WIP 11 vpn: add gateway support

Author: pymq

api/peers.go

@@ -119,22 +119,21 @@ func (h *Handler) UpdatePeerSettings(c echo.Context) (err error) {
 		return c.JSON(http.StatusBadRequest, ErrorMessage("invalid domain name"))
 	}
 
-	knownPeer, exists := h.conf.GetPeer(req.PeerID)
+	req.Alias = strings.TrimSpace(req.Alias)
+
+	// Read, validate and write under a single critical section so the peer can't
+	// change between the lookup and the write, and so the uniqueness checks stay
+	// consistent with the write.
+	h.conf.Lock()
+	defer h.conf.Unlock()
+	knownPeer, exists := h.conf.GetPeerUnlocked(req.PeerID)
 	if !exists {
 		return c.JSON(http.StatusNotFound, ErrorMessage("peer not found"))
 	}
-	peerID := knownPeer.PeerId()
-
-	req.Alias = strings.TrimSpace(req.Alias)
-	if !h.conf.IsUniqPeerAlias(req.PeerID, req.Alias) {
+	if !h.conf.IsUniqPeerAliasUnlocked(req.PeerID, req.Alias) {
 		return c.JSON(http.StatusBadRequest, ErrorMessage(ErrorPeerAliasIsNotUniq))
 	}
-
-	h.conf.Lock()
-	defer h.conf.Unlock()
-
-	checkIPErr := h.conf.CheckIPUnique(req.IPAddr, knownPeer.PeerID)
-	if checkIPErr != nil {
+	if checkIPErr := h.conf.CheckIPUnique(req.IPAddr, knownPeer.PeerID); checkIPErr != nil {
 		return c.JSON(http.StatusBadRequest, ErrorMessage(checkIPErr.Error()))
 	}
 
@@ -145,6 +144,7 @@ func (h *Handler) UpdatePeerSettings(c echo.Context) (err error) {
 
 	h.conf.UpsertPeerUnlocked(knownPeer)
 
+	peerID := knownPeer.PeerId()
 	go func() {
 		_ = h.authStatus.ExchangeNewStatusInfo(h.ctx, peerID, knownPeer)
 	}()

api/settings.go

@@ -19,9 +19,17 @@ func (h *Handler) GetMyPeerInfo(c echo.Context) (err error) {
 	totalBootstraps, connectedBootstraps := h.p2p.BootstrapPeersStats()
 	netStats := h.p2p.NetworkStats()
 
+	// Snapshot the runtime-mutable scalar config fields under the read lock.
+	// P2pNode.Name is mutated by UpdateMySettings; VPNConfig fields may change
+	// once runtime reconfiguration lands — read them under the lock too.
+	h.conf.RLock()
+	p2pNode := h.conf.P2pNode
+	vpnConfig := h.conf.VPNConfig
+	h.conf.RUnlock()
+
 	peerInfo := entity.PeerInfo{
-		PeerID:                  h.conf.P2pNode.PeerID,
-		Name:                    h.conf.P2pNode.Name,
+		PeerID:                  p2pNode.PeerID,
+		Name:                    p2pNode.Name,
 		Uptime:                  h.p2p.Uptime(),
 		ServerVersion:           config.Version,
 		NetworkStats:            netStats,
@@ -33,8 +41,8 @@ func (h *Handler) GetMyPeerInfo(c echo.Context) (err error) {
 		IsAwlDNSSetAsSystem:     h.dns.IsAwlDNSSetAsSystem(),
 		VPN: entity.VPNInfo{
 			VPNInterfaceEnabled: h.tunnel != nil,
-			InterfaceName:       h.conf.VPNConfig.InterfaceName,
-			IPNet:               h.conf.VPNConfig.IPNet,
+			InterfaceName:       vpnConfig.InterfaceName,
+			IPNet:               vpnConfig.IPNet,
 		},
 		SOCKS5: func() entity.SOCKS5Info {
 			h.conf.RLock()
@@ -143,7 +151,6 @@ func (h *Handler) ListAvailableProxies(c echo.Context) (err error) {
 
 	response := entity.ListAvailableProxiesResponse{
 		Proxies: proxies,
-		//Proxies: []entity.AvailableProxy{},
 	}
 
 	return c.JSON(http.StatusOK, response)

application_gateway_test.go

@@ -2,19 +2,31 @@ package awl
 
 import (
 	"context"
-	"runtime"
 	"testing"
 	"time"
 
 	"github.com/anywherelan/awl/config"
 	"github.com/anywherelan/awl/entity"
+	"github.com/anywherelan/awl/service"
 )
 
 const (
 	gatewayTestPacketSize = 500
 	internetIP            = "8.8.8.8"
 )
 
+// skipIfVPNGatewayUnsupported skips tests that drive the VPN gateway runtime API
+// (client/server enable) or its startup wiring. The feature is implemented only
+// on Linux; on Windows and macOS the API returns an error and startup wiring is
+// a no-op, so these tests don't apply there. service.VPNGatewaySupported is the
+// single source of truth for platform support.
+func skipIfVPNGatewayUnsupported(t *testing.T) {
+	t.Helper()
+	if err := service.VPNGatewaySupported(); err != nil {
+		t.Skipf("VPN gateway is only supported on Linux: %v", err)
+	}
+}
+
 // setupGatewayPeers creates two peers that are friends and configures them for gateway mode.
 // peer1 = gateway client, peer2 = exit node.
 // Returns the peers and peer1's assigned IP in peer2's config.
@@ -642,6 +654,7 @@ func TestGatewayAPIEnableNotAllowed(t *testing.T) {
 // /settings/peer_info (the canonical status surface — there is no dedicated
 // /gateway/status endpoint).
 func TestGatewayPeerInfoStatus(t *testing.T) {
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 	client, exitNode, _ := setupGatewayPeers(ts)
 
@@ -675,6 +688,7 @@ func TestGatewayAPIListAvailableGateways(t *testing.T) {
 // atomic-switch case: an enable with a different exit-node ID while already
 // enabled must rebind the tunnel without tearing routes down and back up.
 func TestGatewayAPIRuntimeToggle(t *testing.T) {
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 	client, exitNode, _ := setupGatewayPeers(ts)
 
@@ -734,6 +748,7 @@ func TestGatewayAPIRuntimeToggle(t *testing.T) {
 // applies and tears down the server-side state at runtime, persisting the
 // flag and propagating it to peers via the next status exchange.
 func TestGatewayAPIExitNodeMode(t *testing.T) {
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 	peer1 := ts.NewTestPeer(true)
 	peer2 := ts.NewTestPeer(true)
@@ -1034,9 +1049,7 @@ func TestGatewayListAvailableGatewaysFiltersToVPNGatewayOnly(t *testing.T) {
 // KnownPeers, OS-level apply failure, etc.) propagates from EnableClient and
 // fails Init — see TestGatewayUnknownPeerIDAtStartupFailsBoot.
 func TestGatewayInvalidPeerIDAtStartupClearsGracefully(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("VPN gateway mode is gated off on Windows; setupGateway returns early")
-	}
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 
 	// Malformed peer ID: not a valid multihash, so peer.Decode returns an
@@ -1066,9 +1079,7 @@ func TestGatewayInvalidPeerIDAtStartupClearsGracefully(t *testing.T) {
 // SetupAtStartup wraps it, and Init fails. The persisted config is left
 // untouched so a human can investigate why the peer disappeared.
 func TestGatewayUnknownPeerIDAtStartupFailsBoot(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("VPN gateway mode is gated off on Windows; setupGateway returns early")
-	}
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 
 	// Valid-format peer ID that won't be in KnownPeers.

cli_test.go

@@ -381,6 +381,7 @@ func TestCLI_Proxy(t *testing.T) {
 // state. Subtests are ordered so DisableGateway runs before re-enabling, and
 // the exit_node toggle runs on the exitNode peer where it makes sense.
 func TestCLI_Gateway(t *testing.T) {
+	skipIfVPNGatewayUnsupported(t)
 	ts := NewTestSuite(t)
 	client, exitNode, _ := setupGatewayPeers(ts)
 

config/config.go

@@ -171,6 +171,11 @@ func (c *Config) SaveLocked() {
 func (c *Config) IsUniqPeerAlias(excludePeerID, alias string) bool {
 	c.RLock()
 	defer c.RUnlock()
+	return c.IsUniqPeerAliasUnlocked(excludePeerID, alias)
+}
+
+// IsUniqPeerAliasUnlocked is IsUniqPeerAlias without locking; the caller must hold the lock.
+func (c *Config) IsUniqPeerAliasUnlocked(excludePeerID, alias string) bool {
 	for _, kPeer := range c.KnownPeers {
 		if kPeer.PeerID == excludePeerID {
 			continue
@@ -189,6 +194,11 @@ func (c *Config) GenUniqPeerAlias(name, alias string) string {
 	return alias
 }
 
+// GenUniqPeerAliasUnlocked is GenUniqPeerAlias without locking; the caller must hold the lock.
+func (c *Config) GenUniqPeerAliasUnlocked(name, alias string) string {
+	return c.genUniqPeerAlias(name, alias, nil)
+}
+
 func (c *Config) KnownPeersIds() []peer.ID {
 	c.RLock()
 	ids := make([]peer.ID, 0, len(c.KnownPeers))
@@ -201,11 +211,25 @@ func (c *Config) KnownPeersIds() []peer.ID {
 
 func (c *Config) GetPeer(peerID string) (KnownPeer, bool) {
 	c.RLock()
-	knownPeer, ok := c.KnownPeers[peerID]
+	knownPeer, ok := c.GetPeerUnlocked(peerID)
 	c.RUnlock()
 	return knownPeer, ok
 }
 
+// GetPeerUnlocked is GetPeer without locking; the caller must hold the lock.
+func (c *Config) GetPeerUnlocked(peerID string) (KnownPeer, bool) {
+	knownPeer, ok := c.KnownPeers[peerID]
+	return knownPeer, ok
+}
+
+// NodeName returns this node's name under the read lock. P2pNode.Name is mutated
+// at runtime (UpdateMySettings), so it must not be read directly without the lock.
+func (c *Config) NodeName() string {
+	c.RLock()
+	defer c.RUnlock()
+	return c.P2pNode.Name
+}
+
 func (c *Config) RemovePeer(peerID string) (KnownPeer, bool) {
 	c.Lock()
 	knownPeer, exists := c.KnownPeers[peerID]
@@ -238,6 +262,29 @@ func (c *Config) UpsertPeerUnlocked(peer KnownPeer) {
 	_ = c.emitter.Emit(awlevent.KnownPeerChanged{})
 }
 
+// UpdatePeerFields atomically applies mutate to the stored KnownPeer under the
+// write lock and persists the change. It returns false if the peer is unknown.
+//
+// mutate must only change the fields it owns and must NOT replace the struct
+// wholesale, so that fields updated concurrently by other callers are not
+// clobbered. mutate runs while the lock is held, so it must not call other
+// Config methods that take the lock (use the *Unlocked variants instead).
+func (c *Config) UpdatePeerFields(peerID string, mutate func(*KnownPeer)) bool {
+	c.Lock()
+	knownPeer, ok := c.KnownPeers[peerID]
+	if ok {
+		mutate(&knownPeer)
+		c.KnownPeers[peerID] = knownPeer
+		c.save()
+	}
+	c.Unlock()
+
+	if ok {
+		_ = c.emitter.Emit(awlevent.KnownPeerChanged{})
+	}
+	return ok
+}
+
 func (c *Config) UpdatePeerLastSeen(peerID string) {
 	c.Lock()
 	knownPeer, ok := c.KnownPeers[peerID]