Skip network map calculation when client serial matches current

Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>

.devcontainer/Dockerfile

@@ -1,15 +1,15 @@
-FROM golang:1.25-bookworm
+FROM golang:1.23-bullseye
 
 RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
     && apt-get -y install --no-install-recommends\
-        gettext-base=0.21-12 \
-        iptables=1.8.9-2 \
-        libgl1-mesa-dev=22.3.6-1+deb12u1 \
-        xorg-dev=1:7.7+23 \
-        libayatana-appindicator3-dev=0.5.92-1 \
+        gettext-base=0.21-4 \ 
+        iptables=1.8.7-1 \
+        libgl1-mesa-dev=20.3.5-1 \
+        xorg-dev=1:7.7+22 \
+        libayatana-appindicator3-dev=0.5.5-2+deb11u2 \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* \
-    && go install -v golang.org/x/tools/gopls@latest
+    && go install -v golang.org/x/tools/gopls@v0.18.1
 
 
 WORKDIR /app

.github/workflows/golang-test-freebsd.yml

@@ -25,7 +25,7 @@ jobs:
           release: "14.2"
           prepare: |
             pkg install -y curl pkgconf xorg
-            GO_TARBALL="go1.25.3.freebsd-amd64.tar.gz"
+            GO_TARBALL="go1.24.10.freebsd-amd64.tar.gz"
             GO_URL="https://go.dev/dl/$GO_TARBALL"
             curl -vLO "$GO_URL"
             tar -C /usr/local -vxzf "$GO_TARBALL"            
@@ -39,7 +39,7 @@ jobs:
             # check all component except management, since we do not support management server on freebsd
             time go test -timeout 1m -failfast ./base62/...
             # NOTE: without -p1 `client/internal/dns` will fail because of `listen udp4 :33100: bind: address already in use`
-            time go test -timeout 8m -failfast -v -p 1 ./client/...
+            time go test -timeout 8m -failfast -p 1 ./client/...
             time go test -timeout 1m -failfast ./dns/...
             time go test -timeout 1m -failfast ./encryption/...
             time go test -timeout 1m -failfast ./formatter/...

.github/workflows/golang-test-linux.yml

@@ -200,7 +200,7 @@ jobs:
             -e GOCACHE=${CONTAINER_GOCACHE} \
             -e GOMODCACHE=${CONTAINER_GOMODCACHE} \
             -e CONTAINER=${CONTAINER} \
-            golang:1.25-alpine \
+            golang:1.24-alpine \
             sh -c ' \
               apk update; apk add --no-cache \
                 ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
@@ -259,7 +259,7 @@ jobs:
           CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
           go test ${{ matrix.raceFlag }} \
             -exec 'sudo' \
-            -timeout 10m -p 1 ./relay/... ./shared/relay/...
+            -timeout 10m ./relay/... ./shared/relay/...
 
   test_signal:
     name: "Signal / Unit"

.github/workflows/golangci-lint.yml

@@ -19,7 +19,7 @@ jobs:
       - name: codespell
         uses: codespell-project/actions-codespell@v2
         with:
-          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans
+          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros
           skip: go.mod,go.sum
   golangci:
     strategy:
@@ -52,10 +52,7 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
         run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@v4
         with:
           version: latest
-          skip-cache: true
-          skip-save-cache: true
-          cache-invalidation-interval: 0
-          args: --timeout=12m
+          args: --timeout=12m --out-format colored-line-number

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  SIGN_PIPE_VER: "v0.1.0"
+  SIGN_PIPE_VER: "v0.0.23"
   GORELEASER_VER: "v2.3.2"
   PRODUCT_NAME: "NetBird"
   COPYRIGHT: "NetBird GmbH"
@@ -19,100 +19,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  release_freebsd_port:
-    name: "FreeBSD Port / Build & Test"
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Generate FreeBSD port diff
-        run: bash release_files/freebsd-port-diff.sh
-
-      - name: Generate FreeBSD port issue body
-        run: bash release_files/freebsd-port-issue-body.sh
-
-      - name: Check if diff was generated
-        id: check_diff
-        run: |
-          if ls netbird-*.diff 1> /dev/null 2>&1; then
-            echo "diff_exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "diff_exists=false" >> $GITHUB_OUTPUT
-            echo "No diff file generated (port may already be up to date)"
-          fi
-
-      - name: Extract version
-        if: steps.check_diff.outputs.diff_exists == 'true'
-        id: version
-        run: |
-          VERSION=$(ls netbird-*.diff | sed 's/netbird-\(.*\)\.diff/\1/')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Generated files for version: $VERSION"
-          cat netbird-*.diff
-
-      - name: Test FreeBSD port
-        if: steps.check_diff.outputs.diff_exists == 'true'
-        uses: vmactions/freebsd-vm@v1
-        with:
-          usesh: true
-          copyback: false
-          release: "15.0"
-          prepare: |
-            # Install required packages
-            pkg install -y git curl portlint go
-
-            # Install Go for building
-            GO_TARBALL="go1.25.5.freebsd-amd64.tar.gz"
-            GO_URL="https://go.dev/dl/$GO_TARBALL"
-            curl -LO "$GO_URL"
-            tar -C /usr/local -xzf "$GO_TARBALL"
-
-            # Clone ports tree (shallow, only what we need)
-            git clone --depth 1 --filter=blob:none https://git.FreeBSD.org/ports.git /usr/ports
-            cd /usr/ports
-
-          run: |
-            set -e -x
-            export PATH=$PATH:/usr/local/go/bin
-
-            # Find the diff file
-            echo "Finding diff file..."
-            DIFF_FILE=$(find $PWD -name "netbird-*.diff" -type f 2>/dev/null | head -1)
-            echo "Found: $DIFF_FILE"
-
-            if [[ -z "$DIFF_FILE" ]]; then
-              echo "ERROR: Could not find diff file"
-              find ~ -name "*.diff" -type f 2>/dev/null || true
-              exit 1
-            fi
-
-            # Apply the generated diff from /usr/ports (diff has a/security/netbird/... paths)
-            cd /usr/ports
-            patch -p1 -V none < "$DIFF_FILE"
-
-            # Show patched Makefile
-            version=$(cat security/netbird/Makefile | grep -E '^DISTVERSION=' | awk '{print $NF}')
-            
-            cd /usr/ports/security/netbird
-            export BATCH=yes
-            make package
-            pkg add ./work/pkg/netbird-*.pkg
-            
-            netbird version | grep "$version"
-
-            echo "FreeBSD port test completed successfully!"
-
-      - name: Upload FreeBSD port files
-        if: steps.check_diff.outputs.diff_exists == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: freebsd-port-files
-          path: |
-            ./netbird-*-issue.txt
-            ./netbird-*.diff
-          retention-days: 30
-
   release:
     runs-on: ubuntu-latest-m
     env:

.github/workflows/test-infrastructure-files.yml

@@ -243,7 +243,6 @@ jobs:
         working-directory: infrastructure_files/artifacts
         run: |
           sleep 30
-          docker compose logs
           docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
           docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db
 

.github/workflows/wasm-build-validation.yml

@@ -14,9 +14,6 @@ jobs:
   js_lint:
     name: "JS / Lint"
     runs-on: ubuntu-latest
-    env:
-      GOOS: js
-      GOARCH: wasm
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -27,14 +24,16 @@ jobs:
       - name: Install dependencies
         run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
       - name: Install golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc
         with:
           version: latest
           install-mode: binary
           skip-cache: true
-          skip-save-cache: true
-          cache-invalidation-interval: 0
-          working-directory: ./client
+          skip-pkg-cache: true
+          skip-build-cache: true
+      - name: Run golangci-lint for WASM
+        run: |
+          GOOS=js GOARCH=wasm golangci-lint run --timeout=12m --out-format colored-line-number ./client/...
         continue-on-error: true
 
   js_build:

.gitignore

@@ -31,4 +31,3 @@ infrastructure_files/setup-*.env
 .DS_Store
 vendor/
 /netbird
-client/netbird-electron/

.golangci.yaml

@@ -1,124 +1,139 @@
-version: "2"
-linters:
-  default: none
-  enable:
-    - bodyclose
-    - dupword
-    - durationcheck
-    - errcheck
-    - forbidigo
-    - gocritic
-    - gosec
-    - govet
-    - ineffassign
-    - mirror
-    - misspell
-    - nilerr
-    - nilnil
-    - predeclared
-    - revive
-    - sqlclosecheck
-    - staticcheck
-    - unused
-    - wastedassign
-  settings:
-    errcheck:
-      check-type-assertions: false
-    gocritic:
-      disabled-checks:
-        - commentFormatting
-        - captLocal
-        - deprecatedComment
-    gosec:
-      includes:
-        - G101
-        - G103
-        - G104
-        - G106
-        - G108
-        - G109
-        - G110
-        - G111
-        - G201
-        - G202
-        - G203
-        - G301
-        - G302
-        - G303
-        - G304
-        - G305
-        - G306
-        - G307
-        - G403
-        - G502
-        - G503
-        - G504
-        - G601
-        - G602
-    govet:
-      enable:
-        - nilness
-      enable-all: false
-    revive:
-      rules:
-        - name: exported
-          arguments:
-            - checkPrivateReceivers
-            - sayRepetitiveInsteadOfStutters
-          severity: warning
-          disabled: false
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
+run:
+  # Timeout for analysis, e.g. 30s, 5m.
+  # Default: 1m
+  timeout: 6m
+
+# This file contains only configs which differ from defaults.
+# All possible options can be found here https://github.com/golangci/golangci-lint/blob/master/.golangci.reference.yml
+linters-settings:
+  errcheck:
+    # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
+    # Such cases aren't reported by default.
+    # Default: false
+    check-type-assertions: false
+
+  gosec:
+    includes:
+      - G101 # Look for hard coded credentials
+      #- G102 # Bind to all interfaces
+      - G103 # Audit the use of unsafe block
+      - G104 # Audit errors not checked
+      - G106 # Audit the use of ssh.InsecureIgnoreHostKey
+      #- G107 # Url provided to HTTP request as taint input
+      - G108 # Profiling endpoint automatically exposed on /debug/pprof
+      - G109 # Potential Integer overflow made by strconv.Atoi result conversion to int16/32
+      - G110 # Potential DoS vulnerability via decompression bomb
+      - G111 # Potential directory traversal
+      #- G112 # Potential slowloris attack
+      - G113 # Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772)
+      #- G114 # Use of net/http serve function that has no support for setting timeouts
+      - G201 # SQL query construction using format string
+      - G202 # SQL query construction using string concatenation
+      - G203 # Use of unescaped data in HTML templates
+      #- G204 # Audit use of command execution
+      - G301 # Poor file permissions used when creating a directory
+      - G302 # Poor file permissions used with chmod
+      - G303 # Creating tempfile using a predictable path
+      - G304 # File path provided as taint input
+      - G305 # File traversal when extracting zip/tar archive
+      - G306 # Poor file permissions used when writing to a new file
+      - G307 # Poor file permissions used when creating a file with os.Create
+      #- G401 # Detect the usage of DES, RC4, MD5 or SHA1
+      #- G402 # Look for bad TLS connection settings
+      - G403 # Ensure minimum RSA key length of 2048 bits
+      #- G404 # Insecure random number source (rand)
+      #- G501 # Import blocklist: crypto/md5
+      - G502 # Import blocklist: crypto/des
+      - G503 # Import blocklist: crypto/rc4
+      - G504 # Import blocklist: net/http/cgi
+      #- G505 # Import blocklist: crypto/sha1
+      - G601 # Implicit memory aliasing of items from a range statement
+      - G602 # Slice access out of bounds
+
+  gocritic:
+    disabled-checks:
+      - commentFormatting
+      - captLocal
+      - deprecatedComment
+
+  govet:
+    # Enable all analyzers.
+    # Default: false
+    enable-all: false
+    enable:
+      - nilness
+
+  revive:
     rules:
-      - linters:
-          - forbidigo
-        path: management/cmd/root\.go
-      - linters:
-          - forbidigo
-        path: signal/cmd/root\.go
-      - linters:
-          - unused
-        path: sharedsock/filter\.go
-      - linters:
-          - unused
-        path: client/firewall/iptables/rule\.go
-      - linters:
-          - gosec
-          - mirror
-        path: test\.go
-      - linters:
-          - nilnil
-        path: mock\.go
-      - linters:
-          - staticcheck
-        text: grpc.DialContext is deprecated
-      - linters:
-          - staticcheck
-        text: grpc.WithBlock is deprecated
-      - linters:
-          - staticcheck
-        text: "QF1001"
-      - linters:
-          - staticcheck
-        text: "QF1008"
-      - linters:
-          - staticcheck
-        text: "QF1012"
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+      - name: exported
+        severity: warning
+        disabled: false
+        arguments:
+          - "checkPrivateReceivers"
+          - "sayRepetitiveInsteadOfStutters"
+  tenv:
+    # The option `all` will run against whole test files (`_test.go`) regardless of method/function signatures.
+    # Otherwise, only methods that take `*testing.T`, `*testing.B`, and `testing.TB` as arguments are checked.
+    # Default: false
+    all: true
+
+linters:
+  disable-all: true
+  enable:
+    ## enabled by default
+    - errcheck # checking for unchecked errors, these unchecked errors can be critical bugs in some cases
+    - gosimple # specializes in simplifying a code
+    - govet # reports suspicious constructs, such as Printf calls whose arguments do not align with the format string
+    - ineffassign # detects when assignments to existing variables are not used
+    - staticcheck # is a go vet on steroids, applying a ton of static analysis checks
+    - tenv # Tenv is analyzer that detects using os.Setenv instead of t.Setenv since Go1.17.
+    - typecheck # like the front-end of a Go compiler, parses and type-checks Go code
+    - unused # checks for unused constants, variables, functions and types
+    ## disable by default but the have interesting results so lets add them
+    - bodyclose # checks whether HTTP response body is closed successfully
+    - dupword # dupword checks for duplicate words in the source code
+    - durationcheck # durationcheck checks for two durations multiplied together
+    - forbidigo # forbidigo forbids identifiers
+    - gocritic # provides diagnostics that check for bugs, performance and style issues
+    - gosec # inspects source code for security problems
+    - mirror # mirror reports wrong mirror patterns of bytes/strings usage
+    - misspell # misspess finds commonly misspelled English words in comments
+    - nilerr # finds the code that returns nil even if it checks that the error is not nil
+    - nilnil # checks that there is no simultaneous return of nil error and an invalid value
+    - predeclared # predeclared finds code that shadows one of Go's predeclared identifiers
+    - revive # Fast, configurable, extensible, flexible, and beautiful linter for Go. Drop-in replacement of golint.
+    - sqlclosecheck # checks that sql.Rows and sql.Stmt are closed
+    # - thelper # thelper detects Go test helpers without t.Helper() call and checks the consistency of test helpers.
+    - wastedassign # wastedassign finds wasted assignment statements
 issues:
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
   max-same-issues: 5
-formatters:
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+
+  exclude-rules:
+    # allow fmt
+    - path: management/cmd/root\.go
+      linters: forbidigo
+    - path: signal/cmd/root\.go
+      linters: forbidigo
+    - path: sharedsock/filter\.go
+      linters:
+      - unused
+    - path: client/firewall/iptables/rule\.go
+      linters:
+      - unused
+    - path: test\.go
+      linters:
+      - mirror
+      - gosec
+    - path: mock\.go
+      linters:
+      - nilnil
+    # Exclude specific deprecation warnings for grpc methods
+    - linters:
+       - staticcheck
+      text: "grpc.DialContext is deprecated"
+    - linters:
+        - staticcheck
+      text: "grpc.WithBlock is deprecated"

.goreleaser.yaml

@@ -713,10 +713,8 @@ checksum:
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh
-    - glob: ./infrastructure_files/getting-started.sh
 
 release:
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh
-    - glob: ./infrastructure_files/getting-started.sh

README.md

@@ -38,11 +38,6 @@
  
 </strong>
 <br>
-<strong>
-  🚀 <a href="https://careers.netbird.io">We are hiring! Join us at careers.netbird.io</a>
-</strong>
-<br>
-<br>
 <a href="https://registry.terraform.io/providers/netbirdio/netbird/latest">
     New: NetBird terraform provider
   </a> 
@@ -90,7 +85,7 @@ Follow the [Advanced guide with a custom identity provider](https://docs.netbird
 
 **Infrastructure requirements:**
 - A Linux VM with at least **1CPU** and **2GB** of memory.
-- The VM should be publicly accessible on TCP ports **80** and **443** and UDP port: **3478**.
+- The VM should be publicly accessible on TCP ports **80** and **443** and UDP ports: **3478**, **49152-65535**.
 - **Public domain** name pointing to the VM.
 
 **Software requirements:**
@@ -103,7 +98,7 @@ Follow the [Advanced guide with a custom identity provider](https://docs.netbird
 **Steps**
 - Download and run the installation script:
 ```bash
-export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash
+export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started-with-zitadel.sh | bash
 ```
 - Once finished, you can manage the resources via `docker-compose`
 
@@ -118,7 +113,7 @@ export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbird
 [Coturn](https://github.com/coturn/coturn) is the one that has been successfully used for STUN and TURN in NetBird setups.
 
 <p float="left" align="middle">
-  <img src="https://docs.netbird.io/docs-static/img/about-netbird/high-level-dia.png" width="700"/>
+  <img src="https://docs.netbird.io/docs-static/img/architecture/high-level-dia.png" width="700"/>
 </p>
 
 See a complete [architecture overview](https://docs.netbird.io/about-netbird/how-netbird-works#architecture) for details.

client/Dockerfile

@@ -4,7 +4,7 @@
 #   sudo podman build -t localhost/netbird:latest -f client/Dockerfile --ignorefile .dockerignore-client .
 #   sudo podman run --rm -it --cap-add={BPF,NET_ADMIN,NET_RAW} localhost/netbird:latest
 
-FROM alpine:3.23.2
+FROM alpine:3.22.2
 # iproute2: busybox doesn't display ip rules properly
 RUN apk add --no-cache \
     bash \

client/android/client.go

@@ -59,6 +59,7 @@ func init() {
 
 // Client struct manage the life circle of background service
 type Client struct {
+	cfgFile               string
 	tunAdapter            device.TunAdapter
 	iFaceDiscover         IFaceDiscover
 	recorder              *peer.Status
@@ -67,16 +68,18 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
+	stateFile             string
 
 	connectClient *internal.ConnectClient
 }
 
 // NewClient instantiate a new Client
-func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAdapter TunAdapter, iFaceDiscover IFaceDiscover, networkChangeListener NetworkChangeListener) *Client {
+func NewClient(platformFiles PlatformFiles, androidSDKVersion int, deviceName string, uiVersion string, tunAdapter TunAdapter, iFaceDiscover IFaceDiscover, networkChangeListener NetworkChangeListener) *Client {
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
 	return &Client{
+		cfgFile:               platformFiles.ConfigurationFilePath(),
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
 		tunAdapter:            tunAdapter,
@@ -84,20 +87,15 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
+		stateFile:             platformFiles.StateFilePath(),
 	}
 }
 
 // Run start the internal client. It is a blocker function
-func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroidTV bool, dns *DNSList, dnsReadyListener DnsReadyListener, envList *EnvList) error {
+func (c *Client) Run(urlOpener URLOpener, isAndroidTV bool, dns *DNSList, dnsReadyListener DnsReadyListener, envList *EnvList) error {
 	exportEnvList(envList)
-
-	cfgFile := platformFiles.ConfigurationFilePath()
-	stateFile := platformFiles.StateFilePath()
-
-	log.Infof("Starting client with config: %s, state: %s", cfgFile, stateFile)
-
 	cfg, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
-		ConfigPath: cfgFile,
+		ConfigPath: c.cfgFile,
 	})
 	if err != nil {
 		return err
@@ -124,22 +122,16 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	c.connectClient = internal.NewConnectClient(ctx, cfg, c.recorder, false)
-	return c.connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile)
+	c.connectClient = internal.NewConnectClient(ctx, cfg, c.recorder)
+	return c.connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, c.stateFile)
 }
 
 // RunWithoutLogin we apply this type of run function when the backed has been started without UI (i.e. after reboot).
 // In this case make no sense handle registration steps.
-func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsReadyListener DnsReadyListener, envList *EnvList) error {
+func (c *Client) RunWithoutLogin(dns *DNSList, dnsReadyListener DnsReadyListener, envList *EnvList) error {
 	exportEnvList(envList)
-
-	cfgFile := platformFiles.ConfigurationFilePath()
-	stateFile := platformFiles.StateFilePath()
-
-	log.Infof("Starting client without login with config: %s, state: %s", cfgFile, stateFile)
-
 	cfg, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
-		ConfigPath: cfgFile,
+		ConfigPath: c.cfgFile,
 	})
 	if err != nil {
 		return err
@@ -157,8 +149,8 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	c.connectClient = internal.NewConnectClient(ctx, cfg, c.recorder, false)
-	return c.connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile)
+	c.connectClient = internal.NewConnectClient(ctx, cfg, c.recorder)
+	return c.connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, c.stateFile)
 }
 
 // Stop the internal client and free the resources

client/android/profile_manager.go

@@ -1,257 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// Android uses a single user context per app (non-empty username required by ServiceManager)
-	androidUsername = "android"
-)
-
-// Profile represents a profile for gomobile
-type Profile struct {
-	Name     string
-	IsActive bool
-}
-
-// ProfileArray wraps profiles for gomobile compatibility
-type ProfileArray struct {
-	items []*Profile
-}
-
-// Length returns the number of profiles
-func (p *ProfileArray) Length() int {
-	return len(p.items)
-}
-
-// Get returns the profile at index i
-func (p *ProfileArray) Get(i int) *Profile {
-	if i < 0 || i >= len(p.items) {
-		return nil
-	}
-	return p.items[i]
-}
-
-/*
-
-/data/data/io.netbird.client/files/           ← configDir parameter
-├── netbird.cfg                                 ← Default profile config
-├── state.json                                  ← Default profile state
-├── active_profile.json                         ← Active profile tracker (JSON with Name + Username)
-└── profiles/                                   ← Subdirectory for non-default profiles
-    ├── work.json                              ← Work profile config
-    ├── work.state.json                        ← Work profile state
-    ├── personal.json                          ← Personal profile config
-    └── personal.state.json                    ← Personal profile state
-*/
-
-// ProfileManager manages profiles for Android
-// It wraps the internal profilemanager to provide Android-specific behavior
-type ProfileManager struct {
-	configDir  string
-	serviceMgr *profilemanager.ServiceManager
-}
-
-// NewProfileManager creates a new profile manager for Android
-func NewProfileManager(configDir string) *ProfileManager {
-	// Set the default config path for Android (stored in root configDir, not profiles/)
-	defaultConfigPath := filepath.Join(configDir, defaultConfigFilename)
-
-	// Set global paths for Android
-	profilemanager.DefaultConfigPathDir = configDir
-	profilemanager.DefaultConfigPath = defaultConfigPath
-	profilemanager.ActiveProfileStatePath = filepath.Join(configDir, "active_profile.json")
-
-	// Create ServiceManager with profiles/ subdirectory
-	// This avoids modifying the global ConfigDirOverride for profile listing
-	profilesDir := filepath.Join(configDir, profilesSubdir)
-	serviceMgr := profilemanager.NewServiceManagerWithProfilesDir(defaultConfigPath, profilesDir)
-
-	return &ProfileManager{
-		configDir:  configDir,
-		serviceMgr: serviceMgr,
-	}
-}
-
-// ListProfiles returns all available profiles
-func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
-	// Use ServiceManager (looks in profiles/ directory, checks active_profile.json for IsActive)
-	internalProfiles, err := pm.serviceMgr.ListProfiles(androidUsername)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list profiles: %w", err)
-	}
-
-	// Convert internal profiles to Android Profile type
-	var profiles []*Profile
-	for _, p := range internalProfiles {
-		profiles = append(profiles, &Profile{
-			Name:     p.Name,
-			IsActive: p.IsActive,
-		})
-	}
-
-	return &ProfileArray{items: profiles}, nil
-}
-
-// GetActiveProfile returns the currently active profile name
-func (pm *ProfileManager) GetActiveProfile() (string, error) {
-	// Use ServiceManager to stay consistent with ListProfiles
-	// ServiceManager uses active_profile.json
-	activeState, err := pm.serviceMgr.GetActiveProfileState()
-	if err != nil {
-		return "", fmt.Errorf("failed to get active profile: %w", err)
-	}
-	return activeState.Name, nil
-}
-
-// SwitchProfile switches to a different profile
-func (pm *ProfileManager) SwitchProfile(profileName string) error {
-	// Use ServiceManager to stay consistent with ListProfiles
-	// ServiceManager uses active_profile.json
-	err := pm.serviceMgr.SetActiveProfileState(&profilemanager.ActiveProfileState{
-		Name:     profileName,
-		Username: androidUsername,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to switch profile: %w", err)
-	}
-
-	log.Infof("switched to profile: %s", profileName)
-	return nil
-}
-
-// AddProfile creates a new profile
-func (pm *ProfileManager) AddProfile(profileName string) error {
-	// Use ServiceManager (creates profile in profiles/ directory)
-	if err := pm.serviceMgr.AddProfile(profileName, androidUsername); err != nil {
-		return fmt.Errorf("failed to add profile: %w", err)
-	}
-
-	log.Infof("created new profile: %s", profileName)
-	return nil
-}
-
-// LogoutProfile logs out from a profile (clears authentication)
-func (pm *ProfileManager) LogoutProfile(profileName string) error {
-	profileName = sanitizeProfileName(profileName)
-
-	configPath, err := pm.getProfileConfigPath(profileName)
-	if err != nil {
-		return err
-	}
-
-	// Check if profile exists
-	if _, err := os.Stat(configPath); os.IsNotExist(err) {
-		return fmt.Errorf("profile '%s' does not exist", profileName)
-	}
-
-	// Read current config using internal profilemanager
-	config, err := profilemanager.ReadConfig(configPath)
-	if err != nil {
-		return fmt.Errorf("failed to read profile config: %w", err)
-	}
-
-	// Clear authentication by removing private key and SSH key
-	config.PrivateKey = ""
-	config.SSHKey = ""
-
-	// Save config using internal profilemanager
-	if err := profilemanager.WriteOutConfig(configPath, config); err != nil {
-		return fmt.Errorf("failed to save config: %w", err)
-	}
-
-	log.Infof("logged out from profile: %s", profileName)
-	return nil
-}
-
-// RemoveProfile deletes a profile
-func (pm *ProfileManager) RemoveProfile(profileName string) error {
-	// Use ServiceManager (removes profile from profiles/ directory)
-	if err := pm.serviceMgr.RemoveProfile(profileName, androidUsername); err != nil {
-		return fmt.Errorf("failed to remove profile: %w", err)
-	}
-
-	log.Infof("removed profile: %s", profileName)
-	return nil
-}
-
-// getProfileConfigPath returns the config file path for a profile
-// This is needed for Android-specific path handling (netbird.cfg for default profile)
-func (pm *ProfileManager) getProfileConfigPath(profileName string) (string, error) {
-	if profileName == "" || profileName == profilemanager.DefaultProfileName {
-		// Android uses netbird.cfg for default profile instead of default.json
-		// Default profile is stored in root configDir, not in profiles/
-		return filepath.Join(pm.configDir, defaultConfigFilename), nil
-	}
-
-	// Non-default profiles are stored in profiles subdirectory
-	// This matches the Java Preferences.java expectation
-	profileName = sanitizeProfileName(profileName)
-	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
-	return filepath.Join(profilesDir, profileName+".json"), nil
-}
-
-// GetConfigPath returns the config file path for a given profile
-// Java should call this instead of constructing paths with Preferences.configFile()
-func (pm *ProfileManager) GetConfigPath(profileName string) (string, error) {
-	return pm.getProfileConfigPath(profileName)
-}
-
-// GetStateFilePath returns the state file path for a given profile
-// Java should call this instead of constructing paths with Preferences.stateFile()
-func (pm *ProfileManager) GetStateFilePath(profileName string) (string, error) {
-	if profileName == "" || profileName == profilemanager.DefaultProfileName {
-		return filepath.Join(pm.configDir, "state.json"), nil
-	}
-
-	profileName = sanitizeProfileName(profileName)
-	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
-	return filepath.Join(profilesDir, profileName+".state.json"), nil
-}
-
-// GetActiveConfigPath returns the config file path for the currently active profile
-// Java should call this instead of Preferences.getActiveProfileName() + Preferences.configFile()
-func (pm *ProfileManager) GetActiveConfigPath() (string, error) {
-	activeProfile, err := pm.GetActiveProfile()
-	if err != nil {
-		return "", fmt.Errorf("failed to get active profile: %w", err)
-	}
-	return pm.GetConfigPath(activeProfile)
-}
-
-// GetActiveStateFilePath returns the state file path for the currently active profile
-// Java should call this instead of Preferences.getActiveProfileName() + Preferences.stateFile()
-func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
-	activeProfile, err := pm.GetActiveProfile()
-	if err != nil {
-		return "", fmt.Errorf("failed to get active profile: %w", err)
-	}
-	return pm.GetStateFilePath(activeProfile)
-}
-
-// sanitizeProfileName removes invalid characters from profile name
-func sanitizeProfileName(name string) string {
-	// Keep only alphanumeric, underscore, and hyphen
-	var result strings.Builder
-	for _, r := range name {
-		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') ||
-			(r >= '0' && r <= '9') || r == '_' || r == '-' {
-			result.WriteRune(r)
-		}
-	}
-	return result.String()
-}

client/cmd/debug.go

@@ -16,6 +16,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
+	nbstatus "github.com/netbirdio/netbird/client/status"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/upload-server/types"
 )
@@ -97,6 +98,7 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 	client := proto.NewDaemonServiceClient(conn)
 	request := &proto.DebugBundleRequest{
 		Anonymize:    anonymizeFlag,
+		Status:       getStatusOutput(cmd, anonymizeFlag),
 		SystemInfo:   systemInfoFlag,
 		LogFileCount: logFileCount,
 	}
@@ -134,7 +136,6 @@ func setLogLevel(cmd *cobra.Command, args []string) error {
 	client := proto.NewDaemonServiceClient(conn)
 	level := server.ParseLogLevel(args[0])
 	if level == proto.LogLevel_UNKNOWN {
-		//nolint
 		return fmt.Errorf("unknown log level: %s. Available levels are: panic, fatal, error, warn, info, debug, trace\n", args[0])
 	}
 
@@ -219,37 +220,21 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 
 	time.Sleep(3 * time.Second)
 
-	cpuProfilingStarted := false
-	if _, err := client.StartCPUProfile(cmd.Context(), &proto.StartCPUProfileRequest{}); err != nil {
-		cmd.PrintErrf("Failed to start CPU profiling: %v\n", err)
-	} else {
-		cpuProfilingStarted = true
-		defer func() {
-			if cpuProfilingStarted {
-				if _, err := client.StopCPUProfile(cmd.Context(), &proto.StopCPUProfileRequest{}); err != nil {
-					cmd.PrintErrf("Failed to stop CPU profiling: %v\n", err)
-				}
-			}
-		}()
-	}
+	headerPostUp := fmt.Sprintf("----- NetBird post-up - Timestamp: %s", time.Now().Format(time.RFC3339))
+	statusOutput := fmt.Sprintf("%s\n%s", headerPostUp, getStatusOutput(cmd, anonymizeFlag))
 
 	if waitErr := waitForDurationOrCancel(cmd.Context(), duration, cmd); waitErr != nil {
 		return waitErr
 	}
 	cmd.Println("\nDuration completed")
 
-	if cpuProfilingStarted {
-		if _, err := client.StopCPUProfile(cmd.Context(), &proto.StopCPUProfileRequest{}); err != nil {
-			cmd.PrintErrf("Failed to stop CPU profiling: %v\n", err)
-		} else {
-			cpuProfilingStarted = false
-		}
-	}
-
 	cmd.Println("Creating debug bundle...")
 
+	headerPreDown := fmt.Sprintf("----- NetBird pre-down - Timestamp: %s - Duration: %s", time.Now().Format(time.RFC3339), duration)
+	statusOutput = fmt.Sprintf("%s\n%s\n%s", statusOutput, headerPreDown, getStatusOutput(cmd, anonymizeFlag))
 	request := &proto.DebugBundleRequest{
 		Anonymize:    anonymizeFlag,
+		Status:       statusOutput,
 		SystemInfo:   systemInfoFlag,
 		LogFileCount: logFileCount,
 	}
@@ -316,6 +301,25 @@ func setSyncResponsePersistence(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+func getStatusOutput(cmd *cobra.Command, anon bool) string {
+	var statusOutputString string
+	statusResp, err := getStatus(cmd.Context(), true)
+	if err != nil {
+		cmd.PrintErrf("Failed to get status: %v\n", err)
+	} else {
+		pm := profilemanager.NewProfileManager()
+		var profName string
+		if activeProf, err := pm.GetActiveProfile(); err == nil {
+			profName = activeProf.Name
+		}
+
+		statusOutputString = nbstatus.ParseToFullDetailSummary(
+			nbstatus.ConvertToStatusOutputOverview(statusResp, anon, "", nil, nil, nil, "", profName),
+		)
+	}
+	return statusOutputString
+}
+
 func waitForDurationOrCancel(ctx context.Context, duration time.Duration, cmd *cobra.Command) error {
 	ticker := time.NewTicker(1 * time.Second)
 	defer ticker.Stop()
@@ -374,8 +378,7 @@ func generateDebugBundle(config *profilemanager.Config, recorder *peer.Status, c
 			InternalConfig: config,
 			StatusRecorder: recorder,
 			SyncResponse:   syncResponse,
-			LogPath:        logFilePath,
-			CPUProfile:     nil,
+			LogFile:        logFilePath,
 		},
 		debug.BundleConfig{
 			IncludeSystemInfo: true,

client/cmd/login.go

@@ -81,7 +81,6 @@ var loginCmd = &cobra.Command{
 func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey string, activeProf *profilemanager.Profile, username string, pm *profilemanager.ProfileManager) error {
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
-		//nolint
 		return fmt.Errorf("failed to connect to daemon error: %v\n"+
 			"If the daemon is not running please run: "+
 			"\nnetbird service install \nnetbird service start\n", err)
@@ -207,7 +206,6 @@ func switchProfileOnDaemon(ctx context.Context, pm *profilemanager.ProfileManage
 func switchProfile(ctx context.Context, profileName string, username string) error {
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
-		//nolint
 		return fmt.Errorf("failed to connect to daemon error: %v\n"+
 			"If the daemon is not running please run: "+
 			"\nnetbird service install \nnetbird service start\n", err)

client/cmd/pprof.go

@@ -1,4 +1,5 @@
 //go:build pprof
+// +build pprof
 
 package cmd
 

client/cmd/root.go

@@ -85,9 +85,6 @@ var (
 
 // Execute executes the root command.
 func Execute() error {
-	if isUpdateBinary() {
-		return updateCmd.Execute()
-	}
 	return rootCmd.Execute()
 }
 
@@ -390,7 +387,6 @@ func getClient(cmd *cobra.Command) (*grpc.ClientConn, error) {
 
 	conn, err := DialClientGRPCServer(cmd.Context(), daemonAddr)
 	if err != nil {
-		//nolint
 		return nil, fmt.Errorf("failed to connect to daemon error: %v\n"+
 			"If the daemon is not running please run: "+
 			"\nnetbird service install \nnetbird service start\n", err)

client/cmd/signer/artifactkey.go

@@ -1,176 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/client/internal/updatemanager/reposign"
-)
-
-var (
-	bundlePubKeysRootPrivKeyFile string
-	bundlePubKeysPubKeyFiles     []string
-	bundlePubKeysFile            string
-
-	createArtifactKeyRootPrivKeyFile string
-	createArtifactKeyPrivKeyFile     string
-	createArtifactKeyPubKeyFile      string
-	createArtifactKeyExpiration      time.Duration
-)
-
-var createArtifactKeyCmd = &cobra.Command{
-	Use:   "create-artifact-key",
-	Short: "Create a new artifact signing key",
-	Long: `Generate a new artifact signing key pair signed by the root private key.
-The artifact key will be used to sign software artifacts/updates.`,
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if createArtifactKeyExpiration <= 0 {
-			return fmt.Errorf("--expiration must be a positive duration (e.g., 720h, 365d, 8760h)")
-		}
-
-		if err := handleCreateArtifactKey(cmd, createArtifactKeyRootPrivKeyFile, createArtifactKeyPrivKeyFile, createArtifactKeyPubKeyFile, createArtifactKeyExpiration); err != nil {
-			return fmt.Errorf("failed to create artifact key: %w", err)
-		}
-		return nil
-	},
-}
-
-var bundlePubKeysCmd = &cobra.Command{
-	Use:   "bundle-pub-keys",
-	Short: "Bundle multiple artifact public keys into a signed package",
-	Long: `Bundle one or more artifact public keys into a signed package using the root private key.
-This command is typically used to distribute or authorize a set of valid artifact signing keys.`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if len(bundlePubKeysPubKeyFiles) == 0 {
-			return fmt.Errorf("at least one --artifact-pub-key-file must be provided")
-		}
-
-		if err := handleBundlePubKeys(cmd, bundlePubKeysRootPrivKeyFile, bundlePubKeysPubKeyFiles, bundlePubKeysFile); err != nil {
-			return fmt.Errorf("failed to bundle public keys: %w", err)
-		}
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(createArtifactKeyCmd)
-
-	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyRootPrivKeyFile, "root-private-key-file", "", "Path to the root private key file used to sign the artifact key")
-	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPrivKeyFile, "artifact-priv-key-file", "", "Path where the artifact private key will be saved")
-	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPubKeyFile, "artifact-pub-key-file", "", "Path where the artifact public key will be saved")
-	createArtifactKeyCmd.Flags().DurationVar(&createArtifactKeyExpiration, "expiration", 0, "Expiration duration for the artifact key (e.g., 720h, 365d, 8760h)")
-
-	if err := createArtifactKeyCmd.MarkFlagRequired("root-private-key-file"); err != nil {
-		panic(fmt.Errorf("mark root-private-key-file as required: %w", err))
-	}
-	if err := createArtifactKeyCmd.MarkFlagRequired("artifact-priv-key-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-priv-key-file as required: %w", err))
-	}
-	if err := createArtifactKeyCmd.MarkFlagRequired("artifact-pub-key-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-pub-key-file as required: %w", err))
-	}
-	if err := createArtifactKeyCmd.MarkFlagRequired("expiration"); err != nil {
-		panic(fmt.Errorf("mark expiration as required: %w", err))
-	}
-
-	rootCmd.AddCommand(bundlePubKeysCmd)
-
-	bundlePubKeysCmd.Flags().StringVar(&bundlePubKeysRootPrivKeyFile, "root-private-key-file", "", "Path to the root private key file used to sign the bundle")
-	bundlePubKeysCmd.Flags().StringArrayVar(&bundlePubKeysPubKeyFiles, "artifact-pub-key-file", nil, "Path(s) to the artifact public key files to include in the bundle (can be repeated)")
-	bundlePubKeysCmd.Flags().StringVar(&bundlePubKeysFile, "bundle-pub-key-file", "", "Path where the public keys will be saved")
-
-	if err := bundlePubKeysCmd.MarkFlagRequired("root-private-key-file"); err != nil {
-		panic(fmt.Errorf("mark root-private-key-file as required: %w", err))
-	}
-	if err := bundlePubKeysCmd.MarkFlagRequired("artifact-pub-key-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-pub-key-file as required: %w", err))
-	}
-	if err := bundlePubKeysCmd.MarkFlagRequired("bundle-pub-key-file"); err != nil {
-		panic(fmt.Errorf("mark bundle-pub-key-file as required: %w", err))
-	}
-}
-
-func handleCreateArtifactKey(cmd *cobra.Command, rootPrivKeyFile, artifactPrivKeyFile, artifactPubKeyFile string, expiration time.Duration) error {
-	cmd.Println("Creating new artifact signing key...")
-
-	privKeyPEM, err := os.ReadFile(rootPrivKeyFile)
-	if err != nil {
-		return fmt.Errorf("read root private key file: %w", err)
-	}
-
-	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse private root key: %w", err)
-	}
-
-	artifactKey, privPEM, pubPEM, signature, err := reposign.GenerateArtifactKey(privateRootKey, expiration)
-	if err != nil {
-		return fmt.Errorf("generate artifact key: %w", err)
-	}
-
-	if err := os.WriteFile(artifactPrivKeyFile, privPEM, 0o600); err != nil {
-		return fmt.Errorf("write private key file (%s): %w", artifactPrivKeyFile, err)
-	}
-
-	if err := os.WriteFile(artifactPubKeyFile, pubPEM, 0o600); err != nil {
-		return fmt.Errorf("write public key file (%s): %w", artifactPubKeyFile, err)
-	}
-
-	signatureFile := artifactPubKeyFile + ".sig"
-	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
-		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
-	}
-
-	cmd.Printf("✅ Artifact key created successfully.\n")
-	cmd.Printf("%s\n", artifactKey.String())
-	return nil
-}
-
-func handleBundlePubKeys(cmd *cobra.Command, rootPrivKeyFile string, artifactPubKeyFiles []string, bundlePubKeysFile string) error {
-	cmd.Println("📦 Bundling public keys into signed package...")
-
-	privKeyPEM, err := os.ReadFile(rootPrivKeyFile)
-	if err != nil {
-		return fmt.Errorf("read root private key file: %w", err)
-	}
-
-	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse private root key: %w", err)
-	}
-
-	publicKeys := make([]reposign.PublicKey, 0, len(artifactPubKeyFiles))
-	for _, pubFile := range artifactPubKeyFiles {
-		pubPem, err := os.ReadFile(pubFile)
-		if err != nil {
-			return fmt.Errorf("read public key file: %w", err)
-		}
-
-		pk, err := reposign.ParseArtifactPubKey(pubPem)
-		if err != nil {
-			return fmt.Errorf("failed to parse artifact key: %w", err)
-		}
-		publicKeys = append(publicKeys, pk)
-	}
-
-	parsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)
-	if err != nil {
-		return fmt.Errorf("bundle artifact keys: %w", err)
-	}
-
-	if err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {
-		return fmt.Errorf("write public keys file (%s): %w", bundlePubKeysFile, err)
-	}
-
-	signatureFile := bundlePubKeysFile + ".sig"
-	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
-		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
-	}
-
-	cmd.Printf("✅ Bundle created with %d public keys.\n", len(artifactPubKeyFiles))
-	return nil
-}

client/cmd/signer/artifactsign.go

@@ -1,276 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/client/internal/updatemanager/reposign"
-)
-
-const (
-	envArtifactPrivateKey = "NB_ARTIFACT_PRIV_KEY"
-)
-
-var (
-	signArtifactPrivKeyFile  string
-	signArtifactArtifactFile string
-
-	verifyArtifactPubKeyFile    string
-	verifyArtifactFile          string
-	verifyArtifactSignatureFile string
-
-	verifyArtifactKeyPubKeyFile     string
-	verifyArtifactKeyRootPubKeyFile string
-	verifyArtifactKeySignatureFile  string
-	verifyArtifactKeyRevocationFile string
-)
-
-var signArtifactCmd = &cobra.Command{
-	Use:   "sign-artifact",
-	Short: "Sign an artifact using an artifact private key",
-	Long: `Sign a software artifact (e.g., update bundle or binary) using the artifact's private key.
-This command produces a detached signature that can be verified using the corresponding artifact public key.`,
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := handleSignArtifact(cmd, signArtifactPrivKeyFile, signArtifactArtifactFile); err != nil {
-			return fmt.Errorf("failed to sign artifact: %w", err)
-		}
-		return nil
-	},
-}
-
-var verifyArtifactCmd = &cobra.Command{
-	Use:          "verify-artifact",
-	Short:        "Verify an artifact signature using an artifact public key",
-	Long:         `Verify a software artifact signature using the artifact's public key.`,
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := handleVerifyArtifact(cmd, verifyArtifactPubKeyFile, verifyArtifactFile, verifyArtifactSignatureFile); err != nil {
-			return fmt.Errorf("failed to verify artifact: %w", err)
-		}
-		return nil
-	},
-}
-
-var verifyArtifactKeyCmd = &cobra.Command{
-	Use:   "verify-artifact-key",
-	Short: "Verify an artifact public key was signed by a root key",
-	Long: `Verify that an artifact public key (or bundle) was properly signed by a root key.
-This validates the chain of trust from the root key to the artifact key.`,
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := handleVerifyArtifactKey(cmd, verifyArtifactKeyPubKeyFile, verifyArtifactKeyRootPubKeyFile, verifyArtifactKeySignatureFile, verifyArtifactKeyRevocationFile); err != nil {
-			return fmt.Errorf("failed to verify artifact key: %w", err)
-		}
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(signArtifactCmd)
-	rootCmd.AddCommand(verifyArtifactCmd)
-	rootCmd.AddCommand(verifyArtifactKeyCmd)
-
-	signArtifactCmd.Flags().StringVar(&signArtifactPrivKeyFile, "artifact-key-file", "", fmt.Sprintf("Path to the artifact private key file used for signing (or set %s env var)", envArtifactPrivateKey))
-	signArtifactCmd.Flags().StringVar(&signArtifactArtifactFile, "artifact-file", "", "Path to the artifact to be signed")
-
-	// artifact-file is required, but artifact-key-file can come from env var
-	if err := signArtifactCmd.MarkFlagRequired("artifact-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-file as required: %w", err))
-	}
-
-	verifyArtifactCmd.Flags().StringVar(&verifyArtifactPubKeyFile, "artifact-public-key-file", "", "Path to the artifact public key file")
-	verifyArtifactCmd.Flags().StringVar(&verifyArtifactFile, "artifact-file", "", "Path to the artifact to be verified")
-	verifyArtifactCmd.Flags().StringVar(&verifyArtifactSignatureFile, "signature-file", "", "Path to the signature file")
-
-	if err := verifyArtifactCmd.MarkFlagRequired("artifact-public-key-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-public-key-file as required: %w", err))
-	}
-	if err := verifyArtifactCmd.MarkFlagRequired("artifact-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-file as required: %w", err))
-	}
-	if err := verifyArtifactCmd.MarkFlagRequired("signature-file"); err != nil {
-		panic(fmt.Errorf("mark signature-file as required: %w", err))
-	}
-
-	verifyArtifactKeyCmd.Flags().StringVar(&verifyArtifactKeyPubKeyFile, "artifact-key-file", "", "Path to the artifact public key file or bundle")
-	verifyArtifactKeyCmd.Flags().StringVar(&verifyArtifactKeyRootPubKeyFile, "root-key-file", "", "Path to the root public key file or bundle")
-	verifyArtifactKeyCmd.Flags().StringVar(&verifyArtifactKeySignatureFile, "signature-file", "", "Path to the signature file")
-	verifyArtifactKeyCmd.Flags().StringVar(&verifyArtifactKeyRevocationFile, "revocation-file", "", "Path to the revocation list file (optional)")
-
-	if err := verifyArtifactKeyCmd.MarkFlagRequired("artifact-key-file"); err != nil {
-		panic(fmt.Errorf("mark artifact-key-file as required: %w", err))
-	}
-	if err := verifyArtifactKeyCmd.MarkFlagRequired("root-key-file"); err != nil {
-		panic(fmt.Errorf("mark root-key-file as required: %w", err))
-	}
-	if err := verifyArtifactKeyCmd.MarkFlagRequired("signature-file"); err != nil {
-		panic(fmt.Errorf("mark signature-file as required: %w", err))
-	}
-}
-
-func handleSignArtifact(cmd *cobra.Command, privKeyFile, artifactFile string) error {
-	cmd.Println("🖋️  Signing artifact...")
-
-	// Load private key from env var or file
-	var privKeyPEM []byte
-	var err error
-
-	if envKey := os.Getenv(envArtifactPrivateKey); envKey != "" {
-		// Use key from environment variable
-		privKeyPEM = []byte(envKey)
-	} else if privKeyFile != "" {
-		// Fall back to file
-		privKeyPEM, err = os.ReadFile(privKeyFile)
-		if err != nil {
-			return fmt.Errorf("read private key file: %w", err)
-		}
-	} else {
-		return fmt.Errorf("artifact private key must be provided via %s environment variable or --artifact-key-file flag", envArtifactPrivateKey)
-	}
-
-	privateKey, err := reposign.ParseArtifactKey(privKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse artifact private key: %w", err)
-	}
-
-	artifactData, err := os.ReadFile(artifactFile)
-	if err != nil {
-		return fmt.Errorf("read artifact file: %w", err)
-	}
-
-	signature, err := reposign.SignData(privateKey, artifactData)
-	if err != nil {
-		return fmt.Errorf("sign artifact: %w", err)
-	}
-
-	sigFile := artifactFile + ".sig"
-	if err := os.WriteFile(artifactFile+".sig", signature, 0o600); err != nil {
-		return fmt.Errorf("write signature file (%s): %w", sigFile, err)
-	}
-
-	cmd.Printf("✅ Artifact signed successfully.\n")
-	cmd.Printf("Signature file: %s\n", sigFile)
-	return nil
-}
-
-func handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {
-	cmd.Println("🔍 Verifying artifact...")
-
-	// Read artifact public key
-	pubKeyPEM, err := os.ReadFile(pubKeyFile)
-	if err != nil {
-		return fmt.Errorf("read public key file: %w", err)
-	}
-
-	publicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse artifact public key: %w", err)
-	}
-
-	// Read artifact data
-	artifactData, err := os.ReadFile(artifactFile)
-	if err != nil {
-		return fmt.Errorf("read artifact file: %w", err)
-	}
-
-	// Read signature
-	sigBytes, err := os.ReadFile(signatureFile)
-	if err != nil {
-		return fmt.Errorf("read signature file: %w", err)
-	}
-
-	signature, err := reposign.ParseSignature(sigBytes)
-	if err != nil {
-		return fmt.Errorf("failed to parse signature: %w", err)
-	}
-
-	// Validate artifact
-	if err := reposign.ValidateArtifact([]reposign.PublicKey{publicKey}, artifactData, *signature); err != nil {
-		return fmt.Errorf("artifact verification failed: %w", err)
-	}
-
-	cmd.Println("✅ Artifact signature is valid")
-	cmd.Printf("Artifact: %s\n", artifactFile)
-	cmd.Printf("Signed by key: %s\n", signature.KeyID)
-	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
-	return nil
-}
-
-func handleVerifyArtifactKey(cmd *cobra.Command, artifactKeyFile, rootKeyFile, signatureFile, revocationFile string) error {
-	cmd.Println("🔍 Verifying artifact key...")
-
-	// Read artifact key data
-	artifactKeyData, err := os.ReadFile(artifactKeyFile)
-	if err != nil {
-		return fmt.Errorf("read artifact key file: %w", err)
-	}
-
-	// Read root public key(s)
-	rootKeyData, err := os.ReadFile(rootKeyFile)
-	if err != nil {
-		return fmt.Errorf("read root key file: %w", err)
-	}
-
-	rootPublicKeys, err := parseRootPublicKeys(rootKeyData)
-	if err != nil {
-		return fmt.Errorf("failed to parse root public key(s): %w", err)
-	}
-
-	// Read signature
-	sigBytes, err := os.ReadFile(signatureFile)
-	if err != nil {
-		return fmt.Errorf("read signature file: %w", err)
-	}
-
-	signature, err := reposign.ParseSignature(sigBytes)
-	if err != nil {
-		return fmt.Errorf("failed to parse signature: %w", err)
-	}
-
-	// Read optional revocation list
-	var revocationList *reposign.RevocationList
-	if revocationFile != "" {
-		revData, err := os.ReadFile(revocationFile)
-		if err != nil {
-			return fmt.Errorf("read revocation file: %w", err)
-		}
-
-		revocationList, err = reposign.ParseRevocationList(revData)
-		if err != nil {
-			return fmt.Errorf("failed to parse revocation list: %w", err)
-		}
-	}
-
-	// Validate artifact key(s)
-	validKeys, err := reposign.ValidateArtifactKeys(rootPublicKeys, artifactKeyData, *signature, revocationList)
-	if err != nil {
-		return fmt.Errorf("artifact key verification failed: %w", err)
-	}
-
-	cmd.Println("✅ Artifact key(s) verified successfully")
-	cmd.Printf("Signed by root key: %s\n", signature.KeyID)
-	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
-	cmd.Printf("\nValid artifact keys (%d):\n", len(validKeys))
-	for i, key := range validKeys {
-		cmd.Printf("  [%d] Key ID: %s\n", i+1, key.Metadata.ID)
-		cmd.Printf("      Created: %s\n", key.Metadata.CreatedAt.Format("2006-01-02 15:04:05 MST"))
-		if !key.Metadata.ExpiresAt.IsZero() {
-			cmd.Printf("      Expires: %s\n", key.Metadata.ExpiresAt.Format("2006-01-02 15:04:05 MST"))
-		} else {
-			cmd.Printf("      Expires: Never\n")
-		}
-	}
-	return nil
-}
-
-// parseRootPublicKeys parses a root public key from PEM data
-func parseRootPublicKeys(data []byte) ([]reposign.PublicKey, error) {
-	key, err := reposign.ParseRootPublicKey(data)
-	if err != nil {
-		return nil, err
-	}
-	return []reposign.PublicKey{key}, nil
-}

client/cmd/signer/main.go

@@ -1,21 +0,0 @@
-package main
-
-import (
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-var rootCmd = &cobra.Command{
-	Use:   "signer",
-	Short: "A CLI tool for managing cryptographic keys and artifacts",
-	Long: `signer is a command-line tool that helps you manage
-root keys, artifact keys, and revocation lists securely.`,
-}
-
-func main() {
-	if err := rootCmd.Execute(); err != nil {
-		rootCmd.Println(err)
-		os.Exit(1)
-	}
-}

client/cmd/signer/revocation.go

@@ -1,220 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/client/internal/updatemanager/reposign"
-)
-
-const (
-	defaultRevocationListExpiration = 365 * 24 * time.Hour // 1 year
-)
-
-var (
-	keyID              string
-	revocationListFile string
-	privateRootKeyFile string
-	publicRootKeyFile  string
-	signatureFile      string
-	expirationDuration time.Duration
-)
-
-var createRevocationListCmd = &cobra.Command{
-	Use:          "create-revocation-list",
-	Short:        "Create a new revocation list signed by the private root key",
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return handleCreateRevocationList(cmd, revocationListFile, privateRootKeyFile)
-	},
-}
-
-var extendRevocationListCmd = &cobra.Command{
-	Use:          "extend-revocation-list",
-	Short:        "Extend an existing revocation list with a given key ID",
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return handleExtendRevocationList(cmd, keyID, revocationListFile, privateRootKeyFile)
-	},
-}
-
-var verifyRevocationListCmd = &cobra.Command{
-	Use:          "verify-revocation-list",
-	Short:        "Verify a revocation list signature using the public root key",
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return handleVerifyRevocationList(cmd, revocationListFile, signatureFile, publicRootKeyFile)
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(createRevocationListCmd)
-	rootCmd.AddCommand(extendRevocationListCmd)
-	rootCmd.AddCommand(verifyRevocationListCmd)
-
-	createRevocationListCmd.Flags().StringVar(&revocationListFile, "revocation-list-file", "", "Path to the existing revocation list file")
-	createRevocationListCmd.Flags().StringVar(&privateRootKeyFile, "private-root-key", "", "Path to the private root key PEM file")
-	createRevocationListCmd.Flags().DurationVar(&expirationDuration, "expiration", defaultRevocationListExpiration, "Expiration duration for the revocation list (e.g., 8760h for 1 year)")
-	if err := createRevocationListCmd.MarkFlagRequired("revocation-list-file"); err != nil {
-		panic(err)
-	}
-	if err := createRevocationListCmd.MarkFlagRequired("private-root-key"); err != nil {
-		panic(err)
-	}
-
-	extendRevocationListCmd.Flags().StringVar(&keyID, "key-id", "", "ID of the key to extend the revocation list for")
-	extendRevocationListCmd.Flags().StringVar(&revocationListFile, "revocation-list-file", "", "Path to the existing revocation list file")
-	extendRevocationListCmd.Flags().StringVar(&privateRootKeyFile, "private-root-key", "", "Path to the private root key PEM file")
-	extendRevocationListCmd.Flags().DurationVar(&expirationDuration, "expiration", defaultRevocationListExpiration, "Expiration duration for the revocation list (e.g., 8760h for 1 year)")
-	if err := extendRevocationListCmd.MarkFlagRequired("key-id"); err != nil {
-		panic(err)
-	}
-	if err := extendRevocationListCmd.MarkFlagRequired("revocation-list-file"); err != nil {
-		panic(err)
-	}
-	if err := extendRevocationListCmd.MarkFlagRequired("private-root-key"); err != nil {
-		panic(err)
-	}
-
-	verifyRevocationListCmd.Flags().StringVar(&revocationListFile, "revocation-list-file", "", "Path to the revocation list file")
-	verifyRevocationListCmd.Flags().StringVar(&signatureFile, "signature-file", "", "Path to the signature file")
-	verifyRevocationListCmd.Flags().StringVar(&publicRootKeyFile, "public-root-key", "", "Path to the public root key PEM file")
-	if err := verifyRevocationListCmd.MarkFlagRequired("revocation-list-file"); err != nil {
-		panic(err)
-	}
-	if err := verifyRevocationListCmd.MarkFlagRequired("signature-file"); err != nil {
-		panic(err)
-	}
-	if err := verifyRevocationListCmd.MarkFlagRequired("public-root-key"); err != nil {
-		panic(err)
-	}
-}
-
-func handleCreateRevocationList(cmd *cobra.Command, revocationListFile string, privateRootKeyFile string) error {
-	privKeyPEM, err := os.ReadFile(privateRootKeyFile)
-	if err != nil {
-		return fmt.Errorf("failed to read private root key file: %w", err)
-	}
-
-	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse private root key: %w", err)
-	}
-
-	rlBytes, sigBytes, err := reposign.CreateRevocationList(*privateRootKey, expirationDuration)
-	if err != nil {
-		return fmt.Errorf("failed to create revocation list: %w", err)
-	}
-
-	if err := writeOutputFiles(revocationListFile, revocationListFile+".sig", rlBytes, sigBytes); err != nil {
-		return fmt.Errorf("failed to write output files: %w", err)
-	}
-
-	cmd.Println("✅ Revocation list created successfully")
-	return nil
-}
-
-func handleExtendRevocationList(cmd *cobra.Command, keyID, revocationListFile, privateRootKeyFile string) error {
-	privKeyPEM, err := os.ReadFile(privateRootKeyFile)
-	if err != nil {
-		return fmt.Errorf("failed to read private root key file: %w", err)
-	}
-
-	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse private root key: %w", err)
-	}
-
-	rlBytes, err := os.ReadFile(revocationListFile)
-	if err != nil {
-		return fmt.Errorf("failed to read revocation list file: %w", err)
-	}
-
-	rl, err := reposign.ParseRevocationList(rlBytes)
-	if err != nil {
-		return fmt.Errorf("failed to parse revocation list: %w", err)
-	}
-
-	kid, err := reposign.ParseKeyID(keyID)
-	if err != nil {
-		return fmt.Errorf("invalid key ID: %w", err)
-	}
-
-	newRLBytes, sigBytes, err := reposign.ExtendRevocationList(*privateRootKey, *rl, kid, expirationDuration)
-	if err != nil {
-		return fmt.Errorf("failed to extend revocation list: %w", err)
-	}
-
-	if err := writeOutputFiles(revocationListFile, revocationListFile+".sig", newRLBytes, sigBytes); err != nil {
-		return fmt.Errorf("failed to write output files: %w", err)
-	}
-
-	cmd.Println("✅ Revocation list extended successfully")
-	return nil
-}
-
-func handleVerifyRevocationList(cmd *cobra.Command, revocationListFile, signatureFile, publicRootKeyFile string) error {
-	// Read revocation list file
-	rlBytes, err := os.ReadFile(revocationListFile)
-	if err != nil {
-		return fmt.Errorf("failed to read revocation list file: %w", err)
-	}
-
-	// Read signature file
-	sigBytes, err := os.ReadFile(signatureFile)
-	if err != nil {
-		return fmt.Errorf("failed to read signature file: %w", err)
-	}
-
-	// Read public root key file
-	pubKeyPEM, err := os.ReadFile(publicRootKeyFile)
-	if err != nil {
-		return fmt.Errorf("failed to read public root key file: %w", err)
-	}
-
-	// Parse public root key
-	publicKey, err := reposign.ParseRootPublicKey(pubKeyPEM)
-	if err != nil {
-		return fmt.Errorf("failed to parse public root key: %w", err)
-	}
-
-	// Parse signature
-	signature, err := reposign.ParseSignature(sigBytes)
-	if err != nil {
-		return fmt.Errorf("failed to parse signature: %w", err)
-	}
-
-	// Validate revocation list
-	rl, err := reposign.ValidateRevocationList([]reposign.PublicKey{publicKey}, rlBytes, *signature)
-	if err != nil {
-		return fmt.Errorf("failed to validate revocation list: %w", err)
-	}
-
-	// Display results
-	cmd.Println("✅ Revocation list signature is valid")
-	cmd.Printf("Last Updated: %s\n", rl.LastUpdated.Format(time.RFC3339))
-	cmd.Printf("Expires At: %s\n", rl.ExpiresAt.Format(time.RFC3339))
-	cmd.Printf("Number of revoked keys: %d\n", len(rl.Revoked))
-
-	if len(rl.Revoked) > 0 {
-		cmd.Println("\nRevoked Keys:")
-		for keyID, revokedTime := range rl.Revoked {
-			cmd.Printf("  - %s (revoked at: %s)\n", keyID, revokedTime.Format(time.RFC3339))
-		}
-	}
-
-	return nil
-}
-
-func writeOutputFiles(rlPath, sigPath string, rlBytes, sigBytes []byte) error {
-	if err := os.WriteFile(rlPath, rlBytes, 0o600); err != nil {
-		return fmt.Errorf("failed to write revocation list file: %w", err)
-	}
-	if err := os.WriteFile(sigPath, sigBytes, 0o600); err != nil {
-		return fmt.Errorf("failed to write signature file: %w", err)
-	}
-	return nil
-}

client/cmd/signer/rootkey.go

@@ -1,74 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/client/internal/updatemanager/reposign"
-)
-
-var (
-	privKeyFile    string
-	pubKeyFile     string
-	rootExpiration time.Duration
-)
-
-var createRootKeyCmd = &cobra.Command{
-	Use:          "create-root-key",
-	Short:        "Create a new root key pair",
-	Long:         `Create a new root key pair and specify an expiration time for it.`,
-	SilenceUsage: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		// Validate expiration
-		if rootExpiration <= 0 {
-			return fmt.Errorf("--expiration must be a positive duration (e.g., 720h, 365d, 8760h)")
-		}
-
-		// Run main logic
-		if err := handleGenerateRootKey(cmd, privKeyFile, pubKeyFile, rootExpiration); err != nil {
-			return fmt.Errorf("failed to generate root key: %w", err)
-		}
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(createRootKeyCmd)
-	createRootKeyCmd.Flags().StringVar(&privKeyFile, "priv-key-file", "", "Path to output private key file")
-	createRootKeyCmd.Flags().StringVar(&pubKeyFile, "pub-key-file", "", "Path to output public key file")
-	createRootKeyCmd.Flags().DurationVar(&rootExpiration, "expiration", 0, "Expiration time for the root key (e.g., 720h,)")
-
-	if err := createRootKeyCmd.MarkFlagRequired("priv-key-file"); err != nil {
-		panic(err)
-	}
-	if err := createRootKeyCmd.MarkFlagRequired("pub-key-file"); err != nil {
-		panic(err)
-	}
-	if err := createRootKeyCmd.MarkFlagRequired("expiration"); err != nil {
-		panic(err)
-	}
-}
-
-func handleGenerateRootKey(cmd *cobra.Command, privKeyFile, pubKeyFile string, expiration time.Duration) error {
-	rk, privPEM, pubPEM, err := reposign.GenerateRootKey(expiration)
-	if err != nil {
-		return fmt.Errorf("generate root key: %w", err)
-	}
-
-	// Write private key
-	if err := os.WriteFile(privKeyFile, privPEM, 0o600); err != nil {
-		return fmt.Errorf("write private key file (%s): %w", privKeyFile, err)
-	}
-
-	// Write public key
-	if err := os.WriteFile(pubKeyFile, pubPEM, 0o600); err != nil {
-		return fmt.Errorf("write public key file (%s): %w", pubKeyFile, err)
-	}
-
-	cmd.Printf("%s\n\n", rk.String())
-	cmd.Printf("✅ Root key pair generated successfully.\n")
-	return nil
-}

client/cmd/ssh.go

@@ -634,11 +634,7 @@ func parseAndStartLocalForward(ctx context.Context, c *sshclient.Client, forward
 		return err
 	}
 
-	if err := validateDestinationPort(remoteAddr); err != nil {
-		return fmt.Errorf("invalid remote address: %w", err)
-	}
-
-	log.Debugf("Local port forwarding: %s -> %s", localAddr, remoteAddr)
+	cmd.Printf("Local port forwarding: %s -> %s\n", localAddr, remoteAddr)
 
 	go func() {
 		if err := c.LocalPortForward(ctx, localAddr, remoteAddr); err != nil && !errors.Is(err, context.Canceled) {
@@ -656,11 +652,7 @@ func parseAndStartRemoteForward(ctx context.Context, c *sshclient.Client, forwar
 		return err
 	}
 
-	if err := validateDestinationPort(localAddr); err != nil {
-		return fmt.Errorf("invalid local address: %w", err)
-	}
-
-	log.Debugf("Remote port forwarding: %s -> %s", remoteAddr, localAddr)
+	cmd.Printf("Remote port forwarding: %s -> %s\n", remoteAddr, localAddr)
 
 	go func() {
 		if err := c.RemotePortForward(ctx, remoteAddr, localAddr); err != nil && !errors.Is(err, context.Canceled) {
@@ -671,35 +663,6 @@ func parseAndStartRemoteForward(ctx context.Context, c *sshclient.Client, forwar
 	return nil
 }
 
-// validateDestinationPort checks that the destination address has a valid port.
-// Port 0 is only valid for bind addresses (where the OS picks an available port),
-// not for destination addresses where we need to connect.
-func validateDestinationPort(addr string) error {
-	if strings.HasPrefix(addr, "/") || strings.HasPrefix(addr, "./") {
-		return nil
-	}
-
-	_, portStr, err := net.SplitHostPort(addr)
-	if err != nil {
-		return fmt.Errorf("parse address %s: %w", addr, err)
-	}
-
-	port, err := strconv.Atoi(portStr)
-	if err != nil {
-		return fmt.Errorf("invalid port %s: %w", portStr, err)
-	}
-
-	if port == 0 {
-		return fmt.Errorf("port 0 is not valid for destination address")
-	}
-
-	if port < 0 || port > 65535 {
-		return fmt.Errorf("port %d out of range (1-65535)", port)
-	}
-
-	return nil
-}
-
 // parsePortForwardSpec parses port forward specifications like "8080:localhost:80" or "[::1]:8080:localhost:80".
 // Also supports Unix sockets like "8080:/tmp/socket" or "127.0.0.1:8080:/tmp/socket".
 func parsePortForwardSpec(spec string) (string, string, error) {

client/cmd/status.go

@@ -99,17 +99,17 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		profName = activeProf.Name
 	}
 
-	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), anonymizeFlag, resp.GetDaemonVersion(), statusFilter, prefixNamesFilter, prefixNamesFilterMap, ipsFilterMap, connectionTypeFilter, profName)
+	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp, anonymizeFlag, statusFilter, prefixNamesFilter, prefixNamesFilterMap, ipsFilterMap, connectionTypeFilter, profName)
 	var statusOutputString string
 	switch {
 	case detailFlag:
-		statusOutputString = outputInformationHolder.FullDetailSummary()
+		statusOutputString = nbstatus.ParseToFullDetailSummary(outputInformationHolder)
 	case jsonFlag:
-		statusOutputString, err = outputInformationHolder.JSON()
+		statusOutputString, err = nbstatus.ParseToJSON(outputInformationHolder)
 	case yamlFlag:
-		statusOutputString, err = outputInformationHolder.YAML()
+		statusOutputString, err = nbstatus.ParseToYAML(outputInformationHolder)
 	default:
-		statusOutputString = outputInformationHolder.GeneralSummary(false, false, false, false)
+		statusOutputString = nbstatus.ParseGeneralSummary(outputInformationHolder, false, false, false, false)
 	}
 
 	if err != nil {
@@ -124,7 +124,6 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 func getStatus(ctx context.Context, shouldRunProbes bool) (*proto.StatusResponse, error) {
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
-		//nolint
 		return nil, fmt.Errorf("failed to connect to daemon error: %v\n"+
 			"If the daemon is not running please run: "+
 			"\nnetbird service install \nnetbird service start\n", err)

client/cmd/testutil_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	"github.com/netbirdio/netbird/management/server/job"
 
 	clientProto "github.com/netbirdio/netbird/client/proto"
 	client "github.com/netbirdio/netbird/client/server"
@@ -90,6 +89,9 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 	t.Cleanup(cleanUp)
 
 	eventStore := &activity.InMemoryEventStore{}
+	if err != nil {
+		return nil, nil
+	}
 
 	ctrl := gomock.NewController(t)
 	t.Cleanup(ctrl.Finish)
@@ -98,8 +100,6 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 	peersmanager := peers.NewManager(store, permissionsManagerMock)
 	settingsManagerMock := settings.NewMockManager(ctrl)
 
-	jobManager := job.NewJobManager(nil, store, peersmanager)
-
 	iv, _ := integrations.NewIntegratedValidator(context.Background(), peersmanager, settingsManagerMock, eventStore)
 
 	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
@@ -118,7 +118,7 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config)
 
-	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false)
+	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -127,7 +127,7 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 	if err != nil {
 		t.Fatal(err)
 	}
-	mgmtServer, err := nbgrpc.NewServer(config, accountManager, settingsMockManager, jobManager, secretsManager, nil, nil, &mgmt.MockIntegratedValidator{}, networkMapController, nil)
+	mgmtServer, err := nbgrpc.NewServer(config, accountManager, settingsMockManager, secretsManager, nil, nil, &mgmt.MockIntegratedValidator{}, networkMapController)
 	if err != nil {
 		t.Fatal(err)
 	}

client/cmd/up.go

@@ -197,10 +197,10 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 	r := peer.NewRecorder(config.ManagementURL.String())
 	r.GetFullStatus()
 
-	connectClient := internal.NewConnectClient(ctx, config, r, false)
+	connectClient := internal.NewConnectClient(ctx, config, r)
 	SetupDebugHandler(ctx, config, r, connectClient, "")
 
-	return connectClient.Run(nil, util.FindFirstLogPath(logFiles))
+	return connectClient.Run(nil)
 }
 
 func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager.ProfileManager, activeProf *profilemanager.Profile, profileSwitched bool) error {
@@ -216,7 +216,6 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
-		//nolint
 		return fmt.Errorf("failed to connect to daemon error: %v\n"+
 			"If the daemon is not running please run: "+
 			"\nnetbird service install \nnetbird service start\n", err)

client/cmd/update.go

@@ -1,13 +0,0 @@
-//go:build !windows && !darwin
-
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var updateCmd *cobra.Command
-
-func isUpdateBinary() bool {
-	return false
-}

client/cmd/update_supported.go

@@ -1,75 +0,0 @@
-//go:build windows || darwin
-
-package cmd
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	"github.com/netbirdio/netbird/client/internal/updatemanager/installer"
-	"github.com/netbirdio/netbird/util"
-)
-
-var (
-	updateCmd = &cobra.Command{
-		Use:   "update",
-		Short: "Update the NetBird client application",
-		RunE:  updateFunc,
-	}
-
-	tempDirFlag    string
-	installerFile  string
-	serviceDirFlag string
-	dryRunFlag     bool
-)
-
-func init() {
-	updateCmd.Flags().StringVar(&tempDirFlag, "temp-dir", "", "temporary dir")
-	updateCmd.Flags().StringVar(&installerFile, "installer-file", "", "installer file")
-	updateCmd.Flags().StringVar(&serviceDirFlag, "service-dir", "", "service directory")
-	updateCmd.Flags().BoolVar(&dryRunFlag, "dry-run", false, "dry run the update process without making any changes")
-}
-
-// isUpdateBinary checks if the current executable is named "update" or "update.exe"
-func isUpdateBinary() bool {
-	// Remove extension for cross-platform compatibility
-	execPath, err := os.Executable()
-	if err != nil {
-		return false
-	}
-	baseName := filepath.Base(execPath)
-	name := strings.TrimSuffix(baseName, filepath.Ext(baseName))
-
-	return name == installer.UpdaterBinaryNameWithoutExtension()
-}
-
-func updateFunc(cmd *cobra.Command, args []string) error {
-	if err := setupLogToFile(tempDirFlag); err != nil {
-		return err
-	}
-
-	log.Infof("updater started: %s", serviceDirFlag)
-	updater := installer.NewWithDir(tempDirFlag)
-	if err := updater.Setup(context.Background(), dryRunFlag, installerFile, serviceDirFlag); err != nil {
-		log.Errorf("failed to update application: %v", err)
-		return err
-	}
-	return nil
-}
-
-func setupLogToFile(dir string) error {
-	logFile := filepath.Join(dir, installer.LogFile)
-
-	if _, err := os.Stat(logFile); err == nil {
-		if err := os.Remove(logFile); err != nil {
-			log.Errorf("failed to remove existing log file: %v\n", err)
-		}
-	}
-
-	return util.InitLog(logLevel, util.LogConsole, logFile)
-}

client/embed/embed.go

@@ -20,7 +20,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sshcommon "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 var (
@@ -39,7 +38,6 @@ type Client struct {
 	setupKey   string
 	jwtToken   string
 	connect    *internal.ConnectClient
-	recorder   *peer.Status
 }
 
 // Options configures a new Client.
@@ -163,17 +161,11 @@ func New(opts Options) (*Client, error) {
 func (c *Client) Start(startCtx context.Context) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if c.connect != nil {
+	if c.cancel != nil {
 		return ErrClientAlreadyStarted
 	}
 
-	ctx, cancel := context.WithCancel(internal.CtxInitState(context.Background()))
-	defer func() {
-		if c.connect == nil {
-			cancel()
-		}
-	}()
-
+	ctx := internal.CtxInitState(context.Background())
 	// nolint:staticcheck
 	ctx = context.WithValue(ctx, system.DeviceNameCtxKey, c.deviceName)
 	if err := internal.Login(ctx, c.config, c.setupKey, c.jwtToken); err != nil {
@@ -181,16 +173,14 @@ func (c *Client) Start(startCtx context.Context) error {
 	}
 
 	recorder := peer.NewRecorder(c.config.ManagementURL.String())
-	c.recorder = recorder
-	client := internal.NewConnectClient(ctx, c.config, recorder, false)
-	client.SetSyncResponsePersistence(true)
+	client := internal.NewConnectClient(ctx, c.config, recorder)
 
 	// either startup error (permanent backoff err) or nil err (successful engine up)
 	// TODO: make after-startup backoff err available
 	run := make(chan struct{})
 	clientErr := make(chan error, 1)
 	go func() {
-		if err := client.Run(run, ""); err != nil {
+		if err := client.Run(run); err != nil {
 			clientErr <- err
 		}
 	}()
@@ -207,7 +197,6 @@ func (c *Client) Start(startCtx context.Context) error {
 	}
 
 	c.connect = client
-	c.cancel = cancel
 
 	return nil
 }
@@ -222,23 +211,17 @@ func (c *Client) Stop(ctx context.Context) error {
 		return ErrClientNotStarted
 	}
 
-	if c.cancel != nil {
-		c.cancel()
-		c.cancel = nil
-	}
-
 	done := make(chan error, 1)
-	connect := c.connect
 	go func() {
-		done <- connect.Stop()
+		done <- c.connect.Stop()
 	}()
 
 	select {
 	case <-ctx.Done():
-		c.connect = nil
+		c.cancel = nil
 		return ctx.Err()
 	case err := <-done:
-		c.connect = nil
+		c.cancel = nil
 		if err != nil {
 			return fmt.Errorf("stop: %w", err)
 		}
@@ -332,62 +315,6 @@ func (c *Client) NewHTTPClient() *http.Client {
 	}
 }
 
-// Status returns the current status of the client.
-func (c *Client) Status() (peer.FullStatus, error) {
-	c.mu.Lock()
-	recorder := c.recorder
-	connect := c.connect
-	c.mu.Unlock()
-
-	if recorder == nil {
-		return peer.FullStatus{}, errors.New("client not started")
-	}
-
-	if connect != nil {
-		engine := connect.Engine()
-		if engine != nil {
-			_ = engine.RunHealthProbes(false)
-		}
-	}
-
-	return recorder.GetFullStatus(), nil
-}
-
-// GetLatestSyncResponse returns the latest sync response from the management server.
-func (c *Client) GetLatestSyncResponse() (*mgmProto.SyncResponse, error) {
-	engine, err := c.getEngine()
-	if err != nil {
-		return nil, err
-	}
-
-	syncResp, err := engine.GetLatestSyncResponse()
-	if err != nil {
-		return nil, fmt.Errorf("get sync response: %w", err)
-	}
-
-	return syncResp, nil
-}
-
-// SetLogLevel sets the logging level for the client and its components.
-func (c *Client) SetLogLevel(levelStr string) error {
-	level, err := logrus.ParseLevel(levelStr)
-	if err != nil {
-		return fmt.Errorf("parse log level: %w", err)
-	}
-
-	logrus.SetLevel(level)
-
-	c.mu.Lock()
-	connect := c.connect
-	c.mu.Unlock()
-
-	if connect != nil {
-		connect.SetLogLevel(level)
-	}
-
-	return nil
-}
-
 // VerifySSHHostKey verifies an SSH host key against stored peer keys.
 // Returns nil if the key matches, ErrPeerNotFound if peer is not in network,
 // ErrNoStoredKey if peer has no stored key, or an error for verification failures.

client/firewall/iptables/acl_linux.go

@@ -386,8 +386,11 @@ func (m *aclManager) updateState() {
 
 // filterRuleSpecs returns the specs of a filtering rule
 func filterRuleSpecs(ip net.IP, protocol string, sPort, dPort *firewall.Port, action firewall.Action, ipsetName string) (specs []string) {
+	matchByIP := true
 	// don't use IP matching if IP is 0.0.0.0
-	matchByIP := !ip.IsUnspecified()
+	if ip.IsUnspecified() {
+		matchByIP = false
+	}
 
 	if matchByIP {
 		if ipsetName != "" {

client/firewall/iptables/manager_linux_test.go

@@ -161,7 +161,7 @@ func TestIptablesManagerDenyRules(t *testing.T) {
 			t.Logf("  [%d] %s", i, rule)
 		}
 
-		var denyRuleIndex, acceptRuleIndex = -1, -1
+		var denyRuleIndex, acceptRuleIndex int = -1, -1
 		for i, rule := range rules {
 			if strings.Contains(rule, "DROP") {
 				t.Logf("Found DROP rule at index %d: %s", i, rule)

client/firewall/nftables/manager_linux_test.go

@@ -198,7 +198,7 @@ func TestNftablesManagerRuleOrder(t *testing.T) {
 	t.Logf("Found %d rules in nftables chain", len(rules))
 
 	// Find the accept and deny rules and verify deny comes before accept
-	var acceptRuleIndex, denyRuleIndex = -1, -1
+	var acceptRuleIndex, denyRuleIndex int = -1, -1
 	for i, rule := range rules {
 		hasAcceptHTTPSet := false
 		hasDenyHTTPSet := false
@@ -208,13 +208,11 @@ func TestNftablesManagerRuleOrder(t *testing.T) {
 		for _, e := range rule.Exprs {
 			// Check for set lookup
 			if lookup, ok := e.(*expr.Lookup); ok {
-				switch lookup.SetName {
-				case "accept-http":
+				if lookup.SetName == "accept-http" {
 					hasAcceptHTTPSet = true
-				case "deny-http":
+				} else if lookup.SetName == "deny-http" {
 					hasDenyHTTPSet = true
 				}
-
 			}
 			// Check for port 80
 			if cmp, ok := e.(*expr.Cmp); ok {
@@ -224,10 +222,9 @@ func TestNftablesManagerRuleOrder(t *testing.T) {
 			}
 			// Check for verdict
 			if verdict, ok := e.(*expr.Verdict); ok {
-				switch verdict.Kind {
-				case expr.VerdictAccept:
+				if verdict.Kind == expr.VerdictAccept {
 					action = "ACCEPT"
-				case expr.VerdictDrop:
+				} else if verdict.Kind == expr.VerdictDrop {
 					action = "DROP"
 				}
 			}
@@ -389,97 +386,6 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	verifyIptablesOutput(t, stdout, stderr)
 }
 
-func TestNftablesManagerCompatibilityWithIptablesFor6kPrefixes(t *testing.T) {
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-
-	if _, err := exec.LookPath("iptables-save"); err != nil {
-		t.Skipf("iptables-save not available on this system: %v", err)
-	}
-
-	// First ensure iptables-nft tables exist by running iptables-save
-	stdout, stderr := runIptablesSave(t)
-	verifyIptablesOutput(t, stdout, stderr)
-
-	manager, err := Create(ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "failed to create manager")
-	require.NoError(t, manager.Init(nil))
-
-	t.Cleanup(func() {
-		err := manager.Close(nil)
-		require.NoError(t, err, "failed to reset manager state")
-
-		// Verify iptables output after reset
-		stdout, stderr := runIptablesSave(t)
-		verifyIptablesOutput(t, stdout, stderr)
-	})
-
-	const octet2Count = 25
-	const octet3Count = 255
-	prefixes := make([]netip.Prefix, 0, (octet2Count-1)*(octet3Count-1))
-	for i := 1; i < octet2Count; i++ {
-		for j := 1; j < octet3Count; j++ {
-			addr := netip.AddrFrom4([4]byte{192, byte(j), byte(i), 0})
-			prefixes = append(prefixes, netip.PrefixFrom(addr, 24))
-		}
-	}
-	_, err = manager.AddRouteFiltering(
-		nil,
-		prefixes,
-		fw.Network{Prefix: netip.MustParsePrefix("10.2.0.0/24")},
-		fw.ProtocolTCP,
-		nil,
-		&fw.Port{Values: []uint16{443}},
-		fw.ActionAccept,
-	)
-	require.NoError(t, err, "failed to add route filtering rule")
-
-	stdout, stderr = runIptablesSave(t)
-	verifyIptablesOutput(t, stdout, stderr)
-}
-
-func TestNftablesManagerCompatibilityWithIptablesForEmptyPrefixes(t *testing.T) {
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-
-	if _, err := exec.LookPath("iptables-save"); err != nil {
-		t.Skipf("iptables-save not available on this system: %v", err)
-	}
-
-	// First ensure iptables-nft tables exist by running iptables-save
-	stdout, stderr := runIptablesSave(t)
-	verifyIptablesOutput(t, stdout, stderr)
-
-	manager, err := Create(ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err, "failed to create manager")
-	require.NoError(t, manager.Init(nil))
-
-	t.Cleanup(func() {
-		err := manager.Close(nil)
-		require.NoError(t, err, "failed to reset manager state")
-
-		// Verify iptables output after reset
-		stdout, stderr := runIptablesSave(t)
-		verifyIptablesOutput(t, stdout, stderr)
-	})
-
-	_, err = manager.AddRouteFiltering(
-		nil,
-		[]netip.Prefix{},
-		fw.Network{Prefix: netip.MustParsePrefix("10.2.0.0/24")},
-		fw.ProtocolTCP,
-		nil,
-		&fw.Port{Values: []uint16{443}},
-		fw.ActionAccept,
-	)
-	require.NoError(t, err, "failed to add route filtering rule")
-
-	stdout, stderr = runIptablesSave(t)
-	verifyIptablesOutput(t, stdout, stderr)
-}
-
 func compareExprsIgnoringCounters(t *testing.T, got, want []expr.Any) {
 	t.Helper()
 	require.Equal(t, len(got), len(want), "expression count mismatch")

client/firewall/nftables/router_linux.go

@@ -48,12 +48,10 @@ const (
 
 	// ipTCPHeaderMinSize represents minimum IP (20) + TCP (20) header size for MSS calculation
 	ipTCPHeaderMinSize = 40
-
-	// maxPrefixesSet 1638 prefixes start to fail, taking some margin
-	maxPrefixesSet       = 1500
-	refreshRulesMapError = "refresh rules map: %w"
 )
 
+const refreshRulesMapError = "refresh rules map: %w"
+
 var (
 	errFilterTableNotFound = fmt.Errorf("'filter' table not found")
 )
@@ -515,35 +513,16 @@ func (r *router) createIpSet(setName string, input setInput) (*nftables.Set, err
 	}
 
 	elements := convertPrefixesToSet(prefixes)
-	nElements := len(elements)
-
-	maxElements := maxPrefixesSet * 2
-	initialElements := elements[:min(maxElements, nElements)]
-
-	if err := r.conn.AddSet(nfset, initialElements); err != nil {
-		return nil, fmt.Errorf("error adding set %s: %w", setName, err)
+	if err := r.conn.AddSet(nfset, elements); err != nil {
+		return nil, fmt.Errorf("error adding elements to set %s: %w", setName, err)
 	}
+
 	if err := r.conn.Flush(); err != nil {
 		return nil, fmt.Errorf("flush error: %w", err)
 	}
-	log.Debugf("Created new ipset: %s with %d initial prefixes (total prefixes %d)", setName, len(initialElements)/2, len(prefixes))
 
-	var subEnd int
-	for subStart := maxElements; subStart < nElements; subStart += maxElements {
-		subEnd = min(subStart+maxElements, nElements)
-		subElement := elements[subStart:subEnd]
-		nSubPrefixes := len(subElement) / 2
-		log.Tracef("Adding new prefixes (%d) in ipset: %s", nSubPrefixes, setName)
-		if err := r.conn.SetAddElements(nfset, subElement); err != nil {
-			return nil, fmt.Errorf("error adding prefixes (%d) to set %s: %w", nSubPrefixes, setName, err)
-		}
-		if err := r.conn.Flush(); err != nil {
-			return nil, fmt.Errorf("flush error: %w", err)
-		}
-		log.Debugf("Added new prefixes (%d) in ipset: %s", nSubPrefixes, setName)
-	}
+	log.Printf("Created new ipset: %s with %d elements", setName, len(elements)/2)
 
-	log.Infof("Created new ipset: %s with %d prefixes", setName, len(prefixes))
 	return nfset, nil
 }
 

client/firewall/uspfilter/filter.go

@@ -29,7 +29,7 @@ import (
 )
 
 const (
-	layerTypeAll = 255
+	layerTypeAll = 0
 
 	// ipTCPHeaderMinSize represents minimum IP (20) + TCP (20) header size for MSS calculation
 	ipTCPHeaderMinSize = 40
@@ -262,7 +262,10 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 }
 
 func (m *Manager) blockInvalidRouted(iface common.IFaceMapper) (firewall.Rule, error) {
-	wgPrefix := iface.Address().Network
+	wgPrefix, err := netip.ParsePrefix(iface.Address().Network.String())
+	if err != nil {
+		return nil, fmt.Errorf("parse wireguard network: %w", err)
+	}
 	log.Debugf("blocking invalid routed traffic for %s", wgPrefix)
 
 	rule, err := m.addRouteFiltering(
@@ -436,7 +439,19 @@ func (m *Manager) AddPeerFiltering(
 	r.sPort = sPort
 	r.dPort = dPort
 
-	r.protoLayer = protoToLayer(proto, r.ipLayer)
+	switch proto {
+	case firewall.ProtocolTCP:
+		r.protoLayer = layers.LayerTypeTCP
+	case firewall.ProtocolUDP:
+		r.protoLayer = layers.LayerTypeUDP
+	case firewall.ProtocolICMP:
+		r.protoLayer = layers.LayerTypeICMPv4
+		if r.ipLayer == layers.LayerTypeIPv6 {
+			r.protoLayer = layers.LayerTypeICMPv6
+		}
+	case firewall.ProtocolALL:
+		r.protoLayer = layerTypeAll
+	}
 
 	m.mutex.Lock()
 	var targetMap map[netip.Addr]RuleSet
@@ -481,17 +496,16 @@ func (m *Manager) addRouteFiltering(
 	}
 
 	ruleID := uuid.New().String()
-
 	rule := RouteRule{
 		// TODO: consolidate these IDs
-		id:         ruleID,
-		mgmtId:     id,
-		sources:    sources,
-		dstSet:     destination.Set,
-		protoLayer: protoToLayer(proto, layers.LayerTypeIPv4),
-		srcPort:    sPort,
-		dstPort:    dPort,
-		action:     action,
+		id:      ruleID,
+		mgmtId:  id,
+		sources: sources,
+		dstSet:  destination.Set,
+		proto:   proto,
+		srcPort: sPort,
+		dstPort: dPort,
+		action:  action,
 	}
 	if destination.IsPrefix() {
 		rule.destinations = []netip.Prefix{destination.Prefix}
@@ -781,7 +795,7 @@ func (m *Manager) recalculateTCPChecksum(packetData []byte, d *decoder, tcpHeade
 	pseudoSum += uint32(d.ip4.Protocol)
 	pseudoSum += uint32(tcpLength)
 
-	var sum = pseudoSum
+	var sum uint32 = pseudoSum
 	for i := 0; i < tcpLength-1; i += 2 {
 		sum += uint32(tcpLayer[i])<<8 | uint32(tcpLayer[i+1])
 	}
@@ -931,7 +945,7 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 func (m *Manager) handleLocalTraffic(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	ruleID, blocked := m.peerACLsBlock(srcIP, d, packetData)
 	if blocked {
-		pnum := getProtocolFromPacket(d)
+		_, pnum := getProtocolFromPacket(d)
 		srcPort, dstPort := getPortsFromPacket(d)
 
 		m.logger.Trace6("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
@@ -996,22 +1010,20 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe
 		return false
 	}
 
-	protoLayer := d.decoded[1]
+	proto, pnum := getProtocolFromPacket(d)
 	srcPort, dstPort := getPortsFromPacket(d)
 
-	ruleID, pass := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
+	ruleID, pass := m.routeACLsPass(srcIP, dstIP, proto, srcPort, dstPort)
 	if !pass {
-		proto := getProtocolFromPacket(d)
-
 		m.logger.Trace6("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			ruleID, proto, srcIP, srcPort, dstIP, dstPort)
+			ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
 
 		m.flowLogger.StoreEvent(nftypes.EventFields{
 			FlowID:     uuid.New(),
 			Type:       nftypes.TypeDrop,
 			RuleID:     ruleID,
 			Direction:  nftypes.Ingress,
-			Protocol:   proto,
+			Protocol:   pnum,
 			SourceIP:   srcIP,
 			DestIP:     dstIP,
 			SourcePort: srcPort,
@@ -1040,33 +1052,16 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe
 	return true
 }
 
-func protoToLayer(proto firewall.Protocol, ipLayer gopacket.LayerType) gopacket.LayerType {
-	switch proto {
-	case firewall.ProtocolTCP:
-		return layers.LayerTypeTCP
-	case firewall.ProtocolUDP:
-		return layers.LayerTypeUDP
-	case firewall.ProtocolICMP:
-		if ipLayer == layers.LayerTypeIPv6 {
-			return layers.LayerTypeICMPv6
-		}
-		return layers.LayerTypeICMPv4
-	case firewall.ProtocolALL:
-		return layerTypeAll
-	}
-	return 0
-}
-
-func getProtocolFromPacket(d *decoder) nftypes.Protocol {
+func getProtocolFromPacket(d *decoder) (firewall.Protocol, nftypes.Protocol) {
 	switch d.decoded[1] {
 	case layers.LayerTypeTCP:
-		return nftypes.TCP
+		return firewall.ProtocolTCP, nftypes.TCP
 	case layers.LayerTypeUDP:
-		return nftypes.UDP
+		return firewall.ProtocolUDP, nftypes.UDP
 	case layers.LayerTypeICMPv4, layers.LayerTypeICMPv6:
-		return nftypes.ICMP
+		return firewall.ProtocolICMP, nftypes.ICMP
 	default:
-		return nftypes.ProtocolUnknown
+		return firewall.ProtocolALL, nftypes.ProtocolUnknown
 	}
 }
 
@@ -1238,30 +1233,19 @@ func validateRule(ip netip.Addr, packetData []byte, rules map[string]PeerRule, d
 }
 
 // routeACLsPass returns true if the packet is allowed by the route ACLs
-func (m *Manager) routeACLsPass(srcIP, dstIP netip.Addr, protoLayer gopacket.LayerType, srcPort, dstPort uint16) ([]byte, bool) {
+func (m *Manager) routeACLsPass(srcIP, dstIP netip.Addr, proto firewall.Protocol, srcPort, dstPort uint16) ([]byte, bool) {
 	m.mutex.RLock()
 	defer m.mutex.RUnlock()
 
 	for _, rule := range m.routeRules {
-		if matches := m.ruleMatches(rule, srcIP, dstIP, protoLayer, srcPort, dstPort); matches {
+		if matches := m.ruleMatches(rule, srcIP, dstIP, proto, srcPort, dstPort); matches {
 			return rule.mgmtId, rule.action == firewall.ActionAccept
 		}
 	}
 	return nil, false
 }
 
-func (m *Manager) ruleMatches(rule *RouteRule, srcAddr, dstAddr netip.Addr, protoLayer gopacket.LayerType, srcPort, dstPort uint16) bool {
-	// TODO: handle ipv6 vs ipv4 icmp rules
-	if rule.protoLayer != layerTypeAll && rule.protoLayer != protoLayer {
-		return false
-	}
-
-	if protoLayer == layers.LayerTypeTCP || protoLayer == layers.LayerTypeUDP {
-		if !portsMatch(rule.srcPort, srcPort) || !portsMatch(rule.dstPort, dstPort) {
-			return false
-		}
-	}
-
+func (m *Manager) ruleMatches(rule *RouteRule, srcAddr, dstAddr netip.Addr, proto firewall.Protocol, srcPort, dstPort uint16) bool {
 	destMatched := false
 	for _, dst := range rule.destinations {
 		if dst.Contains(dstAddr) {
@@ -1280,8 +1264,21 @@ func (m *Manager) ruleMatches(rule *RouteRule, srcAddr, dstAddr netip.Addr, prot
 			break
 		}
 	}
+	if !sourceMatched {
+		return false
+	}
 
-	return sourceMatched
+	if rule.proto != firewall.ProtocolALL && rule.proto != proto {
+		return false
+	}
+
+	if proto == firewall.ProtocolTCP || proto == firewall.ProtocolUDP {
+		if !portsMatch(rule.srcPort, srcPort) || !portsMatch(rule.dstPort, dstPort) {
+			return false
+		}
+	}
+
+	return true
 }
 
 // AddUDPPacketHook calls hook when UDP packet from given direction matched

client/firewall/uspfilter/filter_bench_test.go

@@ -955,7 +955,7 @@ func BenchmarkRouteACLs(b *testing.B) {
 		for _, tc := range cases {
 			srcIP := netip.MustParseAddr(tc.srcIP)
 			dstIP := netip.MustParseAddr(tc.dstIP)
-			manager.routeACLsPass(srcIP, dstIP, protoToLayer(tc.proto, layers.LayerTypeIPv4), 0, tc.dstPort)
+			manager.routeACLsPass(srcIP, dstIP, tc.proto, 0, tc.dstPort)
 		}
 	}
 }

client/firewall/uspfilter/filter_filter_test.go

@@ -1259,7 +1259,7 @@ func TestRouteACLFiltering(t *testing.T) {
 
 			// testing routeACLsPass only and not FilterInbound, as routed packets are dropped after being passed
 			// to the forwarder
-			_, isAllowed := manager.routeACLsPass(srcIP, dstIP, protoToLayer(tc.proto, layers.LayerTypeIPv4), tc.srcPort, tc.dstPort)
+			_, isAllowed := manager.routeACLsPass(srcIP, dstIP, tc.proto, tc.srcPort, tc.dstPort)
 			require.Equal(t, tc.shouldPass, isAllowed)
 		})
 	}
@@ -1445,7 +1445,7 @@ func TestRouteACLOrder(t *testing.T) {
 				srcIP := netip.MustParseAddr(p.srcIP)
 				dstIP := netip.MustParseAddr(p.dstIP)
 
-				_, isAllowed := manager.routeACLsPass(srcIP, dstIP, protoToLayer(p.proto, layers.LayerTypeIPv4), p.srcPort, p.dstPort)
+				_, isAllowed := manager.routeACLsPass(srcIP, dstIP, p.proto, p.srcPort, p.dstPort)
 				require.Equal(t, p.shouldPass, isAllowed, "packet %d failed", i)
 			}
 		})
@@ -1488,13 +1488,13 @@ func TestRouteACLSet(t *testing.T) {
 	dstIP := netip.MustParseAddr("192.168.1.100")
 
 	// Check that traffic is dropped (empty set shouldn't match anything)
-	_, isAllowed := manager.routeACLsPass(srcIP, dstIP, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+	_, isAllowed := manager.routeACLsPass(srcIP, dstIP, fw.ProtocolTCP, 12345, 80)
 	require.False(t, isAllowed, "Empty set should not allow any traffic")
 
 	err = manager.UpdateSet(set, []netip.Prefix{netip.MustParsePrefix("192.168.1.0/24")})
 	require.NoError(t, err)
 
 	// Now the packet should be allowed
-	_, isAllowed = manager.routeACLsPass(srcIP, dstIP, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+	_, isAllowed = manager.routeACLsPass(srcIP, dstIP, fw.ProtocolTCP, 12345, 80)
 	require.True(t, isAllowed, "After set update, traffic to the added network should be allowed")
 }

client/firewall/uspfilter/filter_test.go

@@ -767,9 +767,9 @@ func TestUpdateSetMerge(t *testing.T) {
 	dstIP2 := netip.MustParseAddr("192.168.1.100")
 	dstIP3 := netip.MustParseAddr("172.16.0.100")
 
-	_, isAllowed1 := manager.routeACLsPass(srcIP, dstIP1, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
-	_, isAllowed2 := manager.routeACLsPass(srcIP, dstIP2, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
-	_, isAllowed3 := manager.routeACLsPass(srcIP, dstIP3, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+	_, isAllowed1 := manager.routeACLsPass(srcIP, dstIP1, fw.ProtocolTCP, 12345, 80)
+	_, isAllowed2 := manager.routeACLsPass(srcIP, dstIP2, fw.ProtocolTCP, 12345, 80)
+	_, isAllowed3 := manager.routeACLsPass(srcIP, dstIP3, fw.ProtocolTCP, 12345, 80)
 
 	require.True(t, isAllowed1, "Traffic to 10.0.0.100 should be allowed")
 	require.True(t, isAllowed2, "Traffic to 192.168.1.100 should be allowed")
@@ -784,8 +784,8 @@ func TestUpdateSetMerge(t *testing.T) {
 	require.NoError(t, err)
 
 	// Check that all original prefixes are still included
-	_, isAllowed1 = manager.routeACLsPass(srcIP, dstIP1, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
-	_, isAllowed2 = manager.routeACLsPass(srcIP, dstIP2, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+	_, isAllowed1 = manager.routeACLsPass(srcIP, dstIP1, fw.ProtocolTCP, 12345, 80)
+	_, isAllowed2 = manager.routeACLsPass(srcIP, dstIP2, fw.ProtocolTCP, 12345, 80)
 	require.True(t, isAllowed1, "Traffic to 10.0.0.100 should still be allowed after update")
 	require.True(t, isAllowed2, "Traffic to 192.168.1.100 should still be allowed after update")
 
@@ -793,8 +793,8 @@ func TestUpdateSetMerge(t *testing.T) {
 	dstIP4 := netip.MustParseAddr("172.16.1.100")
 	dstIP5 := netip.MustParseAddr("10.1.0.50")
 
-	_, isAllowed4 := manager.routeACLsPass(srcIP, dstIP4, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
-	_, isAllowed5 := manager.routeACLsPass(srcIP, dstIP5, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+	_, isAllowed4 := manager.routeACLsPass(srcIP, dstIP4, fw.ProtocolTCP, 12345, 80)
+	_, isAllowed5 := manager.routeACLsPass(srcIP, dstIP5, fw.ProtocolTCP, 12345, 80)
 
 	require.True(t, isAllowed4, "Traffic to new prefix 172.16.0.0/16 should be allowed")
 	require.True(t, isAllowed5, "Traffic to new prefix 10.1.0.0/24 should be allowed")
@@ -922,7 +922,7 @@ func TestUpdateSetDeduplication(t *testing.T) {
 
 	srcIP := netip.MustParseAddr("100.10.0.1")
 	for _, tc := range testCases {
-		_, isAllowed := manager.routeACLsPass(srcIP, tc.dstIP, protoToLayer(fw.ProtocolTCP, layers.LayerTypeIPv4), 12345, 80)
+		_, isAllowed := manager.routeACLsPass(srcIP, tc.dstIP, fw.ProtocolTCP, 12345, 80)
 		require.Equal(t, tc.expected, isAllowed, tc.desc)
 	}
 }

client/firewall/uspfilter/forwarder/endpoint.go

@@ -2,7 +2,6 @@ package forwarder
 
 import (
 	"fmt"
-	"sync/atomic"
 
 	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -17,7 +16,7 @@ type endpoint struct {
 	logger     *nblog.Logger
 	dispatcher stack.NetworkDispatcher
 	device     *wgdevice.Device
-	mtu        atomic.Uint32
+	mtu        uint32
 }
 
 func (e *endpoint) Attach(dispatcher stack.NetworkDispatcher) {
@@ -29,7 +28,7 @@ func (e *endpoint) IsAttached() bool {
 }
 
 func (e *endpoint) MTU() uint32 {
-	return e.mtu.Load()
+	return e.mtu
 }
 
 func (e *endpoint) Capabilities() stack.LinkEndpointCapabilities {
@@ -83,22 +82,6 @@ func (e *endpoint) ParseHeader(*stack.PacketBuffer) bool {
 	return true
 }
 
-func (e *endpoint) Close() {
-	// Endpoint cleanup - nothing to do as device is managed externally
-}
-
-func (e *endpoint) SetLinkAddress(tcpip.LinkAddress) {
-	// Link address is not used for this endpoint type
-}
-
-func (e *endpoint) SetMTU(mtu uint32) {
-	e.mtu.Store(mtu)
-}
-
-func (e *endpoint) SetOnCloseAction(func()) {
-	// No action needed on close
-}
-
 type epID stack.TransportEndpointID
 
 func (i epID) String() string {

client/firewall/uspfilter/forwarder/forwarder.go

@@ -7,7 +7,6 @@ import (
 	"net/netip"
 	"runtime"
 	"sync"
-	"time"
 
 	log "github.com/sirupsen/logrus"
 	"gvisor.dev/gvisor/pkg/buffer"
@@ -36,16 +35,14 @@ type Forwarder struct {
 	logger     *nblog.Logger
 	flowLogger nftypes.FlowLogger
 	// ruleIdMap is used to store the rule ID for a given connection
-	ruleIdMap        sync.Map
-	stack            *stack.Stack
-	endpoint         *endpoint
-	udpForwarder     *udpForwarder
-	ctx              context.Context
-	cancel           context.CancelFunc
-	ip               tcpip.Address
-	netstack         bool
-	hasRawICMPAccess bool
-	pingSemaphore    chan struct{}
+	ruleIdMap    sync.Map
+	stack        *stack.Stack
+	endpoint     *endpoint
+	udpForwarder *udpForwarder
+	ctx          context.Context
+	cancel       context.CancelFunc
+	ip           tcpip.Address
+	netstack     bool
 }
 
 func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.FlowLogger, netstack bool, mtu uint16) (*Forwarder, error) {
@@ -63,8 +60,8 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 	endpoint := &endpoint{
 		logger: logger,
 		device: iface.GetWGDevice(),
+		mtu:    uint32(mtu),
 	}
-	endpoint.mtu.Store(uint32(mtu))
 
 	if err := s.CreateNIC(nicID, endpoint); err != nil {
 		return nil, fmt.Errorf("create NIC: %v", err)
@@ -106,16 +103,15 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 
 	ctx, cancel := context.WithCancel(context.Background())
 	f := &Forwarder{
-		logger:        logger,
-		flowLogger:    flowLogger,
-		stack:         s,
-		endpoint:      endpoint,
-		udpForwarder:  newUDPForwarder(mtu, logger, flowLogger),
-		ctx:           ctx,
-		cancel:        cancel,
-		netstack:      netstack,
-		ip:            tcpip.AddrFromSlice(iface.Address().IP.AsSlice()),
-		pingSemaphore: make(chan struct{}, 3),
+		logger:       logger,
+		flowLogger:   flowLogger,
+		stack:        s,
+		endpoint:     endpoint,
+		udpForwarder: newUDPForwarder(mtu, logger, flowLogger),
+		ctx:          ctx,
+		cancel:       cancel,
+		netstack:     netstack,
+		ip:           tcpip.AddrFromSlice(iface.Address().IP.AsSlice()),
 	}
 
 	receiveWindow := defaultReceiveWindow
@@ -133,8 +129,6 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 
 	s.SetTransportProtocolHandler(icmp.ProtocolNumber4, f.handleICMP)
 
-	f.checkICMPCapability()
-
 	log.Debugf("forwarder: Initialization complete with NIC %d", nicID)
 	return f, nil
 }
@@ -204,24 +198,3 @@ func buildKey(srcIP, dstIP netip.Addr, srcPort, dstPort uint16) conntrack.ConnKe
 		DstPort: dstPort,
 	}
 }
-
-// checkICMPCapability tests whether we have raw ICMP socket access at startup.
-func (f *Forwarder) checkICMPCapability() {
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	lc := net.ListenConfig{}
-	conn, err := lc.ListenPacket(ctx, "ip4:icmp", "0.0.0.0")
-	if err != nil {
-		f.hasRawICMPAccess = false
-		f.logger.Debug("forwarder: No raw ICMP socket access, will use ping binary fallback")
-		return
-	}
-
-	if err := conn.Close(); err != nil {
-		f.logger.Debug1("forwarder: Failed to close ICMP capability test socket: %v", err)
-	}
-
-	f.hasRawICMPAccess = true
-	f.logger.Debug("forwarder: Raw ICMP socket access available")
-}

client/firewall/uspfilter/forwarder/icmp.go

@@ -2,11 +2,8 @@ package forwarder
 
 import (
 	"context"
-	"fmt"
 	"net"
 	"net/netip"
-	"os/exec"
-	"runtime"
 	"time"
 
 	"github.com/google/uuid"
@@ -17,95 +14,30 @@ import (
 )
 
 // handleICMP handles ICMP packets from the network stack
-func (f *Forwarder) handleICMP(id stack.TransportEndpointID, pkt *stack.PacketBuffer) bool {
+func (f *Forwarder) handleICMP(id stack.TransportEndpointID, pkt stack.PacketBufferPtr) bool {
 	icmpHdr := header.ICMPv4(pkt.TransportHeader().View().AsSlice())
+	icmpType := uint8(icmpHdr.Type())
+	icmpCode := uint8(icmpHdr.Code())
 
-	flowID := uuid.New()
-	f.sendICMPEvent(nftypes.TypeStart, flowID, id, uint8(icmpHdr.Type()), uint8(icmpHdr.Code()), 0, 0)
-
-	// For Echo Requests, send and wait for response
-	if icmpHdr.Type() == header.ICMPv4Echo {
-		return f.handleICMPEcho(flowID, id, pkt, uint8(icmpHdr.Type()), uint8(icmpHdr.Code()))
-	}
-
-	// For other ICMP types (Time Exceeded, Destination Unreachable, etc), forward without waiting
-	if !f.hasRawICMPAccess {
-		f.logger.Debug2("forwarder: Cannot handle ICMP type %v without raw socket access for %v", icmpHdr.Type(), epID(id))
-		return false
-	}
-
-	icmpData := stack.PayloadSince(pkt.TransportHeader()).AsSlice()
-	conn, err := f.forwardICMPPacket(id, icmpData, uint8(icmpHdr.Type()), uint8(icmpHdr.Code()), 100*time.Millisecond)
-	if err != nil {
-		f.logger.Error2("forwarder: Failed to forward ICMP packet for %v: %v", epID(id), err)
+	if header.ICMPv4Type(icmpType) == header.ICMPv4EchoReply {
+		// dont process our own replies
 		return true
 	}
-	if err := conn.Close(); err != nil {
-		f.logger.Debug1("forwarder: Failed to close ICMP socket: %v", err)
-	}
 
-	return true
-}
+	flowID := uuid.New()
+	f.sendICMPEvent(nftypes.TypeStart, flowID, id, icmpType, icmpCode, 0, 0)
 
-// handleICMPEcho handles ICMP echo requests asynchronously with rate limiting.
-func (f *Forwarder) handleICMPEcho(flowID uuid.UUID, id stack.TransportEndpointID, pkt *stack.PacketBuffer, icmpType, icmpCode uint8) bool {
-	select {
-	case f.pingSemaphore <- struct{}{}:
-		icmpData := stack.PayloadSince(pkt.TransportHeader()).ToSlice()
-		rxBytes := pkt.Size()
-
-		go func() {
-			defer func() { <-f.pingSemaphore }()
-
-			if f.hasRawICMPAccess {
-				f.handleICMPViaSocket(flowID, id, icmpType, icmpCode, icmpData, rxBytes)
-			} else {
-				f.handleICMPViaPing(flowID, id, icmpType, icmpCode, icmpData, rxBytes)
-			}
-		}()
-	default:
-		f.logger.Debug3("forwarder: ICMP rate limit exceeded for %v type %v code %v",
-			epID(id), icmpType, icmpCode)
-	}
-	return true
-}
-
-// forwardICMPPacket creates a raw ICMP socket and sends the packet, returning the connection.
-// The caller is responsible for closing the returned connection.
-func (f *Forwarder) forwardICMPPacket(id stack.TransportEndpointID, payload []byte, icmpType, icmpCode uint8, timeout time.Duration) (net.PacketConn, error) {
-	ctx, cancel := context.WithTimeout(f.ctx, timeout)
+	ctx, cancel := context.WithTimeout(f.ctx, 5*time.Second)
 	defer cancel()
 
 	lc := net.ListenConfig{}
+	// TODO: support non-root
 	conn, err := lc.ListenPacket(ctx, "ip4:icmp", "0.0.0.0")
 	if err != nil {
-		return nil, fmt.Errorf("create ICMP socket: %w", err)
-	}
+		f.logger.Error2("forwarder: Failed to create ICMP socket for %v: %v", epID(id), err)
 
-	dstIP := f.determineDialAddr(id.LocalAddress)
-	dst := &net.IPAddr{IP: dstIP}
-
-	if _, err = conn.WriteTo(payload, dst); err != nil {
-		if closeErr := conn.Close(); closeErr != nil {
-			f.logger.Debug1("forwarder: Failed to close ICMP socket: %v", closeErr)
-		}
-		return nil, fmt.Errorf("write ICMP packet: %w", err)
-	}
-
-	f.logger.Trace3("forwarder: Forwarded ICMP packet %v type %v code %v",
-		epID(id), icmpType, icmpCode)
-
-	return conn, nil
-}
-
-// handleICMPViaSocket handles ICMP echo requests using raw sockets.
-func (f *Forwarder) handleICMPViaSocket(flowID uuid.UUID, id stack.TransportEndpointID, icmpType, icmpCode uint8, icmpData []byte, rxBytes int) {
-	sendTime := time.Now()
-
-	conn, err := f.forwardICMPPacket(id, icmpData, icmpType, icmpCode, 5*time.Second)
-	if err != nil {
-		f.logger.Error2("forwarder: Failed to send ICMP packet for %v: %v", epID(id), err)
-		return
+		// This will make netstack reply on behalf of the original destination, that's ok for now
+		return false
 	}
 	defer func() {
 		if err := conn.Close(); err != nil {
@@ -113,22 +45,38 @@ func (f *Forwarder) handleICMPViaSocket(flowID uuid.UUID, id stack.TransportEndp
 		}
 	}()
 
-	txBytes := f.handleEchoResponse(conn, id)
-	rtt := time.Since(sendTime).Round(10 * time.Microsecond)
+	dstIP := f.determineDialAddr(id.LocalAddress)
+	dst := &net.IPAddr{IP: dstIP}
 
-	f.logger.Trace4("forwarder: Forwarded ICMP echo reply %v type %v code %v (rtt=%v, raw socket)",
-		epID(id), icmpType, icmpCode, rtt)
+	fullPacket := stack.PayloadSince(pkt.TransportHeader())
+	payload := fullPacket.AsSlice()
 
-	f.sendICMPEvent(nftypes.TypeEnd, flowID, id, icmpType, icmpCode, uint64(rxBytes), uint64(txBytes))
+	if _, err = conn.WriteTo(payload, dst); err != nil {
+		f.logger.Error2("forwarder: Failed to write ICMP packet for %v: %v", epID(id), err)
+		return true
+	}
+
+	f.logger.Trace3("forwarder: Forwarded ICMP packet %v type %v code %v",
+		epID(id), icmpHdr.Type(), icmpHdr.Code())
+
+	// For Echo Requests, send and handle response
+	if header.ICMPv4Type(icmpType) == header.ICMPv4Echo {
+		rxBytes := pkt.Size()
+		txBytes := f.handleEchoResponse(icmpHdr, conn, id)
+		f.sendICMPEvent(nftypes.TypeEnd, flowID, id, icmpType, icmpCode, uint64(rxBytes), uint64(txBytes))
+	}
+
+	// For other ICMP types (Time Exceeded, Destination Unreachable, etc) do nothing
+	return true
 }
 
-func (f *Forwarder) handleEchoResponse(conn net.PacketConn, id stack.TransportEndpointID) int {
+func (f *Forwarder) handleEchoResponse(icmpHdr header.ICMPv4, conn net.PacketConn, id stack.TransportEndpointID) int {
 	if err := conn.SetReadDeadline(time.Now().Add(5 * time.Second)); err != nil {
 		f.logger.Error1("forwarder: Failed to set read deadline for ICMP response: %v", err)
 		return 0
 	}
 
-	response := make([]byte, f.endpoint.mtu.Load())
+	response := make([]byte, f.endpoint.mtu)
 	n, _, err := conn.ReadFrom(response)
 	if err != nil {
 		if !isTimeout(err) {
@@ -137,7 +85,31 @@ func (f *Forwarder) handleEchoResponse(conn net.PacketConn, id stack.TransportEn
 		return 0
 	}
 
-	return f.injectICMPReply(id, response[:n])
+	ipHdr := make([]byte, header.IPv4MinimumSize)
+	ip := header.IPv4(ipHdr)
+	ip.Encode(&header.IPv4Fields{
+		TotalLength: uint16(header.IPv4MinimumSize + n),
+		TTL:         64,
+		Protocol:    uint8(header.ICMPv4ProtocolNumber),
+		SrcAddr:     id.LocalAddress,
+		DstAddr:     id.RemoteAddress,
+	})
+	ip.SetChecksum(^ip.CalculateChecksum())
+
+	fullPacket := make([]byte, 0, len(ipHdr)+n)
+	fullPacket = append(fullPacket, ipHdr...)
+	fullPacket = append(fullPacket, response[:n]...)
+
+	if err := f.InjectIncomingPacket(fullPacket); err != nil {
+		f.logger.Error1("forwarder: Failed to inject ICMP response: %v", err)
+
+		return 0
+	}
+
+	f.logger.Trace3("forwarder: Forwarded ICMP echo reply for %v type %v code %v",
+		epID(id), icmpHdr.Type(), icmpHdr.Code())
+
+	return len(fullPacket)
 }
 
 // sendICMPEvent stores flow events for ICMP packets
@@ -180,95 +152,3 @@ func (f *Forwarder) sendICMPEvent(typ nftypes.Type, flowID uuid.UUID, id stack.T
 
 	f.flowLogger.StoreEvent(fields)
 }
-
-// handleICMPViaPing handles ICMP echo requests by executing the system ping binary.
-// This is used as a fallback when raw socket access is not available.
-func (f *Forwarder) handleICMPViaPing(flowID uuid.UUID, id stack.TransportEndpointID, icmpType, icmpCode uint8, icmpData []byte, rxBytes int) {
-	ctx, cancel := context.WithTimeout(f.ctx, 5*time.Second)
-	defer cancel()
-
-	dstIP := f.determineDialAddr(id.LocalAddress)
-	cmd := buildPingCommand(ctx, dstIP, 5*time.Second)
-
-	pingStart := time.Now()
-	if err := cmd.Run(); err != nil {
-		f.logger.Warn4("forwarder: Ping binary failed for %v type %v code %v: %v", epID(id),
-			icmpType, icmpCode, err)
-		return
-	}
-	rtt := time.Since(pingStart).Round(10 * time.Microsecond)
-
-	f.logger.Trace3("forwarder: Forwarded ICMP echo request %v type %v code %v",
-		epID(id), icmpType, icmpCode)
-
-	txBytes := f.synthesizeEchoReply(id, icmpData)
-
-	f.logger.Trace4("forwarder: Forwarded ICMP echo reply %v type %v code %v (rtt=%v, ping binary)",
-		epID(id), icmpType, icmpCode, rtt)
-
-	f.sendICMPEvent(nftypes.TypeEnd, flowID, id, icmpType, icmpCode, uint64(rxBytes), uint64(txBytes))
-}
-
-// buildPingCommand creates a platform-specific ping command.
-func buildPingCommand(ctx context.Context, target net.IP, timeout time.Duration) *exec.Cmd {
-	timeoutSec := int(timeout.Seconds())
-	if timeoutSec < 1 {
-		timeoutSec = 1
-	}
-
-	switch runtime.GOOS {
-	case "linux", "android":
-		return exec.CommandContext(ctx, "ping", "-c", "1", "-W", fmt.Sprintf("%d", timeoutSec), "-q", target.String())
-	case "darwin", "ios":
-		return exec.CommandContext(ctx, "ping", "-c", "1", "-t", fmt.Sprintf("%d", timeoutSec), "-q", target.String())
-	case "freebsd":
-		return exec.CommandContext(ctx, "ping", "-c", "1", "-t", fmt.Sprintf("%d", timeoutSec), target.String())
-	case "openbsd", "netbsd":
-		return exec.CommandContext(ctx, "ping", "-c", "1", "-w", fmt.Sprintf("%d", timeoutSec), target.String())
-	case "windows":
-		return exec.CommandContext(ctx, "ping", "-n", "1", "-w", fmt.Sprintf("%d", timeoutSec*1000), target.String())
-	default:
-		return exec.CommandContext(ctx, "ping", "-c", "1", target.String())
-	}
-}
-
-// synthesizeEchoReply creates an ICMP echo reply from raw ICMP data and injects it back into the network stack.
-// Returns the size of the injected packet.
-func (f *Forwarder) synthesizeEchoReply(id stack.TransportEndpointID, icmpData []byte) int {
-	replyICMP := make([]byte, len(icmpData))
-	copy(replyICMP, icmpData)
-
-	replyICMPHdr := header.ICMPv4(replyICMP)
-	replyICMPHdr.SetType(header.ICMPv4EchoReply)
-	replyICMPHdr.SetChecksum(0)
-	replyICMPHdr.SetChecksum(header.ICMPv4Checksum(replyICMPHdr, 0))
-
-	return f.injectICMPReply(id, replyICMP)
-}
-
-// injectICMPReply wraps an ICMP payload in an IP header and injects it into the network stack.
-// Returns the total size of the injected packet, or 0 if injection failed.
-func (f *Forwarder) injectICMPReply(id stack.TransportEndpointID, icmpPayload []byte) int {
-	ipHdr := make([]byte, header.IPv4MinimumSize)
-	ip := header.IPv4(ipHdr)
-	ip.Encode(&header.IPv4Fields{
-		TotalLength: uint16(header.IPv4MinimumSize + len(icmpPayload)),
-		TTL:         64,
-		Protocol:    uint8(header.ICMPv4ProtocolNumber),
-		SrcAddr:     id.LocalAddress,
-		DstAddr:     id.RemoteAddress,
-	})
-	ip.SetChecksum(^ip.CalculateChecksum())
-
-	fullPacket := make([]byte, 0, len(ipHdr)+len(icmpPayload))
-	fullPacket = append(fullPacket, ipHdr...)
-	fullPacket = append(fullPacket, icmpPayload...)
-
-	// Bypass netstack and send directly to peer to avoid looping through our ICMP handler
-	if err := f.endpoint.device.CreateOutboundPacket(fullPacket, id.RemoteAddress.AsSlice()); err != nil {
-		f.logger.Error1("forwarder: Failed to send ICMP reply to peer: %v", err)
-		return 0
-	}
-
-	return len(fullPacket)
-}

client/firewall/uspfilter/forwarder/udp.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"net/netip"
 	"sync"
@@ -132,10 +131,10 @@ func (f *udpForwarder) cleanup() {
 }
 
 // handleUDP is called by the UDP forwarder for new packets
-func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
+func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) {
 	if f.ctx.Err() != nil {
 		f.logger.Trace("forwarder: context done, dropping UDP packet")
-		return false
+		return
 	}
 
 	id := r.ID()
@@ -145,7 +144,7 @@ func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
 	f.udpForwarder.RUnlock()
 	if exists {
 		f.logger.Trace1("forwarder: existing UDP connection for %v", epID(id))
-		return true
+		return
 	}
 
 	flowID := uuid.New()
@@ -163,7 +162,7 @@ func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
 	if err != nil {
 		f.logger.Debug2("forwarder: UDP dial error for %v: %v", epID(id), err)
 		// TODO: Send ICMP error message
-		return false
+		return
 	}
 
 	// Create wait queue for blocking syscalls
@@ -174,10 +173,10 @@ func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
 		if err := outConn.Close(); err != nil {
 			f.logger.Debug2("forwarder: UDP outConn close error for %v: %v", epID(id), err)
 		}
-		return false
+		return
 	}
 
-	inConn := gonet.NewUDPConn(&wq, ep)
+	inConn := gonet.NewUDPConn(f.stack, &wq, ep)
 	connCtx, connCancel := context.WithCancel(f.ctx)
 
 	pConn := &udpPacketConn{
@@ -200,7 +199,7 @@ func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
 		if err := outConn.Close(); err != nil {
 			f.logger.Debug2("forwarder: UDP outConn close error for %v: %v", epID(id), err)
 		}
-		return true
+		return
 	}
 	f.udpForwarder.conns[id] = pConn
 	f.udpForwarder.Unlock()
@@ -209,7 +208,6 @@ func (f *Forwarder) handleUDP(r *udp.ForwarderRequest) bool {
 	f.logger.Trace1("forwarder: established UDP connection %v", epID(id))
 
 	go f.proxyUDP(connCtx, pConn, id, ep)
-	return true
 }
 
 func (f *Forwarder) proxyUDP(ctx context.Context, pConn *udpPacketConn, id stack.TransportEndpointID, ep tcpip.Endpoint) {
@@ -350,7 +348,7 @@ func (c *udpPacketConn) copy(ctx context.Context, dst net.Conn, src net.Conn, bu
 }
 
 func isClosedError(err error) bool {
-	return errors.Is(err, net.ErrClosed) || errors.Is(err, context.Canceled) || errors.Is(err, io.EOF)
+	return errors.Is(err, net.ErrClosed) || errors.Is(err, context.Canceled)
 }
 
 func isTimeout(err error) bool {

client/firewall/uspfilter/localip.go

@@ -130,7 +130,6 @@ func (m *localIPManager) UpdateLocalIPs(iface common.IFaceMapper) (err error) {
 	// 127.0.0.0/8
 	newIPv4Bitmap[127] = &ipv4LowBitmap{}
 	for i := 0; i < 8192; i++ {
-		// #nosec G602 -- bitmap is defined as [8192]uint32, loop range is correct
 		newIPv4Bitmap[127].bitmap[i] = 0xFFFFFFFF
 	}
 

client/firewall/uspfilter/localip_test.go

@@ -218,7 +218,7 @@ func BenchmarkIPChecks(b *testing.B) {
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
 			// nolint:gosimple
-			_ = mapManager.localIPs[ip.String()]
+			_, _ = mapManager.localIPs[ip.String()]
 		}
 	})
 
@@ -227,7 +227,7 @@ func BenchmarkIPChecks(b *testing.B) {
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
 			// nolint:gosimple
-			_ = mapManager.localIPs[ip.String()]
+			_, _ = mapManager.localIPs[ip.String()]
 		}
 	})
 }

client/firewall/uspfilter/log/log.go

@@ -168,15 +168,6 @@ func (l *Logger) Warn3(format string, arg1, arg2, arg3 any) {
 	}
 }
 
-func (l *Logger) Warn4(format string, arg1, arg2, arg3, arg4 any) {
-	if l.level.Load() >= uint32(LevelWarn) {
-		select {
-		case l.msgChannel <- logMessage{level: LevelWarn, format: format, arg1: arg1, arg2: arg2, arg3: arg3, arg4: arg4}:
-		default:
-		}
-	}
-}
-
 func (l *Logger) Debug1(format string, arg1 any) {
 	if l.level.Load() >= uint32(LevelDebug) {
 		select {

client/firewall/uspfilter/nat_test.go

@@ -234,10 +234,9 @@ func TestInboundPortDNATNegative(t *testing.T) {
 			require.False(t, translated, "Packet should NOT be translated for %s", tc.name)
 
 			d = parsePacket(t, packet)
-			switch tc.protocol {
-			case layers.IPProtocolTCP:
+			if tc.protocol == layers.IPProtocolTCP {
 				require.Equal(t, tc.dstPort, uint16(d.tcp.DstPort), "Port should remain unchanged")
-			case layers.IPProtocolUDP:
+			} else if tc.protocol == layers.IPProtocolUDP {
 				require.Equal(t, tc.dstPort, uint16(d.udp.DstPort), "Port should remain unchanged")
 			}
 		})

client/firewall/uspfilter/rule.go

@@ -34,7 +34,7 @@ type RouteRule struct {
 	sources      []netip.Prefix
 	dstSet       firewall.Set
 	destinations []netip.Prefix
-	protoLayer   gopacket.LayerType
+	proto        firewall.Protocol
 	srcPort      *firewall.Port
 	dstPort      *firewall.Port
 	action       firewall.Action

client/firewall/uspfilter/tracer.go

@@ -379,9 +379,9 @@ func (m *Manager) handleNativeRouter(trace *PacketTrace) *PacketTrace {
 }
 
 func (m *Manager) handleRouteACLs(trace *PacketTrace, d *decoder, srcIP, dstIP netip.Addr) *PacketTrace {
-	protoLayer := d.decoded[1]
+	proto, _ := getProtocolFromPacket(d)
 	srcPort, dstPort := getPortsFromPacket(d)
-	id, allowed := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
+	id, allowed := m.routeACLsPass(srcIP, dstIP, proto, srcPort, dstPort)
 
 	strId := string(id)
 	if id == nil {

client/iface/bind/dual_stack_conn.go

@@ -1,169 +0,0 @@
-package bind
-
-import (
-	"errors"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-)
-
-var (
-	errNoIPv4Conn  = errors.New("no IPv4 connection available")
-	errNoIPv6Conn  = errors.New("no IPv6 connection available")
-	errInvalidAddr = errors.New("invalid address type")
-)
-
-// DualStackPacketConn wraps IPv4 and IPv6 UDP connections and routes writes
-// to the appropriate connection based on the destination address.
-// ReadFrom is not used in the hot path - ICEBind receives packets via
-// BatchReader.ReadBatch() directly. This is only used by udpMux for sending.
-type DualStackPacketConn struct {
-	ipv4Conn net.PacketConn
-	ipv6Conn net.PacketConn
-
-	readFromWarn sync.Once
-}
-
-// NewDualStackPacketConn creates a new dual-stack packet connection.
-func NewDualStackPacketConn(ipv4Conn, ipv6Conn net.PacketConn) *DualStackPacketConn {
-	return &DualStackPacketConn{
-		ipv4Conn: ipv4Conn,
-		ipv6Conn: ipv6Conn,
-	}
-}
-
-// ReadFrom reads from the available connection (preferring IPv4).
-// NOTE: This method is NOT used in the data path. ICEBind receives packets via
-// BatchReader.ReadBatch() directly for both IPv4 and IPv6, which is much more efficient.
-// This implementation exists only to satisfy the net.PacketConn interface for the udpMux,
-// but the udpMux only uses WriteTo() for sending STUN responses - it never calls ReadFrom()
-// because STUN packets are filtered and forwarded via HandleSTUNMessage() from the receive path.
-func (d *DualStackPacketConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
-	d.readFromWarn.Do(func() {
-		log.Warn("DualStackPacketConn.ReadFrom called - this is unexpected and may indicate an inefficient code path")
-	})
-
-	if d.ipv4Conn != nil {
-		return d.ipv4Conn.ReadFrom(b)
-	}
-	if d.ipv6Conn != nil {
-		return d.ipv6Conn.ReadFrom(b)
-	}
-	return 0, nil, net.ErrClosed
-}
-
-// WriteTo writes to the appropriate connection based on the address type.
-func (d *DualStackPacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
-	udpAddr, ok := addr.(*net.UDPAddr)
-	if !ok {
-		return 0, &net.OpError{
-			Op:   "write",
-			Net:  "udp",
-			Addr: addr,
-			Err:  errInvalidAddr,
-		}
-	}
-
-	if udpAddr.IP.To4() == nil {
-		if d.ipv6Conn != nil {
-			return d.ipv6Conn.WriteTo(b, addr)
-		}
-		return 0, &net.OpError{
-			Op:   "write",
-			Net:  "udp6",
-			Addr: addr,
-			Err:  errNoIPv6Conn,
-		}
-	}
-
-	if d.ipv4Conn != nil {
-		return d.ipv4Conn.WriteTo(b, addr)
-	}
-	return 0, &net.OpError{
-		Op:   "write",
-		Net:  "udp4",
-		Addr: addr,
-		Err:  errNoIPv4Conn,
-	}
-}
-
-// Close closes both connections.
-func (d *DualStackPacketConn) Close() error {
-	var result *multierror.Error
-	if d.ipv4Conn != nil {
-		if err := d.ipv4Conn.Close(); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	if d.ipv6Conn != nil {
-		if err := d.ipv6Conn.Close(); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-// LocalAddr returns the local address of the IPv4 connection if available,
-// otherwise the IPv6 connection.
-func (d *DualStackPacketConn) LocalAddr() net.Addr {
-	if d.ipv4Conn != nil {
-		return d.ipv4Conn.LocalAddr()
-	}
-	if d.ipv6Conn != nil {
-		return d.ipv6Conn.LocalAddr()
-	}
-	return nil
-}
-
-// SetDeadline sets the deadline for both connections.
-func (d *DualStackPacketConn) SetDeadline(t time.Time) error {
-	var result *multierror.Error
-	if d.ipv4Conn != nil {
-		if err := d.ipv4Conn.SetDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	if d.ipv6Conn != nil {
-		if err := d.ipv6Conn.SetDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-// SetReadDeadline sets the read deadline for both connections.
-func (d *DualStackPacketConn) SetReadDeadline(t time.Time) error {
-	var result *multierror.Error
-	if d.ipv4Conn != nil {
-		if err := d.ipv4Conn.SetReadDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	if d.ipv6Conn != nil {
-		if err := d.ipv6Conn.SetReadDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-// SetWriteDeadline sets the write deadline for both connections.
-func (d *DualStackPacketConn) SetWriteDeadline(t time.Time) error {
-	var result *multierror.Error
-	if d.ipv4Conn != nil {
-		if err := d.ipv4Conn.SetWriteDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	if d.ipv6Conn != nil {
-		if err := d.ipv6Conn.SetWriteDeadline(t); err != nil {
-			result = multierror.Append(result, err)
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}

client/iface/bind/dual_stack_conn_bench_test.go

@@ -1,119 +0,0 @@
-package bind
-
-import (
-	"net"
-	"testing"
-)
-
-var (
-	ipv4Addr = &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 12345}
-	ipv6Addr = &net.UDPAddr{IP: net.ParseIP("::1"), Port: 12345}
-	payload  = make([]byte, 1200)
-)
-
-func BenchmarkWriteTo_DirectUDPConn(b *testing.B) {
-	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer conn.Close()
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = conn.WriteTo(payload, ipv4Addr)
-	}
-}
-
-func BenchmarkWriteTo_DualStack_IPv4Only(b *testing.B) {
-	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer conn.Close()
-
-	ds := NewDualStackPacketConn(conn, nil)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ds.WriteTo(payload, ipv4Addr)
-	}
-}
-
-func BenchmarkWriteTo_DualStack_IPv6Only(b *testing.B) {
-	conn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		b.Skipf("IPv6 not available: %v", err)
-	}
-	defer conn.Close()
-
-	ds := NewDualStackPacketConn(nil, conn)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ds.WriteTo(payload, ipv6Addr)
-	}
-}
-
-func BenchmarkWriteTo_DualStack_Both_IPv4Traffic(b *testing.B) {
-	conn4, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer conn4.Close()
-
-	conn6, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		b.Skipf("IPv6 not available: %v", err)
-	}
-	defer conn6.Close()
-
-	ds := NewDualStackPacketConn(conn4, conn6)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ds.WriteTo(payload, ipv4Addr)
-	}
-}
-
-func BenchmarkWriteTo_DualStack_Both_IPv6Traffic(b *testing.B) {
-	conn4, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer conn4.Close()
-
-	conn6, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		b.Skipf("IPv6 not available: %v", err)
-	}
-	defer conn6.Close()
-
-	ds := NewDualStackPacketConn(conn4, conn6)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ds.WriteTo(payload, ipv6Addr)
-	}
-}
-
-func BenchmarkWriteTo_DualStack_Both_MixedTraffic(b *testing.B) {
-	conn4, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	if err != nil {
-		b.Fatal(err)
-	}
-	defer conn4.Close()
-
-	conn6, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		b.Skipf("IPv6 not available: %v", err)
-	}
-	defer conn6.Close()
-
-	ds := NewDualStackPacketConn(conn4, conn6)
-	addrs := []net.Addr{ipv4Addr, ipv6Addr}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ds.WriteTo(payload, addrs[i&1])
-	}
-}

client/iface/bind/dual_stack_conn_test.go

@@ -1,191 +0,0 @@
-package bind
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDualStackPacketConn_RoutesWritesToCorrectSocket(t *testing.T) {
-	ipv4Conn := &mockPacketConn{network: "udp4"}
-	ipv6Conn := &mockPacketConn{network: "udp6"}
-	dualStack := NewDualStackPacketConn(ipv4Conn, ipv6Conn)
-
-	tests := []struct {
-		name       string
-		addr       *net.UDPAddr
-		wantSocket string
-	}{
-		{
-			name:       "IPv4 address",
-			addr:       &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 1234},
-			wantSocket: "udp4",
-		},
-		{
-			name:       "IPv6 address",
-			addr:       &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234},
-			wantSocket: "udp6",
-		},
-		{
-			name:       "IPv4-mapped IPv6 goes to IPv4",
-			addr:       &net.UDPAddr{IP: net.ParseIP("::ffff:192.168.1.1"), Port: 1234},
-			wantSocket: "udp4",
-		},
-		{
-			name:       "IPv4 loopback",
-			addr:       &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 1234},
-			wantSocket: "udp4",
-		},
-		{
-			name:       "IPv6 loopback",
-			addr:       &net.UDPAddr{IP: net.ParseIP("::1"), Port: 1234},
-			wantSocket: "udp6",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ipv4Conn.writeCount = 0
-			ipv6Conn.writeCount = 0
-
-			n, err := dualStack.WriteTo([]byte("test"), tt.addr)
-			require.NoError(t, err)
-			assert.Equal(t, 4, n)
-
-			if tt.wantSocket == "udp4" {
-				assert.Equal(t, 1, ipv4Conn.writeCount, "expected write to IPv4")
-				assert.Equal(t, 0, ipv6Conn.writeCount, "expected no write to IPv6")
-			} else {
-				assert.Equal(t, 0, ipv4Conn.writeCount, "expected no write to IPv4")
-				assert.Equal(t, 1, ipv6Conn.writeCount, "expected write to IPv6")
-			}
-		})
-	}
-}
-
-func TestDualStackPacketConn_IPv4OnlyRejectsIPv6(t *testing.T) {
-	dualStack := NewDualStackPacketConn(&mockPacketConn{network: "udp4"}, nil)
-
-	// IPv4 works
-	_, err := dualStack.WriteTo([]byte("test"), &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 1234})
-	require.NoError(t, err)
-
-	// IPv6 fails
-	_, err = dualStack.WriteTo([]byte("test"), &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no IPv6 connection")
-}
-
-func TestDualStackPacketConn_IPv6OnlyRejectsIPv4(t *testing.T) {
-	dualStack := NewDualStackPacketConn(nil, &mockPacketConn{network: "udp6"})
-
-	// IPv6 works
-	_, err := dualStack.WriteTo([]byte("test"), &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234})
-	require.NoError(t, err)
-
-	// IPv4 fails
-	_, err = dualStack.WriteTo([]byte("test"), &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 1234})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no IPv4 connection")
-}
-
-// TestDualStackPacketConn_ReadFromIsNotUsedInHotPath documents that ReadFrom
-// only reads from one socket (IPv4 preferred). This is fine because the actual
-// receive path uses wireguard-go's BatchReader directly, not ReadFrom.
-func TestDualStackPacketConn_ReadFromIsNotUsedInHotPath(t *testing.T) {
-	ipv4Conn := &mockPacketConn{
-		network:  "udp4",
-		readData: []byte("from ipv4"),
-		readAddr: &net.UDPAddr{IP: net.ParseIP("192.168.1.1"), Port: 1234},
-	}
-	ipv6Conn := &mockPacketConn{
-		network:  "udp6",
-		readData: []byte("from ipv6"),
-		readAddr: &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234},
-	}
-
-	dualStack := NewDualStackPacketConn(ipv4Conn, ipv6Conn)
-
-	buf := make([]byte, 100)
-	n, addr, err := dualStack.ReadFrom(buf)
-
-	require.NoError(t, err)
-	// reads from IPv4 (preferred) - this is expected behavior
-	assert.Equal(t, "from ipv4", string(buf[:n]))
-	assert.Equal(t, "192.168.1.1", addr.(*net.UDPAddr).IP.String())
-}
-
-func TestDualStackPacketConn_LocalAddrPrefersIPv4(t *testing.T) {
-	ipv4Addr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 51820}
-	ipv6Addr := &net.UDPAddr{IP: net.ParseIP("::"), Port: 51820}
-
-	tests := []struct {
-		name     string
-		ipv4     net.PacketConn
-		ipv6     net.PacketConn
-		wantAddr net.Addr
-	}{
-		{
-			name:     "both available returns IPv4",
-			ipv4:     &mockPacketConn{localAddr: ipv4Addr},
-			ipv6:     &mockPacketConn{localAddr: ipv6Addr},
-			wantAddr: ipv4Addr,
-		},
-		{
-			name:     "IPv4 only",
-			ipv4:     &mockPacketConn{localAddr: ipv4Addr},
-			ipv6:     nil,
-			wantAddr: ipv4Addr,
-		},
-		{
-			name:     "IPv6 only",
-			ipv4:     nil,
-			ipv6:     &mockPacketConn{localAddr: ipv6Addr},
-			wantAddr: ipv6Addr,
-		},
-		{
-			name:     "neither returns nil",
-			ipv4:     nil,
-			ipv6:     nil,
-			wantAddr: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			dualStack := NewDualStackPacketConn(tt.ipv4, tt.ipv6)
-			assert.Equal(t, tt.wantAddr, dualStack.LocalAddr())
-		})
-	}
-}
-
-// mock
-
-type mockPacketConn struct {
-	network    string
-	writeCount int
-	readData   []byte
-	readAddr   net.Addr
-	localAddr  net.Addr
-}
-
-func (m *mockPacketConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
-	if m.readData != nil {
-		return copy(b, m.readData), m.readAddr, nil
-	}
-	return 0, nil, nil
-}
-
-func (m *mockPacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
-	m.writeCount++
-	return len(b), nil
-}
-
-func (m *mockPacketConn) Close() error                       { return nil }
-func (m *mockPacketConn) LocalAddr() net.Addr                { return m.localAddr }
-func (m *mockPacketConn) SetDeadline(t time.Time) error      { return nil }
-func (m *mockPacketConn) SetReadDeadline(t time.Time) error  { return nil }
-func (m *mockPacketConn) SetWriteDeadline(t time.Time) error { return nil }

client/iface/bind/ice_bind.go

@@ -14,6 +14,7 @@ import (
 	"github.com/pion/stun/v3"
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
 	wgConn "golang.zx2c4.com/wireguard/conn"
 
@@ -26,8 +27,8 @@ type receiverCreator struct {
 	iceBind *ICEBind
 }
 
-func (rc receiverCreator) CreateReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgConn.ReceiveFunc {
-	return rc.iceBind.createReceiverFn(pc, conn, rxOffload, msgPool)
+func (rc receiverCreator) CreateIPv4ReceiverFn(pc *ipv4.PacketConn, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgConn.ReceiveFunc {
+	return rc.iceBind.createIPv4ReceiverFn(pc, conn, rxOffload, msgPool)
 }
 
 // ICEBind is a bind implementation with two main features:
@@ -57,8 +58,6 @@ type ICEBind struct {
 
 	muUDPMux sync.Mutex
 	udpMux   *udpmux.UniversalUDPMuxDefault
-	ipv4Conn *net.UDPConn
-	ipv6Conn *net.UDPConn
 }
 
 func NewICEBind(transportNet transport.Net, filterFn udpmux.FilterFn, address wgaddr.Address, mtu uint16) *ICEBind {
@@ -104,12 +103,6 @@ func (s *ICEBind) Close() error {
 
 	close(s.closedChan)
 
-	s.muUDPMux.Lock()
-	s.ipv4Conn = nil
-	s.ipv6Conn = nil
-	s.udpMux = nil
-	s.muUDPMux.Unlock()
-
 	return s.StdNetBind.Close()
 }
 
@@ -167,18 +160,19 @@ func (b *ICEBind) Send(bufs [][]byte, ep wgConn.Endpoint) error {
 	return nil
 }
 
-func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgConn.ReceiveFunc {
+func (s *ICEBind) createIPv4ReceiverFn(pc *ipv4.PacketConn, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgConn.ReceiveFunc {
 	s.muUDPMux.Lock()
 	defer s.muUDPMux.Unlock()
 
-	// Detect IPv4 vs IPv6 from connection's local address
-	if localAddr := conn.LocalAddr().(*net.UDPAddr); localAddr.IP.To4() != nil {
-		s.ipv4Conn = conn
-	} else {
-		s.ipv6Conn = conn
-	}
-	s.createOrUpdateMux()
-
+	s.udpMux = udpmux.NewUniversalUDPMuxDefault(
+		udpmux.UniversalUDPMuxParams{
+			UDPConn:   nbnet.WrapPacketConn(conn),
+			Net:       s.transportNet,
+			FilterFn:  s.filterFn,
+			WGAddress: s.address,
+			MTU:       s.mtu,
+		},
+	)
 	return func(bufs [][]byte, sizes []int, eps []wgConn.Endpoint) (n int, err error) {
 		msgs := getMessages(msgsPool)
 		for i := range bufs {
@@ -186,13 +180,12 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 			(*msgs)[i].OOB = (*msgs)[i].OOB[:cap((*msgs)[i].OOB)]
 		}
 		defer putMessages(msgs, msgsPool)
-
 		var numMsgs int
 		if runtime.GOOS == "linux" || runtime.GOOS == "android" {
 			if rxOffload {
 				readAt := len(*msgs) - (wgConn.IdealBatchSize / wgConn.UdpSegmentMaxDatagrams)
-				//nolint:staticcheck
-				_, err = pc.ReadBatch((*msgs)[readAt:], 0)
+				//nolint
+				numMsgs, err = pc.ReadBatch((*msgs)[readAt:], 0)
 				if err != nil {
 					return 0, err
 				}
@@ -214,12 +207,12 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 			}
 			numMsgs = 1
 		}
-
 		for i := 0; i < numMsgs; i++ {
 			msg := &(*msgs)[i]
 
 			// todo: handle err
-			if ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
+			ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr)
+			if ok {
 				continue
 			}
 			sizes[i] = msg.N
@@ -240,38 +233,6 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 	}
 }
 
-// createOrUpdateMux creates or updates the UDP mux with the available connections.
-// Must be called with muUDPMux held.
-func (s *ICEBind) createOrUpdateMux() {
-	var muxConn net.PacketConn
-
-	switch {
-	case s.ipv4Conn != nil && s.ipv6Conn != nil:
-		muxConn = NewDualStackPacketConn(
-			nbnet.WrapPacketConn(s.ipv4Conn),
-			nbnet.WrapPacketConn(s.ipv6Conn),
-		)
-	case s.ipv4Conn != nil:
-		muxConn = nbnet.WrapPacketConn(s.ipv4Conn)
-	case s.ipv6Conn != nil:
-		muxConn = nbnet.WrapPacketConn(s.ipv6Conn)
-	default:
-		return
-	}
-
-	// Don't close the old mux - it doesn't own the underlying connections.
-	// The sockets are managed by WireGuard's StdNetBind, not by us.
-	s.udpMux = udpmux.NewUniversalUDPMuxDefault(
-		udpmux.UniversalUDPMuxParams{
-			UDPConn:   muxConn,
-			Net:       s.transportNet,
-			FilterFn:  s.filterFn,
-			WGAddress: s.address,
-			MTU:       s.mtu,
-		},
-	)
-}
-
 func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr) (bool, error) {
 	for i := range buffers {
 		if !stun.IsMessage(buffers[i]) {
@@ -284,14 +245,9 @@ func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr)
 			return true, err
 		}
 
-		s.muUDPMux.Lock()
-		mux := s.udpMux
-		s.muUDPMux.Unlock()
-
-		if mux != nil {
-			if muxErr := mux.HandleSTUNMessage(msg, addr); muxErr != nil {
-				log.Warnf("failed to handle STUN packet: %v", muxErr)
-			}
+		muxErr := s.udpMux.HandleSTUNMessage(msg, addr)
+		if muxErr != nil {
+			log.Warnf("failed to handle STUN packet")
 		}
 
 		buffers[i] = []byte{}

client/iface/bind/ice_bind_test.go

@@ -1,324 +0,0 @@
-package bind
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/pion/transport/v3/stdnet"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
-
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func TestICEBind_CreatesReceiverForBothIPv4AndIPv6(t *testing.T) {
-	iceBind := setupICEBind(t)
-
-	ipv4Conn, ipv6Conn := createDualStackConns(t)
-	defer ipv4Conn.Close()
-	defer ipv6Conn.Close()
-
-	rc := receiverCreator{iceBind}
-	pool := createMsgPool()
-
-	// Simulate wireguard-go calling CreateReceiverFn for IPv4
-	ipv4RecvFn := rc.CreateReceiverFn(ipv4.NewPacketConn(ipv4Conn), ipv4Conn, false, pool)
-	require.NotNil(t, ipv4RecvFn)
-
-	iceBind.muUDPMux.Lock()
-	assert.NotNil(t, iceBind.ipv4Conn, "should store IPv4 connection")
-	assert.Nil(t, iceBind.ipv6Conn, "IPv6 not added yet")
-	assert.NotNil(t, iceBind.udpMux, "mux should be created after first connection")
-	iceBind.muUDPMux.Unlock()
-
-	// Simulate wireguard-go calling CreateReceiverFn for IPv6
-	ipv6RecvFn := rc.CreateReceiverFn(ipv6.NewPacketConn(ipv6Conn), ipv6Conn, false, pool)
-	require.NotNil(t, ipv6RecvFn)
-
-	iceBind.muUDPMux.Lock()
-	assert.NotNil(t, iceBind.ipv4Conn, "should still have IPv4 connection")
-	assert.NotNil(t, iceBind.ipv6Conn, "should now have IPv6 connection")
-	assert.NotNil(t, iceBind.udpMux, "mux should still exist")
-	iceBind.muUDPMux.Unlock()
-
-	mux, err := iceBind.GetICEMux()
-	require.NoError(t, err)
-	require.NotNil(t, mux)
-}
-
-func TestICEBind_WorksWithIPv4Only(t *testing.T) {
-	iceBind := setupICEBind(t)
-
-	ipv4Conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	require.NoError(t, err)
-	defer ipv4Conn.Close()
-
-	rc := receiverCreator{iceBind}
-	recvFn := rc.CreateReceiverFn(ipv4.NewPacketConn(ipv4Conn), ipv4Conn, false, createMsgPool())
-	require.NotNil(t, recvFn)
-
-	iceBind.muUDPMux.Lock()
-	assert.NotNil(t, iceBind.ipv4Conn)
-	assert.Nil(t, iceBind.ipv6Conn)
-	assert.NotNil(t, iceBind.udpMux)
-	iceBind.muUDPMux.Unlock()
-
-	mux, err := iceBind.GetICEMux()
-	require.NoError(t, err)
-	require.NotNil(t, mux)
-}
-
-func TestICEBind_WorksWithIPv6Only(t *testing.T) {
-	iceBind := setupICEBind(t)
-
-	ipv6Conn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		t.Skipf("IPv6 not available: %v", err)
-	}
-	defer ipv6Conn.Close()
-
-	rc := receiverCreator{iceBind}
-	recvFn := rc.CreateReceiverFn(ipv6.NewPacketConn(ipv6Conn), ipv6Conn, false, createMsgPool())
-	require.NotNil(t, recvFn)
-
-	iceBind.muUDPMux.Lock()
-	assert.Nil(t, iceBind.ipv4Conn)
-	assert.NotNil(t, iceBind.ipv6Conn)
-	assert.NotNil(t, iceBind.udpMux)
-	iceBind.muUDPMux.Unlock()
-
-	mux, err := iceBind.GetICEMux()
-	require.NoError(t, err)
-	require.NotNil(t, mux)
-}
-
-// TestICEBind_SendsToIPv4AndIPv6PeersSimultaneously verifies that we can communicate
-// with peers on different address families through the same DualStackPacketConn.
-func TestICEBind_SendsToIPv4AndIPv6PeersSimultaneously(t *testing.T) {
-	// two "remote peers" listening on different address families
-	ipv4Peer := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer ipv4Peer.Close()
-
-	ipv6Peer, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
-	if err != nil {
-		t.Skipf("IPv6 not available: %v", err)
-	}
-	defer ipv6Peer.Close()
-
-	// our local dual-stack connection
-	ipv4Local := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer ipv4Local.Close()
-
-	ipv6Local := listenUDP(t, "udp6", "[::1]:0")
-	defer ipv6Local.Close()
-
-	dualStack := NewDualStackPacketConn(ipv4Local, ipv6Local)
-
-	// send to both peers
-	_, err = dualStack.WriteTo([]byte("to-ipv4"), ipv4Peer.LocalAddr())
-	require.NoError(t, err)
-
-	_, err = dualStack.WriteTo([]byte("to-ipv6"), ipv6Peer.LocalAddr())
-	require.NoError(t, err)
-
-	// verify IPv4 peer got its packet from the IPv4 socket
-	buf := make([]byte, 100)
-	_ = ipv4Peer.SetReadDeadline(time.Now().Add(time.Second))
-	n, addr, err := ipv4Peer.ReadFrom(buf)
-	require.NoError(t, err)
-	assert.Equal(t, "to-ipv4", string(buf[:n]))
-	assert.Equal(t, ipv4Local.LocalAddr().(*net.UDPAddr).Port, addr.(*net.UDPAddr).Port)
-
-	// verify IPv6 peer got its packet from the IPv6 socket
-	_ = ipv6Peer.SetReadDeadline(time.Now().Add(time.Second))
-	n, addr, err = ipv6Peer.ReadFrom(buf)
-	require.NoError(t, err)
-	assert.Equal(t, "to-ipv6", string(buf[:n]))
-	assert.Equal(t, ipv6Local.LocalAddr().(*net.UDPAddr).Port, addr.(*net.UDPAddr).Port)
-}
-
-// TestICEBind_HandlesConcurrentMixedTraffic sends packets concurrently to both IPv4
-// and IPv6 peers. Verifies no packets get misrouted (IPv4 peer only gets v4- packets,
-// IPv6 peer only gets v6- packets). Some packet loss is acceptable for UDP.
-func TestICEBind_HandlesConcurrentMixedTraffic(t *testing.T) {
-	ipv4Peer := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer ipv4Peer.Close()
-
-	ipv6Peer, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
-	if err != nil {
-		t.Skipf("IPv6 not available: %v", err)
-	}
-	defer ipv6Peer.Close()
-
-	ipv4Local := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer ipv4Local.Close()
-
-	ipv6Local := listenUDP(t, "udp6", "[::1]:0")
-	defer ipv6Local.Close()
-
-	dualStack := NewDualStackPacketConn(ipv4Local, ipv6Local)
-
-	const packetsPerFamily = 500
-
-	ipv4Received := make(chan string, packetsPerFamily)
-	ipv6Received := make(chan string, packetsPerFamily)
-
-	startGate := make(chan struct{})
-	var wg sync.WaitGroup
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		buf := make([]byte, 100)
-		for i := 0; i < packetsPerFamily; i++ {
-			n, _, err := ipv4Peer.ReadFrom(buf)
-			if err != nil {
-				return
-			}
-			ipv4Received <- string(buf[:n])
-		}
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		buf := make([]byte, 100)
-		for i := 0; i < packetsPerFamily; i++ {
-			n, _, err := ipv6Peer.ReadFrom(buf)
-			if err != nil {
-				return
-			}
-			ipv6Received <- string(buf[:n])
-		}
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		<-startGate
-		for i := 0; i < packetsPerFamily; i++ {
-			_, _ = dualStack.WriteTo([]byte(fmt.Sprintf("v4-%04d", i)), ipv4Peer.LocalAddr())
-		}
-	}()
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		<-startGate
-		for i := 0; i < packetsPerFamily; i++ {
-			_, _ = dualStack.WriteTo([]byte(fmt.Sprintf("v6-%04d", i)), ipv6Peer.LocalAddr())
-		}
-	}()
-
-	close(startGate)
-
-	time.AfterFunc(5*time.Second, func() {
-		_ = ipv4Peer.SetReadDeadline(time.Now())
-		_ = ipv6Peer.SetReadDeadline(time.Now())
-	})
-
-	wg.Wait()
-	close(ipv4Received)
-	close(ipv6Received)
-
-	ipv4Count := 0
-	for pkt := range ipv4Received {
-		require.True(t, len(pkt) >= 3 && pkt[:3] == "v4-", "IPv4 peer got misrouted packet: %s", pkt)
-		ipv4Count++
-	}
-
-	ipv6Count := 0
-	for pkt := range ipv6Received {
-		require.True(t, len(pkt) >= 3 && pkt[:3] == "v6-", "IPv6 peer got misrouted packet: %s", pkt)
-		ipv6Count++
-	}
-
-	assert.Equal(t, packetsPerFamily, ipv4Count)
-	assert.Equal(t, packetsPerFamily, ipv6Count)
-}
-
-func TestICEBind_DetectsAddressFamilyFromConnection(t *testing.T) {
-	tests := []struct {
-		name     string
-		network  string
-		addr     string
-		wantIPv4 bool
-	}{
-		{"IPv4 any", "udp4", "0.0.0.0:0", true},
-		{"IPv4 loopback", "udp4", "127.0.0.1:0", true},
-		{"IPv6 any", "udp6", "[::]:0", false},
-		{"IPv6 loopback", "udp6", "[::1]:0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			addr, err := net.ResolveUDPAddr(tt.network, tt.addr)
-			require.NoError(t, err)
-
-			conn, err := net.ListenUDP(tt.network, addr)
-			if err != nil {
-				t.Skipf("%s not available: %v", tt.network, err)
-			}
-			defer conn.Close()
-
-			localAddr := conn.LocalAddr().(*net.UDPAddr)
-			isIPv4 := localAddr.IP.To4() != nil
-			assert.Equal(t, tt.wantIPv4, isIPv4)
-		})
-	}
-}
-
-// helpers
-
-func setupICEBind(t *testing.T) *ICEBind {
-	t.Helper()
-	transportNet, err := stdnet.NewNet()
-	require.NoError(t, err)
-
-	address := wgaddr.Address{
-		IP:      netip.MustParseAddr("100.64.0.1"),
-		Network: netip.MustParsePrefix("100.64.0.0/10"),
-	}
-	return NewICEBind(transportNet, nil, address, 1280)
-}
-
-func createDualStackConns(t *testing.T) (*net.UDPConn, *net.UDPConn) {
-	t.Helper()
-	ipv4Conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
-	require.NoError(t, err)
-
-	ipv6Conn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
-	if err != nil {
-		ipv4Conn.Close()
-		t.Skipf("IPv6 not available: %v", err)
-	}
-	return ipv4Conn, ipv6Conn
-}
-
-func createMsgPool() *sync.Pool {
-	return &sync.Pool{
-		New: func() any {
-			msgs := make([]ipv6.Message, 1)
-			for i := range msgs {
-				msgs[i].Buffers = make(net.Buffers, 1)
-				msgs[i].OOB = make([]byte, 0, 40)
-			}
-			return &msgs
-		},
-	}
-}
-
-func listenUDP(t *testing.T, network, addr string) *net.UDPConn {
-	t.Helper()
-	udpAddr, err := net.ResolveUDPAddr(network, addr)
-	require.NoError(t, err)
-	conn, err := net.ListenUDP(network, udpAddr)
-	require.NoError(t, err)
-	return conn
-}

client/iface/configurer/common.go

@@ -3,22 +3,8 @@ package configurer
 import (
 	"net"
 	"net/netip"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// buildPresharedKeyConfig creates a wgtypes.Config for setting a preshared key on a peer.
-// This is a shared helper used by both kernel and userspace configurers.
-func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bool) wgtypes.Config {
-	return wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey:    peerKey,
-			PresharedKey: &psk,
-			UpdateOnly:   updateOnly,
-		}},
-	}
-}
-
 func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
 	ipNets := make([]net.IPNet, len(prefixes))
 	for i, prefix := range prefixes {

client/iface/configurer/kernel_unix.go

@@ -15,6 +15,8 @@ import (
 	"github.com/netbirdio/netbird/monotime"
 )
 
+var zeroKey wgtypes.Key
+
 type KernelConfigurer struct {
 	deviceName string
 }
@@ -46,18 +48,6 @@ func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error
 	return nil
 }
 
-// SetPresharedKey sets the preshared key for a peer.
-// If updateOnly is true, only updates the existing peer; if false, creates or updates.
-func (c *KernelConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error {
-	parsedPeerKey, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	cfg := buildPresharedKeyConfig(parsedPeerKey, psk, updateOnly)
-	return c.configure(cfg)
-}
-
 func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
@@ -289,7 +279,7 @@ func (c *KernelConfigurer) FullStats() (*Stats, error) {
 			TxBytes:       p.TransmitBytes,
 			RxBytes:       p.ReceiveBytes,
 			LastHandshake: p.LastHandshakeTime,
-			PresharedKey:  [32]byte(p.PresharedKey),
+			PresharedKey:  p.PresharedKey != zeroKey,
 		}
 		if p.Endpoint != nil {
 			peer.Endpoint = *p.Endpoint

client/iface/configurer/usp.go

@@ -22,16 +22,17 @@ import (
 )
 
 const (
-	privateKey                 = "private_key"
-	ipcKeyLastHandshakeTimeSec = "last_handshake_time_sec"
-	ipcKeyTxBytes              = "tx_bytes"
-	ipcKeyRxBytes              = "rx_bytes"
-	allowedIP                  = "allowed_ip"
-	endpoint                   = "endpoint"
-	fwmark                     = "fwmark"
-	listenPort                 = "listen_port"
-	publicKey                  = "public_key"
-	presharedKey               = "preshared_key"
+	privateKey                  = "private_key"
+	ipcKeyLastHandshakeTimeSec  = "last_handshake_time_sec"
+	ipcKeyLastHandshakeTimeNsec = "last_handshake_time_nsec"
+	ipcKeyTxBytes               = "tx_bytes"
+	ipcKeyRxBytes               = "rx_bytes"
+	allowedIP                   = "allowed_ip"
+	endpoint                    = "endpoint"
+	fwmark                      = "fwmark"
+	listenPort                  = "listen_port"
+	publicKey                   = "public_key"
+	presharedKey                = "preshared_key"
 )
 
 var ErrAllowedIPNotFound = fmt.Errorf("allowed IP not found")
@@ -71,18 +72,6 @@ func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error
 	return c.device.IpcSet(toWgUserspaceString(config))
 }
 
-// SetPresharedKey sets the preshared key for a peer.
-// If updateOnly is true, only updates the existing peer; if false, creates or updates.
-func (c *WGUSPConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error {
-	parsedPeerKey, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	cfg := buildPresharedKeyConfig(parsedPeerKey, psk, updateOnly)
-	return c.device.IpcSet(toWgUserspaceString(cfg))
-}
-
 func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
@@ -433,25 +422,13 @@ func toWgUserspaceString(wgCfg wgtypes.Config) string {
 		hexKey := hex.EncodeToString(p.PublicKey[:])
 		sb.WriteString(fmt.Sprintf("public_key=%s\n", hexKey))
 
-		if p.Remove {
-			sb.WriteString("remove=true\n")
-		}
-
-		if p.UpdateOnly {
-			sb.WriteString("update_only=true\n")
-		}
-
 		if p.PresharedKey != nil {
 			preSharedHexKey := hex.EncodeToString(p.PresharedKey[:])
 			sb.WriteString(fmt.Sprintf("preshared_key=%s\n", preSharedHexKey))
 		}
 
-		if p.Endpoint != nil {
-			sb.WriteString(fmt.Sprintf("endpoint=%s\n", p.Endpoint.String()))
-		}
-
-		if p.PersistentKeepaliveInterval != nil {
-			sb.WriteString(fmt.Sprintf("persistent_keepalive_interval=%d\n", int(p.PersistentKeepaliveInterval.Seconds())))
+		if p.Remove {
+			sb.WriteString("remove=true")
 		}
 
 		if p.ReplaceAllowedIPs {
@@ -461,6 +438,14 @@ func toWgUserspaceString(wgCfg wgtypes.Config) string {
 		for _, aip := range p.AllowedIPs {
 			sb.WriteString(fmt.Sprintf("allowed_ip=%s\n", aip.String()))
 		}
+
+		if p.Endpoint != nil {
+			sb.WriteString(fmt.Sprintf("endpoint=%s\n", p.Endpoint.String()))
+		}
+
+		if p.PersistentKeepaliveInterval != nil {
+			sb.WriteString(fmt.Sprintf("persistent_keepalive_interval=%d\n", int(p.PersistentKeepaliveInterval.Seconds())))
+		}
 	}
 	return sb.String()
 }
@@ -614,9 +599,7 @@ func parseStatus(deviceName, ipcStr string) (*Stats, error) {
 				continue
 			}
 			if val != "" && val != "0000000000000000000000000000000000000000000000000000000000000000" {
-				if pskKey, err := hexToWireguardKey(val); err == nil {
-					currentPeer.PresharedKey = [32]byte(pskKey)
-				}
+				currentPeer.PresharedKey = true
 			}
 		}
 	}

client/iface/configurer/wgshow.go

@@ -12,7 +12,7 @@ type Peer struct {
 	TxBytes       int64
 	RxBytes       int64
 	LastHandshake time.Time
-	PresharedKey  [32]byte
+	PresharedKey  bool
 }
 
 type Stats struct {

client/iface/device/device_ios.go

@@ -1,7 +1,9 @@
+//go:build ios
+// +build ios
+
 package device
 
 import (
-	"fmt"
 	"os"
 
 	log "github.com/sirupsen/logrus"
@@ -43,31 +45,10 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 	}
 }
 
-// ErrInvalidTunnelFD is returned when the tunnel file descriptor is invalid (0).
-// This typically means the Swift code couldn't find the utun control socket.
-var ErrInvalidTunnelFD = fmt.Errorf("invalid tunnel file descriptor: fd is 0 (Swift failed to locate utun socket)")
-
 func (t *TunDevice) Create() (WGConfigurer, error) {
 	log.Infof("create tun interface")
 
-	var tunDevice tun.Device
-	var err error
-
-	// Validate the tunnel file descriptor.
-	// On iOS/tvOS, the FD must be provided by the NEPacketTunnelProvider.
-	// A value of 0 means the Swift code couldn't find the utun control socket
-	// (the low-level APIs like ctl_info, sockaddr_ctl may not be exposed in
-	// tvOS SDK headers). This is a hard error - there's no viable fallback
-	// since tun.CreateTUN() cannot work within the iOS/tvOS sandbox.
-	if t.tunFd == 0 {
-		log.Errorf("Tunnel file descriptor is 0 - Swift code failed to locate the utun control socket. " +
-			"On tvOS, ensure the NEPacketTunnelProvider is properly configured and the tunnel is started.")
-		return nil, ErrInvalidTunnelFD
-	}
-
-	// Normal iOS/tvOS path: use the provided file descriptor from NEPacketTunnelProvider
-	var dupTunFd int
-	dupTunFd, err = unix.Dup(t.tunFd)
+	dupTunFd, err := unix.Dup(t.tunFd)
 	if err != nil {
 		log.Errorf("Unable to dup tun fd: %v", err)
 		return nil, err
@@ -79,7 +60,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 		_ = unix.Close(dupTunFd)
 		return nil, err
 	}
-	tunDevice, err = tun.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
+	tunDevice, err := tun.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
 	if err != nil {
 		log.Errorf("Unable to create new tun device from fd: %v", err)
 		_ = unix.Close(dupTunFd)

client/iface/device/interface.go

@@ -17,7 +17,6 @@ type WGConfigurer interface {
 	RemovePeer(peerKey string) error
 	AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
-	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
 	Close()
 	GetStats() (map[string]configurer.WGStats, error)
 	FullStats() (*configurer.Stats, error)

client/iface/iface.go

@@ -297,19 +297,6 @@ func (w *WGIface) FullStats() (*configurer.Stats, error) {
 	return w.configurer.FullStats()
 }
 
-// SetPresharedKey sets or updates the preshared key for a peer.
-// If updateOnly is true, only updates existing peer; if false, creates or updates.
-func (w *WGIface) SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	if w.configurer == nil {
-		return ErrIfaceNotFound
-	}
-
-	return w.configurer.SetPresharedKey(peerKey, psk, updateOnly)
-}
-
 func (w *WGIface) waitUntilRemoved() error {
 	maxWaitTime := 5 * time.Second
 	timeout := time.NewTimer(maxWaitTime)

client/iface/wgproxy/factory_kernel.go

@@ -3,19 +3,12 @@
 package wgproxy
 
 import (
-	"os"
-	"strconv"
-
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/wgproxy/ebpf"
 	udpProxy "github.com/netbirdio/netbird/client/iface/wgproxy/udp"
 )
 
-const (
-	envDisableEBPFWGProxy = "NB_DISABLE_EBPF_WG_PROXY"
-)
-
 type KernelFactory struct {
 	wgPort int
 	mtu    uint16
@@ -29,12 +22,6 @@ func NewKernelFactory(wgPort int, mtu uint16) *KernelFactory {
 		mtu:    mtu,
 	}
 
-	if isEBPFDisabled() {
-		log.Infof("WireGuard Proxy Factory will produce UDP proxy")
-		log.Infof("eBPF WireGuard proxy is disabled via %s environment variable", envDisableEBPFWGProxy)
-		return f
-	}
-
 	ebpfProxy := ebpf.NewWGEBPFProxy(wgPort, mtu)
 	if err := ebpfProxy.Listen(); err != nil {
 		log.Infof("WireGuard Proxy Factory will produce UDP proxy")
@@ -60,16 +47,3 @@ func (w *KernelFactory) Free() error {
 	}
 	return w.ebpfProxy.Free()
 }
-
-func isEBPFDisabled() bool {
-	val := os.Getenv(envDisableEBPFWGProxy)
-	if val == "" {
-		return false
-	}
-	disabled, err := strconv.ParseBool(val)
-	if err != nil {
-		log.Warnf("failed to parse %s: %v", envDisableEBPFWGProxy, err)
-		return false
-	}
-	return disabled
-}

client/internal/connect.go

@@ -24,14 +24,10 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/internal/updatemanager"
-	"github.com/netbirdio/netbird/client/internal/updatemanager/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
-	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
 	"github.com/netbirdio/netbird/client/system"
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
@@ -43,13 +39,11 @@ import (
 )
 
 type ConnectClient struct {
-	ctx                 context.Context
-	config              *profilemanager.Config
-	statusRecorder      *peer.Status
-	doInitialAutoUpdate bool
-
-	engine      *Engine
-	engineMutex sync.Mutex
+	ctx            context.Context
+	config         *profilemanager.Config
+	statusRecorder *peer.Status
+	engine         *Engine
+	engineMutex    sync.Mutex
 
 	persistSyncResponse bool
 }
@@ -58,20 +52,19 @@ func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
 	statusRecorder *peer.Status,
-	doInitalAutoUpdate bool,
+
 ) *ConnectClient {
 	return &ConnectClient{
-		ctx:                 ctx,
-		config:              config,
-		statusRecorder:      statusRecorder,
-		doInitialAutoUpdate: doInitalAutoUpdate,
-		engineMutex:         sync.Mutex{},
+		ctx:            ctx,
+		config:         config,
+		statusRecorder: statusRecorder,
+		engineMutex:    sync.Mutex{},
 	}
 }
 
 // Run with main logic.
-func (c *ConnectClient) Run(runningChan chan struct{}, logPath string) error {
-	return c.run(MobileDependency{}, runningChan, logPath)
+func (c *ConnectClient) Run(runningChan chan struct{}) error {
+	return c.run(MobileDependency{}, runningChan)
 }
 
 // RunOnAndroid with main logic on mobile system
@@ -92,7 +85,7 @@ func (c *ConnectClient) RunOnAndroid(
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
 	}
-	return c.run(mobileDependency, nil, "")
+	return c.run(mobileDependency, nil)
 }
 
 func (c *ConnectClient) RunOniOS(
@@ -110,10 +103,10 @@ func (c *ConnectClient) RunOniOS(
 		DnsManager:            dnsManager,
 		StateFilePath:         stateFilePath,
 	}
-	return c.run(mobileDependency, nil, "")
+	return c.run(mobileDependency, nil)
 }
 
-func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan struct{}, logPath string) error {
+func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan struct{}) error {
 	defer func() {
 		if r := recover(); r != nil {
 			rec := c.statusRecorder
@@ -169,33 +162,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		return err
 	}
 
-	var path string
-	if runtime.GOOS == "ios" || runtime.GOOS == "android" {
-		// On mobile, use the provided state file path directly
-		if !fileExists(mobileDependency.StateFilePath) {
-			if err := createFile(mobileDependency.StateFilePath); err != nil {
-				log.Errorf("failed to create state file: %v", err)
-				// we are not exiting as we can run without the state manager
-			}
-		}
-		path = mobileDependency.StateFilePath
-	} else {
-		sm := profilemanager.NewServiceManager("")
-		path = sm.GetStatePath()
-	}
-	stateManager := statemanager.New(path)
-	stateManager.RegisterState(&sshconfig.ShutdownState{})
-
-	updateManager, err := updatemanager.NewManager(c.statusRecorder, stateManager)
-	if err == nil {
-		updateManager.CheckUpdateSuccess(c.ctx)
-
-		inst := installer.New()
-		if err := inst.CleanUpInstallerFiles(); err != nil {
-			log.Errorf("failed to clean up temporary installer file: %v", err)
-		}
-	}
-
 	defer c.statusRecorder.ClientStop()
 	operation := func() error {
 		// if context cancelled we not start new backoff cycle
@@ -283,7 +249,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		relayURLs, token := parseRelayInfo(loginResp)
 		peerConfig := loginResp.GetPeerConfig()
 
-		engineConfig, err := createEngineConfig(myPrivateKey, c.config, peerConfig, logPath)
+		engineConfig, err := createEngineConfig(myPrivateKey, c.config, peerConfig)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -307,7 +273,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		checks := loginResp.GetChecks()
 
 		c.engineMutex.Lock()
-		engine := NewEngine(engineCtx, cancel, signalClient, mgmClient, relayManager, engineConfig, mobileDependency, c.statusRecorder, checks, stateManager)
+		engine := NewEngine(engineCtx, cancel, signalClient, mgmClient, relayManager, engineConfig, mobileDependency, c.statusRecorder, checks)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
 		c.engineMutex.Unlock()
@@ -317,15 +283,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 
-		if loginResp.PeerConfig != nil && loginResp.PeerConfig.AutoUpdate != nil {
-			// AutoUpdate will be true when the user click on "Connect" menu on the UI
-			if c.doInitialAutoUpdate {
-				log.Infof("start engine by ui, run auto-update check")
-				c.engine.InitialUpdateHandling(loginResp.PeerConfig.AutoUpdate)
-				c.doInitialAutoUpdate = false
-			}
-		}
-
 		log.Infof("Netbird engine started, the IP is: %s", peerConfig.GetAddress())
 		state.Set(StatusConnected)
 
@@ -419,19 +376,6 @@ func (c *ConnectClient) GetLatestSyncResponse() (*mgmProto.SyncResponse, error)
 	return syncResponse, nil
 }
 
-// SetLogLevel sets the log level for the firewall manager if the engine is running.
-func (c *ConnectClient) SetLogLevel(level log.Level) {
-	engine := c.Engine()
-	if engine == nil {
-		return
-	}
-
-	fwManager := engine.GetFirewallManager()
-	if fwManager != nil {
-		fwManager.SetLogLevel(level)
-	}
-}
-
 // Status returns the current client status
 func (c *ConnectClient) Status() StatusType {
 	if c == nil {
@@ -471,7 +415,7 @@ func (c *ConnectClient) SetSyncResponsePersistence(enabled bool) {
 }
 
 // createEngineConfig converts configuration received from Management Service to EngineConfig
-func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConfig *mgmProto.PeerConfig, logPath string) (*EngineConfig, error) {
+func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConfig *mgmProto.PeerConfig) (*EngineConfig, error) {
 	nm := false
 	if config.NetworkMonitor != nil {
 		nm = *config.NetworkMonitor
@@ -506,10 +450,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 
 		LazyConnectionEnabled: config.LazyConnectionEnabled,
 
-		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
-		LogPath: logPath,
-
-		ProfileConfig: config,
+		MTU: selectMTU(config.MTU, peerConfig.Mtu),
 	}
 
 	if config.PreSharedKey != "" {

client/internal/debug/debug.go

@@ -27,11 +27,8 @@ import (
 	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/internal/updatemanager/installer"
-	nbstatus "github.com/netbirdio/netbird/client/status"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/util"
-	"github.com/netbirdio/netbird/version"
 )
 
 const readmeContent = `Netbird debug bundle
@@ -59,8 +56,6 @@ block.prof: Block profiling information.
 heap.prof: Heap profiling information (snapshot of memory allocations).
 allocs.prof: Allocations profiling information.
 threadcreate.prof: Thread creation profiling information.
-cpu.prof: CPU profiling information.
-stack_trace.txt: Complete stack traces of all goroutines at the time of bundle creation.
 
 
 Anonymization Process
@@ -114,9 +109,6 @@ go tool pprof -http=:8088 heap.prof
 
 This will open a web browser tab with the profiling information.
 
-Stack Trace
-The stack_trace.txt file contains a complete snapshot of all goroutine stack traces at the time the debug bundle was created.
-
 Routes
 The routes.txt file contains detailed routing table information in a tabular format:
 
@@ -226,10 +218,10 @@ type BundleGenerator struct {
 	internalConfig *profilemanager.Config
 	statusRecorder *peer.Status
 	syncResponse   *mgmProto.SyncResponse
-	logPath        string
-	cpuProfile     []byte
+	logFile        string
 
 	anonymize         bool
+	clientStatus      string
 	includeSystemInfo bool
 	logFileCount      uint32
 
@@ -238,6 +230,7 @@ type BundleGenerator struct {
 
 type BundleConfig struct {
 	Anonymize         bool
+	ClientStatus      string
 	IncludeSystemInfo bool
 	LogFileCount      uint32
 }
@@ -246,8 +239,7 @@ type GeneratorDependencies struct {
 	InternalConfig *profilemanager.Config
 	StatusRecorder *peer.Status
 	SyncResponse   *mgmProto.SyncResponse
-	LogPath        string
-	CPUProfile     []byte
+	LogFile        string
 }
 
 func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGenerator {
@@ -263,10 +255,10 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		internalConfig: deps.InternalConfig,
 		statusRecorder: deps.StatusRecorder,
 		syncResponse:   deps.SyncResponse,
-		logPath:        deps.LogPath,
-		cpuProfile:     deps.CPUProfile,
+		logFile:        deps.LogFile,
 
 		anonymize:         cfg.Anonymize,
+		clientStatus:      cfg.ClientStatus,
 		includeSystemInfo: cfg.IncludeSystemInfo,
 		logFileCount:      logFileCount,
 	}
@@ -312,6 +304,13 @@ func (g *BundleGenerator) createArchive() error {
 		return fmt.Errorf("add status: %w", err)
 	}
 
+	if g.statusRecorder != nil {
+		status := g.statusRecorder.GetFullStatus()
+		seedFromStatus(g.anonymizer, &status)
+	} else {
+		log.Debugf("no status recorder available for seeding")
+	}
+
 	if err := g.addConfig(); err != nil {
 		log.Errorf("failed to add config to debug bundle: %v", err)
 	}
@@ -328,14 +327,6 @@ func (g *BundleGenerator) createArchive() error {
 		log.Errorf("failed to add profiles to debug bundle: %v", err)
 	}
 
-	if err := g.addCPUProfile(); err != nil {
-		log.Errorf("failed to add CPU profile to debug bundle: %v", err)
-	}
-
-	if err := g.addStackTrace(); err != nil {
-		log.Errorf("failed to add stack trace to debug bundle: %v", err)
-	}
-
 	if err := g.addSyncResponse(); err != nil {
 		return fmt.Errorf("add sync response: %w", err)
 	}
@@ -352,7 +343,7 @@ func (g *BundleGenerator) createArchive() error {
 		log.Errorf("failed to add wg show output: %v", err)
 	}
 
-	if g.logPath != "" && !slices.Contains(util.SpecialLogs, g.logPath) {
+	if g.logFile != "" && !slices.Contains(util.SpecialLogs, g.logFile) {
 		if err := g.addLogfile(); err != nil {
 			log.Errorf("failed to add log file to debug bundle: %v", err)
 			if err := g.trySystemdLogFallback(); err != nil {
@@ -363,10 +354,6 @@ func (g *BundleGenerator) createArchive() error {
 		log.Errorf("failed to add systemd logs: %v", err)
 	}
 
-	if err := g.addUpdateLogs(); err != nil {
-		log.Errorf("failed to add updater logs: %v", err)
-	}
-
 	return nil
 }
 
@@ -401,26 +388,11 @@ func (g *BundleGenerator) addReadme() error {
 }
 
 func (g *BundleGenerator) addStatus() error {
-	if g.statusRecorder != nil {
-		pm := profilemanager.NewProfileManager()
-		var profName string
-		if activeProf, err := pm.GetActiveProfile(); err == nil {
-			profName = activeProf.Name
-		}
-
-		fullStatus := g.statusRecorder.GetFullStatus()
-		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
-		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
-		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, g.anonymize, version.NetbirdVersion(), "", nil, nil, nil, "", profName)
-		statusOutput := overview.FullDetailSummary()
-
-		statusReader := strings.NewReader(statusOutput)
+	if status := g.clientStatus; status != "" {
+		statusReader := strings.NewReader(status)
 		if err := g.addFileToZip(statusReader, "status.txt"); err != nil {
 			return fmt.Errorf("add status file to zip: %w", err)
 		}
-		seedFromStatus(g.anonymizer, &fullStatus)
-	} else {
-		log.Debugf("no status recorder available for seeding")
 	}
 	return nil
 }
@@ -550,31 +522,6 @@ func (g *BundleGenerator) addProf() (err error) {
 	return nil
 }
 
-func (g *BundleGenerator) addCPUProfile() error {
-	if len(g.cpuProfile) == 0 {
-		return nil
-	}
-
-	reader := bytes.NewReader(g.cpuProfile)
-	if err := g.addFileToZip(reader, "cpu.prof"); err != nil {
-		return fmt.Errorf("add CPU profile to zip: %w", err)
-	}
-
-	return nil
-}
-
-func (g *BundleGenerator) addStackTrace() error {
-	buf := make([]byte, 5242880) // 5 MB buffer
-	n := runtime.Stack(buf, true)
-
-	stackTrace := bytes.NewReader(buf[:n])
-	if err := g.addFileToZip(stackTrace, "stack_trace.txt"); err != nil {
-		return fmt.Errorf("add stack trace file to zip: %w", err)
-	}
-
-	return nil
-}
-
 func (g *BundleGenerator) addInterfaces() error {
 	interfaces, err := net.Interfaces()
 	if err != nil {
@@ -683,29 +630,6 @@ func (g *BundleGenerator) addStateFile() error {
 	return nil
 }
 
-func (g *BundleGenerator) addUpdateLogs() error {
-	inst := installer.New()
-	logFiles := inst.LogFiles()
-	if len(logFiles) == 0 {
-		return nil
-	}
-
-	log.Infof("adding updater logs")
-	for _, logFile := range logFiles {
-		data, err := os.ReadFile(logFile)
-		if err != nil {
-			log.Warnf("failed to read update log file %s: %v", logFile, err)
-			continue
-		}
-
-		baseName := filepath.Base(logFile)
-		if err := g.addFileToZip(bytes.NewReader(data), filepath.Join("update-logs", baseName)); err != nil {
-			return fmt.Errorf("add update log file %s to zip: %w", baseName, err)
-		}
-	}
-	return nil
-}
-
 func (g *BundleGenerator) addCorruptedStateFiles() error {
 	sm := profilemanager.NewServiceManager("")
 	pattern := sm.GetStatePath()
@@ -738,14 +662,14 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 }
 
 func (g *BundleGenerator) addLogfile() error {
-	if g.logPath == "" {
+	if g.logFile == "" {
 		log.Debugf("skipping empty log file in debug bundle")
 		return nil
 	}
 
-	logDir := filepath.Dir(g.logPath)
+	logDir := filepath.Dir(g.logFile)
 
-	if err := g.addSingleLogfile(g.logPath, clientLogFile); err != nil {
+	if err := g.addSingleLogfile(g.logFile, clientLogFile); err != nil {
 		return fmt.Errorf("add client log file to zip: %w", err)
 	}
 

client/internal/debug/debug_linux.go

@@ -507,13 +507,15 @@ func formatPayloadWithCmp(p *expr.Payload, cmp *expr.Cmp) string {
 	if p.Base == expr.PayloadBaseNetworkHeader {
 		switch p.Offset {
 		case 12:
-			switch p.Len {
-			case 4, 2:
+			if p.Len == 4 {
+				return fmt.Sprintf("ip saddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
+			} else if p.Len == 2 {
 				return fmt.Sprintf("ip saddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
 			}
 		case 16:
-			switch p.Len {
-			case 4, 2:
+			if p.Len == 4 {
+				return fmt.Sprintf("ip daddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
+			} else if p.Len == 2 {
 				return fmt.Sprintf("ip daddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
 			}
 		}

client/internal/debug/upload.go

@@ -1,101 +0,0 @@
-package debug
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-
-	"github.com/netbirdio/netbird/upload-server/types"
-)
-
-const maxBundleUploadSize = 50 * 1024 * 1024
-
-func UploadDebugBundle(ctx context.Context, url, managementURL, filePath string) (key string, err error) {
-	response, err := getUploadURL(ctx, url, managementURL)
-	if err != nil {
-		return "", err
-	}
-
-	err = upload(ctx, filePath, response)
-	if err != nil {
-		return "", err
-	}
-	return response.Key, nil
-}
-
-func upload(ctx context.Context, filePath string, response *types.GetURLResponse) error {
-	fileData, err := os.Open(filePath)
-	if err != nil {
-		return fmt.Errorf("open file: %w", err)
-	}
-
-	defer fileData.Close()
-
-	stat, err := fileData.Stat()
-	if err != nil {
-		return fmt.Errorf("stat file: %w", err)
-	}
-
-	if stat.Size() > maxBundleUploadSize {
-		return fmt.Errorf("file size exceeds maximum limit of %d bytes", maxBundleUploadSize)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, "PUT", response.URL, fileData)
-	if err != nil {
-		return fmt.Errorf("create PUT request: %w", err)
-	}
-
-	req.ContentLength = stat.Size()
-	req.Header.Set("Content-Type", "application/octet-stream")
-
-	putResp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("upload failed: %v", err)
-	}
-	defer putResp.Body.Close()
-
-	if putResp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(putResp.Body)
-		return fmt.Errorf("upload status %d: %s", putResp.StatusCode, string(body))
-	}
-	return nil
-}
-
-func getUploadURL(ctx context.Context, url string, managementURL string) (*types.GetURLResponse, error) {
-	id := getURLHash(managementURL)
-	getReq, err := http.NewRequestWithContext(ctx, "GET", url+"?id="+id, nil)
-	if err != nil {
-		return nil, fmt.Errorf("create GET request: %w", err)
-	}
-
-	getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
-
-	resp, err := http.DefaultClient.Do(getReq)
-	if err != nil {
-		return nil, fmt.Errorf("get presigned URL: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("get presigned URL status %d: %s", resp.StatusCode, string(body))
-	}
-
-	urlBytes, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("read response body: %w", err)
-	}
-	var response types.GetURLResponse
-	if err := json.Unmarshal(urlBytes, &response); err != nil {
-		return nil, fmt.Errorf("unmarshal response: %w", err)
-	}
-	return &response, nil
-}
-
-func getURLHash(url string) string {
-	return fmt.Sprintf("%x", sha256.Sum256([]byte(url)))
-}

client/internal/debug/wgshow.go

@@ -60,7 +60,7 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 		}
 		sb.WriteString(fmt.Sprintf("  latest handshake: %s\n", peer.LastHandshake.Format(time.RFC1123)))
 		sb.WriteString(fmt.Sprintf("  transfer: %d B received, %d B sent\n", peer.RxBytes, peer.TxBytes))
-		if peer.PresharedKey != [32]byte{} {
+		if peer.PresharedKey {
 			sb.WriteString("  preshared key: (hidden)\n")
 		}
 	}

client/internal/dns.go

@@ -76,7 +76,7 @@ func collectPTRRecords(config *nbdns.Config, prefix netip.Prefix) []nbdns.Simple
 	var records []nbdns.SimpleRecord
 
 	for _, zone := range config.CustomZones {
-		if zone.NonAuthoritative {
+		if zone.SkipPTRProcess {
 			continue
 		}
 		for _, record := range zone.Records {

client/internal/dns/handler_chain.go

@@ -3,21 +3,17 @@ package dns
 import (
 	"fmt"
 	"slices"
-	"strconv"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 )
 
 const (
 	PriorityMgmtCache = 150
-	PriorityDNSRoute  = 100
-	PriorityLocal     = 75
+	PriorityLocal     = 100
+	PriorityDNSRoute  = 75
 	PriorityUpstream  = 50
 	PriorityDefault   = 1
 	PriorityFallback  = -100
@@ -47,23 +43,7 @@ type HandlerChain struct {
 type ResponseWriterChain struct {
 	dns.ResponseWriter
 	origPattern    string
-	requestID      string
 	shouldContinue bool
-	response       *dns.Msg
-	meta           map[string]string
-}
-
-// RequestID returns the request ID for tracing
-func (w *ResponseWriterChain) RequestID() string {
-	return w.requestID
-}
-
-// SetMeta sets a metadata key-value pair for logging
-func (w *ResponseWriterChain) SetMeta(key, value string) {
-	if w.meta == nil {
-		w.meta = make(map[string]string)
-	}
-	w.meta[key] = value
 }
 
 func (w *ResponseWriterChain) WriteMsg(m *dns.Msg) error {
@@ -72,7 +52,6 @@ func (w *ResponseWriterChain) WriteMsg(m *dns.Msg) error {
 		w.shouldContinue = true
 		return nil
 	}
-	w.response = m
 	return w.ResponseWriter.WriteMsg(m)
 }
 
@@ -122,8 +101,6 @@ func (c *HandlerChain) AddHandler(pattern string, handler dns.Handler, priority
 
 	pos := c.findHandlerPosition(entry)
 	c.handlers = append(c.handlers[:pos], append([]HandlerEntry{entry}, c.handlers[pos:]...)...)
-
-	c.logHandlers()
 }
 
 // findHandlerPosition determines where to insert a new handler based on priority and specificity
@@ -163,109 +140,68 @@ func (c *HandlerChain) removeEntry(pattern string, priority int) {
 	for i := len(c.handlers) - 1; i >= 0; i-- {
 		entry := c.handlers[i]
 		if strings.EqualFold(entry.OrigPattern, pattern) && entry.Priority == priority {
-			log.Debugf("removing handler pattern: domain=%s priority=%d", entry.OrigPattern, priority)
 			c.handlers = append(c.handlers[:i], c.handlers[i+1:]...)
-			c.logHandlers()
 			break
 		}
 	}
 }
 
-// logHandlers logs the current handler chain state. Caller must hold the lock.
-func (c *HandlerChain) logHandlers() {
-	if !log.IsLevelEnabled(log.TraceLevel) {
-		return
-	}
-
-	var b strings.Builder
-	b.WriteString("handler chain (" + strconv.Itoa(len(c.handlers)) + "):\n")
-	for _, h := range c.handlers {
-		b.WriteString("  - pattern: domain=" + h.Pattern + " original: domain=" + h.OrigPattern +
-			" wildcard=" + strconv.FormatBool(h.IsWildcard) +
-			" match_subdomain=" + strconv.FormatBool(h.MatchSubdomains) +
-			" priority=" + strconv.Itoa(h.Priority) + "\n")
-	}
-	log.Trace(strings.TrimSuffix(b.String(), "\n"))
-}
-
 func (c *HandlerChain) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	if len(r.Question) == 0 {
 		return
 	}
 
-	startTime := time.Now()
-	requestID := resutil.GenerateRequestID()
-	logger := log.WithFields(log.Fields{
-		"request_id": requestID,
-		"dns_id":     fmt.Sprintf("%04x", r.Id),
-	})
-
-	question := r.Question[0]
-	qname := strings.ToLower(question.Name)
+	qname := strings.ToLower(r.Question[0].Name)
 
 	c.mu.RLock()
 	handlers := slices.Clone(c.handlers)
 	c.mu.RUnlock()
 
+	if log.IsLevelEnabled(log.TraceLevel) {
+		var b strings.Builder
+		b.WriteString(fmt.Sprintf("DNS request domain=%s, handlers (%d):\n", qname, len(handlers)))
+		for _, h := range handlers {
+			b.WriteString(fmt.Sprintf("  - pattern: domain=%s original: domain=%s wildcard=%v match_subdomain=%v priority=%d\n",
+				h.Pattern, h.OrigPattern, h.IsWildcard, h.MatchSubdomains, h.Priority))
+		}
+		log.Trace(strings.TrimSuffix(b.String(), "\n"))
+	}
+
 	// Try handlers in priority order
 	for _, entry := range handlers {
-		if !c.isHandlerMatch(qname, entry) {
-			continue
-		}
+		matched := c.isHandlerMatch(qname, entry)
 
-		handlerName := entry.OrigPattern
-		if s, ok := entry.Handler.(interface{ String() string }); ok {
-			handlerName = s.String()
-		}
+		if matched {
+			log.Tracef("handler matched: domain=%s -> pattern=%s wildcard=%v match_subdomain=%v priority=%d",
+				qname, entry.OrigPattern, entry.IsWildcard, entry.MatchSubdomains, entry.Priority)
 
-		logger.Tracef("question: domain=%s type=%s class=%s -> handler=%s pattern=%s wildcard=%v match_subdomain=%v priority=%d",
-			qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass],
-			handlerName, entry.OrigPattern, entry.IsWildcard, entry.MatchSubdomains, entry.Priority)
-
-		chainWriter := &ResponseWriterChain{
-			ResponseWriter: w,
-			origPattern:    entry.OrigPattern,
-			requestID:      requestID,
-		}
-		entry.Handler.ServeDNS(chainWriter, r)
-
-		// If handler wants to continue, try next handler
-		if chainWriter.shouldContinue {
-			if entry.Priority != PriorityMgmtCache {
-				logger.Tracef("handler requested continue for domain=%s", qname)
+			chainWriter := &ResponseWriterChain{
+				ResponseWriter: w,
+				origPattern:    entry.OrigPattern,
 			}
-			continue
-		}
+			entry.Handler.ServeDNS(chainWriter, r)
 
-		c.logResponse(logger, chainWriter, qname, startTime)
-		return
+			// If handler wants to continue, try next handler
+			if chainWriter.shouldContinue {
+				// Only log continue for non-management cache handlers to reduce noise
+				if entry.Priority != PriorityMgmtCache {
+					log.Tracef("handler requested continue to next handler for domain=%s", qname)
+				}
+				continue
+			}
+			return
+		}
 	}
 
 	// No handler matched or all handlers passed
-	logger.Tracef("no handler found for domain=%s type=%s class=%s",
-		qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
+	log.Tracef("no handler found for domain=%s", qname)
 	resp := &dns.Msg{}
 	resp.SetRcode(r, dns.RcodeRefused)
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
+		log.Errorf("failed to write DNS response: %v", err)
 	}
 }
 
-func (c *HandlerChain) logResponse(logger *log.Entry, cw *ResponseWriterChain, qname string, startTime time.Time) {
-	if cw.response == nil {
-		return
-	}
-
-	var meta string
-	for k, v := range cw.meta {
-		meta += " " + k + "=" + v
-	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s%s took=%s",
-		qname, dns.RcodeToString[cw.response.Rcode], resutil.FormatAnswers(cw.response.Answer),
-		meta, time.Since(startTime))
-}
-
 func (c *HandlerChain) isHandlerMatch(qname string, entry HandlerEntry) bool {
 	switch {
 	case entry.Pattern == ".":

client/internal/dns/local/local.go

@@ -1,52 +1,30 @@
 package local
 
 import (
-	"context"
-	"errors"
 	"fmt"
-	"net"
-	"net/netip"
 	"slices"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
 
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-const externalResolutionTimeout = 4 * time.Second
-
-type resolver interface {
-	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
 type Resolver struct {
 	mu      sync.RWMutex
 	records map[dns.Question][]dns.RR
 	domains map[domain.Domain]struct{}
-	// zones maps zone domain -> NonAuthoritative (true = non-authoritative, user-created zone)
-	zones    map[domain.Domain]bool
-	resolver resolver
-
-	ctx    context.Context
-	cancel context.CancelFunc
 }
 
 func NewResolver() *Resolver {
-	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
 		records: make(map[dns.Question][]dns.RR),
 		domains: make(map[domain.Domain]struct{}),
-		zones:   make(map[domain.Domain]bool),
-		ctx:     ctx,
-		cancel:  cancel,
 	}
 }
 
@@ -59,18 +37,7 @@ func (d *Resolver) String() string {
 	return fmt.Sprintf("LocalResolver [%d records]", len(d.records))
 }
 
-func (d *Resolver) Stop() {
-	if d.cancel != nil {
-		d.cancel()
-	}
-
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	maps.Clear(d.records)
-	maps.Clear(d.domains)
-	maps.Clear(d.zones)
-}
+func (d *Resolver) Stop() {}
 
 // ID returns the unique handler ID
 func (d *Resolver) ID() types.HandlerID {
@@ -81,147 +48,60 @@ func (d *Resolver) ProbeAvailability() {}
 
 // ServeDNS handles a DNS request
 func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	logger := log.WithField("request_id", resutil.GetRequestID(w))
-
 	if len(r.Question) == 0 {
-		logger.Debug("received local resolver request with no question")
+		log.Debugf("received local resolver request with no question")
 		return
 	}
 	question := r.Question[0]
 	question.Name = strings.ToLower(dns.Fqdn(question.Name))
 
+	log.Tracef("received local question: domain=%s type=%v class=%v", r.Question[0].Name, question.Qtype, question.Qclass)
+
 	replyMessage := &dns.Msg{}
 	replyMessage.SetReply(r)
 	replyMessage.RecursionAvailable = true
 
-	result := d.lookupRecords(logger, question)
-	replyMessage.Authoritative = !result.hasExternalData
-	replyMessage.Answer = result.records
-	replyMessage.Rcode = d.determineRcode(question, result)
-
-	if replyMessage.Rcode == dns.RcodeNameError && d.shouldFallthrough(question.Name) {
-		d.continueToNext(logger, w, r)
-		return
+	// lookup all records matching the question
+	records := d.lookupRecords(question)
+	if len(records) > 0 {
+		replyMessage.Rcode = dns.RcodeSuccess
+		replyMessage.Answer = append(replyMessage.Answer, records...)
+	} else {
+		// Check if we have any records for this domain name with different types
+		if d.hasRecordsForDomain(domain.Domain(question.Name)) {
+			replyMessage.Rcode = dns.RcodeSuccess // NOERROR with 0 records
+		} else {
+			replyMessage.Rcode = dns.RcodeNameError // NXDOMAIN
+		}
 	}
 
 	if err := w.WriteMsg(replyMessage); err != nil {
-		logger.Warnf("failed to write the local resolver response: %v", err)
-	}
-}
-
-// determineRcode returns the appropriate DNS response code.
-// Per RFC 6604, CNAME chains should return the rcode of the final target resolution,
-// even if CNAME records are included in the answer.
-func (d *Resolver) determineRcode(question dns.Question, result lookupResult) int {
-	// Use the rcode from lookup - this properly handles CNAME chains where
-	// the target may be NXDOMAIN or SERVFAIL even though we have CNAME records
-	if result.rcode != 0 {
-		return result.rcode
-	}
-
-	// No records found, but domain exists with different record types (NODATA)
-	if d.hasRecordsForDomain(domain.Domain(question.Name), question.Qtype) {
-		return dns.RcodeSuccess
-	}
-
-	return dns.RcodeNameError
-}
-
-// findZone finds the matching zone for a query name using reverse suffix lookup.
-// Returns (nonAuthoritative, found). This is O(k) where k = number of labels in qname.
-func (d *Resolver) findZone(qname string) (nonAuthoritative bool, found bool) {
-	qname = strings.ToLower(dns.Fqdn(qname))
-	for {
-		if nonAuth, ok := d.zones[domain.Domain(qname)]; ok {
-			return nonAuth, true
-		}
-		// Move to parent domain
-		idx := strings.Index(qname, ".")
-		if idx == -1 || idx == len(qname)-1 {
-			return false, false
-		}
-		qname = qname[idx+1:]
-	}
-}
-
-// shouldFallthrough checks if the query should fallthrough to the next handler.
-// Returns true if the queried name belongs to a non-authoritative zone.
-func (d *Resolver) shouldFallthrough(qname string) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-
-	nonAuth, found := d.findZone(qname)
-	return found && nonAuth
-}
-
-func (d *Resolver) continueToNext(logger *log.Entry, w dns.ResponseWriter, r *dns.Msg) {
-	resp := &dns.Msg{}
-	resp.SetRcode(r, dns.RcodeNameError)
-	resp.MsgHdr.Zero = true
-	if err := w.WriteMsg(resp); err != nil {
-		logger.Warnf("failed to write continue signal: %v", err)
+		log.Warnf("failed to write the local resolver response: %v", err)
 	}
 }
 
 // hasRecordsForDomain checks if any records exist for the given domain name regardless of type
-func (d *Resolver) hasRecordsForDomain(domainName domain.Domain, qType uint16) bool {
+func (d *Resolver) hasRecordsForDomain(domainName domain.Domain) bool {
 	d.mu.RLock()
 	defer d.mu.RUnlock()
 
 	_, exists := d.domains[domainName]
-	if !exists && supportsWildcard(qType) {
-		testWild := transformDomainToWildcard(string(domainName))
-		_, exists = d.domains[domain.Domain(testWild)]
-	}
 	return exists
 }
 
-// isInManagedZone checks if the given name falls within any of our managed zones.
-// This is used to avoid unnecessary external resolution for CNAME targets that
-// are within zones we manage - if we don't have a record for it, it doesn't exist.
-// Caller must NOT hold the lock.
-func (d *Resolver) isInManagedZone(name string) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-
-	_, found := d.findZone(name)
-	return found
-}
-
-// lookupResult contains the result of a DNS lookup operation.
-type lookupResult struct {
-	records         []dns.RR
-	rcode           int
-	hasExternalData bool
-}
-
 // lookupRecords fetches *all* DNS records matching the first question in r.
-func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) lookupResult {
+func (d *Resolver) lookupRecords(question dns.Question) []dns.RR {
 	d.mu.RLock()
 	records, found := d.records[question]
-	usingWildcard := false
-	wildQuestion := transformToWildcard(question)
-	// RFC 4592 section 2.2.1: wildcard only matches if the name does NOT exist in the zone.
-	// If the domain exists with any record type, return NODATA instead of wildcard match.
-	if !found && supportsWildcard(question.Qtype) {
-		if _, domainExists := d.domains[domain.Domain(question.Name)]; !domainExists {
-			records, found = d.records[wildQuestion]
-			usingWildcard = found
-		}
-	}
 
 	if !found {
 		d.mu.RUnlock()
 		// alternatively check if we have a cname
 		if question.Qtype != dns.TypeCNAME {
-			cnameQuestion := dns.Question{
-				Name:   question.Name,
-				Qtype:  dns.TypeCNAME,
-				Qclass: question.Qclass,
-			}
-			return d.lookupCNAMEChain(logger, cnameQuestion, question.Qtype)
+			question.Qtype = dns.TypeCNAME
+			return d.lookupRecords(question)
 		}
-		return lookupResult{rcode: dns.RcodeNameError}
+		return nil
 	}
 
 	recordsCopy := slices.Clone(records)
@@ -230,229 +110,29 @@ func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) looku
 	// if there's more than one record, rotate them (round-robin)
 	if len(recordsCopy) > 1 {
 		d.mu.Lock()
-		q := question
-		if usingWildcard {
-			q = wildQuestion
-		}
-		records = d.records[q]
+		records = d.records[question]
 		if len(records) > 1 {
 			first := records[0]
 			records = append(records[1:], first)
-			d.records[q] = records
+			d.records[question] = records
 		}
 		d.mu.Unlock()
 	}
 
-	if usingWildcard {
-		return responseFromWildRecords(question.Name, wildQuestion.Name, recordsCopy)
-	}
-
-	return lookupResult{records: recordsCopy, rcode: dns.RcodeSuccess}
+	return recordsCopy
 }
 
-func transformToWildcard(question dns.Question) dns.Question {
-	wildQuestion := question
-	wildQuestion.Name = transformDomainToWildcard(wildQuestion.Name)
-	return wildQuestion
-}
-
-func transformDomainToWildcard(domain string) string {
-	s := strings.Split(domain, ".")
-	s[0] = "*"
-	return strings.Join(s, ".")
-}
-
-func supportsWildcard(queryType uint16) bool {
-	return queryType != dns.TypeNS && queryType != dns.TypeSOA
-}
-
-func responseFromWildRecords(originalName, wildName string, wildRecords []dns.RR) lookupResult {
-	records := make([]dns.RR, len(wildRecords))
-	for i, record := range wildRecords {
-		copiedRecord := dns.Copy(record)
-		copiedRecord.Header().Name = originalName
-		records[i] = copiedRecord
-	}
-
-	return lookupResult{records: records, rcode: dns.RcodeSuccess}
-}
-
-// lookupCNAMEChain follows a CNAME chain and returns the CNAME records along with
-// the final resolved record of the requested type. This is required for musl libc
-// compatibility, which expects the full answer chain rather than just the CNAME.
-func (d *Resolver) lookupCNAMEChain(logger *log.Entry, cnameQuestion dns.Question, targetType uint16) lookupResult {
-	const maxDepth = 8
-	var chain []dns.RR
-
-	for range maxDepth {
-		cnameRecords := d.getRecords(cnameQuestion)
-		if len(cnameRecords) == 0 && supportsWildcard(targetType) {
-			wildQuestion := transformToWildcard(cnameQuestion)
-			if wildRecords := d.getRecords(wildQuestion); len(wildRecords) > 0 {
-				cnameRecords = responseFromWildRecords(cnameQuestion.Name, wildQuestion.Name, wildRecords).records
-			}
-		}
-
-		if len(cnameRecords) == 0 {
-			break
-		}
-
-		chain = append(chain, cnameRecords...)
-
-		cname, ok := cnameRecords[0].(*dns.CNAME)
-		if !ok {
-			break
-		}
-
-		targetName := strings.ToLower(cname.Target)
-		targetResult := d.resolveCNAMETarget(logger, targetName, targetType, cnameQuestion.Qclass)
-
-		// keep following chain
-		if targetResult.rcode == -1 {
-			cnameQuestion = dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: cnameQuestion.Qclass}
-			continue
-		}
-
-		return d.buildChainResult(chain, targetResult)
-	}
-
-	if len(chain) > 0 {
-		return lookupResult{records: chain, rcode: dns.RcodeSuccess}
-	}
-	return lookupResult{rcode: dns.RcodeSuccess}
-}
-
-// buildChainResult combines CNAME chain records with the target resolution result.
-// Per RFC 6604, the final rcode is propagated through the chain.
-func (d *Resolver) buildChainResult(chain []dns.RR, target lookupResult) lookupResult {
-	records := chain
-	if len(target.records) > 0 {
-		records = append(records, target.records...)
-	}
-
-	// preserve hasExternalData for SERVFAIL so caller knows the error came from upstream
-	if target.hasExternalData && target.rcode == dns.RcodeServerFailure {
-		return lookupResult{
-			records:         records,
-			rcode:           dns.RcodeServerFailure,
-			hasExternalData: true,
-		}
-	}
-
-	return lookupResult{
-		records:         records,
-		rcode:           target.rcode,
-		hasExternalData: target.hasExternalData,
-	}
-}
-
-// resolveCNAMETarget attempts to resolve a CNAME target name.
-// Returns rcode=-1 to signal "keep following the chain".
-func (d *Resolver) resolveCNAMETarget(logger *log.Entry, targetName string, targetType uint16, qclass uint16) lookupResult {
-	if records := d.getRecords(dns.Question{Name: targetName, Qtype: targetType, Qclass: qclass}); len(records) > 0 {
-		return lookupResult{records: records, rcode: dns.RcodeSuccess}
-	}
-
-	// another CNAME, keep following
-	if d.hasRecord(dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: qclass}) {
-		return lookupResult{rcode: -1}
-	}
-
-	// domain exists locally but not this record type (NODATA)
-	if d.hasRecordsForDomain(domain.Domain(targetName), targetType) {
-		return lookupResult{rcode: dns.RcodeSuccess}
-	}
-
-	// in our zone but doesn't exist (NXDOMAIN)
-	if d.isInManagedZone(targetName) {
-		return lookupResult{rcode: dns.RcodeNameError}
-	}
-
-	return d.resolveExternal(logger, targetName, targetType)
-}
-
-func (d *Resolver) getRecords(q dns.Question) []dns.RR {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-	return d.records[q]
-}
-
-func (d *Resolver) hasRecord(q dns.Question) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-	_, ok := d.records[q]
-	return ok
-}
-
-// resolveExternal resolves a domain name using the system resolver.
-// This is used to resolve CNAME targets that point outside our local zone,
-// which is required for musl libc compatibility (musl expects complete answers).
-func (d *Resolver) resolveExternal(logger *log.Entry, name string, qtype uint16) lookupResult {
-	network := resutil.NetworkForQtype(qtype)
-	if network == "" {
-		return lookupResult{rcode: dns.RcodeNotImplemented}
-	}
-
-	resolver := d.resolver
-	if resolver == nil {
-		resolver = net.DefaultResolver
-	}
-
-	ctx, cancel := context.WithTimeout(d.ctx, externalResolutionTimeout)
-	defer cancel()
-
-	result := resutil.LookupIP(ctx, resolver, network, name, qtype)
-	if result.Err != nil {
-		d.logDNSError(logger, name, qtype, result.Err)
-		return lookupResult{rcode: result.Rcode, hasExternalData: true}
-	}
-
-	return lookupResult{
-		records:         resutil.IPsToRRs(name, result.IPs, 60),
-		rcode:           dns.RcodeSuccess,
-		hasExternalData: true,
-	}
-}
-
-// logDNSError logs DNS resolution errors for debugging.
-func (d *Resolver) logDNSError(logger *log.Entry, hostname string, qtype uint16, err error) {
-	qtypeName := dns.TypeToString[qtype]
-
-	var dnsErr *net.DNSError
-	if !errors.As(err, &dnsErr) {
-		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
-		return
-	}
-
-	if dnsErr.IsNotFound {
-		logger.Tracef("DNS target not found: %s type %s", hostname, qtypeName)
-		return
-	}
-
-	if dnsErr.Server != "" {
-		logger.Debugf("DNS resolution failed for %s type %s server=%s: %v", hostname, qtypeName, dnsErr.Server, err)
-	} else {
-		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
-	}
-}
-
-// Update replaces all zones and their records
-func (d *Resolver) Update(customZones []nbdns.CustomZone) {
+func (d *Resolver) Update(update []nbdns.SimpleRecord) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
 	maps.Clear(d.records)
 	maps.Clear(d.domains)
-	maps.Clear(d.zones)
 
-	for _, zone := range customZones {
-		zoneDomain := domain.Domain(strings.ToLower(dns.Fqdn(zone.Domain)))
-		d.zones[zoneDomain] = zone.NonAuthoritative
-
-		for _, rec := range zone.Records {
-			if err := d.registerRecord(rec); err != nil {
-				log.Warnf("failed to register the record (%s): %v", rec, err)
-			}
+	for _, rec := range update {
+		if err := d.registerRecord(rec); err != nil {
+			log.Warnf("failed to register the record (%s): %v", rec, err)
+			continue
 		}
 	}
 }

client/internal/dns/mgmt/mgmt.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"net"
-	"net/netip"
 	"net/url"
 	"strings"
 	"sync"
@@ -27,11 +26,6 @@ type Resolver struct {
 	mutex         sync.RWMutex
 }
 
-type ipsResponse struct {
-	ips []netip.Addr
-	err error
-}
-
 // NewResolver creates a new management domains cache resolver.
 func NewResolver() *Resolver {
 	return &Resolver{
@@ -105,9 +99,9 @@ func (m *Resolver) AddDomain(ctx context.Context, d domain.Domain) error {
 	ctx, cancel := context.WithTimeout(ctx, dnsTimeout)
 	defer cancel()
 
-	ips, err := lookupIPWithExtraTimeout(ctx, d)
+	ips, err := net.DefaultResolver.LookupNetIP(ctx, "ip", d.PunycodeString())
 	if err != nil {
-		return err
+		return fmt.Errorf("resolve domain %s: %w", d.SafeString(), err)
 	}
 
 	var aRecords, aaaaRecords []dns.RR
@@ -165,36 +159,6 @@ func (m *Resolver) AddDomain(ctx context.Context, d domain.Domain) error {
 	return nil
 }
 
-func lookupIPWithExtraTimeout(ctx context.Context, d domain.Domain) ([]netip.Addr, error) {
-	log.Infof("looking up IP for mgmt domain=%s", d.SafeString())
-	defer log.Infof("done looking up IP for mgmt domain=%s", d.SafeString())
-	resultChan := make(chan *ipsResponse, 1)
-
-	go func() {
-		ips, err := net.DefaultResolver.LookupNetIP(ctx, "ip", d.PunycodeString())
-		resultChan <- &ipsResponse{
-			err: err,
-			ips: ips,
-		}
-	}()
-
-	var resp *ipsResponse
-
-	select {
-	case <-time.After(dnsTimeout + time.Millisecond*500):
-		log.Warnf("timed out waiting for IP for mgmt domain=%s", d.SafeString())
-		return nil, fmt.Errorf("timed out waiting for ips to be available for domain %s", d.SafeString())
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	case resp = <-resultChan:
-	}
-
-	if resp.err != nil {
-		return nil, fmt.Errorf("resolve domain %s: %w", d.SafeString(), resp.err)
-	}
-	return resp.ips, nil
-}
-
 // PopulateFromConfig extracts and caches domains from the client configuration.
 func (m *Resolver) PopulateFromConfig(ctx context.Context, mgmtURL *url.URL) error {
 	if mgmtURL == nil {

client/internal/dns/resutil/resolve.go

@@ -1,197 +0,0 @@
-// Package resutil provides shared DNS resolution utilities
-package resutil
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"errors"
-	"net"
-	"net/netip"
-	"strings"
-
-	"github.com/miekg/dns"
-	log "github.com/sirupsen/logrus"
-)
-
-// GenerateRequestID creates a random 8-character hex string for request tracing.
-func GenerateRequestID() string {
-	bytes := make([]byte, 4)
-	if _, err := rand.Read(bytes); err != nil {
-		log.Errorf("generate request ID: %v", err)
-		return ""
-	}
-	return hex.EncodeToString(bytes)
-}
-
-// IPsToRRs converts a slice of IP addresses to DNS resource records.
-// IPv4 addresses become A records, IPv6 addresses become AAAA records.
-func IPsToRRs(name string, ips []netip.Addr, ttl uint32) []dns.RR {
-	var result []dns.RR
-
-	for _, ip := range ips {
-		if ip.Is6() {
-			result = append(result, &dns.AAAA{
-				Hdr: dns.RR_Header{
-					Name:   name,
-					Rrtype: dns.TypeAAAA,
-					Class:  dns.ClassINET,
-					Ttl:    ttl,
-				},
-				AAAA: ip.AsSlice(),
-			})
-		} else {
-			result = append(result, &dns.A{
-				Hdr: dns.RR_Header{
-					Name:   name,
-					Rrtype: dns.TypeA,
-					Class:  dns.ClassINET,
-					Ttl:    ttl,
-				},
-				A: ip.AsSlice(),
-			})
-		}
-	}
-
-	return result
-}
-
-// NetworkForQtype returns the network string ("ip4" or "ip6") for a DNS query type.
-// Returns empty string for unsupported types.
-func NetworkForQtype(qtype uint16) string {
-	switch qtype {
-	case dns.TypeA:
-		return "ip4"
-	case dns.TypeAAAA:
-		return "ip6"
-	default:
-		return ""
-	}
-}
-
-type resolver interface {
-	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
-// chainedWriter is implemented by ResponseWriters that carry request metadata
-type chainedWriter interface {
-	RequestID() string
-	SetMeta(key, value string)
-}
-
-// GetRequestID extracts a request ID from the ResponseWriter if available,
-// otherwise generates a new one.
-func GetRequestID(w dns.ResponseWriter) string {
-	if cw, ok := w.(chainedWriter); ok {
-		if id := cw.RequestID(); id != "" {
-			return id
-		}
-	}
-	return GenerateRequestID()
-}
-
-// SetMeta sets metadata on the ResponseWriter if it supports it.
-func SetMeta(w dns.ResponseWriter, key, value string) {
-	if cw, ok := w.(chainedWriter); ok {
-		cw.SetMeta(key, value)
-	}
-}
-
-// LookupResult contains the result of an external DNS lookup
-type LookupResult struct {
-	IPs   []netip.Addr
-	Rcode int
-	Err   error // Original error for caller's logging needs
-}
-
-// LookupIP performs a DNS lookup and determines the appropriate rcode.
-func LookupIP(ctx context.Context, r resolver, network, host string, qtype uint16) LookupResult {
-	ips, err := r.LookupNetIP(ctx, network, host)
-	if err != nil {
-		return LookupResult{
-			Rcode: getRcodeForError(ctx, r, host, qtype, err),
-			Err:   err,
-		}
-	}
-
-	// Unmap IPv4-mapped IPv6 addresses that some resolvers may return
-	for i, ip := range ips {
-		ips[i] = ip.Unmap()
-	}
-
-	return LookupResult{
-		IPs:   ips,
-		Rcode: dns.RcodeSuccess,
-	}
-}
-
-func getRcodeForError(ctx context.Context, r resolver, host string, qtype uint16, err error) int {
-	var dnsErr *net.DNSError
-	if !errors.As(err, &dnsErr) {
-		return dns.RcodeServerFailure
-	}
-
-	if dnsErr.IsNotFound {
-		return getRcodeForNotFound(ctx, r, host, qtype)
-	}
-
-	return dns.RcodeServerFailure
-}
-
-// getRcodeForNotFound distinguishes between NXDOMAIN (domain doesn't exist) and NODATA
-// (domain exists but no records of requested type) by checking the opposite record type.
-//
-// musl libc (the reason we need this distinction) only queries A/AAAA pairs in getaddrinfo,
-// so checking the opposite A/AAAA type is sufficient. Other record types (MX, TXT, etc.)
-// are not queried by musl and don't need this handling.
-func getRcodeForNotFound(ctx context.Context, r resolver, domain string, originalQtype uint16) int {
-	// Try querying for a different record type to see if the domain exists
-	// If the original query was for AAAA, try A. If it was for A, try AAAA.
-	// This helps distinguish between NXDOMAIN and NODATA.
-	var alternativeNetwork string
-	switch originalQtype {
-	case dns.TypeAAAA:
-		alternativeNetwork = "ip4"
-	case dns.TypeA:
-		alternativeNetwork = "ip6"
-	default:
-		return dns.RcodeNameError
-	}
-
-	if _, err := r.LookupNetIP(ctx, alternativeNetwork, domain); err != nil {
-		var dnsErr *net.DNSError
-		if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
-			// Alternative query also returned not found - domain truly doesn't exist
-			return dns.RcodeNameError
-		}
-		// Some other error (timeout, server failure, etc.) - can't determine, assume domain exists
-		return dns.RcodeSuccess
-	}
-
-	// Alternative query succeeded - domain exists but has no records of this type
-	return dns.RcodeSuccess
-}
-
-// FormatAnswers formats DNS resource records for logging.
-func FormatAnswers(answers []dns.RR) string {
-	if len(answers) == 0 {
-		return "[]"
-	}
-
-	parts := make([]string, 0, len(answers))
-	for _, rr := range answers {
-		switch r := rr.(type) {
-		case *dns.A:
-			parts = append(parts, r.A.String())
-		case *dns.AAAA:
-			parts = append(parts, r.AAAA.String())
-		case *dns.CNAME:
-			parts = append(parts, "CNAME:"+r.Target)
-		case *dns.PTR:
-			parts = append(parts, "PTR:"+r.Ptr)
-		default:
-			parts = append(parts, dns.TypeToString[rr.Header().Rrtype])
-		}
-	}
-	return "[" + strings.Join(parts, ", ") + "]"
-}

client/internal/dns/server.go

@@ -80,7 +80,6 @@ type DefaultServer struct {
 	updateSerial       uint64
 	previousConfigHash uint64
 	currentConfig      HostDNSConfig
-	currentConfigHash  uint64
 	handlerChain       *HandlerChain
 	extraDomains       map[domain.Domain]int
 
@@ -208,7 +207,6 @@ func newDefaultServer(
 		hostsDNSHolder:    newHostsDNSHolder(),
 		hostManager:       &noopHostConfigurator{},
 		mgmtCacheResolver: mgmtCacheResolver,
-		currentConfigHash: ^uint64(0), // Initialize to max uint64 to ensure first config is always applied
 	}
 
 	// register with root zone, handler chain takes care of the routing
@@ -485,7 +483,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 		}
 	}
 
-	localMuxUpdates, localZones, err := s.buildLocalHandlerUpdate(update.CustomZones)
+	localMuxUpdates, localRecords, err := s.buildLocalHandlerUpdate(update.CustomZones)
 	if err != nil {
 		return fmt.Errorf("local handler updater: %w", err)
 	}
@@ -498,7 +496,8 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 
 	s.updateMux(muxUpdates)
 
-	s.localResolver.Update(localZones)
+	// register local records
+	s.localResolver.Update(localRecords)
 
 	s.currentConfig = dnsConfigToHostDNSConfig(update, s.service.RuntimeIP(), s.service.RuntimePort())
 
@@ -587,29 +586,8 @@ func (s *DefaultServer) applyHostConfig() {
 
 	log.Debugf("extra match domains: %v", maps.Keys(s.extraDomains))
 
-	hash, err := hashstructure.Hash(config, hashstructure.FormatV2, &hashstructure.HashOptions{
-		ZeroNil:         true,
-		IgnoreZeroValue: true,
-		SlicesAsSets:    true,
-		UseStringer:     true,
-	})
-	if err != nil {
-		log.Warnf("unable to hash the host dns configuration, will apply config anyway: %s", err)
-		// Fall through to apply config anyway (fail-safe approach)
-	} else if s.currentConfigHash == hash {
-		log.Debugf("not applying host config as there are no changes")
-		return
-	}
-
-	log.Debugf("applying host config as there are changes")
 	if err := s.hostManager.applyDNSConfig(config, s.stateManager); err != nil {
 		log.Errorf("failed to apply DNS host manager update: %v", err)
-		return
-	}
-
-	// Only update hash if it was computed successfully and config was applied
-	if err == nil {
-		s.currentConfigHash = hash
 	}
 
 	s.registerFallback(config)
@@ -631,7 +609,9 @@ func (s *DefaultServer) registerFallback(config HostDNSConfig) {
 
 	handler, err := newUpstreamResolver(
 		s.ctx,
-		s.wgInterface,
+		s.wgInterface.Name(),
+		s.wgInterface.Address().IP,
+		s.wgInterface.Address().Network,
 		s.statusRecorder,
 		s.hostsDNSHolder,
 		nbdns.RootZone,
@@ -656,9 +636,9 @@ func (s *DefaultServer) registerFallback(config HostDNSConfig) {
 	s.registerHandler([]string{nbdns.RootZone}, handler, PriorityFallback)
 }
 
-func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone) ([]handlerWrapper, []nbdns.CustomZone, error) {
+func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone) ([]handlerWrapper, []nbdns.SimpleRecord, error) {
 	var muxUpdates []handlerWrapper
-	var zones []nbdns.CustomZone
+	var localRecords []nbdns.SimpleRecord
 
 	for _, customZone := range customZones {
 		if len(customZone.Records) == 0 {
@@ -672,20 +652,17 @@ func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone)
 			priority: PriorityLocal,
 		})
 
-		// zone records contain the fqdn, so we can just flatten them
-		var localRecords []nbdns.SimpleRecord
 		for _, record := range customZone.Records {
 			if record.Class != nbdns.DefaultClass {
 				log.Warnf("received an invalid class type: %s", record.Class)
 				continue
 			}
+			// zone records contain the fqdn, so we can just flatten them
 			localRecords = append(localRecords, record)
 		}
-		customZone.Records = localRecords
-		zones = append(zones, customZone)
 	}
 
-	return muxUpdates, zones, nil
+	return muxUpdates, localRecords, nil
 }
 
 func (s *DefaultServer) buildUpstreamHandlerUpdate(nameServerGroups []*nbdns.NameServerGroup) ([]handlerWrapper, error) {
@@ -741,7 +718,9 @@ func (s *DefaultServer) createHandlersForDomainGroup(domainGroup nsGroupsByDomai
 		log.Debugf("creating handler for domain=%s with priority=%d", domainGroup.domain, priority)
 		handler, err := newUpstreamResolver(
 			s.ctx,
-			s.wgInterface,
+			s.wgInterface.Name(),
+			s.wgInterface.Address().IP,
+			s.wgInterface.Address().Network,
 			s.statusRecorder,
 			s.hostsDNSHolder,
 			domainGroup.domain,
@@ -922,7 +901,9 @@ func (s *DefaultServer) addHostRootZone() {
 
 	handler, err := newUpstreamResolver(
 		s.ctx,
-		s.wgInterface,
+		s.wgInterface.Name(),
+		s.wgInterface.Address().IP,
+		s.wgInterface.Address().Network,
 		s.statusRecorder,
 		s.hostsDNSHolder,
 		nbdns.RootZone,

client/internal/dns/server_test.go

@@ -15,7 +15,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/firewall/uspfilter"
@@ -82,10 +81,6 @@ func (w *mocWGIface) GetStats(_ string) (configurer.WGStats, error) {
 	return configurer.WGStats{}, nil
 }
 
-func (w *mocWGIface) GetNet() *netstack.Net {
-	return nil
-}
-
 var zoneRecords = []nbdns.SimpleRecord{
 	{
 		Name:  "peera.netbird.cloud",
@@ -133,7 +128,7 @@ func TestUpdateDNSServer(t *testing.T) {
 	testCases := []struct {
 		name                string
 		initUpstreamMap     registeredHandlerMap
-		initLocalZones      []nbdns.CustomZone
+		initLocalRecords    []nbdns.SimpleRecord
 		initSerial          uint64
 		inputSerial         uint64
 		inputUpdate         nbdns.Config
@@ -185,8 +180,8 @@ func TestUpdateDNSServer(t *testing.T) {
 			expectedLocalQs: []dns.Question{{Name: "peera.netbird.cloud.", Qtype: dns.TypeA, Qclass: dns.ClassINET}},
 		},
 		{
-			name:           "New Config Should Succeed",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			name:             "New Config Should Succeed",
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   "netbird.cloud",
@@ -226,19 +221,19 @@ func TestUpdateDNSServer(t *testing.T) {
 			expectedLocalQs: []dns.Question{{Name: zoneRecords[0].Name, Qtype: 1, Qclass: 1}},
 		},
 		{
-			name:            "Smaller Config Serial Should Be Skipped",
-			initLocalZones:  []nbdns.CustomZone{},
-			initUpstreamMap: make(registeredHandlerMap),
-			initSerial:      2,
-			inputSerial:     1,
-			shouldFail:      true,
+			name:             "Smaller Config Serial Should Be Skipped",
+			initLocalRecords: []nbdns.SimpleRecord{},
+			initUpstreamMap:  make(registeredHandlerMap),
+			initSerial:       2,
+			inputSerial:      1,
+			shouldFail:       true,
 		},
 		{
-			name:            "Empty NS Group Domain Or Not Primary Element Should Fail",
-			initLocalZones:  []nbdns.CustomZone{},
-			initUpstreamMap: make(registeredHandlerMap),
-			initSerial:      0,
-			inputSerial:     1,
+			name:             "Empty NS Group Domain Or Not Primary Element Should Fail",
+			initLocalRecords: []nbdns.SimpleRecord{},
+			initUpstreamMap:  make(registeredHandlerMap),
+			initSerial:       0,
+			inputSerial:      1,
 			inputUpdate: nbdns.Config{
 				ServiceEnable: true,
 				CustomZones: []nbdns.CustomZone{
@@ -256,11 +251,11 @@ func TestUpdateDNSServer(t *testing.T) {
 			shouldFail: true,
 		},
 		{
-			name:            "Invalid NS Group Nameservers list Should Fail",
-			initLocalZones:  []nbdns.CustomZone{},
-			initUpstreamMap: make(registeredHandlerMap),
-			initSerial:      0,
-			inputSerial:     1,
+			name:             "Invalid NS Group Nameservers list Should Fail",
+			initLocalRecords: []nbdns.SimpleRecord{},
+			initUpstreamMap:  make(registeredHandlerMap),
+			initSerial:       0,
+			inputSerial:      1,
 			inputUpdate: nbdns.Config{
 				ServiceEnable: true,
 				CustomZones: []nbdns.CustomZone{
@@ -278,11 +273,11 @@ func TestUpdateDNSServer(t *testing.T) {
 			shouldFail: true,
 		},
 		{
-			name:            "Invalid Custom Zone Records list Should Skip",
-			initLocalZones:  []nbdns.CustomZone{},
-			initUpstreamMap: make(registeredHandlerMap),
-			initSerial:      0,
-			inputSerial:     1,
+			name:             "Invalid Custom Zone Records list Should Skip",
+			initLocalRecords: []nbdns.SimpleRecord{},
+			initUpstreamMap:  make(registeredHandlerMap),
+			initSerial:       0,
+			inputSerial:      1,
 			inputUpdate: nbdns.Config{
 				ServiceEnable: true,
 				CustomZones: []nbdns.CustomZone{
@@ -304,8 +299,8 @@ func TestUpdateDNSServer(t *testing.T) {
 			}},
 		},
 		{
-			name:           "Empty Config Should Succeed and Clean Maps",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			name:             "Empty Config Should Succeed and Clean Maps",
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   zoneRecords[0].Name,
@@ -320,8 +315,8 @@ func TestUpdateDNSServer(t *testing.T) {
 			expectedLocalQs:     []dns.Question{},
 		},
 		{
-			name:           "Disabled Service Should clean map",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			name:             "Disabled Service Should clean map",
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   zoneRecords[0].Name,
@@ -390,7 +385,7 @@ func TestUpdateDNSServer(t *testing.T) {
 			}()
 
 			dnsServer.dnsMuxMap = testCase.initUpstreamMap
-			dnsServer.localResolver.Update(testCase.initLocalZones)
+			dnsServer.localResolver.Update(testCase.initLocalRecords)
 			dnsServer.updateSerial = testCase.initSerial
 
 			err = dnsServer.UpdateDNSServer(testCase.inputSerial, testCase.inputUpdate)
@@ -515,7 +510,8 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 			priority: PriorityUpstream,
 		},
 	}
-	dnsServer.localResolver.Update([]nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}})
+	//dnsServer.localResolver.RegisteredMap = local.RegistrationMap{local.BuildRecordKey("netbird.cloud", dns.ClassINET, dns.TypeA): struct{}{}}
+	dnsServer.localResolver.Update([]nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}})
 	dnsServer.updateSerial = 0
 
 	nameServers := []nbdns.NameServer{
@@ -1606,10 +1602,7 @@ func TestExtraDomains(t *testing.T) {
 				"other.example.com.",
 				"duplicate.example.com.",
 			},
-			// Expect 3 calls instead of 4 because when deregistering duplicate.example.com,
-			// the domain remains in the config (ref count goes from 2 to 1), so the host
-			// config hash doesn't change and applyDNSConfig is not called.
-			applyHostConfigCall: 3,
+			applyHostConfigCall: 4,
 		},
 		{
 			name: "Config update with new domains after registration",
@@ -1664,10 +1657,7 @@ func TestExtraDomains(t *testing.T) {
 			expectedMatchOnly: []string{
 				"extra.example.com.",
 			},
-			// Expect 2 calls instead of 3 because when deregistering protected.example.com,
-			// it's removed from extraDomains but still remains in the config (from customZones),
-			// so the host config hash doesn't change and applyDNSConfig is not called.
-			applyHostConfigCall: 2,
+			applyHostConfigCall: 3,
 		},
 		{
 			name: "Register domain that is part of nameserver group",
@@ -2052,7 +2042,7 @@ func TestLocalResolverPriorityInServer(t *testing.T) {
 
 func TestLocalResolverPriorityConstants(t *testing.T) {
 	// Test that priority constants are ordered correctly
-	assert.Greater(t, PriorityDNSRoute, PriorityLocal, "DNS Route should be higher than Local priority")
+	assert.Greater(t, PriorityLocal, PriorityDNSRoute, "Local priority should be higher than DNS route")
 	assert.Greater(t, PriorityLocal, PriorityUpstream, "Local priority should be higher than upstream")
 	assert.Greater(t, PriorityUpstream, PriorityDefault, "Upstream priority should be higher than default")
 

client/internal/dns/upstream.go

@@ -2,6 +2,7 @@ package dns
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
@@ -18,10 +19,8 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/proto"
@@ -114,7 +113,10 @@ func (u *upstreamResolverBase) Stop() {
 
 // ServeDNS handles a DNS request
 func (u *upstreamResolverBase) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	logger := log.WithField("request_id", resutil.GetRequestID(w))
+	requestID := GenerateRequestID()
+	logger := log.WithField("request_id", requestID)
+
+	logger.Tracef("received upstream question: domain=%s type=%v class=%v", r.Question[0].Name, r.Question[0].Qtype, r.Question[0].Qclass)
 
 	u.prepareRequest(r)
 
@@ -200,18 +202,11 @@ func (u *upstreamResolverBase) handleUpstreamError(err error, upstream netip.Add
 
 func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dns.Msg, upstream netip.AddrPort, domain string, t time.Duration, logger *log.Entry) bool {
 	u.successCount.Add(1)
-
-	resutil.SetMeta(w, "upstream", upstream.String())
-
-	// Clear Zero bit from external responses to prevent upstream servers from
-	// manipulating our internal fallthrough signaling mechanism
-	rm.MsgHdr.Zero = false
+	logger.Tracef("took %s to query the upstream %s for question domain=%s", t, upstream, domain)
 
 	if err := w.WriteMsg(rm); err != nil {
 		logger.Errorf("failed to write DNS response for question domain=%s: %s", domain, err)
-		return true
 	}
-
 	return true
 }
 
@@ -419,56 +414,16 @@ func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, u
 	return rm, t, nil
 }
 
-// ExchangeWithNetstack performs a DNS exchange using netstack for dialing.
-// This is needed when netstack is enabled to reach peer IPs through the tunnel.
-func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream string) (*dns.Msg, error) {
-	reply, err := netstackExchange(ctx, nsNet, r, upstream, "udp")
+func GenerateRequestID() string {
+	bytes := make([]byte, 4)
+	_, err := rand.Read(bytes)
 	if err != nil {
-		return nil, err
+		log.Errorf("failed to generate request ID: %v", err)
+		return ""
 	}
-
-	// If response is truncated, retry with TCP
-	if reply != nil && reply.MsgHdr.Truncated {
-		log.Tracef("udp response for domain=%s type=%v class=%v is truncated, trying TCP",
-			r.Question[0].Name, r.Question[0].Qtype, r.Question[0].Qclass)
-		return netstackExchange(ctx, nsNet, r, upstream, "tcp")
-	}
-
-	return reply, nil
+	return hex.EncodeToString(bytes)
 }
 
-func netstackExchange(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream, network string) (*dns.Msg, error) {
-	conn, err := nsNet.DialContext(ctx, network, upstream)
-	if err != nil {
-		return nil, fmt.Errorf("with %s: %w", network, err)
-	}
-	defer func() {
-		if err := conn.Close(); err != nil {
-			log.Debugf("failed to close DNS connection: %v", err)
-		}
-	}()
-
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			return nil, fmt.Errorf("set deadline: %w", err)
-		}
-	}
-
-	dnsConn := &dns.Conn{Conn: conn}
-
-	if err := dnsConn.WriteMsg(r); err != nil {
-		return nil, fmt.Errorf("write %s message: %w", network, err)
-	}
-
-	reply, err := dnsConn.ReadMsg()
-	if err != nil {
-		return nil, fmt.Errorf("read %s message: %w", network, err)
-	}
-
-	return reply, nil
-}
-
-
 // FormatPeerStatus formats peer connection status information for debugging DNS timeouts
 func FormatPeerStatus(peerState *peer.State) string {
 	isConnected := peerState.ConnStatus == peer.StatusConnected

client/internal/dns/upstream_android.go

@@ -23,7 +23,9 @@ type upstreamResolver struct {
 // first time, and we need to wait for a while to start to use again the proper DNS resolver.
 func newUpstreamResolver(
 	ctx context.Context,
-	_ WGIface,
+	_ string,
+	_ netip.Addr,
+	_ netip.Prefix,
 	statusRecorder *peer.Status,
 	hostsDNSHolder *hostsDNSHolder,
 	domain string,

client/internal/dns/upstream_general.go

@@ -5,23 +5,22 @@ package dns
 import (
 	"context"
 	"net/netip"
-	"runtime"
 	"time"
 
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
 )
 
 type upstreamResolver struct {
 	*upstreamResolverBase
-	nsNet *netstack.Net
 }
 
 func newUpstreamResolver(
 	ctx context.Context,
-	wgIface WGIface,
+	_ string,
+	_ netip.Addr,
+	_ netip.Prefix,
 	statusRecorder *peer.Status,
 	_ *hostsDNSHolder,
 	domain string,
@@ -29,23 +28,12 @@ func newUpstreamResolver(
 	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, domain)
 	nonIOS := &upstreamResolver{
 		upstreamResolverBase: upstreamResolverBase,
-		nsNet:                wgIface.GetNet(),
 	}
 	upstreamResolverBase.upstreamClient = nonIOS
 	return nonIOS, nil
 }
 
 func (u *upstreamResolver) exchange(ctx context.Context, upstream string, r *dns.Msg) (rm *dns.Msg, t time.Duration, err error) {
-	// TODO: Check if upstream DNS server is routed through a peer before using netstack.
-	// Similar to iOS logic, we should determine if the DNS server is reachable directly
-	// or needs to go through the tunnel, and only use netstack when necessary.
-	// For now, only use netstack on JS platform where direct access is not possible.
-	if u.nsNet != nil && runtime.GOOS == "js" {
-		start := time.Now()
-		reply, err := ExchangeWithNetstack(ctx, u.nsNet, r, upstream)
-		return reply, time.Since(start), err
-	}
-
 	client := &dns.Client{
 		Timeout: ClientTimeout,
 	}

client/internal/dns/upstream_ios.go

@@ -26,7 +26,9 @@ type upstreamResolverIOS struct {
 
 func newUpstreamResolver(
 	ctx context.Context,
-	wgIface WGIface,
+	interfaceName string,
+	ip netip.Addr,
+	net netip.Prefix,
 	statusRecorder *peer.Status,
 	_ *hostsDNSHolder,
 	domain string,
@@ -35,9 +37,9 @@ func newUpstreamResolver(
 
 	ios := &upstreamResolverIOS{
 		upstreamResolverBase: upstreamResolverBase,
-		lIP:                  wgIface.Address().IP,
-		lNet:                 wgIface.Address().Network,
-		interfaceName:        wgIface.Name(),
+		lIP:                  ip,
+		lNet:                 net,
+		interfaceName:        interfaceName,
 	}
 	ios.upstreamClient = ios
 

client/internal/dns/upstream_test.go

@@ -2,17 +2,13 @@ package dns
 
 import (
 	"context"
-	"net"
 	"net/netip"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 )
 
@@ -62,7 +58,7 @@ func TestUpstreamResolver_ServeDNS(t *testing.T) {
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.TODO())
-			resolver, _ := newUpstreamResolver(ctx, &mockNetstackProvider{}, nil, nil, ".")
+			resolver, _ := newUpstreamResolver(ctx, "", netip.Addr{}, netip.Prefix{}, nil, nil, ".")
 			// Convert test servers to netip.AddrPort
 			var servers []netip.AddrPort
 			for _, server := range testCase.InputServers {
@@ -116,19 +112,6 @@ func TestUpstreamResolver_ServeDNS(t *testing.T) {
 	}
 }
 
-type mockNetstackProvider struct{}
-
-func (m *mockNetstackProvider) Name() string                      { return "mock" }
-func (m *mockNetstackProvider) Address() wgaddr.Address           { return wgaddr.Address{} }
-func (m *mockNetstackProvider) ToInterface() *net.Interface       { return nil }
-func (m *mockNetstackProvider) IsUserspaceBind() bool             { return false }
-func (m *mockNetstackProvider) GetFilter() device.PacketFilter    { return nil }
-func (m *mockNetstackProvider) GetDevice() *device.FilteredDevice { return nil }
-func (m *mockNetstackProvider) GetNet() *netstack.Net             { return nil }
-func (m *mockNetstackProvider) GetInterfaceGUIDString() (string, error) {
-	return "", nil
-}
-
 type mockUpstreamResolver struct {
 	r   *dns.Msg
 	rtt time.Duration

client/internal/dns/wgiface.go

@@ -5,8 +5,6 @@ package dns
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
@@ -19,5 +17,4 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
 }

client/internal/dns/wgiface_windows.go

@@ -1,8 +1,6 @@
 package dns
 
 import (
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
@@ -14,6 +12,5 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
 	GetInterfaceGUIDString() (string, error)
 }

client/internal/dnsfwd/forwarder.go

@@ -18,7 +18,6 @@ import (
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/route"
 )
@@ -190,22 +189,29 @@ func (f *DNSForwarder) Close(ctx context.Context) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, query *dns.Msg) *dns.Msg {
+func (f *DNSForwarder) handleDNSQuery(w dns.ResponseWriter, query *dns.Msg) *dns.Msg {
 	if len(query.Question) == 0 {
 		return nil
 	}
 	question := query.Question[0]
-	logger.Tracef("received DNS request for DNS forwarder: domain=%s type=%s class=%s",
-		question.Name, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
+	log.Tracef("received DNS request for DNS forwarder: domain=%v type=%v class=%v",
+		question.Name, question.Qtype, question.Qclass)
 
 	domain := strings.ToLower(question.Name)
 
 	resp := query.SetReply(query)
-	network := resutil.NetworkForQtype(question.Qtype)
-	if network == "" {
+	var network string
+	switch question.Qtype {
+	case dns.TypeA:
+		network = "ip4"
+	case dns.TypeAAAA:
+		network = "ip6"
+	default:
+		// TODO: Handle other types
+
 		resp.Rcode = dns.RcodeNotImplemented
 		if err := w.WriteMsg(resp); err != nil {
-			logger.Errorf("failed to write DNS response: %v", err)
+			log.Errorf("failed to write DNS response: %v", err)
 		}
 		return nil
 	}
@@ -215,35 +221,33 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 	if mostSpecificResId == "" {
 		resp.Rcode = dns.RcodeRefused
 		if err := w.WriteMsg(resp); err != nil {
-			logger.Errorf("failed to write DNS response: %v", err)
+			log.Errorf("failed to write DNS response: %v", err)
 		}
 		return nil
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), upstreamTimeout)
 	defer cancel()
-
-	result := resutil.LookupIP(ctx, f.resolver, network, domain, question.Qtype)
-	if result.Err != nil {
-		f.handleDNSError(ctx, logger, w, question, resp, domain, result)
+	ips, err := f.resolver.LookupNetIP(ctx, network, domain)
+	if err != nil {
+		f.handleDNSError(ctx, w, question, resp, domain, err)
 		return nil
 	}
 
-	f.updateInternalState(result.IPs, mostSpecificResId, matchingEntries)
-	resp.Answer = append(resp.Answer, resutil.IPsToRRs(domain, result.IPs, f.ttl)...)
-	f.cache.set(domain, question.Qtype, result.IPs)
+	// Unmap IPv4-mapped IPv6 addresses that some resolvers may return
+	for i, ip := range ips {
+		ips[i] = ip.Unmap()
+	}
+
+	f.updateInternalState(ips, mostSpecificResId, matchingEntries)
+	f.addIPsToResponse(resp, domain, ips)
+	f.cache.set(domain, question.Qtype, ips)
 
 	return resp
 }
 
 func (f *DNSForwarder) handleDNSQueryUDP(w dns.ResponseWriter, query *dns.Msg) {
-	startTime := time.Now()
-	logger := log.WithFields(log.Fields{
-		"request_id": resutil.GenerateRequestID(),
-		"dns_id":     fmt.Sprintf("%04x", query.Id),
-	})
-
-	resp := f.handleDNSQuery(logger, w, query)
+	resp := f.handleDNSQuery(w, query)
 	if resp == nil {
 		return
 	}
@@ -261,33 +265,19 @@ func (f *DNSForwarder) handleDNSQueryUDP(w dns.ResponseWriter, query *dns.Msg) {
 	}
 
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
-		return
+		log.Errorf("failed to write DNS response: %v", err)
 	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s took=%s",
-		query.Question[0].Name, dns.RcodeToString[resp.Rcode], resutil.FormatAnswers(resp.Answer), time.Since(startTime))
 }
 
 func (f *DNSForwarder) handleDNSQueryTCP(w dns.ResponseWriter, query *dns.Msg) {
-	startTime := time.Now()
-	logger := log.WithFields(log.Fields{
-		"request_id": resutil.GenerateRequestID(),
-		"dns_id":     fmt.Sprintf("%04x", query.Id),
-	})
-
-	resp := f.handleDNSQuery(logger, w, query)
+	resp := f.handleDNSQuery(w, query)
 	if resp == nil {
 		return
 	}
 
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
-		return
+		log.Errorf("failed to write DNS response: %v", err)
 	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s took=%s",
-		query.Question[0].Name, dns.RcodeToString[resp.Rcode], resutil.FormatAnswers(resp.Answer), time.Since(startTime))
 }
 
 func (f *DNSForwarder) updateInternalState(ips []netip.Addr, mostSpecificResId route.ResID, matchingEntries []*ForwarderEntry) {
@@ -325,64 +315,140 @@ func (f *DNSForwarder) updateFirewall(matchingEntries []*ForwarderEntry, prefixe
 	}
 }
 
+// setResponseCodeForNotFound determines and sets the appropriate response code when IsNotFound is true
+// It distinguishes between NXDOMAIN (domain doesn't exist) and NODATA (domain exists but no records of requested type)
+//
+// LIMITATION: This function only checks A and AAAA record types to determine domain existence.
+// If a domain has only other record types (MX, TXT, CNAME, etc.) but no A/AAAA records,
+// it may incorrectly return NXDOMAIN instead of NODATA. This is acceptable since the forwarder
+// only handles A/AAAA queries and returns NOTIMP for other types.
+func (f *DNSForwarder) setResponseCodeForNotFound(ctx context.Context, resp *dns.Msg, domain string, originalQtype uint16) {
+	// Try querying for a different record type to see if the domain exists
+	// If the original query was for AAAA, try A. If it was for A, try AAAA.
+	// This helps distinguish between NXDOMAIN and NODATA.
+	var alternativeNetwork string
+	switch originalQtype {
+	case dns.TypeAAAA:
+		alternativeNetwork = "ip4"
+	case dns.TypeA:
+		alternativeNetwork = "ip6"
+	default:
+		resp.Rcode = dns.RcodeNameError
+		return
+	}
+
+	if _, err := f.resolver.LookupNetIP(ctx, alternativeNetwork, domain); err != nil {
+		var dnsErr *net.DNSError
+		if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+			// Alternative query also returned not found - domain truly doesn't exist
+			resp.Rcode = dns.RcodeNameError
+			return
+		}
+		// Some other error (timeout, server failure, etc.) - can't determine, assume domain exists
+		resp.Rcode = dns.RcodeSuccess
+		return
+	}
+
+	// Alternative query succeeded - domain exists but has no records of this type
+	resp.Rcode = dns.RcodeSuccess
+}
+
 // handleDNSError processes DNS lookup errors and sends an appropriate error response.
 func (f *DNSForwarder) handleDNSError(
 	ctx context.Context,
-	logger *log.Entry,
 	w dns.ResponseWriter,
 	question dns.Question,
 	resp *dns.Msg,
 	domain string,
-	result resutil.LookupResult,
+	err error,
 ) {
+	// Default to SERVFAIL; override below when appropriate.
+	resp.Rcode = dns.RcodeServerFailure
+
 	qType := question.Qtype
 	qTypeName := dns.TypeToString[qType]
 
-	resp.Rcode = result.Rcode
-
-	// NotFound: cache negative result and respond
-	if result.Rcode == dns.RcodeNameError || result.Rcode == dns.RcodeSuccess {
-		f.cache.set(domain, question.Qtype, nil)
+	// Prefer typed DNS errors; fall back to generic logging otherwise.
+	var dnsErr *net.DNSError
+	if !errors.As(err, &dnsErr) {
+		log.Warnf(errResolveFailed, domain, err)
 		if writeErr := w.WriteMsg(resp); writeErr != nil {
-			logger.Errorf("failed to write failure DNS response: %v", writeErr)
+			log.Errorf("failed to write failure DNS response: %v", writeErr)
 		}
 		return
 	}
 
+	// NotFound: set NXDOMAIN / appropriate code via helper.
+	if dnsErr.IsNotFound {
+		f.setResponseCodeForNotFound(ctx, resp, domain, qType)
+		if writeErr := w.WriteMsg(resp); writeErr != nil {
+			log.Errorf("failed to write failure DNS response: %v", writeErr)
+		}
+		f.cache.set(domain, question.Qtype, nil)
+		return
+	}
+
 	// Upstream failed but we might have a cached answer—serve it if present.
 	if ips, ok := f.cache.get(domain, qType); ok {
 		if len(ips) > 0 {
-			logger.Debugf("serving cached DNS response after upstream failure: domain=%s type=%s", domain, qTypeName)
-			resp.Answer = append(resp.Answer, resutil.IPsToRRs(domain, ips, f.ttl)...)
+			log.Debugf("serving cached DNS response after upstream failure: domain=%s type=%s", domain, qTypeName)
+			f.addIPsToResponse(resp, domain, ips)
 			resp.Rcode = dns.RcodeSuccess
 			if writeErr := w.WriteMsg(resp); writeErr != nil {
-				logger.Errorf("failed to write cached DNS response: %v", writeErr)
+				log.Errorf("failed to write cached DNS response: %v", writeErr)
 			}
-			return
-		}
-
-		// Cached negative result - re-verify NXDOMAIN vs NODATA
-		verifyResult := resutil.LookupIP(ctx, f.resolver, resutil.NetworkForQtype(qType), domain, qType)
-		if verifyResult.Rcode == dns.RcodeNameError || verifyResult.Rcode == dns.RcodeSuccess {
-			resp.Rcode = verifyResult.Rcode
+		} else { // send NXDOMAIN / appropriate code if cache is empty
+			f.setResponseCodeForNotFound(ctx, resp, domain, qType)
 			if writeErr := w.WriteMsg(resp); writeErr != nil {
-				logger.Errorf("failed to write failure DNS response: %v", writeErr)
+				log.Errorf("failed to write failure DNS response: %v", writeErr)
 			}
-			return
 		}
+		return
 	}
 
-	// No cache or verification failed. Log with or without the server field for more context.
-	var dnsErr *net.DNSError
-	if errors.As(result.Err, &dnsErr) && dnsErr.Server != "" {
-		logger.Warnf("failed to resolve: type=%s domain=%s server=%s: %v", qTypeName, domain, dnsErr.Server, result.Err)
+	// No cache. Log with or without the server field for more context.
+	if dnsErr.Server != "" {
+		log.Warnf("failed to resolve: type=%s domain=%s server=%s: %v", qTypeName, domain, dnsErr.Server, err)
 	} else {
-		logger.Warnf(errResolveFailed, domain, result.Err)
+		log.Warnf(errResolveFailed, domain, err)
 	}
 
 	// Write final failure response.
 	if writeErr := w.WriteMsg(resp); writeErr != nil {
-		logger.Errorf("failed to write failure DNS response: %v", writeErr)
+		log.Errorf("failed to write failure DNS response: %v", writeErr)
+	}
+}
+
+// addIPsToResponse adds IP addresses to the DNS response as appropriate A or AAAA records
+func (f *DNSForwarder) addIPsToResponse(resp *dns.Msg, domain string, ips []netip.Addr) {
+	for _, ip := range ips {
+		var respRecord dns.RR
+		if ip.Is6() {
+			log.Tracef("resolved domain=%s to IPv6=%s", domain, ip)
+			rr := dns.AAAA{
+				AAAA: ip.AsSlice(),
+				Hdr: dns.RR_Header{
+					Name:   domain,
+					Rrtype: dns.TypeAAAA,
+					Class:  dns.ClassINET,
+					Ttl:    f.ttl,
+				},
+			}
+			respRecord = &rr
+		} else {
+			log.Tracef("resolved domain=%s to IPv4=%s", domain, ip)
+			rr := dns.A{
+				A: ip.AsSlice(),
+				Hdr: dns.RR_Header{
+					Name:   domain,
+					Rrtype: dns.TypeA,
+					Class:  dns.ClassINET,
+					Ttl:    f.ttl,
+				},
+			}
+			respRecord = &rr
+		}
+		resp.Answer = append(resp.Answer, respRecord)
 	}
 }
 

client/internal/dnsfwd/forwarder_test.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/miekg/dns"
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
@@ -318,7 +317,7 @@ func TestDNSForwarder_UnauthorizedDomainAccess(t *testing.T) {
 			query.SetQuestion(dns.Fqdn(tt.queryDomain), dns.TypeA)
 
 			mockWriter := &test.MockResponseWriter{}
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			resp := forwarder.handleDNSQuery(mockWriter, query)
 
 			if tt.shouldResolve {
 				require.NotNil(t, resp, "Expected response for authorized domain")
@@ -466,7 +465,7 @@ func TestDNSForwarder_FirewallSetUpdates(t *testing.T) {
 			dnsQuery.SetQuestion(dns.Fqdn(tt.query), dns.TypeA)
 
 			mockWriter := &test.MockResponseWriter{}
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, dnsQuery)
+			resp := forwarder.handleDNSQuery(mockWriter, dnsQuery)
 
 			// Verify response
 			if tt.shouldResolve {
@@ -528,7 +527,7 @@ func TestDNSForwarder_MultipleIPsInSingleUpdate(t *testing.T) {
 	query.SetQuestion("example.com.", dns.TypeA)
 
 	mockWriter := &test.MockResponseWriter{}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	// Verify response contains all IPs
 	require.NotNil(t, resp)
@@ -605,7 +604,7 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 				},
 			}
 
-			_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			_ = forwarder.handleDNSQuery(mockWriter, query)
 
 			// Check the response written to the writer
 			require.NotNil(t, writtenResp, "Expected response to be written")
@@ -675,7 +674,7 @@ func TestDNSForwarder_ServeFromCacheOnUpstreamFailure(t *testing.T) {
 	q1 := &dns.Msg{}
 	q1.SetQuestion(dns.Fqdn("example.com"), dns.TypeA)
 	w1 := &test.MockResponseWriter{}
-	resp1 := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w1, q1)
+	resp1 := forwarder.handleDNSQuery(w1, q1)
 	require.NotNil(t, resp1)
 	require.Equal(t, dns.RcodeSuccess, resp1.Rcode)
 	require.Len(t, resp1.Answer, 1)
@@ -685,7 +684,7 @@ func TestDNSForwarder_ServeFromCacheOnUpstreamFailure(t *testing.T) {
 	q2.SetQuestion(dns.Fqdn("example.com"), dns.TypeA)
 	var writtenResp *dns.Msg
 	w2 := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { writtenResp = m; return nil }}
-	_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w2, q2)
+	_ = forwarder.handleDNSQuery(w2, q2)
 
 	require.NotNil(t, writtenResp, "expected response to be written")
 	require.Equal(t, dns.RcodeSuccess, writtenResp.Rcode)
@@ -715,7 +714,7 @@ func TestDNSForwarder_CacheNormalizationCasingAndDot(t *testing.T) {
 	q1 := &dns.Msg{}
 	q1.SetQuestion(mixedQuery+".", dns.TypeA)
 	w1 := &test.MockResponseWriter{}
-	resp1 := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w1, q1)
+	resp1 := forwarder.handleDNSQuery(w1, q1)
 	require.NotNil(t, resp1)
 	require.Equal(t, dns.RcodeSuccess, resp1.Rcode)
 	require.Len(t, resp1.Answer, 1)
@@ -729,7 +728,7 @@ func TestDNSForwarder_CacheNormalizationCasingAndDot(t *testing.T) {
 	q2.SetQuestion("EXAMPLE.COM", dns.TypeA)
 	var writtenResp *dns.Msg
 	w2 := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { writtenResp = m; return nil }}
-	_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w2, q2)
+	_ = forwarder.handleDNSQuery(w2, q2)
 
 	require.NotNil(t, writtenResp)
 	require.Equal(t, dns.RcodeSuccess, writtenResp.Rcode)
@@ -784,7 +783,7 @@ func TestDNSForwarder_MultipleOverlappingPatterns(t *testing.T) {
 	query.SetQuestion("smtp.mail.example.com.", dns.TypeA)
 
 	mockWriter := &test.MockResponseWriter{}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	require.NotNil(t, resp)
 	assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
@@ -905,7 +904,7 @@ func TestDNSForwarder_NodataVsNxdomain(t *testing.T) {
 				},
 			}
 
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			resp := forwarder.handleDNSQuery(mockWriter, query)
 
 			// If a response was returned, it means it should be written (happens in wrapper functions)
 			if resp != nil && writtenResp == nil {
@@ -938,7 +937,7 @@ func TestDNSForwarder_EmptyQuery(t *testing.T) {
 			return nil
 		},
 	}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	assert.Nil(t, resp, "Should return nil for empty query")
 	assert.False(t, writeCalled, "Should not write response for empty query")

client/internal/engine.go

@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/internal/acl"
-	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
@@ -49,9 +48,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	"github.com/netbirdio/netbird/client/internal/updatemanager"
-	"github.com/netbirdio/netbird/client/jobexec"
 	cProto "github.com/netbirdio/netbird/client/proto"
+	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	semaphoregroup "github.com/netbirdio/netbird/util/semaphore-group"
 
@@ -75,7 +73,6 @@ const (
 	PeerConnectionTimeoutMax = 45000 // ms
 	PeerConnectionTimeoutMin = 30000 // ms
 	connInitLimit            = 200
-	disableAutoUpdate        = "disabled"
 )
 
 var ErrResetConnection = fmt.Errorf("reset connection")
@@ -135,11 +132,6 @@ type EngineConfig struct {
 	LazyConnectionEnabled bool
 
 	MTU uint16
-
-	// for debug bundle generation
-	ProfileConfig *profilemanager.Config
-
-	LogPath string
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -203,16 +195,12 @@ type Engine struct {
 	stateManager *statemanager.Manager
 	srWatcher    *guard.SRWatcher
 
-	// Sync response persistence (protected by syncRespMux)
-	syncRespMux         sync.RWMutex
+	// Sync response persistence
 	persistSyncResponse bool
 	latestSyncResponse  *mgmProto.SyncResponse
 	connSemaphore       *semaphoregroup.SemaphoreGroup
 	flowManager         nftypes.FlowManager
 
-	// auto-update
-	updateManager *updatemanager.Manager
-
 	// WireGuard interface monitor
 	wgIfaceMonitor *WGIfaceMonitor
 
@@ -220,9 +208,6 @@ type Engine struct {
 	shutdownWg sync.WaitGroup
 
 	probeStunTurn *relay.StunTurnProbe
-
-	jobExecutor   *jobexec.Executor
-	jobExecutorWG sync.WaitGroup
 }
 
 // Peer is an instance of the Connection Peer
@@ -246,7 +231,6 @@ func NewEngine(
 	mobileDep MobileDependency,
 	statusRecorder *peer.Status,
 	checks []*mgmProto.Checks,
-	stateManager *statemanager.Manager,
 ) *Engine {
 	engine := &Engine{
 		clientCtx:      clientCtx,
@@ -263,13 +247,28 @@ func NewEngine(
 		TURNs:          []*stun.URI{},
 		networkSerial:  0,
 		statusRecorder: statusRecorder,
-		stateManager:   stateManager,
 		checks:         checks,
 		connSemaphore:  semaphoregroup.NewSemaphoreGroup(connInitLimit),
 		probeStunTurn:  relay.NewStunTurnProbe(relay.DefaultCacheTTL),
-		jobExecutor:    jobexec.NewExecutor(),
 	}
 
+	sm := profilemanager.NewServiceManager("")
+
+	path := sm.GetStatePath()
+	if runtime.GOOS == "ios" || runtime.GOOS == "android" {
+		if !fileExists(mobileDep.StateFilePath) {
+			err := createFile(mobileDep.StateFilePath)
+			if err != nil {
+				log.Errorf("failed to create state file: %v", err)
+				// we are not exiting as we can run without the state manager
+			}
+		}
+
+		path = mobileDep.StateFilePath
+	}
+	engine.stateManager = statemanager.New(path)
+	engine.stateManager.RegisterState(&sshconfig.ShutdownState{})
+
 	log.Infof("I am: %s", config.WgPrivateKey.PublicKey().String())
 	return engine
 }
@@ -309,10 +308,6 @@ func (e *Engine) Stop() error {
 		e.srWatcher.Close()
 	}
 
-	if e.updateManager != nil {
-		e.updateManager.Stop()
-	}
-
 	log.Info("cleaning up status recorder states")
 	e.statusRecorder.ReplaceOfflinePeers([]peer.State{})
 	e.statusRecorder.UpdateDNSStates([]peer.NSGroupState{})
@@ -336,8 +331,6 @@ func (e *Engine) Stop() error {
 		e.cancel()
 	}
 
-	e.jobExecutorWG.Wait() // block until job goroutines finish
-
 	e.close()
 
 	// stop flow manager after wg interface is gone
@@ -505,11 +498,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		return fmt.Errorf("up wg interface: %w", err)
 	}
 
-	// Set the WireGuard interface for rosenpass after interface is up
-	if e.rpManager != nil {
-		e.rpManager.SetInterface(e.wgInterface)
-	}
-
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -531,7 +519,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 
 	e.receiveSignalEvents()
 	e.receiveManagementEvents()
-	e.receiveJobEvents()
 
 	// starting network monitor at the very last to avoid disruptions
 	e.startNetworkMonitor()
@@ -554,13 +541,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	return nil
 }
 
-func (e *Engine) InitialUpdateHandling(autoUpdateSettings *mgmProto.AutoUpdateSettings) {
-	e.syncMsgMux.Lock()
-	defer e.syncMsgMux.Unlock()
-
-	e.handleAutoUpdateVersion(autoUpdateSettings, true)
-}
-
 func (e *Engine) createFirewall() error {
 	if e.config.DisableFirewall {
 		log.Infof("firewall is disabled")
@@ -769,41 +749,6 @@ func (e *Engine) PopulateNetbirdConfig(netbirdConfig *mgmProto.NetbirdConfig, mg
 	return nil
 }
 
-func (e *Engine) handleAutoUpdateVersion(autoUpdateSettings *mgmProto.AutoUpdateSettings, initialCheck bool) {
-	if autoUpdateSettings == nil {
-		return
-	}
-
-	disabled := autoUpdateSettings.Version == disableAutoUpdate
-
-	// Stop and cleanup if disabled
-	if e.updateManager != nil && disabled {
-		log.Infof("auto-update is disabled, stopping update manager")
-		e.updateManager.Stop()
-		e.updateManager = nil
-		return
-	}
-
-	// Skip check unless AlwaysUpdate is enabled or this is the initial check at startup
-	if !autoUpdateSettings.AlwaysUpdate && !initialCheck {
-		log.Debugf("skipping auto-update check, AlwaysUpdate is false and this is not the initial check")
-		return
-	}
-
-	// Start manager if needed
-	if e.updateManager == nil {
-		log.Infof("starting auto-update manager")
-		updateManager, err := updatemanager.NewManager(e.statusRecorder, e.stateManager)
-		if err != nil {
-			return
-		}
-		e.updateManager = updateManager
-		e.updateManager.Start(e.ctx)
-	}
-	log.Infof("handling auto-update version: %s", autoUpdateSettings.Version)
-	e.updateManager.SetVersion(autoUpdateSettings.Version)
-}
-
 func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 	e.syncMsgMux.Lock()
 	defer e.syncMsgMux.Unlock()
@@ -813,10 +758,6 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return e.ctx.Err()
 	}
 
-	if update.NetworkMap != nil && update.NetworkMap.PeerConfig != nil {
-		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate, false)
-	}
-
 	if update.GetNetbirdConfig() != nil {
 		wCfg := update.GetNetbirdConfig()
 		err := e.updateTURNs(wCfg.GetTurns())
@@ -856,22 +797,13 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 	}
 
 	nm := update.GetNetworkMap()
-	if nm == nil {
+	if nm == nil || update.SkipNetworkMapUpdate {
 		return nil
 	}
 
-	// Persist sync response under the dedicated lock (syncRespMux), not under syncMsgMux.
-	// Read the storage-enabled flag under the syncRespMux too.
-	e.syncRespMux.RLock()
-	enabled := e.persistSyncResponse
-	e.syncRespMux.RUnlock()
-
 	// Store sync response if persistence is enabled
-	if enabled {
-		e.syncRespMux.Lock()
+	if e.persistSyncResponse {
 		e.latestSyncResponse = update
-		e.syncRespMux.Unlock()
-
 		log.Debugf("sync response persisted with serial %d", nm.GetSerial())
 	}
 
@@ -1001,77 +933,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 
 	return nil
 }
-func (e *Engine) receiveJobEvents() {
-	e.jobExecutorWG.Add(1)
-	go func() {
-		defer e.jobExecutorWG.Done()
-		err := e.mgmClient.Job(e.ctx, func(msg *mgmProto.JobRequest) *mgmProto.JobResponse {
-			resp := mgmProto.JobResponse{
-				ID:     msg.ID,
-				Status: mgmProto.JobStatus_failed,
-			}
-			switch params := msg.WorkloadParameters.(type) {
-			case *mgmProto.JobRequest_Bundle:
-				bundleResult, err := e.handleBundle(params.Bundle)
-				if err != nil {
-					log.Errorf("handling bundle: %v", err)
-					resp.Reason = []byte(err.Error())
-					return &resp
-				}
-				resp.Status = mgmProto.JobStatus_succeeded
-				resp.WorkloadResults = bundleResult
-				return &resp
-			default:
-				resp.Reason = []byte(jobexec.ErrJobNotImplemented.Error())
-				return &resp
-			}
-		})
-		if err != nil {
-			// happens if management is unavailable for a long time.
-			// We want to cancel the operation of the whole client
-			_ = CtxGetState(e.ctx).Wrap(ErrResetConnection)
-			e.clientCancel()
-			return
-		}
-		log.Info("stopped receiving jobs from Management Service")
-	}()
-	log.Info("connecting to Management Service jobs stream")
-}
-
-func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobResponse_Bundle, error) {
-	log.Infof("handle remote debug bundle request: %s", params.String())
-	syncResponse, err := e.GetLatestSyncResponse()
-	if err != nil {
-		log.Warnf("get latest sync response: %v", err)
-	}
-
-	bundleDeps := debug.GeneratorDependencies{
-		InternalConfig: e.config.ProfileConfig,
-		StatusRecorder: e.statusRecorder,
-		SyncResponse:   syncResponse,
-		LogPath:        e.config.LogPath,
-	}
-
-	bundleJobParams := debug.BundleConfig{
-		Anonymize:         params.Anonymize,
-		IncludeSystemInfo: true,
-		LogFileCount:      uint32(params.LogFileCount),
-	}
-
-	waitFor := time.Duration(params.BundleForTime) * time.Minute
-
-	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String())
-	if err != nil {
-		return nil, err
-	}
-
-	response := &mgmProto.JobResponse_Bundle{
-		Bundle: &mgmProto.BundleResult{
-			UploadKey: uploadKey,
-		},
-	}
-	return response, nil
-}
 
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
@@ -1102,7 +963,7 @@ func (e *Engine) receiveManagementEvents() {
 			e.config.DisableSSHAuth,
 		)
 
-		err = e.mgmClient.Sync(e.ctx, info, e.handleSync)
+		err = e.mgmClient.Sync(e.ctx, info, e.networkSerial, e.handleSync)
 		if err != nil {
 			// happens if management is unavailable for a long time.
 			// We want to cancel the operation of the whole client
@@ -1233,15 +1094,6 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 
 	e.updateOfflinePeers(networkMap.GetOfflinePeers())
 
-	// Filter out own peer from the remote peers list
-	localPubKey := e.config.WgPrivateKey.PublicKey().String()
-	remotePeers := make([]*mgmProto.RemotePeerConfig, 0, len(networkMap.GetRemotePeers()))
-	for _, p := range networkMap.GetRemotePeers() {
-		if p.GetWgPubKey() != localPubKey {
-			remotePeers = append(remotePeers, p)
-		}
-	}
-
 	// cleanup request, most likely our peer has been deleted
 	if networkMap.GetRemotePeersIsEmpty() {
 		err := e.removeAllPeers()
@@ -1250,34 +1102,32 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 			return err
 		}
 	} else {
-		err := e.removePeers(remotePeers)
+		err := e.removePeers(networkMap.GetRemotePeers())
 		if err != nil {
 			return err
 		}
 
-		err = e.modifyPeers(remotePeers)
+		err = e.modifyPeers(networkMap.GetRemotePeers())
 		if err != nil {
 			return err
 		}
 
-		err = e.addNewPeers(remotePeers)
+		err = e.addNewPeers(networkMap.GetRemotePeers())
 		if err != nil {
 			return err
 		}
 
 		e.statusRecorder.FinishPeerListModifications()
 
-		e.updatePeerSSHHostKeys(remotePeers)
+		e.updatePeerSSHHostKeys(networkMap.GetRemotePeers())
 
-		if err := e.updateSSHClientConfig(remotePeers); err != nil {
+		if err := e.updateSSHClientConfig(networkMap.GetRemotePeers()); err != nil {
 			log.Warnf("failed to update SSH client config: %v", err)
 		}
-
-		e.updateSSHServerAuth(networkMap.GetSshAuth())
 	}
 
 	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store
-	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, remotePeers)
+	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, networkMap.GetRemotePeers())
 	e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
 
 	e.networkSerial = serial
@@ -1363,16 +1213,11 @@ func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig, network netip.Prefix) nbdns
 		ForwarderPort:    forwarderPort,
 	}
 
-	protoZones := protoDNSConfig.GetCustomZones()
-	// Treat single zone as authoritative for backward compatibility with old servers
-	// that only send the peer FQDN zone without setting field 4.
-	singleZoneCompat := len(protoZones) == 1
-
-	for _, zone := range protoZones {
+	for _, zone := range protoDNSConfig.GetCustomZones() {
 		dnsZone := nbdns.CustomZone{
 			Domain:               zone.GetDomain(),
 			SearchDomainDisabled: zone.GetSearchDomainDisabled(),
-			NonAuthoritative:     zone.GetNonAuthoritative() && !singleZoneCompat,
+			SkipPTRProcess:       zone.GetSkipPTRProcess(),
 		}
 		for _, record := range zone.Records {
 			dnsRecord := nbdns.SimpleRecord{
@@ -1517,7 +1362,6 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 	if e.rpManager != nil {
 		peerConn.SetOnConnected(e.rpManager.OnConnected)
 		peerConn.SetOnDisconnected(e.rpManager.OnDisconnected)
-		peerConn.SetRosenpassInitializedPresharedKeyValidator(e.rpManager.IsPresharedKeyInitialized)
 	}
 
 	return peerConn, nil
@@ -1861,26 +1705,22 @@ func (e *Engine) RunHealthProbes(waitForResult bool) bool {
 	}
 
 	e.syncMsgMux.Unlock()
-
-	// Skip STUN/TURN probing for JS/WASM as it's not available
-	relayHealthy := true
-	if runtime.GOOS != "js" {
-		var results []relay.ProbeResult
-		if waitForResult {
-			results = e.probeStunTurn.ProbeAllWaitResult(e.ctx, stuns, turns)
-		} else {
-			results = e.probeStunTurn.ProbeAll(e.ctx, stuns, turns)
-		}
-		e.statusRecorder.UpdateRelayStates(results)
-
-		for _, res := range results {
-			if res.Err != nil {
-				relayHealthy = false
-				break
-			}
-		}
-		log.Debugf("relay health check: healthy=%t", relayHealthy)
+	var results []relay.ProbeResult
+	if waitForResult {
+		results = e.probeStunTurn.ProbeAllWaitResult(e.ctx, stuns, turns)
+	} else {
+		results = e.probeStunTurn.ProbeAll(e.ctx, stuns, turns)
 	}
+	e.statusRecorder.UpdateRelayStates(results)
+
+	relayHealthy := true
+	for _, res := range results {
+		if res.Err != nil {
+			relayHealthy = false
+			break
+		}
+	}
+	log.Debugf("relay health check: healthy=%t", relayHealthy)
 
 	allHealthy := signalHealthy && managementHealthy && relayHealthy
 	log.Debugf("all health checks completed: healthy=%t", allHealthy)
@@ -1961,8 +1801,8 @@ func (e *Engine) stopDNSServer() {
 
 // SetSyncResponsePersistence enables or disables sync response persistence
 func (e *Engine) SetSyncResponsePersistence(enabled bool) {
-	e.syncRespMux.Lock()
-	defer e.syncRespMux.Unlock()
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
 
 	if enabled == e.persistSyncResponse {
 		return
@@ -1977,22 +1817,20 @@ func (e *Engine) SetSyncResponsePersistence(enabled bool) {
 
 // GetLatestSyncResponse returns the stored sync response if persistence is enabled
 func (e *Engine) GetLatestSyncResponse() (*mgmProto.SyncResponse, error) {
-	e.syncRespMux.RLock()
-	enabled := e.persistSyncResponse
-	latest := e.latestSyncResponse
-	e.syncRespMux.RUnlock()
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
 
-	if !enabled {
+	if !e.persistSyncResponse {
 		return nil, errors.New("sync response persistence is disabled")
 	}
 
-	if latest == nil {
+	if e.latestSyncResponse == nil {
 		//nolint:nilnil
 		return nil, nil
 	}
 
-	log.Debugf("Retrieving latest sync response with size %d bytes", proto.Size(latest))
-	sr, ok := proto.Clone(latest).(*mgmProto.SyncResponse)
+	log.Debugf("Retrieving latest sync response with size %d bytes", proto.Size(e.latestSyncResponse))
+	sr, ok := proto.Clone(e.latestSyncResponse).(*mgmProto.SyncResponse)
 	if !ok {
 		return nil, fmt.Errorf("failed to clone sync response")
 	}

client/internal/engine_ssh.go

@@ -11,18 +11,15 @@ import (
 
 	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
-	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
 	sshserver "github.com/netbirdio/netbird/client/ssh/server"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 
 type sshServer interface {
 	Start(ctx context.Context, addr netip.AddrPort) error
 	Stop() error
 	GetStatus() (bool, []sshserver.SessionInfo)
-	UpdateSSHAuth(config *sshauth.Config)
 }
 
 func (e *Engine) setupSSHPortRedirection() error {
@@ -72,16 +69,9 @@ func (e *Engine) updateSSH(sshConf *mgmProto.SSHConfig) error {
 	}
 
 	if protoJWT := sshConf.GetJwtConfig(); protoJWT != nil {
-		audiences := protoJWT.GetAudiences()
-		if len(audiences) == 0 && protoJWT.GetAudience() != "" {
-			audiences = []string{protoJWT.GetAudience()}
-		}
-
-		log.Debugf("starting SSH server with JWT authentication: audiences=%v", audiences)
-
 		jwtConfig := &sshserver.JWTConfig{
 			Issuer:       protoJWT.GetIssuer(),
-			Audiences:    audiences,
+			Audience:     protoJWT.GetAudience(),
 			KeysLocation: protoJWT.GetKeysLocation(),
 			MaxTokenAge:  protoJWT.GetMaxTokenAge(),
 		}
@@ -363,38 +353,3 @@ func (e *Engine) GetSSHServerStatus() (enabled bool, sessions []sshserver.Sessio
 
 	return sshServer.GetStatus()
 }
-
-// updateSSHServerAuth updates SSH fine-grained access control configuration on a running SSH server
-func (e *Engine) updateSSHServerAuth(sshAuth *mgmProto.SSHAuth) {
-	if sshAuth == nil {
-		return
-	}
-
-	if e.sshServer == nil {
-		return
-	}
-
-	protoUsers := sshAuth.GetAuthorizedUsers()
-	authorizedUsers := make([]sshuserhash.UserIDHash, len(protoUsers))
-	for i, hash := range protoUsers {
-		if len(hash) != 16 {
-			log.Warnf("invalid hash length %d, expected 16 - skipping SSH server auth update", len(hash))
-			return
-		}
-		authorizedUsers[i] = sshuserhash.UserIDHash(hash)
-	}
-
-	machineUsers := make(map[string][]uint32)
-	for osUser, indexes := range sshAuth.GetMachineUsers() {
-		machineUsers[osUser] = indexes.GetIndexes()
-	}
-
-	// Update SSH server with new authorization configuration
-	authConfig := &sshauth.Config{
-		UserIDClaim:     sshAuth.GetUserIDClaim(),
-		AuthorizedUsers: authorizedUsers,
-		MachineUsers:    machineUsers,
-	}
-
-	e.sshServer.UpdateSSHAuth(authConfig)
-}

client/internal/engine_sync_test.go

@@ -0,0 +1,79 @@
+package internal
+
+import (
+    "context"
+    "testing"
+
+    "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+    "github.com/netbirdio/netbird/client/iface"
+    "github.com/netbirdio/netbird/client/internal/peer"
+    "github.com/netbirdio/netbird/shared/management/client"
+    mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Ensures handleSync exits early when SkipNetworkMapUpdate is true
+func TestEngine_HandleSync_SkipNetworkMapUpdate(t *testing.T) {
+    key, err := wgtypes.GeneratePrivateKey()
+    if err != nil {
+        t.Fatal(err)
+    }
+
+    ctx, cancel := context.WithCancel(context.Background())
+    defer cancel()
+
+    engine := NewEngine(ctx, cancel, nil, &client.MockClient{}, nil, &EngineConfig{
+        WgIfaceName:  "utun199",
+        WgAddr:       "100.70.0.1/24",
+        WgPrivateKey: key,
+        WgPort:       33100,
+        MTU:          iface.DefaultMTU,
+    }, MobileDependency{}, peer.NewRecorder("https://mgm"), nil)
+    engine.ctx = ctx
+
+    // Precondition
+    if engine.networkSerial != 0 {
+        t.Fatalf("unexpected initial serial: %d", engine.networkSerial)
+    }
+
+    resp := &mgmtProto.SyncResponse{
+        NetworkMap: &mgmtProto.NetworkMap{Serial: 42},
+        SkipNetworkMapUpdate: true,
+    }
+
+    if err := engine.handleSync(resp); err != nil {
+        t.Fatalf("handleSync returned error: %v", err)
+    }
+
+    if engine.networkSerial != 0 {
+        t.Fatalf("networkSerial changed despite SkipNetworkMapUpdate; got %d, want 0", engine.networkSerial)
+    }
+}
+
+// Ensures handleSync exits early when NetworkMap is nil
+func TestEngine_HandleSync_NilNetworkMap(t *testing.T) {
+    key, err := wgtypes.GeneratePrivateKey()
+    if err != nil {
+        t.Fatal(err)
+    }
+
+    ctx, cancel := context.WithCancel(context.Background())
+    defer cancel()
+
+    engine := NewEngine(ctx, cancel, nil, &client.MockClient{}, nil, &EngineConfig{
+        WgIfaceName:  "utun198",
+        WgAddr:       "100.70.0.2/24",
+        WgPrivateKey: key,
+        WgPort:       33101,
+        MTU:          iface.DefaultMTU,
+    }, MobileDependency{}, peer.NewRecorder("https://mgm"), nil)
+    engine.ctx = ctx
+
+    resp := &mgmtProto.SyncResponse{NetworkMap: nil}
+
+    if err := engine.handleSync(resp); err != nil {
+        t.Fatalf("handleSync returned error: %v", err)
+    }
+}
+
+

client/internal/engine_test.go

@@ -25,7 +25,6 @@ import (
 	"google.golang.org/grpc/keepalive"
 
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/management/server/job"
 
 	"github.com/netbirdio/management-integrations/integrations"
 
@@ -214,10 +213,6 @@ func (m *MockWGIface) LastActivities() map[string]monotime.Time {
 	return nil
 }
 
-func (m *MockWGIface) SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error {
-	return nil
-}
-
 func TestMain(m *testing.M) {
 	_ = util.InitLog("debug", util.LogConsole)
 	code := m.Run()
@@ -258,7 +253,6 @@ func TestEngine_SSH(t *testing.T) {
 		MobileDependency{},
 		peer.NewRecorder("https://mgm"),
 		nil,
-		nil,
 	)
 
 	engine.dnsServer = &dns.MockServer{
@@ -420,13 +414,21 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	defer cancel()
 
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
-	engine := NewEngine(ctx, cancel, &signal.MockClient{}, &mgmt.MockClient{}, relayMgr, &EngineConfig{
-		WgIfaceName:  "utun102",
-		WgAddr:       "100.64.0.1/24",
-		WgPrivateKey: key,
-		WgPort:       33100,
-		MTU:          iface.DefaultMTU,
-	}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil, nil)
+	engine := NewEngine(
+		ctx, cancel,
+		&signal.MockClient{},
+		&mgmt.MockClient{},
+		relayMgr,
+		&EngineConfig{
+			WgIfaceName:  "utun102",
+			WgAddr:       "100.64.0.1/24",
+			WgPrivateKey: key,
+			WgPort:       33100,
+			MTU:          iface.DefaultMTU,
+		},
+		MobileDependency{},
+		peer.NewRecorder("https://mgm"),
+		nil)
 
 	wgIface := &MockWGIface{
 		NameFunc: func() string { return "utun102" },
@@ -629,7 +631,7 @@ func TestEngine_Sync(t *testing.T) {
 	// feed updates to Engine via mocked Management client
 	updates := make(chan *mgmtProto.SyncResponse)
 	defer close(updates)
-	syncFunc := func(ctx context.Context, info *system.Info, msgHandler func(msg *mgmtProto.SyncResponse) error) error {
+	syncFunc := func(ctx context.Context, info *system.Info, networkSerial uint64, msgHandler func(msg *mgmtProto.SyncResponse) error) error {
 		for msg := range updates {
 			err := msgHandler(msg)
 			if err != nil {
@@ -645,7 +647,7 @@ func TestEngine_Sync(t *testing.T) {
 		WgPrivateKey: key,
 		WgPort:       33100,
 		MTU:          iface.DefaultMTU,
-	}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil, nil)
+	}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil)
 	engine.ctx = ctx
 
 	engine.dnsServer = &dns.MockServer{
@@ -810,7 +812,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 				WgPrivateKey: key,
 				WgPort:       33100,
 				MTU:          iface.DefaultMTU,
-			}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil, nil)
+			}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil)
 			engine.ctx = ctx
 			newNet, err := stdnet.NewNet(context.Background(), nil)
 			if err != nil {
@@ -1012,7 +1014,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 				WgPrivateKey: key,
 				WgPort:       33100,
 				MTU:          iface.DefaultMTU,
-			}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil, nil)
+			}, MobileDependency{}, peer.NewRecorder("https://mgm"), nil)
 			engine.ctx = ctx
 
 			newNet, err := stdnet.NewNet(context.Background(), nil)
@@ -1538,7 +1540,7 @@ func createEngine(ctx context.Context, cancel context.CancelFunc, setupKey strin
 	}
 
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
-	e, err := NewEngine(ctx, cancel, signalClient, mgmtClient, relayMgr, conf, MobileDependency{}, peer.NewRecorder("https://mgm"), nil, nil), nil
+	e, err := NewEngine(ctx, cancel, signalClient, mgmtClient, relayMgr, conf, MobileDependency{}, peer.NewRecorder("https://mgm"), nil), nil
 	e.ctx = ctx
 	return e, err
 }
@@ -1604,7 +1606,6 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
-	jobManager := job.NewJobManager(nil, store, peersManager)
 
 	ia, _ := integrations.NewIntegratedValidator(context.Background(), peersManager, nil, eventStore)
 
@@ -1628,7 +1629,7 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false)
 	if err != nil {
 		return nil, "", err
 	}
@@ -1637,7 +1638,7 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 	if err != nil {
 		return nil, "", err
 	}
-	mgmtServer, err := nbgrpc.NewServer(config, accountManager, settingsMockManager, jobManager, secretsManager, nil, nil, &server.MockIntegratedValidator{}, networkMapController, nil)
+	mgmtServer, err := nbgrpc.NewServer(config, accountManager, settingsMockManager, secretsManager, nil, nil, &server.MockIntegratedValidator{}, networkMapController)
 	if err != nil {
 		return nil, "", err
 	}

client/internal/iface.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package internal
 

client/internal/iface_common.go

@@ -42,5 +42,4 @@ type wgIfaceBase interface {
 	GetNet() *netstack.Net
 	FullStats() (*configurer.Stats, error)
 	LastActivities() map[string]monotime.Time
-	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
 }

client/internal/networkmonitor/check_change_darwin.go

@@ -110,6 +110,7 @@ func wakeUpListen(ctx context.Context) {
 			}
 
 			if newHash == initialHash {
+				log.Tracef("no wakeup detected")
 				continue
 			}
 

client/internal/peer/conn.go

@@ -88,9 +88,8 @@ type Conn struct {
 	relayManager   *relayClient.Manager
 	srWatcher      *guard.SRWatcher
 
-	onConnected                               func(remoteWireGuardKey string, remoteRosenpassPubKey []byte, wireGuardIP string, remoteRosenpassAddr string)
-	onDisconnected                            func(remotePeer string)
-	rosenpassInitializedPresharedKeyValidator func(peerKey string) bool
+	onConnected    func(remoteWireGuardKey string, remoteRosenpassPubKey []byte, wireGuardIP string, remoteRosenpassAddr string)
+	onDisconnected func(remotePeer string)
 
 	statusRelay         *worker.AtomicWorkerStatus
 	statusICE           *worker.AtomicWorkerStatus
@@ -99,10 +98,7 @@ type Conn struct {
 
 	workerICE   *WorkerICE
 	workerRelay *WorkerRelay
-
-	wgWatcher       *WGWatcher
-	wgWatcherWg     sync.WaitGroup
-	wgWatcherCancel context.CancelFunc
+	wgWatcherWg sync.WaitGroup
 
 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
@@ -130,7 +126,6 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 
 	connLog := log.WithField("peer", config.Key)
 
-	dumpState := newStateDump(config.Key, connLog, services.StatusRecorder)
 	var conn = &Conn{
 		Log:             connLog,
 		config:          config,
@@ -142,9 +137,8 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		semaphore:       services.Semaphore,
 		statusRelay:     worker.NewAtomicStatus(),
 		statusICE:       worker.NewAtomicStatus(),
-		dumpState:       dumpState,
+		dumpState:       newStateDump(config.Key, connLog, services.StatusRecorder),
 		endpointUpdater: NewEndpointUpdater(connLog, config.WgConfig, isController(config)),
-		wgWatcher:       NewWGWatcher(connLog, config.WgConfig.WgInterface, config.Key, dumpState),
 	}
 
 	return conn, nil
@@ -154,26 +148,23 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 // It will try to establish a connection using ICE and in parallel with relay. The higher priority connection type will
 // be used.
 func (conn *Conn) Open(engineCtx context.Context) error {
-	if err := conn.semaphore.Add(engineCtx); err != nil {
-		return err
-	}
+	conn.semaphore.Add(engineCtx)
 
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
 	if conn.opened {
-		conn.semaphore.Done()
+		conn.semaphore.Done(engineCtx)
 		return nil
 	}
 
 	conn.ctx, conn.ctxCancel = context.WithCancel(engineCtx)
 
-	conn.workerRelay = NewWorkerRelay(conn.ctx, conn.Log, isController(conn.config), conn.config, conn, conn.relayManager)
+	conn.workerRelay = NewWorkerRelay(conn.ctx, conn.Log, isController(conn.config), conn.config, conn, conn.relayManager, conn.dumpState)
 
 	relayIsSupportedLocally := conn.workerRelay.RelayIsSupportedLocally()
 	workerICE, err := NewWorkerICE(conn.ctx, conn.Log, conn.config, conn, conn.signaler, conn.iFaceDiscover, conn.statusRecorder, relayIsSupportedLocally)
 	if err != nil {
-		conn.semaphore.Done()
 		return err
 	}
 	conn.workerICE = workerICE
@@ -209,7 +200,7 @@ func (conn *Conn) Open(engineCtx context.Context) error {
 		defer conn.wg.Done()
 
 		conn.waitInitialRandomSleepTime(conn.ctx)
-		conn.semaphore.Done()
+		conn.semaphore.Done(conn.ctx)
 
 		conn.guard.Start(conn.ctx, conn.onGuardEvent)
 	}()
@@ -237,9 +228,7 @@ func (conn *Conn) Close(signalToRemote bool) {
 	conn.Log.Infof("close peer connection")
 	conn.ctxCancel()
 
-	if conn.wgWatcherCancel != nil {
-		conn.wgWatcherCancel()
-	}
+	conn.workerRelay.DisableWgWatcher()
 	conn.workerRelay.CloseConn()
 	conn.workerICE.Close()
 
@@ -297,13 +286,6 @@ func (conn *Conn) SetOnDisconnected(handler func(remotePeer string)) {
 	conn.onDisconnected = handler
 }
 
-// SetRosenpassInitializedPresharedKeyValidator sets a function to check if Rosenpass has taken over
-// PSK management for a peer. When this returns true, presharedKey() returns nil
-// to prevent UpdatePeer from overwriting the Rosenpass-managed PSK.
-func (conn *Conn) SetRosenpassInitializedPresharedKeyValidator(handler func(peerKey string) bool) {
-	conn.rosenpassInitializedPresharedKeyValidator = handler
-}
-
 func (conn *Conn) OnRemoteOffer(offer OfferAnswer) {
 	conn.dumpState.RemoteOffer()
 	conn.Log.Infof("OnRemoteOffer, on status ICE: %s, status Relay: %s", conn.statusICE, conn.statusRelay)
@@ -381,6 +363,9 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		ep = directEp
 	}
 
+	conn.workerRelay.DisableWgWatcher()
+	// todo consider to run conn.wgWatcherWg.Wait() here
+
 	if conn.wgProxyRelay != nil {
 		conn.wgProxyRelay.Pause()
 	}
@@ -402,8 +387,6 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		conn.wgProxyRelay.RedirectAs(ep)
 	}
 
-	conn.enableWgWatcherIfNeeded()
-
 	conn.currentConnPriority = priority
 	conn.statusICE.SetConnected()
 	conn.updateIceState(iceConnInfo)
@@ -437,6 +420,11 @@ func (conn *Conn) onICEStateDisconnected() {
 			conn.Log.Errorf("failed to switch to relay conn: %v", err)
 		}
 
+		conn.wgWatcherWg.Add(1)
+		go func() {
+			defer conn.wgWatcherWg.Done()
+			conn.workerRelay.EnableWgWatcher(conn.ctx)
+		}()
 		conn.wgProxyRelay.Work()
 		conn.currentConnPriority = conntype.Relay
 	} else {
@@ -453,15 +441,15 @@ func (conn *Conn) onICEStateDisconnected() {
 	}
 	conn.statusICE.SetDisconnected()
 
-	conn.disableWgWatcherIfNeeded()
-
 	peerState := State{
 		PubKey:           conn.config.Key,
 		ConnStatus:       conn.evalStatus(),
 		Relayed:          conn.isRelayed(),
 		ConnStatusUpdate: time.Now(),
 	}
-	if err := conn.statusRecorder.UpdatePeerICEStateToDisconnected(peerState); err != nil {
+
+	err := conn.statusRecorder.UpdatePeerICEStateToDisconnected(peerState)
+	if err != nil {
 		conn.Log.Warnf("unable to set peer's state to disconnected ice, got error: %v", err)
 	}
 }
@@ -509,7 +497,11 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 		return
 	}
 
-	conn.enableWgWatcherIfNeeded()
+	conn.wgWatcherWg.Add(1)
+	go func() {
+		defer conn.wgWatcherWg.Done()
+		conn.workerRelay.EnableWgWatcher(conn.ctx)
+	}()
 
 	wgConfigWorkaround()
 	conn.rosenpassRemoteKey = rci.rosenpassPubKey
@@ -524,11 +516,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 func (conn *Conn) onRelayDisconnected() {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
-	conn.handleRelayDisconnectedLocked()
-}
 
-// handleRelayDisconnectedLocked handles relay disconnection. Caller must hold conn.mu.
-func (conn *Conn) handleRelayDisconnectedLocked() {
 	if conn.ctx.Err() != nil {
 		return
 	}
@@ -554,8 +542,6 @@ func (conn *Conn) handleRelayDisconnectedLocked() {
 	}
 	conn.statusRelay.SetDisconnected()
 
-	conn.disableWgWatcherIfNeeded()
-
 	peerState := State{
 		PubKey:           conn.config.Key,
 		ConnStatus:       conn.evalStatus(),
@@ -574,28 +560,6 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
-func (conn *Conn) onWGDisconnected() {
-	conn.mu.Lock()
-	defer conn.mu.Unlock()
-
-	if conn.ctx.Err() != nil {
-		return
-	}
-
-	conn.Log.Warnf("WireGuard handshake timeout detected, closing current connection")
-
-	// Close the active connection based on current priority
-	switch conn.currentConnPriority {
-	case conntype.Relay:
-		conn.workerRelay.CloseConn()
-		conn.handleRelayDisconnectedLocked()
-	case conntype.ICEP2P, conntype.ICETurn:
-		conn.workerICE.Close()
-	default:
-		conn.Log.Debugf("No active connection to close on WG timeout")
-	}
-}
-
 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte) {
 	peerState := State{
 		PubKey:             conn.config.Key,
@@ -702,17 +666,10 @@ func (conn *Conn) isConnectedOnAllWay() (connected bool) {
 		}
 	}()
 
-	// For JS platform: only relay connection is supported
-	if runtime.GOOS == "js" {
-		return conn.statusRelay.Get() == worker.StatusConnected
-	}
-
-	// For non-JS platforms: check ICE connection status
-	if conn.statusICE.Get() == worker.StatusDisconnected && !conn.workerICE.InProgress() {
+	if runtime.GOOS != "js" && conn.statusICE.Get() == worker.StatusDisconnected && !conn.workerICE.InProgress() {
 		return false
 	}
 
-	// If relay is supported with peer, it must also be connected
 	if conn.workerRelay.IsRelayConnectionSupportedWithPeer() {
 		if conn.statusRelay.Get() == worker.StatusDisconnected {
 			return false
@@ -722,25 +679,6 @@ func (conn *Conn) isConnectedOnAllWay() (connected bool) {
 	return true
 }
 
-func (conn *Conn) enableWgWatcherIfNeeded() {
-	if !conn.wgWatcher.IsEnabled() {
-		wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
-		conn.wgWatcherCancel = wgWatcherCancel
-		conn.wgWatcherWg.Add(1)
-		go func() {
-			defer conn.wgWatcherWg.Done()
-			conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, conn.onWGDisconnected)
-		}()
-	}
-}
-
-func (conn *Conn) disableWgWatcherIfNeeded() {
-	if conn.currentConnPriority == conntype.None && conn.wgWatcherCancel != nil {
-		conn.wgWatcherCancel()
-		conn.wgWatcherCancel = nil
-	}
-}
-
 func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
 	conn.Log.Debugf("setup proxied WireGuard connection")
 	udpAddr := &net.UDPAddr{
@@ -811,24 +749,10 @@ func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
 		return conn.config.WgConfig.PreSharedKey
 	}
 
-	// If Rosenpass has already set a PSK for this peer, return nil to prevent
-	// UpdatePeer from overwriting the Rosenpass-managed key.
-	if conn.rosenpassInitializedPresharedKeyValidator != nil && conn.rosenpassInitializedPresharedKeyValidator(conn.config.Key) {
-		return nil
-	}
-
-	// Use NetBird PSK as the seed for Rosenpass. This same PSK is passed to
-	// Rosenpass as PeerConfig.PresharedKey, ensuring the derived post-quantum
-	// key is cryptographically bound to the original secret.
-	if conn.config.WgConfig.PreSharedKey != nil {
-		return conn.config.WgConfig.PreSharedKey
-	}
-
-	// Fallback to deterministic key if no NetBird PSK is configured
 	determKey, err := conn.rosenpassDetermKey()
 	if err != nil {
 		conn.Log.Errorf("failed to generate Rosenpass initial key: %v", err)
-		return nil
+		return conn.config.WgConfig.PreSharedKey
 	}
 
 	return determKey

client/internal/peer/conn_test.go

@@ -284,27 +284,3 @@ func TestConn_presharedKey(t *testing.T) {
 		})
 	}
 }
-
-func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
-	conn := Conn{
-		config: ConnConfig{
-			Key:             "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-			LocalKey:        "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-			RosenpassConfig: RosenpassConfig{PubKey: []byte("dummykey")},
-		},
-	}
-
-	// When Rosenpass has already initialized the PSK for this peer,
-	// presharedKey must return nil to avoid UpdatePeer overwriting it.
-	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return true }
-	if k := conn.presharedKey([]byte("remote")); k != nil {
-		t.Fatalf("expected nil presharedKey when Rosenpass manages PSK, got %v", k)
-	}
-
-	// When Rosenpass hasn't taken over yet, presharedKey should provide
-	// a non-nil initial key (deterministic or from NetBird PSK).
-	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return false }
-	if k := conn.presharedKey([]byte("remote")); k == nil {
-		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
-	}
-}

client/internal/peer/endpoint.go

@@ -20,7 +20,7 @@ type EndpointUpdater struct {
 	wgConfig  WgConfig
 	initiator bool
 
-	// mu protects cancelFunc
+	// mu protects updateWireGuardPeer and cancelFunc
 	mu         sync.Mutex
 	cancelFunc func()
 	updateWg   sync.WaitGroup
@@ -86,9 +86,11 @@ func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.U
 	case <-ctx.Done():
 		return
 	case <-t.C:
+		e.mu.Lock()
 		if err := e.updateWireGuardPeer(addr, presharedKey); err != nil {
 			e.log.Errorf("failed to update WireGuard peer, address: %s, error: %v", addr, err)
 		}
+		e.mu.Unlock()
 	}
 }
 

client/internal/peer/status.go

@@ -14,7 +14,6 @@ import (
 	"golang.org/x/exp/maps"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
@@ -159,7 +158,6 @@ type FullStatus struct {
 	NSGroupStates         []NSGroupState
 	NumOfForwardingRules  int
 	LazyConnectionEnabled bool
-	Events                []*proto.SystemEvent
 }
 
 type StatusChangeSubscription struct {
@@ -983,7 +981,6 @@ func (d *Status) GetFullStatus() FullStatus {
 	}
 
 	fullStatus.Peers = append(fullStatus.Peers, d.offlinePeers...)
-	fullStatus.Events = d.GetEventHistory()
 	return fullStatus
 }
 
@@ -1184,97 +1181,3 @@ type EventSubscription struct {
 func (s *EventSubscription) Events() <-chan *proto.SystemEvent {
 	return s.events
 }
-
-// ToProto converts FullStatus to proto.FullStatus.
-func (fs FullStatus) ToProto() *proto.FullStatus {
-	pbFullStatus := proto.FullStatus{
-		ManagementState: &proto.ManagementState{},
-		SignalState:     &proto.SignalState{},
-		LocalPeerState:  &proto.LocalPeerState{},
-		Peers:           []*proto.PeerState{},
-	}
-
-	pbFullStatus.ManagementState.URL = fs.ManagementState.URL
-	pbFullStatus.ManagementState.Connected = fs.ManagementState.Connected
-	if err := fs.ManagementState.Error; err != nil {
-		pbFullStatus.ManagementState.Error = err.Error()
-	}
-
-	pbFullStatus.SignalState.URL = fs.SignalState.URL
-	pbFullStatus.SignalState.Connected = fs.SignalState.Connected
-	if err := fs.SignalState.Error; err != nil {
-		pbFullStatus.SignalState.Error = err.Error()
-	}
-
-	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
-	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
-	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
-	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
-	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
-	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
-
-	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
-
-	for _, peerState := range fs.Peers {
-		networks := maps.Keys(peerState.GetRoutes())
-
-		pbPeerState := &proto.PeerState{
-			IP:                         peerState.IP,
-			PubKey:                     peerState.PubKey,
-			ConnStatus:                 peerState.ConnStatus.String(),
-			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
-			Relayed:                    peerState.Relayed,
-			LocalIceCandidateType:      peerState.LocalIceCandidateType,
-			RemoteIceCandidateType:     peerState.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  peerState.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: peerState.RemoteIceCandidateEndpoint,
-			RelayAddress:               peerState.RelayServerAddress,
-			Fqdn:                       peerState.FQDN,
-			LastWireguardHandshake:     timestamppb.New(peerState.LastWireguardHandshake),
-			BytesRx:                    peerState.BytesRx,
-			BytesTx:                    peerState.BytesTx,
-			RosenpassEnabled:           peerState.RosenpassEnabled,
-			Networks:                   networks,
-			Latency:                    durationpb.New(peerState.Latency),
-			SshHostKey:                 peerState.SSHHostKey,
-		}
-		pbFullStatus.Peers = append(pbFullStatus.Peers, pbPeerState)
-	}
-
-	for _, relayState := range fs.Relays {
-		pbRelayState := &proto.RelayState{
-			URI:       relayState.URI,
-			Available: relayState.Err == nil,
-		}
-		if err := relayState.Err; err != nil {
-			pbRelayState.Error = err.Error()
-		}
-		pbFullStatus.Relays = append(pbFullStatus.Relays, pbRelayState)
-	}
-
-	for _, dnsState := range fs.NSGroupStates {
-		var err string
-		if dnsState.Error != nil {
-			err = dnsState.Error.Error()
-		}
-
-		var servers []string
-		for _, server := range dnsState.Servers {
-			servers = append(servers, server.String())
-		}
-
-		pbDnsState := &proto.NSGroupState{
-			Servers: servers,
-			Domains: dnsState.Domains,
-			Enabled: dnsState.Enabled,
-			Error:   err,
-		}
-		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
-	}
-
-	pbFullStatus.Events = fs.Events
-
-	return &pbFullStatus
-}

client/internal/peer/wg_watcher.go

@@ -30,8 +30,10 @@ type WGWatcher struct {
 	peerKey       string
 	stateDump     *stateDump
 
-	enabled   bool
-	muEnabled sync.RWMutex
+	ctx         context.Context
+	ctxCancel   context.CancelFunc
+	ctxLock     sync.Mutex
+	enabledTime time.Time
 }
 
 func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *stateDump) *WGWatcher {
@@ -44,44 +46,52 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 }
 
 // EnableWgWatcher starts the WireGuard watcher. If it is already enabled, it will return immediately and do nothing.
-// The watcher runs until ctx is cancelled. Caller is responsible for context lifecycle management.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, onDisconnectedFn func()) {
-	w.muEnabled.Lock()
-	if w.enabled {
-		w.muEnabled.Unlock()
+func (w *WGWatcher) EnableWgWatcher(parentCtx context.Context, onDisconnectedFn func()) {
+	w.log.Debugf("enable WireGuard watcher")
+	w.ctxLock.Lock()
+	w.enabledTime = time.Now()
+
+	if w.ctx != nil && w.ctx.Err() == nil {
+		w.log.Errorf("WireGuard watcher already enabled")
+		w.ctxLock.Unlock()
 		return
 	}
 
-	w.log.Debugf("enable WireGuard watcher")
-	enabledTime := time.Now()
-	w.enabled = true
-	w.muEnabled.Unlock()
+	ctx, ctxCancel := context.WithCancel(parentCtx)
+	w.ctx = ctx
+	w.ctxCancel = ctxCancel
+	w.ctxLock.Unlock()
 
 	initialHandshake, err := w.wgState()
 	if err != nil {
 		w.log.Warnf("failed to read initial wg stats: %v", err)
 	}
 
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, enabledTime, initialHandshake)
-
-	w.muEnabled.Lock()
-	w.enabled = false
-	w.muEnabled.Unlock()
+	w.periodicHandshakeCheck(ctx, ctxCancel, onDisconnectedFn, initialHandshake)
 }
 
-// IsEnabled returns true if the WireGuard watcher is currently enabled
-func (w *WGWatcher) IsEnabled() bool {
-	w.muEnabled.RLock()
-	defer w.muEnabled.RUnlock()
-	return w.enabled
+// DisableWgWatcher stops the WireGuard watcher and wait for the watcher to exit
+func (w *WGWatcher) DisableWgWatcher() {
+	w.ctxLock.Lock()
+	defer w.ctxLock.Unlock()
+
+	if w.ctxCancel == nil {
+		return
+	}
+
+	w.log.Debugf("disable WireGuard watcher")
+
+	w.ctxCancel()
+	w.ctxCancel = nil
 }
 
 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, ctxCancel context.CancelFunc, onDisconnectedFn func(), initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")
 
 	timer := time.NewTimer(wgHandshakeOvertime)
 	defer timer.Stop()
+	defer ctxCancel()
 
 	lastHandshake := initialHandshake
 
@@ -94,7 +104,7 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				return
 			}
 			if lastHandshake.IsZero() {
-				elapsed := calcElapsed(enabledTime, *handshake)
+				elapsed := handshake.Sub(w.enabledTime).Seconds()
 				w.log.Infof("first wg handshake detected within: %.2fsec, (%s)", elapsed, handshake)
 			}
 
@@ -124,19 +134,19 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {
 
 	// the current know handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
+		w.log.Warnf("WireGuard handshake timed out, closing relay connection: %v", handshake)
 		return nil, false
 	}
 
 	// in case if the machine is suspended, the handshake time will be in the past
 	if handshake.Add(checkPeriod).Before(time.Now()) {
-		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
+		w.log.Warnf("WireGuard handshake timed out, closing relay connection: %v", handshake)
 		return nil, false
 	}
 
 	// error handling for handshake time in the future
 	if handshake.After(time.Now()) {
-		w.log.Warnf("WireGuard handshake is in the future: %v", handshake)
+		w.log.Warnf("WireGuard handshake is in the future, closing relay connection: %v", handshake)
 		return nil, false
 	}
 
@@ -154,13 +164,3 @@ func (w *WGWatcher) wgState() (time.Time, error) {
 	}
 	return wgState.LastHandshake, nil
 }
-
-// calcElapsed calculates elapsed time since watcher was enabled.
-// The watcher started after the wg configuration happens, because of this need to normalise the negative value
-func calcElapsed(enabledTime, handshake time.Time) float64 {
-	elapsed := handshake.Sub(enabledTime).Seconds()
-	if elapsed < 0 {
-		elapsed = 0
-	}
-	return elapsed
-}

client/internal/peer/wg_watcher_test.go

@@ -2,7 +2,6 @@ package peer
 
 import (
 	"context"
-	"sync"
 	"testing"
 	"time"
 
@@ -49,6 +48,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		t.Errorf("timeout")
 	}
+	watcher.DisableWgWatcher()
 }
 
 func TestWGWatcher_ReEnable(t *testing.T) {
@@ -60,21 +60,14 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
-	wg := &sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, func() {})
-	}()
-	cancel()
-
-	wg.Wait()
-
-	// Re-enable with a new context
-	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
 	onDisconnected := make(chan struct{}, 1)
+
+	go watcher.EnableWgWatcher(ctx, func() {})
+	time.Sleep(1 * time.Second)
+	watcher.DisableWgWatcher()
+
 	go watcher.EnableWgWatcher(ctx, func() {
 		onDisconnected <- struct{}{}
 	})
@@ -87,4 +80,5 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		t.Errorf("timeout")
 	}
+	watcher.DisableWgWatcher()
 }

client/internal/peer/worker_ice.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"strconv"
 	"sync"
 	"time"
 
@@ -287,8 +286,8 @@ func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent
 		RosenpassAddr:              remoteOfferAnswer.RosenpassAddr,
 		LocalIceCandidateType:      pair.Local.Type().String(),
 		RemoteIceCandidateType:     pair.Remote.Type().String(),
-		LocalIceCandidateEndpoint:  net.JoinHostPort(pair.Local.Address(), strconv.Itoa(pair.Local.Port())),
-		RemoteIceCandidateEndpoint: net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(pair.Remote.Port())),
+		LocalIceCandidateEndpoint:  fmt.Sprintf("%s:%d", pair.Local.Address(), pair.Local.Port()),
+		RemoteIceCandidateEndpoint: fmt.Sprintf("%s:%d", pair.Remote.Address(), pair.Remote.Port()),
 		Relayed:                    isRelayed(pair),
 		RelayedOnLocal:             isRelayCandidate(pair.Local),
 	}
@@ -329,7 +328,13 @@ func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.C
 func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
-	addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(remoteWgPort)))
+	addrString := pair.Remote.Address()
+	parsed, err := netip.ParseAddr(addrString)
+	if (err == nil) && (parsed.Is6()) {
+		addrString = fmt.Sprintf("[%s]", addrString)
+		//IPv6 Literals need to be wrapped in brackets for Resolve*Addr()
+	}
+	addr, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", addrString, remoteWgPort))
 	if err != nil {
 		w.log.Warnf("got an error while resolving the udp address, err: %s", err)
 		return
@@ -381,44 +386,12 @@ func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent,
 	}
 }
 
-func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
-	sessionID := w.SessionID()
-	stats := agent.GetCandidatePairsStats()
-	localCandidates, _ := agent.GetLocalCandidates()
-	remoteCandidates, _ := agent.GetRemoteCandidates()
-
-	localMap := make(map[string]ice.Candidate)
-	for _, c := range localCandidates {
-		localMap[c.ID()] = c
-	}
-	remoteMap := make(map[string]ice.Candidate)
-	for _, c := range remoteCandidates {
-		remoteMap[c.ID()] = c
-	}
-
-	for _, stat := range stats {
-		if stat.State == ice.CandidatePairStateSucceeded {
-			local, lok := localMap[stat.LocalCandidateID]
-			remote, rok := remoteMap[stat.RemoteCandidateID]
-			if !lok || !rok {
-				continue
-			}
-			w.log.Debugf("successful ICE path %s: [%s %s %s] <-> [%s %s %s] rtt=%.3fms",
-				sessionID,
-				local.NetworkType(), local.Type(), local.Address(),
-				remote.NetworkType(), remote.Type(), remote.Address(),
-				stat.CurrentRoundTripTime*1000)
-		}
-	}
-}
-
 func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
 	return func(state ice.ConnectionState) {
 		w.log.Debugf("ICE ConnectionState has changed to %s", state.String())
 		switch state {
 		case ice.ConnectionStateConnected:
 			w.lastKnownState = ice.ConnectionStateConnected
-			w.logSuccessfulPaths(agent)
 			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
 			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to

client/internal/peer/worker_relay.go

@@ -30,9 +30,11 @@ type WorkerRelay struct {
 	relayLock   sync.Mutex
 
 	relaySupportedOnRemotePeer atomic.Bool
+
+	wgWatcher *WGWatcher
 }
 
-func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager) *WorkerRelay {
+func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager, stateDump *stateDump) *WorkerRelay {
 	r := &WorkerRelay{
 		peerCtx:      ctx,
 		log:          log,
@@ -40,6 +42,7 @@ func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnC
 		config:       config,
 		conn:         conn,
 		relayManager: relayManager,
+		wgWatcher:    NewWGWatcher(log, config.WgConfig.WgInterface, config.Key, stateDump),
 	}
 	return r
 }
@@ -90,6 +93,14 @@ func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	})
 }
 
+func (w *WorkerRelay) EnableWgWatcher(ctx context.Context) {
+	w.wgWatcher.EnableWgWatcher(ctx, w.onWGDisconnected)
+}
+
+func (w *WorkerRelay) DisableWgWatcher() {
+	w.wgWatcher.DisableWgWatcher()
+}
+
 func (w *WorkerRelay) RelayInstanceAddress() (string, error) {
 	return w.relayManager.RelayInstanceAddress()
 }
@@ -114,6 +125,14 @@ func (w *WorkerRelay) CloseConn() {
 	}
 }
 
+func (w *WorkerRelay) onWGDisconnected() {
+	w.relayLock.Lock()
+	_ = w.relayedConn.Close()
+	w.relayLock.Unlock()
+
+	w.conn.onRelayDisconnected()
+}
+
 func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	if !w.relayManager.HasRelayAddress() {
 		return false
@@ -129,5 +148,6 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 }
 
 func (w *WorkerRelay) onRelayClientDisconnected() {
+	w.wgWatcher.DisableWgWatcher()
 	go w.conn.onRelayDisconnected()
 }

client/internal/profilemanager/config.go

@@ -3,11 +3,9 @@ package profilemanager
 import (
 	"context"
 	"crypto/tls"
-	"encoding/json"
 	"fmt"
 	"net/url"
 	"os"
-	"os/user"
 	"path/filepath"
 	"reflect"
 	"runtime"
@@ -167,26 +165,19 @@ func getConfigDir() (string, error) {
 	if ConfigDirOverride != "" {
 		return ConfigDirOverride, nil
 	}
-
-	base, err := baseConfigDir()
+	configDir, err := os.UserConfigDir()
 	if err != nil {
 		return "", err
 	}
 
-	configDir := filepath.Join(base, "netbird")
-	if err := os.MkdirAll(configDir, 0o755); err != nil {
-		return "", err
-	}
-	return configDir, nil
-}
-
-func baseConfigDir() (string, error) {
-	if runtime.GOOS == "darwin" {
-		if u, err := user.Current(); err == nil && u.HomeDir != "" {
-			return filepath.Join(u.HomeDir, "Library", "Application Support"), nil
+	configDir = filepath.Join(configDir, "netbird")
+	if _, err := os.Stat(configDir); os.IsNotExist(err) {
+		if err := os.MkdirAll(configDir, 0755); err != nil {
+			return "", err
 		}
 	}
-	return os.UserConfigDir()
+
+	return configDir, nil
 }
 
 func getConfigDirForUser(username string) (string, error) {
@@ -685,7 +676,7 @@ func update(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
-// GetConfig read config file and return with Config and if it was created. Errors out if it does not exist
+// GetConfig read config file and return with Config. Errors out if it does not exist
 func GetConfig(configPath string) (*Config, error) {
 	return readConfig(configPath, false)
 }
@@ -821,85 +812,3 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 func WriteOutConfig(path string, config *Config) error {
 	return util.WriteJson(context.Background(), path, config)
 }
-
-// DirectWriteOutConfig writes config directly without atomic temp file operations.
-// Use this on platforms where atomic writes are blocked (e.g., tvOS sandbox).
-func DirectWriteOutConfig(path string, config *Config) error {
-	return util.DirectWriteJson(context.Background(), path, config)
-}
-
-// DirectUpdateOrCreateConfig is like UpdateOrCreateConfig but uses direct (non-atomic) writes.
-// Use this on platforms where atomic writes are blocked (e.g., tvOS sandbox).
-func DirectUpdateOrCreateConfig(input ConfigInput) (*Config, error) {
-	if !fileExists(input.ConfigPath) {
-		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
-		if err != nil {
-			return nil, err
-		}
-		err = util.DirectWriteJson(context.Background(), input.ConfigPath, cfg)
-		return cfg, err
-	}
-
-	if isPreSharedKeyHidden(input.PreSharedKey) {
-		input.PreSharedKey = nil
-	}
-
-	// Enforce permissions on existing config files (same as UpdateOrCreateConfig)
-	if err := util.EnforcePermission(input.ConfigPath); err != nil {
-		log.Errorf("failed to enforce permission on config file: %v", err)
-	}
-
-	return directUpdate(input)
-}
-
-func directUpdate(input ConfigInput) (*Config, error) {
-	config := &Config{}
-
-	if _, err := util.ReadJson(input.ConfigPath, config); err != nil {
-		return nil, err
-	}
-
-	updated, err := config.apply(input)
-	if err != nil {
-		return nil, err
-	}
-
-	if updated {
-		if err := util.DirectWriteJson(context.Background(), input.ConfigPath, config); err != nil {
-			return nil, err
-		}
-	}
-
-	return config, nil
-}
-
-// ConfigToJSON serializes a Config struct to a JSON string.
-// This is useful for exporting config to alternative storage mechanisms
-// (e.g., UserDefaults on tvOS where file writes are blocked).
-func ConfigToJSON(config *Config) (string, error) {
-	bs, err := json.MarshalIndent(config, "", "    ")
-	if err != nil {
-		return "", err
-	}
-	return string(bs), nil
-}
-
-// ConfigFromJSON deserializes a JSON string to a Config struct.
-// This is useful for restoring config from alternative storage mechanisms.
-// After unmarshaling, defaults are applied to ensure the config is fully initialized.
-func ConfigFromJSON(jsonStr string) (*Config, error) {
-	config := &Config{}
-	err := json.Unmarshal([]byte(jsonStr), config)
-	if err != nil {
-		return nil, err
-	}
-
-	// Apply defaults to ensure required fields are initialized.
-	// This mirrors what readConfig does after loading from file.
-	if _, err := config.apply(ConfigInput{}); err != nil {
-		return nil, fmt.Errorf("failed to apply defaults to config: %w", err)
-	}
-
-	return config, nil
-}

client/internal/profilemanager/service.go

@@ -76,7 +76,6 @@ func (a *ActiveProfileState) FilePath() (string, error) {
 }
 
 type ServiceManager struct {
-	profilesDir string // If set, overrides ConfigDirOverride for profile operations
 }
 
 func NewServiceManager(defaultConfigPath string) *ServiceManager {
@@ -86,17 +85,6 @@ func NewServiceManager(defaultConfigPath string) *ServiceManager {
 	return &ServiceManager{}
 }
 
-// NewServiceManagerWithProfilesDir creates a ServiceManager with a specific profiles directory
-// This allows setting the profiles directory without modifying the global ConfigDirOverride
-func NewServiceManagerWithProfilesDir(defaultConfigPath string, profilesDir string) *ServiceManager {
-	if defaultConfigPath != "" {
-		DefaultConfigPath = defaultConfigPath
-	}
-	return &ServiceManager{
-		profilesDir: profilesDir,
-	}
-}
-
 func (s *ServiceManager) CopyDefaultProfileIfNotExists() (bool, error) {
 
 	if err := os.MkdirAll(DefaultConfigPathDir, 0600); err != nil {
@@ -126,6 +114,14 @@ func (s *ServiceManager) CopyDefaultProfileIfNotExists() (bool, error) {
 		log.Warnf("failed to set permissions for default profile: %v", err)
 	}
 
+	if err := s.SetActiveProfileState(&ActiveProfileState{
+		Name:     "default",
+		Username: "",
+	}); err != nil {
+		log.Errorf("failed to set active profile state: %v", err)
+		return false, fmt.Errorf("failed to set active profile state: %w", err)
+	}
+
 	return true, nil
 }
 
@@ -244,7 +240,7 @@ func (s *ServiceManager) DefaultProfilePath() string {
 }
 
 func (s *ServiceManager) AddProfile(profileName, username string) error {
-	configDir, err := s.getConfigDir(username)
+	configDir, err := getConfigDirForUser(username)
 	if err != nil {
 		return fmt.Errorf("failed to get config directory: %w", err)
 	}
@@ -274,7 +270,7 @@ func (s *ServiceManager) AddProfile(profileName, username string) error {
 }
 
 func (s *ServiceManager) RemoveProfile(profileName, username string) error {
-	configDir, err := s.getConfigDir(username)
+	configDir, err := getConfigDirForUser(username)
 	if err != nil {
 		return fmt.Errorf("failed to get config directory: %w", err)
 	}
@@ -306,7 +302,7 @@ func (s *ServiceManager) RemoveProfile(profileName, username string) error {
 }
 
 func (s *ServiceManager) ListProfiles(username string) ([]Profile, error) {
-	configDir, err := s.getConfigDir(username)
+	configDir, err := getConfigDirForUser(username)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get config directory: %w", err)
 	}
@@ -365,7 +361,7 @@ func (s *ServiceManager) GetStatePath() string {
 		return defaultStatePath
 	}
 
-	configDir, err := s.getConfigDir(activeProf.Username)
+	configDir, err := getConfigDirForUser(activeProf.Username)
 	if err != nil {
 		log.Warnf("failed to get config directory for user %s: %v", activeProf.Username, err)
 		return defaultStatePath
@@ -373,12 +369,3 @@ func (s *ServiceManager) GetStatePath() string {
 
 	return filepath.Join(configDir, activeProf.Name+".state.json")
 }
-
-// getConfigDir returns the profiles directory, using profilesDir if set, otherwise getConfigDirForUser
-func (s *ServiceManager) getConfigDir(username string) (string, error) {
-	if s.profilesDir != "" {
-		return s.profilesDir, nil
-	}
-
-	return getConfigDirForUser(username)
-}