Bump golang.zx2c4.com/wireguard/windows

Bumps the wireguard group with 1 update in the / directory: golang.zx2c4.com/wireguard/windows.


Updates `golang.zx2c4.com/wireguard/windows` from 0.5.3 to 1.0.1

---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: wireguard
...

Signed-off-by: dependabot[bot] <support@github.com>

client/android/client.go

@@ -247,6 +247,9 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/iface/configurer/common.go

@@ -3,7 +3,6 @@ package configurer
 import (
 	"net"
 	"net/netip"
-	"time"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -20,43 +19,6 @@ func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bo
 	}
 }
 
-// buildIdlePeerEndpointConfig creates a config that removes and re-creates a peer in a
-// single transaction with the given allowed IPs, endpoint and disabled keepalive.
-func buildIdlePeerEndpointConfig(peerKey wgtypes.Key, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) wgtypes.Config {
-	keepAlive := time.Duration(0)
-	return wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{
-			{
-				PublicKey: peerKey,
-				Remove:    true,
-			},
-			{
-				PublicKey:                   peerKey,
-				AllowedIPs:                  prefixesToIPNets(allowedIPs),
-				Endpoint:                    endpoint,
-				PersistentKeepaliveInterval: &keepAlive,
-			},
-		},
-	}
-}
-
-// mergePrefixes returns the union of the two prefix lists, keeping the original order and
-// dropping duplicates.
-func mergePrefixes(current, base []netip.Prefix) []netip.Prefix {
-	merged := make([]netip.Prefix, 0, len(current)+len(base))
-	seen := make(map[netip.Prefix]struct{}, len(current)+len(base))
-	for _, group := range [][]netip.Prefix{current, base} {
-		for _, prefix := range group {
-			if _, ok := seen[prefix]; ok {
-				continue
-			}
-			seen[prefix] = struct{}{}
-			merged = append(merged, prefix)
-		}
-	}
-	return merged
-}
-
 func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
 	ipNets := make([]net.IPNet, len(prefixes))
 	for i, prefix := range prefixes {

client/iface/configurer/kernel_unix.go

@@ -3,7 +3,6 @@
 package configurer
 
 import (
-	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -146,39 +145,6 @@ func (c *KernelConfigurer) RemovePeer(peerKey string) error {
 	return nil
 }
 
-// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
-// handshake state while preserving the peer's currently installed allowed IPs.
-func (c *KernelConfigurer) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	var current []netip.Prefix
-	existing, err := c.getPeer(c.deviceName, peerKey)
-	switch {
-	case errors.Is(err, ErrPeerNotFound):
-	case err != nil:
-		return fmt.Errorf("get peer: %w", err)
-	default:
-		for _, ipNet := range existing.AllowedIPs {
-			addr, ok := netip.AddrFromSlice(ipNet.IP)
-			if !ok {
-				log.Warnf("failed to convert allowed IP %s of peer %s", ipNet.String(), peerKey)
-				continue
-			}
-			ones, _ := ipNet.Mask.Size()
-			current = append(current, netip.PrefixFrom(addr.Unmap(), ones))
-		}
-	}
-
-	config := buildIdlePeerEndpointConfig(peerKeyParsed, mergePrefixes(current, allowedIPs), endpoint)
-	if err := c.configure(config); err != nil {
-		return fmt.Errorf(`received error "%w" while setting idle endpoint for peer %s on interface %s`, err, peerKey, c.deviceName)
-	}
-	return nil
-}
-
 func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	ipNet := net.IPNet{
 		IP:   allowedIP.Addr().AsSlice(),

client/iface/configurer/usp.go

@@ -210,64 +210,6 @@ func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 	return ipcErr
 }
 
-// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
-// handshake state while preserving the peer's currently installed allowed IPs.
-func (c *WGUSPConfigurer) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	current, err := c.currentAllowedIPs(hex.EncodeToString(peerKeyParsed[:]))
-	if err != nil {
-		return fmt.Errorf("get current allowed IPs: %w", err)
-	}
-
-	config := buildIdlePeerEndpointConfig(peerKeyParsed, mergePrefixes(current, allowedIPs), endpoint)
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		return fmt.Errorf("set idle peer endpoint: %w", err)
-	}
-
-	if endpoint != nil {
-		addr, err := netip.ParseAddr(endpoint.IP.String())
-		if err != nil {
-			return fmt.Errorf("parse endpoint address: %w", err)
-		}
-		c.activityRecorder.UpsertAddress(peerKey, netip.AddrPortFrom(addr.Unmap(), uint16(endpoint.Port)))
-	}
-	return nil
-}
-
-// currentAllowedIPs returns the allowed IPs currently installed for the peer identified by
-// its hex-encoded public key. It returns an empty list when the peer does not exist.
-func (c *WGUSPConfigurer) currentAllowedIPs(hexKey string) ([]netip.Prefix, error) {
-	ipc, err := c.device.IpcGet()
-	if err != nil {
-		return nil, err
-	}
-
-	var prefixes []netip.Prefix
-	foundPeer := false
-	for _, line := range strings.Split(ipc, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "public_key=") {
-			foundPeer = line == "public_key="+hexKey
-			continue
-		}
-		if !foundPeer || !strings.HasPrefix(line, "allowed_ip=") {
-			continue
-		}
-
-		prefix, err := netip.ParsePrefix(strings.TrimPrefix(line, "allowed_ip="))
-		if err != nil {
-			log.Warnf("failed to parse allowed IP %q: %v", line, err)
-			continue
-		}
-		prefixes = append(prefixes, prefix)
-	}
-	return prefixes, nil
-}
-
 func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	ipNet := net.IPNet{
 		IP:   allowedIP.Addr().AsSlice(),

client/iface/configurer/usp_idle_test.go

@@ -1,158 +0,0 @@
-package configurer
-
-import (
-	"encoding/hex"
-	"net"
-	"net/netip"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	wgconn "golang.zx2c4.com/wireguard/conn"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/iface/bind"
-)
-
-// newTestConfigurer creates a configurer backed by an in-memory wireguard-go device.
-func newTestConfigurer(t *testing.T) *WGUSPConfigurer {
-	t.Helper()
-
-	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, []netip.Addr{}, 1280)
-	require.NoError(t, err)
-
-	wgDev := device.NewDevice(tunDev, wgconn.NewDefaultBind(), device.NewLogger(device.LogLevelSilent, "[test] "))
-	t.Cleanup(wgDev.Close)
-
-	c := NewUSPConfigurerNoUAPI(wgDev, "utun-test", bind.NewActivityRecorder())
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	require.NoError(t, c.ConfigureInterface(key.String(), 0))
-
-	return c
-}
-
-// peerAllowedIPs returns the allowed IPs currently installed for the given peer.
-func peerAllowedIPs(t *testing.T, c *WGUSPConfigurer, pubKey string) []string {
-	t.Helper()
-
-	var ips []string
-	for _, line := range peerIpcLines(t, c, pubKey) {
-		if strings.HasPrefix(line, "allowed_ip=") {
-			ips = append(ips, strings.TrimPrefix(line, "allowed_ip="))
-		}
-	}
-	return ips
-}
-
-// peerEndpoint returns the endpoint currently installed for the given peer.
-func peerEndpoint(t *testing.T, c *WGUSPConfigurer, pubKey string) string {
-	t.Helper()
-
-	for _, line := range peerIpcLines(t, c, pubKey) {
-		if strings.HasPrefix(line, "endpoint=") {
-			return strings.TrimPrefix(line, "endpoint=")
-		}
-	}
-	return ""
-}
-
-// peerIpcLines returns the uapi config lines belonging to the given peer.
-func peerIpcLines(t *testing.T, c *WGUSPConfigurer, pubKey string) []string {
-	t.Helper()
-
-	key, err := wgtypes.ParseKey(pubKey)
-	require.NoError(t, err)
-	hexKey := hex.EncodeToString(key[:])
-
-	ipc, err := c.device.IpcGet()
-	require.NoError(t, err)
-
-	var lines []string
-	inPeer := false
-	for _, line := range strings.Split(ipc, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "public_key=") {
-			inPeer = line == "public_key="+hexKey
-			continue
-		}
-		if inPeer && line != "" {
-			lines = append(lines, line)
-		}
-	}
-	return lines
-}
-
-// TestUSPConfigurer_IdlePeerEndpointPreservesAllowedIPs verifies the invariant the lazy idle
-// transition relies on: IdlePeerEndpoint re-creates the peer (dropping handshake state via the
-// remove+add transaction) while keeping every installed allowed IP, including routed
-// prefixes added later by the route manager, and points the endpoint at the wake listener.
-func TestUSPConfigurer_IdlePeerEndpointPreservesAllowedIPs(t *testing.T) {
-	c := newTestConfigurer(t)
-
-	peerKey, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	pubKey := peerKey.PublicKey().String()
-
-	overlay := netip.MustParsePrefix("100.64.0.5/32")
-	routed := netip.MustParsePrefix("10.99.0.0/24")
-
-	realEndpoint := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51821}
-	require.NoError(t, c.UpdatePeer(pubKey, []netip.Prefix{overlay}, 25*time.Second, realEndpoint, nil))
-	require.NoError(t, c.AddAllowedIP(pubKey, routed))
-
-	ips := peerAllowedIPs(t, c, pubKey)
-	require.Contains(t, ips, overlay.String(), "overlay prefix must be installed before the idle endpoint swap")
-	require.Contains(t, ips, routed.String(), "routed prefix must be installed before the idle endpoint swap")
-
-	wakeEndpoint := &net.UDPAddr{IP: net.ParseIP("127.2.0.5"), Port: 17473}
-	require.NoError(t, c.IdlePeerEndpoint(pubKey, []netip.Prefix{overlay}, wakeEndpoint))
-
-	ips = peerAllowedIPs(t, c, pubKey)
-	assert.Contains(t, ips, routed.String(), "routed prefix must survive the idle endpoint swap")
-	assert.Contains(t, ips, overlay.String(), "overlay prefix must survive the idle endpoint swap")
-	assert.Equal(t, "127.2.0.5:17473", peerEndpoint(t, c, pubKey), "endpoint must point at the wake listener after the idle endpoint swap")
-}
-
-// TestUSPConfigurer_IdlePeerEndpointCreatesMissingPeer verifies the cold-start arm path: when the
-// peer does not exist yet (never connected), IdlePeerEndpoint creates it with the given base
-// allowed IPs and the wake endpoint.
-func TestUSPConfigurer_IdlePeerEndpointCreatesMissingPeer(t *testing.T) {
-	c := newTestConfigurer(t)
-
-	peerKey, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	pubKey := peerKey.PublicKey().String()
-
-	overlay := netip.MustParsePrefix("100.64.0.5/32")
-	wakeEndpoint := &net.UDPAddr{IP: net.ParseIP("127.2.0.5"), Port: 17473}
-
-	require.NoError(t, c.IdlePeerEndpoint(pubKey, []netip.Prefix{overlay}, wakeEndpoint))
-
-	assert.Equal(t, []string{overlay.String()}, peerAllowedIPs(t, c, pubKey), "missing peer must be created with the base allowed IPs")
-	assert.Equal(t, "127.2.0.5:17473", peerEndpoint(t, c, pubKey), "missing peer must be created with the wake endpoint")
-}
-
-// TestUSPConfigurer_AddAllowedIPOnMissingPeerIsSilentNoOp documents the wireguard-go
-// behavior the removed-peer idle flow raced against: AddAllowedIP uses update_only,
-// which is a silent no-op when the peer does not exist. The idle transition must
-// therefore keep the WireGuard peer (Conn.Idle + IdlePeerEndpoint) instead of leaving a
-// window where the peer is absent.
-func TestUSPConfigurer_AddAllowedIPOnMissingPeerIsSilentNoOp(t *testing.T) {
-	c := newTestConfigurer(t)
-
-	peerKey, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	pubKey := peerKey.PublicKey().String()
-
-	routed := netip.MustParsePrefix("10.99.0.0/24")
-
-	require.NoError(t, c.AddAllowedIP(pubKey, routed), "update-only on a missing peer must not return an error")
-
-	assert.Empty(t, peerIpcLines(t, c, pubKey), "update-only call must not create the peer")
-}

client/iface/device/interface.go

@@ -15,7 +15,6 @@ type WGConfigurer interface {
 	ConfigureInterface(privateKey string, port int) error
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeer(peerKey string) error
-	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error

client/iface/iface.go

@@ -184,19 +184,6 @@ func (w *WGIface) RemovePeer(peerKey string) error {
 	return w.configurer.RemovePeer(peerKey)
 }
 
-// IdlePeerEndpoint re-creates the peer pointing at the lazy wake endpoint, dropping
-// handshake state while preserving the peer's currently installed allowed IPs.
-func (w *WGIface) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.configurer == nil {
-		return ErrIfaceNotFound
-	}
-
-	log.Debugf("Resetting peer on interface %s: %s, endpoint %s", w.tun.DeviceName(), peerKey, endpoint)
-	return w.configurer.IdlePeerEndpoint(peerKey, allowedIPs, endpoint)
-}
-
 // AddAllowedIP adds a prefix to the allowed IPs list of peer
 func (w *WGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	w.mu.Lock()

client/internal/conn_mgr.go

@@ -176,20 +176,23 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }
 
-// AddPeerConn registers the conn in the peer store and, in lazy mode, arms the wake endpoint.
-// It starts no connection activity; the caller calls StartPeerConn after registering the peer
-// in the status recorder.
-func (e *ConnMgr) AddPeerConn(peerKey string, conn *peer.Conn) (exists bool) {
+func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn) (exists bool) {
 	if success := e.peerStore.AddPeerConn(peerKey, conn); !success {
 		return true
 	}
 
 	if !e.isStartedWithLazyMgr() {
+		if err := conn.Open(ctx); err != nil {
+			conn.Log.Errorf("failed to open connection: %v", err)
+		}
 		return
 	}
 
 	if !lazyconn.IsSupported(conn.AgentVersionString()) {
-		conn.Log.Warnf("peer does not support lazy connection (%s), will open permanent connection", conn.AgentVersionString())
+		conn.Log.Warnf("peer does not support lazy connection (%s), open permanent connection", conn.AgentVersionString())
+		if err := conn.Open(ctx); err != nil {
+			conn.Log.Errorf("failed to open connection: %v", err)
+		}
 		return
 	}
 
@@ -201,12 +204,18 @@ func (e *ConnMgr) AddPeerConn(peerKey string, conn *peer.Conn) (exists bool) {
 	}
 	excluded, err := e.lazyConnMgr.AddPeer(lazyPeerCfg)
 	if err != nil {
-		conn.Log.Errorf("failed to add peer to lazyconn manager, will open permanent connection: %v", err)
+		conn.Log.Errorf("failed to add peer to lazyconn manager: %v", err)
+		if err := conn.Open(ctx); err != nil {
+			conn.Log.Errorf("failed to open connection: %v", err)
+		}
 		return
 	}
 
 	if excluded {
-		conn.Log.Infof("peer is on lazy conn manager exclude list, will open permanent connection")
+		conn.Log.Infof("peer is on lazy conn manager exclude list, opening connection")
+		if err := conn.Open(ctx); err != nil {
+			conn.Log.Errorf("failed to open connection: %v", err)
+		}
 		return
 	}
 
@@ -214,29 +223,12 @@ func (e *ConnMgr) AddPeerConn(peerKey string, conn *peer.Conn) (exists bool) {
 	return
 }
 
-// StartPeerConn starts the activity prepared by AddPeerConn: lazy wake listening or a
-// permanent connection.
-func (e *ConnMgr) StartPeerConn(ctx context.Context, peerKey string) {
-	conn, ok := e.peerStore.PeerConn(peerKey)
-	if !ok {
-		return
-	}
-
-	if e.isStartedWithLazyMgr() && e.lazyConnMgr.StartPeer(peerKey) {
-		return
-	}
-
-	if err := conn.Open(ctx); err != nil {
-		conn.Log.Errorf("failed to open connection: %v", err)
-	}
-}
-
 func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn, ok := e.peerStore.Remove(peerKey)
 	if !ok {
 		return
 	}
-	defer conn.Close()
+	defer conn.Close(false)
 
 	if !e.isStartedWithLazyMgr() {
 		return

client/internal/engine.go

@@ -1771,20 +1771,16 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 		return fmt.Errorf("create peer connection: %w", err)
 	}
 
-	// Order matters: the WireGuard peer must exist before the peer becomes visible in the
-	// status recorder, and event sources may start only after the recorder registration.
-	if exists := e.connMgr.AddPeerConn(peerKey, conn); exists {
-		conn.Close()
-		return fmt.Errorf("peer already exists: %s", peerKey)
-	}
-
 	peerV4, peerV6 := overlayAddrsFromAllowedIPs(peerConfig.GetAllowedIps(), e.wgInterface.Address().IPv6Net)
 	err = e.statusRecorder.AddPeer(peerKey, peerConfig.Fqdn, addrToString(peerV4), addrToString(peerV6))
 	if err != nil {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}
 
-	e.connMgr.StartPeerConn(e.ctx, peerKey)
+	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn); exists {
+		conn.Close(false)
+		return fmt.Errorf("peer already exists: %s", peerKey)
+	}
 
 	return nil
 }

client/internal/engine_test.go

@@ -53,7 +53,6 @@ type MockWGIface struct {
 	UpdateAddrFunc             func(newAddr wgaddr.Address) error
 	UpdatePeerFunc             func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeerFunc             func(peerKey string) error
-	IdlePeerEndpointFunc       func(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIPFunc           func(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIPFunc        func(peerKey string, allowedIP netip.Prefix) error
 	CloseFunc                  func() error
@@ -125,13 +124,6 @@ func (m *MockWGIface) RemovePeer(peerKey string) error {
 	return m.RemovePeerFunc(peerKey)
 }
 
-func (m *MockWGIface) IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error {
-	if m.IdlePeerEndpointFunc == nil {
-		return nil
-	}
-	return m.IdlePeerEndpointFunc(peerKey, allowedIPs, endpoint)
-}
-
 func (m *MockWGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	return m.AddAllowedIPFunc(peerKey, allowedIP)
 }

client/internal/iface_common.go

@@ -32,7 +32,6 @@ type wgIfaceBase interface {
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemoveEndpointAddress(key string) error
 	RemovePeer(peerKey string) error
-	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
 	AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	Close() error

client/internal/lazyconn/activity/listener_bind.go

@@ -106,7 +106,7 @@ func (d *BindListener) setupLazyConn() error {
 		IP:   d.fakeIP.AsSlice(),
 		Port: lazyBindPort,
 	}
-	return d.wgIface.IdlePeerEndpoint(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, endpoint)
+	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, endpoint, nil)
 }
 
 // ReadPackets blocks until activity is detected on the LazyConn or the listener is closed.

client/internal/lazyconn/activity/listener_bind_test.go

@@ -9,6 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
@@ -44,7 +45,7 @@ type MockWGIfaceBind struct {
 	endpointMgr *mockEndpointManager
 }
 
-func (m *MockWGIfaceBind) IdlePeerEndpoint(string, []netip.Prefix, *net.UDPAddr) error {
+func (m *MockWGIfaceBind) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
 	return nil
 }
 

client/internal/lazyconn/activity/listener_udp.go

@@ -101,7 +101,7 @@ func (d *UDPListener) Close() {
 
 func (d *UDPListener) createEndpoint() error {
 	d.peerCfg.Log.Debugf("creating lazy endpoint: %s", d.endpoint.String())
-	return d.wgIface.IdlePeerEndpoint(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, d.endpoint)
+	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, d.endpoint, nil)
 }
 
 func (d *UDPListener) newConn() (*net.UDPConn, error) {

client/internal/lazyconn/activity/manager.go

@@ -5,8 +5,10 @@ import (
 	"net"
 	"net/netip"
 	"sync"
+	"time"
 
 	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
@@ -28,23 +30,18 @@ type Event struct {
 }
 
 type WgInterface interface {
-	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
 	MTU() uint16
 }
 
-type managedListener struct {
-	l       listener
-	started bool
-}
-
 type Manager struct {
 	OnActivityChan chan Event
 
 	wgIface WgInterface
 
-	peers map[peerid.ConnID]*managedListener
+	peers map[peerid.ConnID]listener
 	done  chan struct{}
 
 	mu sync.Mutex
@@ -54,24 +51,13 @@ func NewManager(wgIface WgInterface) *Manager {
 	m := &Manager{
 		OnActivityChan: make(chan Event, 1),
 		wgIface:        wgIface,
-		peers:          make(map[peerid.ConnID]*managedListener),
+		peers:          make(map[peerid.ConnID]listener),
 		done:           make(chan struct{}),
 	}
 	return m
 }
 
-// MonitorPeerActivity creates the peer's activity listener and starts consuming traffic on it.
 func (m *Manager) MonitorPeerActivity(peerCfg lazyconn.PeerConfig) error {
-	if err := m.CreatePeerListener(peerCfg); err != nil {
-		return err
-	}
-	m.StartPeerListener(peerCfg.PeerConnID)
-	return nil
-}
-
-// CreatePeerListener arms the wake endpoint without starting to consume traffic; packets queue
-// in the listener socket until StartPeerListener runs.
-func (m *Manager) CreatePeerListener(peerCfg lazyconn.PeerConfig) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -85,23 +71,11 @@ func (m *Manager) CreatePeerListener(peerCfg lazyconn.PeerConfig) error {
 		return err
 	}
 
-	m.peers[peerCfg.PeerConnID] = &managedListener{l: listener}
+	m.peers[peerCfg.PeerConnID] = listener
+	go m.waitForTraffic(listener, peerCfg.PeerConnID)
 	return nil
 }
 
-// StartPeerListener starts consuming traffic on the peer's armed activity listener.
-func (m *Manager) StartPeerListener(peerConnID peerid.ConnID) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	ml, ok := m.peers[peerConnID]
-	if !ok || ml.started {
-		return
-	}
-	ml.started = true
-	go m.waitForTraffic(ml.l, peerConnID)
-}
-
 func (m *Manager) createListener(peerCfg lazyconn.PeerConfig) (listener, error) {
 	if !m.wgIface.IsUserspaceBind() {
 		return NewUDPListener(m.wgIface, peerCfg)
@@ -119,13 +93,13 @@ func (m *Manager) RemovePeer(log *log.Entry, peerConnID peerid.ConnID) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	ml, ok := m.peers[peerConnID]
+	listener, ok := m.peers[peerConnID]
 	if !ok {
 		return
 	}
 	log.Debugf("removing activity listener")
 	delete(m.peers, peerConnID)
-	closeListener(ml)
+	listener.Close()
 }
 
 func (m *Manager) Close() {
@@ -133,22 +107,12 @@ func (m *Manager) Close() {
 	defer m.mu.Unlock()
 
 	close(m.done)
-	for peerID, ml := range m.peers {
+	for peerID, listener := range m.peers {
 		delete(m.peers, peerID)
-		closeListener(ml)
+		listener.Close()
 	}
 }
 
-// closeListener closes the listener. Close waits for the reader goroutine, so for a
-// never-started listener the reader is launched first; outside waitForTraffic it cannot emit events.
-func closeListener(ml *managedListener) {
-	if !ml.started {
-		ml.started = true
-		go ml.l.ReadPackets()
-	}
-	ml.l.Close()
-}
-
 func (m *Manager) waitForTraffic(l listener, peerConnID peerid.ConnID) {
 	l.ReadPackets()
 

client/internal/lazyconn/activity/manager_test.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
@@ -25,7 +26,7 @@ func (m *MocPeer) ConnID() peerid.ConnID {
 type MocWGIface struct {
 }
 
-func (m MocWGIface) IdlePeerEndpoint(string, []netip.Prefix, *net.UDPAddr) error {
+func (m MocWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
 	return nil
 }
 
@@ -49,11 +50,8 @@ func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (listener, bool) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	ml, exists := m.peers[peerConnID]
-	if !exists {
-		return nil, false
-	}
-	return ml.l, true
+	l, exists := m.peers[peerConnID]
+	return l, exists
 }
 
 func TestManager_MonitorPeerActivity(t *testing.T) {

client/internal/lazyconn/manager/manager.go

@@ -185,7 +185,6 @@ func (m *Manager) ExcludePeer(peerConfigs []lazyconn.PeerConfig) []string {
 	return added
 }
 
-// AddPeer arms the peer's wake endpoint without starting to consume traffic on it.
 func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 	m.managedPeersMu.Lock()
 	defer m.managedPeersMu.Unlock()
@@ -202,7 +201,7 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		return false, nil
 	}
 
-	if err := m.activityManager.CreatePeerListener(peerCfg); err != nil {
+	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
 		return false, err
 	}
 
@@ -212,29 +211,13 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		expectedWatcher: watcherActivity,
 	}
 
-	return false, nil
-}
-
-// StartPeer starts the peer's activity listener and applies HA activation. It reports whether
-// the peer is managed by the lazy manager.
-func (m *Manager) StartPeer(peerKey string) bool {
-	m.managedPeersMu.Lock()
-	defer m.managedPeersMu.Unlock()
-
-	peerCfg, ok := m.managedPeers[peerKey]
-	if !ok {
-		return false
-	}
-
-	m.activityManager.StartPeerListener(peerCfg.PeerConnID)
-
 	// Check if this peer should be activated because its HA group peers are active
-	if group, ok := m.shouldActivateNewPeer(peerKey); ok {
+	if group, ok := m.shouldActivateNewPeer(peerCfg.PublicKey); ok {
 		peerCfg.Log.Debugf("peer belongs to active HA group %s, will activate immediately", group)
-		m.activateNewPeerInActiveGroup(*peerCfg)
+		m.activateNewPeerInActiveGroup(peerCfg)
 	}
 
-	return true
+	return false, nil
 }
 
 // AddActivePeers adds a list of peers to the lazy connection manager
@@ -297,7 +280,7 @@ func (m *Manager) DeactivatePeer(peerID peerid.ConnID) {
 		return
 	}
 
-	m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey, false)
+	m.peerStore.PeerConnClose(mp.peerCfg.PublicKey)
 
 	mp.peerCfg.Log.Infof("start activity monitor")
 
@@ -586,7 +569,7 @@ func (m *Manager) onPeerInactivityTimedOut(peerIDs map[string]struct{}) {
 		mp.peerCfg.Log.Infof("connection timed out")
 
 		// this is blocking operation, potentially can be optimized
-		m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey, true)
+		m.peerStore.PeerConnIdle(mp.peerCfg.PublicKey)
 
 		mp.expectedWatcher = watcherActivity
 

client/internal/lazyconn/wgiface.go

@@ -3,6 +3,9 @@ package lazyconn
 import (
 	"net"
 	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/monotime"
@@ -10,7 +13,7 @@ import (
 
 type WGIface interface {
 	RemovePeer(peerKey string) error
-	IdlePeerEndpoint(peerKey string, allowedIPs []netip.Prefix, endpoint *net.UDPAddr) error
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
 	LastActivities() map[string]monotime.Time

client/internal/peer/conn.go

@@ -285,20 +285,8 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 	return nil
 }
 
-// Close closes this peer Conn issuing a close event to the Conn closeCh and removes the WireGuard peer
-func (conn *Conn) Close() {
-	conn.close(false, true)
-}
-
-// Idle tears down the connection for the lazy idle state: transports and proxies are
-// closed but the WireGuard peer is kept, so its AllowedIPs (including routed prefixes
-// installed by the route manager) survive until the activity listener re-points the
-// endpoint at the wake listener.
-func (conn *Conn) Idle(signalToRemote bool) {
-	conn.close(signalToRemote, false)
-}
-
-func (conn *Conn) close(signalToRemote bool, removeWgPeer bool) {
+// Close closes this peer Conn issuing a close event to the Conn closeCh
+func (conn *Conn) Close(signalToRemote bool) {
 	conn.mu.Lock()
 	defer conn.wgWatcherWg.Wait()
 	defer conn.mu.Unlock()
@@ -341,12 +329,8 @@ func (conn *Conn) close(signalToRemote bool, removeWgPeer bool) {
 		conn.wgProxyICE = nil
 	}
 
-	if removeWgPeer {
-		if err := conn.endpointUpdater.RemoveWgPeer(); err != nil {
-			conn.Log.Errorf("failed to remove wg endpoint: %v", err)
-		}
-	} else {
-		conn.endpointUpdater.CancelPendingUpdates()
+	if err := conn.endpointUpdater.RemoveWgPeer(); err != nil {
+		conn.Log.Errorf("failed to remove wg endpoint: %v", err)
 	}
 
 	if conn.evalStatus() == StatusConnected && conn.onDisconnected != nil {

client/internal/peer/endpoint.go

@@ -65,16 +65,6 @@ func (e *EndpointUpdater) RemoveWgPeer() error {
 	return e.wgConfig.WgInterface.RemovePeer(e.wgConfig.RemoteKey)
 }
 
-// CancelPendingUpdates stops a scheduled delayed endpoint update without touching the
-// WireGuard peer. Used on the idle transition where the peer is kept so a pending
-// responder-side update cannot overwrite the wake endpoint later.
-func (e *EndpointUpdater) CancelPendingUpdates() {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-
-	e.waitForCloseTheDelayedUpdate()
-}
-
 func (e *EndpointUpdater) RemoveEndpointAddress() error {
 	e.mu.Lock()
 	defer e.mu.Unlock()

client/internal/peer/endpoint_test.go

@@ -1,101 +0,0 @@
-package peer
-
-import (
-	"net"
-	"net/netip"
-	"sync"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	"github.com/netbirdio/netbird/client/iface/wgproxy"
-)
-
-type endpointTestWGIface struct {
-	mu          sync.Mutex
-	updateCalls int
-	removeCalls int
-}
-
-func (m *endpointTestWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.updateCalls++
-	return nil
-}
-
-func (m *endpointTestWGIface) RemovePeer(string) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.removeCalls++
-	return nil
-}
-
-func (m *endpointTestWGIface) GetStats() (map[string]configurer.WGStats, error) {
-	return map[string]configurer.WGStats{}, nil
-}
-
-func (m *endpointTestWGIface) GetProxy() wgproxy.Proxy { return nil }
-
-func (m *endpointTestWGIface) Address() wgaddr.Address { return wgaddr.Address{} }
-
-func (m *endpointTestWGIface) RemoveEndpointAddress(string) error { return nil }
-
-func (m *endpointTestWGIface) counts() (updates, removes int) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.updateCalls, m.removeCalls
-}
-
-func newTestEndpointUpdater(iface *endpointTestWGIface, initiator bool) *EndpointUpdater {
-	cfg := WgConfig{
-		RemoteKey:   "remoteKey",
-		WgInterface: iface,
-		AllowedIps:  []netip.Prefix{netip.MustParsePrefix("100.64.0.5/32")},
-	}
-	return NewEndpointUpdater(log.WithField("peer", "test"), cfg, initiator)
-}
-
-// TestEndpointUpdater_CancelPendingUpdates ensures a scheduled responder-side delayed
-// update is stopped without removing the WireGuard peer, so an idle transition cannot
-// be overwritten later by a stale endpoint update.
-func TestEndpointUpdater_CancelPendingUpdates(t *testing.T) {
-	iface := &endpointTestWGIface{}
-	e := newTestEndpointUpdater(iface, false)
-
-	addr := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51820}
-	require.NoError(t, e.ConfigureWGEndpoint(addr, nil))
-
-	updates, _ := iface.counts()
-	require.Equal(t, 1, updates, "responder must apply the immediate nil-endpoint update")
-
-	// CancelPendingUpdates waits for the delayed-update goroutine to exit, so the
-	// call counts below are final: the 5s fallback update can never fire anymore.
-	e.CancelPendingUpdates()
-
-	updates, removes := iface.counts()
-	assert.Equal(t, 1, updates, "delayed endpoint update must not fire after cancellation")
-	assert.Equal(t, 0, removes, "cancellation must not remove the WireGuard peer")
-}
-
-// TestEndpointUpdater_CancelPendingUpdatesNoPending ensures cancellation is a safe no-op
-// when no delayed update is scheduled (initiator path).
-func TestEndpointUpdater_CancelPendingUpdatesNoPending(t *testing.T) {
-	iface := &endpointTestWGIface{}
-	e := newTestEndpointUpdater(iface, true)
-
-	addr := &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 51820}
-	require.NoError(t, e.ConfigureWGEndpoint(addr, nil))
-
-	e.CancelPendingUpdates()
-
-	updates, removes := iface.counts()
-	assert.Equal(t, 1, updates, "initiator applies exactly one direct update")
-	assert.Equal(t, 0, removes, "cancellation must not remove the WireGuard peer")
-}

client/internal/peerstore/store.go

@@ -108,10 +108,7 @@ func (s *Store) PeerConnOpenWithFirstPacket(ctx context.Context, pubKey string,
 	}
 }
 
-// PeerConnIdle transitions the peer connection to the lazy idle state, keeping the
-// WireGuard peer and its AllowedIPs in place. signalToRemote indicates whether the
-// remote peer should be notified (false when the remote initiated the idle via GOAWAY).
-func (s *Store) PeerConnIdle(pubKey string, signalToRemote bool) {
+func (s *Store) PeerConnIdle(pubKey string) {
 	s.peerConnsMu.RLock()
 	defer s.peerConnsMu.RUnlock()
 
@@ -119,7 +116,18 @@ func (s *Store) PeerConnIdle(pubKey string, signalToRemote bool) {
 	if !ok {
 		return
 	}
-	p.Idle(signalToRemote)
+	p.Close(true)
+}
+
+func (s *Store) PeerConnClose(pubKey string) {
+	s.peerConnsMu.RLock()
+	defer s.peerConnsMu.RUnlock()
+
+	p, ok := s.peerConns[pubKey]
+	if !ok {
+		return
+	}
+	p.Close(false)
 }
 
 func (s *Store) PeersPubKey() []string {

client/internal/routemanager/dynamic/route.go

@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }
 
 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains()
+	resolved, err := r.resolveDomains(ctx)
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }
 
-func (r *Route) resolveDomains() (domainMap, error) {
+func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(results)
+	go r.resolve(ctx, results)
 
 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains() (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *Route) resolve(results chan resolveResult) {
+func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 	var wg sync.WaitGroup
 
 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()
 
-			ips, err := r.getIPsFromResolver(domain)
+			ips, err := r.getIPsFromResolver(ctx, domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = net.LookupIP(domain.PunycodeString())
+				ips, err = lookupHostIPs(ctx, domain)
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,6 +364,20 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }
 
+// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
+func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
+	if err != nil {
+		return nil, err
+	}
+
+	ips := make([]net.IP, 0, len(addrs))
+	for _, addr := range addrs {
+		ips = append(ips, addr.IP)
+	}
+	return ips, nil
+}
+
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {

client/internal/routemanager/dynamic/route_generic.go

@@ -3,11 +3,12 @@
 package dynamic
 
 import (
+	"context"
 	"net"
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
-	return net.LookupIP(domain.PunycodeString())
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+	return lookupHostIPs(ctx, domain)
 }

client/internal/routemanager/dynamic/route_ios.go

@@ -3,6 +3,7 @@
 package dynamic
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"time"
@@ -16,7 +17,7 @@ import (
 
 const dialTimeout = 10 * time.Second
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -32,7 +33,7 @@ func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)
 
-		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)

client/ios/NetBirdSDK/client.go

@@ -233,6 +233,9 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/server/server.go

@@ -1081,7 +1081,10 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 
 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		// todo review to update the status in case any type of error
+		if errors.Is(err, ErrServiceNotUp) {
+			log.Debugf("Down called while service not up: %v", err)
+			return nil, err
+		}
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1154,7 +1157,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			return err
+			log.Errorf("failed to stop engine during cleanup: %v", err)
 		}
 	}
 

client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx

@@ -1,10 +1,13 @@
+import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
+import { Version } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useStatus } from "@/contexts/StatusContext.tsx";
 
 const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
+const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";
 
 function openUrl(url: string) {
     Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
@@ -12,7 +15,26 @@ function openUrl(url: string) {
 
 export const DaemonOutdatedOverlay = () => {
     const { t } = useTranslation();
-    const { isDaemonOutdated } = useStatus();
+    const { status, isDaemonOutdated } = useStatus();
+
+    const [guiVersion, setGuiVersion] = useState<string>("-");
+    const clientVersion = status?.daemonVersion ?? "—";
+
+    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
+    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
+
+    useEffect(() => {
+        if (!isDaemonOutdated) return;
+        let cancelled = false;
+        Version.GUI()
+            .then((v) => {
+                if (!cancelled) setGuiVersion(v);
+            })
+            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
+        return () => {
+            cancelled = true;
+        };
+    }, [isDaemonOutdated]);
 
     if (!isDaemonOutdated) return null;
 
@@ -38,10 +60,37 @@ export const DaemonOutdatedOverlay = () => {
                     <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
                 </div>
 
+                <div className={"flex flex-col items-center gap-0.5 text-center"}>
+                    <p className={"text-sm font-semibold text-nb-gray-100"}>
+                        {clientVersion === "development" ? (
+                            <span>
+                                {t("settings.about.clientName")}{" "}
+                                <span className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.client", { version: clientVersion })
+                        )}
+                    </p>
+                    <p className={"text-sm font-medium text-nb-gray-250"}>
+                        {guiVersion === "development" ? (
+                            <span>
+                                {t("settings.about.guiName")}{" "}
+                                <span className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.gui", { version: guiVersion })
+                        )}
+                    </p>
+                </div>
+
                 <div className={"wails-no-draggable"}>
-                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
                         <DownloadIcon size={14} />
-                        {t("update.card.getInstaller")}
+                        {t("daemon.outdated.download")}
                     </Button>
                 </div>
             </div>

client/ui/frontend/src/contexts/ProfileContext.tsx

@@ -28,6 +28,7 @@ type ProfileContextValue = {
     loaded: boolean;
     refresh: () => Promise<void>;
     switchProfile: (id: string) => Promise<void>;
+    switchProfileNoConnect: (id: string) => Promise<void>;
     addProfile: (name: string) => Promise<string>;
     removeProfile: (id: string) => Promise<void>;
     renameProfile: (id: string, newName: string) => Promise<void>;
@@ -112,6 +113,16 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
         [username, refresh],
     );
 
+    // Manage-profiles variant: switches without connecting, so the user can
+    // still adjust the management URL before bringing the connection up.
+    const switchProfileNoConnect = useCallback(
+        async (id: string) => {
+            await ProfileSwitcher.SwitchActiveNoConnect({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
     // addProfile creates a profile by display name and returns the
     // daemon-generated ID, so the caller can immediately address it by ID.
     const addProfile = useCallback(
@@ -158,6 +169,7 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
+            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,
@@ -171,6 +183,7 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
+            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,

client/ui/frontend/src/modules/profiles/ProfilesTab.tsx

@@ -45,7 +45,7 @@ export function ProfilesTab() {
         activeProfileId,
         loaded,
         username,
-        switchProfile,
+        switchProfileNoConnect,
         addProfile,
         removeProfile,
         renameProfile,
@@ -100,7 +100,7 @@ export function ProfilesTab() {
             confirmLabel: t("profile.switch.confirm"),
         });
         if (!ok) return;
-        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfile(id));
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfileNoConnect(id));
     };
 
     const handleDeregister = async (id: string, name: string) => {
@@ -129,14 +129,13 @@ export function ProfilesTab() {
         await guarded(i18next.t("profile.error.createTitle"), async () => {
             const id = await addProfile(name);
             // SetConfig is keyed by the new profile's ID, so it writes the
-            // not-yet-active profile. Write before switching so any reconnect
-            // targets the right deployment.
+            // not-yet-active profile before the switch makes it current.
             if (!isNetbirdCloud(managementUrl)) {
                 await SettingsSvc.SetConfig(
                     new SetConfigParams({ profileName: id, username, managementUrl }),
                 );
             }
-            await switchProfile(id);
+            await switchProfileNoConnect(id);
         });
     };
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -73,6 +73,13 @@ export default function SessionExpirationDialog() {
 
         let offCancel: (() => void) | undefined;
 
+        // Return the dialog to its interactive state and dismiss the browser popup
+        const resetDialog = () => {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
+        };
+
         try {
             const start = await Session.RequestExtend({ hint: "" });
             const uri = start.verificationUriComplete || start.verificationUri;
@@ -105,25 +112,22 @@ export default function SessionExpirationDialog() {
             if (outcome.kind === "cancel") {
                 waitPromise.cancel?.();
                 waitPromise.catch(() => {});
+                resetDialog();
                 return;
             }
 
             // Another surface owns this flow; keep the dialog open to retry.
             if (outcome.result.preempted) {
+                resetDialog();
                 return;
             }
-
-            // Close before the popup so the restore can't flash this window back.
-            WindowManager.CloseSessionExpiration().catch(console.error);
+            WindowManager.CloseRenewFlow().catch(console.error);
         } catch (e) {
+            resetDialog();
             await errorDialog({
                 Title: t("sessionExpiration.extendFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            offCancel?.();
-            WindowManager.CloseBrowserLogin().catch(console.error);
-            setBusy(false);
         }
     }, [busy, t]);
 
@@ -139,12 +143,11 @@ export default function SessionExpirationDialog() {
             });
             WindowManager.CloseSessionExpiration().catch(console.error);
         } catch (e) {
+            setBusy(false);
             await errorDialog({
                 Title: t("sessionExpiration.logoutFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            setBusy(false);
         }
     }, [busy, t]);
 

client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx

@@ -22,6 +22,9 @@ type WelcomeStepTrayProps = {
 export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>) {
     const { t } = useTranslation();
     const trayScreenshot = trayScreenshotForOS();
+    // macOS has no tray — the icon sits in the menu bar, so the copy says so.
+    const titleKey = isMacOS() ? "welcome.titleMac" : "welcome.title";
+    const descriptionKey = isMacOS() ? "welcome.descriptionMac" : "welcome.description";
 
     return (
         <>
@@ -36,9 +39,9 @@ export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>)
 
             <div className={"flex w-full flex-col gap-1"}>
                 <DialogHeading id={"nb-welcome-title"} align={"left"}>
-                    {t("welcome.title")}
+                    {t(titleKey)}
                 </DialogHeading>
-                <DialogDescription align={"left"}>{t("welcome.description")}</DialogDescription>
+                <DialogDescription align={"left"}>{t(descriptionKey)}</DialogDescription>
             </div>
 
             <DialogActions>

client/ui/i18n/locales/_index.json

@@ -8,6 +8,7 @@
         {"code": "fr", "displayName": "Français", "englishName": "French"},
         {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
         {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
-        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"}
+        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"},
+        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"}
     ]
 }

client/ui/i18n/locales/de/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Suchen Sie NetBird in der Taskleiste"
     },
+    "welcome.titleMac": {
+        "message": "Suchen Sie NetBird in der Menüleiste"
+    },
     "welcome.description": {
         "message": "NetBird läuft in Ihrer Taskleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird läuft in Ihrer Menüleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
+    },
     "welcome.continue": {
         "message": "Weiter"
     },
@@ -1293,10 +1299,13 @@
         "message": "Dokumentation"
     },
     "daemon.outdated.title": {
-        "message": "NetBird-Dienst ist veraltet"
+        "message": "NetBird Client ist veraltet"
     },
     "daemon.outdated.description": {
-        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
+        "message": "Die neue GUI ist nicht mit Ihrem älteren Client kompatibel. Aktualisieren Sie Ihren Client, um die neue Anwendung zu verwenden."
+    },
+    "daemon.outdated.download": {
+        "message": "Neueste Version herunterladen"
     },
     "error.jwt_clock_skew": {
         "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."

client/ui/i18n/locales/en/common.json

@@ -1377,11 +1377,19 @@
     },
     "welcome.title": {
         "message": "Look for NetBird in your tray",
-        "description": "Heading on the first onboarding step, pointing the user to the tray icon. 'tray' = system tray / menu bar."
+        "description": "Heading on the first onboarding step, pointing the user to the tray icon. Shown on Windows and Linux; macOS uses welcome.titleMac."
+    },
+    "welcome.titleMac": {
+        "message": "Look for NetBird in your menu bar",
+        "description": "Heading on the first onboarding step on macOS, pointing the user to the menu bar icon. Use your language's Apple term for the macOS menu bar."
     },
     "welcome.description": {
         "message": "NetBird lives in your tray. Click the icon to connect, switch profiles, or open settings.",
-        "description": "Body of the first onboarding step explaining the tray icon."
+        "description": "Body of the first onboarding step explaining the tray icon. Shown on Windows and Linux; macOS uses welcome.descriptionMac."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird lives in your menu bar. Click the icon to connect, switch profiles, or open settings.",
+        "description": "Body of the first onboarding step on macOS explaining the menu bar icon. Use your language's Apple term for the macOS menu bar."
     },
     "welcome.continue": {
         "message": "Continue",
@@ -1724,12 +1732,16 @@
         "description": "Documentation link on the daemon-unavailable overlay."
     },
     "daemon.outdated.title": {
-        "message": "NetBird Service Is Outdated",
-        "description": "Title of the overlay shown when the NetBird background service is too old to drive this UI."
+        "message": "NetBird Client Is Outdated",
+        "description": "Title of the overlay shown when the NetBird client (daemon) is too old to drive this UI."
     },
     "daemon.outdated.description": {
-        "message": "Update the NetBird service to use this app.",
-        "description": "Body of the daemon-outdated overlay telling the user to upgrade the service."
+        "message": "The new GUI isn't compatible with the older NetBird client. Update your client to use the new application.",
+        "description": "Body of the daemon-outdated overlay explaining that the GUI is newer than the client and the client must be updated."
+    },
+    "daemon.outdated.download": {
+        "message": "Download Latest",
+        "description": "Button on the daemon-outdated overlay that opens the download page for the latest release."
     },
     "error.jwt_clock_skew": {
         "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",

client/ui/i18n/locales/es/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Busque NetBird en su bandeja del sistema"
     },
+    "welcome.titleMac": {
+        "message": "Busque NetBird en su barra de menús"
+    },
     "welcome.description": {
         "message": "NetBird reside en su bandeja del sistema. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside en su barra de menús. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
+    },
     "welcome.continue": {
         "message": "Continuar"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentación"
     },
     "daemon.outdated.title": {
-        "message": "El servicio de NetBird está desactualizado"
+        "message": "NetBird Client está desactualizado"
     },
     "daemon.outdated.description": {
-        "message": "Actualice el servicio de NetBird para usar esta aplicación."
+        "message": "La nueva GUI no es compatible con su cliente anterior. Actualice su cliente para usar la nueva aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar la última versión"
     },
     "error.jwt_clock_skew": {
         "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."

client/ui/i18n/locales/fr/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Cherchez NetBird dans votre barre d’état système"
     },
+    "welcome.titleMac": {
+        "message": "Cherchez NetBird dans votre barre des menus"
+    },
     "welcome.description": {
         "message": "NetBird se trouve dans votre barre d’état système. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird se trouve dans votre barre des menus. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
+    },
     "welcome.continue": {
         "message": "Continuer"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentation"
     },
     "daemon.outdated.title": {
-        "message": "Le service NetBird est obsolète"
+        "message": "Le Client NetBird est obsolète"
     },
     "daemon.outdated.description": {
-        "message": "Mettez à jour le service NetBird pour utiliser cette application."
+        "message": "La nouvelle GUI n'est pas compatible avec votre ancien client. Mettez à jour votre client pour utiliser la nouvelle application."
+    },
+    "daemon.outdated.download": {
+        "message": "Télécharger la dernière version"
     },
     "error.jwt_clock_skew": {
         "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."

client/ui/i18n/locales/hu/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Keresse a NetBirdöt a tálcán"
     },
+    "welcome.titleMac": {
+        "message": "Keresse a NetBirdöt a menüsorban"
+    },
     "welcome.description": {
         "message": "A NetBird a tálcán fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
     },
+    "welcome.descriptionMac": {
+        "message": "A NetBird a menüsorban fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
+    },
     "welcome.continue": {
         "message": "Folytatás"
     },
@@ -1293,10 +1299,13 @@
         "message": "Dokumentáció"
     },
     "daemon.outdated.title": {
-        "message": "A NetBird szolgáltatás elavult"
+        "message": "A NetBird Kliens elavult"
     },
     "daemon.outdated.description": {
-        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
+        "message": "Az új GUI nem kompatibilis a régebbi klienseddel. Frissítsd a klienst az új alkalmazás használatához."
+    },
+    "daemon.outdated.download": {
+        "message": "Legújabb letöltése"
     },
     "error.jwt_clock_skew": {
         "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."

client/ui/i18n/locales/it/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Cerchi NetBird nella tray"
     },
+    "welcome.titleMac": {
+        "message": "Cerchi NetBird nella barra dei menu"
+    },
     "welcome.description": {
         "message": "NetBird risiede nella tray. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird risiede nella barra dei menu. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
+    },
     "welcome.continue": {
         "message": "Continua"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentazione"
     },
     "daemon.outdated.title": {
-        "message": "Il servizio NetBird è obsoleto"
+        "message": "NetBird Client è obsoleto"
     },
     "daemon.outdated.description": {
-        "message": "Aggiorna il servizio NetBird per usare questa app."
+        "message": "La nuova GUI non è compatibile con il tuo client precedente. Aggiorna il client per usare la nuova applicazione."
+    },
+    "daemon.outdated.download": {
+        "message": "Scarica l'ultima versione"
     },
     "error.jwt_clock_skew": {
         "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."

client/ui/i18n/locales/pt/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Procure o NetBird na sua bandeja"
     },
+    "welcome.titleMac": {
+        "message": "Procure o NetBird na sua barra de menus"
+    },
     "welcome.description": {
         "message": "O NetBird fica na sua bandeja. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
     },
+    "welcome.descriptionMac": {
+        "message": "O NetBird fica na sua barra de menus. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
+    },
     "welcome.continue": {
         "message": "Continuar"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentação"
     },
     "daemon.outdated.title": {
-        "message": "O serviço NetBird está desatualizado"
+        "message": "O NetBird Client está desatualizado"
     },
     "daemon.outdated.description": {
-        "message": "Atualize o serviço NetBird para usar este aplicativo."
+        "message": "A nova GUI não é compatível com o seu cliente mais antigo. Atualize o seu cliente para usar o novo aplicativo."
+    },
+    "daemon.outdated.download": {
+        "message": "Baixar a versão mais recente"
     },
     "error.jwt_clock_skew": {
         "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."

client/ui/i18n/locales/ru/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Найдите NetBird в системном трее"
     },
+    "welcome.titleMac": {
+        "message": "Найдите NetBird в строке меню"
+    },
     "welcome.description": {
         "message": "NetBird находится в системном трее. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird находится в строке меню. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
+    },
     "welcome.continue": {
         "message": "Продолжить"
     },
@@ -1293,10 +1299,13 @@
         "message": "Документация"
     },
     "daemon.outdated.title": {
-        "message": "Служба NetBird устарела"
+        "message": "Клиент NetBird устарел"
     },
     "daemon.outdated.description": {
-        "message": "Обновите службу NetBird, чтобы использовать это приложение."
+        "message": "Новый GUI несовместим с вашим более старым клиентом. Обновите клиент, чтобы использовать новое приложение."
+    },
+    "daemon.outdated.download": {
+        "message": "Скачать последнюю версию"
     },
     "error.jwt_clock_skew": {
         "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."

client/ui/i18n/locales/zh-CN/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "在托盘中查找 NetBird"
     },
+    "welcome.titleMac": {
+        "message": "在菜单栏中查找 NetBird"
+    },
     "welcome.description": {
         "message": "NetBird 驻留在您的托盘中。点击图标即可连接、切换配置文件或打开设置。"
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird 驻留在您的菜单栏中。点击图标即可连接、切换配置文件或打开设置。"
+    },
     "welcome.continue": {
         "message": "继续"
     },
@@ -1293,10 +1299,13 @@
         "message": "文档"
     },
     "daemon.outdated.title": {
-        "message": "NetBird 服务版本过旧"
+        "message": "NetBird 客户端版本过旧"
     },
     "daemon.outdated.description": {
-        "message": "请更新 NetBird 服务以使用此应用。"
+        "message": "新版 GUI 与您较旧的客户端不兼容。请更新客户端以使用新应用。"
+    },
+    "daemon.outdated.download": {
+        "message": "下载最新版本"
     },
     "error.jwt_clock_skew": {
         "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"

client/ui/services/profileswitcher.go

@@ -12,13 +12,15 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
 
-// ProfileSwitcher holds the reconnect policy shared by the tray and React
-// frontend so both flip profiles identically. The policy keys off prevStatus
-// from DaemonFeed.Get at SwitchActive entry:
+// ProfileSwitcher holds the switch policy shared by the tray and React
+// frontend so both flip profiles identically. SwitchActive (plain selection:
+// header dropdown, tray submenu) always connects after the switch;
+// SwitchActiveNoConnect (manage-profiles screen) never does, so the user can
+// still adjust the management URL before connecting. prevStatus from
+// DaemonFeed.Get at entry only decides the teardown:
 //
-//	Connected/Connecting → Switch + Down + Up; optimistic Connecting paint.
-//	NeedsLogin/LoginFailed/SessionExpired → Switch + Down; clear stale error for re-login.
-//	Idle → Switch only.
+//	Connected/Connecting/NeedsLogin/LoginFailed/SessionExpired → Down first.
+//	Idle → no Down.
 type ProfileSwitcher struct {
 	profiles   *Profiles
 	connection *Connection
@@ -29,29 +31,40 @@ func NewProfileSwitcher(profiles *Profiles, connection *Connection, feed *Daemon
 	return &ProfileSwitcher{profiles: profiles, connection: connection, feed: feed}
 }
 
-// SwitchActive switches to the named profile applying the reconnect policy.
+// SwitchActive switches to the named profile and always connects afterwards.
 func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, true)
+}
+
+// SwitchActiveNoConnect switches to the named profile without connecting,
+// tearing down any existing connection first.
+func (s *ProfileSwitcher) SwitchActiveNoConnect(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, false)
+}
+
+func (s *ProfileSwitcher) switchActive(ctx context.Context, p ProfileRef, connect bool) error {
 	prevStatus := ""
-	if st, err := s.feed.Get(ctx); err == nil {
-		prevStatus = st.Status
-	} else {
-		log.Warnf("profileswitcher: get status: %v", err)
+	if s.feed != nil {
+		if st, err := s.feed.Get(ctx); err == nil {
+			prevStatus = st.Status
+		} else {
+			log.Warnf("profileswitcher: get status: %v", err)
+		}
 	}
 
-	wasActive := strings.EqualFold(prevStatus, StatusConnected) ||
-		strings.EqualFold(prevStatus, StatusConnecting)
-	needsDown := wasActive ||
+	needsDown := strings.EqualFold(prevStatus, StatusConnected) ||
+		strings.EqualFold(prevStatus, StatusConnecting) ||
 		strings.EqualFold(prevStatus, StatusNeedsLogin) ||
 		strings.EqualFold(prevStatus, StatusLoginFailed) ||
 		strings.EqualFold(prevStatus, StatusSessionExpired)
 
-	log.Infof("profileswitcher: switch profile=%q prevStatus=%q wasActive=%v needsDown=%v",
-		p.ProfileName, prevStatus, wasActive, needsDown)
+	log.Infof("profileswitcher: switch profile=%q prevStatus=%q connect=%v needsDown=%v",
+		p.ProfileName, prevStatus, connect, needsDown)
 
-	// Optimistic Connecting paint only when wasActive: those prevStatuses emit
-	// stale Connected + transient Idle pushes during Down that must be
-	// suppressed until Up resumes the stream (see DaemonFeed suppression table).
-	if wasActive {
+	// Optimistic Connecting paint plus stale-push suppression during Down (see
+	// DaemonFeed suppression table); also arms the login-watch that pops
+	// browser-login when the new profile turns out to need SSO.
+	if connect && s.feed != nil {
 		s.feed.BeginProfileSwitch()
 	}
 
@@ -76,9 +89,9 @@ func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error
 		}
 	}
 
-	if wasActive {
+	if connect {
 		if err := s.connection.Up(ctx, UpParams(p)); err != nil {
-			return fmt.Errorf("reconnect %q: %w", p.ProfileName, err)
+			return fmt.Errorf("connect %q: %w", p.ProfileName, err)
 		}
 	}
 

client/ui/services/windowmanager.go

@@ -185,37 +185,38 @@ func (s *WindowManager) OpenBrowserLogin(uri string) {
 			startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
 		}
 		s.hideOtherWindowsLocked("browser-login")
-		// Prefer the main window's screen (multi-monitor); falls back to OS-default centering.
-		var screen *application.Screen
-		if s.mainWindow != nil {
-			if sc, err := s.mainWindow.GetScreen(); err == nil {
-				screen = sc
-			}
-		}
 		opts := DialogWindowOptions("browser-login", s.title("window.title.signIn"), startURL, s.linuxIcon)
 		// Not always-on-top: it would obscure the browser tab the user logs in through.
 		opts.AlwaysOnTop = false
 		opts.InitialPosition = application.WindowCentered
-		opts.Screen = screen
+		// Open on the active (where users cursor is) display, like the session-expiration dialog.
+		opts.Screen = s.getScreenBasedOnCursorPosition()
 		s.browserLogin = s.app.Window.NewWithOptions(opts)
 		bl := s.browserLogin
-		// Red-X close means cancel: emit the event so startLogin() tears down the SSO wait.
 		bl.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-			s.app.Event.Emit(EventBrowserLoginCancel)
 			s.mu.Lock()
-			s.browserLogin = nil
-			s.restoreHiddenWindowsLocked()
+			// Only a live user red-X still has this registered; programmatic closers
+			// nil s.browserLogin first and clean up themselves. Guarding here stops a
+			// stale close event from wiping a replacement popup's state.
+			userClosed := s.browserLogin == bl
+			if userClosed {
+				s.browserLogin = nil
+				s.restoreHiddenWindowsLocked()
+			}
 			s.mu.Unlock()
+			if userClosed {
+				s.app.Event.Emit(EventBrowserLoginCancel)
+			}
 		})
-		s.centerWhenReady(s.browserLogin)
+		s.centerOnCursorScreen(s.browserLogin)
 		return
 	}
 	if uri != "" {
 		s.browserLogin.SetURL("/#/dialog/browser-login?uri=" + url.QueryEscape(uri))
 	}
+	s.centerOnCursorScreen(s.browserLogin)
 	s.browserLogin.Show()
 	s.browserLogin.Focus()
-	s.centerWhenReady(s.browserLogin)
 }
 
 // BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
@@ -238,6 +239,15 @@ func (s *WindowManager) CloseBrowserLogin() {
 	s.mu.Lock()
 	w := s.browserLogin
 	s.browserLogin = nil
+	// The WindowClosing hook no-ops on a programmatic close, so restore here —
+	// but only if a popup was actually open. The frontend calls this even when no
+	// popup was ever shown (e.g. resetDialog() after an early RequestExtend failure,
+	// or connection.ts's catch path), and hiddenForLogin is shared with
+	// OpenInstallProgress, so an unconditional restore could re-show windows a
+	// still-running install-progress is hiding.
+	if w != nil {
+		s.restoreHiddenWindowsLocked()
+	}
 	s.mu.Unlock()
 	if w != nil {
 		w.Close()
@@ -279,6 +289,35 @@ func (s *WindowManager) CloseSessionExpiration() {
 	}
 }
 
+// CloseRenewFlow tears down the SSO session-renewal UI in a single call: it
+// closes the browser-login popup and the session-expiration window together.
+func (s *WindowManager) CloseRenewFlow() {
+	s.mu.Lock()
+	bl := s.browserLogin
+	se := s.sessionExpiration
+	s.browserLogin = nil
+	s.sessionExpiration = nil
+	if se != nil {
+		kept := s.hiddenForLogin[:0]
+		for _, w := range s.hiddenForLogin {
+			if w != se {
+				kept = append(kept, w)
+			}
+		}
+		s.hiddenForLogin = kept
+	}
+	s.restoreHiddenWindowsLocked()
+	s.mu.Unlock()
+
+	// Close after unlock so the re-entrant handlers can take s.mu.
+	if bl != nil {
+		bl.Close()
+	}
+	if se != nil {
+		se.Close()
+	}
+}
+
 // OpenInstallProgress shows the install-progress window and hides the rest for the duration
 // (restored on close). It owns its own result polling since the daemon restarts mid-install.
 func (s *WindowManager) OpenInstallProgress(version string) {

client/ui/tray.go

@@ -30,6 +30,8 @@ const (
 
 	statusError = "Error"
 
+	quitDownTimeout = 5 * time.Second
+
 	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
 	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
 	urlDocs           = "https://docs.netbird.io"
@@ -446,11 +448,28 @@ func (t *Tray) buildMenu() *application.Menu {
 	menu.AddSeparator()
 	menu.Add(t.loc.T("tray.menu.quit")).
 		SetAccelerator("CmdOrCtrl+Q").
-		OnClick(func(*application.Context) { t.app.Quit() })
+		OnClick(func(*application.Context) { t.handleQuit() })
 
 	return menu
 }
 
+func (t *Tray) handleQuit() {
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+		t.switchCancel = nil
+	}
+	t.profileMu.Unlock()
+	t.svc.DaemonFeed.CancelProfileSwitch()
+
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
+	}
+	t.app.Quit()
+}
+
 // handleConnect receives the clicked item from the buildMenu closure —
 // t.upItem is menuMu-guarded and must not be read here.
 func (t *Tray) handleConnect(upItem *application.MenuItem) {

combined/cmd/root.go

@@ -226,7 +226,7 @@ func (s *serverInstances) createRelayServer(cfg *CombinedConfig, tlsSupport bool
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cfg.Relay.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
 
 	relayCfg := relayServer.Config{
 		Meter:          s.metricsServer.Meter,

go.mod

@@ -23,7 +23,7 @@ require (
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
-	golang.zx2c4.com/wireguard/windows v0.5.3
+	golang.zx2c4.com/wireguard/windows v1.0.1
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 )
@@ -113,7 +113,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-alpha2.111
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -303,7 +303,6 @@ require (
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/wailsapp/wails/webview2 v1.0.27 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect

go.sum

@@ -660,10 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.111 h1:MKx1nOnhnDuEGrRBmtxLOJq1NERwailu2cI4BvzWhi4=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.111/go.mod h1:wrdvmyeCsB/K3YqJDoH8E3MwcN8NXAMnEFaDTW46w60=
-github.com/wailsapp/wails/webview2 v1.0.27 h1:wjgAi/I8BBZ7kUGU8um3XF3ILEfzr96Q2Q1G4GPjMns=
-github.com/wailsapp/wails/webview2 v1.0.27/go.mod h1:zdM4jcO1IaC61RiJL5F1BzgoqBHFIdacz8gPr5exr0o=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -873,8 +871,8 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
-golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
-golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
+golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
+golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.276.0 h1:nVArUtfLEihtW+b0DdcqRGK1xoEm2+ltAihyztq7MKY=

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -197,6 +197,12 @@ type JSONMetadataInjection struct {
 	// enforces a 128-char limit per value; oversized values are
 	// truncated rather than failing the request. 0 disables the cap.
 	MaxValueLength int
+	// Sanitize, when true, replaces characters outside the destination's
+	// accepted set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to a limited character
+	// class, so unsanitized group display names (e.g. containing spaces) would
+	// make Bedrock reject the request with 400.
+	Sanitize bool
 }
 
 // providers is the canonical list of supported Agent Network providers.
@@ -329,6 +335,18 @@ var providers = []Provider{
 			{ID: "amazon.nova-lite", Label: "Amazon Nova Lite (Bedrock)", InputPer1k: 0.00006, OutputPer1k: 0.00024, ContextWindow: 300000},
 			{ID: "amazon.nova-micro", Label: "Amazon Nova Micro (Bedrock)", InputPer1k: 0.000035, OutputPer1k: 0.00014, ContextWindow: 128000},
 		},
+		// Bedrock accepts a cost-allocation metadata header; stamp the caller's
+		// user + authorizing group so spend can be attributed in AWS Cost
+		// Management. Sanitized because Bedrock restricts the value character set.
+		IdentityInjection: &IdentityInjection{
+			JSONMetadata: &JSONMetadataInjection{
+				Header:         "X-Amzn-Bedrock-Request-Metadata",
+				UserKey:        "user",
+				GroupsKey:      "group",
+				MaxValueLength: 256,
+				Sanitize:       true,
+			},
+		},
 	},
 	{
 		ID:                 "vertex_ai_api",

management/internals/modules/agentnetwork/synthesizer.go

@@ -540,6 +540,7 @@ type identityInjectJSONMetadata struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	Sanitize       bool   `json:"sanitize,omitempty"`
 }
 
 // buildIdentityInjectConfigJSON walks the enabled providers and emits
@@ -583,9 +584,11 @@ func buildIdentityInjectConfigJSON(providers []*types.Provider, groupIndex map[s
 func buildIdentityInjectRule(p *types.Provider, entry catalog.Provider) (identityInjectProvider, bool) {
 	rule := identityInjectProvider{ProviderID: p.ID}
 	// Identity-stamping shape (one of HeaderPair / JSONMetadata). Skip the
-	// shape silently when the catalog entry doesn't declare one — extras
-	// can still apply, see below.
-	if entry.IdentityInjection != nil {
+	// shape silently when the catalog entry doesn't declare one, or when the
+	// operator disabled metadata for this provider — extras can still apply,
+	// see below. MetadataDisabled suppresses only the identity dimensions
+	// (user + authorizing group), not the catalog's routing ExtraHeaders.
+	if !p.MetadataDisabled && entry.IdentityInjection != nil {
 		switch {
 		case entry.IdentityInjection.HeaderPair != nil:
 			rule.HeaderPair = buildIdentityHeaderPair(p, entry.IdentityInjection.HeaderPair)
@@ -651,6 +654,7 @@ func buildIdentityJSONMetadata(p *types.Provider, jm *catalog.JSONMetadataInject
 		UserKey:        userKey,
 		GroupsKey:      groupsKey,
 		MaxValueLength: jm.MaxValueLength,
+		Sanitize:       jm.Sanitize,
 	}
 }
 

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -698,6 +698,94 @@ func TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable(t *testing.T)
 		"same fixed-schema guarantee for the groups dimension")
 }
 
+// TestSynthesizeServices_IdentityInject_Bedrock pins Bedrock's cost-allocation
+// metadata: a JSONMetadata shape emitting X-Amzn-Bedrock-Request-Metadata with
+// the reserved user/group keys, sanitized to Bedrock's accepted charset.
+func TestSynthesizeServices_IdentityInject_Bedrock(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.JSONMetadata, "Bedrock uses the JSONMetadata shape for cost-allocation metadata")
+	assert.Nil(t, entry.HeaderPair, "shapes are mutually exclusive")
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", entry.JSONMetadata.Header,
+		"the caller identity lands in Bedrock's cost-allocation metadata header")
+	assert.Equal(t, "user", entry.JSONMetadata.UserKey)
+	assert.Equal(t, "group", entry.JSONMetadata.GroupsKey)
+	assert.True(t, entry.JSONMetadata.Sanitize,
+		"Bedrock restricts the metadata value charset, so values must be sanitized")
+}
+
+// TestSynthesizeServices_MetadataDisabled_SuppressesInjection verifies the
+// per-provider opt-out: a provider with MetadataDisabled set emits no
+// identity-inject entry (Bedrock has no catalog ExtraHeaders, so the whole
+// entry is dropped).
+func TestSynthesizeServices_MetadataDisabled_SuppressesInjection(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.MetadataDisabled = true
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	assert.Empty(t, injectCfg.Providers,
+		"metadata_disabled must drop the provider's identity-inject entry")
+}
+
 // TestSynthesizeServices_IdentityInject_Vercel pins Vercel AI
 // Gateway's wiring: HeaderPair shape with fixed wire names dictated
 // by Vercel's Custom Reporting API (ai-reporting-user /

management/internals/modules/agentnetwork/types/provider.go

@@ -51,6 +51,12 @@ type Provider struct {
 	// private or self-signed certificate. The synthesiser propagates it into
 	// the router route so the proxy dials that provider's upstream insecurely.
 	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
+	// MetadataDisabled suppresses identity metadata injection for this provider.
+	// Metadata (the caller's user + authorizing group) is injected by default;
+	// when true the synthesiser omits the provider's identity-inject shape, so no
+	// user/group headers (e.g. Bedrock's X-Amzn-Bedrock-Request-Metadata) are
+	// stamped. Catalog ExtraHeaders (routing config) are unaffected.
+	MetadataDisabled bool `gorm:"column:metadata_disabled"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -137,6 +143,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.SkipTlsVerification != nil {
 		p.SkipTLSVerification = *req.SkipTlsVerification
 	}
+	if req.MetadataDisabled != nil {
+		p.MetadataDisabled = *req.MetadataDisabled
+	}
 	// Identity-header overrides for catalogs flagged Customizable.
 	// nil pointer = "field omitted on the wire" → leave the stored
 	// value untouched (per the openapi description). Empty string is
@@ -170,6 +179,7 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		Models:              models,
 		Enabled:             p.Enabled,
 		SkipTlsVerification: p.SkipTLSVerification,
+		MetadataDisabled:    p.MetadataDisabled,
 		CreatedAt:           &created,
 		UpdatedAt:           &updated,
 	}

management/internals/modules/agentnetwork/types/provider_test.go

@@ -42,3 +42,38 @@ func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
 	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
 	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
 }
+
+// TestProvider_MetadataDisabled_RoundTrip covers the request→provider→response
+// mapping of metadata_disabled, with the same update semantics: nil preserves,
+// explicit false clears.
+func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
+	enable := true
+	disable := false
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "bedrock_api",
+			Name:        "bedrock",
+			UpstreamUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
+		}
+	}
+
+	p := NewProvider("acc-1")
+
+	req := base()
+	req.MetadataDisabled = &enable
+	p.FromAPIRequest(req)
+	assert.True(t, p.MetadataDisabled, "create with metadata_disabled=true must set the field")
+	assert.True(t, p.ToAPIResponse().MetadataDisabled, "response must surface metadata_disabled")
+
+	// Omitting the field on update leaves the stored value untouched.
+	p.FromAPIRequest(base())
+	assert.True(t, p.MetadataDisabled, "omitting metadata_disabled on update must preserve it")
+
+	// Explicit false clears it (re-enables metadata).
+	req = base()
+	req.MetadataDisabled = &disable
+	p.FromAPIRequest(req)
+	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
+	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
+}

proxy/Dockerfile.multistage

@@ -14,6 +14,7 @@ COPY proxy ./proxy
 COPY route ./route
 COPY shared ./shared
 COPY sharedsock ./sharedsock
+COPY trustedproxy ./trustedproxy
 COPY upload-server ./upload-server
 COPY util ./util
 COPY version ./version

proxy/cmd/proxy/cmd/root.go

@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy"
 	nbacme "github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -209,7 +210,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid domain value %q: %w", proxyDomain, err)
 	}
 
-	parsedTrustedProxies, err := proxy.ParseTrustedProxies(trustedProxies)
+	parsedTrustedProxies, err := trustedproxy.Parse(trustedProxies)
 	if err != nil {
 		return fmt.Errorf("invalid --trusted-proxies: %w", err)
 	}

proxy/internal/accesslog/logger.go

@@ -16,6 +16,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -66,7 +67,7 @@ type denyBucket struct {
 type Logger struct {
 	client         gRPCClient
 	logger         *log.Logger
-	trustedProxies []netip.Prefix
+	trustedProxies *trustedproxy.List
 
 	usageMux    sync.Mutex
 	domainUsage map[string]*domainUsage
@@ -82,7 +83,7 @@ type Logger struct {
 // NewLogger creates a new access log Logger. The trustedProxies parameter
 // configures which upstream proxy IP ranges are trusted for extracting
 // the real client IP from X-Forwarded-For headers.
-func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies []netip.Prefix) *Logger {
+func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies *trustedproxy.List) *Logger {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}

proxy/internal/accesslog/requestip.go

@@ -4,13 +4,13 @@ import (
 	"net/http"
 	"net/netip"
 
-	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // extractSourceIP resolves the real client IP from the request using trusted
 // proxy configuration. When trustedProxies is non-empty and the direct
 // connection is from a trusted source, it walks X-Forwarded-For right-to-left
 // skipping trusted IPs. Otherwise it returns RemoteAddr directly.
-func extractSourceIP(r *http.Request, trustedProxies []netip.Prefix) netip.Addr {
-	return proxy.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"), trustedProxies)
+func extractSourceIP(r *http.Request, trustedProxies *trustedproxy.List) netip.Addr {
+	return trustedProxies.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"))
 }

proxy/internal/llm/bedrock_model.go

@@ -0,0 +1,38 @@
+package llm
+
+import (
+	"regexp"
+	"strings"
+)
+
+// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
+// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
+var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
+// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and the inference-profile ARN's last segment likewise. It is the single
+// source of truth shared by the request parser (which normalizes the request
+// model from the URL path) and the router (which normalizes the operator's
+// registered Bedrock model ids so both sides compare equal).
+func NormalizeBedrockModel(modelID string) string {
+	m := modelID
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	for _, p := range bedrockRegionPrefixes {
+		if strings.HasPrefix(m, p) {
+			m = m[len(p):]
+			break
+		}
+	}
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}

proxy/internal/llm/bedrock_model_test.go

@@ -0,0 +1,23 @@
+package llm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeBedrockModel(t *testing.T) {
+	cases := map[string]string{
+		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-haiku-4-5":                "anthropic.claude-haiku-4-5",
+		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
+		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
+		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
+		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
+		// Inference-profile ARN — model id lives in the last path segment.
+		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, NormalizeBedrockModel(in), "normalize %q", in)
+	}
+}

proxy/internal/middleware/builtin/llm_identity_inject/factory.go

@@ -64,6 +64,11 @@ type JSONMetadataRule struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	// Sanitize replaces characters outside the destination provider's accepted
+	// set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to [A-Za-z0-9 +-=._:/@];
+	// group display names with other characters would otherwise 400.
+	Sanitize bool `json:"sanitize,omitempty"`
 }
 
 // Config is the on-wire configuration accepted by the factory. An

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -292,15 +292,21 @@ func applyJSONMetadata(rule *JSONMetadataRule, in *middleware.Input) *middleware
 	mutations := &middleware.Mutations{}
 	mutations.HeadersRemove = append(mutations.HeadersRemove, rule.Header)
 
+	emit := func(v string) string {
+		if rule.Sanitize {
+			v = sanitizeMetadataValue(v)
+		}
+		return truncate(v, rule.MaxValueLength)
+	}
 	payload := map[string]string{}
 	if rule.UserKey != "" {
 		if identity := identityFor(in); identity != "" {
-			payload[rule.UserKey] = truncate(identity, rule.MaxValueLength)
+			payload[rule.UserKey] = emit(identity)
 		}
 	}
 	if rule.GroupsKey != "" {
 		if csv := authorisingTagsCSV(in); csv != "" {
-			payload[rule.GroupsKey] = truncate(csv, rule.MaxValueLength)
+			payload[rule.GroupsKey] = emit(csv)
 		}
 	}
 	if len(payload) == 0 {
@@ -359,6 +365,36 @@ func truncate(s string, maxBytes int) string {
 	return s[:maxBytes]
 }
 
+// sanitizeMetadataValue replaces any character outside AWS Bedrock's accepted
+// request-metadata class — letters, digits, space, and + - = . _ : / @ — with
+// '_'. This keeps values (notably the groups CSV, whose commas are rejected, and
+// group display names with arbitrary characters) from making Bedrock reject the
+// request with 400. The result stays opaque to the gateway.
+func sanitizeMetadataValue(s string) string {
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if metadataCharAllowed(r) {
+			b.WriteRune(r)
+		} else {
+			b.WriteByte('_')
+		}
+	}
+	return b.String()
+}
+
+func metadataCharAllowed(r rune) bool {
+	switch {
+	case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+		return true
+	}
+	switch r {
+	case ' ', '+', '-', '=', '.', '_', ':', '/', '@':
+		return true
+	}
+	return false
+}
+
 // tagsIDsFromAuthorising reads llm_router's authorising-groups metadata
 // (a CSV of group ids) and returns the parsed slice. Returns nil when
 // the key is absent or empty so the caller can fall back to the full

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -304,6 +304,46 @@ func TestInject_JSONMetadata_TruncatesValues(t *testing.T) {
 		"per-value byte length must be capped at MaxValueLength")
 }
 
+// TestInject_JSONMetadata_Sanitize pins the AWS-Bedrock sanitization path: when
+// Sanitize is set, characters outside Bedrock's accepted metadata class
+// (notably the groups CSV comma and arbitrary characters in group display
+// names) are replaced with '_' so Bedrock doesn't reject the request. Allowed
+// characters (letters, digits, spaces, and @ . _ : / + - =) pass through.
+func TestInject_JSONMetadata_Sanitize(t *testing.T) {
+	rule := ProviderInjection{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:         "X-Amzn-Bedrock-Request-Metadata",
+			UserKey:        "user",
+			GroupsKey:      "group",
+			MaxValueLength: 256,
+			Sanitize:       true,
+		},
+	}
+	mw := New(Config{Providers: []ProviderInjection{rule}})
+	in := newInput(portkeyProvider, "alice", []string{"g1", "g2"})
+	in.UserEmail = "alice@example.com"
+	// Group display names carry characters Bedrock rejects (comma, '#'); the CSV
+	// join adds another comma between the two groups.
+	in.UserGroupNames = []string{"Eng,Team", "Ops#1"}
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+	added := out.Mutations.HeadersAdd[0]
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", added.Key,
+		"the Bedrock cost-allocation header carries the metadata JSON")
+
+	var payload map[string]string
+	require.NoError(t, json.Unmarshal([]byte(added.Value), &payload))
+	assert.Equal(t, "alice@example.com", payload["user"],
+		"'@' and '.' are in Bedrock's accepted set and must be preserved")
+	assert.NotContains(t, payload["group"], ",", "commas must be sanitized — Bedrock rejects them")
+	assert.NotContains(t, payload["group"], "#", "disallowed characters must be sanitized")
+	assert.Contains(t, payload["group"], "Eng", "allowed characters must be preserved")
+}
+
 // TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd verifies the
 // anti-spoof Remove still fires when there's nothing to stamp.
 func TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {

proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go

@@ -0,0 +1,30 @@
+package llm_router
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
+// Bedrock routing gap: the request model reaches the router already normalized
+// (the parser strips the region/inference-profile prefix and version suffix),
+// so a provider registered with the raw inference-profile id must still match.
+func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
+	route := ProviderRoute{Bedrock: true, Models: []string{"us.anthropic.claude-haiku-4-5"}}
+	assert.True(t, routeClaimsModel(route, "anthropic.claude-haiku-4-5"),
+		"raw region-prefixed Bedrock model must match the normalized request model")
+	assert.False(t, routeClaimsModel(route, "anthropic.claude-opus-4-8"),
+		"a model outside the provider's list must not match")
+
+	// A provider registered with the already-normalized id also matches.
+	normalized := ProviderRoute{Bedrock: true, Models: []string{"anthropic.claude-haiku-4-5"}}
+	assert.True(t, routeClaimsModel(normalized, "anthropic.claude-haiku-4-5"),
+		"normalized Bedrock model must match")
+
+	// Non-Bedrock routes keep exact matching (no prefix stripping).
+	openai := ProviderRoute{Models: []string{"gpt-4o"}}
+	assert.True(t, routeClaimsModel(openai, "gpt-4o"), "exact model must match")
+	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
+		"non-Bedrock routes must not strip a us. prefix")
+}

proxy/internal/middleware/builtin/llm_router/middleware.go

@@ -23,6 +23,7 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 
+	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
@@ -555,6 +556,14 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if candidate == model {
 			return true
 		}
+		// Bedrock request models reach the router already normalized (the parser
+		// strips the region / inference-profile prefix and version suffix), but
+		// the operator may register the raw inference-profile id (e.g.
+		// "us.anthropic.claude-haiku-4-5"). Normalize the candidate so both sides
+		// compare equal; otherwise a native Bedrock request denies as not-routable.
+		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
+			return true
+		}
 	}
 	return false
 }

proxy/internal/proxy/reverseproxy.go

@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 type ReverseProxy struct {
@@ -29,10 +30,10 @@ type ReverseProxy struct {
 	// forwardedProto overrides the X-Forwarded-Proto header value.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	forwardedProto string
-	// trustedProxies is a list of IP prefixes for trusted upstream proxies.
-	// When the direct connection comes from a trusted proxy, forwarding
-	// headers are preserved and appended to instead of being stripped.
-	trustedProxies []netip.Prefix
+	// trustedProxies is the set of trusted upstream proxies. When the direct
+	// connection comes from a trusted proxy, forwarding headers are preserved
+	// and appended to instead of being stripped.
+	trustedProxies *trustedproxy.List
 	mappingsMux    sync.RWMutex
 	mappings       map[string]Mapping
 	logger         *log.Logger
@@ -63,7 +64,7 @@ func WithMiddlewareManager(m *middleware.Manager) Option {
 // between requested URLs and targets.
 // The internal mappings can be modified using the AddMapping
 // and RemoveMapping functions.
-func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger, opts ...Option) *ReverseProxy {
+func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies *trustedproxy.List, logger *log.Logger, opts ...Option) *ReverseProxy {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
@@ -527,7 +528,7 @@ func (p *ReverseProxy) isSelfTargetLoop(r *http.Request, target *url.URL) bool {
 	if !types.IsOverlayOrigin(r.Context()) {
 		return false
 	}
-	srcIP := extractHostIP(r.RemoteAddr)
+	srcIP := trustedproxy.ExtractHostIP(r.RemoteAddr)
 	if !srcIP.IsValid() {
 		return false
 	}
@@ -578,9 +579,9 @@ func (p *ReverseProxy) rewriteFunc(target *url.URL, matchedPath string, passHost
 
 		stampNetBirdIdentity(r)
 
-		clientIP := extractHostIP(r.In.RemoteAddr)
+		clientIP := trustedproxy.ExtractHostIP(r.In.RemoteAddr)
 
-		if isTrustedAddr(clientIP, p.trustedProxies) {
+		if p.trustedProxies.Contains(clientIP) {
 			p.setTrustedForwardingHeaders(r, clientIP)
 		} else {
 			p.setUntrustedForwardingHeaders(r, clientIP)
@@ -664,7 +665,7 @@ func (p *ReverseProxy) setTrustedForwardingHeaders(r *httputil.ProxyRequest, cli
 	if realIP := r.In.Header.Get("X-Real-IP"); realIP != "" {
 		r.Out.Header.Set("X-Real-IP", realIP)
 	} else {
-		resolved := ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"), p.trustedProxies)
+		resolved := p.trustedProxies.ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"))
 		r.Out.Header.Set("X-Real-IP", resolved.String())
 	}
 

proxy/internal/proxy/reverseproxy_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestRewriteFunc_HostRewriting(t *testing.T) {
@@ -302,7 +303,7 @@ func TestExtractHostIP(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, extractHostIP(tt.remoteAddr))
+			assert.Equal(t, tt.expected, trustedproxy.ExtractHostIP(tt.remoteAddr))
 		})
 	}
 }
@@ -330,7 +331,7 @@ func TestExtractForwardedPort(t *testing.T) {
 
 func TestRewriteFunc_TrustedProxy(t *testing.T) {
 	target, _ := url.Parse("http://backend.internal:8080")
-	trusted := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}
+	trusted := trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")})
 
 	t.Run("appends to X-Forwarded-For", func(t *testing.T) {
 		p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}

proxy/internal/proxy/trustedproxy.go

@@ -1,81 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"strings"
-)
-
-// IsTrustedProxy checks if the given IP string falls within any of the trusted prefixes.
-func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
-	addr, err := netip.ParseAddr(ipStr)
-	if err != nil || len(trusted) == 0 {
-		return false
-	}
-	return isTrustedAddr(addr.Unmap(), trusted)
-}
-
-// ResolveClientIP extracts the real client IP from X-Forwarded-For using the trusted proxy list.
-// It walks the XFF chain right-to-left, skipping IPs that match trusted prefixes.
-// The first untrusted IP is the real client.
-//
-// If the trusted list is empty or remoteAddr is not trusted, it returns the
-// remoteAddr IP directly (ignoring any forwarding headers).
-func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) netip.Addr {
-	remoteIP := extractHostIP(remoteAddr)
-
-	if len(trusted) == 0 || !isTrustedAddr(remoteIP, trusted) {
-		return remoteIP
-	}
-
-	if xff == "" {
-		return remoteIP
-	}
-
-	parts := strings.Split(xff, ",")
-	for i := len(parts) - 1; i >= 0; i-- {
-		ip := strings.TrimSpace(parts[i])
-		if ip == "" {
-			continue
-		}
-		addr, err := netip.ParseAddr(ip)
-		if err != nil {
-			continue
-		}
-		addr = addr.Unmap()
-		if !isTrustedAddr(addr, trusted) {
-			return addr
-		}
-	}
-
-	// All IPs in XFF are trusted; return the leftmost as best guess.
-	if first := strings.TrimSpace(parts[0]); first != "" {
-		if addr, err := netip.ParseAddr(first); err == nil {
-			return addr.Unmap()
-		}
-	}
-	return remoteIP
-}
-
-// extractHostIP parses the IP from a host:port string and returns it unmapped.
-func extractHostIP(hostPort string) netip.Addr {
-	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
-		return ap.Addr().Unmap()
-	}
-	if addr, err := netip.ParseAddr(hostPort); err == nil {
-		return addr.Unmap()
-	}
-	return netip.Addr{}
-}
-
-// isTrustedAddr checks if the given address falls within any of the trusted prefixes.
-func isTrustedAddr(addr netip.Addr, trusted []netip.Prefix) bool {
-	if !addr.IsValid() {
-		return false
-	}
-	for _, prefix := range trusted {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}

proxy/internal/proxy/trustedproxy_test.go

@@ -1,129 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIsTrustedProxy(t *testing.T) {
-	trusted := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("192.168.1.0/24"),
-		netip.MustParsePrefix("fd00::/8"),
-	}
-
-	tests := []struct {
-		name    string
-		ip      string
-		trusted []netip.Prefix
-		want    bool
-	}{
-		{"empty trusted list", "10.0.0.1", nil, false},
-		{"IP within /8 prefix", "10.1.2.3", trusted, true},
-		{"IP within /24 prefix", "192.168.1.100", trusted, true},
-		{"IP outside all prefixes", "203.0.113.50", trusted, false},
-		{"boundary IP just outside prefix", "192.168.2.1", trusted, false},
-		{"unparsable IP", "not-an-ip", trusted, false},
-		{"IPv6 in trusted range", "fd00::1", trusted, true},
-		{"IPv6 outside range", "2001:db8::1", trusted, false},
-		{"empty string", "", trusted, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsTrustedProxy(tt.ip, tt.trusted))
-		})
-	}
-}
-
-func TestResolveClientIP(t *testing.T) {
-	trusted := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("172.16.0.0/12"),
-	}
-
-	tests := []struct {
-		name       string
-		remoteAddr string
-		xff        string
-		trusted    []netip.Prefix
-		want       netip.Addr
-	}{
-		{
-			name:       "empty trusted list returns RemoteAddr",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4",
-			trusted:    nil,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "untrusted RemoteAddr ignores XFF",
-			remoteAddr: "203.0.113.50:9999",
-			xff:        "1.2.3.4, 10.0.0.1",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with single client in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr walks past trusted entries in XFF",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("10.0.0.1"),
-		},
-		{
-			name:       "all XFF IPs trusted returns leftmost",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("10.0.0.2"),
-		},
-		{
-			name:       "XFF with whitespace",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        " 203.0.113.50 , 10.0.0.2 ",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "XFF with empty segments",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "203.0.113.50,,10.0.0.2",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "multi-hop with mixed trust",
-			remoteAddr: "10.0.0.1:5000",
-			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-		{
-			name:       "RemoteAddr without port",
-			remoteAddr: "10.0.0.1",
-			xff:        "203.0.113.50",
-			trusted:    trusted,
-			want:       netip.MustParseAddr("203.0.113.50"),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ResolveClientIP(tt.remoteAddr, tt.xff, tt.trusted))
-		})
-	}
-}

proxy/lifecycle.go

@@ -2,13 +2,13 @@ package proxy
 
 import (
 	"context"
-	"net/netip"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // Config bundles every knob the proxy reads at construction time. It mirrors
@@ -83,9 +83,9 @@ type Config struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to
 	// backends. Valid values: "auto", "http", "https".
 	ForwardedProto string
-	// TrustedProxies is a list of IP prefixes for trusted upstream
-	// proxies that may set forwarding headers.
-	TrustedProxies []netip.Prefix
+	// TrustedProxies is the set of trusted upstream proxies that may set
+	// forwarding headers.
+	TrustedProxies *trustedproxy.List
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
 	WireguardPort uint16

proxy/proxyprotocol_test.go

@@ -10,12 +10,14 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("127.0.0.1/32")}),
 		ProxyProtocol:  true,
 	}
 
@@ -66,7 +68,7 @@ func TestWrapProxyProtocol_OverridesRemoteAddr(t *testing.T) {
 func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -80,7 +82,7 @@ func TestProxyProtocolPolicy_TrustedRequires(t *testing.T) {
 func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{
@@ -94,7 +96,7 @@ func TestProxyProtocolPolicy_UntrustedIgnores(t *testing.T) {
 func TestProxyProtocolPolicy_InvalidIPRejects(t *testing.T) {
 	srv := &Server{
 		Logger:         log.StandardLogger(),
-		TrustedProxies: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		TrustedProxies: trustedproxy.FromPrefixes([]netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}),
 	}
 
 	opts := proxyproto.ConnPolicyOptions{

proxy/server.go

@@ -67,6 +67,7 @@ import (
 	"github.com/netbirdio/netbird/proxy/web"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util/embeddedroots"
 )
 
@@ -79,19 +80,19 @@ type portRouter struct {
 
 type Server struct {
 	ctx               context.Context
-	mgmtClient    proto.ProxyServiceClient
-	proxy         *proxy.ReverseProxy
-	netbird       *roundtrip.NetBird
-	acme          *acme.Manager
+	mgmtClient        proto.ProxyServiceClient
+	proxy             *proxy.ReverseProxy
+	netbird           *roundtrip.NetBird
+	acme              *acme.Manager
 	staticCertWatcher *certwatch.Watcher
-	auth          *auth.Middleware
-	http          *http.Server
-	https         *http.Server
-	debug         *http.Server
-	healthServer  *health.Server
-	healthChecker *health.Checker
-	meter         *proxymetrics.Metrics
-	accessLog     *accesslog.Logger
+	auth              *auth.Middleware
+	http              *http.Server
+	https             *http.Server
+	debug             *http.Server
+	healthServer      *health.Server
+	healthChecker     *health.Checker
+	meter             *proxymetrics.Metrics
+	accessLog         *accesslog.Logger
 	// middlewareManager drives per-target middleware dispatch. Always
 	// constructed during boot; an empty registry produces empty chains and
 	// the reverse-proxy stays on the no-capture fast path.
@@ -99,16 +100,16 @@ type Server struct {
 	// middlewareRegistry is the source of registered middleware factories.
 	// Concrete middlewares register themselves through init().
 	middlewareRegistry *middleware.Registry
-	mainRouter    *nbtcp.Router
-	mainPort      uint16
-	udpMu         sync.Mutex
-	udpRelays     map[types.ServiceID]*udprelay.Relay
-	udpRelayWg    sync.WaitGroup
-	portMu        sync.RWMutex
-	portRouters   map[uint16]*portRouter
-	svcPorts      map[types.ServiceID][]uint16
-	lastMappings  map[types.ServiceID]*proto.ProxyMapping
-	portRouterWg  sync.WaitGroup
+	mainRouter         *nbtcp.Router
+	mainPort           uint16
+	udpMu              sync.Mutex
+	udpRelays          map[types.ServiceID]*udprelay.Relay
+	udpRelayWg         sync.WaitGroup
+	portMu             sync.RWMutex
+	portRouters        map[uint16]*portRouter
+	svcPorts           map[types.ServiceID][]uint16
+	lastMappings       map[types.ServiceID]*proto.ProxyMapping
+	portRouterWg       sync.WaitGroup
 
 	// hijackTracker tracks hijacked connections (e.g. WebSocket upgrades)
 	// so they can be closed during graceful shutdown, since http.Server.Shutdown
@@ -192,10 +193,10 @@ type Server struct {
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to backends.
 	// Valid values: "auto" (detect from TLS), "http", "https".
 	ForwardedProto string
-	// TrustedProxies is a list of IP prefixes for trusted upstream proxies.
-	// When set, forwarding headers from these sources are preserved and
-	// appended to instead of being stripped.
-	TrustedProxies []netip.Prefix
+	// TrustedProxies is the set of trusted upstream proxies. When set,
+	// forwarding headers from these sources are preserved and appended to
+	// instead of being stripped.
+	TrustedProxies *trustedproxy.List
 	// WireguardPort is the port for the NetBird tunnel interface. Use 0
 	// for a random OS-assigned port. A fixed port only works with
 	// single-account deployments; multiple accounts will fail to bind
@@ -718,7 +719,7 @@ func (s *Server) wrapProxyProtocol(ln net.Listener) net.Listener {
 		Listener:          ln,
 		ReadHeaderTimeout: proxyProtoHeaderTimeout,
 	}
-	if len(s.TrustedProxies) > 0 {
+	if !s.TrustedProxies.Empty() {
 		ppListener.ConnPolicy = s.proxyProtocolPolicy
 	} else {
 		s.Logger.Warn("PROXY protocol enabled without trusted proxies; any source may send PROXY headers")
@@ -742,10 +743,8 @@ func (s *Server) proxyProtocolPolicy(opts proxyproto.ConnPolicyOptions) (proxypr
 	addr = addr.Unmap()
 
 	// called per accept
-	for _, prefix := range s.TrustedProxies {
-		if prefix.Contains(addr) {
-			return proxyproto.REQUIRE, nil
-		}
+	if s.TrustedProxies.Contains(addr) {
+		return proxyproto.REQUIRE, nil
 	}
 	return proxyproto.IGNORE, nil
 }

proxy/trustedproxy.go

@@ -1,43 +0,0 @@
-package proxy
-
-import (
-	"fmt"
-	"net/netip"
-	"strings"
-)
-
-// ParseTrustedProxies parses a comma-separated list of CIDR prefixes or bare IPs
-// into a slice of netip.Prefix values suitable for trusted proxy configuration.
-// Bare IPs are converted to single-host prefixes (/32 or /128).
-func ParseTrustedProxies(raw string) ([]netip.Prefix, error) {
-	if raw == "" {
-		return nil, nil
-	}
-
-	parts := strings.Split(raw, ",")
-	prefixes := make([]netip.Prefix, 0, len(parts))
-	for _, part := range parts {
-		part = strings.TrimSpace(part)
-		if part == "" {
-			continue
-		}
-
-		prefix, err := netip.ParsePrefix(part)
-		if err == nil {
-			prefixes = append(prefixes, prefix)
-			continue
-		}
-
-		addr, addrErr := netip.ParseAddr(part)
-		if addrErr != nil {
-			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
-		}
-
-		bits := 32
-		if addr.Is6() {
-			bits = 128
-		}
-		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
-	}
-	return prefixes, nil
-}

proxy/trustedproxy_test.go

@@ -1,90 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseTrustedProxies(t *testing.T) {
-	tests := []struct {
-		name    string
-		raw     string
-		want    []netip.Prefix
-		wantErr bool
-	}{
-		{
-			name: "empty string returns nil",
-			raw:  "",
-			want: nil,
-		},
-		{
-			name: "single CIDR",
-			raw:  "10.0.0.0/8",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name: "single bare IPv4",
-			raw:  "1.2.3.4",
-			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
-		},
-		{
-			name: "single bare IPv6",
-			raw:  "::1",
-			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
-		},
-		{
-			name: "comma-separated CIDRs",
-			raw:  "10.0.0.0/8, 192.168.1.0/24",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.1.0/24"),
-			},
-		},
-		{
-			name: "mixed CIDRs and bare IPs",
-			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("1.2.3.4/32"),
-				netip.MustParsePrefix("fd00::/8"),
-			},
-		},
-		{
-			name: "whitespace around entries",
-			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
-			want: []netip.Prefix{
-				netip.MustParsePrefix("10.0.0.0/8"),
-				netip.MustParsePrefix("192.168.0.0/16"),
-			},
-		},
-		{
-			name: "trailing comma produces no extra entry",
-			raw:  "10.0.0.0/8,",
-			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
-		},
-		{
-			name:    "invalid entry",
-			raw:     "not-an-ip",
-			wantErr: true,
-		},
-		{
-			name:    "partially invalid",
-			raw:     "10.0.0.0/8, garbage",
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseTrustedProxies(tt.raw)
-			if tt.wantErr {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}

relay/cmd/root.go

@@ -24,6 +24,7 @@ import (
 	"github.com/netbirdio/netbird/shared/metrics"
 	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/stun"
+	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -45,6 +46,9 @@ type Config struct {
 	LogLevel                 string
 	LogFile                  string
 	HealthcheckListenAddress string
+	// TrustedProxies is a comma-separated list of upstream proxy CIDRs/IPs whose
+	// X-Real-Ip/X-Real-Port headers are trusted. Empty means never trust these headers.
+	TrustedProxies string
 	// STUN server configuration
 	EnableSTUN   bool
 	STUNPorts    []int
@@ -116,6 +120,7 @@ func init() {
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogLevel, "log-level", "info", "log level")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.LogFile, "log-file", "console", "log file")
 	rootCmd.PersistentFlags().StringVarP(&cobraConfig.HealthcheckListenAddress, "health-listen-address", "H", ":9000", "listen address of healthcheck server")
+	rootCmd.PersistentFlags().StringVar(&cobraConfig.TrustedProxies, "trusted-proxies", "", "comma-separated list of upstream proxy CIDRs or IPs whose X-Real-Ip/X-Real-Port headers are trusted; leave empty to always use the direct connection address")
 	rootCmd.PersistentFlags().BoolVar(&cobraConfig.EnableSTUN, "enable-stun", false, "enable embedded STUN server")
 	rootCmd.PersistentFlags().IntSliceVar(&cobraConfig.STUNPorts, "stun-ports", []int{3478}, "ports for the embedded STUN server (can be specified multiple times or comma-separated)")
 	rootCmd.PersistentFlags().StringVar(&cobraConfig.STUNLogLevel, "stun-log-level", "info", "log level for STUN server (panic, fatal, error, warn, info, debug, trace)")
@@ -155,8 +160,15 @@ func execute(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("setup metrics: %v", err)
 	}
 
+	trustedProxies, err := trustedproxy.Parse(cobraConfig.TrustedProxies)
+	if err != nil {
+		log.Debugf("failed to parse trusted proxies: %s", err)
+		return fmt.Errorf("failed to parse trusted proxies: %s", err)
+	}
+
 	srvListenerCfg := server.ListenerConfig{
-		Address: cobraConfig.ListenAddress,
+		Address:        cobraConfig.ListenAddress,
+		TrustedProxies: trustedProxies,
 	}
 
 	tlsConfig, tlsSupport, err := handleTLSConfig(cobraConfig)
@@ -173,7 +185,7 @@ func execute(cmd *cobra.Command, args []string) error {
 	}
 
 	hashedSecret := sha256.Sum256([]byte(cobraConfig.AuthSecret))
-	authenticator := auth.NewTimedHMACValidator(hashedSecret[:], 24*time.Hour)
+	authenticator := auth.NewTimedHMACValidator(hashedSecret[:])
 
 	cfg := server.Config{
 		Meter:          metricsServer.Meter,

relay/server/handshake.go

@@ -5,14 +5,8 @@ import (
 	"fmt"
 	"time"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay/messages"
-	//nolint:staticcheck
-	"github.com/netbirdio/netbird/shared/relay/messages/address"
-	//nolint:staticcheck
-	authmsg "github.com/netbirdio/netbird/shared/relay/messages/auth"
 )
 
 const (
@@ -23,55 +17,30 @@ const (
 
 type Validator interface {
 	Validate(any) error
-	// Deprecated: Use Validate instead.
-	ValidateHelloMsgType(any) error
 }
 
-// preparedMsg contains the marshalled success response messages
+// preparedMsg contains the marshalled success response message
 type preparedMsg struct {
-	responseHelloMsg []byte
-	responseAuthMsg  []byte
+	responseAuthMsg []byte
 }
 
 func newPreparedMsg(instanceURL string) (*preparedMsg, error) {
-	rhm, err := marshalResponseHelloMsg(instanceURL)
-	if err != nil {
-		return nil, err
-	}
-
 	ram, err := messages.MarshalAuthResponse(instanceURL)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal auth response msg: %w", err)
 	}
 
 	return &preparedMsg{
-		responseHelloMsg: rhm,
-		responseAuthMsg:  ram,
+		responseAuthMsg: ram,
 	}, nil
 }
 
-func marshalResponseHelloMsg(instanceURL string) ([]byte, error) {
-	addr := &address.Address{URL: instanceURL}
-	addrData, err := addr.Marshal()
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal response address: %w", err)
-	}
-
-	//nolint:staticcheck
-	responseMsg, err := messages.MarshalHelloResponse(addrData)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal hello response: %w", err)
-	}
-	return responseMsg, nil
-}
-
 type handshake struct {
 	conn        listener.Conn
 	validator   Validator
 	preparedMsg *preparedMsg
 
-	handshakeMethodAuth bool
-	peerID              *messages.PeerID
+	peerID *messages.PeerID
 }
 
 func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, error) {
@@ -93,17 +62,11 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 		return nil, fmt.Errorf("determine message type from %s: %w", h.conn.RemoteAddr(), err)
 	}
 
-	var peerID *messages.PeerID
-	switch msgType {
-	//nolint:staticcheck
-	case messages.MsgTypeHello:
-		peerID, err = h.handleHelloMsg(buf)
-	case messages.MsgTypeAuth:
-		h.handshakeMethodAuth = true
-		peerID, err = h.handleAuthMsg(buf)
-	default:
+	if msgType != messages.MsgTypeAuth {
 		return nil, fmt.Errorf("invalid message type %d from %s", msgType, h.conn.RemoteAddr())
 	}
+
+	peerID, err := h.handleAuthMsg(buf)
 	if err != nil {
 		return peerID, err
 	}
@@ -112,46 +75,17 @@ func (h *handshake) handshakeReceive(ctx context.Context) (*messages.PeerID, err
 }
 
 func (h *handshake) handshakeResponse(ctx context.Context) error {
-	var responseMsg []byte
-	if h.handshakeMethodAuth {
-		responseMsg = h.preparedMsg.responseAuthMsg
-	} else {
-		responseMsg = h.preparedMsg.responseHelloMsg
-	}
-
-	if _, err := h.conn.Write(ctx, responseMsg); err != nil {
+	if _, err := h.conn.Write(ctx, h.preparedMsg.responseAuthMsg); err != nil {
 		return fmt.Errorf("handshake response write to %s (%s): %w", h.peerID, h.conn.RemoteAddr(), err)
 	}
 
 	return nil
 }
 
-func (h *handshake) handleHelloMsg(buf []byte) (*messages.PeerID, error) {
-	//nolint:staticcheck
-	peerID, authData, err := messages.UnmarshalHelloMsg(buf)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshal hello message: %w", err)
-	}
-
-	log.Warnf("peer %s (%s) is using deprecated initial message type", peerID, h.conn.RemoteAddr())
-
-	authMsg, err := authmsg.UnmarshalMsg(authData)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshal auth message: %w", err)
-	}
-
-	//nolint:staticcheck
-	if err := h.validator.ValidateHelloMsgType(authMsg.AdditionalData); err != nil {
-		return nil, fmt.Errorf("validate %s (%s): %w", peerID, h.conn.RemoteAddr(), err)
-	}
-
-	return peerID, nil
-}
-
 func (h *handshake) handleAuthMsg(buf []byte) (*messages.PeerID, error) {
 	rawPeerID, authPayload, err := messages.UnmarshalAuthMsg(buf)
 	if err != nil {
-		return nil, fmt.Errorf("unmarshal hello message: %w", err)
+		return nil, fmt.Errorf("unmarshal auth message: %w", err)
 	}
 
 	if err := h.validator.Validate(authPayload); err != nil {

relay/server/listener/ws/listener.go

@@ -15,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/relay/protocol"
 	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/shared/relay"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 const (
@@ -27,6 +28,9 @@ type Listener struct {
 	Address string
 	// TLSConfig is the TLS configuration for the server.
 	TLSConfig *tls.Config
+	// TrustedProxies is the set of upstream proxies whose X-Real-Ip/X-Real-Port
+	// headers are trusted. Headers from any other immediate peer are ignored.
+	TrustedProxies *trustedproxy.List
 
 	server   *http.Server
 	acceptFn func(conn relaylistener.Conn)
@@ -75,7 +79,7 @@ func (l *Listener) Shutdown(ctx context.Context) error {
 }
 
 func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
-	connRemoteAddr := remoteAddr(r)
+	connRemoteAddr := remoteAddr(r, l.TrustedProxies)
 
 	acceptOptions := &websocket.AcceptOptions{
 		OriginPatterns: []string{"*"},
@@ -102,9 +106,17 @@ func (l *Listener) onAccept(w http.ResponseWriter, r *http.Request) {
 	l.acceptFn(conn)
 }
 
-func remoteAddr(r *http.Request) string {
-	if r.Header.Get("X-Real-Ip") == "" || r.Header.Get("X-Real-Port") == "" {
+func remoteAddr(r *http.Request, trustedProxies *trustedproxy.List) string {
+	realIP := r.Header.Get("X-Real-Ip")
+	realPort := r.Header.Get("X-Real-Port")
+	if realIP == "" || realPort == "" {
 		return r.RemoteAddr
 	}
-	return net.JoinHostPort(r.Header.Get("X-Real-Ip"), r.Header.Get("X-Real-Port"))
+
+	if !trustedProxies.IsTrusted(r.RemoteAddr) {
+		log.Debugf("ignoring X-Real-Ip header from untrusted peer %s", r.RemoteAddr)
+		return r.RemoteAddr
+	}
+
+	return net.JoinHostPort(realIP, realPort)
 }

relay/server/server.go

@@ -15,14 +15,17 @@ import (
 	"github.com/netbirdio/netbird/relay/server/listener/quic"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
 	quictls "github.com/netbirdio/netbird/shared/relay/tls"
+	"github.com/netbirdio/netbird/trustedproxy"
 )
 
 // ListenerConfig is the configuration for the listener.
 // Address: the address to bind the listener to. It could be an address behind a reverse proxy.
 // TLSConfig: the TLS configuration for the listener.
+// TrustedProxies: upstream proxy prefixes whose forwarding headers (X-Real-Ip/X-Real-Port) are trusted.
 type ListenerConfig struct {
-	Address   string
-	TLSConfig *tls.Config
+	Address        string
+	TLSConfig      *tls.Config
+	TrustedProxies *trustedproxy.List
 }
 
 // Server is the main entry point for the relay server.
@@ -62,8 +65,9 @@ func NewServer(config Config) (*Server, error) {
 // Listen starts the relay server.
 func (r *Server) Listen(cfg ListenerConfig) error {
 	wSListener := &ws.Listener{
-		Address:   cfg.Address,
-		TLSConfig: cfg.TLSConfig,
+		Address:        cfg.Address,
+		TLSConfig:      cfg.TLSConfig,
+		TrustedProxies: cfg.TrustedProxies,
 	}
 
 	r.listenerMux.Lock()

shared/management/http/api/openapi.yml

@@ -5164,6 +5164,10 @@ components:
           type: boolean
           description: Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
           example: false
+        metadata_disabled:
+          type: boolean
+          description: Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+          example: false
         created_at:
           type: string
           format: date-time
@@ -5184,6 +5188,7 @@ components:
         - models
         - enabled
         - skip_tls_verification
+        - metadata_disabled
         - created_at
         - updated_at
     AgentNetworkProviderRequest:
@@ -5240,6 +5245,10 @@ components:
           type: boolean
           description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
           example: false
+        metadata_disabled:
+          type: boolean
+          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
+          example: false
       required:
         - provider_id
         - name

shared/management/http/api/types.gen.go

@@ -2227,6 +2227,9 @@ type AgentNetworkProvider struct {
 	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
+	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+	MetadataDisabled bool `json:"metadata_disabled"`
+
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models []AgentNetworkProviderModel `json:"models"`
 
@@ -2278,6 +2281,9 @@ type AgentNetworkProviderRequest struct {
 	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
+	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
+	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
+
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models *[]AgentNetworkProviderModel `json:"models,omitempty"`
 

shared/relay/auth/allow/allow_all.go

@@ -8,7 +8,3 @@ type Auth struct {
 func (a *Auth) Validate(any) error {
 	return nil
 }
-
-func (a *Auth) ValidateHelloMsgType(any) error {
-	return nil
-}

shared/relay/auth/hmac/token.go

@@ -1,10 +1,8 @@
 package hmac
 
 import (
-	"bytes"
 	"crypto/hmac"
 	"encoding/base64"
-	"encoding/gob"
 	"fmt"
 	"hash"
 	"strconv"
@@ -18,14 +16,6 @@ type Token struct {
 	Signature string
 }
 
-func unmarshalToken(payload []byte) (Token, error) {
-	var creds Token
-	buffer := bytes.NewBuffer(payload)
-	decoder := gob.NewDecoder(buffer)
-	err := decoder.Decode(&creds)
-	return creds, err
-}
-
 // TimedHMAC generates a token with TTL and uses a pre-shared secret known to the relay server
 type TimedHMAC struct {
 	secret     string

shared/relay/auth/hmac/validator.go

@@ -1,33 +0,0 @@
-package hmac
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-type TimedHMACValidator struct {
-	*TimedHMAC
-}
-
-func NewTimedHMACValidator(secret string, duration time.Duration) *TimedHMACValidator {
-	ta := NewTimedHMAC(secret, duration)
-	return &TimedHMACValidator{
-		ta,
-	}
-}
-
-func (a *TimedHMACValidator) Validate(credentials any) error {
-	b, ok := credentials.([]byte)
-	if !ok {
-		return fmt.Errorf("invalid credentials type")
-	}
-	c, err := unmarshalToken(b)
-	if err != nil {
-		log.Debugf("failed to unmarshal token: %s", err)
-		return err
-	}
-	return a.TimedHMAC.Validate(sha256.New, c)
-}

shared/relay/auth/validator.go

@@ -1,28 +1,19 @@
 package auth
 
 import (
-	"time"
-
-	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	authv2 "github.com/netbirdio/netbird/shared/relay/auth/hmac/v2"
 )
 
 type TimedHMACValidator struct {
 	authenticatorV2 *authv2.Validator
-	authenticator   *auth.TimedHMACValidator
 }
 
-func NewTimedHMACValidator(secret []byte, duration time.Duration) *TimedHMACValidator {
+func NewTimedHMACValidator(secret []byte) *TimedHMACValidator {
 	return &TimedHMACValidator{
 		authenticatorV2: authv2.NewValidator(secret),
-		authenticator:   auth.NewTimedHMACValidator(string(secret), duration),
 	}
 }
 
 func (a *TimedHMACValidator) Validate(credentials any) error {
 	return a.authenticatorV2.Validate(credentials)
 }
-
-func (a *TimedHMACValidator) ValidateHelloMsgType(credentials any) error {
-	return a.authenticator.Validate(credentials)
-}

shared/relay/messages/address/address.go

@@ -1,21 +0,0 @@
-// Deprecated: This package is deprecated and will be removed in a future release.
-package address
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-)
-
-type Address struct {
-	URL string
-}
-
-func (addr *Address) Marshal() ([]byte, error) {
-	var buf bytes.Buffer
-	enc := gob.NewEncoder(&buf)
-	if err := enc.Encode(addr); err != nil {
-		return nil, fmt.Errorf("encode Address: %w", err)
-	}
-	return buf.Bytes(), nil
-}

shared/relay/messages/auth/auth.go

@@ -1,43 +0,0 @@
-// Deprecated: This package is deprecated and will be removed in a future release.
-package auth
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-)
-
-type Algorithm int
-
-const (
-	AlgoUnknown Algorithm = iota
-	AlgoHMACSHA256
-	AlgoHMACSHA512
-)
-
-func (a Algorithm) String() string {
-	switch a {
-	case AlgoHMACSHA256:
-		return "HMAC-SHA256"
-	case AlgoHMACSHA512:
-		return "HMAC-SHA512"
-	default:
-		return "Unknown"
-	}
-}
-
-type Msg struct {
-	AuthAlgorithm  Algorithm
-	AdditionalData []byte
-}
-
-func UnmarshalMsg(data []byte) (*Msg, error) {
-	var msg *Msg
-
-	buf := bytes.NewBuffer(data)
-	dec := gob.NewDecoder(buf)
-	if err := dec.Decode(&msg); err != nil {
-		return nil, fmt.Errorf("decode Msg: %w", err)
-	}
-	return msg, nil
-}

shared/relay/messages/message.go

@@ -14,9 +14,10 @@ const (
 	CurrentProtocolVersion = 1
 
 	MsgTypeUnknown MsgType = 0
-	// Deprecated: Use MsgTypeAuth instead.
-	MsgTypeHello = 1
-	// Deprecated: Use MsgTypeAuthResponse instead.
+	// MsgTypeHello and MsgTypeHelloResponse are the removed legacy handshake
+	// message types. They are retained only to reserve wire values 1 and 2 so
+	// the values are never reused; the server rejects both.
+	MsgTypeHello         = 1
 	MsgTypeHelloResponse = 2
 	MsgTypeTransport     = 3
 	MsgTypeClose         = 4
@@ -42,10 +43,6 @@ const (
 	offsetAuthPeerID    = sizeOfProtoHeader + sizeOfMagicByte
 	headerTotalSizeAuth = sizeOfProtoHeader + headerSizeAuth
 
-	// hello message
-	headerSizeHello     = sizeOfMagicByte + peerIDSize
-	headerSizeHelloResp = 0
-
 	// transport
 	headerSizeTransport      = peerIDSize
 	offsetTransportID        = sizeOfProtoHeader
@@ -113,7 +110,6 @@ func DetermineClientMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
-		MsgTypeHello,
 		MsgTypeAuth,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -135,7 +131,6 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	msgType := MsgType(msg[1])
 	switch msgType {
 	case
-		MsgTypeHelloResponse,
 		MsgTypeAuthResponse,
 		MsgTypeTransport,
 		MsgTypeClose,
@@ -148,67 +143,6 @@ func DetermineServerMessageType(msg []byte) (MsgType, error) {
 	}
 }
 
-// Deprecated: Use MarshalAuthMsg instead.
-// MarshalHelloMsg initial hello message
-// The Hello message is the first message sent by a client after establishing a connection with the Relay server. This
-// message is used to authenticate the client with the server. The authentication is done using an HMAC method.
-// The protocol does not limit to use HMAC, it can be any other method. If the authentication failed the server will
-// close the network connection without any response.
-func MarshalHelloMsg(peerID PeerID, additions []byte) ([]byte, error) {
-	msg := make([]byte, sizeOfProtoHeader+sizeOfMagicByte, sizeOfProtoHeader+headerSizeHello+len(additions))
-
-	msg[0] = byte(CurrentProtocolVersion)
-	msg[1] = byte(MsgTypeHello)
-
-	copy(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader)
-
-	msg = append(msg, peerID[:]...)
-	msg = append(msg, additions...)
-
-	return msg, nil
-}
-
-// Deprecated: Use UnmarshalAuthMsg instead.
-// UnmarshalHelloMsg extracts peerID and the additional data from the hello message. The Additional data is used to
-// authenticate the client with the server.
-func UnmarshalHelloMsg(msg []byte) (*PeerID, []byte, error) {
-	if len(msg) < sizeOfProtoHeader+headerSizeHello {
-		return nil, nil, ErrInvalidMessageLength
-	}
-	if !bytes.Equal(msg[sizeOfProtoHeader:sizeOfProtoHeader+sizeOfMagicByte], magicHeader) {
-		return nil, nil, errors.New("invalid magic header")
-	}
-
-	peerID := PeerID(msg[sizeOfProtoHeader+sizeOfMagicByte : sizeOfProtoHeader+headerSizeHello])
-
-	return &peerID, msg[headerSizeHello:], nil
-}
-
-// Deprecated: Use MarshalAuthResponse instead.
-// MarshalHelloResponse creates a response message to the hello message.
-// In case of success connection the server response with a Hello Response message. This message contains the server's
-// instance URL. This URL will be used by choose the common Relay server in case if the peers are in different Relay
-// servers.
-func MarshalHelloResponse(additionalData []byte) ([]byte, error) {
-	msg := make([]byte, sizeOfProtoHeader, sizeOfProtoHeader+headerSizeHelloResp+len(additionalData))
-
-	msg[0] = byte(CurrentProtocolVersion)
-	msg[1] = byte(MsgTypeHelloResponse)
-
-	msg = append(msg, additionalData...)
-
-	return msg, nil
-}
-
-// Deprecated: Use UnmarshalAuthResponse instead.
-// UnmarshalHelloResponse extracts the additional data from the hello response message.
-func UnmarshalHelloResponse(msg []byte) ([]byte, error) {
-	if len(msg) < sizeOfProtoHeader+headerSizeHelloResp {
-		return nil, ErrInvalidMessageLength
-	}
-	return msg, nil
-}
-
 // MarshalAuthMsg initial authentication message
 // The Auth message is the first message sent by a client after establishing a connection with the Relay server. This
 // message is used to authenticate the client with the server. The authentication is done using an HMAC method.

shared/relay/messages/message_test.go

@@ -4,28 +4,11 @@ import (
 	"testing"
 )
 
-func TestMarshalHelloMsg(t *testing.T) {
-	peerID := HashID("abdFAaBcawquEiCMzAabYosuUaGLtSNhKxz+")
-	msg, err := MarshalHelloMsg(peerID, nil)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-
-	msgType, err := DetermineClientMessageType(msg)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-
-	if msgType != MsgTypeHello {
-		t.Errorf("expected %d, got %d", MsgTypeHello, msgType)
-	}
-
-	receivedPeerID, _, err := UnmarshalHelloMsg(msg)
-	if err != nil {
-		t.Fatalf("error: %v", err)
-	}
-	if receivedPeerID.String() != peerID.String() {
-		t.Errorf("expected %s, got %s", peerID, receivedPeerID)
+func TestDetermineClientMessageTypeRejectsHello(t *testing.T) {
+	// The reserved legacy Hello message (type 1) must be rejected by the server.
+	msg := []byte{byte(CurrentProtocolVersion), byte(MsgTypeHello)}
+	if _, err := DetermineClientMessageType(msg); err == nil {
+		t.Fatalf("expected hello message type to be rejected")
 	}
 }
 

trustedproxy/trustedproxy.go

@@ -0,0 +1,132 @@
+package trustedproxy
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+)
+
+// List holds a parsed set of trusted upstream proxy prefixes and answers trust
+// questions against it. The zero value (and a nil *List) is a valid, empty list
+// that never trusts any address, so callers can use it without a nil check.
+type List struct {
+	prefixes []netip.Prefix
+}
+
+// Parse parses a comma-separated list of CIDR prefixes or bare IPs into a List.
+// Bare IPs are converted to single-host prefixes (/32 or /128). An empty input
+// yields an empty List that trusts nothing.
+func Parse(raw string) (*List, error) {
+	if raw == "" {
+		return &List{}, nil
+	}
+
+	parts := strings.Split(raw, ",")
+	prefixes := make([]netip.Prefix, 0, len(parts))
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		prefix, err := netip.ParsePrefix(part)
+		if err == nil {
+			prefixes = append(prefixes, prefix)
+			continue
+		}
+
+		addr, addrErr := netip.ParseAddr(part)
+		if addrErr != nil {
+			return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
+		}
+
+		bits := 32
+		if addr.Is6() {
+			bits = 128
+		}
+		prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
+	}
+	return &List{prefixes: prefixes}, nil
+}
+
+// FromPrefixes wraps an already-parsed set of prefixes in a List.
+func FromPrefixes(prefixes []netip.Prefix) *List {
+	return &List{prefixes: prefixes}
+}
+
+// Empty reports whether the list contains no prefixes.
+func (l *List) Empty() bool {
+	return l == nil || len(l.prefixes) == 0
+}
+
+// IsTrusted reports whether the given host:port or bare IP falls within the list.
+func (l *List) IsTrusted(remoteAddr string) bool {
+	if l.Empty() {
+		return false
+	}
+	return l.Contains(ExtractHostIP(remoteAddr))
+}
+
+// Contains reports whether the given address falls within any trusted prefix.
+func (l *List) Contains(addr netip.Addr) bool {
+	if l.Empty() || !addr.IsValid() {
+		return false
+	}
+	for _, prefix := range l.prefixes {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
+// ResolveClientIP extracts the real client IP from X-Forwarded-For using the
+// list. It walks the XFF chain right-to-left, skipping IPs that match trusted
+// prefixes; the first untrusted IP is the real client. If the list is empty or
+// remoteAddr is not trusted, it returns the remoteAddr IP directly, ignoring any
+// forwarding headers.
+func (l *List) ResolveClientIP(remoteAddr, xff string) netip.Addr {
+	remoteIP := ExtractHostIP(remoteAddr)
+
+	if l.Empty() || !l.Contains(remoteIP) {
+		return remoteIP
+	}
+
+	if xff == "" {
+		return remoteIP
+	}
+
+	parts := strings.Split(xff, ",")
+	for i := len(parts) - 1; i >= 0; i-- {
+		ip := strings.TrimSpace(parts[i])
+		if ip == "" {
+			continue
+		}
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			continue
+		}
+		addr = addr.Unmap()
+		if !l.Contains(addr) {
+			return addr
+		}
+	}
+
+	if first := strings.TrimSpace(parts[0]); first != "" {
+		if addr, err := netip.ParseAddr(first); err == nil {
+			return addr.Unmap()
+		}
+	}
+	return remoteIP
+}
+
+// ExtractHostIP parses the IP from a host:port string and returns it unmapped.
+func ExtractHostIP(hostPort string) netip.Addr {
+	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
+		return ap.Addr().Unmap()
+	}
+	if addr, err := netip.ParseAddr(hostPort); err == nil {
+		return addr.Unmap()
+	}
+	return netip.Addr{}
+}

trustedproxy/trustedproxy_test.go

@@ -0,0 +1,216 @@
+package trustedproxy
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		want    []netip.Prefix
+		wantErr bool
+	}{
+		{
+			name: "empty string returns empty list",
+			raw:  "",
+			want: nil,
+		},
+		{
+			name: "single CIDR",
+			raw:  "10.0.0.0/8",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name: "single bare IPv4",
+			raw:  "1.2.3.4",
+			want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
+		},
+		{
+			name: "single bare IPv6",
+			raw:  "::1",
+			want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
+		},
+		{
+			name: "comma-separated CIDRs",
+			raw:  "10.0.0.0/8, 192.168.1.0/24",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.1.0/24"),
+			},
+		},
+		{
+			name: "mixed CIDRs and bare IPs",
+			raw:  "10.0.0.0/8, 1.2.3.4, fd00::/8",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("1.2.3.4/32"),
+				netip.MustParsePrefix("fd00::/8"),
+			},
+		},
+		{
+			name: "whitespace around entries",
+			raw:  "  10.0.0.0/8 , 192.168.0.0/16  ",
+			want: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/8"),
+				netip.MustParsePrefix("192.168.0.0/16"),
+			},
+		},
+		{
+			name: "trailing comma produces no extra entry",
+			raw:  "10.0.0.0/8,",
+			want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name:    "invalid entry",
+			raw:     "not-an-ip",
+			wantErr: true,
+		},
+		{
+			name:    "partially invalid",
+			raw:     "10.0.0.0/8, garbage",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := Parse(tt.raw)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got.prefixes)
+		})
+	}
+}
+
+func TestListIsTrusted(t *testing.T) {
+	list, err := Parse("10.0.0.0/8, 192.168.1.0/24, fd00::/8")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+		addr string
+		list *List
+		want bool
+	}{
+		{"nil list", "10.0.0.1", nil, false},
+		{"empty list", "10.0.0.1", &List{}, false},
+		{"IP within /8 prefix", "10.1.2.3", list, true},
+		{"IP within /24 prefix", "192.168.1.100", list, true},
+		{"IP outside all prefixes", "203.0.113.50", list, false},
+		{"boundary IP just outside prefix", "192.168.2.1", list, false},
+		{"unparsable IP", "not-an-ip", list, false},
+		{"IPv6 in trusted range", "fd00::1", list, true},
+		{"IPv6 outside range", "2001:db8::1", list, false},
+		{"empty string", "", list, false},
+		{"host:port within prefix", "10.1.2.3:9999", list, true},
+		{"host:port outside prefix", "203.0.113.50:9999", list, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.list.IsTrusted(tt.addr))
+		})
+	}
+}
+
+func TestListResolveClientIP(t *testing.T) {
+	trusted, err := Parse("10.0.0.0/8, 172.16.0.0/12")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		list       *List
+		want       netip.Addr
+	}{
+		{
+			name:       "empty list returns RemoteAddr",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4",
+			list:       &List{},
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "nil list returns RemoteAddr",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4",
+			list:       nil,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "untrusted RemoteAddr ignores XFF",
+			remoteAddr: "203.0.113.50:9999",
+			xff:        "1.2.3.4, 10.0.0.1",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with single client in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr walks past trusted entries in XFF",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50, 10.0.0.2, 172.16.0.5",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "",
+			list:       trusted,
+			want:       netip.MustParseAddr("10.0.0.1"),
+		},
+		{
+			name:       "all XFF IPs trusted returns leftmost",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "10.0.0.2, 172.16.0.1, 10.0.0.3",
+			list:       trusted,
+			want:       netip.MustParseAddr("10.0.0.2"),
+		},
+		{
+			name:       "XFF with whitespace",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        " 203.0.113.50 , 10.0.0.2 ",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "XFF with empty segments",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "203.0.113.50,,10.0.0.2",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "multi-hop with mixed trust",
+			remoteAddr: "10.0.0.1:5000",
+			xff:        "8.8.8.8, 203.0.113.50, 172.16.0.1",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+		{
+			name:       "RemoteAddr without port",
+			remoteAddr: "10.0.0.1",
+			xff:        "203.0.113.50",
+			list:       trusted,
+			want:       netip.MustParseAddr("203.0.113.50"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.list.ResolveClientIP(tt.remoteAddr, tt.xff))
+		})
+	}
+}