home: add IPv6 support for encrypted listeners

Preserve the configured address family of the web bind address:  an
explicitly configured unspecified IPv4 address now produces an IPv4-only
listener, while the unspecified IPv6 address enables dual-stack
listening.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: waffen29

internal/home/config.go

@@ -465,7 +465,7 @@ var config = &configuration{
 	AuthAttempts: 5,
 	AuthBlockMin: 15,
 	HTTPConfig: httpConfig{
-		Address:    netip.AddrPortFrom(netip.IPv4Unspecified(), 3000),
+		Address:    netip.AddrPortFrom(netip.IPv6Unspecified(), 3000),
 		SessionTTL: timeutil.Duration(30 * timeutil.Day),
 		Pprof: &httpPprofConfig{
 			Enabled: false,

internal/home/config_internal_test.go

@@ -1,10 +1,13 @@
 package home
 
 import (
+	"net/netip"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
+	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -89,3 +92,73 @@ func TestConfigFilePath(t *testing.T) {
 		})
 	}
 }
+
+func TestNewServerConfig_DefaultHosts(t *testing.T) {
+	dnsConf := &dnsConfig{
+		BindHosts: nil,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{}
+	dohConf := &doHConfig{}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		dohConf,
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.UDPListenAddrs, 2)
+
+	assert.Equal(t, netutil.IPv4Localhost().String(), conf.UDPListenAddrs[0].IP.String())
+	assert.Equal(t, netutil.IPv6Localhost().String(), conf.UDPListenAddrs[1].IP.String())
+}
+
+func TestNewServerConfig_Issue8363BindHosts(t *testing.T) {
+	bindHosts := []netip.Addr{
+		netip.IPv4Unspecified(),
+		netip.IPv6Unspecified(),
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	}
+	dnsConf := &dnsConfig{
+		BindHosts: bindHosts,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{
+		Enabled:              true,
+		PortDNSOverTLS:       853,
+		PortDNSOverQUIC:      853,
+		CertificateChainData: requireReadFile(t, testCertificatePath),
+		PrivateKeyData:       requireReadFile(t, testPrivateKeyPath),
+	}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		&doHConfig{},
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.TLSConf.TLSListenAddrs, len(bindHosts))
+	require.Len(t, conf.TLSConf.QUICListenAddrs, len(bindHosts))
+
+	for i, host := range bindHosts {
+		assert.Equal(t, host.String(), conf.TLSConf.TLSListenAddrs[i].IP.String())
+		assert.Equal(t, host.String(), conf.TLSConf.QUICListenAddrs[i].IP.String())
+	}
+}

internal/home/control.go

@@ -71,7 +71,7 @@ func appendDNSAddrsWithIfaces(dst []string, src []netip.Addr) (res []string, err
 // tlsMgr must not be nil.
 func collectDNSAddresses(tlsMgr *tlsManager) (addrs []string, err error) {
 	if hosts := config.DNS.BindHosts; len(hosts) == 0 {
-		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost())
+		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost(), netutil.IPv6Localhost())
 	} else {
 		addrs, err = appendDNSAddrsWithIfaces(addrs, hosts)
 		if err != nil {

internal/home/dns.go

@@ -264,7 +264,10 @@ func newServerConfig(
 	clientsContainer dnsforward.ClientsContainer,
 	confModifier agh.ConfigModifier,
 ) (newConf *dnsforward.ServerConfig, err error) {
-	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{netutil.IPv4Localhost()})
+	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	})
 
 	fwdConf := dnsConf.Config
 	fwdConf.ClientsContainer = clientsContainer

internal/home/web.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/netip"
 	"runtime"
@@ -345,6 +346,24 @@ func (web *webAPI) tlsConfigChanged(ctx context.Context, tlsConf *tlsConfigSetti
 // loggerKeyServer is the key used by [webAPI] to identify servers.
 const loggerKeyServer = "server"
 
+// getBindAddr returns the network and address strings to use when creating a
+// listener on addr and port.  network must be either "tcp" or "udp".  The
+// address family of addr is preserved:  for the unspecified IPv4 address the
+// IPv4-only network is returned, since Go's wildcard listeners otherwise
+// accept connections of both address families on platforms that support
+// IPv4-mapped IPv6 addresses.  For the unspecified IPv6 address the returned
+// address is in the ":port" form, which enables dual-stack listening.
+func getBindAddr(network string, addr netip.Addr, port uint16) (listenNetwork, addrStr string) {
+	switch {
+	case !addr.IsUnspecified():
+		return network, netip.AddrPortFrom(addr, port).String()
+	case addr.Is4():
+		return network + "4", netip.AddrPortFrom(addr, port).String()
+	default:
+		return network, netutil.JoinHostPort("", port)
+	}
+}
+
 // start starts serving HTTP requests.
 func (web *webAPI) start(ctx context.Context) {
 	defer slogutil.RecoverAndExit(ctx, web.logger, osutil.ExitCodeFailure)
@@ -367,9 +386,11 @@ func (web *webAPI) start(ctx context.Context) {
 		protocols.SetUnencryptedHTTP2(true)
 		protocols.SetHTTP1(true)
 
+		network, addrStr := getBindAddr("tcp", web.conf.BindAddr.Addr(), web.conf.BindAddr.Port())
+
 		// Create a new instance, because the Web is not usable after Shutdown.
 		web.httpServer = &http.Server{
-			Addr:              web.conf.BindAddr.String(),
+			Addr:              addrStr,
 			Handler:           hdlr,
 			ReadTimeout:       web.conf.ReadTimeout,
 			ReadHeaderTimeout: web.conf.ReadHeaderTimeout,
@@ -380,9 +401,16 @@ func (web *webAPI) start(ctx context.Context) {
 		go func() {
 			defer slogutil.RecoverAndLog(ctx, logger)
 
-			logger.InfoContext(ctx, "starting plain server", "addr", web.httpServer.Addr)
+			logger.InfoContext(ctx, "starting plain server", "addr", addrStr)
 
-			errs <- web.httpServer.ListenAndServe()
+			ln, lErr := net.Listen(network, addrStr)
+			if lErr != nil {
+				errs <- lErr
+
+				return
+			}
+
+			errs <- web.httpServer.Serve(ln)
 		}()
 
 		err := <-errs
@@ -463,13 +491,13 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 		portHTTPS = config.TLS.PortHTTPS
 	}()
 
-	addr := netip.AddrPortFrom(web.conf.BindAddr.Addr(), portHTTPS).String()
+	network, addrStr := getBindAddr("tcp", web.conf.BindAddr.Addr(), portHTTPS)
 	logger := web.baseLogger.With(loggerKeyServer, "https")
 
 	hdlr := web.wrapMux(logger)
 
 	web.httpsServer.server = &http.Server{
-		Addr:    addr,
+		Addr:    addrStr,
 		Handler: hdlr,
 		// TODO(m.kazantsev):  Do not create TLS config manually, but use
 		// [aghtls.TLSConfigProvider].
@@ -488,11 +516,15 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 	printHTTPAddresses(ctx, web.logger, urlutil.SchemeHTTPS, web.tlsManager)
 
 	if web.conf.serveHTTP3 {
-		go web.mustStartHTTP3(ctx, addr)
+		go web.mustStartHTTP3(ctx, portHTTPS)
 	}
 
 	logger.InfoContext(ctx, "starting https server")
-	err := web.httpsServer.server.ListenAndServeTLS("", "")
+	ln, err := net.Listen(network, addrStr)
+	if err == nil {
+		err = web.httpsServer.server.ServeTLS(ln, "", "")
+	}
+
 	if !errors.Is(err, http.ErrServerClosed) {
 		cleanupAlways(ctx, logger, web.pidFilePath)
 
@@ -502,17 +534,20 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 	return true
 }
 
-// mustStartHTTP3 initializes and starts HTTP3 server.
-func (web *webAPI) mustStartHTTP3(ctx context.Context, address string) {
+// mustStartHTTP3 initializes and starts HTTP3 server on the configured bind
+// address with the given port.
+func (web *webAPI) mustStartHTTP3(ctx context.Context, port uint16) {
 	defer slogutil.RecoverAndExit(ctx, web.logger, osutil.ExitCodeFailure)
 
 	logger := web.baseLogger.With(loggerKeyServer, "http3")
 	hdlr := web.wrapMux(logger)
 
+	network, addrStr := getBindAddr("udp", web.conf.BindAddr.Addr(), port)
+
 	web.httpsServer.server3 = &http3.Server{
 		// TODO(a.garipov): See if there is a way to use the error log as
 		// well as timeouts here.
-		Addr: address,
+		Addr: addrStr,
 		// TODO(m.kazantsev):  Do not create TLS config manually, but use
 		// [aghtls.TLSConfigProvider].
 		TLSConfig: &tls.Config{
@@ -525,18 +560,21 @@ func (web *webAPI) mustStartHTTP3(ctx context.Context, address string) {
 	}
 
 	web.logger.DebugContext(ctx, "starting http/3 server")
-	err := web.httpsServer.server3.ListenAndServe()
+	conn, err := net.ListenPacket(network, addrStr)
+	if err == nil {
+		err = web.httpsServer.server3.Serve(conn)
+	}
+
 	if !errors.Is(err, http.ErrServerClosed) {
 		cleanupAlways(ctx, logger, web.pidFilePath)
 
 		panic(fmt.Errorf("http3: %w", err))
 	}
 }
 
-// startPprof launches the debug and profiling server on the provided port.
+// startPprof launches the debug and profiling server on the provided port on
+// both IPv4 and IPv6 loopback addresses.
 func startPprof(baseLogger *slog.Logger, port uint16) {
-	addr := netip.AddrPortFrom(netutil.IPv4Localhost(), port)
-
 	runtime.SetBlockProfileRate(1)
 	runtime.SetMutexProfileFraction(1)
 
@@ -546,15 +584,26 @@ func startPprof(baseLogger *slog.Logger, port uint16) {
 	ctx := context.Background()
 	logger := baseLogger.With(slogutil.KeyPrefix, "pprof")
 
-	go func() {
-		defer slogutil.RecoverAndLog(ctx, logger)
+	go servePprof(ctx, logger, mux, netutil.IPv4Localhost(), port)
+	go servePprof(ctx, logger, mux, netutil.IPv6Localhost(), port)
+}
 
-		logger.InfoContext(ctx, "listening", "addr", addr)
-		err := http.ListenAndServe(addr.String(), mux)
-		if !errors.Is(err, http.ErrServerClosed) {
-			logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
-		}
-	}()
+// servePprof serves the pprof HTTP endpoints on the given host and port.
+func servePprof(
+	ctx context.Context,
+	logger *slog.Logger,
+	mux *http.ServeMux,
+	host netip.Addr,
+	port uint16,
+) {
+	defer slogutil.RecoverAndLog(ctx, logger)
+
+	addrStr := netip.AddrPortFrom(host, port).String()
+	logger.InfoContext(ctx, "listening", "addr", addrStr)
+	err := http.ListenAndServe(addrStr, mux)
+	if !errors.Is(err, http.ErrServerClosed) {
+		logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
+	}
 }
 
 // handleTLSStatus is the handler for the GET /control/tls/status HTTP API.