Fix iptable fallback first hop

[frezzzze]

Fixes #2887

The iptable stream dialer drops the FirstHop value from its fallback dialer. When TCP uses iptable with a Shadowsocks fallback and UDP uses the same Shadowsocks endpoint, this causes the Windows client to fail with host:port separator not found.

This change preserves the fallback's FirstHop and adds a regression test.

Tested with go test ./client/go/outline/configregistry.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge.

Summary

Preserves the fallback dialer’s FirstHop in parseIPTableStreamDialer.

• The IP-table stream dialer keeps its fallback’s first-hop address.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Shadowsocks fallback FirstHop] --> B[iptable stream FirstHop]
  B --> C{TCP and UDP hops match?}
  D[UDP FirstHop] --> C
  C -->|Yes| E[Return shared FirstHop]
  E --> F[Windows resolves host and sets route]

Loading

_{Reviews (1) · Last reviewed commit: "Fix iptable fallback first hop" · Reviewed by Greptile}

[fortuna]

The problem is that the IP routing doesn't really have a well defined first-hop. for the other IP rules, you will use a different first hop, so we can't say it's the fallback.

Could you please dig deeper and explain where the separator error is coming from? The fix most certainly belongs somewhere else.

[frezzzze]

Oh, you're right, my fix isn't correct for this case. An iptable can have multiple routing paths, so we can't just use the fallback's first hop for the whole thing.

I traced the error a bit further. In parse.go, FirstHop is only set when the stream and packet first hops match. With an iptable, they may not match, so FirstHop ends up empty. Then createVpnTunnel() in client/electron/index.ts calls net.splitHostPort(request.firstHop) without checking for an empty value, which causes the host:port separator not found error.

This also looks related to #2686, since that issue seems to involve the same assumption about firstHop in more complex YAML configs. I'm not sure yet if it's exactly the same root cause, but I'll look into it and try to find something.