LLT-6855: Separation of daemon lifecycle from VPN connection state management by tomasz-kumor · Pull Request #1909 · NordSecurity/libtelio

tomasz-kumor · 2026-07-24T08:47:09Z

Problem

Currently the VPN connection state is tightly coupled with the daemon lifecycle and there is not way to connect/disconnect VPN exit node without changing the NordVPN Lite daemon state.

Solution

Separate nordvpnlite daemon lifecycle management from VPN connection state management.
- Introduced nordvpnlite start --do-not-connect flag to allow separate launching the daemon from establishing VPN connection.
- Introduced dedicated CLI connect/disconnect commands that allows to control the VPN connection state

Testing

Run daemon without establishing VPN connection

# ./nordvpnlite start --do-not-connect -c config.json

Check that daemon is running but VPN connection is not established

# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}

Connect to the VPN exit node & check that VPN connection is established

# ./nordvpnlite connect
Command executed successfully
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

Disconnect from the VPN exit node

# ./nordvpnlite disconnect
Command executed successfully
# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}

Check legacy behavior

# ./nordvpnlite stop
# ./nordvpnlite start -c config.json
...
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

☑️ Definition of Done checklist

Commit history is clean (requirements)
README.md is updated
Functionality is covered by unit or integration tests

lcruz99 · 2026-09-01T13:03:45Z

+        error!("Connect: receiver dropped before result could be sent");
+    }
+    Ok(TelioTaskOutcome::Continue)
 }


How does this look like? can you share a snippet of the logs?

lcruz99 · 2026-09-01T14:07:42Z

+    /// Sender to send commands back to the telio task loop
+    telio_tx: mpsc::Sender<TelioTaskCmd>,
+    /// Flag to track if a connect is pending to avoid double-connect race
+    pending_connect: bool,


perhaps this should be a state machine, updated periodically or/and whenever getstatus is called

lcruz99 · 2026-09-02T11:10:20Z

                "dev",
                &self.interface_name,
            ]))?;
        }


Not affected by this PR, but I think we should log something here. eg: "Unsupported".

lcruz99 · 2026-09-02T11:14:39Z

+    #[error("Already connected to exit node")]
+    AlreadyConnected,
+    #[error("Connection to exit node already in progress")]
+    ConnectionPending,
+    #[error("Not connected to exit node")]
+    NotConnected,


Abstract or reuse errors, these errors all have the same base, e.g.: CommandFailed.

I mean, these are error details not errors themselves.

lcruz99 · 2026-09-02T13:34:15Z

        mut rx_channel: mpsc::Receiver<TelioTaskCmd>,
-    ) -> Result<(), NordVpnLiteError> {
+    ) -> Result<bool, NordVpnLiteError> {
+        let mut was_connected = false;


Why is was_connected added? Also find it a bit confusing/non-intuitive that fn start_listening_commands() returns it.

lcruz99 · 2026-09-02T14:32:50Z

-                            external_nodes.iter().find(|node| node.is_exit).map(|node| {
-                                ExitNodeStatus::from_node(node, exit_node.endpoint.hostname)
+            TelioTaskCmd::Disconnect(response_tx) => {
+                let result = (|| {


why the closure?

lcruz99 · 2026-09-02T14:43:33Z

+                    Ok(()) => Ok(CommandResponse::Ok),
+                    Err(e) => Ok(CommandResponse::Err(e)),
+                })
+                .await


any reason for blocking here and not on the upper ClientCmd::Connect arm?

lcruz99 · 2026-09-02T14:44:56Z

+                        ClientCmd::GetStatus
+                        | ClientCmd::Reload
+                        | ClientCmd::Connect
+                        | ClientCmd::Disconnect => CommandResponse::DaemonInitializing,


at this point we should consider replacing these commands with _

lcruz99 · 2026-09-02T15:12:10Z

OpenWrt tests at https://github.com/NordSecurity/libtelio/blob/kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite/nat-lab/tests/test_openwrt.py should be adapted, they are still using start/stopping the daemon on every reconnect. It's critical that these new changes are tested on that platform.

To avoid missing them, maybe is a good idea to put them in the same dir or couple them smw

nat-lab
├──tests
         ├──nordvpnlite
                 ├── test_nordvpnlite.py
                 └── test_openwrt.py

lcruz99 · 2026-09-02T15:16:48Z

+    /// Sends `command` to a fake daemon that replies with `error_msg`
+    /// and asserts that the error is propagated to the client.
+    async fn test_command_error_helper(command: ClientCmd, error_msg: &str) {
+        let path = make_socket_path();


this is not a test but a helper, remove the test_ prefix.

lcruz99 · 2026-09-02T15:17:14Z

+            response.unwrap(),
+            CommandResponse::Err(error_msg.to_string())
+        );
+        assert_eq!(cmd.unwrap(), command);


assertions should be made on tests, not on helpers.

lcruz99 · 2026-09-02T15:48:10Z

            trace!("TelioTask got command {:?}", cmd);
+
+            if matches!(cmd, TelioTaskCmd::Quit(_)) {
+                was_connected = self.is_connected()?;


why return if not connected?

or if external_nodes() fail at https://github.com/NordSecurity/libtelio/blob/c336ab9fdb9ce4f3944139758c13e897ffc35943/clis/nordvpnlite/src/daemon.rs#L225

lcruz99 · 2026-09-02T16:01:40Z


+    /// Sends `command` to a fake daemon that replies with `error_msg`
+    /// and asserts that the error is propagated to the client.
+    async fn test_command_error_helper(command: ClientCmd, error_msg: &str) {


no point of using a string literal for error_msg, use a owned type instead ie: String

lcruz99 · 2026-09-02T16:07:58Z

+    }
+
+    #[tokio::test]
+    async fn test_command_disconnect_error() {


where's the assertions?

lcruz99 · 2026-09-02T16:11:56Z

+    }
+
+    #[tokio::test]
+    async fn test_command_connect_returns_ok_immediately() {


what is this test doing? is literally the same as test_command_connect()

lcruz99 · 2026-09-02T16:34:49Z

                });

+                // Has to be after cleanup to avoid issues with missing device
+                ctx.telio.stop();


this is a workaround for a faulty cleanup. If the device is missing it shouldn't fail cleanup but instead handle that failure. It should be resilient.

Currently, starting the nordvpnlite daemon is strictly coupled with establishing a VPN connection. This commit introduces a new flag that allows the daemon startup to be separated from establishing a VPN connection, without breaking the legacy behaviour.

Without explicitly deleting the IPv6 default route, the route persisted after the interface was brought down, causing stale routing entries and potential IPv6 traffic leaks through the old interface.

After reload, the daemon re-evaluated --do-not-connect instead of the VPN last state and as a result after the reload VPN connection state could be different than the pre-reload state.

Currently, establishing a VPN connection is tightly coupled with the NordVPN Lite daemon start/stop lifecycle. This commit decouples VPN connection management from daemon state management, establishing clear separation of concerns between the two functionalities.

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from f57a61c to e00827b Compare July 24, 2026 09:19

tomasz-kumor temporarily deployed to Internal July 24, 2026 09:19 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e00827b to 2558ede Compare July 24, 2026 11:05

tomasz-kumor temporarily deployed to Internal July 24, 2026 11:05 — with GitHub Actions Inactive

tomasz-kumor temporarily deployed to Internal July 24, 2026 14:24 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 958e427 to 0c1644b Compare July 30, 2026 09:52

tomasz-kumor temporarily deployed to Internal July 30, 2026 09:52 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 0c1644b to 26f42ca Compare July 30, 2026 15:09

tomasz-kumor temporarily deployed to Internal July 30, 2026 15:09 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 26f42ca to 3111f18 Compare July 31, 2026 09:56

tomasz-kumor temporarily deployed to Internal July 31, 2026 09:56 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 3111f18 to be8d6ac Compare July 31, 2026 14:23

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:23 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from be8d6ac to 9401f81 Compare July 31, 2026 14:25

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:25 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 9401f81 to e16efbb Compare July 31, 2026 14:28

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:30 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e16efbb to 59fd4e2 Compare August 3, 2026 10:05

tomasz-kumor temporarily deployed to Internal August 3, 2026 10:05 — with GitHub Actions Inactive

tomasz-kumor changed the title ~~[DRAFT] kumor/llt 6855 only one way of stopping nordvpnlite~~ LLT-6855: start/stop command currently is confusing when used manually - can't stop daemon Aug 3, 2026

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 59fd4e2 to 09d954f Compare August 3, 2026 13:08

tomasz-kumor temporarily deployed to Internal August 3, 2026 13:09 — with GitHub Actions Inactive

tomasz-kumor marked this pull request as ready for review August 3, 2026 13:21

tomasz-kumor requested a review from a team as a code owner August 3, 2026 13:21

tomasz-kumor requested a review from tomaszpatejko August 3, 2026 13:31

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 09d954f to 507311f Compare August 5, 2026 11:40

tomasz-kumor temporarily deployed to Internal August 5, 2026 11:40 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 507311f to d34ae16 Compare August 6, 2026 09:10

tomasz-kumor temporarily deployed to Internal August 6, 2026 09:10 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from d34ae16 to fa5151f Compare August 6, 2026 13:41

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 3d885ab to 2549ddd Compare August 25, 2026 12:24

tomasz-kumor temporarily deployed to Internal August 25, 2026 12:31 — with GitHub Actions Inactive

tomasz-kumor temporarily deployed to Internal August 27, 2026 08:46 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 586fcf1 to 111bb52 Compare August 27, 2026 09:42

tomasz-kumor temporarily deployed to Internal August 27, 2026 09:42 — with GitHub Actions Inactive

tomasz-kumor requested a review from lcruz99 August 27, 2026 12:38

lcruz99 reviewed Sep 1, 2026

View reviewed changes

lcruz99 reviewed Sep 2, 2026

View reviewed changes

tomasz-kumor added 2 commits September 11, 2026 10:27

LLT-6855: remove IPv6 default route on interface teardown

070e842

Without explicitly deleting the IPv6 default route, the route persisted after the interface was brought down, causing stale routing entries and potential IPv6 traffic leaks through the old interface.

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 111bb52 to a919b29 Compare September 11, 2026 08:30

tomasz-kumor deployed to Internal September 11, 2026 08:30 — with GitHub Actions Active

tomasz-kumor added 2 commits September 11, 2026 13:10

LLT-6855: preserve VPN connection state across nordvpnlite reloads

fcb1b61

After reload, the daemon re-evaluated --do-not-connect instead of the VPN last state and as a result after the reload VPN connection state could be different than the pre-reload state.

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from a919b29 to 3beaa3d Compare September 11, 2026 11:31

tomasz-kumor deployed to Internal September 11, 2026 11:31 — with GitHub Actions Active

Uh oh!

Conversation

tomasz-kumor commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Testing

☑️ Definition of Done checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tomasz-kumor commented Jul 24, 2026 •

edited

Loading

lcruz99 Sep 2, 2026 •

edited

Loading

lcruz99 Sep 2, 2026 •

edited

Loading

lcruz99 commented Sep 2, 2026 •

edited

Loading

lcruz99 Sep 2, 2026 •

edited

Loading