fix some problems

Author: NNdroid

config/other.go

@@ -174,7 +174,10 @@ func setDefaults(conf *Config, bus awlevent.Bus) {
 	if conf.VPNConfig.IPNet == "" {
 		conf.VPNConfig.IPNet = DefaultVPNNetworkSubnet
 	}
-	if conf.VPNConfig.IPNetV6 == "" {
+	
+	// IPv6 support is a significant change, so it's opt-in for existing users 
+	// to ensure a safe upgrade path. We only set the default for new configs.
+	if isEmptyConfig && conf.VPNConfig.IPNetV6 == "" {
 		conf.VPNConfig.IPNetV6 = DefaultVPNNetworkSubnet6
 	}
 	if ip, _ := conf.VPNLocalIPMask(); ip == nil {

service/tunnel.go

@@ -726,8 +726,11 @@ func (t *Tunnel) writeInboundBatch(packets []*vpn.Packet, bufs [][]byte, senderI
 	isOurGateway := t.vpnGatewayClientEnabled && vp.peerID == t.vpnGatewayPeerID
 	t.peersLock.RUnlock()
 
-	localIPv4, _ := t.conf.VPNLocalIPMask()
-	localIPv6, _ := t.conf.VPNLocalIPMaskV6()
+	localIPv4 := t.awlSubnet.IP
+	var localIPv6 net.IP
+	if t.awlSubnet6 != nil {
+		localIPv6 = t.awlSubnet6.IP
+	}
 
 	allowGateway := vp.weAllowUsingAsExitNode.Load()
 
@@ -789,6 +792,12 @@ func (t *Tunnel) writeInboundBatch(packets []*vpn.Packet, bufs [][]byte, senderI
 }
 
 // isNonRoutableIP returns true for IPs that should not be forwarded through the gateway.
+//
+// TODO(gateway): add client-side drop of
+// private destinations (10/8, 172.16/12, 192.168/16, CGNAT, link-local)
+// before sending to the gateway: fast local refusal instead of a silent drop
+// at the exit node's filter. Not a replacement for the server-side filtering
+// (iptables on Linux, WFP on Windows) — the server cannot trust clients.
 func isNonRoutableIP(ip net.IP) bool {
 	return ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsMulticast()
 }

socks5/server_test.go

@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"net/url"
 	"sync"
-	"sync/atomic"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -117,14 +116,13 @@ func TestProxyWithAuthRejection(t *testing.T) {
 	}
 }
 
-var testPortCounter int32 = 25000
-
 func pickFreeAddr(t testing.TB) string {
-	port := atomic.AddInt32(&testPortCounter, 1)
-	if port < testPortCounter {
-		t.Fatalf("port counter overflow: %d", port)
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
 	}
-	return fmt.Sprintf("127.0.0.1:%d", port)
+	defer l.Close()
+	return l.Addr().String()
 }
 
 // startUpstreamServer starts an HTTP server that responds with "test text" on /test.

test_suite_test.go

@@ -536,14 +536,13 @@ func (t *testTun) Close() error {
 	return nil
 }
 
-var testPortCounter int32 = 20000
-
 func pickFreeAddr(t testing.TB) string {
-	port := atomic.AddInt32(&testPortCounter, 1)
-	if port < testPortCounter {
-		t.Fatalf("port counter overflow: %d", port)
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
 	}
-	return fmt.Sprintf("127.0.0.1:%d", port)
+	defer l.Close()
+	return l.Addr().String()
 }
 
 func testPacket(length int) []byte {