[client] Add comment explaining kernel-only RemovePeer guard

[client] Gate RemovePeer call on kernel mode in UDPListener
In userspace bind mode, the WireGuard-go patch triggers SendStagedPackets automatically via IpcSet/handlePostConfig when the peer endpoint is updated, so RemovePeer is not needed. Only call RemovePeer for kernel mode where the kernel WireGuard implementation requires it to force a new handshake.
2026-06-28 18:59:57 +00:00 · 2026-06-07 19:56:08 +00:00 · 2026-06-07 19:54:35 +00:00 · 2026-06-07 17:49:08 +02:00 · 2026-06-07 17:34:43 +02:00 · 2026-06-07 12:26:09 +02:00
4 changed files with 10 additions and 9 deletions
--- a/client/internal/lazyconn/activity/listener_bind.go
+++ b/client/internal/lazyconn/activity/listener_bind.go
@@ -119,10 +119,6 @@ func (d *BindListener) ReadPackets() {
 	}

 	d.peerCfg.Log.Debugf("removing lazy endpoint for peer %s", d.peerCfg.PublicKey)
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
-	}
-
 	_ = d.lazyConn.Close()
 	d.bind.RemoveEndpoint(d.fakeIP)
 	d.done.Done()
--- a/client/internal/lazyconn/activity/listener_udp.go
+++ b/client/internal/lazyconn/activity/listener_udp.go
@@ -67,8 +67,13 @@ func (d *UDPListener) ReadPackets() {
 	}

 	d.peerCfg.Log.Debugf("removing lazy endpoint: %s", d.endpoint.String())
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
+	// In kernel mode, RemovePeer is required to force a new handshake initiation on the real endpoint.
+	// In userspace mode, the WireGuard-go patch triggers SendStagedPackets via IpcSet/handlePostConfig
+	// when UpdatePeer is called after ICE/relay negotiation, so the removal is not needed.
+	if !d.wgIface.IsUserspaceBind() {
+		if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
+			d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
+		}
 	}

 	// Ignore close error as it may return "use of closed network connection" if already closed.
--- a/go.mod
+++ b/go.mod
@@ -335,7 +335,7 @@ replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-2024

 replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949

-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f
+replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86

 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6

--- a/go.sum
+++ b/go.sum
@@ -503,8 +503,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f h1:ff2D57RBjWtyQ2wVwJOxOgXAXOe/J2lJWtSX0Bz/BRk=
-github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86 h1:RRE/wwAsukj4/06pgVcMiRzJEHi2AYtoFyVlNeapamY=
+github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
 github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
 github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=
Author	SHA1	Message	Date
Claude	2a92fd73e0	[client] Add comment explaining kernel-only RemovePeer guard	2026-06-07 19:56:08 +00:00
Claude	9eb405a019	[client] Gate RemovePeer call on kernel mode in UDPListener In userspace bind mode, the WireGuard-go patch triggers SendStagedPackets automatically via IpcSet/handlePostConfig when the peer endpoint is updated, so RemovePeer is not needed. Only call RemovePeer for kernel mode where the kernel WireGuard implementation requires it to force a new handshake.	2026-06-07 19:54:35 +00:00
Zoltán Papp	f7c72481f1	Update WireGuard dependencies	2026-06-07 17:49:08 +02:00
Zoltán Papp	acb7fc8e22	Update WireGuard dependency	2026-06-07 17:34:43 +02:00
Zoltán Papp	af3e9d1a9c	[client] Remove peer deletion on lazy activity detection Updated WireGuard dependency with a patch and removed the RemovePeer call on lazy activity detection to force a new handshake initiation to the updated endpoint. This also flushed the staged queue, dropping the first packet. Since UpdatePeer (called after ICE/relay negotiation) triggers SendStagedPackets via IpcSet/handlePostConfig, the peer removal is no longer necessary. The staged packet survives and the handshake is initiated on the real endpoint automatically. This also eliminates the transient state where the peer's endpoint and routes were absent between the lazy idle and connected states.	2026-06-07 12:26:09 +02:00