merge main

client/cmd/up.go

@@ -21,8 +21,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
 	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"

client/firewall/nftables/acl_linux.go

@@ -702,7 +702,6 @@ func ifname(n string) []byte {
 	return b
 }
 
-
 // ipToBytes converts net.IP to the correct byte length for the address family.
 func ipToBytes(ip net.IP, af addrFamily) []byte {
 	if af.addrLen == 4 {
@@ -710,4 +709,3 @@ func ipToBytes(ip net.IP, af addrFamily) []byte {
 	}
 	return ip.To16()
 }
-

client/firewall/uspfilter/conntrack/tcp_state_bugs_test.go

@@ -158,8 +158,8 @@ func TestTCPPerStateTeardownTimeouts(t *testing.T) {
 			name: "FinWait2",
 			drive: func(t *testing.T, tr *TCPTracker, srcIP netip.Addr, srcPort uint16) (ConnKey, TCPState) {
 				establishConnection(t, tr, srcIP, dstIP, srcPort, dstPort)
-				tr.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPFin|TCPAck, 0)              // FinWait1
-				require.True(t, tr.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPAck, 0))   // → FinWait2
+				tr.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPFin|TCPAck, 0)            // FinWait1
+				require.True(t, tr.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPAck, 0)) // → FinWait2
 				return ConnKey{SrcIP: srcIP, DstIP: dstIP, SrcPort: srcPort, DstPort: dstPort}, TCPStateFinWait2
 			},
 		},

client/firewall/uspfilter/rule.go

@@ -18,7 +18,7 @@ type PeerRule struct {
 	protoLayer gopacket.LayerType
 	sPort      *firewall.Port
 	dPort      *firewall.Port
-	drop bool
+	drop       bool
 }
 
 // ID returns the rule id

client/iface/iface_close_test.go

@@ -34,14 +34,14 @@ func (f *fakeTunDevice) Create() (device.WGConfigurer, error) {
 func (f *fakeTunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return nil, errors.New("not implemented")
 }
-func (f *fakeTunDevice) UpdateAddr(wgaddr.Address) error      { return nil }
-func (f *fakeTunDevice) WgAddress() wgaddr.Address            { return wgaddr.Address{} }
-func (f *fakeTunDevice) MTU() uint16                          { return DefaultMTU }
-func (f *fakeTunDevice) DeviceName() string                   { return "nb-close-test" }
+func (f *fakeTunDevice) UpdateAddr(wgaddr.Address) error        { return nil }
+func (f *fakeTunDevice) WgAddress() wgaddr.Address              { return wgaddr.Address{} }
+func (f *fakeTunDevice) MTU() uint16                            { return DefaultMTU }
+func (f *fakeTunDevice) DeviceName() string                     { return "nb-close-test" }
 func (f *fakeTunDevice) FilteredDevice() *device.FilteredDevice { return nil }
-func (f *fakeTunDevice) Device() *wgdevice.Device             { return nil }
-func (f *fakeTunDevice) GetNet() *netstack.Net                { return nil }
-func (f *fakeTunDevice) GetICEBind() device.EndpointManager   { return nil }
+func (f *fakeTunDevice) Device() *wgdevice.Device               { return nil }
+func (f *fakeTunDevice) GetNet() *netstack.Net                  { return nil }
+func (f *fakeTunDevice) GetICEBind() device.EndpointManager     { return nil }
 
 func (f *fakeTunDevice) Close() error {
 	close(f.closeStarted)

client/internal/acl/manager.go

@@ -116,11 +116,11 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 // firewall state, so an identical hash means an identical resulting ruleset.
 func (d *DefaultManager) firewallConfigHash(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool) (uint64, error) {
 	return hashstructure.Hash(struct {
-		PeerRules            []*mgmProto.FirewallRule
-		PeerRulesIsEmpty     bool
-		RouteRules           []*mgmProto.RouteFirewallRule
-		RouteRulesIsEmpty    bool
-		DNSRouteFeatureFlag  bool
+		PeerRules           []*mgmProto.FirewallRule
+		PeerRulesIsEmpty    bool
+		RouteRules          []*mgmProto.RouteFirewallRule
+		RouteRulesIsEmpty   bool
+		DNSRouteFeatureFlag bool
 	}{
 		PeerRules:           networkMap.GetFirewallRules(),
 		PeerRulesIsEmpty:    networkMap.GetFirewallRulesIsEmpty(),
@@ -407,7 +407,6 @@ func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) st
 	return fmt.Sprintf("%v:%v:%v:%s:%v", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port, rule.PortInfo)
 }
 
-
 // extractRuleIP extracts the peer IP from a firewall rule.
 // If sourcePrefixes is populated (new management), decode the first entry and use its address.
 // Otherwise fall back to the deprecated PeerIP string field (old management).

client/internal/acl/manager_test.go

@@ -556,7 +556,7 @@ func TestApplyFilteringSkipsUnchangedConfig(t *testing.T) {
 
 func buildNetworkMap(peerRules, routeRules int) *mgmProto.NetworkMap {
 	nm := &mgmProto.NetworkMap{
-		FirewallRulesIsEmpty:      peerRules == 0,
+		FirewallRulesIsEmpty:       peerRules == 0,
 		RoutesFirewallRulesIsEmpty: routeRules == 0,
 	}
 	for i := range peerRules {

client/internal/ebpf/ebpf/dns_fwd_linux.go

@@ -49,4 +49,3 @@ func (tf *GeneralManager) FreeDNSFwd() error {
 	log.Debugf("free ebpf DNS forwarder")
 	return tf.unsetFeatureFlag(featureFlagDnsForwarder)
 }
-

client/internal/portforward/manager_test.go

@@ -138,7 +138,6 @@ func TestManager_Cleanup_NilMapping(t *testing.T) {
 	m.cleanup(context.Background(), gateway)
 }
 
-
 func TestManager_CreateMapping_PermanentLeaseFallback(t *testing.T) {
 	m := NewManager()
 	m.wgPort = 51820

client/ssh/common.go

@@ -193,4 +193,3 @@ func buildAddressList(hostname string, remote net.Addr) []string {
 	}
 	return addresses
 }
-

client/ui/tray_click_linux.go

@@ -11,6 +11,7 @@ package main
 //   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
 //     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
 //     call itself (xembed_host_linux.go), so it routes through the same hook.
+//
 // Registering OnClick here therefore covers both paths with one handler — no
 // changes to the watcher or XEmbed C code are needed. Left-click now opens the
 // main window; right-click still opens the menu via Wails' default

client/wasm/internal/rdp/rdcleanpath.go

@@ -72,12 +72,12 @@ type proxyConnection struct {
 	// Go-side callbacks exposed to JS. js.FuncOf pins the Go closure in a
 	// global handle map and MUST be released, otherwise every connection
 	// leaks the Go memory the closure captures.
-	wsHandlerFn  js.Func
-	onMessageFn  js.Func
-	onCloseFn    js.Func
-	cleanupOnce  sync.Once
-	ctx          context.Context
-	cancel       context.CancelFunc
+	wsHandlerFn js.Func
+	onMessageFn js.Func
+	onCloseFn   js.Func
+	cleanupOnce sync.Once
+	ctx         context.Context
+	cancel      context.CancelFunc
 }
 
 // NewRDCleanPathProxy creates a new RDCleanPath proxy

management/internals/controllers/network_map/controller/repository.go

@@ -3,9 +3,9 @@ package controller
 import (
 	"context"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"

management/internals/server/boot.go

@@ -24,13 +24,13 @@ import (
 
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"

management/internals/server/modules.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -20,7 +21,6 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"

management/internals/shared/grpc/proxy.go

@@ -29,6 +29,7 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -36,7 +37,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"

management/server/http/handlers/groups/groups_handler_test.go

@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/netip"
 	"net/http/httptest"
+	"net/netip"
 	"strings"
 	"testing"
 

management/server/types/policyrule_test.go

@@ -191,4 +191,3 @@ func TestPolicyRuleEqual_EmptySlices(t *testing.T) {
 	}
 	assert.True(t, a.Equal(b))
 }
-

proxy/internal/llm/openai_test.go

@@ -27,12 +27,12 @@ func TestOpenAIDetectFromURL(t *testing.T) {
 		// catches Cloudflare's OpenAI direct path
 		// (/v1/{account}/{gateway}/openai/chat/completions) and
 		// compat path (/v1/{account}/{gateway}/compat/chat/completions).
-		"/v1/{account}/{gateway}/openai/chat/completions":  true,
-		"/v1/{account}/{gateway}/compat/chat/completions":  true,
-		"/chat/completions":                                true,
-		"/v1/messages":                                     false,
-		"/healthz":                                         false,
-		"":                                                 false,
+		"/v1/{account}/{gateway}/openai/chat/completions": true,
+		"/v1/{account}/{gateway}/compat/chat/completions": true,
+		"/chat/completions": true,
+		"/v1/messages":      false,
+		"/healthz":          false,
+		"":                  false,
 	}
 	for path, want := range cases {
 		assert.Equal(t, want, p.DetectFromURL(path), "DetectFromURL(%q)", path)

proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go

@@ -14,9 +14,9 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"
 
-	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/store"
 	nbtypes "github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"

proxy/internal/proxy/agent_network_chain_realstack_test.go

@@ -18,10 +18,10 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"
 
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"

proxy/internal/tcp/router_test.go

@@ -1964,4 +1964,3 @@ func TestRouter_Serve_BacksOffOnTransientError(t *testing.T) {
 type errSentinel string
 
 func (e errSentinel) Error() string { return string(e) }
-