WIP 3

Author: pymq

.github/workflows/test.yml

@@ -259,22 +259,27 @@ jobs:
 
           ./awl.exe cli gateway client use --name awl-tester
           ./awl.exe cli gateway status
-          ROUTES_ON=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1 -ErrorAction SilentlyContinue | Measure-Object).Count')
-          NRPT_ON=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count')
+          ROUTES_ON=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1 -ErrorAction SilentlyContinue | Measure-Object).Count' | tr -d '\r')
+          NRPT_ON=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count' | tr -d '\r')
           powershell -NoProfile -Command 'Get-DnsClientNrptPolicy | Format-List Namespace,NameServers'
-          powershell -NoProfile -Command 'Get-NetRoute -DestinationPrefix ::/1,8000::/1 -ErrorAction SilentlyContinue | Format-List DestinationPrefix,InterfaceAlias'   # v6 fence diagnostics
+          # Route diagnostics incl. lifetimes/protocol: a route created without
+          # InitializeIpForwardEntry shows zero lifetimes and is ignored by the
+          # forwarding path while still being listed here.
+          powershell -NoProfile -Command 'Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1,::/1,8000::/1 -ErrorAction SilentlyContinue | Format-List DestinationPrefix,InterfaceAlias,RouteMetric,Protocol,ValidLifetime,PreferredLifetime'
           # Tolerate a failed curl here so we always reach `client stop` below
           # (a broken tunnel must not leave the runner black-holed); the
           # `test -n "$IP_GW"` assertion after teardown turns it into a clean failure.
           IP_GW=$(curl4 || true); echo "egress IP (via gateway): $IP_GW"
 
           ./awl.exe cli gateway client stop
-          ROUTES_OFF=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1 -ErrorAction SilentlyContinue | Measure-Object).Count')
-          NRPT_OFF=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count')
+          ROUTES_OFF=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1 -ErrorAction SilentlyContinue | Measure-Object).Count' | tr -d '\r')
+          NRPT_OFF=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count' | tr -d '\r')
           IP_REVERTED=$(curl4); echo "egress IP (reverted): $IP_REVERTED"
 
           # Assertions run with the gateway already disabled, so a failure here
-          # can't leave the runner's egress black-holed.
+          # can't leave the runner's egress black-holed. Values are echoed
+          # first so a failed assertion is attributable from the log alone.
+          echo "ROUTES_ON=$ROUTES_ON NRPT_ON=$NRPT_ON ROUTES_OFF=$ROUTES_OFF NRPT_OFF=$NRPT_OFF"
           test "$ROUTES_ON" -eq 2                            # /1 pair installed while gateway is on
           test "$NRPT_ON" -ge 1                              # full-capture NRPT rule while gateway is on
           test -n "$IP_GW"                                   # traffic really flowed through the exit node
@@ -293,12 +298,14 @@ jobs:
           # awl is gone. Route absence can't distinguish a clean teardown from a
           # crash here — the /1 routes are bound to the Wintun LUID and die with
           # the adapter either way — so this only re-verifies crash semantics.
-          DANGLING=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1,::/1,8000::/1 -ErrorAction SilentlyContinue | Measure-Object).Count')
+          DANGLING=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1,::/1,8000::/1 -ErrorAction SilentlyContinue | Measure-Object).Count' | tr -d '\r')
+          echo "DANGLING=$DANGLING"
           test "$DANGLING" -eq 0
           # The NRPT catch-all rule CAN distinguish them: it lives in the
           # registry and survives a killed process, but the graceful shutdown
           # path removes it — its absence proves the shutdown teardown ran
           # (the Windows analogue of the interface-independent fwmark ip rule
           # asserted on Linux).
-          NRPT_SHUTDOWN=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count')
+          NRPT_SHUTDOWN=$(powershell -NoProfile -Command '(Get-DnsClientNrptPolicy | Where-Object { $_.Namespace -eq "." } | Measure-Object).Count' | tr -d '\r')
+          echo "NRPT_SHUTDOWN=$NRPT_SHUTDOWN"
           test "$NRPT_SHUTDOWN" -eq 0

service/vpn_gateway.go

@@ -390,9 +390,8 @@ func (g *VPNGateway) applyClient() error {
 		return nil
 	}
 
-	// Temporary exception rather than a restructure: this branching moves into
-	// the netstate manager in the next MR (plans/windows-vpn-gateway.md §8.2)
-	// and flattens there.
+	// TODO: Temporary exception rather than a restructure: this branching moves into
+	//  the netstate manager in the next MR and flattens there.
 	//nolint:nestif
 	if g.disableOSSetup {
 		g.clientRouteState = &routes.RouteState{}

vpn/routes/routes_windows.go

@@ -87,6 +87,12 @@ func SetupGatewayRoutes(tunIfName string, fwmark uint32) (*RouteState, error) {
 // and records it for teardown.
 func (state *RouteState) addTunRoute(prefix netip.Prefix, nextHop netip.Addr) error {
 	row := winipcfg.MibIPforwardRow2{}
+	// InitializeIpForwardEntry is mandatory before CreateIpForwardEntry2
+	// it sets ValidLifetime/PreferredLifetime to infinite and Protocol to NetMgmt.
+	// Without it the route lands in the table with zero lifetimes and is
+	// ignored by the forwarding path — visible in Get-NetRoute, yet traffic
+	// keeps flowing past it.
+	row.Init()
 	row.InterfaceLUID = state.tunLUID
 	row.DestinationPrefix.PrefixLength = uint8(prefix.Bits())
 	if err := row.DestinationPrefix.RawPrefix.SetAddr(prefix.Addr()); err != nil {

vpn/routes/vpn_hostnet_windows_integration_test.go

@@ -227,21 +227,25 @@ func TestGatewayHostNetNATRollback(t *testing.T) {
 	forwardingBefore := forwardingEnabled(t, nicLUID)
 
 	// Provoke a New-NetNat failure at the last setup step by occupying WinNAT
-	// with a conflicting instance (WinNAT is effectively single-instance).
+	// with a conflicting instance whose internal prefix CONTAINS the awl one
+	// (10.66.0.0/15 ⊃ 10.66.0.0/16). Windows Server images tolerate multiple
+	// instances with disjoint prefixes (observed on the GitHub runner), but
+	// overlapping prefixes are rejected — which is exactly the failure we
+	// need at the last step.
 	const conflictName = "awl-hostnet-conflict"
 	_, err := runPowerShell(fmt.Sprintf(
-		"New-NetNat -Name %s -InternalIPInterfaceAddressPrefix 10.77.0.0/16 | Out-Null", conflictName))
+		"New-NetNat -Name %s -InternalIPInterfaceAddressPrefix 10.66.0.0/15 | Out-Null", conflictName))
 	require.NoError(t, err, "creating the conflicting NetNat must succeed on a clean host")
 	t.Cleanup(func() {
 		_, _ = runPowerShell(fmt.Sprintf("Remove-NetNat -Name %s -Confirm:$false", conflictName))
 	})
 
 	state, err := SetupNAT(testAwlSubnet, nicGUID)
 	if err == nil {
-		// Some builds tolerate multiple WinNAT instances — then there is no
+		// If even overlapping-prefix instances are tolerated, there is no
 		// failure to roll back from. Clean up and skip rather than fail.
 		require.NoError(t, TeardownNAT(state))
-		t.Skip("this host allows multiple WinNAT instances; rollback path not reachable here")
+		t.Skip("this host allows overlapping WinNAT instances; rollback path not reachable here")
 	}
 	require.Contains(t, err.Error(), "WinNAT", "failure must come from the WinNAT step")