fix(client): fix NetworkAddresses discovery on Android and re-sync on network change

Android 10+ restricts MAC addresses and Go's net.Interfaces() is broken
on Android 11+ due to SELinux restrictions on netlink sockets.

Use wlynxg/anet as drop-in replacement on Android. Remove MAC-based
interface filter. Add 10s network address watcher with 30s debounce
to re-sync with management server on WiFi/cellular transitions.

Fixes #3614 #2962

Author: MichaelUray

.gitignore

@@ -33,3 +33,5 @@ infrastructure_files/setup-*.env
 vendor/
 /netbird
 client/netbird-electron/
+build/
+docs/superpowers/

client/android/client.go

@@ -185,6 +185,22 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
+// OnUnderlyingNetworkChanged should be called by the Android layer when the
+// underlying network changes (e.g., WiFi ↔ cellular). It triggers a re-sync
+// of NetworkAddresses with the management server so posture checks evaluate
+// the current network state immediately, without waiting for the next
+// periodic sync cycle.
+func (c *Client) OnUnderlyingNetworkChanged() {
+	if c.connectClient == nil {
+		return
+	}
+	e := c.connectClient.Engine()
+	if e == nil {
+		return
+	}
+	e.ResyncNetworkAddresses()
+}
+
 // SetTraceLogLevel configure the logger to trace level
 func (c *Client) SetTraceLogLevel() {
 	log.SetLevel(log.TraceLevel)

client/internal/engine.go

@@ -210,6 +210,10 @@ type Engine struct {
 	// checks are the client-applied posture checks that need to be evaluated on the client
 	checks []*mgmProto.Checks
 
+	// lastNetworkAddresses tracks reported addresses for change detection
+	lastNetworkAddresses    []system.NetworkAddress
+	lastNetworkAddressSync  time.Time
+
 	relayManager *relayClient.Manager
 	stateManager *statemanager.Manager
 	srWatcher    *guard.SRWatcher
@@ -560,6 +564,10 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	e.receiveManagementEvents()
 	e.receiveJobEvents()
 
+	// watch for network address changes (WiFi ↔ mobile) for posture checks
+	e.shutdownWg.Add(1)
+	go e.startNetworkAddressWatcher()
+
 	// starting network monitor at the very last to avoid disruptions
 	e.startNetworkMonitor()
 
@@ -884,6 +892,10 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
+	// Fallback: detect network address changes during periodic sync in case
+	// platform-specific callbacks (e.g., Android NetworkCallback) were missed.
+	e.resyncMetaIfNetworkChanged()
+
 	nm := update.GetNetworkMap()
 	if nm == nil {
 		return nil
@@ -1003,6 +1015,99 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 	return nil
 }
 
+// ResyncNetworkAddresses can be called externally (e.g., from Android
+// network change callbacks) to immediately re-sync NetworkAddresses.
+func (e *Engine) ResyncNetworkAddresses() {
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+	e.resyncMetaIfNetworkChanged()
+}
+
+// startNetworkAddressWatcher polls for network address changes every 10s.
+// This catches cases where platform callbacks are missed or delayed,
+// ensuring posture checks always evaluate the current network state.
+func (e *Engine) startNetworkAddressWatcher() {
+	defer e.shutdownWg.Done()
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-e.ctx.Done():
+			return
+		case <-ticker.C:
+			e.syncMsgMux.Lock()
+			e.resyncMetaIfNetworkChanged()
+			e.syncMsgMux.Unlock()
+		}
+	}
+}
+
+// resyncMetaIfNetworkChanged detects changes in local network addresses
+// (e.g., WiFi reconnect on mobile) and re-syncs meta with the management
+// server so that posture checks evaluate the current network state.
+func (e *Engine) resyncMetaIfNetworkChanged() {
+	// Debounce: don't re-sync more than once per 30 seconds to avoid
+	// flapping during VPN tunnel setup when interfaces are in flux.
+	if time.Since(e.lastNetworkAddressSync) < 30*time.Second {
+		return
+	}
+
+	info := system.GetInfo(e.ctx)
+	if info == nil {
+		return
+	}
+
+	current := info.NetworkAddresses
+	if networkAddressesEqual(e.lastNetworkAddresses, current) {
+		return
+	}
+
+	log.Infof("network addresses changed (%d -> %d addrs), re-syncing meta with management server",
+		len(e.lastNetworkAddresses), len(current))
+	e.lastNetworkAddresses = current
+	e.lastNetworkAddressSync = time.Now()
+
+	info.SetFlags(
+		e.config.RosenpassEnabled,
+		e.config.RosenpassPermissive,
+		&e.config.ServerSSHAllowed,
+		e.config.DisableClientRoutes,
+		e.config.DisableServerRoutes,
+		e.config.DisableDNS,
+		e.config.DisableFirewall,
+		e.config.BlockLANAccess,
+		e.config.BlockInbound,
+		e.config.LazyConnectionEnabled,
+		e.config.EnableSSHRoot,
+		e.config.EnableSSHSFTP,
+		e.config.EnableSSHLocalPortForwarding,
+		e.config.EnableSSHRemotePortForwarding,
+		e.config.DisableSSHAuth,
+	)
+
+	if err := e.mgmClient.SyncMeta(info); err != nil {
+		log.Warnf("failed to re-sync meta after network change: %v", err)
+	}
+}
+
+func networkAddressesEqual(a, b []system.NetworkAddress) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	// Sort-unabhängiger Vergleich: prüfe ob alle IPs aus a in b vorkommen
+	bSet := make(map[string]struct{}, len(b))
+	for _, addr := range b {
+		bSet[addr.NetIP.String()] = struct{}{}
+	}
+	for _, addr := range a {
+		if _, ok := bSet[addr.NetIP.String()]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
 func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 	if e.wgInterface == nil {
 		return errors.New("wireguard interface is not initialized")

client/internal/network_address_sync_test.go

@@ -0,0 +1,102 @@
+package internal
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/system"
+)
+
+func TestNetworkAddressesEqual(t *testing.T) {
+	tests := []struct {
+		name string
+		a    []system.NetworkAddress
+		b    []system.NetworkAddress
+		want bool
+	}{
+		{
+			name: "both nil",
+			a:    nil,
+			b:    nil,
+			want: true,
+		},
+		{
+			name: "both empty",
+			a:    []system.NetworkAddress{},
+			b:    []system.NetworkAddress{},
+			want: true,
+		},
+		{
+			name: "nil vs empty",
+			a:    nil,
+			b:    []system.NetworkAddress{},
+			want: true,
+		},
+		{
+			name: "same addresses same order",
+			a: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+				{NetIP: netip.MustParsePrefix("10.0.0.1/8")},
+			},
+			b: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+				{NetIP: netip.MustParsePrefix("10.0.0.1/8")},
+			},
+			want: true,
+		},
+		{
+			name: "same addresses different order",
+			a: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("10.0.0.1/8")},
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+			},
+			b: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+				{NetIP: netip.MustParsePrefix("10.0.0.1/8")},
+			},
+			want: true,
+		},
+		{
+			name: "different lengths",
+			a: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+			},
+			b: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+				{NetIP: netip.MustParsePrefix("10.0.0.1/8")},
+			},
+			want: false,
+		},
+		{
+			name: "different addresses",
+			a: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.1.10/24")},
+			},
+			b: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("172.16.0.1/12")},
+			},
+			want: false,
+		},
+		{
+			name: "wifi to mobile switch",
+			a: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.91.167/24")},
+				{NetIP: netip.MustParsePrefix("100.87.143.60/16")},
+			},
+			b: []system.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("93.111.154.63/24")},
+				{NetIP: netip.MustParsePrefix("100.87.143.60/16")},
+			},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := networkAddressesEqual(tt.a, tt.b)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

client/system/info.go

@@ -146,21 +146,20 @@ func extractDeviceName(ctx context.Context, defaultName string) string {
 }
 
 func networkAddresses() ([]NetworkAddress, error) {
-	interfaces, err := net.Interfaces()
+	interfaces, err := getNetInterfaces()
 	if err != nil {
 		return nil, err
 	}
 
 	var netAddresses []NetworkAddress
 	for _, iface := range interfaces {
-		if iface.HardwareAddr.String() == "" {
-			continue
-		}
-		addrs, err := iface.Addrs()
+		addrs, err := getInterfaceAddrs(&iface)
 		if err != nil {
 			continue
 		}
 
+		mac := iface.HardwareAddr.String()
+
 		for _, address := range addrs {
 			ipNet, ok := address.(*net.IPNet)
 			if !ok {
@@ -173,7 +172,7 @@ func networkAddresses() ([]NetworkAddress, error) {
 
 			netAddr := NetworkAddress{
 				NetIP: netip.MustParsePrefix(ipNet.String()),
-				Mac:   iface.HardwareAddr.String(),
+				Mac:   mac,
 			}
 
 			if isDuplicated(netAddresses, netAddr) {

client/system/info_android.go

@@ -30,6 +30,11 @@ func GetInfo(ctx context.Context) *Info {
 		kernelVersion = osInfo[2]
 	}
 
+	addrs, err := networkAddresses()
+	if err != nil {
+		log.Warnf("failed to discover network addresses: %s", err)
+	}
+
 	gio := &Info{
 		GoOS:               runtime.GOOS,
 		Kernel:             kernel,
@@ -41,6 +46,7 @@ func GetInfo(ctx context.Context) *Info {
 		NetbirdVersion:     version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
+		NetworkAddresses:   addrs,
 		SystemSerialNumber: serial(),
 		SystemProductName:  productModel(),
 		SystemManufacturer: productManufacturer(),

client/system/info_test.go

@@ -43,3 +43,27 @@ func Test_NetAddresses(t *testing.T) {
 		t.Errorf("no network addresses found")
 	}
 }
+
+func Test_networkAddresses(t *testing.T) {
+	addrs, err := networkAddresses()
+	assert.NoError(t, err)
+	assert.NotEmpty(t, addrs, "should discover at least one network address")
+
+	for _, addr := range addrs {
+		assert.True(t, addr.NetIP.IsValid(), "address should be valid: %s", addr.NetIP)
+		assert.False(t, addr.NetIP.Addr().IsLoopback(), "should not include loopback addresses")
+	}
+}
+
+func Test_networkAddresses_noDuplicates(t *testing.T) {
+	addrs, err := networkAddresses()
+	assert.NoError(t, err)
+
+	seen := make(map[string]struct{})
+	for _, addr := range addrs {
+		key := addr.NetIP.String()
+		_, exists := seen[key]
+		assert.False(t, exists, "duplicate address found: %s", key)
+		seen[key] = struct{}{}
+	}
+}

client/system/network_addresses.go

@@ -0,0 +1,13 @@
+//go:build !android
+
+package system
+
+import "net"
+
+func getNetInterfaces() ([]net.Interface, error) {
+	return net.Interfaces()
+}
+
+func getInterfaceAddrs(iface *net.Interface) ([]net.Addr, error) {
+	return iface.Addrs()
+}

client/system/network_addresses_android.go

@@ -0,0 +1,17 @@
+//go:build android
+
+package system
+
+import (
+	"net"
+
+	"github.com/wlynxg/anet"
+)
+
+func getNetInterfaces() ([]net.Interface, error) {
+	return anet.Interfaces()
+}
+
+func getInterfaceAddrs(iface *net.Interface) ([]net.Addr, error) {
+	return anet.InterfaceAddrsByInterface(iface)
+}