vpn/netstate: re-sync exit-node forwarding on uplink change (windows)

The watch cycle moves from sockmark_windows.go into manager_windows.go and
gains a second consumer besides the marker re-bind: when the best IPv4
uplink appears or moves, resyncServerForwarding enables IPv4 forwarding on
it, so exit-node roaming and an offline server start heal without a server
off/on toggle. Forwarding on the abandoned uplink is deliberately left on;
teardown reverts only what we enabled.

The marker re-bind chain gets a hostnet test on a real Winsock socket, with
the stored index poisoned to 0 so the re-bind is observable.

Also, from review: WFP session rollback unified through teardownNAT,
runPowerShell bounded by a timeout (a hung PowerShell would freeze the
watch goroutine via m.mu), kick/redetect/reapply/apply renamed to
notifyNetChange/redetectUplinks/rebindSockets/bindSocketToUplink, WFP
weight rationale documented.

Author: pymq

vpn/netstate/manager_windows.go

@@ -8,10 +8,26 @@ import (
 	"fmt"
 	"sync"
 	"sync/atomic"
+	"time"
 
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 )
 
+const (
+	// Debounce parameters for network-change notifications, borrowed from
+	// WireGuard for Windows (tunnel/defaultroutemonitor.go): coalesce bursts
+	// for 150ms, but never delay a re-detection beyond 2s if the burst keeps
+	// going (interface storms during docking/undocking).
+	debounceInterval = 150 * time.Millisecond
+	debounceBurstMax = 2 * time.Second
+
+	// sweepInterval paces the registry liveness sweep. On a stable network
+	// re-apply (the other cleanup point) may not run for weeks; the sweep
+	// guarantees closed sockets don't stay pinned by their RawConn either
+	// way. The registry holds a handful of entries, so this is nearly free.
+	sweepInterval = 2 * time.Minute
+)
+
 // Manager owns the Windows OS network state behind AWL's VPN gateway feature:
 // the always-on socket marking (IP_UNICAST_IF binding to the physical uplink
 // NIC — mechanism and lifecycle in sockmark_windows.go) and the runtime state
@@ -33,11 +49,11 @@ type Manager struct {
 	index6 atomic.Uint32
 
 	// registry tracks the live long-lived UDP sockets for re-binding on
-	// uplink changes; kickCh feeds debounced network-change notifications to
-	// the watch goroutine. Both belong to the marking machinery in
-	// sockmark_windows.go.
-	registry sockRegistry
-	kickCh   chan struct{}
+	// uplink changes (marking machinery, sockmark_windows.go); netChangeCh
+	// carries network-change notifications from the OS callbacks to the
+	// watch goroutine, which debounces them.
+	registry    sockRegistry
+	netChangeCh chan struct{}
 
 	mu         sync.Mutex
 	routeState *routeState
@@ -47,7 +63,7 @@ type Manager struct {
 // NewManager returns the Manager for Windows. The uplink indexes stay zero
 // (marking is a no-op) until Start performs the initial detection.
 func NewManager() *Manager {
-	return &Manager{kickCh: make(chan struct{}, 1)}
+	return &Manager{netChangeCh: make(chan struct{}, 1)}
 }
 
 // Start synchronously detects the current uplink and launches the
@@ -58,14 +74,18 @@ func NewManager() *Manager {
 // registration itself can fail — and that deliberately fails Init (unlike
 // the Linux Start, whose netlink monitor is best-effort staleness tracking):
 // the notifications drive socket marking itself, which never recovers
-// without them. Must be called before the first libp2p socket is created.
+// without them. Called before the first libp2p socket is created (Init
+// guarantees this); the ordering matters mostly for TCP — a UDP socket
+// created earlier is registered and re-bound by the initial uplink
+// re-detection anyway, but a TCP dial made before Start would stay unmarked
+// for its lifetime.
 func (m *Manager) Start(ctx context.Context) error {
-	m.redetect()
+	m.redetectUplinks()
 
 	routeCb, err := winipcfg.RegisterRouteChangeCallback(func(_ winipcfg.MibNotificationType, route *winipcfg.MibIPforwardRow2) {
 		// Only default-route changes can change the uplink choice.
 		if route != nil && route.DestinationPrefix.PrefixLength == 0 {
-			m.kick()
+			m.notifyNetChange()
 		}
 	})
 	if err != nil {
@@ -75,7 +95,7 @@ func (m *Manager) Start(ctx context.Context) error {
 		// Parameter changes cover interface metric flips, which reorder
 		// default routes without touching the route table itself.
 		if notificationType == winipcfg.MibParameterNotification {
-			m.kick()
+			m.notifyNetChange()
 		}
 	})
 	if err != nil {
@@ -93,6 +113,83 @@ func (m *Manager) Start(ctx context.Context) error {
 	return nil
 }
 
+// notifyNetChange signals the watch goroutine that the network changed, which
+// reacts after a debounce (onNetworkChange). Non-blocking and coalescing:
+// called from OS notification threads.
+func (m *Manager) notifyNetChange() {
+	select {
+	case m.netChangeCh <- struct{}{}:
+	default:
+	}
+}
+
+// watch is the Manager's background goroutine: the debounced reaction to
+// network change notifications plus the periodic registry sweep. cleanup
+// unregisters the OS callbacks when ctx dies.
+func (m *Manager) watch(ctx context.Context, cleanup func()) {
+	defer cleanup()
+
+	coalesce := time.NewTimer(time.Hour)
+	if !coalesce.Stop() {
+		<-coalesce.C
+	}
+	defer coalesce.Stop()
+	sweep := time.NewTicker(sweepInterval)
+	defer sweep.Stop()
+
+	stopCoalesce := func() {
+		if !coalesce.Stop() {
+			select {
+			case <-coalesce.C:
+			default:
+			}
+		}
+	}
+
+	var burstStart time.Time
+	pending := false
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-m.netChangeCh:
+			now := time.Now()
+			switch {
+			case !pending:
+				burstStart = now
+				pending = true
+				coalesce.Reset(debounceInterval)
+			case now.Sub(burstStart) >= debounceBurstMax:
+				// The burst has been going on too long — don't starve the
+				// re-detection, run it now.
+				stopCoalesce()
+				pending = false
+				m.onNetworkChange()
+			default:
+				stopCoalesce()
+				coalesce.Reset(debounceInterval)
+			}
+		case <-coalesce.C:
+			pending = false
+			m.onNetworkChange()
+		case <-sweep.C:
+			if evicted := m.registry.sweep(); evicted > 0 {
+				logger.Debugf("registry sweep evicted %d closed sockets", evicted)
+			}
+		}
+	}
+}
+
+// onNetworkChange runs the debounced consumers of a network-change event:
+// socket-marking re-detection first (lock-free — atomics + the registry's own
+// lock), then the exit node's forwarding re-sync, which takes m.mu.
+// EnableServerNAT can hold m.mu for seconds of PowerShell, and must never
+// delay socket re-binding — only the re-sync itself, which is harmless.
+func (m *Manager) onNetworkChange() {
+	m.redetectUplinks()
+	m.resyncServerForwarding()
+}
+
 // EnableClientRoutes installs the gateway client routes on the TUN (the
 // default-route capture plus the IPv6 fail-closed fence). Idempotent: a
 // second call while routes are installed is a no-op. It refuses while no