feat: complete wgcloak v1 transports

tests/integration_transports.rs

@@ -177,3 +177,53 @@ async fn tls_tcp_authenticates_round_trips_and_classifies_failures() {
         .unwrap()
         .is_err());
 }
+
+#[tokio::test]
+async fn tls_tcp_ipv6_loopback_listener_accepts_bracketed_configuration() {
+    if Command::new("openssl").arg("version").output().is_err() {
+        return;
+    }
+    let probe = match tokio::net::TcpListener::bind("[::1]:0").await {
+        Ok(listener) => listener,
+        Err(_) => return,
+    };
+    let port = probe.local_addr().unwrap().port();
+    drop(probe);
+    let dir = tempdir().unwrap();
+    let cert = dir.path().join("cert.pem");
+    let key = dir.path().join("key.pem");
+    let generated = Command::new("openssl")
+        .args([
+            "req",
+            "-x509",
+            "-newkey",
+            "rsa:2048",
+            "-nodes",
+            "-subj",
+            "/CN=localhost",
+            "-addext",
+            "subjectAltName=IP:::1",
+            "-days",
+            "1",
+            "-keyout",
+        ])
+        .arg(&key)
+        .args(["-out"])
+        .arg(&cert)
+        .output()
+        .unwrap();
+    assert!(generated.status.success(), "openssl failed: {generated:?}");
+    let config = Config::from_str(&format!(
+        "[server]\nlisten = \"::1\"\n[backend]\ntarget = \"127.0.0.1:51820\"\n[transports.direct_udp]\nenabled = false\n[transports.quic]\nenabled = false\n[transports.http3]\nenabled = false\n[transports.tls_tcp]\nenabled = true\nport = {port}\n[tls]\ncertificate = \"{}\"\nprivate_key = \"{}\"\n[[auth.clients]]\nid = \"test\"\nsecret = \"{SECRET}\"\n",
+        cert.display(),
+        key.display()
+    ))
+    .unwrap()
+    .into_server()
+    .unwrap();
+    let server =
+        TlsTcpServer::bind_with_admission(&config, AdmissionController::new(&config.limits))
+            .await
+            .unwrap();
+    assert!(server.local_addr().unwrap().ip().is_ipv6());
+}