Bump the patch-updates group across 1 directory with 2 updates

Bumps the patch-updates group with 2 updates in the / directory: [github.com/miekg/dns](https://github.com/miekg/dns) and software.sslmate.com/src/go-pkcs12.


Updates `github.com/miekg/dns` from 1.1.70 to 1.1.72
- [Commits](https://github.com/miekg/dns/compare/v1.1.70...v1.1.72)

Updates `software.sslmate.com/src/go-pkcs12` from 0.7.0 to 0.7.1

---
updated-dependencies:
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.72
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: software.sslmate.com/src/go-pkcs12
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/CODEOWNERS

@@ -1 +0,0 @@
-* @oschwartz10612 @miloschwartz

.github/ISSUE_TEMPLATE/1.bug_report.yml

@@ -14,13 +14,12 @@ body:
           label: Environment
           description: Please fill out the relevant details below for your environment.
           value: |
-              - OS Type & Version:
+              - OS Type & Version: (e.g., Ubuntu 22.04)
               - Pangolin Version:
-              - Edition (Community or Enterprise):
               - Gerbil Version:
               - Traefik Version:
               - Newt Version:
-              - Client Version:
+              - Olm Version: (if applicable)
       validations:
           required: true
 

README.md

@@ -1,5 +1,4 @@
 # Olm
-Olm is being phased out in favor of the [Pangolin CLI](https://github.com/fosrl/cli) and is only meant for advanced use cases.
 
 Olm is a [WireGuard](https://www.wireguard.com/) tunnel client designed to securely connect your computer to Newt sites running on remote networks.
 

api/api.go

@@ -29,7 +29,6 @@ type ConnectionRequest struct {
 	PingInterval  string   `json:"pingInterval,omitempty"`
 	PingTimeout   string   `json:"pingTimeout,omitempty"`
 	OrgID         string   `json:"orgId,omitempty"`
-	MatchDomains  []string `json:"matchDomains,omitempty"`
 }
 
 // SwitchOrgRequest defines the structure for switching organizations
@@ -51,7 +50,6 @@ type PeerStatus struct {
 	LastSeen           time.Time     `json:"lastSeen"`
 	Endpoint           string        `json:"endpoint,omitempty"`
 	IsRelay            bool          `json:"isRelay"`
-	IsLocal            bool          `json:"isLocal"` // true when connected via a local network endpoint, bypassing both the public endpoint and relay
 	PeerIP             string        `json:"peerAddress,omitempty"`
 	HolepunchConnected bool          `json:"holepunchConnected"`
 }
@@ -230,7 +228,7 @@ func (s *API) Stop() error {
 	return nil
 }
 
-func (s *API) AddPeerStatus(siteID int, siteName string, connected bool, rtt time.Duration, endpoint string, isRelay bool, isLocal bool) {
+func (s *API) AddPeerStatus(siteID int, siteName string, connected bool, rtt time.Duration, endpoint string, isRelay bool) {
 	s.statusMu.Lock()
 	defer s.statusMu.Unlock()
 
@@ -248,11 +246,10 @@ func (s *API) AddPeerStatus(siteID int, siteName string, connected bool, rtt tim
 	status.LastSeen = time.Now()
 	status.Endpoint = endpoint
 	status.IsRelay = isRelay
-	status.IsLocal = isLocal
 }
 
-// UpdatePeerStatus updates the status of a peer including endpoint, relay, and local info
-func (s *API) UpdatePeerStatus(siteID int, connected bool, rtt time.Duration, endpoint string, isRelay bool, isLocal bool) {
+// UpdatePeerStatus updates the status of a peer including endpoint and relay info
+func (s *API) UpdatePeerStatus(siteID int, connected bool, rtt time.Duration, endpoint string, isRelay bool) {
 	s.statusMu.Lock()
 	defer s.statusMu.Unlock()
 
@@ -269,7 +266,6 @@ func (s *API) UpdatePeerStatus(siteID int, connected bool, rtt time.Duration, en
 	status.LastSeen = time.Now()
 	status.Endpoint = endpoint
 	status.IsRelay = isRelay
-	status.IsLocal = isLocal
 }
 
 func (s *API) RemovePeerStatus(siteID int) { // remove the peer from the status map
@@ -366,31 +362,6 @@ func (s *API) UpdatePeerRelayStatus(siteID int, endpoint string, isRelay bool) {
 
 	status.Endpoint = endpoint
 	status.IsRelay = isRelay
-	if isRelay {
-		// Relay and local are mutually exclusive; local always wins when viable.
-		status.IsLocal = false
-	}
-}
-
-// UpdatePeerLocalStatus updates only the local-connection status of a peer. A peer using a
-// local connection is never simultaneously relayed.
-func (s *API) UpdatePeerLocalStatus(siteID int, endpoint string, isLocal bool) {
-	s.statusMu.Lock()
-	defer s.statusMu.Unlock()
-
-	status, exists := s.peerStatuses[siteID]
-	if !exists {
-		status = &PeerStatus{
-			SiteID: siteID,
-		}
-		s.peerStatuses[siteID] = status
-	}
-
-	status.Endpoint = endpoint
-	status.IsLocal = isLocal
-	if isLocal {
-		status.IsRelay = false
-	}
 }
 
 // UpdatePeerHolepunchStatus updates the holepunch connection status of a peer

config.go

@@ -27,13 +27,6 @@ type OlmConfig struct {
 	UpstreamDNS   []string `json:"upstreamDNS"`
 	InterfaceName string   `json:"interface"`
 
-	// MatchDomains lists FQDN wildcard patterns (using * and ? wildcards, e.g.
-	// "*.proxy.internal") that olm should check against local records / resolve
-	// via UpstreamDNS. Queries for domains that don't match any pattern are sent
-	// directly to the host's own system DNS servers instead. Empty means match
-	// every domain (i.e. the feature is disabled).
-	MatchDomains []string `json:"matchDomainsDNS"`
-
 	// Logging
 	LogLevel string `json:"logLevel"`
 
@@ -47,12 +40,11 @@ type OlmConfig struct {
 	PingTimeout  string `json:"pingTimeout"`
 
 	// Advanced
-	DisableHolepunch  bool   `json:"disableHolepunch"`
-	TlsClientCert     string `json:"tlsClientCert"`
-	OverrideDNS       bool   `json:"overrideDNS"`
-	TunnelDNS         bool   `json:"tunnelDNS"`
-	DisableRelay      bool   `json:"disableRelay"`
-	PreferLocalRoutes bool   `json:"preferLocalRoutes"`
+	DisableHolepunch bool   `json:"disableHolepunch"`
+	TlsClientCert    string `json:"tlsClientCert"`
+	OverrideDNS      bool   `json:"overrideDNS"`
+	TunnelDNS        bool   `json:"tunnelDNS"`
+	DisableRelay     bool   `json:"disableRelay"`
 	// DoNotCreateNewClient bool   `json:"doNotCreateNewClient"`
 
 	// Parsed values (not in JSON)
@@ -107,7 +99,6 @@ func DefaultConfig() *OlmConfig {
 	config.sources["mtu"] = string(SourceDefault)
 	config.sources["dns"] = string(SourceDefault)
 	config.sources["upstreamDNS"] = string(SourceDefault)
-	config.sources["matchDomains"] = string(SourceDefault)
 	config.sources["logLevel"] = string(SourceDefault)
 	config.sources["interface"] = string(SourceDefault)
 	config.sources["enableApi"] = string(SourceDefault)
@@ -119,7 +110,6 @@ func DefaultConfig() *OlmConfig {
 	config.sources["overrideDNS"] = string(SourceDefault)
 	config.sources["tunnelDNS"] = string(SourceDefault)
 	config.sources["disableRelay"] = string(SourceDefault)
-	config.sources["preferLocalRoutes"] = string(SourceDefault)
 	// config.sources["doNotCreateNewClient"] = string(SourceDefault)
 
 	return config
@@ -239,10 +229,6 @@ func loadConfigFromEnv(config *OlmConfig) {
 		config.UpstreamDNS = []string{val}
 		config.sources["upstreamDNS"] = string(SourceEnv)
 	}
-	if val := os.Getenv("MATCH_DOMAINS_DNS"); val != "" {
-		config.MatchDomains = splitComma(val)
-		config.sources["matchDomains"] = string(SourceEnv)
-	}
 	if val := os.Getenv("LOG_LEVEL"); val != "" {
 		config.LogLevel = val
 		config.sources["logLevel"] = string(SourceEnv)
@@ -283,10 +269,6 @@ func loadConfigFromEnv(config *OlmConfig) {
 		config.DisableRelay = true
 		config.sources["disableRelay"] = string(SourceEnv)
 	}
-	if val := os.Getenv("PREFER_LOCAL_ROUTES"); val == "true" {
-		config.PreferLocalRoutes = true
-		config.sources["preferLocalRoutes"] = string(SourceEnv)
-	}
 	if val := os.Getenv("TUNNEL_DNS"); val == "true" {
 		config.TunnelDNS = true
 		config.sources["tunnelDNS"] = string(SourceEnv)
@@ -303,27 +285,25 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 
 	// Store original values to detect changes
 	origValues := map[string]interface{}{
-		"endpoint":          config.Endpoint,
-		"id":                config.ID,
-		"secret":            config.Secret,
-		"org":               config.OrgID,
-		"userToken":         config.UserToken,
-		"mtu":               config.MTU,
-		"dns":               config.DNS,
-		"upstreamDNS":       fmt.Sprintf("%v", config.UpstreamDNS),
-		"matchDomains":      fmt.Sprintf("%v", config.MatchDomains),
-		"logLevel":          config.LogLevel,
-		"interface":         config.InterfaceName,
-		"httpAddr":          config.HTTPAddr,
-		"socketPath":        config.SocketPath,
-		"pingInterval":      config.PingInterval,
-		"pingTimeout":       config.PingTimeout,
-		"enableApi":         config.EnableAPI,
-		"disableHolepunch":  config.DisableHolepunch,
-		"overrideDNS":       config.OverrideDNS,
-		"disableRelay":      config.DisableRelay,
-		"preferLocalRoutes": config.PreferLocalRoutes,
-		"tunnelDNS":         config.TunnelDNS,
+		"endpoint":         config.Endpoint,
+		"id":               config.ID,
+		"secret":           config.Secret,
+		"org":              config.OrgID,
+		"userToken":        config.UserToken,
+		"mtu":              config.MTU,
+		"dns":              config.DNS,
+		"upstreamDNS":      fmt.Sprintf("%v", config.UpstreamDNS),
+		"logLevel":         config.LogLevel,
+		"interface":        config.InterfaceName,
+		"httpAddr":         config.HTTPAddr,
+		"socketPath":       config.SocketPath,
+		"pingInterval":     config.PingInterval,
+		"pingTimeout":      config.PingTimeout,
+		"enableApi":        config.EnableAPI,
+		"disableHolepunch": config.DisableHolepunch,
+		"overrideDNS":      config.OverrideDNS,
+		"disableRelay":     config.DisableRelay,
+		"tunnelDNS":        config.TunnelDNS,
 		// "doNotCreateNewClient": config.DoNotCreateNewClient,
 	}
 
@@ -337,8 +317,6 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 	serviceFlags.StringVar(&config.DNS, "dns", config.DNS, "DNS server to use")
 	var upstreamDNSFlag string
 	serviceFlags.StringVar(&upstreamDNSFlag, "upstream-dns", "", "Upstream DNS server(s) (comma-separated, default: 8.8.8.8:53)")
-	var matchDomainsFlag string
-	serviceFlags.StringVar(&matchDomainsFlag, "match-domains-dns", "", "FQDN wildcard patterns (comma-separated, e.g. '*.proxy.internal,*.host-0?.autoco.internal') to check against local records/upstream DNS; queries for non-matching domains are sent directly to the system's DNS servers (default: match all domains)")
 	serviceFlags.StringVar(&config.LogLevel, "log-level", config.LogLevel, "Log level (DEBUG, INFO, WARN, ERROR, FATAL)")
 	serviceFlags.StringVar(&config.InterfaceName, "interface", config.InterfaceName, "Name of the WireGuard interface")
 	serviceFlags.StringVar(&config.HTTPAddr, "http-addr", config.HTTPAddr, "HTTP server address (e.g., ':9452')")
@@ -349,7 +327,6 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 	serviceFlags.BoolVar(&config.DisableHolepunch, "disable-holepunch", config.DisableHolepunch, "Disable hole punching")
 	serviceFlags.BoolVar(&config.OverrideDNS, "override-dns", config.OverrideDNS, "When enabled, the client uses custom DNS servers to resolve internal resources and aliases. This overrides your system's default DNS settings. Queries that cannot be resolved as a Pangolin resource will be forwarded to your configured Upstream DNS Server. (default false)")
 	serviceFlags.BoolVar(&config.DisableRelay, "disable-relay", config.DisableRelay, "Disable relay connections")
-	serviceFlags.BoolVar(&config.PreferLocalRoutes, "prefer-local-routes", config.PreferLocalRoutes, "Add tunnel routes with a high metric so overlapping local/connected routes take precedence (default false)")
 	serviceFlags.BoolVar(&config.TunnelDNS, "tunnel-dns", config.TunnelDNS, "When enabled, DNS queries are routed through the tunnel for remote resolution. To ensure queries are tunneled correctly, you must define the DNS server as a Pangolin resource and enter its address as an Upstream DNS Server. (default false)")
 	// serviceFlags.BoolVar(&config.DoNotCreateNewClient, "do-not-create-new-client", config.DoNotCreateNewClient, "Do not create new client")
 
@@ -371,11 +348,6 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 		}
 	}
 
-	// Parse match domains flag if provided
-	if matchDomainsFlag != "" {
-		config.MatchDomains = splitComma(matchDomainsFlag)
-	}
-
 	// Track which values were changed by CLI args
 	if config.Endpoint != origValues["endpoint"].(string) {
 		config.sources["endpoint"] = string(SourceCLI)
@@ -401,9 +373,6 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 	if fmt.Sprintf("%v", config.UpstreamDNS) != origValues["upstreamDNS"].(string) {
 		config.sources["upstreamDNS"] = string(SourceCLI)
 	}
-	if fmt.Sprintf("%v", config.MatchDomains) != origValues["matchDomains"].(string) {
-		config.sources["matchDomains"] = string(SourceCLI)
-	}
 	if config.LogLevel != origValues["logLevel"].(string) {
 		config.sources["logLevel"] = string(SourceCLI)
 	}
@@ -434,9 +403,6 @@ func loadConfigFromCLI(config *OlmConfig, args []string) (bool, bool, error) {
 	if config.DisableRelay != origValues["disableRelay"].(bool) {
 		config.sources["disableRelay"] = string(SourceCLI)
 	}
-	if config.PreferLocalRoutes != origValues["preferLocalRoutes"].(bool) {
-		config.sources["preferLocalRoutes"] = string(SourceCLI)
-	}
 	if config.TunnelDNS != origValues["tunnelDNS"].(bool) {
 		config.sources["tunnelDNS"] = string(SourceCLI)
 	}
@@ -515,10 +481,6 @@ func mergeConfigs(dest, src *OlmConfig) {
 		dest.UpstreamDNS = src.UpstreamDNS
 		dest.sources["upstreamDNS"] = string(SourceFile)
 	}
-	if len(src.MatchDomains) > 0 {
-		dest.MatchDomains = src.MatchDomains
-		dest.sources["matchDomains"] = string(SourceFile)
-	}
 	if src.LogLevel != "" && src.LogLevel != "INFO" {
 		dest.LogLevel = src.LogLevel
 		dest.sources["logLevel"] = string(SourceFile)
@@ -568,10 +530,6 @@ func mergeConfigs(dest, src *OlmConfig) {
 		dest.DisableRelay = src.DisableRelay
 		dest.sources["disableRelay"] = string(SourceFile)
 	}
-	if src.PreferLocalRoutes {
-		dest.PreferLocalRoutes = src.PreferLocalRoutes
-		dest.sources["preferLocalRoutes"] = string(SourceFile)
-	}
 	// if src.DoNotCreateNewClient {
 	// 	dest.DoNotCreateNewClient = src.DoNotCreateNewClient
 	// 	dest.sources["doNotCreateNewClient"] = string(SourceFile)
@@ -640,7 +598,6 @@ func (c *OlmConfig) ShowConfig() {
 	fmt.Printf("  mtu          = %d [%s]\n", c.MTU, getSource("mtu"))
 	fmt.Printf("  dns          = %s [%s]\n", c.DNS, getSource("dns"))
 	fmt.Printf("  upstream-dns = %v [%s]\n", c.UpstreamDNS, getSource("upstreamDNS"))
-	fmt.Printf("  match-domains-dns = %v [%s]\n", c.MatchDomains, getSource("matchDomains"))
 	fmt.Printf("  interface    = %s [%s]\n", c.InterfaceName, getSource("interface"))
 
 	// Logging
@@ -664,7 +621,6 @@ func (c *OlmConfig) ShowConfig() {
 	fmt.Printf("  override-dns          = %v [%s]\n", c.OverrideDNS, getSource("overrideDNS"))
 	fmt.Printf("  tunnel-dns            = %v [%s]\n", c.TunnelDNS, getSource("tunnelDNS"))
 	fmt.Printf("  disable-relay         = %v [%s]\n", c.DisableRelay, getSource("disableRelay"))
-	fmt.Printf("  prefer-local-routes   = %v [%s]\n", c.PreferLocalRoutes, getSource("preferLocalRoutes"))
 	// fmt.Printf("  do-not-create-new-client = %v [%s]\n", c.DoNotCreateNewClient, getSource("doNotCreateNewClient"))
 	if c.TlsClientCert != "" {
 		fmt.Printf("  tls-cert              = %s [%s]\n", c.TlsClientCert, getSource("tlsClientCert"))

device/middle_device.go

@@ -1,7 +1,6 @@
 package device
 
 import (
-	"bytes"
 	"io"
 	"net/netip"
 	"os"
@@ -9,7 +8,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/fosrl/newt/bind"
 	"github.com/fosrl/newt/logger"
 	"golang.zx2c4.com/wireguard/tun"
 )
@@ -26,7 +24,7 @@ type FilterRule struct {
 // closeAwareDevice wraps a tun.Device along with a flag
 // indicating whether its Close method was called.
 type closeAwareDevice struct {
-	isClosed atomic.Bool
+	isClosed     atomic.Bool
 	tun.Device
 	closeEventCh chan struct{}
 	wg           sync.WaitGroup
@@ -425,33 +423,6 @@ func extractDestIP(packet []byte) (netip.Addr, bool) {
 	return netip.Addr{}, false
 }
 
-// extractUDPPayload returns the UDP payload of packet, if packet is a well-formed
-// IPv4 or IPv6 UDP datagram (ignoring IPv6 extension headers).
-func extractUDPPayload(packet []byte) ([]byte, bool) {
-	if len(packet) < 20 {
-		return nil, false
-	}
-
-	const udpProtocol = 17
-
-	switch packet[0] >> 4 {
-	case 4:
-		ihl := int(packet[0]&0x0f) * 4
-		if ihl < 20 || len(packet) < ihl+8 || packet[9] != udpProtocol {
-			return nil, false
-		}
-		return packet[ihl+8:], true
-	case 6:
-		const ipv6HeaderLen = 40
-		if len(packet) < ipv6HeaderLen+8 || packet[6] != udpProtocol {
-			return nil, false
-		}
-		return packet[ipv6HeaderLen+8:], true
-	}
-
-	return nil, false
-}
-
 // Read intercepts packets going UP from the TUN device (towards WireGuard)
 func (d *MiddleDevice) Read(bufs [][]byte, sizes []int, offset int) (n int, err error) {
 	for {
@@ -526,19 +497,17 @@ func (d *MiddleDevice) Read(bufs [][]byte, sizes []int, offset int) (n int, err
 		rules := d.rules
 		d.rulesMutex.RUnlock()
 
-		// Process packets and filter out handled ones. This always runs (even with
-		// no per-IP rules registered) so magic connectivity-test packets can be
-		// dropped before they reach WireGuard - see isLeakedMagicPacket.
+		if len(rules) == 0 {
+			return n, nil
+		}
+
+		// Process packets and filter out handled ones
 		writeIdx := 0
 		for readIdx := 0; readIdx < n; readIdx++ {
 			packet := bufs[readIdx][offset : offset+sizes[readIdx]]
 
-			if isLeakedMagicPacket(packet) {
-				continue
-			}
-
 			destIP, ok := extractDestIP(packet)
-			if !ok || len(rules) == 0 {
+			if !ok {
 				if writeIdx != readIdx {
 					bufs[writeIdx] = bufs[readIdx]
 					sizes[writeIdx] = sizes[readIdx]
@@ -570,74 +539,6 @@ func (d *MiddleDevice) Read(bufs [][]byte, sizes []int, offset int) (n int, err
 	}
 }
 
-// isLeakedMagicPacket reports whether packet carries one of our UDP connectivity-test
-// magic payloads (see bind.IsMagicPacket). These packets are sent directly between
-// physical UDP sockets by the local-endpoint holepunch tester and must never be
-// encapsulated by WireGuard: if OS routing sends one into this TUN interface instead
-// of out the real network interface (e.g. because the destination falls inside a
-// routed tunnel subnet), tunneling and echoing it back would make a LAN-local
-// endpoint falsely appear directly reachable. Dropping it here makes the test
-// correctly time out instead.
-func isLeakedMagicPacket(packet []byte) bool {
-	payload, ok := extractUDPPayload(packet)
-	return ok && isMagicPacket(payload)
-}
-
-// IsMagicPacket reports whether payload is one of our connectivity-test magic
-// packets (a MagicTestRequest or MagicTestResponse). These packets are meant to
-// travel directly between physical UDP sockets and must never be encapsulated by
-// WireGuard - e.g. if OS routing mistakenly sends one into a WireGuard TUN
-// interface (because the destination falls inside a routed tunnel subnet), it
-// should be dropped there rather than tunneled, which would otherwise make a
-// LAN-local endpoint test falsely appear to succeed over the tunnel.
-func isMagicPacket(payload []byte) bool {
-	if len(payload) >= bind.MagicTestRequestLen && bytes.HasPrefix(payload, bind.MagicTestRequest) {
-		return true
-	}
-	if len(payload) >= bind.MagicTestResponseLen && bytes.HasPrefix(payload, bind.MagicTestResponse) {
-		return true
-	}
-	return false
-}
-
-// filterDownstreamBufs drops packets going DOWN to the TUN device (from WireGuard)
-// that are handled by a per-IP rule or are a leaked magic connectivity-test packet
-// (see isLeakedMagicPacket) - always checked, even with no rules registered. It
-// returns bufs unchanged (no allocation) unless a packet actually needs to be
-// dropped, at which point it switches to an owned copy of the buffers kept so far.
-func filterDownstreamBufs(bufs [][]byte, rules []FilterRule, offset int) [][]byte {
-	filtered := bufs
-	for i, buf := range bufs {
-		drop := len(buf) <= offset
-		if !drop {
-			packet := buf[offset:]
-			if isLeakedMagicPacket(packet) {
-				drop = true
-			} else if destIP, ok := extractDestIP(packet); ok && len(rules) > 0 {
-				for _, rule := range rules {
-					if rule.DestIP == destIP && rule.Handler(packet) {
-						drop = true
-						break
-					}
-				}
-			}
-		}
-
-		if drop {
-			if len(filtered) == len(bufs) {
-				// First drop: switch to an owned, growable copy of everything kept so far.
-				filtered = append([][]byte(nil), bufs[:i]...)
-			}
-			continue
-		}
-
-		if len(filtered) != len(bufs) {
-			filtered = append(filtered, buf)
-		}
-	}
-	return filtered
-}
-
 // Write intercepts packets going DOWN to the TUN device (from WireGuard)
 func (d *MiddleDevice) Write(bufs [][]byte, offset int) (int, error) {
 	for {
@@ -657,7 +558,38 @@ func (d *MiddleDevice) Write(bufs [][]byte, offset int) (int, error) {
 		rules := d.rules
 		d.rulesMutex.RUnlock()
 
-		filteredBufs := filterDownstreamBufs(bufs, rules, offset)
+		var filteredBufs [][]byte
+		if len(rules) == 0 {
+			filteredBufs = bufs
+		} else {
+			filteredBufs = make([][]byte, 0, len(bufs))
+			for _, buf := range bufs {
+				if len(buf) <= offset {
+					continue
+				}
+
+				packet := buf[offset:]
+				destIP, ok := extractDestIP(packet)
+				if !ok {
+					filteredBufs = append(filteredBufs, buf)
+					continue
+				}
+
+				handled := false
+				for _, rule := range rules {
+					if rule.DestIP == destIP {
+						if rule.Handler(packet) {
+							handled = true
+							break
+						}
+					}
+				}
+
+				if !handled {
+					filteredBufs = append(filteredBufs, buf)
+				}
+			}
+		}
 
 		if len(filteredBufs) == 0 {
 			return len(bufs), nil
@@ -728,4 +660,4 @@ func (d *MiddleDevice) WriteToTun(bufs [][]byte, offset int) (int, error) {
 
 		return n, err
 	}
-}
+}

device/middle_device_test.go

@@ -4,22 +4,9 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/fosrl/newt/bind"
 	"github.com/fosrl/newt/util"
 )
 
-// buildIPv4UDPPacket builds a minimal IPv4/UDP packet (no options) carrying payload.
-func buildIPv4UDPPacket(payload []byte) []byte {
-	const ipHeaderLen = 20
-	const udpHeaderLen = 8
-
-	packet := make([]byte, ipHeaderLen+udpHeaderLen+len(payload))
-	packet[0] = 0x45 // version 4, IHL 5
-	packet[9] = 17    // protocol: UDP
-	copy(packet[ipHeaderLen+udpHeaderLen:], payload)
-	return packet
-}
-
 func TestExtractDestIP(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -101,49 +88,6 @@ func TestGetProtocol(t *testing.T) {
 	}
 }
 
-func TestIsLeakedMagicPacket(t *testing.T) {
-	request := make([]byte, bind.MagicTestRequestLen)
-	copy(request, bind.MagicTestRequest)
-
-	response := make([]byte, bind.MagicTestResponseLen)
-	copy(response, bind.MagicTestResponse)
-
-	tests := []struct {
-		name   string
-		packet []byte
-		want   bool
-	}{
-		{
-			name:   "magic test request leaked into tunnel",
-			packet: buildIPv4UDPPacket(request),
-			want:   true,
-		},
-		{
-			name:   "magic test response leaked into tunnel",
-			packet: buildIPv4UDPPacket(response),
-			want:   true,
-		},
-		{
-			name:   "ordinary UDP payload",
-			packet: buildIPv4UDPPacket([]byte("just some ordinary application data")),
-			want:   false,
-		},
-		{
-			name:   "too short to be a packet",
-			packet: []byte{0x45, 0x00},
-			want:   false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isLeakedMagicPacket(tt.packet); got != tt.want {
-				t.Errorf("isLeakedMagicPacket() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 func BenchmarkExtractDestIP(b *testing.B) {
 	packet := []byte{
 		0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00,
@@ -156,61 +100,3 @@ func BenchmarkExtractDestIP(b *testing.B) {
 		extractDestIP(packet)
 	}
 }
-
-func TestFilterDownstreamBufsNoDropIsAllocFree(t *testing.T) {
-	bufs := make([][]byte, 128)
-	for i := range bufs {
-		bufs[i] = buildIPv4UDPPacket(make([]byte, 1372))
-	}
-
-	allocs := testing.AllocsPerRun(1000, func() {
-		out := filterDownstreamBufs(bufs, nil, 0)
-		if len(out) != len(bufs) {
-			t.Fatalf("expected no packets dropped, got %d/%d", len(out), len(bufs))
-		}
-	})
-
-	if allocs != 0 {
-		t.Errorf("filterDownstreamBufs() with nothing to drop allocated %v times per call, want 0", allocs)
-	}
-}
-
-func TestFilterDownstreamBufsDropsMagicPacket(t *testing.T) {
-	request := make([]byte, bind.MagicTestRequestLen)
-	copy(request, bind.MagicTestRequest)
-
-	bufs := [][]byte{
-		buildIPv4UDPPacket([]byte("ordinary payload one")),
-		buildIPv4UDPPacket(request),
-		buildIPv4UDPPacket([]byte("ordinary payload two")),
-	}
-
-	out := filterDownstreamBufs(bufs, nil, 0)
-	if len(out) != 2 {
-		t.Fatalf("expected 1 packet dropped, got %d remaining", len(out))
-	}
-}
-
-func BenchmarkFilterDownstreamBufsNoDrop(b *testing.B) {
-	bufs := make([][]byte, 128)
-	for i := range bufs {
-		bufs[i] = buildIPv4UDPPacket(make([]byte, 1372))
-	}
-
-	b.ResetTimer()
-	b.ReportAllocs()
-	for i := 0; i < b.N; i++ {
-		filterDownstreamBufs(bufs, nil, 0)
-	}
-}
-
-func BenchmarkIsLeakedMagicPacket(b *testing.B) {
-	// A typical ~1400 byte ordinary application payload (the common case on the
-	// hot path - almost every real packet should look like this).
-	ordinary := buildIPv4UDPPacket(make([]byte, 1372))
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		isLeakedMagicPacket(ordinary)
-	}
-}

dns/dns_proxy.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"strings"
 	"sync"
 	"time"
 
@@ -39,20 +38,6 @@ type DNSProxy struct {
 	middleDevice *device.MiddleDevice // Reference to MiddleDevice for packet filtering and TUN writes
 	recordStore  *DNSRecordStore      // Local DNS records
 
-	// matchDomains lists the FQDN wildcard patterns (using * and ? wildcards, see
-	// matchWildcard) that this proxy is responsible for. Queries whose name matches
-	// one of these patterns are checked against local records and, failing that,
-	// forwarded to upstreamDNS. Queries that match none of the patterns are sent
-	// directly to localDNS instead, bypassing local records and upstreamDNS
-	// entirely. An empty matchDomains means "match everything" (i.e. behave as if
-	// this feature were not configured).
-	matchDomains []string
-	// localDNS holds the host's own system DNS servers (as reported by
-	// SystemDNSMonitor / PublicDNS), used to resolve queries that don't match
-	// matchDomains rather than sending them upstream or through the tunnel.
-	localDNS   []string
-	matchMu    sync.RWMutex
-
 	// Tunnel DNS fields - for sending queries over WireGuard
 	tunnelIP          netip.Addr   // WireGuard interface IP (source for tunneled queries)
 	tunnelStack       *stack.Stack // Separate netstack for outbound tunnel queries
@@ -70,14 +55,8 @@ type DNSProxy struct {
 	wg     sync.WaitGroup
 }
 
-// NewDNSProxy creates a new DNS proxy.
-//
-// matchDomains, if non-empty, restricts local-record lookup and upstream
-// forwarding to queries whose name matches one of the given wildcard patterns
-// (see matchWildcard). Queries that match none of the patterns are instead
-// forwarded directly to localDNS (the host's own system DNS servers). Pass an
-// empty matchDomains to match every query, preserving prior behavior.
-func NewDNSProxy(middleDevice *device.MiddleDevice, mtu int, utilitySubnet string, upstreamDns []string, tunnelDns bool, tunnelIP string, matchDomains []string, localDNS []string) (*DNSProxy, error) {
+// NewDNSProxy creates a new DNS proxy
+func NewDNSProxy(middleDevice *device.MiddleDevice, mtu int, utilitySubnet string, upstreamDns []string, tunnelDns bool, tunnelIP string) (*DNSProxy, error) {
 	proxyIP, err := PickIPFromSubnet(utilitySubnet)
 	if err != nil {
 		return nil, fmt.Errorf("failed to pick DNS proxy IP from subnet: %v", err)
@@ -97,8 +76,6 @@ func NewDNSProxy(middleDevice *device.MiddleDevice, mtu int, utilitySubnet strin
 		tunnelDNS:         tunnelDns,
 		recordStore:       NewDNSRecordStore(),
 		tunnelActivePorts: make(map[uint16]bool),
-		matchDomains:      matchDomains,
-		localDNS:          localDNS,
 		ctx:               ctx,
 		cancel:            cancel,
 	}
@@ -406,27 +383,6 @@ func (p *DNSProxy) handleDNSQuery(udpConn *gonet.UDPConn, queryData []byte, clie
 	question := msg.Question[0]
 	logger.Debug("DNS query for %s (type %s)", question.Name, dns.TypeToString[question.Qtype])
 
-	// If matchDomains is configured and this query's name doesn't match any of
-	// the configured patterns, skip local records and upstream entirely and
-	// send it straight to the host's own system DNS servers.
-	if !p.matchesConfiguredDomains(question.Name) {
-		logger.Debug("Query for %s does not match configured domains, forwarding to local DNS %v", question.Name, p.getLocalDNS())
-		response := p.forwardToLocalDNS(msg)
-		if response == nil {
-			logger.Error("Failed to get DNS response for %s from local DNS", question.Name)
-			return
-		}
-		responseData, err := response.Pack()
-		if err != nil {
-			logger.Error("Failed to pack DNS response: %v", err)
-			return
-		}
-		if _, err := udpConn.WriteTo(responseData, clientAddr); err != nil {
-			logger.Error("Failed to send DNS response: %v", err)
-		}
-		return
-	}
-
 	// Check if we have local records for this query
 	var response *dns.Msg
 	if question.Qtype == dns.TypeA || question.Qtype == dns.TypeAAAA || question.Qtype == dns.TypePTR {
@@ -549,77 +505,6 @@ func (p *DNSProxy) checkLocalRecords(query *dns.Msg, question dns.Question) *dns
 	return response
 }
 
-// matchesConfiguredDomains reports whether name matches one of the configured
-// matchDomains wildcard patterns. If matchDomains is empty, every name is
-// considered a match (i.e. the feature is disabled).
-func (p *DNSProxy) matchesConfiguredDomains(name string) bool {
-	p.matchMu.RLock()
-	patterns := p.matchDomains
-	p.matchMu.RUnlock()
-
-	if len(patterns) == 0 {
-		return true
-	}
-
-	name = strings.ToLower(dns.Fqdn(name))
-	for _, pattern := range patterns {
-		pattern = strings.ToLower(dns.Fqdn(pattern))
-		if matchWildcard(pattern, name) {
-			return true
-		}
-	}
-	return false
-}
-
-// getLocalDNS returns the currently configured local (system) DNS servers.
-func (p *DNSProxy) getLocalDNS() []string {
-	p.matchMu.RLock()
-	defer p.matchMu.RUnlock()
-	return p.localDNS
-}
-
-// forwardToLocalDNS forwards a DNS query directly to the host's own system DNS
-// servers (localDNS), always using host networking regardless of tunnelDNS -
-// these queries are for domains the caller has explicitly excluded from
-// Pangolin resolution, so they should never traverse the tunnel.
-func (p *DNSProxy) forwardToLocalDNS(query *dns.Msg) *dns.Msg {
-	servers := p.getLocalDNS()
-	if len(servers) == 0 {
-		logger.Warn("No local DNS servers configured, dropping query for %s", query.Question[0].Name)
-		return nil
-	}
-
-	var lastErr error
-	for _, server := range servers {
-		response, err := p.queryUpstreamDirect(server, query, 2*time.Second)
-		if err == nil {
-			return response
-		}
-		lastErr = err
-	}
-	logger.Error("All local DNS servers failed: %v", lastErr)
-	return nil
-}
-
-// SetMatchDomains replaces the list of wildcard domain patterns (see
-// matchWildcard) that this proxy checks against local records / upstream DNS.
-// Queries not matching any pattern are sent to localDNS instead. Pass an
-// empty slice to match every query (i.e. disable filtering).
-func (p *DNSProxy) SetMatchDomains(patterns []string) {
-	p.matchMu.Lock()
-	defer p.matchMu.Unlock()
-	p.matchDomains = patterns
-}
-
-// SetLocalDNS replaces the list of local (host system) DNS servers used to
-// resolve queries that don't match matchDomains. Servers must be in
-// "host:port" format (e.g. "192.168.1.1:53").
-func (p *DNSProxy) SetLocalDNS(servers []string) {
-	p.matchMu.Lock()
-	defer p.matchMu.Unlock()
-	p.localDNS = servers
-}
-
 // forwardToUpstream forwards a DNS query to upstream DNS servers
 func (p *DNSProxy) forwardToUpstream(query *dns.Msg) *dns.Msg {
 	// Try primary DNS server
@@ -856,16 +741,6 @@ func (p *DNSProxy) SetJITHandler(handler func(siteId int)) {
 	p.jitHandler = handler
 }
 
-// SetUpstreamDNS replaces the list of upstream DNS servers used to forward
-// queries that are not served by local records.  The servers must be in
-// "host:port" format (e.g. "8.8.8.8:53").
-func (p *DNSProxy) SetUpstreamDNS(servers []string) {
-	if len(servers) == 0 {
-		return
-	}
-	p.upstreamDNS = servers
-}
-
 // AddDNSRecord adds a DNS record to the local store
 // domain should be a domain name (e.g., "example.com" or "example.com.")
 // ip should be a valid IPv4 or IPv6 address
@@ -880,12 +755,6 @@ func (p *DNSProxy) RemoveDNSRecord(domain string, ip net.IP) {
 	p.recordStore.RemoveRecord(domain, ip)
 }
 
-// RemoveDNSRecordForSite removes DNS records for a domain that are owned by a specific site.
-// If ip is nil, removes all records for the domain that are owned by that site.
-func (p *DNSProxy) RemoveDNSRecordForSite(domain string, ip net.IP, siteId int) {
-	p.recordStore.RemoveRecordForSite(domain, ip, siteId)
-}
-
 // GetDNSRecords returns all IP addresses for a domain and record type.
 // The second return value indicates whether the domain exists.
 func (p *DNSProxy) GetDNSRecords(domain string, recordType RecordType) ([]net.IP, bool) {

dns/dns_records.go

@@ -23,7 +23,6 @@ type recordSet struct {
 	A      []net.IP
 	AAAA   []net.IP
 	SiteId int
-	owners map[string]map[int]bool // IP string -> owning site IDs
 }
 
 // DNSRecordStore manages local DNS records for A, AAAA, and PTR queries.
@@ -72,17 +71,9 @@ func (s *DNSRecordStore) AddRecord(domain string, ip net.IP, siteId int) error {
 	}
 
 	if m[domain] == nil {
-		m[domain] = &recordSet{SiteId: siteId, owners: make(map[string]map[int]bool)}
+		m[domain] = &recordSet{SiteId: siteId}
 	}
 	rs := m[domain]
-	if rs.owners == nil {
-		rs.owners = make(map[string]map[int]bool)
-	}
-	ipKey := ip.String()
-	if rs.owners[ipKey] == nil {
-		rs.owners[ipKey] = make(map[int]bool)
-	}
-	rs.owners[ipKey][siteId] = true
 	if isV4 {
 		for _, existing := range rs.A {
 			if existing.Equal(ip) {
@@ -106,6 +97,7 @@ func (s *DNSRecordStore) AddRecord(domain string, ip net.IP, siteId int) error {
 	return nil
 }
 
+
 // AddPTRRecord adds a PTR record mapping an IP address to a domain name
 // ip should be a valid IPv4 or IPv6 address
 // domain should be in FQDN format (e.g., "example.com.")
@@ -131,16 +123,6 @@ func (s *DNSRecordStore) AddPTRRecord(ip net.IP, domain string) error {
 // If ip is nil, removes all records for the domain (including wildcards)
 // Automatically removes corresponding PTR records for non-wildcard domains
 func (s *DNSRecordStore) RemoveRecord(domain string, ip net.IP) {
-	s.removeRecord(domain, ip, 0, false)
-}
-
-// RemoveRecordForSite removes DNS records owned by a specific site.
-// If ip is nil, it removes all records for the domain owned by that site.
-func (s *DNSRecordStore) RemoveRecordForSite(domain string, ip net.IP, siteId int) {
-	s.removeRecord(domain, ip, siteId, true)
-}
-
-func (s *DNSRecordStore) removeRecord(domain string, ip net.IP, siteId int, bySite bool) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -160,20 +142,8 @@ func (s *DNSRecordStore) removeRecord(domain string, ip net.IP, siteId int, bySi
 	if rs == nil {
 		return
 	}
-	if rs.owners == nil {
-		rs.owners = make(map[string]map[int]bool)
-	}
 
 	if ip == nil {
-		if bySite {
-			rs.A = s.removeOwnedIPs(rs, rs.A, siteId, !isWildcard, domain)
-			rs.AAAA = s.removeOwnedIPs(rs, rs.AAAA, siteId, !isWildcard, domain)
-			if len(rs.A) == 0 && len(rs.AAAA) == 0 {
-				delete(m, domain)
-			}
-			return
-		}
-
 		// Remove all records for this domain
 		if !isWildcard {
 			for _, ipAddr := range rs.A {
@@ -192,19 +162,6 @@ func (s *DNSRecordStore) removeRecord(domain string, ip net.IP, siteId int, bySi
 	}
 
 	// Remove specific IP
-	ipKey := ip.String()
-	if bySite {
-		owners := rs.owners[ipKey]
-		if len(owners) == 0 {
-			return
-		}
-		delete(owners, siteId)
-		if len(owners) > 0 {
-			return
-		}
-		delete(rs.owners, ipKey)
-	}
-
 	if ip.To4() != nil {
 		rs.A = removeIP(rs.A, ip)
 		if !isWildcard {
@@ -220,7 +177,6 @@ func (s *DNSRecordStore) removeRecord(domain string, ip net.IP, siteId int, bySi
 			}
 		}
 	}
-	delete(rs.owners, ipKey)
 
 	// Clean up empty record sets
 	if len(rs.A) == 0 && len(rs.AAAA) == 0 {
@@ -228,33 +184,6 @@ func (s *DNSRecordStore) removeRecord(domain string, ip net.IP, siteId int, bySi
 	}
 }
 
-func (s *DNSRecordStore) removeOwnedIPs(rs *recordSet, ips []net.IP, siteId int, removePTR bool, domain string) []net.IP {
-	kept := make([]net.IP, 0, len(ips))
-	for _, ipAddr := range ips {
-		ipKey := ipAddr.String()
-		owners := rs.owners[ipKey]
-		if len(owners) == 0 {
-			kept = append(kept, ipAddr)
-			continue
-		}
-
-		delete(owners, siteId)
-		if len(owners) > 0 {
-			kept = append(kept, ipAddr)
-			continue
-		}
-
-		delete(rs.owners, ipKey)
-		if removePTR {
-			if ptrDomain, exists := s.ptrRecords[ipKey]; exists && ptrDomain == domain {
-				delete(s.ptrRecords, ipKey)
-			}
-		}
-	}
-
-	return kept
-}
-
 // RemovePTRRecord removes a PTR record for an IP address
 func (s *DNSRecordStore) RemovePTRRecord(ip net.IP) {
 	s.mu.Lock()

dns/dns_records_test.go

@@ -782,37 +782,6 @@ func TestAutomaticPTRRecordOnRemove(t *testing.T) {
 	}
 }
 
-func TestRemoveRecordForSiteKeepsSharedAliasIP(t *testing.T) {
-	store := NewDNSRecordStore()
-
-	domain := "shared.example.com."
-	ip := net.ParseIP("192.168.1.100")
-
-	if err := store.AddRecord(domain, ip, 10); err != nil {
-		t.Fatalf("Failed to add record for site 10: %v", err)
-	}
-	if err := store.AddRecord(domain, ip, 20); err != nil {
-		t.Fatalf("Failed to add record for site 20: %v", err)
-	}
-
-	store.RemoveRecordForSite(domain, ip, 10)
-
-	ips, exists := store.GetRecords(domain, RecordTypeA)
-	if !exists {
-		t.Fatal("Expected shared record to still exist after removing one site owner")
-	}
-	if len(ips) != 1 || !ips[0].Equal(ip) {
-		t.Fatalf("Expected shared IP to remain after first owner removal, got %v", ips)
-	}
-
-	store.RemoveRecordForSite(domain, ip, 20)
-
-	ips, exists = store.GetRecords(domain, RecordTypeA)
-	if exists {
-		t.Fatalf("Expected domain to be removed after last owner removal, got %v", ips)
-	}
-}
-
 func TestAutomaticPTRRecordOnRemoveAll(t *testing.T) {
 	store := NewDNSRecordStore()
 

dns/override/dns_override_android.go

@@ -20,9 +20,3 @@ func CleanupStaleState(interfaceName string) error {
 	_ = interfaceName
 	return nil
 }
-
-// ForceResetDNS is a no-op on Android.
-func ForceResetDNS(interfaceName string) error {
-	_ = interfaceName
-	return nil
-}

dns/override/dns_override_darwin.go

@@ -15,13 +15,6 @@ var configurator platform.DNSConfigurator
 // SetupDNSOverride configures the system DNS to use the DNS proxy on macOS
 // Uses scutil for DNS configuration
 func SetupDNSOverride(interfaceName string, proxyIp netip.Addr) error {
-	// Defensively clear any stale DNS state from a previous unclean shutdown
-	// before installing the new override. This makes a second tunnel start
-	// safe even if the previous client crashed without restoring DNS.
-	if err := CleanupStaleState(interfaceName); err != nil {
-		logger.Warn("Pre-setup stale DNS cleanup failed (continuing): %v", err)
-	}
-
 	var err error
 	configurator, err = platform.NewDarwinDNSConfigurator()
 	if err != nil {
@@ -85,31 +78,3 @@ func CleanupStaleState(interfaceName string) error {
 	logger.Info("Stale DNS state cleanup completed successfully")
 	return nil
 }
-
-// ForceResetDNS forcibly clears any DNS override state, whether or not the
-// current process installed it. This is intended for the "reset-dns" CLI
-// command and for the watchdog process to recover from a stuck override
-// left behind by a crashed client.
-func ForceResetDNS(interfaceName string) error {
-	logger.Info("Forcing DNS reset on Darwin (interface=%s)", interfaceName)
-
-	// First clean up any persisted state from a previous session.
-	cleanupErr := CleanupStaleState(interfaceName)
-
-	// Then, if the current process happens to hold a live configurator,
-	// instruct it to restore DNS as well so in-memory state is consistent.
-	if configurator != nil {
-		if err := configurator.RestoreDNS(); err != nil {
-			logger.Warn("ForceResetDNS: in-memory restore failed: %v", err)
-		}
-		configurator = nil
-	}
-
-	// As a last-resort defense, sweep any scutil keys matching our naming
-	// convention even if no state file exists.
-	if err := platform.SweepOlmScutilKeys(); err != nil {
-		logger.Warn("ForceResetDNS: scutil sweep failed: %v", err)
-	}
-
-	return cleanupErr
-}

dns/override/dns_override_ios.go

@@ -19,9 +19,3 @@ func CleanupStaleState(interfaceName string) error {
 	_ = interfaceName
 	return nil
 }
-
-// ForceResetDNS is a no-op on iOS.
-func ForceResetDNS(interfaceName string) error {
-	_ = interfaceName
-	return nil
-}

dns/override/dns_override_unix.go

@@ -15,13 +15,6 @@ var configurator platform.DNSConfigurator
 // SetupDNSOverride configures the system DNS to use the DNS proxy on Linux/FreeBSD
 // Detects the DNS manager by reading /etc/resolv.conf and verifying runtime availability
 func SetupDNSOverride(interfaceName string, proxyIp netip.Addr) error {
-	// Defensively clear any stale DNS state from a previous unclean shutdown
-	// before installing the new override. This makes a second tunnel start
-	// safe even if the previous client crashed without restoring DNS.
-	if err := CleanupStaleState(interfaceName); err != nil {
-		logger.Warn("Pre-setup stale DNS cleanup failed (continuing): %v", err)
-	}
-
 	var err error
 
 	// Detect which DNS manager is in use by checking /etc/resolv.conf and runtime availability
@@ -151,25 +144,3 @@ func CleanupStaleState(interfaceName string) error {
 	logger.Info("Stale DNS state cleanup completed successfully")
 	return nil
 }
-
-// ForceResetDNS forcibly clears any DNS override state, whether or not the
-// current process installed it. This is intended for the "reset-dns" CLI
-// command and for the watchdog process to recover from a stuck override
-// left behind by a crashed client.
-func ForceResetDNS(interfaceName string) error {
-	logger.Info("Forcing DNS reset on Linux/FreeBSD (interface=%s)", interfaceName)
-
-	// First clean up any persisted state from a previous session.
-	cleanupErr := CleanupStaleState(interfaceName)
-
-	// Then, if the current process happens to hold a live configurator,
-	// instruct it to restore DNS as well so in-memory state is consistent.
-	if configurator != nil {
-		if err := configurator.RestoreDNS(); err != nil {
-			logger.Warn("ForceResetDNS: in-memory restore failed: %v", err)
-		}
-		configurator = nil
-	}
-
-	return cleanupErr
-}

dns/override/dns_override_windows.go

@@ -15,12 +15,6 @@ var configurator platform.DNSConfigurator
 // SetupDNSOverride configures the system DNS to use the DNS proxy on Windows
 // Uses registry-based configuration (automatically extracts interface GUID)
 func SetupDNSOverride(interfaceName string, proxyIp netip.Addr) error {
-	// Defensively clear any stale DNS state from a previous unclean shutdown
-	// before installing the new override.
-	if err := CleanupStaleState(interfaceName); err != nil {
-		logger.Warn("Pre-setup stale DNS cleanup failed (continuing): %v", err)
-	}
-
 	var err error
 	configurator, err = platform.NewWindowsDNSConfigurator(interfaceName)
 	if err != nil {
@@ -83,17 +77,3 @@ func CleanupStaleState(interfaceName string) error {
 	logger.Debug("Windows DNS cleanup: no stale state to clean (interface-specific)")
 	return nil
 }
-
-// ForceResetDNS forcibly clears any DNS override state. On Windows this is
-// largely a no-op because the registry override is tied to the interface
-// GUID and is reclaimed when the interface is torn down.
-func ForceResetDNS(interfaceName string) error {
-	logger.Info("Forcing DNS reset on Windows (interface=%s)", interfaceName)
-	if configurator != nil {
-		if err := configurator.RestoreDNS(); err != nil {
-			logger.Warn("ForceResetDNS: in-memory restore failed: %v", err)
-		}
-		configurator = nil
-	}
-	return CleanupStaleState(interfaceName)
-}

dns/override/watchdog.go

@@ -1,136 +0,0 @@
-package olm
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"time"
-
-	"github.com/fosrl/newt/logger"
-)
-
-// WatchdogConfig configures the DNS override watchdog. The watchdog runs as
-// an external process (spawned via SpawnWatchdog) and monitors a parent olm
-// process. When the parent appears to have died without restoring DNS, the
-// watchdog forcibly resets the system DNS configuration.
-type WatchdogConfig struct {
-	// ParentPID is the PID of the olm process that installed the DNS
-	// override. The watchdog exits when this PID is no longer alive.
-	ParentPID int
-
-	// SocketPath is the path to the olm Unix domain socket (or named pipe
-	// on Windows). The watchdog uses it as a secondary liveness signal.
-	// May be empty if no socket-based API is enabled.
-	SocketPath string
-
-	// InterfaceName is the name of the WireGuard interface whose DNS
-	// override should be reset on parent death.
-	InterfaceName string
-
-	// CheckInterval is how often to poll the parent's liveness.
-	// Defaults to 5 seconds when zero.
-	CheckInterval time.Duration
-
-	// FailureThreshold is the number of consecutive failed liveness checks
-	// before the watchdog declares the parent dead and resets DNS.
-	// Defaults to 3 when zero.
-	FailureThreshold int
-}
-
-// RunWatchdog runs the watchdog loop in the current process until either
-// (a) the parent dies and DNS is reset, or (b) ctx is cancelled.
-func RunWatchdog(ctx context.Context, cfg WatchdogConfig) error {
-	if cfg.ParentPID <= 0 {
-		return fmt.Errorf("watchdog: invalid parent PID %d", cfg.ParentPID)
-	}
-	if cfg.CheckInterval <= 0 {
-		cfg.CheckInterval = 5 * time.Second
-	}
-	if cfg.FailureThreshold <= 0 {
-		cfg.FailureThreshold = 3
-	}
-
-	logger.Info("DNS watchdog started: parent=%d interval=%s threshold=%d socket=%q interface=%q",
-		cfg.ParentPID, cfg.CheckInterval, cfg.FailureThreshold, cfg.SocketPath, cfg.InterfaceName)
-
-	ticker := time.NewTicker(cfg.CheckInterval)
-	defer ticker.Stop()
-
-	consecutiveFailures := 0
-
-	for {
-		select {
-		case <-ctx.Done():
-			logger.Info("DNS watchdog context cancelled, exiting cleanly")
-			return ctx.Err()
-		case <-ticker.C:
-		}
-
-		alive := isParentAlive(cfg.ParentPID, cfg.SocketPath)
-		if alive {
-			if consecutiveFailures > 0 {
-				logger.Debug("DNS watchdog: parent recovered after %d failures", consecutiveFailures)
-			}
-			consecutiveFailures = 0
-			continue
-		}
-
-		consecutiveFailures++
-		logger.Warn("DNS watchdog: parent liveness check failed (%d/%d)",
-			consecutiveFailures, cfg.FailureThreshold)
-
-		if consecutiveFailures >= cfg.FailureThreshold {
-			logger.Warn("DNS watchdog: parent declared dead, forcing DNS reset")
-			if err := ForceResetDNS(cfg.InterfaceName); err != nil {
-				logger.Error("DNS watchdog: ForceResetDNS failed: %v", err)
-				return err
-			}
-			logger.Info("DNS watchdog: DNS reset complete, exiting")
-			return nil
-		}
-	}
-}
-
-// isParentAlive returns true if the parent process appears to be alive. It
-// considers the parent alive if EITHER the PID is still running OR the
-// socket-based health endpoint responds. This dual check avoids false
-// positives where one signal is flaky (e.g., socket blocked but process
-// still recovering).
-func isParentAlive(pid int, socketPath string) bool {
-	if pidAlive(pid) {
-		return true
-	}
-	// Process is gone; double-check via socket to avoid races where PID
-	// recycling or signal-0 quirks lie to us. Socket should already be
-	// gone too.
-	if socketPath != "" && socketHealthy(socketPath) {
-		return true
-	}
-	return false
-}
-
-// socketHealthy attempts a fast /health request over the unix socket.
-func socketHealthy(socketPath string) bool {
-	if _, err := os.Stat(socketPath); err != nil {
-		return false
-	}
-
-	client := &http.Client{
-		Timeout: 2 * time.Second,
-		Transport: &http.Transport{
-			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-				d := net.Dialer{Timeout: 2 * time.Second}
-				return d.DialContext(ctx, "unix", socketPath)
-			},
-		},
-	}
-
-	resp, err := client.Get("http://localhost/health")
-	if err != nil {
-		return false
-	}
-	defer resp.Body.Close()
-	return resp.StatusCode == http.StatusOK
-}

dns/override/watchdog_spawn_unix.go

@@ -1,119 +0,0 @@
-//go:build !windows
-
-package olm
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"strconv"
-	"syscall"
-
-	"github.com/fosrl/newt/logger"
-)
-
-// SpawnWatchdogConfig captures the inputs needed to launch the external
-// watchdog subprocess that monitors the calling olm process and forces a
-// DNS reset if the parent dies before restoring DNS.
-type SpawnWatchdogConfig struct {
-	// Executable is the path to the binary that will host the watchdog
-	// (typically os.Executable()). The binary must understand the
-	// watchdog subcommand layout described below.
-	Executable string
-
-	// Subcommand is the argv prefix the binary uses to enter watchdog
-	// mode (e.g., []string{"watchdog"} or []string{"dns", "watchdog"}).
-	Subcommand []string
-
-	// InterfaceName is the WireGuard interface whose DNS override should
-	// be reset if the parent dies.
-	InterfaceName string
-
-	// SocketPath is the parent's olm API socket path (may be empty).
-	SocketPath string
-
-	// LogFile, if non-empty, is the path the watchdog writes its stdout
-	// and stderr to. If empty, /dev/null is used.
-	LogFile string
-}
-
-// SpawnWatchdog launches the watchdog subprocess in a detached process group
-// so that it survives the death of the parent. The returned *exec.Cmd is the
-// handle the parent should call StopWatchdog on during clean shutdown.
-//
-// The spawned process is invoked as:
-//
-//	<Executable> <Subcommand...> --parent-pid=<ppid> \
-//	    --interface=<InterfaceName> [--socket=<SocketPath>]
-//
-// Both pangolin (cli) and olm should map their watchdog subcommand to
-// RunWatchdog.
-func SpawnWatchdog(cfg SpawnWatchdogConfig) (*exec.Cmd, error) {
-	if cfg.Executable == "" {
-		return nil, fmt.Errorf("watchdog: executable is required")
-	}
-	if len(cfg.Subcommand) == 0 {
-		return nil, fmt.Errorf("watchdog: subcommand is required")
-	}
-
-	args := append([]string{}, cfg.Subcommand...)
-	args = append(args,
-		"--parent-pid="+strconv.Itoa(os.Getpid()),
-		"--interface="+cfg.InterfaceName,
-	)
-	if cfg.SocketPath != "" {
-		args = append(args, "--socket="+cfg.SocketPath)
-	}
-
-	cmd := exec.Command(cfg.Executable, args...)
-
-	// Detach: new session so the watchdog is not killed by a signal
-	// delivered to the parent's process group.
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Setsid: true,
-	}
-
-	// Direct watchdog output to a log file or /dev/null so it doesn't
-	// share file descriptors with the parent's TTY.
-	logTarget := cfg.LogFile
-	if logTarget == "" {
-		logTarget = os.DevNull
-	}
-	logFile, err := os.OpenFile(logTarget, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
-	if err != nil {
-		return nil, fmt.Errorf("watchdog: open log file: %w", err)
-	}
-	cmd.Stdin = nil
-	cmd.Stdout = logFile
-	cmd.Stderr = logFile
-
-	if err := cmd.Start(); err != nil {
-		_ = logFile.Close()
-		return nil, fmt.Errorf("watchdog: start: %w", err)
-	}
-
-	// We don't need our handle on the log file after the subprocess
-	// inherits it.
-	_ = logFile.Close()
-
-	logger.Info("DNS watchdog spawned (pid=%d, exe=%s)", cmd.Process.Pid, cfg.Executable)
-	return cmd, nil
-}
-
-// StopWatchdog asks the watchdog to exit cleanly via SIGTERM and reaps it.
-// Safe to call with a nil cmd.
-func StopWatchdog(cmd *exec.Cmd) {
-	if cmd == nil || cmd.Process == nil {
-		return
-	}
-	pid := cmd.Process.Pid
-	if err := cmd.Process.Signal(syscall.SIGTERM); err != nil {
-		logger.Debug("DNS watchdog stop signal failed (pid=%d): %v", pid, err)
-	}
-	// Reap in the background; we don't want to block shutdown if the
-	// watchdog is wedged.
-	go func() {
-		_ = cmd.Wait()
-		logger.Debug("DNS watchdog (pid=%d) reaped", pid)
-	}()
-}

dns/override/watchdog_spawn_windows.go

@@ -1,29 +0,0 @@
-//go:build windows
-
-package olm
-
-import (
-	"os/exec"
-)
-
-// SpawnWatchdogConfig is provided on Windows for API symmetry but the
-// watchdog itself is effectively a no-op there (see watchdog_windows.go).
-type SpawnWatchdogConfig struct {
-	Executable    string
-	Subcommand    []string
-	InterfaceName string
-	SocketPath    string
-	LogFile       string
-}
-
-// SpawnWatchdog is a no-op on Windows; DNS overrides are interface-GUID
-// scoped and reclaimed when the interface is removed.
-func SpawnWatchdog(cfg SpawnWatchdogConfig) (*exec.Cmd, error) {
-	_ = cfg
-	return nil, nil
-}
-
-// StopWatchdog is a no-op on Windows.
-func StopWatchdog(cmd *exec.Cmd) {
-	_ = cmd
-}

dns/override/watchdog_unix.go

@@ -1,25 +0,0 @@
-//go:build !windows
-
-package olm
-
-import (
-	"os"
-	"syscall"
-)
-
-// pidAlive returns true if the process with the given PID is still alive.
-// On Unix-like systems we use signal 0, which performs error checking but
-// does not deliver an actual signal.
-func pidAlive(pid int) bool {
-	if pid <= 0 {
-		return false
-	}
-	proc, err := os.FindProcess(pid)
-	if err != nil {
-		return false
-	}
-	if err := proc.Signal(syscall.Signal(0)); err != nil {
-		return false
-	}
-	return true
-}

dns/override/watchdog_windows.go

@@ -1,15 +0,0 @@
-//go:build windows
-
-package olm
-
-// pidAlive on Windows. Reliable PID probing on Windows requires syscall
-// OpenProcess with PROCESS_QUERY_LIMITED_INFORMATION followed by
-// GetExitCodeProcess, which is non-trivial. Since DNS override on Windows
-// is interface-GUID-scoped and is naturally cleaned up when the WireGuard
-// interface goes away, the watchdog is effectively a no-op on Windows.
-// We always report the parent as alive so the watchdog never tears down
-// DNS based on PID checks.
-func pidAlive(pid int) bool {
-	_ = pid
-	return true
-}

dns/platform/darwin.go

@@ -422,17 +422,6 @@ func (d *DarwinDNSConfigurator) clearState() error {
 // configurator from a previous unclean shutdown. This is a static function that can be
 // called without creating a configurator instance, useful for cleanup before network operations.
 func CleanupStaleDarwinDNS() error {
-	// Always sweep orphaned Olm scutil keys regardless of whether a state
-	// file exists. This protects against cases where the state file was
-	// lost (e.g., user home wiped, write failed) but DNS keys are still
-	// installed in the running scutil session.
-	defer func() {
-		_ = SweepOlmScutilKeys()
-		// Flush DNS cache after any sweep so changes take effect.
-		_ = exec.Command(dscacheutilPath, "-flushcache").Run()
-		_ = exec.Command("killall", "-HUP", "mDNSResponder").Run()
-	}()
-
 	stateFilePath := getDNSStateFilePath()
 
 	// Check if state file exists
@@ -484,59 +473,3 @@ func CleanupStaleDarwinDNS() error {
 
 	return nil
 }
-
-// SweepOlmScutilKeys enumerates scutil State:/Network/Service/Olm-* keys and
-// removes any that are present. This is a best-effort safety net used when
-// state files have been lost or never written.
-func SweepOlmScutilKeys() error {
-	// list scutil keys matching our naming convention
-	listOutput, err := runScutilOnce("list State:/Network/Service/Olm-.*/DNS\n")
-	if err != nil {
-		return fmt.Errorf("scutil list: %w", err)
-	}
-
-	var keys []string
-	scanner := bufio.NewScanner(bytes.NewReader(listOutput))
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		// scutil output format: subKey [0] = State:/Network/Service/Olm-Override/DNS
-		idx := strings.Index(line, "State:/Network/Service/Olm-")
-		if idx < 0 {
-			continue
-		}
-		key := strings.TrimSpace(line[idx:])
-		if key != "" {
-			keys = append(keys, key)
-		}
-	}
-
-	if len(keys) == 0 {
-		return nil
-	}
-
-	logger.Info("Sweeping %d orphaned Olm scutil DNS keys", len(keys))
-
-	var commands strings.Builder
-	for _, key := range keys {
-		commands.WriteString(fmt.Sprintf("remove %s\n", key))
-	}
-
-	if _, err := runScutilOnce(commands.String()); err != nil {
-		return fmt.Errorf("scutil sweep remove: %w", err)
-	}
-
-	return nil
-}
-
-// runScutilOnce runs a one-shot scutil command sequence wrapped with open/quit
-// without requiring a configurator instance.
-func runScutilOnce(commands string) ([]byte, error) {
-	wrapped := fmt.Sprintf("open\n%squit\n", commands)
-	cmd := exec.Command(scutilPath)
-	cmd.Stdin = strings.NewReader(wrapped)
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		return nil, fmt.Errorf("scutil command failed: %w, output: %s", err, output)
-	}
-	return output, nil
-}

dns/platform/network_manager.go

@@ -4,7 +4,6 @@ package dns
 
 import (
 	"context"
-	"encoding/binary"
 	"errors"
 	"fmt"
 	"net/netip"
@@ -17,25 +16,12 @@ import (
 
 const (
 	// NetworkManager D-Bus constants
-	networkManagerDest                        = "org.freedesktop.NetworkManager"
-	networkManagerDbusObjectNode              = "/org/freedesktop/NetworkManager"
-	networkManagerDbusDNSManagerInterface     = "org.freedesktop.NetworkManager.DnsManager"
-	networkManagerDbusDNSManagerObjectNode    = networkManagerDbusObjectNode + "/DnsManager"
-	networkManagerDbusDNSManagerModeProperty  = networkManagerDbusDNSManagerInterface + ".Mode"
-	networkManagerDbusVersionProperty         = "org.freedesktop.NetworkManager.Version"
-	networkManagerDbusActiveConnsProperty     = networkManagerDest + ".ActiveConnections"
-	networkManagerDbusActiveInterface         = "org.freedesktop.NetworkManager.Connection.Active"
-	networkManagerDbusActiveIP4ConfigProperty = networkManagerDbusActiveInterface + ".Ip4Config"
-	networkManagerDbusActiveIP6ConfigProperty = networkManagerDbusActiveInterface + ".Ip6Config"
-	networkManagerDbusActiveDevicesProperty   = networkManagerDbusActiveInterface + ".Devices"
-	networkManagerDbusIP4ConfigInterface      = "org.freedesktop.NetworkManager.IP4Config"
-	networkManagerDbusIP6ConfigInterface      = "org.freedesktop.NetworkManager.IP6Config"
-	networkManagerDbusDeviceInterface         = "org.freedesktop.NetworkManager.Device"
-	networkManagerDbusDeviceDhcp4ConfigProp   = networkManagerDbusDeviceInterface + ".Dhcp4Config"
-	networkManagerDbusDeviceDhcp6ConfigProp   = networkManagerDbusDeviceInterface + ".Dhcp6Config"
-	networkManagerDbusDhcp4ConfigInterface    = "org.freedesktop.NetworkManager.DHCP4Config"
-	networkManagerDbusDhcp6ConfigInterface    = "org.freedesktop.NetworkManager.DHCP6Config"
-	networkManagerDbusGetAppliedConnMethod    = networkManagerDbusDeviceInterface + ".GetAppliedConnection"
+	networkManagerDest                       = "org.freedesktop.NetworkManager"
+	networkManagerDbusObjectNode             = "/org/freedesktop/NetworkManager"
+	networkManagerDbusDNSManagerInterface    = "org.freedesktop.NetworkManager.DnsManager"
+	networkManagerDbusDNSManagerObjectNode   = networkManagerDbusObjectNode + "/DnsManager"
+	networkManagerDbusDNSManagerModeProperty = networkManagerDbusDNSManagerInterface + ".Mode"
+	networkManagerDbusVersionProperty        = "org.freedesktop.NetworkManager.Version"
 
 	// NetworkManager dispatcher script path
 	networkManagerDispatcherDir  = "/etc/NetworkManager/dispatcher.d"
@@ -315,220 +301,6 @@ func GetNetworkManagerDNSMode() (string, error) {
 	return mode, nil
 }
 
-// GetNetworkManagerNameservers returns the DNS servers NetworkManager knows
-// about for every active connection, read live via D-Bus.
-//
-// olm's own NetworkManager DNS override (see NetworkManagerDNSConfigurator)
-// works by writing a [global-dns-domain-*] section to
-// /etc/NetworkManager/conf.d/olm-dns.conf and reloading NetworkManager. That
-// is NetworkManager's global DNS override mechanism: it replaces the DNS
-// servers NetworkManager's DnsManager computes as "effective" system-wide,
-// for every connection - not just what gets written to /etc/resolv.conf. So
-// once olm's override is active, even each connection's merged
-// IP4Config/IP6Config.NameserverData (the previous, sole source used here)
-// can end up reporting olm's own proxy address instead of the real network
-// DNS.
-//
-// To recover the real DNS regardless, this also reads two further sources
-// that NetworkManager's DNS merging - and therefore olm's global-dns override
-// - never touches, since both are populated independently of it:
-//   - Dhcp4Config/Dhcp6Config.Options["*name_servers"]: the raw nameserver
-//     list straight from the DHCP lease.
-//   - Device.GetAppliedConnection()'s ipv4.dns/ipv6.dns: the DNS servers
-//     explicitly configured on the connection profile itself, e.g. a static
-//     DNS override set by the user directly in NetworkManager (the
-//     NetworkManager equivalent of a manually-set Windows adapter DNS).
-//
-// IP4Config/IP6Config.NameserverData is still queried too, as a fallback for
-// setups the other two don't cover. Any of olm's own address that leaks
-// through any of these sources is expected to be dropped by the caller via
-// SystemDNSMonitor.SetExcludeIP.
-func GetNetworkManagerNameservers() ([]netip.Addr, error) {
-	conn, err := dbus.SystemBus()
-	if err != nil {
-		return nil, fmt.Errorf("connect to system bus: %w", err)
-	}
-	defer conn.Close()
-
-	nm := conn.Object(networkManagerDest, networkManagerDbusObjectNode)
-
-	activeVariant, err := nm.GetProperty(networkManagerDbusActiveConnsProperty)
-	if err != nil {
-		return nil, fmt.Errorf("get active connections: %w", err)
-	}
-	activePaths, ok := activeVariant.Value().([]dbus.ObjectPath)
-	if !ok {
-		return nil, errors.New("ActiveConnections is not a list of object paths")
-	}
-
-	ipConfigSources := []struct {
-		activeProperty string
-		configIface    string
-	}{
-		{networkManagerDbusActiveIP4ConfigProperty, networkManagerDbusIP4ConfigInterface},
-		{networkManagerDbusActiveIP6ConfigProperty, networkManagerDbusIP6ConfigInterface},
-	}
-
-	seen := make(map[netip.Addr]bool)
-	var servers []netip.Addr
-	add := func(addr netip.Addr) {
-		addr = addr.Unmap()
-		if !addr.IsValid() || addr.IsLoopback() || addr.IsLinkLocalUnicast() {
-			return
-		}
-		if !seen[addr] {
-			seen[addr] = true
-			servers = append(servers, addr)
-		}
-	}
-
-	for _, activePath := range activePaths {
-		active := conn.Object(networkManagerDest, activePath)
-
-		for _, src := range ipConfigSources {
-			cfgVariant, err := active.GetProperty(src.activeProperty)
-			if err != nil {
-				continue
-			}
-			cfgPath, ok := cfgVariant.Value().(dbus.ObjectPath)
-			if !ok || cfgPath == "" || cfgPath == "/" {
-				continue
-			}
-
-			nsVariant, err := conn.Object(networkManagerDest, cfgPath).GetProperty(src.configIface + ".NameserverData")
-			if err != nil {
-				continue
-			}
-			entries, ok := nsVariant.Value().([]map[string]dbus.Variant)
-			if !ok {
-				continue
-			}
-			for _, entry := range entries {
-				addrVariant, ok := entry["address"]
-				if !ok {
-					continue
-				}
-				addrStr, ok := addrVariant.Value().(string)
-				if !ok {
-					continue
-				}
-				if addr, err := netip.ParseAddr(addrStr); err == nil {
-					add(addr)
-				}
-			}
-		}
-
-		devicesVariant, err := active.GetProperty(networkManagerDbusActiveDevicesProperty)
-		if err != nil {
-			continue
-		}
-		devicePaths, ok := devicesVariant.Value().([]dbus.ObjectPath)
-		if !ok {
-			continue
-		}
-
-		for _, devicePath := range devicePaths {
-			device := conn.Object(networkManagerDest, devicePath)
-
-			for _, addr := range dhcpLeaseNameservers(conn, device, networkManagerDbusDeviceDhcp4ConfigProp, networkManagerDbusDhcp4ConfigInterface, "domain_name_servers") {
-				add(addr)
-			}
-			for _, addr := range dhcpLeaseNameservers(conn, device, networkManagerDbusDeviceDhcp6ConfigProp, networkManagerDbusDhcp6ConfigInterface, "dhcp6_name_servers") {
-				add(addr)
-			}
-			for _, addr := range appliedConnectionNameservers(device) {
-				add(addr)
-			}
-		}
-	}
-
-	return servers, nil
-}
-
-// dhcpLeaseNameservers reads a space-separated nameserver list out of a
-// device's Dhcp4Config/Dhcp6Config Options, straight from the DHCP lease -
-// data NetworkManager's DNS merging (and therefore olm's own global-dns
-// override) never touches.
-func dhcpLeaseNameservers(conn *dbus.Conn, device dbus.BusObject, configProperty, configIface, optionsKey string) []netip.Addr {
-	cfgVariant, err := device.GetProperty(configProperty)
-	if err != nil {
-		return nil
-	}
-	cfgPath, ok := cfgVariant.Value().(dbus.ObjectPath)
-	if !ok || cfgPath == "" || cfgPath == "/" {
-		return nil
-	}
-
-	optsVariant, err := conn.Object(networkManagerDest, cfgPath).GetProperty(configIface + ".Options")
-	if err != nil {
-		return nil
-	}
-	opts, ok := optsVariant.Value().(map[string]dbus.Variant)
-	if !ok {
-		return nil
-	}
-	raw, ok := opts[optionsKey]
-	if !ok {
-		return nil
-	}
-	str, ok := raw.Value().(string)
-	if !ok {
-		return nil
-	}
-
-	var addrs []netip.Addr
-	for _, field := range strings.Fields(str) {
-		if addr, err := netip.ParseAddr(field); err == nil {
-			addrs = append(addrs, addr)
-		}
-	}
-	return addrs
-}
-
-// appliedConnectionNameservers reads the ipv4.dns/ipv6.dns servers configured
-// on the device's currently-applied connection profile - e.g. a static DNS
-// override set by the user directly in NetworkManager - independent of DHCP
-// and of olm's own global-dns override.
-func appliedConnectionNameservers(device dbus.BusObject) []netip.Addr {
-	var settings map[string]map[string]dbus.Variant
-	var versionID uint64
-	if err := device.Call(networkManagerDbusGetAppliedConnMethod, 0, uint32(0)).Store(&settings, &versionID); err != nil {
-		return nil
-	}
-
-	var addrs []netip.Addr
-
-	if ipv4, ok := settings["ipv4"]; ok {
-		if dnsVariant, ok := ipv4["dns"]; ok {
-			if raw, ok := dnsVariant.Value().([]uint32); ok {
-				for _, v := range raw {
-					var b [4]byte
-					// NetworkManager encodes IPv4 addresses in this setting as
-					// network-byte-order bytes reinterpreted as a native uint32.
-					binary.LittleEndian.PutUint32(b[:], v)
-					addrs = append(addrs, netip.AddrFrom4(b))
-				}
-			}
-		}
-	}
-
-	if ipv6, ok := settings["ipv6"]; ok {
-		if dnsVariant, ok := ipv6["dns"]; ok {
-			if raw, ok := dnsVariant.Value().([][]byte); ok {
-				for _, b := range raw {
-					if len(b) == 16 {
-						var arr [16]byte
-						copy(arr[:], b)
-						addrs = append(addrs, netip.AddrFrom16(arr))
-					}
-				}
-			}
-		}
-	}
-
-	return addrs
-}
-
 // GetNetworkManagerVersion returns the version of NetworkManager
 func GetNetworkManagerVersion() (string, error) {
 	conn, err := dbus.SystemBus()

dns/sysresolver.go

@@ -1,274 +0,0 @@
-package dns
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"sort"
-	"sync"
-	"time"
-
-	"github.com/fosrl/newt/logger"
-	"github.com/miekg/dns"
-)
-
-const defaultPollInterval = 30 * time.Second
-
-// dnsHealthCheckTimeout bounds how long we wait for a candidate DNS server to
-// answer a health-check query before considering it unusable.
-const dnsHealthCheckTimeout = 2 * time.Second
-
-// SystemDNSMonitor monitors the host system's DNS configuration and notifies
-// callers when it changes. The reported servers are in "host:port" format
-// (e.g. "8.8.8.8:53") and can be used directly as UpstreamDNS and PublicDNS.
-//
-// Platform behaviour:
-//   - Linux: reads /run/systemd/resolve/resolv.conf when present (updated by
-//     systemd-resolved on every DHCP change), then falls back to
-//     /etc/resolv.conf.olm.backup (written before olm overrides DNS), and
-//     finally /etc/resolv.conf.
-//   - macOS: reads the unscoped resolvers from `scutil --dns`, falling back
-//     to /etc/resolv.conf if scutil is unavailable. This includes olm's own
-//     supplemental scutil DNS override entry, which is expected to be
-//     filtered out via SetExcludeIP.
-//   - Windows: enumerates every network adapter's effective DNS servers
-//     (static if set, else DHCP-assigned) from the registry.
-//   - Other platforms: returns an empty list (no-op monitor).
-type SystemDNSMonitor struct {
-	mu         sync.RWMutex
-	current    []string // last health-checked, applied server list
-	lastRaw    []string // last raw (exclude-filtered but unvalidated) candidate list seen
-	onChange   func(servers []string)
-	interval   time.Duration
-	stopCh     chan struct{}
-	excludeMu  sync.RWMutex
-	excludeIPs map[netip.Addr]bool
-}
-
-// NewSystemDNSMonitor creates a new monitor. onChange is called with the new
-// server list whenever a change is detected; it is also called once from Start
-// with the initial values. A zero interval uses the 30-second default.
-func NewSystemDNSMonitor(interval time.Duration, onChange func(servers []string)) *SystemDNSMonitor {
-	if interval <= 0 {
-		interval = defaultPollInterval
-	}
-	return &SystemDNSMonitor{
-		interval:   interval,
-		onChange:   onChange,
-		stopCh:     make(chan struct{}),
-		excludeIPs: make(map[netip.Addr]bool),
-	}
-}
-
-// SetExcludeIP registers an IP address that must never appear in the reported
-// DNS server list. Call this after olm's DNS proxy is created to prevent the
-// proxy's own IP from being returned as an upstream server when the OS DNS has
-// been overridden to point at the proxy.
-func (m *SystemDNSMonitor) SetExcludeIP(ip netip.Addr) {
-	m.excludeMu.Lock()
-	m.excludeIPs[ip.Unmap()] = true
-	m.excludeMu.Unlock()
-}
-
-// Start reads the current system DNS immediately, fires onChange, then polls
-// in the background until Stop is called or ctx is cancelled.
-func (m *SystemDNSMonitor) Start(ctx context.Context) {
-	m.applyCandidates(m.readFiltered())
-	go m.run(ctx)
-}
-
-// Stop halts the background polling goroutine.
-func (m *SystemDNSMonitor) Stop() {
-	select {
-	case <-m.stopCh:
-	default:
-		close(m.stopCh)
-	}
-}
-
-// Current returns the most recently observed system DNS servers.
-func (m *SystemDNSMonitor) Current() []string {
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-	out := make([]string, len(m.current))
-	copy(out, m.current)
-	return out
-}
-
-// readFiltered calls the platform-specific readSystemDNS and removes any
-// addresses that have been excluded via SetExcludeIP. If all addresses are
-// excluded the function returns nil so the caller can retain the last
-// known-good value.
-func (m *SystemDNSMonitor) readFiltered() []string {
-	return m.filterExcluded(readSystemDNS())
-}
-
-// filterExcluded removes any addresses that have been excluded via
-// SetExcludeIP from servers. Used both for the internally-polled server list
-// (readFiltered) and for server lists reported externally (ReportExternal) by
-// platforms - Android, iOS - where olm cannot read the OS's DNS configuration
-// itself.
-func (m *SystemDNSMonitor) filterExcluded(servers []string) []string {
-	m.excludeMu.RLock()
-	excludeIPs := m.excludeIPs
-	m.excludeMu.RUnlock()
-
-	if len(excludeIPs) == 0 {
-		return servers
-	}
-
-	var filtered []string
-	for _, s := range servers {
-		host, _, err := net.SplitHostPort(s)
-		if err != nil {
-			filtered = append(filtered, s)
-			continue
-		}
-		addr, err := netip.ParseAddr(host)
-		if err != nil || excludeIPs[addr.Unmap()] {
-			continue
-		}
-		filtered = append(filtered, s)
-	}
-	return filtered
-}
-
-// ReportExternal applies an externally-observed DNS server list (e.g. from
-// Android's ConnectivityManager or iOS's SCDynamicStore, where the platform
-// itself - not olm - must detect the OS's real DNS configuration) through the
-// same exclude-IP filtering, health-check validation, and change-detection as
-// the internal poll loop, firing onChange if the result differs from the last
-// known value.
-func (m *SystemDNSMonitor) ReportExternal(servers []string) {
-	m.applyCandidates(m.filterExcluded(servers))
-}
-
-func (m *SystemDNSMonitor) run(ctx context.Context) {
-	ticker := time.NewTicker(m.interval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-m.stopCh:
-			return
-		case <-ticker.C:
-			m.applyCandidates(m.readFiltered())
-		}
-	}
-}
-
-// applyCandidates takes an exclude-filtered (but not yet health-checked) list
-// of candidate DNS servers - from either the internal poll loop or
-// ReportExternal - and, only if it differs from the last raw list seen (to
-// avoid re-running network health checks on every 30-second poll tick when
-// nothing has actually changed), health-checks it via filterUnreachable and
-// applies whatever passes, firing onChange if the result changed.
-//
-// If none of the candidates pass the health check, the previous known-good
-// value is retained rather than clobbered - this is what protects against
-// e.g. a carrier reporting a DNS server (such as T-Mobile's internal ULA
-// DNS64 resolvers) that is technically "the system DNS" but not actually
-// reachable/usable from wherever queries are sent.
-func (m *SystemDNSMonitor) applyCandidates(raw []string) {
-	if len(raw) == 0 {
-		return
-	}
-
-	m.mu.Lock()
-	if dnsSlicesEqual(m.lastRaw, raw) {
-		m.mu.Unlock()
-		logger.Debug("System DNS candidates unchanged, skipping health check: %v", raw)
-		return
-	}
-	m.lastRaw = raw
-	m.mu.Unlock()
-
-	logger.Debug("System DNS candidates changed, health-checking: %v", raw)
-	validated := filterUnreachable(raw)
-	if len(validated) == 0 {
-		logger.Warn("None of the detected DNS servers answered a health-check query, keeping previous value: %v", raw)
-		return
-	}
-
-	m.mu.Lock()
-	changed := !dnsSlicesEqual(m.current, validated)
-	if changed {
-		m.current = validated
-	}
-	m.mu.Unlock()
-
-	if changed && m.onChange != nil {
-		logger.Info("System DNS changed: %v", validated)
-		m.onChange(validated)
-	}
-}
-
-// dnsServerReachable is a seam for tests; production code always uses probeDNSServerErr.
-var dnsServerReachable = probeDNSServerErr
-
-// filterUnreachable validates that each candidate server actually answers a
-// DNS query before it's trusted, rather than statically guessing from the
-// address (e.g. rejecting all private/ULA addresses, which would also reject
-// a perfectly valid home router forwarding to a real resolver). Checks run
-// concurrently so multiple candidates don't serialize the timeout.
-func filterUnreachable(servers []string) []string {
-	if len(servers) == 0 {
-		return servers
-	}
-
-	reachable := make([]bool, len(servers))
-	errs := make([]error, len(servers))
-	var wg sync.WaitGroup
-	for i, server := range servers {
-		wg.Add(1)
-		go func(i int, server string) {
-			defer wg.Done()
-			reachable[i], errs[i] = dnsServerReachable(server)
-		}(i, server)
-	}
-	wg.Wait()
-
-	var result []string
-	for i, server := range servers {
-		if reachable[i] {
-			result = append(result, server)
-		} else {
-			logger.Debug("Discarding DNS server %s: failed health check: %v", server, errs[i])
-		}
-	}
-	return result
-}
-
-// probeDNSServerErr sends a minimal root NS query to confirm a candidate server
-// actually answers, without depending on any specific external hostname being
-// reachable (which could itself be blocked/filtered independently of whether
-// the resolver works). The returned error is kept (rather than just a bool) so
-// callers can log why a candidate was rejected (unreachable route, timeout, etc.).
-func probeDNSServerErr(server string) (bool, error) {
-	client := &dns.Client{Timeout: dnsHealthCheckTimeout}
-	msg := new(dns.Msg)
-	msg.SetQuestion(".", dns.TypeNS)
-	_, _, err := client.Exchange(msg, server)
-	return err == nil, err
-}
-
-// dnsSlicesEqual reports whether two server lists are equal regardless of order.
-func dnsSlicesEqual(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	ac := make([]string, len(a))
-	bc := make([]string, len(b))
-	copy(ac, a)
-	copy(bc, b)
-	sort.Strings(ac)
-	sort.Strings(bc)
-	for i := range ac {
-		if ac[i] != bc[i] {
-			return false
-		}
-	}
-	return true
-}

dns/sysresolver_android.go

@@ -1,18 +0,0 @@
-//go:build android
-
-package dns
-
-// readSystemDNS returns nil on Android: olm cannot read the OS's DNS
-// configuration itself here, so the app detects it (via ConnectivityManager)
-// and pushes it in through Olm.SetSystemDNS instead (see SystemDnsMonitor.java).
-//
-// This is a dedicated file (rather than falling through the general
-// sysresolver_stub.go catch-all) because wireguard-android's build passes
-// "-tags linux" to share Linux netlink code with Android, and that custom tag
-// makes "!linux" evaluate to false even on a real GOOS=android build, which
-// would otherwise make sysresolver_stub.go stop applying and leave
-// readSystemDNS undefined. An explicit "android" constraint isn't affected by
-// that, since nothing passes a conflicting "-tags android".
-func readSystemDNS() []string {
-	return nil
-}

dns/sysresolver_darwin.go

@@ -1,116 +0,0 @@
-//go:build darwin && !ios && !nosysresolver
-
-package dns
-
-import (
-	"bufio"
-	"net"
-	"net/netip"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-// scutilPath is the well-known location of scutil on macOS.
-const scutilPath = "/usr/sbin/scutil"
-
-// readSystemDNS returns the current system DNS servers in "host:53" format.
-//
-// olm's own DNS override is itself a scutil supplemental resolver (see
-// dns/platform/darwin.go), and macOS gives supplemental resolvers priority
-// over the primary network service's resolver when generating the merged
-// configuration - which is also what gets mirrored into /etc/resolv.conf.  So
-// once olm's override is active, /etc/resolv.conf (and a naive read of just
-// the top of "scutil --dns") reflects olm's own proxy address, not the
-// physical network's real DNS.
-//
-// Instead this reads every resolver in the unscoped "DNS configuration"
-// section of `scutil --dns` (the "(for scoped queries)" section that follows
-// only duplicates per-interface resolvers and is skipped), which includes
-// both the real physical-network resolver and olm's own supplemental one.
-// olm's own address is expected to be filtered out by the caller via
-// SystemDNSMonitor.SetExcludeIP, the same mechanism used on Windows to drop
-// olm's own adapter DNS entry.
-//
-// /etc/resolv.conf is kept as a fallback for when scutil is unavailable.
-func readSystemDNS() []string {
-	if out, err := exec.Command(scutilPath, "--dns").Output(); err == nil {
-		if servers := parseScutilDNS(string(out)); len(servers) > 0 {
-			return servers
-		}
-	}
-	return parseMacResolvConf("/etc/resolv.conf")
-}
-
-// parseScutilDNS extracts nameserver addresses from the unscoped "DNS
-// configuration" section at the top of `scutil --dns` output, stopping at
-// the "DNS configuration (for scoped queries)" section that follows it.
-func parseScutilDNS(output string) []string {
-	var result []string
-	seen := make(map[string]bool)
-
-	scanner := bufio.NewScanner(strings.NewReader(output))
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if strings.HasPrefix(line, "DNS configuration (for scoped queries)") {
-			break
-		}
-		if !strings.HasPrefix(line, "nameserver[") {
-			continue
-		}
-
-		parts := strings.SplitN(line, ":", 2)
-		if len(parts) != 2 {
-			continue
-		}
-		addr, err := netip.ParseAddr(strings.TrimSpace(parts[1]))
-		if err != nil {
-			continue
-		}
-		if addr.IsLoopback() || addr.IsLinkLocalUnicast() {
-			continue
-		}
-		hp := net.JoinHostPort(addr.String(), "53")
-		if !seen[hp] {
-			seen[hp] = true
-			result = append(result, hp)
-		}
-	}
-	return result
-}
-
-func parseMacResolvConf(path string) []string {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil
-	}
-	defer f.Close()
-
-	var result []string
-	seen := make(map[string]bool)
-
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if !strings.HasPrefix(line, "nameserver") {
-			continue
-		}
-		fields := strings.Fields(line)
-		if len(fields) < 2 {
-			continue
-		}
-		addr, err := netip.ParseAddr(fields[1])
-		if err != nil {
-			continue
-		}
-		if addr.IsLoopback() || addr.IsLinkLocalUnicast() {
-			continue
-		}
-		s := net.JoinHostPort(addr.String(), "53")
-		if !seen[s] {
-			seen[s] = true
-			result = append(result, s)
-		}
-	}
-	return result
-}

dns/sysresolver_darwin_nosysresolver.go

@@ -1,17 +0,0 @@
-//go:build darwin && !ios && nosysresolver
-
-package dns
-
-// readSystemDNS is disabled by the nosysresolver build tag. This is used for
-// the macOS app build: unlike the CLI, the app's PacketTunnel system
-// extension additionally applies NEDNSSettings (see apple/PacketTunnel),
-// which can become the system's primary resolver and make /etc/resolv.conf
-// reflect olm's own proxy IP instead of the real upstream DNS. Rather than
-// have olm poll a value that may be self-referential, the app pushes the
-// real DNS servers in via SetSystemDNS (detected in Swift via
-// SCDynamicStore) exactly like Android and iOS. The CLI keeps the real
-// implementation in sysresolver_darwin.go, since it has no such override
-// mechanism and /etc/resolv.conf always reflects the physical network there.
-func readSystemDNS() []string {
-	return nil
-}

dns/sysresolver_ios.go

@@ -1,18 +0,0 @@
-//go:build ios
-
-package dns
-
-// readSystemDNS returns nil on iOS: olm cannot read the OS's DNS
-// configuration itself here, so the app must detect it and push it in
-// through the equivalent of Olm.SetSystemDNS instead.
-//
-// This is a dedicated file (rather than falling through the general
-// sysresolver_stub.go catch-all) because Go's build constraint evaluator
-// treats GOOS=ios as implicitly satisfying the "darwin" tag as well as
-// "ios". sysresolver_stub.go excludes with "!darwin", which is false for an
-// iOS build, so the stub silently stops applying and would leave
-// readSystemDNS undefined. An explicit "ios" constraint isn't affected by
-// that ambiguity.
-func readSystemDNS() []string {
-	return nil
-}

dns/sysresolver_linux.go

@@ -1,129 +0,0 @@
-//go:build linux && !android
-
-package dns
-
-import (
-	"bufio"
-	"net"
-	"net/netip"
-	"os"
-	"strings"
-
-	platform "github.com/fosrl/olm/dns/platform"
-)
-
-// readSystemDNS returns the current system DNS servers in "host:53" format.
-//
-// Resolution order:
-//  1. /run/systemd/resolve/resolv.conf, but only when systemd-resolved is
-//     actually running (checked live via D-Bus) — the file lives in /run and
-//     can linger there, frozen at whatever it last contained, long after the
-//     service that maintained it has stopped (e.g. it ran earlier in the
-//     boot and was since disabled). Trusting its mere existence would report
-//     that stale snapshot forever instead of falling through to a live
-//     source. When the service is actually up the file is maintained with
-//     the real per-link DNS servers, updated on every DHCP change and never
-//     touched by olm's D-Bus DNS override.
-//  2. NetworkManager, queried live over D-Bus — NetworkManager's own view of
-//     each active connection's DNS servers, independent of what is currently
-//     written to /etc/resolv.conf. This covers NetworkManager's "dnsmasq" and
-//     "unbound" DNS modes, where /etc/resolv.conf only contains a loopback
-//     stub address, and stays accurate even if olm's own override has
-//     directly overwritten /etc/resolv.conf, without going stale the way a
-//     one-time backup snapshot would if the real DNS changes mid-override
-//     (e.g. the user switches WiFi networks). olm's own NetworkManager
-//     override is itself a NetworkManager-level global DNS override (see
-//     platform.GetNetworkManagerNameservers), so this also reads each
-//     device's raw DHCP lease and applied-connection settings, which that
-//     override does not touch, to recover the real servers.
-//  3. /etc/resolv.conf.olm.backup — written by olm before it overrides
-//     /etc/resolv.conf on non-systemd systems, for when NetworkManager isn't
-//     in use at all.
-//  4. /etc/resolv.conf — plain fallback.
-//
-// Loopback and link-local addresses (e.g. 127.0.0.53, ::1) are excluded
-// because they are stub resolver addresses, not real upstream servers.
-func readSystemDNS() []string {
-	// Prefer systemd-resolved's resolved (non-stub) resolv.conf, but only if
-	// systemd-resolved is actually alive right now - see resolution order
-	// note above on why the file's existence alone isn't enough.
-	if platform.IsSystemdResolvedAvailable() {
-		if servers := parseResolvConf("/run/systemd/resolve/resolv.conf"); len(servers) > 0 {
-			return servers
-		}
-	}
-
-	if servers := readNetworkManagerDNS(); len(servers) > 0 {
-		return servers
-	}
-
-	// If olm has already overridden /etc/resolv.conf the backup holds the
-	// original pre-override DNS servers.
-	if _, err := os.Stat("/etc/resolv.conf.olm.backup"); err == nil {
-		if servers := parseResolvConf("/etc/resolv.conf.olm.backup"); len(servers) > 0 {
-			return servers
-		}
-	}
-
-	return parseResolvConf("/etc/resolv.conf")
-}
-
-// readNetworkManagerDNS returns the DNS servers NetworkManager reports over
-// D-Bus for its active connections, in "host:53" format. Returns nil if
-// NetworkManager isn't running or reports nothing usable.
-func readNetworkManagerDNS() []string {
-	addrs, err := platform.GetNetworkManagerNameservers()
-	if err != nil || len(addrs) == 0 {
-		return nil
-	}
-
-	result := make([]string, 0, len(addrs))
-	for _, addr := range addrs {
-		result = append(result, addrToHostPort(addr))
-	}
-	return result
-}
-
-// parseResolvConf reads nameserver lines from a resolv.conf-style file,
-// skipping loopback and link-local addresses.
-func parseResolvConf(path string) []string {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil
-	}
-	defer f.Close()
-
-	var result []string
-	seen := make(map[string]bool)
-
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if !strings.HasPrefix(line, "nameserver") {
-			continue
-		}
-		fields := strings.Fields(line)
-		if len(fields) < 2 {
-			continue
-		}
-		addr, err := netip.ParseAddr(fields[1])
-		if err != nil {
-			continue
-		}
-		if addr.IsLoopback() || addr.IsLinkLocalUnicast() {
-			continue
-		}
-		s := addrToHostPort(addr)
-		if !seen[s] {
-			seen[s] = true
-			result = append(result, s)
-		}
-	}
-	return result
-}
-
-// addrToHostPort converts a netip.Addr to "addr:53" format, wrapping IPv6
-// addresses in brackets as required by net.JoinHostPort.
-func addrToHostPort(addr netip.Addr) string {
-	return net.JoinHostPort(addr.String(), "53")
-}

dns/sysresolver_stub.go

@@ -1,23 +0,0 @@
-//go:build !linux && !darwin && !windows && !android
-
-package dns
-
-// readSystemDNS returns nil on platforms where automatic DNS discovery is not
-// implemented (freebsd, etc.).  Callers should fall back to a statically
-// configured DNS server.
-//
-// android and ios are excluded from this constraint (and have their own
-// sysresolver_android.go / sysresolver_ios.go with an explicit "android" /
-// "ios" tag) rather than falling through the "!linux" / "!darwin" catch-all
-// here:
-//   - wireguard-android's build passes "-tags linux" to share Linux netlink code
-//     (a deliberate, long-standing convention, since Android's kernel is Linux), and Go's
-//     build constraint evaluator can't distinguish a custom "-tags linux" from the real
-//     GOOS=linux - so with that tag set, "!linux" is false even though GOOS is actually
-//     android, and this file would silently stop applying, leaving readSystemDNS undefined.
-//   - Go's build constraint evaluator treats GOOS=ios as implicitly satisfying the
-//     "darwin" tag as well as "ios", so "!darwin" is false on an iOS build too, which
-//     would otherwise leave readSystemDNS undefined there as well.
-func readSystemDNS() []string {
-	return nil
-}

dns/sysresolver_test.go

@@ -1,149 +0,0 @@
-package dns
-
-import (
-	"net/netip"
-	"reflect"
-	"testing"
-)
-
-// stubReachable overrides dnsServerReachable for the duration of the test so
-// tests don't depend on real network access, restoring the original on
-// cleanup.
-func stubReachable(t *testing.T, fn func(server string) bool) {
-	t.Helper()
-	orig := dnsServerReachable
-	dnsServerReachable = func(server string) (bool, error) { return fn(server), nil }
-	t.Cleanup(func() { dnsServerReachable = orig })
-}
-
-func allReachable(t *testing.T) {
-	stubReachable(t, func(string) bool { return true })
-}
-
-func TestReportExternalFiltersExcludedIP(t *testing.T) {
-	allReachable(t)
-
-	var got []string
-	m := &SystemDNSMonitor{
-		excludeIPs: make(map[netip.Addr]bool),
-		onChange: func(servers []string) {
-			got = servers
-		},
-	}
-	m.SetExcludeIP(netip.MustParseAddr("10.0.0.1"))
-
-	m.ReportExternal([]string{"10.0.0.1:53", "8.8.8.8:53"})
-
-	want := []string{"8.8.8.8:53"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("onChange servers = %v, want %v", got, want)
-	}
-	if !reflect.DeepEqual(m.Current(), want) {
-		t.Fatalf("Current() = %v, want %v", m.Current(), want)
-	}
-}
-
-func TestReportExternalAllExcludedIsNoop(t *testing.T) {
-	allReachable(t)
-
-	called := false
-	m := &SystemDNSMonitor{
-		excludeIPs: make(map[netip.Addr]bool),
-		current:    []string{"1.1.1.1:53"},
-		onChange: func(servers []string) {
-			called = true
-		},
-	}
-	m.SetExcludeIP(netip.MustParseAddr("10.0.0.1"))
-
-	m.ReportExternal([]string{"10.0.0.1:53"})
-
-	if called {
-		t.Fatal("onChange should not fire when all reported servers are excluded")
-	}
-	want := []string{"1.1.1.1:53"}
-	if !reflect.DeepEqual(m.Current(), want) {
-		t.Fatalf("Current() = %v, want unchanged %v", m.Current(), want)
-	}
-}
-
-func TestReportExternalOnlyFiresOnChange(t *testing.T) {
-	allReachable(t)
-
-	calls := 0
-	m := &SystemDNSMonitor{
-		excludeIPs: make(map[netip.Addr]bool),
-		onChange: func(servers []string) {
-			calls++
-		},
-	}
-
-	m.ReportExternal([]string{"8.8.8.8:53"})
-	m.ReportExternal([]string{"8.8.8.8:53"})
-
-	if calls != 1 {
-		t.Fatalf("onChange fired %d times, want 1", calls)
-	}
-}
-
-func TestReportExternalDropsUnreachableServer(t *testing.T) {
-	// Simulates e.g. T-Mobile's private ULA DNS64 resolver: technically "the
-	// system DNS" per the OS, but doesn't actually answer queries.
-	stubReachable(t, func(server string) bool {
-		return server != "[fd00:976a::9]:53"
-	})
-
-	var got []string
-	m := &SystemDNSMonitor{
-		excludeIPs: make(map[netip.Addr]bool),
-		onChange: func(servers []string) {
-			got = servers
-		},
-	}
-
-	m.ReportExternal([]string{"[fd00:976a::9]:53", "8.8.8.8:53"})
-
-	want := []string{"8.8.8.8:53"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("onChange servers = %v, want %v", got, want)
-	}
-}
-
-func TestReportExternalKeepsPreviousValueWhenAllUnreachable(t *testing.T) {
-	stubReachable(t, func(string) bool { return true })
-
-	called := false
-	m := &SystemDNSMonitor{
-		excludeIPs: make(map[netip.Addr]bool),
-		current:    []string{"1.1.1.1:53"},
-		onChange: func(servers []string) {
-			called = true
-		},
-	}
-
-	// Now simulate every candidate failing the health check (e.g. moved to a
-	// network where none of the reported servers actually respond).
-	stubReachable(t, func(string) bool { return false })
-
-	m.ReportExternal([]string{"[fd00:976a::9]:53", "[fd00:976a::10]:53"})
-
-	if called {
-		t.Fatal("onChange should not fire when no candidate passes the health check")
-	}
-	want := []string{"1.1.1.1:53"}
-	if !reflect.DeepEqual(m.Current(), want) {
-		t.Fatalf("Current() = %v, want unchanged %v", m.Current(), want)
-	}
-}
-
-func TestFilterUnreachable(t *testing.T) {
-	stubReachable(t, func(server string) bool {
-		return server == "8.8.8.8:53"
-	})
-
-	got := filterUnreachable([]string{"10.0.0.1:53", "8.8.8.8:53", "9.9.9.9:53"})
-	want := []string{"8.8.8.8:53"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("filterUnreachable() = %v, want %v", got, want)
-	}
-}

dns/sysresolver_windows.go

@@ -1,110 +0,0 @@
-//go:build windows
-
-package dns
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-
-	"golang.org/x/sys/windows/registry"
-)
-
-const (
-	tcpipInterfacesPath = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	dhcpNameServerKey   = "DhcpNameServer"
-	staticNameServerKey = "NameServer"
-)
-
-// readSystemDNS returns the current system DNS servers in "host:53" format by
-// enumerating every network adapter in the Windows registry.
-//
-// For each adapter olm reads the effective DNS servers: static (NameServer)
-// if set, since a static entry overrides DHCP for that adapter and is what
-// the OS resolver actually uses, otherwise falling back to the DHCP-assigned
-// servers (DhcpNameServer). This also picks up olm's own WireGuard adapter,
-// which olm points at its local DNS proxy via a static NameServer entry; that
-// address is expected to be filtered out by the caller via
-// SystemDNSMonitor.SetExcludeIP. Loopback and link-local addresses are
-// excluded.
-func readSystemDNS() []string {
-	key, err := registry.OpenKey(registry.LOCAL_MACHINE, tcpipInterfacesPath, registry.ENUMERATE_SUB_KEYS)
-	if err != nil {
-		return nil
-	}
-	defer key.Close()
-
-	subkeys, err := key.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil
-	}
-
-	seen := make(map[string]bool)
-	var result []string
-
-	for _, guid := range subkeys {
-		path := fmt.Sprintf(`%s\%s`, tcpipInterfacesPath, guid)
-		iKey, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
-		if err != nil {
-			continue
-		}
-
-		servers, _, err := iKey.GetStringValue(staticNameServerKey)
-		if err != nil || servers == "" {
-			servers, _, err = iKey.GetStringValue(dhcpNameServerKey)
-		}
-		iKey.Close()
-		if err != nil || servers == "" {
-			continue
-		}
-
-		for _, s := range splitWinDNSList(servers) {
-			addr, err := netip.ParseAddr(s)
-			if err != nil {
-				continue
-			}
-			if addr.IsLoopback() || addr.IsLinkLocalUnicast() {
-				continue
-			}
-			hp := net.JoinHostPort(addr.String(), "53")
-			if !seen[hp] {
-				seen[hp] = true
-				result = append(result, hp)
-			}
-		}
-	}
-
-	return result
-}
-
-// splitWinDNSList splits a Windows DNS server list that may be comma- or
-// space-separated.
-func splitWinDNSList(s string) []string {
-	var out []string
-	for _, part := range splitByRunes(s, []rune{',', ' '}) {
-		if part != "" {
-			out = append(out, part)
-		}
-	}
-	return out
-}
-
-func splitByRunes(s string, delims []rune) []string {
-	var result []string
-	start := 0
-	for i, r := range s {
-		for _, d := range delims {
-			if r == d {
-				if i > start {
-					result = append(result, s[start:i])
-				}
-				start = i + len(string(r))
-				break
-			}
-		}
-	}
-	if start < len(s) {
-		result = append(result, s[start:])
-	}
-	return result
-}

dns_commands.go

@@ -1,68 +0,0 @@
-package main
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"time"
-
-	"github.com/fosrl/newt/logger"
-	dnsOverride "github.com/fosrl/olm/dns/override"
-)
-
-const (
-	defaultWatchdogInterval  = 5 * time.Second
-	defaultWatchdogThreshold = 3
-)
-
-// runDNSWatchdogCommand handles the `olm watchdog` subcommand. The watchdog
-// is meant to be spawned by an olm process after it installs a DNS
-// override, and forcibly resets the system DNS if that parent dies before
-// restoring it.
-func runDNSWatchdogCommand(ctx context.Context, args []string) error {
-	fs := flag.NewFlagSet("watchdog", flag.ContinueOnError)
-	parentPID := fs.Int("parent-pid", 0, "PID of the olm process to monitor")
-	socketPath := fs.String("socket", "", "Path to the olm API unix socket (optional)")
-	interfaceName := fs.String("interface", "", "WireGuard interface name (used for cleanup)")
-	interval := fs.Duration("interval", defaultWatchdogInterval, "Liveness check interval")
-	threshold := fs.Int("threshold", defaultWatchdogThreshold, "Consecutive failures before DNS reset")
-
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	if *parentPID <= 0 {
-		return fmt.Errorf("--parent-pid is required and must be positive")
-	}
-
-	// Ensure logger is initialised for the watchdog process.
-	logger.Init(nil)
-
-	return dnsOverride.RunWatchdog(ctx, dnsOverride.WatchdogConfig{
-		ParentPID:        *parentPID,
-		SocketPath:       *socketPath,
-		InterfaceName:    *interfaceName,
-		CheckInterval:    *interval,
-		FailureThreshold: *threshold,
-	})
-}
-
-// runResetDNSCommand handles the `olm reset-dns` subcommand. It forcibly
-// removes any DNS override state left behind on the system.
-func runResetDNSCommand(args []string) error {
-	fs := flag.NewFlagSet("reset-dns", flag.ContinueOnError)
-	interfaceName := fs.String("interface", "olm", "WireGuard interface name")
-
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	logger.Init(nil)
-
-	if err := dnsOverride.ForceResetDNS(*interfaceName); err != nil {
-		return err
-	}
-
-	fmt.Println("DNS reset complete")
-	return nil
-}

go.mod

@@ -4,15 +4,15 @@ go 1.25.0
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/fosrl/newt v1.15.0
+	github.com/fosrl/newt v1.10.3
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/gorilla/websocket v1.5.3
-	github.com/miekg/dns v1.1.70
-	golang.org/x/sys v0.46.0
+	github.com/miekg/dns v1.1.72
+	golang.org/x/sys v0.41.0
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c
-	software.sslmate.com/src/go-pkcs12 v0.7.3
+	software.sslmate.com/src/go-pkcs12 v0.7.1
 )
 
 require (
@@ -20,15 +20,15 @@ require (
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/vishvananda/netlink v1.3.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect
+	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
 )
 
 // To be used ONLY for local development

go.sum

@@ -1,7 +1,7 @@
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/fosrl/newt v1.15.0 h1:WpL0whZM1FMjUe2Vy5jSH1bgbxm1O9k1qCyF/mqZT+s=
-github.com/fosrl/newt v1.15.0/go.mod h1:l6kWoZPSaXT+ZRUjiyPgwflRqZWYaXpUj9oQ0sOPh4o=
+github.com/fosrl/newt v1.10.3 h1:JO9gFK9LP/w2EeDIn4wU+jKggAFPo06hX5hxFSETqcw=
+github.com/fosrl/newt v1.10.3/go.mod h1:iYuuCAG7iabheiogMOX87r61uQN31S39nKxMKRuLS+s=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
@@ -10,39 +10,39 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
-github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 h1:zfMcR1Cs4KNuomFFgGefv5N0czO2XZpUbxGUy8i8ug0=
 golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6/go.mod h1:46edojNIoXTNOhySWIWdix628clX9ODXwPsQuG6hsK0=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
 golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
-golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
-golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
+golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
+golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI=
 gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
-software.sslmate.com/src/go-pkcs12 v0.7.3 h1:JBQD3FDqYjTeyDAeZQklj2ar88ykBLtALloPJHyAauU=
-software.sslmate.com/src/go-pkcs12 v0.7.3/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
+software.sslmate.com/src/go-pkcs12 v0.7.1 h1:bxkUPRsvTPNRBZa4M/aSX4PyMOEbq3V8I6hbkG4F4Q8=
+software.sslmate.com/src/go-pkcs12 v0.7.1/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=

main.go

@@ -164,26 +164,6 @@ func main() {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	// Internal DNS subcommands. These are handled before normal flag
-	// parsing because they have their own argument layouts and need to
-	// run without setting up the full olm runtime.
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "watchdog", "dns-watchdog":
-			if err := runDNSWatchdogCommand(signalCtx, os.Args[2:]); err != nil {
-				fmt.Fprintf(os.Stderr, "watchdog failed: %v\n", err)
-				os.Exit(1)
-			}
-			return
-		case "reset-dns":
-			if err := runResetDNSCommand(os.Args[2:]); err != nil {
-				fmt.Fprintf(os.Stderr, "reset-dns failed: %v\n", err)
-				os.Exit(1)
-			}
-			return
-		}
-	}
-
 	// Run in console mode
 	runOlmMainWithArgs(ctx, cancel, signalCtx, os.Args[1:])
 }
@@ -241,8 +221,6 @@ func runOlmMainWithArgs(ctx context.Context, cancel context.CancelFunc, signalCt
 		OnExit:       cancel, // Pass cancel function directly to trigger shutdown
 		OnTerminated: cancel,
 		PprofAddr:    ":4444", // TODO: REMOVE OR MAKE CONFIGURABLE
-		// Re-invoke this binary in watchdog mode to clean up DNS if we die.
-		WatchdogSubcommand: []string{"watchdog"},
 	}
 
 	olm, err := olmpkg.Init(ctx, olmConfig)
@@ -263,7 +241,6 @@ func runOlmMainWithArgs(ctx context.Context, cancel context.CancelFunc, signalCt
 			MTU:                  config.MTU,
 			DNS:                  config.DNS,
 			UpstreamDNS:          config.UpstreamDNS,
-			MatchDomains:         config.MatchDomains,
 			InterfaceName:        config.InterfaceName,
 			Holepunch:            !config.DisableHolepunch,
 			TlsClientCert:        config.TlsClientCert,
@@ -272,7 +249,6 @@ func runOlmMainWithArgs(ctx context.Context, cancel context.CancelFunc, signalCt
 			OrgID:                config.OrgID,
 			OverrideDNS:          config.OverrideDNS,
 			DisableRelay:         config.DisableRelay,
-			PreferLocalRoutes:    config.PreferLocalRoutes,
 			EnableUAPI:           true,
 		}
 		go olm.StartTunnel(tunnelConfig)

olm/connect.go

@@ -145,19 +145,11 @@ func (o *Olm) handleConnect(msg websocket.WSMessage) {
 	}
 
 	// Create and start DNS proxy
-	o.dnsProxy, err = dns.NewDNSProxy(o.middleDev, o.tunnelConfig.MTU, wgData.UtilitySubnet, o.tunnelConfig.UpstreamDNS, o.tunnelConfig.TunnelDNS, interfaceIP, o.tunnelConfig.MatchDomains, o.tunnelConfig.PublicDNS)
+	o.dnsProxy, err = dns.NewDNSProxy(o.middleDev, o.tunnelConfig.MTU, wgData.UtilitySubnet, o.tunnelConfig.UpstreamDNS, o.tunnelConfig.TunnelDNS, interfaceIP)
 	if err != nil {
 		logger.Error("Failed to create DNS proxy: %v", err)
 	}
 
-	// Tell the system DNS monitor to exclude the proxy IP so that subsequent
-	// polls never mistake the proxy for a real upstream server (on Linux the OS
-	// DNS is overridden to point at this IP, which would otherwise feed back
-	// into UpstreamDNS or PublicDNS on the next poll).
-	if o.dnsMonitor != nil && o.dnsProxy != nil {
-		o.dnsMonitor.SetExcludeIP(o.dnsProxy.GetProxyIP())
-	}
-
 	if err = network.ConfigureInterface(o.tunnelConfig.InterfaceName, wgData.TunnelIP, o.tunnelConfig.MTU); err != nil {
 		logger.Error("Failed to o.tunnelConfigure interface: %v", err)
 	}
@@ -192,7 +184,7 @@ func (o *Olm) handleConnect(msg websocket.WSMessage) {
 				siteEndpoint = site.Endpoint
 			}
 
-			o.apiServer.AddPeerStatus(site.SiteId, site.Name, false, 0, siteEndpoint, false, false)
+			o.apiServer.AddPeerStatus(site.SiteId, site.Name, false, 0, siteEndpoint, false)
 		}
 
 		// we still call this to add the aliases for jit lookup but we just do that then pass inside. need to skip the above so we dont add to the api
@@ -213,13 +205,12 @@ func (o *Olm) handleConnect(msg websocket.WSMessage) {
 	// Register JIT handler: when the DNS proxy resolves a local record, check whether
 	// the owning site is already connected and, if not, initiate a JIT connection.
 	o.dnsProxy.SetJITHandler(func(siteId int) {
-		pm := o.getPeerManager()
-		if pm == nil || o.websocket == nil {
+		if o.peerManager == nil || o.websocket == nil {
 			return
 		}
 
 		// Site already has an active peer connection - nothing to do.
-		if _, exists := pm.GetPeer(siteId); exists {
+		if _, exists := o.peerManager.GetPeer(siteId); exists {
 			return
 		}
 
@@ -248,12 +239,6 @@ func (o *Olm) handleConnect(msg websocket.WSMessage) {
 			return
 		}
 
-		// Start the external watchdog (if configured). The watchdog will
-		// reset DNS if this process dies before it can call
-		// RestoreDNSOverride. This is a no-op when no watchdog
-		// subcommand has been configured on the OlmConfig.
-		o.startDNSWatchdog(o.tunnelConfig.InterfaceName)
-
 		network.SetDNSServers([]string{o.dnsProxy.GetProxyIP().String()})
 	}
 

olm/data.go

@@ -32,27 +32,21 @@ func (o *Olm) handleWgPeerAddData(msg websocket.WSMessage) {
 		return
 	}
 
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring add-remote-subnets-aliases message: peerManager is nil (shutdown in progress)")
-		return
-	}
-
-	if _, exists := pm.GetPeer(addSubnetsData.SiteId); !exists {
+	if _, exists := o.peerManager.GetPeer(addSubnetsData.SiteId); !exists {
 		logger.Debug("Peer %d not found for removing remote subnets and aliases", addSubnetsData.SiteId)
 		return
 	}
 
 	// Add new subnets
 	for _, subnet := range addSubnetsData.RemoteSubnets {
-		if err := pm.AddRemoteSubnet(addSubnetsData.SiteId, subnet); err != nil {
+		if err := o.peerManager.AddRemoteSubnet(addSubnetsData.SiteId, subnet); err != nil {
 			logger.Error("Failed to add allowed IP %s: %v", subnet, err)
 		}
 	}
 
 	// Add new aliases
 	for _, alias := range addSubnetsData.Aliases {
-		if err := pm.AddAlias(addSubnetsData.SiteId, alias); err != nil {
+		if err := o.peerManager.AddAlias(addSubnetsData.SiteId, alias); err != nil {
 			logger.Error("Failed to add alias %s: %v", alias.Alias, err)
 		}
 	}
@@ -79,27 +73,21 @@ func (o *Olm) handleWgPeerRemoveData(msg websocket.WSMessage) {
 		return
 	}
 
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring remove-remote-subnets-aliases message: peerManager is nil (shutdown in progress)")
-		return
-	}
-
-	if _, exists := pm.GetPeer(removeSubnetsData.SiteId); !exists {
+	if _, exists := o.peerManager.GetPeer(removeSubnetsData.SiteId); !exists {
 		logger.Debug("Peer %d not found for removing remote subnets and aliases", removeSubnetsData.SiteId)
 		return
 	}
 
 	// Remove subnets
 	for _, subnet := range removeSubnetsData.RemoteSubnets {
-		if err := pm.RemoveRemoteSubnet(removeSubnetsData.SiteId, subnet); err != nil {
+		if err := o.peerManager.RemoveRemoteSubnet(removeSubnetsData.SiteId, subnet); err != nil {
 			logger.Error("Failed to remove allowed IP %s: %v", subnet, err)
 		}
 	}
 
 	// Remove aliases
 	for _, alias := range removeSubnetsData.Aliases {
-		if err := pm.RemoveAlias(removeSubnetsData.SiteId, alias.Alias); err != nil {
+		if err := o.peerManager.RemoveAlias(removeSubnetsData.SiteId, alias.Alias); err != nil {
 			logger.Error("Failed to remove alias %s: %v", alias.Alias, err)
 		}
 	}
@@ -126,13 +114,7 @@ func (o *Olm) handleWgPeerUpdateData(msg websocket.WSMessage) {
 		return
 	}
 
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring update-remote-subnets-aliases message: peerManager is nil (shutdown in progress)")
-		return
-	}
-
-	if _, exists := pm.GetPeer(updateSubnetsData.SiteId); !exists {
+	if _, exists := o.peerManager.GetPeer(updateSubnetsData.SiteId); !exists {
 		logger.Debug("Peer %d not found for updating remote subnets and aliases", updateSubnetsData.SiteId)
 		return
 	}
@@ -141,14 +123,14 @@ func (o *Olm) handleWgPeerUpdateData(msg websocket.WSMessage) {
 	// This ensures that if an old and new subnet are the same on different peers,
 	// the route won't be temporarily removed
 	for _, subnet := range updateSubnetsData.NewRemoteSubnets {
-		if err := pm.AddRemoteSubnet(updateSubnetsData.SiteId, subnet); err != nil {
+		if err := o.peerManager.AddRemoteSubnet(updateSubnetsData.SiteId, subnet); err != nil {
 			logger.Error("Failed to add allowed IP %s: %v", subnet, err)
 		}
 	}
 
 	// Remove old subnets after new ones are added
 	for _, subnet := range updateSubnetsData.OldRemoteSubnets {
-		if err := pm.RemoveRemoteSubnet(updateSubnetsData.SiteId, subnet); err != nil {
+		if err := o.peerManager.RemoveRemoteSubnet(updateSubnetsData.SiteId, subnet); err != nil {
 			logger.Error("Failed to remove allowed IP %s: %v", subnet, err)
 		}
 	}
@@ -157,14 +139,14 @@ func (o *Olm) handleWgPeerUpdateData(msg websocket.WSMessage) {
 	// This ensures that if an old and new alias share the same IP, the IP won't be
 	// temporarily removed from the allowed IPs list
 	for _, alias := range updateSubnetsData.NewAliases {
-		if err := pm.AddAlias(updateSubnetsData.SiteId, alias); err != nil {
+		if err := o.peerManager.AddAlias(updateSubnetsData.SiteId, alias); err != nil {
 			logger.Error("Failed to add alias %s: %v", alias.Alias, err)
 		}
 	}
 
 	// Remove old aliases after new ones are added
 	for _, alias := range updateSubnetsData.OldAliases {
-		if err := pm.RemoveAlias(updateSubnetsData.SiteId, alias.Alias); err != nil {
+		if err := o.peerManager.RemoveAlias(updateSubnetsData.SiteId, alias.Alias); err != nil {
 			logger.Error("Failed to remove alias %s: %v", alias.Alias, err)
 		}
 	}
@@ -181,8 +163,7 @@ func (o *Olm) handleSync(msg websocket.WSMessage) {
 		return
 	}
 
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Warn("Peer manager not initialized, ignoring sync request")
 		return
 	}
@@ -209,7 +190,7 @@ func (o *Olm) handleSync(msg websocket.WSMessage) {
 	}
 
 	// Get all current peers
-	currentPeers := pm.GetAllPeers()
+	currentPeers := o.peerManager.GetAllPeers()
 	currentPeerMap := make(map[int]peers.SiteConfig)
 	for _, peer := range currentPeers {
 		currentPeerMap[peer.SiteId] = peer
@@ -219,7 +200,7 @@ func (o *Olm) handleSync(msg websocket.WSMessage) {
 	for siteId := range currentPeerMap {
 		if _, exists := expectedPeers[siteId]; !exists {
 			logger.Info("Sync: Removing peer for site %d (no longer in expected config)", siteId)
-			if err := pm.RemovePeer(siteId); err != nil {
+			if err := o.peerManager.RemovePeer(siteId); err != nil {
 				logger.Error("Sync: Failed to remove peer %d: %v", siteId, err)
 			} else {
 				// Remove any exit nodes associated with this peer from hole punching
@@ -236,22 +217,19 @@ func (o *Olm) handleSync(msg websocket.WSMessage) {
 	// Find peers to add (in expected but not in current) and peers to update
 	for siteId, expectedSite := range expectedPeers {
 		if _, exists := currentPeerMap[siteId]; !exists {
-			// Only trigger add if this is NOT a JIT-only config (i.e., has more than just siteId and aliases)
-			jitOnly := expectedSite.PublicKey == ""
-			if jitOnly {
-				logger.Debug("Sync: Registering aliases for JIT-only site %d", siteId)
-				if err := pm.AddPeer(expectedSite); err != nil {
-					logger.Error("Sync: Failed to register aliases for JIT site %d: %v", siteId, err)
-				}
-				continue
-			}
-
 			// New peer - add it using the add flow (with holepunch)
 			logger.Info("Sync: Adding new peer for site %d", siteId)
 
 			o.holePunchManager.TriggerHolePunch()
 			o.holePunchManager.ResetServerHolepunchInterval() // start sending immediately again so we fill in the endpoint on the cloud
 
+			// // TODO: do we need to send the message to the cloud to add the peer that way?
+			// if err := o.peerManager.AddPeer(expectedSite); err != nil {
+			// 	logger.Error("Sync: Failed to add peer %d: %v", siteId, err)
+			// } else {
+			// 	logger.Info("Sync: Successfully added peer for site %d", siteId)
+			// }
+
 			// add the peer via the server
 			// this is important because newt needs to get triggered as well to add the peer once the hp is complete
 			chainId := fmt.Sprintf("sync-%d", expectedSite.SiteId)
@@ -323,7 +301,7 @@ func (o *Olm) handleSync(msg websocket.WSMessage) {
 					siteConfig.Aliases = expectedSite.Aliases
 				}
 
-				if err := pm.UpdatePeer(siteConfig); err != nil {
+				if err := o.peerManager.UpdatePeer(siteConfig); err != nil {
 					logger.Error("Sync: Failed to update peer %d: %v", siteId, err)
 				} else {
 					// If the endpoint changed, trigger holepunch to refresh NAT mappings

olm/olm.go

@@ -9,7 +9,6 @@ import (
 	"net/http"
 	_ "net/http/pprof"
 	"os"
-	"os/exec"
 	"sync"
 	"time"
 
@@ -43,18 +42,11 @@ type Olm struct {
 	middleDev    *olmDevice.MiddleDevice
 	sharedBind   *bind.SharedBind
 
-	dnsProxy   *dns.DNSProxy
-	dnsMonitor *dns.SystemDNSMonitor
-	// pendingSystemDNS holds a SetSystemDNS report received before dnsMonitor exists
-	// (e.g. Android/iOS push a value while the tunnel is still starting up), so it
-	// isn't silently dropped. Drained into dnsMonitor as soon as StartTunnel creates it.
-	pendingSystemDNSMu sync.Mutex
-	pendingSystemDNS   []string
-	apiServer          *api.API
-	websocket          *websocket.Client
-	holePunchManager   *holepunch.Manager
-	peerManager        *peers.PeerManager
-	peerManagerMu      sync.RWMutex
+	dnsProxy         *dns.DNSProxy
+	apiServer        *api.API
+	websocket        *websocket.Client
+	holePunchManager *holepunch.Manager
+	peerManager      *peers.PeerManager
 	// Power mode management
 	currentPowerMode string
 	powerModeMu      sync.Mutex
@@ -75,26 +67,13 @@ type Olm struct {
 	stopRegister   func()
 	updateRegister func(newData any)
 
-	stopPeerSends   map[string]func()
-	stopPeerInits   map[string]func()
+	stopPeerSends  map[string]func()
+	stopPeerInits  map[string]func()
 	jitPendingSites map[int]string // siteId -> chainId for in-flight JIT requests
-	peerSendMu      sync.Mutex
+	peerSendMu    sync.Mutex
 
 	// WaitGroup to track tunnel lifecycle
 	tunnelWg sync.WaitGroup
-
-	// External DNS watchdog process (spawned after DNS override is installed).
-	// nil when no watchdog is running.
-	dnsWatchdogCmd *exec.Cmd
-}
-
-// getPeerManager safely returns the current peerManager under a read-lock.
-// Callers must check the returned value for nil before using it.
-func (o *Olm) getPeerManager() *peers.PeerManager {
-	o.peerManagerMu.RLock()
-	pm := o.peerManager
-	o.peerManagerMu.RUnlock()
-	return pm
 }
 
 // initTunnelInfo creates the shared UDP socket and holepunch manager.
@@ -199,10 +178,10 @@ func Init(ctx context.Context, config OlmConfig) (*Olm, error) {
 	apiServer.SetAgent(config.Agent)
 
 	newOlm := &Olm{
-		logFile:         logFile,
-		olmCtx:          ctx,
-		apiServer:       apiServer,
-		olmConfig:       config,
+		logFile:       logFile,
+		olmCtx:        ctx,
+		apiServer:     apiServer,
+		olmConfig:     config,
 		stopPeerSends:   make(map[string]func()),
 		stopPeerInits:   make(map[string]func()),
 		jitPendingSites: make(map[int]string),
@@ -231,7 +210,6 @@ func (o *Olm) registerAPICallbacks() {
 				Holepunch:     req.Holepunch,
 				TlsClientCert: req.TlsClientCert,
 				OrgID:         req.OrgID,
-				MatchDomains:  req.MatchDomains,
 			}
 
 			var err error
@@ -339,54 +317,6 @@ func (o *Olm) registerAPICallbacks() {
 	)
 }
 
-// startDNSWatchdog launches an external watchdog process that will reset
-// system DNS if this olm process dies before it can call
-// RestoreDNSOverride. It is a no-op when the OlmConfig has no
-// WatchdogSubcommand configured, or when the watchdog has already been
-// started for this Olm instance.
-func (o *Olm) startDNSWatchdog(interfaceName string) {
-	if o.dnsWatchdogCmd != nil {
-		return
-	}
-	if len(o.olmConfig.WatchdogSubcommand) == 0 {
-		logger.Debug("DNS watchdog disabled (no WatchdogSubcommand configured)")
-		return
-	}
-
-	executable := o.olmConfig.WatchdogExecutable
-	if executable == "" {
-		exe, err := os.Executable()
-		if err != nil {
-			logger.Warn("DNS watchdog: failed to resolve executable: %v", err)
-			return
-		}
-		executable = exe
-	}
-
-	cmd, err := dnsOverride.SpawnWatchdog(dnsOverride.SpawnWatchdogConfig{
-		Executable:    executable,
-		Subcommand:    o.olmConfig.WatchdogSubcommand,
-		InterfaceName: interfaceName,
-		SocketPath:    o.olmConfig.SocketPath,
-		LogFile:       o.olmConfig.WatchdogLogFile,
-	})
-	if err != nil {
-		logger.Warn("DNS watchdog: spawn failed: %v", err)
-		return
-	}
-	o.dnsWatchdogCmd = cmd
-}
-
-// stopDNSWatchdog stops any previously spawned DNS watchdog process.
-// Safe to call when no watchdog was started.
-func (o *Olm) stopDNSWatchdog() {
-	if o.dnsWatchdogCmd == nil {
-		return
-	}
-	dnsOverride.StopWatchdog(o.dnsWatchdogCmd)
-	o.dnsWatchdogCmd = nil
-}
-
 func (o *Olm) StartTunnel(config TunnelConfig) {
 	if o.tunnelRunning {
 		logger.Info("Tunnel already running")
@@ -398,73 +328,12 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
 
 	o.tunnelRunning = true // Also set it here in case it is called externally
 	o.tunnelConfig = config
-	network.PreferLocalRoutes = config.PreferLocalRoutes
 
-	// Determine whether the system DNS monitor should also manage UpstreamDNS.
-	// If the caller did not provide an explicit UpstreamDNS (it was defaulted to
-	// 8.8.8.8:53 by the API handler), we want the monitor to keep it updated
-	// with whatever DNS the host network is currently using.
-	upstreamFromConfig := len(config.UpstreamDNS) > 0 &&
-		!(len(config.UpstreamDNS) == 1 && config.UpstreamDNS[0] == "8.8.8.8:53")
-	if upstreamFromConfig {
-		logger.Info("UpstreamDNS is statically configured (%v); automatic system DNS detection will only update PublicDNS, DNS forwarding will keep using the configured value even if it becomes unreachable on a new network", config.UpstreamDNS)
-	}
-
-	// Start the system DNS monitor. The callback fires synchronously once with
-	// the initial values so that PublicDNS (and optionally UpstreamDNS) are
-	// populated before the tunnel goroutine proceeds.
-	o.dnsMonitor = dns.NewSystemDNSMonitor(0, func(servers []string) {
-		if len(servers) == 0 {
-			return
-		}
-		logger.Info("Applying system DNS: %v", servers)
-
-		// PublicDNS must always reflect the physical-network DNS so that
-		// WireGuard endpoint hostnames and hole-punch targets can be resolved
-		// even after the system resolver has been overridden by olm.
-		o.tunnelConfig.PublicDNS = servers
-		if o.holePunchManager != nil {
-			o.holePunchManager.SetPublicDNS(servers)
-		}
-		if pm := o.getPeerManager(); pm != nil {
-			pm.SetPublicDNS(servers)
-		}
-		// Keep the DNS proxy's local-DNS fallback (used for MatchDomains
-		// misses) in sync with the host's real system DNS servers.
-		if o.dnsProxy != nil {
-			o.dnsProxy.SetLocalDNS(servers)
-		}
-
-		// UpstreamDNS is updated only when the caller did not supply an
-		// explicit value; dynamic updates keep the proxy forwarding to the
-		// network's real resolver as the host moves between networks.
-		if !upstreamFromConfig {
-			o.tunnelConfig.UpstreamDNS = servers
-			if o.dnsProxy != nil {
-				o.dnsProxy.SetUpstreamDNS(servers)
-			}
-		} else {
-			logger.Debug("Not updating UpstreamDNS: statically configured to %v", config.UpstreamDNS)
-		}
-	})
-	o.dnsMonitor.Start(o.olmCtx)
-
-	// Apply any SetSystemDNS report that arrived before dnsMonitor existed (e.g. an
-	// Android/iOS push that raced ahead of this goroutine).
-	if pending := o.takePendingSystemDNS(); len(pending) > 0 {
-		o.dnsMonitor.ReportExternal(pending)
-	}
-
-	// Fall back to hardcoded DNS if the system monitor could not detect any.
-	if len(o.tunnelConfig.PublicDNS) == 0 {
-		if o.tunnelConfig.DNS != "" {
-			o.tunnelConfig.PublicDNS = []string{o.tunnelConfig.DNS + ":53"}
-		} else {
-			o.tunnelConfig.PublicDNS = []string{"8.8.8.8:53"}
-		}
-	}
-	if len(o.tunnelConfig.UpstreamDNS) == 0 {
-		o.tunnelConfig.UpstreamDNS = []string{"8.8.8.8:53"}
+	// TODO: we are hardcoding this for now but we should really pull it from the current config of the system
+	if o.tunnelConfig.DNS != "" {
+		o.tunnelConfig.PublicDNS = []string{o.tunnelConfig.DNS + ":53"}
+	} else {
+		o.tunnelConfig.PublicDNS = []string{"8.8.8.8:53"}
 	}
 
 	// Reset terminated status when tunnel starts
@@ -537,8 +406,6 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
 	o.websocket.RegisterHandler("olm/wg/peer/update", o.handleWgPeerUpdate)
 	o.websocket.RegisterHandler("olm/wg/peer/relay", o.handleWgPeerRelay)
 	o.websocket.RegisterHandler("olm/wg/peer/unrelay", o.handleWgPeerUnrelay)
-	o.websocket.RegisterHandler("olm/wg/peer/local", o.handleWgPeerLocal)
-	o.websocket.RegisterHandler("olm/wg/peer/unlocal", o.handleWgPeerUnlocal)
 
 	// Handlers for managing remote subnets to a peer
 	o.websocket.RegisterHandler("olm/wg/peer/data/add", o.handleWgPeerAddData)
@@ -590,8 +457,7 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
 				"userToken":   userToken,
 				"fingerprint": o.fingerprint,
 				"postures":    o.postures,
-				"chainId":     generateChainId(), // use a random chainId for registration updates - it won't be used for cancellation since registration is a one-time message but for tracking the session
-			}, 2*time.Second, 20) // after 18 tries on the server side we send the error so dont change this without changing that
+			}, 2*time.Second, 10)
 
 			// Invoke onRegistered callback if configured
 			if o.olmConfig.OnRegistered != nil {
@@ -719,30 +585,16 @@ func (o *Olm) Close() {
 		logger.Error("Failed to restore DNS: %v", err)
 	}
 
-	// Stop the watchdog *after* a successful DNS restore so that if we
-	// somehow crash mid-restore the watchdog still has a chance to clean
-	// up. The watchdog itself is a no-op if it was never spawned.
-	o.stopDNSWatchdog()
-
 	if o.holePunchManager != nil {
 		o.holePunchManager.Stop()
 		o.holePunchManager = nil
 	}
 
-	// Stop the system DNS monitor after hole punch is stopped (it feeds
-	// publicDNS into the hole punch manager).
-	if o.dnsMonitor != nil {
-		o.dnsMonitor.Stop()
-		o.dnsMonitor = nil
-	}
-
 	// Close() also calls Stop() internally
-	o.peerManagerMu.Lock()
 	if o.peerManager != nil {
 		o.peerManager.Close()
 		o.peerManager = nil
 	}
-	o.peerManagerMu.Unlock()
 
 	if o.uapiListener != nil {
 		_ = o.uapiListener.Close()
@@ -904,38 +756,6 @@ func (o *Olm) SetPostures(data map[string]any) {
 	o.postures = data
 }
 
-// SetSystemDNS reports DNS servers observed by platform-native code. On
-// Android and iOS olm cannot read the OS's DNS configuration itself (unlike
-// Linux/macOS/Windows, see dns.readSystemDNS), so the app/extension detects
-// the real pre-override DNS servers and pushes them here as the network
-// changes. The list is applied through the same exclude-IP filtering and
-// change detection as the internally-polled SystemDNSMonitor.
-func (o *Olm) SetSystemDNS(servers []string) {
-	logger.Info("SetSystemDNS called with: %v", servers)
-	if o.dnsMonitor == nil {
-		// StartTunnel hasn't created the monitor yet (mobile platforms may push a
-		// value the moment they start observing, before the tunnel goroutine has
-		// gotten far enough to construct it). Stash it so StartTunnel can apply it
-		// instead of falling back to a hardcoded default DNS server.
-		o.pendingSystemDNSMu.Lock()
-		o.pendingSystemDNS = servers
-		o.pendingSystemDNSMu.Unlock()
-		logger.Debug("dnsMonitor not yet started, queued SetSystemDNS value")
-		return
-	}
-	o.dnsMonitor.ReportExternal(servers)
-}
-
-// takePendingSystemDNS returns and clears any SetSystemDNS value reported before
-// dnsMonitor existed.
-func (o *Olm) takePendingSystemDNS() []string {
-	o.pendingSystemDNSMu.Lock()
-	defer o.pendingSystemDNSMu.Unlock()
-	pending := o.pendingSystemDNS
-	o.pendingSystemDNS = nil
-	return pending
-}
-
 // SetPowerMode switches between normal and low power modes
 // In low power mode: websocket is closed (stopping pings) and monitoring intervals are set to 10 minutes
 // In normal power mode: websocket is reconnected (restarting pings) and monitoring intervals are restored
@@ -986,14 +806,14 @@ func (o *Olm) SetPowerMode(mode string) error {
 
 		lowPowerInterval := 10 * time.Minute
 
-		if pm := o.getPeerManager(); pm != nil {
-			peerMonitor := pm.GetPeerMonitor()
+		if o.peerManager != nil {
+			peerMonitor := o.peerManager.GetPeerMonitor()
 			if peerMonitor != nil {
 				peerMonitor.SetPeerInterval(lowPowerInterval, lowPowerInterval)
 				peerMonitor.SetPeerHolepunchInterval(lowPowerInterval, lowPowerInterval)
 				logger.Info("Set monitoring intervals to 10 minutes for low power mode")
 			}
-			pm.UpdateAllPeersPersistentKeepalive(0) // disable
+			o.peerManager.UpdateAllPeersPersistentKeepalive(0) // disable
 		}
 
 		if o.holePunchManager != nil {
@@ -1038,14 +858,14 @@ func (o *Olm) SetPowerMode(mode string) error {
 			}
 
 			// Restore intervals and reconnect websocket
-			if pm := o.getPeerManager(); pm != nil {
-				peerMonitor := pm.GetPeerMonitor()
+			if o.peerManager != nil {
+				peerMonitor := o.peerManager.GetPeerMonitor()
 				if peerMonitor != nil {
 					peerMonitor.ResetPeerHolepunchInterval()
 					peerMonitor.ResetPeerInterval()
 				}
 
-				pm.UpdateAllPeersPersistentKeepalive(5)
+				o.peerManager.UpdateAllPeersPersistentKeepalive(5)
 			}
 
 			if o.holePunchManager != nil {

olm/peer.go

@@ -20,14 +20,7 @@ func (o *Olm) handleWgPeerAdd(msg websocket.WSMessage) {
 		return
 	}
 
-	// Check if connection setup is complete
-	if !o.registered {
-		logger.Warn("Not connected, ignoring add-peer message")
-		return
-	}
-
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Debug("Ignoring add-peer message: peerManager is nil (shutdown in progress)")
 		return
 	}
@@ -71,7 +64,7 @@ func (o *Olm) handleWgPeerAdd(msg websocket.WSMessage) {
 
 	_ = o.holePunchManager.TriggerHolePunch() // Trigger immediate hole punch attempt so that if the peer decides to relay we have already punched close to when we need it
 
-	if err := pm.AddPeer(siteConfigMsg.SiteConfig); err != nil {
+	if err := o.peerManager.AddPeer(siteConfigMsg.SiteConfig); err != nil {
 		logger.Error("Failed to add peer: %v", err)
 		return
 	}
@@ -88,14 +81,7 @@ func (o *Olm) handleWgPeerRemove(msg websocket.WSMessage) {
 		return
 	}
 
-	// Check if connection setup is complete
-	if !o.registered {
-		logger.Warn("Not connected, ignoring remove-peer message")
-		return
-	}
-
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Debug("Ignoring remove-peer message: peerManager is nil (shutdown in progress)")
 		return
 	}
@@ -112,7 +98,7 @@ func (o *Olm) handleWgPeerRemove(msg websocket.WSMessage) {
 		return
 	}
 
-	if err := pm.RemovePeer(removeData.SiteId); err != nil {
+	if err := o.peerManager.RemovePeer(removeData.SiteId); err != nil {
 		logger.Error("Failed to remove peer: %v", err)
 		return
 	}
@@ -137,14 +123,7 @@ func (o *Olm) handleWgPeerUpdate(msg websocket.WSMessage) {
 		return
 	}
 
-	// Check if connection setup is complete
-	if !o.registered {
-		logger.Warn("Not connected, ignoring update-peer message")
-		return
-	}
-
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Debug("Ignoring update-peer message: peerManager is nil (shutdown in progress)")
 		return
 	}
@@ -162,7 +141,7 @@ func (o *Olm) handleWgPeerUpdate(msg websocket.WSMessage) {
 	}
 
 	// Get existing peer from PeerManager
-	existingPeer, exists := pm.GetPeer(updateData.SiteId)
+	existingPeer, exists := o.peerManager.GetPeer(updateData.SiteId)
 	if !exists {
 		logger.Warn("Peer with site ID %d not found", updateData.SiteId)
 		return
@@ -189,11 +168,8 @@ func (o *Olm) handleWgPeerUpdate(msg websocket.WSMessage) {
 	if updateData.RemoteSubnets != nil {
 		siteConfig.RemoteSubnets = updateData.RemoteSubnets
 	}
-	if updateData.Aliases != nil {
-		siteConfig.Aliases = updateData.Aliases
-	}
 
-	if err := pm.UpdatePeer(siteConfig); err != nil {
+	if err := o.peerManager.UpdatePeer(siteConfig); err != nil {
 		logger.Error("Failed to update peer: %v", err)
 		return
 	}
@@ -201,10 +177,8 @@ func (o *Olm) handleWgPeerUpdate(msg websocket.WSMessage) {
 	// If the endpoint changed, trigger holepunch to refresh NAT mappings
 	if updateData.Endpoint != "" && updateData.Endpoint != existingPeer.Endpoint {
 		logger.Info("Endpoint changed for site %d, triggering holepunch to refresh NAT mappings", updateData.SiteId)
-		if o.holePunchManager != nil {
-			_ = o.holePunchManager.TriggerHolePunch()
-			o.holePunchManager.ResetServerHolepunchInterval()
-		}
+		_ = o.holePunchManager.TriggerHolePunch()
+		o.holePunchManager.ResetServerHolepunchInterval()
 	}
 
 	logger.Info("Successfully updated peer for site %d", updateData.SiteId)
@@ -214,8 +188,7 @@ func (o *Olm) handleWgPeerRelay(msg websocket.WSMessage) {
 	logger.Debug("Received relay-peer message: %v", msg.Data)
 
 	// Check if peerManager is still valid (may be nil during shutdown)
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Debug("Ignoring relay message: peerManager is nil (shutdown in progress)")
 		return
 	}
@@ -235,7 +208,7 @@ func (o *Olm) handleWgPeerRelay(msg websocket.WSMessage) {
 		return
 	}
 
-	if monitor := pm.GetPeerMonitor(); monitor != nil {
+	if monitor := o.peerManager.GetPeerMonitor(); monitor != nil {
 		monitor.CancelRelaySend(relayData.ChainId)
 	}
 
@@ -249,15 +222,14 @@ func (o *Olm) handleWgPeerRelay(msg websocket.WSMessage) {
 	// Update HTTP server to mark this peer as using relay
 	o.apiServer.UpdatePeerRelayStatus(relayData.SiteId, relayData.RelayEndpoint, true)
 
-	pm.RelayPeer(relayData.SiteId, primaryRelay, relayData.RelayPort)
+	o.peerManager.RelayPeer(relayData.SiteId, primaryRelay, relayData.RelayPort)
 }
 
 func (o *Olm) handleWgPeerUnrelay(msg websocket.WSMessage) {
 	logger.Debug("Received unrelay-peer message: %v", msg.Data)
 
 	// Check if peerManager is still valid (may be nil during shutdown)
-	pm := o.getPeerManager()
-	if pm == nil {
+	if o.peerManager == nil {
 		logger.Debug("Ignoring unrelay message: peerManager is nil (shutdown in progress)")
 		return
 	}
@@ -277,7 +249,7 @@ func (o *Olm) handleWgPeerUnrelay(msg websocket.WSMessage) {
 		return
 	}
 
-	if monitor := pm.GetPeerMonitor(); monitor != nil {
+	if monitor := o.peerManager.GetPeerMonitor(); monitor != nil {
 		monitor.CancelRelaySend(relayData.ChainId)
 	}
 
@@ -290,72 +262,7 @@ func (o *Olm) handleWgPeerUnrelay(msg websocket.WSMessage) {
 	// Update HTTP server to mark this peer as using relay
 	o.apiServer.UpdatePeerRelayStatus(relayData.SiteId, relayData.Endpoint, false)
 
-	pm.UnRelayPeer(relayData.SiteId, primaryRelay)
-}
-
-// handleWgPeerLocal handles the server's acknowledgement of an "olm/wg/local" message.
-// olm already switched the peer to the local endpoint before sending that message (it
-// doesn't wait for permission, unlike relay), so all this needs to do is stop the retry
-// sender for the given chain.
-func (o *Olm) handleWgPeerLocal(msg websocket.WSMessage) {
-	logger.Debug("Received local-peer ack message: %v", msg.Data)
-
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring local ack message: peerManager is nil (shutdown in progress)")
-		return
-	}
-
-	jsonData, err := json.Marshal(msg.Data)
-	if err != nil {
-		logger.Error("Error marshaling data: %v", err)
-		return
-	}
-
-	var localData struct {
-		peers.LocalPeerAckData
-		ChainId string `json:"chainId"`
-	}
-	if err := json.Unmarshal(jsonData, &localData); err != nil {
-		logger.Error("Error unmarshaling local ack data: %v", err)
-		return
-	}
-
-	if monitor := pm.GetPeerMonitor(); monitor != nil {
-		monitor.CancelLocalSend(localData.ChainId)
-	}
-}
-
-// handleWgPeerUnlocal handles the server's acknowledgement of an "olm/wg/unlocal" message.
-// Same as handleWgPeerLocal, olm has already fallen back from the local endpoint by the time
-// it sends the notification, so this just stops the retry sender.
-func (o *Olm) handleWgPeerUnlocal(msg websocket.WSMessage) {
-	logger.Debug("Received unlocal-peer ack message: %v", msg.Data)
-
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring unlocal ack message: peerManager is nil (shutdown in progress)")
-		return
-	}
-
-	jsonData, err := json.Marshal(msg.Data)
-	if err != nil {
-		logger.Error("Error marshaling data: %v", err)
-		return
-	}
-
-	var localData struct {
-		peers.LocalPeerAckData
-		ChainId string `json:"chainId"`
-	}
-	if err := json.Unmarshal(jsonData, &localData); err != nil {
-		logger.Error("Error unmarshaling unlocal ack data: %v", err)
-		return
-	}
-
-	if monitor := pm.GetPeerMonitor(); monitor != nil {
-		monitor.CancelLocalSend(localData.ChainId)
-	}
+	o.peerManager.UnRelayPeer(relayData.SiteId, primaryRelay)
 }
 
 func (o *Olm) handleWgPeerHolepunchAddSite(msg websocket.WSMessage) {
@@ -410,12 +317,7 @@ func (o *Olm) handleWgPeerHolepunchAddSite(msg websocket.WSMessage) {
 	}
 
 	// Get existing peer from PeerManager
-	pm := o.getPeerManager()
-	if pm == nil {
-		logger.Debug("Ignoring peer-handshake message: peerManager is nil (shutdown in progress)")
-		return
-	}
-	_, exists := pm.GetPeer(handshakeData.SiteId)
+	_, exists := o.peerManager.GetPeer(handshakeData.SiteId)
 	if exists {
 		logger.Warn("Peer with site ID %d already added", handshakeData.SiteId)
 		return

olm/types.go

@@ -48,21 +48,6 @@ type OlmConfig struct {
 	OnAuthError  func(statusCode int, message string) // Called when auth fails (401/403)
 	OnOlmError   func(code string, message string)    // Called when registration fails
 	OnExit       func()                               // Called when exit is requested via API
-
-	// DNS watchdog (optional). When WatchdogSubcommand is non-empty, the
-	// olm package will spawn an external watchdog subprocess after a DNS
-	// override is installed. The watchdog will reset the system DNS if
-	// this process dies before it can call RestoreDNSOverride.
-	//
-	// The watchdog is launched as:
-	//   <WatchdogExecutable> <WatchdogSubcommand...> \
-	//       --parent-pid=<pid> --interface=<name> [--socket=<path>]
-	//
-	// When WatchdogExecutable is empty, os.Executable() of the calling
-	// process is used. WatchdogLogFile defaults to /dev/null.
-	WatchdogExecutable string
-	WatchdogSubcommand []string
-	WatchdogLogFile    string
 }
 
 type TunnelConfig struct {
@@ -76,16 +61,9 @@ type TunnelConfig struct {
 	MTU           int
 	DNS           string
 	UpstreamDNS   []string
-	PublicDNS     []string
+	PublicDNS   []string
 	InterfaceName string
 
-	// MatchDomains lists FQDN wildcard patterns (using * and ? wildcards) that
-	// olm should check against local records / resolve via UpstreamDNS. Queries
-	// that don't match any pattern are sent directly to the host's own system
-	// DNS servers (PublicDNS) instead of being handled by the DNS proxy at all.
-	// An empty MatchDomains matches every query, preserving prior behavior.
-	MatchDomains []string
-
 	// Advanced
 	Holepunch     bool
 	TlsClientCert string
@@ -109,12 +87,4 @@ type TunnelConfig struct {
 	InitialPostures    map[string]any
 
 	DisableRelay bool
-
-	// PreferLocalRoutes, when enabled, adds tunnel routes with an explicit
-	// high metric/priority so that an overlapping local/connected route to
-	// the same destination always takes precedence over the VPN route,
-	// rather than the two racing based on insertion order. Defaults to
-	// false, preserving the routing behavior from before this option was
-	// introduced.
-	PreferLocalRoutes bool
 }

peers/manager.go

@@ -6,7 +6,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/fosrl/newt/bind"
 	"github.com/fosrl/newt/logger"
@@ -33,7 +32,7 @@ type PeerManagerConfig struct {
 	SharedBind *bind.SharedBind
 	// WSClient is optional - if nil, relay messages won't be sent
 	WSClient  *websocket.Client
-	APIServer *api.API
+	APIServer   *api.API
 	PublicDNS []string
 }
 
@@ -52,35 +51,11 @@ type PeerManager struct {
 	// key is the CIDR string, value is a set of siteIds that want this IP
 	allowedIPClaims map[string]map[int]bool
 	APIServer       *api.API
-	publicDNS       []string
+	publicDNS     []string
 
 	PersistentKeepalive int
-
-	routeOptimizerStop chan struct{}
-	optimizerTrigger   chan struct{}
-
-	// lastOwnerChange tracks, per allowed-IP CIDR, when ownership was last transferred.
-	// Used to enforce a cooldown so routes don't flap between two similarly-performing sites.
-	lastOwnerChange map[string]time.Time
 }
 
-const (
-	// routeSwitchRTTMargin requires a candidate site's RTT to be at least this much
-	// better (as a fraction) than the current owner's before we consider it worth
-	// switching, so two similarly-performing sites don't flap back and forth.
-	routeSwitchRTTMargin = 0.20 // candidate must be >=20% faster
-
-	// routeSwitchMinAbsMargin is a floor on the RTT improvement required, so the
-	// percentage margin above doesn't become meaningless at very low RTTs (e.g. a
-	// 1ms vs 0.8ms "20% improvement" shouldn't trigger a switch).
-	routeSwitchMinAbsMargin = 5 * time.Millisecond
-
-	// routeSwitchCooldown is the minimum time to wait after transferring ownership
-	// of a route before it can be transferred again, unless the current owner's
-	// connection quality degrades (disconnects or falls back to relay).
-	routeSwitchCooldown = 30 * time.Second
-)
-
 // NewPeerManager creates a new PeerManager with an internal PeerMonitor
 func NewPeerManager(config PeerManagerConfig) *PeerManager {
 	pm := &PeerManager{
@@ -92,8 +67,7 @@ func NewPeerManager(config PeerManagerConfig) *PeerManager {
 		allowedIPOwners: make(map[string]int),
 		allowedIPClaims: make(map[string]map[int]bool),
 		APIServer:       config.APIServer,
-		publicDNS:       config.PublicDNS,
-		lastOwnerChange: make(map[string]time.Time),
+		publicDNS:     config.PublicDNS,
 	}
 
 	// Create the peer monitor
@@ -106,10 +80,6 @@ func NewPeerManager(config PeerManagerConfig) *PeerManager {
 		config.PublicDNS,
 	)
 
-	pm.optimizerTrigger = make(chan struct{}, 1)
-
-	pm.peerMonitor.SetLocalConnectionCallbacks(pm.LocalPeer, pm.UnLocalPeer)
-
 	return pm
 }
 
@@ -127,21 +97,6 @@ func (pm *PeerManager) GetPeerMonitor() *monitor.PeerMonitor {
 	return pm.peerMonitor
 }
 
-// SetPublicDNS replaces the DNS servers used to resolve WireGuard peer
-// endpoints and hole-punch targets.  The servers must be in "host:port" format
-// (e.g. "8.8.8.8:53").  The change takes effect for all future peer
-// configuration calls; existing WireGuard peers are not re-resolved.
-func (pm *PeerManager) SetPublicDNS(servers []string) {
-	pm.mu.Lock()
-	pm.publicDNS = servers
-	mon := pm.peerMonitor
-	pm.mu.Unlock()
-
-	if mon != nil {
-		mon.SetPublicDNS(servers)
-	}
-}
-
 func (pm *PeerManager) GetAllPeers() []SiteConfig {
 	pm.mu.RLock()
 	defer pm.mu.RUnlock()
@@ -155,7 +110,7 @@ func (pm *PeerManager) GetAllPeers() []SiteConfig {
 func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
 	pm.mu.Lock()
 	defer pm.mu.Unlock()
-
+	
 	for _, alias := range siteConfig.Aliases {
 		address := net.ParseIP(alias.AliasAddress)
 		if address == nil {
@@ -163,7 +118,7 @@ func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
 		}
 		pm.dnsProxy.AddDNSRecord(alias.Alias, address, siteConfig.SiteId)
 	}
-
+	
 	if siteConfig.PublicKey == "" {
 		logger.Debug("Skip adding site %d because no pub key", siteConfig.SiteId)
 		return nil
@@ -201,11 +156,11 @@ func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
 	if err := network.AddRoutes(siteConfig.RemoteSubnets, pm.interfaceName); err != nil {
 		logger.Error("Failed to add routes for remote subnets: %v", err)
 	}
-
+	
 	monitorAddress := strings.Split(siteConfig.ServerIP, "/")[0]
 	monitorPeer := net.JoinHostPort(monitorAddress, strconv.Itoa(int(siteConfig.ServerPort+1))) // +1 for the monitor port
 
-	err := pm.peerMonitor.AddPeer(siteConfig.SiteId, monitorPeer, siteConfig.Endpoint, siteConfig.LocalEndpoints) // always use the real site endpoint for hole punch monitoring
+	err := pm.peerMonitor.AddPeer(siteConfig.SiteId, monitorPeer, siteConfig.Endpoint) // always use the real site endpoint for hole punch monitoring
 	if err != nil {
 		logger.Warn("Failed to setup monitoring for site %d: %v", siteConfig.SiteId, err)
 	} else {
@@ -214,11 +169,11 @@ func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
 
 	pm.peers[siteConfig.SiteId] = siteConfig
 
-	pm.APIServer.AddPeerStatus(siteConfig.SiteId, siteConfig.Name, false, 0, siteConfig.Endpoint, false, false)
+	pm.APIServer.AddPeerStatus(siteConfig.SiteId, siteConfig.Name, false, 0, siteConfig.Endpoint, false)
 
 	// Perform rapid initial holepunch test (outside of lock to avoid blocking)
 	// This quickly determines if holepunch is viable and triggers relay if not
-	go pm.performRapidInitialTest(siteConfig.SiteId, siteConfig.Endpoint, siteConfig.LocalEndpoints)
+	go pm.performRapidInitialTest(siteConfig.SiteId, siteConfig.Endpoint)
 
 	return nil
 }
@@ -228,7 +183,7 @@ func (pm *PeerManager) AddPeer(siteConfig SiteConfig) error {
 func (pm *PeerManager) UpdateAllPeersPersistentKeepalive(interval int) map[int]error {
 	pm.mu.RLock()
 	defer pm.mu.RUnlock()
-
+	
 	pm.PersistentKeepalive = interval
 
 	errors := make(map[int]error)
@@ -281,7 +236,7 @@ func (pm *PeerManager) RemovePeer(siteId int) error {
 			}
 		}
 		if !subnetStillInUse {
-			if err := network.RemoveRoutes([]string{subnet}, pm.interfaceName); err != nil {
+			if err := network.RemoveRoutes([]string{subnet}); err != nil {
 				logger.Error("Failed to remove route for remote subnet %s: %v", subnet, err)
 			}
 		}
@@ -350,33 +305,6 @@ func (pm *PeerManager) UpdatePeer(siteConfig SiteConfig) error {
 		return fmt.Errorf("peer with site ID %d not found", siteConfig.SiteId)
 	}
 
-	// Preserve the currently active local endpoint (if any) across updates so an in-progress
-	// local connection isn't disrupted by an unrelated site update.
-	siteConfig.ActiveLocalEndpoint = oldPeer.ActiveLocalEndpoint
-
-	// Update aliases
-	// Remove old aliases
-	for _, alias := range oldPeer.Aliases {
-		address := net.ParseIP(alias.AliasAddress)
-		if address == nil {
-			continue
-		}
-		pm.dnsProxy.RemoveDNSRecord(alias.Alias, address)
-	}
-	// Add new aliases
-	for _, alias := range siteConfig.Aliases {
-		address := net.ParseIP(alias.AliasAddress)
-		if address == nil {
-			continue
-		}
-		pm.dnsProxy.AddDNSRecord(alias.Alias, address, siteConfig.SiteId)
-	}
-
-	if siteConfig.PublicKey == "" {
-		logger.Debug("Skip updating site %d because no pub key", siteConfig.SiteId)
-		return nil
-	}
-
 	// If public key changed, remove old peer first
 	if siteConfig.PublicKey != oldPeer.PublicKey {
 		if err := RemovePeer(pm.device, siteConfig.SiteId, oldPeer.PublicKey); err != nil {
@@ -487,7 +415,7 @@ func (pm *PeerManager) UpdatePeer(siteConfig SiteConfig) error {
 			}
 		}
 		if !subnetStillInUse {
-			if err := network.RemoveRoutes([]string{subnet}, pm.interfaceName); err != nil {
+			if err := network.RemoveRoutes([]string{subnet}); err != nil {
 				logger.Error("Failed to remove route for subnet %s: %v", subnet, err)
 			}
 		}
@@ -500,8 +428,25 @@ func (pm *PeerManager) UpdatePeer(siteConfig SiteConfig) error {
 		}
 	}
 
+	// Update aliases
+	// Remove old aliases
+	for _, alias := range oldPeer.Aliases {
+		address := net.ParseIP(alias.AliasAddress)
+		if address == nil {
+			continue
+		}
+		pm.dnsProxy.RemoveDNSRecord(alias.Alias, address)
+	}
+	// Add new aliases
+	for _, alias := range siteConfig.Aliases {
+		address := net.ParseIP(alias.AliasAddress)
+		if address == nil {
+			continue
+		}
+		pm.dnsProxy.AddDNSRecord(alias.Alias, address, siteConfig.SiteId)
+	}
+
 	pm.peerMonitor.UpdateHolepunchEndpoint(siteConfig.SiteId, siteConfig.Endpoint)
-	pm.peerMonitor.UpdateLocalEndpoints(siteConfig.SiteId, siteConfig.LocalEndpoints)
 
 	monitorAddress := strings.Split(siteConfig.ServerIP, "/")[0]
 	monitorPeer := net.JoinHostPort(monitorAddress, strconv.Itoa(int(siteConfig.ServerPort+1))) // +1 for the monitor port
@@ -537,7 +482,6 @@ func (pm *PeerManager) releaseAllowedIP(siteId int, cidr string) (newOwner int,
 		delete(claims, siteId)
 		if len(claims) == 0 {
 			delete(pm.allowedIPClaims, cidr)
-			delete(pm.lastOwnerChange, cidr)
 		}
 	}
 
@@ -756,7 +700,7 @@ func (pm *PeerManager) RemoveRemoteSubnet(siteId int, ip string) error {
 
 	// Only remove route if no other peer needs it
 	if !subnetStillInUse {
-		if err := network.RemoveRoutes([]string{ip}, pm.interfaceName); err != nil {
+		if err := network.RemoveRoutes([]string{ip}); err != nil {
 			return err
 		}
 	}
@@ -813,7 +757,7 @@ func (pm *PeerManager) RemoveAlias(siteId int, aliasName string) error {
 	if aliasToRemove != nil {
 		address := net.ParseIP(aliasToRemove.AliasAddress)
 		if address != nil {
-			pm.dnsProxy.RemoveDNSRecordForSite(aliasName, address, siteId)
+			pm.dnsProxy.RemoveDNSRecord(aliasName, address)
 		}
 	}
 
@@ -844,11 +788,6 @@ func (pm *PeerManager) RemoveAlias(siteId int, aliasName string) error {
 func (pm *PeerManager) RelayPeer(siteId int, relayEndpoint string, relayPort uint16) {
 	pm.mu.Lock()
 	peer, exists := pm.peers[siteId]
-	if exists && peer.ActiveLocalEndpoint != "" {
-		pm.mu.Unlock()
-		logger.Info("Ignoring relay request for site %d: local connection is active", siteId)
-		return
-	}
 	if exists {
 		// Store the relay endpoint
 		peer.RelayEndpoint = relayEndpoint
@@ -891,43 +830,15 @@ endpoint=%s:%d`, util.FixKey(peer.PublicKey), formattedEndpoint, relayPort)
 }
 
 // performRapidInitialTest performs a rapid holepunch test for a newly added peer.
-// It races a test of the public endpoint against a test of the local candidate endpoints
-// (if any) and waits for both to finish before acting, so we never request relay only to
-// have it immediately superseded by a local connection (or vice versa). Local wins if it's
-// viable at all; otherwise relay is requested only if the public endpoint isn't viable.
-// This runs in a goroutine to avoid blocking AddPeer - the peer already starts out pointed
-// at the public endpoint (set synchronously in AddPeer), so this just settles the peer onto
-// its steady-state connection within ~1-2 seconds.
-func (pm *PeerManager) performRapidInitialTest(siteId int, endpoint string, localEndpoints []string) {
+// If the test fails, it immediately requests relay to minimize connection delay.
+// This runs in a goroutine to avoid blocking AddPeer.
+func (pm *PeerManager) performRapidInitialTest(siteId int, endpoint string) {
 	if pm.peerMonitor == nil {
 		return
 	}
 
-	var wg sync.WaitGroup
-	var localWinner string
-	var holepunchViable bool
-
-	if len(localEndpoints) > 0 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			localWinner = pm.peerMonitor.RapidTestLocalEndpoints(siteId, localEndpoints)
-		}()
-	}
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		holepunchViable = pm.peerMonitor.RapidTestPeer(siteId, endpoint)
-	}()
-
-	wg.Wait()
-
-	if localWinner != "" {
-		logger.Info("Rapid test: local connection viable for site %d, switching to %s", siteId, localWinner)
-		pm.LocalPeer(siteId, localWinner)
-		return
-	}
+	// Perform rapid test - this takes ~1-2 seconds max
+	holepunchViable := pm.peerMonitor.RapidTestPeer(siteId, endpoint)
 
 	if !holepunchViable {
 		// Holepunch failed rapid test, request relay immediately
@@ -945,12 +856,10 @@ func (pm *PeerManager) Start() {
 	if pm.peerMonitor != nil {
 		pm.peerMonitor.Start()
 	}
-	pm.startRouteOptimizer()
 }
 
 // Stop stops the peer monitor
 func (pm *PeerManager) Stop() {
-	pm.stopRouteOptimizer()
 	if pm.peerMonitor != nil {
 		pm.peerMonitor.Stop()
 	}
@@ -958,7 +867,6 @@ func (pm *PeerManager) Stop() {
 
 // Close stops the peer monitor and cleans up resources
 func (pm *PeerManager) Close() {
-	pm.stopRouteOptimizer()
 	if pm.peerMonitor != nil {
 		pm.peerMonitor.Close()
 		pm.peerMonitor = nil
@@ -989,11 +897,6 @@ func (pm *PeerManager) MarkPeerRelayed(siteID int, relayed bool) {
 func (pm *PeerManager) UnRelayPeer(siteId int, endpoint string) error {
 	pm.mu.Lock()
 	peer, exists := pm.peers[siteId]
-	if exists && peer.ActiveLocalEndpoint != "" {
-		pm.mu.Unlock()
-		logger.Info("Ignoring unrelay request for site %d: local connection is active", siteId)
-		return nil
-	}
 	if exists {
 		// Store the relay endpoint
 		peer.Endpoint = endpoint
@@ -1025,285 +928,3 @@ endpoint=%s`, util.FixKey(peer.PublicKey), endpoint)
 	logger.Info("Switched peer %d back to direct connection at %s", siteId, endpoint)
 	return nil
 }
-
-// LocalPeer switches a peer to a local network endpoint discovered by the peer monitor.
-// Local endpoints take priority over both the public endpoint and the relay, so this
-// bypasses relay/public-endpoint bookkeeping entirely and just updates the WireGuard
-// endpoint directly.
-func (pm *PeerManager) LocalPeer(siteId int, localEndpoint string) {
-	pm.mu.Lock()
-	peer, exists := pm.peers[siteId]
-	if exists {
-		peer.ActiveLocalEndpoint = localEndpoint
-		pm.peers[siteId] = peer
-	}
-	pm.mu.Unlock()
-
-	if !exists {
-		logger.Error("Cannot switch to local connection: peer with site ID %d not found", siteId)
-		return
-	}
-
-	// Update only the endpoint for this peer (update_only preserves other settings)
-	wgConfig := fmt.Sprintf(`public_key=%s
-update_only=true
-endpoint=%s`, util.FixKey(peer.PublicKey), localEndpoint)
-
-	if err := pm.device.IpcSet(wgConfig); err != nil {
-		logger.Error("Failed to switch peer %d to local connection: %v", siteId, err)
-		return
-	}
-
-	if pm.APIServer != nil {
-		pm.APIServer.UpdatePeerLocalStatus(siteId, localEndpoint, true)
-	}
-
-	logger.Info("Switched peer %d to local connection at %s", siteId, localEndpoint)
-}
-
-// UnLocalPeer switches a peer away from its active local endpoint back to the public
-// endpoint, resuming the normal public/relay monitoring logic from scratch (which will
-// re-trigger relay on its own if the public endpoint also turns out to be unreachable).
-func (pm *PeerManager) UnLocalPeer(siteId int) {
-	pm.mu.Lock()
-	peer, exists := pm.peers[siteId]
-	publicDNS := pm.publicDNS
-	if exists {
-		peer.ActiveLocalEndpoint = ""
-		pm.peers[siteId] = peer
-	}
-	pm.mu.Unlock()
-
-	if !exists {
-		logger.Error("Cannot fall back from local connection: peer with site ID %d not found", siteId)
-		return
-	}
-
-	resolved, err := util.ResolveDomainUpstream(formatEndpoint(peer.Endpoint), publicDNS)
-	if err != nil {
-		logger.Error("Failed to resolve fallback endpoint for peer %d: %v", siteId, err)
-		return
-	}
-
-	if err := pm.UnRelayPeer(siteId, resolved); err != nil {
-		logger.Error("Failed to fall back peer %d from local connection: %v", siteId, err)
-		return
-	}
-
-	if pm.APIServer != nil {
-		pm.APIServer.UpdatePeerLocalStatus(siteId, resolved, false)
-	}
-}
-
-// isBetterConnection returns true if connection quality (a) is better than (b).
-// Priority: connected > disconnected, then direct > relayed, then lower RTT.
-func isBetterConnection(aConn bool, aRelay bool, aRTT time.Duration,
-	bConn bool, bRelay bool, bRTT time.Duration) bool {
-	if aConn != bConn {
-		return aConn // connected beats disconnected
-	}
-	if !aConn {
-		return false // both offline, no preference
-	}
-	if aRelay != bRelay {
-		return !aRelay // direct beats relayed
-	}
-	// Same connectivity class: prefer lower RTT
-	if aRTT == 0 {
-		return false // unknown RTT, don't displace
-	}
-	if bRTT == 0 {
-		return true // current has no RTT data, prefer known
-	}
-	return aRTT < bRTT
-}
-
-// selectBestOwner returns the siteId of the best site to own the given IP,
-// based on connection quality. Must be called with pm.mu held.
-func (pm *PeerManager) selectBestOwner(claims map[int]bool) int {
-	bestSiteId := -1
-	var bestConn, bestRelay bool
-	var bestRTT time.Duration
-
-	for siteId := range claims {
-		conn, relay, rtt := pm.peerMonitor.GetConnectionQuality(siteId)
-		if bestSiteId < 0 || isBetterConnection(conn, relay, rtt, bestConn, bestRelay, bestRTT) {
-			bestSiteId = siteId
-			bestConn = conn
-			bestRelay = relay
-			bestRTT = rtt
-		}
-	}
-	return bestSiteId
-}
-
-// shouldSwitchOwner decides whether ownership of cidr should move from the current
-// owner to the candidate. It applies hysteresis so two sites with roughly equal
-// performance don't flap back and forth:
-//   - A switch driven by connectivity class (connected vs not, direct vs relayed) is
-//     always allowed immediately - these are correctness issues, not noise.
-//   - A switch driven purely by RTT requires both a minimum improvement margin and
-//     that the cooldown since the last switch of this route has elapsed.
-//
-// Must be called with pm.mu held.
-func (pm *PeerManager) shouldSwitchOwner(cidr string, currentSiteId, candidateSiteId int) bool {
-	curConn, curRelay, curRTT := pm.peerMonitor.GetConnectionQuality(currentSiteId)
-	candConn, candRelay, candRTT := pm.peerMonitor.GetConnectionQuality(candidateSiteId)
-
-	// Connectivity-class differences (up/down, direct/relayed) are not subject to
-	// hysteresis - always act on them so we don't stay stuck on a broken route.
-	if curConn != candConn || curRelay != candRelay {
-		return true
-	}
-	if !curConn {
-		return false // both down, nothing to do
-	}
-
-	// Same connectivity class: only switch on a meaningful, sustained RTT win.
-	if candRTT == 0 || curRTT == 0 {
-		return false
-	}
-	minImprovement := time.Duration(float64(curRTT) * routeSwitchRTTMargin)
-	if minImprovement < routeSwitchMinAbsMargin {
-		minImprovement = routeSwitchMinAbsMargin
-	}
-	if candRTT > curRTT-minImprovement {
-		return false // not enough of an improvement to be worth switching
-	}
-
-	if lastChange, ok := pm.lastOwnerChange[cidr]; ok {
-		if time.Since(lastChange) < routeSwitchCooldown {
-			return false // switched too recently, avoid flapping
-		}
-	}
-
-	return true
-}
-
-// getWireGuardAllowedIPs returns the full set of IPs that should be in WireGuard
-// for a peer: server IP /32 plus all shared IPs it currently owns.
-// Must be called with pm.mu held.
-func (pm *PeerManager) getWireGuardAllowedIPs(siteId int) []string {
-	peer, exists := pm.peers[siteId]
-	if !exists {
-		return nil
-	}
-	serverIP := strings.Split(peer.ServerIP, "/")[0] + "/32"
-	ips := []string{serverIP}
-	for cidr, owner := range pm.allowedIPOwners {
-		if owner == siteId {
-			ips = append(ips, cidr)
-		}
-	}
-	return ips
-}
-
-// transferOwnership moves WireGuard ownership of cidr from fromSiteId to toSiteId.
-// Must be called with pm.mu held.
-func (pm *PeerManager) transferOwnership(cidr string, fromSiteId int, toSiteId int) error {
-	// Update owner map first
-	pm.allowedIPOwners[cidr] = toSiteId
-
-	// Remove cidr from old owner's WireGuard allowed IPs
-	if fromPeer, exists := pm.peers[fromSiteId]; exists {
-		remaining := pm.getWireGuardAllowedIPs(fromSiteId) // cidr is no longer in owners, so it won't appear here
-		if err := RemoveAllowedIP(pm.device, fromPeer.PublicKey, remaining); err != nil {
-			// Revert
-			pm.allowedIPOwners[cidr] = fromSiteId
-			return fmt.Errorf("remove IP %s from site %d: %v", cidr, fromSiteId, err)
-		}
-	}
-
-	// Add cidr to new owner's WireGuard allowed IPs
-	if toPeer, exists := pm.peers[toSiteId]; exists {
-		if err := AddAllowedIP(pm.device, toPeer.PublicKey, cidr); err != nil {
-			return fmt.Errorf("add IP %s to site %d: %v", cidr, toSiteId, err)
-		}
-	}
-
-	return nil
-}
-
-// optimizeRoutes evaluates all shared IPs and reassigns ownership to the best site.
-func (pm *PeerManager) optimizeRoutes() {
-	pm.mu.Lock()
-	defer pm.mu.Unlock()
-
-	for cidr, claims := range pm.allowedIPClaims {
-		if len(claims) <= 1 {
-			continue // No competition, nothing to optimize
-		}
-
-		currentOwner, hasOwner := pm.allowedIPOwners[cidr]
-		bestOwner := pm.selectBestOwner(claims)
-
-		if bestOwner < 0 {
-			continue
-		}
-		if hasOwner && currentOwner == bestOwner {
-			continue // Already on the best site
-		}
-
-		if !hasOwner {
-			// No current owner, just assign
-			pm.allowedIPOwners[cidr] = bestOwner
-			pm.lastOwnerChange[cidr] = time.Now()
-			if toPeer, exists := pm.peers[bestOwner]; exists {
-				if err := AddAllowedIP(pm.device, toPeer.PublicKey, cidr); err != nil {
-					logger.Error("Failed to assign IP %s to site %d: %v", cidr, bestOwner, err)
-				}
-			}
-			continue
-		}
-
-		if !pm.shouldSwitchOwner(cidr, currentOwner, bestOwner) {
-			continue // Not a big enough or sustained enough improvement, avoid flapping
-		}
-
-		logger.Info("Route optimizer: moving %s from site %d to site %d", cidr, currentOwner, bestOwner)
-		if err := pm.transferOwnership(cidr, currentOwner, bestOwner); err != nil {
-			logger.Error("Failed to transfer ownership of %s from site %d to site %d: %v",
-				cidr, currentOwner, bestOwner, err)
-		} else {
-			pm.lastOwnerChange[cidr] = time.Now()
-		}
-	}
-}
-
-// startRouteOptimizer registers the status-change callback and launches the optimizer goroutine.
-func (pm *PeerManager) startRouteOptimizer() {
-	pm.routeOptimizerStop = make(chan struct{})
-
-	// Trigger optimization whenever any peer's connection status changes
-	if pm.peerMonitor != nil {
-		pm.peerMonitor.SetStatusChangeCallback(func(_ int) {
-			select {
-			case pm.optimizerTrigger <- struct{}{}:
-			default:
-			}
-		})
-	}
-
-	go func() {
-		ticker := time.NewTicker(5 * time.Second)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-pm.routeOptimizerStop:
-				return
-			case <-pm.optimizerTrigger:
-				pm.optimizeRoutes()
-			case <-ticker.C:
-				pm.optimizeRoutes()
-			}
-		}
-	}()
-}
-
-// stopRouteOptimizer stops the route optimizer goroutine if it is running.
-func (pm *PeerManager) stopRouteOptimizer() {
-	if pm.routeOptimizerStop != nil {
-		close(pm.routeOptimizerStop)
-		pm.routeOptimizerStop = nil
-	}
-}

peers/monitor/monitor.go

@@ -36,7 +36,7 @@ type PeerMonitor struct {
 	timeout     time.Duration
 	maxAttempts int
 	wsClient    *websocket.Client
-	publicDNS   []string
+	publicDNS []string
 
 	// Relay sender tracking
 	relaySends  map[string]func()
@@ -67,23 +67,6 @@ type PeerMonitor struct {
 	holepunchMaxAttempts int          // max consecutive failures before triggering relay
 	holepunchFailures    map[int]int  // siteID -> consecutive failure count
 
-	// Local endpoint testing fields. Local endpoints are ip:port addresses on the
-	// site host's local network interfaces (ordered best-to-worst by the server).
-	// When one is reachable it takes priority over both the public endpoint and
-	// the relay.
-	localEndpoints      map[int][]string // siteID -> ordered candidate local endpoints
-	localActiveEndpoint map[int]string   // siteID -> currently active local endpoint ("" = not using local)
-	localFailures       map[int]int      // siteID -> consecutive failures of the active local endpoint
-	localTestTimeout    time.Duration    // timeout for each local endpoint probe
-
-	// Local connection switch callbacks, set by the PeerManager
-	localSwitchCallback   func(siteId int, endpoint string) // invoked when a local endpoint becomes active
-	localFallbackCallback func(siteId int)                  // invoked when we fall back from a local endpoint
-
-	// Local connection sender tracking, keyed by chainId (informational messages only)
-	localSends  map[string]func()
-	localSendMu sync.Mutex
-
 	// Exponential backoff fields for holepunch monitor
 	defaultHolepunchMinInterval time.Duration // Minimum interval (initial)
 	defaultHolepunchMaxInterval time.Duration
@@ -102,9 +85,7 @@ type PeerMonitor struct {
 	apiServer *api.API
 
 	// WG connection status tracking
-	wgConnectionStatus   map[int]bool          // siteID -> WG connected status
-	wgConnectionRTT      map[int]time.Duration // siteID -> last known RTT
-	statusChangeCallback func(siteId int)      // called when any peer's connection status changes
+	wgConnectionStatus map[int]bool // siteID -> WG connected status
 }
 
 // NewPeerMonitor creates a new peer monitor with the given callback
@@ -123,7 +104,7 @@ func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDe
 		wsClient:             wsClient,
 		middleDev:            middleDev,
 		localIP:              localIP,
-		publicDNS:            publicDNS,
+		publicDNS:          publicDNS,
 		activePorts:          make(map[uint16]bool),
 		nsCtx:                ctx,
 		nsCancel:             cancel,
@@ -135,18 +116,12 @@ func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDe
 		relaySends:           make(map[string]func()),
 		holepunchMaxAttempts: 3, // Trigger relay after 3 consecutive failures
 		holepunchFailures:    make(map[int]int),
-		localEndpoints:       make(map[int][]string),
-		localActiveEndpoint:  make(map[int]string),
-		localFailures:        make(map[int]int),
-		localTestTimeout:     300 * time.Millisecond, // local network round trips should be fast
-		localSends:           make(map[string]func()),
 		// Rapid initial test settings: complete within ~1.5 seconds
 		rapidTestInterval:    200 * time.Millisecond, // 200ms between attempts
 		rapidTestTimeout:     400 * time.Millisecond, // 400ms timeout per attempt
 		rapidTestMaxAttempts: 5,                      // 5 attempts = ~1-1.5 seconds total
 		apiServer:            apiServer,
 		wgConnectionStatus:   make(map[int]bool),
-		wgConnectionRTT:      make(map[int]time.Duration),
 		// Exponential backoff settings for holepunch monitor
 		defaultHolepunchMinInterval: 2 * time.Second,
 		defaultHolepunchMaxInterval: 30 * time.Second,
@@ -170,19 +145,6 @@ func NewPeerMonitor(wsClient *websocket.Client, middleDev *middleDevice.MiddleDe
 	return pm
 }
 
-// SetPublicDNS replaces the DNS servers used to resolve peer endpoints and
-// hole-punch exit nodes.  The servers must be in "host:port" format.
-func (pm *PeerMonitor) SetPublicDNS(servers []string) {
-	pm.mutex.Lock()
-	pm.publicDNS = servers
-	tester := pm.holepunchTester
-	pm.mutex.Unlock()
-
-	if tester != nil {
-		tester.SetPublicDNS(servers)
-	}
-}
-
 // SetInterval changes how frequently peers are checked
 func (pm *PeerMonitor) SetPeerInterval(minInterval, maxInterval time.Duration) {
 	pm.mutex.Lock()
@@ -257,7 +219,7 @@ func (pm *PeerMonitor) ResetPeerHolepunchInterval() {
 }
 
 // AddPeer adds a new peer to monitor
-func (pm *PeerMonitor) AddPeer(siteID int, endpoint string, holepunchEndpoint string, localEndpoints []string) error {
+func (pm *PeerMonitor) AddPeer(siteID int, endpoint string, holepunchEndpoint string) error {
 	pm.mutex.Lock()
 	defer pm.mutex.Unlock()
 
@@ -275,9 +237,6 @@ func (pm *PeerMonitor) AddPeer(siteID int, endpoint string, holepunchEndpoint st
 
 	pm.holepunchEndpoints[siteID] = holepunchEndpoint
 	pm.holepunchStatus[siteID] = false // Initially unknown/disconnected
-	pm.localEndpoints[siteID] = localEndpoints
-	pm.localActiveEndpoint[siteID] = ""
-	pm.localFailures[siteID] = 0
 
 	if pm.running {
 		if err := client.StartMonitor(func(status ConnectionStatus) {
@@ -300,25 +259,6 @@ func (pm *PeerMonitor) UpdateHolepunchEndpoint(siteID int, endpoint string) {
 	logger.Debug("Updated holepunch endpoint for site %d to %s", siteID, endpoint)
 }
 
-// UpdateLocalEndpoints updates the candidate local endpoints for a peer
-func (pm *PeerMonitor) UpdateLocalEndpoints(siteID int, localEndpoints []string) {
-	pm.mutex.Lock()
-	defer pm.mutex.Unlock()
-	pm.localEndpoints[siteID] = localEndpoints
-	logger.Debug("Updated local endpoints for site %d: %v", siteID, localEndpoints)
-}
-
-// SetLocalConnectionCallbacks registers the callbacks invoked when a peer switches to
-// or falls back from a local network endpoint. onLocal is called with the endpoint that
-// became active; onFallback is called when we give up on the active local endpoint and
-// resume the normal public/relay monitoring logic.
-func (pm *PeerMonitor) SetLocalConnectionCallbacks(onLocal func(siteId int, endpoint string), onFallback func(siteId int)) {
-	pm.mutex.Lock()
-	defer pm.mutex.Unlock()
-	pm.localSwitchCallback = onLocal
-	pm.localFallbackCallback = onFallback
-}
-
 // RapidTestPeer performs a rapid connectivity test for a newly added peer.
 // This is designed to quickly determine if holepunch is viable within ~1-2 seconds.
 // Returns true if the connection is viable (holepunch works), false if it should relay.
@@ -370,126 +310,6 @@ func (pm *PeerMonitor) RapidTestPeer(siteID int, endpoint string) bool {
 	return false
 }
 
-// RapidTestLocalEndpoints performs a rapid connectivity test of local candidate endpoints
-// for a newly added peer, so local viability is known within the same ~1-2 second window as
-// RapidTestPeer's public-endpoint test (rather than waiting for the next backoff-loop tick,
-// which could be tens of seconds away). Candidates are tried in order (best-to-worst) and
-// the first reachable one wins. Returns the winning endpoint, or "" if none are reachable.
-func (pm *PeerMonitor) RapidTestLocalEndpoints(siteID int, endpoints []string) string {
-	if pm.holepunchTester == nil || len(endpoints) == 0 {
-		return ""
-	}
-
-	pm.mutex.Lock()
-	timeout := pm.rapidTestTimeout
-	pm.mutex.Unlock()
-
-	for _, endpoint := range endpoints {
-		result := pm.holepunchTester.TestEndpoint(endpoint, timeout)
-		if !result.Success {
-			continue
-		}
-
-		logger.Info("Rapid test: local endpoint %s for site %d SUCCEEDED (RTT: %v)", endpoint, siteID, result.RTT)
-
-		pm.mutex.Lock()
-		// Peer may have been removed while we were testing.
-		stillTracked := false
-		if _, tracked := pm.localEndpoints[siteID]; tracked {
-			stillTracked = true
-			pm.localActiveEndpoint[siteID] = endpoint
-			pm.localFailures[siteID] = 0
-		}
-		pm.mutex.Unlock()
-
-		if stillTracked {
-			pm.sendLocal(siteID, endpoint)
-		}
-
-		return endpoint
-	}
-
-	logger.Info("Rapid test: no local endpoint reachable for site %d", siteID)
-	return ""
-}
-
-// remainingLocalCandidates returns all of endpoints except exclude, preserving order.
-func remainingLocalCandidates(endpoints []string, exclude string) []string {
-	remaining := make([]string, 0, len(endpoints))
-	for _, ep := range endpoints {
-		if ep != exclude {
-			remaining = append(remaining, ep)
-		}
-	}
-	return remaining
-}
-
-// rapidTestOnLocalFallback runs a fast (~1-2 second) test of the public endpoint, racing it
-// against any remaining untried local candidates, immediately after we fall back from a dead
-// active local endpoint. Without this, the peer would sit on the public endpoint - which may
-// itself be unreachable - relying on the normal checkHolepunchEndpoints loop to notice, which
-// can take tens of seconds if the holepunch backoff interval had climbed while the local
-// endpoint was stable. If neither the public endpoint nor a local candidate is reachable, relay
-// is requested immediately. Mirrors PeerManager.performRapidInitialTest's race, but is triggered
-// by local-endpoint failure rather than initial peer setup.
-func (pm *PeerMonitor) rapidTestOnLocalFallback(siteID int, publicEndpoint string, remainingLocal []string) {
-	if pm.holepunchTester == nil {
-		return
-	}
-
-	var wg sync.WaitGroup
-	var localWinner string
-	var holepunchViable bool
-
-	if len(remainingLocal) > 0 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			localWinner = pm.RapidTestLocalEndpoints(siteID, remainingLocal)
-		}()
-	}
-
-	if publicEndpoint != "" {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			holepunchViable = pm.RapidTestPeer(siteID, publicEndpoint)
-		}()
-	}
-
-	wg.Wait()
-
-	pm.mutex.Lock()
-	_, stillTracked := pm.localEndpoints[siteID]
-	noLocalActiveYet := pm.localActiveEndpoint[siteID] == ""
-	switchCb := pm.localSwitchCallback
-	pm.mutex.Unlock()
-
-	if !stillTracked {
-		return // peer was removed while we were testing
-	}
-
-	if localWinner != "" {
-		// RapidTestLocalEndpoints already recorded the new active endpoint and notified the
-		// server, but doesn't move the WireGuard peer itself - do that here, unless a
-		// concurrent checkLocalEndpoints tick already beat us to activating something.
-		if noLocalActiveYet && switchCb != nil {
-			switchCb(siteID, localWinner)
-		}
-		logger.Info("Rapid fallback test: local connection %s viable for site %d", localWinner, siteID)
-		return
-	}
-
-	if !holepunchViable {
-		logger.Warn("Rapid fallback test: site %d unreachable on public endpoint after local fallback, requesting relay", siteID)
-		if pm.wsClient != nil {
-			pm.sendRelay(siteID)
-		}
-	} else {
-		logger.Info("Rapid fallback test: site %d reachable on public endpoint after local fallback", siteID)
-	}
-}
-
 // UpdatePeerEndpoint updates the monitor endpoint for a peer
 func (pm *PeerMonitor) UpdatePeerEndpoint(siteID int, monitorPeer string) {
 	pm.mutex.Lock()
@@ -523,18 +343,15 @@ func (pm *PeerMonitor) removePeerUnlocked(siteID int) {
 // RemovePeer stops monitoring a peer and removes it from the monitor
 func (pm *PeerMonitor) RemovePeer(siteID int) {
 	pm.mutex.Lock()
+	defer pm.mutex.Unlock()
 
 	// remove the holepunch endpoint info
 	delete(pm.holepunchEndpoints, siteID)
 	delete(pm.holepunchStatus, siteID)
 	delete(pm.relayedPeers, siteID)
 	delete(pm.holepunchFailures, siteID)
-	delete(pm.localEndpoints, siteID)
-	delete(pm.localActiveEndpoint, siteID)
-	delete(pm.localFailures, siteID)
 
 	pm.removePeerUnlocked(siteID)
-	pm.mutex.Unlock()
 }
 
 func (pm *PeerMonitor) RemoveHolepunchEndpoint(siteID int) {
@@ -575,22 +392,10 @@ func (pm *PeerMonitor) handleConnectionStatusChange(siteID int, status Connectio
 	pm.mutex.Lock()
 	previousStatus, exists := pm.wgConnectionStatus[siteID]
 	pm.wgConnectionStatus[siteID] = status.Connected
-	if status.Connected && status.RTT > 0 {
-		pm.wgConnectionRTT[siteID] = status.RTT
-	}
 	isRelayed := pm.relayedPeers[siteID]
-	localEndpoint := pm.localActiveEndpoint[siteID]
 	endpoint := pm.holepunchEndpoints[siteID]
 	pm.mutex.Unlock()
 
-	isLocal := localEndpoint != ""
-	if isLocal {
-		// Report the active local endpoint rather than the public one; local and relay
-		// are mutually exclusive.
-		endpoint = localEndpoint
-		isRelayed = false
-	}
-
 	// Log status changes
 	if !exists || previousStatus != status.Connected {
 		if status.Connected {
@@ -602,12 +407,7 @@ func (pm *PeerMonitor) handleConnectionStatusChange(siteID int, status Connectio
 
 	// Update API with connection status
 	if pm.apiServer != nil {
-		pm.apiServer.UpdatePeerStatus(siteID, status.Connected, status.RTT, endpoint, isRelayed, isLocal)
-	}
-
-	// Notify route optimizer of status change
-	if pm.statusChangeCallback != nil {
-		pm.statusChangeCallback(siteID)
+		pm.apiServer.UpdatePeerStatus(siteID, status.Connected, status.RTT, endpoint, isRelayed)
 	}
 }
 
@@ -657,75 +457,6 @@ func (pm *PeerMonitor) sendUnRelay(siteID int) error {
 	return nil
 }
 
-// sendLocal notifies the server that this peer switched to a local network endpoint, with
-// retry keyed by chainId. This is informational (e.g. so the server can relay the information
-// to newt) - olm does not wait for an acknowledgement before using the local connection, but
-// it does stop retrying once the server acks via CancelLocalSend, same as relay/unrelay.
-func (pm *PeerMonitor) sendLocal(siteID int, endpoint string) {
-	if pm.wsClient == nil {
-		return
-	}
-
-	chainId := generateChainId()
-	stopFunc, _ := pm.wsClient.SendMessageInterval("olm/wg/local", map[string]interface{}{
-		"siteId":   siteID,
-		"endpoint": endpoint,
-		"chainId":  chainId,
-	}, 2*time.Second, 10)
-
-	pm.localSendMu.Lock()
-	pm.localSends[chainId] = stopFunc
-	pm.localSendMu.Unlock()
-
-	logger.Info("Sent local-connection message for site %d (%s, chain %s)", siteID, endpoint, chainId)
-}
-
-// sendUnLocal notifies the server that this peer fell back from its local network endpoint,
-// with retry keyed by chainId.
-func (pm *PeerMonitor) sendUnLocal(siteID int) {
-	if pm.wsClient == nil {
-		return
-	}
-
-	chainId := generateChainId()
-	stopFunc, _ := pm.wsClient.SendMessageInterval("olm/wg/unlocal", map[string]interface{}{
-		"siteId":  siteID,
-		"chainId": chainId,
-	}, 2*time.Second, 10)
-
-	pm.localSendMu.Lock()
-	pm.localSends[chainId] = stopFunc
-	pm.localSendMu.Unlock()
-
-	logger.Info("Sent unlocal-connection message for site %d (chain %s)", siteID, chainId)
-}
-
-// CancelLocalSend stops the interval sender for the given chainId, if one exists.
-// If chainId is empty, all active local-connection senders are stopped.
-func (pm *PeerMonitor) CancelLocalSend(chainId string) {
-	pm.localSendMu.Lock()
-	defer pm.localSendMu.Unlock()
-
-	if chainId == "" {
-		for id, stop := range pm.localSends {
-			if stop != nil {
-				stop()
-			}
-			delete(pm.localSends, id)
-		}
-		logger.Info("Cancelled all local-connection senders")
-		return
-	}
-
-	if stop, ok := pm.localSends[chainId]; ok {
-		stop()
-		delete(pm.localSends, chainId)
-		logger.Info("Cancelled local-connection sender for chain %s", chainId)
-	} else {
-		logger.Warn("CancelLocalSend: no active sender for chain %s", chainId)
-	}
-}
-
 // CancelRelaySend stops the interval sender for the given chainId, if one exists.
 // If chainId is empty, all active relay senders are stopped.
 func (pm *PeerMonitor) CancelRelaySend(chainId string) {
@@ -790,25 +521,6 @@ func (pm *PeerMonitor) IsPeerRelayed(siteID int) bool {
 	return pm.relayedPeers[siteID]
 }
 
-// SetStatusChangeCallback registers a callback that is invoked whenever a peer's
-// WireGuard connection status changes (connected/disconnected). The callback must
-// be non-blocking (e.g., send to a buffered channel).
-func (pm *PeerMonitor) SetStatusChangeCallback(cb func(siteId int)) {
-	pm.mutex.Lock()
-	defer pm.mutex.Unlock()
-	pm.statusChangeCallback = cb
-}
-
-// GetConnectionQuality returns the current connection quality metrics for a peer.
-func (pm *PeerMonitor) GetConnectionQuality(siteId int) (connected bool, relayed bool, rtt time.Duration) {
-	pm.mutex.Lock()
-	defer pm.mutex.Unlock()
-	connected = pm.wgConnectionStatus[siteId]
-	relayed = pm.relayedPeers[siteId]
-	rtt = pm.wgConnectionRTT[siteId]
-	return
-}
-
 // startHolepunchMonitor starts the holepunch connection monitoring
 // Note: This function assumes the mutex is already held by the caller (called from Start())
 func (pm *PeerMonitor) startHolepunchMonitor() error {
@@ -873,8 +585,7 @@ func (pm *PeerMonitor) runHolepunchMonitor() {
 			timer.Reset(currentInterval)
 			logger.Debug("Holepunch monitor interval updated, reset to %v", currentInterval)
 		case <-timer.C:
-			localChanged := pm.checkLocalEndpoints()
-			anyStatusChanged := pm.checkHolepunchEndpoints() || localChanged
+			anyStatusChanged := pm.checkHolepunchEndpoints()
 
 			pm.mutex.Lock()
 			if anyStatusChanged {
@@ -896,140 +607,6 @@ func (pm *PeerMonitor) runHolepunchMonitor() {
 	}
 }
 
-// checkLocalEndpoints tests local network endpoints for sites that have them configured.
-// For a site not currently using a local endpoint, it probes each candidate in order
-// (candidates are ordered best-to-worst by the server) and switches to the first one that
-// succeeds. For a site already using a local endpoint, it re-tests that endpoint and falls
-// back to the normal public/relay logic after a few consecutive failures.
-// Returns true if any site's local-connection status changed.
-func (pm *PeerMonitor) checkLocalEndpoints() bool {
-	pm.mutex.Lock()
-	if !pm.running {
-		pm.mutex.Unlock()
-		return false
-	}
-	if pm.holepunchTester == nil {
-		pm.mutex.Unlock()
-		return false
-	}
-	candidates := make(map[int][]string, len(pm.localEndpoints))
-	for siteID, eps := range pm.localEndpoints {
-		if len(eps) > 0 {
-			candidates[siteID] = eps
-		}
-	}
-	active := make(map[int]string, len(pm.localActiveEndpoint))
-	for siteID, ep := range pm.localActiveEndpoint {
-		active[siteID] = ep
-	}
-	timeout := pm.localTestTimeout
-	maxAttempts := pm.holepunchMaxAttempts
-	pm.mutex.Unlock()
-
-	anyChanged := false
-
-	for siteID, endpoints := range candidates {
-		if activeEndpoint := active[siteID]; activeEndpoint != "" {
-			// Already using a local endpoint - verify it's still working.
-			result := pm.holepunchTester.TestEndpoint(activeEndpoint, timeout)
-
-			pm.mutex.Lock()
-			if _, stillTracked := pm.localEndpoints[siteID]; !stillTracked {
-				pm.mutex.Unlock()
-				continue // peer was removed while we were testing
-			}
-			if result.Success {
-				pm.localFailures[siteID] = 0
-				pm.mutex.Unlock()
-				continue
-			}
-			pm.localFailures[siteID]++
-			failureCount := pm.localFailures[siteID]
-			pm.mutex.Unlock()
-
-			if failureCount >= maxAttempts {
-				logger.Warn("Local endpoint %s for site %d failed %d times, falling back to public/relay logic", activeEndpoint, siteID, failureCount)
-
-				pm.mutex.Lock()
-				pm.localActiveEndpoint[siteID] = ""
-				pm.localFailures[siteID] = 0
-				pm.holepunchFailures[siteID] = 0 // don't immediately re-trigger relay on stale failures
-				// The holepunch backoff timer keeps climbing while a local endpoint is
-				// active (checkHolepunchEndpoints skips those sites but backoff still
-				// applies), so reset it here to avoid the resumed public/relay logic
-				// being stuck polling at a stale, heavily-backed-off interval.
-				pm.holepunchCurrentInterval = pm.holepunchMinInterval
-				publicEndpoint := pm.holepunchEndpoints[siteID]
-				remainingLocal := remainingLocalCandidates(pm.localEndpoints[siteID], activeEndpoint)
-				pm.mutex.Unlock()
-
-				anyChanged = true
-				pm.deactivateLocalEndpoint(siteID)
-
-				// Don't wait out the next backed-off checkHolepunchEndpoints tick to find out
-				// whether the public endpoint is reachable - rapidly test it (and any untried
-				// local candidates) now so a total connectivity loss triggers relay within
-				// ~1-2 seconds instead of potentially tens of seconds.
-				go pm.rapidTestOnLocalFallback(siteID, publicEndpoint, remainingLocal)
-			}
-			continue
-		}
-
-		// Not currently using a local endpoint - probe candidates in order.
-		for _, endpoint := range endpoints {
-			result := pm.holepunchTester.TestEndpoint(endpoint, timeout)
-
-			pm.mutex.Lock()
-			if _, stillTracked := pm.localEndpoints[siteID]; !stillTracked {
-				pm.mutex.Unlock()
-				break // peer was removed while we were testing
-			}
-			if !result.Success {
-				pm.mutex.Unlock()
-				continue
-			}
-			pm.localActiveEndpoint[siteID] = endpoint
-			pm.localFailures[siteID] = 0
-			pm.mutex.Unlock()
-
-			logger.Info("Local endpoint %s for site %d is reachable (RTT: %v), switching to local connection", endpoint, siteID, result.RTT)
-			anyChanged = true
-			pm.activateLocalEndpoint(siteID, endpoint)
-			break
-		}
-	}
-
-	return anyChanged
-}
-
-// activateLocalEndpoint invokes the switch callback and notifies the server that a local
-// endpoint became active for the given site.
-func (pm *PeerMonitor) activateLocalEndpoint(siteID int, endpoint string) {
-	pm.mutex.Lock()
-	cb := pm.localSwitchCallback
-	pm.mutex.Unlock()
-
-	if cb != nil {
-		cb(siteID, endpoint)
-	}
-
-	pm.sendLocal(siteID, endpoint)
-}
-
-// deactivateLocalEndpoint invokes the fallback callback and notifies the server that the
-// given site fell back from its local endpoint.
-func (pm *PeerMonitor) deactivateLocalEndpoint(siteID int) {
-	pm.mutex.Lock()
-	cb := pm.localFallbackCallback
-	pm.mutex.Unlock()
-
-	if cb != nil {
-		cb(siteID)
-	}
-
-	pm.sendUnLocal(siteID)
-}
-
 // checkHolepunchEndpoints tests all holepunch endpoints
 // Returns true if any endpoint's status changed
 func (pm *PeerMonitor) checkHolepunchEndpoints() bool {
@@ -1041,9 +618,6 @@ func (pm *PeerMonitor) checkHolepunchEndpoints() bool {
 	}
 	endpoints := make(map[int]string, len(pm.holepunchEndpoints))
 	for siteID, endpoint := range pm.holepunchEndpoints {
-		if pm.localActiveEndpoint[siteID] != "" {
-			continue // using a local connection, skip public/relay monitoring
-		}
 		endpoints[siteID] = endpoint
 	}
 	timeout := pm.holepunchTimeout
@@ -1101,10 +675,8 @@ func (pm *PeerMonitor) checkHolepunchEndpoints() bool {
 			wgConnected := pm.wgConnectionStatus[siteID]
 			pm.mutex.Unlock()
 
-			// Update API - use holepunch endpoint and relay status. Sites with an active
-			// local endpoint are filtered out of this loop above, so isLocal is always
-			// false here.
-			pm.apiServer.UpdatePeerStatus(siteID, wgConnected, result.RTT, endpoint, isRelayed, false)
+			// Update API - use holepunch endpoint and relay status
+			pm.apiServer.UpdatePeerStatus(siteID, wgConnected, result.RTT, endpoint, isRelayed)
 		}
 
 		// Handle relay logic based on holepunch status
@@ -1162,16 +734,6 @@ func (pm *PeerMonitor) Close() {
 	}
 	pm.relaySendMu.Unlock()
 
-	// Stop all pending local-connection senders
-	pm.localSendMu.Lock()
-	for chainId, stop := range pm.localSends {
-		if stop != nil {
-			stop()
-		}
-		delete(pm.localSends, chainId)
-	}
-	pm.localSendMu.Unlock()
-
 	pm.mutex.Lock()
 	defer pm.mutex.Unlock()
 

peers/peer.go

@@ -10,26 +10,17 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// ConfigurePeer sets up or updates a peer within the WireGuard device.
-// If siteConfig.ActiveLocalEndpoint is set, it takes priority over both the relay and the
-// public endpoint since it's a directly-reachable address on the site host's local network.
+// ConfigurePeer sets up or updates a peer within the WireGuard device
 func ConfigurePeer(dev *device.Device, siteConfig SiteConfig, privateKey wgtypes.Key, relay bool, persistentKeepalive int, publicDNS []string) error {
-	var siteHost string
-	if siteConfig.ActiveLocalEndpoint != "" {
-		// Local endpoints are already literal ip:port pairs on the local network, no DNS resolution needed.
-		siteHost = siteConfig.ActiveLocalEndpoint
+	var endpoint string
+	if relay && siteConfig.RelayEndpoint != "" {
+		endpoint = formatEndpoint(siteConfig.RelayEndpoint)
 	} else {
-		var endpoint string
-		if relay && siteConfig.RelayEndpoint != "" {
-			endpoint = formatEndpoint(siteConfig.RelayEndpoint)
-		} else {
-			endpoint = formatEndpoint(siteConfig.Endpoint)
-		}
-		var err error
-		siteHost, err = util.ResolveDomainUpstream(endpoint, publicDNS)
-		if err != nil {
-			return fmt.Errorf("failed to resolve endpoint for site %d: %v", siteConfig.SiteId, err)
-		}
+		endpoint = formatEndpoint(siteConfig.Endpoint)
+	}
+	siteHost, err := util.ResolveDomainUpstream(endpoint, publicDNS)
+	if err != nil {
+		return fmt.Errorf("failed to resolve endpoint for site %d: %v", siteConfig.SiteId, err)
 	}
 
 	// Split off the CIDR of the server IP which is just a string and add /32 for the allowed IP
@@ -75,7 +66,8 @@ func ConfigurePeer(dev *device.Device, siteConfig SiteConfig, privateKey wgtypes
 	config := configBuilder.String()
 	logger.Debug("Configuring peer with config: %s", config)
 
-	if err := dev.IpcSet(config); err != nil {
+	err = dev.IpcSet(config)
+	if err != nil {
 		return fmt.Errorf("failed to configure WireGuard peer: %v", err)
 	}
 

peers/types.go

@@ -8,21 +8,16 @@ type PeerAction struct {
 
 // UpdatePeerData represents the data needed to update a peer
 type SiteConfig struct {
-	SiteId         int      `json:"siteId"`
-	Name           string   `json:"name,omitempty"`
-	Endpoint       string   `json:"endpoint,omitempty"`
-	LocalEndpoints []string `json:"localEndpoints,omitempty"` // optional, ip:port endpoints on the site host's local network interfaces, ordered best-to-worst
-	RelayEndpoint  string   `json:"relayEndpoint,omitempty"`
-	PublicKey      string   `json:"publicKey,omitempty"`
-	ServerIP       string   `json:"serverIP,omitempty"`
-	ServerPort     uint16   `json:"serverPort,omitempty"`
-	RemoteSubnets  []string `json:"remoteSubnets,omitempty"` // optional, array of subnets that this site can access
-	AllowedIps     []string `json:"allowedIps,omitempty"`    // optional, array of allowed IPs for the peer
-	Aliases        []Alias  `json:"aliases,omitempty"`       // optional, array of alias configurations
-
-	// ActiveLocalEndpoint tracks the local network endpoint currently in use for this
-	// peer, if any. Not part of the wire protocol; set internally by the PeerManager.
-	ActiveLocalEndpoint string `json:"-"`
+	SiteId        int      `json:"siteId"`
+	Name          string   `json:"name,omitempty"`
+	Endpoint      string   `json:"endpoint,omitempty"`
+	RelayEndpoint string   `json:"relayEndpoint,omitempty"`
+	PublicKey     string   `json:"publicKey,omitempty"`
+	ServerIP      string   `json:"serverIP,omitempty"`
+	ServerPort    uint16   `json:"serverPort,omitempty"`
+	RemoteSubnets []string `json:"remoteSubnets,omitempty"` // optional, array of subnets that this site can access
+	AllowedIps    []string `json:"allowedIps,omitempty"`    // optional, array of allowed IPs for the peer
+	Aliases       []Alias  `json:"aliases,omitempty"`       // optional, array of alias configurations
 }
 
 type Alias struct {
@@ -46,13 +41,6 @@ type UnRelayPeerData struct {
 	Endpoint string `json:"endpoint"`
 }
 
-// LocalPeerAckData represents the server's acknowledgement of an "olm/wg/local" or
-// "olm/wg/unlocal" message. olm has already applied the local connection switch by the time
-// it sends the notification, so the ack is only used to stop the retry sender.
-type LocalPeerAckData struct {
-	SiteId int `json:"siteId"`
-}
-
 // PeerAdd represents the data needed to add remote subnets to a peer
 type PeerAdd struct {
 	SiteId        int      `json:"siteId"`

websocket/client.go

@@ -22,14 +22,6 @@ import (
 	"github.com/gorilla/websocket"
 )
 
-// writeDeadline bounds how long a websocket write may block before it is
-// treated as a failure. Without this, a write to a TCP connection whose
-// underlying network interface has disappeared (e.g. laptop sleep/resume,
-// Wi-Fi roam) can sit buffered in the kernel for minutes without erroring,
-// which prevents the ping monitor from ever detecting the dead connection
-// and reconnecting.
-const writeDeadline = 10 * time.Second
-
 // AuthError represents an authentication/authorization error (401/403)
 type AuthError struct {
 	StatusCode int
@@ -91,7 +83,6 @@ type Client struct {
 	isDisconnected    bool // Flag to track if client is intentionally disconnected
 	reconnectMux      sync.RWMutex
 	pingInterval      time.Duration
-	pongWait          time.Duration // read deadline window; if no pong/message arrives within it, the connection is considered dead
 	onConnect         func() error
 	onTokenUpdate     func(token string, exitNodes []ExitNode)
 	onAuthError       func(statusCode int, message string) // Callback for auth errors
@@ -176,16 +167,6 @@ func NewClient(ID, secret, userToken, orgId, endpoint string, pingInterval time.
 		OrgID:     orgId,
 	}
 
-	// Read deadline window: must exceed pingInterval so a healthy connection
-	// (which gets a pong/message at least every pingInterval) is never torn
-	// down, but a dead/half-open one — including one where writes keep
-	// "succeeding" because small pings fit in the kernel send buffer even
-	// under total packet loss — is detected within ~2 ping cycles.
-	pongWait := pingInterval * 2
-	if pongWait < 20*time.Second {
-		pongWait = 20 * time.Second
-	}
-
 	client := &Client{
 		config:            config,
 		baseURL:           endpoint, // default value
@@ -194,7 +175,6 @@ func NewClient(ID, secret, userToken, orgId, endpoint string, pingInterval time.
 		reconnectInterval: 3 * time.Second,
 		isConnected:       false,
 		pingInterval:      pingInterval,
-		pongWait:          pongWait,
 		clientType:        "olm",
 		pingDone:          make(chan struct{}),
 	}
@@ -288,9 +268,6 @@ func (c *Client) SendMessage(messageType string, data interface{}) error {
 
 	c.writeMux.Lock()
 	defer c.writeMux.Unlock()
-	if err := c.conn.SetWriteDeadline(time.Now().Add(writeDeadline)); err != nil {
-		return err
-	}
 	return c.conn.WriteJSON(msg)
 }
 
@@ -605,18 +582,6 @@ func (c *Client) establishConnection() error {
 	c.conn = conn
 	c.setConnected(true)
 
-	// Arm a read deadline and refresh it whenever a pong arrives. Combined with
-	// the protocol-level ping sent alongside the app-level one in sendPing,
-	// this detects a dead or half-open connection (e.g. the route disappearing
-	// on sleep/resume, or total packet loss) that a write-side check alone
-	// misses: small periodic pings fit in the kernel send buffer and keep
-	// "succeeding" even when nothing is actually reaching the peer.
-	_ = c.conn.SetReadDeadline(time.Now().Add(c.pongWait))
-	c.conn.SetPongHandler(func(appData string) error {
-		_ = c.conn.SetReadDeadline(time.Now().Add(c.pongWait))
-		return nil
-	})
-
 	// Note: ping monitor is NOT started here - it will be started when
 	// StartPingMonitor() is called after registration completes
 
@@ -732,17 +697,7 @@ func (c *Client) sendPing() {
 	logger.Debug("websocket: Sending ping: %+v", pingMsg)
 
 	c.writeMux.Lock()
-	err := c.conn.SetWriteDeadline(time.Now().Add(writeDeadline))
-	if err == nil {
-		err = c.conn.WriteJSON(pingMsg)
-	}
-	if err == nil {
-		// Protocol-level ping: a standards-compliant server replies with a
-		// PONG, which refreshes the read deadline via SetPongHandler. This is
-		// what actually detects a half-open connection where writes still
-		// "succeed" (buffered by the kernel) but nothing is reaching the peer.
-		_ = c.conn.WriteControl(websocket.PingMessage, nil, time.Now().Add(writeDeadline))
-	}
+	err := c.conn.WriteJSON(pingMsg)
 	c.writeMux.Unlock()
 	if err != nil {
 		// Check if we're shutting down before logging error and reconnecting
@@ -848,13 +803,6 @@ func (c *Client) readPumpWithDisconnectDetection() {
 			return
 		default:
 			messageType, p, err := c.conn.ReadMessage()
-			if err == nil {
-				// Any inbound traffic means the peer is alive — extend the
-				// read deadline (also covers servers that answer the
-				// app-level "olm/ping" with a message rather than a
-				// protocol pong).
-				_ = c.conn.SetReadDeadline(time.Now().Add(c.pongWait))
-			}
 			if err != nil {
 				// Check if we're shutting down or explicitly disconnected before logging error
 				select {