fix: accept boundary ports in forwarding mappings

internal/server/transport/kcp.go

@@ -572,12 +572,7 @@ func (s *KcpTransport) parsePortMappings(g *kcpGen) {
 				continue
 			}
 
-			port, err := strconv.Atoi(localPortOrRange)
-			if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-				localAddr = fmt.Sprintf(":%d", port)
-			} else {
-				localAddr = localPortOrRange // format ip:port=remoteAddress
-			}
+			localAddr = mappingListenAddress(localPortOrRange)
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)
 		}

internal/server/transport/portmapping.go

@@ -0,0 +1,19 @@
+package transport
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// mappingListenAddress converts the numeric shorthand used by forwarded-port
+// mappings into a wildcard listen address. Non-numeric values are already full
+// listen addresses and are returned unchanged.
+func mappingListenAddress(value string) string {
+	value = strings.TrimSpace(value)
+	port, err := strconv.Atoi(value)
+	if err == nil && port >= 1 && port <= 65535 {
+		return fmt.Sprintf(":%d", port)
+	}
+	return value
+}

internal/server/transport/portmapping_test.go

@@ -0,0 +1,28 @@
+package transport
+
+import "testing"
+
+func TestMappingListenAddress(t *testing.T) {
+	tests := []struct {
+		name  string
+		value string
+		want  string
+	}{
+		{"lowest port", "1", ":1"},
+		{"highest port", "65535", ":65535"},
+		{"typical port", "443", ":443"},
+		{"whitespace", " 443 ", ":443"},
+		{"IPv4 address", "127.0.0.1:443", "127.0.0.1:443"},
+		{"IPv6 address", "[::1]:443", "[::1]:443"},
+		{"below range", "0", "0"},
+		{"above range", "65536", "65536"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := mappingListenAddress(tt.value); got != tt.want {
+				t.Fatalf("mappingListenAddress(%q) = %q, want %q", tt.value, got, tt.want)
+			}
+		})
+	}
+}

internal/server/transport/quic.go

@@ -459,12 +459,7 @@ func (s *QuicTransport) parsePortMappings(g *quicGen) {
 				continue
 			}
 
-			port, err := strconv.Atoi(localPortOrRange)
-			if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-				localAddr = fmt.Sprintf(":%d", port)
-			} else {
-				localAddr = localPortOrRange // format ip:port=remoteAddress
-			}
+			localAddr = mappingListenAddress(localPortOrRange)
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)
 		}

internal/server/transport/tcp.go

@@ -577,12 +577,7 @@ func (s *TcpTransport) parsePortMappings(g *tcpGen) {
 				continue
 			} else {
 				// Handle single local port case
-				port, err := strconv.Atoi(localPortOrRange)
-				if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-					localAddr = fmt.Sprintf(":%d", port)
-				} else {
-					localAddr = localPortOrRange // format ip:port=remoteAddress
-				}
+				localAddr = mappingListenAddress(localPortOrRange)
 			}
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)

internal/server/transport/tcpmux.go

@@ -601,12 +601,7 @@ func (s *TcpMuxTransport) parsePortMappings(g *tcpMuxGen) {
 				continue
 			} else {
 				// Handle single local port case
-				port, err := strconv.Atoi(localPortOrRange)
-				if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-					localAddr = fmt.Sprintf(":%d", port)
-				} else {
-					localAddr = localPortOrRange // format ip:port=remoteAddress
-				}
+				localAddr = mappingListenAddress(localPortOrRange)
 			}
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)

internal/server/transport/udp.go

@@ -536,12 +536,7 @@ func (s *UdpTransport) parsePortMappings(g *udpGen) {
 				continue
 			} else {
 				// Handle single local port case
-				port, err := strconv.Atoi(localPortOrRange)
-				if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-					localAddr = fmt.Sprintf(":%d", port)
-				} else {
-					localAddr = localPortOrRange // format ip:port=remoteAddress
-				}
+				localAddr = mappingListenAddress(localPortOrRange)
 			}
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)

internal/server/transport/ws.go

@@ -451,12 +451,7 @@ func (s *WsTransport) parsePortMappings(g *wsGen) {
 				continue
 			} else {
 				// Handle single local port case
-				port, err := strconv.Atoi(localPortOrRange)
-				if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-					localAddr = fmt.Sprintf(":%d", port)
-				} else {
-					localAddr = localPortOrRange // format ip:port=remoteAddress
-				}
+				localAddr = mappingListenAddress(localPortOrRange)
 			}
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)

internal/server/transport/wsmux.go

@@ -476,12 +476,7 @@ func (s *WsMuxTransport) parsePortMappings(g *wsMuxGen) {
 				continue
 			} else {
 				// Handle single local port case
-				port, err := strconv.Atoi(localPortOrRange)
-				if err == nil && port > 1 && port < 65535 { // format port=remoteAddress
-					localAddr = fmt.Sprintf(":%d", port)
-				} else {
-					localAddr = localPortOrRange // format ip:port=remoteAddress
-				}
+				localAddr = mappingListenAddress(localPortOrRange)
 			}
 		} else {
 			s.logger.Fatalf("invalid port mapping format: %s", portMapping)