fix: isolate tunnel UDP sessions by listener

[fzlzjerry]

Summary

• include the tunnel UDP listener address in the SNAT session key
• keep the real client address available for metadata and UDP replies
• add a regression test for one source socket sending through multiple tunnel listeners

Root cause

UDP packet adapters used only the client source address as their NAT table key. As a result, tunnel listeners receiving packets from the same source IP and port shared one PacketSender, even when their listening ports and forwarding targets were different.

The tunnel packet now exposes a listener-scoped custom address for key generation while retaining the real source address as its raw address and write-back destination. Packets from the same source still reuse an association within one listener, but different listeners create independent associations.

User impact

A single UDP socket can send to multiple tunnel listener ports and each flow is forwarded to its configured target independently. Source metadata, inbound-port metadata, and reply routing remain unchanged.

Validation

• go test ./listener/tunnel -count=1
• SKIP_INTEROP_TEST=1 CGO_ENABLED=0 go test ./... -count=1
• SKIP_INTEROP_TEST=1 CGO_ENABLED=0 go test ./... -count=1 -tags with_gvisor

Closes #3052

[Copilot]

Pull request overview

This PR fixes a UDP tunnel NAT/session collision where packets from the same client source IP:port were incorrectly sharing the same SNAT association across different tunnel listeners. It does so by incorporating the listener’s local address into the session key while preserving the real client address for metadata and write-back behavior.

Changes:

• Generate a listener-scoped session key for tunnel UDP packets (listener local addr + client addr).
• Extend the tunnel UDP packet implementation to carry a dedicated key address used for SNAT keying.
• Add a regression test covering one source socket sending via multiple tunnel listeners.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
listener/tunnel/udp.go	Builds a listener-scoped session key and stores it as a custom key address for SNAT key generation.
listener/tunnel/packet.go	Adds keyAddr and makes LocalAddr() return the keying address used by PacketAdapter.Key().
listener/tunnel/udp_test.go	Adds a regression test validating key separation across listeners and preserving source metadata/write-back.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.