LLT-6855: Separation of daemon lifecycle from VPN connection state management by tomasz-kumor · Pull Request #1909 · NordSecurity/libtelio

tomasz-kumor · 2026-07-24T08:47:09Z

Problem

Currently the VPN connection state is tightly coupled with the daemon lifecycle and there is not way to connect/disconnect VPN exit node without changing the NordVPN Lite daemon state.

Solution

Separate nordvpnlite daemon lifecycle management from VPN connection state management.
- Introduced nordvpnlite start --do-not-connect flag to allow separate launching the daemon from establishing VPN connection.
- Introduced dedicated CLI connect/disconnect commands that allows to control the VPN connection state

Testing

Run daemon without establishing VPN connection

# ./nordvpnlite start --do-not-connect -c config.json

Check that daemon is running but VPN connection is not established

# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}

Connect to the VPN exit node & check that VPN connection is established

# ./nordvpnlite connect
Command executed successfully
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

Disconnect from the VPN exit node

# ./nordvpnlite disconnect
Command executed successfully
# ./nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": null
}

Check legacy behavior

# ./nordvpnlite stop
# ./nordvpnlite start -c config.json
...
# /nordvpnlite status
{
  "telio_is_running": true,
  "ip_address": null,
  "exit_node": {
    "identifier": "2432424-234536f34f3-4235f34-323",
    "public_key": "cnwurvevke4747tb43y3v74659g45gh45vd5e",
    "hostname": "lt.nordvpn.com",
    "endpoint": "181.88.88.88:51320",
    "state": "connected"
  }
}

☑️ Definition of Done checklist

Commit history is clean (requirements)
README.md is updated
Functionality is covered by unit or integration tests

lcruz99 · 2026-08-24T13:31:25Z

 pub async fn daemon_event_loop(
    mut config: RunningConfig,
    logging_handle: &mut logging::LoggingHandle,
+    auto_connect: bool,


Perhaps this param belongs to the config? Not saying to ditch the CLI flag, both can coexist

Not really. It would require a bigger refactoring. Right now the RunningConfig contains the parsed data from the configuration file and some information about the configuration file itself. Command line parameter does not fit to it now.

lcruz99 · 2026-08-24T13:38:20Z

+
+        if let Err(e) = execute(Command::new("ip").args([
+            "-6",
+            "route",
+            "del",
+            "default",
+            "dev",
+            &self.interface_name,
+        ])) {
+            error!("Failed to remove IPv6 default route: {e}");
+        }
+


Seeing this makes me wonder: is there anything else to be cleaned for IPv6? (eg: tables, routes, fwmarks)

This was added to make the cleanup implementation symetric to set_exit_routes(). Without that there were sometimes problems with reconnecting after the VPN connection was disconnected.

lcruz99 · 2026-08-24T14:29:49Z

+    Disconnected,
+    Connected,
+}
+


This enum is needless, the exit node status should be checked instead. See examples in the code

isn't what TelioTaskCmd::GetStatus is doing? IIUC, you have created enum VpnConnectionState which is intrinsically Daemon's object, however this is an exclusive property of telio, the protocol lib.

That's a good point. I have changed the implementation that if exit node was in connected or connecting state after reload, the app will try to re-establish the VPN connection.

lcruz99 · 2026-08-24T15:07:04Z

                .await
            }
+            ClientCmd::Connect => {
+                trace!("Connect");


Maybe we can wrap self.telio_task_tx.send() and trace!() on every call. Wdyt?

This change won't remove too much duplications. I would prefer not try to refactor this code in scope of this PR.

lcruz99 · 2026-08-24T15:13:13Z

+
+    #[tokio::test]
+    async fn test_command_connect_disconnect_error() {
+        test_command_error_helper(ClientCmd::Connect, "simulated connect failure").await;


'"simulated connect failure"' message doesn't add any info, pls add more details like what was the test intention and what failed

Slightly improved it by adding comments and documenting the helper function.

lcruz99 · 2026-08-25T10:02:34Z

+
+                let endpoint_result = ctx
+                    .tokio_handle
+                    .block_on(get_server_endpoints_list(&ctx.config))


This API call can block the whole daemon for long time, and I think would be best to avoid moving the runtime around.

lcruz99 · 2026-08-25T10:03:37Z

    config: NordVpnLiteConfig,
    exit_node: Option<ExitNodeStatus>,
+    connection_state: VpnConnectionState,
+    /// Handle to the tokio runtime. Used to run async tasks (e.g. HTTP calls) from


Used to run async tasks

You're using it to run sync tasks.

I am calling the get_server_endpoints_list() which is async.

lcruz99 · 2026-08-25T11:06:00Z

+        exit_node_config: ExitNodeConfig,
+    ) -> Result<(), NordVpnLiteError> {
+        self.interface_config_provider
+            .set_exit_routes(&exit_node_config.endpoint.address, &exit_node_config.dns)


set_exit_routes() can be called twice if handle_exit_node_connection() is still fetching the endpoints, this should be fixed by making the endpoints fetch async though.

lcruz99 · 2026-08-25T11:12:04Z

+                f"got {status['exit_node']['state']!r}"
+            )
+
+            log.debug("Confirmed: VPN connection intact after duplicate connect")


You're asserting that nordvpnlite reports connected, you should (also) assert that the connection is working independently of what the app says.

How should I do that?

lcruz99 · 2026-08-25T11:29:23Z

+                f"but exit_node={status.get('exit_node')}"
+            )
+
+            log.debug("Confirmed: VPN disconnected")


I think these tests can be already split into their own categories/classes/mods, e.g.: TestLog, TestConnection.. just like libtelio.

They could be but there are not that many of them yet. 3 tests for connect/disconnect command and 2 for reload.

tomasz-kumor · 2026-08-25T12:18:37Z

Rebased on top of main

Currently, starting the nordvpnlite daemon is strictly coupled with establishing a VPN connection. This commit introduces a new flag that allows the daemon startup to be separated from establishing a VPN connection, without breaking the legacy behaviour.

Without explicitly deleting the IPv6 default route, the route persisted after the interface was brought down, causing stale routing entries and potential IPv6 traffic leaks through the old interface.

After reload, the daemon re-evaluated --do-not-connect instead of the VPN last state and as a result after the reload VPN connection state could be different than the pre-reload state.

Currently, establishing a VPN connection is tightly coupled with the NordVPN Lite daemon start/stop lifecycle. This commit decouples VPN connection management from daemon state management, establishing clear separation of concerns between the two functionalities.

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from f57a61c to e00827b Compare July 24, 2026 09:19

tomasz-kumor temporarily deployed to Internal July 24, 2026 09:19 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e00827b to 2558ede Compare July 24, 2026 11:05

tomasz-kumor temporarily deployed to Internal July 24, 2026 11:05 — with GitHub Actions Inactive

tomasz-kumor temporarily deployed to Internal July 24, 2026 14:24 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 958e427 to 0c1644b Compare July 30, 2026 09:52

tomasz-kumor temporarily deployed to Internal July 30, 2026 09:52 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 0c1644b to 26f42ca Compare July 30, 2026 15:09

tomasz-kumor temporarily deployed to Internal July 30, 2026 15:09 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 26f42ca to 3111f18 Compare July 31, 2026 09:56

tomasz-kumor temporarily deployed to Internal July 31, 2026 09:56 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 3111f18 to be8d6ac Compare July 31, 2026 14:23

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:23 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from be8d6ac to 9401f81 Compare July 31, 2026 14:25

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:25 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 9401f81 to e16efbb Compare July 31, 2026 14:28

tomasz-kumor temporarily deployed to Internal July 31, 2026 14:30 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from e16efbb to 59fd4e2 Compare August 3, 2026 10:05

tomasz-kumor temporarily deployed to Internal August 3, 2026 10:05 — with GitHub Actions Inactive

tomasz-kumor changed the title ~~[DRAFT] kumor/llt 6855 only one way of stopping nordvpnlite~~ LLT-6855: start/stop command currently is confusing when used manually - can't stop daemon Aug 3, 2026

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 59fd4e2 to 09d954f Compare August 3, 2026 13:08

tomasz-kumor temporarily deployed to Internal August 3, 2026 13:09 — with GitHub Actions Inactive

tomasz-kumor marked this pull request as ready for review August 3, 2026 13:21

tomasz-kumor requested a review from a team as a code owner August 3, 2026 13:21

tomasz-kumor requested a review from tomaszpatejko August 3, 2026 13:31

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 09d954f to 507311f Compare August 5, 2026 11:40

tomasz-kumor temporarily deployed to Internal August 5, 2026 11:40 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 507311f to d34ae16 Compare August 6, 2026 09:10

tomasz-kumor temporarily deployed to Internal August 6, 2026 09:10 — with GitHub Actions Inactive

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from d34ae16 to fa5151f Compare August 6, 2026 13:41

tomaszpatejko previously approved these changes Aug 18, 2026

View reviewed changes

tomasz-kumor dismissed tomaszpatejko’s stale review via f42f791 August 19, 2026 09:03

tomasz-kumor temporarily deployed to Internal August 19, 2026 09:03 — with GitHub Actions Inactive

lcruz99 reviewed Aug 19, 2026

View reviewed changes

Comment thread Cargo.lock

tomasz-kumor requested a review from lcruz99 August 21, 2026 07:52

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from f42f791 to 6e90760 Compare August 21, 2026 11:19

tomasz-kumor temporarily deployed to Internal August 21, 2026 11:19 — with GitHub Actions Inactive

lcruz99 reviewed Aug 24, 2026

View reviewed changes

Comment thread nat-lab/tests/test_nordvpnlite.py

lcruz99 reviewed Aug 24, 2026

View reviewed changes

Comment thread clis/nordvpnlite/src/command_listener.rs

lcruz99 reviewed Aug 24, 2026

View reviewed changes

Comment thread clis/nordvpnlite/src/command_listener.rs Outdated

lcruz99 reviewed Aug 24, 2026

View reviewed changes

Comment thread clis/nordvpnlite/src/command_listener.rs

lcruz99 reviewed Aug 25, 2026

View reviewed changes

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 6e90760 to 3d885ab Compare August 25, 2026 12:18

tomasz-kumor deployed to Internal August 25, 2026 12:18 — with GitHub Actions Active

tomasz-kumor added 4 commits August 25, 2026 14:19

LLT-6855: remove IPv6 default route on interface teardown

f3bd563

Without explicitly deleting the IPv6 default route, the route persisted after the interface was brought down, causing stale routing entries and potential IPv6 traffic leaks through the old interface.

LLT-6855: preserve VPN connection state across nordvpnlite reloads

6ba26db

After reload, the daemon re-evaluated --do-not-connect instead of the VPN last state and as a result after the reload VPN connection state could be different than the pre-reload state.

tomasz-kumor force-pushed the kumor/LLT-6855_only_one_way_of_stopping_nordvpnlite branch from 3d885ab to 2549ddd Compare August 25, 2026 12:24

tomasz-kumor deployed to Internal August 25, 2026 12:31 — with GitHub Actions Active

Uh oh!

Conversation

tomasz-kumor commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Testing

☑️ Definition of Done checklist

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcruz99 Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasz-kumor Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasz-kumor commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tomasz-kumor commented Jul 24, 2026 •

edited

Loading

lcruz99 Aug 24, 2026 •

edited

Loading

lcruz99 Aug 24, 2026 •

edited

Loading

tomasz-kumor Aug 25, 2026 •

edited

Loading