add header auth cache to proxy

.git-branches.toml

@@ -3,7 +3,7 @@
 [branches]
 main = "main"
 perennials = []
-perennial-regex = "^release-"
+perennial-regex = ""
 
 [create]
 new-branch-type = "feature"

.github/workflows/check-license-dependencies.yml

@@ -2,7 +2,7 @@ name: Check License Dependencies
 
 on:
   push:
-    branches: [main, "release-*"]
+    branches: [main]
     paths:
       - "go.mod"
       - "go.sum"

.github/workflows/frontend-ui.yml

@@ -10,7 +10,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
     paths:
       - "client/ui/frontend/**"
       - "client/ui/i18n/**"

.github/workflows/golang-test-darwin.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-freebsd.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-linux.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-windows.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:

.github/workflows/install-script-test.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "release_files/install.sh"

.github/workflows/mobile-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/release.yml

@@ -6,7 +6,6 @@ on:
       - "v*"
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:
@@ -255,23 +254,15 @@ jobs:
         id: tag_and_push_images
         if: |
           (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
-          (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))
+          (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: |
           set -euo pipefail
 
-          # $GITHUB_REF / $GITHUB_EVENT_NAME are read from the runner
-          # environment rather than substituted into this script with the
-          # workflow expression syntax: branch names may legally contain
-          # $(…), and interpolating github.ref would execute it.
           resolve_tags() {
-            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
               echo "pr-${{ github.event.pull_request.number }}"
-            elif [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
-              echo "main sha-$(git rev-parse --short HEAD)"
             else
-              # Release branches get an immutable sha-* tag only — the floating
-              # "main" tag must never move from a release branch.
-              echo "sha-$(git rev-parse --short HEAD)"
+              echo "main sha-$(git rev-parse --short HEAD)"
             fi
           }
 

.github/workflows/sync-tag.yml

@@ -9,9 +9,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
 
-# The receiving bump-netbird workflows expect the short tag form
-# (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
+# Receiving workflows (cloud sync-tag, mobile bump-netbird) expect the short
+# tag form (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
 jobs:
+  trigger_sync_tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger release tag sync
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: sync-tag.yml
+          ref: main
+          repo: ${{ secrets.UPSTREAM_REPO }}
+          token: ${{ secrets.NC_GITHUB_TOKEN }}
+          inputs: '{ "tag": "${{ github.ref_name }}" }'
+
   trigger_android_bump:
     runs-on: ubuntu-latest
     if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')

.github/workflows/test-infrastructure-files.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "infrastructure_files/**"

.github/workflows/ui-translations.yml

@@ -1,42 +0,0 @@
-name: UI Translations
-
-on:
-  pull_request:
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-      - ".github/workflows/ui-translations.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
-  cancel-in-progress: true
-
-jobs:
-  check-translations:
-    name: Check translation key parity
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      # English (en) is the source of truth for translation keys; every other
-      # locale declared in _index.json must carry the exact same key set.
-      - name: Check translation key parity
-        run: node client/ui/i18n/check-translations.mjs

.github/workflows/wasm-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.goreleaser.yaml

@@ -468,13 +468,6 @@ checksum:
     - glob: ./infrastructure_files/migrate-to-enterprise.sh
 
 release:
-  # The signing pipeline (netbirdio/sign-pipelines, dispatched by
-  # trigger_signer) marks the release latest once the Windows and macOS
-  # artifacts are signed. Without this override goreleaser marks it latest
-  # at publish time, while those artifacts are still unsigned.
-  make_latest: false
-  # Mark x.y.z-rc.* and other prerelease tags as prereleases on GitHub.
-  prerelease: auto
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh

.goreleaser_ui.yaml

@@ -144,11 +144,3 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_darwin.yaml

@@ -43,11 +43,3 @@ checksum:
   name_template: "{{ .ProjectName }}_darwin_checksums.txt"
 changelog:
   disable: true
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_gtk3.yaml

@@ -43,17 +43,19 @@ archives:
       - netbird-ui-gtk3
 
 nfpms:
-  # Mutually-exclusive alternative to the GTK4 netbird-ui package -- both
-  # ship the same /usr/bin/netbird-ui from the shared stable/yum repos, so
-  # this one carries its own name and conflicts with the GTK4 package.
+  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
+  # alternatives served from separate repo paths (see uploads below); a given
+  # distro points at exactly one of them. The file names must still differ:
+  # the Debian pool is shared storage keyed by file name, so a default-named
+  # gtk3 .deb would overwrite the stable one.
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_deb_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -65,10 +67,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    conflicts:
-      - netbird-ui
-    replaces:
-      - netbird-ui
     dependencies:
       - netbird (>= 0.75.0)
       - libgtk-3-0
@@ -81,8 +79,8 @@ nfpms:
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -94,10 +92,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    # No `replaces` here: nfpm maps it to rpm Obsoletes, which would make
-    # dnf swap installed GTK4 netbird-ui packages for this one on upgrade.
-    conflicts:
-      - netbird-ui
     dependencies:
       - netbird >= 0.75.0
       - (gtk3 or libgtk-3-0)
@@ -117,28 +111,32 @@ changelog:
   disable: true
 
 uploads:
-  - name: debian
+  # The gtk3 packages reuse the netbird-ui package name, so they live in
+  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
+  # legacy distros point their repo config at.
+  #
+  # GoReleaser derives the credential env var from the upload name, so these
+  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
+  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
+  # a missing secret is a silent skip rather than a failure -- the packages
+  # reached the GitHub release but never the package repositories. Point
+  # `password` at the exported vars so both uploads authenticate.
+  - name: debian-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_deb_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
     method: PUT
 
-  - name: yum
+  - name: yum-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_rpm_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
+    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

AGENTS.md

@@ -1,6 +1,6 @@
 # NetBird Agent Guidelines
 
-**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
+**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
 network with a control plane. The **agent** (`client/`) runs on user machines as
 a privileged daemon and manages the WireGuard interface, routing, firewall, and
 DNS. **Management** (`management/`) is the control plane and REST/gRPC API,

CONTRIBUTING.md

@@ -112,7 +112,6 @@ aligns with our security standards and design expectations.
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
     - [When we close a PR](#when-we-close-a-pr)
-    - [Translations](#translations)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -479,7 +478,7 @@ go test -race ./client/internal/dns/...
 
 ## Checklist before submitting a PR
 
-As a critical network service and open source project, we must enforce a few
+As a critical network service and open-source project, we must enforce a few
 things before submitting a pull request. The
 [pull request template](/.github/pull_request_template.md) mirrors this list —
 fill it in rather than deleting it.
@@ -613,17 +612,6 @@ A closed PR is not a rejected idea. Take it back to the
 [discussion](https://github.com/netbirdio/netbird/discussions), settle the
 approach, and reopen the work from there.
 
-## Translations
-
-Desktop UI translations are not contributed through pull requests. Translate on
-[Crowdin](https://crowdin.com/project/netbird) instead: no ticket needed, just
-join the project and pick your language. Crowdin syncs with this repository and
-opens the service PRs itself, so hand-edited locale files would conflict with
-the next sync. Style, terminology, and review guidance live in
-[client/ui/i18n/TRANSLATING.md](client/ui/i18n/TRANSLATING.md). To request a
-language the project does not offer yet, ask on the Crowdin project page or in
-a [discussion](https://github.com/netbirdio/netbird/discussions).
-
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:

README.md

@@ -130,7 +130,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.

SECURITY.md

@@ -14,7 +14,7 @@ Report security issues one of these two ways:
   on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
 - **Email** — `security@netbird.io`.
 
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
 filing a repository report.
 
 ### What to include

client/android/client.go

@@ -26,8 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -42,6 +40,11 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
+// ConnectionListener export internal Listener for mobile
+type ConnectionListener interface {
+	peer.Listener
+}
+
 // TunAdapter export internal TunAdapter for mobile
 type TunAdapter interface {
 	device.TunAdapter
@@ -82,13 +85,6 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run and RunWithoutLogin inject it into each new
-	// ConnectClient, which distributes it to every reconnection loop.
-	netState *netstate.State
-
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
@@ -152,7 +148,6 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
-	system.SetIFaceDiscover(iFaceDiscover)
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
@@ -161,8 +156,6 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
 	}
 }
 
@@ -203,8 +196,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	}
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -245,8 +237,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
@@ -294,24 +285,6 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 	}, nil
 }
 
-// SetNetworkAvailable feeds OS-reported network availability into the client.
-// While unavailable, the internal reconnect loops suspend their attempts and
-// the connection listener reports NoNetwork instead of Connecting; when
-// availability returns, the loops resume immediately with a fresh backoff.
-func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
-}
-
-// NotifyNetworkChange marks the management, signal and relay connections
-// stale after the OS switched networks and schedules a sweep that cuts
-// whatever has not redialed on the new network by then. The engine and the
-// TUN device stay untouched.
-func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine. anonymizeLevel is "default"
 // or "strict"; strict also anonymizes internal IP ranges, peer names, and
@@ -552,11 +525,7 @@ func (c *Client) OnUpdatedHostDNS(list *DNSList) error {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	if listener == nil {
-		c.recorder.RemoveConnectionListener()
-		return
-	}
-	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
+	c.recorder.SetConnectionListener(listener)
 }
 
 // RemoveConnectionListener remove connection listener

client/android/connection_listener.go

@@ -1,41 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-// Client state values delivered via ConnectionListener.OnStateChanged,
-// re-exported as basic constants so gomobile emits them into the generated
-// Java bindings. They mirror peer.ClientState*: append-only, never reorder.
-const (
-	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
-	ClientStateConnected     = int(peer.ClientStateConnected)
-	ClientStateConnecting    = int(peer.ClientStateConnecting)
-	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
-	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
-)
-
-// ConnectionListener export internal Listener for mobile. It mirrors
-// peer.Listener with OnStateChanged taking a plain int (one of the
-// ClientState* constants), because gomobile cannot bind named types.
-type ConnectionListener interface {
-	OnStateChanged(state int)
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
-// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
-// peer.Listener, converting the typed state to the int the binding carries.
-type connectionListenerAdapter struct {
-	ConnectionListener
-}
-
-func (a connectionListenerAdapter) OnStateChanged(state peer.ClientState) {
-	a.ConnectionListener.OnStateChanged(int(state))
-}

client/android/login.go

@@ -204,9 +204,8 @@ func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh profile leaves the
-	// choice to the IdP. Switching accounts is done by switching or removing
-	// profiles, not by logging out — logout keeps the email.
+	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
+	// leaves the choice to the IdP, which is how accounts get switched.
 	if a.cfgPath != "" {
 		if hint := readProfileEmail(a.cfgPath); hint != "" {
 			if setter, ok := oAuthFlow.(loginHintSetter); ok {

client/android/profile_manager.go

@@ -22,8 +22,7 @@ type Profile struct {
 	ID   string
 	Name string
 	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login. Kept across logouts; cleared when the profile is
-	// removed. See profile_state.go.
+	// completed an SSO login or was logged out. See profile_state.go.
 	Email    string
 	IsActive bool
 }
@@ -201,9 +200,11 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// The stored account email is kept on purpose, matching the desktop and CLI
-	// logout semantics: the next login passes it as the login_hint so the IdP
-	// preselects the account. Removing the profile is what deletes it.
+	// Not fatal: a stale hint costs an account switch, not the logout itself.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
+	}
+
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }
@@ -223,24 +224,11 @@ func (pm *ProfileManager) RenameProfile(id string, newName string) error {
 
 // RemoveProfile deletes a profile
 func (pm *ProfileManager) RemoveProfile(id string) error {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return err
-	}
-
 	// Use ServiceManager (removes profile from profiles/ directory)
 	if err := pm.serviceMgr.RemoveProfile(profilemanager.ID(id), androidUsername); err != nil {
 		return fmt.Errorf("failed to remove profile: %w", err)
 	}
 
-	// The account file is this package's, not the ServiceManager's, so it must
-	// go here. The default profile has a fixed filename, so a recreated one
-	// would otherwise inherit the deleted profile's email as its login_hint.
-	// Not fatal: the profile itself is gone.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to remove stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("removed profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -90,10 +90,10 @@ func writeProfileEmail(configPath string, email string) error {
 	return nil
 }
 
-// removeProfileEmail drops the stored account email. Called on profile removal,
-// not on logout: a logged-out profile keeps its email so the next login passes
-// it as the login_hint, matching the desktop and CLI semantics. Mirrors the
-// desktop UI's RemoveProfileState call.
+// removeProfileEmail drops the stored account email. Called on logout: while the
+// email is on disk it goes out as a login_hint, which would steer the next login
+// straight back into the account just logged out of. Mirrors the desktop UI's
+// RemoveProfileState call.
 func removeProfileEmail(configPath string) error {
 	accountPath, err := profileAccountPathFor(configPath)
 	if err != nil {

client/android/profile_state_test.go

@@ -127,10 +127,10 @@ func TestWriteThenReadProfileEmail(t *testing.T) {
 		t.Fatalf("remove: %v", err)
 	}
 	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after removal, got %q", got)
+		t.Errorf("expected no email after logout, got %q", got)
 	}
 
-	// Removal may run on a never-logged-in profile, so a second remove must pass.
+	// Logout may run on a never-logged-in profile, so a second remove must pass.
 	if err := removeProfileEmail(configPath); err != nil {
 		t.Fatalf("second remove should be a no-op: %v", err)
 	}

client/anonymize/anonymize.go

@@ -305,12 +305,6 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		return domain
 	}
 
-	// A reverse zone names an address prefix, so it follows the address rules,
-	// which also keeps its digit labels intact.
-	if zone, ok := a.anonymizeReverseZone(baseDomain); ok {
-		return withTrailingDot(zone, hasDot)
-	}
-
 	if suffix := protectedSuffix(baseDomain); suffix != "" {
 		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
 			return domain
@@ -411,10 +405,6 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	ipv4Regex := regexp.MustCompile(`\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b`)
 	ipv6Regex := regexp.MustCompile(`\b([0-9a-fA-F:]+:+[0-9a-fA-F]{0,4})(?:%[0-9a-zA-Z]+)?(?:\/[0-9]{1,3})?(?::[0-9]{1,5})?\b`)
 
-	// Reverse zones go first and are then held out of the passes below: their
-	// labels are digits, which the address patterns would otherwise consume.
-	str, restoreZones := a.replaceReverseZones(str)
-
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
@@ -435,7 +425,7 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
 	}
 
-	return restoreZones(str)
+	return str
 }
 
 // sortedDomains returns the domain mappings longest-first, so a full-FQDN

client/anonymize/reverse_zone.go

@@ -1,174 +0,0 @@
-package anonymize
-
-import (
-	"encoding/hex"
-	"net/netip"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-const (
-	reverseZoneSuffixV4 = ".in-addr.arpa"
-	reverseZoneSuffixV6 = ".ip6.arpa"
-
-	v6Nibbles = 32
-	v4Octets  = 4
-)
-
-// reverseZoneRegexes match a reverse zone or a full reverse name in free text.
-// They are applied before the address passes of AnonymizeString, whose IPv4
-// pattern would otherwise consume the digit labels of a zone and replace parts
-// of it with unrelated addresses.
-var reverseZoneRegexes = []*regexp.Regexp{
-	regexp.MustCompile(`(?:[0-9]{1,3}\.){1,4}in-addr\.arpa\b`),
-	regexp.MustCompile(`(?:[0-9a-fA-F]\.){1,32}ip6\.arpa\b`),
-}
-
-// anonymizeReverseZone maps a reverse zone to the zone of the anonymized form
-// of the prefix it encodes, so it follows the address rules rather than the
-// domain ones: the zone of an address that is preserved is preserved too, and
-// the zone of one that is replaced names the replacement. This keeps a reverse
-// zone recognizable as such, and consistent with the addresses it belongs to
-// elsewhere in the same output. It reports false for anything that is not a
-// reverse zone.
-func (a *Anonymizer) anonymizeReverseZone(domain string) (string, bool) {
-	prefix, labelCount, suffix, ok := parseReverseZone(domain)
-	if !ok {
-		return "", false
-	}
-
-	anonymized := a.AnonymizeIP(prefix)
-	if anonymized == prefix {
-		return domain, true
-	}
-
-	return reverseZoneName(anonymized, labelCount) + suffix, true
-}
-
-// replaceReverseZones anonymizes every reverse zone in str and swaps each one
-// for a placeholder, returning a function that puts the anonymized zones back.
-// The placeholders carry no dots, digits or colons, so no later pass matches
-// them.
-func (a *Anonymizer) replaceReverseZones(str string) (string, func(string) string) {
-	var zones []string
-
-	for _, re := range reverseZoneRegexes {
-		str = re.ReplaceAllStringFunc(str, func(match string) string {
-			zone, ok := a.anonymizeReverseZone(match)
-			if !ok {
-				return match
-			}
-
-			zones = append(zones, zone)
-			return reverseZonePlaceholder(len(zones) - 1)
-		})
-	}
-
-	if len(zones) == 0 {
-		return str, func(s string) string { return s }
-	}
-
-	return str, func(s string) string {
-		for i, zone := range zones {
-			s = strings.ReplaceAll(s, reverseZonePlaceholder(i), zone)
-		}
-		return s
-	}
-}
-
-func reverseZonePlaceholder(index int) string {
-	return "\x00reversezone" + strconv.Itoa(index) + "\x00"
-}
-
-// parseReverseZone turns a reverse zone into the address of the prefix its
-// labels spell backwards, padding the absent low-order part with zeroes, and
-// returns the label count and zone suffix so the name can be rebuilt.
-func parseReverseZone(domain string) (netip.Addr, int, string, bool) {
-	lower := strings.ToLower(domain)
-
-	switch {
-	case strings.HasSuffix(lower, reverseZoneSuffixV4):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV4), ".")
-		addr, ok := reverseZoneAddrV4(labels)
-		return addr, len(labels), reverseZoneSuffixV4, ok
-	case strings.HasSuffix(lower, reverseZoneSuffixV6):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV6), ".")
-		addr, ok := reverseZoneAddrV6(labels)
-		return addr, len(labels), reverseZoneSuffixV6, ok
-	default:
-		return netip.Addr{}, 0, "", false
-	}
-}
-
-func reverseZoneAddrV4(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v4Octets {
-		return netip.Addr{}, false
-	}
-
-	var octets [v4Octets]byte
-	for i, label := range labels {
-		octet, err := strconv.ParseUint(label, 10, 8)
-		if err != nil {
-			return netip.Addr{}, false
-		}
-		octets[len(labels)-1-i] = byte(octet)
-	}
-
-	return netip.AddrFrom4(octets), true
-}
-
-func reverseZoneAddrV6(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v6Nibbles {
-		return netip.Addr{}, false
-	}
-
-	nibbles := make([]byte, 0, v6Nibbles)
-	for i := len(labels) - 1; i >= 0; i-- {
-		if len(labels[i]) != 1 || !isHexDigit(labels[i][0]) {
-			return netip.Addr{}, false
-		}
-		nibbles = append(nibbles, labels[i][0])
-	}
-	for len(nibbles) < v6Nibbles {
-		nibbles = append(nibbles, '0')
-	}
-
-	var groups []string
-	for i := 0; i < len(nibbles); i += 4 {
-		groups = append(groups, string(nibbles[i:i+4]))
-	}
-
-	addr, err := netip.ParseAddr(strings.Join(groups, ":"))
-	if err != nil {
-		return netip.Addr{}, false
-	}
-
-	return addr, true
-}
-
-// reverseZoneName spells the first labelCount labels of addr backwards, the
-// inverse of parseReverseZone, without the zone suffix.
-func reverseZoneName(addr netip.Addr, labelCount int) string {
-	labels := make([]string, 0, labelCount)
-
-	if addr.Is4() {
-		octets := addr.As4()
-		for i := labelCount - 1; i >= 0; i-- {
-			labels = append(labels, strconv.Itoa(int(octets[i])))
-		}
-		return strings.Join(labels, ".")
-	}
-
-	address := addr.As16()
-	nibbles := hex.EncodeToString(address[:])
-	for i := labelCount - 1; i >= 0; i-- {
-		labels = append(labels, string(nibbles[i]))
-	}
-
-	return strings.Join(labels, ".")
-}
-
-func isHexDigit(c byte) bool {
-	return c >= '0' && c <= '9' || c >= 'a' && c <= 'f' || c >= 'A' && c <= 'F'
-}

client/anonymize/reverse_zone_test.go

@@ -1,171 +0,0 @@
-package anonymize
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func newLeveledAnonymizer(level Level) *Anonymizer {
-	a := NewAnonymizer(DefaultAddresses())
-	a.SetLevel(level)
-	return a
-}
-
-// TestAnonymizeDomainReverseZone covers reverse zones going through the address
-// rules instead of the domain ones, so a zone stays a zone and an address that
-// is preserved keeps the zone that names it.
-func TestAnonymizeDomainReverseZone(t *testing.T) {
-	// 100.64.0.0/10 is the overlay range, which is CGNAT: preserved at the
-	// default level and replaced from the internal pool at the strict one
-	const overlayZone = "64.100.in-addr.arpa"
-
-	t.Run("overlay zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, overlayZone, a.AnonymizeDomain(overlayZone), "should keep the zone of a preserved address")
-	})
-
-	t.Run("private zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "168.192.in-addr.arpa", a.AnonymizeDomain("168.192.in-addr.arpa"), "should keep the zone of a private address")
-	})
-
-	t.Run("overlay zone replaced at the strict level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelStrict)
-
-		got := a.AnonymizeDomain(overlayZone)
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, overlayZone, got, "should replace the encoded prefix")
-		assert.Len(t, strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV4), "."), 2,
-			"should keep the label count, got %q", got)
-	})
-
-	t.Run("public zone replaced at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("113.0.203.in-addr.arpa")
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, "113.0.203.in-addr.arpa", got, "should replace a public prefix")
-	})
-
-	t.Run("zone of an address keeps that address mapping", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		anonymizedAddr := a.AnonymizeIPString("203.0.113.7")
-		got := a.AnonymizeDomain("7.113.0.203.in-addr.arpa")
-
-		octets := strings.Split(anonymizedAddr, ".")
-		want := octets[3] + "." + octets[2] + "." + octets[1] + "." + octets[0] + reverseZoneSuffixV4
-		assert.Equal(t, want, got, "should name the same replacement as the address itself")
-	})
-
-	t.Run("ipv6 nibble labels stay single digits", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeDomain(zone)
-
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV6), "should stay a reverse zone, got %q", got)
-		labels := strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV6), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-		for _, label := range labels {
-			assert.Len(t, label, 1, "nibble label %q should stay a single digit", label)
-		}
-	})
-
-	t.Run("trailing dot is kept", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "64.100.in-addr.arpa.", a.AnonymizeDomain("64.100.in-addr.arpa."), "should keep the trailing dot")
-	})
-
-	t.Run("a domain that only looks like a zone is anonymized as a domain", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("not-a-zone.in-addr.arpa")
-		assert.NotContains(t, got, "in-addr.arpa", "should fall back to domain anonymization")
-	})
-}
-
-// TestAnonymizeStringReverseZone verifies that a zone inside free text, such as
-// a DNS log line, is not chewed up by the address passes. The IPv4 pattern
-// matches any run of dotted digits, which a reverse zone is made of.
-func TestAnonymizeStringReverseZone(t *testing.T) {
-	t.Run("ipv6 zone survives the address passes", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeString("question: domain=" + zone + " type=PTR")
-
-		assert.Contains(t, got, "type=PTR", "should keep the rest of the line")
-		assert.NotContains(t, got, "198.51.100", "should not rewrite nibble labels as an address")
-
-		labels := strings.Split(strings.TrimSuffix(strings.TrimPrefix(got, "question: domain="), reverseZoneSuffixV6+" type=PTR"), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-	})
-
-	t.Run("preserved ipv4 zone is untouched", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		line := "reverse zone 64.100.in-addr.arpa registered"
-		assert.Equal(t, line, a.AnonymizeString(line), "should keep the zone of a preserved address")
-	})
-
-	t.Run("public ipv4 zone is replaced consistently", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeString("zone 113.0.203.in-addr.arpa and address 203.0.113.7")
-		assert.NotContains(t, got, "113.0.203.in-addr.arpa", "should replace the zone")
-		assert.NotContains(t, got, "203.0.113.7", "should replace the address")
-		assert.Contains(t, got, reverseZoneSuffixV4, "should keep the zone suffix")
-	})
-}
-
-func TestParseReverseZone(t *testing.T) {
-	tests := []struct {
-		name   string
-		zone   string
-		addr   string
-		labels int
-	}{
-		{name: "v4 two labels", zone: "0.100" + reverseZoneSuffixV4, addr: "100.0.0.0", labels: 2},
-		{name: "v4 three labels", zone: "1.168.192" + reverseZoneSuffixV4, addr: "192.168.1.0", labels: 3},
-		{name: "v4 full address", zone: "7.113.0.203" + reverseZoneSuffixV4, addr: "203.0.113.7", labels: 4},
-		{
-			name:   "v6 prefix",
-			zone:   "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6,
-			addr:   "2::",
-			labels: 28,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			addr, labels, suffix, ok := parseReverseZone(tc.zone)
-			require.True(t, ok, "should decode the reverse zone")
-			assert.Equal(t, tc.addr, addr.String(), "should decode to the encoded prefix")
-			assert.Equal(t, tc.labels, labels, "should count the labels")
-			assert.Equal(t, tc.zone, reverseZoneName(addr, labels)+suffix, "should re-encode to the original zone")
-		})
-	}
-}
-
-func TestParseReverseZoneRejectsNonZones(t *testing.T) {
-	tests := []string{
-		"example.com",
-		"in-addr.arpa",
-		"x.100" + reverseZoneSuffixV4,
-		"256" + reverseZoneSuffixV4,
-		"1.2.3.4.5" + reverseZoneSuffixV4,
-		"ab" + reverseZoneSuffixV6,
-		"g" + reverseZoneSuffixV6,
-	}
-
-	for _, zone := range tests {
-		t.Run(zone, func(t *testing.T) {
-			_, _, _, ok := parseReverseZone(zone)
-			assert.False(t, ok, "should reject %q", zone)
-		})
-	}
-}

client/cmd/login.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/user"
+	"runtime"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -120,7 +121,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
 		ManagementUrl:       managementURL,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		DnsLabels:           dnsLabelsReq,
 		ProfileName:         &handle,
@@ -188,8 +189,7 @@ func doExtendSession(ctx context.Context, cmd *cobra.Command) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 
-	// the CLI runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestExtendAuthSessionRequest{}
 	// Pre-fill the IdP login hint from the active profile so the user
 	// doesn't have to retype their email. Best-effort: we still proceed
 	// without a hint if the lookup fails.
@@ -408,7 +408,7 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isUnixRunningDesktop(), false, hint)
 	if err != nil {
 		return nil, err
 	}
@@ -458,6 +458,14 @@ func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBro
 	}
 }
 
+// isUnixRunningDesktop checks if a Linux OS is running desktop environment
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func setEnvAndFlags(cmd *cobra.Command) error {
 	SetFlagsFromEnvVars(rootCmd)
 

client/cmd/up.go

@@ -21,8 +21,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -626,7 +626,7 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		NatExternalIPs:      natExternalIPs,
 		CleanNATExternalIPs: natExternalIPs != nil && len(natExternalIPs) == 0,
 		CustomDNSAddress:    customDNSAddressConverted,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		ExtraIFaceBlacklist: extraIFaceBlackList,
 		DnsLabels:           dnsLabels,

client/firewall/iptables/acl_linux.go

@@ -42,7 +42,6 @@ type aclManager struct {
 	optionalEntries map[string][]entry
 	ipsetStore      *ipsetStore
 	v6              bool
-	ipsetSupported  bool
 
 	stateManager *statemanager.Manager
 }
@@ -61,8 +60,6 @@ func newAclManager(iptablesClient *iptables.IPTables, wgIface iFaceMapper) (*acl
 func (m *aclManager) init(stateManager *statemanager.Manager) error {
 	m.stateManager = stateManager
 
-	m.ipsetSupported = m.probeIPSetSupport()
-
 	m.seedInitialEntries()
 	m.seedInitialOptionalEntries()
 
@@ -94,12 +91,6 @@ func (m *aclManager) AddPeerFiltering(
 	if m.v6 && ipsetName != "" {
 		ipsetName += "-v6"
 	}
-	// When the kernel lacks the required ipset hash module, fall back to
-	// per-IP iptables rules (pre-0.68 behavior) so ACLs keep working instead
-	// of silently leaving the chain empty.
-	if ipsetName != "" && !m.ipsetSupported {
-		ipsetName = ""
-	}
 	proto := protoForFamily(protocol, m.v6)
 	specs := filterRuleSpecs(ip, proto, sPort, dPort, action, ipsetName)
 
@@ -507,40 +498,6 @@ func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port, action fi
 	}
 }
 
-// probeIPSetSupport checks whether the kernel can create the ipset type used for
-// ACL rules. On kernels lacking the required ipset hash module, ipset creation
-// fails (e.g. "invalid argument"), which would otherwise leave the ACL chain
-// empty and silently drop all policy-permitted inbound traffic. When unsupported,
-// the manager falls back to per-IP iptables rules.
-func (m *aclManager) probeIPSetSupport() bool {
-	// Use a unique name so concurrent processes don't collide and we only ever
-	// destroy the set we created ourselves. ipset names are limited to 31 chars,
-	// so use a short random suffix.
-	probeName := "nb-probe-" + uuid.New().String()[:8]
-
-	opts := ipset.CreateOptions{
-		Replace: true,
-	}
-	if m.v6 {
-		opts.Family = ipset.FamilyIPV6
-	}
-
-	if err := ipset.Create(probeName, ipset.TypeHashNet, opts); err != nil {
-		log.Warnf("ipset is not available (failed to create probe set: %v); "+
-			"falling back to per-IP iptables ACL rules. Ensure the kernel provides "+
-			"the ipset hash:net module (ip_set_hash_net) for better performance with large rule sets", err)
-		return false
-	}
-
-	defer func() {
-		if err := ipset.Destroy(probeName); err != nil {
-			log.Debugf("destroy ipset probe set %q: %v", probeName, err)
-		}
-	}()
-
-	return true
-}
-
 func (m *aclManager) createIPSet(name string) error {
 	opts := ipset.CreateOptions{
 		Replace: true,

client/firewall/iptables/dnat_refcount_linux_test.go

@@ -1,240 +0,0 @@
-//go:build privileged
-
-package iptables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func iptRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-			}
-		},
-	}
-}
-
-func iptRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newIptRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = iptRefcountIfaceDual()
-	} else {
-		ifMock = iptRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func iptDnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func iptDnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
-func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newIptRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV4(7081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(iptDnatV4(7082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestIptablesDNAT_RefcountBalancedV6 checks the v6 path increments v6 only and
-// decrements back to zero.
-func TestIptablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9081))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(iptDnatV6(9082))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestIptablesDNAT_DuplicateAddNoLeak verifies the duplicate-rule path returns
-// without bumping the refcount.
-func TestIptablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := iptDnatV4(7083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err)
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestIptablesDNAT_DeleteMissingNoUnderflow verifies Delete on an unknown rule
-// neither errors nor releases the refcount.
-func TestIptablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	phantom := iptDnatV4(7099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	phantom6 := iptDnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	r1, err := m.AddDNATRule(iptDnatV4(7100))
-	require.NoError(t, err)
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestIptablesDNAT_DoubleDeleteNoUnderflow verifies a second Delete on the same
-// rule is a no-op.
-func TestIptablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9083))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/iptables/manager_linux.go

@@ -89,7 +89,7 @@ func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
 	}
 
 	// Share the same IP forwarding state with the v4 router, since
-	// Forwarding refcounter is per-family but shared between v4 and v6 routers.
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclMgr6, err = newAclManager(ip6Client, wgIface)
@@ -402,12 +402,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // AddDNATRule adds a DNAT rule

client/firewall/iptables/manager_linux_test.go

@@ -291,40 +291,3 @@ func TestIptablesCreatePerformance(t *testing.T) {
 		})
 	}
 }
-
-// TestIptablesACLIPSetFallback verifies that when the kernel lacks ipset support,
-// the ACL manager falls back to per-IP iptables rules (-s <ip>) instead of
-// silently leaving the chain empty. See discussion #6125.
-func TestIptablesACLIPSetFallback(t *testing.T) {
-	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
-	require.NoError(t, err)
-
-	// Use Create()/Init() so the router-owned chains (chainRTFWDIN/OUT) are
-	// created before the ACL manager's createDefaultChains() references them.
-	manager, err := Create(ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err)
-	require.NoError(t, manager.Init(nil))
-
-	aclMgr := manager.aclMgr
-	// Simulate a kernel without the ipset hash module.
-	aclMgr.ipsetSupported = false
-
-	defer func() {
-		require.NoError(t, manager.Close(nil))
-	}()
-
-	ip := netip.MustParseAddr("10.20.0.42")
-	port := &fw.Port{Values: []uint16{22}}
-
-	rules, err := aclMgr.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "nb0000001")
-	require.NoError(t, err, "AddPeerFiltering should succeed via fallback")
-	require.NotEmpty(t, rules)
-
-	rule := rules[0].(*Rule)
-	require.Empty(t, rule.ipsetName, "fallback rule must not reference an ipset")
-	require.Contains(t, strings.Join(rule.specs, " "), "-s 10.20.0.42", "fallback rule must match by source IP")
-	require.NotContains(t, strings.Join(rule.specs, " "), "--match-set", "fallback rule must not use ipset matching")
-
-	// The rule must actually be present in the ACL chain (not silently dropped).
-	checkRuleSpecs(t, ipv4Client, rule.chain, true, rule.specs...)
-}

client/firewall/iptables/router_linux.go

@@ -102,7 +102,7 @@ func newRouter(iptablesClient *iptables.IPTables, wgIface iFaceMapper, mtu uint1
 		wgIface:        wgIface,
 		mtu:            mtu,
 		v6:             iptablesClient.Proto() == iptables.ProtocolIPv6,
-		ipFwdState:     ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState:     ipfwdstate.NewIPForwardingState(),
 	}
 
 	r.ipsetCounter = refcounter.New(
@@ -770,6 +770,10 @@ func (r *router) updateState() {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -836,34 +840,18 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 
 	for key, ruleInfo := range rules {
 		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			r.cleanupFailedDNATAdd(rules)
+			if rollbackErr := r.rollbackRules(rules); rollbackErr != nil {
+				log.Errorf("rollback failed: %v", rollbackErr)
+			}
 			return nil, fmt.Errorf("add rule %s: %w", key, err)
 		}
 		r.rules[key] = ruleInfo.rule
 	}
 
-	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
-		r.cleanupFailedDNATAdd(rules)
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	r.updateState()
 	return rule, nil
 }
 
-// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
-// AddDNATRule before rolling back the kernel rules, so no entries remain that
-// never got a forwarding refcount. rollbackRules re-adds entries it failed to
-// remove from the kernel.
-func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {
-	for key := range rules {
-		delete(r.rules, key)
-	}
-	if err := r.rollbackRules(rules); err != nil {
-		log.Errorf("rollback failed: %v", err)
-	}
-}
-
 func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 	var merr *multierror.Error
 	for key, ruleInfo := range rules {
@@ -880,47 +868,32 @@ func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
-	ruleKey := rule.ID()
-
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	_, hadFWD := r.rules[ruleKey+fwdSuffix]
-	if !hadDNAT && !hadSNAT && !hadFWD {
-		return nil
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
 	}
 
+	ruleKey := rule.ID()
+
 	var merr *multierror.Error
 	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+dnatSuffix)
 		}
+		delete(r.rules, ruleKey+dnatSuffix)
 	}
 
 	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+snatSuffix)
 		}
+		delete(r.rules, ruleKey+snatSuffix)
 	}
 
 	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+fwdSuffix)
-		}
-	}
-
-	// Release the refcount only once all rules are gone from the kernel. On
-	// partial failure the failed entries stay in r.rules so a retry can remove
-	// them and release then.
-	if merr == nil {
-		if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
-			log.Errorf("%v", err)
 		}
+		delete(r.rules, ruleKey+fwdSuffix)
 	}
 
 	r.updateState()

client/firewall/nftables/dnat_refcount_linux_test.go

@@ -1,249 +0,0 @@
-//go:build privileged
-
-package nftables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func nftRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-			}
-		},
-	}
-}
-
-func nftRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newNftRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = nftRefcountIfaceDual()
-	} else {
-		ifMock = nftRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func dnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func dnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestNftablesDNAT_RefcountBalancedV4 verifies that Add/Delete pairs leave the
-// v4 refcount at zero.
-func TestNftablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newNftRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV4(8081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(dnatV4(8082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestNftablesDNAT_RefcountBalancedV6 verifies the v6 path increments v6 only
-// and decrements back to zero on Delete.
-func TestNftablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9091))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(dnatV6(9092))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestNftablesDNAT_DuplicateAddNoLeak verifies that a duplicate Add (same
-// ForwardRule) does not double-increment the refcount.
-func TestNftablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := dnatV4(8083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err, "add v4 dnat")
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	// duplicate add: same rule ID, must be a no-op for the refcount.
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat")
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestNftablesDNAT_DeleteMissingNoUnderflow verifies deleting a rule that was
-// never added does not underflow the refcount.
-func TestNftablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	// Construct a Rule reference for something never added. The router stores
-	// rules by ID(), and DeleteDNATRule looks them up in r.rules; a missing
-	// entry must be a no-op rather than calling Release.
-	phantom := dnatV4(8099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4 dnat")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unaffected by missing delete")
-	assert.Equal(t, 0, v6, "v6 refcount unaffected")
-
-	phantom6 := dnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6 dnat")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount unaffected by missing delete")
-
-	// And after a phantom delete, a real add still results in count=1.
-	r1, err := m.AddDNATRule(dnatV4(8100))
-	require.NoError(t, err, "add v4 dnat after phantom delete")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestNftablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestNftablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestNftablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestNftablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestNftablesDNAT_DoubleDeleteNoUnderflow verifies that deleting the same rule
-// twice does not underflow the refcount (the second delete is a no-op).
-func TestNftablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9093))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/nftables/manager_linux.go

@@ -105,8 +105,8 @@ func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mt
 		return fmt.Errorf("create v6 router: %w", err)
 	}
 
-	// Share the per-family forwarding refcounter with the v4 router so a v4
-	// rule and a v6 rule against the same state machine cooperate cleanly.
+	// Share the same IP forwarding state with the v4 router, since
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclManager6, err = newAclManager(workTable6, wgIface, chainNameRoutingFw)
@@ -530,12 +530,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // Flush rule/chain/set operations from the buffer

client/firewall/nftables/router_linux.go

@@ -93,7 +93,7 @@ func newRouter(workTable *nftables.Table, wgIface iFaceMapper, mtu uint16) (*rou
 		rules:      make(map[string]*nftables.Rule),
 		af:         familyForAddr(workTable.Family == nftables.TableFamilyIPv4),
 		wgIface:    wgIface,
-		ipFwdState: ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState: ipfwdstate.NewIPForwardingState(),
 		mtu:        mtu,
 	}
 
@@ -1553,6 +1553,10 @@ func (r *router) refreshRulesMap() error {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -1563,18 +1567,7 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 		return nil, fmt.Errorf("convert protocol to number: %w", err)
 	}
 
-	// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
-	// buffer netlink messages on r.conn that the next caller's Flush would
-	// commit if we returned without flushing them ourselves.
-	v6 := r.af.tableFamily == nftables.TableFamilyIPv6
-	if err := r.ipFwdState.RequestForwarding(v6); err != nil {
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	if err := r.addDnatRedirect(rule, protoNum, ruleKey); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
 		return nil, err
 	}
 
@@ -1586,11 +1579,6 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 	// TODO: find chains with drop policies and add rules there
 
 	if err := r.conn.Flush(); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
-		delete(r.rules, ruleKey+dnatSuffix)
-		delete(r.rules, ruleKey+snatSuffix)
 		return nil, fmt.Errorf("flush rules: %w", err)
 	}
 
@@ -1793,18 +1781,16 @@ func (r *router) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleKey
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
+	}
+
 	ruleKey := rule.ID()
 
 	if err := r.refreshRulesMap(); err != nil {
 		return fmt.Errorf(refreshRulesMapError, err)
 	}
 
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	if !hadDNAT && !hadSNAT {
-		return nil
-	}
-
 	var merr *multierror.Error
 	var needsFlush bool
 
@@ -1836,16 +1822,9 @@ func (r *router) DeleteDNATRule(rule firewall.Rule) error {
 		}
 	}
 
-	// Release the refcount only once the rules are gone from the kernel. On
-	// failure (including the refreshRulesMap error above) the rules and their
-	// map entries remain, keeping forwarding on until a retry removes them.
 	if merr == nil {
 		delete(r.rules, ruleKey+dnatSuffix)
 		delete(r.rules, ruleKey+snatSuffix)
-
-		if err := r.ipFwdState.ReleaseForwarding(r.af.tableFamily == nftables.TableFamilyIPv6); err != nil {
-			log.Errorf("%v", err)
-		}
 	}
 
 	return nberrors.FormatErrorOrNil(merr)

client/grpc/dialer_generic.go

@@ -16,47 +16,28 @@ import (
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netsweep"
 )
 
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
-	return grpc.WithContextDialer(dialContext)
-}
-
-// WithSweeper dials like WithCustomDialer but registers connections and
-// dials with the sweeper. Append it after WithCustomDialer: gRPC applies
-// dial options in order, so the later context dialer wins.
-func WithSweeper(sweeper *netsweep.Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
-		dial := sweeper.StartDial(ctx)
-		defer dial.Release()
+		if runtime.GOOS == "linux" {
+			currentUser, err := user.Current()
+			if err != nil {
+				return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
+			}
 
-		conn, err := dialContext(dial.Ctx(), addr)
-		if err != nil {
-			return nil, err
+			// the custom dialer requires root permissions which are not required for use cases run as non-root
+			if currentUser.Uid != "0" {
+				log.Debug("Not running as root, using standard dialer")
+				dialer := &net.Dialer{}
+				return dialer.DialContext(ctx, "tcp", addr)
+			}
 		}
-		return dial.WrapConn(conn)
+
+		conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+		if err != nil {
+			return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+		}
+		return conn, nil
 	})
 }
-
-func dialContext(ctx context.Context, addr string) (net.Conn, error) {
-	if runtime.GOOS == "linux" {
-		currentUser, err := user.Current()
-		if err != nil {
-			return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
-		}
-
-		// the custom dialer requires root permissions which are not required for use cases run as non-root
-		if currentUser.Uid != "0" {
-			log.Debug("Not running as root, using standard dialer")
-			dialer := &net.Dialer{}
-			return dialer.DialContext(ctx, "tcp", addr)
-		}
-	}
-
-	conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
-	}
-	return conn, nil
-}

client/grpc/dialer_js.go

@@ -3,7 +3,6 @@ package grpc
 import (
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
@@ -12,8 +11,3 @@ import (
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 	return client.WithWebSocketDialer(tlsEnabled, component)
 }
-
-// WithSweeper is a no-op on WASM/JS: there is no network change signal.
-func WithSweeper(_ *netsweep.Sweeper) grpc.DialOption {
-	return grpc.EmptyDialOption{}
-}

client/grpc/retry.go

@@ -1,49 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// Retry mirrors backoff.Retry, but the sleep between attempts also wakes on
-// OS network availability transitions: an operation cut down by a network
-// change retries the moment the network settles instead of sleeping through
-// the recovery. A nil netState never fires, leaving plain backoff.Retry
-// behavior.
-func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, netState *netstate.State) error {
-	bo.Reset()
-	for {
-		err := operation()
-		if err == nil {
-			return nil
-		}
-
-		var permanent *backoff.PermanentError
-		if errors.As(err, &permanent) {
-			return permanent.Err
-		}
-
-		next := bo.NextBackOff()
-		if next == backoff.Stop {
-			if cerr := ctx.Err(); cerr != nil {
-				return cerr
-			}
-			return err
-		}
-
-		timer := time.NewTimer(next)
-		select {
-		case <-timer.C:
-		case <-netState.Changed():
-			timer.Stop()
-		case <-ctx.Done():
-			timer.Stop()
-			return ctx.Err()
-		}
-	}
-}

client/grpc/retry_test.go

@@ -1,91 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-func TestRetryWakesOnNetworkChange(t *testing.T) {
-	ns := netstate.New()
-	attempts := 0
-	operation := func() error {
-		attempts++
-		if attempts == 1 {
-			return errors.New("cut by network change")
-		}
-		return nil
-	}
-
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		ns.Set(false)
-	}()
-
-	start := time.Now()
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Minute), ns)
-
-	require.NoError(t, err)
-	assert.Equal(t, 2, attempts)
-	assert.Less(t, time.Since(start), time.Second, "the transition must cut the minute-long sleep short")
-}
-
-func TestRetryPermanentError(t *testing.T) {
-	sentinel := errors.New("permission denied")
-	operation := func() error {
-		return backoff.Permanent(sentinel)
-	}
-
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
-	assert.ErrorIs(t, err, sentinel)
-}
-
-func TestRetryNilNetState(t *testing.T) {
-	attempts := 0
-	operation := func() error {
-		attempts++
-		if attempts < 3 {
-			return errors.New("transient")
-		}
-		return nil
-	}
-
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
-	require.NoError(t, err)
-	assert.Equal(t, 3, attempts)
-}
-
-func TestRetryStops(t *testing.T) {
-	failure := errors.New("still failing")
-	operation := func() error {
-		return failure
-	}
-
-	err := Retry(context.Background(), operation, &backoff.StopBackOff{}, nil)
-	assert.ErrorIs(t, err, failure)
-}
-
-func TestRetryCtxCancelDuringSleep(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	operation := func() error {
-		return errors.New("failing")
-	}
-
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		cancel()
-	}()
-
-	start := time.Now()
-	err := Retry(ctx, operation, backoff.NewConstantBackOff(time.Minute), netstate.New())
-
-	assert.ErrorIs(t, err, context.Canceled)
-	assert.Less(t, time.Since(start), time.Second)
-}

client/installer.nsis

@@ -22,6 +22,8 @@
 !define UI_REG_APP_PATH "Software\Microsoft\Windows\CurrentVersion\App Paths\${UI_APP_EXE}"
 !define UI_UNINSTALL_PATH "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UI_APP_NAME}"
 
+!define AUTOSTART_REG_KEY "Software\Microsoft\Windows\CurrentVersion\Run"
+
 !define NETBIRD_DATA_DIR "$COMMONPROGRAMDATA\Netbird"
 
 Unicode True
@@ -226,6 +228,13 @@ WriteRegStr ${REG_ROOT} "${UNINSTALL_PATH}"  "Publisher" "${COMP_NAME}"
 
 WriteRegStr ${REG_ROOT} "${UI_REG_APP_PATH}" "" "$INSTDIR\${UI_APP_EXE}"
 
+; Autostart is owned by the UI's per-user setting (HKCU\...\Run via Wails),
+; not the installer. Drop the machine-wide entry older installers wrote so the
+; toggle is the single source of truth. HKCU is left untouched -- it may hold
+; the user's own toggle state, which must survive upgrades.
+DetailPrint "Removing installer-managed autostart registry entry if present..."
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+
 EnVar::SetHKLM
 EnVar::AddValueEx "path" "$INSTDIR"
 
@@ -290,6 +299,15 @@ ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service uninstall'
 DetailPrint "Terminating Netbird UI process..."
 ExecWait `taskkill /im ${UI_APP_EXE}.exe /f`
 
+; Remove autostart registry entries
+DetailPrint "Removing autostart registry entries if they exist..."
+; Legacy machine-wide entry written by older installers.
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+; Per-user entry the UI toggle writes via Wails (value name is the lowercase
+; app-name slug). Uninstall removes the app, so drop it too.
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "netbird"
+
 ; Handle data deletion based on checkbox
 DetailPrint "Checking if user requested data deletion..."
 ${If} $DeleteDataEnabled == "1"

client/internal/connect.go

@@ -38,8 +38,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -72,42 +70,18 @@ type ConnectClient struct {
 	updateManager *updater.Manager
 
 	persistSyncResponse bool
-
-	// netState gates every reconnection loop on OS-reported network
-	// availability. Nil (the default) disables gating; mobile platforms
-	// inject it via WithNetworkState.
-	netState *netstate.State
-
-	// sweeper cuts the management, signal and relay connections on network
-	// change; nil disables it.
-	sweeper *netsweep.Sweeper
-}
-
-// ConnectClientOption configures optional ConnectClient behavior.
-type ConnectClientOption func(*ConnectClient)
-
-// WithNetworkState injects the OS network availability state that gates every
-// reconnection loop; without it gating is disabled.
-func WithNetworkState(netState *netstate.State) ConnectClientOption {
-	return func(c *ConnectClient) { c.netState = netState }
-}
-
-// WithSweeper injects the network change sweeper.
-func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
-	return func(c *ConnectClient) { c.sweeper = sweeper }
 }
 
 func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
 	statusRecorder *peer.Status,
-	opts ...ConnectClientOption,
 ) *ConnectClient {
 	// Derive the run context here so Stop owns the cancel that unblocks the run
 	// loop. runCancel is set once at construction, so Stop can call it without
 	// racing the run loop's startup. Callers therefore need not cancel before Stop.
 	runCtx, runCancel := context.WithCancel(ctx)
-	c := &ConnectClient{
+	return &ConnectClient{
 		ctx:            runCtx,
 		runCancel:      runCancel,
 		runExited:      make(chan struct{}),
@@ -115,10 +89,6 @@ func NewConnectClient(
 		statusRecorder: statusRecorder,
 		engineMutex:    sync.Mutex{},
 	}
-	for _, opt := range opts {
-		opt(c)
-	}
-	return c
 }
 
 func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
@@ -304,13 +274,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return nil
 		}
 
-		// suspend connection attempts while the OS reports no usable network
-		if waited, err := c.netState.Wait(c.ctx); err != nil {
-			return nil
-		} else if waited {
-			backOff.Reset()
-		}
-
 		state.Set(StatusConnecting)
 
 		engineCtx, cancel := context.WithCancel(c.ctx)
@@ -322,8 +285,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
-		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
-			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
+		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled)
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -398,7 +360,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -434,8 +396,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			engineConfig.StateDir = filepath.Dir(path)
 		}
 
-		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
-			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
+		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU)
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -463,7 +424,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			NetState:       c.netState,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -520,16 +480,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	// status stream stuck at Connecting.
 	err = backoff.Retry(operation, backoff.WithContext(backOff, c.ctx))
 	if err != nil {
-		// Once the client context is cancelled backoff.WithContext surfaces the
-		// bare context error, and any attempt torn down mid-flight reports the
-		// same. That cancellation is the caller asking us to stop (Stop, Down or
-		// an engine restart), so exit cleanly instead of handing back a failure
-		// the caller would have to distinguish from a real one.
-		if c.ctx.Err() != nil && errors.Is(err, context.Canceled) {
-			log.Info("exiting client retry loop, context cancelled")
-			return nil
-		}
-
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
 		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
 			state.Set(StatusNeedsLogin)
@@ -723,7 +673,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -731,8 +681,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 		sigTLSEnabled = false
 	}
 
-	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
-		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
+	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled)
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)

client/internal/debug/debug.go

@@ -51,7 +51,6 @@ nftables.txt: Anonymized nftables rules with packet counters across all families
 sysctls.txt: Forwarding, reverse-path filter, source-validation, and conntrack accounting sysctl values that the NetBird client may read or modify, if --system-info flag was provided (Linux only).
 resolv.conf: DNS resolver configuration from /etc/resolv.conf (Unix systems only), if --system-info flag was provided.
 scutil_dns.txt: DNS configuration from scutil --dns (macOS only), if --system-info flag was provided.
-dns_windows.txt: Anonymized NRPT rules and policy table in effect, DNS client policy, and per-interface and per-adapter DNS configuration (Windows only), if --system-info flag was provided.
 resolved_domains.txt: Anonymized resolved domain IP addresses from the status recorder.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized sync response containing peer configurations, routes, DNS settings, and firewall rules.
@@ -238,13 +237,6 @@ scutil_dns.txt (macOS only):
 - Shows DNS configuration for all network interfaces
 - Includes search domains, nameservers, and DNS resolver settings
 - All IP addresses and domain names are anonymized
-
-dns_windows.txt (Windows only):
-- Lists the NRPT rules of both policy stores, the local one and the group policy one, marking the rules the client created
-- Follows them with the policy table the resolver has loaded, which differs from the rules while a change has not been picked up yet
-- Includes the DNS client group policy, the global TCP/IP and Dnscache parameters, and the DNS values of every interface that has any
-- Ends with the resolver configuration in effect per adapter, from GetAdaptersAddresses
-- All IP addresses and domain names are anonymized
 `
 
 const (

client/internal/debug/debug_linux.go

@@ -844,10 +844,6 @@ func collectSysctls() string {
 		[]string{"net.ipv4.conf.all.src_valid_mark", "net.ipv4.conf.default.src_valid_mark"},
 		listInterfaceSysctls("ipv4", "src_valid_mark")...,
 	))
-	writeSysctlGroup(&builder, "accept_ra", append(
-		[]string{"net.ipv6.conf.all.accept_ra", "net.ipv6.conf.default.accept_ra"},
-		listInterfaceSysctls("ipv6", "accept_ra")...,
-	))
 	writeSysctlGroup(&builder, "conntrack", []string{
 		"net.netfilter.nf_conntrack_acct",
 		"net.netfilter.nf_conntrack_tcp_loose",

client/internal/debug/debug_nonunix.go

@@ -1,4 +1,4 @@
-//go:build !unix && !windows
+//go:build !unix
 
 package debug
 

client/internal/debug/debug_windows.go

@@ -1,443 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"net/netip"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-	"golang.org/x/sys/windows/registry"
-
-	nbdns "github.com/netbirdio/netbird/client/internal/dns"
-)
-
-const dnsInfoFileName = "dns_windows.txt"
-
-const (
-	gpoDNSClientRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
-	tcpipParamsPath  = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters`
-	dnscacheParams   = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`
-)
-
-// interfaceDNSValues are the per-interface values that decide how a name is
-// resolved and registered. Everything the DNS host manager writes is in here,
-// so a bundle shows both what we set and what it replaced.
-var interfaceDNSValues = []string{
-	"NameServer",
-	"DhcpNameServer",
-	"Domain",
-	"DhcpDomain",
-	"SearchList",
-	"RegistrationEnabled",
-	"DisableDynamicUpdate",
-	"MaxNumberOfAddressesToRegister",
-	"EnableDHCP",
-}
-
-// addDNSInfo collects and adds DNS configuration information to the archive
-func (g *BundleGenerator) addDNSInfo() error {
-	if err := g.addFileToZip(strings.NewReader(g.collectDNSInfo()), dnsInfoFileName); err != nil {
-		return fmt.Errorf("add DNS info to zip: %w", err)
-	}
-
-	return nil
-}
-
-// collectDNSInfo renders the report. Everything below it reaches the platform
-// through COM and through lazily resolved procedures, which panic when a
-// procedure is missing rather than returning an error, and a debug bundle is not
-// allowed to take the daemon down. The panic is contained here, and whatever was
-// collected before it is kept and reported with it.
-func (g *BundleGenerator) collectDNSInfo() (content string) {
-	var sb strings.Builder
-
-	defer func() {
-		if r := recover(); r != nil {
-			log.Errorf("collecting Windows DNS configuration panicked: %v", r)
-			fmt.Fprintf(&sb, "\nerror: collection stopped: %v\n", r)
-		}
-		content = sb.String()
-	}()
-
-	sb.WriteString("Windows DNS configuration\n")
-	sb.WriteString("=========================\n")
-
-	adapters, adaptersErr := adapterAddresses()
-
-	g.writeNRPTRules(&sb, "NRPT rules, local policy store", nbdns.DNSPolicyConfigRoot)
-	g.writeNRPTRules(&sb, "NRPT rules, group policy store", nbdns.GPODNSPolicyConfigRoot)
-	g.writeEffectiveNRPTPolicies(&sb)
-	g.writeRegistryKey(&sb, "DNS client group policy", gpoDNSClientRoot)
-	g.writeRegistryKey(&sb, "Global TCP/IP parameters", tcpipParamsPath)
-	g.writeRegistryKey(&sb, "Dnscache parameters", dnscacheParams)
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv4", nbdns.InterfaceConfigPath, adapterNames(adapters))
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv6", nbdns.InterfaceConfigPathV6, adapterNames(adapters))
-	g.writeAdapterDNS(&sb, adapters, adaptersErr)
-
-	return sb.String()
-}
-
-// writeNRPTRules lists every rule in a policy store, ours and any other
-// product's, since a foreign rule for the same namespace decides resolution
-// just as ours does. Rules the client wrote are marked.
-func (g *BundleGenerator) writeNRPTRules(sb *strings.Builder, title, root string) {
-	writeSection(sb, title, root)
-
-	names, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(names) == 0 {
-		sb.WriteString("no rules\n")
-		return
-	}
-
-	for _, name := range names {
-		owner := ""
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(nbdns.NRPTKeyPrefix)) {
-			owner = "  (netbird)"
-		}
-		fmt.Fprintf(sb, "%s%s\n", name, owner)
-		g.writeValues(sb, root+`\`+name, nil, "  ")
-	}
-}
-
-// writeEffectiveNRPTPolicies reports the table the resolver answers from, which
-// the registry cannot show: a rule is written before it is loaded, and it keeps
-// being enforced after its key is gone until the resolver reloads its policy.
-func (g *BundleGenerator) writeEffectiveNRPTPolicies(sb *strings.Builder) {
-	writeSection(sb, "NRPT policy table in effect", nrptPolicyClass+"."+nrptPolicyMethod+" in "+nrptPolicyNamespace)
-
-	entries, err := effectiveNRPTPolicies()
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(entries) == 0 {
-		sb.WriteString("no policies\n")
-		return
-	}
-
-	for _, entry := range entries {
-		fmt.Fprintf(sb, "%s\n", g.anonymizeValue("Namespace", entry.namespace))
-		for _, value := range entry.values {
-			fmt.Fprintf(sb, "  %s: %s\n", value.name, g.anonymizeValue(value.name, value.value))
-		}
-	}
-}
-
-// writeInterfaceDNS reports the DNS values of every interface that has any, so
-// the netbird interface can be compared against the physical ones. The registry
-// keys the values by GUID, so each is named from the adapter list; a GUID with
-// no adapter is a leftover key of an interface that no longer exists.
-func (g *BundleGenerator) writeInterfaceDNS(sb *strings.Builder, title, root string, names map[string]string) {
-	writeSection(sb, title, root)
-
-	guids, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	var reported int
-	for _, guid := range guids {
-		var iface strings.Builder
-		g.writeValues(&iface, root+`\`+guid, interfaceDNSValues, "  ")
-		if iface.Len() == 0 {
-			continue
-		}
-
-		name, ok := names[strings.ToLower(guid)]
-		if !ok {
-			name = "no adapter with this GUID"
-		}
-
-		reported++
-		fmt.Fprintf(sb, "%s (%s)\n%s", guid, name, iface.String())
-	}
-
-	if reported == 0 {
-		sb.WriteString("no interface holds DNS values\n")
-	}
-}
-
-// writeRegistryKey reports the values of a single key, without its subkeys.
-func (g *BundleGenerator) writeRegistryKey(sb *strings.Builder, title, path string) {
-	writeSection(sb, title, path)
-
-	var values strings.Builder
-	g.writeValues(&values, path, nil, "")
-	if values.Len() == 0 {
-		sb.WriteString("no values\n")
-		return
-	}
-
-	sb.WriteString(values.String())
-}
-
-// writeValues renders the values of a key. A nil names list reports every
-// value, otherwise only those named and present.
-func (g *BundleGenerator) writeValues(sb *strings.Builder, path string, names []string, indent string) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, windows.ERROR_PATH_NOT_FOUND):
-		// an absent key is the normal state for the GPO store and for
-		// interfaces without DNS settings
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", path)
-		return
-	case err != nil:
-		fmt.Fprintf(sb, "%serror: open HKEY_LOCAL_MACHINE\\%s: %v\n", indent, path, err)
-		return
-	}
-	defer closeKey(k)
-
-	if names == nil {
-		names, err = k.ReadValueNames(-1)
-		if err != nil {
-			fmt.Fprintf(sb, "%serror: read value names: %v\n", indent, err)
-			return
-		}
-	}
-
-	for _, name := range names {
-		value, err := readRegistryValue(k, name)
-		switch {
-		case errors.Is(err, registry.ErrNotExist):
-			// the caller asks for a fixed set of values, most of which a
-			// given interface does not carry
-			continue
-		case err != nil:
-			// report rather than omit: a value that is there but cannot be
-			// read reads as unset otherwise
-			fmt.Fprintf(sb, "%s%s: error: %v\n", indent, name, err)
-			continue
-		}
-
-		fmt.Fprintf(sb, "%s%s: %s\n", indent, name, g.anonymizeValue(name, value))
-	}
-}
-
-// anonymizeValue redacts a registry value according to what its name says it
-// holds. Domains and addresses are handled per entry rather than by the string
-// pass: the pass only replaces domains something else in the bundle already
-// seeded, and its address regex would eat the digit labels of a reverse zone.
-func (g *BundleGenerator) anonymizeValue(name, value string) string {
-	if !g.anonymize || value == "" {
-		return value
-	}
-
-	switch {
-	case holdsDomains(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizeDomain)
-	case holdsAddresses(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizer.AnonymizeIPString)
-	default:
-		return g.anonymizer.AnonymizeString(value)
-	}
-}
-
-// holdsDomains reports whether a value name holds domains: the domain list of
-// an NRPT rule (Name) or of the policy table (Namespace), a search list, the
-// DNS suffix values of the TCP/IP and policy keys, which all end in "Domain"
-// (Domain, DhcpDomain, NV Domain, ICSDomain), and a proxy host name.
-func holdsDomains(name string) bool {
-	lower := strings.ToLower(name)
-	return lower == "name" || lower == "namespace" || lower == "searchlist" ||
-		strings.HasSuffix(lower, "domain") || strings.HasSuffix(lower, "proxyname")
-}
-
-// holdsAddresses reports whether a value name holds DNS server addresses
-// (NameServer, DhcpNameServer, GenericDNSServers, NameServers).
-func holdsAddresses(name string) bool {
-	lower := strings.ToLower(name)
-	return strings.Contains(lower, "nameserver") || strings.Contains(lower, "dnsserver")
-}
-
-// adapterNames maps adapter GUIDs, as the registry keys the interfaces, to the
-// names an operator sees.
-func adapterNames(adapters []*windows.IpAdapterAddresses) map[string]string {
-	names := make(map[string]string, len(adapters))
-	for _, adapter := range adapters {
-		guid := windows.BytePtrToString(adapter.AdapterName)
-		names[strings.ToLower(guid)] = windows.UTF16PtrToString(adapter.FriendlyName)
-	}
-	return names
-}
-
-// writeAdapterDNS reports the resolver configuration in effect per adapter,
-// which is what the resolver uses for a name no NRPT rule matches.
-func (g *BundleGenerator) writeAdapterDNS(sb *strings.Builder, adapters []*windows.IpAdapterAddresses, err error) {
-	writeSection(sb, "Adapter DNS configuration", "GetAdaptersAddresses")
-
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	for _, adapter := range adapters {
-		name := windows.UTF16PtrToString(adapter.FriendlyName)
-		suffix := g.anonymizeDomain(windows.UTF16PtrToString(adapter.DnsSuffix))
-
-		fmt.Fprintf(sb, "%s (index %d, oper status %d)\n", name, adapter.IfIndex, adapter.OperStatus)
-		fmt.Fprintf(sb, "  DNS suffix: %s\n", suffix)
-
-		var servers []string
-		for server := adapter.FirstDnsServerAddress; server != nil; server = server.Next {
-			addr, ok := netip.AddrFromSlice(server.Address.IP())
-			if !ok {
-				continue
-			}
-
-			addr = addr.Unmap()
-			if g.anonymize {
-				addr = g.anonymizer.AnonymizeIP(addr)
-			}
-			servers = append(servers, addr.String())
-		}
-
-		fmt.Fprintf(sb, "  DNS servers: %s\n", strings.Join(servers, ", "))
-	}
-}
-
-// anonymizeDomain anonymizes a single domain, keeping the leading dot an NRPT
-// match domain carries.
-func (g *BundleGenerator) anonymizeDomain(entry string) string {
-	if !g.anonymize {
-		return entry
-	}
-
-	domain, dot := strings.CutPrefix(entry, ".")
-	if domain == "" {
-		return entry
-	}
-
-	anonymized := g.anonymizer.AnonymizeDomain(domain)
-	if dot {
-		anonymized = "." + anonymized
-	}
-	return anonymized
-}
-
-// splitValueEntries splits a registry value that holds a list. The separator
-// differs per value: a REG_MULTI_SZ arrives joined with ", ", a SearchList is
-// comma separated and a NameServer may use commas or spaces.
-func splitValueEntries(value string) []string {
-	return strings.FieldsFunc(value, func(r rune) bool {
-		return r == ',' || r == ';' || r == ' ' || r == '\t'
-	})
-}
-
-func joinValueEntries(entries []string, anonymize func(string) string) string {
-	for i, entry := range entries {
-		entries[i] = anonymize(entry)
-	}
-	return strings.Join(entries, ", ")
-}
-
-func writeSection(sb *strings.Builder, title, source string) {
-	fmt.Fprintf(sb, "\n%s\n%s\n%s\n", title, strings.Repeat("-", len(title)), source)
-}
-
-func subKeyNames(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	if err != nil {
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closeKey(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	return names, nil
-}
-
-// readRegistryValue renders a value as text regardless of its type, so an
-// unexpected type in a policy key still shows up instead of being dropped.
-func readRegistryValue(k registry.Key, name string) (string, error) {
-	_, valueType, err := k.GetValue(name, nil)
-	if err != nil {
-		return "", fmt.Errorf("get value %s: %w", name, err)
-	}
-
-	switch valueType {
-	case registry.SZ, registry.EXPAND_SZ:
-		value, _, err := k.GetStringValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get string value %s: %w", name, err)
-		}
-		return value, nil
-	case registry.MULTI_SZ:
-		values, _, err := k.GetStringsValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get strings value %s: %w", name, err)
-		}
-		return strings.Join(values, ", "), nil
-	case registry.DWORD, registry.QWORD:
-		value, _, err := k.GetIntegerValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get integer value %s: %w", name, err)
-		}
-		return fmt.Sprintf("%d (0x%x)", value, value), nil
-	case registry.BINARY:
-		value, _, err := k.GetBinaryValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get binary value %s: %w", name, err)
-		}
-		return hex.EncodeToString(value), nil
-	default:
-		return fmt.Sprintf("<unhandled registry type %d>", valueType), nil
-	}
-}
-
-// adapterAddresses returns the adapter list including DNS servers. The call
-// reports the size it needs, so grow the buffer and retry until it fits.
-func adapterAddresses() (adapters []*windows.IpAdapterAddresses, err error) {
-	// GetAdaptersAddresses is resolved on first use and panics when it is
-	// missing, so this reports it as an error and leaves the rest of the
-	// report intact.
-	defer func() {
-		if r := recover(); r != nil {
-			adapters, err = nil, fmt.Errorf("GetAdaptersAddresses: %v", r)
-		}
-	}()
-
-	const flags = windows.GAA_FLAG_SKIP_ANYCAST | windows.GAA_FLAG_SKIP_MULTICAST
-
-	size := uint32(15000)
-	for range 3 {
-		buf := make([]byte, size)
-		first := (*windows.IpAdapterAddresses)(unsafe.Pointer(&buf[0]))
-
-		err := windows.GetAdaptersAddresses(windows.AF_UNSPEC, flags, 0, first, &size)
-		if errors.Is(err, windows.ERROR_BUFFER_OVERFLOW) {
-			continue
-		}
-		if err != nil {
-			return nil, fmt.Errorf("GetAdaptersAddresses: %w", err)
-		}
-
-		for adapter := first; adapter != nil; adapter = adapter.Next {
-			adapters = append(adapters, adapter)
-		}
-		return adapters, nil
-	}
-
-	return nil, fmt.Errorf("GetAdaptersAddresses: buffer kept growing")
-}
-
-func closeKey(k registry.Key) {
-	if err := k.Close(); err != nil {
-		log.Debugf("close registry key: %v", err)
-	}
-}

client/internal/debug/debug_windows_test.go

@@ -1,146 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/anonymize"
-)
-
-func newDNSValueGenerator(level anonymize.Level) *BundleGenerator {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(level)
-
-	return &BundleGenerator{
-		anonymize:      true,
-		anonymizeLevel: level,
-		anonymizer:     anonymizer,
-	}
-}
-
-// TestAnonymizeValueByName covers the value kinds of the DNS registry keys. The
-// names decide the treatment, because the string pass alone replaces only
-// domains another part of the bundle already seeded.
-func TestAnonymizeValueByName(t *testing.T) {
-	tests := []struct {
-		name      string
-		valueName string
-		value     string
-		assert    func(t *testing.T, got string)
-	}{
-		{
-			name:      "NRPT match domains keep the leading dot",
-			valueName: "Name",
-			value:     ".internal.example.com, .corp.example.org",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				for _, entry := range strings.Split(got, ", ") {
-					assert.True(t, strings.HasPrefix(entry, "."), "entry %q should keep its leading dot", entry)
-					assert.NotContains(t, entry, "example", "entry %q should not keep the original domain", entry)
-				}
-			},
-		},
-		{
-			name:      "any value name ending in Domain is treated as a domain",
-			valueName: "ICSDomain",
-			value:     "mshome.net",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "mshome", "should anonymize a domain suffix value")
-			},
-		},
-		{
-			name:      "search list is a comma separated domain list",
-			valueName: "SearchList",
-			value:     "corp.example.com,branch.example.com",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "example", "should anonymize every search domain")
-				assert.Len(t, strings.Split(got, ", "), 2, "should keep both search domains")
-			},
-		},
-		{
-			name:      "name servers are anonymized as addresses",
-			valueName: "DhcpNameServer",
-			value:     "203.0.113.10 8.8.8.8",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "203.0.113.10", "should anonymize a public resolver address")
-				// well-known resolvers stay readable at every level
-				assert.Contains(t, got, "8.8.8.8", "should keep a well-known resolver address")
-			},
-		},
-		{
-			name:      "opaque values are left to the string pass",
-			valueName: "DataBasePath",
-			value:     `%SystemRoot%\System32\drivers\etc`,
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.Equal(t, `%SystemRoot%\System32\drivers\etc`, got, "should not alter a path")
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			g := newDNSValueGenerator(anonymize.LevelDefault)
-			tc.assert(t, g.anonymizeValue(tc.valueName, tc.value))
-		})
-	}
-}
-
-// TestParseNRPTPolicyTable parses the MOF text of the policy table out
-// parameters, as the provider on a client with one NRPT rule renders it.
-func TestParseNRPTPolicyTable(t *testing.T) {
-	const text = `[abstract]
-class __PARAMETERS
-{
-	[Out, EmbeddedInstance("DnsClientPolicyConfiguration"): ToSubClass, ID(2): DisableOverride ToInstance] DnsClientPolicyConfiguration cmdletOutput[] = {
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	DirectAccessQueryIPsecRequired = FALSE;
-	NameEncoding = "Utf8WithoutMapping";
-	Namespace = ".0.100.in-addr.arpa";
-}, 
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	NameEncoding = "Utf8WithoutMapping";
-	NameServers = {"100.0.255.254", "100.0.255.253"};
-	Namespace = ".nb.internal";
-}};
-	[in] boolean Effective;
-	[out] uint32 ReturnValue = 0;
-};
-`
-
-	entries := parseNRPTPolicyTable(text)
-	require.Len(t, entries, 2, "should parse both embedded instances")
-
-	assert.Equal(t, ".0.100.in-addr.arpa", entries[0].namespace, "should read the namespace of the first instance")
-	assert.Equal(t, ".nb.internal", entries[1].namespace, "should read the namespace of the second instance")
-
-	assert.Equal(t, []registryValue{
-		{name: "DirectAccessProxyType", value: "NoProxy"},
-		{name: "DirectAccessQueryIPsecRequired", value: "FALSE"},
-		{name: "NameEncoding", value: "Utf8WithoutMapping"},
-	}, entries[0].values, "should keep the remaining values in order")
-
-	assert.Contains(t, entries[1].values, registryValue{name: "NameServers", value: "100.0.255.254, 100.0.255.253"},
-		"should flatten a MOF array")
-
-	for _, value := range entries[1].values {
-		assert.NotContains(t, value.name, "ReturnValue", "should not read the class level parameters as values")
-	}
-}
-
-func TestParseNRPTPolicyTableEmpty(t *testing.T) {
-	assert.Empty(t, parseNRPTPolicyTable(""), "should parse no entries from empty text")
-	assert.Empty(t, parseNRPTPolicyTable("class __PARAMETERS\n{\n};\n"), "should parse no entries from a table with no instances")
-}

client/internal/debug/nrpt_windows.go

@@ -1,317 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"errors"
-	"fmt"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/go-ole/go-ole"
-	"github.com/go-ole/go-ole/oleutil"
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// The NRPT policy table is reachable through the CIM class that backs
-	// Get-DnsClientNrptPolicy. Unlike the rules in the registry, the table is
-	// what the resolver currently has loaded, which is the only way to tell an
-	// applied rule from one that is merely written, in either direction.
-	nrptPolicyNamespace = `root\Microsoft\Windows\DNS`
-	nrptPolicyClass     = "PS_DnsClientNrptPolicy"
-	nrptPolicyMethod    = "Get"
-
-	// The class has no instances, so the table comes from the out parameters
-	// of a static method call, rendered as MOF text: the embedded instances
-	// arrive as a safe array of objects, which cannot be read back through the
-	// COM bindings, and the text form carries all of them.
-	nrptPolicyInstanceKeyword = "instance of DnsClientPolicyConfiguration"
-
-	nrptPolicyTimeout = 15 * time.Second
-)
-
-// COM initialization results that leave the calling thread usable: S_FALSE for
-// a thread this process already initialized, RPC_E_CHANGED_MODE for one that
-// belongs to another apartment.
-const (
-	sFalse          = 0x00000001
-	rpcEChangedMode = 0x80010106
-)
-
-// nrptQueryInFlight admits one read of the policy table at a time. A provider
-// that stops answering keeps its goroutine and the OS thread that goroutine
-// pinned, so a later bundle reports that instead of pinning another one.
-var nrptQueryInFlight = make(chan struct{}, 1)
-
-// nrptPolicyEntry is one namespace of the effective policy table, holding the
-// values of an embedded DnsClientPolicyConfiguration instance in the order the
-// provider reported them.
-type nrptPolicyEntry struct {
-	namespace string
-	values    []registryValue
-}
-
-// registryValue is a name and its rendered value, shared by the registry and
-// policy table readers so both anonymize by value name the same way.
-type registryValue struct {
-	name  string
-	value string
-}
-
-// effectiveNRPTPolicies reads the effective NRPT table. The call is bounded
-// because a WMI provider can block indefinitely and a debug bundle must not.
-func effectiveNRPTPolicies() ([]nrptPolicyEntry, error) {
-	type result struct {
-		text string
-		err  error
-	}
-
-	select {
-	case nrptQueryInFlight <- struct{}{}:
-	default:
-		return nil, errors.New("an earlier read of the policy table has not returned")
-	}
-
-	done := make(chan result, 1)
-	go func() {
-		// the slot is released here rather than by the caller, so a read that
-		// outlives the timeout holds it until the provider answers
-		defer func() { <-nrptQueryInFlight }()
-
-		text, err := nrptPolicyTableText()
-		done <- result{text: text, err: err}
-	}()
-
-	select {
-	case res := <-done:
-		if res.err != nil {
-			return nil, res.err
-		}
-		return parseNRPTPolicyTable(res.text), nil
-	case <-time.After(nrptPolicyTimeout):
-		return nil, errors.New("read of the policy table timed out")
-	}
-}
-
-// nrptPolicyTableText calls the policy table method and returns the MOF text of
-// its out parameters.
-func nrptPolicyTableText() (text string, err error) {
-	// COM is per thread, and the collection is short lived, so the thread is
-	// pinned for the duration rather than initialized for the process.
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	defer func() {
-		// The COM call chain is dynamically typed, so a provider that answers
-		// with an unexpected shape must not take the daemon down with it.
-		if r := recover(); r != nil {
-			err = fmt.Errorf("read NRPT policy table: %v", r)
-		}
-	}()
-
-	owns, err := coInitialize()
-	if err != nil {
-		return "", err
-	}
-	if owns {
-		defer ole.CoUninitialize()
-	}
-
-	locator, err := oleutil.CreateObject("WbemScripting.SWbemLocator")
-	if err != nil {
-		return "", fmt.Errorf("create WMI locator: %w", err)
-	}
-	defer locator.Release()
-
-	dispatch, err := locator.QueryInterface(ole.IID_IDispatch)
-	if err != nil {
-		return "", fmt.Errorf("query WMI locator interface: %w", err)
-	}
-	defer dispatch.Release()
-
-	service, err := dispatchCall(dispatch, "ConnectServer", nil, nrptPolicyNamespace)
-	if err != nil {
-		return "", fmt.Errorf("connect to %s: %w", nrptPolicyNamespace, err)
-	}
-	defer service.Release()
-
-	inParams, err := spawnMethodInParams(service)
-	if err != nil {
-		return "", err
-	}
-	defer inParams.Release()
-
-	// The effective table is the merge of the local and the group policy
-	// store, which is what the resolver answers from.
-	if _, err := oleutil.PutProperty(inParams, "Effective", true); err != nil {
-		return "", fmt.Errorf("set Effective parameter: %w", err)
-	}
-
-	outParams, err := dispatchCall(service, "ExecMethod", nrptPolicyClass, nrptPolicyMethod, inParams)
-	if err != nil {
-		return "", fmt.Errorf("call %s.%s: %w", nrptPolicyClass, nrptPolicyMethod, err)
-	}
-	defer outParams.Release()
-
-	textVariant, err := oleutil.CallMethod(outParams, "GetObjectText_")
-	if err != nil {
-		return "", fmt.Errorf("render policy table: %w", err)
-	}
-	defer func() {
-		if err := textVariant.Clear(); err != nil {
-			log.Debugf("clear policy table variant: %v", err)
-		}
-	}()
-
-	return textVariant.ToString(), nil
-}
-
-// spawnMethodInParams builds the in parameters instance the method needs. The
-// provider rejects the call without one, even when every parameter is optional.
-func spawnMethodInParams(service *ole.IDispatch) (*ole.IDispatch, error) {
-	class, err := dispatchCall(service, "Get", nrptPolicyClass)
-	if err != nil {
-		return nil, fmt.Errorf("get class %s: %w", nrptPolicyClass, err)
-	}
-	defer class.Release()
-
-	methods, err := dispatchProperty(class, "Methods_")
-	if err != nil {
-		return nil, fmt.Errorf("get class methods: %w", err)
-	}
-	defer methods.Release()
-
-	method, err := dispatchCall(methods, "Item", nrptPolicyMethod)
-	if err != nil {
-		return nil, fmt.Errorf("get method %s: %w", nrptPolicyMethod, err)
-	}
-	defer method.Release()
-
-	params, err := dispatchProperty(method, "InParameters")
-	if err != nil {
-		return nil, fmt.Errorf("get method parameters: %w", err)
-	}
-	defer params.Release()
-
-	inParams, err := dispatchCall(params, "SpawnInstance_")
-	if err != nil {
-		return nil, fmt.Errorf("spawn parameter instance: %w", err)
-	}
-
-	return inParams, nil
-}
-
-// parseNRPTPolicyTable pulls the embedded instances out of the MOF text. Each
-// instance is a namespace of the table, with one name and value per line.
-func parseNRPTPolicyTable(text string) []nrptPolicyEntry {
-	var entries []nrptPolicyEntry
-	var current *nrptPolicyEntry
-
-	for _, line := range strings.Split(text, "\n") {
-		line = strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(line), ";"))
-
-		switch {
-		case strings.HasPrefix(line, nrptPolicyInstanceKeyword):
-			entries = append(entries, nrptPolicyEntry{})
-			current = &entries[len(entries)-1]
-			continue
-		case strings.HasPrefix(line, "}"):
-			// closes an instance, and the array with the last one, so the
-			// class level parameters that follow are not read as values
-			current = nil
-			continue
-		case current == nil, line == "{":
-			continue
-		}
-
-		name, value, ok := strings.Cut(line, " = ")
-		if !ok {
-			continue
-		}
-
-		value = unquoteMOFValue(value)
-		if name == "Namespace" {
-			current.namespace = value
-			continue
-		}
-
-		current.values = append(current.values, registryValue{name: name, value: value})
-	}
-
-	return entries
-}
-
-// unquoteMOFValue renders a MOF scalar or array as plain text: "a" becomes a,
-// and {"a", "b"} becomes a, b.
-func unquoteMOFValue(value string) string {
-	value = strings.TrimSpace(value)
-
-	if inner, ok := strings.CutPrefix(value, "{"); ok {
-		value = strings.TrimSuffix(inner, "}")
-
-		entries := strings.Split(value, ",")
-		for i, entry := range entries {
-			entries[i] = strings.Trim(strings.TrimSpace(entry), `"`)
-		}
-		return strings.Join(entries, ", ")
-	}
-
-	return strings.Trim(value, `"`)
-}
-
-// coInitialize prepares the calling thread for COM and reports whether this
-// call owns the initialization, which decides whether it may be balanced with
-// CoUninitialize. S_FALSE took a reference on a thread this process had already
-// initialized and so has to be released, while RPC_E_CHANGED_MODE took none:
-// the thread belongs to another apartment, which is usable but is not ours to
-// uninitialize.
-func coInitialize() (bool, error) {
-	err := ole.CoInitializeEx(0, ole.COINIT_MULTITHREADED)
-	if err == nil {
-		return true, nil
-	}
-
-	var oleErr *ole.OleError
-	if errors.As(err, &oleErr) {
-		switch oleErr.Code() {
-		case sFalse:
-			return true, nil
-		case rpcEChangedMode:
-			return false, nil
-		}
-	}
-
-	return false, fmt.Errorf("initialize COM: %w", err)
-}
-
-// dispatchCall calls a COM method that returns an object.
-func dispatchCall(dispatch *ole.IDispatch, method string, params ...any) (*ole.IDispatch, error) {
-	variant, err := oleutil.CallMethod(dispatch, method, params...)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("%s returned no object", method)
-	}
-
-	return object, nil
-}
-
-// dispatchProperty reads a COM property that holds an object.
-func dispatchProperty(dispatch *ole.IDispatch, property string) (*ole.IDispatch, error) {
-	variant, err := oleutil.GetProperty(dispatch, property)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("property %s holds no object", property)
-	}
-
-	return object, nil
-}

client/internal/dns/host_darwin.go

@@ -267,38 +267,18 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 		return SystemDNSSettings{}, fmt.Errorf("sending the command: %w", err)
 	}
 
-	dnsSettings, serverAddresses, err := parseSystemDNSSettings(b)
-	if err != nil {
-		return dnsSettings, err
-	}
-
-	s.mu.Lock()
-	s.origNameservers = serverAddresses
-	s.mu.Unlock()
-
-	return dnsSettings, nil
-}
-
-// parseSystemDNSSettings parses the output of `scutil show State:/Network/Service/<id>/DNS`.
-// Lines that don't match the expected "index : value" shape are skipped: hosts with unusual
-// network services (e.g. orphaned hardware ports) can produce entries without a value.
-func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error) {
-	// port is not exposed by scutil, default to 53
-	dnsSettings := SystemDNSSettings{ServerPort: DefaultPort}
+	var dnsSettings SystemDNSSettings
 	var serverAddresses []netip.Addr
 	inSearchDomainsArray := false
 	inServerAddressesArray := false
 
-	scanner := bufio.NewScanner(bytes.NewReader(out))
+	scanner := bufio.NewScanner(bytes.NewReader(b))
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		switch {
 		case strings.HasPrefix(line, "DomainName :"):
-			domainName := strings.TrimSpace(strings.TrimPrefix(line, "DomainName :"))
-			if domainName != "" {
-				dnsSettings.Domains = append(dnsSettings.Domains, domainName)
-			}
-			continue
+			domainName := strings.TrimSpace(strings.Split(line, ":")[1])
+			dnsSettings.Domains = append(dnsSettings.Domains, domainName)
 		case line == "SearchDomains : <array> {":
 			inSearchDomainsArray = true
 			continue
@@ -308,45 +288,36 @@ func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error)
 		case line == "}":
 			inSearchDomainsArray = false
 			inServerAddressesArray = false
-			continue
-		}
-
-		if !inSearchDomainsArray && !inServerAddressesArray {
-			continue
-		}
-
-		parts := strings.SplitN(line, " : ", 2)
-		if len(parts) != 2 {
-			log.Debugf("skipping unexpected scutil DNS line %q", line)
-			continue
-		}
-		value := strings.TrimSpace(parts[1])
-		if value == "" {
-			continue
 		}
 
 		if inSearchDomainsArray {
-			dnsSettings.Domains = append(dnsSettings.Domains, value)
-			continue
-		}
-
-		ip, err := netip.ParseAddr(value)
-		if err != nil || ip.IsUnspecified() {
-			continue
-		}
-		ip = ip.Unmap()
-		serverAddresses = append(serverAddresses, ip)
-		// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
-		if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
-			dnsSettings.ServerIP = ip
+			searchDomain := strings.Split(line, " : ")[1]
+			dnsSettings.Domains = append(dnsSettings.Domains, searchDomain)
+		} else if inServerAddressesArray {
+			address := strings.Split(line, " : ")[1]
+			if ip, err := netip.ParseAddr(address); err == nil && !ip.IsUnspecified() {
+				ip = ip.Unmap()
+				serverAddresses = append(serverAddresses, ip)
+				// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
+				if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
+					dnsSettings.ServerIP = ip
+				}
+			}
 		}
 	}
 
 	if err := scanner.Err(); err != nil {
-		return dnsSettings, serverAddresses, err
+		return dnsSettings, err
 	}
 
-	return dnsSettings, serverAddresses, nil
+	// default to 53 port
+	dnsSettings.ServerPort = DefaultPort
+
+	s.mu.Lock()
+	s.origNameservers = serverAddresses
+	s.mu.Unlock()
+
+	return dnsSettings, nil
 }
 
 func (s *systemConfigurator) getOriginalNameservers() []netip.Addr {
@@ -464,15 +435,11 @@ func (s *systemConfigurator) getPrimaryService() (string, string, error) {
 	router := ""
 	for scanner.Scan() {
 		text := scanner.Text()
-		parts := strings.SplitN(text, ":", 2)
-		if len(parts) != 2 {
-			continue
-		}
 		if strings.Contains(text, "PrimaryService") {
-			primaryService = strings.TrimSpace(parts[1])
+			primaryService = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 		if strings.Contains(text, "Router") {
-			router = strings.TrimSpace(parts[1])
+			router = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 	}
 	if err := scanner.Err(); err != nil && err != io.EOF {

client/internal/dns/host_darwin_test.go

@@ -328,120 +328,6 @@ func removeTestDNSKey(key string) error {
 	return err
 }
 
-func TestParseSystemDNSSettings(t *testing.T) {
-	tests := []struct {
-		name            string
-		output          string
-		expectedDomains []string
-		expectedServers []netip.Addr
-		expectedIP      netip.Addr
-	}{
-		{
-			name: "well_formed",
-			output: `<dictionary> {
-  DomainName : example.com
-  SearchDomains : <array> {
-    0 : example.com
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-    1 : fd00::53
-  }
-}
-`,
-			expectedDomains: []string{"example.com", "example.com", "corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1"), netip.MustParseAddr("fd00::53")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			// entries without a value after the separator used to panic with
-			// "index out of range [1] with length 1"
-			name: "malformed_array_entries_skipped",
-			output: `<dictionary> {
-  SearchDomains : <array> {
-    0 :
-    (null)
-
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 :
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedDomains: []string{"corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "domain_name_without_value_skipped",
-			output: `<dictionary> {
-  DomainName :
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "ipv6_first_prefers_ipv4_server_ip",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : fd00::53
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("fd00::53"), netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "invalid_and_unspecified_addresses_skipped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : (null)
-    1 : 0.0.0.0
-    2 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "v4_mapped_address_unmapped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : ::ffff:192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name:   "empty_output",
-			output: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			settings, servers, err := parseSystemDNSSettings([]byte(tc.output))
-			require.NoError(t, err, "parsing should not fail")
-
-			assert.Equal(t, tc.expectedDomains, settings.Domains, "domains should match")
-			assert.Equal(t, tc.expectedServers, servers, "server addresses should match")
-			assert.Equal(t, tc.expectedIP, settings.ServerIP, "server IP should match")
-			assert.Equal(t, DefaultPort, settings.ServerPort, "server port should default to 53")
-		})
-	}
-}
-
 func TestGetOriginalNameservers(t *testing.T) {
 	configurator := &systemConfigurator{
 		createdKeys: make(map[string]struct{}),

client/internal/dns/host_windows.go

@@ -31,30 +31,10 @@ var (
 	dnsFlushResolverCacheFn = dnsapi.NewProc("DnsFlushResolverCache")
 )
 
-// Registry locations of the host DNS configuration this package programs,
-// exported so a diagnostic reader reports the same locations that are written.
 const (
-	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
-	// Older versions used different layouts under the same prefix: a single
-	// unsuffixed key, then one key per domain, now one key per batch of domains.
-	NRPTKeyPrefix = "NetBird-Match"
-
-	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
-	DNSPolicyConfigRoot = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
-
-	// GPODNSPolicyConfigRoot holds the NRPT rules of the group policy store,
-	// which takes precedence over the local one when it is present.
-	GPODNSPolicyConfigRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
-
-	// InterfaceConfigPath and InterfaceConfigPathV6 hold the per-interface DNS
-	// settings, keyed by interface GUID, in separate hives per address family.
-	InterfaceConfigPath   = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	InterfaceConfigPathV6 = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
-)
-
-const (
-	dnsPolicyConfigMatchPath    = DNSPolicyConfigRoot + `\` + NRPTKeyPrefix
-	gpoDnsPolicyConfigMatchPath = GPODNSPolicyConfigRoot + `\` + NRPTKeyPrefix
+	dnsPolicyConfigMatchPath    = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match`
+	gpoDnsPolicyRoot            = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+	gpoDnsPolicyConfigMatchPath = gpoDnsPolicyRoot + `\NetBird-Match`
 
 	dnsPolicyConfigVersionKey           = "Version"
 	dnsPolicyConfigVersionValue         = 2
@@ -65,6 +45,8 @@ const (
 
 	nrptMaxDomainsPerRule = 50
 
+	interfaceConfigPath           = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
+	interfaceConfigPathV6         = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
 	interfaceConfigNameServerKey  = "NameServer"
 	interfaceConfigDhcpNameSrvKey = "DhcpNameServer"
 	interfaceConfigSearchListKey  = "SearchList"
@@ -91,6 +73,7 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
+	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -101,7 +84,7 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 	}
 
 	var useGPO bool
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.QUERY_VALUE)
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, gpoDnsPolicyRoot, registry.QUERY_VALUE)
 	if err != nil {
 		log.Debugf("failed to open GPO DNS policy root: %v", err)
 	} else {
@@ -140,7 +123,7 @@ func (r *registryConfigurator) captureOriginalNameservers() ([]netip.Addr, error
 	seen := make(map[netip.Addr]struct{})
 	var out []netip.Addr
 	var merr *multierror.Error
-	for _, root := range []string{InterfaceConfigPath, InterfaceConfigPathV6} {
+	for _, root := range []string{interfaceConfigPath, interfaceConfigPathV6} {
 		addrs, err := r.captureFromTcpipRoot(root)
 		if err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("%s: %w", root, err))
@@ -323,9 +306,14 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	}
 
 	if len(matchDomains) != 0 {
-		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
+		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
+		// Update count even on error to ensure cleanup covers partially created rules
+		r.nrptEntryCount = count
+		if err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
+	} else {
+		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -341,8 +329,9 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid: r.guid,
-		GPO:  r.gpo,
+		Guid:           r.guid,
+		GPO:            r.gpo,
+		NRPTEntryCount: r.nrptEntryCount,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -357,7 +346,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -374,17 +363,19 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
+		// Increment immediately so the caller's cleanup path knows about this rule
+		ruleIndex++
+
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
+				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
-		ruleIndex++
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
 	}
 
 	if r.gpo {
@@ -394,7 +385,7 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return nil
+	return ruleIndex, nil
 }
 
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
@@ -505,7 +496,7 @@ func (r *registryConfigurator) deleteInterfaceRegistryKeyProperty(propertyKey st
 }
 
 func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
-	regKeyPath := InterfaceConfigPath + "\\" + r.guid
+	regKeyPath := interfaceConfigPath + "\\" + r.guid
 	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.SET_VALUE)
 	if err != nil {
 		return regKey, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", regKeyPath, err)
@@ -527,28 +518,28 @@ func (r *registryConfigurator) restoreHostDNS() error {
 	return nil
 }
 
-// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
-// from the local and the GPO policy store. The rules are found by enumerating
-// the registry, the only authoritative record of what was written. Cleanup must
-// not depend on a rule count: the in-memory one is scoped to a single
-// registryConfigurator and the persisted one is deleted on every clean
-// disconnect, and a rule left behind keeps resolving names over an interface
-// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
-		names, err := listNRPTRuleKeys(root)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
-			continue
+	// Try to remove the base entries (for backward compatibility)
+	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
+	}
+
+	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
+	}
+
+	for i := 0; i < r.nrptEntryCount; i++ {
+		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
+		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
+
+		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
 		}
 
-		for _, name := range names {
-			path := root + `\` + name
-			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
-			}
+		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
 		}
 	}
 
@@ -563,39 +554,6 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
-// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
-// root. An absent root holds nothing to clean up, which is the normal state of
-// the GPO store on a machine without DNS Client policy.
-func listNRPTRuleKeys(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
-		// the GPO store is absent on a machine without DNS client policy
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
-		return nil, nil
-	case err != nil:
-		// any other failure has to reach the caller: reporting no rules would
-		// report a successful cleanup while leaving the rules in place
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closer(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	var ruleKeys []string
-	for _, name := range names {
-		// registry key names are case insensitive
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
-			ruleKeys = append(ruleKeys, name)
-		}
-	}
-
-	return ruleKeys, nil
-}
-
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
 	if err != nil {

client/internal/dns/host_windows_test.go

@@ -25,7 +25,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +56,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +81,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -106,65 +106,9 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
-// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
-// are removed by a configurator that has no record of how many there are: an
-// unclean exit loses the in-memory count and a clean disconnect deletes the
-// persisted one, so cleanup cannot depend on either.
-func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping registry integration test in short mode")
-	}
-
-	defer cleanupRegistryKeys(t)
-	cleanupRegistryKeys(t)
-
-	testIP := netip.MustParseAddr("100.64.0.1")
-
-	// 75 domains produce two indexed rules, as the current layout does
-	domains := make([]string, 75)
-	for i := range domains {
-		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
-	}
-
-	previousRun := &registryConfigurator{}
-	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
-
-	// the unsuffixed key an older version would have written
-	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
-
-	// a policy owned by someone else, which cleanup must not touch
-	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
-	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
-	require.NoError(t, err, "Should create foreign policy key")
-	foreignKey.Close()
-	defer func() {
-		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
-	}()
-
-	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
-
-	// a configurator that never applied a DNS config, as one built after a
-	// restart or from a shutdown state without a count is
-	freshRun := &registryConfigurator{}
-	require.NoError(t, freshRun.removeDNSMatchPolicies())
-
-	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
-
-	exists, err := registryKeyExists(foreignPath)
-	require.NoError(t, err)
-	assert.True(t, exists, "Should not remove a policy that is not ours")
-}
-
-func countNRPTRuleKeys(t *testing.T) int {
-	t.Helper()
-
-	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
-	require.NoError(t, err, "Should list NRPT rule keys")
-	return len(names)
-}
-
 func cleanupRegistryKeys(*testing.T) {
-	cfg := &registryConfigurator{}
+	// Clean up more entries to account for batching tests with many domains
+	cfg := &registryConfigurator{nrptEntryCount: 20}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -181,7 +125,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -249,7 +193,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
+			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist

client/internal/dns/unclean_shutdown_windows.go

@@ -5,8 +5,9 @@ import (
 )
 
 type ShutdownState struct {
-	Guid string
-	GPO  bool
+	Guid           string
+	GPO            bool
+	NRPTEntryCount int
 }
 
 func (s *ShutdownState) Name() string {
@@ -15,8 +16,9 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid: s.Guid,
-		gpo:  s.GPO,
+		guid:           s.Guid,
+		gpo:            s.GPO,
+		nrptEntryCount: s.NRPTEntryCount,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {

client/internal/ebpf/ebpf/manager_linux.go

@@ -2,21 +2,17 @@ package ebpf
 
 import (
 	_ "embed"
-	"fmt"
 	"net"
 	"sync"
 
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/rlimit"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
-	xdpProgName = "nb_xdp_prog"
-
 	mapKeyFeatures uint32 = 0
 
 	featureFlagWGProxy      = 0b00000001
@@ -72,50 +68,21 @@ func (tf *GeneralManager) loadXdp() error {
 		return err
 	}
 
-	// lo has no native XDP, so the program runs in generic mode. Unless it
-	// declares multi-buffer support the kernel must linearize every non-linear
-	// skb before running it. Loopback packets are up to 64 KB, so that is a
-	// contiguous GFP_ATOMIC allocation per packet, and when it fails the packet
-	// is dropped before the program runs, stalling local TCP connections.
-	// Multi-buffer XDP in generic mode requires kernel 6.3, so fall back to a
-	// plain attach when the kernel rejects it.
-	err = tf.attachXdp(iFace.Index, true)
-	if err == nil {
-		return nil
-	}
-	log.Debugf("failed to attach multi-buffer xdp program, retrying without it: %s", err)
-
-	return tf.attachXdp(iFace.Index, false)
-}
-
-func (tf *GeneralManager) attachXdp(iFaceIndex int, multiBuffer bool) error {
-	spec, err := loadBpf()
+	// load pre-compiled programs into the kernel.
+	err = loadBpfObjects(&tf.bpfObjs, nil)
 	if err != nil {
-		return fmt.Errorf("load bpf spec: %w", err)
-	}
-
-	if multiBuffer {
-		prog, ok := spec.Programs[xdpProgName]
-		if !ok {
-			return fmt.Errorf("program %s not found in bpf spec", xdpProgName)
-		}
-		prog.Flags |= unix.BPF_F_XDP_HAS_FRAGS
-	}
-
-	if err := spec.LoadAndAssign(&tf.bpfObjs, nil); err != nil {
-		return fmt.Errorf("load bpf objects: %w", err)
+		return err
 	}
 
 	tf.link, err = link.AttachXDP(link.XDPOptions{
 		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFaceIndex,
+		Interface: iFace.Index,
 	})
+
 	if err != nil {
-		if closeErr := tf.bpfObjs.Close(); closeErr != nil {
-			log.Debugf("failed to close bpf objects after xdp attach error: %s", closeErr)
-		}
+		_ = tf.bpfObjs.Close()
 		tf.link = nil
-		return fmt.Errorf("attach xdp: %w", err)
+		return err
 	}
 	return nil
 }

client/internal/engine.go

@@ -59,7 +59,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
-	"github.com/netbirdio/netbird/client/netstate"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -182,9 +181,6 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
-	// NetState gates the reconnection loops on OS-reported network
-	// availability; nil disables gating.
-	NetState *netstate.State
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -208,10 +204,6 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency
 
-	// netState gates the peer reconnection guards on OS-reported network
-	// availability; nil disables gating.
-	netState *netstate.State
-
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
 	// TURNs is a list of STUN servers used by ICE
@@ -345,7 +337,6 @@ func NewEngine(
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
-		netState:           services.NetState,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -1902,8 +1893,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
-		ICEConfig:    e.createICEConfig(),
-		NetworkState: e.netState,
+		ICEConfig: e.createICEConfig(),
 	}
 
 	serviceDependencies := peer.ServiceDependencies{

client/internal/peer/conn.go

@@ -26,7 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/netstate"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -94,10 +93,6 @@ type ConnConfig struct {
 
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
-
-	// NetworkState gates the reconnection guard on OS-reported network
-	// availability; nil disables gating.
-	NetworkState *netstate.State
 }
 
 type Conn struct {
@@ -259,7 +254,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}
 
-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetworkState)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher)
 
 	conn.wg.Add(1)
 	go func() {

client/internal/peer/guard/guard.go

@@ -6,8 +6,6 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // ConnStatus represents the connection state as seen by the guard.
@@ -33,26 +31,20 @@ type connStatusFunc func() ConnStatus
 // - Relayed connection disconnected
 // - ICE candidate changes
 type Guard struct {
-	log                 *log.Entry
-	isConnectedOnAllWay connStatusFunc
-	timeout             time.Duration
-	srWatcher           *SRWatcher
-	// netState gates reconnect attempts on OS-reported network availability;
-	// nil disables gating.
-	netState                *netstate.State
+	log                     *log.Entry
+	isConnectedOnAllWay     connStatusFunc
+	timeout                 time.Duration
+	srWatcher               *SRWatcher
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
-// NewGuard creates a reconnection guard for a peer connection. A nil netState
-// disables network availability gating.
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
-		netState:                netState,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -104,16 +96,9 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
-	netChanged := g.netState.Changed()
-
 	for {
 		select {
 		case <-tickerChannel:
-			// skip attempts while the OS reports no usable network; the
-			// netChanged case below resumes the loop once it returns
-			if !g.netState.IsOnline() {
-				continue
-			}
 			switch g.isConnectedOnAllWay() {
 			case ConnStatusConnected:
 				// all good, nothing to do
@@ -150,23 +135,6 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 			tickerChannel = ticker.C
 			iceState.reset()
 
-		case <-netChanged:
-			// Re-arm for the next transition before acting on this one.
-			netChanged = g.netState.Changed()
-			if !g.netState.IsOnline() {
-				continue
-			}
-			// Ticks skipped while offline drove the backoff towards its
-			// maximum without ever attempting, and left the ICE budget
-			// frozen — possibly in hourly mode. Recover on our own so the
-			// peer does not depend on a signal or relay event that never
-			// comes when both stayed up across the outage.
-			g.log.Debugf("network is back, reset reconnection ticker")
-			ticker.Stop()
-			ticker = g.newReconnectTicker(ctx)
-			tickerChannel = ticker.C
-			iceState.reset()
-
 		case <-ctx.Done():
 			g.log.Debugf("context is done, stop reconnect loop")
 			return

client/internal/peer/guard/guard_leak_test.go

@@ -15,7 +15,7 @@ import (
 
 func newTestGuard(status connStatusFunc) *Guard {
 	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw, nil)
+	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw)
 }
 
 // countBackoffTickerGoroutines returns how many goroutines are currently sitting

client/internal/peer/guard/guard_netstate_test.go

@@ -1,107 +0,0 @@
-package guard
-
-import (
-	"context"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// newTestGuardWithNetState builds a guard with a realistic MaxInterval: the
-// backoff must be able to grow well past the outage, as it does in production
-// where the timeout is seconds to minutes.
-func newTestGuardWithNetState(status connStatusFunc, netState *netstate.State) *Guard {
-	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 30*time.Second, srw, netState)
-}
-
-// TestGuard_RecoversAfterOfflineToOnline covers a peer that stays disconnected
-// across a network outage while neither signal nor relay reports an event —
-// both stayed up, as on a short airplane mode toggle over Wi-Fi.
-//
-// Every tick taken while offline is skipped, but it still advances the
-// exponential backoff, so by the time the network returns the next tick can be
-// tens of seconds away. Without an explicit reaction to the transition the
-// peer waits out that interval for a recovery that could start immediately.
-func TestGuard_RecoversAfterOfflineToOnline(t *testing.T) {
-	netState := netstate.New()
-
-	var attempts atomic.Int32
-	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	// Start from the reconnect ticker (800ms initial interval), the state a
-	// peer is in after it loses its connection.
-	go g.Start(ctx, func() { attempts.Add(1) })
-	g.SetRelayedConnDisconnected()
-
-	// Let the backoff climb: 0.8s, 1.6s, 3.2s, 6.4s ... every tick is skipped
-	// while offline, but each one doubles the wait for the next.
-	netState.Set(false)
-	time.Sleep(8 * time.Second)
-
-	offlineAttempts := attempts.Load()
-	if offlineAttempts != 0 {
-		t.Fatalf("callback ran %d times while offline, want 0", offlineAttempts)
-	}
-
-	netState.Set(true)
-
-	// The next organic tick is now several seconds out, so anything within
-	// this window can only come from reacting to the transition itself.
-	pollCtx, stopPolling := context.WithTimeout(ctx, 2*time.Second)
-	defer stopPolling()
-
-	select {
-	case <-pollCtx.Done():
-		t.Fatal("peer was not retried within 2s of the network coming back, " +
-			"with neither a signal nor a relay event to fall back on")
-	case <-pollUntil(pollCtx, func() bool { return attempts.Load() > 0 }):
-	}
-}
-
-// TestGuard_OfflineTransitionDoesNotRetry checks the other direction: going
-// offline must not itself trigger an attempt.
-func TestGuard_OfflineTransitionDoesNotRetry(t *testing.T) {
-	netState := netstate.New()
-
-	var attempts atomic.Int32
-	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go g.Start(ctx, func() { attempts.Add(1) })
-
-	netState.Set(false)
-	time.Sleep(5 * time.Second)
-
-	if got := attempts.Load(); got != 0 {
-		t.Fatalf("callback ran %d times after going offline, want 0", got)
-	}
-}
-
-// pollUntil closes the returned channel once cond holds. It gives up when ctx
-// is done, so the polling goroutine never outlives the test that started it.
-func pollUntil(ctx context.Context, cond func() bool) <-chan struct{} {
-	done := make(chan struct{})
-	go func() {
-		for {
-			if cond() {
-				close(done)
-				return
-			}
-			select {
-			case <-ctx.Done():
-				return
-			case <-time.After(10 * time.Millisecond):
-			}
-		}
-	}()
-	return done
-}

client/internal/peer/listener.go

@@ -1,40 +1,11 @@
 package peer
 
-// ClientState identifies the client connection state delivered via
-// Listener.OnStateChanged.
-type ClientState int
-
-// Client states. The numeric values cross the gomobile boundary (the mobile
-// bindings re-export them as integer constants), so they are a wire format:
-// append new states at the end, never reorder or insert.
-const (
-	ClientStateDisconnected ClientState = iota
-	ClientStateConnected
-	ClientStateConnecting
-	ClientStateDisconnecting
-	// ClientStateNoNetwork is an overlay state: it is never stored as the
-	// last notification, only derived from ClientStateConnecting while the
-	// OS reports no usable network (see notifier.effectiveState).
-	ClientStateNoNetwork
-)
-
 // Listener is a callback type about the NetBird network connection state
 type Listener interface {
-	// OnStateChanged reports every client state transition. New states are
-	// delivered only through this callback; the per-state callbacks below
-	// are kept for compatibility and will be removed once all consumers
-	// have migrated.
-	OnStateChanged(state ClientState)
-
-	// Deprecated: consume OnStateChanged instead.
 	OnConnected()
-	// Deprecated: consume OnStateChanged instead.
 	OnDisconnected()
-	// Deprecated: consume OnStateChanged instead.
 	OnConnecting()
-	// Deprecated: consume OnStateChanged instead.
 	OnDisconnecting()
-
 	OnAddressChanged(string, string)
 	OnPeersListChanged(int)
 }

client/internal/peer/notifier.go

@@ -4,64 +4,31 @@ import (
 	"sync"
 )
 
+const (
+	stateDisconnected = iota
+	stateConnected
+	stateConnecting
+	stateDisconnecting
+)
+
 type notifier struct {
-	// publishLock orders state publication: it is held across computing the
-	// effective state and handing it to the listener, so a transition cannot
-	// overtake a newer one and leave the listener on a stale state.
-	publishLock        sync.Mutex
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
 	currentClientState bool
-	lastNotification   ClientState
+	lastNotification   int
 	lastNumberOfPeers  int
 	lastFqdnAddress    string
 	lastIPAddress      string
-	networkAvailable   bool
 }
 
 func newNotifier() *notifier {
-	return &notifier{
-		networkAvailable: true,
-	}
-}
-
-// effectiveState maps the computed state to what listeners should see:
-// while the OS reports no usable network, "Connecting" would be a lie —
-// connection attempts are suspended — so it is reported as NoNetwork.
-// Caller must hold serverStateLock.
-func (n *notifier) effectiveState(state ClientState) ClientState {
-	if !n.networkAvailable && state == ClientStateConnecting {
-		return ClientStateNoNetwork
-	}
-	return state
-}
-
-// setNetworkAvailable records the OS network availability and re-notifies
-// the listener when the flag flips the effective state (Connecting <->
-// NoNetwork).
-func (n *notifier) setNetworkAvailable(available bool) {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
-	n.serverStateLock.Lock()
-	if n.networkAvailable == available {
-		n.serverStateLock.Unlock()
-		return
-	}
-	previous := n.effectiveState(n.lastNotification)
-	n.networkAvailable = available
-	current := n.effectiveState(n.lastNotification)
-	n.serverStateLock.Unlock()
-
-	if previous != current {
-		n.notify(current)
-	}
+	return &notifier{}
 }
 
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
-	lastNotification := n.effectiveState(n.lastNotification)
+	lastNotification := n.lastNotification
 	numOfPeers := n.lastNumberOfPeers
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
@@ -85,9 +52,6 @@ func (n *notifier) removeListener() {
 }
 
 func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	calculatedState := n.calculateState(mgmState, signalState)
 
@@ -97,54 +61,43 @@ func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
 	}
 
 	n.lastNotification = calculatedState
-	effective := n.effectiveState(calculatedState)
 	n.serverStateLock.Unlock()
 
-	n.notify(effective)
+	n.notify(calculatedState)
 }
 
 func (n *notifier) clientStart() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = true
-	n.lastNotification = ClientStateConnecting
-	effective := n.effectiveState(ClientStateConnecting)
+	n.lastNotification = stateConnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(effective)
+	n.notify(stateConnecting)
 }
 
 func (n *notifier) clientStop() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = ClientStateDisconnected
+	n.lastNotification = stateDisconnected
 	n.serverStateLock.Unlock()
 
-	n.notify(ClientStateDisconnected)
+	n.notify(stateDisconnected)
 }
 
 func (n *notifier) clientTearDown() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = ClientStateDisconnecting
+	n.lastNotification = stateDisconnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(ClientStateDisconnecting)
+	n.notify(stateDisconnecting)
 }
 
-func (n *notifier) isServerStateChanged(newState ClientState) bool {
+func (n *notifier) isServerStateChanged(newState int) bool {
 	return n.lastNotification != newState
 }
 
-func (n *notifier) notify(state ClientState) {
+func (n *notifier) notify(state int) {
 	n.listenersLock.Lock()
 	listener := n.listener
 	n.listenersLock.Unlock()
@@ -156,20 +109,20 @@ func (n *notifier) notify(state ClientState) {
 	notifyListener(listener, state)
 }
 
-func (n *notifier) calculateState(managementConn, signalConn bool) ClientState {
+func (n *notifier) calculateState(managementConn, signalConn bool) int {
 	if managementConn && signalConn {
-		return ClientStateConnected
+		return stateConnected
 	}
 
 	if !managementConn && !signalConn && !n.currentClientState {
-		return ClientStateDisconnected
+		return stateDisconnected
 	}
 
-	if n.lastNotification == ClientStateDisconnecting {
-		return ClientStateDisconnecting
+	if n.lastNotification == stateDisconnecting {
+		return stateDisconnecting
 	}
 
-	return ClientStateConnecting
+	return stateConnecting
 }
 
 func (n *notifier) peerListChanged(numOfPeers int) {
@@ -206,19 +159,15 @@ func (n *notifier) localAddressChanged(fqdn, address string) {
 	listener.OnAddressChanged(fqdn, address)
 }
 
-func notifyListener(l Listener, state ClientState) {
-	// legacy per-state callbacks; NoNetwork is delivered only via
-	// OnStateChanged below
+func notifyListener(l Listener, state int) {
 	switch state {
-	case ClientStateDisconnected:
+	case stateDisconnected:
 		l.OnDisconnected()
-	case ClientStateConnected:
+	case stateConnected:
 		l.OnConnected()
-	case ClientStateConnecting:
+	case stateConnecting:
 		l.OnConnecting()
-	case ClientStateDisconnecting:
+	case stateDisconnecting:
 		l.OnDisconnecting()
 	}
-
-	l.OnStateChanged(state)
 }

client/internal/peer/notifier_concurrent_test.go

@@ -1,108 +0,0 @@
-package peer
-
-import (
-	"sync"
-	"testing"
-	"time"
-)
-
-type recordingListener struct {
-	mu      sync.Mutex
-	states  []ClientState
-	onState func(ClientState)
-}
-
-func (l *recordingListener) OnStateChanged(state ClientState) {
-	l.mu.Lock()
-	l.states = append(l.states, state)
-	hook := l.onState
-	l.mu.Unlock()
-
-	if hook != nil {
-		hook(state)
-	}
-}
-
-func (l *recordingListener) last() (ClientState, bool) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	if len(l.states) == 0 {
-		return 0, false
-	}
-	return l.states[len(l.states)-1], true
-}
-
-func (l *recordingListener) snapshot() []ClientState {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return append([]ClientState(nil), l.states...)
-}
-
-func (l *recordingListener) OnConnected()                    {}
-func (l *recordingListener) OnDisconnected()                 {}
-func (l *recordingListener) OnConnecting()                   {}
-func (l *recordingListener) OnDisconnecting()                {}
-func (l *recordingListener) OnAddressChanged(string, string) {}
-func (l *recordingListener) OnPeersListChanged(int)          {}
-
-// TestNotifier_ConcurrentAvailabilityFlipOrdersPublication holds the first
-// transition inside the listener callback and flips availability again from
-// another goroutine while it is parked. The second flip must not publish
-// ahead of the one in flight, otherwise the listener ends up on a state the
-// notifier already superseded.
-func TestNotifier_ConcurrentAvailabilityFlipOrdersPublication(t *testing.T) {
-	n := newNotifier()
-	n.currentClientState = true
-	n.lastNotification = ClientStateConnecting
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	l := &recordingListener{}
-	l.onState = func(state ClientState) {
-		if state != ClientStateNoNetwork {
-			return
-		}
-		l.mu.Lock()
-		l.onState = nil
-		l.mu.Unlock()
-		close(entered)
-		<-release
-	}
-	n.listener = l
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		n.setNetworkAvailable(false)
-	}()
-
-	<-entered
-
-	flipped := make(chan struct{})
-	go func() {
-		defer close(flipped)
-		n.setNetworkAvailable(true)
-	}()
-
-	select {
-	case <-flipped:
-		t.Fatal("the online transition published while the offline one was " +
-			"still in flight; publication is not serialized")
-	case <-time.After(200 * time.Millisecond):
-	}
-
-	close(release)
-	<-flipped
-	wg.Wait()
-
-	got, ok := l.last()
-	if !ok {
-		t.Fatal("listener never observed a state")
-	}
-	if got != ClientStateConnecting {
-		t.Fatalf("listener holds %v after the network came back, want Connecting; sequence: %v",
-			got, l.snapshot())
-	}
-}

client/internal/peer/notifier_test.go

@@ -6,32 +6,29 @@ import (
 )
 
 type mocListener struct {
-	lastState ClientState
+	lastState int
 	wg        sync.WaitGroup
 	peersWg   sync.WaitGroup
 	peers     int
 }
 
 func (l *mocListener) OnConnected() {
-	l.lastState = ClientStateConnected
+	l.lastState = stateConnected
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnected() {
-	l.lastState = ClientStateDisconnected
+	l.lastState = stateDisconnected
 	l.wg.Done()
 }
 func (l *mocListener) OnConnecting() {
-	l.lastState = ClientStateConnecting
+	l.lastState = stateConnecting
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnecting() {
-	l.lastState = ClientStateDisconnecting
+	l.lastState = stateDisconnecting
 	l.wg.Done()
 }
 
-func (l *mocListener) OnStateChanged(state ClientState) {
-
-}
 func (l *mocListener) OnAddressChanged(host, addr string) {
 
 }
@@ -60,15 +57,15 @@ func Test_notifier_serverState(t *testing.T) {
 
 	type scenario struct {
 		name        string
-		expected    ClientState
+		expected    int
 		mgmState    bool
 		signalState bool
 	}
 	scenarios := []scenario{
-		{"connected", ClientStateConnected, true, true},
-		{"mgm down", ClientStateConnecting, false, true},
-		{"signal down", ClientStateConnecting, true, false},
-		{"disconnected", ClientStateDisconnected, false, false},
+		{"connected", stateConnected, true, true},
+		{"mgm down", stateConnecting, false, true},
+		{"signal down", stateConnecting, true, false},
+		{"disconnected", stateDisconnected, false, false},
 	}
 
 	for _, tt := range scenarios {
@@ -88,7 +85,7 @@ func Test_notifier_SetListener(t *testing.T) {
 	listener.setPeersWaiter()
 
 	n := newNotifier()
-	n.lastNotification = ClientStateConnecting
+	n.lastNotification = stateConnecting
 	n.setListener(listener)
 	listener.wait()
 	listener.waitPeers()
@@ -102,7 +99,7 @@ func Test_notifier_RemoveListener(t *testing.T) {
 	listener.setWaiter()
 	listener.setPeersWaiter()
 	n := newNotifier()
-	n.lastNotification = ClientStateConnecting
+	n.lastNotification = stateConnecting
 	n.setListener(listener)
 	// setListener replays cached state on a goroutine; wait for both the state
 	// and peers callbacks to finish so we don't race on listener.peers.

client/internal/peer/status.go

@@ -1211,12 +1211,6 @@ func (d *Status) ClientTeardown() {
 	d.notifyStateChange()
 }
 
-// SetNetworkAvailable records the OS-reported network availability; while
-// unavailable, listeners see NoNetwork instead of Connecting.
-func (d *Status) SetNetworkAvailable(available bool) {
-	d.notifier.setNetworkAvailable(available)
-}
-
 // SetConnectionListener set a listener to the notifier
 func (d *Status) SetConnectionListener(listener Listener) {
 	d.notifier.setListener(listener)

client/internal/profilemanager/state.go

@@ -87,10 +87,9 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 
 // RemoveProfileState deletes the per-profile state file (which holds the
 // account email used for the SSO login hint and the UI display). Called after
-// profile removal; logout keeps the file so the next login can pass the email
-// as the login_hint. The state file only stores the email, so deleting it is
-// equivalent to clearing it; the next SSO login recreates it. A missing file
-// is not an error.
+// a successful logout so a logged-out profile no longer shows a stale account
+// email. The state file only stores the email, so deleting it is equivalent to
+// clearing it; the next SSO login recreates it. A missing file is not an error.
 func (pm *ProfileManager) RemoveProfileState(profileName string) error {
 	configDir, err := getConfigDir()
 	if err != nil {

client/internal/routemanager/ipfwdstate/ipfwdstate.go

@@ -2,183 +2,54 @@ package ipfwdstate
 
 import (
 	"fmt"
-	"sync"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 )
 
-// IPForwardingState tracks v4 and v6 IP-forwarding sysctl enables with
-// independent refcounts so a v4-only routing setup doesn't flip v6 sysctls.
+// IPForwardingState is a struct that keeps track of the IP forwarding state.
+// todo: read initial state of the IP forwarding from the system and reset the state based on it.
+// todo: separate v4/v6 forwarding state, since the sysctls are independent
+// (net.ipv4.ip_forward vs net.ipv6.conf.all.forwarding). Currently the nftables
+// manager shares one instance between both routers, which works only because
+// EnableIPForwarding enables both sysctls in a single call.
 type IPForwardingState struct {
-	mu sync.Mutex
-
-	v4Count int
-	v6Count int
-
-	// routingV4/routingV6 track whether the routing path currently holds a
-	// reference, so repeated EnableRouting calls (one per network-map update)
-	// hold at most one reference per family and an unpaired DisableRouting
-	// can't release references held by DNAT rules.
-	routingV4 bool
-	routingV6 bool
-
-	wgIfaceName string
-	v6Saved     map[string]int
+	enabledCounter int
 }
 
-// NewIPForwardingState returns a state tracker for the IP-forwarding sysctls.
-// wgIfaceName is excluded from the per-interface accept_ra handling.
-func NewIPForwardingState(wgIfaceName string) *IPForwardingState {
-	return &IPForwardingState{wgIfaceName: wgIfaceName}
+func NewIPForwardingState() *IPForwardingState {
+	return &IPForwardingState{}
 }
 
-// Counts returns the current v4 and v6 refcounts. Intended for diagnostics
-// and tests.
-func (f *IPForwardingState) Counts() (v4, v6 int) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.v4Count, f.v6Count
-}
-
-// RequestRouting takes the forwarding references for the routing path. It is
-// idempotent: while routing already holds a reference, further calls don't
-// increment the refcounts, and a v4-only request releases a previously held v6
-// reference. A v6 sysctl failure is logged and not returned so it can't take
-// down v4 routing (the sysctl may be unwritable, e.g. read-only /proc/sys or
-// IPv6 disabled on the kernel command line); v6 is retried on the next call.
-func (f *IPForwardingState) RequestRouting(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if !f.routingV4 {
-		if err := f.requestV4(); err != nil {
-			return err
-		}
-		f.routingV4 = true
-	}
-
-	if !v6 {
-		if !f.routingV6 {
-			return nil
-		}
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-
-	if f.routingV6 {
-		return nil
-	}
-	if err := f.requestV6(); err != nil {
-		log.Warnf("enable IPv6 forwarding for routing: %v", err)
-		return nil
-	}
-	f.routingV6 = true
-	return nil
-}
-
-// ReleaseRouting releases the references RequestRouting holds. Calls without a
-// held reference are no-ops.
-func (f *IPForwardingState) ReleaseRouting() error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if f.routingV4 {
-		f.routingV4 = false
-		f.releaseV4()
-	}
-	if f.routingV6 {
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-	return nil
-}
-
-// RequestForwarding enables the family's forwarding sysctl on first request.
-func (f *IPForwardingState) RequestForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.requestV6()
-	}
-	return f.requestV4()
-}
-
-// ReleaseForwarding decrements the family counter. The last v6 release restores
-// what enable captured. v4 stays on: net.ipv4.ip_forward is co-owned by other
-// tooling (docker, k8s, libvirt).
-func (f *IPForwardingState) ReleaseForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.releaseV6()
-	}
-	f.releaseV4()
-	return nil
-}
-
-func (f *IPForwardingState) requestV4() error {
-	if f.v4Count == 0 {
-		if err := systemops.EnableV4IPForwarding(); err != nil {
-			return fmt.Errorf("enable IPv4 forwarding: %w", err)
-		}
-		log.Info("IPv4 forwarding enabled")
-	}
-	f.v4Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV4() {
-	if f.v4Count > 0 {
-		f.v4Count--
-	}
-}
-
-func (f *IPForwardingState) requestV6() error {
-	if f.v6Count == 0 {
-		saved, err := systemops.EnableV6IPForwarding(f.wgIfaceName)
-		if err != nil {
-			if rerr := systemops.DisableV6IPForwarding(saved); rerr != nil {
-				log.Warnf("rollback partial v6 sysctls: %v", rerr)
-			}
-			return fmt.Errorf("enable IPv6 forwarding: %w", err)
-		}
-		// A failed restore on a previous release keeps its saved values; those
-		// are the true originals, so keep them over what this enable captured.
-		if f.v6Saved == nil {
-			f.v6Saved = saved
-		} else {
-			for k, v := range saved {
-				if _, ok := f.v6Saved[k]; !ok {
-					f.v6Saved[k] = v
-				}
-			}
-		}
-		log.Info("IPv6 forwarding enabled")
-	}
-	f.v6Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV6() error {
-	if f.v6Count == 0 {
-		return nil
-	}
-	f.v6Count--
-	if f.v6Count > 0 {
+func (f *IPForwardingState) RequestForwarding() error {
+	if f.enabledCounter != 0 {
+		f.enabledCounter++
 		return nil
 	}
 
-	// Keep the saved values on failure so a later release or enable/release
-	// cycle can still restore them; re-restoring an already-restored key is a
-	// no-op since the sysctl already holds the desired value.
-	if err := systemops.DisableV6IPForwarding(f.v6Saved); err != nil {
-		return fmt.Errorf("disable IPv6 forwarding: %w", err)
+	if err := systemops.EnableIPForwarding(); err != nil {
+		return fmt.Errorf("failed to enable IP forwarding with sysctl: %w", err)
 	}
-	f.v6Saved = nil
-	log.Info("IPv6 forwarding disabled")
+	f.enabledCounter = 1
+	log.Info("IP forwarding enabled")
+
+	return nil
+}
+
+func (f *IPForwardingState) ReleaseForwarding() error {
+	if f.enabledCounter == 0 {
+		return nil
+	}
+
+	if f.enabledCounter > 1 {
+		f.enabledCounter--
+		return nil
+	}
+
+	// if failed to disable IP forwarding we anyway decrement the counter
+	f.enabledCounter = 0
+
+	// todo call systemops.DisableIPForwarding()
 	return nil
 }

client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go

@@ -1,39 +0,0 @@
-//go:build privileged
-
-package ipfwdstate
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
-// releases a previously held routing-owned v6 reference without touching
-// references held by DNAT rules.
-func TestRequestRoutingV6ToV4Transition(t *testing.T) {
-	f := NewIPForwardingState("wt-fwd-test")
-
-	require.NoError(t, f.RequestRouting(true), "request routing with v6")
-	v4, v6 := f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference held")
-	assert.Equal(t, 1, v6, "v6 reference held")
-
-	require.NoError(t, f.RequestRouting(false), "request routing v4-only")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference kept")
-	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
-
-	// A DNAT-held reference survives a v4-only routing request.
-	require.NoError(t, f.RequestForwarding(true), "dnat v6 reference")
-	require.NoError(t, f.RequestRouting(false), "repeat v4-only request")
-	_, v6 = f.Counts()
-	assert.Equal(t, 1, v6, "dnat-held v6 reference survives")
-	require.NoError(t, f.ReleaseForwarding(true), "release dnat v6 reference")
-
-	require.NoError(t, f.ReleaseRouting(), "release routing")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 0, v4, "all v4 references released")
-	assert.Equal(t, 0, v6, "all v6 references released")
-}

client/internal/routemanager/sysctl/sysctl_linux.go

@@ -58,7 +58,11 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		i := fmt.Sprintf(rpFilterInterfacePath, EscapeInterfaceName(intf.Name))
+		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
+		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
+		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
+
+		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -70,13 +74,6 @@ func Setup(wgIface iface) (map[string]int, error) {
 	return keys, nberrors.FormatErrorOrNil(result)
 }
 
-// EscapeInterfaceName escapes '%' and '.' in an interface name (e.g. VLANs
-// like eth0.100) so the name survives the dot-to-slash conversion in Set.
-func EscapeInterfaceName(name string) string {
-	safe := strings.ReplaceAll(name, "%", percentEscape)
-	return strings.ReplaceAll(safe, ".", dotEscape)
-}
-
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
 	path := strings.ReplaceAll(key, ".", "/")

client/internal/routemanager/systemops/routeselection_windows_test.go

@@ -1,82 +0,0 @@
-//go:build windows
-
-package systemops
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestSortRouteCandidates(t *testing.T) {
-	tests := []struct {
-		name       string
-		candidates []candidateRoute
-		wantOrder  []uint32
-	}{
-		{
-			name: "longest prefix wins over metrics",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 0, interfaceMetric: 5},
-				{interfaceIndex: 2, prefixLength: 24, routeMetric: 100, interfaceMetric: 50},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			// Windows ranks equal-length prefixes by route metric + interface metric,
-			// so a higher route metric on a low metric interface can still win.
-			name: "combined metric beats route metric alone",
-			candidates: []candidateRoute{
-				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
-				{interfaceIndex: 5, prefixLength: 0, routeMetric: 10, interfaceMetric: 5},
-			},
-			wantOrder: []uint32{5, 8},
-		},
-		{
-			name: "lower combined metric wins",
-			candidates: []candidateRoute{
-				{interfaceIndex: 5, prefixLength: 0, routeMetric: 300, interfaceMetric: 5},
-				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
-			},
-			wantOrder: []uint32{8, 5},
-		},
-		{
-			name: "equal combined metric falls back to route metric",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 20, interfaceMetric: 10},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 25},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			// The metrics are uint32 on the Windows side, so the sum must not wrap.
-			name: "combined metric beyond the uint32 range",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: math.MaxUint32, interfaceMetric: 5},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: math.MaxUint32 - 10, interfaceMetric: 5},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			name: "unknown interface metric ranks on route metric only",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 30, interfaceMetric: -1},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 10},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sortRouteCandidates(tt.candidates)
-
-			got := make([]uint32, 0, len(tt.candidates))
-			for _, c := range tt.candidates {
-				got = append(got, c.interfaceIndex)
-			}
-			assert.Equal(t, tt.wantOrder, got)
-		})
-	}
-}

client/internal/routemanager/systemops/systemops_android.go

@@ -32,17 +32,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_ios.go

@@ -58,17 +58,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_linux.go

@@ -763,10 +763,13 @@ func flushRoutes(tableID, family int) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func EnableV4IPForwarding() error {
+func EnableIPForwarding() error {
 	if _, err := sysctl.Set(ipv4ForwardingPath, 1, false); err != nil {
 		return err
 	}
+	if _, err := sysctl.Set(ipv6ForwardingPath, 1, false); err != nil {
+		log.Warnf("failed to enable IPv6 forwarding: %v", err)
+	}
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_nonlinux.go

@@ -43,17 +43,8 @@ func (r *SysOps) RemoveVPNRoute(prefix netip.Prefix, intf *net.Interface) error
 	return r.genericRemoveVPNRoute(prefix, intf)
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_windows.go

@@ -882,40 +882,26 @@ func getInterfaceMetric(interfaceIndex uint32, family int16) int {
 	return int(ipInterfaceRow.Metric)
 }
 
-// sortRouteCandidates sorts route candidates by priority: prefix length -> combined metric -> route metric.
-// Windows prefers the longest matching prefix and, among prefixes of the same length, the lowest metric, see
-// https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-tcpip-interfaces-interface-routes-route-metric
+// sortRouteCandidates sorts route candidates by priority: prefix length -> route metric -> interface metric
 func sortRouteCandidates(candidates []candidateRoute) {
 	sort.Slice(candidates, func(i, j int) bool {
 		if candidates[i].prefixLength != candidates[j].prefixLength {
 			return candidates[i].prefixLength > candidates[j].prefixLength
 		}
-		mi, mj := combinedMetric(candidates[i]), combinedMetric(candidates[j])
-		if mi != mj {
-			return mi < mj
+		if candidates[i].routeMetric != candidates[j].routeMetric {
+			return candidates[i].routeMetric < candidates[j].routeMetric
 		}
-		return candidates[i].routeMetric < candidates[j].routeMetric
+		return candidates[i].interfaceMetric < candidates[j].interfaceMetric
 	})
 }
 
-// combinedMetric returns the effective metric Windows uses to rank routes with an equal prefix length:
-// the sum of the route metric and the metric of the interface the route is on, see
-// https://learn.microsoft.com/en-us/windows-server/networking/technologies/network-subsystem/net-sub-interface-metric
-// An unknown interface metric contributes nothing.
-func combinedMetric(candidate candidateRoute) uint64 {
-	if candidate.interfaceMetric < 0 {
-		return uint64(candidate.routeMetric)
-	}
-	return uint64(candidate.routeMetric) + uint64(candidate.interfaceMetric)
-}
-
 // GetBestInterface finds the best interface for reaching a destination,
 // excluding the VPN interface to avoid routing loops.
 //
 // Route selection priority:
 // 1. Longest prefix match (most specific route)
-// 2. Lowest combined metric (route metric + interface metric)
-// 3. Lowest route metric.
+// 2. Lowest route metric
+// 3. Lowest interface metric
 func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 	var skipInterfaceIndex int
 	if vpnIntf != "" {
@@ -939,6 +925,7 @@ func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 		return nil, fmt.Errorf("no route to %s", dest)
 	}
 
+	// Sort routes: prefix length -> route metric -> interface metric
 	sortRouteCandidates(candidates)
 
 	for _, candidate := range candidates {

client/internal/routemanager/systemops/v6forwarding_linux.go

@@ -1,92 +0,0 @@
-//go:build !android
-
-package systemops
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/routemanager/sysctl"
-)
-
-const (
-	// 1 (default) accepts RAs only while forwarding is off; 2 keeps RA
-	// acceptance on regardless, so RA-installed host defaults survive our
-	// v6 forwarding flip.
-	acceptRAInterfacePath  = "net.ipv6.conf.%s.accept_ra"
-	acceptRADefaultPath    = "net.ipv6.conf.default.accept_ra"
-	acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
-)
-
-// EnableV6IPForwarding bumps accept_ra=2 on host v6 interfaces before flipping
-// forwarding=1, so RA-installed host defaults survive. Returns the prior values
-// of sysctls we actually changed; entries already at the target are omitted.
-func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
-	saved := map[string]int{}
-	bumpAcceptRA(saved, wgIfaceName)
-
-	oldVal, err := sysctl.Set(ipv6ForwardingPath, 1, false)
-	if err != nil {
-		return saved, err
-	}
-	if oldVal != 1 {
-		saved[ipv6ForwardingPath] = oldVal
-	}
-	return saved, nil
-}
-
-// DisableV6IPForwarding restores what EnableV6IPForwarding captured.
-func DisableV6IPForwarding(saved map[string]int) error {
-	var result *multierror.Error
-	for key, value := range saved {
-		if _, err := sysctl.Set(key, value, false); err != nil {
-			result = multierror.Append(result, fmt.Errorf("restore %s: %w", key, err))
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
-	// Also bump conf.default so interfaces created while forwarding is on
-	// (hotplug, new Wi-Fi/dock) inherit accept_ra=2 and keep accepting RAs.
-	bumpAcceptRAKey(saved, acceptRADefaultPath)
-
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		log.Warnf("list interfaces for accept_ra: %v", err)
-		return
-	}
-	for _, intf := range interfaces {
-		if intf.Name == "lo" || intf.Name == wgIfaceName {
-			continue
-		}
-		bumpAcceptRAForInterface(saved, intf.Name)
-	}
-}
-
-func bumpAcceptRAForInterface(saved map[string]int, name string) {
-	// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
-	if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
-		return
-	}
-	bumpAcceptRAKey(saved, fmt.Sprintf(acceptRAInterfacePath, sysctl.EscapeInterfaceName(name)))
-}
-
-func bumpAcceptRAKey(saved map[string]int, key string) {
-	// onlyIfOne=true: leave admin overrides (0, 2) alone.
-	oldVal, err := sysctl.Set(key, 2, true)
-	if err != nil {
-		log.Warnf("bump %s: %v", key, err)
-		return
-	}
-	// With onlyIfOne, a write only happened when the old value was 1; values
-	// left untouched (0, 2) must not be recorded for restore.
-	if oldVal == 1 {
-		saved[key] = oldVal
-	}
-}

client/internal/routemanager/systemops/v6route_linux_test.go

@@ -5,7 +5,6 @@ package systemops
 import (
 	"errors"
 	"net"
-	"net/netip"
 	"syscall"
 	"testing"
 
@@ -30,7 +29,6 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 	}
 	if err := netlink.RouteAdd(route); err != nil {
 		if errors.Is(err, syscall.EEXIST) {
-			requireUsableIPv6Nexthop(t)
 			return
 		}
 		t.Skipf("install IPv6 fallback default route: %v", err)
@@ -40,36 +38,4 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 			t.Logf("delete IPv6 fallback default route: %v", err)
 		}
 	})
-
-	requireUsableIPv6Nexthop(t)
-}
-
-// requireUsableIPv6Nexthop skips the test unless the resolved IPv6 default
-// nexthop can actually carry a route. Installing the default route succeeding
-// does not imply the kernel accepts it as a nexthop for a concrete prefix.
-func requireUsableIPv6Nexthop(t *testing.T) {
-	t.Helper()
-
-	nexthop, err := GetNextHop(netip.IPv6Unspecified())
-	if err != nil {
-		t.Skipf("resolve IPv6 default nexthop: %v", err)
-	}
-
-	probe := &netlink.Route{
-		Scope:  netlink.SCOPE_UNIVERSE,
-		Table:  syscall.RT_TABLE_MAIN,
-		Family: netlink.FAMILY_V6,
-		Dst:    &net.IPNet{IP: net.ParseIP("100::64"), Mask: net.CIDRMask(128, 128)},
-	}
-	require.NoError(t, addNextHop(nexthop, probe), "build IPv6 probe route")
-
-	switch err := netlink.RouteAdd(probe); {
-	case err == nil:
-		if err := netlink.RouteDel(probe); err != nil && !errors.Is(err, syscall.ESRCH) {
-			t.Logf("delete IPv6 probe route: %v", err)
-		}
-	case errors.Is(err, syscall.EEXIST):
-	default:
-		t.Skipf("IPv6 nexthop %s unusable for route installation: %v", nexthop, err)
-	}
 }

client/ios/NetBirdSDK/client.go

@@ -22,8 +22,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -38,6 +36,11 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
+// ConnectionListener export internal Listener for mobile
+type ConnectionListener interface {
+	peer.Listener
+}
+
 // RouteListener export internal RouteListener for mobile
 type NetworkChangeListener interface {
 	listener.NetworkChangeListener
@@ -84,12 +87,6 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run injects it into each new ConnectClient, which
-	// distributes it to every reconnection loop.
-	netState *netstate.State
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -112,8 +109,6 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
 	}
 }
 
@@ -189,8 +184,7 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	c.onHostDnsFn = func([]string) {}
 	cfg.WgIface = interfaceName
 
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -199,25 +193,6 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	return connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile, c.cacheDir, c.logFilePath)
 }
 
-// SetNetworkAvailable feeds OS-reported network availability into the client
-// (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
-// suspend their attempts and the connection listener reports NoNetwork
-// instead of Connecting; when availability returns, the loops resume
-// immediately with a fresh backoff.
-func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
-}
-
-// NotifyNetworkChange marks the management, signal and relay connections
-// stale after the OS switched networks and schedules a sweep that cuts
-// whatever has not redialed on the new network by then. The engine and the
-// TUN device stay untouched.
-func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
-}
-
 // Stop the internal client and free the resources
 func (c *Client) Stop() {
 	c.ctxCancelLock.Lock()
@@ -356,11 +331,7 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	if listener == nil {
-		c.recorder.RemoveConnectionListener()
-		return
-	}
-	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
+	c.recorder.SetConnectionListener(listener)
 }
 
 // RemoveConnectionListener remove connection listener

client/ios/NetBirdSDK/connection_listener.go

@@ -1,43 +0,0 @@
-//go:build ios
-
-package NetBirdSDK
-
-import (
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-// Client state values, re-exported as basic constants so gomobile emits them
-// into the generated bindings. They mirror peer.ClientState*: append-only,
-// never reorder.
-const (
-	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
-	ClientStateConnected     = int(peer.ClientStateConnected)
-	ClientStateConnecting    = int(peer.ClientStateConnecting)
-	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
-	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
-)
-
-// ConnectionListener export internal Listener for mobile.
-//
-// It intentionally lacks OnStateChanged for now: adding a method to a gomobile
-// interface breaks every Swift implementation, so the iOS app keeps building
-// against the legacy per-state callbacks. A follow-up will extend it together
-// with the app.
-type ConnectionListener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
-// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
-// peer.Listener.
-type connectionListenerAdapter struct {
-	ConnectionListener
-}
-
-// OnStateChanged is dropped on iOS until the app adopts the state callback;
-// the legacy per-state callbacks continue to fire.
-func (a connectionListenerAdapter) OnStateChanged(peer.ClientState) {}

client/netstate/netstate.go

@@ -1,107 +0,0 @@
-// Package netstate tracks OS-reported network availability for the client.
-//
-// A State instance is owned by the platform integration (e.g. the Android or
-// iOS bindings, fed from ConnectivityManager callbacks or NWPathMonitor) and
-// is injected into the connection retry loops (management, signal, relay,
-// peer guards and the top-level connect loop), which consult it to avoid
-// burning CPU and battery on reconnect attempts while the device has no
-// network at all (e.g. airplane mode), and to reset their backoff as soon as
-// the network returns.
-//
-// Consumers hold a *State that may be nil — every non-mobile platform leaves
-// it unset. The read methods are safe on a nil receiver: they report online
-// and never block, so consumers behave as if this package did not exist.
-package netstate
-
-import (
-	"context"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// State holds the OS-reported network availability. The zero value is not
-// usable; create instances with New.
-type State struct {
-	mu      sync.Mutex
-	online  bool
-	changed chan struct{}
-}
-
-// New creates a State that starts online.
-func New() *State {
-	return &State{
-		online:  true,
-		changed: make(chan struct{}),
-	}
-}
-
-// Set records whether the OS reports any usable network. Transitions wake up
-// all Wait callers immediately.
-func (s *State) Set(online bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.online == online {
-		return
-	}
-	s.online = online
-	close(s.changed)
-	s.changed = make(chan struct{})
-	log.Infof("OS network availability changed: online=%t", online)
-}
-
-// IsOnline reports whether the OS reports at least one usable network. On a
-// nil receiver — no State injected — it reports online.
-func (s *State) IsOnline() bool {
-	if s == nil {
-		return true
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.online
-}
-
-// Changed returns a channel closed on the next availability transition, for
-// callers that already own a select loop and cannot block in Wait. Re-read it
-// after every fire: each transition installs a fresh channel. On a nil
-// receiver — no State injected — it returns nil, which blocks forever in a
-// select, so the caller simply never observes a transition.
-func (s *State) Changed() <-chan struct{} {
-	if s == nil {
-		return nil
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.changed
-}
-
-// Wait blocks while the network is offline. It reports whether it had to
-// wait, so callers can reset their backoff after an outage. It returns early
-// with the context error when ctx is done. On a nil receiver — no State
-// injected — it returns immediately.
-func (s *State) Wait(ctx context.Context) (bool, error) {
-	if s == nil {
-		return false, nil
-	}
-	waited := false
-	for {
-		s.mu.Lock()
-		if s.online {
-			s.mu.Unlock()
-			return waited, nil
-		}
-		ch := s.changed
-		s.mu.Unlock()
-
-		if !waited {
-			waited = true
-			log.Debugf("network is offline, pausing connection attempts")
-		}
-
-		select {
-		case <-ctx.Done():
-			return waited, ctx.Err()
-		case <-ch:
-		}
-	}
-}

client/netstate/netstate_test.go

@@ -1,170 +0,0 @@
-package netstate
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewStateIsOnline(t *testing.T) {
-	assert.True(t, New().IsOnline(), "a fresh State should start online")
-}
-
-func TestSetTogglesOnlineState(t *testing.T) {
-	s := New()
-
-	s.Set(false)
-	assert.False(t, s.IsOnline(), "state should be offline after Set(false)")
-
-	s.Set(true)
-	assert.True(t, s.IsOnline(), "state should be online after Set(true)")
-}
-
-func TestWaitReturnsImmediatelyWhenOnline(t *testing.T) {
-	s := New()
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-
-	waited, err := s.Wait(ctx)
-	require.NoError(t, err)
-	assert.False(t, waited, "Wait should not block when the network is online")
-}
-
-func TestWaitBlocksUntilOnline(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	result := make(chan bool, 1)
-	go func() {
-		waited, err := s.Wait(ctx)
-		if err != nil {
-			result <- false
-			return
-		}
-		result <- waited
-	}()
-
-	// Verify Wait is actually blocking while offline
-	select {
-	case <-result:
-		t.Fatal("Wait should block while the network is offline")
-	case <-time.After(100 * time.Millisecond):
-	}
-
-	s.Set(true)
-
-	select {
-	case waited := <-result:
-		assert.True(t, waited, "Wait should report that it had to wait for the network")
-	case <-time.After(2 * time.Second):
-		t.Fatal("Wait should return promptly after the network becomes available")
-	}
-}
-
-func TestWaitReturnsOnContextCancel(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	result := make(chan error, 1)
-	go func() {
-		_, err := s.Wait(ctx)
-		result <- err
-	}()
-
-	cancel()
-
-	select {
-	case err := <-result:
-		assert.ErrorIs(t, err, context.Canceled)
-	case <-time.After(2 * time.Second):
-		t.Fatal("Wait should return promptly after context cancellation")
-	}
-}
-
-func TestWaitWakesAllWaiters(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	const waiters = 10
-	var wg sync.WaitGroup
-	results := make(chan bool, waiters)
-	for i := 0; i < waiters; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			waited, err := s.Wait(ctx)
-			if err != nil {
-				results <- false
-				return
-			}
-			results <- waited
-		}()
-	}
-
-	time.Sleep(100 * time.Millisecond)
-	s.Set(true)
-	wg.Wait()
-
-	close(results)
-	count := 0
-	for waited := range results {
-		assert.True(t, waited, "every waiter should report that it waited")
-		count++
-	}
-	assert.Equal(t, waiters, count, "all waiters should have returned")
-}
-
-func TestNilStateReadsAreNoops(t *testing.T) {
-	var s *State
-
-	assert.True(t, s.IsOnline(), "nil State should report online")
-
-	waited, err := s.Wait(context.Background())
-	require.NoError(t, err)
-	assert.False(t, waited, "nil State's Wait should not block")
-}
-
-func TestConcurrentSetAndWait(t *testing.T) {
-	s := New()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	var wg sync.WaitGroup
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for j := 0; j < 100; j++ {
-				s.Set(j%2 == 0)
-				s.IsOnline()
-			}
-		}()
-	}
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for j := 0; j < 100; j++ {
-				if _, err := s.Wait(ctx); err != nil {
-					return
-				}
-			}
-		}()
-	}
-
-	wg.Wait()
-}

client/netsweep/netsweep.go

@@ -1,267 +0,0 @@
-// Package netsweep cuts network-bound activity when the OS switches networks:
-// a sweep closes the registered connections and aborts the in-flight dials, so
-// their owners redial immediately instead of waiting for the old sockets to
-// time out.
-//
-// A nil *Sweeper disables everything: all methods are nil-safe no-ops.
-package netsweep
-
-import (
-	"context"
-	"errors"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// DefaultSweepDelay absorbs network flapping while the OS settles on a
-// default network before the stale registrations are cut.
-const DefaultSweepDelay = 500 * time.Millisecond
-
-const recentMarkWindow = 3 * time.Second
-
-// Config customizes a Sweeper. The zero value applies the defaults.
-type Config struct {
-	// SweepDelay overrides DefaultSweepDelay when positive.
-	SweepDelay time.Duration
-}
-
-// ErrSwept reports that a dial finished after a network change swept its
-// registration. The connection is already closed; the caller must treat it
-// as a failed dial and redial on the new network.
-var ErrSwept = errors.New("netsweep: connection swept by network change")
-
-// sweepID identifies one registration in a sweeper. Connections and dials
-// draw from the same counter, so an id is unique across both registries.
-type sweepID uint64
-
-type connEntry struct {
-	conn net.Conn
-	gen  uint64
-}
-
-// Dial tracks one dial from start to connection registration. It hands the
-// dialed connection to the sweeper atomically, so a sweep can never fall
-// between the dial finishing and the connection being registered.
-type Dial struct {
-	sweeper *Sweeper
-	ctx     context.Context
-	cancel  context.CancelFunc
-	id      sweepID
-	done    bool // set by a sweep, WrapConn or Release; guarded by sweeper.mu
-	gen     uint64
-}
-
-// Ctx returns the dial's context. A sweep cancels it, so a dial started on the
-// old network aborts instead of waiting out its handshake timeout.
-func (d *Dial) Ctx() context.Context {
-	return d.ctx
-}
-
-// Release ends the dial's registration and cancels its context. It is
-// idempotent and safe after WrapConn, so callers can defer it.
-func (d *Dial) Release() {
-	s := d.sweeper
-	if s == nil {
-		return
-	}
-
-	s.mu.Lock()
-	d.done = true
-	delete(s.dials, d.id)
-	s.mu.Unlock()
-
-	d.cancel()
-}
-
-// sweptConn deregisters itself from the sweeper when closed.
-type sweptConn struct {
-	net.Conn
-	sweeper *Sweeper
-	id      sweepID
-}
-
-func (c *sweptConn) Close() error {
-	c.sweeper.deregister(c.id)
-	return c.Conn.Close()
-}
-
-// Sweeper registers live connections and in-flight dials so the
-// network-change sweep can cut everything registered before the change.
-type Sweeper struct {
-	mu         sync.Mutex
-	conns      map[sweepID]connEntry
-	dials      map[sweepID]*Dial
-	nextID     sweepID
-	gen        uint64
-	timer      *time.Timer
-	sweepDelay time.Duration
-	lastMark   time.Time
-}
-
-// New creates an empty sweeper with the default configuration.
-func New() *Sweeper {
-	return NewWithConfig(Config{})
-}
-
-// NewWithConfig creates an empty sweeper customized by cfg.
-func NewWithConfig(cfg Config) *Sweeper {
-	delay := cfg.SweepDelay
-	if delay <= 0 {
-		delay = DefaultSweepDelay
-	}
-	return &Sweeper{
-		conns:      make(map[sweepID]connEntry),
-		dials:      make(map[sweepID]*Dial),
-		sweepDelay: delay,
-	}
-}
-
-// StartDial registers an in-flight dial. Dial with Ctx, hand the result to
-// WrapConn, and Release the dial when the attempt is over, typically deferred.
-func (s *Sweeper) StartDial(ctx context.Context) *Dial {
-	if s == nil {
-		return &Dial{ctx: ctx}
-	}
-
-	ctx, cancel := context.WithCancel(ctx)
-	d := &Dial{sweeper: s, ctx: ctx, cancel: cancel}
-
-	s.mu.Lock()
-	d.id = s.nextID
-	s.nextID++
-	d.gen = s.gen
-	s.dials[d.id] = d
-	s.mu.Unlock()
-
-	return d
-}
-
-// WrapConn hands conn over to the sweeper. If a sweep ran since StartDial,
-// the connection belongs to the old network: it is closed and ErrSwept is
-// returned. Otherwise conn is registered against the next sweep and returned
-// wrapped, deregistering itself on Close. Call it once, before Release.
-func (d *Dial) WrapConn(conn net.Conn) (net.Conn, error) {
-	s := d.sweeper
-	if s == nil {
-		return conn, nil
-	}
-
-	s.mu.Lock()
-	if d.done {
-		s.mu.Unlock()
-		if err := conn.Close(); err != nil {
-			log.Debugf("swept dial close error: %v", err)
-		}
-		return nil, ErrSwept
-	}
-	d.done = true
-	delete(s.dials, d.id)
-	id := s.nextID
-	s.nextID++
-	// The conn inherits the dial's generation: the socket was bound to the
-	// network that was default when the dial started, not when it finished.
-	s.conns[id] = connEntry{conn: conn, gen: d.gen}
-	s.mu.Unlock()
-
-	return &sweptConn{Conn: conn, sweeper: s, id: id}, nil
-}
-
-// MarkNetworkChange records that the OS switched networks: everything
-// registered so far becomes stale, and a sweep is (re)scheduled after the
-// configured delay to cut whatever is still stale by then. Owners that
-// redialed in the meantime hold fresh-generation registrations and survive,
-// so no cancellation is needed around the sweep.
-func (s *Sweeper) MarkNetworkChange() {
-	if s == nil {
-		return
-	}
-
-	s.mu.Lock()
-	s.gen++
-	cutoff := s.gen
-	s.lastMark = time.Now()
-	if s.timer != nil {
-		s.timer.Stop()
-	}
-	s.timer = time.AfterFunc(s.sweepDelay, func() {
-		n := s.sweep(cutoff)
-		log.Infof("network change sweep: closed %d stale connections", n)
-	})
-	s.mu.Unlock()
-}
-
-// QuickRetryBackoff wraps bo so that after each Reset the first retry comes
-// quickly when the disconnect followed a recent network change and the
-// network is online. Any other failure keeps bo's spread, so the clients of
-// a restarted server still scatter their reconnects. A nil sweeper returns
-// bo unchanged.
-func (s *Sweeper) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff, netState *netstate.State) backoff.BackOff {
-	if s == nil {
-		return bo
-	}
-	return backoff.WithContext(newQuickRetryBackoff(bo, s, netState), ctx)
-}
-
-func (s *Sweeper) markedRecently() bool {
-	if s == nil {
-		return false
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return !s.lastMark.IsZero() && time.Since(s.lastMark) < recentMarkWindow
-}
-
-// sweep closes the registered connections and aborts the in-flight dials
-// older than cutoff, and returns how many connections it closed. A dial
-// whose connection was not yet handed to WrapConn is marked, so the late
-// WrapConn closes it instead of registering it.
-func (s *Sweeper) sweep(cutoff uint64) int {
-	if s == nil {
-		return 0
-	}
-
-	s.mu.Lock()
-	var conns []net.Conn
-	for id, e := range s.conns {
-		if e.gen < cutoff {
-			delete(s.conns, id)
-			conns = append(conns, e.conn)
-		}
-	}
-	var dials []*Dial
-	for id, d := range s.dials {
-		if d.gen < cutoff {
-			d.done = true
-			delete(s.dials, id)
-			dials = append(dials, d)
-		}
-	}
-	s.mu.Unlock()
-
-	if len(dials) > 0 {
-		log.Debugf("aborting %d in-flight dials", len(dials))
-		for _, d := range dials {
-			d.cancel()
-		}
-	}
-
-	for _, conn := range conns {
-		log.Debugf("sweeping connection %s -> %s", conn.LocalAddr(), conn.RemoteAddr())
-		if err := conn.Close(); err != nil {
-			log.Debugf("swept connection close error: %v", err)
-		}
-	}
-	return len(conns)
-}
-
-func (s *Sweeper) deregister(id sweepID) {
-	s.mu.Lock()
-	delete(s.conns, id)
-	s.mu.Unlock()
-}

client/netsweep/netsweep_test.go

@@ -1,241 +0,0 @@
-package netsweep
-
-import (
-	"context"
-	"math"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSweepClosesRegisteredConns(t *testing.T) {
-	sweeper := New()
-
-	c1 := wrap(t, sweeper, connPair(t))
-	c2 := wrap(t, sweeper, connPair(t))
-
-	assert.Equal(t, 2, sweeper.sweepAll(), "both live connections should be closed")
-
-	// The wrappers must report closed now.
-	buf := make([]byte, 1)
-	_, err := c1.Read(buf)
-	assert.Error(t, err, "first connection should be unusable after the sweep")
-	_, err = c2.Read(buf)
-	assert.Error(t, err, "second connection should be unusable after the sweep")
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "second sweep should find nothing")
-}
-
-func TestCloseDeregisters(t *testing.T) {
-	sweeper := New()
-
-	conn := wrap(t, sweeper, connPair(t))
-	require.NoError(t, conn.Close())
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "closed connection must leave the registry")
-}
-
-func TestCloseIsIdempotent(t *testing.T) {
-	sweeper := New()
-
-	conn := wrap(t, sweeper, connPair(t))
-	require.NoError(t, conn.Close())
-	assert.Error(t, conn.Close(), "double close surfaces the underlying error but must not panic")
-}
-
-func TestSweepOnlyAffectsOlderConns(t *testing.T) {
-	sweeper := New()
-
-	_ = wrap(t, sweeper, connPair(t))
-	assert.Equal(t, 1, sweeper.sweepAll())
-
-	// A connection dialed after the sweep must survive until the next one.
-	_ = wrap(t, sweeper, connPair(t))
-	assert.Equal(t, 1, sweeper.sweepAll(), "post-sweep connection belongs to the next sweep")
-}
-
-func TestSweepAbortsInFlightDials(t *testing.T) {
-	sweeper := New()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	sweeper.sweepAll()
-
-	assert.ErrorIs(t, dial.Ctx().Err(), context.Canceled, "sweep must cancel the in-flight dial context")
-}
-
-func TestReleasedDialIsNotAborted(t *testing.T) {
-	sweeper := New()
-
-	// Simulate a dial that finished before the sweep.
-	released := sweeper.StartDial(context.Background())
-	released.Release()
-
-	// A dial still in flight during the sweep.
-	pending := sweeper.StartDial(context.Background())
-	defer pending.Release()
-
-	sweeper.sweepAll()
-	assert.ErrorIs(t, pending.Ctx().Err(), context.Canceled, "pending dial must be aborted")
-}
-
-func TestSweepBetweenDialAndHandoffClosesConn(t *testing.T) {
-	sweeper := New()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	// The dial succeeds on the old network, then the sweep lands before the
-	// connection is handed over.
-	conn := connPair(t)
-	assert.Equal(t, 0, sweeper.sweepAll(), "the connection is not registered yet")
-
-	wrapped, err := dial.WrapConn(conn)
-	require.ErrorIs(t, err, ErrSwept)
-	require.Nil(t, wrapped)
-
-	buf := make([]byte, 1)
-	_, err = conn.Read(buf)
-	assert.Error(t, err, "the old-network connection must be closed, not leaked")
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "nothing may leak into the next sweep")
-}
-
-func TestMarkNetworkChangeSparesFreshConns(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
-
-	stale := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	_ = wrap(t, sweeper, connPair(t))
-
-	_ = stale.SetReadDeadline(time.Now().Add(time.Second))
-	buf := make([]byte, 1)
-	_, err := stale.Read(buf)
-	require.ErrorIs(t, err, net.ErrClosed, "stale connection must be closed by the delayed sweep")
-
-	assert.Equal(t, 1, sweeper.sweepAll(), "the fresh connection must survive the stale sweep")
-}
-
-func TestMarkNetworkChangeAbortsStaleDials(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
-
-	stale := sweeper.StartDial(context.Background())
-	defer stale.Release()
-	sweeper.MarkNetworkChange()
-	fresh := sweeper.StartDial(context.Background())
-	defer fresh.Release()
-
-	assert.Eventually(t, func() bool {
-		return stale.Ctx().Err() != nil
-	}, time.Second, 5*time.Millisecond, "stale dial must be aborted by the delayed sweep")
-	assert.NoError(t, fresh.Ctx().Err(), "post-mark dial must not be aborted")
-}
-
-func TestConnInheritsDialGeneration(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
-
-	// The dial starts before the network change but completes after it: the
-	// socket is bound to the old network, so the sweep must still cut it.
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-	sweeper.MarkNetworkChange()
-
-	wrapped, err := dial.WrapConn(connPair(t))
-	require.NoError(t, err)
-
-	_ = wrapped.SetReadDeadline(time.Now().Add(time.Second))
-	buf := make([]byte, 1)
-	_, err = wrapped.Read(buf)
-	require.ErrorIs(t, err, net.ErrClosed, "old-generation connection must be swept")
-}
-
-func TestRepeatedMarksCoalesce(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
-
-	first := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	second := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	_ = wrap(t, sweeper, connPair(t))
-
-	buf := make([]byte, 1)
-	for _, conn := range []net.Conn{first, second} {
-		_ = conn.SetReadDeadline(time.Now().Add(time.Second))
-		_, err := conn.Read(buf)
-		require.ErrorIs(t, err, net.ErrClosed, "every pre-mark connection must be swept by the rescheduled sweep")
-	}
-	assert.Equal(t, 1, sweeper.sweepAll(), "only the newest-generation connection may remain")
-}
-
-func TestNilSweeperIsNoop(t *testing.T) {
-	var sweeper *Sweeper
-
-	conn := connPair(t)
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	wrapped, err := dial.WrapConn(conn)
-	require.NoError(t, err)
-	assert.Equal(t, conn, wrapped, "nil sweeper must return the conn unchanged")
-	assert.NoError(t, dial.Ctx().Err(), "nil sweeper must not cancel the dial context")
-	assert.Equal(t, 0, sweeper.sweepAll(), "nil sweeper closes nothing")
-}
-
-// wrap registers conn with the sweeper through a completed dial.
-func wrap(t *testing.T, sweeper *Sweeper, conn net.Conn) net.Conn {
-	t.Helper()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	wrapped, err := dial.WrapConn(conn)
-	require.NoError(t, err)
-	return wrapped
-}
-
-// connPair dials a loopback TCP connection and keeps the accepted peer open
-// until the test ends: a peer that closed early would make the connection
-// unreadable on its own, so a read error after the sweep would prove nothing.
-func connPair(t *testing.T) net.Conn {
-	t.Helper()
-
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		if err := l.Close(); err != nil {
-			t.Logf("listener close error: %v", err)
-		}
-	})
-
-	accepted := make(chan net.Conn, 1)
-	go func() {
-		conn, err := l.Accept()
-		if err != nil {
-			close(accepted)
-			return
-		}
-		accepted <- conn
-	}()
-
-	conn, err := net.Dial("tcp", l.Addr().String())
-	require.NoError(t, err)
-
-	peer, ok := <-accepted
-	require.True(t, ok, "listener must accept the dialed connection")
-	t.Cleanup(func() {
-		if err := peer.Close(); err != nil {
-			t.Logf("peer close error: %v", err)
-		}
-	})
-
-	return conn
-}
-
-// sweepAll cuts every registration regardless of generation.
-func (s *Sweeper) sweepAll() int {
-	return s.sweep(math.MaxUint64)
-}

client/netsweep/quick_retry.go

@@ -1,39 +0,0 @@
-package netsweep
-
-import (
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-const quickRetryDelay = 200 * time.Millisecond
-
-type quickRetryBackoff struct {
-	backoff.BackOff
-	sweeper  *Sweeper
-	netState *netstate.State
-	used     bool
-}
-
-func newQuickRetryBackoff(bo backoff.BackOff, sweeper *Sweeper, netState *netstate.State) *quickRetryBackoff {
-	return &quickRetryBackoff{
-		BackOff:  bo,
-		sweeper:  sweeper,
-		netState: netState,
-	}
-}
-
-func (b *quickRetryBackoff) NextBackOff() time.Duration {
-	if !b.used && b.sweeper.markedRecently() && b.netState.IsOnline() {
-		b.used = true
-		return quickRetryDelay
-	}
-	return b.BackOff.NextBackOff()
-}
-
-func (b *quickRetryBackoff) Reset() {
-	b.used = false
-	b.BackOff.Reset()
-}

client/netsweep/quick_retry_test.go

@@ -1,58 +0,0 @@
-package netsweep
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestQuickRetryAfterRecentMark(t *testing.T) {
-	sweeper := New()
-	sweeper.MarkNetworkChange()
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "first retry after a mark must be quick")
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "second retry must fall back to the wrapped backoff")
-
-	bo.Reset()
-	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "reset must re-arm the quick retry")
-}
-
-func TestQuickRetryWithoutMarkKeepsSpread(t *testing.T) {
-	sweeper := New()
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "without a mark the wrapped backoff decides")
-
-	sweeper.mu.Lock()
-	sweeper.lastMark = time.Now().Add(-recentMarkWindow)
-	sweeper.mu.Unlock()
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "a stale mark must not trigger the quick retry")
-}
-
-func TestQuickRetryNilSweeperPassthrough(t *testing.T) {
-	var sweeper *Sweeper
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, backoff.BackOff(slow), bo, "nil sweeper must return the backoff unchanged")
-}
-
-func TestQuickRetryHonorsContext(t *testing.T) {
-	sweeper := New()
-	sweeper.MarkNetworkChange()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	bo := sweeper.QuickRetryBackoff(ctx, backoff.NewConstantBackOff(time.Millisecond), nil)
-
-	assert.Equal(t, backoff.Stop, bo.NextBackOff(), "cancelled context must stop the retry loop")
-}

client/proto/daemon.pb.go

@@ -5628,13 +5628,9 @@ func (x *GetPeerSSHHostKeyResponse) GetFound() bool {
 type RequestJWTAuthRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// hint for OIDC login_hint parameter (typically email address)
-	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
-	// hasGraphicalSession tells the daemon that the caller has a graphical session,
-	// which decides whether PKCE or the device code flow is preferred. The daemon
-	// cannot detect this itself: it does not inherit the session environment.
-	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
-	unknownFields       protoimpl.UnknownFields
-	sizeCache           protoimpl.SizeCache
+	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RequestJWTAuthRequest) Reset() {
@@ -5674,13 +5670,6 @@ func (x *RequestJWTAuthRequest) GetHint() string {
 	return ""
 }
 
-func (x *RequestJWTAuthRequest) GetHasGraphicalSession() bool {
-	if x != nil {
-		return x.HasGraphicalSession
-	}
-	return false
-}
-
 // RequestJWTAuthResponse contains authentication flow information
 type RequestJWTAuthResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -5905,13 +5894,9 @@ type RequestExtendAuthSessionRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Optional OIDC login_hint (typically the user's email) to pre-fill the
 	// IdP login form.
-	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
-	// hasGraphicalSession tells the daemon that the caller has a graphical session,
-	// which decides whether PKCE or the device code flow is preferred. The daemon
-	// cannot detect this itself: it does not inherit the session environment.
-	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
-	unknownFields       protoimpl.UnknownFields
-	sizeCache           protoimpl.SizeCache
+	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RequestExtendAuthSessionRequest) Reset() {
@@ -5951,13 +5936,6 @@ func (x *RequestExtendAuthSessionRequest) GetHint() string {
 	return ""
 }
 
-func (x *RequestExtendAuthSessionRequest) GetHasGraphicalSession() bool {
-	if x != nil {
-		return x.HasGraphicalSession
-	}
-	return false
-}
-
 // RequestExtendAuthSessionResponse carries the verification URI the UI
 // should open in a browser. The daemon retains the flow state and resolves
 // it via WaitExtendAuthSession.
@@ -7525,10 +7503,9 @@ const file_daemon_proto_rawDesc = "" +
 	"sshHostKey\x12\x16\n" +
 	"\x06peerIP\x18\x02 \x01(\tR\x06peerIP\x12\x1a\n" +
 	"\bpeerFQDN\x18\x03 \x01(\tR\bpeerFQDN\x12\x14\n" +
-	"\x05found\x18\x04 \x01(\bR\x05found\"k\n" +
+	"\x05found\x18\x04 \x01(\bR\x05found\"9\n" +
 	"\x15RequestJWTAuthRequest\x12\x17\n" +
-	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
-	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
 	"\x05_hint\"\x9a\x02\n" +
 	"\x16RequestJWTAuthResponse\x12(\n" +
 	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +
@@ -7548,10 +7525,9 @@ const file_daemon_proto_rawDesc = "" +
 	"\x14WaitJWTTokenResponse\x12\x14\n" +
 	"\x05token\x18\x01 \x01(\tR\x05token\x12\x1c\n" +
 	"\ttokenType\x18\x02 \x01(\tR\ttokenType\x12\x1c\n" +
-	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"u\n" +
+	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"C\n" +
 	"\x1fRequestExtendAuthSessionRequest\x12\x17\n" +
-	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
-	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
 	"\x05_hint\"\xe0\x01\n" +
 	" RequestExtendAuthSessionResponse\x12(\n" +
 	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +

client/proto/daemon.proto

@@ -894,10 +894,6 @@ message GetPeerSSHHostKeyResponse {
 message RequestJWTAuthRequest {
   // hint for OIDC login_hint parameter (typically email address)
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestJWTAuthResponse contains authentication flow information
@@ -941,10 +937,6 @@ message RequestExtendAuthSessionRequest {
   // Optional OIDC login_hint (typically the user's email) to pre-fill the
   // IdP login form.
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestExtendAuthSessionResponse carries the verification URI the UI

client/server/server.go

@@ -1723,8 +1723,8 @@ func (s *Server) RequestJWTAuth(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1827,8 +1827,8 @@ func (s *Server) RequestExtendAuthSession(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -2000,6 +2000,13 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func (s *Server) runProbes(ctx context.Context, waitForProbeResult bool) {
 	if s.connectClient == nil {
 		return

client/ssh/common.go

@@ -13,7 +13,6 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -93,8 +92,7 @@ func printAuthInstructions(stderr io.Writer, authResponse *proto.RequestJWTAuthR
 
 // RequestJWTToken requests or retrieves a JWT token for SSH authentication
 func RequestJWTToken(ctx context.Context, client proto.DaemonServiceClient, stdout, stderr io.Writer, useCache bool, hint string, openBrowser func(string) error) (string, error) {
-	// the ssh client runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestJWTAuthRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestJWTAuthRequest{}
 	if hint != "" {
 		req.Hint = &hint
 	}
@@ -195,3 +193,4 @@ func buildAddressList(hostname string, remote net.Addr) []string {
 	}
 	return addresses
 }
+

client/ssh/server/command_execution_windows.go

@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{

client/ssh/server/port_forwarding.go

@@ -133,12 +133,7 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
-	// is asked directly rather than through isPrivilegedOrUnknown: that helper
-	// reports an account it cannot evaluate as privileged, which is safe for a
-	// refusal and unsafe for a grant such as this one. Windows has returned
-	// above, so Uid here is a Unix uid and never a SID.
-	if result.User != nil && result.User.Uid == "0" {
+	if result.User != nil && isPrivilegedUsername(result.User.Username) {
 		return nil
 	}
 

client/ssh/server/privileges_other.go

@@ -1,16 +0,0 @@
-//go:build !windows
-
-package server
-
-// isProcessElevated is only meaningful on Windows; other platforms use the
-// effective UID check in isCurrentProcessPrivileged.
-func isProcessElevated() bool {
-	return false
-}
-
-// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
-// privileged on other platforms so a caller refusing privileged accounts fails
-// closed.
-func isWindowsAccountPrivilegedOrUnknown(string) bool {
-	return true
-}

client/ssh/server/privileges_windows.go

@@ -1,228 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"fmt"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-var (
-	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
-	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
-)
-
-const (
-	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
-	// the user belongs to through a global group.
-	lgIncludeIndirect  = 0x1
-	maxPreferredLength = 0xFFFFFFFF
-)
-
-// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
-type localGroupUsersInfo0 struct {
-	name *uint16
-}
-
-// isProcessElevated reports whether the current process token is elevated
-// (TokenElevation): true for elevated administrators, the built-in
-// Administrator, administrators with UAC disabled, and SYSTEM; false for
-// standard users and administrators running with a UAC-filtered token.
-func isProcessElevated() bool {
-	return windows.GetCurrentProcessToken().IsElevated()
-}
-
-// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
-// on this machine: a well-known service account, a built-in Administrator
-// (RID 500), or a member of the local Administrators group, directly or through
-// nested groups.
-//
-// An account whose privilege cannot be determined counts as privileged, which
-// is why the name says "or unknown". That is fail-closed for a caller that
-// refuses privileged accounts, and fail-open for a caller that grants something
-// to them, so only the former may use this.
-func isWindowsAccountPrivilegedOrUnknown(username string) bool {
-	sid, _, _, err := windows.LookupSID("", username)
-	if err != nil {
-		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
-		return true
-	}
-
-	if isPrivilegedUserSID(sid) {
-		return true
-	}
-
-	member, err := isLocalAdminsMember(username)
-	if err != nil {
-		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
-		return true
-	}
-	return member
-}
-
-// isPrivilegedUserSID reports whether the SID itself identifies a privileged
-// principal, without consulting group membership.
-func isPrivilegedUserSID(sid *windows.SID) bool {
-	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinLocalServiceSid,
-		windows.WinNetworkServiceSid,
-		windows.WinBuiltinAdministratorsSid,
-	}
-	for _, sidType := range wellKnown {
-		if sid.IsWellKnown(sidType) {
-			return true
-		}
-	}
-	return isBuiltinAdministratorSID(sid)
-}
-
-// isBuiltinAdministratorSID reports whether the SID is a machine or domain
-// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
-// that account; it can be renamed but cannot be removed from the
-// Administrators group.
-func isBuiltinAdministratorSID(sid *windows.SID) bool {
-	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-		return false
-	}
-	count := sid.SubAuthorityCount()
-	if count < 2 || sid.SubAuthority(0) != 21 {
-		return false
-	}
-	return sid.SubAuthority(uint32(count-1)) == 500
-}
-
-// isLocalAdminsMember reports whether the account is a member of the local
-// Administrators group.
-//
-// Local accounts are checked against the local SAM, which is authoritative for
-// them and, unlike a token, cannot under-report: UAC filters the tokens of
-// local administrators, and a filtered token carries Administrators as
-// deny-only, which a membership check on the token would read as "not a
-// member". Domain accounts are exempt from that filtering, so for them an S4U
-// token is preferred because its group list is LSA's transitive expansion and
-// therefore covers nested and universal groups plus the machine's own local
-// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
-// logon, so it serves as the fallback when no token can be obtained.
-func isLocalAdminsMember(username string) (bool, error) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	if err != nil {
-		return false, fmt.Errorf("create Administrators SID: %w", err)
-	}
-
-	account, domain := parseUsername(username)
-	if NewPrivilegeDropper().isLocalUser(domain) {
-		return localGroupsContainSID(account, adminSid)
-	}
-
-	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
-	if s4uErr == nil {
-		return member, nil
-	}
-	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
-
-	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
-	if err != nil {
-		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
-	}
-	return member, nil
-}
-
-// s4uTokenIsMember obtains an S4U token for the account and checks whether the
-// given SID is enabled in it.
-func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
-	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
-	if err != nil {
-		return false, err
-	}
-	defer func() {
-		if err := windows.CloseHandle(token); err != nil {
-			log.Debugf("close S4U token: %v", err)
-		}
-	}()
-	return windows.Token(token).IsMember(sid)
-}
-
-// localGroupsContainSID reports whether the wanted group is among the local
-// groups the account belongs to, directly or through a global group.
-//
-// The wanted SID is resolved to its group name once and compared against the
-// enumerated names. Well-known SIDs resolve from a static table, so that lookup
-// needs no domain controller, and it keeps the comparison correct for a renamed
-// or localized group because both sides then carry the new name. Resolving each
-// enumerated name back to a SID instead would add a lookup per group that can
-// block until it times out while a domain controller is unreachable, and cannot
-// change the outcome: the names enumerated here are local groups of this
-// machine, whose names are unique, so a name match identifies the group.
-//
-// A failure to resolve the wanted SID is returned rather than reported as
-// "not a member", so a privilege check built on this fails closed.
-func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
-	wantName, _, _, err := want.LookupAccount("")
-	if err != nil {
-		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
-	}
-
-	groups, err := netUserGetLocalGroups(username)
-	if err != nil {
-		return false, err
-	}
-
-	for _, group := range groups {
-		if strings.EqualFold(group, wantName) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// netUserGetLocalGroups returns the names of the local groups the account is a
-// member of, including indirect membership through global groups.
-func netUserGetLocalGroups(username string) ([]string, error) {
-	name16, err := windows.UTF16PtrFromString(username)
-	if err != nil {
-		return nil, fmt.Errorf("convert username: %w", err)
-	}
-
-	var buf *byte
-	var entriesRead, totalEntries uint32
-	status, _, _ := procNetUserGetLocalGroups.Call(
-		0, // local server
-		uintptr(unsafe.Pointer(name16)),
-		0, // level 0: LOCALGROUP_USERS_INFO_0
-		lgIncludeIndirect,
-		uintptr(unsafe.Pointer(&buf)),
-		maxPreferredLength,
-		uintptr(unsafe.Pointer(&entriesRead)),
-		uintptr(unsafe.Pointer(&totalEntries)),
-	)
-	if status != 0 {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
-	}
-	if buf == nil {
-		return nil, nil
-	}
-	defer func() {
-		if err := windows.NetApiBufferFree(buf); err != nil {
-			log.Debugf("free NetApi buffer: %v", err)
-		}
-	}()
-
-	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
-	// short read is not expected. Report it rather than silently returning a
-	// subset of the account's groups.
-	if entriesRead != totalEntries {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
-	}
-
-	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
-	groups := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		groups = append(groups, windows.UTF16PtrToString(entry.name))
-	}
-	return groups, nil
-}

client/ssh/server/privileges_windows_test.go

@@ -1,293 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"os/user"
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// filterNormalAccount limits NetUserEnum to normal user accounts.
-const filterNormalAccount = 0x2
-
-// TOKEN_ELEVATION_TYPE values.
-const (
-	tokenElevationTypeDefault = 1
-	tokenElevationTypeFull    = 2
-	tokenElevationTypeLimited = 3
-)
-
-// tokenElevationType reads TokenElevationType from a token.
-func tokenElevationType(token windows.Token) (uint32, error) {
-	var elevationType, returnedLen uint32
-	err := windows.GetTokenInformation(token, windows.TokenElevationType,
-		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
-	if err != nil {
-		return 0, err
-	}
-	return elevationType, nil
-}
-
-// userInfo0 mirrors USER_INFO_0.
-type userInfo0 struct {
-	name *uint16
-}
-
-func mustParseSID(t *testing.T, s string) *windows.SID {
-	t.Helper()
-	sid, err := windows.StringToSid(s)
-	require.NoError(t, err, "parse SID %s", s)
-	return sid
-}
-
-// localAccountNames returns the names of the local user accounts.
-func localAccountNames(t *testing.T) []string {
-	t.Helper()
-
-	var buf *byte
-	var entriesRead, totalEntries, resume uint32
-	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
-		&entriesRead, &totalEntries, &resume)
-	require.NoError(t, err, "enumerate local users")
-	t.Cleanup(func() {
-		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
-	})
-
-	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
-	names := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		names = append(names, windows.UTF16PtrToString(entry.name))
-	}
-	return names
-}
-
-// localAccountNameByRID returns the name of the local account carrying the
-// given RID. Accounts such as Administrator and Guest can be renamed and are
-// localized, so tests must not name them literally.
-func localAccountNameByRID(t *testing.T, rid uint32) string {
-	t.Helper()
-
-	for _, name := range localAccountNames(t) {
-		sid, _, _, err := windows.LookupSID("", name)
-		if err != nil {
-			continue
-		}
-		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-			continue
-		}
-		count := sid.SubAuthorityCount()
-		if count < 2 || sid.SubAuthority(0) != 21 {
-			continue
-		}
-		if sid.SubAuthority(uint32(count-1)) == rid {
-			return name
-		}
-	}
-
-	t.Fatalf("no local account with RID %d", rid)
-	return ""
-}
-
-// wellKnownAccountName resolves a well-known SID to the qualified account name
-// the local system uses for it, which is localized.
-func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
-	t.Helper()
-
-	sid, err := windows.CreateWellKnownSid(sidType)
-	require.NoError(t, err, "create well-known SID")
-	name, domain, _, err := sid.LookupAccount("")
-	require.NoError(t, err, "resolve %s to an account name", sid)
-	if domain == "" {
-		return name
-	}
-	return domain + `\` + name
-}
-
-func TestIsBuiltinAdministratorSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
-		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
-		{"system", "S-1-5-18", false},
-		{"administrators_group", "S-1-5-32-544", false},
-		{"non_nt_authority", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsPrivilegedUserSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"local_system", "S-1-5-18", true},
-		{"local_service", "S-1-5-19", true},
-		{"network_service", "S-1-5-20", true},
-		{"administrators_group", "S-1-5-32-544", true},
-		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"users_group", "S-1-5-32-545", false},
-		{"everyone", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
-	tests := []struct {
-		name     string
-		username string
-		want     bool
-	}{
-		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
-		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
-		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
-		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
-		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
-		// exist on every Windows installation, though they may be disabled.
-		{"builtin_administrator", localAccountNameByRID(t, 500), true},
-		{"guest", localAccountNameByRID(t, 501), false},
-		// Unresolvable accounts fail closed.
-		{"nonexistent_user", "netbird-no-such-user", true},
-		{"empty_username", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
-		})
-	}
-}
-
-func TestIsProcessElevated(t *testing.T) {
-	elevated := isProcessElevated()
-
-	// TokenElevationType is a second, independent view of the same token:
-	// Full means elevated and Limited means a filtered administrator, while
-	// Default covers both a standard user and an administrator with no linked
-	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
-	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
-	require.NoError(t, err, "read token elevation type")
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
-	// counts only enabled SIDs, so a filtered administrator reports false here.
-	member, err := windows.Token(0).IsMember(adminSid)
-	require.NoError(t, err, "check own Administrators membership")
-
-	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
-
-	switch elevationType {
-	case tokenElevationTypeFull:
-		assert.True(t, elevated, "a token of elevation type Full must report elevated")
-	case tokenElevationTypeLimited:
-		assert.False(t, elevated, "a filtered administrator token must not report elevated")
-	}
-
-	// Administrators enabled in the token means the token wields administrative
-	// rights, which is what elevation reports.
-	if member {
-		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
-	}
-}
-
-// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
-// for domain accounts. S4U logons need the TCB privilege, so the test runs
-// only as SYSTEM (which is how CI executes the suite). For local accounts the
-// token's Administrators membership must agree with the SAM enumeration.
-func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
-	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
-	require.NoError(t, err, "create SYSTEM SID")
-	current, err := user.Current()
-	require.NoError(t, err, "get current user")
-	if current.Uid != system.String() {
-		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
-	}
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	checked := 0
-	for _, name := range localAccountNames(t) {
-		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
-		if err != nil {
-			// Disabled or logon-restricted accounts cannot get an S4U logon.
-			t.Logf("skipping %s: %v", name, err)
-			continue
-		}
-		viaSAM, err := localGroupsContainSID(name, adminSid)
-		require.NoError(t, err, "enumerate local groups for %s", name)
-
-		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
-		checked++
-	}
-	// Ineligible accounts are skipped, so without this the test could report
-	// success while comparing nothing at all.
-	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
-	t.Logf("checked %d local accounts via S4U", checked)
-}
-
-// TestLocalGroupsContainSID_Administrator checks the positive case against the
-// built-in Administrator, a member of Administrators on every installation.
-func TestLocalGroupsContainSID_Administrator(t *testing.T) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	administrator := localAccountNameByRID(t, 500)
-	member, err := localGroupsContainSID(administrator, adminSid)
-	require.NoError(t, err, "enumerate local groups for %s", administrator)
-	assert.True(t, member, "%s is a member of the Administrators group", administrator)
-}
-
-// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
-// that resolves to no group: the error must surface rather than being reported
-// as "not a member", so the privilege check treats the account as privileged.
-func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
-	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
-
-	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
-	require.Error(t, err, "must report an error when the wanted group cannot be identified")
-}
-
-func TestLocalGroupsContainSID_Guest(t *testing.T) {
-	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
-	require.NoError(t, err, "create Guests SID")
-	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	guest := localAccountNameByRID(t, 501)
-
-	inGuests, err := localGroupsContainSID(guest, guestsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
-
-	inAdmins, err := localGroupsContainSID(guest, adminsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
-}

client/ssh/server/server_config_test.go

@@ -239,7 +239,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
-		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -249,7 +248,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -259,7 +257,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -269,7 +266,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -277,7 +273,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -285,35 +280,13 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
-			uid:         "0",
 			expectError: false,
 		},
-		{
-			// Only uid 0 is privileged, whatever the account is called.
-			name:          "uid 0 under another name may bind a privileged port",
-			forwardType:   "remote",
-			port:          22,
-			username:      "toor",
-			uid:           "0",
-			expectError:   false,
-			skipOnWindows: true,
-		},
-		{
-			name:          "account named root without uid 0 may not",
-			forwardType:   "remote",
-			port:          22,
-			username:      "root",
-			uid:           "1000",
-			expectError:   true,
-			errorMsg:      "cannot bind to privileged port",
-			skipOnWindows: true,
-		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -326,7 +299,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username, Uid: tt.uid},
+				User:    &user.User{Username: tt.username},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -447,13 +420,6 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
-	// Windows classification depends on account SIDs and group membership, and
-	// the accounts involved carry localized, renameable names. It is covered by
-	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
-	if runtime.GOOS == "windows" {
-		t.Skip("covered by TestIsWindowsAccountPrivileged")
-	}
-
 	tests := []struct {
 		username    string
 		expected    bool
@@ -474,16 +440,44 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-		{
-			username:    "Administrator",
-			expected:    false,
-			description: "Administrator should not be privileged on non-Windows systems",
-		},
+	}
+
+	// Add Windows-specific tests
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    true,
+				description: "Administrator should be considered privileged on Windows",
+			},
+			{
+				username:    "administrator",
+				expected:    true,
+				description: "administrator should be considered privileged on Windows (case insensitive)",
+			},
+		}...)
+	} else {
+		// On non-Windows systems, Administrator should not be privileged
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    false,
+				description: "Administrator should not be privileged on non-Windows systems",
+			},
+		}...)
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedOrUnknown(tt.username)
+			result := isPrivilegedUsername(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}

client/ssh/server/sftp_windows.go

@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := parseUsername(targetUser.Username)
+	username, domain := s.parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {