WIP

client/internal/engine.go

@@ -522,7 +522,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}

client/internal/peer/conn.go

@@ -30,11 +30,6 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
-// wgTimeoutEscalationThreshold is the number of consecutive WireGuard
-// handshake timeouts after which the rosenpass state for the peer is
-// considered desynced and gets reset.
-const wgTimeoutEscalationThreshold = 3
-
 // MetricsRecorder is an interface for recording peer connection metrics
 type MetricsRecorder interface {
 	RecordConnectionStages(
@@ -123,9 +118,6 @@ type Conn struct {
 	wgWatcher       *WGWatcher
 	wgWatcherWg     sync.WaitGroup
 	wgWatcherCancel context.CancelFunc
-	// wgTimeouts counts consecutive WireGuard handshake timeouts without a
-	// successful handshake in between. Guarded by mu.
-	wgTimeouts int
 
 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
@@ -691,29 +683,6 @@ func (conn *Conn) onWGDisconnected() {
 	default:
 		conn.Log.Debugf("No active connection to close on WG timeout")
 	}
-
-	conn.escalateWGTimeoutLocked()
-}
-
-// escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
-// handshake timeouts. With rosenpass enabled, persistent timeouts mean the
-// preshared keys have desynced; the renewal exchange runs over the dead
-// tunnel and cannot resync them. Reporting the peer disconnected drops its
-// rosenpass state, so the next connection configuration programs the
-// rendezvous key and the tunnel can bootstrap again. Callers must hold mu.
-func (conn *Conn) escalateWGTimeoutLocked() {
-	if conn.config.RosenpassConfig.PubKey == nil {
-		return
-	}
-
-	conn.wgTimeouts++
-	if conn.wgTimeouts < wgTimeoutEscalationThreshold || conn.onDisconnected == nil {
-		return
-	}
-	conn.wgTimeouts = 0
-
-	conn.Log.Warnf("%d consecutive WireGuard handshake timeouts, resetting rosenpass state for peer", wgTimeoutEscalationThreshold)
-	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
@@ -843,7 +812,7 @@ func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
+		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
 	}()
 }
 
@@ -923,15 +892,6 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 	conn.recordConnectionMetrics()
 }
 
-// onWGCheckSuccess is called for every watcher check that observed a fresh
-// handshake, including handshakes of connections that were already up when
-// the watcher started.
-func (conn *Conn) onWGCheckSuccess() {
-	conn.mu.Lock()
-	conn.wgTimeouts = 0
-	conn.mu.Unlock()
-}
-
 // recordConnectionMetrics records connection stage timestamps as metrics
 func (conn *Conn) recordConnectionMetrics() {
 	if conn.metricsRecorder == nil {

client/internal/peer/conn_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -305,84 +304,3 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
-
-func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
-	cfg := ConnConfig{
-		Key:      "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		LocalKey: "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		WgConfig: WgConfig{RemoteKey: "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU="},
-	}
-	if rosenpassEnabled {
-		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
-	}
-
-	conn := &Conn{
-		ctx:           context.Background(),
-		config:        cfg,
-		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &MetricsStages{},
-	}
-	conn.SetOnDisconnected(func(remotePeer string) {
-		*disconnected = append(*disconnected, remotePeer)
-	})
-	return conn
-}
-
-// TestConn_onWGDisconnected_EscalatesToRosenpassReset: repeated handshake
-// timeouts with rosenpass enabled mean the preshared keys have desynced. The
-// renewal exchange runs over the dead tunnel and cannot resync them, so after
-// wgTimeoutEscalationThreshold consecutive timeouts the conn must report the
-// peer disconnected, dropping its rosenpass state so the next configuration
-// programs the rendezvous key.
-func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
-
-	conn.onWGDisconnected()
-	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
-		"reaching the threshold must report the peer disconnected once")
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
-
-	conn.onWGDisconnected()
-	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
-}
-
-// TestConn_onWGDisconnected_CheckSuccessResetsEscalation: a successful
-// handshake between timeouts means the tunnel recovered; the counter must
-// start over.
-func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	conn.onWGCheckSuccess()
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
-}
-
-// TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
-// there is no per-peer key state to reset; repeated timeouts must not report
-// disconnects.
-func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(false, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
-}

client/internal/peer/wg_watcher.go

@@ -71,11 +71,9 @@ func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
 // PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
-// for context lifecycle management. onHandshakeSuccessFn is called only for the first
-// handshake observed by this run, onCheckSuccessFn for every check that observed a fresh
-// handshake, including the first.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
+// for context lifecycle management.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
 
 	w.muEnabled.Lock()
 	w.enabled = false
@@ -92,7 +90,7 @@ func (w *WGWatcher) Reset() {
 }
 
 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func(), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), enabledTime time.Time, initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")
 
 	timer := time.NewTimer(wgHandshakeOvertime)
@@ -119,10 +117,6 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				}
 			}
 
-			if onCheckSuccessFn != nil && ctx.Err() == nil {
-				onCheckSuccessFn()
-			}
-
 			lastHandshake = *handshake
 
 			resetTime := time.Until(handshake.Add(checkPeriod))

client/internal/peer/wg_watcher_test.go

@@ -24,72 +24,6 @@ func (m *MocWgIface) disconnect() {
 	m.stop = true
 }
 
-type mockHandshakeStats struct {
-	mu        sync.Mutex
-	handshake time.Time
-}
-
-func (m *mockHandshakeStats) GetStats() (map[string]configurer.WGStats, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return map[string]configurer.WGStats{"": {LastHandshake: m.handshake}}, nil
-}
-
-func (m *mockHandshakeStats) advance() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.handshake = time.Now()
-}
-
-// TestWGWatcher_CheckSuccessCallback: onCheckSuccessFn must fire for a fresh
-// handshake even when the watcher started with an existing handshake baseline,
-// the case where onHandshakeSuccessFn stays silent.
-func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
-	// checkPeriod bounds how stale a handshake may be before the watcher treats it
-	// as a suspended-machine timeout. The first check fires after wgHandshakeOvertime,
-	// so keep checkPeriod well above any scheduling jitter to avoid a false timeout
-	// converting the expected success into a disconnect on a loaded runner.
-	checkPeriod = 1 * time.Minute
-	wgHandshakeOvertime = 1 * time.Second
-
-	mlog := log.WithField("peer", "tet")
-	// Use an old baseline so advance() yields a strictly newer handshake even on
-	// platforms with coarse clock resolution (Windows), where two time.Now() calls
-	// microseconds apart can return the same instant and read as a timed-out handshake.
-	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	require.True(t, watcher.PrepareInitialHandshake())
-
-	firstHandshake := make(chan struct{}, 1)
-	checkSuccess := make(chan struct{}, 1)
-	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-		firstHandshake <- struct{}{}
-	}, func() {
-		select {
-		case checkSuccess <- struct{}{}:
-		default:
-		}
-	})
-
-	stats.advance()
-
-	select {
-	case <-checkSuccess:
-	case <-time.After(10 * time.Second):
-		t.Errorf("timeout waiting for check success callback")
-	}
-
-	select {
-	case <-firstHandshake:
-		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
-	default:
-	}
-}
-
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	checkPeriod = 5 * time.Second
 	wgHandshakeOvertime = 1 * time.Second
@@ -110,7 +44,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 		onDisconnected <- struct{}{}
 	}, func(when time.Time) {
 		mlog.Infof("onHandshakeSuccess: %v", when)
-	}, nil)
+	})
 
 	// wait for initial reading
 	time.Sleep(2 * time.Second)
@@ -139,7 +73,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {}, nil)
+		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {})
 	}()
 	cancel()
 
@@ -155,7 +89,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}
-	}, func(when time.Time) {}, nil)
+	}, func(when time.Time) {})
 
 	time.Sleep(2 * time.Second)
 	mocWgIface.disconnect()

client/internal/rosenpass/manager.go

@@ -39,7 +39,6 @@ type rpServer interface {
 
 type Manager struct {
 	ifaceName    string
-	localWgKey   wgtypes.Key
 	spk          []byte
 	ssk          []byte
 	rpKeyHash    string
@@ -52,9 +51,8 @@ type Manager struct {
 	wgIface      PresharedKeySetter
 }
 
-// NewManager creates a new Rosenpass manager. localWgKey is the local
-// WireGuard public key, used to derive the per-peer rendezvous key.
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
+// NewManager creates a new Rosenpass manager
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error) {
 	public, secret, err := rp.GenerateKeyPair()
 	if err != nil {
 		return nil, err
@@ -64,7 +62,6 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 	log.Tracef("generated new rosenpass key pair with public key %s", rpKeyHash)
 	return &Manager{
 		ifaceName:    wgIfaceName,
-		localWgKey:   localWgKey,
 		rpKeyHash:    rpKeyHash,
 		spk:          public,
 		ssk:          secret,
@@ -76,7 +73,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
+		rpWgHandler: NewNetbirdHandler(),
 		lock:        sync.Mutex{},
 	}, nil
 }
@@ -164,7 +161,7 @@ func (m *Manager) generateConfig() (rp.Config, error) {
 	cfg.Peers = []rp.PeerConfig{}
 
 	m.lock.Lock()
-	m.rpWgHandler = NewNetbirdHandler(m.preSharedKey, m.localWgKey)
+	m.rpWgHandler = NewNetbirdHandler()
 	if m.wgIface != nil {
 		m.rpWgHandler.SetInterface(m.wgIface)
 	}

client/internal/rosenpass/manager_test.go

@@ -85,7 +85,7 @@ func newTestManager(spkFirstByte byte, mock *mockServer) *Manager {
 		ssk:         make([]byte, 32),
 		rpKeyHash:   "test-hash",
 		rpPeerIDs:   make(map[string]*rp.PeerID),
-		rpWgHandler: NewNetbirdHandler(nil, wgtypes.Key{0x01}),
+		rpWgHandler: NewNetbirdHandler(),
 		server:      mock,
 	}
 }
@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
+	m, err := NewManager(&psk, "wt0")
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }
@@ -329,10 +329,10 @@ func TestIsPresharedKeyInitialized_AddedButNotHandshaken_ReturnsFalse(t *testing
 	require.False(t, m.IsPresharedKeyInitialized(wgKey))
 }
 
-// --- NetbirdHandler.applyKey ----------------------------------------------
+// --- NetbirdHandler.outputKey ----------------------------------------------
 
-func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -348,8 +348,8 @@ func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
 	require.Equal(t, wgKey.String(), iface.calls[0].peerKey)
 }
 
-func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -364,8 +364,8 @@ func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
 	require.True(t, iface.calls[1].updateOnly, "subsequent rotations must use updateOnly=true")
 }
 
-func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	// no SetInterface — iface remains nil
 	pid := rp.PeerID{0x03}
 	h.AddPeer(pid, "wt0", rp.Key(wgtypes.Key{}))
@@ -374,8 +374,8 @@ func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
 	h.HandshakeCompleted(pid, rp.Key{})
 }
 
-func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -384,7 +384,7 @@ func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
 }
 
 func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -398,7 +398,7 @@ func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
 }
 
 func TestHandler_SetInterfaceAfterAddPeer_StillReceivesKey(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	pid := rp.PeerID{0x05}
 	wgKey := wgtypes.Key{0xEE}
 	h.AddPeer(pid, "wt0", rp.Key(wgKey))

client/internal/rosenpass/netbird_handler.go

@@ -18,34 +18,19 @@ type PresharedKeySetter interface {
 type wireGuardPeer struct {
 	Interface string
 	PublicKey rp.Key
-	// initialized is true once a completed exchange has set a
-	// Rosenpass-managed PSK for this peer.
-	initialized bool
-	// chainKey is the key output by the last completed exchange, advanced by
-	// one ratchet step on expiry. Nil until the first exchange completes and
-	// after the peer has fallen back to the rendezvous key.
-	chainKey *wgtypes.Key
-	// expiries counts failed renewals since the last completed exchange.
-	expiries int
 }
 
 type NetbirdHandler struct {
-	mu    sync.Mutex
-	iface PresharedKeySetter
-	// preSharedKey is the account-level preshared key, used as the rendezvous
-	// key when set. Nil means the deterministic seed key is used instead.
-	preSharedKey *[32]byte
-	// localWgKey is the local WireGuard public key, one of the two inputs to
-	// the deterministic seed key.
-	localWgKey wgtypes.Key
-	peers      map[rp.PeerID]*wireGuardPeer
+	mu               sync.Mutex
+	iface            PresharedKeySetter
+	peers            map[rp.PeerID]wireGuardPeer
+	initializedPeers map[rp.PeerID]bool
 }
 
-func NewNetbirdHandler(preSharedKey *[32]byte, localWgKey wgtypes.Key) *NetbirdHandler {
+func NewNetbirdHandler() *NetbirdHandler {
 	return &NetbirdHandler{
-		preSharedKey: preSharedKey,
-		localWgKey:   localWgKey,
-		peers:        map[rp.PeerID]*wireGuardPeer{},
+		peers:            map[rp.PeerID]wireGuardPeer{},
+		initializedPeers: map[rp.PeerID]bool{},
 	}
 }
 
@@ -57,16 +42,10 @@ func (h *NetbirdHandler) SetInterface(iface PresharedKeySetter) {
 	h.iface = iface
 }
 
-// AddPeer registers a peer with the handler. Re-adding a known peer (every
-// reconnection does) keeps its key recovery state.
 func (h *NetbirdHandler) AddPeer(pid rp.PeerID, intf string, pk rp.Key) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if existing, ok := h.peers[pid]; ok && existing.PublicKey == pk {
-		existing.Interface = intf
-		return
-	}
-	h.peers[pid] = &wireGuardPeer{
+	h.peers[pid] = wireGuardPeer{
 		Interface: intf,
 		PublicKey: pk,
 	}
@@ -76,6 +55,7 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	delete(h.peers, pid)
+	delete(h.initializedPeers, pid)
 }
 
 // IsPeerInitialized returns true if Rosenpass has completed a handshake
@@ -83,120 +63,50 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 func (h *NetbirdHandler) IsPeerInitialized(pid rp.PeerID) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	peer, ok := h.peers[pid]
-	return ok && peer.initialized
+	return h.initializedPeers[pid]
 }
 
-// HandshakeCompleted programs the freshly exchanged output key and resets the
-// peer's key recovery state.
 func (h *NetbirdHandler) HandshakeCompleted(pid rp.PeerID, key rp.Key) {
-	psk := wgtypes.Key(key)
-
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-	if peer.expiries > 0 {
-		log.Infof("rosenpass exchange completed for peer %s after %d expired renewals", wgtypes.Key(peer.PublicKey), peer.expiries)
-	}
-	// chainKey tracks the shared exchange output regardless of the local write
-	// outcome, so both ends still converge on the next expiry.
-	peer.chainKey = &psk
-	peer.expiries = 0
-	if !h.applyKeyLocked(pid, psk, peer.initialized) {
-		return
-	}
-	peer.initialized = true
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
 }
 
-// HandshakeExpired replaces the expired key. The renewal exchange runs over
-// the tunnel keyed by the PSK itself, so the replacement must be derivable on
-// both ends without communication: the first expiry ratchets the last shared
-// key forward, repeated expiries (and expiries without a completed exchange)
-// fall back to the rendezvous key and drop the peer out of the initialized
-// state so connection reconfigurations reprogram the rendezvous key as well.
 func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
+	key, _ := rp.GeneratePresharedKey()
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
+}
+
+func (h *NetbirdHandler) outputKey(_ rp.KeyOutputReason, pid rp.PeerID, psk rp.Key) {
 	h.mu.Lock()
-	defer h.mu.Unlock()
+	iface := h.iface
+	wg, ok := h.peers[pid]
+	isInitialized := h.initializedPeers[pid]
+	h.mu.Unlock()
 
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-
-	peer.expiries++
-
-	var psk wgtypes.Key
-	if peer.chainKey != nil && peer.expiries == 1 {
-		log.Infof("rosenpass key for peer %s expired without renewal, advancing to ratcheted key", wgtypes.Key(peer.PublicKey))
-		psk = RatchetKey(*peer.chainKey)
-		peer.chainKey = &psk
-	} else {
-		rendezvous, err := h.rendezvousKey(peer)
-		if err != nil {
-			// Fail closed: without a rendezvous key the expired key must
-			// still be rotated out, even if the replacement is unusable.
-			log.Errorf("failed to derive rendezvous key, replacing expired key with a random one: %v", err)
-			h.applyRandomKeyLocked(pid)
-			return
-		}
-		log.Warnf("rosenpass key for peer %s expired %d times without renewal, falling back to the rendezvous key", wgtypes.Key(peer.PublicKey), peer.expiries)
-		psk = rendezvous
-		peer.chainKey = nil
-		peer.initialized = false
-	}
-
-	h.applyKeyLocked(pid, psk, true)
-}
-
-// rendezvousKey returns the key both ends converge on without communication:
-// the account-level preshared key when configured, the deterministic seed key
-// otherwise. It mirrors the key that peer connections program when Rosenpass
-// does not manage the peer yet.
-func (h *NetbirdHandler) rendezvousKey(peer *wireGuardPeer) (wgtypes.Key, error) {
-	if h.preSharedKey != nil {
-		return *h.preSharedKey, nil
-	}
-
-	seed, err := DeterministicSeedKey(h.localWgKey.String(), wgtypes.Key(peer.PublicKey).String())
-	if err != nil {
-		return wgtypes.Key{}, err
-	}
-	return *seed, nil
-}
-
-// applyKeyLocked writes the preshared key for the peer to the WireGuard
-// interface and reports whether the write succeeded. Callers must hold h.mu
-// for the whole state-mutation-plus-write so that a concurrent completion and
-// expiry cannot reorder their writes relative to the in-memory chain key.
-func (h *NetbirdHandler) applyKeyLocked(pid rp.PeerID, psk wgtypes.Key, updateOnly bool) bool {
-	peer, ok := h.peers[pid]
-	if !ok {
-		return false
-	}
-
-	if h.iface == nil {
+	if iface == nil {
 		log.Warn("rosenpass: interface not set, cannot update preshared key")
-		return false
-	}
-
-	peerKey := wgtypes.Key(peer.PublicKey).String()
-	if err := h.iface.SetPresharedKey(peerKey, psk, updateOnly); err != nil {
-		log.Errorf("Failed to apply rosenpass key: %v", err)
-		return false
-	}
-
-	return true
-}
-
-func (h *NetbirdHandler) applyRandomKeyLocked(pid rp.PeerID) {
-	key, err := rp.GeneratePresharedKey()
-	if err != nil {
-		log.Errorf("failed to generate random preshared key: %v", err)
 		return
 	}
-	h.applyKeyLocked(pid, wgtypes.Key(key), true)
+
+	if !ok {
+		return
+	}
+
+	peerKey := wgtypes.Key(wg.PublicKey).String()
+	pskKey := wgtypes.Key(psk)
+
+	// Use updateOnly=true for later rotations (peer already has Rosenpass PSK)
+	// Use updateOnly=false for first rotation (peer has original/empty PSK)
+	if err := iface.SetPresharedKey(peerKey, pskKey, isInitialized); err != nil {
+		log.Errorf("Failed to apply rosenpass key: %v", err)
+		return
+	}
+
+	// Mark peer as isInitialized after the successful first rotation
+	if !isInitialized {
+		h.mu.Lock()
+		if _, exists := h.peers[pid]; exists {
+			h.initializedPeers[pid] = true
+		}
+		h.mu.Unlock()
+	}
 }

client/internal/rosenpass/netbird_handler_test.go

@@ -1,250 +0,0 @@
-package rosenpass
-
-import (
-	"testing"
-
-	rp "cunicu.li/go-rosenpass"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// handlerTestLink wires two NetbirdHandlers as the two ends of a single
-// tunnel: handler A manages the rosenpass peer B and vice versa, the way two
-// NetBird clients see each other.
-type handlerTestLink struct {
-	handlerA, handlerB *NetbirdHandler
-	ifaceA, ifaceB     *mockIface
-	pidA, pidB         rp.PeerID
-	wgKeyA, wgKeyB     wgtypes.Key
-}
-
-func newHandlerTestLink(t *testing.T, preSharedKey *[32]byte) *handlerTestLink {
-	t.Helper()
-
-	link := &handlerTestLink{
-		ifaceA: &mockIface{},
-		ifaceB: &mockIface{},
-	}
-	link.pidA[0] = 0xaa
-	link.pidB[0] = 0xbb
-	link.wgKeyA[31] = 1
-	link.wgKeyB[31] = 2
-
-	link.handlerA = NewNetbirdHandler(preSharedKey, link.wgKeyA)
-	link.handlerB = NewNetbirdHandler(preSharedKey, link.wgKeyB)
-
-	link.handlerA.SetInterface(link.ifaceA)
-	link.handlerB.SetInterface(link.ifaceB)
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	link.handlerB.AddPeer(link.pidA, "wt0", rp.Key(link.wgKeyA))
-
-	return link
-}
-
-// complete simulates a completed rosenpass exchange: both ends derive the
-// same output key.
-func (l *handlerTestLink) complete(osk rp.Key) {
-	l.handlerA.HandshakeCompleted(l.pidB, osk)
-	l.handlerB.HandshakeCompleted(l.pidA, osk)
-}
-
-// expire simulates a failed key renewal on both ends.
-func (l *handlerTestLink) expire() {
-	l.handlerA.HandshakeExpired(l.pidB)
-	l.handlerB.HandshakeExpired(l.pidA)
-}
-
-func lastPSK(t *testing.T, m *mockIface) wgtypes.Key {
-	t.Helper()
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	require.NotEmpty(t, m.calls, "expected at least one SetPresharedKey call")
-	return m.calls[len(m.calls)-1].psk
-}
-
-func TestHandshakeCompleted_SetsKeyAndInitializes(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	require.Equal(t, wgtypes.Key(osk), lastPSK(t, link.ifaceA), "completed exchange must program the osk")
-	require.False(t, link.ifaceA.calls[0].updateOnly, "first rotation must not be update-only")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized after first completed exchange")
-
-	link.complete(osk)
-	require.True(t, link.ifaceA.calls[1].updateOnly, "later rotations must be update-only")
-}
-
-// TestHandshakeExpired_BothSidesConverge encodes the core recovery invariant:
-// rosenpass renewals run over the tunnel that the PSK itself keys, so when a
-// renewal fails on both ends, both ends must fall back to the same key or the
-// tunnel can never handshake again.
-func TestHandshakeExpired_BothSidesConverge(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	keyA := lastPSK(t, link.ifaceA)
-	keyB := lastPSK(t, link.ifaceB)
-	require.NotEqual(t, wgtypes.Key(osk), keyA, "expired key must be rotated out")
-	require.Equal(t, keyA, keyB, "both ends must converge on the same key after expiry")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must still converge after repeated expiries")
-}
-
-// TestHandshakeExpired_ExpiryWithoutCompletionConverges covers the bootstrap
-// case: the initial exchange never completed (the tunnel ran on the rendezvous
-// key), so an expiry must not replace the working key with an unrecoverable
-// one on either end.
-func TestHandshakeExpired_ExpiryWithoutCompletionConverges(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must converge when the exchange never completed")
-}
-
-// TestHandshakeExpired_RepeatedExpiryClearsInitialized: once renewals keep
-// failing, the peer must drop out of the initialized state so the next
-// connection reconfiguration reprograms the rendezvous key instead of
-// preserving a poisoned rosenpass-managed key.
-func TestHandshakeExpired_RepeatedExpiryClearsInitialized(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.False(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"repeated expiries must clear the initialized state")
-	require.False(t, link.handlerB.IsPeerInitialized(link.pidA),
-		"repeated expiries must clear the initialized state")
-}
-
-// TestHandshakeCompleted_AfterExpiryRecovers: a completed exchange after a
-// desync must fully reset the recovery state.
-func TestHandshakeCompleted_AfterExpiryRecovers(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk1, osk2 rp.Key
-	osk1[0] = 1
-	osk2[0] = 2
-
-	link.complete(osk1)
-	link.expire()
-	link.expire()
-
-	link.complete(osk2)
-	require.Equal(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "new exchange must program the fresh osk")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized again after recovery")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"recovered link must converge again on the next expiry")
-	require.NotEqual(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "expired key must be rotated out")
-}
-
-// TestHandshakeExpired_FirstExpiryRatchetsLastKey: the first expiry must
-// derive the replacement from the last shared key, so an attacker who only
-// blocks the renewal exchange gains nothing over the previous key.
-func TestHandshakeExpired_FirstExpiryRatchetsLastKey(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	require.Equal(t, RatchetKey(wgtypes.Key(osk)), lastPSK(t, link.ifaceA),
-		"first expiry must program the ratcheted key")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"ratchet step must keep the peer initialized so reconfigurations preserve the key")
-}
-
-// TestHandshakeExpired_RepeatedExpiryFallsBackToSeed: once the ratchet key
-// also fails, both ends must land on the same key that peer connections
-// program for uninitialized peers, so a reconnect completes the recovery.
-func TestHandshakeExpired_RepeatedExpiryFallsBackToSeed(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA), "repeated expiry must fall back to the seed key")
-	require.Equal(t, *seed, lastPSK(t, link.ifaceB), "repeated expiry must fall back to the seed key")
-}
-
-// TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous: with an account-level
-// preshared key configured, the fallback must be that key, matching what peer
-// connections program for uninitialized peers.
-func TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous(t *testing.T) {
-	psk := &[32]byte{0x77}
-	link := newHandlerTestLink(t, psk)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceA),
-		"fallback must be the configured preshared key")
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceB),
-		"fallback must be the configured preshared key on both ends")
-}
-
-// TestHandshakeExpired_ExpiryWritesAreUpdateOnly: expiry replacements must
-// never create a WireGuard peer that connection management has removed.
-func TestHandshakeExpired_ExpiryWritesAreUpdateOnly(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	for _, call := range link.ifaceA.calls[1:] {
-		require.True(t, call.updateOnly, "expiry writes must be update-only")
-	}
-}
-
-// TestAddPeer_ReAddKeepsRecoveryState: reconnections re-add the peer on every
-// OnConnected; that must not reset the expiry chain state.
-func TestAddPeer_ReAddKeepsRecoveryState(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-	link.expire()
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"re-adding a known peer must keep its state")
-
-	link.expire()
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA),
-		"second expiry after re-add must continue to the seed fallback")
-}

client/internal/rosenpass/seed.go

@@ -1,28 +1,11 @@
 package rosenpass
 
 import (
-	"crypto/sha256"
 	"fmt"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// ratchetLabel domain-separates the expiry ratchet from other uses of the
-// rosenpass output key.
-const ratchetLabel = "netbird-rosenpass-expiry-ratchet"
-
-// RatchetKey derives the successor preshared key from the previous Rosenpass
-// output key. When a key expires without a completed renewal, both peers
-// advance their last shared key by one ratchet step: the expired key is
-// rotated out while both ends still converge on an identical, non-public
-// replacement without communicating.
-func RatchetKey(prev wgtypes.Key) wgtypes.Key {
-	input := make([]byte, 0, len(ratchetLabel)+len(prev))
-	input = append(input, ratchetLabel...)
-	input = append(input, prev[:]...)
-	return sha256.Sum256(input)
-}
-
 // DeterministicSeedKey derives a 32-byte WireGuard preshared key from a pair
 // of peer public keys. Both peers, given the same key pair, produce the same
 // output regardless of which side runs the function: the inputs are ordered

client/ios/NetBirdSDK/login.go

@@ -44,25 +44,10 @@ type Auth struct {
 // NewAuth instantiate Auth struct and validate the management URL
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	// Load the existing config when a config file is already present so an
-	// interactive re-login reuses the peer's persisted WireGuard private key
-	// (and thus its identity) instead of generating a fresh one. Generating a
-	// new key registers a brand-new peer on the management server on every
-	// re-auth (named after the fallback hostname). Only fall back to a fresh
-	// in-memory config for the first-time login when no config file exists yet.
-	// DirectUpdateOrCreateConfig uses non-atomic writes so it also works inside
-	// the tvOS App Group sandbox where atomic temp-file+rename is blocked.
-	var cfg *profilemanager.Config
-	var err error
-	if cfgPath != "" {
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(inputCfg)
-	} else {
-		cfg, err = profilemanager.CreateInMemoryConfig(inputCfg)
-	}
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}

client/server/mdm.go

@@ -3,7 +3,6 @@ package server
 import (
 	"context"
 	"fmt"
-	"net/url"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -182,37 +181,6 @@ func conflictBool(key string, p *bool) conflictCheck {
 	}
 }
 
-func canonicalURL(s string) string {
-	u, err := url.ParseRequestURI(s)
-	if err != nil {
-		return s
-	}
-	if u.Port() == "" {
-		switch u.Scheme {
-		case "https":
-			u.Host += ":443"
-		case "http":
-			u.Host += ":80"
-		}
-	}
-	return u.String()
-}
-
-// conflictURL is conflictString for URL-typed keys: both sides are
-// normalized via canonicalURL before comparison.
-func conflictURL(key, got string) conflictCheck {
-	return conflictCheck{
-		key: key,
-		check: func(pol *mdm.Policy) bool {
-			if got == "" {
-				return true
-			}
-			want, ok := pol.GetString(key)
-			return ok && canonicalURL(want) == canonicalURL(got)
-		},
-	}
-}
-
 // conflictString builds a conflictCheck for a string MDM key. An empty
 // `got` is treated as "field not set" (no override requested); otherwise
 // the check returns true only when the policy contains the key and its
@@ -288,7 +256,7 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
@@ -409,7 +377,7 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),

client/server/setconfig_mdm_test.go

@@ -181,43 +181,6 @@ func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	require.NotNil(t, resp)
 }
 
-// TestSetConfig_MDMAllow_ManagementURLPortNormalized covers the
-// regression from discussion #6483: MDM URL without explicit port vs
-// UI echo with the parseURL-appended default port must be treated as
-// a no-op echo, not a conflict.
-func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
-	tests := []struct {
-		name      string
-		mdmURL    string
-		submitURL string
-	}{
-		{"policy_no_port_submit_with_443", "https://netbird.corp.example", "https://netbird.corp.example:443"},
-		{"policy_with_443_submit_no_port", "https://netbird.corp.example:443", "https://netbird.corp.example"},
-		{"http_policy_no_port_submit_with_80", "http://netbird.corp.example", "http://netbird.corp.example:80"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-				mdm.KeyManagementURL: tc.mdmURL,
-			}))
-
-			s, ctx, profName, username, _ := setupServerWithProfile(t)
-
-			rosenpassEnabled := true
-			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
-				ProfileName:      profName,
-				Username:         username,
-				ManagementUrl:    tc.submitURL,
-				RosenpassEnabled: &rosenpassEnabled,
-			})
-
-			require.NoError(t, err, "port-normalized URL echo must not trip MDM conflict gate")
-			require.NotNil(t, resp)
-		})
-	}
-}
-
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
 	withMDMPolicy(t, mdm.NewPolicy(nil))

client/ssh/server/getent_unix.go

@@ -69,8 +69,7 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
-// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
-// rejected so the input can never be parsed as a command-line flag.
+// (@ for Kerberos, $ for Samba, + for NIS compat).
 func validateGetentInput(input string) bool {
 	maxLen := 32
 	if runtime.GOOS == "linux" {
@@ -81,10 +80,6 @@ func validateGetentInput(input string) bool {
 		return false
 	}
 
-	if input[0] == '-' {
-		return false
-	}
-
 	for _, r := range input {
 		if isAllowedGetentChar(r) {
 			continue

client/ssh/server/getent_unix_test.go

@@ -157,9 +157,6 @@ func TestValidateGetentInput(t *testing.T) {
 		{"numeric UID", "1001", true},
 		{"dots and underscores", "alice.bob_test", true},
 		{"hyphen", "alice-bob", true},
-		{"leading hyphen rejected", "-i", false},
-		{"leading double hyphen rejected", "--no-idn", false},
-		{"lone hyphen rejected", "-", false},
 		{"kerberos principal", "user@REALM", true},
 		{"samba machine account", "MACHINE$", true},
 		{"NIS compat", "+user", true},

client/system/process.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"slices"
 
-	"github.com/shirou/gopsutil/v4/process"
+	"github.com/shirou/gopsutil/v3/process"
 )
 
 // getRunningProcesses returns a list of running process paths. The context bounds the work:

client/system/process_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/shirou/gopsutil/v4/process"
+	"github.com/shirou/gopsutil/v3/process"
 )
 
 func Benchmark_getRunningProcesses(b *testing.B) {

e2e/agentnetwork/chat_test.go

@@ -91,7 +91,7 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "us-east-1"
 		}
-		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireBedrock})
+		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireMessages})
 	}
 	return ps
 }
@@ -224,12 +224,9 @@ func TestProvidersMatrix(t *testing.T) {
 				var c int
 				var b string
 				var cerr error
-				switch pc.kind {
-				case harness.WireVertex:
+				if pc.kind == harness.WireVertex {
 					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
-				case harness.WireBedrock:
-					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
-				default:
+				} else {
 					c, b, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
 				}
 				if cerr == nil {

e2e/agentnetwork/guardrail_test.go

@@ -1,168 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// catalogModel returns the normalized catalog id the proxy stamps for a
-// path-routed provider's configured model — the form the guardrail allowlist is
-// compared against (region prefix / @version stripped).
-func catalogModel(pc providerCase) string {
-	switch pc.kind {
-	case harness.WireBedrock:
-		return strings.TrimPrefix(pc.model, "us.")
-	case harness.WireVertex:
-		return strings.SplitN(pc.model, "@", 2)[0]
-	default:
-		return pc.model
-	}
-}
-
-// disallowedModel returns a valid-shaped model id for the provider that is NOT
-// the configured/allowed one, so the guardrail must reject it before the
-// request ever reaches the upstream.
-func disallowedModel(pc providerCase) string {
-	switch pc.kind {
-	case harness.WireBedrock:
-		return "us.anthropic.claude-opus-4-8"
-	case harness.WireVertex:
-		return "claude-opus-4-8@20250101"
-	default:
-		return "unlisted-model"
-	}
-}
-
-// sendModel drives one request for the given model through the provider's native
-// wire shape and returns the HTTP status.
-func sendModel(ctx context.Context, t *testing.T, cl *harness.Client, endpoint, proxyIP string, pc providerCase, model string) int {
-	t.Helper()
-	var code int
-	var err error
-	switch pc.kind {
-	case harness.WireBedrock:
-		code, _, err = cl.Bedrock(ctx, endpoint, proxyIP, model, "Reply with exactly: pong", "")
-	case harness.WireVertex:
-		code, _, err = cl.Vertex(ctx, endpoint, proxyIP, pc.project, pc.region, model, "Reply with exactly: pong", "")
-	default:
-		code, _, err = cl.Chat(ctx, endpoint, proxyIP, pc.kind, model, "Reply with exactly: pong", "")
-	}
-	require.NoError(t, err, "request must reach the proxy for %s", pc.name)
-	return code
-}
-
-// TestModelAllowlistEnforced provisions a Model Allowlist guardrail limiting each
-// path-routed provider (Bedrock, Vertex) to its configured model, then drives
-// requests over the tunnel: the allowed model returns 200 while a model outside
-// the allowlist is denied 403 by the guardrail before it reaches the upstream.
-// This is the coverage missing for #6751 — the model for these providers travels
-// in the URL path, and the allowlist must be enforced there.
-func TestModelAllowlistEnforced(t *testing.T) {
-	var providers []providerCase
-	for _, pc := range availableProviders() {
-		if pc.kind == harness.WireBedrock || pc.kind == harness.WireVertex {
-			providers = append(providers, pc)
-		}
-	}
-	if len(providers) == 0 {
-		t.Skip("no path-routed provider keys set (AWS_BEARER_TOKEN_BEDROCK / GOOGLE_VERTEX_*); source ~/.llm-keys")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-allowlist"})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-allowlist-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-
-	// Providers with their configured (allowed) models; the first bootstraps the cluster.
-	ids := make([]string, 0, len(providers))
-	allowed := make([]string, 0, len(providers))
-	for i, pc := range providers {
-		req := providerRequest(pc)
-		if i == 0 {
-			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
-		}
-		prov, perr := srv.CreateProvider(ctx, req)
-		require.NoError(t, perr, "create provider %s", pc.name)
-		id := prov.Id
-		ids = append(ids, id)
-		allowed = append(allowed, catalogModel(pc))
-		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
-	}
-
-	// Guardrail allowlisting exactly the configured models.
-	var gr api.AgentNetworkGuardrailRequest
-	gr.Name = "e2e-allowlist"
-	gr.Checks.ModelAllowlist.Enabled = true
-	gr.Checks.ModelAllowlist.Models = allowed
-	guard, err := srv.CreateGuardrail(ctx, gr)
-	require.NoError(t, err, "create guardrail")
-	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
-
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-allowlist",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: ids,
-		GuardrailIds:           &[]string{guard.Id},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	settings, err := srv.GetSettings(ctx)
-	require.NoError(t, err, "read settings for endpoint")
-	require.NotEmpty(t, settings.Endpoint, "agent-network endpoint must be assigned")
-
-	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-proxy-allowlist")
-	require.NoError(t, err, "mint proxy token via CLI")
-	px, err := harness.StartProxy(ctx, srv, proxyToken)
-	require.NoError(t, err, "start proxy")
-	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
-
-	cl, err := harness.StartClient(ctx, srv, sk.Key)
-	require.NoError(t, err, "start client")
-	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
-
-	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
-		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
-	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
-
-	for _, pc := range providers {
-		pc := pc
-		t.Run(pc.name, func(t *testing.T) {
-			// The admin's allowlisted model is served end to end.
-			assert.Equal(t, 200, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, pc.model),
-				"allowlisted model must be permitted for %s", pc.name)
-			// A model outside the allowlist is rejected by the guardrail (before
-			// the upstream), regardless of whether it is a real catalog model.
-			assert.Equal(t, 403, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, disallowedModel(pc)),
-				"model outside the allowlist must be denied for %s", pc.name)
-		})
-	}
-}

e2e/harness/agentnetwork.go

@@ -107,17 +107,6 @@ func (c *Combined) DeletePolicy(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/policies/"+id)
 }
 
-// CreateGuardrail creates an agent-network guardrail (e.g. a model allowlist)
-// that can then be attached to a policy via its GuardrailIds.
-func (c *Combined) CreateGuardrail(ctx context.Context, req api.AgentNetworkGuardrailRequest) (api.AgentNetworkGuardrail, error) {
-	return anRequest[api.AgentNetworkGuardrail](ctx, c, http.MethodPost, "/api/agent-network/guardrails", req)
-}
-
-// DeleteGuardrail removes a guardrail by id.
-func (c *Combined) DeleteGuardrail(ctx context.Context, id string) error {
-	return anDelete(ctx, c, "/api/agent-network/guardrails/"+id)
-}
-
 // GetSettings returns the account's agent-network settings row. It exists only
 // after the first provider create bootstraps it.
 func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {

e2e/harness/client.go

@@ -194,11 +194,6 @@ const (
 	// WireVertex is the Anthropic-on-Vertex rawPredict shape: the client posts
 	// the full Vertex model path and the proxy mints the SA OAuth token.
 	WireVertex = "vertex"
-	// WireBedrock is the native AWS Bedrock InvokeModel shape: the model id
-	// travels in the URL path (/model/{id}/invoke), not the body, so the proxy
-	// routes by path. This is what a Bedrock SDK client sends and the shape the
-	// model-allowlist guardrail must enforce.
-	WireBedrock = "bedrock"
 )
 
 // Chat issues a chat-completion POST to the agent-network endpoint over the
@@ -231,17 +226,6 @@ func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
-// Bedrock issues a native AWS Bedrock InvokeModel POST over the tunnel. The
-// model id is carried in the request path (/model/{id}/invoke), so the proxy
-// routes by path; the body uses the bedrock anthropic_version rather than a
-// model field. A non-empty sessionID is sent as the universal x-session-id
-// header the proxy records.
-func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
-	path := "/model/" + model + "/invoke"
-	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
-	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
-}
-
 // withSessionID appends the x-session-id header when sessionID is non-empty.
 func withSessionID(headers []string, sessionID string) []string {
 	if sessionID == "" {

go.mod

@@ -2,7 +2,7 @@ module github.com/netbirdio/netbird
 
 go 1.25.5
 
-toolchain go1.25.12
+toolchain go1.25.11
 
 require (
 	cunicu.li/go-rosenpass v0.5.42
@@ -19,8 +19,8 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.9
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.54.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/crypto v0.50.0
+	golang.org/x/sys v0.43.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	golang.zx2c4.com/wireguard/windows v0.5.3
@@ -104,7 +104,6 @@ require (
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/rs/xid v1.3.0
 	github.com/shirou/gopsutil/v3 v3.24.4
-	github.com/shirou/gopsutil/v4 v4.25.8
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
 	github.com/stretchr/testify v1.11.1
@@ -128,11 +127,11 @@ require (
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
 	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/mod v0.34.0
+	golang.org/x/net v0.53.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/term v0.45.0
+	golang.org/x/sync v0.20.0
+	golang.org/x/term v0.42.0
 	golang.org/x/time v0.15.0
 	google.golang.org/api v0.276.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -309,6 +308,7 @@ require (
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/rymdport/portal v0.4.2 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
 	github.com/shoenig/go-m1cpu v0.2.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
@@ -332,8 +332,8 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/image v0.33.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/tools v0.43.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect

go.sum

@@ -781,8 +781,8 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/image v0.33.0 h1:LXRZRnv1+zGd5XBUVRFmYEphyyKJjQjCRiOuAP3sZfQ=
@@ -799,8 +799,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -819,8 +819,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -835,8 +835,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -872,8 +872,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -886,8 +886,8 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -899,8 +899,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -914,8 +914,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

management/internals/modules/peers/manager.go

@@ -224,6 +224,30 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 		return nil
 	}
 
+	// Dedupe stale embedded peer records for the same (account, cluster).
+	// The proxy generates a fresh WireGuard keypair on every startup
+	// (proxy/internal/roundtrip/netbird.go), so without this sweep the
+	// prior embedded peer would linger forever — holding its CGNAT IP
+	// allocation, polluting other peers' rosters, and (most visibly)
+	// leaving the synth DNS pointing at the dead address. The
+	// (account, cluster) tuple identifies "the embedded peer for this
+	// proxy instance at this cluster"; any record matching that tuple
+	// with a different pubkey is by definition stale and must go.
+	staleIDs, err := m.findStaleEmbeddedProxyPeers(ctx, accountID, cluster, peerKey)
+	if err != nil {
+		return fmt.Errorf("scan for stale embedded proxy peers: %w", err)
+	}
+	if len(staleIDs) > 0 {
+		// userID="" + checkConnected=false: the deletion is initiated
+		// by management itself on behalf of the freshly-registering
+		// proxy, not by an end user; the stale peer may still be
+		// marked Connected from its prior session, but its session is
+		// dead by definition (its key no longer exists).
+		if err := m.DeletePeers(ctx, accountID, staleIDs, "", false); err != nil {
+			return fmt.Errorf("delete stale embedded proxy peers %v: %w", staleIDs, err)
+		}
+	}
+
 	name := fmt.Sprintf("proxy-%s", xid.New().String())
 	newPeer := &peer.Peer{
 		Ephemeral: true,
@@ -249,3 +273,29 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 
 	return nil
 }
+
+// findStaleEmbeddedProxyPeers returns the peer IDs of embedded proxy peer
+// records in accountID that target the same cluster but carry a different
+// WireGuard pubkey than the freshly-registering one. Used by CreateProxyPeer
+// to garbage-collect stale records left behind when the proxy restarts with a
+// regenerated keypair.
+func (m *managerImpl) findStaleEmbeddedProxyPeers(ctx context.Context, accountID, cluster, newKey string) ([]string, error) {
+	account, err := m.store.GetAccount(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+	var stale []string
+	for _, p := range account.Peers {
+		if p == nil || !p.ProxyMeta.Embedded {
+			continue
+		}
+		if p.ProxyMeta.Cluster != cluster {
+			continue
+		}
+		if p.Key == newKey {
+			continue
+		}
+		stale = append(stale, p.ID)
+	}
+	return stale, nil
+}

management/internals/server/server.go

@@ -15,7 +15,7 @@ import (
 	"go.opentelemetry.io/otel/metric"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c" //nolint:staticcheck
+	"golang.org/x/net/http2/h2c"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/encryption"
@@ -382,7 +382,6 @@ func (s *BaseServer) serveGRPCWithHTTP(ctx context.Context, listener net.Listene
 			// the following magic is needed to support HTTP2 without TLS
 			// and still share a single port between gRPC and HTTP APIs
 			h1s := &http.Server{
-				//nolint:staticcheck // h2c also handles the HTTP/1 Upgrade mechanism, which http.Server's UnencryptedHTTP2 does not
 				Handler: h2c.NewHandler(handler, &http2.Server{}),
 			}
 			err = h1s.Serve(listener)

management/server/agentnetwork_proxypeer_restart_test.go

@@ -0,0 +1,199 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/peers"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale is the no-mock
+// regression guard for the bug the user reported: restarting the proxy creates
+// a fresh embedded peer with a NEW WireGuard public key (the proxy generates
+// the keypair on every startup at proxy/internal/roundtrip/netbird.go:312).
+// The PRIOR embedded peer record is never deleted on management, so the
+// account accumulates a stale peer holding a stale CGNAT IP. Other peers
+// in the account either keep routing to the dead IP, or — if synth DNS
+// picks the wrong record — never see the new IP at all.
+//
+// What this test exercises (no mocks):
+//   - real SQLite test store
+//   - real DefaultAccountManager, network-map controller, peer-update channels
+//   - real peers.Manager.CreateProxyPeer path (the very method the proxy
+//     invokes over gRPC on every startup)
+//   - real agentnetwork.Manager + synth chain so the client receives a
+//     concrete DNS record that must point at the LATEST proxy peer.
+//
+// Pre-fix expected behavior (red): two embedded peers exist after the
+// "restart"; the synth DNS record points at the stale one; the client
+// receives an update reflecting the new peer but the old one lingers.
+// Post-fix expected behavior (green): exactly one embedded peer exists
+// after restart (with the new key) AND the client's network map carries
+// the synth DNS pointing at that new peer's CGNAT IP.
+func TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale(t *testing.T) {
+	am, updateManager, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID   = "an-restart-acct"
+		adminUserID = "an-restart-admin"
+		groupAID    = "an-restart-grp-A"
+		clusterAddr = "eu.proxy.netbird.io"
+		clientKey   = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		// Two different proxy pubkeys — the "before" and "after" of a
+		// proxy-process restart with fresh-keypair generation.
+		proxyKey1 = "Aaaaa1aaaaYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		proxyKey2 = "Bbbbb2bbbbYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+	)
+
+	// --- Account scaffold ---
+	account := newAccountWithId(ctx, accountID, adminUserID, "an-restart.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account))
+
+	clientPeer := &nbpeer.Peer{
+		Key:      clientKey,
+		Name:     "an-restart-client",
+		DNSLabel: "an-restart-client",
+		Meta:     nbpeer.PeerSystemMeta{Hostname: "an-restart-client", GoOS: "linux", WtVersion: "development"},
+	}
+	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
+	require.NoError(t, err, "AddPeer for client must succeed")
+	require.NoError(t, am.MarkPeerConnected(ctx, clientKey, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for the client peer must succeed (affected-peer fan-out skips disconnected peers)")
+
+	// Place the client in group A so the synth policy reaches it.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist group A")
+
+	// --- Real peers + agent-network managers ---
+	permMgr := permissions.NewManager(am.Store)
+	peersMgr := peers.NewManager(am.Store, permMgr)
+	peersMgr.SetAccountManager(am)
+	peersMgr.SetNetworkMapController(am.networkMapController)
+	agentMgr := agentnetwork.NewManager(am.Store, permMgr, am, nil)
+
+	// Subscribe BEFORE any state-mutating call so we don't lose the update
+	// that contains the synth DNS record.
+	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
+	t.Cleanup(func() { updateManager.CloseChannel(ctx, addedClient.ID) })
+	drain(clientCh)
+
+	// --- First proxy startup: register peer key K1, then mark it
+	// connected. In production the proxy follows CreateProxyPeer with the
+	// regular sync stream which lands on MarkPeerConnected; the synth DNS
+	// path filters out peers that aren't Connected (types/account.go:323),
+	// so without this step no DNS record would be emitted.
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey1, clusterAddr),
+		"first CreateProxyPeer (proxy startup) must succeed")
+
+	peer1ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "proxy peer for K1 must be persisted after CreateProxyPeer")
+	require.NotEmpty(t, peer1ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey1, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K1 must succeed")
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP1 := account.Peers[peer1ID].IP.String()
+	require.NotEmpty(t, proxyIP1, "K1 must have an assigned overlay IP")
+
+	// --- Provider + policy. CreateProvider / CreatePolicy trigger the
+	// agentnetwork reconcile which runs UpdateAccountPeers; the resulting
+	// NetworkMap delivered to the client carries the synth DNS record
+	// pointing at K1's IP. ---
+	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
+		AccountID:   accountID,
+		ProviderID:  "openai_api",
+		Name:        "openai-test",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test-key",
+		Enabled:     true,
+		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must succeed")
+
+	_, err = agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
+		AccountID:              accountID,
+		Name:                   "p1",
+		Enabled:                true,
+		SourceGroups:           []string{groupAID},
+		DestinationProviderIDs: []string{provider.ID},
+	})
+	require.NoError(t, err, "CreatePolicy must succeed")
+
+	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	fqdn := settings.Endpoint()
+
+	rdata1 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	require.Equal(t, proxyIP1, rdata1,
+		"client must receive a synth DNS record pointing at K1's overlay IP after the synth path runs")
+	drain(clientCh)
+
+	// --- Proxy restart: NEW keypair K2, same account, same cluster ---
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey2, clusterAddr),
+		"second CreateProxyPeer (proxy restart with fresh keypair) must succeed")
+
+	peer2ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey2)
+	require.NoError(t, err, "proxy peer for K2 must be persisted after restart")
+	require.NotEmpty(t, peer2ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey2, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K2 must succeed")
+
+	// In production the agent's sync stream pulls a fresh NetworkMap as
+	// part of its normal reconcile cadence; in this isolated test
+	// MarkPeerConnected's affected-peer fan-out can race the channel-side
+	// buffer in a way that swallows the synth-DNS-bearing update before
+	// our await reads it. Trigger an explicit account-wide fan-out so the
+	// assertion below tests what production actually delivers, not the
+	// in-test buffer race.
+	am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourcePeer, Operation: types.UpdateOperationUpdate})
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP2 := account.Peers[peer2ID].IP.String()
+	require.NotEmpty(t, proxyIP2, "K2 must have an assigned overlay IP")
+	require.NotEqual(t, proxyIP1, proxyIP2, "K2 must get a different overlay IP than K1 (sanity)")
+
+	// CRITICAL ASSERTION 1: K1 must no longer be in the store. The SqlStore
+	// returns ("", nil) for a missing key rather than NotFound, so assert
+	// on the returned ID being empty.
+	staleID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "GetPeerIDByKey for a missing peer must not error")
+	assert.Empty(t, staleID,
+		"stale embedded proxy peer K1 must be removed when a new embedded peer registers for the same (account, cluster); pre-fix this assertion fails because management never cleans up the prior peer record")
+
+	// CRITICAL ASSERTION 2: exactly one embedded proxy peer remains, and it
+	// is K2.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	embeddedKeys := []string{}
+	for _, p := range account.Peers {
+		if p.ProxyMeta.Embedded {
+			embeddedKeys = append(embeddedKeys, p.Key)
+		}
+	}
+	assert.Equal(t, []string{proxyKey2}, embeddedKeys,
+		"after a proxy restart exactly one embedded proxy peer should remain — the one with the new key K2")
+
+	// CRITICAL ASSERTION 3: the synth DNS record the client receives now
+	// points at K2's IP, not K1's.
+	rdata2 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	assert.Equal(t, proxyIP2, rdata2,
+		"after proxy restart, the client's synth DNS record must point at the NEW embedded peer's IP, not the stale K1 IP")
+}

management/server/types/account.go

@@ -305,8 +305,7 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 			zone = &nbdns.CustomZone{
 				Domain:           dns.Fqdn(serviceDomainZone),
 				Records:          []nbdns.SimpleRecord{},
-				NonAuthoritative:     true,
-				SearchDomainDisabled: true,
+				NonAuthoritative: true,
 			}
 			zonesByApex[serviceDomainZone] = zone
 		}

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -25,14 +25,6 @@ const (
 	denyCodeModel    = "llm_policy.model_blocked"
 	denyReasonModel  = "model_blocked"
 	denyMessageModel = "model is not in the policy allowlist"
-	// Deny reason used when an allowlist is configured but the request model
-	// could not be determined. URL/path-routed providers (AWS Bedrock, Google
-	// Vertex, ...) carry the model outside the JSON body, so a request shape the
-	// parser does not recognise reaches the guardrail with no model. Such a
-	// request must be denied (fail closed), never waved through.
-	denyCodeModelUnknown    = "llm_policy.model_unknown"
-	denyReasonModelUnknown  = "model_unknown"
-	denyMessageModelUnknown = "request model could not be determined for the policy allowlist"
 )
 
 // Middleware enforces the model allowlist and optionally captures the
@@ -116,37 +108,23 @@ func (m *Middleware) evaluateAllowlist(model string, modelPresent bool) *middlew
 	if len(m.cfg.ModelAllowlist) == 0 {
 		return nil
 	}
-	// Fail closed: with an allowlist configured, a request whose model the
-	// upstream parser could not extract (absent or empty) must be denied rather
-	// than allowed. This is what enforces the allowlist for URL/path-routed
-	// providers (Bedrock, Vertex, ...) whose model lives outside the JSON body.
-	if !modelPresent || normaliseModel(model) == "" {
-		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+	if !modelPresent {
+		return nil
 	}
 	if m.modelInAllowlist(model) {
 		return nil
 	}
-	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
-}
-
-// denyModel builds a 403 deny Output for a model-allowlist rejection. model is
-// included in the details only when non-empty.
-func denyModel(model, code, message, reason string) *middleware.Output {
-	details := map[string]string{}
-	if model != "" {
-		details["model"] = model
-	}
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Code:    code,
-			Message: message,
-			Details: details,
+			Code:    denyCodeModel,
+			Message: denyMessageModel,
+			Details: map[string]string{"model": model},
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
-			{Key: middleware.KeyLLMPolicyReason, Value: reason},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonModel},
 		},
 	}
 }

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -102,44 +102,13 @@ func TestAllowlistCaseInsensitive(t *testing.T) {
 	}
 }
 
-func TestAllowlistMissingModelKeyDenies(t *testing.T) {
-	// Fail closed: with an allowlist configured, a request whose model the
-	// parser could not extract (URL/path-routed providers such as Bedrock or
-	// Vertex whose shape wasn't recognised) must be denied, not allowed.
+func TestAllowlistMissingModelKeyAllows(t *testing.T) {
 	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
 	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when an allowlist is set")
-	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
-	require.NotNil(t, out.DenyReason, "deny reason must be populated")
-	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "missing model key must allow even with non-empty allowlist")
 	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
-	assert.Equal(t, "deny", dec, "decision must be deny when model key is absent")
-	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
-	assert.Equal(t, "model_unknown", reason, "reason metadata must be model_unknown")
-}
-
-func TestAllowlistEmptyModelValueDenies(t *testing.T) {
-	// A present-but-empty model is as undeterminable as an absent one.
-	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
-	out, err := mw.Invoke(context.Background(), newInput(
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "   "},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when an allowlist is set")
-	require.NotNil(t, out.DenyReason, "deny reason must be populated")
-	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
-}
-
-func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
-	// Without an allowlist there is nothing to enforce, so a missing model is
-	// still allowed — the fail-closed rule only applies when a list is set.
-	mw := New(Config{})
-	out, err := mw.Invoke(context.Background(), newInput())
-	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no allowlist must allow even without a model")
+	assert.Equal(t, "allow", dec, "decision must be allow when model key is absent")
 }
 
 func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {

proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go

@@ -1,106 +0,0 @@
-package llm_request_parser
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
-	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
-)
-
-// runParserGuardrail runs the request parser then the model-allowlist guardrail
-// in SlotOnRequest order, threading the parser's metadata into the guardrail the
-// same way the real chain does. It returns the guardrail decision so tests can
-// assert allowlist enforcement for URL/path-routed providers end to end.
-func runParserGuardrail(t *testing.T, url string, body []byte, allowlist []string) *middleware.Output {
-	t.Helper()
-	parser := newMiddleware(t)
-	parsed, err := parser.Invoke(context.Background(), &middleware.Input{
-		Slot: middleware.SlotOnRequest,
-		URL:  url,
-		Body: body,
-	})
-	require.NoError(t, err, "parser must not error")
-
-	guard := llm_guardrail.New(llm_guardrail.Config{ModelAllowlist: allowlist})
-	out, err := guard.Invoke(context.Background(), &middleware.Input{
-		Slot:     middleware.SlotOnRequest,
-		Metadata: parsed.Metadata,
-	})
-	require.NoError(t, err, "guardrail must not error")
-	require.NotNil(t, out, "guardrail must return an output")
-	return out
-}
-
-// TestModelAllowlist_URLRoutedProviders validates that the model allowlist is
-// enforced for providers whose model travels in the URL path (AWS Bedrock,
-// Google Vertex) rather than the JSON body. The "unknown action" case is the
-// regression guard for #6751: a Bedrock request shape the parser cannot map to a
-// model must fail closed under an allowlist instead of bypassing it.
-func TestModelAllowlist_URLRoutedProviders(t *testing.T) {
-	const bedrockBody = `{"anthropic_version":"bedrock-2023-05-31","messages":[{"role":"user","content":"hi"}]}`
-	const vertexBody = `{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`
-
-	tests := []struct {
-		name      string
-		url       string
-		body      string
-		allowlist []string
-		decision  middleware.Decision
-		denyCode  string
-	}{
-		{
-			name:      "bedrock allowed model passes",
-			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-haiku-4-5-v1:0/invoke",
-			body:      bedrockBody,
-			allowlist: []string{"anthropic.claude-haiku-4-5"},
-			decision:  middleware.DecisionAllow,
-		},
-		{
-			name:      "bedrock disallowed model denied",
-			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/invoke",
-			body:      bedrockBody,
-			allowlist: []string{"anthropic.claude-haiku-4-5"},
-			decision:  middleware.DecisionDeny,
-			denyCode:  "llm_policy.model_blocked",
-		},
-		{
-			name:      "bedrock unknown action fails closed",
-			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/some-future-action",
-			body:      bedrockBody,
-			allowlist: []string{"anthropic.claude-haiku-4-5"},
-			decision:  middleware.DecisionDeny,
-			denyCode:  "llm_policy.model_unknown",
-		},
-		{
-			name:      "vertex disallowed model denied",
-			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-opus-4-8@20250101:rawPredict",
-			body:      vertexBody,
-			allowlist: []string{"claude-haiku-4-5"},
-			decision:  middleware.DecisionDeny,
-			denyCode:  "llm_policy.model_blocked",
-		},
-		{
-			name:      "vertex allowed model passes",
-			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-haiku-4-5@20250101:rawPredict",
-			body:      vertexBody,
-			allowlist: []string{"claude-haiku-4-5"},
-			decision:  middleware.DecisionAllow,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			out := runParserGuardrail(t, tt.url, []byte(tt.body), tt.allowlist)
-			assert.Equal(t, tt.decision, out.Decision, "unexpected decision for %s", tt.name)
-			if tt.decision == middleware.DecisionDeny {
-				require.NotNil(t, out.DenyReason, "deny reason must be set for %s", tt.name)
-				assert.Equal(t, 403, out.DenyStatus, "deny status must be 403 for %s", tt.name)
-				assert.Equal(t, tt.denyCode, out.DenyReason.Code, "deny code for %s", tt.name)
-			}
-		})
-	}
-}

relay/server/listener/quic/listener.go

@@ -51,10 +51,7 @@ func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
 
 		log.Infof("QUIC client connected from: %s", session.RemoteAddr())
 		conn := NewConn(session)
-		// Run the accept handler (which performs the pre-auth handshake) in its
-		// own goroutine so a slow or stalled handshake cannot block accepting
-		// further connections.
-		go acceptFn(conn)
+		acceptFn(conn)
 	}
 }
 

shared/relay/client/manager.go

@@ -30,9 +30,10 @@ type RelayTrack struct {
 	relayClient *Client
 	err         error
 	created     time.Time
-	// ready is closed once the dial started by openConnVia finishes (relayClient
-	// or err is set). Callers reusing a track wait on this instead of the track
-	// lock, so the dial never runs under rt.Lock.
+	// ready is closed once the dial started by openConnVia finishes, at which
+	// point exactly one of relayClient/err is set. Callers that find an existing
+	// track wait on this channel instead of the track lock, so the network dial
+	// is never performed while holding rt.Lock(). See openConnVia.
 	ready chan struct{}
 }
 
@@ -299,8 +300,17 @@ func (m *Manager) RelayStates() []RelayConnState {
 
 	// Only connected foreign relays carry state; a failed connect is evicted
 	// immediately (openConnVia), so there is no error state to surface.
+	//
+	// Query each track without blocking: openConnVia holds a track's write-lock
+	// for the whole of relayClient.Connect() (the network dial). A blocking
+	// RLock here would stall the status path (GetFullStatus -> GetRelayStates)
+	// for the full dial timeout. A track mid-Connect has no relayClient set yet
+	// and would be skipped anyway, so TryRLock + skip preserves the result while
+	// keeping status responsive.
 	for _, rt := range tracks {
-		rt.RLock()
+		if !rt.TryRLock() {
+			continue
+		}
 		rc := rt.relayClient
 		rt.RUnlock()
 		if rc != nil {
@@ -345,9 +355,12 @@ func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string
 		return m.openConnOnTrack(ctx, rt, peerKey)
 	}
 
-	// Publish the track and release the map lock BEFORE dialing, so the dial does
-	// not run under rt.Lock (which would block RelayStates and the cleanup loop
-	// for the full dial). Concurrent callers find this track and wait on rt.ready.
+	// Create the track, publish it, and release the map lock BEFORE dialing. The
+	// dial must not run while holding any track lock: RelayStates() and the
+	// cleanup loop take the track lock, and blocking them for the whole dial
+	// timeout is what stalls `netbird status -d`. Concurrent callers find this
+	// track in the map and wait on rt.ready (see openConnOnTrack), so only this
+	// goroutine performs the dial and the others reuse its result.
 	rt = NewRelayTrack()
 	m.relayClients[serverAddress] = rt
 	m.relayClientsMutex.Unlock()
@@ -372,13 +385,20 @@ func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string
 	rt.Unlock()
 	close(rt.ready)
 
-	return relayClient.OpenConn(ctx, peerKey)
+	conn, err := relayClient.OpenConn(ctx, peerKey)
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
 }
 
 // openConnOnTrack opens a peer connection through an existing relay track,
-// waiting for the dial started by another openConnVia call to finish. It waits
-// on rt.ready rather than the track lock, so it neither holds nor contends the
-// track lock across the dial.
+// waiting for the dial started by another openConnVia call (if still running)
+// to finish. It waits on rt.ready rather than the track lock, so it neither
+// holds nor contends the track lock across the dial; the RLock it takes
+// afterwards only guards the brief relayClient read + OpenConn, matching the
+// previous behaviour of protecting the client against a concurrent cleanup
+// close.
 func (m *Manager) openConnOnTrack(ctx context.Context, rt *RelayTrack, peerKey string) (net.Conn, error) {
 	select {
 	case <-rt.ready:
@@ -493,8 +513,10 @@ func (m *Manager) cleanUpUnusedRelays() {
 			continue
 		}
 
-		// dial still in progress (openConnVia publishes the track before Connect
-		// completes and no longer holds rt.Lock during it), nothing to clean up.
+		// The dial started by openConnVia is still in progress: the track is
+		// published before Connect() completes and no longer runs under rt.Lock,
+		// so relayClient is not set yet. Nothing to clean up, and it must not be
+		// evicted out from under the in-flight dial.
 		if rt.relayClient == nil {
 			rt.Unlock()
 			continue

shared/relay/client/manager_cleanup_test.go

@@ -1,60 +0,0 @@
-package client
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial drives a real, hanging foreign
-// relay dial and asserts cleanUpUnusedRelays does not stall behind it.
-func TestCleanUpUnusedRelays_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr := stallingRelayListener(t)
-
-	mCtx, mCancel := context.WithCancel(context.Background())
-	t.Cleanup(mCancel)
-
-	m := NewManager(mCtx, nil, "alice", 1280)
-
-	dialDone := make(chan struct{})
-	go func() {
-		defer close(dialDone)
-		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
-	}()
-
-	// The track appears in the map once the dial is in flight.
-	require.Eventually(t, func() bool {
-		m.relayClientsMutex.RLock()
-		defer m.relayClientsMutex.RUnlock()
-		_, ok := m.relayClients[serverAddr]
-		return ok
-	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
-
-	cleanupDone := make(chan struct{})
-	go func() {
-		defer close(cleanupDone)
-		m.cleanUpUnusedRelays()
-	}()
-
-	select {
-	case <-cleanupDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("cleanUpUnusedRelays blocked on an in-progress relay dial while holding the relay map lock")
-	}
-
-	m.relayClientsMutex.RLock()
-	_, stillTracked := m.relayClients[serverAddr]
-	m.relayClientsMutex.RUnlock()
-	require.True(t, stillTracked, "an in-progress relay dial must not be evicted by cleanup")
-
-	// Release the hanging dial so the goroutine can exit cleanly.
-	mCancel()
-	select {
-	case <-dialDone:
-	case <-time.After(5 * time.Second):
-		t.Fatal("openConnVia did not return after context cancellation")
-	}
-}

shared/relay/client/manager_dial_test.go

@@ -0,0 +1,72 @@
+package client
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestManager_InProgressDialIsSafeForReadersAndCleanup covers the new state that
+// option 1 introduces: openConnVia now publishes a relay track in the map and
+// releases the map lock BEFORE dialing, so a track can legitimately exist with
+// relayClient == nil and no track lock held while its Connect() is in flight.
+//
+// The status path (RelayStates) and the cleanup loop both touch every track, so
+// both must tolerate that mid-dial state — neither deref the nil relayClient nor
+// evict a track whose dial is still running.
+func TestManager_InProgressDialIsSafeForReadersAndCleanup(t *testing.T) {
+	m := &Manager{
+		relayClients: make(map[string]*RelayTrack),
+		// 0 so the created-time grace does not mask the mid-dial (nil relayClient)
+		// guard in cleanUpUnusedRelays.
+		keepUnusedServerTime: 0,
+	}
+
+	const addr = "relay.example.com:443"
+	rt := NewRelayTrack() // ready open, relayClient nil, unlocked == dial in progress
+	m.relayClients[addr] = rt
+
+	// A status call must not block or panic on a relay still being dialed; it has
+	// no state to report yet.
+	require.Empty(t, m.RelayStates(), "a relay still being dialed has no state to report")
+
+	// Cleanup must not deref the nil relayClient, and must not evict an in-flight dial.
+	m.cleanUpUnusedRelays()
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[addr]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "an in-progress dial must not be cleaned up")
+}
+
+// TestOpenConnOnTrack_ReleasesOnContextCancelDuringDial verifies the core option-1
+// property: a caller that finds a track whose dial is in progress waits on
+// rt.ready, not on the track lock, and can be released by its own context. This
+// is what keeps a slow relay dial from serializing behind the track lock.
+func TestOpenConnOnTrack_ReleasesOnContextCancelDuringDial(t *testing.T) {
+	m := &Manager{relayClients: make(map[string]*RelayTrack)}
+
+	rt := NewRelayTrack() // ready deliberately left open == dial in progress
+
+	ctx, cancel := context.WithCancel(context.Background())
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := m.openConnOnTrack(ctx, rt, "peerKey")
+		errCh <- err
+	}()
+
+	// While waiting for the dial the caller holds no track lock, so a concurrent
+	// reader (e.g. RelayStates) can still take it.
+	require.True(t, rt.TryRLock(), "waiter must not hold the track lock while the dial is in progress")
+	rt.RUnlock()
+
+	// Caller gives up: openConnOnTrack must return via ctx rather than hang on the dial.
+	cancel()
+	select {
+	case err := <-errCh:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(2 * time.Second):
+		t.Fatal("openConnOnTrack did not return on ctx cancellation while a dial was in progress")
+	}
+}

shared/relay/client/manager_relaystates_test.go

@@ -1,73 +1,50 @@
 package client
 
 import (
-	"context"
-	"net"
-	"net/netip"
-	"sync"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/require"
 )
 
-// stallingRelayListener accepts TCP connections and holds them open without ever
-// responding, so a relay handshake dialed against it blocks until its context is
-// cancelled. It returns the "rel://host:port" URL to dial.
-func stallingRelayListener(t *testing.T) string {
-	t.Helper()
+// TestRelayStates_DoesNotBlockWhileForeignRelayConnecting is a regression test for
+// status calls hanging behind an in-progress relay dial.
+//
+// openConnVia establishes a new foreign relay like this:
+//
+//	rt = NewRelayTrack()
+//	rt.Lock()                          // track write-lock
+//	m.relayClients[serverAddress] = rt
+//	m.relayClientsMutex.Unlock()
+//	...
+//	err := relayClient.Connect(m.ctx)  // network dial, held UNDER rt.Lock()
+//	...
+//	rt.Unlock()                        // released only after Connect returns/times out
+//
+// So while a relay is being dialed, its RelayTrack write-lock is held for the whole
+// dial (up to serverResponseTimeout per transport attempt, times the transport
+// fallback chain, times however many relays are being dialed at once).
+//
+// RelayStates() — reached from the daemon status path via
+// peer.Status.GetFullStatus() -> GetRelayStates() -> Manager.RelayStates() — takes
+// rt.RLock() on every tracked relay. A reader lock blocks while a writer holds the
+// lock, so a single foreign relay mid-Connect stalls RelayStates(), and therefore
+// `netbird status -d`, for the full dial timeout. #6547 moved this off the shared
+// map lock but the per-track RLock still blocks the status path.
+//
+// This test recreates the exact in-progress-dial state (track present in the map
+// with its write-lock held) and asserts RelayStates() does not wait on it.
+func TestRelayStates_DoesNotBlockWhileForeignRelayConnecting(t *testing.T) {
+	m := &Manager{
+		relayClients: make(map[string]*RelayTrack),
+	}
 
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-
-	var mu sync.Mutex
-	var conns []net.Conn
-	go func() {
-		for {
-			c, err := ln.Accept()
-			if err != nil {
-				return
-			}
-			mu.Lock()
-			conns = append(conns, c)
-			mu.Unlock()
-		}
-	}()
-	t.Cleanup(func() {
-		_ = ln.Close()
-		mu.Lock()
-		for _, c := range conns {
-			_ = c.Close()
-		}
-		mu.Unlock()
-	})
-
-	return "rel://" + ln.Addr().String()
-}
-
-// TestRelayStates_DoesNotBlockOnRealHangingDial is a regression test for
-// RelayStates() called by a "status -d command" hanging behind an in-progress
-// relay dial.
-func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
-	serverAddr := stallingRelayListener(t)
-
-	mCtx, mCancel := context.WithCancel(context.Background())
-	t.Cleanup(mCancel)
-
-	m := NewManager(mCtx, nil, "alice", 1280)
-
-	dialDone := make(chan struct{})
-	go func() {
-		defer close(dialDone)
-		_, _ = m.openConnVia(mCtx, serverAddr, "peerKey", netip.Addr{})
-	}()
-
-	require.Eventually(t, func() bool {
-		m.relayClientsMutex.RLock()
-		defer m.relayClientsMutex.RUnlock()
-		_, ok := m.relayClients[serverAddr]
-		return ok
-	}, 5*time.Second, 5*time.Millisecond, "relay dial did not start")
+	// Mirror openConnVia's state during a live dial: a track in the map whose
+	// write-lock is held for the duration of relayClient.Connect().
+	rt := NewRelayTrack()
+	rt.Lock()
+	m.relayClients["relay.example.com:443"] = rt
+	// Release at the end so a (buggy) blocked RelayStates goroutine can unwind
+	// instead of leaking past the test.
+	t.Cleanup(rt.Unlock)
 
 	done := make(chan []RelayConnState, 1)
 	go func() {
@@ -75,17 +52,11 @@ func TestRelayStates_DoesNotBlockOnRealHangingDial(t *testing.T) {
 	}()
 
 	select {
-	case states := <-done:
-		require.Empty(t, states, "a relay still being dialed carries no state and must be omitted")
+	case <-done:
+		// RelayStates returned without waiting for the in-progress dial. Good.
 	case <-time.After(2 * time.Second):
-		t.Fatal("RelayStates blocked on a foreign relay whose Connect() is in progress")
-	}
-
-	// Release the hanging dial so the goroutine can exit cleanly.
-	mCancel()
-	select {
-	case <-dialDone:
-	case <-time.After(5 * time.Second):
-		t.Fatal("openConnVia did not return after context cancellation")
+		t.Fatal("RelayStates() blocked on a relay track whose Connect() is in progress " +
+			"(rt.Lock held across the dial in openConnVia); `netbird status -d` hangs for " +
+			"the relay dial timeout")
 	}
 }

signal/cmd/run.go

@@ -16,7 +16,7 @@ import (
 	"go.opentelemetry.io/otel/metric"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c" //nolint:staticcheck
+	"golang.org/x/net/http2/h2c"
 
 	"github.com/netbirdio/netbird/shared/metrics"
 
@@ -281,7 +281,6 @@ func serveHTTP(httpListener net.Listener, handler http.Handler) {
 	go func() {
 		// Use h2c to support HTTP/2 without TLS (needed for gRPC)
 		h1s := &http.Server{
-			//nolint:staticcheck // h2c also handles the HTTP/1 Upgrade mechanism, which http.Server's UnencryptedHTTP2 does not
 			Handler: h2c.NewHandler(handler, &http2.Server{}),
 		}
 		err := h1s.Serve(httpListener)