vpn gateway: track routes changes on Linux

Route-staleness monitor (routes_linux.go): subscribe to netlink route changes
and re-sync the tableID exemption copies (v4 and v6) with the live host
default(s) on DHCP renew / Wi-Fi<->Ethernet roam / new RA. Debounced (500ms)
reconcile diffs by route key; it never touches the TUN default or the IPv6
unreachable fence, so there is no leak window even mid-uplink-change. The
monitor re-subscribes with backoff on a mid-session netlink socket death, using
a per-subscription cancel channel so a dead socket + its watcher goroutine are
released immediately rather than leaked. RouteState gains a mutex + monitor
lifecycle; teardown stops the monitor first. Adds vpn_hostnet integration tests
(v4 + v6 reconcile) with goleak checks.

Drop the conf lock on the inbound hot path: writeInboundBatch takes *VpnPeer and
reads vp.weAllowUsingAsExitNode (atomic, synced by RefreshPeersList) instead of a
per-batch conf.GetPeer RLock + peer.ID.String() alloc. Forward-without-permission
is still dropped before the TUN write.

Gateway connectivity event: new awlevent.VPNGatewayConnectivityChanged, emitted
from Tunnel on gateway-peer connect/disconnect with edge dedup and an initial
state on enable. awl-tray shows a desktop notification on up/down.

Refuse removing a peer that is the active VPN gateway (409) instead of
black-holing all non-local traffic; the user must disable the gateway first.

Author: pymq

README.md

@@ -259,8 +259,6 @@ On macOS and Windows awl currently refuses to start with VPN gateway enabled.
 > - **Dual-stack (IPv4 + IPv6):** everything automatically uses IPv4 through the tunnel.
 > - **IPv6-only network:** you'll have no internet connectivity until you turn the gateway off.
 
-> **Linux: host network changes mid-session aren't tracked.** If the host switches network (new Wi-Fi, Ethernet or cellular connection) while the gateway is on, restart awl. This will be fixed in a future release.
-
 ### Serve as an exit node
 
 This lets your other devices route their internet traffic out through this one. It is **off by default** — see [Why serving as an exit node is opt-in](#why-serving-as-an-exit-node-is-opt-in) below. Two things need to be set: turn the gateway service on, then allow each specific device to use it. Serving as an exit node is Linux-only (see the status table above).

api/peers.go

@@ -280,6 +280,7 @@ func (h *Handler) GetAuthRequests(c echo.Context) (err error) {
 // @Success	200		"OK"
 // @Failure	400		{object}	api.Error
 // @Failure	404		{object}	api.Error
+// @Failure	409		{object}	api.Error
 // @Router		/peers/remove [POST]
 func (h *Handler) RemovePeer(c echo.Context) (err error) {
 	req := entity.PeerIDRequest{}
@@ -296,6 +297,18 @@ func (h *Handler) RemovePeer(c echo.Context) (err error) {
 			ErrorMessage("Invalid hex-encoded multihash representing of a peer ID"))
 	}
 
+	// Refuse to remove the peer while it is the active VPN gateway: doing so
+	// would leave the TUN default route / DNS installed with nothing bound and
+	// black-hole all non-local traffic. The user must disable gateway client
+	// mode first (an explicit, reversible action).
+	h.conf.RLock()
+	isActiveGateway := h.conf.VPNGateway.ClientEnabled && h.conf.VPNGateway.GatewayPeerID == req.PeerID
+	h.conf.RUnlock()
+	if isActiveGateway {
+		return c.JSON(http.StatusConflict,
+			ErrorMessage("disable VPN gateway before removing this peer"))
+	}
+
 	knownPeer, exists := h.conf.RemovePeer(req.PeerID)
 	if !exists {
 		return c.JSON(http.StatusNotFound, ErrorMessage("peer not found"))

application.go

@@ -135,7 +135,7 @@ func (a *Application) Init(ctx context.Context, tunDevice tun.Device) error {
 		}
 		a.logger.Infof("VPN interface created. Name: %s CIDR: %s", interfaceName, &net.IPNet{IP: localIP, Mask: netMask})
 
-		a.Tunnel = service.NewTunnel(a.P2p, a.vpnDevice, a.Conf)
+		a.Tunnel = service.NewTunnel(a.P2p, a.vpnDevice, a.Conf, a.Eventbus)
 		go a.vpnDevice.ReadTUNPackets(a.Tunnel.HandleReadPackets)
 	}
 

application_gateway_test.go

@@ -187,12 +187,17 @@ func TestGatewayPermissionDenied(t *testing.T) {
 	// Defence-in-depth on the exit-node side: silently flip WeAllow without
 	// going through the API (so the change does not propagate back to the
 	// client yet) and verify writeInboundBatch drops gateway-style packets.
+	// The hot-path permission check reads VpnPeer.weAllowUsingAsExitNode, an
+	// atomic kept in sync by RefreshPeersList; in production a settings change
+	// emits KnownPeerChanged which triggers it, so we call it directly here to
+	// mirror that local sync (the revocation still does not reach the client).
 	t.Run("DefenceInDepthDropsAtExitNode", func(t *testing.T) {
 		exitNode.app.Conf.Lock()
 		clientPeer := exitNode.app.Conf.KnownPeers[client.PeerID()]
 		clientPeer.WeAllowUsingAsExitNode = false
 		exitNode.app.Conf.KnownPeers[client.PeerID()] = clientPeer
 		exitNode.app.Conf.Unlock()
+		exitNode.app.Tunnel.RefreshPeersList()
 
 		captureInbound(exitNode, 10)
 
@@ -988,6 +993,41 @@ func TestGatewayRebindOnPeerReadd(t *testing.T) {
 	ts.True(ok, "gateway should flow again after the peer is re-added")
 }
 
+// TestGatewayPeerRemovalRefusedWhileActive verifies the API refuses to remove
+// the configured gateway peer while client mode is ACTIVE. Allowing the removal
+// would leave the OS routes/DNS installed with nothing bound and black-hole all
+// non-local traffic until restart, so RemovePeer returns 409 and the user must
+// disable the gateway first. The peer and its gateway binding stay intact.
+func TestGatewayPeerRemovalRefusedWhileActive(t *testing.T) {
+	skipIfVPNGatewayUnsupported(t)
+	ts := NewTestSuite(t)
+	client, exitNode, _ := setupGatewayPeers(ts)
+
+	// Enable via the API so VPNGateway applies (stubbed) routes + config.
+	ts.NoError(client.api.EnableVPNGatewayClient(exitNode.PeerID()))
+	ts.True(client.app.VPNGateway.IsClientActive(), "precondition: client routes installed")
+
+	// Removing the active gateway peer must be rejected.
+	err := client.api.RemovePeer(exitNode.PeerID())
+	ts.Error(err, "removing the active gateway peer must be refused")
+	ts.Contains(err.Error(), "disable VPN gateway")
+
+	// The peer is still known and the gateway is still active and persisted.
+	_, ok := client.app.Conf.GetPeer(exitNode.PeerID())
+	ts.True(ok, "the gateway peer must remain in KnownPeers after a refused removal")
+	ts.True(client.app.VPNGateway.IsClientActive(), "gateway client mode must stay active")
+	client.app.Conf.RLock()
+	ts.True(client.app.Conf.VPNGateway.ClientEnabled, "ClientEnabled must stay persisted")
+	client.app.Conf.RUnlock()
+
+	// After disabling the gateway, removal succeeds.
+	ts.NoError(client.api.DisableVPNGatewayClient())
+	ts.NoError(client.api.RemovePeer(exitNode.PeerID()),
+		"removal must succeed once the gateway is disabled")
+	_, ok = client.app.Conf.GetPeer(exitNode.PeerID())
+	ts.False(ok, "the peer must be gone after removal")
+}
+
 // TestGatewayListAvailableGatewaysFiltersToVPNGatewayOnly verifies that
 // /gateway/list_available returns only peers where
 // KnownPeer.CanUseAsVPNGateway() is true. SOCKS5-only exit nodes

awlevent/awlevent.go

@@ -18,6 +18,16 @@ type ReceivedAuthRequest struct {
 	PeerID string
 }
 
+// VPNGatewayConnectivityChanged is emitted (client mode only) when the
+// connection to the configured VPN gateway peer goes up or down, so the UI /
+// tray can reflect gateway reachability immediately instead of waiting for the
+// next GatewayInfo poll. GatewayInfo.Connected stays the canonical state; this
+// event is a low-latency edge signal, deduplicated to fire only on transitions.
+type VPNGatewayConnectivityChanged struct {
+	Connected bool
+	PeerID    string
+}
+
 func WrapSubscriptionToCallback(ctx context.Context, callback func(interface{}), bus Bus,
 	eventType interface{}, opts ...event.SubscriptionOpt) {
 	sub, err := bus.Subscribe(eventType, opts...)

cmd/awl-tray/main.go

@@ -169,6 +169,28 @@ func subscribeToNotifications(app *awl.Application) {
 			logger.Errorf("show notification: incoming friend request: %v", notifyErr)
 		}
 	}, app.Eventbus, new(awlevent.ReceivedAuthRequest))
+
+	// VPN gateway reachability: notify the user when the connection to their
+	// selected VPN gateway peer goes up or down.
+	awlevent.WrapSubscriptionToCallback(app.Ctx(), func(evt interface{}) {
+		change := evt.(awlevent.VPNGatewayConnectivityChanged)
+		peerName := change.PeerID
+		if kp, ok := app.Conf.GetPeer(change.PeerID); ok {
+			peerName = kp.DisplayName()
+		}
+		var title, body string
+		if change.Connected {
+			title = "Anywherelan: VPN gateway connected"
+			body = fmt.Sprintf("Connected to: %s", peerName)
+		} else {
+			title = "Anywherelan: VPN gateway disconnected"
+			body = fmt.Sprintf("Lost connection to: %s", peerName)
+		}
+		notifyErr := beeep.Notify(title, body, embeds.GetIconPath())
+		if notifyErr != nil {
+			logger.Errorf("show notification: vpn gateway connectivity: %v", notifyErr)
+		}
+	}, app.Eventbus, new(awlevent.VPNGatewayConnectivityChanged))
 }
 
 func openWebGUI(a *awl.Application) error {

docs/swagger.yaml

@@ -270,7 +270,7 @@ definitions:
       gatewayPeerID:
         type: string
     required:
-      - gatewayPeerID
+    - gatewayPeerID
     type: object
   entity.FriendRequest:
     properties:
@@ -814,6 +814,10 @@ paths:
           description: Not Found
           schema:
             $ref: '#/definitions/api.Error'
+        "409":
+          description: Conflict
+          schema:
+            $ref: '#/definitions/api.Error'
       summary: Remove known peer
       tags:
       - Peers
@@ -857,13 +861,13 @@ paths:
             $ref: '#/definitions/github_com_anywherelan_awl_config.Config'
       summary: Export server configuration
       tags:
-        - Settings
+      - Settings
   /settings/list_proxies:
     get:
       consumes:
-        - application/json
+      - application/json
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
@@ -885,20 +889,20 @@ paths:
             $ref: '#/definitions/entity.PeerInfo'
       summary: Get my peer info
       tags:
-        - Settings
+      - Settings
   /settings/set_proxy:
     post:
       consumes:
-        - application/json
+      - application/json
       parameters:
-        - description: Params
-          in: body
-          name: body
-          required: true
-          schema:
-            $ref: '#/definitions/entity.UpdateProxySettingsRequest'
+      - description: Params
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/entity.UpdateProxySettingsRequest'
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
@@ -927,65 +931,65 @@ paths:
   /vpn_gateway/client/disable:
     post:
       consumes:
-        - application/json
+      - application/json
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
       summary: Disable VPN gateway client mode
       tags:
-        - VPN Gateway
+      - VPN Gateway
   /vpn_gateway/client/enable:
     post:
       consumes:
-        - application/json
+      - application/json
       parameters:
-        - description: Params
-          in: body
-          name: body
-          required: true
-          schema:
-            $ref: '#/definitions/entity.EnableVPNGatewayClientRequest'
+      - description: Params
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/entity.EnableVPNGatewayClientRequest'
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
       summary: Enable VPN gateway client mode
       tags:
-        - VPN Gateway
+      - VPN Gateway
   /vpn_gateway/client/list_available:
     get:
       consumes:
-        - application/json
+      - application/json
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
           schema:
             $ref: '#/definitions/entity.ListAvailableVPNGatewaysResponse'
       summary: List available VPN gateways
       tags:
-        - VPN Gateway
+      - VPN Gateway
   /vpn_gateway/server/set_enabled:
     post:
       consumes:
-        - application/json
+      - application/json
       parameters:
-        - description: Params
-          in: body
-          name: body
-          required: true
-          schema:
-            $ref: '#/definitions/entity.SetVPNGatewayServerEnabledRequest'
+      - description: Params
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/entity.SetVPNGatewayServerEnabledRequest'
       produces:
-        - application/json
+      - application/json
       responses:
         "200":
           description: OK
       summary: Toggle VPN gateway server mode
       tags:
-        - VPN Gateway
+      - VPN Gateway
 swagger: "2.0"

service/auth_status.go

@@ -180,6 +180,10 @@ func (s *AuthStatus) createPeerInfo(peer config.KnownPeer, myPeerName string, de
 // the peer is no longer known.
 func (s *AuthStatus) processPeerStatusInfo(peerID string, peerInfo protocol.PeerStatusInfo) {
 	if peerInfo.Declined {
+		// TODO: emit an awlevent (analogous to VPNGatewayConnectivityChanged) when
+		//  a peer explicitly declines us, so the UI can surface it immediately. The
+		//  peer stays in KnownPeers as not-confirmed (including if it was our VPN
+		//  gateway — we keep the binding even though it will no longer forward).
 		s.conf.UpdatePeerFields(peerID, func(peer *config.KnownPeer) {
 			peer.LastSeen = time.Now()
 			peer.Declined = true
@@ -305,11 +309,9 @@ func (s *AuthStatus) SendAuthRequest(ctx context.Context, peerID peer.ID, req pr
 		s.authsLock.Unlock()
 	}
 	if authResponse.Declined {
-		knownPeer, exists := s.conf.GetPeer(peerID.String())
-		if exists {
-			knownPeer.Declined = true
-			s.conf.UpsertPeer(knownPeer)
-		}
+		s.conf.UpdatePeerFields(peerID.String(), func(peer *config.KnownPeer) {
+			peer.Declined = true
+		})
 	}
 
 	s.logger.Infof("Successfully send auth to %s", peerID)