Bump golang.zx2c4.com/wireguard/windows

Bumps the wireguard group with 1 update in the / directory: golang.zx2c4.com/wireguard/windows.


Updates `golang.zx2c4.com/wireguard/windows` from 0.5.3 to 1.0.1

---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: wireguard
...

Signed-off-by: dependabot[bot] <support@github.com>

client/internal/peer/worker_relay.go

@@ -54,15 +54,19 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relaySupportedOnRemotePeer.Store(true)
 
 	// the relayManager will return with error in case if the connection has lost with relay server
-	_, _, err := w.relayManager.RelayInstanceAddress()
+	currentRelayAddress, _, err := w.relayManager.RelayInstanceAddress()
 	if err != nil {
 		w.log.Errorf("failed to handle new offer: %s", err)
 		return
 	}
 
-	preferForeign := !w.isController
-	remoteRelayServer := relayClient.RelayServer{Addr: remoteOfferAnswer.RelaySrvAddress, IP: remoteOfferAnswer.RelaySrvIP}
-	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, remoteRelayServer, w.config.Key, preferForeign)
+	srv := w.preferredRelayServer(currentRelayAddress, remoteOfferAnswer.RelaySrvAddress)
+	var serverIP netip.Addr
+	if srv == remoteOfferAnswer.RelaySrvAddress {
+		serverIP = remoteOfferAnswer.RelaySrvIP
+	}
+
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -76,13 +80,14 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relayedConn = relayedConn
 	w.relayLock.Unlock()
 
-	if err := w.relayManager.AddCloseListener(relayedConn.RemoteAddr().String(), w.onRelayClientDisconnected); err != nil {
-		w.log.Errorf("failed to add close listener: %s", err)
+	err = w.relayManager.AddCloseListener(srv, w.onRelayClientDisconnected)
+	if err != nil {
+		log.Errorf("failed to add close listener: %s", err)
 		_ = relayedConn.Close()
 		return
 	}
 
-	w.log.Debugf("peer conn opened via Relay: %s", relayedConn.RemoteAddr())
+	w.log.Debugf("peer conn opened via Relay: %s", srv)
 	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
 		relayedConn:     relayedConn,
 		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
@@ -121,6 +126,13 @@ func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	return answer.RelaySrvAddress != ""
 }
 
+func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress string) string {
+	if w.isController {
+		return myRelayAddress
+	}
+	return remoteRelayAddress
+}
+
 func (w *WorkerRelay) onRelayClientDisconnected() {
 	go w.conn.onRelayDisconnected()
 }

client/internal/routemanager/dynamic/route.go

@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }
 
 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains()
+	resolved, err := r.resolveDomains(ctx)
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }
 
-func (r *Route) resolveDomains() (domainMap, error) {
+func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(results)
+	go r.resolve(ctx, results)
 
 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains() (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *Route) resolve(results chan resolveResult) {
+func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 	var wg sync.WaitGroup
 
 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()
 
-			ips, err := r.getIPsFromResolver(domain)
+			ips, err := r.getIPsFromResolver(ctx, domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = net.LookupIP(domain.PunycodeString())
+				ips, err = lookupHostIPs(ctx, domain)
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,6 +364,20 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }
 
+// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
+func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
+	if err != nil {
+		return nil, err
+	}
+
+	ips := make([]net.IP, 0, len(addrs))
+	for _, addr := range addrs {
+		ips = append(ips, addr.IP)
+	}
+	return ips, nil
+}
+
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {

client/internal/routemanager/dynamic/route_generic.go

@@ -3,11 +3,12 @@
 package dynamic
 
 import (
+	"context"
 	"net"
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
-	return net.LookupIP(domain.PunycodeString())
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+	return lookupHostIPs(ctx, domain)
 }

client/internal/routemanager/dynamic/route_ios.go

@@ -3,6 +3,7 @@
 package dynamic
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"time"
@@ -16,7 +17,7 @@ import (
 
 const dialTimeout = 10 * time.Second
 
-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -32,7 +33,7 @@ func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)
 
-		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)

client/server/server.go

@@ -1081,7 +1081,10 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 
 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		// todo review to update the status in case any type of error
+		if errors.Is(err, ErrServiceNotUp) {
+			log.Debugf("Down called while service not up: %v", err)
+			return nil, err
+		}
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1154,7 +1157,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			return err
+			log.Errorf("failed to stop engine during cleanup: %v", err)
 		}
 	}
 

client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx

@@ -1,10 +1,13 @@
+import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
+import { Version } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useStatus } from "@/contexts/StatusContext.tsx";
 
 const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
+const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";
 
 function openUrl(url: string) {
     Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
@@ -12,7 +15,26 @@ function openUrl(url: string) {
 
 export const DaemonOutdatedOverlay = () => {
     const { t } = useTranslation();
-    const { isDaemonOutdated } = useStatus();
+    const { status, isDaemonOutdated } = useStatus();
+
+    const [guiVersion, setGuiVersion] = useState<string>("-");
+    const clientVersion = status?.daemonVersion ?? "—";
+
+    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
+    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
+
+    useEffect(() => {
+        if (!isDaemonOutdated) return;
+        let cancelled = false;
+        Version.GUI()
+            .then((v) => {
+                if (!cancelled) setGuiVersion(v);
+            })
+            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
+        return () => {
+            cancelled = true;
+        };
+    }, [isDaemonOutdated]);
 
     if (!isDaemonOutdated) return null;
 
@@ -38,10 +60,37 @@ export const DaemonOutdatedOverlay = () => {
                     <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
                 </div>
 
+                <div className={"flex flex-col items-center gap-0.5 text-center"}>
+                    <p className={"text-sm font-semibold text-nb-gray-100"}>
+                        {clientVersion === "development" ? (
+                            <span>
+                                {t("settings.about.clientName")}{" "}
+                                <span className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.client", { version: clientVersion })
+                        )}
+                    </p>
+                    <p className={"text-sm font-medium text-nb-gray-250"}>
+                        {guiVersion === "development" ? (
+                            <span>
+                                {t("settings.about.guiName")}{" "}
+                                <span className={"font-mono text-yellow-400"}>
+                                    {t("settings.about.development")}
+                                </span>
+                            </span>
+                        ) : (
+                            t("settings.about.gui", { version: guiVersion })
+                        )}
+                    </p>
+                </div>
+
                 <div className={"wails-no-draggable"}>
-                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
                         <DownloadIcon size={14} />
-                        {t("update.card.getInstaller")}
+                        {t("daemon.outdated.download")}
                     </Button>
                 </div>
             </div>

client/ui/frontend/src/contexts/ProfileContext.tsx

@@ -28,6 +28,7 @@ type ProfileContextValue = {
     loaded: boolean;
     refresh: () => Promise<void>;
     switchProfile: (id: string) => Promise<void>;
+    switchProfileNoConnect: (id: string) => Promise<void>;
     addProfile: (name: string) => Promise<string>;
     removeProfile: (id: string) => Promise<void>;
     renameProfile: (id: string, newName: string) => Promise<void>;
@@ -112,6 +113,16 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
         [username, refresh],
     );
 
+    // Manage-profiles variant: switches without connecting, so the user can
+    // still adjust the management URL before bringing the connection up.
+    const switchProfileNoConnect = useCallback(
+        async (id: string) => {
+            await ProfileSwitcher.SwitchActiveNoConnect({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
     // addProfile creates a profile by display name and returns the
     // daemon-generated ID, so the caller can immediately address it by ID.
     const addProfile = useCallback(
@@ -158,6 +169,7 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
+            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,
@@ -171,6 +183,7 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
+            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,

client/ui/frontend/src/modules/profiles/ProfilesTab.tsx

@@ -45,7 +45,7 @@ export function ProfilesTab() {
         activeProfileId,
         loaded,
         username,
-        switchProfile,
+        switchProfileNoConnect,
         addProfile,
         removeProfile,
         renameProfile,
@@ -100,7 +100,7 @@ export function ProfilesTab() {
             confirmLabel: t("profile.switch.confirm"),
         });
         if (!ok) return;
-        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfile(id));
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfileNoConnect(id));
     };
 
     const handleDeregister = async (id: string, name: string) => {
@@ -129,14 +129,13 @@ export function ProfilesTab() {
         await guarded(i18next.t("profile.error.createTitle"), async () => {
             const id = await addProfile(name);
             // SetConfig is keyed by the new profile's ID, so it writes the
-            // not-yet-active profile. Write before switching so any reconnect
-            // targets the right deployment.
+            // not-yet-active profile before the switch makes it current.
             if (!isNetbirdCloud(managementUrl)) {
                 await SettingsSvc.SetConfig(
                     new SetConfigParams({ profileName: id, username, managementUrl }),
                 );
             }
-            await switchProfile(id);
+            await switchProfileNoConnect(id);
         });
     };
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -73,6 +73,13 @@ export default function SessionExpirationDialog() {
 
         let offCancel: (() => void) | undefined;
 
+        // Return the dialog to its interactive state and dismiss the browser popup
+        const resetDialog = () => {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
+        };
+
         try {
             const start = await Session.RequestExtend({ hint: "" });
             const uri = start.verificationUriComplete || start.verificationUri;
@@ -105,25 +112,22 @@ export default function SessionExpirationDialog() {
             if (outcome.kind === "cancel") {
                 waitPromise.cancel?.();
                 waitPromise.catch(() => {});
+                resetDialog();
                 return;
             }
 
             // Another surface owns this flow; keep the dialog open to retry.
             if (outcome.result.preempted) {
+                resetDialog();
                 return;
             }
-
-            // Close before the popup so the restore can't flash this window back.
-            WindowManager.CloseSessionExpiration().catch(console.error);
+            WindowManager.CloseRenewFlow().catch(console.error);
         } catch (e) {
+            resetDialog();
             await errorDialog({
                 Title: t("sessionExpiration.extendFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            offCancel?.();
-            WindowManager.CloseBrowserLogin().catch(console.error);
-            setBusy(false);
         }
     }, [busy, t]);
 
@@ -139,12 +143,11 @@ export default function SessionExpirationDialog() {
             });
             WindowManager.CloseSessionExpiration().catch(console.error);
         } catch (e) {
+            setBusy(false);
             await errorDialog({
                 Title: t("sessionExpiration.logoutFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            setBusy(false);
         }
     }, [busy, t]);
 

client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx

@@ -22,6 +22,9 @@ type WelcomeStepTrayProps = {
 export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>) {
     const { t } = useTranslation();
     const trayScreenshot = trayScreenshotForOS();
+    // macOS has no tray — the icon sits in the menu bar, so the copy says so.
+    const titleKey = isMacOS() ? "welcome.titleMac" : "welcome.title";
+    const descriptionKey = isMacOS() ? "welcome.descriptionMac" : "welcome.description";
 
     return (
         <>
@@ -36,9 +39,9 @@ export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>)
 
             <div className={"flex w-full flex-col gap-1"}>
                 <DialogHeading id={"nb-welcome-title"} align={"left"}>
-                    {t("welcome.title")}
+                    {t(titleKey)}
                 </DialogHeading>
-                <DialogDescription align={"left"}>{t("welcome.description")}</DialogDescription>
+                <DialogDescription align={"left"}>{t(descriptionKey)}</DialogDescription>
             </div>
 
             <DialogActions>

client/ui/i18n/locales/de/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Suchen Sie NetBird in der Taskleiste"
     },
+    "welcome.titleMac": {
+        "message": "Suchen Sie NetBird in der Menüleiste"
+    },
     "welcome.description": {
         "message": "NetBird läuft in Ihrer Taskleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird läuft in Ihrer Menüleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
+    },
     "welcome.continue": {
         "message": "Weiter"
     },
@@ -1293,10 +1299,13 @@
         "message": "Dokumentation"
     },
     "daemon.outdated.title": {
-        "message": "NetBird-Dienst ist veraltet"
+        "message": "NetBird Client ist veraltet"
     },
     "daemon.outdated.description": {
-        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
+        "message": "Die neue GUI ist nicht mit Ihrem älteren Client kompatibel. Aktualisieren Sie Ihren Client, um die neue Anwendung zu verwenden."
+    },
+    "daemon.outdated.download": {
+        "message": "Neueste Version herunterladen"
     },
     "error.jwt_clock_skew": {
         "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."

client/ui/i18n/locales/en/common.json

@@ -1377,11 +1377,19 @@
     },
     "welcome.title": {
         "message": "Look for NetBird in your tray",
-        "description": "Heading on the first onboarding step, pointing the user to the tray icon. 'tray' = system tray / menu bar."
+        "description": "Heading on the first onboarding step, pointing the user to the tray icon. Shown on Windows and Linux; macOS uses welcome.titleMac."
+    },
+    "welcome.titleMac": {
+        "message": "Look for NetBird in your menu bar",
+        "description": "Heading on the first onboarding step on macOS, pointing the user to the menu bar icon. Use your language's Apple term for the macOS menu bar."
     },
     "welcome.description": {
         "message": "NetBird lives in your tray. Click the icon to connect, switch profiles, or open settings.",
-        "description": "Body of the first onboarding step explaining the tray icon."
+        "description": "Body of the first onboarding step explaining the tray icon. Shown on Windows and Linux; macOS uses welcome.descriptionMac."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird lives in your menu bar. Click the icon to connect, switch profiles, or open settings.",
+        "description": "Body of the first onboarding step on macOS explaining the menu bar icon. Use your language's Apple term for the macOS menu bar."
     },
     "welcome.continue": {
         "message": "Continue",
@@ -1724,12 +1732,16 @@
         "description": "Documentation link on the daemon-unavailable overlay."
     },
     "daemon.outdated.title": {
-        "message": "NetBird Service Is Outdated",
-        "description": "Title of the overlay shown when the NetBird background service is too old to drive this UI."
+        "message": "NetBird Client Is Outdated",
+        "description": "Title of the overlay shown when the NetBird client (daemon) is too old to drive this UI."
     },
     "daemon.outdated.description": {
-        "message": "Update the NetBird service to use this app.",
-        "description": "Body of the daemon-outdated overlay telling the user to upgrade the service."
+        "message": "The new GUI isn't compatible with the older NetBird client. Update your client to use the new application.",
+        "description": "Body of the daemon-outdated overlay explaining that the GUI is newer than the client and the client must be updated."
+    },
+    "daemon.outdated.download": {
+        "message": "Download Latest",
+        "description": "Button on the daemon-outdated overlay that opens the download page for the latest release."
     },
     "error.jwt_clock_skew": {
         "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",

client/ui/i18n/locales/es/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Busque NetBird en su bandeja del sistema"
     },
+    "welcome.titleMac": {
+        "message": "Busque NetBird en su barra de menús"
+    },
     "welcome.description": {
         "message": "NetBird reside en su bandeja del sistema. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside en su barra de menús. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
+    },
     "welcome.continue": {
         "message": "Continuar"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentación"
     },
     "daemon.outdated.title": {
-        "message": "El servicio de NetBird está desactualizado"
+        "message": "NetBird Client está desactualizado"
     },
     "daemon.outdated.description": {
-        "message": "Actualice el servicio de NetBird para usar esta aplicación."
+        "message": "La nueva GUI no es compatible con su cliente anterior. Actualice su cliente para usar la nueva aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar la última versión"
     },
     "error.jwt_clock_skew": {
         "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."

client/ui/i18n/locales/fr/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Cherchez NetBird dans votre barre d’état système"
     },
+    "welcome.titleMac": {
+        "message": "Cherchez NetBird dans votre barre des menus"
+    },
     "welcome.description": {
         "message": "NetBird se trouve dans votre barre d’état système. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird se trouve dans votre barre des menus. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
+    },
     "welcome.continue": {
         "message": "Continuer"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentation"
     },
     "daemon.outdated.title": {
-        "message": "Le service NetBird est obsolète"
+        "message": "Le Client NetBird est obsolète"
     },
     "daemon.outdated.description": {
-        "message": "Mettez à jour le service NetBird pour utiliser cette application."
+        "message": "La nouvelle GUI n'est pas compatible avec votre ancien client. Mettez à jour votre client pour utiliser la nouvelle application."
+    },
+    "daemon.outdated.download": {
+        "message": "Télécharger la dernière version"
     },
     "error.jwt_clock_skew": {
         "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."

client/ui/i18n/locales/hu/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Keresse a NetBirdöt a tálcán"
     },
+    "welcome.titleMac": {
+        "message": "Keresse a NetBirdöt a menüsorban"
+    },
     "welcome.description": {
         "message": "A NetBird a tálcán fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
     },
+    "welcome.descriptionMac": {
+        "message": "A NetBird a menüsorban fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
+    },
     "welcome.continue": {
         "message": "Folytatás"
     },
@@ -1293,10 +1299,13 @@
         "message": "Dokumentáció"
     },
     "daemon.outdated.title": {
-        "message": "A NetBird szolgáltatás elavult"
+        "message": "A NetBird Kliens elavult"
     },
     "daemon.outdated.description": {
-        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
+        "message": "Az új GUI nem kompatibilis a régebbi klienseddel. Frissítsd a klienst az új alkalmazás használatához."
+    },
+    "daemon.outdated.download": {
+        "message": "Legújabb letöltése"
     },
     "error.jwt_clock_skew": {
         "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."

client/ui/i18n/locales/it/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Cerchi NetBird nella tray"
     },
+    "welcome.titleMac": {
+        "message": "Cerchi NetBird nella barra dei menu"
+    },
     "welcome.description": {
         "message": "NetBird risiede nella tray. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird risiede nella barra dei menu. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
+    },
     "welcome.continue": {
         "message": "Continua"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentazione"
     },
     "daemon.outdated.title": {
-        "message": "Il servizio NetBird è obsoleto"
+        "message": "NetBird Client è obsoleto"
     },
     "daemon.outdated.description": {
-        "message": "Aggiorna il servizio NetBird per usare questa app."
+        "message": "La nuova GUI non è compatibile con il tuo client precedente. Aggiorna il client per usare la nuova applicazione."
+    },
+    "daemon.outdated.download": {
+        "message": "Scarica l'ultima versione"
     },
     "error.jwt_clock_skew": {
         "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."

client/ui/i18n/locales/ja/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "トレイの NetBird を確認してください"
     },
+    "welcome.titleMac": {
+        "message": "メニューバーの NetBird を確認してください"
+    },
     "welcome.description": {
         "message": "NetBird はトレイに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird はメニューバーに常駐します。アイコンをクリックして、接続、プロファイルの切り替え、設定を開くことができます。"
+    },
     "welcome.continue": {
         "message": "続ける"
     },

client/ui/i18n/locales/pt/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Procure o NetBird na sua bandeja"
     },
+    "welcome.titleMac": {
+        "message": "Procure o NetBird na sua barra de menus"
+    },
     "welcome.description": {
         "message": "O NetBird fica na sua bandeja. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
     },
+    "welcome.descriptionMac": {
+        "message": "O NetBird fica na sua barra de menus. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
+    },
     "welcome.continue": {
         "message": "Continuar"
     },
@@ -1293,10 +1299,13 @@
         "message": "Documentação"
     },
     "daemon.outdated.title": {
-        "message": "O serviço NetBird está desatualizado"
+        "message": "O NetBird Client está desatualizado"
     },
     "daemon.outdated.description": {
-        "message": "Atualize o serviço NetBird para usar este aplicativo."
+        "message": "A nova GUI não é compatível com o seu cliente mais antigo. Atualize o seu cliente para usar o novo aplicativo."
+    },
+    "daemon.outdated.download": {
+        "message": "Baixar a versão mais recente"
     },
     "error.jwt_clock_skew": {
         "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."

client/ui/i18n/locales/ru/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "Найдите NetBird в системном трее"
     },
+    "welcome.titleMac": {
+        "message": "Найдите NetBird в строке меню"
+    },
     "welcome.description": {
         "message": "NetBird находится в системном трее. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird находится в строке меню. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
+    },
     "welcome.continue": {
         "message": "Продолжить"
     },
@@ -1293,10 +1299,13 @@
         "message": "Документация"
     },
     "daemon.outdated.title": {
-        "message": "Служба NetBird устарела"
+        "message": "Клиент NetBird устарел"
     },
     "daemon.outdated.description": {
-        "message": "Обновите службу NetBird, чтобы использовать это приложение."
+        "message": "Новый GUI несовместим с вашим более старым клиентом. Обновите клиент, чтобы использовать новое приложение."
+    },
+    "daemon.outdated.download": {
+        "message": "Скачать последнюю версию"
     },
     "error.jwt_clock_skew": {
         "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."

client/ui/i18n/locales/zh-CN/common.json

@@ -1034,9 +1034,15 @@
     "welcome.title": {
         "message": "在托盘中查找 NetBird"
     },
+    "welcome.titleMac": {
+        "message": "在菜单栏中查找 NetBird"
+    },
     "welcome.description": {
         "message": "NetBird 驻留在您的托盘中。点击图标即可连接、切换配置文件或打开设置。"
     },
+    "welcome.descriptionMac": {
+        "message": "NetBird 驻留在您的菜单栏中。点击图标即可连接、切换配置文件或打开设置。"
+    },
     "welcome.continue": {
         "message": "继续"
     },
@@ -1293,10 +1299,13 @@
         "message": "文档"
     },
     "daemon.outdated.title": {
-        "message": "NetBird 服务版本过旧"
+        "message": "NetBird 客户端版本过旧"
     },
     "daemon.outdated.description": {
-        "message": "请更新 NetBird 服务以使用此应用。"
+        "message": "新版 GUI 与您较旧的客户端不兼容。请更新客户端以使用新应用。"
+    },
+    "daemon.outdated.download": {
+        "message": "下载最新版本"
     },
     "error.jwt_clock_skew": {
         "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"

client/ui/services/profileswitcher.go

@@ -12,13 +12,15 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
 
-// ProfileSwitcher holds the reconnect policy shared by the tray and React
-// frontend so both flip profiles identically. The policy keys off prevStatus
-// from DaemonFeed.Get at SwitchActive entry:
+// ProfileSwitcher holds the switch policy shared by the tray and React
+// frontend so both flip profiles identically. SwitchActive (plain selection:
+// header dropdown, tray submenu) always connects after the switch;
+// SwitchActiveNoConnect (manage-profiles screen) never does, so the user can
+// still adjust the management URL before connecting. prevStatus from
+// DaemonFeed.Get at entry only decides the teardown:
 //
-//	Connected/Connecting → Switch + Down + Up; optimistic Connecting paint.
-//	NeedsLogin/LoginFailed/SessionExpired → Switch + Down; clear stale error for re-login.
-//	Idle → Switch only.
+//	Connected/Connecting/NeedsLogin/LoginFailed/SessionExpired → Down first.
+//	Idle → no Down.
 type ProfileSwitcher struct {
 	profiles   *Profiles
 	connection *Connection
@@ -29,29 +31,40 @@ func NewProfileSwitcher(profiles *Profiles, connection *Connection, feed *Daemon
 	return &ProfileSwitcher{profiles: profiles, connection: connection, feed: feed}
 }
 
-// SwitchActive switches to the named profile applying the reconnect policy.
+// SwitchActive switches to the named profile and always connects afterwards.
 func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, true)
+}
+
+// SwitchActiveNoConnect switches to the named profile without connecting,
+// tearing down any existing connection first.
+func (s *ProfileSwitcher) SwitchActiveNoConnect(ctx context.Context, p ProfileRef) error {
+	return s.switchActive(ctx, p, false)
+}
+
+func (s *ProfileSwitcher) switchActive(ctx context.Context, p ProfileRef, connect bool) error {
 	prevStatus := ""
-	if st, err := s.feed.Get(ctx); err == nil {
-		prevStatus = st.Status
-	} else {
-		log.Warnf("profileswitcher: get status: %v", err)
+	if s.feed != nil {
+		if st, err := s.feed.Get(ctx); err == nil {
+			prevStatus = st.Status
+		} else {
+			log.Warnf("profileswitcher: get status: %v", err)
+		}
 	}
 
-	wasActive := strings.EqualFold(prevStatus, StatusConnected) ||
-		strings.EqualFold(prevStatus, StatusConnecting)
-	needsDown := wasActive ||
+	needsDown := strings.EqualFold(prevStatus, StatusConnected) ||
+		strings.EqualFold(prevStatus, StatusConnecting) ||
 		strings.EqualFold(prevStatus, StatusNeedsLogin) ||
 		strings.EqualFold(prevStatus, StatusLoginFailed) ||
 		strings.EqualFold(prevStatus, StatusSessionExpired)
 
-	log.Infof("profileswitcher: switch profile=%q prevStatus=%q wasActive=%v needsDown=%v",
-		p.ProfileName, prevStatus, wasActive, needsDown)
+	log.Infof("profileswitcher: switch profile=%q prevStatus=%q connect=%v needsDown=%v",
+		p.ProfileName, prevStatus, connect, needsDown)
 
-	// Optimistic Connecting paint only when wasActive: those prevStatuses emit
-	// stale Connected + transient Idle pushes during Down that must be
-	// suppressed until Up resumes the stream (see DaemonFeed suppression table).
-	if wasActive {
+	// Optimistic Connecting paint plus stale-push suppression during Down (see
+	// DaemonFeed suppression table); also arms the login-watch that pops
+	// browser-login when the new profile turns out to need SSO.
+	if connect && s.feed != nil {
 		s.feed.BeginProfileSwitch()
 	}
 
@@ -76,9 +89,9 @@ func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error
 		}
 	}
 
-	if wasActive {
+	if connect {
 		if err := s.connection.Up(ctx, UpParams(p)); err != nil {
-			return fmt.Errorf("reconnect %q: %w", p.ProfileName, err)
+			return fmt.Errorf("connect %q: %w", p.ProfileName, err)
 		}
 	}
 

client/ui/services/windowmanager.go

@@ -185,37 +185,38 @@ func (s *WindowManager) OpenBrowserLogin(uri string) {
 			startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
 		}
 		s.hideOtherWindowsLocked("browser-login")
-		// Prefer the main window's screen (multi-monitor); falls back to OS-default centering.
-		var screen *application.Screen
-		if s.mainWindow != nil {
-			if sc, err := s.mainWindow.GetScreen(); err == nil {
-				screen = sc
-			}
-		}
 		opts := DialogWindowOptions("browser-login", s.title("window.title.signIn"), startURL, s.linuxIcon)
 		// Not always-on-top: it would obscure the browser tab the user logs in through.
 		opts.AlwaysOnTop = false
 		opts.InitialPosition = application.WindowCentered
-		opts.Screen = screen
+		// Open on the active (where users cursor is) display, like the session-expiration dialog.
+		opts.Screen = s.getScreenBasedOnCursorPosition()
 		s.browserLogin = s.app.Window.NewWithOptions(opts)
 		bl := s.browserLogin
-		// Red-X close means cancel: emit the event so startLogin() tears down the SSO wait.
 		bl.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-			s.app.Event.Emit(EventBrowserLoginCancel)
 			s.mu.Lock()
-			s.browserLogin = nil
-			s.restoreHiddenWindowsLocked()
+			// Only a live user red-X still has this registered; programmatic closers
+			// nil s.browserLogin first and clean up themselves. Guarding here stops a
+			// stale close event from wiping a replacement popup's state.
+			userClosed := s.browserLogin == bl
+			if userClosed {
+				s.browserLogin = nil
+				s.restoreHiddenWindowsLocked()
+			}
 			s.mu.Unlock()
+			if userClosed {
+				s.app.Event.Emit(EventBrowserLoginCancel)
+			}
 		})
-		s.centerWhenReady(s.browserLogin)
+		s.centerOnCursorScreen(s.browserLogin)
 		return
 	}
 	if uri != "" {
 		s.browserLogin.SetURL("/#/dialog/browser-login?uri=" + url.QueryEscape(uri))
 	}
+	s.centerOnCursorScreen(s.browserLogin)
 	s.browserLogin.Show()
 	s.browserLogin.Focus()
-	s.centerWhenReady(s.browserLogin)
 }
 
 // BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
@@ -238,6 +239,15 @@ func (s *WindowManager) CloseBrowserLogin() {
 	s.mu.Lock()
 	w := s.browserLogin
 	s.browserLogin = nil
+	// The WindowClosing hook no-ops on a programmatic close, so restore here —
+	// but only if a popup was actually open. The frontend calls this even when no
+	// popup was ever shown (e.g. resetDialog() after an early RequestExtend failure,
+	// or connection.ts's catch path), and hiddenForLogin is shared with
+	// OpenInstallProgress, so an unconditional restore could re-show windows a
+	// still-running install-progress is hiding.
+	if w != nil {
+		s.restoreHiddenWindowsLocked()
+	}
 	s.mu.Unlock()
 	if w != nil {
 		w.Close()
@@ -279,6 +289,35 @@ func (s *WindowManager) CloseSessionExpiration() {
 	}
 }
 
+// CloseRenewFlow tears down the SSO session-renewal UI in a single call: it
+// closes the browser-login popup and the session-expiration window together.
+func (s *WindowManager) CloseRenewFlow() {
+	s.mu.Lock()
+	bl := s.browserLogin
+	se := s.sessionExpiration
+	s.browserLogin = nil
+	s.sessionExpiration = nil
+	if se != nil {
+		kept := s.hiddenForLogin[:0]
+		for _, w := range s.hiddenForLogin {
+			if w != se {
+				kept = append(kept, w)
+			}
+		}
+		s.hiddenForLogin = kept
+	}
+	s.restoreHiddenWindowsLocked()
+	s.mu.Unlock()
+
+	// Close after unlock so the re-entrant handlers can take s.mu.
+	if bl != nil {
+		bl.Close()
+	}
+	if se != nil {
+		se.Close()
+	}
+}
+
 // OpenInstallProgress shows the install-progress window and hides the rest for the duration
 // (restored on close). It owns its own result polling since the daemon restarts mid-install.
 func (s *WindowManager) OpenInstallProgress(version string) {

client/ui/tray.go

@@ -30,6 +30,8 @@ const (
 
 	statusError = "Error"
 
+	quitDownTimeout = 5 * time.Second
+
 	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
 	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
 	urlDocs           = "https://docs.netbird.io"
@@ -446,11 +448,28 @@ func (t *Tray) buildMenu() *application.Menu {
 	menu.AddSeparator()
 	menu.Add(t.loc.T("tray.menu.quit")).
 		SetAccelerator("CmdOrCtrl+Q").
-		OnClick(func(*application.Context) { t.app.Quit() })
+		OnClick(func(*application.Context) { t.handleQuit() })
 
 	return menu
 }
 
+func (t *Tray) handleQuit() {
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+		t.switchCancel = nil
+	}
+	t.profileMu.Unlock()
+	t.svc.DaemonFeed.CancelProfileSwitch()
+
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
+	}
+	t.app.Quit()
+}
+
 // handleConnect receives the clicked item from the buildMenu closure —
 // t.upItem is menuMu-guarded and must not be read here.
 func (t *Tray) handleConnect(upItem *application.MenuItem) {

go.mod

@@ -23,7 +23,7 @@ require (
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
-	golang.zx2c4.com/wireguard/windows v0.5.3
+	golang.zx2c4.com/wireguard/windows v1.0.1
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 )

go.sum

@@ -871,8 +871,8 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
-golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
-golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
+golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
+golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.276.0 h1:nVArUtfLEihtW+b0DdcqRGK1xoEm2+ltAihyztq7MKY=

proxy/Dockerfile.multistage

@@ -14,6 +14,7 @@ COPY proxy ./proxy
 COPY route ./route
 COPY shared ./shared
 COPY sharedsock ./sharedsock
+COPY trustedproxy ./trustedproxy
 COPY upload-server ./upload-server
 COPY util ./util
 COPY version ./version

shared/relay/client/fallback_opener.go

@@ -1,176 +0,0 @@
-package client
-
-import (
-	"context"
-	"errors"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	raceTotalTimeout  = 40 * time.Second
-	raceFallbackDelay = 10 * time.Second
-)
-
-type raceAttempt struct {
-	conn net.Conn
-	err  error
-}
-
-type raceOutcome struct {
-	conn net.Conn
-	err  error
-	done bool
-}
-
-type connRace struct {
-	opener            *FallbackOpener
-	peerKey           string
-	remoteRelayServer RelayServer
-	preferForeign     bool
-
-	raceCtx         context.Context
-	otherCtx        context.Context
-	cancelPreferred context.CancelFunc
-	cancelOther     context.CancelFunc
-	results         chan raceAttempt
-	fallbackTimer   *time.Timer
-
-	otherStarted bool
-	settled      int
-	lastErr      error
-}
-
-type FallbackOpener struct {
-	home         *Client
-	foreignStore *ForeignRelaysStore
-
-	fallbackDelay time.Duration
-	totalTimeout  time.Duration
-	// openFn performs a single attempt. It is overridable in tests; when nil the
-	// real home/foreign dispatch in open is used.
-	openFn func(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt
-}
-
-func NewFallbackOpener(home *Client, foreignStore *ForeignRelaysStore) *FallbackOpener {
-	return &FallbackOpener{
-		home:          home,
-		foreignStore:  foreignStore,
-		fallbackDelay: raceFallbackDelay,
-		totalTimeout:  raceTotalTimeout,
-	}
-}
-
-func (r *FallbackOpener) Run(ctx context.Context, peerKey string, remoteRelayServer RelayServer, preferForeign bool) (net.Conn, error) {
-	raceCtx, cancel := context.WithTimeout(ctx, r.totalTimeout)
-	defer cancel()
-
-	preferredCtx, cancelPreferred := context.WithCancel(raceCtx)
-	otherCtx, cancelOther := context.WithCancel(raceCtx)
-
-	race := &connRace{
-		opener:            r,
-		peerKey:           peerKey,
-		remoteRelayServer: remoteRelayServer,
-		preferForeign:     preferForeign,
-		raceCtx:           raceCtx,
-		otherCtx:          otherCtx,
-		cancelPreferred:   cancelPreferred,
-		cancelOther:       cancelOther,
-		results:           make(chan raceAttempt, 2),
-		fallbackTimer:     time.NewTimer(r.fallbackDelay),
-	}
-	defer race.fallbackTimer.Stop()
-
-	go func() {
-		race.results <- r.open(preferredCtx, peerKey, remoteRelayServer, preferForeign)
-	}()
-
-	for {
-		select {
-		case <-race.fallbackTimer.C:
-			race.startOther()
-		case res := <-race.results:
-			if o := race.handleResult(res); o.done {
-				return o.conn, o.err
-			}
-		case <-raceCtx.Done():
-			return race.onTimeout()
-		}
-	}
-}
-
-func (c *connRace) startOther() {
-	if c.otherStarted {
-		return
-	}
-	c.otherStarted = true
-	c.fallbackTimer.Stop()
-	go func() {
-		c.results <- c.opener.open(c.otherCtx, c.peerKey, c.remoteRelayServer, !c.preferForeign)
-	}()
-}
-
-func (c *connRace) handleResult(res raceAttempt) raceOutcome {
-	if (res.err == nil && res.conn != nil) || errors.Is(res.err, ErrConnAlreadyExists) {
-		c.settled++
-		c.stop()
-		return raceOutcome{conn: res.conn, err: res.err, done: true}
-	}
-
-	c.lastErr = res.err
-	c.settled++
-	if !c.otherStarted {
-		c.startOther()
-		return raceOutcome{}
-	}
-	if c.settled == 2 {
-		c.cancelPreferred()
-		c.cancelOther()
-		return raceOutcome{err: c.lastErr, done: true}
-	}
-	return raceOutcome{}
-}
-
-func (c *connRace) onTimeout() (net.Conn, error) {
-	c.stop()
-	if c.lastErr != nil {
-		return nil, c.lastErr
-	}
-	return nil, c.raceCtx.Err()
-}
-
-func (c *connRace) stop() {
-	c.cancelPreferred()
-	c.cancelOther()
-	go c.opener.drainLoser(c.results, c.settled, c.otherStarted)
-}
-
-func (r *FallbackOpener) open(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt {
-	if r.openFn != nil {
-		return r.openFn(ctx, peerKey, remoteRelayServer, foreign)
-	}
-	if foreign {
-		conn, err := r.foreignStore.OpenConn(ctx, peerKey, remoteRelayServer)
-		return raceAttempt{conn: conn, err: err}
-	}
-	conn, err := r.home.OpenConn(ctx, peerKey)
-	return raceAttempt{conn: conn, err: err}
-}
-
-func (r *FallbackOpener) drainLoser(results chan raceAttempt, settled int, otherStarted bool) {
-	started := 1
-	if otherStarted {
-		started = 2
-	}
-	for i := settled; i < started; i++ {
-		res := <-results
-		if res.conn != nil {
-			if err := res.conn.Close(); err != nil {
-				log.Debugf("failed to close losing relay connection: %v", err)
-			}
-		}
-	}
-}

shared/relay/client/fallback_opener_test.go

@@ -1,450 +0,0 @@
-package client
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The FallbackOpener race is driven by a single goroutine (Run's select loop)
-// with worker goroutines that communicate only through the buffered results
-// channel and the two cancel contexts. These tests exercise that state machine
-// in isolation via an injected openFn, so no relay server or network is needed.
-// Timing is scaled down through the fallbackDelay/totalTimeout fields.
-
-// raceFakeConn tracks whether Close was called. Only Close is exercised by the
-// race logic (drainLoser closes losers; Run returns the winner untouched).
-type raceFakeConn struct {
-	net.Conn
-	label  string
-	closed atomic.Bool
-}
-
-func (c *raceFakeConn) Close() error {
-	c.closed.Store(true)
-	return nil
-}
-
-// raceAttemptScript describes how a single scripted attempt behaves.
-type raceAttemptScript struct {
-	delay time.Duration
-	conn  *raceFakeConn // non-nil => the attempt succeeds and returns this conn
-	err   error         // returned when conn is nil
-	// ignoreCtx makes the attempt complete after delay even if its context is
-	// cancelled. It models an OpenConn that produced a real connection right as
-	// the race cancelled it - exactly the case drainLoser must clean up.
-	ignoreCtx bool
-}
-
-// fakeOpener replaces FallbackOpener.open. Scripts are keyed by the foreign
-// flag, so which script is "preferred" depends on the preferForeign argument
-// passed to Run.
-type fakeOpener struct {
-	mu      sync.Mutex
-	scripts map[bool]raceAttemptScript
-	calls   []bool // foreign flag of each open() invocation, in order
-}
-
-func (f *fakeOpener) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
-	f.mu.Lock()
-	f.calls = append(f.calls, foreign)
-	s, ok := f.scripts[foreign]
-	f.mu.Unlock()
-	if !ok {
-		return raceAttempt{err: fmt.Errorf("no script for foreign=%v", foreign)}
-	}
-
-	if s.delay > 0 {
-		timer := time.NewTimer(s.delay)
-		defer timer.Stop()
-		if s.ignoreCtx {
-			<-timer.C
-		} else {
-			select {
-			case <-timer.C:
-			case <-ctx.Done():
-				return raceAttempt{err: ctx.Err()}
-			}
-		}
-	}
-
-	if s.conn != nil {
-		return raceAttempt{conn: s.conn}
-	}
-	return raceAttempt{err: s.err}
-}
-
-func (f *fakeOpener) callCount() int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.calls)
-}
-
-func (f *fakeOpener) firstCallForeign(t *testing.T) bool {
-	t.Helper()
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	require.NotEmpty(t, f.calls, "expected at least one open attempt")
-	return f.calls[0]
-}
-
-func newTestOpener(f *fakeOpener, fallbackDelay, totalTimeout time.Duration) *FallbackOpener {
-	o := NewFallbackOpener(nil, nil)
-	o.openFn = f.open
-	o.fallbackDelay = fallbackDelay
-	o.totalTimeout = totalTimeout
-	return o
-}
-
-const (
-	// controller prefers the home relay, i.e. preferForeign == false.
-	preferHome    = false
-	preferForeign = true
-)
-
-var errAttempt = errors.New("attempt failed")
-
-// The preferred attempt wins before the fallback timer fires, so the other
-// attempt is never started.
-func TestFallbackOpener_PreferredWinsImmediately(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {conn: homeConn},                            // preferred (home): instant success
-		true:  {delay: 5 * time.Second, conn: foreignConn}, // would never finish in time
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, homeConn, conn)
-	assert.Equal(t, 1, f.callCount(), "other attempt must not start when preferred wins first")
-	assert.False(t, f.firstCallForeign(t), "home must be tried first when preferring home")
-	assert.False(t, foreignConn.closed.Load())
-}
-
-// preferForeign flips which relay is tried first.
-func TestFallbackOpener_PreferForeignRoutesForeignFirst(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		true:  {conn: foreignConn}, // preferred (foreign): instant success
-		false: {delay: 5 * time.Second, conn: &raceFakeConn{}},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferForeign)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 1, f.callCount())
-	assert.True(t, f.firstCallForeign(t), "foreign must be tried first when preferring foreign")
-}
-
-// ErrConnAlreadyExists counts as success: Run returns it and does not start the
-// other attempt.
-func TestFallbackOpener_ErrConnAlreadyExistsIsSuccess(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: ErrConnAlreadyExists},
-		true:  {delay: 5 * time.Second, conn: &raceFakeConn{}},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.ErrorIs(t, err, ErrConnAlreadyExists)
-	assert.Nil(t, conn)
-	assert.Equal(t, 1, f.callCount(), "other attempt must not start on ErrConnAlreadyExists")
-}
-
-// A preferred failure starts the other attempt immediately, without waiting for
-// the fallback timer.
-func TestFallbackOpener_PreferredFailsStartsOtherBeforeTimer(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: errAttempt}, // preferred fails instantly
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
-	}}
-	fallbackDelay := 500 * time.Millisecond
-	o := newTestOpener(f, fallbackDelay, 2*time.Second)
-
-	start := time.Now()
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-	elapsed := time.Since(start)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.Less(t, elapsed, fallbackDelay/2, "fallback must not wait for the timer after a preferred failure")
-}
-
-// When the preferred attempt is slow, the fallback timer starts the other
-// attempt and its success wins.
-func TestFallbackOpener_TimerStartsOtherWhenPreferredSlow(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second}, // preferred hangs until cancelled
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
-	}}
-	fallbackDelay := 40 * time.Millisecond
-	o := newTestOpener(f, fallbackDelay, 2*time.Second)
-
-	start := time.Now()
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-	elapsed := time.Since(start)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.GreaterOrEqual(t, elapsed, fallbackDelay, "other must not start before the fallback timer fires")
-}
-
-// Both attempts fail: Run returns the last error and tries both relays.
-func TestFallbackOpener_BothFail(t *testing.T) {
-	errOther := errors.New("other failed")
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: errAttempt},
-		true:  {err: errOther},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, errOther, "the most recent error should be surfaced")
-	assert.Equal(t, 2, f.callCount())
-}
-
-// When both attempts succeed, drainLoser must close the losing connection so it
-// is not leaked. Here the preferred attempt wins and the foreign loser - which
-// produced a real conn despite being cancelled - is closed.
-func TestFallbackOpener_DoubleSuccessClosesLoser(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 30 * time.Millisecond, conn: homeConn},                     // preferred wins
-		true:  {delay: 80 * time.Millisecond, conn: foreignConn, ignoreCtx: true}, // loser yields a conn after cancel
-	}}
-	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, homeConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.False(t, homeConn.closed.Load(), "the winning connection must not be closed")
-	require.Eventually(t, foreignConn.closed.Load, time.Second, 5*time.Millisecond,
-		"the losing connection must be closed by drainLoser")
-}
-
-// Winner selection is purely by result arrival order, not by preference: when
-// the non-preferred attempt returns first it wins even though home was
-// preferred. This is the mechanism behind the split-relay concern - two peers
-// racing independently have no shared tie-break, so under adversarial timing
-// they can settle on different relays. Documented here as current behavior.
-func TestFallbackOpener_FasterOtherWinsDespitePreference(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 60 * time.Millisecond, conn: homeConn, ignoreCtx: true}, // preferred but slower
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},                // other is faster
-	}}
-	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn, "the first successful attempt wins regardless of preference")
-	require.Eventually(t, homeConn.closed.Load, time.Second, 5*time.Millisecond,
-		"the slower preferred attempt becomes the loser and is closed")
-}
-
-// The whole race is bounded by totalTimeout. With no attempt succeeding or
-// failing, Run returns the deadline error.
-func TestFallbackOpener_TotalTimeout(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second},
-		true:  {delay: 5 * time.Second},
-	}}
-	o := newTestOpener(f, 20*time.Millisecond, 80*time.Millisecond)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// Cancelling the caller's context aborts the race promptly with the cancel
-// error, even before the fallback timer would fire.
-func TestFallbackOpener_ParentContextCanceled(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second},
-		true:  {delay: 5 * time.Second},
-	}}
-	// fallbackDelay large so the timer never fires; only the parent cancel ends the race.
-	o := newTestOpener(f, 5*time.Second, 5*time.Second)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		cancel()
-	}()
-
-	start := time.Now()
-	conn, err := o.Run(ctx, "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, context.Canceled)
-	assert.Less(t, time.Since(start), time.Second, "must return shortly after the parent context is cancelled")
-	assert.Equal(t, 1, f.callCount(), "the other attempt must not start")
-}
-
-// rendezvous models the relay-level requirement that a relayed connection is
-// established only once BOTH peers subscribe to the same relay server. arrive
-// records a peer's presence on a relay and returns a channel that closes when
-// the second peer arrives, so an attempt can only complete after a real
-// rendezvous - the same coupling the production code depends on.
-type rendezvous struct {
-	mu       sync.Mutex
-	arrivals map[string]int
-	gates    map[string]chan struct{}
-}
-
-func newRendezvous() *rendezvous {
-	return &rendezvous{arrivals: map[string]int{}, gates: map[string]chan struct{}{}}
-}
-
-func (r *rendezvous) arrive(relay string) <-chan struct{} {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	g, ok := r.gates[relay]
-	if !ok {
-		g = make(chan struct{})
-		r.gates[relay] = g
-	}
-	r.arrivals[relay]++
-	if r.arrivals[relay] == 2 {
-		close(g)
-	}
-	return g
-}
-
-// splitPeer is one peer's view of the two relays. relayFor maps the foreign
-// flag to a relay name; postDelay is how long after the rendezvous that peer's
-// OpenConn takes to return (its per-relay subscribe latency). Different values
-// per peer model the asymmetric timing that triggers finding #1.
-type splitPeer struct {
-	rv        *rendezvous
-	relayFor  map[bool]string
-	postDelay map[string]time.Duration
-}
-
-func (p *splitPeer) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
-	relay := p.relayFor[foreign]
-
-	select {
-	case <-p.rv.arrive(relay):
-	case <-ctx.Done():
-		return raceAttempt{err: ctx.Err()}
-	}
-
-	timer := time.NewTimer(p.postDelay[relay])
-	defer timer.Stop()
-	select {
-	case <-timer.C:
-	case <-ctx.Done():
-		return raceAttempt{err: ctx.Err()}
-	}
-	return raceAttempt{conn: &raceFakeConn{label: relay}}
-}
-
-// TestFallbackOpener_SplitRelaySelection reproduces finding #1: the two peers
-// run FallbackOpener.Run independently with no shared tie-break, so the winner
-// is chosen purely by local result-arrival order. Under an adversarial - but
-// self-consistent - timing profile they settle on DIFFERENT relays.
-//
-// Both peers prefer relayA (the controller's home). The split needs each peer's
-// preferred relayA to be slow enough that both start their fallback (so both
-// relays actually rendezvous), and then each peer's fast path to be a different
-// relay:
-//   - peerA: relayA slow (abandoned), relayB fast  -> peerA wins relayB
-//   - peerB: relayA fast (wins),      relayB slow  -> peerB wins relayA
-//
-// Each winner then cancels its attempt on the relay the OTHER peer actually
-// kept, leaving two half-open relayed connections that were both reported as
-// successful. When a deterministic cross-peer tie-break is added to fix this,
-// invert the assertion below to require convergence.
-func TestFallbackOpener_SplitRelaySelection(t *testing.T) {
-	const (
-		relayA = "relayA" // controller's home relay; both peers prefer it
-		relayB = "relayB" // non-controller's home relay
-	)
-	rv := newRendezvous()
-
-	peerA := &splitPeer{
-		rv:       rv,
-		relayFor: map[bool]string{false: relayA, true: relayB}, // home=relayA
-		postDelay: map[string]time.Duration{
-			relayA: 500 * time.Millisecond, // preferred but slow -> abandoned
-			relayB: 10 * time.Millisecond,  // fallback is fast -> peerA wins relayB
-		},
-	}
-	peerB := &splitPeer{
-		rv:       rv,
-		relayFor: map[bool]string{false: relayB, true: relayA}, // home=relayB
-		postDelay: map[string]time.Duration{
-			relayA: 80 * time.Millisecond,  // preferred, wins - but only after starting fallback
-			relayB: 500 * time.Millisecond, // fallback (home) is slow -> abandoned
-		},
-	}
-
-	fallbackDelay := 30 * time.Millisecond
-	newPeerOpener := func(p *splitPeer) *FallbackOpener {
-		o := NewFallbackOpener(nil, nil)
-		o.openFn = p.open
-		o.fallbackDelay = fallbackDelay
-		o.totalTimeout = 5 * time.Second
-		return o
-	}
-	oA := newPeerOpener(peerA)
-	oB := newPeerOpener(peerB)
-
-	type result struct {
-		conn net.Conn
-		err  error
-	}
-	var ra, rb result
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		ra.conn, ra.err = oA.Run(context.Background(), "peerB", RelayServer{Addr: relayB}, preferHome)
-	}()
-	go func() {
-		defer wg.Done()
-		rb.conn, rb.err = oB.Run(context.Background(), "peerA", RelayServer{Addr: relayA}, preferForeign)
-	}()
-	wg.Wait()
-
-	require.NoError(t, ra.err)
-	require.NoError(t, rb.err)
-	aRelay := ra.conn.(*raceFakeConn).label
-	bRelay := rb.conn.(*raceFakeConn).label
-	t.Logf("peerA settled on %s, peerB settled on %s", aRelay, bRelay)
-
-	assert.Equal(t, aRelay, bRelay,
-		"peers selected different relays with no cross-peer tie-break")
-	assert.Equal(t, relayB, aRelay, "peerA abandoned its slow preferred relay and won the fallback")
-	assert.Equal(t, relayA, bRelay, "peerB won its preferred relay after starting the fallback")
-}

shared/relay/client/foreign_relays_store.go

@@ -1,155 +0,0 @@
-package client
-
-import (
-	"context"
-	"net"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sync/singleflight"
-
-	relayAuth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
-)
-
-type foreignRelay struct {
-	client  *Client
-	created time.Time
-	inUse   int
-}
-
-type ForeignRelaysStore struct {
-	mu      sync.RWMutex
-	clients map[string]*foreignRelay
-
-	group singleflight.Group
-
-	ctx                  context.Context
-	tokenStore           *relayAuth.TokenStore
-	peerID               string
-	mtu                  uint16
-	transportFallback    *transportFallback
-	onDisconnect         func(string)
-	keepUnusedServerTime time.Duration
-}
-
-func NewForeignRelaysStore(ctx context.Context, tokenStore *relayAuth.TokenStore, peerID string, mtu uint16, transportFallback *transportFallback, onDisconnect func(string), keepUnusedServerTime time.Duration) *ForeignRelaysStore {
-	return &ForeignRelaysStore{
-		clients:              make(map[string]*foreignRelay),
-		ctx:                  ctx,
-		tokenStore:           tokenStore,
-		peerID:               peerID,
-		mtu:                  mtu,
-		transportFallback:    transportFallback,
-		onDisconnect:         onDisconnect,
-		keepUnusedServerTime: keepUnusedServerTime,
-	}
-}
-
-func (f *ForeignRelaysStore) OpenConn(ctx context.Context, peerKey string, remoteRelayServer RelayServer) (net.Conn, error) {
-	fr, err := f.acquire(remoteRelayServer)
-	if err != nil {
-		return nil, err
-	}
-	defer f.release(fr)
-
-	return fr.client.OpenConn(ctx, peerKey)
-}
-
-func (f *ForeignRelaysStore) acquire(remoteRelayServer RelayServer) (*foreignRelay, error) {
-	f.mu.Lock()
-	if fr, ok := f.clients[remoteRelayServer.Addr]; ok {
-		fr.inUse++
-		f.mu.Unlock()
-		return fr, nil
-	}
-	f.mu.Unlock()
-
-	v, err, _ := f.group.Do(remoteRelayServer.Addr, func() (any, error) {
-		f.mu.RLock()
-		fr, ok := f.clients[remoteRelayServer.Addr]
-		f.mu.RUnlock()
-		if ok {
-			return fr, nil
-		}
-
-		relayClient := NewClientWithServerIP(remoteRelayServer.Addr, remoteRelayServer.IP, f.tokenStore, f.peerID, f.mtu)
-		relayClient.SetTransportFallback(f.transportFallback)
-		if err := relayClient.Connect(f.ctx); err != nil {
-			return nil, err
-		}
-		relayClient.SetOnDisconnectListener(f.onDisconnect)
-
-		f.mu.Lock()
-		fr = &foreignRelay{client: relayClient, created: time.Now()}
-		f.clients[remoteRelayServer.Addr] = fr
-		f.mu.Unlock()
-		return fr, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	fr := v.(*foreignRelay)
-	f.mu.Lock()
-	if cur, ok := f.clients[remoteRelayServer.Addr]; !ok || cur != fr {
-		f.mu.Unlock()
-		return f.acquire(remoteRelayServer)
-	}
-	fr.inUse++
-	f.mu.Unlock()
-	return fr, nil
-}
-
-func (f *ForeignRelaysStore) release(fr *foreignRelay) {
-	f.mu.Lock()
-	fr.inUse--
-	f.mu.Unlock()
-}
-
-func (f *ForeignRelaysStore) evict(serverAddress string) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if _, ok := f.clients[serverAddress]; ok {
-		delete(f.clients, serverAddress)
-		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
-	}
-}
-
-func (f *ForeignRelaysStore) cleanupUnused() {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	for addr, fr := range f.clients {
-		if time.Since(fr.created) <= f.keepUnusedServerTime {
-			continue
-		}
-		if fr.inUse > 0 {
-			continue
-		}
-		if fr.client.HasConns() {
-			continue
-		}
-		fr.client.SetOnDisconnectListener(nil)
-		go func() {
-			_ = fr.client.Close()
-		}()
-		log.Debugf("clean up unused relay server connection: %s", addr)
-		delete(f.clients, addr)
-	}
-}
-
-func (f *ForeignRelaysStore) states() []RelayConnState {
-	f.mu.RLock()
-	clients := make([]*Client, 0, len(f.clients))
-	for _, fr := range f.clients {
-		clients = append(clients, fr.client)
-	}
-	f.mu.RUnlock()
-
-	states := make([]RelayConnState, 0, len(clients))
-	for _, c := range clients {
-		states = append(states, relayConnState(c))
-	}
-	return states
-}

shared/relay/client/manager.go

@@ -22,6 +22,27 @@ var (
 	ErrRelayClientNotConnected = fmt.Errorf("relay client not connected")
 )
 
+// RelayTrack hold the relay clients for the foreign relay servers.
+// With the mutex can ensure we can open new connection in case the relay connection has been established with
+// the relay server.
+type RelayTrack struct {
+	sync.RWMutex
+	relayClient *Client
+	err         error
+	created     time.Time
+	// ready is closed once the dial started by openConnVia finishes (relayClient
+	// or err is set). Callers reusing a track wait on this instead of the track
+	// lock, so the dial never runs under rt.Lock.
+	ready chan struct{}
+}
+
+func NewRelayTrack() *RelayTrack {
+	return &RelayTrack{
+		created: time.Now(),
+		ready:   make(chan struct{}),
+	}
+}
+
 type OnServerCloseListener func()
 
 // ManagerOption configures a Manager at construction time.
@@ -38,11 +59,6 @@ type RelayConnState struct {
 	Err error
 }
 
-type RelayServer struct {
-	Addr string
-	IP   netip.Addr
-}
-
 // WithMaxBackoffInterval caps the exponential backoff between reconnect
 // attempts to the home relay. A non-positive value keeps the default.
 func WithMaxBackoffInterval(d time.Duration) ManagerOption {
@@ -67,7 +83,8 @@ type Manager struct {
 	relayClientMu  sync.RWMutex
 	reconnectGuard *Guard
 
-	foreign *ForeignRelaysStore
+	relayClients      map[string]*RelayTrack
+	relayClientsMutex sync.RWMutex
 
 	onDisconnectedListeners map[string]*list.List
 	onReconnectedListenerFn func()
@@ -103,6 +120,7 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 			ConnectionTimeout: defaultConnectionTimeout,
 			TransportFallback: tf,
 		},
+		relayClients:            make(map[string]*RelayTrack),
 		onDisconnectedListeners: make(map[string]*list.List),
 		cleanupInterval:         relayCleanupInterval,
 		keepUnusedServerTime:    keepUnusedServerTime,
@@ -110,7 +128,6 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 	for _, opt := range opts {
 		opt(m)
 	}
-	m.foreign = NewForeignRelaysStore(ctx, tokenStore, peerID, mtu, tf, m.onServerDisconnected, m.keepUnusedServerTime)
 	m.serverPicker.ServerURLs.Store(serverURLs)
 	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval)
 	return m
@@ -142,26 +159,40 @@ func (m *Manager) Serve() error {
 	return err
 }
 
-func (m *Manager) OpenConn(ctx context.Context, remoteRelayServer RelayServer, peerKey string, preferForeign bool) (net.Conn, error) {
+// OpenConn opens a connection to the given peer key. If the peer is on the same relay server, the connection will be
+// established via the relay server. If the peer is on a different relay server, the manager will establish a new
+// connection to the relay server. It returns back with a net.Conn what represent the remote peer connection.
+//
+// serverIP, when valid and serverAddress is foreign, is used as a dial target if the FQDN-based dial fails.
+// Ignored for the local home-server path. TLS verification still uses the FQDN via SNI.
+func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
 	m.relayClientMu.RLock()
-	relayClient := m.relayClient
-	m.relayClientMu.RUnlock()
+	defer m.relayClientMu.RUnlock()
 
-	if relayClient == nil {
+	if m.relayClient == nil {
 		return nil, ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(relayClient, remoteRelayServer.Addr)
+	foreign, err := m.isForeignServer(serverAddress)
 	if err != nil {
 		return nil, err
 	}
 
+	var (
+		netConn net.Conn
+	)
 	if !foreign {
-		return relayClient.OpenConn(ctx, peerKey)
+		log.Debugf("open peer connection via permanent server: %s", peerKey)
+		netConn, err = m.relayClient.OpenConn(ctx, peerKey)
+	} else {
+		log.Debugf("open peer connection via foreign server: %s", serverAddress)
+		netConn, err = m.openConnVia(ctx, serverAddress, peerKey, serverIP)
+	}
+	if err != nil {
+		return nil, err
 	}
 
-	opener := NewFallbackOpener(relayClient, m.foreign)
-	return opener.Run(ctx, peerKey, remoteRelayServer, preferForeign)
+	return netConn, err
 }
 
 // Ready returns true if the home Relay client is connected to the relay server.
@@ -192,7 +223,7 @@ func (m *Manager) AddCloseListener(serverAddress string, onClosedListener OnServ
 		return ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(m.relayClient, serverAddress)
+	foreign, err := m.isForeignServer(serverAddress)
 	if err != nil {
 		return err
 	}
@@ -256,7 +287,26 @@ func (m *Manager) RelayStates() []RelayConnState {
 		states = append(states, st)
 	}
 
-	states = append(states, m.foreign.states()...)
+	// Snapshot the tracks, then query each outside the map lock: a track can be
+	// held by an in-progress Connect, and blocking on it must not stall other
+	// relay operations.
+	m.relayClientsMutex.RLock()
+	tracks := make([]*RelayTrack, 0, len(m.relayClients))
+	for _, rt := range m.relayClients {
+		tracks = append(tracks, rt)
+	}
+	m.relayClientsMutex.RUnlock()
+
+	// Only connected foreign relays carry state; a failed connect is evicted
+	// immediately (openConnVia), so there is no error state to surface.
+	for _, rt := range tracks {
+		rt.RLock()
+		rc := rt.relayClient
+		rt.RUnlock()
+		if rc != nil {
+			states = append(states, relayConnState(rc))
+		}
+	}
 
 	return states
 }
@@ -277,6 +327,76 @@ func (m *Manager) UpdateToken(token *relayAuth.Token) error {
 	return m.tokenStore.UpdateToken(token)
 }
 
+func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
+	// check if already has a connection to the desired relay server
+	m.relayClientsMutex.RLock()
+	rt, ok := m.relayClients[serverAddress]
+	m.relayClientsMutex.RUnlock()
+	if ok {
+		return m.openConnOnTrack(ctx, rt, peerKey)
+	}
+
+	// if not, establish a new connection but check it again (because changed the lock type) before starting the
+	// connection
+	m.relayClientsMutex.Lock()
+	rt, ok = m.relayClients[serverAddress]
+	if ok {
+		m.relayClientsMutex.Unlock()
+		return m.openConnOnTrack(ctx, rt, peerKey)
+	}
+
+	// Publish the track and release the map lock BEFORE dialing, so the dial does
+	// not run under rt.Lock (which would block RelayStates and the cleanup loop
+	// for the full dial). Concurrent callers find this track and wait on rt.ready.
+	rt = NewRelayTrack()
+	m.relayClients[serverAddress] = rt
+	m.relayClientsMutex.Unlock()
+
+	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
+	relayClient.SetTransportFallback(m.transportFallback)
+	err := relayClient.Connect(m.ctx)
+	if err != nil {
+		rt.Lock()
+		rt.err = err
+		rt.Unlock()
+		close(rt.ready)
+		m.relayClientsMutex.Lock()
+		delete(m.relayClients, serverAddress)
+		m.relayClientsMutex.Unlock()
+		return nil, err
+	}
+	// if connection closed then delete the relay client from the list
+	relayClient.SetOnDisconnectListener(m.onServerDisconnected)
+	rt.Lock()
+	rt.relayClient = relayClient
+	rt.Unlock()
+	close(rt.ready)
+
+	return relayClient.OpenConn(ctx, peerKey)
+}
+
+// openConnOnTrack opens a peer connection through an existing relay track,
+// waiting for the dial started by another openConnVia call to finish. It waits
+// on rt.ready rather than the track lock, so it neither holds nor contends the
+// track lock across the dial.
+func (m *Manager) openConnOnTrack(ctx context.Context, rt *RelayTrack, peerKey string) (net.Conn, error) {
+	select {
+	case <-rt.ready:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	rt.RLock()
+	defer rt.RUnlock()
+	if rt.err != nil {
+		return nil, rt.err
+	}
+	if rt.relayClient == nil {
+		return nil, ErrRelayClientNotConnected
+	}
+	return rt.relayClient.OpenConn(ctx, peerKey)
+}
+
 func (m *Manager) onServerConnected() {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()
@@ -302,12 +422,21 @@ func (m *Manager) onServerDisconnected(serverAddress string) {
 	m.relayClientMu.Unlock()
 
 	if !isHome {
-		m.foreign.evict(serverAddress)
+		m.evictForeignRelay(serverAddress)
 	}
 
 	m.notifyOnDisconnectListeners(serverAddress)
 }
 
+func (m *Manager) evictForeignRelay(serverAddress string) {
+	m.relayClientsMutex.Lock()
+	defer m.relayClientsMutex.Unlock()
+	if _, ok := m.relayClients[serverAddress]; ok {
+		delete(m.relayClients, serverAddress)
+		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
+	}
+}
+
 func (m *Manager) listenGuardEvent(ctx context.Context) {
 	for {
 		select {
@@ -330,8 +459,8 @@ func (m *Manager) storeClient(client *Client) {
 	m.relayClient.SetOnDisconnectListener(m.onServerDisconnected)
 }
 
-func (m *Manager) isForeignServer(relayClient *Client, address string) (bool, error) {
-	rAddr, err := relayClient.ServerInstanceURL()
+func (m *Manager) isForeignServer(address string) (bool, error) {
+	rAddr, err := m.relayClient.ServerInstanceURL()
 	if err != nil {
 		return false, fmt.Errorf("relay client not connected")
 	}
@@ -346,11 +475,50 @@ func (m *Manager) startCleanupLoop() {
 		case <-m.ctx.Done():
 			return
 		case <-ticker.C:
-			m.foreign.cleanupUnused()
+			m.cleanUpUnusedRelays()
 		}
 	}
 }
 
+func (m *Manager) cleanUpUnusedRelays() {
+	m.relayClientsMutex.Lock()
+	defer m.relayClientsMutex.Unlock()
+
+	for addr, rt := range m.relayClients {
+		rt.Lock()
+		// if the connection failed to the server the relay client will be nil
+		// but the instance will be kept in the relayClients until the next locking
+		if rt.err != nil {
+			rt.Unlock()
+			continue
+		}
+
+		// dial still in progress (openConnVia publishes the track before Connect
+		// completes and no longer holds rt.Lock during it), nothing to clean up.
+		if rt.relayClient == nil {
+			rt.Unlock()
+			continue
+		}
+
+		if time.Since(rt.created) <= m.keepUnusedServerTime {
+			rt.Unlock()
+			continue
+		}
+
+		if rt.relayClient.HasConns() {
+			rt.Unlock()
+			continue
+		}
+		rt.relayClient.SetOnDisconnectListener(nil)
+		go func() {
+			_ = rt.relayClient.Close()
+		}()
+		log.Debugf("clean up unused relay server connection: %s", addr)
+		delete(m.relayClients, addr)
+		rt.Unlock()
+	}
+}
+
 func (m *Manager) addListener(serverAddress string, onClosedListener OnServerCloseListener) {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()

shared/relay/client/manager_cleanup_test.go

@@ -2,14 +2,17 @@ package client
 
 import (
 	"context"
+	"net/netip"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/require"
 )
 
 // TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial drives a real, hanging foreign
-// relay dial and asserts the foreign store cleanup does not stall behind it.
+// relay dial and asserts cleanUpUnusedRelays does not stall behind it.
 func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr, accepted := stallingRelayListener(t)
+	serverAddr := stallingRelayListener(t)
 
 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -19,32 +22,39 @@ func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
 	}()
 
-	select {
-	case <-accepted:
-	case <-time.After(5 * time.Second):
-		t.Fatal("relay dial did not reach the listener")
-	}
+	// The track appears in the map once the dial is in flight.
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
 
 	cleanupDone := make(chan struct{})
 	go func() {
 		defer close(cleanupDone)
-		m.foreign.cleanupUnused()
+		m.cleanUpUnusedRelays()
 	}()
 
 	select {
 	case <-cleanupDone:
 	case <-time.After(2 * time.Second):
-		t.Fatal("cleanupUnused blocked on an in-progress relay dial")
+		t.Fatal("cleanUpUnusedRelays blocked on an in-progress relay dial while holding the relay map lock")
 	}
 
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[serverAddr]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "an in-progress relay dial must not be evicted by cleanup")
+
 	// Release the hanging dial so the goroutine can exit cleanly.
 	mCancel()
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("foreign OpenConn did not return after context cancellation")
+		t.Fatal("openConnVia did not return after context cancellation")
 	}
 }

shared/relay/client/manager_relaystates_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"net"
+	"net/netip"
 	"sync"
 	"testing"
 	"time"
@@ -12,16 +13,13 @@ import (
 
 // stallingRelayListener accepts TCP connections and holds them open without ever
 // responding, so a relay handshake dialed against it blocks until its context is
-// cancelled. accepted is signalled once per incoming connection so a caller can
-// wait until a dial has actually reached the listener. It returns the
-// "rel://host:port" URL to dial.
-func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
+// cancelled. It returns the "rel://host:port" URL to dial.
+func stallingRelayListener(t *testing.T) string {
 	t.Helper()
 
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
-	accepted := make(chan struct{}, 1)
 	var mu sync.Mutex
 	var conns []net.Conn
 	go func() {
@@ -33,10 +31,6 @@ func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
 			mu.Lock()
 			conns = append(conns, c)
 			mu.Unlock()
-			select {
-			case accepted <- struct{}{}:
-			default:
-			}
 		}
 	}()
 	t.Cleanup(func() {
@@ -48,14 +42,14 @@ func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
 		mu.Unlock()
 	})
 
-	return "rel://" + ln.Addr().String(), accepted
+	return "rel://" + ln.Addr().String()
 }
 
 // TestRelayStates_DoesNotBlockOnRealHangingDial is a regression test for
 // RelayStates() called by a "status -d command" hanging behind an in-progress
-// foreign relay dial.
+// relay dial.
 func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr, accepted := stallingRelayListener(t)
+	serverAddr := stallingRelayListener(t)
 
 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -65,14 +59,15 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
 	}()
 
-	select {
-	case <-accepted:
-	case <-time.After(5 * time.Second):
-		t.Fatal("relay dial did not reach the listener")
-	}
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
 
 	done := make(chan []RelayConnState, 1)
 	go func() {
@@ -91,6 +86,6 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("foreign OpenConn did not return after context cancellation")
+		t.Fatal("openConnVia did not return after context cancellation")
 	}
 }

shared/relay/client/manager_serverip_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"io"
+	"net/netip"
 	"testing"
 	"time"
 
@@ -84,7 +85,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 	t.Run("no server IP, dial fails", func(t *testing.T) {
 		dialCtx, dialCancel := context.WithTimeout(ctx, 5*time.Second)
 		defer dialCancel()
-		_, err := mgrAlice.OpenConn(dialCtx, RelayServer{Addr: brokenFQDN}, "bob", true)
+		_, err := mgrAlice.OpenConn(dialCtx, brokenFQDN, "bob", netip.Addr{})
 		if err == nil {
 			t.Fatalf("expected OpenConn to fail without server IP, got success")
 		}
@@ -94,7 +95,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 		// Bob waits for Alice's incoming peer connection on his side.
 		bobSideCh := make(chan error, 1)
 		go func() {
-			conn, err := mgrBob.OpenConn(ctx, RelayServer{Addr: bobRealAddr}, "alice", false)
+			conn, err := mgrBob.OpenConn(ctx, bobRealAddr, "alice", netip.Addr{})
 			if err != nil {
 				bobSideCh <- err
 				return
@@ -112,7 +113,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 			bobSideCh <- nil
 		}()
 
-		aliceConn, err := mgrAlice.OpenConn(ctx, RelayServer{Addr: brokenFQDN, IP: bobAdvertisedIP}, "bob", true)
+		aliceConn, err := mgrAlice.OpenConn(ctx, brokenFQDN, "bob", bobAdvertisedIP)
 		if err != nil {
 			t.Fatalf("alice OpenConn with server IP: %s", err)
 		}

shared/relay/client/manager_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"fmt"
+	"net/netip"
 	"testing"
 	"time"
 
@@ -105,11 +106,11 @@ func TestForeignConn(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to get relay address: %s", err)
 	}
-	connAliceToBob, err := clientAlice.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "bob", true)
+	connAliceToBob, err := clientAlice.OpenConn(ctx, bobsSrvAddr, "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
-	connBobToAlice, err := clientBob.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "alice", false)
+	connBobToAlice, err := clientBob.OpenConn(ctx, bobsSrvAddr, "alice", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -209,7 +210,7 @@ func TestForeginConnClose(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
-	conn, err := mgr.OpenConn(ctx, RelayServer{Addr: toURL(srvCfg2)[0]}, "bob", true)
+	conn, err := mgr.OpenConn(ctx, toURL(srvCfg2)[0], "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -301,7 +302,7 @@ func TestForeignAutoClose(t *testing.T) {
 	}
 
 	t.Log("open connection to another peer")
-	if _, err = mgr.OpenConn(ctx, RelayServer{Addr: foreignServerURL}, "anotherpeer", true); err == nil {
+	if _, err = mgr.OpenConn(ctx, foreignServerURL, "anotherpeer", netip.Addr{}); err == nil {
 		t.Fatalf("should have failed to open connection to another peer")
 	}
 
@@ -371,7 +372,7 @@ func TestAutoReconnect(t *testing.T) {
 	if err != nil {
 		t.Errorf("failed to get relay address: %s", err)
 	}
-	conn, err := clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
+	conn, err := clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
 	if err != nil {
 		t.Errorf("failed to bind channel: %s", err)
 	}
@@ -391,7 +392,7 @@ func TestAutoReconnect(t *testing.T) {
 	}
 
 	log.Infof("reopent the connection")
-	_, err = clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
+	_, err = clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
 	if err != nil {
 		t.Errorf("failed to open channel: %s", err)
 	}
@@ -453,7 +454,7 @@ func TestNotifierDoubleAdd(t *testing.T) {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
 
-	conn1, err := clientAlice.OpenConn(ctx, RelayServer{Addr: clientAlice.ServerURLs()[0]}, "bob", false)
+	conn1, err := clientAlice.OpenConn(ctx, clientAlice.ServerURLs()[0], "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}