test(shared): add unit tests for tun MTU resolution and validate android input

Add comprehensive tests covering the `resolve_tun_mtu()` priority chain:
explicit config > env var > default, with out-of-range and non-numeric
values falling through gracefully. Remove unused `DEFAULT_TUN_MTU`
import in linux vpn_core.

Harden android SettingsScreen with a `parseValidatedMtu()` helper that
rejects values outside 1280–1360 with a user-facing Toast instead of
silently passing invalid input through the onBack callback.

Author: zerox80

android/app/src/main/java/com/mavi/vpn/ui/screens/SettingsScreen.kt

@@ -23,6 +23,7 @@ import com.mavi.vpn.data.InstalledApp
 import com.mavi.vpn.ui.components.drawableToBitmap
 import com.mavi.vpn.ui.components.toImageBitmap
 import com.mavi.vpn.viewmodel.VpnViewModel
+import android.widget.Toast
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 
@@ -43,6 +44,16 @@ fun SettingsScreen(
     var censorshipResistant by remember { mutableStateOf(initialCensorshipResistant) }
     var http3Framing by remember { mutableStateOf(initialHttp3Framing) }
     var vpnMtuText by remember { mutableStateOf(if (initialVpnMtu > 0) initialVpnMtu.toString() else "") }
+
+    fun parseValidatedMtu(): Int {
+        if (vpnMtuText.isBlank()) return 0
+        val value = vpnMtuText.toIntOrNull() ?: return 0
+        if (value !in 1280..1360) {
+            Toast.makeText(context, "VPN MTU must be between 1280 and 1360", Toast.LENGTH_SHORT).show()
+            return 0
+        }
+        return value
+    }
 
     val selectedPackages = remember { 
         mutableStateListOf<String>().apply { 
@@ -91,7 +102,7 @@ fun SettingsScreen(
             verticalAlignment = Alignment.CenterVertically,
             modifier = Modifier.fillMaxWidth().padding(bottom = 16.dp)
         ) {
-            IconButton(onClick = { onBack(mode, selectedPackages.joinToString(","), censorshipResistant, http3Framing, vpnMtuText.toIntOrNull() ?: 0) }) {
+            IconButton(onClick = { onBack(mode, selectedPackages.joinToString(","), censorshipResistant, http3Framing, parseValidatedMtu()) }) {
                 Icon(Icons.Default.ArrowBack, contentDescription = "Back", tint = Color.White)
             }
             Text(
@@ -275,7 +286,7 @@ fun SettingsScreen(
         Spacer(modifier = Modifier.height(16.dp))
 
         Button(
-            onClick = { onBack(mode, selectedPackages.joinToString(","), censorshipResistant, http3Framing, vpnMtuText.toIntOrNull() ?: 0) },
+            onClick = { onBack(mode, selectedPackages.joinToString(","), censorshipResistant, http3Framing, parseValidatedMtu()) },
             modifier = Modifier.fillMaxWidth().height(50.dp),
             shape = RoundedCornerShape(12.dp)
         ) {

gui/src-tauri/src/lib.rs

@@ -406,6 +406,7 @@ mod tests {
         assert!(!conn.http3_framing);
         assert!(!conn.censorship_resistant);
         assert!(conn.kc_auth.is_none());
+        assert!(conn.vpn_mtu.is_none());
     }
 
     #[test]

linux/src/vpn_core.rs

@@ -14,7 +14,7 @@ use shared::{
     icmp,
     ipc::Config,
     masque::{self, CAPSULE_MAVI_CONFIG},
-    ControlMessage, DEFAULT_TUN_MTU, QUIC_OVERHEAD_BYTES, resolve_tun_mtu,
+    ControlMessage, QUIC_OVERHEAD_BYTES, resolve_tun_mtu,
 };
 use std::net::{Ipv4Addr, Ipv6Addr};
 use std::sync::atomic::{AtomicBool, Ordering};

shared/src/lib.rs

@@ -32,8 +32,8 @@ pub const MAX_TUN_MTU: u16 = 1360;
 /// Resolve the inner TUN MTU from an explicit config value, the `VPN_MTU`
 /// environment variable, or the compiled-in default (1280). The explicit
 /// `vpn_mtu` parameter takes highest priority; it must be within the
-/// 1280–1360 range. Invalid values fall through to the next source with a
-/// warning.
+/// 1280–1360 range. Invalid or out-of-range values are silently ignored and
+/// fall through to the next source.
 ///
 /// QUIC Payload MTU is always derived as `tun_mtu + QUIC_OVERHEAD_BYTES`
 /// (i.e. +80) and must never be set independently.
@@ -312,4 +312,86 @@ mod tests {
             bincode::serde::decode_from_slice(&[], bincode::config::standard());
         assert!(result.is_err());
     }
+
+    #[test]
+    fn resolve_tun_mtu_none_returns_default() {
+        // Env var tests run in a single function to avoid parallel race conditions
+        // on std::env::set_var/remove_var.
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::remove_var("VPN_MTU");
+        assert_eq!(resolve_tun_mtu(None), DEFAULT_TUN_MTU);
+        // Restore
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        }
+    }
+
+    #[test]
+    fn resolve_tun_mtu_explicit_valid() {
+        assert_eq!(resolve_tun_mtu(Some(1300)), 1300);
+        assert_eq!(resolve_tun_mtu(Some(1280)), 1280);
+        assert_eq!(resolve_tun_mtu(Some(1360)), 1360);
+    }
+
+    #[test]
+    fn resolve_tun_mtu_explicit_out_of_range_falls_through() {
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::remove_var("VPN_MTU");
+        assert_eq!(resolve_tun_mtu(Some(500)), DEFAULT_TUN_MTU);
+        assert_eq!(resolve_tun_mtu(Some(2000)), DEFAULT_TUN_MTU);
+        assert_eq!(resolve_tun_mtu(Some(0)), DEFAULT_TUN_MTU);
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        }
+    }
+
+    #[test]
+    fn resolve_tun_mtu_env_var_fallback() {
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::set_var("VPN_MTU", "1300");
+        assert_eq!(resolve_tun_mtu(None), 1300);
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        } else {
+            std::env::remove_var("VPN_MTU");
+        }
+    }
+
+    #[test]
+    fn resolve_tun_mtu_explicit_takes_priority_over_env() {
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::set_var("VPN_MTU", "1300");
+        assert_eq!(resolve_tun_mtu(Some(1340)), 1340);
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        } else {
+            std::env::remove_var("VPN_MTU");
+        }
+    }
+
+    #[test]
+    fn resolve_tun_mtu_invalid_env_falls_through() {
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::set_var("VPN_MTU", "not_a_number");
+        assert_eq!(resolve_tun_mtu(None), DEFAULT_TUN_MTU);
+        std::env::set_var("VPN_MTU", "99999");
+        assert_eq!(resolve_tun_mtu(None), DEFAULT_TUN_MTU);
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        } else {
+            std::env::remove_var("VPN_MTU");
+        }
+    }
+
+    #[test]
+    fn resolve_tun_mtu_invalid_env_with_valid_explicit() {
+        let prev = std::env::var("VPN_MTU").ok();
+        std::env::set_var("VPN_MTU", "bad");
+        assert_eq!(resolve_tun_mtu(Some(1300)), 1300);
+        if let Some(v) = prev {
+            std::env::set_var("VPN_MTU", v);
+        } else {
+            std::env::remove_var("VPN_MTU");
+        }
+    }
 }