LLT-6855: Separation of daemon lifecycle from VPN connection state management - #1909
Open
tomasz-kumor wants to merge 5 commits into
Open
LLT-6855: Separation of daemon lifecycle from VPN connection state management#1909tomasz-kumor wants to merge 5 commits into
tomasz-kumor wants to merge 5 commits into
Conversation
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 24, 2026 09:19
f57a61c to
e00827b
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 24, 2026 11:05
e00827b to
2558ede
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 30, 2026 09:52
958e427 to
0c1644b
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 30, 2026 15:09
0c1644b to
26f42ca
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 31, 2026 09:56
26f42ca to
3111f18
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 31, 2026 14:23
3111f18 to
be8d6ac
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 31, 2026 14:25
be8d6ac to
9401f81
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
July 31, 2026 14:28
9401f81 to
e16efbb
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 3, 2026 10:05
e16efbb to
59fd4e2
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 3, 2026 13:08
59fd4e2 to
09d954f
Compare
tomasz-kumor
marked this pull request as ready for review
August 3, 2026 13:21
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 5, 2026 11:40
09d954f to
507311f
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 6, 2026 09:10
507311f to
d34ae16
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 6, 2026 13:41
d34ae16 to
fa5151f
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 13, 2026 12:45
5c65ee1 to
ede8d7f
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 14, 2026 07:31
ede8d7f to
dbff665
Compare
lcruz99
reviewed
Aug 14, 2026
lcruz99
reviewed
Aug 14, 2026
lcruz99
reviewed
Aug 14, 2026
lcruz99
reviewed
Aug 14, 2026
lcruz99
reviewed
Aug 14, 2026
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 17, 2026 10:28
dbff665 to
f02076c
Compare
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 18, 2026 09:41
f02076c to
9ef4693
Compare
Currently, starting the nordvpnlite daemon is strictly coupled with establishing a VPN connection. This commit introduces a new flag that allows the daemon startup to be separated from establishing a VPN connection, without breaking the legacy behaviour.
Without explicitly deleting the IPv6 default route, the route persisted after the interface was brought down, causing stale routing entries and potential IPv6 traffic leaks through the old interface.
After reload, the daemon re-evaluated --do-not-connect instead of the VPN last state and as a result after the reload VPN connection state could be different than the pre-reload state.
Currently, establishing a VPN connection is tightly coupled with the NordVPN Lite daemon start/stop lifecycle. This commit decouples VPN connection management from daemon state management, establishing clear separation of concerns between the two functionalities.
tomasz-kumor
force-pushed
the
kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite
branch
from
August 18, 2026 09:42
9ef4693 to
350bd9a
Compare
tomaszpatejko
previously approved these changes
Aug 18, 2026
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
lcruz99
reviewed
Aug 19, 2026
Contributor
There was a problem hiding this comment.
what's the reason for this downgrade?
Contributor
Author
There was a problem hiding this comment.
I just called
cargo update -p h2
which was suggested as a fix by deny CI job
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Currently the VPN connection state is tightly coupled with the daemon lifecycle and there is not way to connect/disconnect VPN exit node without changing the NordVPN Lite daemon state.
Solution
nordvpnlite start --do-not-connectflag to allow separate launching the daemon from establishing VPN connection.connect/disconnectcommands that allows to control the VPN connection stateTesting
Check that daemon is running but VPN connection is not established
Connect to the VPN exit node & check that VPN connection is established
Disconnect from the VPN exit node
☑️ Definition of Done checklist