vpn/netstate: split Manager into per-platform implementations

Replace the cross-platform Manager + marker interface with a per-GOOS
Manager type owning the marker state and routes/NAT under one lock.
Windows-only helpers (uplink, sock registry, families, winnat) move
under the windows constraint; setup/teardown become Manager methods and
the fwmark parameter threading is replaced by the awlMark const.
Hostnet test suites now exercise the Manager API directly. No behaviour change.

Author: pymq

vpn/netstate/families.go

@@ -1,3 +1,5 @@
+//go:build windows
+
 package netstate
 
 import (

vpn/netstate/families_test.go

@@ -2,10 +2,135 @@
 
 package netstate
 
+import (
+	"context"
+	"fmt"
+	"sync"
+	"syscall"
+)
+
+// ProtectFunc is the type of the callback supplied by the Android host
+// application (VpnService.protect via the gomobile/JNI bridge). Returns true
+// on success.
+type ProtectFunc func(fd int) bool
+
+// Manager on Android delegates everything to the host application: socket
+// marking invokes the host-supplied protect callback for each libp2p socket
+// so the host's VpnService.protect() can mark it as bypassing the TUN, and
+// routes/NAT are owned by the host's VpnService.Builder — Enable*/Disable*
+// only track the enabled state so Active reporting stays consistent with the
+// other platforms.
+//
+// The protector is set once at construction (via NewAndroidManager). To
+// change it, stop the application and start a new one with a fresh Manager.
+// This avoids any runtime synchronisation and matches the gomobile-lib
+// lifecycle (one Application instance per StartServer call).
+type Manager struct {
+	protect ProtectFunc
+
+	mu                 sync.Mutex
+	clientRoutesActive bool
+	serverNATActive    bool
+}
+
+// NewManager returns a Manager with a no-op protector (ControlFunc will
+// return nil). Production code should construct the Manager via
+// NewAndroidManager with a protector wired to VpnService.protect; NewManager
+// exists so that the cross-platform default construction path works and
+// callers that don't enable gateway mode don't have to special-case Android.
+func NewManager() *Manager {
+	return &Manager{}
+}
+
 // NewAndroidManager returns a Manager whose socket marker calls the
 // host-supplied protect callback (VpnService.protect via the gomobile/JNI
-// bridge) for each new socket. The routes/NAT sides stay no-ops on Android —
-// routing is owned by the host's VpnService.Builder.
+// bridge) for each new socket.
 func NewAndroidManager(protect ProtectFunc) *Manager {
-	return &Manager{marker: newAndroidMarker(protect)}
+	return &Manager{protect: protect}
+}
+
+// Start is a no-op: socket protection is delegated to the host's
+// VpnService.protect, which owns its own network tracking.
+func (m *Manager) Start(_ context.Context) error { return nil }
+
+// ControlFunc returns a function compatible with net.Dialer.Control that
+// invokes the host-supplied protector for each new socket. Returns nil when
+// no protector was supplied (NewManager).
+func (m *Manager) ControlFunc() func(network, address string, c syscall.RawConn) error {
+	if m.protect == nil {
+		return nil
+	}
+	return func(_, _ string, c syscall.RawConn) error {
+		var sockErr error
+		err := c.Control(func(fd uintptr) {
+			// gomobile turns Java-side exceptions into Go panics. If the
+			// host VpnService has been destroyed between Application.Close
+			// and a still-running libp2p dial, the JVM ref behind protect
+			// may be dead; recover so the dial fails cleanly instead of
+			// crashing the process.
+			defer func() {
+				if r := recover(); r != nil {
+					logger.Warnf("VpnService.protect panicked for fd %d: %v", fd, r)
+					sockErr = fmt.Errorf("VpnService.protect panic: %v", r)
+				}
+			}()
+			if !m.protect(int(fd)) {
+				sockErr = fmt.Errorf("VpnService.protect failed for fd %d", fd)
+			}
+		})
+		if err != nil {
+			return fmt.Errorf("sockmark control: %w", err)
+		}
+		return sockErr
+	}
+}
+
+// EnableClientRoutes only records the enabled state: routes are configured
+// via VpnService.Builder in the Android app:
+//   - Gateway mode: builder.addRoute("0.0.0.0", 0) + builder.addRoute("::", 0)
+//   - Normal mode: builder.addRoute("10.66.0.0", 24) (awl subnet only)
+func (m *Manager) EnableClientRoutes(_ string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.clientRoutesActive = true
+	return nil
+}
+
+// DisableClientRoutes only records the disabled state — see EnableClientRoutes.
+func (m *Manager) DisableClientRoutes() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.clientRoutesActive = false
+	return nil
+}
+
+// ClientRoutesActive reports whether gateway client routes are enabled.
+func (m *Manager) ClientRoutesActive() bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.clientRoutesActive
+}
+
+// EnableServerNAT only records the enabled state: Android exit node support
+// requires root or special system configuration, so no OS state is touched.
+func (m *Manager) EnableServerNAT(_, _ string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.serverNATActive = true
+	return nil
+}
+
+// DisableServerNAT only records the disabled state — see EnableServerNAT.
+func (m *Manager) DisableServerNAT() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.serverNATActive = false
+	return nil
+}
+
+// ServerNATActive reports whether the exit-node NAT is enabled.
+func (m *Manager) ServerNATActive() bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.serverNATActive
 }

vpn/netstate/log.go

@@ -1,3 +1,5 @@
+//go:build linux && !android
+
 package netstate
 
 import (
@@ -7,74 +9,69 @@ import (
 	"syscall"
 )
 
-// Manager is the single entry point to this package: it owns the socket
-// marker (always-on, started once per process) and the runtime OS state of
-// VPN gateway mode — the client routes and the server NAT. The struct is the
-// same on every platform; the platform-specific behaviour lives in the marker
-// and in the setup/teardown functions the methods call. Consumers declare
-// their own narrow interfaces over the methods they use (see awl.NetManager,
-// service.NetManager, service.SocketMarker).
+// awlMark is the numeric value shared by the SO_MARK fwmark applied to marked
+// sockets and the policy-routing table ID holding their exemption routes.
+// 0x61776C = "awl" in ASCII (lowercase). The two live in different kernel
+// namespaces and don't collide; using one value makes awl-owned state
+// trivially greppable in `ip rule` / `ip route show table`.
+const awlMark = 0x61776C
+
+// Manager owns the Linux OS network state behind AWL's VPN gateway feature:
+// the always-on socket marking (SO_MARK, applied via ControlFunc) and the
+// runtime state of gateway mode — the client routes and the server NAT.
 //
 // Enable/Disable methods are idempotent and safe for concurrent use. The
 // internal mutex only guards the Manager's own state; the orchestration
 // above (service.VPNGateway) still serialises whole enable/disable
 // transactions — config, tunnel binding, DNS and the calls here — under its
 // own lock.
 type Manager struct {
-	marker marker
-
 	mu         sync.Mutex
 	routeState *routeState
 	natState   *natState
 }
 
-// NewManager returns the Manager for the current platform. On Android it
-// carries a no-op socket protector — use NewAndroidManager to wire
-// VpnService.protect.
+// NewManager returns the Manager for Linux. Setting SO_MARK requires
+// CAP_NET_ADMIN, which AWL already needs for TUN setup, so no extra
+// capability is required.
 func NewManager() *Manager {
-	return &Manager{marker: newMarker()}
+	return &Manager{}
 }
 
-// Start performs the marker's initial setup and launches any background
-// machinery it needs, living until ctx is cancelled. On Windows this is the
-// uplink detection + network-change watcher; elsewhere it is a no-op. Must be
-// called before the first libp2p socket is created (see marker.Start for the
-// offline-start semantics).
-func (m *Manager) Start(ctx context.Context) error {
-	return m.marker.Start(ctx)
-}
+// Start is a no-op on Linux: SO_MARK is interpreted by the kernel per packet,
+// there is no per-socket state to keep in sync with the network.
+func (m *Manager) Start(_ context.Context) error { return nil }
 
 // ControlFunc returns a function compatible with net.Dialer.Control and the
-// QUIC ListenUDP override, marking each new socket to bypass the VPN tunnel.
-// It returns nil when the platform is not configured (e.g. Android before the
-// host app supplies a protector).
+// QUIC ListenUDP override, marking each new socket with SO_MARK so its
+// traffic bypasses the VPN tunnel via the fwmark ip rule.
 func (m *Manager) ControlFunc() func(network, address string, c syscall.RawConn) error {
-	return m.marker.ControlFunc()
+	return func(_, _ string, c syscall.RawConn) error {
+		var sockErr error
+		err := c.Control(func(fd uintptr) {
+			sockErr = syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_MARK, awlMark)
+		})
+		if err != nil {
+			return fmt.Errorf("sockmark control: %w", err)
+		}
+		if sockErr != nil {
+			return fmt.Errorf("sockmark SO_MARK: %w", sockErr)
+		}
+		return nil
+	}
 }
 
 // EnableClientRoutes installs the gateway client routes on the TUN (the
 // default-route capture plus the IPv6 fail-closed fence). Idempotent: a
-// second call while routes are installed is a no-op. On Windows it refuses
-// while no IPv4 uplink is known (marking could not exempt libp2p traffic —
-// routing loop); the condition is self-healing, so that is "try again once
-// online", not a permanent failure.
+// second call while routes are installed is a no-op.
 func (m *Manager) EnableClientRoutes(tunIfName string) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
 	if m.routeState != nil {
 		return nil
 	}
-	// Markers that can be temporarily unable to guarantee loop-free marking
-	// (Windows: no uplink detected right now) expose Ready. Other platforms
-	// don't implement the interface and skip the check.
-	if readier, ok := m.marker.(interface{ Ready() error }); ok {
-		if err := readier.Ready(); err != nil {
-			return fmt.Errorf("cannot enable VPN gateway: %w", err)
-		}
-	}
-
-	state, err := setupGatewayRoutes(tunIfName, m.marker.FWMark())
+	state, err := m.setupGatewayRoutes(tunIfName)
 	if err != nil {
 		return fmt.Errorf("setup gateway routes: %w", err)
 	}
@@ -95,7 +92,7 @@ func (m *Manager) DisableClientRoutes() error {
 	}
 	state := m.routeState
 	m.routeState = nil
-	return teardownGatewayRoutes(state)
+	return m.teardownGatewayRoutes(state)
 }
 
 // ClientRoutesActive reports whether gateway client routes are currently
@@ -107,17 +104,16 @@ func (m *Manager) ClientRoutesActive() bool {
 }
 
 // EnableServerNAT configures the exit-node data path for the awl subnet
-// (Linux: ip_forward + iptables chain + MASQUERADE; Windows: WFP filter +
-// per-interface forwarding + WinNAT). Idempotent: a second call while NAT is
-// configured is a no-op.
+// (ip_forward + iptables chain + MASQUERADE). Idempotent: a second call while
+// NAT is configured is a no-op.
 func (m *Manager) EnableServerNAT(awlSubnet, tunIfName string) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
 	if m.natState != nil {
 		return nil
 	}
-	state, err := setupNAT(awlSubnet, tunIfName)
+	state, err := m.setupNAT(awlSubnet, tunIfName)
 	if err != nil {
 		return fmt.Errorf("setup NAT: %w", err)
 	}
@@ -137,7 +133,7 @@ func (m *Manager) DisableServerNAT() error {
 	}
 	state := m.natState
 	m.natState = nil
-	return teardownNAT(state)
+	return m.teardownNAT(state)
 }
 
 // ServerNATActive reports whether the exit-node NAT is currently configured.