasPrefix(line, "endpoint=") {
+			return strings.TrimPrefix(line, "endpoint=")
+		}
+	}
+	return ""
+}
+
+// peerIpcLines returns the uapi config lines belonging to the given peer.
+func peerIpcLines(t *testing.T, c *WGUSPConfigurer, pubKey string) []string {
+	t.Helper()
+
+	key, err := wgtypes.ParseKey(pubKey)
+	require.NoError(t, err)
+	hexKey := hex.EncodeToString(key[:])
+
+	ipc, err := c.device.IpcGet()
+	require.NoError(t, err)
+
+	var lines []string
+	inPeer := false
+	for _, line := range strings.Split(ipc, "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "public_key=") {
+			inPeer = line == "public_key="+hexKey
+			continue
+		}
+		if inPeer && line != "" {
+			lines = append(lines, line)
+		}
+	}
+	return lines
+}
+
+// TestUSPConfigurer_IdlePeerEndpointPreservesAllowedIPs verifies the invariant the lazy idle
+// transition relies on: IdlePeerEndpoint re-creates the peer (dropping handshake state via the
+// remove+add transaction) while keeping every installed allowed IP, including routed
+// prefixes added later by the route manager, and points the endpoint at the wake listener.
+func TestUSPConfigurer_IdlePeerEndpointPreservesAllowedIPs(t *testing.T) {
+	c := newTestConfigurer(t)
+
+	peerKey, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	pubKey := peerKey.PublicKey().String()
+
+	overlay := netip.MustParsePrefix("100.64.0.5/32")
+	routed := netip.MustParsePrefix("10.99.0.0/24")
+
+	realEndpoint := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51821}
+	require.NoError(t, c.UpdatePeer(pubKey, []netip.Prefix{overlay}, 25*time.Second, realEndpoint, nil))
+	require.NoError(t, c.AddAllowedIP(pubKey, routed))
+
+	ips := peerAllowedIPs(t, c, pubKey)
+	require.Contains(t, ips, overlay.String(), "overlay prefix must be installed before the idle endpoint swap")
+	require.Contains(t, ips, routed.String(), "routed prefix must be installed before the idle endpoint swap")
+
+	wakeEndpoint := &net.UDPAddr{IP: net.ParseIP("127.2.0.5"), Port: 17473}
+	require.NoError(t, c.IdlePeerEndpoint(pubKey, []netip.Prefix{overlay}, wakeEndpoint))
+
+	ips = peerAllowedIPs(t, c, pubKey)
+	assert.Contains(t, ips, routed.String(), "routed prefix must survive the idle endpoint swap")
+	assert.Contains(t, ips, overlay.String(), "overlay prefix must survive the idle endpoint swap")
+	assert.Equal(t, "127.2.0.5:17473", peerEndpoint(t, c, pubKey), "endpoint must point at the wake listener after the idle endpoint swap")
+}
+
+// TestUSPConfigurer_IdlePeerEndpointCreatesMissingPeer verifies the cold-start arm path: when the
+// peer does not exist yet (never connected), IdlePeerEndpoint creates it with the given base
+// allowed IPs and the wake endpoint.
+func TestUSPConfigurer_IdlePeerEndpointCreatesMissingPeer(t *testing.T) {
+	c := newTestConfigurer(t)
+
+	peerKey, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	pubKey := peerKey.PublicKey().String()
+
+	overlay := netip.MustParsePrefix("100.64.0.5/32")
+	wakeEndpoint := &net.UDPAddr{IP: net.ParseIP("127.2.0.5"), Port: 17473}
+
+	require.NoError(t, c.IdlePeerEndpoint(pubKey, []netip.Prefix{overlay}, wakeEndpoint))
+
+	assert.Equal(t, []string{overlay.String()}, peerAllowedIPs(t, c, pubKey), "missing peer must be created with the base allowed IPs")
+	assert.Equal(t, "127.2.0.5:17473", peerEndpoint(t, c, pubKey), "missing peer must be created with the wake endpoint")
+}
+
+// TestUSPConfigurer_AddAllowedIPOnMissingPeerIsSilentNoOp documents the wireguard-go
+// behavior the removed-peer idle flow raced against: AddAllowedIP uses update_only,
+// which is a silent no-op when the peer does not exist. The idle transition must
+// therefore keep the WireGuard peer (Conn.Idle + IdlePeerEndpoint) instead of leaving a
+// window where the peer is absent.
+func TestUSPConfigurer_AddAllowedIPOnMissingPeerIsSilentNoOp(t *testing.T) {
+	c := newTestConfigurer(t)
+
+	peerKey, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	pubKey := peerKey.PublicKey().String()
+
+	routed := netip.MustParsePrefix("10.99.0.0/24")
+
+	require.NoError(t, c.AddAllowedIP(pubKey, routed), "update-only on a missing peer must not return an error")
+
+	assert.Empty(t, peerIpcLines(t, c, pubKey), "update-only call must not create the peer")
+}

client/iface/device/interface.go

@@ -15,6 +15,7 @@ type WGConfigurer interface {
 	ConfigureInterface(privateKey string, port int) error
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeer(peerKey string) error
+	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error

client/iface/iface.go

@@ -184,6 +184,19 @@ func (w *WGIface) RemovePeer(peerKey string) error {
 	return w.configurer.RemovePeer(peerKey)
 }
 
+// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
+// handshake state while preserving the peer's currently installed allowed IPs.
+func (w *WGIface) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.configurer == nil {
+		return ErrIfaceNotFound
+	}
+
+	log.Debugf("Resetting peer on interface %s: %s, endpoint %s", w.tun.DeviceName(), peerKey, endpoint)
+	return w.configurer.IdlePeerEndpoint(peerKey, allowedIPs, endpoint)
+}
+
 // AddAllowedIP adds a prefix to the allowed IPs list of peer
 func (w *WGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	w.mu.Lock()

client/internal/conn_mgr.go

@@ -176,23 +176,20 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }
 
-func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn) (exists bool) {
+// AddPeerConn registers the conn in the peer store and, in lazy mode, arms the wake endpoint.
+// It starts no connection activity; the caller calls StartPeerConn after registering the peer
+// in the status recorder.
+func (e *ConnMgr) AddPeerConn(peerKey string, conn *peer.Conn) (exists bool) {
 	if success := e.peerStore.AddPeerConn(peerKey, conn); !success {
 		return true
 	}
 
 	if !e.isStartedWithLazyMgr() {
-		if err := conn.Open(ctx); err != nil {
-			conn.Log.Errorf("failed to open connection: %v", err)
-		}
 		return
 	}
 
 	if !lazyconn.IsSupported(conn.AgentVersionString()) {
-		conn.Log.Warnf("peer does not support lazy connection (%s), open permanent connection", conn.AgentVersionString())
-		if err := conn.Open(ctx); err != nil {
-			conn.Log.Errorf("failed to open connection: %v", err)
-		}
+		conn.Log.Warnf("peer does not support lazy connection (%s), will open permanent connection", conn.AgentVersionString())
 		return
 	}
 
@@ -204,18 +201,12 @@ func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Co
 	}
 	excluded, err := e.lazyConnMgr.AddPeer(lazyPeerCfg)
 	if err != nil {
-		conn.Log.Errorf("failed to add peer to lazyconn manager: %v", err)
-		if err := conn.Open(ctx); err != nil {
-			conn.Log.Errorf("failed to open connection: %v", err)
-		}
+		conn.Log.Errorf("failed to add peer to lazyconn manager, will open permanent connection: %v", err)
 		return
 	}
 
 	if excluded {
-		conn.Log.Infof("peer is on lazy conn manager exclude list, opening connection")
-		if err := conn.Open(ctx); err != nil {
-			conn.Log.Errorf("failed to open connection: %v", err)
-		}
+		conn.Log.Infof("peer is on lazy conn manager exclude list, will open permanent connection")
 		return
 	}
 
@@ -223,12 +214,29 @@ func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Co
 	return
 }
 
+// StartPeerConn starts the activity prepared by AddPeerConn: lazy wake listening or a
+// permanent connection.
+func (e *ConnMgr) StartPeerConn(ctx context.Context, peerKey string) {
+	conn, ok := e.peerStore.PeerConn(peerKey)
+	if !ok {
+		return
+	}
+
+	if e.isStartedWithLazyMgr() && e.lazyConnMgr.StartPeer(peerKey) {
+		return
+	}
+
+	if err := conn.Open(ctx); err != nil {
+		conn.Log.Errorf("failed to open connection: %v", err)
+	}
+}
+
 func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn, ok := e.peerStore.Remove(peerKey)
 	if !ok {
 		return
 	}
-	defer conn.Close(false)
+	defer conn.Close()
 
 	if !e.isStartedWithLazyMgr() {
 		return

client/internal/engine.go

@@ -1771,16 +1771,20 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 		return fmt.Errorf("create peer connection: %w", err)
 	}
 
+	// Order matters: the WireGuard peer must exist before the peer becomes visible in the
+	// status recorder, and event sources may start only after the recorder registration.
+	if exists := e.connMgr.AddPeerConn(peerKey, conn); exists {
+		conn.Close()
+		return fmt.Errorf("peer already exists: %s", peerKey)
+	}
+
 	peerV4, peerV6 := overlayAddrsFromAllowedIPs(peerConfig.GetAllowedIps(), e.wgInterface.Address().IPv6Net)
 	err = e.statusRecorder.AddPeer(peerKey, peerConfig.Fqdn, addrToString(peerV4), addrToString(peerV6))
 	if err != nil {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}
 
-	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn); exists {
-		conn.Close(false)
-		return fmt.Errorf("peer already exists: %s", peerKey)
-	}
+	e.connMgr.StartPeerConn(e.ctx, peerKey)
 
 	return nil
 }

client/internal/engine_test.go

@@ -53,6 +53,7 @@ type MockWGIface struct {
 	UpdateAddrFunc             func(newAddr wgaddr.Address) error
 	UpdatePeerFunc             func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeerFunc             func(peerKey string) error
+	IdlePeerEndpointFunc       func(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIPFunc           func(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIPFunc        func(peerKey string, allowedIP netip.Prefix) error
 	CloseFunc                  func() error
@@ -124,6 +125,13 @@ func (m *MockWGIface) RemovePeer(peerKey string) error {
 	return m.RemovePeerFunc(peerKey)
 }
 
+func (m *MockWGIface) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
+	if m.IdlePeerEndpointFunc == nil {
+		return nil
+	}
+	return m.IdlePeerEndpointFunc(peerKey, allowedIPs, endpoint)
+}
+
 func (m *MockWGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	return m.AddAllowedIPFunc(peerKey, allowedIP)
 }

client/internal/iface_common.go

@@ -32,6 +32,7 @@ type wgIfaceBase interface {
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemoveEndpointAddress(key string) error
 	RemovePeer(peerKey string) error
+	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	Close() error

client/internal/ipcauth/creds_stub.go

@@ -1,13 +0,0 @@
-//go:build !linux && !darwin && !freebsd && !windows
-
-package ipcauth
-
-import "google.golang.org/grpc/credentials"
-
-// NewTransportCredentials returns nil on platforms without a peer-identity
-// primitive. The daemon falls back to insecure credentials and skips per-RPC
-// authorization (logging a warning), preserving pre-hardening behavior until
-// the transport gains an identity primitive.
-func NewTransportCredentials() credentials.TransportCredentials {
-	return nil
-}

client/internal/ipcauth/creds_unix.go

@@ -1,48 +0,0 @@
-//go:build linux || darwin || freebsd
-
-package ipcauth
-
-import (
-	"context"
-	"net"
-
-	"google.golang.org/grpc/credentials"
-)
-
-// NewTransportCredentials returns gRPC transport credentials that extract the
-// caller's kernel-authenticated identity from a Unix-socket connection and
-// expose it via IdentityFromContext. It is non-nil on platforms with a
-// peer-credential primitive.
-func NewTransportCredentials() credentials.TransportCredentials {
-	return unixCreds{}
-}
-
-// unixCreds implements credentials.TransportCredentials over a Unix socket.
-// The server side reads SO_PEERCRED/LOCAL_PEERCRED during the handshake; the
-// client side is a no-op (the kernel supplies the peer identity to the server
-// without any client cooperation).
-type unixCreds struct{}
-
-func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
-	return conn, AuthInfo{}, nil
-}
-
-// ServerHandshake extracts the peer identity and fails closed if it cannot be read.
-func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
-	id, err := PeerIdentity(conn)
-	if err != nil {
-		return nil, nil, err
-	}
-	return conn, AuthInfo{
-		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
-		Identity:       id,
-	}, nil
-}
-
-func (unixCreds) Info() credentials.ProtocolInfo {
-	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
-}
-
-func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
-
-func (unixCreds) OverrideServerName(string) error { return nil }

client/internal/ipcauth/creds_windows.go

@@ -1,142 +0,0 @@
-//go:build windows
-
-package ipcauth
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"runtime"
-
-	"golang.org/x/sys/windows"
-	"google.golang.org/grpc/credentials"
-)
-
-var (
-	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
-	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
-	procRevertToSelf               = modadvapi32.NewProc("RevertToSelf")
-)
-
-// Windows group-SID attribute flags (winnt.h): a group only counts toward
-// membership when it is enabled and not marked use-for-deny-only.
-const (
-	seGroupEnabled        = 0x00000004
-	seGroupUseForDenyOnly = 0x00000010
-)
-
-// DefaultPipeSDDL restricts the daemon control pipe to LocalSystem (SY), the
-// Administrators group (BA), and interactive logon users (IU). It deliberately
-// excludes Authenticated Users / Everyone so remote or arbitrary service
-// principals cannot connect. This is the Layer-1 channel gate; the interceptor
-// (Layer 2) further restricts by per-profile ownership.
-func DefaultPipeSDDL() string {
-	return "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;IU)"
-}
-
-// NewTransportCredentials returns gRPC transport credentials that derive the
-// caller's identity from the named-pipe client token, following Microsoft's
-// "Verifying Client Access with ACLs" pattern: ImpersonateNamedPipeClient ->
-// OpenThreadToken -> RevertToSelf. Per threat-model M-NOIMP, impersonation is
-// used only to read the client token for identity, never to perform privileged work.
-func NewTransportCredentials() credentials.TransportCredentials {
-	return winpipeCreds{}
-}
-
-type winpipeCreds struct{}
-
-func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
-	return conn, AuthInfo{}, nil
-}
-
-// ServerHandshake extracts the connecting client's identity from the pipe token.
-// Fails closed if the handle or token cannot be read.
-func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
-	// go-winio's pipe connection embeds *win32File, which exposes Fd().
-	fdConn, ok := conn.(interface{ Fd() uintptr })
-	if !ok {
-		return nil, nil, fmt.Errorf("connection %T does not expose a pipe handle", conn)
-	}
-	handle := windows.Handle(fdConn.Fd())
-
-	id, err := pipeClientIdentity(handle)
-	if err != nil {
-		return nil, nil, err
-	}
-	return conn, AuthInfo{
-		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
-		Identity:       id,
-	}, nil
-}
-
-func (winpipeCreds) Info() credentials.ProtocolInfo {
-	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
-}
-
-func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
-
-func (winpipeCreds) OverrideServerName(string) error { return nil }
-
-// pipeClientIdentity reads the connecting client's user SID and enabled group
-// SIDs from the named-pipe handle. The impersonation window is kept as small as
-// possible and pinned to the OS thread (impersonation is thread-local).
-func pipeClientIdentity(handle windows.Handle) (Identity, error) {
-	var pid uint32
-	hasPID := windows.GetNamedPipeClientProcessId(handle, &pid) == nil
-
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	if err := impersonateNamedPipeClient(handle); err != nil {
-		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
-	}
-	defer func() { _ = revertToSelf() }()
-
-	// openAsSelf=true: the token is opened using the daemon's process context
-	// (LocalSystem), not the impersonated client's, so the open always succeeds.
-	var token windows.Token
-	if err := windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
-		return Identity{}, fmt.Errorf("open thread token: %w", err)
-	}
-	defer token.Close()
-
-	tu, err := token.GetTokenUser()
-	if err != nil {
-		return Identity{}, fmt.Errorf("get token user: %w", err)
-	}
-
-	tg, err := token.GetTokenGroups()
-	if err != nil {
-		return Identity{}, fmt.Errorf("get token groups: %w", err)
-	}
-	var groups []string
-	for _, g := range tg.AllGroups() {
-		if g.Attributes&seGroupEnabled == 0 || g.Attributes&seGroupUseForDenyOnly != 0 {
-			continue
-		}
-		groups = append(groups, g.Sid.String())
-	}
-
-	return Identity{
-		SID:    tu.User.Sid.String(),
-		Groups: groups,
-		PID:    int32(pid),
-		HasPID: hasPID,
-	}, nil
-}
-
-func impersonateNamedPipeClient(h windows.Handle) error {
-	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
-	if r == 0 {
-		return e
-	}
-	return nil
-}
-
-func revertToSelf() error {
-	r, _, e := procRevertToSelf.Call()
-	if r == 0 {
-		return e
-	}
-	return nil
-}

client/internal/ipcauth/identity.go

@@ -1,93 +0,0 @@
-// Package ipcauth provides kernel-authenticated caller identity for the daemon's
-// local IPC (gRPC) channel and the transport credentials that populate it.
-//
-// It is the identity foundation shared by two layers of the local-IPC hardening:
-//   - the socket-permission layer (Layer 1, client/cmd), which reads the peer
-//     identity to gate who may connect and to run trust-on-first-use; and
-//   - the per-RPC authorization interceptor (Layer 2), which reads the same
-//     identity from the gRPC context to enforce per-profile ownership.
-//
-// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
-// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the named-pipe
-// client token. Platforms without a peer-identity primitive get no credentials
-// and therefore no enforcement (the daemon logs a warning and stays open,
-// preserving today's behavior until the transport is hardened).
-package ipcauth
-
-import (
-	"context"
-	"fmt"
-
-	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/peer"
-)
-
-// Identity is the kernel-authenticated identity of a local IPC caller.
-//
-// The zero value is not a valid identity; callers obtain one via
-// IdentityFromContext (which reports presence) or PeerIdentity.
-type Identity struct {
-	// UID and GID are the caller's Unix user ID and primary group ID.
-	// Zero on Windows, where SID is authoritative instead.
-	UID uint32
-	GID uint32
-
-	// PID is the caller's process ID, for audit only. HasPID is false when the
-	// platform cannot supply it (e.g. Darwin/FreeBSD xucred carries no PID).
-	PID    int32
-	HasPID bool
-
-	// SID is the caller's Windows security identifier (empty on Unix).
-	SID string
-
-	// Groups holds the caller's Windows group SIDs, captured from the client
-	// token at handshake time (empty on Unix, where supplementary group
-	// membership is resolved on demand via NSS/getent by the authorizer).
-	Groups []string
-}
-
-// IsWindows reports whether this identity is a Windows principal (SID-based)
-// rather than a Unix uid/gid principal.
-func (i Identity) IsWindows() bool {
-	return i.SID != ""
-}
-
-// String renders the identity for audit logs.
-func (i Identity) String() string {
-	if i.IsWindows() {
-		if i.HasPID {
-			return fmt.Sprintf("sid=%s pid=%d", i.SID, i.PID)
-		}
-		return fmt.Sprintf("sid=%s", i.SID)
-	}
-	if i.HasPID {
-		return fmt.Sprintf("uid=%d gid=%d pid=%d", i.UID, i.GID, i.PID)
-	}
-	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
-}
-
-// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so the
-// interceptor can retrieve it from the request context via IdentityFromContext.
-type AuthInfo struct {
-	credentials.CommonAuthInfo
-	Identity Identity
-}
-
-// AuthType identifies the authentication scheme.
-func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
-
-// IdentityFromContext extracts the caller's kernel-authenticated identity from
-// the gRPC peer context. The second return value is false when no IPC transport
-// credentials were negotiated (e.g. an unsupported platform, or a caller that
-// did not come through the daemon socket) — callers MUST fail closed in that case.
-func IdentityFromContext(ctx context.Context) (Identity, bool) {
-	p, ok := peer.FromContext(ctx)
-	if !ok {
-		return Identity{}, false
-	}
-	info, ok := p.AuthInfo.(AuthInfo)
-	if !ok {
-		return Identity{}, false
-	}
-	return info.Identity, true
-}

client/internal/ipcauth/identity_test.go

@@ -1,47 +0,0 @@
-package ipcauth
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/peer"
-)
-
-func TestIdentityFromContext_NoPeer(t *testing.T) {
-	_, ok := IdentityFromContext(context.Background())
-	assert.False(t, ok, "bare context must report no identity (fail closed)")
-}
-
-func TestIdentityFromContext_WrongAuthInfo(t *testing.T) {
-	ctx := peer.NewContext(context.Background(), &peer.Peer{})
-	_, ok := IdentityFromContext(ctx)
-	assert.False(t, ok, "peer without our AuthInfo must report no identity")
-}
-
-func TestIdentityFromContext_Present(t *testing.T) {
-	want := Identity{UID: 1000, GID: 1000, PID: 4242, HasPID: true}
-	ctx := peer.NewContext(context.Background(), &peer.Peer{
-		AuthInfo: AuthInfo{
-			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
-			Identity:       want,
-		},
-	})
-
-	got, ok := IdentityFromContext(ctx)
-	assert.True(t, ok)
-	assert.Equal(t, want, got)
-}
-
-func TestIdentity_String(t *testing.T) {
-	assert.Equal(t, "uid=1000 gid=1000 pid=42", Identity{UID: 1000, GID: 1000, PID: 42, HasPID: true}.String())
-	assert.Equal(t, "uid=1000 gid=1000", Identity{UID: 1000, GID: 1000}.String())
-	assert.Equal(t, "sid=S-1-5-21-1 pid=42", Identity{SID: "S-1-5-21-1", PID: 42, HasPID: true}.String())
-	assert.Equal(t, "sid=S-1-5-21-1", Identity{SID: "S-1-5-21-1"}.String())
-}
-
-func TestIdentity_IsWindows(t *testing.T) {
-	assert.True(t, Identity{SID: "S-1-5-18"}.IsWindows())
-	assert.False(t, Identity{UID: 0}.IsWindows())
-}

client/internal/ipcauth/peercred_bsd.go

@@ -1,43 +0,0 @@
-//go:build darwin || freebsd
-
-package ipcauth
-
-import (
-	"fmt"
-	"net"
-
-	"golang.org/x/sys/unix"
-)
-
-// PeerIdentity reads the kernel-authenticated identity of the process on the
-// other end of a Unix socket connection via LOCAL_PEERCRED (xucred). xucred
-// carries the uid and group list but no pid, so audit on these platforms is
-// uid/gid-based (HasPID is false); PID via LOCAL_PEERPID is a possible follow-up.
-func PeerIdentity(c net.Conn) (Identity, error) {
-	uc, ok := c.(*net.UnixConn)
-	if !ok {
-		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
-	}
-	raw, err := uc.SyscallConn()
-	if err != nil {
-		return Identity{}, fmt.Errorf("raw conn: %w", err)
-	}
-
-	var cred *unix.Xucred
-	var credErr error
-	if err := raw.Control(func(fd uintptr) {
-		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
-	}); err != nil {
-		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
-	}
-	if credErr != nil {
-		return Identity{}, fmt.Errorf("LOCAL_PEERCRED: %w", credErr)
-	}
-
-	id := Identity{UID: cred.Uid}
-	// Groups[0] is the effective (primary) GID; guard against an empty list.
-	if cred.Ngroups > 0 {
-		id.GID = cred.Groups[0]
-	}
-	return id, nil
-}

client/internal/ipcauth/peercred_linux.go

@@ -1,43 +0,0 @@
-//go:build linux
-
-package ipcauth
-
-import (
-	"fmt"
-	"net"
-
-	"golang.org/x/sys/unix"
-)
-
-// PeerIdentity reads the kernel-authenticated identity of the process on the
-// other end of a Unix socket connection via SO_PEERCRED. The credentials are
-// captured by the kernel at connect() time and cannot be spoofed or changed for
-// the life of the connection.
-func PeerIdentity(c net.Conn) (Identity, error) {
-	uc, ok := c.(*net.UnixConn)
-	if !ok {
-		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
-	}
-	raw, err := uc.SyscallConn()
-	if err != nil {
-		return Identity{}, fmt.Errorf("raw conn: %w", err)
-	}
-
-	var cred *unix.Ucred
-	var credErr error
-	if err := raw.Control(func(fd uintptr) {
-		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
-	}); err != nil {
-		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
-	}
-	if credErr != nil {
-		return Identity{}, fmt.Errorf("SO_PEERCRED: %w", credErr)
-	}
-
-	return Identity{
-		UID:    cred.Uid,
-		GID:    cred.Gid,
-		PID:    cred.Pid,
-		HasPID: true,
-	}, nil
-}

client/internal/ipcauth/peercred_stub.go

@@ -1,16 +0,0 @@
-//go:build !linux && !darwin && !freebsd
-
-package ipcauth
-
-import (
-	"fmt"
-	"net"
-	"runtime"
-)
-
-// PeerIdentity is unimplemented on platforms without a Unix-socket peer-credential
-// primitive. Windows derives identity from the named-pipe client token instead
-// (see the Windows transport credentials), so it never calls this.
-func PeerIdentity(net.Conn) (Identity, error) {
-	return Identity{}, fmt.Errorf("peer credential check not supported on %s", runtime.GOOS)
-}

client/internal/ipcauth/peercred_unix_test.go

@@ -1,113 +0,0 @@
-//go:build linux || darwin || freebsd
-
-package ipcauth
-
-import (
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestPeerIdentity_MatchesCurrentProcess connects to a real Unix socket and
-// verifies the extracted UID/GID match the running process (both ends are us).
-func TestPeerIdentity_MatchesCurrentProcess(t *testing.T) {
-	sock := filepath.Join(t.TempDir(), "peer.sock")
-	ln, err := net.Listen("unix", sock)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = ln.Close() })
-
-	type result struct {
-		id  Identity
-		err error
-	}
-	done := make(chan result, 1)
-	go func() {
-		c, aerr := ln.Accept()
-		if aerr != nil {
-			done <- result{err: aerr}
-			return
-		}
-		defer func() { _ = c.Close() }()
-		id, ierr := PeerIdentity(c)
-		done <- result{id: id, err: ierr}
-	}()
-
-	client, err := net.Dial("unix", sock)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = client.Close() })
-
-	res := <-done
-	require.NoError(t, res.err)
-	assert.Equal(t, uint32(os.Getuid()), res.id.UID, "UID should match current process")
-	assert.Equal(t, uint32(os.Getgid()), res.id.GID, "primary GID should match current process")
-}
-
-// TestPeerIdentity_NonUnixConn rejects non-Unix connections (fail closed).
-func TestPeerIdentity_NonUnixConn(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = ln.Close() })
-
-	done := make(chan error, 1)
-	go func() {
-		c, aerr := ln.Accept()
-		if aerr != nil {
-			done <- aerr
-			return
-		}
-		defer func() { _ = c.Close() }()
-		_, ierr := PeerIdentity(c)
-		done <- ierr
-	}()
-
-	client, err := net.Dial("tcp", ln.Addr().String())
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = client.Close() })
-
-	assert.Error(t, <-done, "PeerIdentity must reject a non-Unix connection")
-}
-
-// TestUnixCreds_ServerHandshake exercises the transport-credentials path end to end.
-func TestUnixCreds_ServerHandshake(t *testing.T) {
-	creds := NewTransportCredentials()
-	require.NotNil(t, creds)
-
-	sock := filepath.Join(t.TempDir(), "hs.sock")
-	ln, err := net.Listen("unix", sock)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = ln.Close() })
-
-	type result struct {
-		info interface{ AuthType() string }
-		err  error
-	}
-	done := make(chan result, 1)
-	go func() {
-		c, aerr := ln.Accept()
-		if aerr != nil {
-			done <- result{err: aerr}
-			return
-		}
-		_, ai, herr := creds.ServerHandshake(c)
-		if herr != nil {
-			done <- result{err: herr}
-			return
-		}
-		done <- result{info: ai}
-	}()
-
-	client, err := net.Dial("unix", sock)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = client.Close() })
-
-	res := <-done
-	require.NoError(t, res.err)
-	ai, ok := res.info.(AuthInfo)
-	require.True(t, ok, "expected ipcauth.AuthInfo, got %T", res.info)
-	assert.Equal(t, uint32(os.Getuid()), ai.Identity.UID)
-	assert.Equal(t, "netbird-ipc-peercred", ai.AuthType())
-}

client/internal/lazyconn/activity/listener_bind.go

@@ -106,7 +106,7 @@ func (d *BindListener) setupLazyConn() error {
 		IP:   d.fakeIP.AsSlice(),
 		Port: lazyBindPort,
 	}
-	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, endpoint, nil)
+	return d.wgIface.IdlePeerEndpoint(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, endpoint)
 }
 
 // ReadPackets blocks until activity is detected on the LazyConn or the listener is closed.

client/internal/lazyconn/activity/listener_bind_test.go

@@ -9,7 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
@@ -45,7 +44,7 @@ type MockWGIfaceBind struct {
 	endpointMgr *mockEndpointManager
 }
 
-func (m *MockWGIfaceBind) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
+func (m *MockWGIfaceBind) IdlePeerEndpoint(string, []netip.Prefix, *net.UDPAddr) error {
 	return nil
 }
 

client/internal/lazyconn/activity/listener_udp.go

@@ -101,7 +101,7 @@ func (d *UDPListener) Close() {
 
 func (d *UDPListener) createEndpoint() error {
 	d.peerCfg.Log.Debugf("creating lazy endpoint: %s", d.endpoint.String())
-	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, d.endpoint, nil)
+	return d.wgIface.IdlePeerEndpoint(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, d.endpoint)
 }
 
 func (d *UDPListener) newConn() (*net.UDPConn, error) {

client/internal/lazyconn/activity/manager.go

@@ -5,10 +5,8 @@ import (
 	"net"
 	"net/netip"
 	"sync"
-	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
@@ -30,18 +28,23 @@ type Event struct {
 }
 
 type WgInterface interface {
-	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
 	MTU() uint16
 }
 
+type managedListener struct {
+	l       listener
+	started bool
+}
+
 type Manager struct {
 	OnActivityChan chan Event
 
 	wgIface WgInterface
 
-	peers map[peerid.ConnID]listener
+	peers map[peerid.ConnID]*managedListener
 	done  chan struct{}
 
 	mu sync.Mutex
@@ -51,13 +54,24 @@ func NewManager(wgIface WgInterface) *Manager {
 	m := &Manager{
 		OnActivityChan: make(chan Event, 1),
 		wgIface:        wgIface,
-		peers:          make(map[peerid.ConnID]listener),
+		peers:          make(map[peerid.ConnID]*managedListener),
 		done:           make(chan struct{}),
 	}
 	return m
 }
 
+// MonitorPeerActivity creates the peer's activity listener and starts consuming traffic on it.
 func (m *Manager) MonitorPeerActivity(peerCfg lazyconn.PeerConfig) error {
+	if err := m.CreatePeerListener(peerCfg); err != nil {
+		return err
+	}
+	m.StartPeerListener(peerCfg.PeerConnID)
+	return nil
+}
+
+// CreatePeerListener arms the wake endpoint without starting to consume traffic; packets queue
+// in the listener socket until StartPeerListener runs.
+func (m *Manager) CreatePeerListener(peerCfg lazyconn.PeerConfig) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -71,11 +85,23 @@ func (m *Manager) MonitorPeerActivity(peerCfg lazyconn.PeerConfig) error {
 		return err
 	}
 
-	m.peers[peerCfg.PeerConnID] = listener
-	go m.waitForTraffic(listener, peerCfg.PeerConnID)
+	m.peers[peerCfg.PeerConnID] = &managedListener{l: listener}
 	return nil
 }
 
+// StartPeerListener starts consuming traffic on the peer's armed activity listener.
+func (m *Manager) StartPeerListener(peerConnID peerid.ConnID) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ml, ok := m.peers[peerConnID]
+	if !ok || ml.started {
+		return
+	}
+	ml.started = true
+	go m.waitForTraffic(ml.l, peerConnID)
+}
+
 func (m *Manager) createListener(peerCfg lazyconn.PeerConfig) (listener, error) {
 	if !m.wgIface.IsUserspaceBind() {
 		return NewUDPListener(m.wgIface, peerCfg)
@@ -93,13 +119,13 @@ func (m *Manager) RemovePeer(log *log.Entry, peerConnID peerid.ConnID) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	listener, ok := m.peers[peerConnID]
+	ml, ok := m.peers[peerConnID]
 	if !ok {
 		return
 	}
 	log.Debugf("removing activity listener")
 	delete(m.peers, peerConnID)
-	listener.Close()
+	closeListener(ml)
 }
 
 func (m *Manager) Close() {
@@ -107,12 +133,22 @@ func (m *Manager) Close() {
 	defer m.mu.Unlock()
 
 	close(m.done)
-	for peerID, listener := range m.peers {
+	for peerID, ml := range m.peers {
 		delete(m.peers, peerID)
-		listener.Close()
+		closeListener(ml)
 	}
 }
 
+// closeListener closes the listener. Close waits for the reader goroutine, so for a
+// never-started listener the reader is launched first; outside waitForTraffic it cannot emit events.
+func closeListener(ml *managedListener) {
+	if !ml.started {
+		ml.started = true
+		go ml.l.ReadPackets()
+	}
+	ml.l.Close()
+}
+
 func (m *Manager) waitForTraffic(l listener, peerConnID peerid.ConnID) {
 	l.ReadPackets()
 

client/internal/lazyconn/activity/manager_test.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
@@ -26,7 +25,7 @@ func (m *MocPeer) ConnID() peerid.ConnID {
 type MocWGIface struct {
 }
 
-func (m MocWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
+func (m MocWGIface) IdlePeerEndpoint(string, []netip.Prefix, *net.UDPAddr) error {
 	return nil
 }
 
@@ -50,8 +49,11 @@ func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (listener, bool) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	l, exists := m.peers[peerConnID]
-	return l, exists
+	ml, exists := m.peers[peerConnID]
+	if !exists {
+		return nil, false
+	}
+	return ml.l, true
 }
 
 func TestManager_MonitorPeerActivity(t *testing.T) {

client/internal/lazyconn/manager/manager.go

@@ -185,6 +185,7 @@ func (m *Manager) ExcludePeer(peerConfigs []lazyconn.PeerConfig) []string {
 	return added
 }
 
+// AddPeer arms the peer's wake endpoint without starting to consume traffic on it.
 func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 	m.managedPeersMu.Lock()
 	defer m.managedPeersMu.Unlock()
@@ -201,7 +202,7 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		return false, nil
 	}
 
-	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
+	if err := m.activityManager.CreatePeerListener(peerCfg); err != nil {
 		return false, err
 	}
 
@@ -211,13 +212,29 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		expectedWatcher: watcherActivity,
 	}
 
-	// Check if this peer should be activated because its HA group peers are active
-	if group, ok := m.shouldActivateNewPeer(peerCfg.PublicKey); ok {
-		peerCfg.Log.Debugf("peer belongs to active HA group %s, will activate immediately", group)
-		m.activateNewPeerInActiveGroup(peerCfg)
+	return false, nil
+}
+
+// StartPeer starts the peer's activity listener and applies HA activation. It reports whether
+// the peer is managed by the lazy manager.
+func (m *Manager) StartPeer(peerKey string) bool {
+	m.managedPeersMu.Lock()
+	defer m.managedPeersMu.Unlock()
+
+	peerCfg, ok := m.managedPeers[peerKey]
+	if !ok {
+		return false
 	}
 
-	return false, nil
+	m.activityManager.StartPeerListener(peerCfg.PeerConnID)
+
+	// Check if this peer should be activated because its HA group peers are active
+	if group, ok := m.shouldActivateNewPeer(peerKey); ok {
+		peerCfg.Log.Debugf("peer belongs to active HA group %s, will activate immediately", group)
+		m.activateNewPeerInActiveGroup(*peerCfg)
+	}
+
+	return true
 }
 
 // AddActivePeers adds a list of peers to the lazy connection manager
@@ -280,7 +297,7 @@ func (m *Manager) DeactivatePeer(peerID peerid.ConnID) {
 		return
 	}
 
-	m.peerStore.PeerConnClose(mp.peerCfg.PublicKey)
+	m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey, false)
 
 	mp.peerCfg.Log.Infof("start activity monitor")
 
@@ -569,7 +586,7 @@ func (m *Manager) onPeerInactivityTimedOut(peerIDs map[string]struct{}) {
 		mp.peerCfg.Log.Infof("connection timed out")
 
 		// this is blocking operation, potentially can be optimized
-		m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey)
+		m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey, true)
 
 		mp.expectedWatcher = watcherActivity
 

client/internal/lazyconn/wgiface.go

@@ -3,9 +3,6 @@ package lazyconn
 import (
 	"net"
 	"net/netip"
-	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/monotime"
@@ -13,7 +10,7 @@ import (
 
 type WGIface interface {
 	RemovePeer(peerKey string) error
-	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
 	LastActivities() map[string]monotime.Time

client/internal/peer/conn.go

@@ -285,8 +285,20 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 	return nil
 }
 
-// Close closes this peer Conn issuing a close event to the Conn closeCh
-func (conn *Conn) Close(signalToRemote bool) {
+// Close closes this peer Conn issuing a close event to the Conn closeCh and removes the WireGuard peer
+func (conn *Conn) Close() {
+	conn.close(false, true)
+}
+
+// Idle tears down the connection for the lazy idle state: transports and proxies are
+// closed but the WireGuard peer is kept, so its AllowedIPs (including routed prefixes
+// installed by the route manager) survive until the activity listener re-points the
+// endpoint at the wake listener.
+func (conn *Conn) Idle(signalToRemote bool) {
+	conn.close(signalToRemote, false)
+}
+
+func (conn *Conn) close(signalToRemote bool, removeWgPeer bool) {
 	conn.mu.Lock()
 	defer conn.wgWatcherWg.Wait()
 	defer conn.mu.Unlock()
@@ -329,8 +341,12 @@ func (conn *Conn) Close(signalToRemote bool) {
 		conn.wgProxyICE = nil
 	}
 
-	if err := conn.endpointUpdater.RemoveWgPeer(); err != nil {
-		conn.Log.Errorf("failed to remove wg endpoint: %v", err)
+	if removeWgPeer {
+		if err := conn.endpointUpdater.RemoveWgPeer(); err != nil {
+			conn.Log.Errorf("failed to remove wg endpoint: %v", err)
+		}
+	} else {
+		conn.endpointUpdater.CancelPendingUpdates()
 	}
 
 	if conn.evalStatus() == StatusConnected && conn.onDisconnected != nil {

client/internal/peer/endpoint.go

@@ -65,6 +65,16 @@ func (e *EndpointUpdater) RemoveWgPeer() error {
 	return e.wgConfig.WgInterface.RemovePeer(e.wgConfig.RemoteKey)
 }
 
+// CancelPendingUpdates stops a scheduled delayed endpoint update without touching the
+// WireGuard peer. Used on the idle transition where the peer is kept so a pending
+// responder-side update cannot overwrite the wake endpoint later.
+func (e *EndpointUpdater) CancelPendingUpdates() {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	e.waitForCloseTheDelayedUpdate()
+}
+
 func (e *EndpointUpdater) RemoveEndpointAddress() error {
 	e.mu.Lock()
 	defer e.mu.Unlock()

client/internal/peer/endpoint_test.go

@@ -0,0 +1,101 @@
+package peer
+
+import (
+	"net"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+type endpointTestWGIface struct {
+	mu          sync.Mutex
+	updateCalls int
+	removeCalls int
+}
+
+func (m *endpointTestWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.updateCalls++
+	return nil
+}
+
+func (m *endpointTestWGIface) RemovePeer(string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.removeCalls++
+	return nil
+}
+
+func (m *endpointTestWGIface) GetStats() (map[string]configurer.WGStats, error) {
+	return map[string]configurer.WGStats{}, nil
+}
+
+func (m *endpointTestWGIface) GetProxy() wgproxy.Proxy { return nil }
+
+func (m *endpointTestWGIface) Address() wgaddr.Address { return wgaddr.Address{} }
+
+func (m *endpointTestWGIface) RemoveEndpointAddress(string) error { return nil }
+
+func (m *endpointTestWGIface) counts() (updates, removes int) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.updateCalls, m.removeCalls
+}
+
+func newTestEndpointUpdater(iface *endpointTestWGIface, initiator bool) *EndpointUpdater {
+	cfg := WgConfig{
+		RemoteKey:   "remoteKey",
+		WgInterface: iface,
+		AllowedIps:  []netip.Prefix{netip.MustParsePrefix("100.64.0.5/32")},
+	}
+	return NewEndpointUpdater(log.WithField("peer", "test"), cfg, initiator)
+}
+
+// TestEndpointUpdater_CancelPendingUpdates ensures a scheduled responder-side delayed
+// update is stopped without removing the WireGuard peer, so an idle transition cannot
+// be overwritten later by a stale endpoint update.
+func TestEndpointUpdater_CancelPendingUpdates(t *testing.T) {
+	iface := &endpointTestWGIface{}
+	e := newTestEndpointUpdater(iface, false)
+
+	addr := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51820}
+	require.NoError(t, e.ConfigureWGEndpoint(addr, nil))
+
+	updates, _ := iface.counts()
+	require.Equal(t, 1, updates, "responder must apply the immediate nil-endpoint update")
+
+	// CancelPendingUpdates waits for the delayed-update goroutine to exit, so the
+	// call counts below are final: the 5s fallback update can never fire anymore.
+	e.CancelPendingUpdates()
+
+	updates, removes := iface.counts()
+	assert.Equal(t, 1, updates, "delayed endpoint update must not fire after cancellation")
+	assert.Equal(t, 0, removes, "cancellation must not remove the WireGuard peer")
+}
+
+// TestEndpointUpdater_CancelPendingUpdatesNoPending ensures cancellation is a safe no-op
+// when no delayed update is scheduled (initiator path).
+func TestEndpointUpdater_CancelPendingUpdatesNoPending(t *testing.T) {
+	iface := &endpointTestWGIface{}
+	e := newTestEndpointUpdater(iface, true)
+
+	addr := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51820}
+	require.NoError(t, e.ConfigureWGEndpoint(addr, nil))
+
+	e.CancelPendingUpdates()
+
+	updates, removes := iface.counts()
+	assert.Equal(t, 1, updates, "initiator applies exactly one direct update")
+	assert.Equal(t, 0, removes, "cancellation must not remove the WireGuard peer")
+}

client/internal/peerstore/store.go

@@ -108,7 +108,10 @@ func (s *Store) PeerConnOpenWithFirstPacket(ctx context.Context, pubKey string,
 	}
 }
 
-func (s *Store) PeerConnIdle(pubKey string) {
+// PeerConnIdle transitions the peer connection to the lazy idle state, keeping the
+// WireGuard peer and its AllowedIPs in place. signalToRemote indicates whether the
+// remote peer should be notified (false when the remote initiated the idle via GOAWAY).
+func (s *Store) PeerConnIdle(pubKey string, signalToRemote bool) {
 	s.peerConnsMu.RLock()
 	defer s.peerConnsMu.RUnlock()
 
@@ -116,18 +119,7 @@ func (s *Store) PeerConnIdle(pubKey string) {
 	if !ok {
 		return
 	}
-	p.Close(true)
-}
-
-func (s *Store) PeerConnClose(pubKey string) {
-	s.peerConnsMu.RLock()
-	defer s.peerConnsMu.RUnlock()
-
-	p, ok := s.peerConns[pubKey]
-	if !ok {
-		return
-	}
-	p.Close(false)
+	p.Idle(signalToRemote)
 }
 
 func (s *Store) PeersPubKey() []string {

client/internal/shell/getent_cgo_unix.go

@@ -1,29 +0,0 @@
-//go:build cgo && !osusergo && !windows
-
-package shell
-
-import "os/user"
-
-// LookupWithGetent with CGO delegates directly to os/user.Lookup.
-// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
-// the NSS stack natively. If it fails, the user truly doesn't exist and
-// getent would also fail.
-func LookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// CurrentUserWithGetent with CGO delegates directly to os/user.Current.
-func CurrentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// LookupGroupWithGetent returns the resolved group from either a gid or groupname.
-func LookupGroupWithGetent(name string) (*user.Group, error) {
-	return user.LookupGroup(name)
-}
-
-// GroupIdsWithFallback with CGO delegates directly to user.GroupIds.
-// libc's getgrouplist handles NSS groups natively.
-func GroupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/internal/shell/getent_windows.go

@@ -1,31 +0,0 @@
-//go:build windows
-
-package shell
-
-import "os/user"
-
-// LookupWithGetent on Windows just delegates to os/user.Lookup.
-// Windows does not use NSS/getent; its user lookup works without CGO.
-func LookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// CurrentUserWithGetent on Windows just delegates to os/user.Current.
-func CurrentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// LookupGroupWithGetent on Windows just delegates to os/user.LookupGroup.
-func LookupGroupWithGetent(name string) (*user.Group, error) {
-	return user.LookupGroup(name)
-}
-
-// GetShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
-func GetShellFromGetent(_ string) string {
-	return ""
-}
-
-// GroupIdsWithFallback on Windows just delegates to u.GroupIds().
-func GroupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/ssh/server/command_execution_unix.go

@@ -20,8 +20,6 @@ import (
 	"github.com/creack/pty"
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
-
-	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // ptyManager manages Pty file operations with thread safety
@@ -148,10 +146,10 @@ func (s *Server) createShellCommand(ctx context.Context, shell string, args []st
 
 // prepareCommandEnv prepares environment variables for command execution on Unix
 func (s *Server) prepareCommandEnv(_ *log.Entry, localUser *user.User, session ssh.Session) []string {
-	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
+	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if shellutil.AcceptEnv(v) {
+		if acceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/command_execution_windows.go

@@ -15,7 +15,6 @@ import (
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
 
-	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 	"github.com/netbirdio/netbird/client/ssh/server/winpty"
 )
 
@@ -248,10 +247,10 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
-		env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
+		env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
 		env = append(env, prepareSSHEnv(session)...)
 		for _, v := range session.Environ() {
-			if shellutil.AcceptEnv(v) {
+			if acceptEnv(v) {
 				env = append(env, v)
 			}
 		}
@@ -261,7 +260,7 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	env := userEnv
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if shellutil.AcceptEnv(v) {
+		if acceptEnv(v) {
 			env = append(env, v)
 		}
 	}
@@ -274,7 +273,7 @@ func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, privileg
 		return false
 	}
 
-	shell := shellutil.GetUserShell(privilegeResult.User.Uid)
+	shell := getUserShell(privilegeResult.User.Uid)
 	logger.Infof("starting interactive shell: %s", shell)
 
 	s.executeCommandWithPty(logger, session, nil, privilegeResult, ptyReq, nil)
@@ -385,7 +384,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 	}
 
 	username, domain := s.parseUsername(localUser.Username)
-	shell := shellutil.GetUserShell(localUser.Uid)
+	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{
 		Shell:    shell,

client/ssh/server/getent_cgo_unix.go

@@ -0,0 +1,24 @@
+//go:build cgo && !osusergo && !windows
+
+package server
+
+import "os/user"
+
+// lookupWithGetent with CGO delegates directly to os/user.Lookup.
+// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
+// the NSS stack natively. If it fails, the user truly doesn't exist and
+// getent would also fail.
+func lookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// currentUserWithGetent with CGO delegates directly to os/user.Current.
+func currentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// groupIdsWithFallback with CGO delegates directly to user.GroupIds.
+// libc's getgrouplist handles NSS groups natively.
+func groupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/ssh/server/getent_nocgo_unix.go

@@ -1,6 +1,6 @@
 //go:build (!cgo || osusergo) && !windows
 
-package shell
+package server
 
 import (
 	"os"
@@ -10,10 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// LookupWithGetent looks up a user by name, falling back to getent if os/user fails.
+// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
 // Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
 // getent goes through the host's NSS stack.
-func LookupWithGetent(username string) (*user.User, error) {
+func lookupWithGetent(username string) (*user.User, error) {
 	u, err := user.Lookup(username)
 	if err == nil {
 		return u, nil
@@ -22,7 +22,7 @@ func LookupWithGetent(username string) (*user.User, error) {
 	stdErr := err
 	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
 
-	u, _, getentErr := runGetentPasswd(username)
+	u, _, getentErr := runGetent(username)
 	if getentErr != nil {
 		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
 		return nil, stdErr
@@ -31,26 +31,8 @@ func LookupWithGetent(username string) (*user.User, error) {
 	return u, nil
 }
 
-// LookupGroupWithGetent returns the resolved group from either a gid or groupname,
-// falling back to getent if os/user fails (NSS groups under nocgo).
-func LookupGroupWithGetent(name string) (*user.Group, error) {
-	g, err := user.LookupGroup(name)
-	if err == nil {
-		return g, nil
-	}
-
-	stdErr := err
-	log.Debugf("os/user.LookupGroup(%q) failed, trying getent: %v", name, err)
-	g, getentErr := runGetentGroup(name)
-	if getentErr != nil {
-		log.Debugf("getent fallback for %q also failed: %v", name, getentErr)
-		return nil, stdErr
-	}
-	return g, nil
-}
-
-// CurrentUserWithGetent gets the current user, falling back to getent if os/user fails.
-func CurrentUserWithGetent() (*user.User, error) {
+// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
+func currentUserWithGetent() (*user.User, error) {
 	u, err := user.Current()
 	if err == nil {
 		return u, nil
@@ -60,7 +42,7 @@ func CurrentUserWithGetent() (*user.User, error) {
 	uid := strconv.Itoa(os.Getuid())
 	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
 
-	u, _, getentErr := runGetentPasswd(uid)
+	u, _, getentErr := runGetent(uid)
 	if getentErr != nil {
 		return nil, stdErr
 	}
@@ -68,14 +50,14 @@ func CurrentUserWithGetent() (*user.User, error) {
 	return u, nil
 }
 
-// GroupIdsWithFallback gets group IDs for a user via the id command first,
+// groupIdsWithFallback gets group IDs for a user via the id command first,
 // falling back to user.GroupIds().
-// NOTE: unlike LookupWithGetent/CurrentUserWithGetent which try stdlib first,
+// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
 // this intentionally tries `id -G` first because without CGO, user.GroupIds()
 // only reads /etc/group and silently returns incomplete results for NSS users
 // (no error, just missing groups). The id command goes through NSS and returns
 // the full set.
-func GroupIdsWithFallback(u *user.User) ([]string, error) {
+func groupIdsWithFallback(u *user.User) ([]string, error) {
 	ids, err := runIdGroups(u.Username)
 	if err == nil {
 		return ids, nil

client/ssh/server/getent_test.go

@@ -1,4 +1,4 @@
-package shell
+package server
 
 import (
 	"os/user"
@@ -15,7 +15,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := LookupWithGetent(current.Username)
+	u, err := lookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Username, u.Username)
 	assert.Equal(t, current.Uid, u.Uid)
@@ -23,7 +23,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 }
 
 func TestLookupWithGetent_NonexistentUser(t *testing.T) {
-	_, err := LookupWithGetent("nonexistent_user_xyzzy_12345")
+	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
 	require.Error(t, err, "should fail for nonexistent user")
 }
 
@@ -31,7 +31,7 @@ func TestCurrentUserWithGetent(t *testing.T) {
 	stdUser, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := CurrentUserWithGetent()
+	u, err := currentUserWithGetent()
 	require.NoError(t, err)
 	assert.Equal(t, stdUser.Uid, u.Uid)
 	assert.Equal(t, stdUser.Username, u.Username)
@@ -41,7 +41,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	groups, err := GroupIdsWithFallback(current)
+	groups, err := groupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")
 
@@ -56,7 +56,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		// Windows stub always returns empty, which is correct
-		shell := GetShellFromGetent("1000")
+		shell := getShellFromGetent("1000")
 		assert.Empty(t, shell, "Windows stub should return empty")
 		return
 	}
@@ -65,9 +65,9 @@ func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	require.NoError(t, err)
 
 	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
-	shell := GetShellFromGetent(current.Uid)
+	shell := getShellFromGetent(current.Uid)
 	if shell == "" {
-		t.Log("GetShellFromGetent returned empty, getent may not be available")
+		t.Log("getShellFromGetent returned empty, getent may not be available")
 		return
 	}
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
@@ -78,7 +78,7 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 		t.Skip("no root user on Windows")
 	}
 
-	u, err := LookupWithGetent("root")
+	u, err := lookupWithGetent("root")
 	if err != nil {
 		t.Skip("root user not available on this system")
 	}
@@ -86,25 +86,25 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 }
 
 // TestIntegration_FullLookupChain exercises the complete user lookup chain
-// against the real system, testing that all wrappers (LookupWithGetent,
-// CurrentUserWithGetent, GroupIdsWithFallback, GetShellFromGetent) produce
+// against the real system, testing that all wrappers (lookupWithGetent,
+// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
 // consistent and correct results when composed together.
 func TestIntegration_FullLookupChain(t *testing.T) {
-	// Step 1: CurrentUserWithGetent must resolve the running user.
-	current, err := CurrentUserWithGetent()
-	require.NoError(t, err, "CurrentUserWithGetent must resolve the running user")
+	// Step 1: currentUserWithGetent must resolve the running user.
+	current, err := currentUserWithGetent()
+	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
 	require.NotEmpty(t, current.Uid)
 	require.NotEmpty(t, current.Username)
 
-	// Step 2: LookupWithGetent by the same username must return matching identity.
-	byName, err := LookupWithGetent(current.Username)
+	// Step 2: lookupWithGetent by the same username must return matching identity.
+	byName, err := lookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
 	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
 	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
 
-	// Step 3: GroupIdsWithFallback must return at least the primary GID.
-	groups, err := GroupIdsWithFallback(current)
+	// Step 3: groupIdsWithFallback must return at least the primary GID.
+	groups, err := groupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "user must have at least one group")
 
@@ -120,10 +120,10 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 	}
 	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
 
-	// Step 4: GetShellFromGetent should either return a valid shell path or empty
+	// Step 4: getShellFromGetent should either return a valid shell path or empty
 	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
 	if runtime.GOOS != "windows" {
-		shell := GetShellFromGetent(current.Uid)
+		shell := getShellFromGetent(current.Uid)
 		if shell != "" {
 			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 		}
@@ -131,17 +131,17 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 }
 
 // TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
-// LookupWithGetent can have their groups resolved via GroupIdsWithFallback,
+// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
 // testing the handoff between the two functions as used by the SSH server.
 func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
 	// Simulate the SSH server flow: lookup user, then get their groups.
-	resolved, err := LookupWithGetent(current.Username)
+	resolved, err := lookupWithGetent(current.Username)
 	require.NoError(t, err)
 
-	groups, err := GroupIdsWithFallback(resolved)
+	groups, err := groupIdsWithFallback(resolved)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "resolved user must have groups")
 
@@ -156,7 +156,7 @@ func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 }
 
 // TestIntegration_ShellLookupChain tests the full shell resolution chain
-// (getShellFromPasswd -> GetShellFromGetent -> $SHELL -> default) on Unix.
+// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
 func TestIntegration_ShellLookupChain(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Unix shell lookup not applicable on Windows")
@@ -165,8 +165,8 @@ func TestIntegration_ShellLookupChain(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	// GetUserShell is the top-level function used by the SSH server.
-	shell := GetUserShell(current.Uid)
-	require.NotEmpty(t, shell, "GetUserShell must always return a shell")
+	// getUserShell is the top-level function used by the SSH server.
+	shell := getUserShell(current.Uid)
+	require.NotEmpty(t, shell, "getUserShell must always return a shell")
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 }

client/ssh/server/getent_unix.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package shell
+package server
 
 import (
 	"context"
@@ -14,26 +14,19 @@ import (
 
 const getentTimeout = 5 * time.Second
 
-// GetShellFromGetent gets a user's login shell via getent by UID.
+// getShellFromGetent gets a user's login shell via getent by UID.
 // This is needed even with CGO because getShellFromPasswd reads /etc/passwd
 // directly and won't find NSS-provided users there.
-func GetShellFromGetent(userID string) string {
-	_, shell, err := runGetentPasswd(userID)
+func getShellFromGetent(userID string) string {
+	_, shell, err := runGetent(userID)
 	if err != nil {
 		return ""
 	}
 	return shell
 }
 
-// GetUserFromGetent returns the resolved user from either a uid or username,
-// going through the host's NSS stack.
-func GetUserFromGetent(query string) (*user.User, error) {
-	u, _, err := runGetentPasswd(query)
-	return u, err
-}
-
-// runGetentPasswd executes `getent passwd <query>` and returns the user and login shell.
-func runGetentPasswd(query string) (*user.User, string, error) {
+// runGetent executes `getent passwd <query>` and returns the user and login shell.
+func runGetent(query string) (*user.User, string, error) {
 	if !validateGetentInput(query) {
 		return nil, "", fmt.Errorf("invalid getent input: %q", query)
 	}
@@ -49,24 +42,7 @@ func runGetentPasswd(query string) (*user.User, string, error) {
 	return parseGetentPasswd(string(out))
 }
 
-// runGetentGroup executes `getent group <query>` and returns the group.
-func runGetentGroup(query string) (*user.Group, error) {
-	if !validateGetentInput(query) {
-		return nil, fmt.Errorf("invalid getent input: %q", query)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
-	defer cancel()
-
-	out, err := exec.CommandContext(ctx, "getent", "group", query).Output()
-	if err != nil {
-		return nil, fmt.Errorf("getent group %s: %w", query, err)
-	}
-
-	return parseGetentGroup(string(out))
-}
-
-// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell".
+// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
 func parseGetentPasswd(output string) (*user.User, string, error) {
 	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
 	if len(fields) < 6 {
@@ -91,20 +67,6 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 	}, shell, nil
 }
 
-// parseGetentGroup parses getent group output: "group:x:gid:members".
-func parseGetentGroup(output string) (*user.Group, error) {
-	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
-	if len(fields) < 4 {
-		return nil, fmt.Errorf("unexpected getent output (need 4+ fields): %q", output)
-	}
-
-	if fields[0] == "" || fields[2] == "" {
-		return nil, fmt.Errorf("missing required fields in getent output: %q", output)
-	}
-
-	return &user.Group{Gid: fields[2], Name: fields[0]}, nil
-}
-
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
 // (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is

client/ssh/server/getent_unix_test.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package shell
+package server
 
 import (
 	"os/exec"
@@ -198,7 +198,7 @@ func TestRunGetent_RootUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, shell, err := runGetentPasswd("root")
+	u, shell, err := runGetent("root")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -211,7 +211,7 @@ func TestRunGetent_ByUID(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, _, err := runGetentPasswd("0")
+	u, _, err := runGetent("0")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -222,15 +222,15 @@ func TestRunGetent_NonexistentUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	_, _, err := runGetentPasswd("nonexistent_user_xyzzy_12345")
+	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }
 
 func TestRunGetent_InvalidInput(t *testing.T) {
-	_, _, err := runGetentPasswd("")
+	_, _, err := runGetent("")
 	assert.Error(t, err)
 
-	_, _, err = runGetentPasswd("user\x00name")
+	_, _, err = runGetent("user\x00name")
 	assert.Error(t, err)
 }
 
@@ -239,7 +239,7 @@ func TestRunGetent_NotAvailable(t *testing.T) {
 		t.Skip("getent is available, can't test missing case")
 	}
 
-	_, _, err := runGetentPasswd("root")
+	_, _, err := runGetent("root")
 	assert.Error(t, err, "should fail when getent is not installed")
 }
 
@@ -286,7 +286,7 @@ func TestGetentResultsMatchStdlib(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetentPasswd(current.Username)
+	getentUser, _, err := runGetent(current.Username)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match")
@@ -303,7 +303,7 @@ func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetentPasswd(current.Uid)
+	getentUser, _, err := runGetent(current.Uid)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
@@ -359,7 +359,7 @@ func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 
 	if _, err := exec.LookPath("getent"); err == nil {
-		_, getentShell, getentErr := runGetentPasswd(current.Uid)
+		_, getentShell, getentErr := runGetent(current.Uid)
 		if getentErr == nil && getentShell != "" {
 			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
 		}
@@ -403,7 +403,7 @@ func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
 			continue
 		}
 
-		_, getentShell, err := runGetentPasswd(uid)
+		_, getentShell, err := runGetent(uid)
 		if err != nil {
 			continue
 		}

client/ssh/server/getent_windows.go

@@ -0,0 +1,26 @@
+//go:build windows
+
+package server
+
+import "os/user"
+
+// lookupWithGetent on Windows just delegates to os/user.Lookup.
+// Windows does not use NSS/getent; its user lookup works without CGO.
+func lookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// currentUserWithGetent on Windows just delegates to os/user.Current.
+func currentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// getShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
+func getShellFromGetent(_ string) string {
+	return ""
+}
+
+// groupIdsWithFallback on Windows just delegates to u.GroupIds().
+func groupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/ssh/server/shell.go

@@ -1,14 +1,17 @@
-package shell
+package server
 
 import (
 	"bufio"
 	"fmt"
+	"net"
 	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
+	"strconv"
 	"strings"
 
+	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -19,9 +22,9 @@ const (
 	powershellExe = "powershell.exe"
 )
 
-// GetUserShell returns the appropriate shell for the given user ID.
-// Handles all platform-specific logic and fallbacks consistently.
-func GetUserShell(userID string) string {
+// getUserShell returns the appropriate shell for the given user ID
+// Handles all platform-specific logic and fallbacks consistently
+func getUserShell(userID string) string {
 	switch runtime.GOOS {
 	case "windows":
 		return getWindowsUserShell()
@@ -53,7 +56,7 @@ func getUnixUserShell(userID string) string {
 		return shell
 	}
 
-	if shell := GetShellFromGetent(userID); shell != "" {
+	if shell := getShellFromGetent(userID); shell != "" {
 		return shell
 	}
 
@@ -64,7 +67,7 @@ func getUnixUserShell(userID string) string {
 	return defaultUnixShell
 }
 
-// getShellFromPasswd reads the shell from /etc/passwd for the given user ID.
+// getShellFromPasswd reads the shell from /etc/passwd for the given user ID
 func getShellFromPasswd(userID string) string {
 	file, err := os.Open("/etc/passwd")
 	if err != nil {
@@ -98,8 +101,8 @@ func getShellFromPasswd(userID string) string {
 	return ""
 }
 
-// PrepareUserEnv prepares environment variables for user execution.
-func PrepareUserEnv(user *user.User, shell string) []string {
+// prepareUserEnv prepares environment variables for user execution
+func prepareUserEnv(user *user.User, shell string) []string {
 	pathValue := "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 	if runtime.GOOS == "windows" {
 		pathValue = `C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0`
@@ -114,9 +117,9 @@ func PrepareUserEnv(user *user.User, shell string) []string {
 	}
 }
 
-// AcceptEnv checks if an environment variable from an SSH client should be accepted.
-// This is a whitelist of variables that SSH clients can send to the server.
-func AcceptEnv(envVar string) bool {
+// acceptEnv checks if environment variable from SSH client should be accepted
+// This is a whitelist of variables that SSH clients can send to the server
+func acceptEnv(envVar string) bool {
 	varName := envVar
 	if idx := strings.Index(envVar, "="); idx != -1 {
 		varName = envVar[:idx]
@@ -153,3 +156,29 @@ func AcceptEnv(envVar string) bool {
 
 	return false
 }
+
+// prepareSSHEnv prepares SSH protocol-specific environment variables
+// These variables provide information about the SSH connection itself
+func prepareSSHEnv(session ssh.Session) []string {
+	remoteAddr := session.RemoteAddr()
+	localAddr := session.LocalAddr()
+
+	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
+	if err != nil {
+		remoteHost = remoteAddr.String()
+		remotePort = "0"
+	}
+
+	localHost, localPort, err := net.SplitHostPort(localAddr.String())
+	if err != nil {
+		localHost = localAddr.String()
+		localPort = strconv.Itoa(InternalSSHPort)
+	}
+
+	return []string{
+		// SSH_CLIENT format: "client_ip client_port server_port"
+		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
+		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
+		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
+	}
+}

client/ssh/server/ssh_env.go

@@ -1,35 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"net"
-	"strconv"
-
-	"github.com/gliderlabs/ssh"
-)
-
-// prepareSSHEnv prepares SSH protocol-specific environment variables
-// These variables provide information about the SSH connection itself
-func prepareSSHEnv(session ssh.Session) []string {
-	remoteAddr := session.RemoteAddr()
-	localAddr := session.LocalAddr()
-
-	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
-	if err != nil {
-		remoteHost = remoteAddr.String()
-		remotePort = "0"
-	}
-
-	localHost, localPort, err := net.SplitHostPort(localAddr.String())
-	if err != nil {
-		localHost = localAddr.String()
-		localPort = strconv.Itoa(InternalSSHPort)
-	}
-
-	return []string{
-		// SSH_CLIENT format: "client_ip client_port server_port"
-		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
-		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
-		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
-	}
-}

client/ssh/server/user_utils.go

@@ -9,8 +9,6 @@ import (
 	"strings"
 
 	log "github.com/sirupsen/logrus"
-
-	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 var (
@@ -25,8 +23,8 @@ func isPlatformUnix() bool {
 
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
-	getCurrentUser         = shellutil.CurrentUserWithGetent
-	lookupUser             = shellutil.LookupWithGetent
+	getCurrentUser         = currentUserWithGetent
+	lookupUser             = lookupWithGetent
 	getCurrentOS           = func() string { return runtime.GOOS }
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 

client/ssh/server/userswitching_unix.go

@@ -16,8 +16,6 @@ import (
 
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
-
-	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // POSIX portable filename character set regex: [a-zA-Z0-9._-]
@@ -162,7 +160,7 @@ func (s *Server) parseUserCredentials(localUser *user.User) (uint32, uint32, []u
 // getSupplementaryGroups retrieves supplementary group IDs for a user.
 // Uses id/getent fallback for NSS users in CGO_ENABLED=0 builds.
 func (s *Server) getSupplementaryGroups(u *user.User) ([]uint32, error) {
-	groupIDStrings, err := shellutil.GroupIdsWithFallback(u)
+	groupIDStrings, err := groupIdsWithFallback(u)
 	if err != nil {
 		return nil, fmt.Errorf("get group IDs for user %s: %w", u.Username, err)
 	}
@@ -198,7 +196,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 		GID:        gid,
 		Groups:     groups,
 		WorkingDir: localUser.HomeDir,
-		Shell:      shellutil.GetUserShell(localUser.Uid),
+		Shell:      getUserShell(localUser.Uid),
 		Command:    session.RawCommand(),
 		PTY:        hasPty,
 	}
@@ -230,7 +228,7 @@ func (s *Server) createPtyCommand(privilegeResult PrivilegeCheckResult, ptyReq s
 func (s *Server) createDirectPtyCommand(session ssh.Session, localUser *user.User, ptyReq ssh.Pty) *exec.Cmd {
 	log.Debugf("creating direct Pty command for user %s (no user switching needed)", localUser.Username)
 
-	shell := shellutil.GetUserShell(localUser.Uid)
+	shell := getUserShell(localUser.Uid)
 	args := s.getShellCommandArgs(shell, session.RawCommand())
 
 	cmd := s.createShellCommand(session.Context(), shell, args)
@@ -247,12 +245,12 @@ func (s *Server) preparePtyEnv(localUser *user.User, ptyReq ssh.Pty, session ssh
 		termType = "xterm-256color"
 	}
 
-	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
+	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	env = append(env, fmt.Sprintf("TERM=%s", termType))
 
 	for _, v := range session.Environ() {
-		if shellutil.AcceptEnv(v) {
+		if acceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/userswitching_windows.go

@@ -13,8 +13,6 @@ import (
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/windows"
-
-	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // validateUsername validates Windows usernames according to SAM Account Name rules
@@ -106,7 +104,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
 	username, domain := s.parseUsername(localUser.Username)
 
-	shell := shellutil.GetUserShell(localUser.Uid)
+	shell := getUserShell(localUser.Uid)
 
 	rawCmd := session.RawCommand()
 	var command string

client/ui/i18n/locales/_index.json

@@ -8,7 +8,6 @@
         {"code": "fr", "displayName": "Français", "englishName": "French"},
         {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
         {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
-        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"},
-        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"}
+        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"}
     ]
 }

combined/cmd/root.go

@@ -226,7 +226,7 @@ func (s *serverInstances) createRelayServer(cfg *CombinedConfig, tlsSupport bool
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cfg.Relay.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
 
 	relayCfg := relayServer.Config{
 		Meter:          s.metricsServer.Meter,

go.mod

@@ -30,7 +30,6 @@ require (
 
 require (
 	github.com/DeRuina/timberjack v1.4.2
-	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
@@ -157,6 +156,7 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -197,12 +197,6 @@ type JSONMetadataInjection struct {
 	// enforces a 128-char limit per value; oversized values are
 	// truncated rather than failing the request. 0 disables the cap.
 	MaxValueLength int
-	// Sanitize, when true, replaces characters outside the destination's
-	// accepted set with '_' before emitting each value. AWS Bedrock's
-	// X-Amzn-Bedrock-Request-Metadata restricts values to a limited character
-	// class, so unsanitized group display names (e.g. containing spaces) would
-	// make Bedrock reject the request with 400.
-	Sanitize bool
 }
 
 // providers is the canonical list of supported Agent Network providers.
@@ -335,18 +329,6 @@ var providers = []Provider{
 			{ID: "amazon.nova-lite", Label: "Amazon Nova Lite (Bedrock)", InputPer1k: 0.00006, OutputPer1k: 0.00024, ContextWindow: 300000},
 			{ID: "amazon.nova-micro", Label: "Amazon Nova Micro (Bedrock)", InputPer1k: 0.000035, OutputPer1k: 0.00014, ContextWindow: 128000},
 		},
-		// Bedrock accepts a cost-allocation metadata header; stamp the caller's
-		// user + authorizing group so spend can be attributed in AWS Cost
-		// Management. Sanitized because Bedrock restricts the value character set.
-		IdentityInjection: &IdentityInjection{
-			JSONMetadata: &JSONMetadataInjection{
-				Header:         "X-Amzn-Bedrock-Request-Metadata",
-				UserKey:        "user",
-				GroupsKey:      "group",
-				MaxValueLength: 256,
-				Sanitize:       true,
-			},
-		},
 	},
 	{
 		ID:                 "vertex_ai_api",

management/internals/modules/agentnetwork/synthesizer.go

@@ -540,7 +540,6 @@ type identityInjectJSONMetadata struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
-	Sanitize       bool   `json:"sanitize,omitempty"`
 }
 
 // buildIdentityInjectConfigJSON walks the enabled providers and emits
@@ -584,11 +583,9 @@ func buildIdentityInjectConfigJSON(providers []*types.Provider, groupIndex map[s
 func buildIdentityInjectRule(p *types.Provider, entry catalog.Provider) (identityInjectProvider, bool) {
 	rule := identityInjectProvider{ProviderID: p.ID}
 	// Identity-stamping shape (one of HeaderPair / JSONMetadata). Skip the
-	// shape silently when the catalog entry doesn't declare one, or when the
-	// operator disabled metadata for this provider — extras can still apply,
-	// see below. MetadataDisabled suppresses only the identity dimensions
-	// (user + authorizing group), not the catalog's routing ExtraHeaders.
-	if !p.MetadataDisabled && entry.IdentityInjection != nil {
+	// shape silently when the catalog entry doesn't declare one — extras
+	// can still apply, see below.
+	if entry.IdentityInjection != nil {
 		switch {
 		case entry.IdentityInjection.HeaderPair != nil:
 			rule.HeaderPair = buildIdentityHeaderPair(p, entry.IdentityInjection.HeaderPair)
@@ -654,7 +651,6 @@ func buildIdentityJSONMetadata(p *types.Provider, jm *catalog.JSONMetadataInject
 		UserKey:        userKey,
 		GroupsKey:      groupsKey,
 		MaxValueLength: jm.MaxValueLength,
-		Sanitize:       jm.Sanitize,
 	}
 }
 

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -698,94 +698,6 @@ func TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable(t *testing.T)
 		"same fixed-schema guarantee for the groups dimension")
 }
 
-// TestSynthesizeServices_IdentityInject_Bedrock pins Bedrock's cost-allocation
-// metadata: a JSONMetadata shape emitting X-Amzn-Bedrock-Request-Metadata with
-// the reserved user/group keys, sanitized to Bedrock's accepted charset.
-func TestSynthesizeServices_IdentityInject_Bedrock(t *testing.T) {
-	ctx := context.Background()
-	ctrl := gomock.NewController(t)
-	defer ctrl.Finish()
-	mockStore := store.NewMockStore(ctrl)
-
-	br := newSynthTestProvider()
-	br.ID = "prov-bedrock"
-	br.ProviderID = "bedrock_api"
-	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
-	br.APIKey = "bedrock-bearer"
-	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
-
-	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
-	policy.ID = "pol-bedrock"
-
-	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
-		[]*types.Provider{br},
-		[]*types.Policy{policy},
-		[]*types.Guardrail{})
-
-	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
-	require.NoError(t, err)
-	require.Len(t, services, 1)
-
-	var injectCfg identityInjectConfig
-	for _, m := range services[0].Targets[0].Options.Middlewares {
-		if m.ID == middlewareIDLLMIdentityInject {
-			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
-			break
-		}
-	}
-	require.Len(t, injectCfg.Providers, 1)
-	entry := injectCfg.Providers[0]
-	require.NotNil(t, entry.JSONMetadata, "Bedrock uses the JSONMetadata shape for cost-allocation metadata")
-	assert.Nil(t, entry.HeaderPair, "shapes are mutually exclusive")
-	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", entry.JSONMetadata.Header,
-		"the caller identity lands in Bedrock's cost-allocation metadata header")
-	assert.Equal(t, "user", entry.JSONMetadata.UserKey)
-	assert.Equal(t, "group", entry.JSONMetadata.GroupsKey)
-	assert.True(t, entry.JSONMetadata.Sanitize,
-		"Bedrock restricts the metadata value charset, so values must be sanitized")
-}
-
-// TestSynthesizeServices_MetadataDisabled_SuppressesInjection verifies the
-// per-provider opt-out: a provider with MetadataDisabled set emits no
-// identity-inject entry (Bedrock has no catalog ExtraHeaders, so the whole
-// entry is dropped).
-func TestSynthesizeServices_MetadataDisabled_SuppressesInjection(t *testing.T) {
-	ctx := context.Background()
-	ctrl := gomock.NewController(t)
-	defer ctrl.Finish()
-	mockStore := store.NewMockStore(ctrl)
-
-	br := newSynthTestProvider()
-	br.ID = "prov-bedrock"
-	br.ProviderID = "bedrock_api"
-	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
-	br.APIKey = "bedrock-bearer"
-	br.MetadataDisabled = true
-	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
-
-	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
-	policy.ID = "pol-bedrock"
-
-	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
-		[]*types.Provider{br},
-		[]*types.Policy{policy},
-		[]*types.Guardrail{})
-
-	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
-	require.NoError(t, err)
-	require.Len(t, services, 1)
-
-	var injectCfg identityInjectConfig
-	for _, m := range services[0].Targets[0].Options.Middlewares {
-		if m.ID == middlewareIDLLMIdentityInject {
-			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
-			break
-		}
-	}
-	assert.Empty(t, injectCfg.Providers,
-		"metadata_disabled must drop the provider's identity-inject entry")
-}
-
 // TestSynthesizeServices_IdentityInject_Vercel pins Vercel AI
 // Gateway's wiring: HeaderPair shape with fixed wire names dictated
 // by Vercel's Custom Reporting API (ai-reporting-user /

management/internals/modules/agentnetwork/types/provider.go

@@ -51,12 +51,6 @@ type Provider struct {
 	// private or self-signed certificate. The synthesiser propagates it into
 	// the router route so the proxy dials that provider's upstream insecurely.
 	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
-	// MetadataDisabled suppresses identity metadata injection for this provider.
-	// Metadata (the caller's user + authorizing group) is injected by default;
-	// when true the synthesiser omits the provider's identity-inject shape, so no
-	// user/group headers (e.g. Bedrock's X-Amzn-Bedrock-Request-Metadata) are
-	// stamped. Catalog ExtraHeaders (routing config) are unaffected.
-	MetadataDisabled bool `gorm:"column:metadata_disabled"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -143,9 +137,6 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.SkipTlsVerification != nil {
 		p.SkipTLSVerification = *req.SkipTlsVerification
 	}
-	if req.MetadataDisabled != nil {
-		p.MetadataDisabled = *req.MetadataDisabled
-	}
 	// Identity-header overrides for catalogs flagged Customizable.
 	// nil pointer = "field omitted on the wire" → leave the stored
 	// value untouched (per the openapi description). Empty string is
@@ -179,7 +170,6 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		Models:              models,
 		Enabled:             p.Enabled,
 		SkipTlsVerification: p.SkipTLSVerification,
-		MetadataDisabled:    p.MetadataDisabled,
 		CreatedAt:           &created,
 		UpdatedAt:           &updated,
 	}

management/internals/modules/agentnetwork/types/provider_test.go

@@ -42,38 +42,3 @@ func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
 	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
 	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
 }
-
-// TestProvider_MetadataDisabled_RoundTrip covers the request→provider→response
-// mapping of metadata_disabled, with the same update semantics: nil preserves,
-// explicit false clears.
-func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
-	enable := true
-	disable := false
-
-	base := func() *api.AgentNetworkProviderRequest {
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "bedrock_api",
-			Name:        "bedrock",
-			UpstreamUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
-		}
-	}
-
-	p := NewProvider("acc-1")
-
-	req := base()
-	req.MetadataDisabled = &enable
-	p.FromAPIRequest(req)
-	assert.True(t, p.MetadataDisabled, "create with metadata_disabled=true must set the field")
-	assert.True(t, p.ToAPIResponse().MetadataDisabled, "response must surface metadata_disabled")
-
-	// Omitting the field on update leaves the stored value untouched.
-	p.FromAPIRequest(base())
-	assert.True(t, p.MetadataDisabled, "omitting metadata_disabled on update must preserve it")
-
-	// Explicit false clears it (re-enables metadata).
-	req = base()
-	req.MetadataDisabled = &disable
-	p.FromAPIRequest(req)
-	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
-	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
-}

proxy/cmd/proxy/cmd/root.go

@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy"
 	nbacme "github.com/netbirdio/netbird/proxy/internal/acme"
-	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -210,7 +209,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid domain value %q: %w", proxyDomain, err)
 	}
 
-	parsedTrustedProxies, err := trustedproxy.Parse(trustedProxies)
+	parsedTrustedProxies, err := proxy.ParseTrustedProxies(trustedProxies)
 	if err != nil {
 		return fmt.Errorf("invalid --trusted-proxies: %w", err)
 	}

proxy/internal/accesslog/logger.go

@@ -16,7 +16,6 @@ import (
 	"github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -67,7 +66,7 @@ type denyBucket struct {
 type Logger struct {
 	client         gRPCClient
 	logger         *log.Logger
-	trustedProxies *trustedproxy.List
+	trustedProxies []netip.Prefix
 
 	usageMux    sync.Mutex
 	domainUsage map[string]*domainUsage
@@ -83,7 +82,7 @@ type Logger struct {
 // NewLogger creates a new access log Logger. The trustedProxies parameter
 // configures which upstream proxy IP ranges are trusted for extracting
 // the real client IP from X-Forwarded-For headers.
-func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies *trustedproxy.List) *Logger {
+func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies []netip.Prefix) *Logger {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}

proxy/internal/accesslog/requestip.go

@@ -4,13 +4,13 @@ import (
 	"net/http"
 	"net/netip"
 
-	"github.com/netbirdio/netbird/trustedproxy"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
 )
 
 // extractSourceIP resolves the real client IP from the request using trusted
 // proxy configuration. When trustedProxies is non-empty and the direct
 // connection is from a trusted source, it walks X-Forwarded-For right-to-left
 // skipping trusted IPs. Otherwise it returns RemoteAddr directly.
-func extractSourceIP(r *http.Request, trustedProxies *trustedproxy.List) netip.Addr {
-	return trustedProxies.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"))
+func extractSourceIP(r *http.Request, trustedProxies []netip.Prefix) netip.Addr {
+	return proxy.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"), trustedProxies)
 }

proxy/internal/middleware/builtin/llm_identity_inject/factory.go

@@ -64,11 +64,6 @@ type JSONMetadataRule struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
-	// Sanitize replaces characters outside the destination provider's accepted
-	// set with '_' before emitting each value. AWS Bedrock's
-	// X-Amzn-Bedrock-Request-Metadata restricts values to [A-Za-z0-9 +-=._:/@];
-	// group display names with other characters would otherwise 400.
-	Sanitize bool `json:"sanitize,omitempty"`
 }
 
 // Config is the on-wire configuration accepted by the factory. An

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -292,21 +292,15 @@ func applyJSONMetadata(rule *JSONMetadataRule, in *middleware.Input) *middleware
 	mutations := &middleware.Mutations{}
 	mutations.HeadersRemove = append(mutations.HeadersRemove, rule.Header)
 
-	emit := func(v string) string {
-		if rule.Sanitize {
-			v = sanitizeMetadataValue(v)
-		}
-		return truncate(v, rule.MaxValueLength)
-	}
 	payload := map[string]string{}
 	if rule.UserKey != "" {
 		if identity := identityFor(in); identity != "" {
-			payload[rule.UserKey] = emit(identity)
+			payload[rule.UserKey] = truncate(identity, rule.MaxValueLength)
 		}
 	}
 	if rule.GroupsKey != "" {
 		if csv := authorisingTagsCSV(in); csv != "" {
-			payload[rule.GroupsKey] = emit(csv)
+			payload[rule.GroupsKey] = truncate(csv, rule.MaxValueLength)
 		}
 	}
 	if len(payload) == 0 {
@@ -365,36 +359,6 @@ func truncate(s string, maxBytes int) string {
 	return s[:maxBytes]
 }
 
-// sanitizeMetadataValue replaces any character outside AWS Bedrock's accepted
-// request-metadata class — letters, digits, space, and + - = . _ : / @ — with
-// '_'. This keeps values (notably the groups CSV, whose commas are rejected, and
-// group display names with arbitrary characters) from making Bedrock reject the
-// request with 400. The result stays opaque to the gateway.
-func sanitizeMetadataValue(s string) string {
-	var b strings.Builder
-	b.Grow(len(s))
-	for _, r := range s {
-		if metadataCharAllowed(r) {
-			b.WriteRune(r)
-		} else {
-			b.WriteByte('_')
-		}
-	}
-	return b.String()
-}
-
-func metadataCharAllowed(r rune) bool {
-	switch {
-	case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
-		return true
-	}
-	switch r {
-	case ' ', '+', '-', '=', '.', '_', ':', '/', '@':
-		return true
-	}
-	return false
-}
-
 // tagsIDsFromAuthorising reads llm_router's authorising-groups metadata
 // (a CSV of group ids) and returns the parsed slice. Returns nil when
 // the key is absent or empty so the caller can fall back to the full

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -304,46 +304,6 @@ func TestInject_JSONMetadata_TruncatesValues(t *testing.T) {
 		"per-value byte length must be capped at MaxValueLength")
 }
 
-// TestInject_JSONMetadata_Sanitize pins the AWS-Bedrock sanitization path: when
-// Sanitize is set, characters outside Bedrock's accepted metadata class
-// (notably the groups CSV comma and arbitrary characters in group display
-// names) are replaced with '_' so Bedrock doesn't reject the request. Allowed
-// characters (letters, digits, spaces, and @ . _ : / + - =) pass through.
-func TestInject_JSONMetadata_Sanitize(t *testing.T) {
-	rule := ProviderInjection{
-		ProviderID: portkeyProvider,
-		JSONMetadata: &JSONMetadataRule{
-			Header:         "X-Amzn-Bedrock-Request-Metadata",
-			UserKey:        "user",
-			GroupsKey:      "group",
-			MaxValueLength: 256,
-			Sanitize:       true,
-		},
-	}
-	mw := New(Config{Providers: []ProviderInjection{rule}})
-	in := newInput(portkeyProvider, "alice", []string{"g1", "g2"})
-	in.UserEmail = "alice@example.com"
-	// Group display names carry characters Bedrock rejects (comma, '#'); the CSV
-	// join adds another comma between the two groups.
-	in.UserGroupNames = []string{"Eng,Team", "Ops#1"}
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	require.Len(t, out.Mutations.HeadersAdd, 1)
-	added := out.Mutations.HeadersAdd[0]
-	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", added.Key,
-		"the Bedrock cost-allocation header carries the metadata JSON")
-
-	var payload map[string]string
-	require.NoError(t, json.Unmarshal([]byte(added.Value), &payload))
-	assert.Equal(t, "alice@example.com", payload["user"],
-		"'@' and '.' are in Bedrock's accepted set and must be preserved")
-	assert.NotContains(t, payload["group"], ",", "commas must be sanitized — Bedrock rejects them")
-	assert.NotContains(t, payload["group"], "#", "disallowed characters must be sanitized")
-	assert.Contains(t, payload["group"], "Eng", "allowed characters must be preserved")
-}
-
 // TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd verifies the
 // anti-spoof Remove still fires when there's nothing to stamp.
 func TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {

proxy/internal/proxy/reverseproxy.go

@@ -22,7 +22,6 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 type ReverseProxy struct {
@@ -30,10 +29,10 @@ type ReverseProxy struct {
 	// forwardedProto overrides the X-Forwarded-Proto header value.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	forwardedProto string
-	// trustedProxies is the set of trusted upstream proxies. When the direct
-	// connection comes from a trusted proxy, forwarding headers are preserved
-	// and appended to instead of being stripped.
-	trustedProxies *trustedproxy.List
+	// trustedProxies is a list of IP prefixes for trusted upstream proxies.
+	// When the direct connection comes from a trusted proxy, forwarding
+	// headers are preserved and appended to instead of being stripped.
+	trustedProxies []netip.Prefix
 	mappingsMux    sync.RWMutex
 	mappings       map[string]Mapping
 	logger         *log.Logger
@@ -64,7 +63,7 @@ func WithMiddlewareManager(m *middleware.Manager) Option {
 // between requested URLs and targets.
 // The internal mappings can be modified using the AddMapping
 // and RemoveMapping functions.
-func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies *trustedproxy.List, logger *log.Logger, opts ...Option) *ReverseProxy {
+func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger, opts ...Option) *ReverseProxy {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
@@ -528,7 +527,7 @@ func (p *ReverseProxy) isSelfTargetLoop(r *http.Request, target *url.URL) bool {
 	if !types.IsOverlayOrigin(r.Context()) {
 		return false
 	}
-	srcIP := trustedproxy.ExtractHostIP(r.RemoteAddr)
+	srcIP := extractHostIP(r.RemoteAddr)
 	if !srcIP.IsValid() {
 		return false
 	}
@@ -579,9 +578,9 @@ func (p *ReverseProxy) rewriteFunc(target *url.URL, matchedPath string, passHost
 
 		stampNetBirdIdentity(r)
 
-		clientIP := trustedproxy.ExtractHostIP(r.In.RemoteAddr)
+		clientIP := extractHostIP(r.In.RemoteAddr)
 
-		if p.trustedProxies.Contains(clientIP) {
+		if isTrustedAddr(clientIP, p.trustedProxies) {
 			p.setTrustedForwardingHeaders(r, clientIP)
 		} else {
 			p.setUntrustedForwardingHeaders(r, clientIP)
@@ -665,7 +664,7 @@ func (p *ReverseProxy) setTrustedForwardingHeaders(r *httputil.ProxyRequest, cli
 	if realIP := r.In.Header.Get("X-Real-IP"); realIP != "" {
 		r.Out.Header.Set("X-Real-IP", realIP)
 	} else {
-		resolved := p.trustedProxies.ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"))
+		resolved := ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"), p.trustedProxies)
 		r.Out.Header.Set("X-Real-IP", resolved.String())
 	}
 

proxy/internal/proxy/reverseproxy_test.go

@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestRewriteFunc_HostRewriting(t *testing.T) {
@@ -303,7 +302,7 @@ func TestExtractHostIP(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, trustedproxy.ExtractHostIP(tt.remoteAddr))
+			assert.Equal(t, tt.expected, extractHostIP(tt.remoteAddr))
 		})
 	}
 }
@@ -331,7 +330,7 @@ func TestExtractForwardedPort(t *testing.T) {
 
 func TestRewriteFunc_TrustedProxy(t *testing.T) {
 	target, _ := url.Parse("http://backend.internal:8080")
-	trusted := trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")})
+	trusted := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}
 
 	t.Run("appends to X-Forwarded-For", func(t *testing.T) {
 		p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}

proxy/internal/proxy/trustedproxy.go

@@ -0,0 +1,81 @@
+package proxy
+
+import (
+	"net/netip"
+	"strings"
+)
+
+// IsTrustedProxy checks if the given IP string falls within any of the trusted prefixes.
+func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
+	addr, err := netip.ParseAddr(ipStr)
+	if err != nil || len(trusted) == 0 {
+		return false
+	}
+	return isTrustedAddr(addr.Unmap(), trusted)
+}
+
+// ResolveClientIP extracts the real client IP from X-Forwarded-For using the trusted proxy list.
+// It walks the XFF chain right-to-left, skipping IPs that match trusted prefixes.
+// The first untrusted IP is the real client.
+//
+// If the trusted list is empty or remoteAddr is not trusted, it returns the
+// remoteAddr IP directly (ignoring any forwarding headers).
+func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) netip.Addr {
+	remoteIP := extractHostIP(remoteAddr)
+
+	if len(trusted) == 0 || !isTrustedAddr(remoteIP, trusted) {
+		return remoteIP
+	}
+
+	if xff == "" {
+		return remoteIP
+	}
+
+	parts := strings.Split(xff, ",")
+	for i := len(parts) - 1; i >= 0; i-- {
+		ip := strings.TrimSpace(parts[i])
+		if ip == "" {
+			continue
+		}
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			continue
+		}
+		addr = addr.Unmap()
+		if !isTrustedAddr(addr, trusted) {
+			return addr
+		}
+	}
+
+	// All IPs in XFF are trusted; return the leftmost as best guess.
+	if first := strings.TrimSpace(parts[0]); first != "" {
+		if addr, err := netip.ParseAddr(first); err == nil {
+			return addr.Unmap()
+		}
+	}
+	return remoteIP
+}
+
+// extractHostIP parses the IP from a host:port string and returns it unmapped.
+func extractHostIP(hostPort string) netip.Addr {
+	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
+		return ap.Addr().Unmap()
+	}
+	if addr, err := netip.ParseAddr(hostPort); err == nil {
+		return addr.Unmap()
+	}
+	return netip.Addr{}
+}
+
+// isTrustedAddr checks if the given address falls within any of the trusted prefixes.
+func isTrustedAddr(addr netip.Addr, trusted []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	for _, prefix := range trusted {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}

proxy/internal/proxy/trustedproxy_test.go

@@ -0,0 +1,129 @@
+package proxy
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsTrustedProxy(t *testing.T) {
+	trusted := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("192.168.1.0/24"),
+		netip.MustParsePrefix("fd00::/8"),
+	}
+
+	tests := []struct {
+		name    string
+		ip      string
+		trusted []netip.Prefix
+		want    bool
+	}{
+		{"empty trusted list", "10.0.0.1", nil, false},
+		{"IP within /8 prefix", "10.1.2.3", trusted, true},
+		{"IP within /24 prefix", "192.168.1.100", trusted, true},
+		{"IP outside all prefixes", "203.0.113.50", trusted, false},
+		{"boundary IP just outside prefix", "192.168.2.1", trusted, false},
+		{"unparsable IP", "not-an-ip", trusted, false},
+		{"IPv6 in trusted range", "fd00::1", trusted, true},
+		{"IPv6 outside range", "2001:db8::1", trusted, false},
+		{"empty string", "", trusted, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsTrustedProxy(tt.ip, tt.trusted))
+		})
+	}
+}
+
+func TestResolveClientIP(t *testing.T) {
+	trusted := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+	}
+
+	tests := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		trusted    []netip.Prefix
+		want       netip.Addr
+	}{
+		{
+			name:       "empty trusted list returns RemoteAddr",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4",
+			trusted:    nil,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "untrusted RemoteAddr ignores XFF",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4, 10.0.0.1",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with single client in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr walks past trusted entries in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("10.0.0.1"),
+		},
+		{
+			name:       "all XFF IPs trusted returns leftmost",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("10.0.0.2"),
+		},
+		{
+			name:       "XFF with whitespace",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        " 203.0.113.50 , 10.0.0.2 ",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "XFF with empty segments",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50,,10.0.0.2",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "multi-hop with mixed trust",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "RemoteAddr without port",
+			remoteAddr: "10.0.0.1",
+			xff:        "203.0.113.50",
+			trusted:    trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, ResolveClientIP(tt.remoteAddr, tt.xff, tt.trusted))
+		})
+	}
+}

proxy/lifecycle.go

@@ -2,13 +2,13 @@ package proxy
 
 import (
 	"context"
+	"net/netip"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // Config bundles every knob the proxy reads at construction time. It mirrors
@@ -83,9 +83,9 @@ type Config struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to
 	// backends. Valid values: "auto", "http", "https".
 	ForwardedProto string
-	// TrustedProxies is the set of trusted upstream proxies that may set
-	// forwarding headers.
-	TrustedProxies *trustedproxy.List
+	// TrustedProxies is a list of IP prefixes for trusted upstream
+	// proxies that may set forwarding headers.
+	TrustedProxies []netip.Prefix
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
 	WireguardPort uint16

proxy/proxyprotocol_test.go

@@ -10,14 +10,12 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")}),
+		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")},
 		ProxyProtocol:  true,
 	}
 
@@ -68,7 +66,7 @@ func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
+		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -82,7 +80,7 @@ func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
+		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -96,7 +94,7 @@ func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 func TestProxyProtocolPolicy_InvalidIPRejects(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
+		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
 	}
 
 	opts := proxyproto.ConnPolicyOptions{

proxy/server.go

@@ -67,7 +67,6 @@ import (
 	"github.com/netbirdio/netbird/proxy/web"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util/embeddedroots"
 )
 
@@ -80,19 +79,19 @@ type portRouter struct {
 
 type Server struct {
 	ctx               context.Context
-	mgmtClient        proto.ProxyServiceClient
-	proxy             *proxy.ReverseProxy
-	netbird           *roundtrip.NetBird
-	acme              *acme.Manager
+	mgmtClient    proto.ProxyServiceClient
+	proxy         *proxy.ReverseProxy
+	netbird       *roundtrip.NetBird
+	acme          *acme.Manager
 	staticCertWatcher *certwatch.Watcher
-	auth              *auth.Middleware
-	http              *http.Server
-	https             *http.Server
-	debug             *http.Server
-	healthServer      *health.Server
-	healthChecker     *health.Checker
-	meter             *proxymetrics.Metrics
-	accessLog         *accesslog.Logger
+	auth          *auth.Middleware
+	http          *http.Server
+	https         *http.Server
+	debug         *http.Server
+	healthServer  *health.Server
+	healthChecker *health.Checker
+	meter         *proxymetrics.Metrics
+	accessLog     *accesslog.Logger
 	// middlewareManager drives per-target middleware dispatch. Always
 	// constructed during boot; an empty registry produces empty chains and
 	// the reverse-proxy stays on the no-capture fast path.
@@ -100,16 +99,16 @@ type Server struct {
 	// middlewareRegistry is the source of registered middleware factories.
 	// Concrete middlewares register themselves through init().
 	middlewareRegistry *middleware.Registry
-	mainRouter         *nbtcp.Router
-	mainPort           uint16
-	udpMu              sync.Mutex
-	udpRelays          map[types.ServiceID]*udprelay.Relay
-	udpRelayWg         sync.WaitGroup
-	portMu             sync.RWMutex
-	portRouters        map[uint16]*portRouter
-	svcPorts           map[types.ServiceID][]uint16
-	lastMappings       map[types.ServiceID]*proto.ProxyMapping
-	portRouterWg       sync.WaitGroup
+	mainRouter    *nbtcp.Router
+	mainPort      uint16
+	udpMu         sync.Mutex
+	udpRelays     map[types.ServiceID]*udprelay.Relay
+	udpRelayWg    sync.WaitGroup
+	portMu        sync.RWMutex
+	portRouters   map[uint16]*portRouter
+	svcPorts      map[types.ServiceID][]uint16
+	lastMappings  map[types.ServiceID]*proto.ProxyMapping
+	portRouterWg  sync.WaitGroup
 
 	// hijackTracker tracks hijacked connections (e.g. WebSocket upgrades)
 	// so they can be closed during graceful shutdown, since http.Server.Shutdown
@@ -193,10 +192,10 @@ type Server struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to backends.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	ForwardedProto string
-	// TrustedProxies is the set of trusted upstream proxies. When set,
-	// forwarding headers from these sources are preserved and appended to
-	// instead of being stripped.
-	TrustedProxies *trustedproxy.List
+	// TrustedProxies is a list of IP prefixes for trusted upstream proxies.
+	// When set, forwarding headers from these sources are preserved and
+	// appended to instead of being stripped.
+	TrustedProxies []netip.Prefix
 	// WireguardPort is the port for the NetBird tunnel interface. Use 0
 	// for a random OS-assigned port. A fixed port only works with
 	// single-account deployments; multiple accounts will fail to bind
@@ -719,7 +718,7 @@ func (s *Server) wrapProxyProtocol(ln net.Listener) net.Listener {
 		Listener:          ln,
 		ReadHeaderTimeout: proxyProtoHeaderTimeout,
 	}
-	if !s.TrustedProxies.Empty() {
+	if len(s.TrustedProxies) > 0 {
 		ppListener.ConnPolicy = s.proxyProtocolPolicy
 	} else {
 		s.Logger.Warn("PROXY protocol enabled without trusted proxies; any source may send PROXY headers")
@@ -743,8 +742,10 @@ func (s *Server) proxyProtocolPolicy(opts proxyproto.ConnPolicyOptions) (proxypr
 	addr = addr.Unmap()
 
 	// called per accept
-	if s.TrustedProxies.Contains(addr) {
-		return proxyproto.REQUIRE, nil
+	for _, prefix := range s.TrustedProxies {
+		if prefix.Contains(addr) {
+			return proxyproto.REQUIRE, nil
+		}
 	}
 	return proxyproto.IGNORE, nil
 }

proxy/trustedproxy.go

@@ -0,0 +1,43 @@
+package proxy
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+)
+
+// ParseTrustedProxies parses a comma-separated list of CIDR prefixes or bare IPs
+// into a slice of netip.Prefix values suitable for trusted proxy configuration.
+// Bare IPs are converted to single-host prefixes (/32 or /128).
+func ParseTrustedProxies(raw string) ([]netip.Prefix, error) {
+	if raw == "" {
+		return nil, nil
+	}
+
+	parts := strings.Split(raw, ",")
+	prefixes := make([]netip.Prefix, 0, len(parts))
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		prefix, err := netip.ParsePrefix(part)
+		if err == nil {
+			prefixes = append(prefixes, prefix)
+			continue
+		}
+
+		addr, addrErr := netip.ParseAddr(part)
+		if addrErr != nil {
+			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
+		}
+
+		bits := 32
+		if addr.Is6() {
+			bits = 128
+		}
+		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
+	}
+	return prefixes, nil
+}

proxy/trustedproxy_test.go

@@ -0,0 +1,90 @@
+package proxy
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseTrustedProxies(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		want    []netip.Prefix
+		wantErr bool
+	}{
+		{
+			name: "empty string returns nil",
+			raw:  "",
+			want: nil,
+		},
+		{
+			name: "single CIDR",
+			raw:  "10.0.0.0/8",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name: "single bare IPv4",
+			raw:  "1.2.3.4",
+			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
+		},
+		{
+			name: "single bare IPv6",
+			raw:  "::1",
+			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
+		},
+		{
+			name: "comma-separated CIDRs",
+			raw:  "10.0.0.0/8, 192.168.1.0/24",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.1.0/24"),
+			},
+		},
+		{
+			name: "mixed CIDRs and bare IPs",
+			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("1.2.3.4/32"),
+				netip.MustParsePrefix("fd00::/8"),
+			},
+		},
+		{
+			name: "whitespace around entries",
+			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.0.0/16"),
+			},
+		},
+		{
+			name: "trailing comma produces no extra entry",
+			raw:  "10.0.0.0/8,",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name:    "invalid entry",
+			raw:     "not-an-ip",
+			wantErr: true,
+		},
+		{
+			name:    "partially invalid",
+			raw:     "10.0.0.0/8, garbage",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseTrustedProxies(tt.raw)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

relay/cmd/root.go

@@ -24,7 +24,6 @@ import (
 	"github.com/netbirdio/netbird/shared/metrics"
 	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/stun"
-	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -46,9 +45,6 @@ type Config struct {
 	LogLevel                 string
 	LogFile                  string
 	HealthcheckListenAddress string
-	// TrustedProxies is a comma-separated list of upstream proxy CIDRs/IPs whose
-	// X-Real-Ip/X-Real-Port headers are trusted. Empty means never trust these headers.
-	TrustedProxies string
 	// STUN server configuration
 	EnableSTUN   bool
 	STUNPorts    []int
@@ -120,7 +116,6 @@ func init() {
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogLevel, "log-level", "info", "log level")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogFile, "log-file", "console", "log file")
 	rootCmd.PersistentFlags().StringVarP(&cobraConfig.HealthcheckListenAddress, "health-listen-address", "H", ":9000", "listen address of healthcheck server")
-	rootCmd.PersistentFlags().StringVar(&cobraConfig.TrustedProxies, "trusted-proxies", "", "comma-separated list of upstream proxy CIDRs or IPs whose X-Real-Ip/X-Real-Port headers are trusted; leave empty to always use the direct connection address")
 	rootCmd.PersistentFlags().BoolVar(&cobraConfig.EnableSTUN, "enable-stun", false, "enable embedded STUN server")
 	rootCmd.PersistentFlags().IntSliceVar(&cobraConfig.STUNPorts, "stun-ports", []int{3478}, "ports for the embedded STUN server (can be specified multiple times or comma-separated)")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.STUNLogLevel, "stun-log-level", "info", "log level for STUN server (panic, fatal, error, warn, info, debug, trace)")
@@ -160,15 +155,8 @@ func execute(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("setup metrics: %v", err)
 	}
 
-	trustedProxies, err := trustedproxy.Parse(cobraConfig.TrustedProxies)
-	if err != nil {
-		log.Debugf("failed to parse trusted proxies: %s", err)
-		return fmt.Errorf("failed to parse trusted proxies: %s", err)
-	}
-
 	srvListenerCfg := server.ListenerConfig{
-		Address:        cobraConfig.ListenAddress,
-		TrustedProxies: trustedProxies,
+		Address: cobraConfig.ListenAddress,
 	}
 
 	tlsConfig, tlsSupport, err := handleTLSConfig(cobraConfig)
@@ -185,7 +173,7 @@ func execute(cmd *cobra.Command, args []string) error {
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cobraConfig.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
 
 	cfg := server.Config{
 		Meter:          metricsServer.Meter,

relay/server/handshake.go

@@ -5,8 +5,14 @@ import (
 	"fmt"
 	"time"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay/messages"
+	//nolint:staticcheck
+	"github.com/netbirdio/netbird/shared/relay/messages/address"
+	//nolint:staticcheck
+	authmsg "github.com/netbirdio/netbird/shared/relay/messages/auth"
 )
 
 const (
@@ -17,30 +23,55 @@ const (
 
 type Validator interface {
 	Validate(any) error
+	// Deprecated: Use Validate instead.
+	ValidateHelloMsgType(any) error
 }
 
-// preparedMsg contains the marshalled success response message
+// preparedMsg contains the marshalled success response messages
 type preparedMsg struct {
-	responseAuthMsg []byte
+	responseHelloMsg []byte
+	responseAuthMsg  []byte
 }
 
 func newPreparedMsg(instanceURL string) (*preparedMsg, error) {
+	rhm, err := marshalResponseHelloMsg(instanceURL)
+	if err != nil {
+		return nil, err
+	}
+
 	ram, err := messages.MarshalAuthResponse(instanceURL)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal auth response msg: %w", err)
 	}
 
 	return &preparedMsg{
-		responseAuthMsg: ram,
+		responseHelloMsg: rhm,
+		responseAuthMsg:  ram,
 	}, nil
 }
 
+func marshalResponseHelloMsg(instanceURL string) ([]byte, error) {
+	addr := &address.Address{URL: instanceURL}
+	addrData, err := addr.Marshal()
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal response address: %w", err)
+	}
+
+	//nolint:staticcheck
+	responseMsg, err := messages.MarshalHelloResponse(addrData)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal hello response: %w", err)
+	}
+	return responseMsg, nil
+}
+
 type handshake struct {
 	conn        listener.Conn
 	validator   Validator
 	preparedMsg *preparedMsg
 
-	peerID *messages.PeerID
+	handshakeMethodAuth bool
+	peerID              *messages.PeerID
 }
 
 func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, error) {
@@ -62,11 +93,17 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 		return nil, fmt.Errorf("determine message type from %s: %w", h.conn.RemoteAddr(), err)
 	}
 
-	if msgType != messages.MsgTypeAuth {
+	var peerID *messages.PeerID
+	switch msgType {
+	//nolint:staticcheck
+	case messages.MsgTypeHello:
+		peerID, err = h.handleHelloMsg(buf)
+	case messages.MsgTypeAuth:
+		h.handshakeMethodAuth = true
+		peerID, err = h.handleAuthMsg(buf)
+	default:
 		return nil, fmt.Errorf("invalid message type %d from %s", msgType, h.conn.RemoteAddr())
 	}
-
-	peerID, err := h.handleAuthMsg(buf)
 	if err != nil {
 		return peerID, err
 	}
@@ -75,17 +112,46 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 }
 
 func (h *handshake) handshakeResponse(ctx context.Context) error {
-	if _, err := h.conn.Write(ctx, h.preparedMsg.responseAuthMsg); err != nil {
+	var responseMsg []byte
+	if h.handshakeMethodAuth {
+		responseMsg = h.preparedMsg.responseAuthMsg
+	} else {
+		responseMsg = h.preparedMsg.responseHelloMsg
+	}
+
+	if _, err := h.conn.Write(ctx, responseMsg); err != nil {
 		return fmt.Errorf("handshake response write to %s (%s): %w", h.peerID, h.conn.RemoteAddr(), err)
 	}
 
 	return nil
 }
 
+func (h *handshake) handleHelloMsg(buf []byte) (*messages.PeerID, error) {
+	//nolint:staticcheck
+	peerID, authData, err := messages.UnmarshalHelloMsg(buf)
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal hello message: %w", err)
+	}
+
+	log.Warnf("peer %s (%s) is using deprecated initial message type", peerID, h.conn.RemoteAddr())
+
+	authMsg, err := authmsg.UnmarshalMsg(authData)
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal auth message: %w", err)
+	}
+
+	//nolint:staticcheck
+	if err := h.validator.ValidateHelloMsgType(authMsg.AdditionalData); err != nil {
+		return nil, fmt.Errorf("validate %s (%s): %w", peerID, h.conn.RemoteAddr(), err)
+	}
+
+	return peerID, nil
+}
+
 func (h *handshake) handleAuthMsg(buf []byte) (*messages.PeerID, error) {
 	rawPeerID, authPayload, err := messages.UnmarshalAuthMsg(buf)
 	if err != nil {
-		return nil, fmt.Errorf("unmarshal auth message: %w", err)
+		return nil, fmt.Errorf("unmarshal hello message: %w", err)
 	}
 
 	if err := h.validator.Validate(authPayload); err != nil {

relay/server/listener/ws/listener.go

@@ -15,7 +15,6 @@ import (
 	"github.com/netbirdio/netbird/relay/protocol"
 	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -28,9 +27,6 @@ type Listener struct {
 	Address string
 	// TLSConfig is the TLS configuration for the server.
 	TLSConfig *tls.Config
-	// TrustedProxies is the set of upstream proxies whose X-Real-Ip/X-Real-Port
-	// headers are trusted. Headers from any other immediate peer are ignored.
-	TrustedProxies *trustedproxy.List
 
 	server   *http.Server
 	acceptFn func(conn relaylistener.Conn)
@@ -79,7 +75,7 @@ func (l *Listener) Shutdown(ctx context.Context) error {
 }
 
 func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
-	connRemoteAddr := remoteAddr(r, l.TrustedProxies)
+	connRemoteAddr := remoteAddr(r)
 
 	acceptOptions := &websocket.AcceptOptions{
 		OriginPatterns: []string{"*"},
@@ -106,17 +102,9 @@ func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
 	l.acceptFn(conn)
 }
 
-func remoteAddr(r *http.Request, trustedProxies *trustedproxy.List) string {
-	realIP := r.Header.Get("X-Real-Ip")
-	realPort := r.Header.Get("X-Real-Port")
-	if realIP == "" || realPort == "" {
+func remoteAddr(r *http.Request) string {
+	if r.Header.Get("X-Real-Ip") == "" || r.Header.Get("X-Real-Port") == "" {
 		return r.RemoteAddr
 	}
-
-	if !trustedProxies.IsTrusted(r.RemoteAddr) {
-		log.Debugf("ignoring X-Real-Ip header from untrusted peer %s", r.RemoteAddr)
-		return r.RemoteAddr
-	}
-
-	return net.JoinHostPort(realIP, realPort)
+	return net.JoinHostPort(r.Header.Get("X-Real-Ip"), r.Header.Get("X-Real-Port"))
 }

relay/server/server.go

@@ -15,17 +15,14 @@ import (
 	"github.com/netbirdio/netbird/relay/server/listener/quic"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
 	quictls "github.com/netbirdio/netbird/shared/relay/tls"
-	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // ListenerConfig is the configuration for the listener.
 // Address: the address to bind the listener to. It could be an address behind a reverse proxy.
 // TLSConfig: the TLS configuration for the listener.
-// TrustedProxies: upstream proxy prefixes whose forwarding headers (X-Real-Ip/X-Real-Port) are trusted.
 type ListenerConfig struct {
-	Address        string
-	TLSConfig      *tls.Config
-	TrustedProxies *trustedproxy.List
+	Address   string
+	TLSConfig *tls.Config
 }
 
 // Server is the main entry point for the relay server.
@@ -65,9 +62,8 @@ func NewServer(config Config) (*Server, error) {
 // Listen starts the relay server.
 func (r *Server) Listen(cfg ListenerConfig) error {
 	wSListener := &ws.Listener{
-		Address:        cfg.Address,
-		TLSConfig:      cfg.TLSConfig,
-		TrustedProxies: cfg.TrustedProxies,
+		Address:   cfg.Address,
+		TLSConfig: cfg.TLSConfig,
 	}
 
 	r.listenerMux.Lock()

shared/management/http/api/openapi.yml

@@ -5164,10 +5164,6 @@ components:
           type: boolean
           description: Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
           example: false
-        metadata_disabled:
-          type: boolean
-          description: Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
-          example: false
         created_at:
           type: string
           format: date-time
@@ -5188,7 +5184,6 @@ components:
         - models
         - enabled
         - skip_tls_verification
-        - metadata_disabled
         - created_at
         - updated_at
     AgentNetworkProviderRequest:
@@ -5245,10 +5240,6 @@ components:
           type: boolean
           description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
           example: false
-        metadata_disabled:
-          type: boolean
-          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
-          example: false
       required:
         - provider_id
         - name

shared/management/http/api/types.gen.go

@@ -2227,9 +2227,6 @@ type AgentNetworkProvider struct {
 	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
-	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
-	MetadataDisabled bool `json:"metadata_disabled"`
-
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models []AgentNetworkProviderModel `json:"models"`
 
@@ -2281,9 +2278,6 @@ type AgentNetworkProviderRequest struct {
 	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
-	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
-	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
-
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models *[]AgentNetworkProviderModel `json:"models,omitempty"`
 

shared/relay/auth/allow/allow_all.go

@@ -8,3 +8,7 @@ type Auth struct {
 func (a *Auth) Validate(any) error {
 	return nil
 }
+
+func (a *Auth) ValidateHelloMsgType(any) error {
+	return nil
+}

shared/relay/auth/hmac/token.go

@@ -1,8 +1,10 @@
 package hmac
 
 import (
+	"bytes"
 	"crypto/hmac"
 	"encoding/base64"
+	"encoding/gob"
 	"fmt"
 	"hash"
 	"strconv"
@@ -16,6 +18,14 @@ type Token struct {
 	Signature string
 }
 
+func unmarshalToken(payload []byte) (Token, error) {
+	var creds Token
+	buffer := bytes.NewBuffer(payload)
+	decoder := gob.NewDecoder(buffer)
+	err := decoder.Decode(&creds)
+	return creds, err
+}
+
 // TimedHMAC generates a token with TTL and uses a pre-shared secret known to the relay server
 type TimedHMAC struct {
 	secret     string

shared/relay/auth/hmac/validator.go

@@ -0,0 +1,33 @@
+package hmac
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+type TimedHMACValidator struct {
+	*TimedHMAC
+}
+
+func NewTimedHMACValidator(secret string, duration time.Duration) *TimedHMACValidator {
+	ta := NewTimedHMAC(secret, duration)
+	return &TimedHMACValidator{
+		ta,
+	}
+}
+
+func (a *TimedHMACValidator) Validate(credentials any) error {
+	b, ok := credentials.([]byte)
+	if !ok {
+		return fmt.Errorf("invalid credentials type")
+	}
+	c, err := unmarshalToken(b)
+	if err != nil {
+		log.Debugf("failed to unmarshal token: %s", err)
+		return err
+	}
+	return a.TimedHMAC.Validate(sha256.New, c)
+}

shared/relay/auth/validator.go

@@ -1,19 +1,28 @@
 package auth
 
 import (
+	"time"
+
+	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	authv2 "github.com/netbirdio/netbird/shared/relay/auth/hmac/v2"
 )
 
 type TimedHMACValidator struct {
 	authenticatorV2 *authv2.Validator
+	authenticator   *auth.TimedHMACValidator
 }
 
-func NewTimedHMACValidator(secret []byte) *TimedHMACValidator {
+func NewTimedHMACValidator(secret []byte, duration time.Duration) *TimedHMACValidator {
 	return &TimedHMACValidator{
 		authenticatorV2: authv2.NewValidator(secret),
+		authenticator:   auth.NewTimedHMACValidator(string(secret), duration),
 	}
 }
 
 func (a *TimedHMACValidator) Validate(credentials any) error {
 	return a.authenticatorV2.Validate(credentials)
 }
+
+func (a *TimedHMACValidator) ValidateHelloMsgType(credentials any) error {
+	return a.authenticator.Validate(credentials)
+}

shared/relay/messages/address/address.go

@@ -0,0 +1,21 @@
+// Deprecated: This package is deprecated and will be removed in a future release.
+package address
+
+import (
+	"bytes"
+	"encoding/gob"
+	"fmt"
+)
+
+type Address struct {
+	URL string
+}
+
+func (addr *Address) Marshal() ([]byte, error) {
+	var buf bytes.Buffer
+	enc := gob.NewEncoder(&buf)
+	if err := enc.Encode(addr); err != nil {
+		return nil, fmt.Errorf("encode Address: %w", err)
+	}
+	return buf.Bytes(), nil
+}

shared/relay/messages/auth/auth.go

@@ -0,0 +1,43 @@
+// Deprecated: This package is deprecated and will be removed in a future release.
+package auth
+
+import (
+	"bytes"
+	"encoding/gob"
+	"fmt"
+)
+
+type Algorithm int
+
+const (
+	AlgoUnknown Algorithm = iota
+	AlgoHMACSHA256
+	AlgoHMACSHA512
+)
+
+func (a Algorithm) String() string {
+	switch a {
+	case AlgoHMACSHA256:
+		return "HMAC-SHA256"
+	case AlgoHMACSHA512:
+		return "HMAC-SHA512"
+	default:
+		return "Unknown"
+	}
+}
+
+type Msg struct {
+	AuthAlgorithm  Algorithm
+	AdditionalData []byte
+}
+
+func UnmarshalMsg(data []byte) (*Msg, error) {
+	var msg *Msg
+
+	buf := bytes.NewBuffer(data)
+	dec := gob.NewDecoder(buf)
+	if err := dec.Decode(&msg); err != nil {
+		return nil, fmt.Errorf("decode Msg: %w", err)
+	}
+	return msg, nil
+}

shared/relay/messages/message.go

@@ -14,10 +14,9 @@ const (
 	CurrentProtocolVersion = 1
 
 	MsgTypeUnknown MsgType = 0
-	// MsgTypeHello and MsgTypeHelloResponse are the removed legacy handshake
-	// message types. They are retained only to reserve wire values 1 and 2 so
-	// the values are never reused; the server rejects both.
-	MsgTypeHello         = 1
+	// Deprecated: Use MsgTypeAuth instead.
+	MsgTypeHello = 1
+	// Deprecated: Use MsgTypeAuthResponse instead.
 	MsgTypeHelloResponse = 2
 	MsgTypeTransport     = 3
 	MsgTypeClose         = 4
@@ -43,6 +42,10 @@ const (
 	offsetAuthPeerID    = sizeOfProtoHeader + sizeOfMagicByte
 	headerTotalSizeAuth = sizeOfProtoHeader + headerSizeAuth
 
+	// hello message
+	headerSizeHello     = sizeOfMagicByte + peerIDSize
+	headerSizeHelloResp = 0
+
 	// transport
 	headerSizeTransport      = peerIDSize
 	offsetTransportID        = sizeOfProtoHeader
@@ -110,6 +113,7 @@ func DetermineClientMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
+		MsgTypeHello,
 		MsgTypeAuth,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -131,6 +135,7 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
+		MsgTypeHelloResponse,
 		MsgTypeAuthResponse,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -143,6 +148,67 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	}
 }
 
+// Deprecated: Use MarshalAuthMsg instead.
+// MarshalHelloMsg initial hello message
+// The Hello message is the first message sent by a client after establishing a connection with the Relay server. This
+// message is used to authenticate the client with the server. The authentication is done using an HMAC method.
+// The protocol does not limit to use HMAC, it can be any other method. If the authentication failed the server will
+// close the network connection without any response.
+func MarshalHelloMsg(peerID PeerID, additions []byte) ([]byte, error) {
+	msg := make([]byte, sizeOfProtoHeader+sizeOfMagicByte, sizeOfProtoHeader+headerSizeHello+len(additions))
+
+	msg[0] = byte(CurrentProtocolVersion)
+	msg[1] = byte(MsgTypeHello)
+
+	copy(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader)
+
+	msg = append(msg, peerID[:]...)
+	msg = append(msg, additions...)
+
+	return msg, nil
+}
+
+// Deprecated: Use UnmarshalAuthMsg instead.
+// UnmarshalHelloMsg extracts peerID and the additional data from the hello message. The Additional data is used to
+// authenticate the client with the server.
+func UnmarshalHelloMsg(msg []byte) (*PeerID, []byte, error) {
+	if len(msg) < sizeOfProtoHeader+headerSizeHello {
+		return nil, nil, ErrInvalidMessageLength
+	}
+	if !bytes.Equal(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader) {
+		return nil, nil, errors.New("invalid magic header")
+	}
+
+	peerID := PeerID(msg[sizeOfProtoHeader+sizeOfMagicByte : sizeOfProtoHeader+headerSizeHello])
+
+	return &peerID, msg[headerSizeHello:], nil
+}
+
+// Deprecated: Use MarshalAuthResponse instead.
+// MarshalHelloResponse creates a response message to the hello message.
+// In case of success connection the server response with a Hello Response message. This message contains the server's
+// instance URL. This URL will be used by choose the common Relay server in case if the peers are in different Relay
+// servers.
+func MarshalHelloResponse(additionalData []byte) ([]byte, error) {
+	msg := make([]byte, sizeOfProtoHeader, sizeOfProtoHeader+headerSizeHelloResp+len(additionalData))
+
+	msg[0] = byte(CurrentProtocolVersion)
+	msg[1] = byte(MsgTypeHelloResponse)
+
+	msg = append(msg, additionalData...)
+
+	return msg, nil
+}
+
+// Deprecated: Use UnmarshalAuthResponse instead.
+// UnmarshalHelloResponse extracts the additional data from the hello response message.
+func UnmarshalHelloResponse(msg []byte) ([]byte, error) {
+	if len(msg) < sizeOfProtoHeader+headerSizeHelloResp {
+		return nil, ErrInvalidMessageLength
+	}
+	return msg, nil
+}
+
 // MarshalAuthMsg initial authentication message
 // The Auth message is the first message sent by a client after establishing a connection with the Relay server. This
 // message is used to authenticate the client with the server. The authentication is done using an HMAC method.

shared/relay/messages/message_test.go

@@ -4,11 +4,28 @@ import (
 	"testing"
 )
 
-func TestDetermineClientMessageTypeRejectsHello(t *testing.T) {
-	// The reserved legacy Hello message (type 1) must be rejected by the server.
-	msg := []byte{byte(CurrentProtocolVersion), byte(MsgTypeHello)}
-	if _, err := DetermineClientMessageType(msg); err == nil {
-		t.Fatalf("expected hello message type to be rejected")
+func TestMarshalHelloMsg(t *testing.T) {
+	peerID := HashID("abdFAaBcawquEiCMzAabYosuUaGLtSNhKxz+")
+	msg, err := MarshalHelloMsg(peerID, nil)
+	if err != nil {
+		t.Fatalf("error: %v", err)
+	}
+
+	msgType, err := DetermineClientMessageType(msg)
+	if err != nil {
+		t.Fatalf("error: %v", err)
+	}
+
+	if msgType != MsgTypeHello {
+		t.Errorf("expected %d, got %d", MsgTypeHello, msgType)
+	}
+
+	receivedPeerID, _, err := UnmarshalHelloMsg(msg)
+	if err != nil {
+		t.Fatalf("error: %v", err)
+	}
+	if receivedPeerID.String() != peerID.String() {
+		t.Errorf("expected %s, got %s", peerID, receivedPeerID)
 	}
 }
 

trustedproxy/trustedproxy.go

@@ -1,132 +0,0 @@
-package trustedproxy
-
-import (
-	"fmt"
-	"net/netip"
-	"strings"
-)
-
-// List holds a parsed set of trusted upstream proxy prefixes and answers trust
-// questions against it. The zero value (and a nil *List) is a valid, empty list
-// that never trusts any address, so callers can use it without a nil check.
-type List struct {
-	prefixes []netip.Prefix
-}
-
-// Parse parses a comma-separated list of CIDR prefixes or bare IPs into a List.
-// Bare IPs are converted to single-host prefixes (/32 or /128). An empty input
-// yields an empty List that trusts nothing.
-func Parse(raw string) (*List, error) {
-	if raw == "" {
-		return &List{}, nil
-	}
-
-	parts := strings.Split(raw, ",")
-	prefixes := make([]netip.Prefix, 0, len(parts))
-	for _, part := range parts {
-		part = strings.TrimSpace(part)
-		if part == "" {
-			continue
-		}
-
-		prefix, err := netip.ParsePrefix(part)
-		if err == nil {
-			prefixes = append(prefixes, prefix)
-			continue
-		}
-
-		addr, addrErr := netip.ParseAddr(part)
-		if addrErr != nil {
-			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
-		}
-
-		bits := 32
-		if addr.Is6() {
-			bits = 128
-		}
-		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
-	}
-	return &List{prefixes: prefixes}, nil
-}
-
-// FromPrefixes wraps an already-parsed set of prefixes in a List.
-func FromPrefixes(prefixes []netip.Prefix) *List {
-	return &List{prefixes: prefixes}
-}
-
-// Empty reports whether the list contains no prefixes.
-func (l *List) Empty() bool {
-	return l == nil || len(l.prefixes) == 0
-}
-
-// IsTrusted reports whether the given host:port or bare IP falls within the list.
-func (l *List) IsTrusted(remoteAddr string) bool {
-	if l.Empty() {
-		return false
-	}
-	return l.Contains(ExtractHostIP(remoteAddr))
-}
-
-// Contains reports whether the given address falls within any trusted prefix.
-func (l *List) Contains(addr netip.Addr) bool {
-	if l.Empty() || !addr.IsValid() {
-		return false
-	}
-	for _, prefix := range l.prefixes {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}
-
-// ResolveClientIP extracts the real client IP from X-Forwarded-For using the
-// list. It walks the XFF chain right-to-left, skipping IPs that match trusted
-// prefixes; the first untrusted IP is the real client. If the list is empty or
-// remoteAddr is not trusted, it returns the remoteAddr IP directly, ignoring any
-// forwarding headers.
-func (l *List) ResolveClientIP(remoteAddr, xff string) netip.Addr {
-	remoteIP := ExtractHostIP(remoteAddr)
-
-	if l.Empty() || !l.Contains(remoteIP) {
-		return remoteIP
-	}
-
-	if xff == "" {
-		return remoteIP
-	}
-
-	parts := strings.Split(xff, ",")
-	for i := len(parts) - 1; i >= 0; i-- {
-		ip := strings.TrimSpace(parts[i])
-		if ip == "" {
-			continue
-		}
-		addr, err := netip.ParseAddr(ip)
-		if err != nil {
-			continue
-		}
-		addr = addr.Unmap()
-		if !l.Contains(addr) {
-			return addr
-		}
-	}
-
-	if first := strings.TrimSpace(parts[0]); first != "" {
-		if addr, err := netip.ParseAddr(first); err == nil {
-			return addr.Unmap()
-		}
-	}
-	return remoteIP
-}
-
-// ExtractHostIP parses the IP from a host:port string and returns it unmapped.
-func ExtractHostIP(hostPort string) netip.Addr {
-	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
-		return ap.Addr().Unmap()
-	}
-	if addr, err := netip.ParseAddr(hostPort); err == nil {
-		return addr.Unmap()
-	}
-	return netip.Addr{}
-}

trustedproxy/trustedproxy_test.go

@@ -1,216 +0,0 @@
-package trustedproxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParse(t *testing.T) {
-	tests := []struct {
-		name    string
-		raw     string
-		want    []netip.Prefix
-		wantErr bool
-	}{
-		{
-			name: "empty string returns empty list",
-			raw:  "",
-			want: nil,
-		},
-		{
-			name: "single CIDR",
-			raw:  "10.0.0.0/8",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name: "single bare IPv4",
-			raw:  "1.2.3.4",
-			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
-		},
-		{
-			name: "single bare IPv6",
-			raw:  "::1",
-			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
-		},
-		{
-			name: "comma-separated CIDRs",
-			raw:  "10.0.0.0/8, 192.168.1.0/24",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.1.0/24"),
-			},
-		},
-		{
-			name: "mixed CIDRs and bare IPs",
-			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("1.2.3.4/32"),
-				netip.MustParsePrefix("fd00::/8"),
-			},
-		},
-		{
-			name: "whitespace around entries",
-			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.0.0/16"),
-			},
-		},
-		{
-			name: "trailing comma produces no extra entry",
-			raw:  "10.0.0.0/8,",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name:    "invalid entry",
-			raw:     "not-an-ip",
-			wantErr: true,
-		},
-		{
-			name:    "partially invalid",
-			raw:     "10.0.0.0/8, garbage",
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := Parse(tt.raw)
-			if tt.wantErr {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tt.want, got.prefixes)
-		})
-	}
-}
-
-func TestListIsTrusted(t *testing.T) {
-	list, err := Parse("10.0.0.0/8, 192.168.1.0/24, fd00::/8")
-	require.NoError(t, err)
-
-	tests := []struct {
-		name string
-		addr string
-		list *List
-		want bool
-	}{
-		{"nil list", "10.0.0.1", nil, false},
-		{"empty list", "10.0.0.1", &List{}, false},
-		{"IP within /8 prefix", "10.1.2.3", list, true},
-		{"IP within /24 prefix", "192.168.1.100", list, true},
-		{"IP outside all prefixes", "203.0.113.50", list, false},
-		{"boundary IP just outside prefix", "192.168.2.1", list, false},
-		{"unparsable IP", "not-an-ip", list, false},
-		{"IPv6 in trusted range", "fd00::1", list, true},
-		{"IPv6 outside range", "2001:db8::1", list, false},
-		{"empty string", "", list, false},
-		{"host:port within prefix", "10.1.2.3:9999", list, true},
-		{"host:port outside prefix", "203.0.113.50:9999", list, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, tt.list.IsTrusted(tt.addr))
-		})
-	}
-}
-
-func TestListResolveClientIP(t *testing.T) {
-	trusted, err := Parse("10.0.0.0/8, 172.16.0.0/12")
-	require.NoError(t, err)
-
-	tests := []struct {
-		name       string
-		remoteAddr string
-		xff        string
-		list       *List
-		want       netip.Addr
-	}{
-		{
-			name:       "empty list returns RemoteAddr",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4",
-			list:       &List{},
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "nil list returns RemoteAddr",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4",
-			list:       nil,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "untrusted RemoteAddr ignores XFF",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4, 10.0.0.1",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with single client in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr walks past trusted entries in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "",
-			list:       trusted,
-			want:       netip.MustParseAddr("10.0.0.1"),
-		},
-		{
-			name:       "all XFF IPs trusted returns leftmost",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
-			list:       trusted,
-			want:       netip.MustParseAddr("10.0.0.2"),
-		},
-		{
-			name:       "XFF with whitespace",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        " 203.0.113.50 , 10.0.0.2 ",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "XFF with empty segments",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50,,10.0.0.2",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "multi-hop with mixed trust",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "RemoteAddr without port",
-			remoteAddr: "10.0.0.1",
-			xff:        "203.0.113.50",
-			list:       trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, tt.list.ResolveClientIP(tt.remoteAddr, tt.xff))
-		})
-	}
-}