[client] Reuse existing sessionExpired label for expired tray row

Drop the newly added tray.session.expired string and render the expired
tray row with the existing tray.status.sessionExpired label, which is
already translated in every locale and short enough for the tray.

client/android/client.go

@@ -247,9 +247,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/internal/auth/sessionwatch/watcher.go

@@ -24,11 +24,7 @@ import (
 )
 
 const (
-	// Skew tolerates a small clock difference between the management
-	// server and this peer before treating a deadline as "in the past".
-	// Slightly above typical NTP drift; tight enough that the UI doesn't
-	// paint a stale expiry as if it were valid.
-	Skew = 30 * time.Second
+	maxPastHorizon = 30 * 24 * time.Hour
 
 	// maxDeadlineHorizon caps how far in the future an accepted deadline
 	// can sit. A timestamp beyond this is almost certainly a protocol
@@ -57,7 +53,7 @@ var (
 	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")
 
 	// ErrDeadlineInPast is returned by Update when the supplied deadline
-	// is more than Skew in the past.
+	// is more than maxPastHorizon in the past.
 	ErrDeadlineInPast = errors.New("session deadline in the past")
 )
 
@@ -66,15 +62,14 @@ var (
 // for deadline change/clear, PublishEvent for the two warnings); tests pass
 // a fake recorder so the same surface is observable without an engine.
 //
-// The watcher is the single owner of the deadline propagated to the
-// recorder: every set, clear, sanity-check rejection and Close routes the
-// value through SetSessionExpiresAt, so the SubscribeStatus snapshot the UI
-// reads can never drift from the watcher's timer state. (SetSessionExpiresAt
-// fans out its own state-change notification, so no separate notify is
-// needed.) The recorder is server-scoped and outlives this engine-scoped
-// watcher — without the Close-time clear a teardown (Down, or the Down+Up of
-// a profile switch) would leave the next session showing the previous one's
-// stale "expires in" value.
+// While the watcher runs, it owns the deadline propagated to the recorder:
+// every set, clear and sanity-check rejection routes the value through
+// SetSessionExpiresAt, so the SubscribeStatus snapshot the UI reads can
+// never drift from the watcher's timer state. (SetSessionExpiresAt fans
+// out its own state-change notification, so no separate notify is needed.)
+// The recorder is server-scoped and outlives this engine-scoped watcher;
+// Close deliberately leaves the recorder value in place so transient engine
+// restarts don't blank it — the client run loop clears it on real teardown.
 //
 // PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
 // composes the metadata internally so the wire format (MetaSession*) is
@@ -135,10 +130,13 @@ func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 // was disabled).
 //
 // Same-value updates are no-ops. A different non-zero value cancels any
-// pending timer, resets the "already fired" guard, and arms a new one.
+// pending timer, resets the "already fired" guards, and — when the
+// deadline lies in the future — arms fresh warning timers. A deadline
+// already in the past (within maxPastHorizon) is recorded as-is with no
+// timers: the session has expired and consumers render it that way.
 //
 // Returns one of the sentinel Err* values when the deadline fails the
-// sanity checks (pre-epoch, far future, or in the past beyond Skew).
+// sanity checks (pre-epoch, far future, or past beyond maxPastHorizon).
 // In every error case the watcher first clears its state so it stays
 // consistent with what the caller will push into its other sinks (e.g.
 // applySessionDeadline forces a zero deadline into the status recorder
@@ -163,7 +161,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	case deadline.After(now.Add(maxDeadlineHorizon)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
-	case deadline.Before(now.Add(-Skew)):
+	case deadline.Before(now.Add(-maxPastHorizon)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
 	}
@@ -183,7 +181,9 @@ func (w *Watcher) Update(deadline time.Time) error {
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
 
-	w.armTimerLocked(deadline)
+	if deadline.After(now) {
+		w.armTimerLocked(deadline)
+	}
 	recorder := w.recorder
 	w.mu.Unlock()
 	if recorder != nil {
@@ -227,30 +227,25 @@ func (w *Watcher) Dismiss() {
 	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
 }
 
-// Close stops any pending timer and drops the deadline on the status
-// recorder. Update calls after Close are ignored. Clearing the recorder
-// here is what keeps a teardown (Down, or the Down+Up of a profile switch)
-// from leaving the next session showing this one's stale "expires in"
-// value — the recorder is server-scoped and outlives this engine-scoped
-// watcher, so nothing else drops the anchor on teardown.
+// Close stops any pending timer. Update calls after Close are ignored.
+// The recorder keeps its deadline: the watcher is engine-scoped and closes
+// on every engine restart (network change, sleep/wake, stream errors)
+// while the SSO deadline stays valid across those, so clearing here would
+// blank the UI's "expires in" row on every transient reconnect. The
+// client run loop clears the server-scoped recorder when it exits for
+// real (Down, profile switch, permanent login failure).
 func (w *Watcher) Close() {
 	w.mu.Lock()
+	defer w.mu.Unlock()
 	if w.closed {
-		w.mu.Unlock()
 		return
 	}
 	w.closed = true
 	w.stopTimerLocked()
-	hadDeadline := !w.current.IsZero()
 	w.current = time.Time{}
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
-	recorder := w.recorder
-	w.mu.Unlock()
-	if recorder != nil && hadDeadline {
-		recorder.SetSessionExpiresAt(time.Time{})
-	}
 }
 
 // clearLocked drops the tracked deadline and notifies the recorder so

client/internal/auth/sessionwatch/watcher_test.go

@@ -224,11 +224,13 @@ func TestNewDeadlineCancelsPriorTimer(t *testing.T) {
 
 func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
 	r := &fakeRecorder{}
-	lead := 30 * time.Millisecond
+	lead := 150 * time.Millisecond
 	w := newWatcher(lead, r)
 	defer w.Close()
 
-	first := time.Now().Add(50 * time.Millisecond)
+	// Warning fires ~20ms in; the deadline itself stays 150ms away so the
+	// replacement below lands well before it.
+	first := time.Now().Add(170 * time.Millisecond)
 	_ = w.Update(first)
 
 	// Wait for stateChange + warning of the first cycle.
@@ -306,7 +308,29 @@ func TestUpdateRejectsTooFarFuture(t *testing.T) {
 	}
 }
 
-func TestUpdateInPastClearsDeadline(t *testing.T) {
+func TestUpdateRecentPastRecordedAsExpired(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(-1 * time.Hour)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("recent-past Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be recorded, got %v want %v", w.Deadline(), d)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline = %v, want %v", got, d)
+	}
+
+	time.Sleep(80 * time.Millisecond)
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("no warning events may fire for an already-past deadline, got %+v", r.snapshot())
+	}
+}
+
+func TestUpdateAncientPastRejected(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
 	defer w.Close()
@@ -318,12 +342,12 @@ func TestUpdateInPastClearsDeadline(t *testing.T) {
 	// Drain the stateChange from the seed.
 	waitForEvents(t, r, 1)
 
-	err := w.Update(time.Now().Add(-1 * time.Hour))
+	err := w.Update(time.Now().Add(-31 * 24 * time.Hour))
 	if !errors.Is(err, ErrDeadlineInPast) {
 		t.Fatalf("want ErrDeadlineInPast, got %v", err)
 	}
 	if !w.Deadline().IsZero() {
-		t.Fatalf("in-past update must clear the deadline, got %v", w.Deadline())
+		t.Fatalf("rejected ancient-past update must clear the deadline, got %v", w.Deadline())
 	}
 	events := waitForEvents(t, r, 2)
 	if events[1].kind != stateChange {
@@ -331,21 +355,6 @@ func TestUpdateInPastClearsDeadline(t *testing.T) {
 	}
 }
 
-func TestUpdateWithinSkewAccepted(t *testing.T) {
-	r := &fakeRecorder{}
-	w := newWatcher(50*time.Millisecond, r)
-	defer w.Close()
-
-	// 5 seconds in the past is within the 30s Skew tolerance — accept it.
-	d := time.Now().Add(-5 * time.Second)
-	if err := w.Update(d); err != nil {
-		t.Fatalf("within-skew Update should succeed, got %v", err)
-	}
-	if !w.Deadline().Equal(d) {
-		t.Fatalf("expected deadline to be applied, got %v want %v", w.Deadline(), d)
-	}
-}
-
 func TestCloseSilencesUpdates(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
@@ -359,11 +368,12 @@ func TestCloseSilencesUpdates(t *testing.T) {
 	}
 }
 
-// TestCloseClearsRecorderDeadline pins the profile-switch fix: a watcher
-// holding a live deadline must zero the recorder on Close so the next
-// engine's watcher (and the UI reading the shared server-scoped recorder)
-// doesn't start out showing the previous session's stale "expires in".
-func TestCloseClearsRecorderDeadline(t *testing.T) {
+// TestCloseKeepsRecorderDeadline pins the reconnect-flap fix: the watcher
+// closes on every engine restart (network change, sleep/wake) while the
+// SSO deadline stays valid across those, so Close must leave the
+// server-scoped recorder's value in place. The client run loop clears the
+// recorder when it exits for real.
+func TestCloseKeepsRecorderDeadline(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r)
 
@@ -377,8 +387,8 @@ func TestCloseClearsRecorderDeadline(t *testing.T) {
 
 	w.Close()
 
-	if got := r.deadline(); !got.IsZero() {
-		t.Fatalf("recorder deadline after Close = %v, want zero", got)
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline after Close = %v, want %v", got, d)
 	}
 }
 

client/internal/connect.go

@@ -257,7 +257,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		log.Errorf("failed to clean up temporary installer file: %v", err)
 	}
 
-	defer c.statusRecorder.ClientStop()
+	defer func() {
+		c.statusRecorder.SetSessionExpiresAt(time.Time{})
+		c.statusRecorder.ClientStop()
+	}()
 	operation := func() error {
 		// if context cancelled we not start new backoff cycle
 		if c.ctx.Err() != nil {

client/internal/engine_session_deadline_test.go

@@ -75,4 +75,14 @@ func TestApplySessionDeadline_ThreeState(t *testing.T) {
 		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
 			"invalid timestamp must clear the deadline")
 	})
+
+	t.Run("recently expired timestamp stays visible as expired", func(t *testing.T) {
+		e := newEngine()
+		expired := time.Now().Add(-5 * time.Minute).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(expired))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(expired),
+			"recently-expired deadline must stay on the recorder so consumers render it as expired")
+	})
 }

client/internal/peer/status.go

@@ -813,19 +813,14 @@ func (d *Status) SetSessionExpiresAt(deadline time.Time) {
 }
 
 // GetSessionExpiresAt returns the most recently recorded SSO session deadline,
-// or the zero value when no deadline is tracked. A deadline that has already
-// slipped into the past reports as "none": once the session has expired it is
-// no longer a meaningful countdown, and the sessionwatch.Watcher does not
-// arm a timer at the deadline itself to clear it (only the two pre-expiry
-// warnings). Without this guard the UI would keep painting a stale
-// "expires in …" against a moment that has passed until the next login,
-// extend, or teardown rewrote the value.
+// or the zero value when no deadline is tracked. A deadline in the past is
+// returned as-is: it means the session has expired, and consumers (tray row,
+// CLI status) render it as "expired" rather than hiding it — masking it as
+// "none" would blank the UI at the exact moment it should say the session
+// ended.
 func (d *Status) GetSessionExpiresAt() time.Time {
 	d.mux.Lock()
 	defer d.mux.Unlock()
-	if !d.sessionExpiresAt.IsZero() && d.sessionExpiresAt.Before(time.Now()) {
-		return time.Time{}
-	}
 	return d.sessionExpiresAt
 }
 

client/internal/peer/worker_relay.go

@@ -54,15 +54,19 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relaySupportedOnRemotePeer.Store(true)
 
 	// the relayManager will return with error in case if the connection has lost with relay server
-	_, _, err := w.relayManager.RelayInstanceAddress()
+	currentRelayAddress, _, err := w.relayManager.RelayInstanceAddress()
 	if err != nil {
 		w.log.Errorf("failed to handle new offer: %s", err)
 		return
 	}
 
-	preferForeign := !w.isController
-	remoteRelayServer := relayClient.RelayServer{Addr: remoteOfferAnswer.RelaySrvAddress, IP: remoteOfferAnswer.RelaySrvIP}
-	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, remoteRelayServer, w.config.Key, preferForeign)
+	srv := w.preferredRelayServer(currentRelayAddress, remoteOfferAnswer.RelaySrvAddress)
+	var serverIP netip.Addr
+	if srv == remoteOfferAnswer.RelaySrvAddress {
+		serverIP = remoteOfferAnswer.RelaySrvIP
+	}
+
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -76,13 +80,14 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.relayedConn = relayedConn
 	w.relayLock.Unlock()
 
-	if err := w.relayManager.AddCloseListener(relayedConn.RemoteAddr().String(), w.onRelayClientDisconnected); err != nil {
-		w.log.Errorf("failed to add close listener: %s", err)
+	err = w.relayManager.AddCloseListener(srv, w.onRelayClientDisconnected)
+	if err != nil {
+		log.Errorf("failed to add close listener: %s", err)
 		_ = relayedConn.Close()
 		return
 	}
 
-	w.log.Debugf("peer conn opened via Relay: %s", relayedConn.RemoteAddr())
+	w.log.Debugf("peer conn opened via Relay: %s", srv)
 	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
 		relayedConn:     relayedConn,
 		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
@@ -121,6 +126,13 @@ func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	return answer.RelaySrvAddress != ""
 }
 
+func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress string) string {
+	if w.isController {
+		return myRelayAddress
+	}
+	return remoteRelayAddress
+}
+
 func (w *WorkerRelay) onRelayClientDisconnected() {
 	go w.conn.onRelayDisconnected()
 }

client/ios/NetBirdSDK/client.go

@@ -233,9 +233,6 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/ui/tray.go

@@ -315,8 +315,7 @@ func (t *Tray) relayoutMenu() {
 		if sessionDeadline.IsZero() {
 			t.sessionExpiresItem.SetHidden(true)
 		} else {
-			remaining := t.formatSessionRemaining(time.Until(sessionDeadline))
-			t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+			t.sessionExpiresItem.SetLabel(t.sessionRowLabel(sessionDeadline))
 			t.sessionExpiresItem.SetHidden(false)
 		}
 	}

client/ui/tray_session.go

@@ -87,30 +87,39 @@ func (t *Tray) refreshSessionExpiresLabel() {
 	if deadline.IsZero() {
 		return
 	}
-	remaining := t.formatSessionRemaining(time.Until(deadline))
-	item.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+	item.SetLabel(t.sessionRowLabel(deadline))
+}
+
+func (t *Tray) sessionRowLabel(deadline time.Time) string {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return t.loc.T("tray.status.sessionExpired")
+	}
+	return t.loc.T("tray.session.expiresIn", "remaining", t.formatSessionRemaining(remaining))
 }
 
 // formatSessionRemaining renders d as a localised long-form string picking the largest non-zero unit.
+// Each unit is rounded up so the label never claims less time than actually remains, matching the
+// upper-bound sense of the sub-minute "less than a minute" fragment.
 // Singular/plural keys are split per language for proper translation.
 func (t *Tray) formatSessionRemaining(d time.Duration) string {
 	switch {
 	case d < time.Minute:
 		return t.loc.T("tray.session.unit.lessThanMinute")
-	case d < time.Hour:
-		m := int(d / time.Minute)
+	case d <= 59*time.Minute:
+		m := ceilDiv(d, time.Minute)
 		if m == 1 {
 			return t.loc.T("tray.session.unit.minute")
 		}
 		return t.loc.T("tray.session.unit.minutes", "count", strconv.Itoa(m))
-	case d < 24*time.Hour:
-		h := int((d + 30*time.Minute) / time.Hour)
+	case d <= 23*time.Hour:
+		h := ceilDiv(d, time.Hour)
 		if h == 1 {
 			return t.loc.T("tray.session.unit.hour")
 		}
 		return t.loc.T("tray.session.unit.hours", "count", strconv.Itoa(h))
 	default:
-		days := int((d + 12*time.Hour) / (24 * time.Hour))
+		days := ceilDiv(d, 24*time.Hour)
 		if days == 1 {
 			return t.loc.T("tray.session.unit.day")
 		}
@@ -118,6 +127,11 @@ func (t *Tray) formatSessionRemaining(d time.Duration) string {
 	}
 }
 
+// ceilDiv divides d by unit rounding up, assuming d > 0.
+func ceilDiv(d, unit time.Duration) int {
+	return int((d + unit - time.Nanosecond) / unit)
+}
+
 // registerSessionWarningCategory wires the OS notification category and response handler for the expiry warning.
 // Errors are swallowed since the worst case is a plain notification without buttons.
 func (t *Tray) registerSessionWarningCategory() {
@@ -252,11 +266,9 @@ func (t *Tray) openSessionExpiration() {
 }
 
 // openSessionExtendFlow opens the SessionExpiration window seeded with the cached deadline's remaining time,
-// for the "Expires in …" tray row. No-ops when the deadline is unknown or elapsed.
+// for the "Expires in …" tray row. Once the deadline has elapsed the row reads "Session expired" and the
+// click routes to the login flow instead. No-op when the deadline is unknown.
 func (t *Tray) openSessionExtendFlow() {
-	if t.svc.WindowManager == nil {
-		return
-	}
 	t.sessionMu.Lock()
 	deadline := t.sessionExpiresAt
 	t.sessionMu.Unlock()
@@ -265,6 +277,14 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
+		return
+	}
+	if t.svc.WindowManager == nil {
 		return
 	}
 	t.svc.WindowManager.OpenSessionExpiration(seconds)

go.mod

@@ -113,7 +113,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.111
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -303,6 +303,7 @@ require (
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/wailsapp/wails/webview2 v1.0.27 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect

go.sum

@@ -660,8 +660,10 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111 h1:MKx1nOnhnDuEGrRBmtxLOJq1NERwailu2cI4BvzWhi4=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111/go.mod h1:wrdvmyeCsB/K3YqJDoH8E3MwcN8NXAMnEFaDTW46w60=
+github.com/wailsapp/wails/webview2 v1.0.27 h1:wjgAi/I8BBZ7kUGU8um3XF3ILEfzr96Q2Q1G4GPjMns=
+github.com/wailsapp/wails/webview2 v1.0.27/go.mod h1:zdM4jcO1IaC61RiJL5F1BzgoqBHFIdacz8gPr5exr0o=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

proxy/internal/llm/bedrock_model.go

@@ -1,38 +0,0 @@
-package llm
-
-import (
-	"regexp"
-	"strings"
-)
-
-// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
-// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
-var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
-
-// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
-// version/throughput suffix of a Bedrock model id.
-var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
-
-// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
-// prefix, and the version/throughput suffix from a Bedrock model id so it
-// matches the catalog/pricing key, e.g.
-// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
-// and the inference-profile ARN's last segment likewise. It is the single
-// source of truth shared by the request parser (which normalizes the request
-// model from the URL path) and the router (which normalizes the operator's
-// registered Bedrock model ids so both sides compare equal).
-func NormalizeBedrockModel(modelID string) string {
-	m := modelID
-	if strings.HasPrefix(m, "arn:") {
-		if i := strings.LastIndex(m, "/"); i >= 0 {
-			m = m[i+1:]
-		}
-	}
-	for _, p := range bedrockRegionPrefixes {
-		if strings.HasPrefix(m, p) {
-			m = m[len(p):]
-			break
-		}
-	}
-	return bedrockVersionSuffix.ReplaceAllString(m, "")
-}

proxy/internal/llm/bedrock_model_test.go

@@ -1,23 +0,0 @@
-package llm
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestNormalizeBedrockModel(t *testing.T) {
-	cases := map[string]string{
-		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
-		"us.anthropic.claude-haiku-4-5":                "anthropic.claude-haiku-4-5",
-		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
-		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
-		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
-		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
-		// Inference-profile ARN — model id lives in the last path segment.
-		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, NormalizeBedrockModel(in), "normalize %q", in)
-	}
-}

proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go

@@ -1,30 +0,0 @@
-package llm_router
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
-// Bedrock routing gap: the request model reaches the router already normalized
-// (the parser strips the region/inference-profile prefix and version suffix),
-// so a provider registered with the raw inference-profile id must still match.
-func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
-	route := ProviderRoute{Bedrock: true, Models: []string{"us.anthropic.claude-haiku-4-5"}}
-	assert.True(t, routeClaimsModel(route, "anthropic.claude-haiku-4-5"),
-		"raw region-prefixed Bedrock model must match the normalized request model")
-	assert.False(t, routeClaimsModel(route, "anthropic.claude-opus-4-8"),
-		"a model outside the provider's list must not match")
-
-	// A provider registered with the already-normalized id also matches.
-	normalized := ProviderRoute{Bedrock: true, Models: []string{"anthropic.claude-haiku-4-5"}}
-	assert.True(t, routeClaimsModel(normalized, "anthropic.claude-haiku-4-5"),
-		"normalized Bedrock model must match")
-
-	// Non-Bedrock routes keep exact matching (no prefix stripping).
-	openai := ProviderRoute{Models: []string{"gpt-4o"}}
-	assert.True(t, routeClaimsModel(openai, "gpt-4o"), "exact model must match")
-	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
-		"non-Bedrock routes must not strip a us. prefix")
-}

proxy/internal/middleware/builtin/llm_router/middleware.go

@@ -23,7 +23,6 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 
-	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
@@ -556,14 +555,6 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if candidate == model {
 			return true
 		}
-		// Bedrock request models reach the router already normalized (the parser
-		// strips the region / inference-profile prefix and version suffix), but
-		// the operator may register the raw inference-profile id (e.g.
-		// "us.anthropic.claude-haiku-4-5"). Normalize the candidate so both sides
-		// compare equal; otherwise a native Bedrock request denies as not-routable.
-		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
-			return true
-		}
 	}
 	return false
 }

shared/relay/client/fallback_opener.go

@@ -1,176 +0,0 @@
-package client
-
-import (
-	"context"
-	"errors"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	raceTotalTimeout  = 40 * time.Second
-	raceFallbackDelay = 10 * time.Second
-)
-
-type raceAttempt struct {
-	conn net.Conn
-	err  error
-}
-
-type raceOutcome struct {
-	conn net.Conn
-	err  error
-	done bool
-}
-
-type connRace struct {
-	opener            *FallbackOpener
-	peerKey           string
-	remoteRelayServer RelayServer
-	preferForeign     bool
-
-	raceCtx         context.Context
-	otherCtx        context.Context
-	cancelPreferred context.CancelFunc
-	cancelOther     context.CancelFunc
-	results         chan raceAttempt
-	fallbackTimer   *time.Timer
-
-	otherStarted bool
-	settled      int
-	lastErr      error
-}
-
-type FallbackOpener struct {
-	home         *Client
-	foreignStore *ForeignRelaysStore
-
-	fallbackDelay time.Duration
-	totalTimeout  time.Duration
-	// openFn performs a single attempt. It is overridable in tests; when nil the
-	// real home/foreign dispatch in open is used.
-	openFn func(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt
-}
-
-func NewFallbackOpener(home *Client, foreignStore *ForeignRelaysStore) *FallbackOpener {
-	return &FallbackOpener{
-		home:          home,
-		foreignStore:  foreignStore,
-		fallbackDelay: raceFallbackDelay,
-		totalTimeout:  raceTotalTimeout,
-	}
-}
-
-func (r *FallbackOpener) Run(ctx context.Context, peerKey string, remoteRelayServer RelayServer, preferForeign bool) (net.Conn, error) {
-	raceCtx, cancel := context.WithTimeout(ctx, r.totalTimeout)
-	defer cancel()
-
-	preferredCtx, cancelPreferred := context.WithCancel(raceCtx)
-	otherCtx, cancelOther := context.WithCancel(raceCtx)
-
-	race := &connRace{
-		opener:            r,
-		peerKey:           peerKey,
-		remoteRelayServer: remoteRelayServer,
-		preferForeign:     preferForeign,
-		raceCtx:           raceCtx,
-		otherCtx:          otherCtx,
-		cancelPreferred:   cancelPreferred,
-		cancelOther:       cancelOther,
-		results:           make(chan raceAttempt, 2),
-		fallbackTimer:     time.NewTimer(r.fallbackDelay),
-	}
-	defer race.fallbackTimer.Stop()
-
-	go func() {
-		race.results <- r.open(preferredCtx, peerKey, remoteRelayServer, preferForeign)
-	}()
-
-	for {
-		select {
-		case <-race.fallbackTimer.C:
-			race.startOther()
-		case res := <-race.results:
-			if o := race.handleResult(res); o.done {
-				return o.conn, o.err
-			}
-		case <-raceCtx.Done():
-			return race.onTimeout()
-		}
-	}
-}
-
-func (c *connRace) startOther() {
-	if c.otherStarted {
-		return
-	}
-	c.otherStarted = true
-	c.fallbackTimer.Stop()
-	go func() {
-		c.results <- c.opener.open(c.otherCtx, c.peerKey, c.remoteRelayServer, !c.preferForeign)
-	}()
-}
-
-func (c *connRace) handleResult(res raceAttempt) raceOutcome {
-	if (res.err == nil && res.conn != nil) || errors.Is(res.err, ErrConnAlreadyExists) {
-		c.settled++
-		c.stop()
-		return raceOutcome{conn: res.conn, err: res.err, done: true}
-	}
-
-	c.lastErr = res.err
-	c.settled++
-	if !c.otherStarted {
-		c.startOther()
-		return raceOutcome{}
-	}
-	if c.settled == 2 {
-		c.cancelPreferred()
-		c.cancelOther()
-		return raceOutcome{err: c.lastErr, done: true}
-	}
-	return raceOutcome{}
-}
-
-func (c *connRace) onTimeout() (net.Conn, error) {
-	c.stop()
-	if c.lastErr != nil {
-		return nil, c.lastErr
-	}
-	return nil, c.raceCtx.Err()
-}
-
-func (c *connRace) stop() {
-	c.cancelPreferred()
-	c.cancelOther()
-	go c.opener.drainLoser(c.results, c.settled, c.otherStarted)
-}
-
-func (r *FallbackOpener) open(ctx context.Context, peerKey string, remoteRelayServer RelayServer, foreign bool) raceAttempt {
-	if r.openFn != nil {
-		return r.openFn(ctx, peerKey, remoteRelayServer, foreign)
-	}
-	if foreign {
-		conn, err := r.foreignStore.OpenConn(ctx, peerKey, remoteRelayServer)
-		return raceAttempt{conn: conn, err: err}
-	}
-	conn, err := r.home.OpenConn(ctx, peerKey)
-	return raceAttempt{conn: conn, err: err}
-}
-
-func (r *FallbackOpener) drainLoser(results chan raceAttempt, settled int, otherStarted bool) {
-	started := 1
-	if otherStarted {
-		started = 2
-	}
-	for i := settled; i < started; i++ {
-		res := <-results
-		if res.conn != nil {
-			if err := res.conn.Close(); err != nil {
-				log.Debugf("failed to close losing relay connection: %v", err)
-			}
-		}
-	}
-}

shared/relay/client/fallback_opener_test.go

@@ -1,450 +0,0 @@
-package client
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The FallbackOpener race is driven by a single goroutine (Run's select loop)
-// with worker goroutines that communicate only through the buffered results
-// channel and the two cancel contexts. These tests exercise that state machine
-// in isolation via an injected openFn, so no relay server or network is needed.
-// Timing is scaled down through the fallbackDelay/totalTimeout fields.
-
-// raceFakeConn tracks whether Close was called. Only Close is exercised by the
-// race logic (drainLoser closes losers; Run returns the winner untouched).
-type raceFakeConn struct {
-	net.Conn
-	label  string
-	closed atomic.Bool
-}
-
-func (c *raceFakeConn) Close() error {
-	c.closed.Store(true)
-	return nil
-}
-
-// raceAttemptScript describes how a single scripted attempt behaves.
-type raceAttemptScript struct {
-	delay time.Duration
-	conn  *raceFakeConn // non-nil => the attempt succeeds and returns this conn
-	err   error         // returned when conn is nil
-	// ignoreCtx makes the attempt complete after delay even if its context is
-	// cancelled. It models an OpenConn that produced a real connection right as
-	// the race cancelled it - exactly the case drainLoser must clean up.
-	ignoreCtx bool
-}
-
-// fakeOpener replaces FallbackOpener.open. Scripts are keyed by the foreign
-// flag, so which script is "preferred" depends on the preferForeign argument
-// passed to Run.
-type fakeOpener struct {
-	mu      sync.Mutex
-	scripts map[bool]raceAttemptScript
-	calls   []bool // foreign flag of each open() invocation, in order
-}
-
-func (f *fakeOpener) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
-	f.mu.Lock()
-	f.calls = append(f.calls, foreign)
-	s, ok := f.scripts[foreign]
-	f.mu.Unlock()
-	if !ok {
-		return raceAttempt{err: fmt.Errorf("no script for foreign=%v", foreign)}
-	}
-
-	if s.delay > 0 {
-		timer := time.NewTimer(s.delay)
-		defer timer.Stop()
-		if s.ignoreCtx {
-			<-timer.C
-		} else {
-			select {
-			case <-timer.C:
-			case <-ctx.Done():
-				return raceAttempt{err: ctx.Err()}
-			}
-		}
-	}
-
-	if s.conn != nil {
-		return raceAttempt{conn: s.conn}
-	}
-	return raceAttempt{err: s.err}
-}
-
-func (f *fakeOpener) callCount() int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.calls)
-}
-
-func (f *fakeOpener) firstCallForeign(t *testing.T) bool {
-	t.Helper()
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	require.NotEmpty(t, f.calls, "expected at least one open attempt")
-	return f.calls[0]
-}
-
-func newTestOpener(f *fakeOpener, fallbackDelay, totalTimeout time.Duration) *FallbackOpener {
-	o := NewFallbackOpener(nil, nil)
-	o.openFn = f.open
-	o.fallbackDelay = fallbackDelay
-	o.totalTimeout = totalTimeout
-	return o
-}
-
-const (
-	// controller prefers the home relay, i.e. preferForeign == false.
-	preferHome    = false
-	preferForeign = true
-)
-
-var errAttempt = errors.New("attempt failed")
-
-// The preferred attempt wins before the fallback timer fires, so the other
-// attempt is never started.
-func TestFallbackOpener_PreferredWinsImmediately(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {conn: homeConn},                            // preferred (home): instant success
-		true:  {delay: 5 * time.Second, conn: foreignConn}, // would never finish in time
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, homeConn, conn)
-	assert.Equal(t, 1, f.callCount(), "other attempt must not start when preferred wins first")
-	assert.False(t, f.firstCallForeign(t), "home must be tried first when preferring home")
-	assert.False(t, foreignConn.closed.Load())
-}
-
-// preferForeign flips which relay is tried first.
-func TestFallbackOpener_PreferForeignRoutesForeignFirst(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		true:  {conn: foreignConn}, // preferred (foreign): instant success
-		false: {delay: 5 * time.Second, conn: &raceFakeConn{}},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferForeign)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 1, f.callCount())
-	assert.True(t, f.firstCallForeign(t), "foreign must be tried first when preferring foreign")
-}
-
-// ErrConnAlreadyExists counts as success: Run returns it and does not start the
-// other attempt.
-func TestFallbackOpener_ErrConnAlreadyExistsIsSuccess(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: ErrConnAlreadyExists},
-		true:  {delay: 5 * time.Second, conn: &raceFakeConn{}},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.ErrorIs(t, err, ErrConnAlreadyExists)
-	assert.Nil(t, conn)
-	assert.Equal(t, 1, f.callCount(), "other attempt must not start on ErrConnAlreadyExists")
-}
-
-// A preferred failure starts the other attempt immediately, without waiting for
-// the fallback timer.
-func TestFallbackOpener_PreferredFailsStartsOtherBeforeTimer(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: errAttempt}, // preferred fails instantly
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
-	}}
-	fallbackDelay := 500 * time.Millisecond
-	o := newTestOpener(f, fallbackDelay, 2*time.Second)
-
-	start := time.Now()
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-	elapsed := time.Since(start)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.Less(t, elapsed, fallbackDelay/2, "fallback must not wait for the timer after a preferred failure")
-}
-
-// When the preferred attempt is slow, the fallback timer starts the other
-// attempt and its success wins.
-func TestFallbackOpener_TimerStartsOtherWhenPreferredSlow(t *testing.T) {
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second}, // preferred hangs until cancelled
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},
-	}}
-	fallbackDelay := 40 * time.Millisecond
-	o := newTestOpener(f, fallbackDelay, 2*time.Second)
-
-	start := time.Now()
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-	elapsed := time.Since(start)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.GreaterOrEqual(t, elapsed, fallbackDelay, "other must not start before the fallback timer fires")
-}
-
-// Both attempts fail: Run returns the last error and tries both relays.
-func TestFallbackOpener_BothFail(t *testing.T) {
-	errOther := errors.New("other failed")
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {err: errAttempt},
-		true:  {err: errOther},
-	}}
-	o := newTestOpener(f, 40*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, errOther, "the most recent error should be surfaced")
-	assert.Equal(t, 2, f.callCount())
-}
-
-// When both attempts succeed, drainLoser must close the losing connection so it
-// is not leaked. Here the preferred attempt wins and the foreign loser - which
-// produced a real conn despite being cancelled - is closed.
-func TestFallbackOpener_DoubleSuccessClosesLoser(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 30 * time.Millisecond, conn: homeConn},                     // preferred wins
-		true:  {delay: 80 * time.Millisecond, conn: foreignConn, ignoreCtx: true}, // loser yields a conn after cancel
-	}}
-	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, homeConn, conn)
-	assert.Equal(t, 2, f.callCount())
-	assert.False(t, homeConn.closed.Load(), "the winning connection must not be closed")
-	require.Eventually(t, foreignConn.closed.Load, time.Second, 5*time.Millisecond,
-		"the losing connection must be closed by drainLoser")
-}
-
-// Winner selection is purely by result arrival order, not by preference: when
-// the non-preferred attempt returns first it wins even though home was
-// preferred. This is the mechanism behind the split-relay concern - two peers
-// racing independently have no shared tie-break, so under adversarial timing
-// they can settle on different relays. Documented here as current behavior.
-func TestFallbackOpener_FasterOtherWinsDespitePreference(t *testing.T) {
-	homeConn := &raceFakeConn{label: "home"}
-	foreignConn := &raceFakeConn{label: "foreign"}
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 60 * time.Millisecond, conn: homeConn, ignoreCtx: true}, // preferred but slower
-		true:  {delay: 5 * time.Millisecond, conn: foreignConn},                // other is faster
-	}}
-	o := newTestOpener(f, 15*time.Millisecond, 2*time.Second)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.NoError(t, err)
-	require.Same(t, foreignConn, conn, "the first successful attempt wins regardless of preference")
-	require.Eventually(t, homeConn.closed.Load, time.Second, 5*time.Millisecond,
-		"the slower preferred attempt becomes the loser and is closed")
-}
-
-// The whole race is bounded by totalTimeout. With no attempt succeeding or
-// failing, Run returns the deadline error.
-func TestFallbackOpener_TotalTimeout(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second},
-		true:  {delay: 5 * time.Second},
-	}}
-	o := newTestOpener(f, 20*time.Millisecond, 80*time.Millisecond)
-
-	conn, err := o.Run(context.Background(), "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// Cancelling the caller's context aborts the race promptly with the cancel
-// error, even before the fallback timer would fire.
-func TestFallbackOpener_ParentContextCanceled(t *testing.T) {
-	f := &fakeOpener{scripts: map[bool]raceAttemptScript{
-		false: {delay: 5 * time.Second},
-		true:  {delay: 5 * time.Second},
-	}}
-	// fallbackDelay large so the timer never fires; only the parent cancel ends the race.
-	o := newTestOpener(f, 5*time.Second, 5*time.Second)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		cancel()
-	}()
-
-	start := time.Now()
-	conn, err := o.Run(ctx, "peer", RelayServer{Addr: "srv"}, preferHome)
-
-	require.Error(t, err)
-	assert.Nil(t, conn)
-	assert.ErrorIs(t, err, context.Canceled)
-	assert.Less(t, time.Since(start), time.Second, "must return shortly after the parent context is cancelled")
-	assert.Equal(t, 1, f.callCount(), "the other attempt must not start")
-}
-
-// rendezvous models the relay-level requirement that a relayed connection is
-// established only once BOTH peers subscribe to the same relay server. arrive
-// records a peer's presence on a relay and returns a channel that closes when
-// the second peer arrives, so an attempt can only complete after a real
-// rendezvous - the same coupling the production code depends on.
-type rendezvous struct {
-	mu       sync.Mutex
-	arrivals map[string]int
-	gates    map[string]chan struct{}
-}
-
-func newRendezvous() *rendezvous {
-	return &rendezvous{arrivals: map[string]int{}, gates: map[string]chan struct{}{}}
-}
-
-func (r *rendezvous) arrive(relay string) <-chan struct{} {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	g, ok := r.gates[relay]
-	if !ok {
-		g = make(chan struct{})
-		r.gates[relay] = g
-	}
-	r.arrivals[relay]++
-	if r.arrivals[relay] == 2 {
-		close(g)
-	}
-	return g
-}
-
-// splitPeer is one peer's view of the two relays. relayFor maps the foreign
-// flag to a relay name; postDelay is how long after the rendezvous that peer's
-// OpenConn takes to return (its per-relay subscribe latency). Different values
-// per peer model the asymmetric timing that triggers finding #1.
-type splitPeer struct {
-	rv        *rendezvous
-	relayFor  map[bool]string
-	postDelay map[string]time.Duration
-}
-
-func (p *splitPeer) open(ctx context.Context, _ string, _ RelayServer, foreign bool) raceAttempt {
-	relay := p.relayFor[foreign]
-
-	select {
-	case <-p.rv.arrive(relay):
-	case <-ctx.Done():
-		return raceAttempt{err: ctx.Err()}
-	}
-
-	timer := time.NewTimer(p.postDelay[relay])
-	defer timer.Stop()
-	select {
-	case <-timer.C:
-	case <-ctx.Done():
-		return raceAttempt{err: ctx.Err()}
-	}
-	return raceAttempt{conn: &raceFakeConn{label: relay}}
-}
-
-// TestFallbackOpener_SplitRelaySelection reproduces finding #1: the two peers
-// run FallbackOpener.Run independently with no shared tie-break, so the winner
-// is chosen purely by local result-arrival order. Under an adversarial - but
-// self-consistent - timing profile they settle on DIFFERENT relays.
-//
-// Both peers prefer relayA (the controller's home). The split needs each peer's
-// preferred relayA to be slow enough that both start their fallback (so both
-// relays actually rendezvous), and then each peer's fast path to be a different
-// relay:
-//   - peerA: relayA slow (abandoned), relayB fast  -> peerA wins relayB
-//   - peerB: relayA fast (wins),      relayB slow  -> peerB wins relayA
-//
-// Each winner then cancels its attempt on the relay the OTHER peer actually
-// kept, leaving two half-open relayed connections that were both reported as
-// successful. When a deterministic cross-peer tie-break is added to fix this,
-// invert the assertion below to require convergence.
-func TestFallbackOpener_SplitRelaySelection(t *testing.T) {
-	const (
-		relayA = "relayA" // controller's home relay; both peers prefer it
-		relayB = "relayB" // non-controller's home relay
-	)
-	rv := newRendezvous()
-
-	peerA := &splitPeer{
-		rv:       rv,
-		relayFor: map[bool]string{false: relayA, true: relayB}, // home=relayA
-		postDelay: map[string]time.Duration{
-			relayA: 500 * time.Millisecond, // preferred but slow -> abandoned
-			relayB: 10 * time.Millisecond,  // fallback is fast -> peerA wins relayB
-		},
-	}
-	peerB := &splitPeer{
-		rv:       rv,
-		relayFor: map[bool]string{false: relayB, true: relayA}, // home=relayB
-		postDelay: map[string]time.Duration{
-			relayA: 80 * time.Millisecond,  // preferred, wins - but only after starting fallback
-			relayB: 500 * time.Millisecond, // fallback (home) is slow -> abandoned
-		},
-	}
-
-	fallbackDelay := 30 * time.Millisecond
-	newPeerOpener := func(p *splitPeer) *FallbackOpener {
-		o := NewFallbackOpener(nil, nil)
-		o.openFn = p.open
-		o.fallbackDelay = fallbackDelay
-		o.totalTimeout = 5 * time.Second
-		return o
-	}
-	oA := newPeerOpener(peerA)
-	oB := newPeerOpener(peerB)
-
-	type result struct {
-		conn net.Conn
-		err  error
-	}
-	var ra, rb result
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		ra.conn, ra.err = oA.Run(context.Background(), "peerB", RelayServer{Addr: relayB}, preferHome)
-	}()
-	go func() {
-		defer wg.Done()
-		rb.conn, rb.err = oB.Run(context.Background(), "peerA", RelayServer{Addr: relayA}, preferForeign)
-	}()
-	wg.Wait()
-
-	require.NoError(t, ra.err)
-	require.NoError(t, rb.err)
-	aRelay := ra.conn.(*raceFakeConn).label
-	bRelay := rb.conn.(*raceFakeConn).label
-	t.Logf("peerA settled on %s, peerB settled on %s", aRelay, bRelay)
-
-	assert.Equal(t, aRelay, bRelay,
-		"peers selected different relays with no cross-peer tie-break")
-	assert.Equal(t, relayB, aRelay, "peerA abandoned its slow preferred relay and won the fallback")
-	assert.Equal(t, relayA, bRelay, "peerB won its preferred relay after starting the fallback")
-}

shared/relay/client/foreign_relays_store.go

@@ -1,155 +0,0 @@
-package client
-
-import (
-	"context"
-	"net"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sync/singleflight"
-
-	relayAuth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
-)
-
-type foreignRelay struct {
-	client  *Client
-	created time.Time
-	inUse   int
-}
-
-type ForeignRelaysStore struct {
-	mu      sync.RWMutex
-	clients map[string]*foreignRelay
-
-	group singleflight.Group
-
-	ctx                  context.Context
-	tokenStore           *relayAuth.TokenStore
-	peerID               string
-	mtu                  uint16
-	transportFallback    *transportFallback
-	onDisconnect         func(string)
-	keepUnusedServerTime time.Duration
-}
-
-func NewForeignRelaysStore(ctx context.Context, tokenStore *relayAuth.TokenStore, peerID string, mtu uint16, transportFallback *transportFallback, onDisconnect func(string), keepUnusedServerTime time.Duration) *ForeignRelaysStore {
-	return &ForeignRelaysStore{
-		clients:              make(map[string]*foreignRelay),
-		ctx:                  ctx,
-		tokenStore:           tokenStore,
-		peerID:               peerID,
-		mtu:                  mtu,
-		transportFallback:    transportFallback,
-		onDisconnect:         onDisconnect,
-		keepUnusedServerTime: keepUnusedServerTime,
-	}
-}
-
-func (f *ForeignRelaysStore) OpenConn(ctx context.Context, peerKey string, remoteRelayServer RelayServer) (net.Conn, error) {
-	fr, err := f.acquire(remoteRelayServer)
-	if err != nil {
-		return nil, err
-	}
-	defer f.release(fr)
-
-	return fr.client.OpenConn(ctx, peerKey)
-}
-
-func (f *ForeignRelaysStore) acquire(remoteRelayServer RelayServer) (*foreignRelay, error) {
-	f.mu.Lock()
-	if fr, ok := f.clients[remoteRelayServer.Addr]; ok {
-		fr.inUse++
-		f.mu.Unlock()
-		return fr, nil
-	}
-	f.mu.Unlock()
-
-	v, err, _ := f.group.Do(remoteRelayServer.Addr, func() (any, error) {
-		f.mu.RLock()
-		fr, ok := f.clients[remoteRelayServer.Addr]
-		f.mu.RUnlock()
-		if ok {
-			return fr, nil
-		}
-
-		relayClient := NewClientWithServerIP(remoteRelayServer.Addr, remoteRelayServer.IP, f.tokenStore, f.peerID, f.mtu)
-		relayClient.SetTransportFallback(f.transportFallback)
-		if err := relayClient.Connect(f.ctx); err != nil {
-			return nil, err
-		}
-		relayClient.SetOnDisconnectListener(f.onDisconnect)
-
-		f.mu.Lock()
-		fr = &foreignRelay{client: relayClient, created: time.Now()}
-		f.clients[remoteRelayServer.Addr] = fr
-		f.mu.Unlock()
-		return fr, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	fr := v.(*foreignRelay)
-	f.mu.Lock()
-	if cur, ok := f.clients[remoteRelayServer.Addr]; !ok || cur != fr {
-		f.mu.Unlock()
-		return f.acquire(remoteRelayServer)
-	}
-	fr.inUse++
-	f.mu.Unlock()
-	return fr, nil
-}
-
-func (f *ForeignRelaysStore) release(fr *foreignRelay) {
-	f.mu.Lock()
-	fr.inUse--
-	f.mu.Unlock()
-}
-
-func (f *ForeignRelaysStore) evict(serverAddress string) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if _, ok := f.clients[serverAddress]; ok {
-		delete(f.clients, serverAddress)
-		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
-	}
-}
-
-func (f *ForeignRelaysStore) cleanupUnused() {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	for addr, fr := range f.clients {
-		if time.Since(fr.created) <= f.keepUnusedServerTime {
-			continue
-		}
-		if fr.inUse > 0 {
-			continue
-		}
-		if fr.client.HasConns() {
-			continue
-		}
-		fr.client.SetOnDisconnectListener(nil)
-		go func() {
-			_ = fr.client.Close()
-		}()
-		log.Debugf("clean up unused relay server connection: %s", addr)
-		delete(f.clients, addr)
-	}
-}
-
-func (f *ForeignRelaysStore) states() []RelayConnState {
-	f.mu.RLock()
-	clients := make([]*Client, 0, len(f.clients))
-	for _, fr := range f.clients {
-		clients = append(clients, fr.client)
-	}
-	f.mu.RUnlock()
-
-	states := make([]RelayConnState, 0, len(clients))
-	for _, c := range clients {
-		states = append(states, relayConnState(c))
-	}
-	return states
-}

shared/relay/client/manager.go

@@ -22,6 +22,27 @@ var (
 	ErrRelayClientNotConnected = fmt.Errorf("relay client not connected")
 )
 
+// RelayTrack hold the relay clients for the foreign relay servers.
+// With the mutex can ensure we can open new connection in case the relay connection has been established with
+// the relay server.
+type RelayTrack struct {
+	sync.RWMutex
+	relayClient *Client
+	err         error
+	created     time.Time
+	// ready is closed once the dial started by openConnVia finishes (relayClient
+	// or err is set). Callers reusing a track wait on this instead of the track
+	// lock, so the dial never runs under rt.Lock.
+	ready chan struct{}
+}
+
+func NewRelayTrack() *RelayTrack {
+	return &RelayTrack{
+		created: time.Now(),
+		ready:   make(chan struct{}),
+	}
+}
+
 type OnServerCloseListener func()
 
 // ManagerOption configures a Manager at construction time.
@@ -38,11 +59,6 @@ type RelayConnState struct {
 	Err error
 }
 
-type RelayServer struct {
-	Addr string
-	IP   netip.Addr
-}
-
 // WithMaxBackoffInterval caps the exponential backoff between reconnect
 // attempts to the home relay. A non-positive value keeps the default.
 func WithMaxBackoffInterval(d time.Duration) ManagerOption {
@@ -67,7 +83,8 @@ type Manager struct {
 	relayClientMu  sync.RWMutex
 	reconnectGuard *Guard
 
-	foreign *ForeignRelaysStore
+	relayClients      map[string]*RelayTrack
+	relayClientsMutex sync.RWMutex
 
 	onDisconnectedListeners map[string]*list.List
 	onReconnectedListenerFn func()
@@ -103,6 +120,7 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 			ConnectionTimeout: defaultConnectionTimeout,
 			TransportFallback: tf,
 		},
+		relayClients:            make(map[string]*RelayTrack),
 		onDisconnectedListeners: make(map[string]*list.List),
 		cleanupInterval:         relayCleanupInterval,
 		keepUnusedServerTime:    keepUnusedServerTime,
@@ -110,7 +128,6 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 	for _, opt := range opts {
 		opt(m)
 	}
-	m.foreign = NewForeignRelaysStore(ctx, tokenStore, peerID, mtu, tf, m.onServerDisconnected, m.keepUnusedServerTime)
 	m.serverPicker.ServerURLs.Store(serverURLs)
 	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval)
 	return m
@@ -142,26 +159,40 @@ func (m *Manager) Serve() error {
 	return err
 }
 
-func (m *Manager) OpenConn(ctx context.Context, remoteRelayServer RelayServer, peerKey string, preferForeign bool) (net.Conn, error) {
+// OpenConn opens a connection to the given peer key. If the peer is on the same relay server, the connection will be
+// established via the relay server. If the peer is on a different relay server, the manager will establish a new
+// connection to the relay server. It returns back with a net.Conn what represent the remote peer connection.
+//
+// serverIP, when valid and serverAddress is foreign, is used as a dial target if the FQDN-based dial fails.
+// Ignored for the local home-server path. TLS verification still uses the FQDN via SNI.
+func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
 	m.relayClientMu.RLock()
-	relayClient := m.relayClient
-	m.relayClientMu.RUnlock()
+	defer m.relayClientMu.RUnlock()
 
-	if relayClient == nil {
+	if m.relayClient == nil {
 		return nil, ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(relayClient, remoteRelayServer.Addr)
+	foreign, err := m.isForeignServer(serverAddress)
 	if err != nil {
 		return nil, err
 	}
 
+	var (
+		netConn net.Conn
+	)
 	if !foreign {
-		return relayClient.OpenConn(ctx, peerKey)
+		log.Debugf("open peer connection via permanent server: %s", peerKey)
+		netConn, err = m.relayClient.OpenConn(ctx, peerKey)
+	} else {
+		log.Debugf("open peer connection via foreign server: %s", serverAddress)
+		netConn, err = m.openConnVia(ctx, serverAddress, peerKey, serverIP)
+	}
+	if err != nil {
+		return nil, err
 	}
 
-	opener := NewFallbackOpener(relayClient, m.foreign)
-	return opener.Run(ctx, peerKey, remoteRelayServer, preferForeign)
+	return netConn, err
 }
 
 // Ready returns true if the home Relay client is connected to the relay server.
@@ -192,7 +223,7 @@ func (m *Manager) AddCloseListener(serverAddress string, onClosedListener OnServ
 		return ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(m.relayClient, serverAddress)
+	foreign, err := m.isForeignServer(serverAddress)
 	if err != nil {
 		return err
 	}
@@ -256,7 +287,26 @@ func (m *Manager) RelayStates() []RelayConnState {
 		states = append(states, st)
 	}
 
-	states = append(states, m.foreign.states()...)
+	// Snapshot the tracks, then query each outside the map lock: a track can be
+	// held by an in-progress Connect, and blocking on it must not stall other
+	// relay operations.
+	m.relayClientsMutex.RLock()
+	tracks := make([]*RelayTrack, 0, len(m.relayClients))
+	for _, rt := range m.relayClients {
+		tracks = append(tracks, rt)
+	}
+	m.relayClientsMutex.RUnlock()
+
+	// Only connected foreign relays carry state; a failed connect is evicted
+	// immediately (openConnVia), so there is no error state to surface.
+	for _, rt := range tracks {
+		rt.RLock()
+		rc := rt.relayClient
+		rt.RUnlock()
+		if rc != nil {
+			states = append(states, relayConnState(rc))
+		}
+	}
 
 	return states
 }
@@ -277,6 +327,76 @@ func (m *Manager) UpdateToken(token *relayAuth.Token) error {
 	return m.tokenStore.UpdateToken(token)
 }
 
+func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (net.Conn, error) {
+	// check if already has a connection to the desired relay server
+	m.relayClientsMutex.RLock()
+	rt, ok := m.relayClients[serverAddress]
+	m.relayClientsMutex.RUnlock()
+	if ok {
+		return m.openConnOnTrack(ctx, rt, peerKey)
+	}
+
+	// if not, establish a new connection but check it again (because changed the lock type) before starting the
+	// connection
+	m.relayClientsMutex.Lock()
+	rt, ok = m.relayClients[serverAddress]
+	if ok {
+		m.relayClientsMutex.Unlock()
+		return m.openConnOnTrack(ctx, rt, peerKey)
+	}
+
+	// Publish the track and release the map lock BEFORE dialing, so the dial does
+	// not run under rt.Lock (which would block RelayStates and the cleanup loop
+	// for the full dial). Concurrent callers find this track and wait on rt.ready.
+	rt = NewRelayTrack()
+	m.relayClients[serverAddress] = rt
+	m.relayClientsMutex.Unlock()
+
+	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
+	relayClient.SetTransportFallback(m.transportFallback)
+	err := relayClient.Connect(m.ctx)
+	if err != nil {
+		rt.Lock()
+		rt.err = err
+		rt.Unlock()
+		close(rt.ready)
+		m.relayClientsMutex.Lock()
+		delete(m.relayClients, serverAddress)
+		m.relayClientsMutex.Unlock()
+		return nil, err
+	}
+	// if connection closed then delete the relay client from the list
+	relayClient.SetOnDisconnectListener(m.onServerDisconnected)
+	rt.Lock()
+	rt.relayClient = relayClient
+	rt.Unlock()
+	close(rt.ready)
+
+	return relayClient.OpenConn(ctx, peerKey)
+}
+
+// openConnOnTrack opens a peer connection through an existing relay track,
+// waiting for the dial started by another openConnVia call to finish. It waits
+// on rt.ready rather than the track lock, so it neither holds nor contends the
+// track lock across the dial.
+func (m *Manager) openConnOnTrack(ctx context.Context, rt *RelayTrack, peerKey string) (net.Conn, error) {
+	select {
+	case <-rt.ready:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	rt.RLock()
+	defer rt.RUnlock()
+	if rt.err != nil {
+		return nil, rt.err
+	}
+	if rt.relayClient == nil {
+		return nil, ErrRelayClientNotConnected
+	}
+	return rt.relayClient.OpenConn(ctx, peerKey)
+}
+
 func (m *Manager) onServerConnected() {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()
@@ -302,12 +422,21 @@ func (m *Manager) onServerDisconnected(serverAddress string) {
 	m.relayClientMu.Unlock()
 
 	if !isHome {
-		m.foreign.evict(serverAddress)
+		m.evictForeignRelay(serverAddress)
 	}
 
 	m.notifyOnDisconnectListeners(serverAddress)
 }
 
+func (m *Manager) evictForeignRelay(serverAddress string) {
+	m.relayClientsMutex.Lock()
+	defer m.relayClientsMutex.Unlock()
+	if _, ok := m.relayClients[serverAddress]; ok {
+		delete(m.relayClients, serverAddress)
+		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
+	}
+}
+
 func (m *Manager) listenGuardEvent(ctx context.Context) {
 	for {
 		select {
@@ -330,8 +459,8 @@ func (m *Manager) storeClient(client *Client) {
 	m.relayClient.SetOnDisconnectListener(m.onServerDisconnected)
 }
 
-func (m *Manager) isForeignServer(relayClient *Client, address string) (bool, error) {
-	rAddr, err := relayClient.ServerInstanceURL()
+func (m *Manager) isForeignServer(address string) (bool, error) {
+	rAddr, err := m.relayClient.ServerInstanceURL()
 	if err != nil {
 		return false, fmt.Errorf("relay client not connected")
 	}
@@ -346,11 +475,50 @@ func (m *Manager) startCleanupLoop() {
 		case <-m.ctx.Done():
 			return
 		case <-ticker.C:
-			m.foreign.cleanupUnused()
+			m.cleanUpUnusedRelays()
 		}
 	}
 }
 
+func (m *Manager) cleanUpUnusedRelays() {
+	m.relayClientsMutex.Lock()
+	defer m.relayClientsMutex.Unlock()
+
+	for addr, rt := range m.relayClients {
+		rt.Lock()
+		// if the connection failed to the server the relay client will be nil
+		// but the instance will be kept in the relayClients until the next locking
+		if rt.err != nil {
+			rt.Unlock()
+			continue
+		}
+
+		// dial still in progress (openConnVia publishes the track before Connect
+		// completes and no longer holds rt.Lock during it), nothing to clean up.
+		if rt.relayClient == nil {
+			rt.Unlock()
+			continue
+		}
+
+		if time.Since(rt.created) <= m.keepUnusedServerTime {
+			rt.Unlock()
+			continue
+		}
+
+		if rt.relayClient.HasConns() {
+			rt.Unlock()
+			continue
+		}
+		rt.relayClient.SetOnDisconnectListener(nil)
+		go func() {
+			_ = rt.relayClient.Close()
+		}()
+		log.Debugf("clean up unused relay server connection: %s", addr)
+		delete(m.relayClients, addr)
+		rt.Unlock()
+	}
+}
+
 func (m *Manager) addListener(serverAddress string, onClosedListener OnServerCloseListener) {
 	m.listenerLock.Lock()
 	defer m.listenerLock.Unlock()

shared/relay/client/manager_cleanup_test.go

@@ -2,14 +2,17 @@ package client
 
 import (
 	"context"
+	"net/netip"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/require"
 )
 
 // TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial drives a real, hanging foreign
-// relay dial and asserts the foreign store cleanup does not stall behind it.
+// relay dial and asserts cleanUpUnusedRelays does not stall behind it.
 func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr, accepted := stallingRelayListener(t)
+	serverAddr := stallingRelayListener(t)
 
 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -19,32 +22,39 @@ func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
 	}()
 
-	select {
-	case <-accepted:
-	case <-time.After(5 * time.Second):
-		t.Fatal("relay dial did not reach the listener")
-	}
+	// The track appears in the map once the dial is in flight.
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
 
 	cleanupDone := make(chan struct{})
 	go func() {
 		defer close(cleanupDone)
-		m.foreign.cleanupUnused()
+		m.cleanUpUnusedRelays()
 	}()
 
 	select {
 	case <-cleanupDone:
 	case <-time.After(2 * time.Second):
-		t.Fatal("cleanupUnused blocked on an in-progress relay dial")
+		t.Fatal("cleanUpUnusedRelays blocked on an in-progress relay dial while holding the relay map lock")
 	}
 
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[serverAddr]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "an in-progress relay dial must not be evicted by cleanup")
+
 	// Release the hanging dial so the goroutine can exit cleanly.
 	mCancel()
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("foreign OpenConn did not return after context cancellation")
+		t.Fatal("openConnVia did not return after context cancellation")
 	}
 }

shared/relay/client/manager_relaystates_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"net"
+	"net/netip"
 	"sync"
 	"testing"
 	"time"
@@ -12,16 +13,13 @@ import (
 
 // stallingRelayListener accepts TCP connections and holds them open without ever
 // responding, so a relay handshake dialed against it blocks until its context is
-// cancelled. accepted is signalled once per incoming connection so a caller can
-// wait until a dial has actually reached the listener. It returns the
-// "rel://host:port" URL to dial.
-func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
+// cancelled. It returns the "rel://host:port" URL to dial.
+func stallingRelayListener(t *testing.T) string {
 	t.Helper()
 
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
-	accepted := make(chan struct{}, 1)
 	var mu sync.Mutex
 	var conns []net.Conn
 	go func() {
@@ -33,10 +31,6 @@ func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
 			mu.Lock()
 			conns = append(conns, c)
 			mu.Unlock()
-			select {
-			case accepted <- struct{}{}:
-			default:
-			}
 		}
 	}()
 	t.Cleanup(func() {
@@ -48,14 +42,14 @@ func stallingRelayListener(t *testing.T) (string, <-chan struct{}) {
 		mu.Unlock()
 	})
 
-	return "rel://" + ln.Addr().String(), accepted
+	return "rel://" + ln.Addr().String()
 }
 
 // TestRelayStates_DoesNotBlockOnRealHangingDial is a regression test for
 // RelayStates() called by a "status -d command" hanging behind an in-progress
-// foreign relay dial.
+// relay dial.
 func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr, accepted := stallingRelayListener(t)
+	serverAddr := stallingRelayListener(t)
 
 	mCtx, mCancel := context.WithCancel(context.Background())
 	t.Cleanup(mCancel)
@@ -65,14 +59,15 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	dialDone := make(chan struct{})
 	go func() {
 		defer close(dialDone)
-		_, _ = m.foreign.OpenConn(mCtx, "peerKey", RelayServer{Addr: serverAddr})
+		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
 	}()
 
-	select {
-	case <-accepted:
-	case <-time.After(5 * time.Second):
-		t.Fatal("relay dial did not reach the listener")
-	}
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[serverAddr]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
 
 	done := make(chan []RelayConnState, 1)
 	go func() {
@@ -91,6 +86,6 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	select {
 	case <-dialDone:
 	case <-time.After(5 * time.Second):
-		t.Fatal("foreign OpenConn did not return after context cancellation")
+		t.Fatal("openConnVia did not return after context cancellation")
 	}
 }

shared/relay/client/manager_serverip_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"io"
+	"net/netip"
 	"testing"
 	"time"
 
@@ -84,7 +85,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 	t.Run("no server IP, dial fails", func(t *testing.T) {
 		dialCtx, dialCancel := context.WithTimeout(ctx, 5*time.Second)
 		defer dialCancel()
-		_, err := mgrAlice.OpenConn(dialCtx, RelayServer{Addr: brokenFQDN}, "bob", true)
+		_, err := mgrAlice.OpenConn(dialCtx, brokenFQDN, "bob", netip.Addr{})
 		if err == nil {
 			t.Fatalf("expected OpenConn to fail without server IP, got success")
 		}
@@ -94,7 +95,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 		// Bob waits for Alice's incoming peer connection on his side.
 		bobSideCh := make(chan error, 1)
 		go func() {
-			conn, err := mgrBob.OpenConn(ctx, RelayServer{Addr: bobRealAddr}, "alice", false)
+			conn, err := mgrBob.OpenConn(ctx, bobRealAddr, "alice", netip.Addr{})
 			if err != nil {
 				bobSideCh <- err
 				return
@@ -112,7 +113,7 @@ func TestManager_ForeignRelayServerIP(t *testing.T) {
 			bobSideCh <- nil
 		}()
 
-		aliceConn, err := mgrAlice.OpenConn(ctx, RelayServer{Addr: brokenFQDN, IP: bobAdvertisedIP}, "bob", true)
+		aliceConn, err := mgrAlice.OpenConn(ctx, brokenFQDN, "bob", bobAdvertisedIP)
 		if err != nil {
 			t.Fatalf("alice OpenConn with server IP: %s", err)
 		}

shared/relay/client/manager_test.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"fmt"
+	"net/netip"
 	"testing"
 	"time"
 
@@ -105,11 +106,11 @@ func TestForeignConn(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to get relay address: %s", err)
 	}
-	connAliceToBob, err := clientAlice.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "bob", true)
+	connAliceToBob, err := clientAlice.OpenConn(ctx, bobsSrvAddr, "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
-	connBobToAlice, err := clientBob.OpenConn(ctx, RelayServer{Addr: bobsSrvAddr}, "alice", false)
+	connBobToAlice, err := clientBob.OpenConn(ctx, bobsSrvAddr, "alice", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -209,7 +210,7 @@ func TestForeginConnClose(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
-	conn, err := mgr.OpenConn(ctx, RelayServer{Addr: toURL(srvCfg2)[0]}, "bob", true)
+	conn, err := mgr.OpenConn(ctx, toURL(srvCfg2)[0], "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}
@@ -301,7 +302,7 @@ func TestForeignAutoClose(t *testing.T) {
 	}
 
 	t.Log("open connection to another peer")
-	if _, err = mgr.OpenConn(ctx, RelayServer{Addr: foreignServerURL}, "anotherpeer", true); err == nil {
+	if _, err = mgr.OpenConn(ctx, foreignServerURL, "anotherpeer", netip.Addr{}); err == nil {
 		t.Fatalf("should have failed to open connection to another peer")
 	}
 
@@ -371,7 +372,7 @@ func TestAutoReconnect(t *testing.T) {
 	if err != nil {
 		t.Errorf("failed to get relay address: %s", err)
 	}
-	conn, err := clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
+	conn, err := clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
 	if err != nil {
 		t.Errorf("failed to bind channel: %s", err)
 	}
@@ -391,7 +392,7 @@ func TestAutoReconnect(t *testing.T) {
 	}
 
 	log.Infof("reopent the connection")
-	_, err = clientAlice.OpenConn(ctx, RelayServer{Addr: ra}, "bob", false)
+	_, err = clientAlice.OpenConn(ctx, ra, "bob", netip.Addr{})
 	if err != nil {
 		t.Errorf("failed to open channel: %s", err)
 	}
@@ -453,7 +454,7 @@ func TestNotifierDoubleAdd(t *testing.T) {
 		t.Fatalf("failed to serve manager: %s", err)
 	}
 
-	conn1, err := clientAlice.OpenConn(ctx, RelayServer{Addr: clientAlice.ServerURLs()[0]}, "bob", false)
+	conn1, err := clientAlice.OpenConn(ctx, clientAlice.ServerURLs()[0], "bob", netip.Addr{})
 	if err != nil {
 		t.Fatalf("failed to bind channel: %s", err)
 	}