Skip to content

LLT-6855: Separation of daemon lifecycle from VPN connection state management - #1909

Open
tomasz-kumor wants to merge 5 commits into
mainfrom
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
Open

LLT-6855: Separation of daemon lifecycle from VPN connection state management#1909
tomasz-kumor wants to merge 5 commits into
mainfrom
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite

Conversation

@tomasz-kumor

@tomasz-kumor tomasz-kumor commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Problem

Currently the VPN connection state is tightly coupled with the daemon lifecycle and there is not way to connect/disconnect VPN exit node without changing the NordVPN Lite daemon state.

Solution

  • Separate nordvpnlite daemon lifecycle management from VPN connection state management.
    • Introduced nordvpnlite start --do-not-connect flag to allow separate launching the daemon from establishing VPN connection.
    • Introduced dedicated CLI connect/disconnect commands that allows to control the VPN connection state

Testing

  1. Run daemon without establishing VPN connection
# ./nordvpnlite start --do-not-connect -c config.json

Check that daemon is running but VPN connection is not established

# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}

Connect to the VPN exit node & check that VPN connection is established

# ./nordvpnlite connect
Command executed successfully
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

Disconnect from the VPN exit node

# ./nordvpnlite disconnect
Command executed successfully
# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}
  1. Check legacy behavior
# ./nordvpnlite stop
# ./nordvpnlite start -c config.json
...
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

☑️ Definition of Done checklist

  • Commit history is clean (requirements)
  • README.md is updated
  • Functionality is covered by unit or integration tests

@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from f57a61c to e00827b Compare July 24, 2026 09:19
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e00827b to 2558ede Compare July 24, 2026 11:05
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 958e427 to 0c1644b Compare July 30, 2026 09:52
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 0c1644b to 26f42ca Compare July 30, 2026 15:09
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 26f42ca to 3111f18 Compare July 31, 2026 09:56
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 3111f18 to be8d6ac Compare July 31, 2026 14:23
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from be8d6ac to 9401f81 Compare July 31, 2026 14:25
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 9401f81 to e16efbb Compare July 31, 2026 14:28
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e16efbb to 59fd4e2 Compare August 3, 2026 10:05
@tomasz-kumor tomasz-kumor changed the title [DRAFT] kumor/llt 6855 only one way of stopping nordvpnlite LLT-6855: start/stop command currently is confusing when used manually - can't stop daemon Aug 3, 2026
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 59fd4e2 to 09d954f Compare August 3, 2026 13:08
@tomasz-kumor
tomasz-kumor marked this pull request as ready for review August 3, 2026 13:21
@tomasz-kumor
tomasz-kumor requested a review from a team as a code owner August 3, 2026 13:21
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 09d954f to 507311f Compare August 5, 2026 11:40
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 507311f to d34ae16 Compare August 6, 2026 09:10
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from d34ae16 to fa5151f Compare August 6, 2026 13:41
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 5c65ee1 to ede8d7f Compare August 13, 2026 12:45
@tomasz-kumor tomasz-kumor changed the title LLT-6855: start/stop command currently is confusing when used manually - can't stop daemon LLT-6855: Separation of daemon lifecycle management from VPN connection state management Aug 13, 2026
@tomasz-kumor tomasz-kumor changed the title LLT-6855: Separation of daemon lifecycle management from VPN connection state management LLT-6855: Separation of daemon lifecycle from VPN connection state management Aug 13, 2026
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from ede8d7f to dbff665 Compare August 14, 2026 07:31
@tomasz-kumor
tomasz-kumor requested a review from lcruz99 August 14, 2026 08:58
Comment thread clis/nordvpnlite/src/daemon.rs Outdated
Comment thread clis/nordvpnlite/src/command_listener.rs Outdated
Comment thread clis/nordvpnlite/src/daemon.rs Outdated
Comment thread clis/nordvpnlite/src/daemon.rs Outdated
Comment thread clis/nordvpnlite/src/main.rs Outdated
Comment thread clis/nordvpnlite/README.md
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from dbff665 to f02076c Compare August 17, 2026 10:28
@tomasz-kumor
tomasz-kumor requested a review from lcruz99 August 17, 2026 10:33
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from f02076c to 9ef4693 Compare August 18, 2026 09:41
Currently, starting the nordvpnlite daemon is strictly coupled with establishing
a VPN connection. This commit introduces a new flag that allows the daemon
startup to be separated from establishing a VPN connection, without breaking
the legacy behaviour.
Without explicitly deleting the IPv6 default route, the route
persisted after the interface was brought down, causing stale
routing entries and potential IPv6 traffic leaks through the
old interface.
After reload, the daemon re-evaluated --do-not-connect instead
of the VPN last state and as a result after the reload VPN connection
state could be different than the pre-reload state.
Currently, establishing a VPN connection is tightly coupled with
the NordVPN Lite daemon start/stop lifecycle.
This commit decouples VPN connection management from daemon state management,
establishing clear separation of concerns between the two functionalities.
@tomasz-kumor
tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 9ef4693 to 350bd9a Compare August 18, 2026 09:42
tomaszpatejko
tomaszpatejko previously approved these changes Aug 18, 2026
The h2 crate, used internally by hyper, had a flaw that would accept and queue
empty DATA frames without limit. If streams were not actively drained, this
could lead to unbounded memory usage, or a panic if the length overflows.
Comment thread Cargo.lock

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the reason for this downgrade?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just called

cargo update -p h2

which was suggested as a fix by deny CI job

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants