NM-295: TCP encapsulation over udp

[abhishek9686]

Describe your changes

Provide Issue ticket number if applicable/not in title

Provide link to Netmaker PR if required

Provide testing steps

Checklist before requesting a review

• My changes affect only 10 files or less.
• I have performed a self-review of my code and tested it.
• If it is a new feature, I have added thorough tests, my code is <= 1450 lines.
• If it is a bugfix, my code is <= 200 lines.
• My functions are <= 80 lines.
• I have had my code reviewed by a peer.
• My unit tests pass locally.
• Netclient & Netmaker are awesome.

[tenki-reviewer]

Review complete. 12 potential issues to review.

Files Reviewed: 19
Findings: 12

By Severity:

• 🔴 Critical: 1
• 🟡 Medium: 7
• 🟢 Low: 4

---

This PR introduces TCP proxy uplink and WireGuard relay TCP bind support, but contains a critical authorization bypass in ValidateClientHello, TLS certificate verification disabled, multiple data races and goroutine leak risks that must be resolved before merge.

Files Reviewed (19 files)

README.md
functions/daemon.go
functions/mqhandlers.go
functions/tcp_uplink.go
go.mod
internal/proxyuplink/detect.go
internal/proxyuplink/doc.go
internal/proxyuplink/manager.go
internal/proxyuplink/relay_lookup.go
internal/proxyuplink/server.go
internal/proxyuplink/tls.go
internal/proxyuplink/wgproof.go
ncutils/netclientutils.go
wireguard/relay_tcp_bind.go
wireguard/relay_tcp_bind_windows.go
wireguard/relay_tcp_hooks.go
wireguard/relay_tcp_out.go
wireguard/wireguard_linux.go
wireguard/wireguard_unix.go

[tenki-reviewer]

Review complete. 12 potential issues to review.

---

Summary

PR #1351 adds TCP proxy uplink and WireGuard relay TCP bind functionality to the Netclient agent, enabling relay-based WireGuard connectivity through a proxy server. The changes span 19 files across wireguard, proxyuplink, and functions packages.

Critical Issues

• finding-001: internal/proxyuplink/server.go:153 — ValidateClientHello authorization bypass: when gateway RelayedNodes is empty, any node can connect without authentication. This is a critical security vulnerability.
• finding-004: internal/proxyuplink/tls.go:68 — TLS client certificate verification is disabled (InsecureSkipVerify: true), exposing the TCP uplink to MITM attacks.

Medium Severity Issues

• finding-002: wireguard/relay_tcp_out.go:45 — Send-on-closed-channel panic and goroutine leak in enqueueTCPOut/DrainTCPOutQueue race.
• finding-003: wireguard/relay_tcp_hooks.go:80 — Send-on-closed-channel panic in pushInbound racing with closeInbound during shutdown.
• finding-005: functions/tcp_uplink.go:164 — Cumulative goroutine leak on TCP uplink client/server manager restart.
• finding-009: functions/tcp_uplink.go:48 — Data race on tcpUplinkWasOn in prepareTCPUplinkWireGuard.
• finding-011: internal/proxyuplink/manager.go:145 — TOCTOU race between Manager.SendPacket and Manager.Stop.

Low Severity Issues

• finding-006: Debug output via fmt.Println instead of slog in TCP uplink code.
• finding-007: SetVerbosity default case silently changed from Error to Debug.
• finding-008: Redundant local min() function shadows Go 1.21+ builtin.
• finding-010: Implicit global-state dependency between prepareTCPUplinkWireGuard and nc.Create.
• finding-012: Data race on needTCPUplinkBind across goroutines.

Recommendation

Request changes. The critical authorization bypass and disabled TLS verification must be fixed before merge. The concurrency issues (panics, data races, goroutine leaks) also need resolution. Consider adding integration tests for the TCP uplink and relay bind paths.