WIP 2

Author: pymq

.github/workflows/test.yml

@@ -59,7 +59,9 @@ jobs:
         run: |
           Get-NetNat | Format-List
           go test -c -tags vpn_hostnet -o gw-hostnet.test.exe ./vpn/routes/
-          ./gw-hostnet.test.exe -test.run '^TestGatewayHostNet' -test.v
+          # Flags are quoted: pwsh splits an unquoted `-test.run` at the dot
+          # into `-test` + `.run`, which the test binary rejects.
+          ./gw-hostnet.test.exe '-test.run' '^TestGatewayHostNet' '-test.v'
       - name: Build cmd/awl
         run: go build github.com/anywherelan/awl/cmd/awl
       - name: Upload cmd/awl build

p2p/p2p.go

@@ -200,6 +200,17 @@ func (p *P2p) InitHost(hostConfig HostConfig) (host.Host, error) {
 	return p2pHost, nil
 }
 
+// buildTransportOpts wires the socket-marking controlFunc into every place
+// libp2p lets us: TCP dials (WithDialerForAddr) and UDP listen sockets
+// (quicreuse.OverrideListenUDP — QUIC dials share the listen socket).
+//
+// TODO(gateway): the TCP *listener* is NOT covered — go-libp2p's TCP
+// transport has no listen hook (Listen goes straight to manet.Listen), so
+// sockets accepted from it stay unmarked on every platform. With gateway
+// client mode on, their replies are routed into the TUN and inbound direct
+// TCP degrades (no leak; QUIC/dials/hole-punch/relay still work). Fixing it
+// needs an upstream listen hook + marking the listener (accepted sockets
+// inherit SO_MARK on Linux / listener options on Windows) — separate task
 func (p *P2p) buildTransportOpts(controlFunc func(network, address string, c syscall.RawConn) error) []libp2p.Option {
 	if controlFunc == nil {
 		return []libp2p.Option{

service/vpn_gateway.go

@@ -390,6 +390,10 @@ func (g *VPNGateway) applyClient() error {
 		return nil
 	}
 
+	// Temporary exception rather than a restructure: this branching moves into
+	// the netstate manager in the next MR (plans/windows-vpn-gateway.md §8.2)
+	// and flattens there.
+	//nolint:nestif
 	if g.disableOSSetup {
 		g.clientRouteState = &routes.RouteState{}
 	} else {

vpn/routes/nat_windows.go

@@ -88,9 +88,13 @@ func SetupNAT(awlSubnet, tunIfName string) (*NATState, error) {
 	// offline we still bring the server up (parity with Linux, where
 	// ServerEnabled is applied at startup regardless of connectivity) and
 	// only warn — transit starts working when SetupNAT next runs with a
-	// live uplink. Roaming note: if the uplink changes mid-session, the new
-	// uplink keeps its own forwarding value; toggle the gateway server off
-	// and on to re-apply. Documented in GATEWAY_FEATURE.md.
+	// live uplink.
+	//
+	// TODO(netstate): if the uplink changes mid-session (or appears after an
+	// offline start), the new uplink keeps its own forwarding value and
+	// transit needs a gateway server off/on toggle.
+	// Fix is a route-change subscriber that re-syncs
+	// forwarding on the new uplink; lands with the netstate refactoring
 	forwardingTargets := []winipcfg.LUID{tunLUID}
 	uplinkRoute, ok, err := uplink.BestDefault(windows.AF_INET, tunLUID)
 	if err != nil {

vpn/routes/routes_linux.go

@@ -121,6 +121,11 @@ func SetupGatewayRoutes(tunIfName string, fwmark uint32) (*RouteState, error) {
 		return nil, fmt.Errorf("get default routes: %w", err)
 	}
 	if len(origDefaults) == 0 {
+		// TODO(gateway-offline-start): soften to a warning and proceed with an
+		// empty exemption table — the route monitor below already re-syncs it
+		// when a default appears (DHCP), so an offline boot with a persisted
+		// ClientEnabled would self-heal instead of failing Init. Needs a
+		// reconcile-from-empty verification + doc updates
 		return nil, fmt.Errorf("no IPv4 default route present, cannot configure VPN gateway")
 	}
 

vpn/routes/vpn_hostnet_windows_integration_test.go

@@ -28,6 +28,16 @@
 // (extracted wintun.dll from the embeds package), because /1 on-link routes
 // need a point-to-point interface and their crash semantics — dying with the
 // adapter — are exactly what we assert.
+//
+// Deliberately NOT covered here (vs the Linux suite):
+//   - reaction to route changes (Linux R4/R5): on Windows that machinery is
+//     the sockmark watcher (UNICAST_IF re-bind), not a routes-package
+//     monitor — its integration test lands with the netstate refactoring,
+//     see TODO(netstate) in vpn/sockmark/sockmark_windows.go
+//   - client-route stale recovery / leftover collisions (Linux R2/R3):
+//     impossible by design — the routes die with the adapter LUID
+//     (TestGatewayHostNetClientRoutesDieWithAdapter proves exactly that),
+//     and a fresh adapter is a fresh LUID.
 package routes
 
 import (
@@ -100,6 +110,14 @@ func forwardingEnabled(t *testing.T, luid winipcfg.LUID) bool {
 	return ipIface.ForwardingEnabled
 }
 
+func setForwarding(t *testing.T, luid winipcfg.LUID, enabled bool) {
+	t.Helper()
+	ipIface, err := luid.IPInterface(windows.AF_INET)
+	require.NoError(t, err)
+	ipIface.ForwardingEnabled = enabled
+	require.NoError(t, ipIface.Set())
+}
+
 // wfpRuleInstalled reports whether our BLOCK rule is currently visible in the
 // filtering engine, via a fresh read-only session (rules created by a dynamic
 // session are visible engine-wide for its lifetime).
@@ -151,6 +169,34 @@ func TestGatewayHostNetNATLifecycle(t *testing.T) {
 	require.False(t, wfpRuleInstalled(t), "teardown must remove the WFP rule (dynamic session closed)")
 }
 
+// ---- Server: teardown must not disable forwarding it did not enable ----
+
+// TestGatewayHostNetNATPreservesExistingForwarding is the Windows counterpart
+// of the Linux "pre-existing ip_forward=1 stays on" test: interfaces that
+// already forward (other VPNs, containers, ICS — or a previous awl run that
+// was killed, leaving the flag set) must be left alone by TeardownNAT.
+// Unlike the Linux test (which skips unless the host happens to have
+// ip_forward pre-enabled), the per-interface flag lets us set up the
+// precondition deterministically.
+func TestGatewayHostNetNATPreservesExistingForwarding(t *testing.T) {
+	verifyNoLeaks(t)
+	requireAdmin(t)
+	nicLUID, nicGUID := pickServerTestNIC(t)
+
+	if !forwardingEnabled(t, nicLUID) {
+		setForwarding(t, nicLUID, true)
+		t.Cleanup(func() { setForwarding(t, nicLUID, false) })
+	}
+
+	state, err := SetupNAT(testAwlSubnet, nicGUID)
+	require.NoError(t, err)
+	require.True(t, forwardingEnabled(t, nicLUID))
+
+	require.NoError(t, TeardownNAT(state))
+	require.True(t, forwardingEnabled(t, nicLUID),
+		"forwarding was already on before setup; teardown must NOT disable it")
+}
+
 // ---- Server: stale state recovery ----
 
 func TestGatewayHostNetNATStaleRecovery(t *testing.T) {

vpn/sockmark/sockmark_windows.go

@@ -120,6 +120,9 @@ func (m *WindowsMarker) Start(ctx context.Context) error {
 // condition is self-healing (the watcher re-binds sockets when connectivity
 // appears), so a failure here means "try again once online", not "restart".
 // IPv6 is not required: the tunnel is IPv4-only and gateway mode fences IPv6.
+//
+// TODO(gateway-offline-start): soften this gate to a warning so gateway
+// client mode can be enabled/booted offline and self-heal when connectivity appears
 func (m *WindowsMarker) Ready() error {
 	if m.index4.Load() == 0 {
 		return errors.New("no active network connection (no IPv4 default route)")
@@ -209,6 +212,14 @@ func (m *WindowsMarker) kick() {
 // watch is the marker's background goroutine: debounced re-detection on
 // network change notifications plus the periodic registry sweep. cleanup
 // unregisters the OS callbacks when ctx dies.
+//
+// TODO(netstate): the callback → debounce → redetect → setsockopt chain has
+// no integration coverage (unit tests cover only the registry logic; the
+// Linux counterpart R4/R5 hostnet tests cover the routes monitor, which has
+// no Windows analogue — the re-bind IS the Windows reaction to route
+// changes). Add a hostnet-style test — Start → socket via ControlFunc →
+// mutate default routes → assert getsockopt(IP_UNICAST_IF) — after the
+// monitor moves into the netstate manager
 func (m *WindowsMarker) watch(ctx context.Context, cleanup func()) {
 	defer cleanup()