vpn: merge sockmark, routes and uplink packages into vpn/netstate

Pure move: files keep their names, the public API (Marker,
SetupGatewayRoutes/TeardownGatewayRoutes, SetupNAT/TeardownNAT) is
unchanged. Resolved on merge: one package logger, one 0x61776C constant
(fwmark + policy-routing table ID, previously duplicated), uplink
helpers unexported (uplinkRoute/bestUplink/bestUplinkDefault).
Consumers, CI hostnet paths and docs updated.

First step of the netstate manager refactoring.

Author: pymq

.github/workflows/test.yml

@@ -44,7 +44,7 @@ jobs:
         # `if: always()` cleanup step
         if: matrix.os == 'ubuntu-latest'
         run: |
-          go test -c -tags vpn_hostnet -o gw-hostnet.test ./vpn/routes/
+          go test -c -tags vpn_hostnet -o gw-hostnet.test ./vpn/netstate/
           sudo ./gw-hostnet.test -test.run '^TestGatewayHostNet' -test.v
       - name: VPN gateway host-network integration test (Windows, admin)
         # Windows counterpart of the step above: exercises WinNAT + WFP +
@@ -58,7 +58,7 @@ jobs:
         shell: pwsh
         run: |
           Get-NetNat | Format-List
-          go test -c -tags vpn_hostnet -o gw-hostnet.test.exe ./vpn/routes/
+          go test -c -tags vpn_hostnet -o gw-hostnet.test.exe ./vpn/netstate/
           # Flags are quoted: pwsh splits an unquoted `-test.run` at the dot
           # into `-test` + `.run`, which the test binary rejects.
           ./gw-hostnet.test.exe '-test.run' '^TestGatewayHostNet' '-test.v'

application.go

@@ -39,7 +39,7 @@ import (
 	"github.com/anywherelan/awl/ringbuffer"
 	"github.com/anywherelan/awl/service"
 	"github.com/anywherelan/awl/vpn"
-	"github.com/anywherelan/awl/vpn/sockmark"
+	"github.com/anywherelan/awl/vpn/netstate"
 )
 
 const (
@@ -97,9 +97,9 @@ type Application struct {
 	// keep libp2p traffic out of the VPN tunnel when gateway mode is on.
 	// Callers (notably cmd/gomobile-lib on Android) may set this before
 	// Init to inject a platform-specific marker — e.g.
-	//   app.SockMarker = sockmark.NewAndroid(protectorFn)
-	// Init falls back to sockmark.New() if SockMarker is left nil.
-	SockMarker sockmark.Marker
+	//   app.SockMarker = netstate.NewAndroid(protectorFn)
+	// Init falls back to netstate.New() if SockMarker is left nil.
+	SockMarker netstate.Marker
 }
 
 func New() *Application {
@@ -111,7 +111,7 @@ func (a *Application) Init(ctx context.Context, tunDevice tun.Device) error {
 
 	a.ctx, a.ctxCancel = context.WithCancel(ctx)
 	if a.SockMarker == nil {
-		a.SockMarker = sockmark.New()
+		a.SockMarker = netstate.New()
 	}
 	// Start before InitHost so the very first libp2p sockets are already
 	// marked (on Windows: bound to the detected uplink). An offline start is

cmd/gomobile-lib/main.go

@@ -13,7 +13,7 @@ import (
 	"github.com/anywherelan/awl"
 	"github.com/anywherelan/awl/config"
 	"github.com/anywherelan/awl/vpn"
-	"github.com/anywherelan/awl/vpn/sockmark"
+	"github.com/anywherelan/awl/vpn/netstate"
 )
 
 const appType = config.AppTypeAwlAndroid
@@ -64,7 +64,7 @@ type SocketProtector interface {
 
 // StartServerWithProtector starts the server, registering a socket protector
 // so that libp2p and other sockets bypass the VPN. The protector reference is held by
-// the Application's sockmark.Marker for the lifetime of the run; calling
+// the Application's netstate.Marker for the lifetime of the run; calling
 // StopServer drops it.
 //
 // When VPN gateway client mode is enabled in the saved config, the host app
@@ -80,7 +80,7 @@ func StartServer(tunFD int32, protector SocketProtector) (err error) {
 
 	globalApp = awl.New()
 	globalApp.SetupLoggerAndConfig(appType)
-	globalApp.SockMarker = sockmark.NewAndroid(protectorToFunc(protector))
+	globalApp.SockMarker = netstate.NewAndroid(protectorToFunc(protector))
 
 	// A tunFD of 0 means the host did not establish a VPN interface (VPN
 	// disabled in config); Init then skips the VPN device entirely. Otherwise
@@ -132,7 +132,7 @@ func UpdateTunDevice(tunFD int32) error {
 	return globalSwapTUN.Swap(inner)
 }
 
-func protectorToFunc(p SocketProtector) sockmark.ProtectFunc {
+func protectorToFunc(p SocketProtector) netstate.ProtectFunc {
 	if p == nil {
 		return nil
 	}

service/socks5.go

@@ -19,7 +19,7 @@ import (
 	"github.com/anywherelan/awl/metrics"
 	"github.com/anywherelan/awl/protocol"
 	"github.com/anywherelan/awl/socks5"
-	"github.com/anywherelan/awl/vpn/sockmark"
+	"github.com/anywherelan/awl/vpn/netstate"
 )
 
 type SOCKS5 struct {
@@ -31,7 +31,7 @@ type SOCKS5 struct {
 	server *socks5.Server
 }
 
-func NewSOCKS5(p2pService P2p, conf *config.Config, sockMarker sockmark.Marker) (*SOCKS5, error) {
+func NewSOCKS5(p2pService P2p, conf *config.Config, sockMarker netstate.Marker) (*SOCKS5, error) {
 	logger := log.Logger("awl/service/socks5")
 
 	var client *socks5.Client

service/vpn_gateway.go

@@ -14,8 +14,7 @@ import (
 	"github.com/anywherelan/awl/config"
 	"github.com/anywherelan/awl/entity"
 	"github.com/anywherelan/awl/vpn"
-	"github.com/anywherelan/awl/vpn/routes"
-	"github.com/anywherelan/awl/vpn/sockmark"
+	"github.com/anywherelan/awl/vpn/netstate"
 )
 
 // DNSReconfigurer is the narrow slice of the DNS service the gateway needs to
@@ -49,7 +48,7 @@ type VPNGateway struct {
 	tunnel     *Tunnel
 	device     *vpn.Device
 	p2p        P2p
-	sockMarker sockmark.Marker
+	sockMarker netstate.Marker
 	dns        DNSReconfigurer
 	logger     *log.ZapEventLogger
 
@@ -63,14 +62,14 @@ type VPNGateway struct {
 	// paths. Connectivity to the bound gateway peer is observed via p2p
 	// events inside Tunnel — no background goroutine here.
 	mu               sync.Mutex
-	clientRouteState *routes.RouteState
-	serverNATState   *routes.NATState
+	clientRouteState *netstate.RouteState
+	serverNATState   *netstate.NATState
 }
 
 // NewVPNGateway constructs a VPNGateway service. tunnel may be nil when the
 // VPN interface is disabled; the API methods still work but only update the
 // persisted config.
-func NewVPNGateway(conf *config.Config, tunnel *Tunnel, device *vpn.Device, p2p P2p, sockMarker sockmark.Marker, dns DNSReconfigurer, disableOSSetup bool) *VPNGateway {
+func NewVPNGateway(conf *config.Config, tunnel *Tunnel, device *vpn.Device, p2p P2p, sockMarker netstate.Marker, dns DNSReconfigurer, disableOSSetup bool) *VPNGateway {
 	return &VPNGateway{
 		conf:           conf,
 		tunnel:         tunnel,
@@ -155,7 +154,7 @@ func (g *VPNGateway) ListAvailableVPNGateways() []entity.AvailableVPNGateway {
 // gateway, applying OS-level routes immediately. Atomic: rolls back the
 // tunnel binding on apply failure.
 //
-// On android the OS-level apply (routes.SetupGatewayRoutes / sockmark) is a
+// On android the OS-level apply (netstate.SetupGatewayRoutes / sockmark) is a
 // no-op — routing is owned by the host's VpnService.Builder. This call flips
 // the in-memory tunnel binding and persists config; the host then re-establishes
 // the VpnService with the new routes and hot-swaps the fresh tun fd into the
@@ -298,7 +297,7 @@ func (g *VPNGateway) IsServerActive() bool {
 // ClientRouteState returns the current route state pointer (or nil). For
 // tests that need pointer-identity comparisons (idempotent re-enable must
 // not reinstall routes).
-func (g *VPNGateway) ClientRouteState() *routes.RouteState {
+func (g *VPNGateway) ClientRouteState() *netstate.RouteState {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 	return g.clientRouteState
@@ -323,7 +322,7 @@ func (g *VPNGateway) applyServer() error {
 	if g.disableOSSetup {
 		// Keep state tracking working (so teardown is symmetric) without
 		// touching the kernel.
-		g.serverNATState = &routes.NATState{}
+		g.serverNATState = &netstate.NATState{}
 		return nil
 	}
 
@@ -334,7 +333,7 @@ func (g *VPNGateway) applyServer() error {
 	localIP, netMask := g.conf.VPNLocalIPMask()
 	awlSubnet := (&net.IPNet{IP: localIP.Mask(netMask), Mask: netMask}).String()
 
-	natState, err := routes.SetupNAT(awlSubnet, tunName)
+	natState, err := netstate.SetupNAT(awlSubnet, tunName)
 	if err != nil {
 		return fmt.Errorf("setup NAT: %w", err)
 	}
@@ -352,7 +351,7 @@ func (g *VPNGateway) teardownServer() {
 		return
 	}
 	if !g.disableOSSetup {
-		if err := routes.TeardownNAT(g.serverNATState); err != nil {
+		if err := netstate.TeardownNAT(g.serverNATState); err != nil {
 			g.logger.Errorf("teardown NAT: %v", err)
 		}
 	}
@@ -394,7 +393,7 @@ func (g *VPNGateway) applyClient() error {
 	//  the netstate manager in the next MR and flattens there.
 	//nolint:nestif
 	if g.disableOSSetup {
-		g.clientRouteState = &routes.RouteState{}
+		g.clientRouteState = &netstate.RouteState{}
 	} else {
 		// Markers that can be temporarily unable to guarantee loop-free
 		// marking (Windows: no uplink detected right now) expose Ready.
@@ -412,7 +411,7 @@ func (g *VPNGateway) applyClient() error {
 		if err != nil {
 			return fmt.Errorf("get TUN name for gateway routes: %w", err)
 		}
-		routeState, err := routes.SetupGatewayRoutes(tunName, g.sockMarker.FWMark())
+		routeState, err := netstate.SetupGatewayRoutes(tunName, g.sockMarker.FWMark())
 		if err != nil {
 			return fmt.Errorf("setup gateway routes: %w", err)
 		}
@@ -446,7 +445,7 @@ func (g *VPNGateway) teardownClient() {
 		return
 	}
 	if !g.disableOSSetup {
-		if err := routes.TeardownGatewayRoutes(g.clientRouteState); err != nil {
+		if err := netstate.TeardownGatewayRoutes(g.clientRouteState); err != nil {
 			g.logger.Errorf("teardown gateway routes: %v", err)
 		}
 	}

test_suite_test.go

@@ -41,7 +41,7 @@ import (
 
 const TestTUNBatchSize = 100
 
-// noopSockMarker is a sockmark.Marker test double that does nothing. Production
+// noopSockMarker is a netstate.Marker test double that does nothing. Production
 // wiring sets SocketControlFunc unconditionally; tests run as a non-root user
 // where SO_MARK fails with EPERM, which would break libp2p dials and leave
 // QUIC reuse goroutines hanging past the goleak window.

vpn/sockmark/families.go vpn/netstate/families.govpn/sockmark/families.go renamed to vpn/netstate/families.go

@@ -1,4 +1,4 @@
-package sockmark
+package netstate
 
 import (
 	"net"

vpn/sockmark/families_test.go vpn/netstate/families_test.govpn/sockmark/families_test.go renamed to vpn/netstate/families_test.go

@@ -1,4 +1,4 @@
-package sockmark
+package netstate
 
 import (
 	"fmt"

vpn/netstate/log.go

@@ -0,0 +1,8 @@
+package netstate
+
+import "github.com/ipfs/go-log/v2"
+
+// logger is the shared package-level logger (socket marker, gateway routes,
+// NAT). Used to surface stale-state recovery, uplink changes and other one-off
+// events that callers shouldn't have to thread through return values.
+var logger = log.Logger("awl/vpn/netstate")

vpn/routes/nat_android.go vpn/netstate/nat_android.govpn/routes/nat_android.go renamed to vpn/netstate/nat_android.go

@@ -1,6 +1,6 @@
 //go:build linux && android
 
-package routes
+package netstate
 
 // NATState holds the state needed to teardown NAT rules.
 type NATState struct{}