overlay/darwin: batch tun writes with sendmsg_x

Passthrough.Flush hands its whole lane to a new tio.BatchWriter in one
WriteBatch call when the queue implements it, and NewSingleQueue
exposes WriteBatch when its source does. On darwin, tun.WriteBatch
writes up to 64 packets per sendmsg_x on the utun control socket,
which is a connected datagram socket, so xnu takes the batched
sendit_x path rather than one sendit per message. utun registers no
send_list handler, so the kernel still passes each packet to utun on
its own: this saves syscalls and fd locking, not per-packet kernel work.

Error handling follows what sendmsg_x reports:

- A short count with no error (a packet past the send buffer
  mid-call, or a later send failing with ENOBUFS): the remainder goes
  out in the next sendmsg_x.
- EMSGSIZE: only returned when the first packet is too large, before
  the kernel takes any, so that packet alone goes through Write, which
  reports it, and the rest are batched again.
- ENOSYS, EPERM, EOPNOTSUPP: sendmsg_x is private API, so WriteBatch
  logs once and falls back to writev per packet for good.
- Anything else: sendmsg_x returns the error without the count it
  took, so the call is reported rather than retried, which could
  deliver packets twice.

One loss mode has no userspace fix. sendit_x counts each packet as
sent once it is copied into an mbuf; if a later allocation fails, it
frees the copied prefix unsent, returns its length, and sendmsg_x
drops the ENOBUFS because the count is nonzero. That looks exactly
like a real short count, so under mbuf exhaustion WriteBatch silently
drops packets that writev would have delivered.

The iOS tun path (tun_ios.go) is unchanged.

Inside a macOS Network Extension, download goes from 640 to 832 Mbps
against the recvmsg_x change alone in three paired rounds, at 15% less
CPU per Mbps; the likely cause is that its utun charges more per write
than a raw one. Raw dnclient already runs download near line rate,
and there the CPU difference is within noise.

TestTunWriteBatch* round-trip through a connected AF_UNIX datagram
socketpair, which takes sendmsg_x the same way, over both the batched
and the fallback path: order, AF prefixes, skipped invalid packets,
and an oversize packet mid-call and first-in-call. Dropping Namelen
from msghdrX fails them. Mutation testing with gremlins leaves only
equivalent survivors in WriteBatch, plus which error is reported first
when several fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

overlay/batch/multi_coalesce_test.go

@@ -435,3 +435,65 @@ func testPP(pkt []byte) *firewall.ParsedPacket {
 	}
 	return pp
 }
+
+// fakeTunBatchWriter records each WriteBatch call and each plain Write separately.
+type fakeTunBatchWriter struct {
+	writes  [][]byte
+	batches [][][]byte
+}
+
+func (w *fakeTunBatchWriter) Write(p []byte) (int, error) {
+	w.writes = append(w.writes, bytes.Clone(p))
+	return len(p), nil
+}
+
+func (w *fakeTunBatchWriter) WriteBatch(pkts [][]byte) error {
+	var b [][]byte
+	for _, p := range pkts {
+		b = append(b, bytes.Clone(p))
+	}
+	w.batches = append(w.batches, b)
+	return nil
+}
+
+// TestPassthroughUsesWriteBatch pins that a writer implementing tio.BatchWriter gets the whole
+// passthrough lane in one WriteBatch per Flush, in order, and no plain Writes; an empty Flush
+// makes no call.
+func TestPassthroughUsesWriteBatch(t *testing.T) {
+	w := &fakeTunBatchWriter{}
+	m := newTestMultiCoalescer(t, w)
+	k := &keySeq{epoch: 1}
+
+	var want [][]byte
+	for i := range 5 {
+		icmp := make([]byte, 28)
+		icmp[0] = 0x45
+		icmp[3] = 28
+		icmp[9] = 1
+		icmp[20] = byte(i)
+		want = append(want, icmp)
+		if err := m.Commit(icmp, k.next(), testPP(icmp)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := m.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	if err := m.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	if len(w.writes) != 0 {
+		t.Fatalf("got %d plain Writes, want 0", len(w.writes))
+	}
+	if len(w.batches) != 1 {
+		t.Fatalf("got %d WriteBatch calls, want 1", len(w.batches))
+	}
+	for i, p := range w.batches[0] {
+		if !bytes.Equal(p, want[i]) {
+			t.Fatalf("packet %d: got % x, want % x", i, p, want[i])
+		}
+	}
+	if len(w.batches[0]) != len(want) {
+		t.Fatalf("got %d packets, want %d", len(w.batches[0]), len(want))
+	}
+}

overlay/batch/passthrough.go

@@ -2,18 +2,23 @@ package batch
 
 import (
 	"io"
+
+	"github.com/slackhq/nebula/overlay/tio"
 )
 
-// Passthrough is MultiCoalescer's verbatim lane: no batching, packets are written at Flush in the
-// order enqueued.
+// Passthrough is MultiCoalescer's verbatim lane: no coalescing, packets are written at Flush in the
+// order enqueued, in one WriteBatch when out implements tio.BatchWriter.
 type Passthrough struct {
 	out   io.Writer
+	bw    tio.BatchWriter // nil: Flush writes one packet per Write
 	slots [][]byte
 }
 
 func NewPassthrough(w io.Writer) *Passthrough {
+	bw, _ := w.(tio.BatchWriter)
 	return &Passthrough{
 		out:   w,
+		bw:    bw,
 		slots: make([][]byte, 0, 128),
 	}
 }
@@ -26,10 +31,16 @@ func (p *Passthrough) enqueue(pkt []byte) error {
 
 func (p *Passthrough) Flush() error {
 	var firstErr error
-	for _, s := range p.slots {
-		_, err := p.out.Write(s)
-		if err != nil && firstErr == nil {
-			firstErr = err
+	if p.bw != nil {
+		if len(p.slots) > 0 {
+			firstErr = p.bw.WriteBatch(p.slots)
+		}
+	} else {
+		for _, s := range p.slots {
+			_, err := p.out.Write(s)
+			if err != nil && firstErr == nil {
+				firstErr = err
+			}
 		}
 	}
 	clear(p.slots)