add Windows TAP support

[Alice39s]

Summary

• add a Windows socket bind implementation compatible with the existing NewDefaultBind API, including standard UDP fallback when RIO is unavailable
• add TAP-Windows6 support for EtherGuard's layer-2 tap.Device interface
• add Windows CI, cross-compilation, release artifacts, checksums, and usage documentation
• rebase onto Update Go to 1.26.5 and dependencies #15's Go 1.26.5 dependency baseline and resolve the platform fallback conflicts

This addresses #4 and #10. The repository's previous pull requests did not contain a reusable Windows implementation.

Compatibility

• current baseline: Windows 10 / Windows Server 2016 or newer, Go 1.26.5, TAP-Windows6 9.27.0
• Windows 10 LTSC 2021 default RIO and forced -bind std
• Administrator and LocalSystem execution
• IPv4-only, IPv6-only, and dual-stack TAP configuration
• deterministic standard-bind fallback when Windows RIO is unavailable
• Windows 7/8 remain limited to the legacy Go 1.20 dependency baseline; the pre-Update Go to 1.26.5 and dependencies #15 implementation was validated on Windows 7, but the current Update Go to 1.26.5 and dependencies #15-based branch does not claim Windows 7 support

Wintun is intentionally not used because EtherGuard transports Ethernet frames and requires a layer-2 adapter.

Review hardening

• use PowerShell 2-compatible adapter restart logic and validate WMI failures
• skip IPv4/IPv6 MTU commands when that address family is not configured
• turn TAP status lookup failures into deduplicated down events and emit an up event after recovery
• retry dual-stack RIO random-port conflicts with bounded, error-aware cleanup
• close RIO sockets with closesocket before freeing request queues and registered buffers, propagate teardown errors, and cover repeated fixed-port reopen
• keep test hooks per bind instance to avoid package-global interference

Verification

Current #15-based head:

• Windows 10 LTSC 2021 with Go 1.26.5: native go test ./..., build, -version, real TAP integration, and real RIO open/close/reopen
• local Go 1.26.5: go test ./... and go test -race ./...
• GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -exec=/usr/bin/true ./...
• GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build
• actionlint for both modified workflows

Legacy pre-#15 baseline:

• Windows 7 Ultimate with Go 1.20.14: native tests, build, TAP integration, automatic standard-bind fallback, Administrator/LocalSystem execution, and 10-minute traffic test with 0% loss
• Windows 10 LTSC with Go 1.21.13: default RIO, forced standard bind, bidirectional IPv4/IPv6 TAP traffic, reboot persistence, and 10-minute traffic tests with 0% loss

The real TAP tests use private KVM VMs and are intentionally separate from GitHub-hosted runners, which do not install a kernel TAP driver. The current hosted workflow run is pending maintainer approval for a first-time external contributor.

[gemini-code-assist]

Code Review

This pull request introduces Windows support for EtherGuard, adding Windows TAP adapter management using the water library and registry/netsh configurations, alongside Windows Registered I/O (RIO) socket binding support. The review feedback highlights two important robustness issues: a PowerShell compatibility bug on Windows 7 regarding Start-Sleep -Milliseconds and potential script errors when disabling/enabling adapters, and a potential failure when configuring IPv6 MTU on systems where IPv6 is globally disabled.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Alice39s]

CI note: GitHub created the latest Go workflow run for commit db174ee, but it is currently marked action_required because workflows from this first-time external contributor require maintainer approval. The same commit has independently passed Windows 7 and Windows 10 LTSC native go test ./.../build/TAP integration, Linux go test ./... and go test -race ./..., Windows cross-compilation, and actionlint. Once a maintainer approves the run, the hosted windows-2022 job can execute normally.

[Alice39s]

/gemini review again

[gemini-code-assist]

Code Review

This pull request introduces Windows TAP adapter support using the "github.com/songgao/water" library, refactors network binding to support selective IPv4/IPv6 address families, and adds comprehensive unit tests. The review feedback suggests implementing a retry mechanism in "WinRingBind.Open" for dual-stack configurations when binding to port 0 to prevent intermittent failures, and treating errors in the TAP status monitoring loop as the interface being down to ensure correct event propagation.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Alice39s]

/gemini review again

[gemini-code-assist]

Code Review

This pull request introduces Windows support to EtherGuard, implementing a Windows TAP device using TAP-Windows6 and adding Windows Registered I/O (RIO) socket binding. It also refactors socket binding across platforms to use shared address parsing logic and updates various dependencies. The review feedback highlights a critical boundary check issue in the Windows TAP device's Read and Write methods, where an offset equal to the buffer length could trigger invalid zero-byte operations instead of returning an error.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.