refactor(ipv6): address PR #262 review comments and optimize IPv6 handling

Author: NNdroid

api/settings.go

@@ -1,7 +1,6 @@
 package api
 
 import (
-	"net"
 	"net/http"
 
 	"github.com/labstack/echo/v4"
@@ -97,12 +96,8 @@ func (h *Handler) GetMyPeerInfo(c echo.Context) (err error) {
 		}(),
 	}
 
-	ipV6, maskV6 := h.conf.VPNLocalIPMaskV6()
-	if ipV6 != nil && maskV6 != nil {
-		ipNetV6 := &net.IPNet{IP: ipV6.Mask(maskV6), Mask: maskV6}
-		if ipv6 := config.DeriveIPv6FromPeerID(h.p2p.PeerID(), ipNetV6); ipv6 != nil {
-			peerInfo.VPN.IPv6Addr = ipv6.String()
-		}
+	if ipV6, _ := h.conf.VPNLocalIPMaskV6(); ipV6 != nil {
+		peerInfo.VPN.IPv6Addr = ipV6.String()
 	}
 
 	return c.JSON(http.StatusOK, peerInfo)

awldns/awldns.go

@@ -219,10 +219,10 @@ func (r *Resolver) dnsLocalDomainHandler(resp dns.ResponseWriter, req *dns.Msg)
 		qtype := question.Qtype
 		hostnameLower := strings.ToLower(hostname)
 		mappedIP, found := cfg.directMapping[hostnameLower]
+		mappedIPv6, foundV6 := cfg.directMappingV6[hostnameLower]
 
 		switch qtype {
 		case dns.TypeA, dns.TypeANY:
-			_, foundV6 := cfg.directMappingV6[hostnameLower]
 			if !found {
 				if foundV6 {
 					continue // domain exists but no A record, return NOERROR with 0 answers (NODATA)
@@ -243,10 +243,8 @@ func (r *Resolver) dnsLocalDomainHandler(resp dns.ResponseWriter, req *dns.Msg)
 				})
 			}
 		case dns.TypeAAAA:
-			_, foundV4 := cfg.directMapping[hostnameLower]
-			mappedIPv6, foundV6 := cfg.directMappingV6[hostnameLower]
 			if !foundV6 {
-				if foundV4 {
+				if found {
 					continue // domain exists but no AAAA record, return NOERROR with 0 answers (NODATA)
 				}
 				m.SetRcode(req, dns.RcodeNameError)

cmd/gomobile-lib/main.go

@@ -5,7 +5,6 @@ package anywherelan
 import (
 	"context"
 	"fmt"
-	"net"
 	"os"
 
 	"golang.zx2c4.com/wireguard/tun"
@@ -48,57 +47,6 @@ func GetConfig() string {
 	return string(data)
 }
 
-func GetLocalIPv6() string {
-	if globalDataDir == "" {
-		panic("call to GetLocalIPv6 before Setup")
-	}
-
-	conf, loadConfigErr := config.LoadConfig(appType, eventbus.NewBus())
-	if loadConfigErr != nil {
-		return ""
-	}
-
-	ipV6, _ := conf.VPNLocalIPMaskV6()
-	if ipV6 != nil {
-		return ipV6.String()
-	}
-	return ""
-}
-
-func GetVpnNetworkAddressV4() string {
-	if globalDataDir == "" {
-		panic("call to GetVpnNetworkAddressV4 before Setup")
-	}
-
-	conf, loadConfigErr := config.LoadConfig(appType, eventbus.NewBus())
-	if loadConfigErr != nil {
-		return ""
-	}
-
-	_, ipNet, err := net.ParseCIDR(conf.VPNConfig.IPNet)
-	if err == nil && ipNet != nil {
-		return ipNet.IP.String()
-	}
-	return ""
-}
-
-func GetVpnNetworkAddressV6() string {
-	if globalDataDir == "" {
-		panic("call to GetVpnNetworkAddressV6 before Setup")
-	}
-
-	conf, loadConfigErr := config.LoadConfig(appType, eventbus.NewBus())
-	if loadConfigErr != nil {
-		return ""
-	}
-
-	_, ipNet, err := net.ParseCIDR(conf.VPNConfig.IPNetV6)
-	if err == nil && ipNet != nil {
-		return ipNet.IP.String()
-	}
-	return ""
-}
-
 // SocketProtector is the interface that the Android host app must implement
 // when it wants AWL to mark libp2p sockets so they bypass the VPN. The
 // implementation should call android.net.VpnService.protect() under the hood.

config/config.go

@@ -380,6 +380,7 @@ func (c *Config) SetIdentity(key crypto.PrivKey, id peer.ID) {
 
 	c.P2pNode.Identity = identity
 	c.P2pNode.PeerID = id.String()
+	c.ensureIPv6AddressLocked()
 	c.Save()
 	c.Unlock()
 }

service/tunnel_test.go config/ipv6_test.goservice/tunnel_test.go renamed to config/ipv6_test.go

@@ -1,19 +1,18 @@
-package service
+package config
 
 import (
 	"net"
 	"testing"
 
-	"github.com/anywherelan/awl/config"
 	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestDeriveIPv6FromPeerID(t *testing.T) {
-	_, sub6, _ := net.ParseCIDR("fd00:66::/48")
-	pid, _ := peer.Decode("12D3KooWNstM7Xq2VvMUPnBfN1Nhm64ZzCDBa64T8wY1oD2kKk8v")
+	_, sub6, _ := net.ParseCIDR("fd00:66:0:7915:10ba:fb1c:ef80:180c/48")
+	pid, _ := peer.Decode("12D3KooWBG3PFoGRgbr8ckoRPCpWQjdFj5tME2XBUot5s4uGZkiL")
 
-	addr := config.DeriveIPv6FromPeerID(pid, sub6)
+	addr := DeriveIPv6FromPeerID(pid, sub6)
 	assert.NotNil(t, addr)
 
 	// Ensure the address has the correct prefix
@@ -23,5 +22,5 @@ func TestDeriveIPv6FromPeerID(t *testing.T) {
 	assert.NotEqual(t, sub6.IP, addr)
 
 	// Ensure the last bit logic works for all-zero hashes (hard to mock hash, but we test nil case)
-	assert.Nil(t, config.DeriveIPv6FromPeerID(pid, nil))
+	assert.Nil(t, DeriveIPv6FromPeerID(pid, nil))
 }

config/network_addr.go

@@ -5,15 +5,13 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-
-	"github.com/libp2p/go-libp2p/core/peer"
 )
 
 const (
 	DefaultVPNInterfaceName = "awl0"
 	// TODO: generate subnets if this has already taken
 	DefaultVPNNetworkSubnet  = "10.66.0.1/16"
-	DefaultVPNNetworkSubnet6 = "fd00:66:0::1/48"
+	DefaultVPNNetworkSubnet6 = "fd00:66:0::/48"
 )
 
 func (c *Config) VPNLocalIPMask() (net.IP, net.IPMask) {
@@ -49,15 +47,6 @@ func (c *Config) VPNLocalIPMaskV6Unlocked() (net.IP, net.IPMask) {
 		return nil, nil
 	}
 
-	if c.P2pNode.PeerID != "" {
-		pid, err := peer.Decode(c.P2pNode.PeerID)
-		if err == nil {
-			if derived := DeriveIPv6FromPeerID(pid, ipNet); derived != nil {
-				return derived, ipNet.Mask
-			}
-		}
-	}
-
 	return localIP.To16(), ipNet.Mask
 }
 
@@ -74,7 +63,7 @@ func (c *Config) NetstackDNSIP() net.IP {
 }
 
 // computeNetstackDNSIP derives the reserved DNS server IP from the current
-// config snapshot: broadcast — shifted down until an address is free to
+// config snapshot: broadcast-1, shifted down until an address is free to
 // assign (CheckIPUnique rejects our own IP, the broadcast address and peers).
 // Deterministic; returns nil when the subnet has no free address. Not thread
 // safe — called from setDefaults at construction only, where netstackDNSIP is

config/other.go

@@ -3,6 +3,7 @@ package config
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -11,6 +12,7 @@ import (
 	"time"
 
 	"github.com/ipfs/go-log/v2"
+	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/libp2p/go-libp2p/p2p/host/eventbus"
 	"github.com/moby/sys/atomicwriter"
 	"github.com/multiformats/go-multiaddr"
@@ -237,10 +239,11 @@ func setDefaults(conf *Config, bus awlevent.Bus) {
 	if isEmptyConfig && conf.VPNConfig.IPNetV6 == "" {
 		conf.VPNConfig.IPNetV6 = DefaultVPNNetworkSubnet6
 	}
+	conf.ensureIPv6AddressLocked()
 	if ip, _ := conf.VPNLocalIPMask(); ip == nil {
 		conf.VPNConfig.IPNet = DefaultVPNNetworkSubnet
 	}
-	if ip, _ := conf.VPNLocalIPMaskV6(); ip == nil {
+	if ip, _ := conf.VPNLocalIPMaskV6(); conf.VPNConfig.IPNetV6 != "" && ip == nil {
 		conf.VPNConfig.IPNetV6 = DefaultVPNNetworkSubnet6
 	}
 	if conf.VPNConfig.InterfaceName == "" {
@@ -355,3 +358,18 @@ func writeFileAtomic(path string, data []byte) error {
 	ChownFileIfNeeded(path)
 	return nil
 }
+
+func (c *Config) ensureIPv6AddressLocked() {
+	if c.VPNConfig.IPNetV6 == "" || c.P2pNode.PeerID == "" {
+		return
+	}
+	localIP, ipNet, err := net.ParseCIDR(c.VPNConfig.IPNetV6)
+	if err == nil && localIP.Equal(ipNet.IP) {
+		if pid, err := peer.Decode(c.P2pNode.PeerID); err == nil {
+			if derived := DeriveIPv6FromPeerID(pid, ipNet); derived != nil {
+				maskLen, _ := ipNet.Mask.Size()
+				c.VPNConfig.IPNetV6 = fmt.Sprintf("%s/%d", derived.String(), maskLen)
+			}
+		}
+	}
+}

service/auth_status.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"maps"
-	"net"
 	"strings"
 	"sync"
 	"time"
@@ -167,21 +166,17 @@ func (s *AuthStatus) createPeerInfo(peer config.KnownPeer, myPeerName string, de
 	vpnGatewayServerEnabled := s.conf.VPNGateway.ServerEnabled
 	s.conf.RUnlock()
 
-	myPeerInfo := protocol.PeerStatusInfo{
+	var ipv6Addr string
+	if ipV6, _ := s.conf.VPNLocalIPMaskV6(); ipV6 != nil {
+		ipv6Addr = ipV6.String()
+	}
+
+	return protocol.PeerStatusInfo{
 		Name:                    myPeerName,
 		AllowUsingAsExitNode:    peer.WeAllowUsingAsExitNode,
 		VPNGatewayServerEnabled: vpnGatewayServerEnabled,
+		IPv6Addr:                ipv6Addr,
 	}
-
-	ipV6, maskV6 := s.conf.VPNLocalIPMaskV6()
-	if ipV6 != nil && maskV6 != nil {
-		ipNetV6 := &net.IPNet{IP: ipV6.Mask(maskV6), Mask: maskV6}
-		if ipv6 := config.DeriveIPv6FromPeerID(s.p2p.PeerID(), ipNetV6); ipv6 != nil {
-			myPeerInfo.IPv6Addr = ipv6.String()
-		}
-	}
-
-	return myPeerInfo
 }
 
 // processPeerStatusInfo merges the status info received from peerID into the
@@ -220,7 +215,7 @@ func (s *AuthStatus) processPeerStatusInfo(peerID string, peerInfo protocol.Peer
 		if peer.Alias == "" {
 			peer.Alias = s.conf.GenUniqPeerAliasUnlocked(peer.Name, peer.Alias)
 		}
-		if peerInfo.IPv6Addr != "" && peer.IPAddrV6 == "" {
+		if peerInfo.IPv6Addr != "" && peer.IPAddrV6 != peerInfo.IPv6Addr {
 			peer.IPAddrV6 = peerInfo.IPv6Addr
 		}
 		peer.AllowedUsingAsExitNode = peerInfo.AllowUsingAsExitNode

service/tunnel.go

@@ -117,22 +117,9 @@ func (t *Tunnel) StreamHandler(stream network.Stream) {
 	peerID := stream.Conn().RemotePeer()
 
 	defer func() {
-		if r := recover(); r != nil {
-			// This typically happens if vpnPeer.inboundCh is closed concurrently
-			// during a tunnel restart or peer removal.
-			t.logger.Debugf("StreamHandler recovered from panic (likely channel closed) for peer %s: %v", peerID, r)
-		}
 		_ = stream.Close()
 	}()
 
-	t.peersLock.RLock()
-	vpnPeer, ok := t.peerIDToPeer[peerID]
-	t.peersLock.RUnlock()
-	if !ok {
-		t.logger.Infof("Unknown peer %s tried to tunnel packet", peerID)
-		return
-	}
-
 	wrappedStream := &io.LimitedReader{}
 	for {
 		packet := t.device.GetTempPacket()
@@ -154,13 +141,23 @@ func (t *Tunnel) StreamHandler(stream network.Stream) {
 		}
 		packet.GatewayDir = dir
 
+		t.peersLock.RLock()
+		vpnPeer, ok := t.peerIDToPeer[peerID]
+		if !ok {
+			t.peersLock.RUnlock()
+			t.logger.Infof("Unknown peer %s tried to tunnel packet", peerID)
+			t.device.PutTempPacket(packet)
+			return
+		}
+
 		select {
 		case vpnPeer.inboundCh <- packet:
 		default:
 			metrics.VPNPacketsDroppedTotal.WithLabelValues("inbound_channel_full").Inc()
 			t.logger.Warnf("inbound reader dropped packet for peer %s", peerID)
 			t.device.PutTempPacket(packet)
 		}
+		t.peersLock.RUnlock()
 	}
 }