WIP 12 vpn: add gateway support

Author: pymq

awldns/awldns_test.go

@@ -80,19 +80,30 @@ func NewResolverClient(address string) *net.Resolver {
 }
 
 func FindFreePort() int {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		panic(fmt.Sprintf("failed to listen on a port: %v", err))
+	const maxAttempts = 50
+	var lastErr error
+	for i := 0; i < maxAttempts; i++ {
+		l, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		port := l.Addr().(*net.TCPAddr).Port
+
+		// The DNS resolver listens on both TCP and UDP on this port, so it must be
+		// free for both. A TCP-free port is not guaranteed to be UDP-free, and on
+		// Windows the chosen port may fall inside an OS-excluded range (Hyper-V/WSL
+		// reservations), which fails the UDP bind with WSAEACCES. Release the port
+		// and try another instead of giving up.
+		u, err := net.ListenPacket("udp", l.Addr().String())
+		if err != nil {
+			_ = l.Close()
+			lastErr = err
+			continue
+		}
+		_ = u.Close()
+		_ = l.Close()
+		return port
 	}
-	defer l.Close()
-
-	port := l.Addr().(*net.TCPAddr).Port
-
-	u, err := net.ListenPacket("udp", l.Addr().String())
-	if err != nil {
-		panic(fmt.Sprintf("failed to listen on a udp port: %v", err))
-	}
-	defer u.Close()
-
-	return port
+	panic(fmt.Sprintf("failed to find a free tcp+udp port after %d attempts: %v", maxAttempts, lastErr))
 }

service/tunnel.go

@@ -126,6 +126,10 @@ func (t *Tunnel) RefreshPeersList() {
 	t.peersLock.Lock()
 	defer t.peersLock.Unlock()
 
+	if t.isClosed.Load() {
+		return
+	}
+
 	t.conf.RLock()
 	defer t.conf.RUnlock()
 	for _, knownPeer := range t.conf.KnownPeers {

vpn/routes/vpn_hostnet_integration_test.go

@@ -226,9 +226,13 @@ func assertNATApplied(t *testing.T) {
 	got := lines(cmdOut(t, "iptables", "-S", awlForwardChain))
 	require.Equal(t, want, got, "AWL-FORWARD chain content/order")
 
+	// iptables -S prints matches in its own canonical order (-s before -i,
+	// -d before -o), regardless of the order the code passes them in
+	// (outboundJumpArgs/returnJumpArgs use -i/-s and -o/-d), so assert against
+	// that canonical form.
 	filter := cmdOut(t, "iptables", "-S", "FORWARD")
-	require.Contains(t, filter, "-i "+testTunIf+" -s "+testAwlSubnet+" -j "+awlForwardChain, "outbound jump")
-	require.Contains(t, filter, "-o "+testTunIf+" -d "+testAwlSubnet+" -j "+awlForwardChain, "return jump")
+	require.Contains(t, filter, "-s "+testAwlSubnet+" -i "+testTunIf+" -j "+awlForwardChain, "outbound jump")
+	require.Contains(t, filter, "-d "+testAwlSubnet+" -o "+testTunIf+" -j "+awlForwardChain, "return jump")
 
 	nat := cmdOut(t, "iptables", "-t", "nat", "-S", "POSTROUTING")
 	require.Contains(t, nat, "-s "+testAwlSubnet+" ! -o "+testTunIf+" -j MASQUERADE", "MASQUERADE")
@@ -270,7 +274,7 @@ func snapshotNet(t *testing.T) string {
 	}
 	section("ip rule", cmdOut(t, "ip", "rule", "show"))
 	section("route main", cmdOut(t, "ip", "-4", "route", "show"))
-	section("route awl-table", cmdOut(t, "ip", "-4", "route", "show", "table", strconv.Itoa(tableID)))
+	section("route awl-table", routeTableDump(t, tableID))
 	section("iptables filter", cmdOut(t, "iptables", "-S"))
 	section("iptables nat", cmdOut(t, "iptables", "-t", "nat", "-S"))
 	return b.String()
@@ -340,8 +344,28 @@ func mustCmd(t *testing.T, name string, args ...string) {
 
 func cmdOut(t *testing.T, name string, args ...string) string {
 	t.Helper()
-	out, err := exec.Command(name, args...).Output()
-	require.NoErrorf(t, err, "%s %s", name, strings.Join(args, " "))
+	// CombinedOutput (not Output) so a failing command surfaces its stderr
+	// diagnostic in the test log instead of a bare "exit status N". On success
+	// these commands print nothing to stderr, so the captured value is unchanged.
+	out, err := exec.Command(name, args...).CombinedOutput()
+	require.NoErrorf(t, err, "%s %s: %s", name, strings.Join(args, " "), out)
+	return string(out)
+}
+
+// routeTableDump returns the routes in the given table, tolerating the
+// "table does not exist" case. Newer iproute2/kernels (e.g. Ubuntu 24.04) make
+// `ip route show table <id>` fail with exit 2 ("FIB table does not exist") when
+// the table has never held a route, whereas older versions returned empty with
+// exit 0. Both mean the same thing here — an empty table — so normalise to "".
+func routeTableDump(t *testing.T, table int) string {
+	t.Helper()
+	out, err := exec.Command("ip", "-4", "route", "show", "table", strconv.Itoa(table)).CombinedOutput()
+	if err != nil {
+		if strings.Contains(string(out), "does not exist") {
+			return ""
+		}
+		require.NoErrorf(t, err, "ip -4 route show table %d: %s", table, out)
+	}
 	return string(out)
 }