TUN inbound's autoSystemWfpBlockLeak: A CIDR in front of any value instead of "ipv4:" and "ipv6:"; Ports alone for TCP and UDP

A CIDR in front of any value limits it to its addresses, an IPv6 one in
brackets, e.g. "1.1.1.0/24:53", "[2001:db8::/32]:tcp/853" or
"[::/0]:all": "0.0.0.0/0:" and "[::/0]:" take the place of "ipv4:" and
"ipv6:". Like autoSystemRoutingTable, it takes CIDRs only, a single
address as "8.8.8.8/32", and no GeoIP.

"<port>" or "<low>-<high>" alone stands for TCP and UDP, so "dns" is
"53", "853" and "windnsclient" now.

The filters follow:
- One filter per layer permits what goes through the TUN, instead of one
  for each value.
- "all" and "misconfigtun" outweigh the local network that "allexceptlan"
  leaves open, so with it, "192.168.1.5/32:all" still blocks that address.
- The DNS Client service's mDNS and LLMNR stay allowed on the local network
  only, and only while no other value blocks them.
- The warning about blocked DNS servers only names those a value blocks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/klauspost/cpuid/v2 v2.4.2
+	github.com/klauspost/cpuid/v2 v2.4.1
 	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138
 	github.com/miekg/dns v1.1.73
 	github.com/pelletier/go-toml v1.9.5

go.sum

@@ -35,8 +35,8 @@ github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
 github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
 github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
 github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/klauspost/cpuid/v2 v2.4.2 h1:xRw7IZEsAgVCp6trS/DgWbTAqpixhmywgVgBjYGg1bQ=
-github.com/klauspost/cpuid/v2 v2.4.2/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
+github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

transport/internet/xdrive/local.go

@@ -72,7 +72,7 @@ func (s *localStorage) Get(ctx context.Context, name string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	data, err := readFile(ctx, full)
+	data, err := os.ReadFile(full)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, errNotFound

transport/internet/xdrive/local_other.go

@@ -1,12 +0,0 @@
-//go:build !windows
-
-package xdrive
-
-import (
-	"context"
-	"os"
-)
-
-func readFile(_ context.Context, name string) ([]byte, error) {
-	return os.ReadFile(name)
-}

transport/internet/xdrive/local_windows.go

@@ -1,30 +0,0 @@
-package xdrive
-
-import (
-	"context"
-	"errors"
-	"os"
-	"time"
-
-	"golang.org/x/sys/windows"
-)
-
-// readFile retries os.ReadFile for up to 2 seconds on sharing violations:
-// os.Rename (MoveFileEx) in Put holds the file with DELETE access, which
-// os.ReadFile does not share, until a moment after its new name appears in List
-func readFile(ctx context.Context, name string) ([]byte, error) {
-	deadline := time.Now().Add(2 * time.Second)
-	delay := time.Millisecond
-	for {
-		data, err := os.ReadFile(name)
-		if !errors.Is(err, windows.ERROR_SHARING_VIOLATION) || time.Now().Add(delay).After(deadline) {
-			return data, err
-		}
-		select {
-		case <-ctx.Done():
-			return nil, err
-		case <-time.After(delay):
-		}
-		delay = min(2*delay, 100*time.Millisecond)
-	}
-}

transport/internet/xdrive/local_windows_test.go

@@ -1,57 +0,0 @@
-package xdrive
-
-import (
-	"context"
-	"errors"
-	"sync"
-	"testing"
-	"time"
-
-	"golang.org/x/sys/windows"
-)
-
-func TestLocalSharingViolation(t *testing.T) {
-	storage, err := newLocalStorage(t.TempDir())
-	if err != nil {
-		t.Fatalf("newLocalStorage: %v", err)
-	}
-	const name = "streams/session/c2s/000000000.seg"
-	if err := storage.Put(context.Background(), name, []byte("segment")); err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-	full, err := storage.resolve(name)
-	if err != nil {
-		t.Fatalf("resolve: %v", err)
-	}
-	path, err := windows.UTF16PtrFromString(full)
-	if err != nil {
-		t.Fatalf("UTF16PtrFromString: %v", err)
-	}
-
-	// os.Rename holds the file like this until a moment after its new name
-	// appears
-	handle, err := windows.CreateFile(path, windows.DELETE,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
-		nil, windows.OPEN_EXISTING, 0, 0)
-	if err != nil {
-		t.Fatalf("CreateFile: %v", err)
-	}
-	var once sync.Once
-	release := func() { once.Do(func() { windows.CloseHandle(handle) }) }
-	defer release()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	defer cancel()
-	if _, err := storage.Get(ctx, name); !errors.Is(err, windows.ERROR_SHARING_VIOLATION) {
-		t.Fatalf("Get returned %v while the file is held, want a sharing violation", err)
-	}
-
-	time.AfterFunc(100*time.Millisecond, release)
-	data, err := storage.Get(context.Background(), name)
-	if err != nil {
-		t.Fatalf("Get: %v", err)
-	}
-	if string(data) != "segment" {
-		t.Fatalf("Get returned %q, want %q", data, "segment")
-	}
-}