routeselector: make exit-node reconciliation atomic

enforceSingleExitNode took the RouteSelector lock three separate times
(IsDeselectAll, then DeselectRoutes, then SelectRoutes), so a concurrent
DeselectAllRoutes could interleave and be silently undone: SelectRoutes on
its deselectAll branch clears the flag and re-selects the preferred exit
node, overriding the user's "all off".

Move the whole reconciliation into a single locked RouteSelector method
(SetExclusiveExitNode) that checks deselectAll inside the critical section,
so a deselect-all either fully precedes the reconcile (left untouched) or
fully follows it (honoured). No interleaving is possible.

.github/workflows/golang-test-linux.yml

@@ -166,7 +166,7 @@ jobs:
         # resolve; the grep then drops the broken package by path. Without -e,
         # go list aborts with empty stdout and `go test` falls back to the repo
         # root, which has no Go files.
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /client/testutil/privileged)
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags devcert -timeout 10m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui)
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'

.github/workflows/release.yml

@@ -293,11 +293,8 @@ jobs:
           ${{ steps.goreleaser.outputs.artifacts }}
           JSON
 
-          # dockers_v2 artifacts have no top-level goarch field, so match the
-          # per-platform -amd64 tag suffix instead; it works for both the old
-          # dockers and the new dockers_v2 image naming.
           mapfile -t src_images < <(
-            jq -r '.[] | select(.type == "Docker Image") | .name | select(startswith("ghcr.io/") and endswith("-amd64"))' /tmp/goreleaser-artifacts.json
+            jq -r '.[] | select(.type == "Docker Image") | select(.goarch == "amd64") | .name | select(startswith("ghcr.io/"))' /tmp/goreleaser-artifacts.json
           )
 
           for src in "${src_images[@]}"; do

.gitignore

@@ -1,4 +1,3 @@
-.claude
 .idea
 .run
 *.iml

agent-network/README.md

@@ -1,47 +1,16 @@
 # NetBird Agent Network
 
-Agent Network is NetBird's access control layer for AI agents and the people who run them. 
-It gives every agent a real identity, tied to an identity provider (IdP), and governs what it can reach: LLM APIs and 
-AI gateways it can call, and the internal resources it can access. Traffic flows only over the encrypted NetBird tunnel, 
-scoped by policy, with no API keys or other credentials to leak. It also gives you control over cost and token usage.
+Agent Network is NetBird's access control layer for AI agents and the people who run
+them. It gives every agent a real identity, tied to your identity provider (IdP), and
+governs what it can reach — the LLM APIs and AI gateways it can call, and the internal
+resources it can access. Traffic flows only over the encrypted NetBird tunnel, scoped by
+policy, with no API keys to leak.
 
-Because every LLM request passes through an
-identity-aware proxy, you can:
-
-- **Set spending and rate limits** per agent, per user, or per team — with hard caps
-  that stop requests once a budget is reached.
-- **Restrict models and providers** so agents can only call approved (and cost-appropriate)
-  endpoints, keeping expensive models off-limits unless explicitly allowed.
-- **Attribute usage** by tracking token consumption and cost per identity, group, or cost center so every
-  request is tied back to the agent and person responsible.
-- **Reuse your existing AI gateway** — point the proxy at a gateway you already run,
-  keeping its routing and config in place while it adds identity on top, so you skip
-  API key distribution.
-
-https://github.com/user-attachments/assets/44d18286-d8ab-49f8-a457-98ccd66f3268
-
-> **Beta.** Agent Network is in beta, but it's stable and already running in
-> production environments. It's fully open source and can be self-hosted on your own
-> infrastructure, with no vendor lock-in and no data leaving your environment.
+> **Beta.** Agent Network is open source and can be self-hosted on your own
+> infrastructure.
 
 ## How it works
 
-Say you have a simple use case: your Engineering or IT team needs access to Claude Code or Codex, and you want visibility into usage plus the ability to enforce budgets.
-How can you do that without creating a dedicated API key for every team?
-
-With Agent Network you get a private endpoint inside your network, for example: https://mirror.netbird.ai
-Teams configure their agents to point to that endpoint instead of using individual API keys directly. 
-
-This endpoint is only reachable when users are connected to your NetBird network and authenticated through your IdP. Otherwise, it is not accessible from the public internet.
-You can then use this private endpoint to configure your AI agents, whether that is Claude Code, Codex, or another tool.
-
-## Quickstart
-
-Full step-by-step setup:
-**https://docs.netbird.io/agent-network/quickstart**
-
-## Architecture 
-
 Agent Network is built on two existing NetBird capabilities:
 
 - **Overlay network** — the encrypted WireGuard mesh between peers.
@@ -53,9 +22,6 @@ LLM traffic is routed through the proxy's identity-aware pipeline, while interna
 resources (databases, internal APIs, self-hosted models) are reached directly over
 peer-to-peer WireGuard tunnels, governed by the same identities and access policies.
 
-<img width="4720" height="2218" alt="image" src="https://github.com/user-attachments/assets/1afa5da1-4b82-4f8a-a7a8-f417efadf1eb" />
-
-
 ## Where the code lives
 
 There is no separate "agent-network" service — it reuses the reverse-proxy and management

client/android/client.go

@@ -247,9 +247,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/android/env_list.go

@@ -10,7 +10,7 @@ var (
 	EnvKeyNBForceRelay = peer.EnvKeyNBForceRelay
 
 	// EnvKeyNBLazyConn Exported for Android java client to configure lazy connection
-	EnvKeyNBLazyConn = lazyconn.EnvLazyConn
+	EnvKeyNBLazyConn = lazyconn.EnvEnableLazyConn
 
 	// EnvKeyNBInactivityThreshold Exported for Android java client to configure connection inactivity threshold
 	EnvKeyNBInactivityThreshold = lazyconn.EnvInactivityThreshold

client/cmd/login.go

@@ -17,9 +17,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
@@ -333,14 +331,6 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
 
-	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
-	// ssh config, legacy routing) from a previous unclean shutdown and
-	// enable advanced routing before dialing management.
-	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configFilePath).GetStatePath()); err != nil {
-		log.Warnf("failed to restore residual state: %v", err)
-	}
-	nbnet.Init()
-
 	err = foregroundLogin(ctx, cmd, config, setupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)

client/cmd/root.go

@@ -71,14 +71,12 @@ var (
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
 	dnsRouteInterval        time.Duration
-	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
-	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
-	lazyConnEnabled        bool
-	mtu                    uint16
-	profilesDisabled       bool
-	updateSettingsDisabled bool
-	captureEnabled         bool
-	networksDisabled       bool
+	lazyConnEnabled         bool
+	mtu                     uint16
+	profilesDisabled        bool
+	updateSettingsDisabled  bool
+	captureEnabled          bool
+	networksDisabled        bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -212,8 +210,7 @@ func init() {
 	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
 	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
 	upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.")
-	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.")
-	_ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable")
+	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "[Experimental] Enable the lazy connection feature. If enabled, the client will establish connections on-demand. Note: this setting may be overridden by management configuration.")
 
 }
 

client/cmd/service.go

@@ -5,7 +5,6 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"net/http"
 	"runtime"
 	"strings"
 	"sync"
@@ -23,21 +22,15 @@ var serviceCmd = &cobra.Command{
 	Short: "Manage the NetBird daemon service",
 }
 
-const defaultJSONSocket = "unix:///var/run/netbird-http.sock"
-
 var (
-	serviceName      string
-	serviceEnvVars   []string
-	jsonSocket       string
-	enableJSONSocket bool
+	serviceName    string
+	serviceEnvVars []string
 )
 
 type program struct {
 	ctx              context.Context
 	cancel           context.CancelFunc
 	serv             *grpc.Server
-	jsonServ         *http.Server
-	jsonServMu       sync.Mutex
 	serverInstance   *server.Server
 	serverInstanceMu sync.Mutex
 }
@@ -53,8 +46,6 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&updateSettingsDisabled, "disable-update-settings", false, "Disables update settings feature. If enabled, the client will not be able to change or edit any settings. To persist this setting, use: netbird service install --disable-update-settings")
 	serviceCmd.PersistentFlags().BoolVar(&captureEnabled, "enable-capture", false, "Enables packet capture via 'netbird debug capture'. To persist, use: netbird service install --enable-capture")
 	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
-	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
-	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +

client/cmd/service_controller.go

@@ -5,6 +5,9 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"net"
+	"os"
+	"strings"
 	"time"
 
 	"github.com/kardianos/service"
@@ -19,56 +22,41 @@ import (
 	"github.com/netbirdio/netbird/util"
 )
 
-func validateJSONSocketFlags() error {
-	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
-		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
-	}
-	return nil
-}
-
 func (p *program) Start(svc service.Service) error {
 	// Start should not block. Do the actual work async.
 	log.Info("starting NetBird service") //nolint
 
-	if err := validateJSONSocketFlags(); err != nil {
-		return err
-	}
-
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
 	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
 	p.serv = grpc.NewServer()
 
-	daemonListener, err := listenOnAddress(daemonAddr)
+	split := strings.Split(daemonAddr, "://")
+	switch split[0] {
+	case "unix":
+		// cleanup failed close
+		stat, err := os.Stat(split[1])
+		if err == nil && !stat.IsDir() {
+			if err := os.Remove(split[1]); err != nil {
+				log.Debugf("remove socket file: %v", err)
+			}
+		}
+	case "tcp":
+	default:
+		return fmt.Errorf("unsupported daemon address protocol: %v", split[0])
+	}
+
+	listen, err := net.Listen(split[0], split[1])
 	if err != nil {
 		return fmt.Errorf("listen daemon interface: %w", err)
 	}
-
-	var jsonListener *socketListener
-	if enableJSONSocket {
-		jsonListener, err = listenOnAddress(jsonSocket)
-		if err != nil {
-			_ = daemonListener.Close()
-			return fmt.Errorf("listen daemon JSON interface: %w", err)
-		}
-	} else {
-		removeStaleUnixSocketForAddress(jsonSocket)
-	}
-
 	go func() {
-		defer daemonListener.Close()
-		if jsonListener != nil {
-			defer jsonListener.Close()
-		}
+		defer listen.Close()
 
-		if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
-			log.Error(err)
-			return
-		}
-		if jsonListener != nil {
-			if err := jsonListener.chmodUnixSocket("daemon JSON"); err != nil {
-				log.Error(err)
+		if split[0] == "unix" {
+			if err := os.Chmod(split[1], 0666); err != nil {
+				log.Errorf("failed setting daemon permissions: %v", split[1])
 				return
 			}
 		}
@@ -83,16 +71,8 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstance = serverInstance
 		p.serverInstanceMu.Unlock()
 
-		if jsonListener != nil {
-			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
-				log.Fatalf("failed to start daemon JSON server: %v", err)
-			}
-		} else {
-			log.Debug("daemon JSON socket disabled")
-		}
-
-		log.Printf("started daemon server: %v", daemonListener.address)
-		if err := p.serv.Serve(daemonListener.Listener); err != nil {
+		log.Printf("started daemon server: %v", split[1])
+		if err := p.serv.Serve(listen); err != nil {
 			log.Errorf("failed to serve daemon requests: %v", err)
 		}
 	}()
@@ -112,20 +92,6 @@ func (p *program) Stop(srv service.Service) error {
 
 	p.cancel()
 
-	p.jsonServMu.Lock()
-	jsonServ := p.jsonServ
-	p.jsonServMu.Unlock()
-	if jsonServ != nil {
-		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 2*time.Second)
-		if err := jsonServ.Shutdown(shutdownCtx); err != nil {
-			log.Errorf("failed to stop daemon JSON server gracefully: %v", err)
-			if err := jsonServ.Close(); err != nil {
-				log.Errorf("failed to close daemon JSON server: %v", err)
-			}
-		}
-		shutdownCancel()
-	}
-
 	if p.serv != nil {
 		p.serv.Stop()
 	}
@@ -182,9 +148,6 @@ var runCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		if err := validateJSONSocketFlags(); err != nil {
-			return err
-		}
 
 		return s.Run()
 	},
@@ -199,9 +162,6 @@ var startCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		if err := validateJSONSocketFlags(); err != nil {
-			return err
-		}
 
 		if err := s.Start(); err != nil {
 			return fmt.Errorf("start service: %w", err)
@@ -238,9 +198,6 @@ var restartCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		if err := validateJSONSocketFlags(); err != nil {
-			return err
-		}
 
 		if err := s.Restart(); err != nil {
 			return fmt.Errorf("restart service: %w", err)

client/cmd/service_installer.go

@@ -67,10 +67,6 @@ func buildServiceArguments() []string {
 		args = append(args, "--disable-networks")
 	}
 
-	if enableJSONSocket {
-		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
-	}
-
 	return args
 }
 
@@ -110,10 +106,6 @@ func configurePlatformSpecificSettings(svcConfig *service.Config) error {
 
 // Create fully configured service config for install/reconfigure
 func createServiceConfigForInstall() (*service.Config, error) {
-	if err := validateJSONSocketFlags(); err != nil {
-		return nil, err
-	}
-
 	svcConfig, err := newSVCConfig()
 	if err != nil {
 		return nil, fmt.Errorf("create service config: %w", err)

client/cmd/service_json_gateway.go

@@ -1,52 +0,0 @@
-//go:build !ios && !android
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"net"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func grpcGatewayEndpoint(addr string) string {
-	return strings.TrimPrefix(addr, "tcp://")
-}
-
-func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
-	mux := runtime.NewServeMux()
-	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
-	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
-		return err
-	}
-
-	jsonServer := &http.Server{
-		Handler:           mux,
-		ReadHeaderTimeout: 5 * time.Second,
-		BaseContext: func(net.Listener) context.Context {
-			return p.ctx
-		},
-	}
-
-	p.jsonServMu.Lock()
-	p.jsonServ = jsonServer
-	p.jsonServMu.Unlock()
-
-	go func() {
-		log.Printf("started daemon JSON server: %v", jsonListener.address)
-		if err := jsonServer.Serve(jsonListener.Listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
-			log.Errorf("failed to serve daemon JSON requests: %v", err)
-		}
-	}()
-
-	return nil
-}

client/cmd/service_json_socket_test.go

@@ -1,176 +0,0 @@
-//go:build !ios && !android
-
-package cmd
-
-import (
-	"net"
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func preserveJSONSocketTestState(t *testing.T) {
-	t.Helper()
-
-	origJSONSocket := jsonSocket
-	origEnableJSONSocket := enableJSONSocket
-	origChanged := map[string]bool{}
-	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
-		origChanged[flag.Name] = flag.Changed
-	})
-
-	t.Cleanup(func() {
-		jsonSocket = origJSONSocket
-		enableJSONSocket = origEnableJSONSocket
-		serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
-			flag.Changed = origChanged[flag.Name]
-		})
-	})
-}
-
-func TestJSONSocketFlagsArePositiveEnableOnly(t *testing.T) {
-	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("enable-json-socket"))
-	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("json-socket"))
-	assert.Nil(t, serviceCmd.PersistentFlags().Lookup("disable-json-socket"))
-	assert.Equal(t, "false", serviceCmd.PersistentFlags().Lookup("enable-json-socket").DefValue)
-}
-
-func TestBuildServiceArgumentsDefaultDisablesJSONSocket(t *testing.T) {
-	preserveJSONSocketTestState(t)
-
-	enableJSONSocket = false
-	jsonSocket = "tcp://127.0.0.1:8080"
-
-	args := buildServiceArguments()
-
-	assert.NotContains(t, args, "--enable-json-socket")
-	assert.NotContains(t, args, "--json-socket")
-}
-
-func TestBuildServiceArgumentsIncludesJSONSocketWhenEnabled(t *testing.T) {
-	preserveJSONSocketTestState(t)
-
-	enableJSONSocket = true
-	jsonSocket = "tcp://127.0.0.1:8080"
-
-	args := buildServiceArguments()
-
-	enableIndex := indexOfArg(args, "--enable-json-socket")
-	jsonIndex := indexOfArg(args, "--json-socket")
-	require.NotEqual(t, -1, enableIndex)
-	require.NotEqual(t, -1, jsonIndex)
-	require.Less(t, enableIndex, jsonIndex)
-	require.Less(t, jsonIndex+1, len(args))
-	assert.Equal(t, "tcp://127.0.0.1:8080", args[jsonIndex+1])
-}
-
-func TestJSONSocketWithoutEnableValidation(t *testing.T) {
-	preserveJSONSocketTestState(t)
-
-	enableJSONSocket = false
-	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
-
-	err := validateJSONSocketFlags()
-
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--enable-json-socket")
-}
-
-func TestJSONSocketWithEnableValidation(t *testing.T) {
-	preserveJSONSocketTestState(t)
-
-	require.NoError(t, serviceCmd.PersistentFlags().Set("enable-json-socket", "true"))
-	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
-
-	assert.NoError(t, validateJSONSocketFlags())
-}
-
-func TestJSONSocketServiceParamsPersistEnableAndAddress(t *testing.T) {
-	preserveJSONSocketTestState(t)
-	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
-		flag.Changed = false
-	})
-
-	enableJSONSocket = true
-	jsonSocket = "tcp://127.0.0.1:8080"
-
-	params := currentServiceParams()
-	require.True(t, params.EnableJSONSocket)
-	require.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
-
-	enableJSONSocket = false
-	jsonSocket = defaultJSONSocket
-	applyServiceParams(testServiceEnvCommand(), params)
-
-	assert.True(t, enableJSONSocket)
-	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
-}
-
-func TestRemoveStaleUnixSocketDoesNotRemoveRegularFile(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "netbird-http.sock")
-	require.NoError(t, os.WriteFile(path, []byte("not a socket"), 0600))
-
-	removeStaleUnixSocket(path)
-
-	data, err := os.ReadFile(path)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("not a socket"), data)
-}
-
-func TestRemoveStaleUnixSocketRemovesSocket(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("unix sockets are not available on Windows")
-	}
-
-	path := filepath.Join(t.TempDir(), "netbird-http.sock")
-	addr := &net.UnixAddr{Name: path, Net: "unix"}
-	listener, err := net.ListenUnix("unix", addr)
-	require.NoError(t, err)
-	listener.SetUnlinkOnClose(false)
-	require.NoError(t, listener.Close())
-
-	_, err = os.Lstat(path)
-	require.NoError(t, err, "test setup must leave a stale Unix socket path")
-
-	removeStaleUnixSocket(path)
-
-	_, err = os.Lstat(path)
-	assert.True(t, os.IsNotExist(err), "expected stale Unix socket to be removed, got %v", err)
-}
-
-func TestRemoveStaleUnixSocketDoesNotRemoveLiveSocket(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("unix sockets are not available on Windows")
-	}
-
-	path := filepath.Join(t.TempDir(), "netbird-http.sock")
-	listener, err := net.Listen("unix", path)
-	require.NoError(t, err)
-	defer listener.Close()
-
-	removeStaleUnixSocket(path)
-
-	_, err = os.Lstat(path)
-	assert.NoError(t, err, "expected live Unix socket to be preserved")
-}
-
-func testServiceEnvCommand() *cobra.Command {
-	cmd := &cobra.Command{}
-	cmd.Flags().StringSlice("service-env", nil, "")
-	return cmd
-}
-
-func indexOfArg(args []string, arg string) int {
-	for i, candidate := range args {
-		if candidate == arg {
-			return i
-		}
-	}
-	return -1
-}

client/cmd/service_params.go

@@ -23,7 +23,6 @@ const serviceParamsFile = "service.json"
 type serviceParams struct {
 	LogLevel              string            `json:"log_level"`
 	DaemonAddr            string            `json:"daemon_addr"`
-	JSONSocket            string            `json:"json_socket"`
 	ManagementURL         string            `json:"management_url,omitempty"`
 	ConfigPath            string            `json:"config_path,omitempty"`
 	LogFiles              []string          `json:"log_files,omitempty"`
@@ -31,7 +30,6 @@ type serviceParams struct {
 	DisableUpdateSettings bool              `json:"disable_update_settings,omitempty"`
 	EnableCapture         bool              `json:"enable_capture,omitempty"`
 	DisableNetworks       bool              `json:"disable_networks,omitempty"`
-	EnableJSONSocket      bool              `json:"enable_json_socket,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -77,7 +75,6 @@ func currentServiceParams() *serviceParams {
 	params := &serviceParams{
 		LogLevel:              logLevel,
 		DaemonAddr:            daemonAddr,
-		JSONSocket:            jsonSocket,
 		ManagementURL:         managementURL,
 		ConfigPath:            configPath,
 		LogFiles:              logFiles,
@@ -85,7 +82,6 @@ func currentServiceParams() *serviceParams {
 		DisableUpdateSettings: updateSettingsDisabled,
 		EnableCapture:         captureEnabled,
 		DisableNetworks:       networksDisabled,
-		EnableJSONSocket:      enableJSONSocket,
 	}
 
 	if len(serviceEnvVars) > 0 {
@@ -117,8 +113,9 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		return
 	}
 
-	// For fields with non-empty defaults, keep the != "" guard so that an older
-	// service.json missing the field doesn't clobber the default with an empty string.
+	// For fields with non-empty defaults (log-level, daemon-addr), keep the
+	// != "" guard so that an older service.json missing the field doesn't
+	// clobber the default with an empty string.
 	if !rootCmd.PersistentFlags().Changed("log-level") && params.LogLevel != "" {
 		logLevel = params.LogLevel
 	}
@@ -127,14 +124,6 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		daemonAddr = params.DaemonAddr
 	}
 
-	if !serviceCmd.PersistentFlags().Changed("json-socket") && params.JSONSocket != "" {
-		jsonSocket = params.JSONSocket
-	}
-
-	if !serviceCmd.PersistentFlags().Changed("enable-json-socket") {
-		enableJSONSocket = params.EnableJSONSocket
-	}
-
 	// For optional fields where empty means "use default", always apply so
 	// that an explicit clear (--management-url "") persists across reinstalls.
 	if !rootCmd.PersistentFlags().Changed("management-url") {

client/cmd/service_params_test.go

@@ -41,8 +41,6 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 	params := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "unix:///var/run/netbird.sock",
-		JSONSocket:            "tcp://127.0.0.1:8080",
-		EnableJSONSocket:      true,
 		ManagementURL:         "https://my.server.com",
 		ConfigPath:            "/etc/netbird/config.json",
 		LogFiles:              []string{"/var/log/netbird/client.log", "console"},
@@ -65,8 +63,6 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 
 	assert.Equal(t, params.LogLevel, loaded.LogLevel)
 	assert.Equal(t, params.DaemonAddr, loaded.DaemonAddr)
-	assert.Equal(t, params.JSONSocket, loaded.JSONSocket)
-	assert.Equal(t, params.EnableJSONSocket, loaded.EnableJSONSocket)
 	assert.Equal(t, params.ManagementURL, loaded.ManagementURL)
 	assert.Equal(t, params.ConfigPath, loaded.ConfigPath)
 	assert.Equal(t, params.LogFiles, loaded.LogFiles)
@@ -105,8 +101,6 @@ func TestLoadServiceParams_InvalidJSON(t *testing.T) {
 func TestCurrentServiceParams(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
-	origJSONSocket := jsonSocket
-	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -116,8 +110,6 @@ func TestCurrentServiceParams(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
-		jsonSocket = origJSONSocket
-		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -128,8 +120,6 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	logLevel = "trace"
 	daemonAddr = "tcp://127.0.0.1:9999"
-	jsonSocket = "tcp://127.0.0.1:8080"
-	enableJSONSocket = true
 	managementURL = "https://mgmt.example.com"
 	configPath = "/tmp/test-config.json"
 	logFiles = []string{"/tmp/test.log"}
@@ -141,8 +131,6 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	assert.Equal(t, "trace", params.LogLevel)
 	assert.Equal(t, "tcp://127.0.0.1:9999", params.DaemonAddr)
-	assert.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
-	assert.True(t, params.EnableJSONSocket)
 	assert.Equal(t, "https://mgmt.example.com", params.ManagementURL)
 	assert.Equal(t, "/tmp/test-config.json", params.ConfigPath)
 	assert.Equal(t, []string{"/tmp/test.log"}, params.LogFiles)
@@ -154,8 +142,6 @@ func TestCurrentServiceParams(t *testing.T) {
 func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
-	origJSONSocket := jsonSocket
-	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -165,8 +151,6 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
-		jsonSocket = origJSONSocket
-		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -178,8 +162,6 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	// Reset all flags to defaults.
 	logLevel = "info"
 	daemonAddr = "unix:///var/run/netbird.sock"
-	jsonSocket = defaultJSONSocket
-	enableJSONSocket = false
 	managementURL = ""
 	configPath = "/etc/netbird/config.json"
 	logFiles = []string{"/var/log/netbird/client.log"}
@@ -202,8 +184,6 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	saved := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "tcp://127.0.0.1:5555",
-		JSONSocket:            "tcp://127.0.0.1:8080",
-		EnableJSONSocket:      true,
 		ManagementURL:         "https://saved.example.com",
 		ConfigPath:            "/saved/config.json",
 		LogFiles:              []string{"/saved/client.log"},
@@ -221,8 +201,6 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 
 	// All other fields were not Changed, so they should use saved values.
 	assert.Equal(t, "tcp://127.0.0.1:5555", daemonAddr)
-	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
-	assert.True(t, enableJSONSocket)
 	assert.Equal(t, "https://saved.example.com", managementURL)
 	assert.Equal(t, "/saved/config.json", configPath)
 	assert.Equal(t, []string{"/saved/client.log"}, logFiles)
@@ -234,17 +212,14 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 	origProfilesDisabled := profilesDisabled
 	origUpdateSettingsDisabled := updateSettingsDisabled
-	origEnableJSONSocket := enableJSONSocket
 	t.Cleanup(func() {
 		profilesDisabled = origProfilesDisabled
 		updateSettingsDisabled = origUpdateSettingsDisabled
-		enableJSONSocket = origEnableJSONSocket
 	})
 
 	// Simulate current state where booleans are true (e.g. set by previous install).
 	profilesDisabled = true
 	updateSettingsDisabled = true
-	enableJSONSocket = true
 
 	// Reset Changed state so flags appear unset.
 	serviceCmd.PersistentFlags().VisitAll(func(f *pflag.Flag) {
@@ -263,7 +238,6 @@ func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 
 	assert.False(t, profilesDisabled, "saved false should override current true")
 	assert.False(t, updateSettingsDisabled, "saved false should override current true")
-	assert.False(t, enableJSONSocket, "saved false should override current true")
 }
 
 func TestApplyServiceParams_ClearManagementURL(t *testing.T) {
@@ -556,7 +530,6 @@ func fieldToGlobalVar(field string) string {
 	m := map[string]string{
 		"LogLevel":              "logLevel",
 		"DaemonAddr":            "daemonAddr",
-		"JSONSocket":            "jsonSocket",
 		"ManagementURL":         "managementURL",
 		"ConfigPath":            "configPath",
 		"LogFiles":              "logFiles",
@@ -564,7 +537,6 @@ func fieldToGlobalVar(field string) string {
 		"DisableUpdateSettings": "updateSettingsDisabled",
 		"EnableCapture":         "captureEnabled",
 		"DisableNetworks":       "networksDisabled",
-		"EnableJSONSocket":      "enableJSONSocket",
 		"ServiceEnvVars":        "serviceEnvVars",
 	}
 	if v, ok := m[field]; ok {

client/cmd/service_socket.go

@@ -1,111 +0,0 @@
-//go:build !ios && !android
-
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"os"
-	"strings"
-	"syscall"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-type socketListener struct {
-	net.Listener
-	network string
-	address string
-}
-
-func listenOnAddress(addr string) (*socketListener, error) {
-	network, address, err := parseListenAddress(addr)
-	if err != nil {
-		return nil, err
-	}
-
-	if network == "unix" {
-		removeStaleUnixSocket(address)
-	}
-
-	listener, err := net.Listen(network, address)
-	if err != nil {
-		return nil, err
-	}
-
-	return &socketListener{Listener: listener, network: network, address: address}, nil
-}
-
-func parseListenAddress(addr string) (string, string, error) {
-	network, address, ok := strings.Cut(addr, "://")
-	if !ok || network == "" || address == "" {
-		return "", "", fmt.Errorf("address must be in [unix|tcp]://[path|host:port] format: %q", addr)
-	}
-
-	switch network {
-	case "unix", "tcp":
-		return network, address, nil
-	default:
-		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
-	}
-}
-
-func removeStaleUnixSocket(path string) {
-	stat, err := os.Lstat(path)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("stat socket file: %v", err)
-		}
-		return
-	}
-
-	if stat.Mode()&os.ModeSocket == 0 {
-		return
-	}
-
-	if !isStaleUnixSocket(path) {
-		return
-	}
-
-	if err := os.Remove(path); err != nil {
-		log.Debugf("remove socket file: %v", err)
-	}
-}
-
-func isStaleUnixSocket(path string) bool {
-	conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
-	if err == nil {
-		if closeErr := conn.Close(); closeErr != nil {
-			log.Debugf("close unix socket probe: %v", closeErr)
-		}
-		return false
-	}
-
-	if os.IsNotExist(err) || os.IsPermission(err) || os.IsTimeout(err) {
-		log.Debugf("not removing unix socket %s after probe error: %v", path, err)
-		return false
-	}
-
-	return errors.Is(err, syscall.ECONNREFUSED)
-}
-
-func removeStaleUnixSocketForAddress(addr string) {
-	network, address, err := parseListenAddress(addr)
-	if err != nil || network != "unix" {
-		return
-	}
-	removeStaleUnixSocket(address)
-}
-
-func (l *socketListener) chmodUnixSocket(description string) error {
-	if l == nil || l.network != "unix" {
-		return nil
-	}
-
-	if err := os.Chmod(l.address, 0666); err != nil {
-		return fmt.Errorf("failed setting %s permissions for %s: %w", description, l.address, err)
-	}
-	return nil
-}

client/cmd/up.go

@@ -22,8 +22,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
-	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
@@ -231,24 +229,6 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 
-	// Restore residual state left by a previous run that did not shut down
-	// cleanly, mirroring what the daemon does before connecting: it recovers
-	// DNS config (a stale resolv.conf takeover can make the management
-	// hostname unresolvable), firewall rules, ssh config and legacy routing.
-	// Route cleanup itself happens at engine start; nbnet.Init() below lets
-	// the management dial bypass a leftover fwmark rule until then.
-	// Foreground mode is particularly exposed in containers: a crashed
-	// container restarts inside the same (pod) network namespace, so stale
-	// state survives while the process does not.
-	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
-		log.Warnf("failed to restore residual state: %v", err)
-	}
-
-	// Enable advanced routing (as the daemon does on startup) so the
-	// management dial bypasses a leftover fwmark rule instead of being
-	// shunted into a stale routing table.
-	nbnet.Init()
-
 	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
@@ -499,6 +479,10 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		req.DisableIpv6 = &disableIPv6
 	}
 
+	if cmd.Flag(enableLazyConnectionFlag).Changed {
+		req.LazyConnectionEnabled = &lazyConnEnabled
+	}
+
 	return &req
 }
 
@@ -616,6 +600,9 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 		ic.DisableIPv6 = &disableIPv6
 	}
 
+	if cmd.Flag(enableLazyConnectionFlag).Changed {
+		ic.LazyConnectionEnabled = &lazyConnEnabled
+	}
 	return &ic, nil
 }
 
@@ -731,6 +718,9 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		loginRequest.DisableIpv6 = &disableIPv6
 	}
 
+	if cmd.Flag(enableLazyConnectionFlag).Changed {
+		loginRequest.LazyConnectionEnabled = &lazyConnEnabled
+	}
 	return &loginRequest, nil
 }
 

client/firewall/uspfilter/filter.go

@@ -121,7 +121,6 @@ type Manager struct {
 	udpTracker     *conntrack.UDPTracker
 	icmpTracker    *conntrack.ICMPTracker
 	tcpTracker     *conntrack.TCPTracker
-	fragments      *fragmentTracker
 	forwarder      atomic.Pointer[forwarder.Forwarder]
 	pendingCapture atomic.Pointer[forwarder.PacketCapture]
 	logger         *nblog.Logger
@@ -184,41 +183,6 @@ func (d *decoder) decodePacket(data []byte) error {
 	}
 }
 
-// decodeTransport decodes the transport header of a first fragment (which
-// gopacket leaves undecoded) into the decoder and appends its layer type to
-// decoded, so the ACL pipeline can evaluate it like a normal packet. It returns
-// false if the protocol is unsupported or the header is truncated.
-func (d *decoder) decodeTransport(proto layers.IPProtocol, payload []byte) bool {
-	var l4 gopacket.DecodingLayer
-	var layerType gopacket.LayerType
-	var minLen int
-	switch proto {
-	case layers.IPProtocolTCP:
-		l4, layerType, minLen = &d.tcp, layers.LayerTypeTCP, 20
-	case layers.IPProtocolUDP:
-		l4, layerType, minLen = &d.udp, layers.LayerTypeUDP, 8
-	case layers.IPProtocolICMPv4:
-		l4, layerType, minLen = &d.icmp4, layers.LayerTypeICMPv4, 8
-	case layers.IPProtocolICMPv6:
-		l4, layerType, minLen = &d.icmp6, layers.LayerTypeICMPv6, 8
-	default:
-		return false
-	}
-
-	// Reject a fragment too small to hold the full transport header before
-	// decoding: it can't be ACL-evaluated (tiny-fragment attack), and skipping
-	// the decode avoids gopacket allocating an error on the drop path.
-	if len(payload) < minLen {
-		return false
-	}
-
-	if err := l4.DecodeFromBytes(payload, gopacket.NilDecodeFeedback); err != nil {
-		return false
-	}
-	d.decoded = append(d.decoded, layerType)
-	return true
-}
-
 // Create userspace firewall manager constructor
 func Create(iface common.IFaceMapper, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
 	return create(iface, nil, disableServerRoutes, flowLogger, mtu)
@@ -322,8 +286,6 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 	if err := m.localipmanager.UpdateLocalIPs(iface); err != nil {
 		return nil, fmt.Errorf("update local IPs: %w", err)
 	}
-	m.fragments = newFragmentTracker(m.logger)
-
 	if disableConntrack {
 		log.Info("conntrack is disabled")
 	} else {
@@ -337,7 +299,6 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 		}
 	}
 	if err := iface.SetFilter(m); err != nil {
-		m.fragments.Close()
 		return nil, fmt.Errorf("set filter: %w", err)
 	}
 	return m, nil
@@ -733,10 +694,6 @@ func (m *Manager) resetState() {
 		m.tcpTracker.Close()
 	}
 
-	if m.fragments != nil {
-		m.fragments.Close()
-	}
-
 	if fwder := m.forwarder.Load(); fwder != nil {
 		fwder.SetCapture(nil)
 		fwder.Stop()
@@ -1089,20 +1046,19 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 		return true
 	}
 
-	// gopacket does not decode the transport header of any IP fragment, so
-	// fragments take a dedicated path: the first fragment's header is decoded
-	// and ACL-evaluated here, and the remaining fragments inherit its verdict.
+	// TODO: pass fragments of routed packets to forwarder
 	if fragment {
-		return m.filterInboundFragment(d, srcIP, dstIP, size)
+		if m.logger.Enabled(nblog.LevelTrace) {
+			if d.decoded[0] == layers.LayerTypeIPv4 {
+				m.logger.Trace4("packet is a fragment: src=%v dst=%v id=%v flags=%v",
+					srcIP, dstIP, d.ip4.Id, d.ip4.Flags)
+			} else {
+				m.logger.Trace2("packet is an IPv6 fragment: src=%v dst=%v", srcIP, dstIP)
+			}
+		}
+		return false
 	}
 
-	return m.filterInboundDecoded(d, srcIP, dstIP, packetData, size)
-}
-
-// filterInboundDecoded runs the ACL, DNAT and conntrack pipeline on a fully
-// decoded (non-fragment) inbound packet. It returns true if the packet should
-// be dropped.
-func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	// TODO: optimize port DNAT by caching matched rules in conntrack
 	if translated := m.translateInboundPortDNAT(packetData, d, srcIP, dstIP); translated {
 		// Re-decode after port DNAT translation to update port information
@@ -1133,226 +1089,33 @@ func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, pack
 	return m.handleRoutedTraffic(d, srcIP, dstIP, packetData, size)
 }
 
-// fragmentMeta holds the reassembly identity and layout of an IP fragment,
-// extracted uniformly for IPv4 and IPv6.
-type fragmentMeta struct {
-	key fragmentKey
-	// offset is the fragment offset in 8-byte units (zero for the first
-	// fragment).
-	offset uint16
-	// moreFragments is the More Fragments bit. A first fragment with it unset is
-	// an IPv6 atomic fragment (a complete datagram, RFC 6946): it has no trailing
-	// fragments to inherit a verdict, so it must not be recorded.
-	moreFragments bool
-	proto         layers.IPProtocol
-	// l4payload is the fragmentable payload of this fragment. For the first
-	// fragment it starts with the transport header.
-	l4payload []byte
-	// headerEndOctets is the first fragment's payload length in 8-byte units:
-	// the smallest offset a trailing fragment may start at without overlapping
-	// the inspected transport header.
-	headerEndOctets uint16
-}
-
-// fragmentMetadata extracts the fragment identity and layout from a decoded IP
-// fragment. It returns false for fragments it can't interpret (e.g. an IPv6
-// fragment header shorter than 8 bytes), which are then dropped.
-func fragmentMetadata(d *decoder, srcIP, dstIP netip.Addr) (fragmentMeta, bool) {
-	switch d.decoded[0] {
-	case layers.LayerTypeIPv4:
-		payload := d.ip4.Payload
-		return fragmentMeta{
-			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: uint32(d.ip4.Id), proto: uint8(d.ip4.Protocol)},
-			offset:          d.ip4.FragOffset,
-			moreFragments:   d.ip4.Flags&layers.IPv4MoreFragments != 0,
-			proto:           d.ip4.Protocol,
-			l4payload:       payload,
-			headerEndOctets: octets(len(payload)),
-		}, true
-
-	case layers.LayerTypeIPv6:
-		// IPv6 fragment extension header: 8 bytes, followed by the fragmentable
-		// payload. Layout: next header (1), reserved (1), offset+flags (2), id (4).
-		payload := d.ip6.Payload
-		if len(payload) < 8 {
-			return fragmentMeta{}, false
-		}
-		nextHeader := layers.IPProtocol(payload[0])
-		offsetFlags := binary.BigEndian.Uint16(payload[2:4])
-		id := binary.BigEndian.Uint32(payload[4:8])
-		l4 := payload[8:]
-		return fragmentMeta{
-			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: id, proto: uint8(nextHeader)},
-			offset:          offsetFlags >> 3,
-			moreFragments:   offsetFlags&1 != 0,
-			proto:           nextHeader,
-			l4payload:       l4,
-			headerEndOctets: octets(len(l4)),
-		}, true
-
-	default:
-		return fragmentMeta{}, false
-	}
-}
-
-// octets rounds a byte length up to whole 8-byte units, the granularity of the
-// IP fragment offset field.
-func octets(nbytes int) uint16 {
-	return uint16((nbytes + 7) / 8)
-}
-
-// filterInboundFragment decides the fate of an IP fragment. gopacket stops
-// decoding at the network layer for every fragment, so the first fragment's
-// transport header is decoded and ACL-evaluated here and its verdict recorded;
-// the remaining (headerless) fragments inherit that verdict. Anything that
-// cannot be tied to an allowed, non-overlapping first fragment is dropped.
-func (m *Manager) filterInboundFragment(d *decoder, srcIP, dstIP netip.Addr, size int) bool {
-	meta, ok := fragmentMetadata(d, srcIP, dstIP)
-	if !ok {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace2("dropping unsupported fragment: src=%v dst=%v", srcIP, dstIP)
-		}
-		return true
-	}
-
-	if meta.offset != 0 {
-		return m.filterTrailingFragment(meta, srcIP, dstIP)
-	}
-
-	// A new first fragment supersedes any recorded verdict for this datagram, so
-	// a re-sent or overlapping offset-zero fragment can't inherit the old one.
-	m.fragments.poison(meta.key)
-
-	// First fragment: decode its transport header so the ACL can evaluate it. A
-	// decode failure means the fragment is too small to hold the full transport
-	// header (RFC 1858 §3 tiny-fragment attack); it can't be evaluated, so drop it.
-	if !d.decodeTransport(meta.proto, meta.l4payload) {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping first fragment without full L4 header: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	}
-
-	return m.filterFirstFragment(d, meta, srcIP, dstIP, size)
-}
-
-// filterTrailingFragment applies a recorded first-fragment verdict to a
-// non-first fragment.
-func (m *Manager) filterTrailingFragment(meta fragmentMeta, srcIP, dstIP netip.Addr) bool {
-	switch m.fragments.verdict(meta.key, meta.offset) {
-	case fragmentAllow:
-		return false
-	case fragmentOverlap:
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping overlapping fragment rewriting inspected header: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	default:
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping fragment with no allowed first fragment: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	}
-}
-
-// filterFirstFragment runs the verdict part of the inbound pipeline on a first
-// fragment with its transport header decoded. It mirrors filterInboundDecoded
-// but skips DNAT (port rewriting on fragments is unsupported) and forwarder
-// injection (fragments are left to the stack to reassemble, not forwarded).
-// Allowed fragments have their verdict recorded so the datagram's trailing
-// fragments inherit it.
-func (m *Manager) filterFirstFragment(d *decoder, meta fragmentMeta, srcIP, dstIP netip.Addr, size int) bool {
-	if m.stateful && m.isValidTrackedConnection(d, srcIP, dstIP, size) {
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	if m.localipmanager.IsLocalIP(dstIP) {
-		ruleID, blocked := m.peerACLsBlock(srcIP, d, nil)
-		if blocked {
-			m.storeDropFlow("Dropping local first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				d, srcIP, dstIP, ruleID, size)
-			return true
-		}
-		m.trackInbound(d, srcIP, dstIP, ruleID, size)
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	if !m.routingEnabled.Load() {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace2("Dropping routed fragment (routing disabled): src=%s dst=%s", srcIP, dstIP)
-		}
-		return true
-	}
-	if m.nativeRouter.Load() {
-		m.trackInbound(d, srcIP, dstIP, nil, size)
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	// TODO: pass fragments of routed packets to the forwarder; until then
-	// allowed routed fragments go to the native stack.
-	srcPort, dstPort := getPortsFromPacket(d)
-	ruleID, pass := m.routeACLsPass(srcIP, dstIP, d.decoded[1], srcPort, dstPort)
-	if !pass {
-		m.storeDropFlow("Dropping routed first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
-		return true
-	}
-
-	m.recordFirstFragment(meta)
-	return false
-}
-
-// recordFirstFragment caches an allowed first fragment's verdict for its
-// trailing fragments to inherit. Atomic fragments (no More Fragments bit) are
-// complete datagrams with no trailing fragments, so they are not cached and
-// cannot exhaust the verdict table.
-func (m *Manager) recordFirstFragment(meta fragmentMeta) {
-	if !meta.moreFragments {
-		return
-	}
-	m.fragments.recordAllowed(meta.key, meta.headerEndOctets)
-}
-
-// storeDropFlow logs and records a netflow drop event for an inbound packet
-// denied by the ACLs. msg is the trace format taking rule id, protocol, source
-// and destination.
-func (m *Manager) storeDropFlow(msg string, d *decoder, srcIP, dstIP netip.Addr, ruleID []byte, size int) {
-	pnum := getProtocolFromPacket(d)
-	srcPort, dstPort := getPortsFromPacket(d)
-
-	if m.logger.Enabled(nblog.LevelTrace) {
-		m.logger.Trace6(msg, ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
-	}
-
-	m.flowLogger.StoreEvent(nftypes.EventFields{
-		FlowID:     uuid.New(),
-		Type:       nftypes.TypeDrop,
-		RuleID:     ruleID,
-		Direction:  nftypes.Ingress,
-		Protocol:   pnum,
-		SourceIP:   srcIP,
-		DestIP:     dstIP,
-		SourcePort: srcPort,
-		DestPort:   dstPort,
-		// TODO: icmp type/code
-		RxPackets: 1,
-		RxBytes:   uint64(size),
-	})
-}
-
 // handleLocalTraffic handles local traffic.
 // If it returns true, the packet should be dropped.
 func (m *Manager) handleLocalTraffic(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	ruleID, blocked := m.peerACLsBlock(srcIP, d, packetData)
 	if blocked {
-		m.storeDropFlow("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
+		pnum := getProtocolFromPacket(d)
+		srcPort, dstPort := getPortsFromPacket(d)
+
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace6("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
+		}
+
+		m.flowLogger.StoreEvent(nftypes.EventFields{
+			FlowID:     uuid.New(),
+			Type:       nftypes.TypeDrop,
+			RuleID:     ruleID,
+			Direction:  nftypes.Ingress,
+			Protocol:   pnum,
+			SourceIP:   srcIP,
+			DestIP:     dstIP,
+			SourcePort: srcPort,
+			DestPort:   dstPort,
+			// TODO: icmp type/code
+			RxPackets: 1,
+			RxBytes:   uint64(size),
+		})
 		return true
 	}
 
@@ -1405,8 +1168,27 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe
 
 	ruleID, pass := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
 	if !pass {
-		m.storeDropFlow("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
+		proto := getProtocolFromPacket(d)
+
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace6("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				ruleID, proto, srcIP, srcPort, dstIP, dstPort)
+		}
+
+		m.flowLogger.StoreEvent(nftypes.EventFields{
+			FlowID:     uuid.New(),
+			Type:       nftypes.TypeDrop,
+			RuleID:     ruleID,
+			Direction:  nftypes.Ingress,
+			Protocol:   proto,
+			SourceIP:   srcIP,
+			DestIP:     dstIP,
+			SourcePort: srcPort,
+			DestPort:   dstPort,
+			// TODO: icmp type/code
+			RxPackets: 1,
+			RxBytes:   uint64(size),
+		})
 		return true
 	}
 

client/firewall/uspfilter/forwarder/forwarder.go

@@ -5,9 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"runtime"
-	"strconv"
 	"sync"
 	"time"
 
@@ -33,11 +31,6 @@ const (
 	defaultMaxInFlight   = 1024
 	iosReceiveWindow     = 16384
 	iosMaxInFlight       = 256
-
-	// envForceTCPRACK overrides the platform default for gVisor's RACK loss
-	// detection. Set to a truthy value to force RACK on, or a falsy value to
-	// force it off, on any platform.
-	envForceTCPRACK = "NB_FORCE_TCP_RACK"
 )
 
 type Forwarder struct {
@@ -159,8 +152,6 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 		maxInFlight = iosMaxInFlight
 	}
 
-	configureTCPRecovery(s)
-
 	tcpForwarder := tcp.NewForwarder(s, receiveWindow, maxInFlight, f.handleTCP)
 	s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
 
@@ -475,31 +466,3 @@ func probeRawICMP(network, addr string, logger *nblog.Logger) bool {
 	logger.Debug1("forwarder: raw %s socket access available", network)
 	return true
 }
-
-// configureTCPRecovery disables gVisor's RACK loss detection on Windows, where
-// it interacts poorly with the host and collapses throughput on routed TCP
-// connections (gVisor issue #9778). Other platforms keep the default. The
-// EnvForceTCPRACK environment variable overrides the platform default.
-func configureTCPRecovery(s *stack.Stack) {
-	disableRACK := runtime.GOOS == "windows"
-
-	if val := os.Getenv(envForceTCPRACK); val != "" {
-		force, err := strconv.ParseBool(val)
-		if err != nil {
-			log.Warnf("parse %s: %v", envForceTCPRACK, err)
-		} else {
-			disableRACK = !force
-		}
-	}
-
-	if !disableRACK {
-		return
-	}
-
-	opt := tcpip.TCPRecovery(0)
-	if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
-		log.Warnf("disable TCP RACK loss detection: %v", err)
-		return
-	}
-	log.Info("forwarder: TCP RACK loss detection disabled")
-}

client/firewall/uspfilter/fragment.go

@@ -1,204 +0,0 @@
-package uspfilter
-
-import (
-	"context"
-	"net/netip"
-	"os"
-	"strconv"
-	"sync"
-	"time"
-
-	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
-)
-
-const (
-	// defaultFragmentTimeout bounds how long a first-fragment verdict is kept
-	// while the remaining fragments arrive. It mirrors the Linux IP reassembly
-	// timeout (net.ipv4.ipfrag_time).
-	defaultFragmentTimeout = 30 * time.Second
-	// fragmentCleanupInterval is how often expired verdicts are purged.
-	fragmentCleanupInterval = 10 * time.Second
-	// defaultMaxFragmentEntries caps the number of concurrently tracked
-	// fragmented datagrams. The table stays bounded because each datagram is a
-	// single small entry regardless of how many fragments it is split into, and
-	// the 13-bit IPv4 fragment-offset field limits any datagram to 64 KiB.
-	defaultMaxFragmentEntries = 16384
-
-	// EnvFragmentMaxEntries overrides defaultMaxFragmentEntries.
-	EnvFragmentMaxEntries = "NB_FRAGMENT_MAX_ENTRIES"
-)
-
-// fragmentVerdict is the decision for a trailing (headerless) fragment.
-type fragmentVerdict int
-
-const (
-	// fragmentDeny drops the fragment: no allowed first fragment is on record.
-	fragmentDeny fragmentVerdict = iota
-	// fragmentAllow passes the fragment: it belongs to an allowed datagram and
-	// does not overlap the already-inspected transport header.
-	fragmentAllow
-	// fragmentOverlap drops the fragment and poisons its datagram: it overlaps
-	// the transport header the ACL inspected (RFC 1858 §4, RFC 3128; RFC 5722
-	// requires discarding the whole datagram on overlap for IPv6).
-	fragmentOverlap
-)
-
-// fragmentKey identifies a fragmented datagram. It matches the RFC 791 / RFC
-// 8200 reassembly key: source, destination, protocol and identification. The id
-// is 32-bit to hold both the IPv4 (16-bit) and IPv6 (32-bit) identification.
-type fragmentKey struct {
-	srcIP netip.Addr
-	dstIP netip.Addr
-	id    uint32
-	proto uint8
-}
-
-// fragmentEntry records the verdict of an allowed first fragment.
-type fragmentEntry struct {
-	// headerEndOctets is the offset, in 8-byte units, at which the first
-	// fragment's payload ended. A trailing fragment starting before this
-	// overlaps bytes the ACL already inspected and is rejected.
-	headerEndOctets uint16
-	// recordedAt is when the first fragment was accepted. The verdict expires a
-	// fixed timeout later and is not refreshed, mirroring the kernel reassembly
-	// timer so a trailing-fragment flood can't keep a datagram alive.
-	recordedAt time.Time
-}
-
-// fragmentTracker records the ACL verdict of a datagram's first fragment so the
-// remaining fragments, which carry no L4 header, can inherit the decision
-// without reassembling the datagram. Only allowed first fragments are stored;
-// anything that cannot be tied to an allowed, non-overlapping first fragment is
-// dropped (fail closed).
-type fragmentTracker struct {
-	logger  *nblog.Logger
-	mutex   sync.Mutex
-	entries map[fragmentKey]fragmentEntry
-	timeout time.Duration
-	// maxEntries caps the table; atCapacity dedups the capacity warning until
-	// the table drains below the cap again.
-	maxEntries    int
-	atCapacity    bool
-	cleanupTicker *time.Ticker
-	cancel        context.CancelFunc
-}
-
-func newFragmentTracker(logger *nblog.Logger) *fragmentTracker {
-	ctx, cancel := context.WithCancel(context.Background())
-	t := &fragmentTracker{
-		logger:        logger,
-		entries:       make(map[fragmentKey]fragmentEntry),
-		timeout:       defaultFragmentTimeout,
-		maxEntries:    fragmentMaxEntries(logger),
-		cleanupTicker: time.NewTicker(fragmentCleanupInterval),
-		cancel:        cancel,
-	}
-	go t.cleanupRoutine(ctx)
-	return t
-}
-
-func fragmentMaxEntries(logger *nblog.Logger) int {
-	v := os.Getenv(EnvFragmentMaxEntries)
-	if v == "" {
-		return defaultMaxFragmentEntries
-	}
-	n, err := strconv.Atoi(v)
-	if err != nil || n <= 0 {
-		logger.Warn2("invalid %s=%q, using default", EnvFragmentMaxEntries, v)
-		return defaultMaxFragmentEntries
-	}
-	return n
-}
-
-// recordAllowed stores the verdict of an allowed first fragment. headerEndOctets
-// is the first fragment's payload length in 8-byte units. When the table is full
-// the record is dropped, which fails closed: the datagram's trailing fragments
-// will be denied.
-func (t *fragmentTracker) recordAllowed(key fragmentKey, headerEndOctets uint16) {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	if t.entries == nil {
-		return
-	}
-	if _, ok := t.entries[key]; !ok && len(t.entries) >= t.maxEntries {
-		if !t.atCapacity {
-			t.atCapacity = true
-			t.logger.Warn2("fragment verdict table at capacity (%d/%d): trailing fragments of new datagrams will be dropped",
-				len(t.entries), t.maxEntries)
-		}
-		return
-	}
-	t.entries[key] = fragmentEntry{
-		headerEndOctets: headerEndOctets,
-		recordedAt:      time.Now(),
-	}
-}
-
-// poison drops any recorded verdict for a datagram, so its later fragments are
-// denied until a new allowed first fragment is recorded. Called on every
-// offset-zero fragment to defeat offset-zero overlap rewrites (RFC 3128).
-func (t *fragmentTracker) poison(key fragmentKey) {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	delete(t.entries, key)
-}
-
-// verdict decides the fate of a trailing fragment at fragOffsetOctets (the IPv4
-// fragment offset, in 8-byte units). A fragment overlapping the inspected
-// header poisons the datagram: the entry is removed so all further fragments of
-// that datagram are denied too.
-func (t *fragmentTracker) verdict(key fragmentKey, fragOffsetOctets uint16) fragmentVerdict {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	entry, ok := t.entries[key]
-	if !ok {
-		return fragmentDeny
-	}
-	if time.Since(entry.recordedAt) > t.timeout {
-		delete(t.entries, key)
-		return fragmentDeny
-	}
-	if fragOffsetOctets < entry.headerEndOctets {
-		delete(t.entries, key)
-		return fragmentOverlap
-	}
-	return fragmentAllow
-}
-
-func (t *fragmentTracker) cleanupRoutine(ctx context.Context) {
-	defer t.cleanupTicker.Stop()
-	for {
-		select {
-		case <-t.cleanupTicker.C:
-			t.cleanup()
-		case <-ctx.Done():
-			return
-		}
-	}
-}
-
-func (t *fragmentTracker) cleanup() {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	for key, entry := range t.entries {
-		if time.Since(entry.recordedAt) > t.timeout {
-			delete(t.entries, key)
-		}
-	}
-
-	if len(t.entries) < t.maxEntries {
-		t.atCapacity = false
-	}
-}
-
-// Close stops the cleanup routine and releases resources.
-func (t *fragmentTracker) Close() {
-	t.cancel()
-
-	t.mutex.Lock()
-	t.entries = nil
-	t.mutex.Unlock()
-}

client/firewall/uspfilter/fragment_bench_test.go

@@ -1,115 +0,0 @@
-package uspfilter
-
-import (
-	"encoding/binary"
-	"testing"
-)
-
-// benchFilterInbound drives filterInbound over a fixed packet in a tight loop.
-// Packets are built once, outside the timed region, so the benchmark measures
-// only pipeline cost, which is what an attacker can amplify.
-func benchFilterInbound(b *testing.B, pkt []byte) {
-	b.Helper()
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		m := benchManager
-		m.filterInbound(pkt, len(pkt))
-	}
-}
-
-// benchManager is a package-level manager reused across fragment benchmarks so
-// setup cost stays out of the timed region.
-var benchManager *Manager
-
-func setupBenchManager(b *testing.B) *Manager {
-	b.Helper()
-	m := newFragmentTestManager(b)
-	allowUDP(b, m, 8080)
-	// Disable conntrack so the allowed-first-fragment path measures transport
-	// decode + ACL every iteration instead of matching the connection tracked
-	// on the first iteration.
-	m.stateful = false
-	benchManager = m
-	return m
-}
-
-// BenchmarkInbound_NormalPacket is the baseline: a full, non-fragmented UDP
-// packet that passes the ACL. Fragment paths should stay comparable to this.
-func BenchmarkInbound_NormalPacket(b *testing.B) {
-	setupBenchManager(b)
-	pkt := normalUDPPacket(b, 8080, 32)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_FirstFragmentAllowed measures the first-fragment path:
-// transport decode + ACL evaluation + verdict record.
-func BenchmarkInbound_FirstFragmentAllowed(b *testing.B) {
-	setupBenchManager(b)
-	pkt := firstFragmentUDP(b, 0x2000, 8080, 32)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentAllowed measures the common trailing-fragment
-// path: a single map lookup after the first fragment is on record.
-func BenchmarkInbound_TrailingFragmentAllowed(b *testing.B) {
-	m := setupBenchManager(b)
-	first := firstFragmentUDP(b, 0x3000, 8080, 32)
-	m.filterInbound(first, len(first))
-	pkt := trailingFragment(b, 0x3000, 5, false, 24)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentNoFirst is the primary DoS vector: an
-// attacker floods trailing fragments with no first fragment on record. Each is
-// a map miss and must be cheap.
-func BenchmarkInbound_TrailingFragmentNoFirst(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x4000, 185, false, 40)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TinyFirstFragment measures the tiny-fragment drop path: a
-// first fragment too small to decode a transport header.
-func BenchmarkInbound_TinyFirstFragment(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x5000, 0, true, 4)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentDistinctIDs is the worst case for the
-// verdict table: an attacker varies the datagram id on every packet so no first
-// fragment ever matches. Verdict lookups always miss and nothing is recorded,
-// so the table cannot grow. Each iteration rewrites the id field in place.
-func BenchmarkInbound_TrailingFragmentDistinctIDs(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x6000, 185, false, 40)
-	m := benchManager
-
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		// IPv4 identification field is at bytes 4:6.
-		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
-		m.filterInbound(pkt, len(pkt))
-	}
-}
-
-// BenchmarkInbound_FirstFragmentDistinctIDs measures sustained first-fragment
-// pressure with distinct ids: transport decode + ACL + verdict insert until the
-// table caps, exercising the map growth and capacity guard.
-func BenchmarkInbound_FirstFragmentDistinctIDs(b *testing.B) {
-	setupBenchManager(b)
-	pkt := firstFragmentUDP(b, 0x7000, 8080, 32)
-	m := benchManager
-
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
-		m.filterInbound(pkt, len(pkt))
-	}
-}

client/firewall/uspfilter/fragment_test.go

@@ -1,554 +0,0 @@
-package uspfilter
-
-import (
-	"encoding/binary"
-	"net"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/google/gopacket"
-	"github.com/google/gopacket/layers"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	nbiface "github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-const (
-	fragTestSrc   = "100.10.0.1"
-	fragTestDst   = "100.10.0.100"
-	fragTestSrcV6 = "fd00::1"
-	fragTestDstV6 = "fd00::100"
-)
-
-func newFragmentTestManager(tb testing.TB) *Manager {
-	tb.Helper()
-
-	ifaceMock := &IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr(fragTestDst),
-				Network: netip.MustParsePrefix("100.10.0.0/16"),
-				IPv6:    netip.MustParseAddr(fragTestDstV6),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
-	require.NoError(tb, err)
-	require.NoError(tb, m.UpdateLocalIPs())
-	tb.Cleanup(func() { require.NoError(tb, m.Close(nil)) })
-	return m
-}
-
-// firstFragmentUDPTo builds the first fragment of a fragmented UDP datagram to
-// the given destination: it carries the full UDP header plus payloadLen bytes
-// of data, with the More Fragments flag set and offset zero.
-func firstFragmentUDPTo(tb testing.TB, dst string, id uint16, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       id,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(dst),
-		Flags:    layers.IPv4MoreFragments,
-	}
-	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func firstFragmentUDP(tb testing.TB, id uint16, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-	return firstFragmentUDPTo(tb, fragTestDst, id, dstPort, payloadLen)
-}
-
-// firstFragmentTCP builds the first fragment of a fragmented TCP datagram: the
-// full 20-byte TCP header plus 12 bytes of data, with the More Fragments flag
-// set and offset zero.
-func firstFragmentTCP(tb testing.TB, id uint16, dstPort uint16) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       id,
-		Protocol: layers.IPProtocolTCP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(fragTestDst),
-		Flags:    layers.IPv4MoreFragments,
-	}
-	tcp := &layers.TCP{SrcPort: 40000, DstPort: layers.TCPPort(dstPort), SYN: true, Window: 64240}
-	require.NoError(tb, tcp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, tcp, gopacket.Payload(make([]byte, 12))))
-	return buf.Bytes()
-}
-
-// trailingFragmentTo builds a non-first fragment to the given destination: an
-// IPv4 header at the given fragment offset (in 8-byte units) carrying raw
-// payload and no L4 header.
-func trailingFragmentTo(tb testing.TB, dst string, proto layers.IPProtocol, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:    4,
-		TTL:        64,
-		Id:         id,
-		Protocol:   proto,
-		SrcIP:      net.ParseIP(fragTestSrc),
-		DstIP:      net.ParseIP(dst),
-		FragOffset: fragOffsetOctets,
-	}
-	if moreFragments {
-		ip.Flags = layers.IPv4MoreFragments
-	}
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func trailingFragment(tb testing.TB, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
-	tb.Helper()
-	return trailingFragmentTo(tb, fragTestDst, layers.IPProtocolUDP, id, fragOffsetOctets, moreFragments, payloadLen)
-}
-
-// outboundUDPPacket builds a complete outbound UDP packet from the local
-// address, used to establish conntrack state for reply-direction tests.
-func outboundUDPPacket(tb testing.TB, srcPort, dstPort uint16) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       1,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestDst),
-		DstIP:    net.ParseIP(fragTestSrc),
-	}
-	udp := &layers.UDP{SrcPort: layers.UDPPort(srcPort), DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, 16))))
-	return buf.Bytes()
-}
-
-// normalUDPPacket builds a complete, non-fragmented UDP packet for baseline
-// comparisons against the fragment paths.
-func normalUDPPacket(tb testing.TB, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       1,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(fragTestDst),
-	}
-	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func allowUDP(tb testing.TB, m *Manager, dstPort uint16) {
-	tb.Helper()
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{dstPort}}, fw.ActionAccept, "")
-	require.NoError(tb, err)
-}
-
-// TestFragment_TrailingWithoutFirstDropped is the core bypass repro: a trailing
-// fragment with no allowed first fragment on record must be dropped. Before the
-// fix, filterInbound returned false (allow) for any fragment.
-func TestFragment_TrailingWithoutFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	frag := trailingFragment(t, 0x1234, 185, false, 40)
-	require.True(t, m.filterInbound(frag, len(frag)),
-		"trailing fragment without an allowed first fragment must be dropped")
-}
-
-// TestFragment_AllowedFirstPassesTrailing verifies that once a first fragment
-// passes the ACL, its trailing fragments inherit the allow verdict.
-func TestFragment_AllowedFirstPassesTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	// First fragment: UDP header (8) + 32 payload = 40 octets -> headerEnd = 5.
-	first := firstFragmentUDP(t, 0x2222, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed first fragment should pass and be recorded")
-
-	trailing := trailingFragment(t, 0x2222, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed datagram should pass")
-}
-
-// TestFragment_DeniedFirstDropsTrailing verifies that a first fragment blocked
-// by the ACL leaves no verdict, so its trailing fragments are dropped.
-func TestFragment_DeniedFirstDropsTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	// No accept rule: local traffic defaults to deny.
-
-	first := firstFragmentUDP(t, 0x3333, 9999, 32)
-	require.True(t, m.filterInbound(first, len(first)),
-		"first fragment to a blocked port should be dropped by the ACL")
-
-	trailing := trailingFragment(t, 0x3333, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of a denied datagram must be dropped")
-}
-
-// TestFragment_OverlappingHeaderDropped covers the RFC 1858 §4 / RFC 3128
-// overlapping-fragment rewrite: a trailing fragment starting inside the range
-// the ACL already inspected is dropped and poisons the datagram. TCP is used so
-// the overlap lands on real header bytes (the flags at byte 13).
-func TestFragment_OverlappingHeaderDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// First fragment: TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
-	first := firstFragmentTCP(t, 0x4444, 8080)
-	require.False(t, m.filterInbound(first, len(first)))
-
-	// Overlapping fragment at offset 1 (byte 8) falls inside the inspected TCP
-	// header, so it could rewrite the flags or port on reassembly.
-	overlap := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 1, true, 32)
-	require.True(t, m.filterInbound(overlap, len(overlap)),
-		"fragment overlapping the inspected header must be dropped")
-
-	// The datagram is now poisoned: a later, non-overlapping fragment is also
-	// dropped because the verdict was removed.
-	later := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 4, false, 24)
-	require.True(t, m.filterInbound(later, len(later)),
-		"fragments after an overlap must be dropped (datagram poisoned)")
-}
-
-// TestFragment_OffsetZeroOverlapPoisons covers the RFC 3128 offset-zero rewrite:
-// an allowed first fragment followed by a denied offset-zero fragment for the
-// same datagram must not leave the earlier allow verdict in place.
-func TestFragment_OffsetZeroOverlapPoisons(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	allowed := firstFragmentUDP(t, 0x5A5A, 8080, 32)
-	require.False(t, m.filterInbound(allowed, len(allowed)),
-		"allowed first fragment should pass and be recorded")
-
-	// A second offset-zero fragment to a denied port supersedes the datagram's
-	// verdict; it is dropped and must not leave the allow in place.
-	denied := firstFragmentUDP(t, 0x5A5A, 9999, 32)
-	require.True(t, m.filterInbound(denied, len(denied)),
-		"denied offset-zero fragment must be dropped")
-
-	trailing := trailingFragment(t, 0x5A5A, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment must be denied after the datagram was poisoned")
-}
-
-// TestFragment_TinyFirstDropped covers the tiny-fragment attack: a first
-// fragment too small to contain the full transport header can't be
-// ACL-evaluated and must be dropped.
-func TestFragment_TinyFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	// IPv4 header + 4 raw bytes, MF set, offset 0: too small for the 8-byte UDP
-	// header, so it decodes to L3 only.
-	tiny := trailingFragment(t, 0x5555, 0, true, 4)
-	require.True(t, m.filterInbound(tiny, len(tiny)),
-		"tiny first fragment without a full L4 header must be dropped")
-}
-
-// TestFragment_TCPFirstFragment verifies the TCP arm of the transport decode: a
-// first fragment carrying the full 20-byte TCP header is ACL-evaluated and its
-// trailing fragments inherit the verdict.
-func TestFragment_TCPFirstFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
-	first := firstFragmentTCP(t, 0x6666, 8080)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed TCP first fragment should pass and be recorded")
-
-	trailing := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x6666, 4, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed TCP datagram should pass")
-}
-
-// TestFragment_TCPTinyFirstDropped verifies the TCP minimum header length: 12
-// bytes would satisfy a UDP header but falls short of the 20-byte TCP header.
-func TestFragment_TCPTinyFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	tiny := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x7777, 0, true, 12)
-	require.True(t, m.filterInbound(tiny, len(tiny)),
-		"first fragment shorter than the TCP header must be dropped")
-}
-
-// TestFragment_ConntrackAllowsFirstFragment verifies the conntrack branch: reply
-// fragments of an outbound-established UDP flow pass without any inbound rule.
-func TestFragment_ConntrackAllowsFirstFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	out := outboundUDPPacket(t, 12345, 40000)
-	require.False(t, m.filterOutbound(out, len(out)))
-
-	first := firstFragmentUDP(t, 0x8888, 12345, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"reply first fragment should pass via conntrack")
-
-	trailing := trailingFragment(t, 0x8888, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of a tracked flow should pass")
-}
-
-// TestFragment_RoutingDisabledDropsFragment verifies routed first fragments are
-// dropped when routing is disabled.
-func TestFragment_RoutingDisabledDropsFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-	m.routingEnabled.Store(false)
-
-	first := firstFragmentUDPTo(t, "198.51.100.10", 0x9999, 8080, 32)
-	require.True(t, m.filterInbound(first, len(first)),
-		"routed first fragment must be dropped when routing is disabled")
-}
-
-// TestFragment_RouteACL verifies the route-ACL branch: fragments to a non-local
-// destination follow the route rules, allowed datagrams pass their trailing
-// fragments and denied ones don't.
-func TestFragment_RouteACL(t *testing.T) {
-	m := newFragmentTestManager(t)
-	m.routingEnabled.Store(true)
-	m.nativeRouter.Store(false)
-
-	_, err := m.AddRouteFiltering(
-		[]byte("rt-1"),
-		[]netip.Prefix{netip.MustParsePrefix("100.10.0.0/16")},
-		fw.Network{Prefix: netip.MustParsePrefix("198.51.100.0/24")},
-		fw.ProtocolUDP,
-		nil,
-		&fw.Port{Values: []uint16{8080}},
-		fw.ActionAccept,
-	)
-	require.NoError(t, err)
-
-	first := firstFragmentUDPTo(t, "198.51.100.10", 0xAAAA, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"route-ACL-allowed first fragment should pass")
-	trailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xAAAA, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed routed datagram should pass")
-
-	denied := firstFragmentUDPTo(t, "198.51.100.10", 0xBBBB, 9999, 32)
-	require.True(t, m.filterInbound(denied, len(denied)),
-		"route-ACL-denied first fragment must be dropped")
-	deniedTrailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xBBBB, 5, false, 24)
-	require.True(t, m.filterInbound(deniedTrailing, len(deniedTrailing)),
-		"trailing fragment of a denied routed datagram must be dropped")
-}
-
-// TestFragment_ExpiredVerdictDropsTrailing verifies a verdict older than the
-// tracker timeout no longer admits trailing fragments.
-func TestFragment_ExpiredVerdictDropsTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	first := firstFragmentUDP(t, 0xCCCC, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)))
-
-	m.fragments.mutex.Lock()
-	for key, entry := range m.fragments.entries {
-		entry.recordedAt = time.Now().Add(-defaultFragmentTimeout - time.Second)
-		m.fragments.entries[key] = entry
-	}
-	m.fragments.mutex.Unlock()
-
-	trailing := trailingFragment(t, 0xCCCC, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment after verdict expiry must be dropped")
-}
-
-// TestFragment_CapacityFailsClosed verifies the table cap: at capacity, new
-// datagram verdicts are not recorded (their trailing fragments are dropped)
-// while already-recorded datagrams keep working.
-func TestFragment_CapacityFailsClosed(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	m.fragments.mutex.Lock()
-	m.fragments.maxEntries = 1
-	m.fragments.mutex.Unlock()
-
-	first1 := firstFragmentUDP(t, 0x0101, 8080, 32)
-	require.False(t, m.filterInbound(first1, len(first1)))
-
-	first2 := firstFragmentUDP(t, 0x0202, 8080, 32)
-	require.False(t, m.filterInbound(first2, len(first2)),
-		"first fragment itself still passes at capacity")
-
-	trailing2 := trailingFragment(t, 0x0202, 5, false, 24)
-	require.True(t, m.filterInbound(trailing2, len(trailing2)),
-		"trailing fragment of an unrecorded datagram must be dropped at capacity")
-
-	trailing1 := trailingFragment(t, 0x0101, 5, false, 24)
-	require.False(t, m.filterInbound(trailing1, len(trailing1)),
-		"already-recorded datagram should keep passing at capacity")
-}
-
-// v6FragmentHeader builds the 8-byte IPv6 fragment extension header for the
-// given inner protocol, offset (8-byte units), More Fragments bit and id.
-func v6FragmentHeader(proto layers.IPProtocol, offsetOctets uint16, moreFragments bool, id uint32) []byte {
-	offsetFlags := offsetOctets << 3
-	if moreFragments {
-		offsetFlags |= 1
-	}
-	hdr := make([]byte, 8)
-	hdr[0] = uint8(proto)
-	binary.BigEndian.PutUint16(hdr[2:4], offsetFlags)
-	binary.BigEndian.PutUint32(hdr[4:8], id)
-	return hdr
-}
-
-func v6UDPHeader(dstPort uint16, dataLen int) []byte {
-	hdr := make([]byte, 8)
-	binary.BigEndian.PutUint16(hdr[0:2], 40000)
-	binary.BigEndian.PutUint16(hdr[2:4], dstPort)
-	binary.BigEndian.PutUint16(hdr[4:6], uint16(8+dataLen))
-	return hdr
-}
-
-// firstFragmentUDPv6 builds the first fragment of a fragmented IPv6 UDP
-// datagram: fragment header (offset 0, More Fragments set) + full UDP header +
-// data.
-func firstFragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int) []byte {
-	tb.Helper()
-	return fragmentUDPv6(tb, id, dstPort, dataLen, true)
-}
-
-// fragmentUDPv6 builds an offset-zero IPv6 UDP fragment. With moreFragments
-// false it is an atomic fragment (a complete datagram, RFC 6946).
-func fragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int, moreFragments bool) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv6{
-		Version:    6,
-		NextHeader: layers.IPProtocolIPv6Fragment,
-		HopLimit:   64,
-		SrcIP:      net.ParseIP(fragTestSrcV6),
-		DstIP:      net.ParseIP(fragTestDstV6),
-	}
-	payload := append(v6FragmentHeader(layers.IPProtocolUDP, 0, moreFragments, id), v6UDPHeader(dstPort, dataLen)...)
-	payload = append(payload, make([]byte, dataLen)...)
-
-	buf := gopacket.NewSerializeBuffer()
-	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
-	return buf.Bytes()
-}
-
-// trailingFragmentV6 builds a non-first IPv6 fragment: fragment header at the
-// given offset carrying raw data and no transport header.
-func trailingFragmentV6(tb testing.TB, id uint32, offsetOctets uint16, moreFragments bool, dataLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv6{
-		Version:    6,
-		NextHeader: layers.IPProtocolIPv6Fragment,
-		HopLimit:   64,
-		SrcIP:      net.ParseIP(fragTestSrcV6),
-		DstIP:      net.ParseIP(fragTestDstV6),
-	}
-	payload := append(v6FragmentHeader(layers.IPProtocolUDP, offsetOctets, moreFragments, id), make([]byte, dataLen)...)
-
-	buf := gopacket.NewSerializeBuffer()
-	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
-	return buf.Bytes()
-}
-
-// TestFragmentV6_TrailingWithoutFirstDropped verifies the IPv6 bypass is closed:
-// a trailing fragment with no allowed first fragment is dropped.
-func TestFragmentV6_TrailingWithoutFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	frag := trailingFragmentV6(t, 0xAABBCCDD, 100, false, 40)
-	require.True(t, m.filterInbound(frag, len(frag)),
-		"IPv6 trailing fragment without an allowed first fragment must be dropped")
-}
-
-// TestFragmentV6_AllowedFirstPassesTrailing verifies IPv6 fragments are
-// evaluated like IPv4: an allowed first fragment lets its trailing fragments
-// through.
-func TestFragmentV6_AllowedFirstPassesTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// First fragment: UDP header (8) + 32 data = 40 octets -> headerEnd = 5.
-	first := firstFragmentUDPv6(t, 0xAABBCCDD, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed IPv6 first fragment should pass and be recorded")
-
-	trailing := trailingFragmentV6(t, 0xAABBCCDD, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed IPv6 datagram should pass")
-}
-
-// TestFragmentV6_AtomicNotCached verifies an IPv6 atomic fragment (fragment
-// header with offset 0 and no More Fragments, a complete datagram per RFC 6946)
-// is evaluated but not recorded, so a flood of allowed atomic fragments can't
-// exhaust the verdict table.
-func TestFragmentV6_AtomicNotCached(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	atomic := fragmentUDPv6(t, 0xA70301C, 8080, 16, false)
-	require.False(t, m.filterInbound(atomic, len(atomic)),
-		"allowed IPv6 atomic fragment should pass")
-
-	m.fragments.mutex.Lock()
-	n := len(m.fragments.entries)
-	m.fragments.mutex.Unlock()
-	require.Zero(t, n, "atomic fragment must not create a verdict entry")
-
-	// A genuine fragmented datagram (More Fragments set) is still recorded.
-	first := fragmentUDPv6(t, 0xBEEF, 8080, 32, true)
-	require.False(t, m.filterInbound(first, len(first)))
-	m.fragments.mutex.Lock()
-	n = len(m.fragments.entries)
-	m.fragments.mutex.Unlock()
-	require.Equal(t, 1, n, "genuine first fragment must record a verdict")
-}

client/iface/configurer/kernel_unix.go

@@ -17,15 +17,12 @@ import (
 
 type KernelConfigurer struct {
 	deviceName string
-	statsCache *statsCache
 }
 
 func NewKernelConfigurer(deviceName string) *KernelConfigurer {
-	c := &KernelConfigurer{
+	return &KernelConfigurer{
 		deviceName: deviceName,
 	}
-	c.statsCache = newStatsCache(statsCacheTTL, c.fetchStats)
-	return c
 }
 
 func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error {
@@ -249,6 +246,12 @@ func (c *KernelConfigurer) configure(config wgtypes.Config) error {
 		}
 	}()
 
+	// validate if device with name exists
+	_, err = wg.Device(c.deviceName)
+	if err != nil {
+		return err
+	}
+
 	return wg.ConfigureDevice(c.deviceName, config)
 }
 
@@ -297,14 +300,6 @@ func (c *KernelConfigurer) FullStats() (*Stats, error) {
 }
 
 func (c *KernelConfigurer) GetStats() (map[string]WGStats, error) {
-	return c.statsCache.get()
-}
-
-func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
-	return nil
-}
-
-func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
 	stats := make(map[string]WGStats)
 	wg, err := wgctrl.New()
 	if err != nil {
@@ -331,3 +326,7 @@ func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
 	}
 	return stats, nil
 }
+
+func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
+	return nil
+}

client/iface/configurer/stats_cache.go

@@ -1,52 +0,0 @@
-package configurer
-
-import (
-	"sync"
-	"time"
-
-	"golang.org/x/sync/singleflight"
-)
-
-const statsCacheTTL = 1 * time.Second
-
-type statsCache struct {
-	ttl   time.Duration
-	fetch func() (map[string]WGStats, error)
-
-	mu       sync.RWMutex
-	value    map[string]WGStats
-	expireAt time.Time
-
-	sf singleflight.Group
-}
-
-func newStatsCache(ttl time.Duration, fetch func() (map[string]WGStats, error)) *statsCache {
-	return &statsCache{ttl: ttl, fetch: fetch}
-}
-
-func (c *statsCache) get() (map[string]WGStats, error) {
-	c.mu.RLock()
-	if c.value != nil && time.Now().Before(c.expireAt) {
-		value := c.value
-		c.mu.RUnlock()
-		return value, nil
-	}
-	c.mu.RUnlock()
-
-	value, err, _ := c.sf.Do("stats", func() (interface{}, error) {
-		res, err := c.fetch()
-		if err != nil {
-			return nil, err
-		}
-
-		c.mu.Lock()
-		c.value = res
-		c.expireAt = time.Now().Add(c.ttl)
-		c.mu.Unlock()
-		return res, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return value.(map[string]WGStats), nil
-}

client/iface/configurer/stats_cache_test.go

@@ -1,70 +0,0 @@
-package configurer
-
-import (
-	"errors"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestStatsCache_CachesWithinTTL(t *testing.T) {
-	var calls atomic.Int64
-	c := newStatsCache(50*time.Millisecond, func() (map[string]WGStats, error) {
-		calls.Add(1)
-		return map[string]WGStats{"p": {}}, nil
-	})
-
-	for i := 0; i < 10; i++ {
-		_, err := c.get()
-		require.NoError(t, err)
-	}
-	require.Equal(t, int64(1), calls.Load(), "within TTL only one underlying fetch")
-
-	time.Sleep(60 * time.Millisecond)
-	_, err := c.get()
-	require.NoError(t, err)
-	require.Equal(t, int64(2), calls.Load(), "after TTL expiry a fresh fetch happens")
-}
-
-func TestStatsCache_SingleFlight(t *testing.T) {
-	var calls atomic.Int64
-	release := make(chan struct{})
-	c := newStatsCache(time.Minute, func() (map[string]WGStats, error) {
-		calls.Add(1)
-		<-release
-		return map[string]WGStats{}, nil
-	})
-
-	const n = 50
-	var wg sync.WaitGroup
-	wg.Add(n)
-	for i := 0; i < n; i++ {
-		go func() {
-			defer wg.Done()
-			_, _ = c.get()
-		}()
-	}
-	time.Sleep(20 * time.Millisecond)
-	close(release)
-	wg.Wait()
-
-	require.Equal(t, int64(1), calls.Load(), "concurrent misses collapse into one fetch")
-}
-
-func TestStatsCache_ErrorNotCached(t *testing.T) {
-	var calls atomic.Int64
-	wantErr := errors.New("dump failed")
-	c := newStatsCache(time.Minute, func() (map[string]WGStats, error) {
-		calls.Add(1)
-		return nil, wantErr
-	})
-
-	_, err := c.get()
-	require.ErrorIs(t, err, wantErr)
-	_, err = c.get()
-	require.ErrorIs(t, err, wantErr)
-	require.Equal(t, int64(2), calls.Load(), "errors are not cached; each call retries")
-}

client/iface/configurer/usp.go

@@ -40,7 +40,6 @@ type WGUSPConfigurer struct {
 	device           *device.Device
 	deviceName       string
 	activityRecorder *bind.ActivityRecorder
-	statsCache       *statsCache
 
 	uapiListener net.Listener
 }
@@ -51,19 +50,16 @@ func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder
 		deviceName:       deviceName,
 		activityRecorder: activityRecorder,
 	}
-	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
 	wgCfg.startUAPI()
 	return wgCfg
 }
 
 func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
-	wgCfg := &WGUSPConfigurer{
+	return &WGUSPConfigurer{
 		device:           device,
 		deviceName:       deviceName,
 		activityRecorder: activityRecorder,
 	}
-	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
-	return wgCfg
 }
 
 func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error {
@@ -352,10 +348,6 @@ func (t *WGUSPConfigurer) Close() {
 }
 
 func (t *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
-	return t.statsCache.get()
-}
-
-func (t *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
 	ipc, err := t.device.IpcGet()
 	if err != nil {
 		return nil, fmt.Errorf("ipc get: %w", err)

client/iface/netstack/env.go

@@ -3,31 +3,14 @@
 package netstack
 
 import (
-	"net"
+	"fmt"
 	"os"
 	"strconv"
 
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
-
-	// EnvSocks5ListenerPort overrides the port the SOCKS5 proxy listens on.
-	EnvSocks5ListenerPort = "NB_SOCKS5_LISTENER_PORT"
-
-	// EnvSocks5ListenerAddress overrides the host/IP the SOCKS5 proxy binds to.
-	// The proxy is a bridge for local host applications into the userspace
-	// WireGuard netstack, so it binds to loopback by default. Override this only
-	// when the proxy must be reachable from other hosts (e.g. a container
-	// gateway); doing so exposes an unauthenticated SOCKS5 proxy on that
-	// address.
-	EnvSocks5ListenerAddress = "NB_SOCKS5_LISTENER_ADDRESS"
-
-	// defaultSocks5Host is the loopback address the SOCKS5 proxy binds to unless
-	// overridden via EnvSocks5ListenerAddress.
-	defaultSocks5Host = "127.0.0.1"
-)
+const EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
 
 // IsEnabled todo: move these function to cmd layer
 func IsEnabled() bool {
@@ -35,40 +18,24 @@ func IsEnabled() bool {
 }
 
 func ListenAddr() string {
-	return net.JoinHostPort(listenHost(), strconv.Itoa(listenPort()))
-}
-
-// listenHost returns the host/IP the SOCKS5 proxy binds to. It defaults to
-// loopback and only honors EnvSocks5ListenerAddress when it holds a valid IP.
-func listenHost() string {
-	addr := os.Getenv(EnvSocks5ListenerAddress)
-	if addr == "" {
-		return defaultSocks5Host
-	}
-	if net.ParseIP(addr) == nil {
-		log.Warnf("invalid socks5 listener address %q, falling back to default: %s", addr, defaultSocks5Host)
-		return defaultSocks5Host
-	}
-	return addr
-}
-
-// listenPort returns the port the SOCKS5 proxy binds to, defaulting to
-// DefaultSocks5Port when EnvSocks5ListenerPort is unset or invalid.
-func listenPort() int {
-	sPort := os.Getenv(EnvSocks5ListenerPort)
+	sPort := os.Getenv("NB_SOCKS5_LISTENER_PORT")
 	if sPort == "" {
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 
 	port, err := strconv.Atoi(sPort)
 	if err != nil {
 		log.Warnf("invalid socks5 listener port, unable to convert it to int, falling back to default: %d", DefaultSocks5Port)
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 	if port < 1 || port > 65535 {
 		log.Warnf("invalid socks5 listener port, it should be in the range 1-65535, falling back to default: %d", DefaultSocks5Port)
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 
-	return port
+	return listenAddr(port)
+}
+
+func listenAddr(port int) string {
+	return fmt.Sprintf("0.0.0.0:%d", port)
 }

client/iface/netstack/env_test.go

@@ -1,63 +0,0 @@
-//go:build !js
-
-package netstack
-
-import (
-	"net"
-	"strconv"
-	"testing"
-)
-
-func TestListenAddr_DefaultsToLoopback(t *testing.T) {
-	// No env overrides: must bind loopback, never all interfaces.
-	got := ListenAddr()
-	want := net.JoinHostPort("127.0.0.1", strconv.Itoa(DefaultSocks5Port))
-	if got != want {
-		t.Fatalf("ListenAddr() = %q, want %q", got, want)
-	}
-}
-
-func TestListenAddr_AddressOverride(t *testing.T) {
-	tests := []struct {
-		name string
-		env  string
-		want string
-	}{
-		{name: "valid override honored", env: "0.0.0.0", want: "0.0.0.0"},
-		{name: "valid specific ip honored", env: "10.0.0.5", want: "10.0.0.5"},
-		{name: "ipv6 loopback bracketed", env: "::1", want: "::1"},
-		{name: "invalid falls back to loopback", env: "not-an-ip", want: "127.0.0.1"},
-		{name: "empty falls back to loopback", env: "", want: "127.0.0.1"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(EnvSocks5ListenerAddress, tc.env)
-			want := net.JoinHostPort(tc.want, strconv.Itoa(DefaultSocks5Port))
-			if got := ListenAddr(); got != want {
-				t.Fatalf("ListenAddr() = %q, want %q", got, want)
-			}
-		})
-	}
-}
-
-func TestListenAddr_PortOverride(t *testing.T) {
-	tests := []struct {
-		name string
-		env  string
-		want int
-	}{
-		{name: "valid port honored", env: "1081", want: 1081},
-		{name: "non-numeric falls back", env: "abc", want: DefaultSocks5Port},
-		{name: "out of range falls back", env: "70000", want: DefaultSocks5Port},
-		{name: "zero falls back", env: "0", want: DefaultSocks5Port},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(EnvSocks5ListenerPort, tc.env)
-			want := net.JoinHostPort("127.0.0.1", strconv.Itoa(tc.want))
-			if got := ListenAddr(); got != want {
-				t.Fatalf("ListenAddr() = %q, want %q", got, want)
-			}
-		})
-	}
-}

client/internal/auth/auth.go

@@ -351,6 +351,7 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.BlockLANAccess,
 		a.config.BlockInbound,
 		a.config.DisableIPv6,
+		a.config.LazyConnectionEnabled,
 		a.config.EnableSSHRoot,
 		a.config.EnableSSHSFTP,
 		a.config.EnableSSHLocalPortForwarding,

client/internal/auth/device_flow.go

@@ -259,18 +259,12 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
-	log.Infof("device flow: waiting for user authorization, polling token endpoint every %s, code expires in %s", interval, timeout)
-
-	start := time.Now()
-	polls := 0
-
 	for {
 		select {
 		case <-waitCtx.Done():
 			return TokenInfo{}, waitCtx.Err()
 		case <-ticker.C:
 
-			polls++
 			tokenResponse, err := d.requestToken(info)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("parsing token response failed with error: %v", err)
@@ -278,12 +272,10 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 
 			if tokenResponse.Error != "" {
 				if tokenResponse.Error == "authorization_pending" {
-					log.Tracef("device flow: authorization still pending after poll %d", polls)
 					continue
 				} else if tokenResponse.Error == "slow_down" {
 					interval += (3 * time.Second)
 					ticker.Reset(interval)
-					log.Infof("device flow: IdP requested slow_down, polling interval increased to %s", interval)
 					continue
 				}
 
@@ -299,12 +291,11 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				UseIDToken:   d.providerConfig.UseIDToken,
 			}
 
-			err = validateTokenAudience(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
+			err = isValidAccessToken(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}
 
-			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
 			return tokenInfo, err
 		}
 	}

client/internal/auth/pkce_flow.go

@@ -188,8 +188,6 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 	waitCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	log.Infof("pkce flow: waiting for authorization callback on %s, timeout %s", p.oAuthConfig.RedirectURL, timeout)
-
 	tokenChan := make(chan *oauth2.Token, 1)
 	errChan := make(chan error, 1)
 
@@ -223,7 +221,6 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 func (p *PKCEAuthorizationFlow) startServer(server *http.Server, tokenChan chan<- *oauth2.Token, errChan chan<- error) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
-		log.Infof("pkce flow: received authorization callback from IdP")
 		cert := p.providerConfig.ClientCertPair
 		if cert != nil {
 			tr := &http.Transport{
@@ -274,18 +271,11 @@ func (p *PKCEAuthorizationFlow) handleRequest(req *http.Request) (*oauth2.Token,
 		return nil, fmt.Errorf("authentication failed: missing code")
 	}
 
-	exchangeStart := time.Now()
-	token, err := p.oAuthConfig.Exchange(
+	return p.oAuthConfig.Exchange(
 		req.Context(),
 		code,
 		oauth2.SetAuthURLParam("code_verifier", p.codeVerifier),
 	)
-	if err != nil {
-		return nil, err
-	}
-
-	log.Infof("pkce flow: authorization code exchanged for token in %s", time.Since(exchangeStart).Round(time.Millisecond))
-	return token, nil
 }
 
 func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo, error) {
@@ -306,7 +296,7 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 		audience = p.providerConfig.ClientID
 	}
 
-	if err := validateTokenAudience(tokenInfo.GetTokenToUse(), audience); err != nil {
+	if err := isValidAccessToken(tokenInfo.GetTokenToUse(), audience); err != nil {
 		return TokenInfo{}, fmt.Errorf("authentication failed: invalid access token - %w", err)
 	}
 
@@ -320,11 +310,6 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 	return tokenInfo, nil
 }
 
-// parseEmailFromIDToken extracts the email (or name) claim from an ID token
-// without verifying its signature. The value is best-effort and used only as a
-// UX convenience (login hint prefill and display); it never drives an
-// authorization decision. The authoritative identity is established server-side
-// from the signature-verified token.
 func parseEmailFromIDToken(token string) (string, error) {
 	parts := strings.Split(token, ".")
 	if len(parts) < 2 {

client/internal/auth/util.go

@@ -20,26 +20,14 @@ func randomBytesInHex(count int) (string, error) {
 	return hex.EncodeToString(buf), nil
 }
 
-// validateTokenAudience checks that the token is a well-formed JWT whose
-// audience claim matches the expected audience.
-//
-// It does NOT verify the token's cryptographic signature and therefore must not
-// be treated as an authenticity check. The token is obtained by the client
-// directly from the IdP token endpoint over TLS, and its signature is verified
-// server-side by the management server against the IdP's JWKS
-// (see shared/auth/jwt/validator.go). This function is only a client-side
-// sanity check that the returned token targets the expected audience.
-func validateTokenAudience(token string, audience string) error {
+// isValidAccessToken is a simple validation of the access token
+func isValidAccessToken(token string, audience string) error {
 	if token == "" {
 		return fmt.Errorf("token received is empty")
 	}
 
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return fmt.Errorf("token is not a well-formed JWT")
-	}
-
-	claimsString, err := base64.RawURLEncoding.DecodeString(parts[1])
+	encodedClaims := strings.Split(token, ".")[1]
+	claimsString, err := base64.RawURLEncoding.DecodeString(encodedClaims)
 	if err != nil {
 		return err
 	}

client/internal/auth/util_test.go

@@ -1,108 +0,0 @@
-package auth
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"testing"
-)
-
-// makeJWT builds an unsigned JWT-shaped string (header.payload.signature) with
-// the given claims payload. The signature part is arbitrary because
-// validateTokenAudience intentionally does not verify it.
-func makeJWT(t *testing.T, claims map[string]interface{}) string {
-	t.Helper()
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`))
-	payloadBytes, err := json.Marshal(claims)
-	if err != nil {
-		t.Fatalf("marshal claims: %v", err)
-	}
-	payload := base64.RawURLEncoding.EncodeToString(payloadBytes)
-	return header + "." + payload + ".unverified-signature"
-}
-
-func TestValidateTokenAudience(t *testing.T) {
-	tests := []struct {
-		name     string
-		token    string
-		audience string
-		wantErr  bool
-	}{
-		{
-			name:     "empty token",
-			token:    "",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "not a JWT - no dots",
-			token:    "notajwt",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "not a JWT - two parts only",
-			token:    "header.payload",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "matching string audience",
-			token:    makeJWT(t, map[string]interface{}{"aud": "netbird"}),
-			audience: "netbird",
-			wantErr:  false,
-		},
-		{
-			name:     "mismatching string audience",
-			token:    makeJWT(t, map[string]interface{}{"aud": "other"}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "matching audience in array",
-			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"other", "netbird"}}),
-			audience: "netbird",
-			wantErr:  false,
-		},
-		{
-			name:     "mismatching audience array",
-			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"a", "b"}}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "missing audience claim",
-			token:    makeJWT(t, map[string]interface{}{"sub": "user"}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "invalid base64 payload",
-			token:    "header.!!!not-base64!!!.sig",
-			audience: "netbird",
-			wantErr:  true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateTokenAudience(tc.token, tc.audience)
-			if tc.wantErr && err == nil {
-				t.Fatalf("expected error, got nil")
-			}
-			if !tc.wantErr && err != nil {
-				t.Fatalf("expected no error, got %v", err)
-			}
-		})
-	}
-}
-
-// TestValidateTokenAudienceNoPanic guards the regression where a non-empty
-// token without the JWT dot structure caused an index-out-of-range panic.
-func TestValidateTokenAudienceNoPanic(t *testing.T) {
-	inputs := []string{"a", ".", "a.", "aaaa", "no-dots-here"}
-	for _, in := range inputs {
-		if err := validateTokenAudience(in, "netbird"); err == nil {
-			t.Fatalf("expected error for malformed token %q, got nil", in)
-		}
-	}
-}

client/internal/conn_mgr.go

@@ -16,16 +16,6 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-// lazyForce is the resolved local decision for lazy connections, layered above the
-// management feature flag. lazyForceNone defers to management.
-type lazyForce int
-
-const (
-	lazyForceNone lazyForce = iota
-	lazyForceOn
-	lazyForceOff
-)
-
 // ConnMgr coordinates both lazy connections (established on-demand) and permanent peer connections.
 //
 // The connection manager is responsible for:
@@ -34,20 +24,14 @@ const (
 // - Handling connection establishment based on peer signaling
 //
 // The implementation is not thread-safe; it is protected by engine.syncMsgMux.
-// The only exception is ActivatePeer, which is safe for concurrent use so the
-// DNS warm-up path can call it without contending on the engine mutex.
 type ConnMgr struct {
 	peerStore        *peerstore.Store
 	statusRecorder   *peer.Status
 	iface            lazyconn.WGIface
-	force            lazyForce
+	enabledLocally   bool
 	rosenpassEnabled bool
 
 	lazyConnMgr *manager.Manager
-	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
-	// engine loop (ActivatePeer). Writers hold it in addition to
-	// engine.syncMsgMux; all other reads stay under engine.syncMsgMux only.
-	lazyConnMgrMu sync.RWMutex
 
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
@@ -59,34 +43,28 @@ func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerSto
 		peerStore:        peerStore,
 		statusRecorder:   statusRecorder,
 		iface:            iface,
-		force:            resolveLazyForce(engineConfig.LazyConnection),
 		rosenpassEnabled: engineConfig.RosenpassEnabled,
 	}
+	if engineConfig.LazyConnectionEnabled || lazyconn.IsLazyConnEnabledByEnv() {
+		e.enabledLocally = true
+	}
 	return e
 }
 
-// Start initializes the connection manager. It starts the lazy connection manager when a
-// local override forces it on; with no local override it waits for the management feature flag.
+// Start initializes the connection manager and starts the lazy connection manager if enabled by env var or cmd line option.
 func (e *ConnMgr) Start(ctx context.Context) {
 	if e.lazyConnMgr != nil {
 		log.Errorf("lazy connection manager is already started")
 		return
 	}
 
-	switch e.force {
-	case lazyForceOff:
-		log.Infof("lazy connection manager is disabled by local override (%s or MDM policy)", lazyconn.EnvLazyConn)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	case lazyForceNone:
-		log.Infof("lazy connection manager is managed by the management feature flag")
-		e.statusRecorder.UpdateLazyConnection(false)
+	if !e.enabledLocally {
+		log.Infof("lazy connection manager is disabled")
 		return
 	}
 
 	if e.rosenpassEnabled {
 		log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
-		e.statusRecorder.UpdateLazyConnection(false)
 		return
 	}
 
@@ -98,8 +76,8 @@ func (e *ConnMgr) Start(ctx context.Context) {
 // If enabled, it initializes the lazy connection manager and start it. Do not need to call Start() again.
 // If disabled, then it closes the lazy connection manager and open the connections to all peers.
 func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) error {
-	// a local override (NB_LAZY_CONN or local config) takes precedence over management
-	if e.force != lazyForceNone {
+	// do not disable lazy connection manager if it was enabled by env var
+	if e.enabledLocally {
 		return nil
 	}
 
@@ -111,17 +89,15 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 
 		if e.rosenpassEnabled {
 			log.Infof("rosenpass connection manager is enabled, lazy connection manager will not be started")
-			e.statusRecorder.UpdateLazyConnection(false)
 			return nil
 		}
 
-		log.Infof("lazy connection manager is enabled by the management feature flag")
+		log.Warnf("lazy connection manager is enabled by management feature flag")
 		e.initLazyManager(ctx)
 		e.statusRecorder.UpdateLazyConnection(true)
 		return e.addPeersToLazyConnManager()
 	} else {
 		if e.lazyConnMgr == nil {
-			e.statusRecorder.UpdateLazyConnection(false)
 			return nil
 		}
 		log.Infof("lazy connection manager is disabled by management feature flag")
@@ -131,6 +107,37 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 	}
 }
 
+// SetLocalLazyConn applies a local lazy connection override (UI / CLI / env).
+// While enabledLocally is true, UpdatedRemoteFeatureFlag (management sync) is a
+// no-op, so the local setting wins until it is turned off again.
+func (e *ConnMgr) SetLocalLazyConn(ctx context.Context, enabled bool) error {
+	e.enabledLocally = enabled
+
+	if enabled {
+		if e.lazyConnMgr != nil {
+			return nil
+		}
+
+		if e.rosenpassEnabled {
+			log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
+			return nil
+		}
+
+		log.Infof("lazy connection manager is enabled locally")
+		e.initLazyManager(ctx)
+		e.statusRecorder.UpdateLazyConnection(true)
+		return e.addPeersToLazyConnManager()
+	}
+
+	if e.lazyConnMgr == nil {
+		return nil
+	}
+	log.Infof("lazy connection manager is disabled locally")
+	e.closeManager(ctx)
+	e.statusRecorder.UpdateLazyConnection(false)
+	return nil
+}
+
 // UpdateRouteHAMap updates the route HA mappings in the lazy connection manager
 func (e *ConnMgr) UpdateRouteHAMap(haMap route.HAMap) {
 	if !e.isStartedWithLazyMgr() {
@@ -244,20 +251,12 @@ func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn.Log.Infof("removed peer from lazy conn manager")
 }
 
-// ActivatePeer wakes an idle lazy connection. Unlike the rest of ConnMgr it is
-// safe for concurrent use: the lazy manager pointer is read under lazyConnMgrMu
-// and the manager itself is internally synchronized, so callers outside the
-// engine loop (DNS warm-up) do not need engine.syncMsgMux.
 func (e *ConnMgr) ActivatePeer(ctx context.Context, conn *peer.Conn) {
-	e.lazyConnMgrMu.RLock()
-	lazyConnMgr := e.lazyConnMgr
-	started := lazyConnMgr != nil && e.lazyCtxCancel != nil
-	e.lazyConnMgrMu.RUnlock()
-	if !started {
+	if !e.isStartedWithLazyMgr() {
 		return
 	}
 
-	if found := lazyConnMgr.ActivatePeer(conn.GetKey()); found {
+	if found := e.lazyConnMgr.ActivatePeer(conn.GetKey()); found {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -282,21 +281,16 @@ func (e *ConnMgr) Close() {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
 }
 
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	cfg := manager.Config{
 		InactivityThreshold: inactivityThresholdEnv(),
 	}
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
+
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
-	e.lazyConnMgrMu.Unlock()
 
 	e.wg.Add(1)
 	go func() {
@@ -335,10 +329,7 @@ func (e *ConnMgr) closeManager(ctx context.Context) {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
 
 	for _, peerID := range e.peerStore.PeersPubKey() {
 		e.peerStore.PeerConnOpen(ctx, peerID)
@@ -349,25 +340,6 @@ func (e *ConnMgr) isStartedWithLazyMgr() bool {
 	return e.lazyConnMgr != nil && e.lazyCtxCancel != nil
 }
 
-// resolveLazyForce determines the local override. NB_LAZY_CONN takes precedence; when it
-// is unset the MDM policy override (mdmState) applies. Either wins in both directions over
-// the management feature flag; StateUnset for both defers to management.
-func resolveLazyForce(mdmState lazyconn.State) lazyForce {
-	state := lazyconn.EnvState()
-	if state == lazyconn.StateUnset {
-		state = mdmState
-	}
-
-	switch state {
-	case lazyconn.StateOn:
-		return lazyForceOn
-	case lazyconn.StateOff:
-		return lazyForceOff
-	default:
-		return lazyForceNone
-	}
-}
-
 func inactivityThresholdEnv() *time.Duration {
 	envValue := os.Getenv(lazyconn.EnvInactivityThreshold)
 	if envValue == "" {

client/internal/conn_mgr_test.go

@@ -1,106 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-	"github.com/netbirdio/netbird/monotime"
-)
-
-func TestResolveLazyForce(t *testing.T) {
-	tests := []struct {
-		name   string
-		env    string
-		envSet bool
-		mdm    lazyconn.State
-		want   lazyForce
-	}{
-		{name: "env unset, mdm unset -> defer to management", mdm: lazyconn.StateUnset, want: lazyForceNone},
-		{name: "env on -> force on", env: "on", envSet: true, mdm: lazyconn.StateUnset, want: lazyForceOn},
-		{name: "env off -> force off", env: "off", envSet: true, mdm: lazyconn.StateUnset, want: lazyForceOff},
-		{name: "env unset, mdm on -> force on", mdm: lazyconn.StateOn, want: lazyForceOn},
-		{name: "env unset, mdm off -> force off", mdm: lazyconn.StateOff, want: lazyForceOff},
-		{name: "env on beats mdm off", env: "on", envSet: true, mdm: lazyconn.StateOff, want: lazyForceOn},
-		{name: "env off beats mdm on", env: "off", envSet: true, mdm: lazyconn.StateOn, want: lazyForceOff},
-		{name: "unrecognized env, mdm on -> mdm wins", env: "auto", envSet: true, mdm: lazyconn.StateOn, want: lazyForceOn},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv(lazyconn.EnvLazyConn, tt.env)
-			if !tt.envSet {
-				os.Unsetenv(lazyconn.EnvLazyConn)
-			}
-
-			if got := resolveLazyForce(tt.mdm); got != tt.want {
-				t.Fatalf("resolveLazyForce(%v) = %v, want %v", tt.mdm, got, tt.want)
-			}
-		})
-	}
-}
-
-type mockLazyWGIface struct{}
-
-func (mockLazyWGIface) RemovePeer(string) error { return nil }
-func (mockLazyWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
-	return nil
-}
-func (mockLazyWGIface) IsUserspaceBind() bool                    { return false }
-func (mockLazyWGIface) Address() wgaddr.Address                  { return wgaddr.Address{} }
-func (mockLazyWGIface) LastActivities() map[string]monotime.Time { return nil }
-func (mockLazyWGIface) MTU() uint16                              { return 1280 }
-
-// TestConnMgr_ActivatePeerConcurrentWithLifecycle exercises ActivatePeer from
-// non-engine goroutines (the DNS warm-up path) racing the manager lifecycle,
-// which stays on the engine loop. Run with -race: it fails if ActivatePeer
-// still requires engine.syncMsgMux for safety.
-func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
-	t.Setenv(lazyconn.EnvLazyConn, "on")
-
-	status := peer.NewRecorder("https://mgm")
-	store := peerstore.NewConnStore()
-	connMgr := NewConnMgr(&EngineConfig{}, status, store, mockLazyWGIface{})
-
-	conn := newTestPeerConn(t, "peerA")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	connMgr.Start(ctx)
-
-	done := make(chan struct{})
-	var wg sync.WaitGroup
-	for range 4 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for {
-				select {
-				case <-done:
-					return
-				default:
-					connMgr.ActivatePeer(ctx, conn)
-				}
-			}
-		}()
-	}
-
-	// Let the activators spin against the started manager, then tear it down
-	// underneath them and let them spin against the stopped manager.
-	time.Sleep(100 * time.Millisecond)
-	connMgr.Close()
-	time.Sleep(50 * time.Millisecond)
-
-	close(done)
-	wg.Wait()
-}

client/internal/connect.go

@@ -27,7 +27,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -619,7 +618,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		BlockInbound:        config.BlockInbound,
 		DisableIPv6:         config.DisableIPv6,
 
-		LazyConnection: lazyconn.ParseState(config.LazyConnection),
+		LazyConnectionEnabled: config.LazyConnectionEnabled,
 
 		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
 		LogPath: logPath,
@@ -693,6 +692,7 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.BlockLANAccess,
 		config.BlockInbound,
 		config.DisableIPv6,
+		config.LazyConnectionEnabled,
 		config.EnableSSHRoot,
 		config.EnableSSHSFTP,
 		config.EnableSSHLocalPortForwarding,

client/internal/debug/debug.go

@@ -480,6 +480,7 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
+		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,
@@ -694,7 +695,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 		configContent.WriteString(fmt.Sprintf("ClientCertKeyPath: %s\n", g.internalConfig.ClientCertKeyPath))
 	}
 
-	configContent.WriteString(fmt.Sprintf("LazyConnection: %q\n", g.internalConfig.LazyConnection))
+	configContent.WriteString(fmt.Sprintf("LazyConnectionEnabled: %v\n", g.internalConfig.LazyConnectionEnabled))
 	configContent.WriteString(fmt.Sprintf("MTU: %d\n", g.internalConfig.MTU))
 }
 

client/internal/debug/debug_test.go

@@ -885,7 +885,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		DNSRouteInterval:              5 * time.Second,
 		ClientCertPath:                "/tmp/cert",
 		ClientCertKeyPath:             "/tmp/key",
-		LazyConnection:                "on",
+		LazyConnectionEnabled:         true,
 		MTU:                           1280,
 	}
 

client/internal/dns/local/local.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"slices"
 	"strings"
 	"sync"
@@ -37,43 +36,7 @@ type resolver interface {
 // record is left alone (it points at something outside our mesh, e.g.
 // a non-peer upstream).
 type PeerConnectivity interface {
-	IsConnectedByIP(ip netip.Addr) (known, connected bool)
-}
-
-// PeerActivator wakes lazy-connection peers on demand. The local resolver calls
-// it with the tunnel IPs an answer points at, so a peer that is idle (lazily
-// disconnected) starts connecting at DNS-resolution time rather than racing the
-// client's first request packet. nil disables warm-up.
-type PeerActivator interface {
-	// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and blocks
-	// until one is connected or ctx (a short per-query budget) expires. It is a
-	// fast no-op for unknown or already-connected addresses.
-	ActivatePeersByIP(ctx context.Context, addrs []netip.Addr)
-}
-
-const (
-	defaultLazyWarmupTimeout = 2 * time.Second
-	envLazyWarmupTimeout     = "NB_DNS_LAZY_WARMUP_TIMEOUT"
-)
-
-// lazyWarmupTimeoutFromEnv returns the per-query budget for waking a
-// lazy-connection peer a DNS answer points at. Tunable via
-// NB_DNS_LAZY_WARMUP_TIMEOUT (a Go duration). Parsed once at construction time.
-func lazyWarmupTimeoutFromEnv() time.Duration {
-	v := os.Getenv(envLazyWarmupTimeout)
-	if v == "" {
-		return defaultLazyWarmupTimeout
-	}
-	d, err := time.ParseDuration(v)
-	if err != nil {
-		log.Warnf("invalid %s value %q, using default %s: %v", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout, err)
-		return defaultLazyWarmupTimeout
-	}
-	if d <= 0 {
-		log.Warnf("non-positive %s value %q, using default %s", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout)
-		return defaultLazyWarmupTimeout
-	}
-	return d
+	IsConnectedByIP(ip string) (known, connected bool)
 }
 
 type Resolver struct {
@@ -88,12 +51,6 @@ type Resolver struct {
 	// filter and preserves the legacy "return whatever is registered"
 	// behaviour for callers that never wire a status source.
 	peerConn PeerConnectivity
-	// peerActivator, when non-nil, is called at resolution time to warm the
-	// lazy connection to the peer(s) an answer points at. nil disables warm-up.
-	peerActivator PeerActivator
-	// warmupTimeout is the per-query budget for the lazy-connection warm-up
-	// wait, resolved from the environment once at construction time.
-	warmupTimeout time.Duration
 
 	ctx    context.Context
 	cancel context.CancelFunc
@@ -102,12 +59,11 @@ type Resolver struct {
 func NewResolver() *Resolver {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
-		records:       make(map[dns.Question][]dns.RR),
-		domains:       make(map[domain.Domain]struct{}),
-		zones:         make(map[domain.Domain]bool),
-		warmupTimeout: lazyWarmupTimeoutFromEnv(),
-		ctx:           ctx,
-		cancel:        cancel,
+		records: make(map[dns.Question][]dns.RR),
+		domains: make(map[domain.Domain]struct{}),
+		zones:   make(map[domain.Domain]bool),
+		ctx:     ctx,
+		cancel:  cancel,
 	}
 }
 
@@ -120,14 +76,6 @@ func (d *Resolver) SetPeerConnectivity(p PeerConnectivity) {
 	d.peerConn = p
 }
 
-// SetPeerActivator wires the DNS-time lazy-connection warm-up. Pass nil to
-// disable. Safe to call multiple times; the latest value wins.
-func (d *Resolver) SetPeerActivator(a PeerActivator) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	d.peerActivator = a
-}
-
 func (d *Resolver) MatchSubdomains() bool {
 	return true
 }
@@ -174,9 +122,6 @@ func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	replyMessage.RecursionAvailable = true
 
 	result := d.lookupRecords(logger, question)
-	// Warm before filtering: activation flips a lazily-idle target to connected,
-	// which then lets it survive the disconnected-peer filter below.
-	d.warmLazyPeers(question, result.records)
 	result.records = d.filterDisconnectedPeerAnswers(logger, question, result.records)
 	replyMessage.Authoritative = !result.hasExternalData
 	replyMessage.Answer = result.records
@@ -550,8 +495,8 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	kept := make([]dns.RR, 0, len(records))
 	var dropped int
 	for _, rr := range records {
-		ip, ok := extractRecordAddr(rr)
-		if !ok {
+		ip := extractRecordIP(rr)
+		if ip == "" {
 			kept = append(kept, rr)
 			continue
 		}
@@ -573,54 +518,22 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	return kept
 }
 
-// warmLazyPeers triggers lazy-connection wake-up for the peers a resolved
-// answer points at and waits briefly for one to connect, so the caller's first
-// request doesn't race the connection establishment. Warm-up is scoped to
-// match-only (non-authoritative) zones — the synthesized private-service zones
-// and user-created zones whose records point at specific peers. The account's
-// peer zone is authoritative, so plain peer-name lookups never trigger warm-up;
-// otherwise resolving any peer's name would wake its idle connection, defeating
-// laziness mesh-wide. No-op when no activator is wired (lazy connections
-// disabled) or the answer carries no peer IPs.
-func (d *Resolver) warmLazyPeers(question dns.Question, records []dns.RR) {
-	d.mu.RLock()
-	activator := d.peerActivator
-	var nonAuth, found bool
-	if activator != nil {
-		nonAuth, found = d.findZone(question.Name)
-	}
-	d.mu.RUnlock()
-	if activator == nil || !found || !nonAuth {
-		return
-	}
-
-	var addrs []netip.Addr
-	for _, rr := range records {
-		if addr, ok := extractRecordAddr(rr); ok {
-			addrs = append(addrs, addr)
-		}
-	}
-	if len(addrs) == 0 {
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(d.ctx, d.warmupTimeout)
-	defer cancel()
-	activator.ActivatePeersByIP(ctx, addrs)
-}
-
-// extractRecordAddr returns the IP address carried by an A or AAAA record.
-// ok is false for any other record type or a record with no address.
-func extractRecordAddr(rr dns.RR) (netip.Addr, bool) {
+// extractRecordIP returns the dotted-decimal / colon-hex IP carried by
+// an A or AAAA record, or "" for any other record type.
+func extractRecordIP(rr dns.RR) string {
 	switch r := rr.(type) {
 	case *dns.A:
-		addr, ok := netip.AddrFromSlice(r.A)
-		return addr.Unmap(), ok
+		if r.A == nil {
+			return ""
+		}
+		return r.A.String()
 	case *dns.AAAA:
-		addr, ok := netip.AddrFromSlice(r.AAAA)
-		return addr.Unmap(), ok
+		if r.AAAA == nil {
+			return ""
+		}
+		return r.AAAA.String()
 	}
-	return netip.Addr{}, false
+	return ""
 }
 
 // Update replaces all zones and their records

client/internal/dns/local/local_test.go

@@ -37,8 +37,8 @@ type mockPeerConnectivity struct {
 	byIP map[string]struct{ known, connected bool }
 }
 
-func (m mockPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
-	v, ok := m.byIP[ip.String()]
+func (m mockPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
+	v, ok := m.byIP[ip]
 	if !ok {
 		return false, false
 	}

client/internal/dns/local/warmup_test.go

@@ -1,172 +0,0 @@
-package local
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/dns/test"
-	nbdns "github.com/netbirdio/netbird/dns"
-)
-
-// recordingActivator records the addresses it was asked to warm and returns
-// immediately, so ServeDNS is not blocked by the test.
-type recordingActivator struct {
-	mu     sync.Mutex
-	called bool
-	addrs  []netip.Addr
-}
-
-func (r *recordingActivator) ActivatePeersByIP(_ context.Context, addrs []netip.Addr) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.called = true
-	r.addrs = append(r.addrs, addrs...)
-}
-
-func serveA(t *testing.T, resolver *Resolver, name string) *dns.Msg {
-	t.Helper()
-	var resp *dns.Msg
-	w := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}
-	resolver.ServeDNS(w, new(dns.Msg).SetQuestion(name, dns.TypeA))
-	return resp
-}
-
-// serviceZone registers rec in a match-only (non-authoritative) zone, the shape
-// the synthesized private-service zones arrive in.
-func serviceZone(t *testing.T, resolver *Resolver, zone string, records ...nbdns.SimpleRecord) {
-	t.Helper()
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:           zone,
-		Records:          records,
-		NonAuthoritative: true,
-	}})
-}
-
-func TestLocalResolver_WarmsLazyPeerOnResolve(t *testing.T) {
-	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must answer")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.True(t, act.called, "activator must be invoked for a service-zone A answer")
-	assert.Contains(t, act.addrs, netip.MustParseAddr("100.64.0.7"), "activator must receive the answer's peer IP")
-}
-
-func TestLocalResolver_NoActivatorNoWarmup(t *testing.T) {
-	// With no activator wired the resolver behaves exactly as before.
-	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must still answer without an activator")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-}
-
-func TestLocalResolver_NoWarmupForMissingRecord(t *testing.T) {
-	// A query that resolves to nothing must not invoke the activator (no IPs).
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud",
-		nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"})
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	serveA(t, resolver, "absent.proxy.netbird.cloud.")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.False(t, act.called, "activator must not be invoked when there is no answer")
-}
-
-func TestLocalResolver_NoWarmupInAuthoritativeZone(t *testing.T) {
-	// The account's peer zone is authoritative; resolving a peer's name there
-	// must not wake its lazy connection — warm-up is scoped to match-only
-	// (non-authoritative) zones such as the synthesized private-service zones.
-	rec := nbdns.SimpleRecord{Name: "peer.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.9"}
-	resolver := NewResolver()
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:  "netbird.cloud",
-		Records: []nbdns.SimpleRecord{rec},
-	}})
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must answer")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.False(t, act.called, "activator must not be invoked for authoritative-zone answers")
-}
-
-func TestLazyWarmupTimeoutFromEnv(t *testing.T) {
-	tests := []struct {
-		name   string
-		value  string
-		envSet bool
-		want   time.Duration
-	}{
-		{name: "unset uses default", want: defaultLazyWarmupTimeout},
-		{name: "valid overrides", value: "5s", envSet: true, want: 5 * time.Second},
-		{name: "invalid falls back", value: "not-a-duration", envSet: true, want: defaultLazyWarmupTimeout},
-		{name: "negative falls back", value: "-1s", envSet: true, want: defaultLazyWarmupTimeout},
-		{name: "zero falls back", value: "0s", envSet: true, want: defaultLazyWarmupTimeout},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.envSet {
-				t.Setenv(envLazyWarmupTimeout, tt.value)
-			}
-			assert.Equal(t, tt.want, lazyWarmupTimeoutFromEnv())
-			assert.Equal(t, tt.want, NewResolver().warmupTimeout, "constructor must resolve the timeout once")
-		})
-	}
-}
-
-func TestExtractRecordAddr(t *testing.T) {
-	t.Run("A record yields unmapped v4", func(t *testing.T) {
-		// net.ParseIP returns the 16-byte v4-in-v6 form, the same shape
-		// miekg/dns stores after parsing an A record; the extracted address
-		// must compare equal to a plain v4 netip.Addr.
-		addr, ok := extractRecordAddr(&dns.A{A: net.ParseIP("100.64.0.7")})
-		require.True(t, ok)
-		assert.True(t, addr.Is4())
-		assert.Equal(t, netip.MustParseAddr("100.64.0.7"), addr)
-	})
-
-	t.Run("AAAA record yields v6", func(t *testing.T) {
-		addr, ok := extractRecordAddr(&dns.AAAA{AAAA: net.ParseIP("fd00::1")})
-		require.True(t, ok)
-		assert.Equal(t, netip.MustParseAddr("fd00::1"), addr)
-	})
-
-	t.Run("A record without address", func(t *testing.T) {
-		_, ok := extractRecordAddr(&dns.A{})
-		assert.False(t, ok)
-	})
-
-	t.Run("non-address record", func(t *testing.T) {
-		_, ok := extractRecordAddr(&dns.CNAME{Target: "target.netbird.cloud."})
-		assert.False(t, ok)
-	})
-}

client/internal/dns/mock_server.go

@@ -8,7 +8,6 @@ import (
 	"github.com/miekg/dns"
 
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
-	"github.com/netbirdio/netbird/client/internal/dns/local"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -93,11 +92,6 @@ func (m *MockServer) SetFirewall(Firewall) {
 	// Mock implementation - no-op
 }
 
-// SetPeerActivator mock implementation of SetPeerActivator from Server interface
-func (m *MockServer) SetPeerActivator(local.PeerActivator) {
-	// Mock implementation - no-op
-}
-
 // BeginBatch mock implementation of BeginBatch from Server interface
 func (m *MockServer) BeginBatch() {
 	// Mock implementation - no-op

client/internal/dns/server.go

@@ -82,7 +82,6 @@ type Server interface {
 	PopulateManagementDomain(mgmtURL *url.URL) error
 	SetRouteSources(selected, active func() route.HAMap)
 	SetFirewall(Firewall)
-	SetPeerActivator(local.PeerActivator)
 }
 
 type nsGroupsByDomain struct {
@@ -492,13 +491,6 @@ func (s *DefaultServer) SetFirewall(fw Firewall) {
 	}
 }
 
-// SetPeerActivator wires the DNS-time lazy-connection warm-up on the local
-// resolver. Injected after the connection manager exists (it does not at
-// DNS-server construction time). Pass nil to disable.
-func (s *DefaultServer) SetPeerActivator(a local.PeerActivator) {
-	s.localResolver.SetPeerActivator(a)
-}
-
 // Stop stops the server
 func (s *DefaultServer) Stop() {
 	s.ctxCancel()
@@ -1443,11 +1435,11 @@ type localPeerConnectivity struct {
 
 // IsConnectedByIP looks the IP up in the peerstore and surfaces both
 // the known and connected bits. Used by Resolver.filterDisconnectedPeerAnswers.
-func (l localPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
+func (l localPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
 	if l.status == nil {
 		return false, false
 	}
-	state, ok := l.status.PeerStateByIP(ip.String())
+	state, ok := l.status.PeerStateByIP(ip)
 	if !ok {
 		return false, false
 	}

client/internal/dns/service_listener.go

@@ -292,16 +292,18 @@ func (s *serviceViaListener) generateFreePort() (uint16, error) {
 		return customPort, nil
 	}
 
-	probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
+	udpAddr := net.UDPAddrFromAddrPort(netip.MustParseAddrPort("0.0.0.0:0"))
+	probeListener, err := net.ListenUDP("udp", udpAddr)
 	if err != nil {
 		log.Debugf("failed to bind random port for DNS: %s", err)
 		return 0, err
 	}
 
-	port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
-	if err = probeListener.Close(); err != nil {
+	addrPort := netip.MustParseAddrPort(probeListener.LocalAddr().String()) // might panic if address is incorrect
+	err = probeListener.Close()
+	if err != nil {
 		log.Debugf("failed to free up DNS port: %s", err)
 		return 0, err
 	}
-	return port, nil
+	return addrPort.Port(), nil
 }

client/internal/dns_peer_activator.go

@@ -1,76 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net/netip"
-	"time"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-)
-
-const dnsActivationPollInterval = 50 * time.Millisecond
-
-// dnsPeerActivator wakes lazy-connection peers from the DNS resolution path. It
-// implements dns/local.PeerActivator. DNS queries run on their own goroutines,
-// so it only touches state that is safe for concurrent use — ConnMgr.ActivatePeer,
-// peerstore.Store and peer.Status — and never takes the engine's syncMsgMux,
-// keeping DNS resolution from contending with network-map processing.
-type dnsPeerActivator struct {
-	connMgr   *ConnMgr
-	peerStore *peerstore.Store
-	status    *peer.Status
-	// ctx is the engine's long-lived context. The connection dial is tied to it
-	// (not the per-query DNS wait budget) so a handshake that outlasts the wait
-	// still completes in the background rather than being cancelled at the deadline.
-	ctx context.Context
-}
-
-// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and waits
-// until one is connected or ctx (the per-query DNS wait budget) expires.
-// Activation itself is tied to the engine's long-lived context so the dial
-// survives a wait that times out. Unknown or already-connected addresses are
-// skipped, so the steady-state (warm) path adds no latency.
-func (a *dnsPeerActivator) ActivatePeersByIP(ctx context.Context, addrs []netip.Addr) {
-	if a == nil || a.connMgr == nil {
-		return
-	}
-
-	var pending []string
-	for _, addr := range addrs {
-		ip := addr.String()
-		st, ok := a.status.PeerStateByIP(ip)
-		if !ok || st.ConnStatus == peer.StatusConnected {
-			continue
-		}
-		conn, ok := a.peerStore.PeerConn(st.PubKey)
-		if !ok {
-			continue
-		}
-		a.connMgr.ActivatePeer(a.ctx, conn)
-		pending = append(pending, ip)
-	}
-
-	if len(pending) == 0 {
-		return
-	}
-	a.waitConnected(ctx, pending)
-}
-
-// waitConnected blocks until any of ips reports a connected peer or ctx expires.
-func (a *dnsPeerActivator) waitConnected(ctx context.Context, ips []string) {
-	ticker := time.NewTicker(dnsActivationPollInterval)
-	defer ticker.Stop()
-	for {
-		for _, ip := range ips {
-			if st, ok := a.status.PeerStateByIP(ip); ok && st.ConnStatus == peer.StatusConnected {
-				return
-			}
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-		}
-	}
-}

client/internal/dns_peer_activator_test.go

@@ -1,129 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-)
-
-func newTestPeerConn(t *testing.T, key string) *peer.Conn {
-	t.Helper()
-	conn, err := peer.NewConn(peer.ConnConfig{
-		Key:      key,
-		LocalKey: "local",
-		WgConfig: peer.WgConfig{
-			AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-		},
-	}, peer.ServiceDependencies{})
-	require.NoError(t, err)
-	return conn
-}
-
-func newTestDNSPeerActivator(t *testing.T) (*dnsPeerActivator, *peer.Status, *peerstore.Store) {
-	t.Helper()
-	status := peer.NewRecorder("https://mgm")
-	store := peerstore.NewConnStore()
-	// ConnMgr without Start: the lazy manager is nil, so ActivatePeer is a
-	// no-op — these tests exercise the activator's skip/wait logic.
-	connMgr := NewConnMgr(&EngineConfig{}, status, store, nil)
-	return &dnsPeerActivator{
-		connMgr:   connMgr,
-		peerStore: store,
-		status:    status,
-		ctx:       context.Background(),
-	}, status, store
-}
-
-func TestDNSPeerActivator_NilSafe(t *testing.T) {
-	var a *dnsPeerActivator
-	a.ActivatePeersByIP(context.Background(), []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-}
-
-// TestDNSPeerActivator_SkipsUnknownAndConnectedPeers verifies the steady-state
-// (warm) path adds no latency: already-connected and unknown addresses never
-// enter the wait loop.
-func TestDNSPeerActivator_SkipsUnknownAndConnectedPeers(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", "fd00::1"))
-	require.NoError(t, status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected}))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{
-		netip.MustParseAddr("100.64.0.1"),  // known, connected -> skipped
-		netip.MustParseAddr("fd00::1"),     // known via IPv6, connected -> skipped
-		netip.MustParseAddr("100.64.0.99"), // unknown -> skipped
-	})
-	require.Less(t, time.Since(start), time.Second, "no pending peer must mean no wait")
-}
-
-// TestDNSPeerActivator_WaitsForPendingPeerToConnect verifies the wait loop
-// returns as soon as a pending peer reports connected, well before the
-// per-query budget expires.
-func TestDNSPeerActivator_WaitsForPendingPeerToConnect(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	go func() {
-		time.Sleep(150 * time.Millisecond)
-		_ = status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected})
-	}()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	elapsed := time.Since(start)
-
-	require.GreaterOrEqual(t, elapsed, 100*time.Millisecond, "must wait for the pending peer")
-	require.Less(t, elapsed, 5*time.Second, "must return on connect, not at the deadline")
-}
-
-// TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle verifies a peer that
-// never connects releases the DNS response at the per-query budget instead of
-// blocking it indefinitely.
-func TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Millisecond)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	elapsed := time.Since(start)
-
-	require.GreaterOrEqual(t, elapsed, 250*time.Millisecond, "must wait out the budget for a pending peer")
-	require.Less(t, elapsed, 5*time.Second, "must not block past the budget")
-}
-
-// TestDNSPeerActivator_NoWaitWithoutPeerConn verifies a known-but-idle peer
-// with no connection object in the store is not waited on: there is nothing to
-// activate, so waiting could only ever time out.
-func TestDNSPeerActivator_NoWaitWithoutPeerConn(t *testing.T) {
-	a, status, _ := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	require.Less(t, time.Since(start), time.Second, "peer without a conn must not be waited on")
-}

client/internal/engine.go

@@ -40,7 +40,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
 	"github.com/netbirdio/netbird/client/internal/ingressgw"
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/netflow"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
@@ -148,9 +147,7 @@ type EngineConfig struct {
 	BlockInbound        bool
 	DisableIPv6         bool
 
-	// LazyConnection is the MDM-sourced lazy-connection override; StateUnset defers to
-	// the env var and management feature flag.
-	LazyConnection lazyconn.State
+	LazyConnectionEnabled bool
 
 	MTU uint16
 
@@ -551,7 +548,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}
@@ -654,16 +651,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	e.connMgr = NewConnMgr(e.config, e.statusRecorder, e.peerStore, wgIface)
 	e.connMgr.Start(e.ctx)
 
-	// Wire DNS-time lazy-connection warm-up now that the connection manager
-	// exists (it does not at DNS-server construction time). A DNS answer that
-	// points at an idle peer then wakes it before the client's first request.
-	e.dnsServer.SetPeerActivator(&dnsPeerActivator{
-		connMgr:   e.connMgr,
-		peerStore: e.peerStore,
-		status:    e.statusRecorder,
-		ctx:       e.ctx,
-	})
-
 	e.srWatcher = guard.NewSRWatcher(e.signal, e.relayManager, e.mobileDep.IFaceDiscover, iceCfg)
 	e.srWatcher.Start(peer.IsForceRelayed())
 
@@ -1174,6 +1161,7 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
+		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
@@ -2042,6 +2030,7 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
+		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
@@ -2615,14 +2604,13 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal
 
 func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
-
-	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
-	// cannot wake a lazy connection, so the peer routing the target must stay
-	// permanently connected. AllowedIPs are already parsed on the peer conn, so
-	// reuse those typed prefixes instead of re-parsing the network map strings.
 	for _, r := range rules {
+		ip := r.TranslatedAddress
 		for _, p := range peers {
-			if e.peerRoutesAddr(p, r.TranslatedAddress) {
+			for _, allowedIP := range p.GetAllowedIps() {
+				if allowedIP != ip.String() {
+					continue
+				}
 				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
 				excludedPeers[p.GetWgPubKey()] = true
 			}
@@ -2632,27 +2620,6 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
 	return excludedPeers
 }
 
-// peerRoutesAddr reports whether the peer is a router for addr, matched against
-// the peer's already-parsed AllowedIPs from the store (the same typed value the
-// lazy manager consumes) rather than re-parsing the network map strings.
-func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
-	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
-	if !ok {
-		return false
-	}
-	return prefixesContain(prefixes, addr)
-}
-
-// prefixesContain reports whether addr falls within any of the prefixes.
-func prefixesContain(prefixes []netip.Prefix, addr netip.Addr) bool {
-	for _, prefix := range prefixes {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}
-
 // isChecksEqual checks if two slices of checks are equal.
 func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 	normalize := func(checks []*mgmProto.Checks) []string {

client/internal/engine_lazy_exclude_test.go

@@ -1,87 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func TestPrefixesContain(t *testing.T) {
-	tests := []struct {
-		name     string
-		prefixes []string
-		addr     string
-		want     bool
-	}{
-		{name: "own overlay /32 matches", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.145", want: true},
-		{name: "addr inside routed subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.121.208.4", want: true},
-		{name: "addr outside subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.122.0.1", want: false},
-		{name: "different /32", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.146", want: false},
-		{name: "ipv6 /128 matches", prefixes: []string{"fd00::1/128"}, addr: "fd00::1", want: true},
-		{name: "no prefixes", prefixes: nil, addr: "10.121.208.4", want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			prefixes := make([]netip.Prefix, 0, len(tt.prefixes))
-			for _, p := range tt.prefixes {
-				prefixes = append(prefixes, netip.MustParsePrefix(p))
-			}
-			require.Equal(t, tt.want, prefixesContain(prefixes, netip.MustParseAddr(tt.addr)))
-		})
-	}
-}
-
-// TestToExcludedLazyPeers_ForwardTarget guards a regression: the forward-target
-// peer (the peer routing a ForwardRule.TranslatedAddress) must be excluded from
-// lazy connections, matched via the peer's already-parsed AllowedIPs.
-func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
-	const targetPeerKey = "cccccccccccccccccccccccccccccccccccccccccc0="
-	const otherPeerKey = "dddddddddddddddddddddddddddddddddddddddddd0="
-
-	store := peerstore.NewConnStore()
-	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
-	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))
-
-	e := &Engine{peerStore: store}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
-		{WgPubKey: otherPeerKey, AllowedIps: []string{"100.110.9.10/32"}},
-	}
-	rules := []firewallManager.ForwardRule{
-		{TranslatedAddress: netip.MustParseAddr("100.110.8.145")},
-	}
-
-	excluded := e.toExcludedLazyPeers(rules, peers)
-
-	require.True(t, excluded[targetPeerKey], "forward-target peer must be excluded from lazy connections")
-	require.False(t, excluded[otherPeerKey], "non-target peer must not be excluded")
-	require.Len(t, excluded, 1)
-}
-
-func TestToExcludedLazyPeers_NoRules(t *testing.T) {
-	e := &Engine{peerStore: peerstore.NewConnStore()}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
-	}
-
-	require.Empty(t, e.toExcludedLazyPeers(nil, peers))
-}
-
-func newTestConn(t *testing.T, key, allowedIP string) *peer.Conn {
-	t.Helper()
-	conn, err := peer.NewConn(peer.ConnConfig{
-		Key:      key,
-		WgConfig: peer.WgConfig{AllowedIps: []netip.Prefix{netip.MustParsePrefix(allowedIP)}},
-	}, peer.ServiceDependencies{})
-	require.NoError(t, err)
-	return conn
-}

client/internal/engine_lazyconn.go

@@ -0,0 +1,19 @@
+package internal
+
+import (
+	"errors"
+)
+
+// SetLazyConnEnabled applies a local lazy connection override to the running
+// engine. It pins the setting like an env/CLI flag, so a later management sync
+// cannot override it. syncMsgMux guards ConnMgr, which is not thread-safe.
+func (e *Engine) SetLazyConnEnabled(enabled bool) error {
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+
+	if e.connMgr == nil {
+		return errors.New("connection manager is not initialised")
+	}
+
+	return e.connMgr.SetLocalLazyConn(e.ctx, enabled)
+}

client/internal/lazyconn/env.go

@@ -3,57 +3,24 @@ package lazyconn
 import (
 	"os"
 	"strconv"
-	"strings"
 
 	log "github.com/sirupsen/logrus"
 )
 
 const (
-	EnvLazyConn            = "NB_LAZY_CONN"
+	EnvEnableLazyConn      = "NB_ENABLE_EXPERIMENTAL_LAZY_CONN"
 	EnvInactivityThreshold = "NB_LAZY_CONN_INACTIVITY_THRESHOLD"
 )
 
-// State is the tri-state local override for lazy connections read from the environment.
-type State int
-
-const (
-	// StateUnset means no local override; defer to the management feature flag.
-	StateUnset State = iota
-	// StateOn forces lazy connections on, overriding management.
-	StateOn
-	// StateOff forces lazy connections off, overriding management.
-	StateOff
-)
-
-// EnvState reads NB_LAZY_CONN and returns the local override state.
-func EnvState() State {
-	return ParseState(os.Getenv(EnvLazyConn))
-}
-
-// ParseState interprets a lazy-connection override value (from the environment or an MDM
-// policy). It accepts the on/off aliases plus any value strconv.ParseBool understands
-// (true/false/1/0). An empty or unrecognized value returns StateUnset so that the
-// management feature flag remains in control.
-func ParseState(raw string) State {
-	if raw == "" {
-		return StateUnset
+func IsLazyConnEnabledByEnv() bool {
+	val := os.Getenv(EnvEnableLazyConn)
+	if val == "" {
+		return false
 	}
-
-	normalized := strings.ToLower(strings.TrimSpace(raw))
-	switch normalized {
-	case "on":
-		return StateOn
-	case "off":
-		return StateOff
-	}
-
-	enabled, err := strconv.ParseBool(normalized)
+	enabled, err := strconv.ParseBool(val)
 	if err != nil {
-		log.Warnf("failed to parse lazy connection value %q (from %s env or MDM policy): %v", raw, EnvLazyConn, err)
-		return StateUnset
+		log.Warnf("failed to parse %s: %v", EnvEnableLazyConn, err)
+		return false
 	}
-	if enabled {
-		return StateOn
-	}
-	return StateOff
+	return enabled
 }

client/internal/lazyconn/env_test.go

@@ -1,45 +0,0 @@
-package lazyconn
-
-import (
-	"os"
-	"testing"
-)
-
-func TestEnvState(t *testing.T) {
-	tests := []struct {
-		value string
-		set   bool
-		want  State
-	}{
-		{set: false, want: StateUnset},
-		{value: "", set: true, want: StateUnset},
-		{value: "on", set: true, want: StateOn},
-		{value: "ON", set: true, want: StateOn},
-		{value: "true", set: true, want: StateOn},
-		{value: "1", set: true, want: StateOn},
-		{value: " on ", set: true, want: StateOn},
-		{value: "off", set: true, want: StateOff},
-		{value: "OFF", set: true, want: StateOff},
-		{value: "false", set: true, want: StateOff},
-		{value: "0", set: true, want: StateOff},
-		{value: "auto", set: true, want: StateUnset},
-		{value: "garbage", set: true, want: StateUnset},
-	}
-
-	for _, tt := range tests {
-		name := tt.value
-		if !tt.set {
-			name = "unset"
-		}
-		t.Run(name, func(t *testing.T) {
-			t.Setenv(EnvLazyConn, tt.value)
-			if !tt.set {
-				os.Unsetenv(EnvLazyConn)
-			}
-
-			if got := EnvState(); got != tt.want {
-				t.Fatalf("EnvState() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}

client/internal/netflow/logger/logger.go

@@ -27,7 +27,7 @@ type Logger struct {
 	wgIfaceNetV6       netip.Prefix
 	dnsCollection      atomic.Bool
 	exitNodeCollection atomic.Bool
-	Store              types.AggregatingStore
+	Store              types.Store
 }
 
 func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix) *Logger {
@@ -35,7 +35,7 @@ func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix)
 		statusRecorder: statusRecorder,
 		wgIfaceNet:     wgIfaceIPNet,
 		wgIfaceNetV6:   wgIfaceIPNetV6,
-		Store:          store.NewAggregatingMemoryStore(),
+		Store:          store.NewMemoryStore(),
 	}
 }
 
@@ -125,10 +125,6 @@ func (l *Logger) stop() {
 	l.mux.Unlock()
 }
 
-func (l *Logger) ResetAggregationWindow() types.FlowEventAggregator {
-	return l.Store.ResetAggregationWindow()
-}
-
 func (l *Logger) GetEvents() []*types.Event {
 	return l.Store.GetEvents()
 }

client/internal/netflow/manager.go

@@ -9,14 +9,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/cenkalti/backoff/v4"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/netflow/conntrack"
 	"github.com/netbirdio/netbird/client/internal/netflow/logger"
-	"github.com/netbirdio/netbird/client/internal/netflow/store"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/flow/client"
@@ -25,16 +23,14 @@ import (
 
 // Manager handles netflow tracking and logging
 type Manager struct {
-	mux               sync.Mutex
-	shutdownWg        sync.WaitGroup
-	logger            nftypes.FlowLogger
-	flowConfig        *nftypes.FlowConfig
-	conntrack         nftypes.ConnTracker
-	receiverClient    *client.GRPCClient
-	eventsWithoutAcks nftypes.Store
-	publicKey         []byte
-	cancel            context.CancelFunc
-	retryInterval     time.Duration
+	mux            sync.Mutex
+	shutdownWg     sync.WaitGroup
+	logger         nftypes.FlowLogger
+	flowConfig     *nftypes.FlowConfig
+	conntrack      nftypes.ConnTracker
+	receiverClient *client.GRPCClient
+	publicKey      []byte
+	cancel         context.CancelFunc
 }
 
 // NewManager creates a new netflow manager
@@ -52,11 +48,9 @@ func NewManager(iface nftypes.IFaceMapper, publicKey []byte, statusRecorder *pee
 	}
 
 	return &Manager{
-		logger:            flowLogger,
-		conntrack:         ct,
-		publicKey:         publicKey,
-		retryInterval:     time.Second,
-		eventsWithoutAcks: store.NewMemoryStore(),
+		logger:    flowLogger,
+		conntrack: ct,
+		publicKey: publicKey,
 	}
 }
 
@@ -72,7 +66,6 @@ func (m *Manager) needsNewClient(previous *nftypes.FlowConfig) bool {
 }
 
 // enableFlow starts components for flow tracking
-// must be called under m.mux lock
 func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	// first make sender ready so events don't pile up
 	if m.needsNewClient(previous) {
@@ -92,7 +85,6 @@ func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	return nil
 }
 
-// must be called under m.mux lock
 func (m *Manager) resetClient() error {
 	if m.receiverClient != nil {
 		if err := m.receiverClient.Close(); err != nil {
@@ -115,19 +107,14 @@ func (m *Manager) resetClient() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	m.cancel = cancel
 
-	m.shutdownWg.Add(3)
-	flowConfigInterval := m.flowConfig.Interval
+	m.shutdownWg.Add(2)
 	go func() {
 		defer m.shutdownWg.Done()
-		m.receiveACKs(ctx, flowClient, flowConfigInterval)
+		m.receiveACKs(ctx, flowClient)
 	}()
 	go func() {
 		defer m.shutdownWg.Done()
-		m.startSender(ctx, flowConfigInterval)
-	}()
-	go func() {
-		defer m.shutdownWg.Done()
-		m.startRetries(ctx, flowConfigInterval)
+		m.startSender(ctx)
 	}()
 
 	return nil
@@ -211,8 +198,8 @@ func (m *Manager) GetLogger() nftypes.FlowLogger {
 	return m.logger
 }
 
-func (m *Manager) startSender(ctx context.Context, flowConfigInterval time.Duration) {
-	ticker := time.NewTicker(flowConfigInterval)
+func (m *Manager) startSender(ctx context.Context) {
+	ticker := time.NewTicker(m.flowConfig.Interval)
 	defer ticker.Stop()
 
 	for {
@@ -220,29 +207,27 @@ func (m *Manager) startSender(ctx context.Context, flowConfigInterval time.Durat
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			collectedEvents := m.logger.ResetAggregationWindow()
-			events := collectedEvents.GetAggregatedEvents()
+			events := m.logger.GetEvents()
 			for _, event := range events {
-				m.eventsWithoutAcks.StoreEvent(event)
 				if err := m.send(event); err != nil {
 					log.Errorf("failed to send flow event to server: %v", err)
-				} else {
-					log.Tracef("sent flow event: %s", event.ID)
+					continue
 				}
+				log.Tracef("sent flow event: %s", event.ID)
 			}
 		}
 	}
 }
 
-func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient, flowConfigInterval time.Duration) {
-	err := client.Receive(ctx, flowConfigInterval, func(ack *proto.FlowEventAck) error {
+func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient) {
+	err := client.Receive(ctx, m.flowConfig.Interval, func(ack *proto.FlowEventAck) error {
 		id, err := uuid.FromBytes(ack.EventId)
 		if err != nil {
 			log.Warnf("failed to convert ack event id to uuid: %v", err)
 			return nil
 		}
 		log.Tracef("received flow event ack: %s", id)
-		m.eventsWithoutAcks.DeleteEvents([]uuid.UUID{id})
+		m.logger.DeleteEvents([]uuid.UUID{id})
 		return nil
 	})
 
@@ -251,51 +236,6 @@ func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient, fl
 	}
 }
 
-// We effectively never drop events (see MaxInterval), which makes eventsWithoutAcks unbounded.
-// We may want to limit the max size of the store, and start dropping oldest events when the threshold is reached.
-func (m *Manager) startRetries(ctx context.Context, flowConfigInterval time.Duration) {
-	timer := time.NewTimer(m.retryInterval)
-	retryBackoff := backoff.WithContext(&backoff.ExponentialBackOff{
-		InitialInterval:     1 * time.Second,
-		RandomizationFactor: 0.5,
-		Multiplier:          1.7,
-		MaxInterval:         flowConfigInterval / 2,
-		MaxElapsedTime:      3 * 30 * 24 * time.Hour, // 3 months
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	}, ctx)
-	defer timer.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-timer.C:
-			resetBackoff := true
-			for _, e := range m.eventsWithoutAcks.GetEvents() {
-				if e.Timestamp.Add(time.Second).After(time.Now()) {
-					// grace period on retries to avoid early retries
-					// do not retry if the event is less than 1 sec old
-					continue
-				}
-				if err := m.send(e); err != nil {
-					if nextBackoff := retryBackoff.NextBackOff(); nextBackoff != backoff.Stop {
-						timer = time.NewTimer(nextBackoff)
-						resetBackoff = false
-					} else {
-						resetBackoff = true // we exhausted retries, reset retry loop
-					}
-					break
-				}
-			}
-			if resetBackoff { // use regular retry interval in absence of network errors
-				retryBackoff.Reset()
-				timer = time.NewTimer(m.retryInterval)
-			}
-		}
-	}
-}
-
 func (m *Manager) send(event *nftypes.Event) error {
 	m.mux.Lock()
 	client := m.receiverClient
@@ -310,11 +250,9 @@ func (m *Manager) send(event *nftypes.Event) error {
 
 func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 	protoEvent := &proto.FlowEvent{
-		EventId:     event.ID[:],
-		Timestamp:   timestamppb.New(event.Timestamp),
-		PublicKey:   publicKey,
-		WindowStart: timestamppb.New(event.WindowStart),
-		WindowEnd:   timestamppb.New(event.WindowEnd),
+		EventId:   event.ID[:],
+		Timestamp: timestamppb.New(event.Timestamp),
+		PublicKey: publicKey,
 		FlowFields: &proto.FlowFields{
 			FlowId:           event.FlowID[:],
 			RuleId:           event.RuleID,
@@ -329,9 +267,6 @@ func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 			TxBytes:          event.TxBytes,
 			SourceResourceId: event.SourceResourceID,
 			DestResourceId:   event.DestResourceID,
-			NumOfStarts:      event.NumOfStarts,
-			NumOfEnds:        event.NumOfEnds,
-			NumOfDrops:       event.NumOfDrops,
 		},
 	}
 

client/internal/netflow/manager_integration_test.go

@@ -1,291 +0,0 @@
-package netflow
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"slices"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	"github.com/netbirdio/netbird/client/internal/netflow/types"
-	"github.com/netbirdio/netbird/flow/proto"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"google.golang.org/grpc"
-)
-
-type testServer struct {
-	proto.UnimplementedFlowServiceServer
-	events         chan *proto.FlowEvent
-	acks           chan *proto.FlowEventAck
-	grpcSrv        *grpc.Server
-	addr           string
-	handlerDone    chan struct{} // signaled each time Events() exits
-	handlerStarted chan struct{} // signaled each time Events() begins
-}
-
-func newTestServer(t *testing.T) *testServer {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-
-	s := &testServer{
-		events:         make(chan *proto.FlowEvent, 100),
-		acks:           make(chan *proto.FlowEventAck, 100),
-		grpcSrv:        grpc.NewServer(),
-		addr:           listener.Addr().String(),
-		handlerDone:    make(chan struct{}, 10),
-		handlerStarted: make(chan struct{}, 10),
-	}
-
-	proto.RegisterFlowServiceServer(s.grpcSrv, s)
-
-	go func() {
-		if err := s.grpcSrv.Serve(listener); err != nil && !errors.Is(err, grpc.ErrServerStopped) {
-			t.Logf("server error: %v", err)
-		}
-	}()
-
-	t.Cleanup(func() {
-		s.grpcSrv.Stop()
-	})
-
-	return s
-}
-
-func (s *testServer) Events(stream proto.FlowService_EventsServer) error {
-	defer func() {
-		select {
-		case s.handlerDone <- struct{}{}:
-		default:
-		}
-	}()
-
-	err := stream.Send(&proto.FlowEventAck{IsInitiator: true})
-	if err != nil {
-		return err
-	}
-
-	select {
-	case s.handlerStarted <- struct{}{}:
-	default:
-	}
-
-	ctx, cancel := context.WithCancel(stream.Context())
-	defer cancel()
-
-	go func() {
-		defer cancel()
-		for {
-			event, err := stream.Recv()
-			if err != nil {
-				return
-			}
-
-			if !event.IsInitiator {
-				select {
-				case s.events <- event:
-				case <-ctx.Done():
-					return
-				}
-			}
-		}
-	}()
-
-	for {
-		select {
-		case ack := <-s.acks:
-			if err := stream.Send(ack); err != nil {
-				return err
-			}
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-	}
-}
-
-func TestSendEventReceiveAck(t *testing.T) {
-	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	t.Cleanup(cancel)
-
-	server := newTestServer(t)
-	manager := createManager(t, server.addr, 60*time.Second) // set high to prevent retries in this test
-	defer manager.Close()
-
-	assert.Eventually(t, func() bool {
-		select {
-		case <-server.handlerStarted:
-			return true
-		default:
-			return false
-		}
-	}, 3*time.Second, 100*time.Millisecond)
-
-	event1 := types.EventFields{
-		FlowID:    uuid.New(),
-		Type:      types.TypeStart,
-		Direction: types.Ingress,
-		DestIP:    ipAddr("172.16.1.2"),
-		DestPort:  2345,
-		Protocol:  6,
-	}
-	manager.logger.StoreEvent(event1)
-	event2 := types.EventFields{
-		FlowID:    uuid.New(),
-		Type:      types.TypeStart,
-		Direction: types.Ingress,
-		DestIP:    ipAddr("172.16.1.1"),
-		DestPort:  1234,
-		Protocol:  6,
-	}
-	manager.logger.StoreEvent(event2)
-
-	// verify the server received logged events
-	serverSideEvents := make([]*proto.FlowEvent, 0)
-	assert.Eventually(t, func() bool {
-		select {
-		case event := <-server.events:
-			serverSideEvents = append(serverSideEvents, event)
-			if len(serverSideEvents) == 2 {
-				return true
-			}
-		default:
-			if len(serverSideEvents) == 2 {
-				return true
-			}
-		}
-		return false
-	}, 5*time.Second, 100*time.Millisecond)
-
-	serverSideFlowIds := make([]uuid.UUID, 0, 2)
-	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
-		id, err := uuid.FromBytes(e.FlowFields.FlowId)
-		assert.NoError(t, err)
-		serverSideFlowIds = append(serverSideFlowIds, id)
-		return true
-	})
-	assert.ElementsMatch(t, []uuid.UUID{event1.FlowID, event2.FlowID}, serverSideFlowIds)
-
-	// verify the manager tracks un-acked events
-	unackedEvents := manager.eventsWithoutAcks.GetEvents()
-	assert.Len(t, unackedEvents, 2)
-	flowIds := make([]uuid.UUID, 0)
-	slices.Values(unackedEvents)(func(e *types.Event) bool {
-		flowIds = append(flowIds, e.FlowID)
-		return true
-	})
-	assert.ElementsMatch(t, flowIds, []uuid.UUID{event1.FlowID, event2.FlowID})
-}
-
-// verify handling of retries:
-//   - unacked events are retried
-//   - when acks arrive, events are removed from the un-acked event tracker
-func TestRetryEvents(t *testing.T) {
-	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	t.Cleanup(cancel)
-
-	server := newTestServer(t)
-	manager := createManager(t, server.addr, time.Second) // set low to start retries sooner
-	defer manager.Close()
-
-	assert.Eventually(t, func() bool {
-		select {
-		case <-server.handlerStarted:
-			return true
-		default:
-			return false
-		}
-	}, 3*time.Second, 100*time.Millisecond)
-
-	event1 := types.EventFields{
-		FlowID:    uuid.New(),
-		Type:      types.TypeStart,
-		Direction: types.Ingress,
-		DestIP:    ipAddr("172.16.1.2"),
-		DestPort:  2345,
-		Protocol:  6,
-	}
-	manager.logger.StoreEvent(event1)
-	event2 := types.EventFields{
-		FlowID:    uuid.New(),
-		Type:      types.TypeStart,
-		Direction: types.Ingress,
-		DestIP:    ipAddr("172.16.1.1"),
-		DestPort:  1234,
-		Protocol:  6,
-	}
-	manager.logger.StoreEvent(event2)
-
-	// verify the server received retries of logged events
-	serverSideEvents := make([]*proto.FlowEvent, 0)
-	func() {
-		c := time.After(2500 * time.Millisecond)
-		for {
-			select {
-			case event := <-server.events:
-				serverSideEvents = append(serverSideEvents, event)
-			case <-c:
-				return
-			}
-		}
-	}()
-	assert.True(t, len(serverSideEvents) > 2) // must see retries
-
-	uniqueServerSideEvents := make(map[uuid.UUID]*proto.FlowEvent)
-	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
-		id, err := uuid.FromBytes(e.FlowFields.FlowId)
-		assert.NoError(t, err)
-		uniqueServerSideEvents[id] = e
-		return true
-	})
-	assert.Contains(t, uniqueServerSideEvents, event1.FlowID)
-	assert.Contains(t, uniqueServerSideEvents, event2.FlowID)
-
-	// ack events
-	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event1.FlowID].EventId}
-	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event2.FlowID].EventId}
-
-	assert.EventuallyWithT(t, func(c *assert.CollectT) {
-		unackedEvents := manager.eventsWithoutAcks.GetEvents()
-		assert.Empty(c, unackedEvents)
-
-	}, 3*time.Second, 100*time.Millisecond)
-}
-
-func createManager(t *testing.T, serverAddr string, retryInterval time.Duration) *Manager {
-	t.Helper()
-
-	mockIFace := &mockIFaceMapper{
-		address: wgaddr.Address{
-			Network: netip.MustParsePrefix("192.168.1.1/32"),
-		},
-		isUserspaceBind: true,
-	}
-
-	publicKey := []byte("test-public-key")
-	manager := NewManager(mockIFace, publicKey, nil)
-	manager.retryInterval = retryInterval
-
-	initialConfig := &types.FlowConfig{
-		Enabled:        true,
-		URL:            fmt.Sprintf("http://%s", serverAddr),
-		TokenPayload:   "initial-payload",
-		TokenSignature: "initial-signature",
-		Interval:       500 * time.Millisecond,
-	}
-
-	err := manager.Update(initialConfig)
-	require.NoError(t, err)
-
-	return manager
-}
-
-func ipAddr(a string) netip.Addr {
-	addr, _ := netip.ParseAddr(a)
-	return addr
-}

client/internal/netflow/store/event_aggregation_test.go

@@ -1,365 +0,0 @@
-package store
-
-import (
-	"math/rand"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/netbirdio/netbird/client/internal/netflow/types"
-	"github.com/stretchr/testify/assert"
-)
-
-var random = rand.New(rand.NewSource(time.Now().UnixNano()))
-
-func TestFlowAggregation(t *testing.T) {
-	var protocols = []types.Protocol{types.ICMP, types.ICMPv6, types.TCP, types.UDP}
-	var tests = []struct {
-		description string
-		addresses   [][]netip.Addr
-		dstPort     uint16
-		eventTypes  []types.Type
-	}{
-		{
-			description: "start and stop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
-		},
-		{
-			description: "start and drop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
-		},
-		{
-			description: "start only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart},
-		},
-		{
-			description: "drop only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeDrop},
-		}}
-
-	for _, protocol := range protocols {
-		for _, tt := range tests {
-			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
-				store := NewAggregatingMemoryStore()
-				store.WindowEnd = time.Now().Add(5 * time.Second)
-
-				allExpected := make([]*types.Event, 0)
-
-				for _, srcAndDst := range tt.addresses {
-					inEvents, expected := generateEvents(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, protocol, types.Ingress, 0, store.WindowStart, store.WindowEnd)
-					for _, e := range inEvents {
-						store.StoreEvent(e)
-					}
-					allExpected = append(allExpected, expected)
-				}
-
-				events := store.GetAggregatedEvents()
-				assert.ElementsMatch(t, events, allExpected)
-			})
-		}
-	}
-}
-
-func TestIcmpEventAggregation(t *testing.T) {
-	var protocols = []types.Protocol{types.ICMP, types.ICMPv6}
-	var icmpTypes = []uint8{1, 2, 3}
-
-	var tests = []struct {
-		description string
-		addresses   [][]netip.Addr
-		eventTypes  []types.Type
-	}{
-		{
-			description: "start and stop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
-			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
-		},
-		{
-			description: "start and drop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
-			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
-		},
-		{
-			description: "start only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
-			eventTypes:  []types.Type{types.TypeStart},
-		},
-		{
-			description: "drop only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
-			eventTypes:  []types.Type{types.TypeDrop},
-		}}
-
-	for _, protocol := range protocols {
-		for _, tt := range tests {
-			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
-				store := NewAggregatingMemoryStore()
-				store.WindowEnd = time.Now().Add(5 * time.Second)
-
-				allExpected := make([]*types.Event, 0)
-				for _, icmpType := range icmpTypes {
-					events, expected := generateEvents(tt.addresses[0][0], tt.addresses[0][1], 0, tt.eventTypes, protocol, types.Ingress, icmpType, store.WindowStart, store.WindowEnd)
-					for _, e := range events {
-						store.StoreEvent(e)
-					}
-					allExpected = append(allExpected, expected)
-				}
-				aggregatedEvents := store.GetAggregatedEvents()
-				assert.Len(t, aggregatedEvents, len(allExpected))
-				assert.ElementsMatch(t, aggregatedEvents, allExpected)
-			})
-		}
-	}
-}
-
-func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
-	var tests = []struct {
-		description string
-		addresses   [][]netip.Addr
-		dstPort     uint16
-		eventTypes  []types.Type
-	}{
-		{
-			description: "start and stop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
-		},
-		{
-			description: "start and drop",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
-		},
-		{
-			description: "start only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeStart},
-		},
-		{
-			description: "drop only",
-			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
-			dstPort:     uint16(random.Uint32() >> 16),
-			eventTypes:  []types.Type{types.TypeDrop},
-		}}
-
-	for _, tt := range tests {
-		t.Run(tt.description+" "+types.ProtocolUnknown.String(), func(t *testing.T) {
-			store := NewAggregatingMemoryStore()
-			store.WindowEnd = time.Now().Add(5 * time.Second)
-
-			allExpected := make([]*types.Event, 0)
-
-			for _, srcAndDst := range tt.addresses {
-				inEvents, expected := generateEventsForUnknownProtocol(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, types.ProtocolUnknown, types.Ingress, store.WindowStart, store.WindowEnd)
-				for _, e := range inEvents {
-					store.StoreEvent(e)
-				}
-				allExpected = append(allExpected, expected...)
-			}
-
-			events := store.GetAggregatedEvents()
-			assert.ElementsMatch(t, events, allExpected)
-		})
-	}
-}
-
-func TestResetAggregationWindow(t *testing.T) {
-	now := time.Now()
-	nowFunc := func() time.Time { return now }
-	store := NewAggregatingMemoryStoreWithTimeFunc(nowFunc)
-	store.StoreEvent(&types.Event{
-		ID:        uuid.New(),
-		Timestamp: time.Now(),
-		EventFields: types.EventFields{
-			FlowID:           uuid.New(),
-			Type:             types.TypeStart,
-			Protocol:         types.TCP,
-			RuleID:           []byte("rule-id-1"),
-			Direction:        types.Ingress,
-			SourceIP:         netip.MustParseAddr("1.1.1.1"),
-			SourcePort:       1234,
-			DestIP:           netip.MustParseAddr("2.2.2.2"),
-			DestPort:         5678,
-			SourceResourceID: []byte("source-resource-id"),
-			DestResourceID:   []byte("dest-resource-id"),
-			RxPackets:        random.Uint64(),
-			TxPackets:        random.Uint64(),
-			RxBytes:          random.Uint64(),
-			TxBytes:          random.Uint64(),
-		},
-	})
-
-	now = now.Add(1 * time.Second)
-	reset := store.ResetAggregationWindow()
-	previousEvents, ok := reset.(*AggregatingMemory)
-	assert.True(t, ok)
-	assert.NotEqual(t, previousEvents.WindowStart, store.WindowStart)
-	assert.Equal(t, previousEvents.WindowEnd, store.WindowStart)
-	assert.NotEmpty(t, previousEvents.events)
-	assert.Empty(t, store.events)
-}
-
-func generateEvents(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
-	direction types.Direction, icmpType uint8, windowStart, windowEnd time.Time) ([]*types.Event, *types.Event) {
-	var rxPackets, txPackets, rxBytes, txBytes uint64
-	inEvents := make([]*types.Event, 0)
-	ts := time.Now()
-	flowId := uuid.New()
-	srcPort := uint16(random.Uint32() >> 16)
-
-	for idx, eventType := range eventTypes {
-		e := &types.Event{
-			ID:        uuid.New(),
-			Timestamp: ts.Add(time.Duration(idx) * time.Second),
-			EventFields: types.EventFields{
-				FlowID:           flowId,
-				Type:             eventType,
-				Protocol:         protocol,
-				RuleID:           []byte("rule-id-1"),
-				Direction:        direction,
-				SourceIP:         srcIp,
-				SourcePort:       srcPort,
-				DestIP:           dstIp,
-				DestPort:         dstPort,
-				SourceResourceID: []byte("source-resource-id"),
-				DestResourceID:   []byte("dest-resource-id"),
-				RxPackets:        random.Uint64(),
-				TxPackets:        random.Uint64(),
-				RxBytes:          random.Uint64(),
-				TxBytes:          random.Uint64(),
-			}}
-		rxBytes += e.RxBytes
-		txBytes += e.TxBytes
-		rxPackets += e.RxPackets
-		txPackets += e.TxPackets
-		inEvents = append(inEvents, e)
-		if protocol == types.ICMP || protocol == types.ICMPv6 {
-			e.ICMPType = icmpType
-		}
-	}
-
-	var start, end, drop uint64
-	for _, eventType := range eventTypes {
-		switch eventType {
-		case types.TypeStart:
-			start += 1
-		case types.TypeDrop:
-			drop += 1
-		case types.TypeEnd:
-			end += 1
-		}
-	}
-	aggregatedEvent := &types.Event{
-		ID:          inEvents[0].ID,
-		Timestamp:   inEvents[0].Timestamp,
-		WindowStart: windowStart,
-		WindowEnd:   windowEnd,
-		EventFields: types.EventFields{
-			FlowID:           flowId,
-			Type:             types.TypeUnknown,
-			Protocol:         inEvents[0].Protocol,
-			RuleID:           []byte("rule-id-1"),
-			Direction:        inEvents[0].Direction,
-			SourceIP:         srcIp,
-			SourcePort:       srcPort,
-			DestIP:           dstIp,
-			DestPort:         dstPort,
-			SourceResourceID: []byte("source-resource-id"),
-			DestResourceID:   []byte("dest-resource-id"),
-			RxPackets:        rxPackets,
-			TxPackets:        txPackets,
-			RxBytes:          rxBytes,
-			TxBytes:          txBytes,
-			NumOfStarts:      start,
-			NumOfEnds:        end,
-			NumOfDrops:       drop,
-		}}
-	if protocol == types.ICMP || protocol == types.ICMPv6 {
-		aggregatedEvent.ICMPType = icmpType
-	}
-
-	return inEvents, aggregatedEvent
-}
-
-func generateEventsForUnknownProtocol(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
-	direction types.Direction, windowStart, windowEnd time.Time) ([]*types.Event, []*types.Event) {
-	inEvents := make([]*types.Event, 0)
-	expectedEvents := make([]*types.Event, 0)
-
-	ts := time.Now()
-	flowId := uuid.New()
-	srcPort := uint16(random.Uint32() >> 16)
-
-	for idx, eventType := range eventTypes {
-		e := &types.Event{
-			ID:        uuid.New(),
-			Timestamp: ts.Add(time.Duration(idx) * time.Second),
-			EventFields: types.EventFields{
-				FlowID:           flowId,
-				Type:             eventType,
-				Protocol:         protocol,
-				RuleID:           []byte("rule-id-1"),
-				Direction:        direction,
-				SourceIP:         srcIp,
-				SourcePort:       srcPort,
-				DestIP:           dstIp,
-				DestPort:         dstPort,
-				SourceResourceID: []byte("source-resource-id"),
-				DestResourceID:   []byte("dest-resource-id"),
-				RxPackets:        random.Uint64(),
-				TxPackets:        random.Uint64(),
-				RxBytes:          random.Uint64(),
-				TxBytes:          random.Uint64(),
-			}}
-		inEvents = append(inEvents, e)
-
-		var start, end, drop uint64
-		switch eventType {
-		case types.TypeStart:
-			start = 1
-		case types.TypeDrop:
-			drop = 1
-		case types.TypeEnd:
-			end = 1
-		}
-
-		expectedEvents = append(expectedEvents, &types.Event{
-			ID:          e.ID,
-			Timestamp:   e.Timestamp,
-			WindowStart: windowStart,
-			WindowEnd:   windowEnd,
-			EventFields: types.EventFields{
-				FlowID:           flowId,
-				Type:             types.TypeUnknown,
-				Protocol:         e.Protocol,
-				RuleID:           []byte("rule-id-1"),
-				Direction:        e.Direction,
-				SourceIP:         srcIp,
-				SourcePort:       srcPort,
-				DestIP:           dstIp,
-				DestPort:         dstPort,
-				SourceResourceID: []byte("source-resource-id"),
-				DestResourceID:   []byte("dest-resource-id"),
-				RxPackets:        e.RxPackets,
-				TxPackets:        e.TxPackets,
-				RxBytes:          e.RxBytes,
-				TxBytes:          e.TxBytes,
-				NumOfStarts:      start,
-				NumOfEnds:        end,
-				NumOfDrops:       drop,
-			}})
-	}
-
-	return inEvents, expectedEvents
-}

client/internal/netflow/store/memory.go

@@ -1,15 +1,10 @@
 package store
 
 import (
-	"maps"
-	"math/rand"
-	v2 "math/rand/v2"
-	"net/netip"
-	"slices"
 	"sync"
-	"time"
 
 	"github.com/google/uuid"
+
 	"github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -24,14 +19,6 @@ type Memory struct {
 	events map[uuid.UUID]*types.Event
 }
 
-type AggregatingMemory struct {
-	Memory
-	WindowStart time.Time
-	WindowEnd   time.Time
-	rnd         *v2.PCG
-	nowFunc     func() time.Time
-}
-
 func (m *Memory) StoreEvent(event *types.Event) {
 	m.mux.Lock()
 	defer m.mux.Unlock()
@@ -61,104 +48,3 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 		delete(m.events, id)
 	}
 }
-
-func NewAggregatingMemoryStore() *AggregatingMemory {
-	return NewAggregatingMemoryStoreWithTimeFunc(defaultNowFunc)
-}
-
-// used in tests when deterministic (less random) time intervals are required
-func NewAggregatingMemoryStoreWithTimeFunc(nowFunc func() time.Time) *AggregatingMemory {
-	return &AggregatingMemory{WindowStart: nowFunc(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, nowFunc: nowFunc, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
-}
-
-func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
-	am.mux.Lock()
-	defer am.mux.Unlock()
-
-	now := am.nowFunc()
-	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
-
-	am.events = make(map[uuid.UUID]*types.Event)
-	am.WindowStart = now
-
-	return &toret
-}
-
-type aggregationKey struct {
-	srcAddr   netip.Addr
-	destAddr  netip.Addr
-	destPort  uint16
-	direction int
-	protocol  uint8
-	icmpType  uint8
-	unique    uint64 // used to prevent aggregation on non icmp/udp/tcp events
-}
-
-func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
-	am.mux.Lock()
-	defer am.mux.Unlock()
-
-	aggregated := make(map[aggregationKey]*types.Event)
-	for _, v := range am.events {
-		lookupKey := aggregationKey{srcAddr: v.SourceIP, destAddr: v.DestIP, destPort: v.DestPort, direction: int(v.Direction), protocol: uint8(v.Protocol), icmpType: v.ICMPType}
-		if _, ok := aggregated[lookupKey]; !ok {
-			event := v.Clone()
-
-			switch event.Type {
-			case types.TypeStart:
-				event.NumOfStarts += 1
-			case types.TypeDrop:
-				event.NumOfDrops += 1
-			case types.TypeEnd:
-				event.NumOfEnds += 1
-			}
-			event.Type = types.TypeUnknown
-
-			// Please note that ICMPCode field isn't propagated by the manager (see flow/proto/flow.pb.go, FlowFields struct)
-			// so the field value in an icmp event in the "aggregated" doesn't matter
-
-			event.WindowStart = am.WindowStart
-			event.WindowEnd = am.WindowEnd
-
-			if event.Protocol != types.ICMP && event.Protocol != types.ICMPv6 && event.Protocol != types.UDP && event.Protocol != types.TCP {
-				lookupKey.unique = am.rnd.Uint64() // to make the lookup key unique so we don't aggregate on it
-			}
-
-			aggregated[lookupKey] = event
-			continue
-		}
-
-		aggregatedEvent := aggregated[lookupKey]
-		if aggregatedEvent.Protocol != types.ICMP && aggregatedEvent.Protocol != types.ICMPv6 && aggregatedEvent.Protocol != types.UDP && aggregatedEvent.Protocol != types.TCP {
-			continue // we don't aggregate this type of events; shouldn't ever get here
-		}
-
-		// track the number of connections, duration?, open and close events?
-		aggregatedEvent.RxBytes += v.RxBytes
-		aggregatedEvent.RxPackets += v.RxPackets
-		aggregatedEvent.TxBytes += v.TxBytes
-		aggregatedEvent.TxPackets += v.TxPackets
-		switch v.Type {
-		case types.TypeStart:
-			aggregatedEvent.NumOfStarts += 1
-		case types.TypeDrop:
-			aggregatedEvent.NumOfDrops += 1
-		case types.TypeEnd:
-			aggregatedEvent.NumOfEnds += 1
-		}
-		if aggregatedEvent.Timestamp.Compare(v.Timestamp) > 0 {
-			aggregatedEvent.Timestamp = v.Timestamp
-			aggregatedEvent.ID = v.ID
-			aggregatedEvent.SourcePort = v.SourcePort
-		}
-		if len(aggregatedEvent.RuleID) == 0 && len(v.RuleID) != 0 {
-			aggregatedEvent.RuleID = slices.Clone(v.RuleID)
-		}
-	}
-
-	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
-}
-
-func defaultNowFunc() time.Time {
-	return time.Now()
-}

client/internal/netflow/types/types.go

@@ -2,7 +2,6 @@ package types
 
 import (
 	"net/netip"
-	"slices"
 	"strconv"
 	"time"
 
@@ -70,10 +69,8 @@ const (
 )
 
 type Event struct {
-	ID          uuid.UUID
-	Timestamp   time.Time
-	WindowStart time.Time
-	WindowEnd   time.Time
+	ID        uuid.UUID
+	Timestamp time.Time
 	EventFields
 }
 
@@ -95,17 +92,6 @@ type EventFields struct {
 	TxPackets        uint64
 	RxBytes          uint64
 	TxBytes          uint64
-	NumOfStarts      uint64
-	NumOfEnds        uint64
-	NumOfDrops       uint64
-}
-
-func (e *Event) Clone() *Event {
-	toret := *e
-	toret.RuleID = slices.Clone(e.RuleID)
-	toret.SourceResourceID = slices.Clone(e.SourceResourceID)
-	toret.DestResourceID = slices.Clone(e.DestResourceID)
-	return &toret
 }
 
 type FlowConfig struct {
@@ -128,15 +114,13 @@ type FlowManager interface {
 	GetLogger() FlowLogger
 }
 
-type FlowEventAggregator interface {
-	ResetAggregationWindow() FlowEventAggregator
-	GetAggregatedEvents() []*Event
-}
-
 type FlowLogger interface {
-	ResetAggregationWindow() FlowEventAggregator
 	// StoreEvent stores a flow event
 	StoreEvent(flowEvent EventFields)
+	// GetEvents returns all stored events
+	GetEvents() []*Event
+	// DeleteEvents deletes events from the store
+	DeleteEvents([]uuid.UUID)
 	// Close closes the logger
 	Close()
 	// Enable enables the flow logger receiver
@@ -156,11 +140,6 @@ type Store interface {
 	Close()
 }
 
-type AggregatingStore interface {
-	FlowEventAggregator
-	Store
-}
-
 // ConnTracker defines the interface for connection tracking functionality
 type ConnTracker interface {
 	// Start begins tracking connections by listening for conntrack events.

client/internal/peer/conn.go

@@ -30,11 +30,6 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
-// wgTimeoutEscalationThreshold is the number of consecutive WireGuard
-// handshake timeouts after which the rosenpass state for the peer is
-// considered desynced and gets reset.
-const wgTimeoutEscalationThreshold = 3
-
 // MetricsRecorder is an interface for recording peer connection metrics
 type MetricsRecorder interface {
 	RecordConnectionStages(
@@ -123,9 +118,6 @@ type Conn struct {
 	wgWatcher       *WGWatcher
 	wgWatcherWg     sync.WaitGroup
 	wgWatcherCancel context.CancelFunc
-	// wgTimeouts counts consecutive WireGuard handshake timeouts without a
-	// successful handshake in between. Guarded by mu.
-	wgTimeouts int
 
 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
@@ -203,6 +195,7 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		statusICE:          worker.NewAtomicStatus(),
 		dumpState:          dumpState,
 		endpointUpdater:    NewEndpointUpdater(connLog, config.WgConfig, isController(config)),
+		wgWatcher:          NewWGWatcher(connLog, config.WgConfig.WgInterface, config.Key, dumpState),
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
@@ -670,12 +663,11 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
-func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
+func (conn *Conn) onWGDisconnected() {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
-	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
-	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
+	if conn.ctx.Err() != nil {
 		return
 	}
 
@@ -691,29 +683,6 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	default:
 		conn.Log.Debugf("No active connection to close on WG timeout")
 	}
-
-	conn.escalateWGTimeoutLocked()
-}
-
-// escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
-// handshake timeouts. With rosenpass enabled, persistent timeouts mean the
-// preshared keys have desynced; the renewal exchange runs over the dead
-// tunnel and cannot resync them. Reporting the peer disconnected drops its
-// rosenpass state, so the next connection configuration programs the
-// rendezvous key and the tunnel can bootstrap again. Callers must hold mu.
-func (conn *Conn) escalateWGTimeoutLocked() {
-	if conn.config.RosenpassConfig.PubKey == nil {
-		return
-	}
-
-	conn.wgTimeouts++
-	if conn.wgTimeouts < wgTimeoutEscalationThreshold || conn.onDisconnected == nil {
-		return
-	}
-	conn.wgTimeouts = 0
-
-	conn.Log.Warnf("%d consecutive WireGuard handshake timeouts, resetting rosenpass state for peer", wgTimeoutEscalationThreshold)
-	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
@@ -833,39 +802,25 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	})
 }
 
-// enableWgWatcherIfNeeded starts a fresh watcher instance per connection attempt, so its
-// lifecycle stays bound to conn.mu and enable/disable can't race an old goroutine's shutdown.
-// Caller must hold conn.mu.
 func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
-	if conn.wgWatcher != nil {
+	if !conn.wgWatcher.PrepareInitialHandshake() {
 		return
 	}
 
-	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
-	watcher.PrepareInitialHandshake()
-
 	wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
-	conn.wgWatcher = watcher
 	conn.wgWatcherCancel = wgWatcherCancel
-
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		onDisconnected := func() { conn.onWGDisconnected(wgWatcherCtx) }
-		watcher.EnableWgWatcher(wgWatcherCtx, enabledTime, onDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
+		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
 	}()
 }
 
-// disableWgWatcherIfNeeded cancels and drops the watcher once no transport is active. It never
-// waits for the goroutine: the timeout path reentrantly calls back here under conn.mu, so
-// blocking would deadlock. Caller must hold conn.mu.
 func (conn *Conn) disableWgWatcherIfNeeded() {
-	if conn.currentConnPriority != conntype.None || conn.wgWatcher == nil {
-		return
+	if conn.currentConnPriority == conntype.None && conn.wgWatcherCancel != nil {
+		conn.wgWatcherCancel()
+		conn.wgWatcherCancel = nil
 	}
-	conn.wgWatcherCancel()
-	conn.wgWatcher = nil
-	conn.wgWatcherCancel = nil
 }
 
 func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
@@ -888,9 +843,7 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
-	if conn.wgWatcher != nil {
-		conn.wgWatcher.Reset()
-	}
+	conn.wgWatcher.Reset()
 	if err := conn.endpointUpdater.RemoveEndpointAddress(); err != nil {
 		conn.Log.Warnf("failed to remove endpoint address before update: %v", err)
 	}
@@ -939,15 +892,6 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 	conn.recordConnectionMetrics()
 }
 
-// onWGCheckSuccess is called for every watcher check that observed a fresh
-// handshake, including handshakes of connections that were already up when
-// the watcher started.
-func (conn *Conn) onWGCheckSuccess() {
-	conn.mu.Lock()
-	conn.wgTimeouts = 0
-	conn.mu.Unlock()
-}
-
 // recordConnectionMetrics records connection stage timestamps as metrics
 func (conn *Conn) recordConnectionMetrics() {
 	if conn.metricsRecorder == nil {

client/internal/peer/conn_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -305,84 +304,3 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
-
-func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
-	cfg := ConnConfig{
-		Key:      "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		LocalKey: "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		WgConfig: WgConfig{RemoteKey: "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU="},
-	}
-	if rosenpassEnabled {
-		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
-	}
-
-	conn := &Conn{
-		ctx:           context.Background(),
-		config:        cfg,
-		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &MetricsStages{},
-	}
-	conn.SetOnDisconnected(func(remotePeer string) {
-		*disconnected = append(*disconnected, remotePeer)
-	})
-	return conn
-}
-
-// TestConn_onWGDisconnected_EscalatesToRosenpassReset: repeated handshake
-// timeouts with rosenpass enabled mean the preshared keys have desynced. The
-// renewal exchange runs over the dead tunnel and cannot resync them, so after
-// wgTimeoutEscalationThreshold consecutive timeouts the conn must report the
-// peer disconnected, dropping its rosenpass state so the next configuration
-// programs the rendezvous key.
-func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
-	}
-	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
-
-	conn.onWGDisconnected(conn.ctx)
-	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
-		"reaching the threshold must report the peer disconnected once")
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
-	}
-	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
-
-	conn.onWGDisconnected(conn.ctx)
-	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
-}
-
-// TestConn_onWGDisconnected_CheckSuccessResetsEscalation: a successful
-// handshake between timeouts means the tunnel recovered; the counter must
-// start over.
-func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
-	}
-	conn.onWGCheckSuccess()
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
-	}
-	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
-}
-
-// TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
-// there is no per-peer key state to reset; repeated timeouts must not report
-// disconnects.
-func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(false, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.onWGDisconnected(conn.ctx)
-	}
-	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
-}

client/internal/peer/guard/guard.go

@@ -85,11 +85,7 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	defer g.srWatcher.RemoveListener(srReconnectedChan)
 
 	ticker := g.initialTicker(ctx)
-	defer func() {
-		// If backoff.Ticker.send is blocked, context.Done will not close the Ticker goroutine.
-		// We have to explicitly call Stop, even if we use backoff.WithContext.
-		ticker.Stop()
-	}()
+	defer ticker.Stop()
 
 	tickerChannel := ticker.C
 

client/internal/peer/guard/guard_leak_test.go

@@ -1,92 +0,0 @@
-package guard
-
-import (
-	"context"
-	"runtime"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/ice"
-)
-
-func newTestGuard(status connStatusFunc) *Guard {
-	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw)
-}
-
-// countBackoffTickerGoroutines returns how many goroutines are currently sitting
-// in backoff/v4.(*Ticker).run (a ticker goroutine that has not exited).
-func countBackoffTickerGoroutines() int {
-	buf := make([]byte, 1<<25) // 32MB
-	n := runtime.Stack(buf, true)
-	return strings.Count(string(buf[:n]), "backoff/v4.(*Ticker).run")
-}
-
-// TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown reproduces a observed
-// leak: after a shutdown burst, ticker run/send goroutines stay parked
-// forever even though every reconnect loop has exited.
-func TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown(t *testing.T) {
-	before := countBackoffTickerGoroutines()
-
-	const peers = 6000
-	cancels := make([]context.CancelFunc, 0, peers)
-	var wg sync.WaitGroup
-
-	// A status check slower than the tick cadence. This models the real
-	// isConnectedOnAllWay/callback doing work: while the loop is busy in the
-	// handler, the ticker fires the next tick and parks in send(), because
-	// send() never selects on ctx.
-	slowStatus := func() ConnStatus {
-		time.Sleep(70 * time.Millisecond)
-		return ConnStatusConnected
-	}
-
-	for range peers {
-		g := newTestGuard(slowStatus)
-		ctx, cancel := context.WithCancel(context.Background())
-		cancels = append(cancels, cancel)
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			g.Start(ctx, func() {})
-		}()
-		// Force the live ticker to be a newReconnectTicker.
-		g.SetRelayedConnDisconnected()
-	}
-
-	// Let the replacement tickers get past their 800ms initial interval, so
-	// many are parked in send() waiting on the (slow) consumer when we tear
-	// everything down.
-	time.Sleep(1500 * time.Millisecond)
-
-	// Shutdown burst: cancel every peer at once, like engine teardown.
-	for _, c := range cancels {
-		c()
-	}
-
-	// Every reconnect loop must return
-	waitCh := make(chan struct{})
-	go func() { wg.Wait(); close(waitCh) }()
-	select {
-	case <-waitCh:
-	case <-time.After(30 * time.Second):
-		t.Fatal("not all reconnect loops returned after ctx cancel")
-	}
-
-	// Give any correctly-stopped ticker goroutines time to unwind.
-	for range 50 {
-		runtime.Gosched()
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	leaked := countBackoffTickerGoroutines() - before
-	t.Logf("backoff Ticker.run goroutines still parked after teardown of %d peers: %d", peers, leaked)
-	if leaked > 0 {
-		t.Errorf("LEAK: %d backoff ticker goroutines parked after all reconnect loops exited "+
-			"(defer ticker.Stop() stops the initial ticker, not the live replacement)", leaked)
-	}
-}

client/internal/peer/wg_watcher.go

@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -23,14 +24,14 @@ type WGInterfaceStater interface {
 	GetStats() (map[string]configurer.WGStats, error)
 }
 
-// WGWatcher is single-shot: one instance per connection attempt, run once, then discarded.
-// Lifecycle is owned by Conn under conn.mu, so it keeps no "enabled" state to go stale.
 type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
 	stateDump     *stateDump
 
+	enabled   bool
+	muEnabled sync.Mutex
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
 
@@ -47,23 +48,36 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }
 
-// PrepareInitialHandshake reads the peer's current WireGuard handshake time. It must be
-// called before the peer is (re)configured on the WireGuard interface, so the captured
-// baseline reflects the state prior to this connection attempt instead of racing with
-// that configuration.
-func (w *WGWatcher) PrepareInitialHandshake() {
+// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
+// handshake time. It must be called before the peer is (re)configured on the WireGuard
+// interface, so the captured baseline reflects the state prior to this connection attempt
+// instead of racing with that configuration. Returns ok=false if the watcher is already
+// running, in which case EnableWgWatcher must not be called.
+func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
+	w.muEnabled.Lock()
+	if w.enabled {
+		w.muEnabled.Unlock()
+		return false
+	}
+
 	w.log.Debugf("enable WireGuard watcher")
+	w.enabled = true
+	w.muEnabled.Unlock()
+
 	handshake, _ := w.wgState()
 	w.initialHandshake = handshake
+	return true
 }
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
 // PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
-// for context lifecycle management. onHandshakeSuccessFn is called only for the first
-// handshake observed by this run, onCheckSuccessFn for every check that observed a fresh
-// handshake, including the first.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
+// for context lifecycle management.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
+
+	w.muEnabled.Lock()
+	w.enabled = false
+	w.muEnabled.Unlock()
 }
 
 // Reset signals the watcher that the WireGuard peer has been reset and a new
@@ -76,7 +90,7 @@ func (w *WGWatcher) Reset() {
 }
 
 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func(), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), enabledTime time.Time, initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")
 
 	timer := time.NewTimer(wgHandshakeOvertime)
@@ -89,7 +103,6 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
-				// early ctx cancel check return
 				if ctx.Err() != nil {
 					return
 				}
@@ -104,10 +117,6 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				}
 			}
 
-			if onCheckSuccessFn != nil && ctx.Err() == nil {
-				onCheckSuccessFn()
-			}
-
 			lastHandshake = *handshake
 
 			resetTime := time.Until(handshake.Add(checkPeriod))
@@ -138,9 +147,9 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {
 
 	w.log.Tracef("previous handshake, handshake: %v, %v", lastHandshake, handshake)
 
-	// the current known handshake did not change
+	// the current know handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake not updated: %v", handshake)
+		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
 		return nil, false
 	}
 

client/internal/peer/wg_watcher_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 )
@@ -23,72 +24,6 @@ func (m *MocWgIface) disconnect() {
 	m.stop = true
 }
 
-type mockHandshakeStats struct {
-	mu        sync.Mutex
-	handshake time.Time
-}
-
-func (m *mockHandshakeStats) GetStats() (map[string]configurer.WGStats, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return map[string]configurer.WGStats{"": {LastHandshake: m.handshake}}, nil
-}
-
-func (m *mockHandshakeStats) advance() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.handshake = time.Now()
-}
-
-// TestWGWatcher_CheckSuccessCallback: onCheckSuccessFn must fire for a fresh
-// handshake even when the watcher started with an existing handshake baseline,
-// the case where onHandshakeSuccessFn stays silent.
-func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
-	// checkPeriod bounds how stale a handshake may be before the watcher treats it
-	// as a suspended-machine timeout. The first check fires after wgHandshakeOvertime,
-	// so keep checkPeriod well above any scheduling jitter to avoid a false timeout
-	// converting the expected success into a disconnect on a loaded runner.
-	checkPeriod = 1 * time.Minute
-	wgHandshakeOvertime = 1 * time.Second
-
-	mlog := log.WithField("peer", "tet")
-	// Use an old baseline so advance() yields a strictly newer handshake even on
-	// platforms with coarse clock resolution (Windows), where two time.Now() calls
-	// microseconds apart can return the same instant and read as a timed-out handshake.
-	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	watcher.PrepareInitialHandshake()
-
-	firstHandshake := make(chan struct{}, 1)
-	checkSuccess := make(chan struct{}, 1)
-	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-		firstHandshake <- struct{}{}
-	}, func() {
-		select {
-		case checkSuccess <- struct{}{}:
-		default:
-		}
-	})
-
-	stats.advance()
-
-	select {
-	case <-checkSuccess:
-	case <-time.After(10 * time.Second):
-		t.Errorf("timeout waiting for check success callback")
-	}
-
-	select {
-	case <-firstHandshake:
-		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
-	default:
-	}
-}
-
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	checkPeriod = 5 * time.Second
 	wgHandshakeOvertime = 1 * time.Second
@@ -100,7 +35,8 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	watcher.PrepareInitialHandshake()
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
@@ -108,7 +44,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 		onDisconnected <- struct{}{}
 	}, func(when time.Time) {
 		mlog.Infof("onHandshakeSuccess: %v", when)
-	}, nil)
+	})
 
 	// wait for initial reading
 	time.Sleep(2 * time.Second)
@@ -130,13 +66,14 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
-	watcher.PrepareInitialHandshake()
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
 
 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {}, nil)
+		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {})
 	}()
 	cancel()
 
@@ -146,12 +83,13 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
-	watcher.PrepareInitialHandshake()
+	ok = watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}
-	}, func(when time.Time) {}, nil)
+	}, func(when time.Time) {})
 
 	time.Sleep(2 * time.Second)
 	mocWgIface.disconnect()

client/internal/profilemanager/config.go

@@ -101,6 +101,8 @@ type ConfigInput struct {
 
 	DNSLabels domain.List
 
+	LazyConnectionEnabled *bool
+
 	MTU *uint16
 }
 
@@ -178,9 +180,7 @@ type Config struct {
 
 	ClientCertKeyPair *tls.Certificate `json:"-"`
 
-	// LazyConnection is the MDM-managed lazy-connection override ("on"/"off"/"").
-	// Runtime-only: re-derived from MDM policy on each load, never persisted.
-	LazyConnection string `json:"-"`
+	LazyConnectionEnabled bool
 
 	MTU uint16
 
@@ -632,6 +632,12 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
+	if input.LazyConnectionEnabled != nil && *input.LazyConnectionEnabled != config.LazyConnectionEnabled {
+		log.Infof("switching lazy connection to %t", *input.LazyConnectionEnabled)
+		config.LazyConnectionEnabled = *input.LazyConnectionEnabled
+		updated = true
+	}
+
 	if input.MTU != nil && *input.MTU != config.MTU {
 		log.Infof("updating MTU to %d (old value %d)", *input.MTU, config.MTU)
 		config.MTU = *input.MTU
@@ -722,15 +728,6 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 			log.Warnf("MDM wireguard port %d out of range [1,65535]; keeping previous value", v)
 		}
 	}
-
-	if v, ok := policy.GetBool(mdm.KeyLazyConnection); ok {
-		state := "off"
-		if v {
-			state = "on"
-		}
-		config.LazyConnection = state
-		logApplied(mdm.KeyLazyConnection, state)
-	}
 }
 
 // parseURL parses and validates the URL for the named service. The URL

client/internal/profilemanager/config_mdm_test.go

@@ -130,37 +130,6 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyRosenpassEnabled))
 }
 
-func TestApply_MDMLazyConnection(t *testing.T) {
-	cases := []struct {
-		name string
-		raw  any
-		want string
-	}{
-		{"native true", true, "on"},
-		{"native false", false, "off"},
-		{"string on", "on", "on"},
-		{"string off", "off", "off"},
-		{"string yes", "yes", "on"},
-		{"string no", "no", "off"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-				mdm.KeyLazyConnection: c.raw,
-			}))
-
-			cfg, err := UpdateOrCreateConfig(ConfigInput{
-				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-			})
-			require.NoError(t, err)
-			require.NotNil(t, cfg)
-
-			assert.Equal(t, c.want, cfg.LazyConnection)
-			assert.True(t, cfg.Policy().HasKey(mdm.KeyLazyConnection))
-		})
-	}
-}
-
 func TestApply_MDMPreSharedKeyRedactionSentinelRejected(t *testing.T) {
 	const maskSentinel = "**********"
 

client/internal/profilemanager/service.go

@@ -11,7 +11,6 @@ import (
 	"runtime"
 	"sort"
 	"strings"
-	"syscall"
 
 	log "github.com/sirupsen/logrus"
 
@@ -440,11 +439,7 @@ func (s *ServiceManager) GetStatePath() string {
 
 	activeProf, err := s.GetActiveProfileState()
 	if err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("active profile state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to get active profile state: %v", err)
-		}
+		log.Warnf("failed to get active profile state: %v", err)
 		return defaultStatePath
 	}
 

client/internal/rosenpass/manager.go

@@ -39,7 +39,6 @@ type rpServer interface {
 
 type Manager struct {
 	ifaceName    string
-	localWgKey   wgtypes.Key
 	spk          []byte
 	ssk          []byte
 	rpKeyHash    string
@@ -52,9 +51,8 @@ type Manager struct {
 	wgIface      PresharedKeySetter
 }
 
-// NewManager creates a new Rosenpass manager. localWgKey is the local
-// WireGuard public key, used to derive the per-peer rendezvous key.
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
+// NewManager creates a new Rosenpass manager
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error) {
 	public, secret, err := rp.GenerateKeyPair()
 	if err != nil {
 		return nil, err
@@ -64,7 +62,6 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 	log.Tracef("generated new rosenpass key pair with public key %s", rpKeyHash)
 	return &Manager{
 		ifaceName:    wgIfaceName,
-		localWgKey:   localWgKey,
 		rpKeyHash:    rpKeyHash,
 		spk:          public,
 		ssk:          secret,
@@ -76,7 +73,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
+		rpWgHandler: NewNetbirdHandler(),
 		lock:        sync.Mutex{},
 	}, nil
 }
@@ -164,7 +161,7 @@ func (m *Manager) generateConfig() (rp.Config, error) {
 	cfg.Peers = []rp.PeerConfig{}
 
 	m.lock.Lock()
-	m.rpWgHandler = NewNetbirdHandler(m.preSharedKey, m.localWgKey)
+	m.rpWgHandler = NewNetbirdHandler()
 	if m.wgIface != nil {
 		m.rpWgHandler.SetInterface(m.wgIface)
 	}

client/internal/rosenpass/manager_test.go

@@ -85,7 +85,7 @@ func newTestManager(spkFirstByte byte, mock *mockServer) *Manager {
 		ssk:         make([]byte, 32),
 		rpKeyHash:   "test-hash",
 		rpPeerIDs:   make(map[string]*rp.PeerID),
-		rpWgHandler: NewNetbirdHandler(nil, wgtypes.Key{0x01}),
+		rpWgHandler: NewNetbirdHandler(),
 		server:      mock,
 	}
 }
@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
+	m, err := NewManager(&psk, "wt0")
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }
@@ -329,10 +329,10 @@ func TestIsPresharedKeyInitialized_AddedButNotHandshaken_ReturnsFalse(t *testing
 	require.False(t, m.IsPresharedKeyInitialized(wgKey))
 }
 
-// --- NetbirdHandler.applyKey ----------------------------------------------
+// --- NetbirdHandler.outputKey ----------------------------------------------
 
-func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -348,8 +348,8 @@ func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
 	require.Equal(t, wgKey.String(), iface.calls[0].peerKey)
 }
 
-func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -364,8 +364,8 @@ func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
 	require.True(t, iface.calls[1].updateOnly, "subsequent rotations must use updateOnly=true")
 }
 
-func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	// no SetInterface — iface remains nil
 	pid := rp.PeerID{0x03}
 	h.AddPeer(pid, "wt0", rp.Key(wgtypes.Key{}))
@@ -374,8 +374,8 @@ func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
 	h.HandshakeCompleted(pid, rp.Key{})
 }
 
-func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -384,7 +384,7 @@ func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
 }
 
 func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -398,7 +398,7 @@ func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
 }
 
 func TestHandler_SetInterfaceAfterAddPeer_StillReceivesKey(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	pid := rp.PeerID{0x05}
 	wgKey := wgtypes.Key{0xEE}
 	h.AddPeer(pid, "wt0", rp.Key(wgKey))

client/internal/rosenpass/netbird_handler.go

@@ -18,34 +18,19 @@ type PresharedKeySetter interface {
 type wireGuardPeer struct {
 	Interface string
 	PublicKey rp.Key
-	// initialized is true once a completed exchange has set a
-	// Rosenpass-managed PSK for this peer.
-	initialized bool
-	// chainKey is the key output by the last completed exchange, advanced by
-	// one ratchet step on expiry. Nil until the first exchange completes and
-	// after the peer has fallen back to the rendezvous key.
-	chainKey *wgtypes.Key
-	// expiries counts failed renewals since the last completed exchange.
-	expiries int
 }
 
 type NetbirdHandler struct {
-	mu    sync.Mutex
-	iface PresharedKeySetter
-	// preSharedKey is the account-level preshared key, used as the rendezvous
-	// key when set. Nil means the deterministic seed key is used instead.
-	preSharedKey *[32]byte
-	// localWgKey is the local WireGuard public key, one of the two inputs to
-	// the deterministic seed key.
-	localWgKey wgtypes.Key
-	peers      map[rp.PeerID]*wireGuardPeer
+	mu               sync.Mutex
+	iface            PresharedKeySetter
+	peers            map[rp.PeerID]wireGuardPeer
+	initializedPeers map[rp.PeerID]bool
 }
 
-func NewNetbirdHandler(preSharedKey *[32]byte, localWgKey wgtypes.Key) *NetbirdHandler {
+func NewNetbirdHandler() *NetbirdHandler {
 	return &NetbirdHandler{
-		preSharedKey: preSharedKey,
-		localWgKey:   localWgKey,
-		peers:        map[rp.PeerID]*wireGuardPeer{},
+		peers:            map[rp.PeerID]wireGuardPeer{},
+		initializedPeers: map[rp.PeerID]bool{},
 	}
 }
 
@@ -57,16 +42,10 @@ func (h *NetbirdHandler) SetInterface(iface PresharedKeySetter) {
 	h.iface = iface
 }
 
-// AddPeer registers a peer with the handler. Re-adding a known peer (every
-// reconnection does) keeps its key recovery state.
 func (h *NetbirdHandler) AddPeer(pid rp.PeerID, intf string, pk rp.Key) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if existing, ok := h.peers[pid]; ok && existing.PublicKey == pk {
-		existing.Interface = intf
-		return
-	}
-	h.peers[pid] = &wireGuardPeer{
+	h.peers[pid] = wireGuardPeer{
 		Interface: intf,
 		PublicKey: pk,
 	}
@@ -76,6 +55,7 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	delete(h.peers, pid)
+	delete(h.initializedPeers, pid)
 }
 
 // IsPeerInitialized returns true if Rosenpass has completed a handshake
@@ -83,120 +63,50 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 func (h *NetbirdHandler) IsPeerInitialized(pid rp.PeerID) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	peer, ok := h.peers[pid]
-	return ok && peer.initialized
+	return h.initializedPeers[pid]
 }
 
-// HandshakeCompleted programs the freshly exchanged output key and resets the
-// peer's key recovery state.
 func (h *NetbirdHandler) HandshakeCompleted(pid rp.PeerID, key rp.Key) {
-	psk := wgtypes.Key(key)
-
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-	if peer.expiries > 0 {
-		log.Infof("rosenpass exchange completed for peer %s after %d expired renewals", wgtypes.Key(peer.PublicKey), peer.expiries)
-	}
-	// chainKey tracks the shared exchange output regardless of the local write
-	// outcome, so both ends still converge on the next expiry.
-	peer.chainKey = &psk
-	peer.expiries = 0
-	if !h.applyKeyLocked(pid, psk, peer.initialized) {
-		return
-	}
-	peer.initialized = true
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
 }
 
-// HandshakeExpired replaces the expired key. The renewal exchange runs over
-// the tunnel keyed by the PSK itself, so the replacement must be derivable on
-// both ends without communication: the first expiry ratchets the last shared
-// key forward, repeated expiries (and expiries without a completed exchange)
-// fall back to the rendezvous key and drop the peer out of the initialized
-// state so connection reconfigurations reprogram the rendezvous key as well.
 func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
+	key, _ := rp.GeneratePresharedKey()
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
+}
+
+func (h *NetbirdHandler) outputKey(_ rp.KeyOutputReason, pid rp.PeerID, psk rp.Key) {
 	h.mu.Lock()
-	defer h.mu.Unlock()
+	iface := h.iface
+	wg, ok := h.peers[pid]
+	isInitialized := h.initializedPeers[pid]
+	h.mu.Unlock()
 
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-
-	peer.expiries++
-
-	var psk wgtypes.Key
-	if peer.chainKey != nil && peer.expiries == 1 {
-		log.Infof("rosenpass key for peer %s expired without renewal, advancing to ratcheted key", wgtypes.Key(peer.PublicKey))
-		psk = RatchetKey(*peer.chainKey)
-		peer.chainKey = &psk
-	} else {
-		rendezvous, err := h.rendezvousKey(peer)
-		if err != nil {
-			// Fail closed: without a rendezvous key the expired key must
-			// still be rotated out, even if the replacement is unusable.
-			log.Errorf("failed to derive rendezvous key, replacing expired key with a random one: %v", err)
-			h.applyRandomKeyLocked(pid)
-			return
-		}
-		log.Warnf("rosenpass key for peer %s expired %d times without renewal, falling back to the rendezvous key", wgtypes.Key(peer.PublicKey), peer.expiries)
-		psk = rendezvous
-		peer.chainKey = nil
-		peer.initialized = false
-	}
-
-	h.applyKeyLocked(pid, psk, true)
-}
-
-// rendezvousKey returns the key both ends converge on without communication:
-// the account-level preshared key when configured, the deterministic seed key
-// otherwise. It mirrors the key that peer connections program when Rosenpass
-// does not manage the peer yet.
-func (h *NetbirdHandler) rendezvousKey(peer *wireGuardPeer) (wgtypes.Key, error) {
-	if h.preSharedKey != nil {
-		return *h.preSharedKey, nil
-	}
-
-	seed, err := DeterministicSeedKey(h.localWgKey.String(), wgtypes.Key(peer.PublicKey).String())
-	if err != nil {
-		return wgtypes.Key{}, err
-	}
-	return *seed, nil
-}
-
-// applyKeyLocked writes the preshared key for the peer to the WireGuard
-// interface and reports whether the write succeeded. Callers must hold h.mu
-// for the whole state-mutation-plus-write so that a concurrent completion and
-// expiry cannot reorder their writes relative to the in-memory chain key.
-func (h *NetbirdHandler) applyKeyLocked(pid rp.PeerID, psk wgtypes.Key, updateOnly bool) bool {
-	peer, ok := h.peers[pid]
-	if !ok {
-		return false
-	}
-
-	if h.iface == nil {
+	if iface == nil {
 		log.Warn("rosenpass: interface not set, cannot update preshared key")
-		return false
-	}
-
-	peerKey := wgtypes.Key(peer.PublicKey).String()
-	if err := h.iface.SetPresharedKey(peerKey, psk, updateOnly); err != nil {
-		log.Errorf("Failed to apply rosenpass key: %v", err)
-		return false
-	}
-
-	return true
-}
-
-func (h *NetbirdHandler) applyRandomKeyLocked(pid rp.PeerID) {
-	key, err := rp.GeneratePresharedKey()
-	if err != nil {
-		log.Errorf("failed to generate random preshared key: %v", err)
 		return
 	}
-	h.applyKeyLocked(pid, wgtypes.Key(key), true)
+
+	if !ok {
+		return
+	}
+
+	peerKey := wgtypes.Key(wg.PublicKey).String()
+	pskKey := wgtypes.Key(psk)
+
+	// Use updateOnly=true for later rotations (peer already has Rosenpass PSK)
+	// Use updateOnly=false for first rotation (peer has original/empty PSK)
+	if err := iface.SetPresharedKey(peerKey, pskKey, isInitialized); err != nil {
+		log.Errorf("Failed to apply rosenpass key: %v", err)
+		return
+	}
+
+	// Mark peer as isInitialized after the successful first rotation
+	if !isInitialized {
+		h.mu.Lock()
+		if _, exists := h.peers[pid]; exists {
+			h.initializedPeers[pid] = true
+		}
+		h.mu.Unlock()
+	}
 }

client/internal/rosenpass/netbird_handler_test.go

@@ -1,250 +0,0 @@
-package rosenpass
-
-import (
-	"testing"
-
-	rp "cunicu.li/go-rosenpass"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// handlerTestLink wires two NetbirdHandlers as the two ends of a single
-// tunnel: handler A manages the rosenpass peer B and vice versa, the way two
-// NetBird clients see each other.
-type handlerTestLink struct {
-	handlerA, handlerB *NetbirdHandler
-	ifaceA, ifaceB     *mockIface
-	pidA, pidB         rp.PeerID
-	wgKeyA, wgKeyB     wgtypes.Key
-}
-
-func newHandlerTestLink(t *testing.T, preSharedKey *[32]byte) *handlerTestLink {
-	t.Helper()
-
-	link := &handlerTestLink{
-		ifaceA: &mockIface{},
-		ifaceB: &mockIface{},
-	}
-	link.pidA[0] = 0xaa
-	link.pidB[0] = 0xbb
-	link.wgKeyA[31] = 1
-	link.wgKeyB[31] = 2
-
-	link.handlerA = NewNetbirdHandler(preSharedKey, link.wgKeyA)
-	link.handlerB = NewNetbirdHandler(preSharedKey, link.wgKeyB)
-
-	link.handlerA.SetInterface(link.ifaceA)
-	link.handlerB.SetInterface(link.ifaceB)
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	link.handlerB.AddPeer(link.pidA, "wt0", rp.Key(link.wgKeyA))
-
-	return link
-}
-
-// complete simulates a completed rosenpass exchange: both ends derive the
-// same output key.
-func (l *handlerTestLink) complete(osk rp.Key) {
-	l.handlerA.HandshakeCompleted(l.pidB, osk)
-	l.handlerB.HandshakeCompleted(l.pidA, osk)
-}
-
-// expire simulates a failed key renewal on both ends.
-func (l *handlerTestLink) expire() {
-	l.handlerA.HandshakeExpired(l.pidB)
-	l.handlerB.HandshakeExpired(l.pidA)
-}
-
-func lastPSK(t *testing.T, m *mockIface) wgtypes.Key {
-	t.Helper()
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	require.NotEmpty(t, m.calls, "expected at least one SetPresharedKey call")
-	return m.calls[len(m.calls)-1].psk
-}
-
-func TestHandshakeCompleted_SetsKeyAndInitializes(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	require.Equal(t, wgtypes.Key(osk), lastPSK(t, link.ifaceA), "completed exchange must program the osk")
-	require.False(t, link.ifaceA.calls[0].updateOnly, "first rotation must not be update-only")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized after first completed exchange")
-
-	link.complete(osk)
-	require.True(t, link.ifaceA.calls[1].updateOnly, "later rotations must be update-only")
-}
-
-// TestHandshakeExpired_BothSidesConverge encodes the core recovery invariant:
-// rosenpass renewals run over the tunnel that the PSK itself keys, so when a
-// renewal fails on both ends, both ends must fall back to the same key or the
-// tunnel can never handshake again.
-func TestHandshakeExpired_BothSidesConverge(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	keyA := lastPSK(t, link.ifaceA)
-	keyB := lastPSK(t, link.ifaceB)
-	require.NotEqual(t, wgtypes.Key(osk), keyA, "expired key must be rotated out")
-	require.Equal(t, keyA, keyB, "both ends must converge on the same key after expiry")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must still converge after repeated expiries")
-}
-
-// TestHandshakeExpired_ExpiryWithoutCompletionConverges covers the bootstrap
-// case: the initial exchange never completed (the tunnel ran on the rendezvous
-// key), so an expiry must not replace the working key with an unrecoverable
-// one on either end.
-func TestHandshakeExpired_ExpiryWithoutCompletionConverges(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must converge when the exchange never completed")
-}
-
-// TestHandshakeExpired_RepeatedExpiryClearsInitialized: once renewals keep
-// failing, the peer must drop out of the initialized state so the next
-// connection reconfiguration reprograms the rendezvous key instead of
-// preserving a poisoned rosenpass-managed key.
-func TestHandshakeExpired_RepeatedExpiryClearsInitialized(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.False(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"repeated expiries must clear the initialized state")
-	require.False(t, link.handlerB.IsPeerInitialized(link.pidA),
-		"repeated expiries must clear the initialized state")
-}
-
-// TestHandshakeCompleted_AfterExpiryRecovers: a completed exchange after a
-// desync must fully reset the recovery state.
-func TestHandshakeCompleted_AfterExpiryRecovers(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk1, osk2 rp.Key
-	osk1[0] = 1
-	osk2[0] = 2
-
-	link.complete(osk1)
-	link.expire()
-	link.expire()
-
-	link.complete(osk2)
-	require.Equal(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "new exchange must program the fresh osk")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized again after recovery")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"recovered link must converge again on the next expiry")
-	require.NotEqual(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "expired key must be rotated out")
-}
-
-// TestHandshakeExpired_FirstExpiryRatchetsLastKey: the first expiry must
-// derive the replacement from the last shared key, so an attacker who only
-// blocks the renewal exchange gains nothing over the previous key.
-func TestHandshakeExpired_FirstExpiryRatchetsLastKey(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	require.Equal(t, RatchetKey(wgtypes.Key(osk)), lastPSK(t, link.ifaceA),
-		"first expiry must program the ratcheted key")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"ratchet step must keep the peer initialized so reconfigurations preserve the key")
-}
-
-// TestHandshakeExpired_RepeatedExpiryFallsBackToSeed: once the ratchet key
-// also fails, both ends must land on the same key that peer connections
-// program for uninitialized peers, so a reconnect completes the recovery.
-func TestHandshakeExpired_RepeatedExpiryFallsBackToSeed(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA), "repeated expiry must fall back to the seed key")
-	require.Equal(t, *seed, lastPSK(t, link.ifaceB), "repeated expiry must fall back to the seed key")
-}
-
-// TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous: with an account-level
-// preshared key configured, the fallback must be that key, matching what peer
-// connections program for uninitialized peers.
-func TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous(t *testing.T) {
-	psk := &[32]byte{0x77}
-	link := newHandlerTestLink(t, psk)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceA),
-		"fallback must be the configured preshared key")
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceB),
-		"fallback must be the configured preshared key on both ends")
-}
-
-// TestHandshakeExpired_ExpiryWritesAreUpdateOnly: expiry replacements must
-// never create a WireGuard peer that connection management has removed.
-func TestHandshakeExpired_ExpiryWritesAreUpdateOnly(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	for _, call := range link.ifaceA.calls[1:] {
-		require.True(t, call.updateOnly, "expiry writes must be update-only")
-	}
-}
-
-// TestAddPeer_ReAddKeepsRecoveryState: reconnections re-add the peer on every
-// OnConnected; that must not reset the expiry chain state.
-func TestAddPeer_ReAddKeepsRecoveryState(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-	link.expire()
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"re-adding a known peer must keep its state")
-
-	link.expire()
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA),
-		"second expiry after re-add must continue to the seed fallback")
-}

client/internal/rosenpass/seed.go

@@ -1,28 +1,11 @@
 package rosenpass
 
 import (
-	"crypto/sha256"
 	"fmt"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// ratchetLabel domain-separates the expiry ratchet from other uses of the
-// rosenpass output key.
-const ratchetLabel = "netbird-rosenpass-expiry-ratchet"
-
-// RatchetKey derives the successor preshared key from the previous Rosenpass
-// output key. When a key expires without a completed renewal, both peers
-// advance their last shared key by one ratchet step: the expired key is
-// rotated out while both ends still converge on an identical, non-public
-// replacement without communicating.
-func RatchetKey(prev wgtypes.Key) wgtypes.Key {
-	input := make([]byte, 0, len(ratchetLabel)+len(prev))
-	input = append(input, ratchetLabel...)
-	input = append(input, prev[:]...)
-	return sha256.Sum256(input)
-}
-
 // DeterministicSeedKey derives a 32-byte WireGuard preshared key from a pair
 // of peer public keys. Both peers, given the same key pair, produce the same
 // output regardless of which side runs the function: the inputs are ordered

client/internal/routemanager/dynamic/route.go

@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }
 
 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains(ctx)
+	resolved, err := r.resolveDomains()
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }
 
-func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
+func (r *Route) resolveDomains() (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(ctx, results)
+	go r.resolve(results)
 
 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
+func (r *Route) resolve(results chan resolveResult) {
 	var wg sync.WaitGroup
 
 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()
 
-			ips, err := r.getIPsFromResolver(ctx, domain)
+			ips, err := r.getIPsFromResolver(domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = lookupHostIPs(ctx, domain)
+				ips, err = net.LookupIP(domain.PunycodeString())
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,20 +364,6 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }
 
-// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
-func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
-	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
-	if err != nil {
-		return nil, err
-	}
-
-	ips := make([]net.IP, 0, len(addrs))
-	for _, addr := range addrs {
-		ips = append(ips, addr.IP)
-	}
-	return ips, nil
-}
-
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {

client/internal/routemanager/dynamic/route_generic.go

@@ -3,12 +3,11 @@
 package dynamic
 
 import (
-	"context"
 	"net"
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
-	return lookupHostIPs(ctx, domain)
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+	return net.LookupIP(domain.PunycodeString())
 }

client/internal/routemanager/dynamic/route_ios.go

@@ -3,7 +3,6 @@
 package dynamic
 
 import (
-	"context"
 	"fmt"
 	"net"
 	"time"
@@ -17,7 +16,7 @@ import (
 
 const dialTimeout = 10 * time.Second
 
-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -33,7 +32,7 @@ func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)
 
-		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)

client/internal/routemanager/manager.go

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 
 	"github.com/google/uuid"
@@ -265,11 +264,7 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
 
 	// restore selector state if it exists
 	if err := m.stateManager.LoadState(state); err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("route selector state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to load state: %v", err)
-		}
+		log.Warnf("failed to load state: %v", err)
 		return routeselector.NewRouteSelector()
 	}
 

client/internal/statemanager/manager.go

@@ -1,7 +1,6 @@
 package statemanager
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -306,11 +305,6 @@ func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage,
 
 	var rawStates map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawStates); err != nil {
-		if len(bytes.TrimSpace(data)) == 0 {
-			log.Warnf("state file %s is empty (%d bytes)", m.filePath, len(data))
-		} else {
-			log.Warnf("state file %s has malformed content (%d bytes)", m.filePath, len(data))
-		}
 		m.handleCorruptedState(deleteCorrupt)
 		return nil, fmt.Errorf("unmarshal states: %w", err)
 	}

client/ios/NetBirdSDK/client.go

@@ -233,9 +233,6 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/ios/NetBirdSDK/env_list.go

@@ -38,7 +38,7 @@ func GetEnvKeyNBForceRelay() string {
 
 // GetEnvKeyNBLazyConn Exports the environment variable for the iOS client
 func GetEnvKeyNBLazyConn() string {
-	return lazyconn.EnvLazyConn
+	return lazyconn.EnvEnableLazyConn
 }
 
 // GetEnvKeyNBInactivityThreshold Exports the environment variable for the iOS client

client/ios/NetBirdSDK/login.go

@@ -44,25 +44,10 @@ type Auth struct {
 // NewAuth instantiate Auth struct and validate the management URL
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	// Load the existing config when a config file is already present so an
-	// interactive re-login reuses the peer's persisted WireGuard private key
-	// (and thus its identity) instead of generating a fresh one. Generating a
-	// new key registers a brand-new peer on the management server on every
-	// re-auth (named after the fallback hostname). Only fall back to a fresh
-	// in-memory config for the first-time login when no config file exists yet.
-	// DirectUpdateOrCreateConfig uses non-atomic writes so it also works inside
-	// the tvOS App Group sandbox where atomic temp-file+rename is blocked.
-	var cfg *profilemanager.Config
-	var err error
-	if cfgPath != "" {
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(inputCfg)
-	} else {
-		cfg, err = profilemanager.CreateInMemoryConfig(inputCfg)
-	}
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}

client/mdm/canonical_loaders.go

@@ -22,14 +22,12 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
-	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,
 	KeyWireguardPort,
 	KeySplitTunnelMode,
 	KeySplitTunnelApps,
-	KeyLazyConnection,
 }
 
 // canonicalKey maps the lowercase form of a managed-config value name to

client/mdm/policy.go

@@ -11,7 +11,6 @@ package mdm
 import (
 	"sort"
 	"strconv"
-	"strings"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -20,10 +19,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL         = "managementURL"
-	KeyDisableUpdateSettings = "disableUpdateSettings"
-	KeyDisableProfiles       = "disableProfiles"
-	KeyDisableNetworks       = "disableNetworks"
+	KeyManagementURL            = "managementURL"
+	KeyDisableUpdateSettings    = "disableUpdateSettings"
+	KeyDisableProfiles          = "disableProfiles"
+	KeyDisableNetworks          = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,16 +36,10 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	// KeyDisableAutostart suppresses the GUI's fresh-install
-	// launch-on-login default and marks the Settings toggle as
-	// MDM-managed. UI-only: NOT stored on Config and not applied by
-	// applyMDMPolicy; the GUI reads it directly and it appears in
-	// GetConfigResponse.mDMManagedFields when set.
-	KeyDisableAutostart    = "disableAutostart"
-	KeyPreSharedKey        = "preSharedKey"
-	KeyRosenpassEnabled    = "rosenpassEnabled"
-	KeyRosenpassPermissive = "rosenpassPermissive"
-	KeyWireguardPort       = "wireguardPort"
+	KeyPreSharedKey             = "preSharedKey"
+	KeyRosenpassEnabled         = "rosenpassEnabled"
+	KeyRosenpassPermissive      = "rosenpassPermissive"
+	KeyWireguardPort            = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator
@@ -55,11 +48,6 @@ const (
 	// construction — only one mode can be set at a time.
 	KeySplitTunnelMode = "splitTunnelMode"
 	KeySplitTunnelApps = "splitTunnelApps"
-
-	// KeyLazyConnection forces the lazy-connection feature on or off, overriding
-	// the management feature flag. Read as a bool (native bool, or on/off,
-	// true/false, 1/0, yes/no); absent = defer to management.
-	KeyLazyConnection = "lazyConnection"
 )
 
 // Split-tunnel mode literals (KeySplitTunnelMode values).
@@ -81,13 +69,12 @@ var boolStringLiterals = map[string]bool{
 	"true":  true,
 	"1":     true,
 	"yes":   true,
-	"on":    true,
 	"false": false,
 	"0":     false,
 	"no":    false,
-	"off":   false,
 }
 
+
 // Policy holds MDM-managed settings read from the platform source. A nil or
 // empty Policy means no enforcement is active.
 type Policy struct {
@@ -170,8 +157,7 @@ func (p *Policy) GetString(key string) (string, bool) {
 }
 
 // GetBool returns the managed value for key coerced to bool, and whether the
-// key was set. Accepts native bool and string literals (true/false, 1/0,
-// yes/no, on/off), case-insensitively and trimmed of surrounding whitespace.
+// key was set. Accepts native bool and string literals "true"/"false"/"1"/"0".
 func (p *Policy) GetBool(key string) (bool, bool) {
 	if p == nil {
 		return false, false
@@ -184,7 +170,7 @@ func (p *Policy) GetBool(key string) (bool, bool) {
 	case bool:
 		return t, true
 	case string:
-		b, known := boolStringLiterals[strings.ToLower(strings.TrimSpace(t))]
+		b, known := boolStringLiterals[t]
 		return b, known
 	case int:
 		return t != 0, true

client/mdm/policy_test.go

@@ -31,8 +31,8 @@ func TestPolicy_Empty(t *testing.T) {
 
 func TestPolicy_HasKey(t *testing.T) {
 	p := NewPolicy(map[string]any{
-		KeyManagementURL:   "https://corp.example.com",
-		KeyDisableProfiles: true,
+		KeyManagementURL:    "https://corp.example.com",
+		KeyDisableProfiles:  true,
 	})
 	assert.False(t, p.IsEmpty())
 	assert.True(t, p.HasKey(KeyManagementURL))
@@ -53,8 +53,8 @@ func TestPolicy_ManagedKeysSorted(t *testing.T) {
 func TestPolicy_GetString(t *testing.T) {
 	p := NewPolicy(map[string]any{
 		KeyManagementURL:   "https://corp.example.com",
-		KeyDisableProfiles: true, // wrong type for GetString
-		KeyPreSharedKey:    "",   // empty rejected
+		KeyDisableProfiles: true,            // wrong type for GetString
+		KeyPreSharedKey:        "",              // empty rejected
 	})
 	v, ok := p.GetString(KeyManagementURL)
 	assert.True(t, ok)
@@ -85,11 +85,6 @@ func TestPolicy_GetBool(t *testing.T) {
 		{"string 0", "0", false, true},
 		{"string yes", "yes", true, true},
 		{"string no", "no", false, true},
-		{"string on", "on", true, true},
-		{"string off", "off", false, true},
-		{"mixed case On", "On", true, true},
-		{"upper TRUE", "TRUE", true, true},
-		{"padded yes", "  yes  ", true, true},
 		{"int nonzero", 1, true, true},
 		{"int zero", 0, false, true},
 		{"int64 nonzero", int64(2), true, true},

client/proto/daemon_gateway_test.go

@@ -1,80 +0,0 @@
-package proto
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	gatewayruntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/test/bufconn"
-)
-
-func TestGatewayServerRoutesCoverDaemonRPCs(t *testing.T) {
-	mux := gatewayruntime.NewServeMux()
-	if err := RegisterDaemonServiceHandlerServer(context.Background(), mux, UnimplementedDaemonServiceServer{}); err != nil {
-		t.Fatalf("register daemon gateway server handlers: %v", err)
-	}
-
-	assertAllDaemonGatewayRoutesRegistered(t, mux)
-}
-
-func TestGatewayClientRoutesCoverDaemonRPCs(t *testing.T) {
-	listener := bufconn.Listen(1024 * 1024)
-	server := grpc.NewServer()
-	RegisterDaemonServiceServer(server, UnimplementedDaemonServiceServer{})
-	go func() {
-		if err := server.Serve(listener); err != nil && err != grpc.ErrServerStopped {
-			t.Errorf("serve bufconn gRPC server: %v", err)
-		}
-	}()
-	t.Cleanup(func() {
-		server.Stop()
-		_ = listener.Close()
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	mux := gatewayruntime.NewServeMux()
-	opts := []grpc.DialOption{
-		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
-			return listener.Dial()
-		}),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-	}
-	if err := RegisterDaemonServiceHandlerFromEndpoint(ctx, mux, "passthrough:///bufnet", opts); err != nil {
-		t.Fatalf("register daemon gateway client handlers: %v", err)
-	}
-
-	assertAllDaemonGatewayRoutesRegistered(t, mux)
-}
-
-func assertAllDaemonGatewayRoutesRegistered(t *testing.T, mux http.Handler) {
-	t.Helper()
-	for _, method := range DaemonService_ServiceDesc.Methods {
-		assertGatewayRouteRegistered(t, mux, method.MethodName)
-	}
-	for _, stream := range DaemonService_ServiceDesc.Streams {
-		assertGatewayRouteRegistered(t, mux, stream.StreamName)
-	}
-}
-
-func assertGatewayRouteRegistered(t *testing.T, mux http.Handler, methodName string) {
-	t.Helper()
-
-	path := "/daemon.DaemonService/" + methodName
-	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader("{}"))
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	mux.ServeHTTP(res, req)
-
-	if res.Code == http.StatusNotFound {
-		t.Fatalf("gateway route for %s is not registered", methodName)
-	}
-}

client/proto/generate.sh

@@ -12,11 +12,5 @@ script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
 go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6
 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.1
-go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.26.3
-protoc -I ./ ./daemon.proto \
-  --go_out=../ \
-  --go-grpc_out=../ \
-  --grpc-gateway_out=../ \
-  --grpc-gateway_opt=generate_unbound_methods=true \
-  --experimental_allow_proto3_optional
+protoc -I ./ ./daemon.proto --go_out=../ --go-grpc_out=../ --experimental_allow_proto3_optional
 cd "$old_pwd"

client/server/mdm.go

@@ -3,7 +3,6 @@ package server
 import (
 	"context"
 	"fmt"
-	"net/url"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -156,6 +155,7 @@ func (s *Server) restartEngineForMDMLocked() error {
 	s.config = config
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
+	s.statusRecorder.UpdateLazyConnection(config.LazyConnectionEnabled)
 
 	ctx, cancel := context.WithCancel(s.rootCtx)
 	s.actCancel = cancel
@@ -185,37 +185,6 @@ func conflictBool(key string, p *bool) conflictCheck {
 	}
 }
 
-func canonicalURL(s string) string {
-	u, err := url.ParseRequestURI(s)
-	if err != nil {
-		return s
-	}
-	if u.Port() == "" {
-		switch u.Scheme {
-		case "https":
-			u.Host += ":443"
-		case "http":
-			u.Host += ":80"
-		}
-	}
-	return u.String()
-}
-
-// conflictURL is conflictString for URL-typed keys: both sides are
-// normalized via canonicalURL before comparison.
-func conflictURL(key, got string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if got == "" {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && canonicalURL(want) == canonicalURL(got)
-		},
-	}
-}
-
 // conflictString builds a conflictCheck for a string MDM key. An empty
 // `got` is treated as "field not set" (no override requested); otherwise
 // the check returns true only when the policy contains the key and its
@@ -291,7 +260,7 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
@@ -339,6 +308,7 @@ func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
 		msg.DisableFirewall != nil ||
 		msg.BlockLanAccess != nil ||
 		msg.DisableNotifications != nil ||
+		msg.LazyConnectionEnabled != nil ||
 		msg.BlockInbound != nil ||
 		msg.DisableIpv6 != nil ||
 		msg.EnableSSHRoot != nil ||
@@ -381,6 +351,7 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
 		msg.BlockLanAccess != nil ||
 		msg.DisableNotifications != nil ||
 		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
+		msg.LazyConnectionEnabled != nil ||
 		msg.BlockInbound != nil
 }
 
@@ -412,7 +383,7 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),

client/server/server.go

@@ -181,7 +181,7 @@ func (s *Server) Start() error {
 		log.Warnf("failed to redirect stderr: %v", err)
 	}
 
-	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -238,6 +238,7 @@ func (s *Server) Start() error {
 
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
+	s.statusRecorder.UpdateLazyConnection(config.LazyConnectionEnabled)
 
 	if s.sessionWatcher == nil {
 		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
@@ -421,6 +422,16 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, fmt.Errorf("failed to update profile config: %w", err)
 	}
 
+	// Apply the lazy connection toggle to the running engine so it takes
+	// effect without a down/up. s.mutex is already held.
+	if msg.LazyConnectionEnabled != nil && s.connectClient != nil {
+		if engine := s.connectClient.Engine(); engine != nil {
+			if err := engine.SetLazyConnEnabled(msg.GetLazyConnectionEnabled()); err != nil {
+				log.Errorf("failed to apply lazy connection change at runtime: %v", err)
+			}
+		}
+	}
+
 	return &proto.SetConfigResponse{}, nil
 }
 
@@ -499,6 +510,7 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 	config.DisableFirewall = msg.DisableFirewall
 	config.BlockLANAccess = msg.BlockLanAccess
 	config.DisableNotifications = msg.DisableNotifications
+	config.LazyConnectionEnabled = msg.LazyConnectionEnabled
 	config.BlockInbound = msg.BlockInbound
 	config.DisableIPv6 = msg.DisableIpv6
 	config.EnableSSHRoot = msg.EnableSSHRoot
@@ -551,7 +563,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.actCancel = cancel
 	s.mutex.Unlock()
 
-	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -828,7 +840,6 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		return nil, err
 	}
 
-	log.Infof("SSO login flow finished, returning success to caller")
 	return &proto.WaitSSOLoginResponse{
 		Email: tokenInfo.Email,
 	}, nil
@@ -836,7 +847,6 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 
 // Up starts engine work in the daemon.
 func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
-	log.Infof("up request received")
 	s.mutex.Lock()
 	// clientRunning is the daemon-intent flag (set by previous Up/Start, cleared
 	// by Down). connectionGoroutineRunning() reports whether the previous retry-loop
@@ -858,7 +868,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 		return s.waitForUp(callerCtx)
 	}
-	if err := RestoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -1081,10 +1091,7 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 
 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		if errors.Is(err, ErrServiceNotUp) {
-			log.Debugf("Down called while service not up: %v", err)
-			return nil, err
-		}
+		// todo review to update the status in case any type of error
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1157,7 +1164,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			log.Errorf("failed to stop engine during cleanup: %v", err)
+			return err
 		}
 	}
 
@@ -1974,6 +1981,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
+		LazyConnectionEnabled:         cfg.LazyConnectionEnabled,
 		BlockInbound:                  cfg.BlockInbound,
 		DisableNotifications:          disableNotifications,
 		NetworkMonitor:                networkMonitor,

client/server/setconfig_mdm_test.go

@@ -181,43 +181,6 @@ func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	require.NotNil(t, resp)
 }
 
-// TestSetConfig_MDMAllow_ManagementURLPortNormalized covers the
-// regression from discussion #6483: MDM URL without explicit port vs
-// UI echo with the parseURL-appended default port must be treated as
-// a no-op echo, not a conflict.
-func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
-	tests := []struct {
-		name      string
-		mdmURL    string
-		submitURL string
-	}{
-		{"policy_no_port_submit_with_443", "https://netbird.corp.example", "https://netbird.corp.example:443"},
-		{"policy_with_443_submit_no_port", "https://netbird.corp.example:443", "https://netbird.corp.example"},
-		{"http_policy_no_port_submit_with_80", "http://netbird.corp.example", "http://netbird.corp.example:80"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-				mdm.KeyManagementURL: tc.mdmURL,
-			}))
-
-			s, ctx, profName, username, _ := setupServerWithProfile(t)
-
-			rosenpassEnabled := true
-			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
-				ProfileName:      profName,
-				Username:         username,
-				ManagementUrl:    tc.submitURL,
-				RosenpassEnabled: &rosenpassEnabled,
-			})
-
-			require.NoError(t, err, "port-normalized URL echo must not trip MDM conflict gate")
-			require.NotNil(t, resp)
-		})
-	}
-}
-
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
 	withMDMPolicy(t, mdm.NewPolicy(nil))

client/server/setconfig_test.go

@@ -69,41 +69,43 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	disableFirewall := true
 	blockLANAccess := true
 	disableNotifications := true
+	lazyConnectionEnabled := true
 	blockInbound := true
 	disableIPv6 := true
 	mtu := int64(1280)
 	sshJWTCacheTTL := int32(300)
 
 	req := &proto.SetConfigRequest{
-		ProfileName:          profName,
-		Username:             currUser.Username,
-		ManagementUrl:        "https://new-api.netbird.io:443",
-		AdminURL:             "https://new-admin.netbird.io",
-		RosenpassEnabled:     &rosenpassEnabled,
-		RosenpassPermissive:  &rosenpassPermissive,
-		ServerSSHAllowed:     &serverSSHAllowed,
-		InterfaceName:        &interfaceName,
-		WireguardPort:        &wireguardPort,
-		OptionalPreSharedKey: &preSharedKey,
-		DisableAutoConnect:   &disableAutoConnect,
-		NetworkMonitor:       &networkMonitor,
-		DisableClientRoutes:  &disableClientRoutes,
-		DisableServerRoutes:  &disableServerRoutes,
-		DisableDns:           &disableDNS,
-		DisableFirewall:      &disableFirewall,
-		BlockLanAccess:       &blockLANAccess,
-		DisableNotifications: &disableNotifications,
-		BlockInbound:         &blockInbound,
-		DisableIpv6:          &disableIPv6,
-		NatExternalIPs:       []string{"1.2.3.4", "5.6.7.8"},
-		CleanNATExternalIPs:  false,
-		CustomDNSAddress:     []byte("1.1.1.1:53"),
-		ExtraIFaceBlacklist:  []string{"eth1", "eth2"},
-		DnsLabels:            []string{"label1", "label2"},
-		CleanDNSLabels:       false,
-		DnsRouteInterval:     durationpb.New(2 * time.Minute),
-		Mtu:                  &mtu,
-		SshJWTCacheTTL:       &sshJWTCacheTTL,
+		ProfileName:           profName,
+		Username:              currUser.Username,
+		ManagementUrl:         "https://new-api.netbird.io:443",
+		AdminURL:              "https://new-admin.netbird.io",
+		RosenpassEnabled:      &rosenpassEnabled,
+		RosenpassPermissive:   &rosenpassPermissive,
+		ServerSSHAllowed:      &serverSSHAllowed,
+		InterfaceName:         &interfaceName,
+		WireguardPort:         &wireguardPort,
+		OptionalPreSharedKey:  &preSharedKey,
+		DisableAutoConnect:    &disableAutoConnect,
+		NetworkMonitor:        &networkMonitor,
+		DisableClientRoutes:   &disableClientRoutes,
+		DisableServerRoutes:   &disableServerRoutes,
+		DisableDns:            &disableDNS,
+		DisableFirewall:       &disableFirewall,
+		BlockLanAccess:        &blockLANAccess,
+		DisableNotifications:  &disableNotifications,
+		LazyConnectionEnabled: &lazyConnectionEnabled,
+		BlockInbound:          &blockInbound,
+		DisableIpv6:           &disableIPv6,
+		NatExternalIPs:        []string{"1.2.3.4", "5.6.7.8"},
+		CleanNATExternalIPs:   false,
+		CustomDNSAddress:      []byte("1.1.1.1:53"),
+		ExtraIFaceBlacklist:   []string{"eth1", "eth2"},
+		DnsLabels:             []string{"label1", "label2"},
+		CleanDNSLabels:        false,
+		DnsRouteInterval:      durationpb.New(2 * time.Minute),
+		Mtu:                   &mtu,
+		SshJWTCacheTTL:        &sshJWTCacheTTL,
 	}
 
 	_, err = s.SetConfig(ctx, req)
@@ -138,6 +140,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, blockLANAccess, cfg.BlockLANAccess)
 	require.NotNil(t, cfg.DisableNotifications)
 	require.Equal(t, disableNotifications, *cfg.DisableNotifications)
+	require.Equal(t, lazyConnectionEnabled, cfg.LazyConnectionEnabled)
 	require.Equal(t, blockInbound, cfg.BlockInbound)
 	require.Equal(t, disableIPv6, cfg.DisableIPv6)
 	require.Equal(t, []string{"1.2.3.4", "5.6.7.8"}, cfg.NATExternalIPs)
@@ -161,14 +164,13 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 	t.Helper()
 
 	metadataFields := map[string]bool{
-		"state":                 true, // protobuf internal
-		"sizeCache":             true, // protobuf internal
-		"unknownFields":         true, // protobuf internal
-		"Username":              true, // metadata
-		"ProfileName":           true, // metadata
-		"CleanNATExternalIPs":   true, // control flag for clearing
-		"CleanDNSLabels":        true, // control flag for clearing
-		"LazyConnectionEnabled": true, // deprecated: proto field retained for compat, no longer applied
+		"state":               true, // protobuf internal
+		"sizeCache":           true, // protobuf internal
+		"unknownFields":       true, // protobuf internal
+		"Username":            true, // metadata
+		"ProfileName":         true, // metadata
+		"CleanNATExternalIPs": true, // control flag for clearing
+		"CleanDNSLabels":      true, // control flag for clearing
 	}
 
 	expectedFields := map[string]bool{
@@ -188,6 +190,7 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"DisableFirewall":               true,
 		"BlockLanAccess":                true,
 		"DisableNotifications":          true,
+		"LazyConnectionEnabled":         true,
 		"BlockInbound":                  true,
 		"DisableIpv6":                   true,
 		"NatExternalIPs":                true,
@@ -249,6 +252,7 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"block-lan-access":                  "BlockLanAccess",
 		"block-inbound":                     "BlockInbound",
 		"disable-ipv6":                      "DisableIpv6",
+		"enable-lazy-connection":            "LazyConnectionEnabled",
 		"external-ip-map":                   "NatExternalIPs",
 		"dns-resolver-address":              "CustomDNSAddress",
 		"extra-iface-blacklist":             "ExtraIFaceBlacklist",
@@ -265,8 +269,7 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 
 	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).
 	fieldsWithoutCLIFlags := map[string]bool{
-		"DisableNotifications":  true, // Only settable via UI
-		"LazyConnectionEnabled": true, // deprecated: no longer settable (managed by server + NB_LAZY_CONN)
+		"DisableNotifications": true, // Only settable via UI
 	}
 
 	// Get all SetConfigRequest fields to verify our map is complete.

client/server/state.go

@@ -46,7 +46,7 @@ func (s *Server) CleanState(ctx context.Context, req *proto.CleanStateRequest) (
 
 	if req.All {
 		// Reuse existing cleanup logic for all states
-		if err := RestoreResidualState(ctx, statePath); err != nil {
+		if err := restoreResidualState(ctx, statePath); err != nil {
 			return nil, status.Errorf(codes.Internal, "failed to clean all states: %v", err)
 		}
 
@@ -113,9 +113,9 @@ func (s *Server) DeleteState(ctx context.Context, req *proto.DeleteStateRequest)
 	}, nil
 }
 
-// RestoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
+// restoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
 // Otherwise, we might not be able to connect to the management server to retrieve new config.
-func RestoreResidualState(ctx context.Context, statePath string) error {
+func restoreResidualState(ctx context.Context, statePath string) error {
 	if statePath == "" {
 		return nil
 	}

client/ssh/config/manager.go

@@ -14,7 +14,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 const (
@@ -219,20 +218,11 @@ func (m *Manager) buildHostPatterns(peer PeerSSHInfo) []string {
 	if peer.IPv6.IsValid() {
 		hostPatterns = append(hostPatterns, peer.IPv6.String())
 	}
-	// Peer FQDNs and hostnames originate from remote peers, so they must be
-	// validated as plain DNS names before being embedded in the ssh_config
-	// "Match host" pattern list. This prevents injection of arbitrary
-	// ssh_config directives via embedded quotes, whitespace, newlines, the
-	// comma pattern separator, or the "*"/"?" pattern metacharacters.
-	if domain.IsValidDomainNoWildcard(peer.FQDN) {
+	if peer.FQDN != "" {
 		hostPatterns = append(hostPatterns, peer.FQDN)
-	} else if peer.FQDN != "" {
-		log.Warnf("skipping peer FQDN with invalid characters in SSH config: %q", peer.FQDN)
 	}
-	if peer.Hostname != peer.FQDN && domain.IsValidDomainNoWildcard(peer.Hostname) {
+	if peer.Hostname != "" && peer.Hostname != peer.FQDN {
 		hostPatterns = append(hostPatterns, peer.Hostname)
-	} else if peer.Hostname != "" && peer.Hostname != peer.FQDN {
-		log.Warnf("skipping peer hostname with invalid characters in SSH config: %q", peer.Hostname)
 	}
 	return hostPatterns
 }

client/ssh/config/manager_test.go

@@ -148,45 +148,6 @@ func TestManager_MatchHostFormat(t *testing.T) {
 		"should use Match host with comma-separated patterns")
 }
 
-func TestManager_HostPatternInjection(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
-	require.NoError(t, err)
-	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
-
-	manager := &Manager{
-		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
-		sshConfigFile: "99-netbird.conf",
-	}
-
-	// A malicious peer FQDN/hostname attempts to break out of the Match host
-	// directive and inject arbitrary ssh_config (a ProxyCommand executing a
-	// command). It must be rejected, not written to the config.
-	peers := []PeerSSHInfo{
-		{
-			Hostname: "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x",
-			IP:       netip.MustParseAddr("100.125.1.1"),
-			FQDN:     "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x.nb.internal",
-		},
-		{Hostname: "peer2", IP: netip.MustParseAddr("100.125.1.2"), FQDN: "peer2.nb.internal"},
-	}
-
-	err = manager.SetupSSHClientConfig(peers)
-	require.NoError(t, err)
-
-	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
-	content, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	configStr := string(content)
-
-	assert.NotContains(t, configStr, "ProxyCommand touch /tmp/pwned",
-		"injected directive must not appear in generated config")
-	assert.NotContains(t, configStr, "evil",
-		"malicious pattern must be dropped entirely")
-	// The valid peer must still be present, on a single Match host line.
-	assert.Contains(t, configStr, "Match host \"100.125.1.1,100.125.1.2,peer2.nb.internal,peer2\"",
-		"valid peers must survive, injected patterns dropped")
-}
-
 func TestManager_ForcedSSHConfig(t *testing.T) {
 	// Set force environment variable
 	t.Setenv(EnvForceSSHConfig, "true")

client/ssh/server/getent_unix.go

@@ -69,8 +69,7 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
-// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
-// rejected so the input can never be parsed as a command-line flag.
+// (@ for Kerberos, $ for Samba, + for NIS compat).
 func validateGetentInput(input string) bool {
 	maxLen := 32
 	if runtime.GOOS == "linux" {
@@ -81,10 +80,6 @@ func validateGetentInput(input string) bool {
 		return false
 	}
 
-	if input[0] == '-' {
-		return false
-	}
-
 	for _, r := range input {
 		if isAllowedGetentChar(r) {
 			continue

client/ssh/server/getent_unix_test.go

@@ -157,9 +157,6 @@ func TestValidateGetentInput(t *testing.T) {
 		{"numeric UID", "1001", true},
 		{"dots and underscores", "alice.bob_test", true},
 		{"hyphen", "alice-bob", true},
-		{"leading hyphen rejected", "-i", false},
-		{"leading double hyphen rejected", "--no-idn", false},
-		{"lone hyphen rejected", "-", false},
 		{"kerberos principal", "user@REALM", true},
 		{"samba machine account", "MACHINE$", true},
 		{"NIS compat", "+user", true},

client/status/status.go

@@ -746,8 +746,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
-	pbFullStatus.Events = fullStatus.Events
-
 	return &pbFullStatus
 }
 

client/system/info.go

@@ -74,6 +74,8 @@ type Info struct {
 	BlockInbound        bool
 	DisableIPv6         bool
 
+	LazyConnectionEnabled bool
+
 	EnableSSHRoot                 bool
 	EnableSSHSFTP                 bool
 	EnableSSHLocalPortForwarding  bool
@@ -85,7 +87,7 @@ func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
+	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6, lazyConnectionEnabled bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
 	disableSSHAuth *bool,
 ) {
@@ -103,6 +105,8 @@ func (i *Info) SetFlags(
 	i.BlockInbound = blockInbound
 	i.DisableIPv6 = disableIPv6
 
+	i.LazyConnectionEnabled = lazyConnectionEnabled
+
 	if enableSSHRoot != nil {
 		i.EnableSSHRoot = *enableSSHRoot
 	}

client/system/process.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"slices"
 
-	"github.com/shirou/gopsutil/v4/process"
+	"github.com/shirou/gopsutil/v3/process"
 )
 
 // getRunningProcesses returns a list of running process paths. The context bounds the work:

client/system/process_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/shirou/gopsutil/v4/process"
+	"github.com/shirou/gopsutil/v3/process"
 )
 
 func Benchmark_getRunningProcesses(b *testing.B) {

client/test/json-socket-docker.sh

@@ -1,223 +0,0 @@
-#!/usr/bin/env bash
-set -eEuo pipefail
-
-usage() {
-  cat <<'EOF'
-Usage: client/test/json-socket-docker.sh [tcp|unix|both]
-
-Builds the NetBird client Docker image from the local source tree, starts
-`netbird service run` in a container with --enable-json-socket, and verifies
-that the HTTP/JSON daemon gateway responds to Status requests.
-
-Modes:
-  tcp   Validate tcp://0.0.0.0:8080 via a published localhost port (default)
-  unix  Validate unix:///sock/netbird-http.sock via a bind-mounted socket dir
-  both  Run both validations
-
-Environment:
-  CONTAINER_RUNTIME  docker or podman. Auto-detected if unset.
-  IMAGE              Image tag to build. Default: netbird-json-socket-test:local
-  TARGETARCH         Go/Docker target arch. Default: `go env GOARCH`
-  PLATFORM           Docker platform. Default: linux/$TARGETARCH
-  WAIT_TIMEOUT       Seconds to wait for the JSON socket. Default: 30
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-MODE="${1:-tcp}"
-case "${MODE}" in
-  tcp|unix|both) ;;
-  *)
-    usage >&2
-    echo "invalid mode: ${MODE}" >&2
-    exit 2
-    ;;
-esac
-
-RUNTIME="${CONTAINER_RUNTIME:-}"
-if [[ -z "${RUNTIME}" ]]; then
-  if command -v docker >/dev/null 2>&1; then
-    RUNTIME=docker
-  elif command -v podman >/dev/null 2>&1; then
-    RUNTIME=podman
-  else
-    echo "docker or podman is required" >&2
-    exit 127
-  fi
-fi
-if ! command -v "${RUNTIME}" >/dev/null 2>&1; then
-  echo "container runtime not found: ${RUNTIME}" >&2
-  exit 127
-fi
-
-if ! command -v curl >/dev/null 2>&1; then
-  echo "curl is required" >&2
-  exit 127
-fi
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-IMAGE="${IMAGE:-netbird-json-socket-test:local}"
-TARGETARCH="${TARGETARCH:-$(go env GOARCH)}"
-PLATFORM="${PLATFORM:-linux/${TARGETARCH}}"
-WAIT_TIMEOUT="${WAIT_TIMEOUT:-30}"
-TMP_DIR="$(mktemp -d)"
-CONTAINERS=()
-
-cleanup() {
-  local status=$?
-  for container in "${CONTAINERS[@]:-}"; do
-    "${RUNTIME}" rm -f "${container}" >/dev/null 2>&1 || true
-  done
-  rm -rf "${TMP_DIR}"
-  exit "${status}"
-}
-trap cleanup EXIT
-
-build_image() {
-  echo "==> Building Linux ${TARGETARCH} netbird binary"
-  mkdir -p "${TMP_DIR}/context/client"
-  cp "${ROOT_DIR}/client/Dockerfile" "${TMP_DIR}/context/Dockerfile"
-  cp "${ROOT_DIR}/client/netbird-entrypoint.sh" "${TMP_DIR}/context/client/netbird-entrypoint.sh"
-
-  (cd "${ROOT_DIR}" && CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" go build -o "${TMP_DIR}/context/netbird" ./client)
-
-  echo "==> Building ${IMAGE} for ${PLATFORM}"
-  "${RUNTIME}" build \
-    --platform "${PLATFORM}" \
-    --build-arg NETBIRD_BINARY=netbird \
-    -t "${IMAGE}" \
-    -f "${TMP_DIR}/context/Dockerfile" \
-    "${TMP_DIR}/context"
-}
-
-pick_port() {
-  python3 - <<'PY'
-import socket
-sock = socket.socket()
-sock.bind(("127.0.0.1", 0))
-print(sock.getsockname()[1])
-sock.close()
-PY
-}
-
-assert_status_json() {
-  local response_file="$1"
-  if command -v python3 >/dev/null 2>&1; then
-    python3 - "${response_file}" <<'PY'
-import json
-import sys
-with open(sys.argv[1], encoding="utf-8") as fh:
-    data = json.load(fh)
-if not data.get("status"):
-    raise SystemExit("missing non-empty status field")
-if "daemonVersion" not in data:
-    raise SystemExit("missing daemonVersion field")
-print(f"status={data['status']} daemonVersion={data['daemonVersion']}")
-PY
-  else
-    grep -q '"status"' "${response_file}"
-    grep -q '"daemonVersion"' "${response_file}"
-    cat "${response_file}"
-  fi
-}
-
-container_logs() {
-  local container="$1"
-  echo "---- ${container} logs ----" >&2
-  "${RUNTIME}" logs "${container}" >&2 || true
-  echo "--------------------------" >&2
-}
-
-wait_for_http_status() {
-  local container="$1"
-  local response="${TMP_DIR}/${container}.json"
-  local curl_err="${TMP_DIR}/${container}.curl.err"
-  shift
-  local deadline=$((SECONDS + WAIT_TIMEOUT))
-
-  while (( SECONDS < deadline )); do
-    if curl -fsS "$@" \
-      -X POST \
-      -H 'Content-Type: application/json' \
-      -d '{}' \
-      -o "${response}" \
-      2>"${curl_err}"; then
-      assert_status_json "${response}"
-      return 0
-    fi
-
-    if ! "${RUNTIME}" ps --format '{{.Names}}' | grep -Fxq "${container}"; then
-      echo "container exited before JSON socket became ready" >&2
-      container_logs "${container}"
-      return 1
-    fi
-    sleep 1
-  done
-
-  echo "timed out waiting for JSON socket after ${WAIT_TIMEOUT}s" >&2
-  cat "${curl_err}" >&2 || true
-  container_logs "${container}"
-  return 1
-}
-
-run_netbird_container() {
-  local container="$1"
-  local json_socket="$2"
-  shift 2
-
-  CONTAINERS+=("${container}")
-  "${RUNTIME}" run --rm -d \
-    --name "${container}" \
-    -e NB_STATE_DIR=/tmp/netbird-state \
-    --entrypoint /usr/local/bin/netbird \
-    "$@" \
-    "${IMAGE}" \
-    --log-file console \
-    --daemon-addr unix:///tmp/netbird.sock \
-    service run \
-    --enable-json-socket \
-    --json-socket "${json_socket}" >/dev/null
-}
-
-run_tcp_test() {
-  local port container
-  port="$(pick_port)"
-  container="nb-json-socket-tcp-$RANDOM-$RANDOM"
-
-  echo "==> Validating TCP JSON socket on 127.0.0.1:${port}"
-  run_netbird_container "${container}" "tcp://0.0.0.0:8080" -p "127.0.0.1:${port}:8080"
-  wait_for_http_status "${container}" "http://127.0.0.1:${port}/daemon.DaemonService/Status"
-}
-
-run_unix_test() {
-  local sock_dir sock_path container
-  sock_dir="${TMP_DIR}/sock"
-  sock_path="${sock_dir}/netbird-http.sock"
-  container="nb-json-socket-unix-$RANDOM-$RANDOM"
-  mkdir -p "${sock_dir}"
-
-  echo "==> Validating Unix JSON socket at ${sock_path}"
-  run_netbird_container "${container}" "unix:///sock/netbird-http.sock" -v "${sock_dir}:/sock"
-  wait_for_http_status "${container}" --unix-socket "${sock_path}" "http://unix/daemon.DaemonService/Status"
-}
-
-build_image
-
-case "${MODE}" in
-  tcp)
-    run_tcp_test
-    ;;
-  unix)
-    run_unix_test
-    ;;
-  both)
-    run_tcp_test
-    run_unix_test
-    ;;
-esac
-
-echo "==> Docker JSON socket validation passed (${MODE})"

client/ui/autostart_default.go

@@ -1,107 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/ui/preferences"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// autostartDefaultState carries the guard inputs of the one-time autostart
-// default decision so the decision itself stays a pure, testable function.
-type autostartDefaultState struct {
-	supported    bool
-	mdmDisabled  bool
-	priorInstall bool
-}
-
-// shouldEnableAutostartDefault applies the first-run guards in order and
-// returns whether autostart may be enabled, plus the reason when it may not.
-func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
-	switch {
-	case !s.supported:
-		return false, "autostart not supported on this platform"
-	case s.mdmDisabled:
-		return false, "autostart disabled by MDM policy"
-	case s.priorInstall:
-		return false, "existing NetBird installation"
-	}
-	return true, ""
-}
-
-// autostartDisabledByMDM reports whether the MDM policy manages the
-// disableAutostart key in a way that must suppress the default. An
-// unparseable managed value is treated as disabled to stay on the safe side.
-func autostartDisabledByMDM(policy *mdm.Policy) bool {
-	if !policy.HasKey(mdm.KeyDisableAutostart) {
-		return false
-	}
-	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
-	return !ok || disabled
-}
-
-// netbirdFootprintExists reports whether the machine already carries NetBird
-// daemon config or state, meaning this is not a genuinely fresh install. It is
-// the update-safety gate for the autostart default: upgrading users always
-// have a footprint, so an update can never trigger a login-item write.
-func netbirdFootprintExists() bool {
-	candidates := []string{
-		profilemanager.DefaultConfigPath,
-		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
-		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
-	}
-	for _, path := range candidates {
-		if path != "" && fileExists(path) {
-			return true
-		}
-	}
-	return false
-}
-
-// applyAutostartDefault runs the one-time launch-on-login default for genuinely
-// fresh installs. The autostartInitialized marker is persisted before any
-// enable attempt so a crash mid-flow degrades to "never enabled" instead of
-// retrying login-item writes on every launch. A user's later disable in
-// Settings is never overridden: the marker guarantees at-most-once, ever.
-func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	priorFootprint := netbirdFootprintExists() || prefsFileExisted
-
-	if prefs.Get().AutostartInitialized {
-		return
-	}
-	if err := prefs.SetAutostartInitialized(true); err != nil {
-		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
-		return
-	}
-
-	state := autostartDefaultState{
-		supported:    autostart.Supported(ctx),
-		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
-		priorInstall: priorFootprint,
-	}
-	enable, reason := shouldEnableAutostartDefault(state)
-	if !enable {
-		log.Debugf("skipping autostart default: %s", reason)
-		return
-	}
-
-	if err := autostart.SetEnabled(ctx, true); err != nil {
-		log.Warnf("enable autostart on fresh install: %v", err)
-		return
-	}
-	log.Info("autostart enabled by default on fresh install")
-}
-
-// fileExists reports whether path exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}