fix(dialer): correct inverted setMark on FreeBSD/OpenBSD

Fix setMark early-return conditions that were inverted relative to
Linux: on FreeBSD (SO_USER_COOKIE) and OpenBSD (SO_RTABLE), a
non-zero mark was short-circuited instead of applied, disabling
socket marking entirely.

Also fix GetClientIP to trim leading whitespace from X-Forwarded-For
entries (per RFC 7239), and fix Body.Read to subtract len(b) instead
of n from recordSize when a single read exceeds the remaining quota.

Add unit tests for internal/net/ (addr, dialer, http, ip, net, pipe,
transport, resolve, proxyproto, udp).

internal/net/dialer/dialer_freebsd.go

@@ -9,7 +9,7 @@ func bindDevice(network, address string, fd uintptr, ifceName string) error {
 }
 
 func setMark(fd uintptr, mark int) error {
-	if mark != 0 {
+	if mark == 0 {
 		return nil
 	}
 	return unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_USER_COOKIE, mark)

internal/net/dialer/dialer_linux_test.go

@@ -0,0 +1,40 @@
+package dialer
+
+import (
+	"testing"
+)
+
+func Test_bindDevice(t *testing.T) {
+	// Empty interface name - no-op
+	err := bindDevice("tcp", "127.0.0.1:80", 0, "")
+	if err != nil {
+		t.Errorf("expected nil for empty ifce, got %v", err)
+	}
+
+	// Non-global unicast IP (loopback) with port - skips binding
+	err = bindDevice("tcp", "127.0.0.1:80", 0, "lo")
+	if err != nil {
+		t.Errorf("expected nil for non-global unicast, got %v", err)
+	}
+
+	// ::1 (IPv6 loopback) is also non-global unicast
+	err = bindDevice("tcp", "[::1]:80", 0, "lo")
+	if err != nil {
+		t.Errorf("expected nil for IPv6 loopback, got %v", err)
+	}
+}
+
+func Test_setMark(t *testing.T) {
+	// mark=0 is no-op
+	err := setMark(0, 0)
+	if err != nil {
+		t.Errorf("expected nil for mark=0, got %v", err)
+	}
+
+	// Non-zero mark should succeed or fail based on fd validity
+	// We test with fd=0 which is stdin (should succeed with SO_MARK)
+	err = setMark(0, 1)
+	if err != nil {
+		t.Logf("setMark with fd=0: %v (expected on some systems)", err)
+	}
+}

internal/net/dialer/dialer_openbsd.go

@@ -9,7 +9,7 @@ func bindDevice(network, address string, fd uintptr, ifceName string) error {
 }
 
 func setMark(fd uintptr, mark int) error {
-	if mark != 0 {
+	if mark == 0 {
 		return nil
 	}
 	return unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RTABLE, mark)

internal/net/dialer/dialer_test.go

@@ -0,0 +1,137 @@
+package dialer
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+)
+
+func TestDialer_Dial_DialFunc(t *testing.T) {
+	customErr := errors.New("custom dial")
+	d := &Dialer{
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, customErr
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err == nil {
+		t.Error("expected error from custom DialFunc")
+	}
+	if err != customErr {
+		t.Errorf("expected custom error, got %v", err)
+	}
+}
+
+func TestDialer_Dial_DialFunc_Success(t *testing.T) {
+	expectedConn := &net.TCPConn{}
+	d := &Dialer{
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return expectedConn, nil
+		},
+	}
+
+	conn, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if conn != expectedConn {
+		t.Error("expected the connection from DialFunc")
+	}
+}
+
+func TestDefaultTimeout(t *testing.T) {
+	if DefaultTimeout == 0 {
+		t.Error("DefaultTimeout should be non-zero")
+	}
+}
+
+func TestDefaultNetDialer(t *testing.T) {
+	if DefaultNetDialer == nil {
+		t.Error("DefaultNetDialer should not be nil")
+	}
+}
+
+func TestDialer_Dial_DialFunc_Unix(t *testing.T) {
+	d := &Dialer{
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, errors.New("unix error")
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "unix", "/tmp/test.sock")
+	if err == nil {
+		t.Error("expected error from DialFunc")
+	}
+}
+
+func TestDialer_Dial_NonStrictInterface(t *testing.T) {
+	// Non-existent interface, non-strict mode
+	d := &Dialer{
+		Interface: "nonexistent_xyz",
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, errors.New("dial failed")
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err == nil {
+		t.Error("expected error from dial")
+	}
+}
+
+func TestDialer_Dial_StrictInterfaceError(t *testing.T) {
+	// Strict mode: non-existent interface returns error immediately
+	d := &Dialer{
+		Interface: "nonexistent_xyz!",
+	}
+
+	_, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err == nil {
+		t.Error("expected error from strict interface")
+	}
+}
+
+func TestDialer_Dial_InterfaceWithIP(t *testing.T) {
+	// Use IP address as interface name in non-strict mode
+	d := &Dialer{
+		Interface: "203.0.113.1",
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, errors.New("dial failed")
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err == nil {
+		t.Error("expected error from dial")
+	}
+}
+
+func TestDialer_Dial_InterfaceLoopback(t *testing.T) {
+	// Use loopback interface
+	d := &Dialer{
+		Interface: "lo",
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, errors.New("dial failed")
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "tcp", "127.0.0.1:0")
+	if err == nil {
+		t.Error("expected error from dial")
+	}
+}
+
+func TestDialer_Dial_UDPInterface(t *testing.T) {
+	d := &Dialer{
+		DialFunc: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, errors.New("udp dial failed")
+		},
+	}
+
+	_, err := d.Dial(context.Background(), "udp", "")
+	if err == nil {
+		t.Error("expected error from dial")
+	}
+}

internal/net/dialer/main_test.go

@@ -0,0 +1,31 @@
+package dialer
+
+import (
+	"os"
+	"testing"
+
+	"github.com/go-gost/core/logger"
+)
+
+type nopLogger struct{}
+
+func (l *nopLogger) WithFields(map[string]any) logger.Logger      { return l }
+func (l *nopLogger) Trace(args ...any)                             {}
+func (l *nopLogger) Tracef(format string, args ...any)             {}
+func (l *nopLogger) Debug(args ...any)                             {}
+func (l *nopLogger) Debugf(format string, args ...any)             {}
+func (l *nopLogger) Info(args ...any)                              {}
+func (l *nopLogger) Infof(format string, args ...any)              {}
+func (l *nopLogger) Warn(args ...any)                              {}
+func (l *nopLogger) Warnf(format string, args ...any)              {}
+func (l *nopLogger) Error(args ...any)                             {}
+func (l *nopLogger) Errorf(format string, args ...any)             {}
+func (l *nopLogger) Fatal(args ...any)                             {}
+func (l *nopLogger) Fatalf(format string, args ...any)             {}
+func (l *nopLogger) GetLevel() logger.LogLevel                     { return logger.InfoLevel }
+func (l *nopLogger) IsLevelEnabled(level logger.LogLevel) bool     { return false }
+
+func TestMain(m *testing.M) {
+	logger.SetDefault(&nopLogger{})
+	os.Exit(m.Run())
+}