atunnel: support IPv6 original destination lookup

[Bingtan Lu (LuBingtan)]

Fixes #686

It's a good idea to open an issue first for discussion.

• Tests pass
• Appropriate changes to documentation are included in the PR

Solution

TCPOriginalDestination first queries the existing IPv4 SOL_IP / SO_ORIGINAL_DST socket option. Linux returns ENOENT when that option is queried for a redirected IPv6 connection, so only in that case it falls back to SOL_IPV6 / IP6T_SO_ORIGINAL_DST (value 80 from linux/netfilter_ipv6/ip6_tables.h). Other IPv4 errors are returned unchanged.

The IPv6 lookup decodes RawSockaddrInet6 and formats the result with net.JoinHostPort, preserving the required bracketed address form.

Tests

The new root-gated integration tests model the production egress path for both address families: an actor-like network namespace sends TCP through a veth, an nftables PREROUTING rule redirects it to a local listener, and the listener verifies that TCPOriginalDestination returns the actor's pre-redirect target. The IPv6 test also disables DAD for the test-only veth addresses so listeners can bind deterministically.

Validation

• go test ./internal/atunnel (privileged IPv4 and IPv6 redirect tests)
• NO_COLOR= GOCACHE=/tmp/substrate-go-build-user make verify