feat: tunnel host and port in the panel settings, ufw kept in sync

The direct tunnel port (8446 by default) and the host agents dial for
it can be set in Settings. The server moves its listeners at once and
agents pick the address up from the panel: on connect and with every
poll, unless TUNNEL_ADDR / TUNNEL_PORT pin it locally.

ufw: run with a C locale (the output is translated), do not adopt rules
that existed before the panel, skip loopback-only listeners, re-open
what saved forwards need on start and when the integration is turned
on, move the shared tunnel rule with the port and drop it when no
direct forward is left. The last ufw error is shown in Settings.

The forwards page shows the real tunnel and panel ports.

internal/server/udp.go

@@ -20,9 +20,10 @@ import (
 //	registration (agent->server): "R <agentID> <sig>"
 //	data         (both):          'D' | sid(4) | port(2) | payload
 type udpRelay struct {
-	db   *DB
-	mu   sync.Mutex
-	ctrl *net.UDPConn
+	db     *DB
+	mu     sync.Mutex
+	ctrl   *net.UDPConn
+	gcOnce sync.Once
 
 	agentAddr map[string]*net.UDPAddr // agentID -> last registered addr
 	sessions  map[uint32]*udpSession
@@ -48,7 +49,8 @@ func newUDPRelay(db *DB) *udpRelay {
 	}
 }
 
-// listen opens the shared 8446 UDP control socket.
+// listen opens the shared UDP control socket. Listening again moves it: the
+// previous socket is closed and agents register anew on the new address.
 func (u *udpRelay) listen(addr string) error {
 	ua, err := net.ResolveUDPAddr("udp", addr)
 	if err != nil {
@@ -58,17 +60,26 @@ func (u *udpRelay) listen(addr string) error {
 	if err != nil {
 		return err
 	}
+	u.mu.Lock()
+	old := u.ctrl
 	u.ctrl = c
+	if old != nil {
+		u.agentAddr = map[string]*net.UDPAddr{}
+	}
+	u.mu.Unlock()
+	if old != nil {
+		old.Close()
+	}
 	log.Printf("tunnel: listening on %s/udp (direct UDP forwarding)", addr)
-	go u.ctrlLoop()
-	go u.gc()
+	go u.ctrlLoop(c)
+	u.gcOnce.Do(func() { go u.gc() })
 	return nil
 }
 
-func (u *udpRelay) ctrlLoop() {
+func (u *udpRelay) ctrlLoop(ctrl *net.UDPConn) {
 	buf := make([]byte, 65535)
 	for {
-		n, src, err := u.ctrl.ReadFromUDP(buf)
+		n, src, err := ctrl.ReadFromUDP(buf)
 		if err != nil {
 			return
 		}
@@ -171,6 +182,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		}
 		u.mu.Lock()
 		aAddr := u.agentAddr[rule.AgentID]
+		ctrl := u.ctrl
 		// Find existing session for this (rule, user).
 		var sess *udpSession
 		for _, s := range u.sessions {
@@ -190,7 +202,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		sess.last = time.Now()
 		u.mu.Unlock()
 
-		if aAddr == nil {
+		if aAddr == nil || ctrl == nil {
 			continue // agent has not registered its UDP endpoint yet
 		}
 		// 'D' | sid(4) | clientPort(2) | payload
@@ -199,7 +211,7 @@ func (u *udpRelay) rulePortLoop(rule ForwardRule, c *net.UDPConn) {
 		binary.BigEndian.PutUint32(out[1:5], sess.id)
 		binary.BigEndian.PutUint16(out[5:7], uint16(rule.ClientPort))
 		copy(out[7:], buf[:n])
-		_, _ = u.ctrl.WriteToUDP(out, aAddr)
+		_, _ = ctrl.WriteToUDP(out, aAddr)
 	}
 }