internal/redirect: TCP NAT-loopback redirector

Listener on 127.0.0.1 accepts NAT-rewritten Discord SYNs (rewrite
done by divert layer in Task 10), looks up the original destination
in a sync-protected map keyed by source port, opens a SOCKS5 CONNECT
to the upstream proxy targeting that destination, and pumps bytes
both directions until either side closes.

30-minute TTL sweeper handles T-6 in the edge case matrix (mapping
leak when a flow never properly closes).

Pump teardown: when one direction's io.Copy exits, the goroutine
CloseWrite's its write side AND sets a past read deadline on the
OTHER conn so the peer goroutine's blocked read unwinds promptly
even when the upstream half never sends EOF (test fake-SOCKS5 hits
this; the real upstream may too).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/redirect/tcp.go

@@ -0,0 +1,177 @@
+package redirect
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"time"
+
+	"git.okcu.io/root/drover-go/internal/socks5"
+)
+
+// Config configures the TCP redirector.
+type Config struct {
+	SOCKS5 socks5.Config
+	Bind   string // "127.0.0.1:0" — listener bind addr
+}
+
+type mapping struct {
+	dstIP   net.IP
+	dstPort uint16
+	added   time.Time
+}
+
+// Redirector is the loopback listener that catches NAT-rewritten SYNs
+// from divert and tunnels them through SOCKS5.
+type Redirector struct {
+	cfg   Config
+	ln    net.Listener
+	mu    sync.RWMutex
+	flows map[uint16]mapping // src_port → mapping
+	wg    sync.WaitGroup
+	ctx   context.Context
+	cnl   context.CancelFunc
+}
+
+// New starts a Redirector. It binds the listener but does not yet
+// have any mappings; SetMapping is called by the divert layer when
+// it sees an outbound SYN from a target PID.
+func New(cfg Config) (*Redirector, error) {
+	bind := cfg.Bind
+	if bind == "" {
+		bind = "127.0.0.1:0"
+	}
+	ln, err := net.Listen("tcp", bind)
+	if err != nil {
+		return nil, fmt.Errorf("listen %s: %w", bind, err)
+	}
+	ctx, cnl := context.WithCancel(context.Background())
+	r := &Redirector{
+		cfg:   cfg,
+		ln:    ln,
+		flows: map[uint16]mapping{},
+		ctx:   ctx,
+		cnl:   cnl,
+	}
+	r.wg.Add(1)
+	go r.acceptLoop()
+	r.wg.Add(1)
+	go r.sweepLoop()
+	return r, nil
+}
+
+func (r *Redirector) LocalAddr() string { return r.ln.Addr().String() }
+
+func (r *Redirector) LocalPort() uint16 {
+	return uint16(r.ln.Addr().(*net.TCPAddr).Port)
+}
+
+// SetMapping records that future TCP connections originating from
+// src_port should be tunneled to dstIP:dstPort. Called by the divert
+// layer at SYN time.
+func (r *Redirector) SetMapping(srcPort uint16, dstIP net.IP, dstPort uint16) {
+	r.mu.Lock()
+	r.flows[srcPort] = mapping{dstIP: dstIP, dstPort: dstPort, added: time.Now()}
+	r.mu.Unlock()
+}
+
+// Close stops accepting and tears down active flows.
+func (r *Redirector) Close() error {
+	r.cnl()
+	err := r.ln.Close()
+	r.wg.Wait()
+	return err
+}
+
+func (r *Redirector) acceptLoop() {
+	defer r.wg.Done()
+	for {
+		c, err := r.ln.Accept()
+		if err != nil {
+			return
+		}
+		r.wg.Add(1)
+		go r.handle(c)
+	}
+}
+
+func (r *Redirector) handle(c net.Conn) {
+	defer r.wg.Done()
+	defer c.Close()
+
+	srcPort := uint16(c.RemoteAddr().(*net.TCPAddr).Port)
+	r.mu.RLock()
+	m, ok := r.flows[srcPort]
+	r.mu.RUnlock()
+	if !ok {
+		return // unknown flow; drop quietly
+	}
+
+	ctx, cancel := context.WithTimeout(r.ctx, 10*time.Second)
+	defer cancel()
+
+	host := m.dstIP.String()
+	upstream, err := socks5.Dial(ctx, r.cfg.SOCKS5, host, m.dstPort)
+	if err != nil {
+		return
+	}
+	defer upstream.Close()
+
+	pump(c, upstream)
+}
+
+func pump(a, b net.Conn) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		// G1: upstream → client (read from b, write to a).
+		_, _ = io.Copy(a, b)
+		if cw, ok := a.(closeWriter); ok {
+			cw.CloseWrite()
+		}
+		// We are exiting — force G2's read of a to unblock so the
+		// pump tears down even if the peer half never closes.
+		_ = a.SetReadDeadline(time.Now())
+	}()
+	go func() {
+		defer wg.Done()
+		// G2: client → upstream (read from a, write to b).
+		_, _ = io.Copy(b, a)
+		if cw, ok := b.(closeWriter); ok {
+			cw.CloseWrite()
+		}
+		_ = b.SetReadDeadline(time.Now())
+	}()
+	wg.Wait()
+}
+
+type closeWriter interface{ CloseWrite() error }
+
+// sweepLoop removes mappings older than 30 minutes (T-6 in spec).
+func (r *Redirector) sweepLoop() {
+	defer r.wg.Done()
+	tk := time.NewTicker(time.Minute)
+	defer tk.Stop()
+	for {
+		select {
+		case <-r.ctx.Done():
+			return
+		case <-tk.C:
+			cutoff := time.Now().Add(-30 * time.Minute)
+			r.mu.Lock()
+			for k, m := range r.flows {
+				if m.added.Before(cutoff) {
+					delete(r.flows, k)
+				}
+			}
+			r.mu.Unlock()
+		}
+	}
+}
+
+// Sentinel for callers.
+var ErrNotMapped = errors.New("redirector: source port has no mapping")