drop runtime.LockOSThread() on listenOut

.github/workflows/release.yml

@@ -209,11 +209,10 @@ jobs:
         id: create_release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REF_NAME: ${{ github.ref_name }}
         run: |
           cd artifacts
           gh release create \
             --verify-tag \
-            --title "Release ${GITHUB_REF_NAME}" \
+            --title "Release ${{ github.ref_name }}" \
-            "${GITHUB_REF_NAME}" \
+            "${{ github.ref_name }}" \
             SHASUM256.txt *-latest/*.zip *-latest/*.tar.gz

.github/workflows/smoke/smoke-vagrant.sh

@@ -29,17 +29,6 @@ docker run --name lighthouse1 --rm "$CONTAINER" -config lighthouse1.yml -test
 docker run --name host2 --rm "$CONTAINER" -config host2.yml -test
 
 vagrant up
-
-# OpenBSD: synced folders are disabled because Vagrant's rsync installer
-# uses ftp.openbsd.org which no longer hosts packages for older releases.
-# Copy build artifacts in via scp instead.
-case "$1" in
-    openbsd-*)
-        vagrant ssh -c "sudo mkdir -p /nebula" -- -T
-        tar -cf - -C build . | vagrant ssh -c "sudo tar -xf - -C /nebula && sudo chmod -R a+r /nebula" -- -T
-        ;;
-esac
-
 vagrant ssh -c "cd /nebula && /nebula/$1-nebula -config host3.yml -test" -- -T
 
 docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &

.github/workflows/smoke/smoke.sh

@@ -124,7 +124,6 @@ set -x
 # host2 speaking to host4 on UDP 4000 should allow it to reply, when firewall rules would normally not permit this
 docker exec host2 sh -c "/usr/bin/echo host2 | ncat -nuv 192.168.100.4 4000"
 docker exec host2 ncat -e '/usr/bin/echo helloagainfromhost2' -nkluv 0.0.0.0 4000 &
-sleep 1
 docker exec host4 sh -c "/usr/bin/echo host4 | ncat -nuv 192.168.100.2 4000"
 
 docker exec host4 sh -c 'kill 1'

.github/workflows/smoke/vagrant-openbsd-amd64/Vagrantfile

@@ -3,5 +3,5 @@
 Vagrant.configure("2") do |config|
   config.vm.box = "generic/openbsd7"
 
-  config.vm.synced_folder ".", "/vagrant", disabled: true
+  config.vm.synced_folder "../build", "/nebula", type: "rsync"
 end

CODEOWNERS

@@ -1 +0,0 @@
-#ECCN:Open Source

README.md

@@ -57,7 +57,7 @@ Check the [releases](https://github.com/slackhq/nebula/releases/latest) page for
     docker pull nebulaoss/nebula
     ```
 
-#### Mobile ([source code](https://github.com/DefinedNet/mobile_nebula))
+#### Mobile
 
 - [iOS](https://apps.apple.com/us/app/mobile-nebula/id1509587936?itsct=apps_box&itscg=30200)
 - [Android](https://play.google.com/store/apps/details?id=net.defined.mobile_nebula&pcampaignid=pcampaignidMKT-Other-global-all-co-prtnr-py-PartBadge-Mar2515-1)
@@ -76,8 +76,6 @@ Nebula was created to provide a mechanism for groups of hosts to communicate sec
 
 ## Getting started (quickly)
 
-**Don't want to manage your own PKI and lighthouses?** [Managed Nebula](https://www.defined.net/) from Defined Networking handles all of this for you.
-
 To set up a Nebula network, you'll need:
 
 #### 1. The [Nebula binaries](https://github.com/slackhq/nebula/releases) or [Distribution Packages](https://github.com/slackhq/nebula#distribution-packages) for your specific platform. Specifically you'll need `nebula-cert` and the specific nebula binary for each platform you use.

batch.go

@@ -1,70 +0,0 @@
-package nebula
-
-import "net/netip"
-
-// sendBatchCap is the maximum number of encrypted packets accumulated before a
-// flush is forced. TSO superpackets segment to at most ~45 packets on
-// reasonable MTUs, so 128 leaves headroom without bloating the backing
-// allocation.
-const sendBatchCap = 128
-
-// sendBatch accumulates encrypted UDP packets for a single sendmmsg flush.
-// One sendBatch is owned by each listenIn goroutine; no locking is needed.
-// The backing storage holds up to batchCap packets of slotCap bytes each;
-// bufs and dsts are parallel slices of committed slots.
-type sendBatch struct {
-	bufs     [][]byte
-	dsts     []netip.AddrPort
-	backing  []byte
-	slotCap  int
-	batchCap int
-	nextSlot int
-}
-
-func newSendBatch(batchCap, slotCap int) *sendBatch {
-	return &sendBatch{
-		bufs:     make([][]byte, 0, batchCap),
-		dsts:     make([]netip.AddrPort, 0, batchCap),
-		backing:  make([]byte, batchCap*slotCap),
-		slotCap:  slotCap,
-		batchCap: batchCap,
-	}
-}
-
-// Next returns a zero-length slice with slotCap capacity over the next unused
-// slot's backing bytes. The caller writes into the returned slice and then
-// calls Commit with the final length and destination. Next returns nil when
-// the batch is full.
-func (b *sendBatch) Next() []byte {
-	if b.nextSlot >= b.batchCap {
-		return nil
-	}
-	start := b.nextSlot * b.slotCap
-	return b.backing[start : start : start+b.slotCap]
-}
-
-// Commit records the slot just returned by Next as a packet of length n
-// destined for dst.
-func (b *sendBatch) Commit(n int, dst netip.AddrPort) {
-	start := b.nextSlot * b.slotCap
-	b.bufs = append(b.bufs, b.backing[start:start+n])
-	b.dsts = append(b.dsts, dst)
-	b.nextSlot++
-}
-
-// Reset clears committed slots; backing storage is retained for reuse.
-func (b *sendBatch) Reset() {
-	b.bufs = b.bufs[:0]
-	b.dsts = b.dsts[:0]
-	b.nextSlot = 0
-}
-
-// Len returns the number of committed packets.
-func (b *sendBatch) Len() int {
-	return len(b.bufs)
-}
-
-// Cap returns the maximum number of slots in the batch.
-func (b *sendBatch) Cap() int {
-	return b.batchCap
-}

batch_test.go

@@ -1,137 +0,0 @@
-package nebula
-
-import (
-	"net/netip"
-	"testing"
-)
-
-func TestSendBatchBookkeeping(t *testing.T) {
-	b := newSendBatch(4, 32)
-	if b.Len() != 0 || b.Cap() != 4 {
-		t.Fatalf("fresh batch: len=%d cap=%d", b.Len(), b.Cap())
-	}
-
-	ap := netip.MustParseAddrPort("10.0.0.1:4242")
-	for i := 0; i < 4; i++ {
-		slot := b.Next()
-		if slot == nil {
-			t.Fatalf("slot %d: Next returned nil before cap", i)
-		}
-		if cap(slot) != 32 || len(slot) != 0 {
-			t.Fatalf("slot %d: got len=%d cap=%d want len=0 cap=32", i, len(slot), cap(slot))
-		}
-		// Write a marker byte.
-		slot = append(slot, byte(i), byte(i+1), byte(i+2))
-		b.Commit(len(slot), ap)
-	}
-	if b.Next() != nil {
-		t.Fatalf("Next should return nil when full")
-	}
-	if b.Len() != 4 {
-		t.Fatalf("Len=%d want 4", b.Len())
-	}
-	for i, buf := range b.bufs {
-		if len(buf) != 3 || buf[0] != byte(i) {
-			t.Errorf("buf %d: %x", i, buf)
-		}
-		if b.dsts[i] != ap {
-			t.Errorf("dst %d: got %v want %v", i, b.dsts[i], ap)
-		}
-	}
-
-	// Reset returns empty and Next works again.
-	b.Reset()
-	if b.Len() != 0 {
-		t.Fatalf("after Reset Len=%d want 0", b.Len())
-	}
-	slot := b.Next()
-	if slot == nil || cap(slot) != 32 {
-		t.Fatalf("after Reset Next nil or wrong cap: %v cap=%d", slot == nil, cap(slot))
-	}
-}
-
-func TestBatchSegmentable(t *testing.T) {
-	ap := netip.MustParseAddrPort("10.0.0.1:4242")
-	other := netip.MustParseAddrPort("10.0.0.2:4242")
-
-	mk := func(addrs []netip.AddrPort, sizes []int) *sendBatch {
-		b := newSendBatch(len(addrs), 64)
-		for i, a := range addrs {
-			s := b.Next()
-			for j := 0; j < sizes[i]; j++ {
-				s = append(s, byte(j))
-			}
-			b.Commit(len(s), a)
-		}
-		return b
-	}
-
-	t.Run("uniform same dst", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 10})
-		seg, ok := batchSegmentable(b)
-		if !ok || seg != 10 {
-			t.Fatalf("got seg=%d ok=%v", seg, ok)
-		}
-	})
-
-	t.Run("last segment short ok", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 4})
-		seg, ok := batchSegmentable(b)
-		if !ok || seg != 10 {
-			t.Fatalf("got seg=%d ok=%v", seg, ok)
-		}
-	})
-
-	t.Run("mixed dst rejected", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, other, ap}, []int{10, 10, 10})
-		if _, ok := batchSegmentable(b); ok {
-			t.Fatalf("expected rejection for mixed dst")
-		}
-	})
-
-	t.Run("mid-batch short rejected", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 4, 10})
-		if _, ok := batchSegmentable(b); ok {
-			t.Fatalf("expected rejection for short mid-batch")
-		}
-	})
-
-	t.Run("mid-batch longer rejected", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 11, 10})
-		if _, ok := batchSegmentable(b); ok {
-			t.Fatalf("expected rejection for longer mid-batch")
-		}
-	})
-
-	t.Run("last longer rejected", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 11})
-		if _, ok := batchSegmentable(b); ok {
-			t.Fatalf("expected rejection for longer last segment")
-		}
-	})
-
-	t.Run("first zero rejected", func(t *testing.T) {
-		b := mk([]netip.AddrPort{ap, ap}, []int{0, 10})
-		if _, ok := batchSegmentable(b); ok {
-			t.Fatalf("expected rejection for zero first")
-		}
-	})
-}
-
-func TestSendBatchSlotsDoNotOverlap(t *testing.T) {
-	b := newSendBatch(3, 8)
-	ap := netip.MustParseAddrPort("10.0.0.1:80")
-
-	// Fill three slots, each with its own sentinel byte.
-	for i := 0; i < 3; i++ {
-		s := b.Next()
-		s = append(s, byte(0xA0+i), byte(0xB0+i))
-		b.Commit(len(s), ap)
-	}
-
-	for i, buf := range b.bufs {
-		if buf[0] != byte(0xA0+i) || buf[1] != byte(0xB0+i) {
-			t.Errorf("slot %d corrupted: %x", i, buf)
-		}
-	}
-}

cert/ca_pool.go

@@ -1,14 +1,11 @@
 package cert
 
 import (
-	"bufio"
-	"bytes"
-	"encoding/pem"
 	"errors"
 	"fmt"
-	"io"
 	"net/netip"
 	"slices"
+	"strings"
 	"time"
 )
 
@@ -32,46 +29,22 @@ func NewCAPool() *CAPool {
 // If the pool contains any expired certificates, an ErrExpired will be
 // returned along with the pool. The caller must handle any such errors.
 func NewCAPoolFromPEM(caPEMs []byte) (*CAPool, error) {
-	return NewCAPoolFromPEMReader(bytes.NewReader(caPEMs))
-}
-
-// NewCAPoolFromPEMReader will create a new CA pool from the provided reader.
-// The reader must contain a PEM-encoded set of nebula certificates.
-func NewCAPoolFromPEMReader(r io.Reader) (*CAPool, error) {
 	pool := NewCAPool()
-
+	var err error
 	var expired bool
-
+	for {
-	scanner := bufio.NewScanner(r)
+		caPEMs, err = pool.AddCAFromPEM(caPEMs)
-	scanner.Split(SplitPEM)
+		if errors.Is(err, ErrExpired) {
-
+			expired = true
-	for scanner.Scan() {
+			err = nil
-		pemBytes := scanner.Bytes()
-
-		block, rest := pem.Decode(pemBytes)
-		if len(bytes.TrimSpace(rest)) > 0 {
-			return nil, ErrInvalidPEMBlock
 		}
-		if block == nil {
-			return nil, ErrInvalidPEMBlock
-		}
-
-		c, err := unmarshalCertificateBlock(block)
 		if err != nil {
 			return nil, err
 		}
-
+		if len(caPEMs) == 0 || strings.TrimSpace(string(caPEMs)) == "" {
-		err = pool.AddCA(c)
+			break
-		if errors.Is(err, ErrExpired) {
-			expired = true
-			continue
-		} else if err != nil {
-			return nil, err
 		}
 	}
-	if err := scanner.Err(); err != nil {
-		return nil, ErrInvalidPEMBlock
-	}
 
 	if expired {
 		return pool, ErrExpired

cert/ca_pool_test.go

@@ -1,10 +1,7 @@
 package cert
 
 import (
-	"bytes"
-	"io"
 	"net/netip"
-	"strings"
 	"testing"
 	"time"
 
@@ -115,60 +112,6 @@ k+coOv04r+zh33ISyhbsafnYduN17p2eD7CmHvHuerguXD9f32gcxo/KsFCKEjMe
 	assert.Len(t, ppppp.CAs, 1)
 }
 
-// oneByteReader wraps a reader to return at most 1 byte per Read call,
-// exercising the streaming accumulation logic in NewCAPoolFromPEMReader.
-type oneByteReader struct {
-	r io.Reader
-}
-
-func (o *oneByteReader) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-	return o.r.Read(p[:1])
-}
-
-func TestNewCAPoolFromPEMReader_EmptyReader(t *testing.T) {
-	pool, err := NewCAPoolFromPEMReader(bytes.NewReader(nil))
-	require.NoError(t, err)
-	assert.Empty(t, pool.CAs)
-
-	pool, err = NewCAPoolFromPEMReader(strings.NewReader("   \n\t\n  "))
-	require.NoError(t, err)
-	assert.Empty(t, pool.CAs)
-}
-
-func TestNewCAPoolFromPEMReader_OneByteReads(t *testing.T) {
-	ca1, _, _, pem1 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-	ca2, _, _, pem2 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-
-	bundle := append(pem1, pem2...)
-	pool, err := NewCAPoolFromPEMReader(&oneByteReader{r: bytes.NewReader(bundle)})
-	require.NoError(t, err)
-	assert.Len(t, pool.CAs, 2)
-
-	fp1, err := ca1.Fingerprint()
-	require.NoError(t, err)
-	fp2, err := ca2.Fingerprint()
-	require.NoError(t, err)
-
-	assert.Contains(t, pool.CAs, fp1)
-	assert.Contains(t, pool.CAs, fp2)
-}
-
-func TestNewCAPoolFromPEMReader_TruncatedPEM(t *testing.T) {
-	_, err := NewCAPoolFromPEMReader(strings.NewReader("-----BEGIN NEBULA CERTIFICATE-----\npartialdata"))
-	assert.ErrorIs(t, err, ErrInvalidPEMBlock)
-}
-
-func TestNewCAPoolFromPEMReader_TrailingGarbage(t *testing.T) {
-	_, _, _, pem1 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-
-	bundle := append(pem1, []byte("some trailing garbage")...)
-	_, err := NewCAPoolFromPEMReader(bytes.NewReader(bundle))
-	assert.ErrorIs(t, err, ErrInvalidPEMBlock)
-}
-
 func TestCertificateV1_Verify(t *testing.T) {
 	ca, _, caKey, _ := NewTestCaCert(Version1, Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, nil)
 	c, _, _, _ := NewTestCert(Version1, Curve_CURVE25519, ca, caKey, "test cert", time.Now(), time.Now().Add(5*time.Minute), nil, nil, nil)

cert/p256/p256.go

@@ -44,12 +44,7 @@ func swap(r, s []byte) ([]byte, []byte, error) {
 	}
 	sNormalized := nMod.Nat().Sub(bigS, nMod)
 
-	result := sNormalized.Bytes(nMod)
+	return r, sNormalized.Bytes(nMod), nil
-	for len(result) > 1 && result[0] == 0 {
-		result = result[1:]
-	}
-
-	return r, result, nil
 }
 
 func Normalize(sig []byte) ([]byte, error) {

cert/pem.go

@@ -1,66 +1,12 @@
 package cert
 
 import (
-	"bytes"
 	"encoding/pem"
-	"errors"
 	"fmt"
 
 	"golang.org/x/crypto/ed25519"
 )
 
-var ErrTruncatedPEMBlock = errors.New("truncated PEM block")
-
-// SplitPEM is a split function for bufio.Scanner that returns each PEM block.
-func SplitPEM(data []byte, atEOF bool) (advance int, token []byte, err error) {
-	// Look for the start of a PEM block
-	start := bytes.Index(data, []byte("-----BEGIN "))
-	if start == -1 {
-		if atEOF && len(bytes.TrimSpace(data)) > 0 {
-			// Non-whitespace content with no PEM block
-			return 0, nil, ErrTruncatedPEMBlock
-		}
-		if atEOF {
-			return len(data), nil, nil
-		}
-		// Request more data
-		return 0, nil, nil
-	}
-
-	// Look for the end marker
-	endMarkerStart := bytes.Index(data[start:], []byte("-----END "))
-	if endMarkerStart == -1 {
-		if atEOF {
-			// Incomplete PEM block at EOF
-			return 0, nil, ErrTruncatedPEMBlock
-		}
-		// Need more data to find the end
-		return 0, nil, nil
-	}
-
-	// Find the actual end of the END line (after the newline)
-	endMarkerStart += start
-	endLineEnd := bytes.IndexByte(data[endMarkerStart:], '\n')
-	var end int
-	if endLineEnd == -1 {
-		if atEOF {
-			// END marker without newline at EOF - take it anyway
-			end = len(data)
-		} else {
-			// Need more data
-			return 0, nil, nil
-		}
-	} else {
-		end = endMarkerStart + endLineEnd + 1
-	}
-
-	// Extract the PEM block
-	pemBlock := data[start:end]
-
-	// Return the valid PEM block
-	return end, pemBlock, nil
-}
-
 const ( //cert banners
 	CertificateBanner   = "NEBULA CERTIFICATE"
 	CertificateV2Banner = "NEBULA CERTIFICATE V2"
@@ -91,7 +37,19 @@ func UnmarshalCertificateFromPEM(b []byte) (Certificate, []byte, error) {
 		return nil, r, ErrInvalidPEMBlock
 	}
 
-	c, err := unmarshalCertificateBlock(p)
+	var c Certificate
+	var err error
+
+	switch p.Type {
+	// Implementations must validate the resulting certificate contains valid information
+	case CertificateBanner:
+		c, err = unmarshalCertificateV1(p.Bytes, nil)
+	case CertificateV2Banner:
+		c, err = unmarshalCertificateV2(p.Bytes, nil, Curve_CURVE25519)
+	default:
+		return nil, r, ErrInvalidPEMCertificateBanner
+	}
+
 	if err != nil {
 		return nil, r, err
 	}
@@ -100,20 +58,6 @@ func UnmarshalCertificateFromPEM(b []byte) (Certificate, []byte, error) {
 
 }
 
-// unmarshalCertificateBlock decodes a single PEM block into a certificate.
-// It expects a Nebula certificate banner and returns ErrInvalidPEMCertificateBanner otherwise.
-func unmarshalCertificateBlock(block *pem.Block) (Certificate, error) {
-	switch block.Type {
-	// Implementations must validate the resulting certificate contains valid information
-	case CertificateBanner:
-		return unmarshalCertificateV1(block.Bytes, nil)
-	case CertificateV2Banner:
-		return unmarshalCertificateV2(block.Bytes, nil, Curve_CURVE25519)
-	default:
-		return nil, ErrInvalidPEMCertificateBanner
-	}
-}
-
 func marshalCertPublicKeyToPEM(c Certificate) []byte {
 	if c.IsCA() {
 		return MarshalSigningPublicKeyToPEM(c.Curve(), c.PublicKey())

cert/pem_test.go

@@ -1,88 +1,12 @@
 package cert
 
 import (
-	"bufio"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func scanAll(t *testing.T, input string) ([]string, error) {
-	t.Helper()
-	scanner := bufio.NewScanner(strings.NewReader(input))
-	scanner.Split(SplitPEM)
-	var blocks []string
-	for scanner.Scan() {
-		blocks = append(blocks, scanner.Text())
-	}
-	return blocks, scanner.Err()
-}
-
-func TestSplitPEM_Single(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----\n"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 1)
-	require.Equal(t, input, blocks[0])
-}
-
-func TestSplitPEM_Multiple(t *testing.T) {
-	block1 := "-----BEGIN TEST-----\naaa\n-----END TEST-----\n"
-	block2 := "-----BEGIN TEST-----\nbbb\n-----END TEST-----\n"
-	blocks, err := scanAll(t, block1+block2)
-	require.NoError(t, err)
-	require.Len(t, blocks, 2)
-	require.Equal(t, block1, blocks[0])
-	require.Equal(t, block2, blocks[1])
-}
-
-func TestSplitPEM_CommentsAndWhitespaceBetweenBlocks(t *testing.T) {
-	input := "# comment\n\n-----BEGIN TEST-----\naaa\n-----END TEST-----\n\n# another comment\n\n-----BEGIN TEST-----\nbbb\n-----END TEST-----\n"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 2)
-}
-
-func TestSplitPEM_Empty(t *testing.T) {
-	blocks, err := scanAll(t, "")
-	require.NoError(t, err)
-	require.Empty(t, blocks)
-}
-
-func TestSplitPEM_WhitespaceOnly(t *testing.T) {
-	blocks, err := scanAll(t, "  \n\t\n  ")
-	require.NoError(t, err)
-	require.Empty(t, blocks)
-}
-
-func TestSplitPEM_TrailingGarbage(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----\ngarbage"
-	blocks, err := scanAll(t, input)
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-	require.Len(t, blocks, 1)
-}
-
-func TestSplitPEM_TruncatedBlock(t *testing.T) {
-	input := "-----BEGIN TEST-----\npartial data with no end"
-	_, err := scanAll(t, input)
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-}
-
-func TestSplitPEM_NoEndNewline(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 1)
-	require.Equal(t, input, blocks[0])
-}
-
-func TestSplitPEM_GarbageOnly(t *testing.T) {
-	_, err := scanAll(t, "this is not PEM data")
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-}
-
 func TestUnmarshalCertificateFromPEM(t *testing.T) {
 	goodCert := []byte(`
 # A good cert

cmd/nebula-cert/verify.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/slackhq/nebula/cert"
@@ -39,17 +40,23 @@ func verify(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}
 
-	caFile, err := os.Open(*vf.caPath)
+	rawCACert, err := os.ReadFile(*vf.caPath)
 	if err != nil {
 		return fmt.Errorf("error while reading ca: %w", err)
 	}
-	defer caFile.Close()
 
-	caPool, err := cert.NewCAPoolFromPEMReader(caFile)
+	caPool := cert.NewCAPool()
-	if err != nil && !errors.Is(err, cert.ErrExpired) {
+	for {
+		rawCACert, err = caPool.AddCAFromPEM(rawCACert)
+		if err != nil {
 			return fmt.Errorf("error while adding ca cert to pool: %w", err)
 		}
 
+		if rawCACert == nil || len(rawCACert) == 0 || strings.TrimSpace(string(rawCACert)) == "" {
+			break
+		}
+	}
+
 	rawCert, err := os.ReadFile(*vf.certPath)
 	if err != nil {
 		return fmt.Errorf("unable to read crt: %w", err)

cmd/nebula-cert/verify_test.go

@@ -64,7 +64,7 @@ func Test_verify(t *testing.T) {
 	err = verify([]string{"-ca", caFile.Name(), "-crt", "does_not_exist"}, ob, eb)
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
-	require.ErrorIs(t, err, cert.ErrInvalidPEMBlock)
+	require.EqualError(t, err, "error while adding ca cert to pool: input did not contain a valid PEM encoded block")
 
 	// make a ca for later
 	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)

cmd/nebula-service/main.go

@@ -78,21 +78,8 @@ func main() {
 	}
 
 	if !*configTest {
-		wait, err := ctrl.Start()
+		ctrl.Start()
-		if err != nil {
+		ctrl.ShutdownBlock()
-			util.LogWithContextIfNeeded("Error while running", err, l)
-			os.Exit(1)
-		}
-
-		go ctrl.ShutdownBlock()
-
-		if err := wait(); err != nil {
-			l.WithError(err).Error("Nebula stopped due to fatal error")
-			l.Info("Goodbye")
-			os.Exit(2)
-		}
-
-		l.Info("Goodbye")
 	}
 
 	os.Exit(0)

cmd/nebula/main.go

@@ -72,22 +72,9 @@ func main() {
 	}
 
 	if !*configTest {
-		wait, err := ctrl.Start()
+		ctrl.Start()
-		if err != nil {
-			util.LogWithContextIfNeeded("Error while running", err, l)
-			os.Exit(1)
-		}
-
-		go ctrl.ShutdownBlock()
 		notifyReady(l)
-
+		ctrl.ShutdownBlock()
-		if err := wait(); err != nil {
-			l.WithError(err).Error("Nebula stopped due to fatal error")
-			l.Info("Goodbye")
-			os.Exit(2)
-		}
-
-		l.Info("Goodbye")
 	}
 
 	os.Exit(0)

connection_manager_test.go

@@ -10,7 +10,6 @@ import (
 	"github.com/flynn/noise"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/test"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
@@ -53,7 +52,7 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlay.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -136,7 +135,7 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlay.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -221,7 +220,7 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlay.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -348,7 +347,7 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlay.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,

control.go

@@ -2,11 +2,9 @@ package nebula
 
 import (
 	"context"
-	"errors"
 	"net/netip"
 	"os"
 	"os/signal"
-	"sync"
 	"syscall"
 
 	"github.com/sirupsen/logrus"
@@ -15,16 +13,6 @@ import (
 	"github.com/slackhq/nebula/overlay"
 )
 
-type RunState int
-
-const (
-	Stopped  RunState = 0 // The control has yet to be started
-	Started  RunState = 1 // The control has been started
-	Stopping RunState = 2 // The control is stopping
-)
-
-var ErrAlreadyStarted = errors.New("nebula is already started")
-
 // Every interaction here needs to take extra care to copy memory and not return or use arguments "as is" when touching
 // core. This means copying IP objects, slices, de-referencing pointers and taking the actual value, etc
 
@@ -38,9 +26,6 @@ type controlHostLister interface {
 }
 
 type Control struct {
-	stateLock sync.Mutex
-	state     RunState
-
 	f                      *Interface
 	l                      *logrus.Logger
 	ctx                    context.Context
@@ -64,24 +49,10 @@ type ControlHostInfo struct {
 	CurrentRelaysThroughMe []netip.Addr     `json:"currentRelaysThroughMe"`
 }
 
-// Start actually runs nebula, this is a nonblocking call.
+// Start actually runs nebula, this is a nonblocking call. To block use Control.ShutdownBlock()
-// The returned function blocks until nebula has fully stopped and returns the
+func (c *Control) Start() {
-// first fatal reader error (if any). A nil error means nebula shut down
-// gracefully; a non-nil error means a reader hit an unexpected failure that
-// triggered the shutdown.
-func (c *Control) Start() (func() error, error) {
-	c.stateLock.Lock()
-	if c.state != Stopped {
-		c.stateLock.Unlock()
-		return nil, ErrAlreadyStarted
-	}
-
 	// Activate the interface
-	err := c.f.activate()
+	c.f.activate()
-	if err != nil {
-		c.stateLock.Unlock()
-		return nil, err
-	}
 
 	// Call all the delayed funcs that waited patiently for the interface to be created.
 	if c.sshStart != nil {
@@ -100,36 +71,16 @@ func (c *Control) Start() (func() error, error) {
 		c.lighthouseStart()
 	}
 
-	c.f.triggerShutdown = c.Stop
-
 	// Start reading packets.
-	c.state = Started
+	c.f.run()
-	c.stateLock.Unlock()
-	return c.f.run()
-}
-
-func (c *Control) State() RunState {
-	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
-	return c.state
 }
 
 func (c *Control) Context() context.Context {
 	return c.ctx
 }
 
-// Stop is a non-blocking call that signals nebula to close all tunnels and shut down
+// Stop signals nebula to shutdown and close all tunnels, returns after the shutdown is complete
 func (c *Control) Stop() {
-	c.stateLock.Lock()
-	if c.state != Started {
-		c.stateLock.Unlock()
-		// We are stopping or stopped already
-		return
-	}
-
-	c.state = Stopping
-	c.stateLock.Unlock()
-
 	// Stop the handshakeManager (and other services), to prevent new tunnels from
 	// being created while we're shutting them all down.
 	c.cancel()
@@ -138,9 +89,7 @@ func (c *Control) Stop() {
 	if err := c.f.Close(); err != nil {
 		c.l.WithError(err).Error("Close interface failed")
 	}
-	c.stateLock.Lock()
+	c.l.Info("Goodbye")
-	c.state = Stopped
-	c.stateLock.Unlock()
 }
 
 // ShutdownBlock will listen for and block on term and interrupt signals, calling Control.Stop() once signalled

dist/wireshark/nebula.lua

@@ -84,24 +84,30 @@ end
 
 function nebula.prefs_changed()
     if default_settings.all_ports == nebula.prefs.all_ports and default_settings.port == nebula.prefs.port then
+        -- Nothing changed, bail
         return
     end
 
-    -- Remove all existing registrations
+    -- Remove our old dissector
     DissectorTable.get("udp.port"):remove_all(nebula)
 
-    if nebula.prefs.all_ports then
+    if nebula.prefs.all_ports and default_settings.all_ports ~= nebula.prefs.all_ports then
-        -- Register on every port for hole punch capture
+        default_settings.all_port = nebula.prefs.all_ports
+
         for i=0, 65535 do
             DissectorTable.get("udp.port"):add(i, nebula)
         end
-    else
+
-        -- Register on the configured port only
+        -- no need to establish again on specific ports
-        DissectorTable.get("udp.port"):add(nebula.prefs.port, nebula)
+        return
     end
 
-    default_settings.all_ports = nebula.prefs.all_ports
+
+    if default_settings.all_ports ~= nebula.prefs.all_ports then
+        -- Add our new port dissector
         default_settings.port = nebula.prefs.port
+        DissectorTable.get("udp.port"):add(default_settings.port, nebula)
+    end
 end
 
 DissectorTable.get("udp.port"):add(default_settings.port, nebula)

e2e/handshake_manager_test.go

@@ -1,565 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-)
-
-// makeHandshakePacket creates a handshake packet with the given parameters.
-func makeHandshakePacket(from, to netip.AddrPort, subtype header.MessageSubType, remoteIndex uint32, counter uint64) *udp.Packet {
-	data := make([]byte, 200)
-	header.Encode(data, header.Version, header.Handshake, subtype, remoteIndex, counter)
-	for i := header.Len; i < len(data); i++ {
-		data[i] = byte(i)
-	}
-	return &udp.Packet{To: to, From: from, Data: data}
-}
-
-func TestHandshakeRetransmitDuplicate(t *testing.T) {
-	// Verify the responder correctly handles receiving the same msg1 multiple times
-	// (retransmission). The duplicate goes through CheckAndComplete -> ErrAlreadySeen
-	// and the cached response is resent.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake from me to them")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Grab my msg1")
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Inject msg1 into them, first time")
-	theirControl.InjectUDPPacket(msg1)
-	_ = theirControl.GetFromUDP(true)
-
-	t.Log("Inject the SAME msg1 again, tests ErrAlreadySeen path")
-	theirControl.InjectUDPPacket(msg1)
-	resp2 := theirControl.GetFromUDP(true)
-	assert.NotNil(t, resp2, "should get cached response on duplicate msg1")
-
-	t.Log("Complete handshake with cached response")
-	myControl.InjectUDPPacket(resp2)
-	myControl.WaitForType(1, 0, theirControl)
-
-	t.Log("Drain cached packet and verify tunnel works")
-	cachedPacket := theirControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify only one tunnel exists on each side")
-	assert.Len(t, myControl.ListHostmapHosts(false), 1)
-	assert.Len(t, theirControl.ListHostmapHosts(false), 1)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeTruncatedPacketRecovery(t *testing.T) {
-	// Verify that a truncated handshake packet is ignored and the real
-	// packet can still complete the handshake.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Get msg1 and deliver to responder")
-	msg1 := myControl.GetFromUDP(true)
-	theirControl.InjectUDPPacket(msg1)
-
-	t.Log("Get the real response")
-	realResp := theirControl.GetFromUDP(true)
-
-	t.Log("Truncate the response and inject, should be ignored")
-	truncResp := realResp.Copy()
-	truncResp.Data = truncResp.Data[:header.Len]
-	myControl.InjectUDPPacket(truncResp)
-
-	t.Log("Verify pending handshake survived the truncated packet")
-	assert.NotEmpty(t, myControl.ListHostmapHosts(true), "pending handshake should still exist")
-
-	t.Log("Inject real response, should complete handshake")
-	myControl.InjectUDPPacket(realResp)
-	myControl.WaitForType(1, 0, theirControl)
-
-	t.Log("Drain and verify tunnel")
-	cachedPacket := theirControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeOrphanedMsg2Dropped(t *testing.T) {
-	// A msg2 arriving with no matching pending index should be silently dropped
-	// with no response sent and no state changes.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Complete a normal handshake")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	r.RouteForAllUntilTxTun(theirControl)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Record hostmap state")
-	myIndexes := len(myControl.ListHostmapIndexes(false))
-
-	t.Log("Inject a fake msg2 with unknown RemoteIndex")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0xDEADBEEF, 2))
-
-	t.Log("Verify no new indexes created")
-	assert.Equal(t, myIndexes, len(myControl.ListHostmapIndexes(false)))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false), "should not send a response to orphaned msg2")
-
-	t.Log("Verify existing tunnel still works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeUnknownMessageCounter(t *testing.T) {
-	// A handshake packet with an unexpected message counter should be silently
-	// dropped with no side effects and no UDP response.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Inject handshake with MessageCounter=3")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 3))
-
-	t.Log("Inject handshake with MessageCounter=99")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 99))
-
-	t.Log("Verify no tunnels or pending handshakes")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeUnknownSubtype(t *testing.T) {
-	// A handshake packet with an unknown subtype should be silently dropped.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, _, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Inject handshake with unknown subtype 99")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.MessageSubType(99), 0, 1))
-
-	t.Log("Verify no tunnels or pending handshakes")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeLateResponse(t *testing.T) {
-	// After a handshake times out, a late response should be silently ignored
-	// with no new tunnels created.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{
-		"handshakes": m{
-			"try_interval": "200ms",
-			"retries":      2,
-		},
-	})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger handshake from me")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Grab msg1 but don't deliver")
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Wait for handshake to time out")
-	for i := 0; i < 5; i++ {
-		time.Sleep(300 * time.Millisecond)
-		myControl.GetFromUDP(false)
-	}
-
-	t.Log("Confirm no pending handshakes remain")
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Deliver old msg1 to them, they create a tunnel")
-	theirControl.InjectUDPPacket(msg1)
-	resp := theirControl.GetFromUDP(true)
-	assert.NotNil(t, resp)
-
-	t.Log("Inject late response into me, should be ignored")
-	myControl.InjectUDPPacket(resp)
-
-	t.Log("No tunnel should exist on my side")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeSelfConnectionRejected(t *testing.T) {
-	// Verify that a node rejects a handshake containing its own VPN IP in the
-	// peer cert. We do this by sending the initiator's own msg1 back to itself.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-
-	// Need a lighthouse entry to trigger a handshake
-	myControl.InjectLightHouseAddr(netip.MustParseAddr("10.128.0.2"), netip.MustParseAddrPort("10.0.0.2:4242"))
-
-	myControl.Start()
-
-	t.Log("Trigger handshake from me")
-	myControl.InjectTunUDPPacket(netip.MustParseAddr("10.128.0.2"), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Drain any handshake retransmits before injecting")
-	time.Sleep(100 * time.Millisecond)
-	for myControl.GetFromUDP(false) != nil {
-	}
-
-	t.Log("Feed my own msg1 back to me as if it came from someone else")
-	selfMsg := msg1.Copy()
-	selfMsg.From = netip.MustParseAddrPort("10.0.0.99:4242")
-	selfMsg.To = myUdpAddr
-	myControl.InjectUDPPacket(selfMsg)
-
-	t.Log("Verify no response was sent (self-connection rejected)")
-	time.Sleep(100 * time.Millisecond)
-	// Drain any further retransmits from the original handshake, then check
-	// that none of them are a handshake response (MessageCounter=2)
-	h := &header.H{}
-	for {
-		p := myControl.GetFromUDP(false)
-		if p == nil {
-			break
-		}
-		_ = h.Parse(p.Data)
-		assert.NotEqual(t, uint64(2), h.MessageCounter,
-			"should not send a stage 2 response to self-connection")
-	}
-
-	t.Log("Verify no tunnel to myself was created")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false))
-
-	myControl.Stop()
-}
-
-func TestHandshakeMessageCounter0Dropped(t *testing.T) {
-	// MessageCounter=0 is not a valid handshake message and should be dropped.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	_, _, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.Start()
-
-	t.Log("Inject handshake with MessageCounter=0")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 0))
-
-	time.Sleep(100 * time.Millisecond)
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-}
-
-func TestHandshakeRemoteAllowList(t *testing.T) {
-	// Verify that a handshake from a blocked underlay IP is dropped with no
-	// response and no state changes. Then verify the same packet from an
-	// allowed IP succeeds.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{
-		"lighthouse": m{
-			"remote_allow_list": m{
-				"10.0.0.0/8": true,
-				"0.0.0.0/0":  false,
-			},
-		},
-	})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake from them")
-	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	msg1 := theirControl.GetFromUDP(true)
-
-	t.Log("Rewrite the source to a blocked IP and inject")
-	blockedMsg := msg1.Copy()
-	blockedMsg.From = netip.MustParseAddrPort("192.168.1.1:4242")
-	myControl.InjectUDPPacket(blockedMsg)
-
-	t.Log("Verify no tunnel, no pending, no response from blocked source")
-	time.Sleep(100 * time.Millisecond)
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-	assert.Nil(t, myControl.GetFromUDP(false), "should not respond to blocked source")
-
-	t.Log("Now inject the real packet from the allowed source")
-	myControl.InjectUDPPacket(msg1)
-
-	t.Log("Verify handshake completes from allowed source")
-	resp := myControl.GetFromUDP(true)
-	assert.NotNil(t, resp)
-	theirControl.InjectUDPPacket(resp)
-	theirControl.WaitForType(1, 0, myControl)
-
-	t.Log("Drain cached packet and verify tunnel works")
-	cachedPacket := myControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
-	// When a duplicate msg1 arrives via ErrAlreadySeen, verify the tunnel
-	// remains functional and hostmap index count is stable.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Complete a normal handshake via the router")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	r.RouteForAllUntilTxTun(theirControl)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Record hostmap state")
-	theirIndexes := len(theirControl.ListHostmapIndexes(false))
-	hi := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, hi)
-	originalRemote := hi.CurrentRemote
-
-	t.Log("Re-trigger traffic to cause a new handshake attempt (ErrAlreadySeen)")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("roam"))
-	r.RouteForAllUntilTxTun(theirControl)
-
-	t.Log("Verify tunnel still works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify remote is still valid and index count is stable")
-	hi2 := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, hi2)
-	assert.Equal(t, originalRemote, hi2.CurrentRemote)
-	assert.Equal(t, theirIndexes, len(theirControl.ListHostmapIndexes(false)),
-		"no extra indexes should be created from ErrAlreadySeen")
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeWrongResponderPacketStore(t *testing.T) {
-	// Verify that when the wrong host responds, the cached packets are
-	// transferred to the new handshake, the evil tunnel is closed, evil's
-	// address is blocked, and the correct tunnel is eventually established.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.100/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.99/24", nil)
-	evilControl, evilVpnIpNet, evilUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "evil", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), evilUdpAddr)
-
-	r := router.NewR(t, myControl, theirControl, evilControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	theirControl.Start()
-	evilControl.Start()
-
-	t.Log("Send multiple packets to them (cached during handshake)")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet1"))
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet2"))
-
-	t.Log("Route until evil tunnel is closed")
-	h := &header.H{}
-	r.RouteForAllExitFunc(func(p *udp.Packet, c *nebula.Control) router.ExitType {
-		if err := h.Parse(p.Data); err != nil {
-			panic(err)
-		}
-		if h.Type == header.CloseTunnel && p.To == evilUdpAddr {
-			return router.RouteAndExit
-		}
-		return router.KeepRouting
-	})
-
-	t.Log("Verify evil's address is blocked in the new pending handshake")
-	pendingHI := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), true)
-	if pendingHI != nil {
-		assert.NotContains(t, pendingHI.RemoteAddrs, evilUdpAddr,
-			"evil's address should be blocked")
-	}
-
-	t.Log("Inject correct lighthouse addr for them")
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	t.Log("Route until cached packets arrive at the real them")
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assert.NotNil(t, p, "a cached packet should be delivered to the correct host")
-
-	t.Log("Verify the correct host has a tunnel")
-	assertHostInfoPair(t, myUdpAddr, theirUdpAddr, myVpnIpNet, theirVpnIpNet, myControl, theirControl)
-
-	t.Log("Verify no hostinfo artifacts from evil remain")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(evilVpnIpNet[0].Addr(), true),
-		"no pending hostinfo for evil")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(evilVpnIpNet[0].Addr(), false),
-		"no main hostinfo for evil")
-
-	myControl.Stop()
-	theirControl.Stop()
-	evilControl.Stop()
-}
-
-func TestHandshakeRelayComplete(t *testing.T) {
-	// Verify that a relay handshake completes correctly and relay state is
-	// properly maintained on all three nodes.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger handshake via relay")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi via relay"))
-
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assertUdpPacket(t, []byte("Hi via relay"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-
-	t.Log("Verify bidirectional tunnel via relay")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify relay state on my side shows relay-to-me")
-	myHI := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, myHI)
-	assert.NotEmpty(t, myHI.CurrentRelaysToMe, "should have relay-to-me for them")
-
-	t.Log("Verify relay state on their side shows relay-to-me")
-	theirHI := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, theirHI)
-	assert.NotEmpty(t, theirHI.CurrentRelaysToMe, "should have relay-to-me for me")
-
-	t.Log("Verify relay node shows through-me relays")
-	relayHI := relayControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, relayHI)
-
-	myControl.Stop()
-	relayControl.Stop()
-	theirControl.Stop()
-}
-
-// NOTE: Relay V1 cert + IPv6 rejection is not tested here because
-// InjectTunUDPPacket from a V4 node to a V6 address panics in the test
-// framework. The check is in handshake_manager.go handleOutbound relay
-// logic (lines ~304-313): if the relay host has a V1 cert and either
-// address is IPv6, the relay is skipped.
-
-// NOTE: Relay reestablishment (Disestablished state transition) is covered
-// by the existing TestReestablishRelays in handshakes_test.go.

e2e/tunnels_test.go

@@ -12,8 +12,6 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"gopkg.in/yaml.v3"
 )
@@ -367,106 +365,3 @@ func TestCrossStackRelaysWork(t *testing.T) {
 	//theirControl.Stop()
 	//relayControl.Stop()
 }
-
-func TestCloseTunnelAuthenticated(t *testing.T) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "5s"}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "10m"}})
-
-	// Share our underlay information
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-
-	r.Log("Assert the tunnel between me and them works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	r.Log("Close the tunnel")
-	myControl.CloseTunnel(theirVpnIpNet[0].Addr(), false)
-	r.FlushAll()
-
-	waitStart := time.Now()
-	for {
-		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := len(theirControl.GetHostmap().Indexes)
-		if myIndexes == 0 && theirIndexes == 0 {
-			break
-		}
-
-		since := time.Since(waitStart)
-		r.Logf("my tunnels: %v; their tunnels: %v; duration: %v", myIndexes, theirIndexes, since)
-		if since > time.Second*6 {
-			t.Fatal("Tunnel should have been declared inactive after 2 seconds and before 6 seconds")
-		}
-
-		time.Sleep(1 * time.Second)
-		//r.FlushAll()
-	}
-
-	r.Logf("Happy path success, tunnels were dropped within %v", time.Since(waitStart))
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-	r.Log("Assert another tunnel between me and them works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	hi := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-	if hi == nil {
-		t.Fatal("There is no hostinfo for this tunnel")
-	}
-	myHi := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	if myHi == nil {
-		t.Fatal("There is no hostinfo for my tunnel")
-	}
-	r.Log("It does")
-
-	buf := make([]byte, 1024)
-	hdr := header.H{
-		Version:        1,
-		Type:           header.CloseTunnel,
-		Subtype:        0,
-		Reserved:       0,
-		RemoteIndex:    hi.RemoteIndex,
-		MessageCounter: 5,
-	}
-	out, err := hdr.Encode(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	pkt := &udp.Packet{
-		To:   hi.CurrentRemote,
-		From: myHi.CurrentRemote,
-		Data: out,
-	}
-	r.InjectUDPPacket(myControl, theirControl, pkt)
-	r.Log("Injected bogus close tunnel. Let's see!")
-	waitStart = time.Now()
-	for {
-		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := len(theirControl.GetHostmap().Indexes)
-		if myIndexes == 0 {
-			t.Fatal("myIndexes should not be 0")
-		}
-		if theirIndexes == 0 {
-			t.Fatal("theirIndexes should not be 0, they should have rejected this bogus packet")
-		}
-
-		since := time.Since(waitStart)
-		r.Logf("my tunnels: %v; their tunnels: %v; duration: %v", myIndexes, theirIndexes, since)
-		if since > time.Second*4 {
-			t.Log("The tunnel would have been gone by now")
-			break
-		}
-
-		time.Sleep(1 * time.Second)
-		r.FlushAll()
-	}
-
-	myControl.Stop()
-	theirControl.Stop()
-}

examples/config.yml

@@ -204,12 +204,6 @@ punchy:
   # Trusted SSH CA public keys. These are the public keys of the CAs that are allowed to sign SSH keys for access.
   #trusted_cas:
     #- "ssh public key string"
-  # sandbox_dir restricts file paths for profiling commands (start-cpu-profile, save-heap-profile,
-  # save-mutex-profile) to the specified directory. Relative paths will be resolved within this directory,
-  # and absolute paths outside of it will be rejected. Default is $TMP/nebula-debug.
-  # The directory is NOT automatically created.
-  # Overriding this to "" is the same as "/" and will allow overwriting any path on the host.
-  #sandbox_dir: /var/tmp/nebula-debug
 
 # EXPERIMENTAL: relay support for networks that can't establish direct connections.
 relay:

firewall.go

@@ -230,7 +230,7 @@ func NewFirewallFromConfig(l *logrus.Logger, cs *CertState, c *config.C) (*Firew
 	case "drop":
 		fw.OutSendReject = false
 	default:
-		l.WithField("action", outboundAction).Warn("invalid firewall.outbound_action, defaulting to `drop`")
+		l.WithField("action", inboundAction).Warn("invalid firewall.outbound_action, defaulting to `drop`")
 		fw.OutSendReject = false
 	}
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/slackhq/nebula
 
-go 1.25.0
+go 1.25
 
 require (
 	dario.cat/mergo v1.0.2
@@ -13,8 +13,8 @@ require (
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.2.4
-	github.com/miekg/dns v1.1.72
+	github.com/miekg/dns v1.1.70
-	github.com/miekg/pkcs11 v1.1.2
+	github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
@@ -24,15 +24,15 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.50.0
+	golang.org/x/crypto v0.47.0
 	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
-	golang.org/x/net v0.52.0
+	golang.org/x/net v0.49.0
-	golang.org/x/sync v0.20.0
+	golang.org/x/sync v0.19.0
-	golang.org/x/sys v0.43.0
+	golang.org/x/sys v0.40.0
-	golang.org/x/term v0.42.0
+	golang.org/x/term v0.39.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
-	golang.zx2c4.com/wireguard/windows v0.6.1
+	golang.zx2c4.com/wireguard/windows v0.5.3
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe
@@ -50,7 +50,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 )

go.sum

@@ -85,10 +85,10 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
-github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
+github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b h1:J/AzCvg5z0Hn1rqZUJjpbzALUmkKX0Zwbc/i4fw7Sfk=
-github.com/miekg/pkcs11 v1.1.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@@ -164,16 +164,16 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -184,8 +184,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -193,8 +193,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -210,11 +210,11 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -225,8 +225,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -235,8 +235,8 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
-golang.zx2c4.com/wireguard/windows v0.6.1 h1:XMaKojH1Hs/raMrmnir4n35nTvzvWj7NmSYzHn2F4qU=
+golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
-golang.zx2c4.com/wireguard/windows v0.6.1/go.mod h1:04aqInu5GYuTFvMuDw/rKBAF7mHrltW/3rekpfbbZDM=
+golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

inside.go

@@ -11,7 +11,7 @@ import (
 	"github.com/slackhq/nebula/routing"
 )
 
-func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet, nb []byte, batch *sendBatch, rejectBuf []byte, q int, localCache firewall.ConntrackCache) {
+func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet, nb, out []byte, q int, localCache firewall.ConntrackCache) {
 	err := newPacket(packet, false, fwPacket)
 	if err != nil {
 		if f.l.Level >= logrus.DebugLevel {
@@ -33,7 +33,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		// routes packets from the Nebula addr to the Nebula addr through the Nebula
 		// TUN device.
 		if immediatelyForwardToSelf {
-			_, err := f.readers[q].WriteReject(packet)
+			_, err := f.readers[q].Write(packet)
 			if err != nil {
 				f.l.WithError(err).Error("Failed to forward to tun")
 			}
@@ -53,7 +53,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 	})
 
 	if hostinfo == nil {
-		f.rejectInside(packet, rejectBuf, q)
+		f.rejectInside(packet, out, q)
 		if f.l.Level >= logrus.DebugLevel {
 			f.l.WithField("vpnAddr", fwPacket.RemoteAddr).
 				WithField("fwPacket", fwPacket).
@@ -68,10 +68,10 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 
 	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
-		f.sendInsideMessage(hostinfo, packet, nb, batch, rejectBuf, q)
+		f.sendNoMetrics(header.Message, 0, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, packet, nb, out, q)
 
 	} else {
-		f.rejectInside(packet, rejectBuf, q)
+		f.rejectInside(packet, out, q)
 		if f.l.Level >= logrus.DebugLevel {
 			hostinfo.logger(f.l).
 				WithField("fwPacket", fwPacket).
@@ -81,63 +81,6 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 	}
 }
 
-// sendInsideMessage encrypts a firewall-approved inside packet into the
-// caller's batch slot for later sendmmsg flush. When hostinfo.remote is not
-// valid we fall through to the relay slow path via the unbatched sendNoMetrics
-// so relay behavior is unchanged.
-func (f *Interface) sendInsideMessage(hostinfo *HostInfo, p, nb []byte, batch *sendBatch, rejectBuf []byte, q int) {
-	ci := hostinfo.ConnectionState
-	if ci.eKey == nil {
-		return
-	}
-
-	if !hostinfo.remote.IsValid() {
-		// Slow path: relay fallback. Reuse rejectBuf as the ciphertext
-		// scratch; sendNoMetrics arranges header space for SendVia.
-		f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, p, nb, rejectBuf, q)
-		return
-	}
-
-	scratch := batch.Next()
-	if scratch == nil {
-		// Batch full: bypass batching and send this packet directly so we
-		// never drop traffic on over-subscribed iterations.
-		f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, p, nb, rejectBuf, q)
-		return
-	}
-
-	if noiseutil.EncryptLockNeeded {
-		ci.writeLock.Lock()
-	}
-	c := ci.messageCounter.Add(1)
-
-	out := header.Encode(scratch, header.Version, header.Message, 0, hostinfo.remoteIndexId, c)
-	f.connectionManager.Out(hostinfo)
-
-	if hostinfo.lastRebindCount != f.rebindCount {
-		//NOTE: there is an update hole if a tunnel isn't used and exactly 256 rebinds occur before the tunnel is
-		// finally used again. This tunnel would eventually be torn down and recreated if this action didn't help.
-		f.lightHouse.QueryServer(hostinfo.vpnAddrs[0])
-		hostinfo.lastRebindCount = f.rebindCount
-		if f.l.Level >= logrus.DebugLevel {
-			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).Debug("Lighthouse update triggered for punch due to rebind counter")
-		}
-	}
-
-	out, err := ci.eKey.EncryptDanger(out, out, p, c, nb)
-	if noiseutil.EncryptLockNeeded {
-		ci.writeLock.Unlock()
-	}
-	if err != nil {
-		hostinfo.logger(f.l).WithError(err).
-			WithField("udpAddr", hostinfo.remote).WithField("counter", c).
-			Error("Failed to encrypt outgoing packet")
-		return
-	}
-
-	batch.Commit(len(out), hostinfo.remote)
-}
-
 func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 	if !f.firewall.InSendReject {
 		return
@@ -148,7 +91,7 @@ func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 		return
 	}
 
-	_, err := f.readers[q].WriteReject(out)
+	_, err := f.readers[q].Write(out)
 	if err != nil {
 		f.l.WithError(err).Error("Failed to write to tun")
 	}

interface.go

@@ -4,8 +4,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"net/netip"
-	"sync"
+	"os"
+	"runtime"
 	"sync/atomic"
 	"time"
 
@@ -85,18 +87,7 @@ type Interface struct {
 	conntrackCacheTimeout time.Duration
 
 	writers []udp.Conn
-	readers []overlay.Queue
+	readers []io.ReadWriteCloser
-	// tunCoalescers is one tcpCoalescer per tun queue, wrapping readers[i].
-	// decryptToTun sends plaintext into the coalescer; listenOut calls its
-	// Flush at the end of each UDP recvmmsg batch.
-	tunCoalescers []*tcpCoalescer
-	wg            sync.WaitGroup
-
-	// fatalErr holds the first unexpected reader error that caused shutdown.
-	// nil means "no fatal error" (yet)
-	fatalErr atomic.Pointer[error]
-	// triggerShutdown is a function that will be run exactly once, when onFatal swaps something non-nil into fatalErr
-	triggerShutdown func()
 
 	metricHandshakes    metrics.Histogram
 	messageMetrics      *MessageMetrics
@@ -187,8 +178,7 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		routines:              c.routines,
 		version:               c.version,
 		writers:               make([]udp.Conn, c.routines),
-		readers:               make([]overlay.Queue, c.routines),
+		readers:               make([]io.ReadWriteCloser, c.routines),
-		tunCoalescers:         make([]*tcpCoalescer, c.routines),
 		myVpnNetworks:         cs.myVpnNetworks,
 		myVpnNetworksTable:    cs.myVpnNetworksTable,
 		myVpnAddrs:            cs.myVpnAddrs,
@@ -220,7 +210,7 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 // activate creates the interface on the host. After the interface is created, any
 // other services that want to bind listeners to its IP may do so successfully. However,
 // the interface isn't going to process anything until run() is called.
-func (f *Interface) activate() error {
+func (f *Interface) activate() {
 	// actually turn on tun dev
 
 	addr, err := f.outside.LocalAddr()
@@ -243,59 +233,32 @@ func (f *Interface) activate() error {
 	metrics.GetOrRegisterGauge("routines", nil).Update(int64(f.routines))
 
 	// Prepare n tun queues
-	var reader overlay.Queue = f.inside
+	var reader io.ReadWriteCloser = f.inside
 	for i := 0; i < f.routines; i++ {
 		if i > 0 {
 			reader, err = f.inside.NewMultiQueueReader()
 			if err != nil {
-				return err
+				f.l.Fatal(err)
 			}
 		}
 		f.readers[i] = reader
-		f.tunCoalescers[i] = newTCPCoalescer(reader)
 	}
 
-	f.wg.Add(1) // for us to wait on Close() to return
+	if err := f.inside.Activate(); err != nil {
-	if err = f.inside.Activate(); err != nil {
 		f.inside.Close()
-		return err
+		f.l.Fatal(err)
 	}
-
-	return nil
 }
 
-func (f *Interface) run() (func() error, error) {
+func (f *Interface) run() {
 	// Launch n queues to read packets from udp
 	for i := 0; i < f.routines; i++ {
-		f.wg.Go(func() {
+		go f.listenOut(i)
-			f.listenOut(i)
-		})
 	}
 
 	// Launch n queues to read packets from tun dev
 	for i := 0; i < f.routines; i++ {
-		f.wg.Go(func() {
+		go f.listenIn(f.readers[i], i)
-			f.listenIn(f.readers[i], i)
-		})
-	}
-
-	return func() error {
-		f.wg.Wait()
-		if e := f.fatalErr.Load(); e != nil {
-			return *e
-		}
-		return nil
-	}, nil
-}
-
-// onFatal stores the first fatal reader error, and calls triggerShutdown if it was the first one
-func (f *Interface) onFatal(err error) {
-	swapped := f.fatalErr.CompareAndSwap(nil, &err)
-	if !swapped {
-		return
-	}
-	if f.triggerShutdown != nil {
-		f.triggerShutdown()
 	}
 }
 
@@ -309,119 +272,40 @@ func (f *Interface) listenOut(i int) {
 
 	ctCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 	lhh := f.lightHouse.NewRequestHandler()
+	plaintext := make([]byte, udp.MTU)
 	h := &header.H{}
 	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)
 
-	// plaintexts is a ring of decrypt scratches, one per packet in a UDP
+	li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
-	// recvmmsg batch. The coalescer borrows payload slices from here and
+		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
-	// requires they stay valid until Flush — so we rotate each packet and
-	// reset only in the batch-end flush callback.
-	var plaintexts [][]byte
-	idx := 0
-	coalescer := f.tunCoalescers[i]
-	err := li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
-		if idx >= len(plaintexts) {
-			plaintexts = append(plaintexts, make([]byte, udp.MTU))
-		}
-		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintexts[idx][:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
-		idx++
-	}, func() {
-		if err := coalescer.Flush(); err != nil {
-			f.l.WithError(err).Error("Failed to flush tun coalescer")
-		}
-		idx = 0
 	})
-
-	if err != nil && !f.closed.Load() {
-		f.l.WithError(err).Error("Error while reading inbound packet, closing")
-		f.onFatal(err)
-	}
-
-	f.l.Infof("underlay reader %v is done", i)
 }
 
-func (f *Interface) listenIn(reader overlay.Queue, i int) {
+func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
-	rejectBuf := make([]byte, mtu)
+	runtime.LockOSThread()
-	batch := newSendBatch(sendBatchCap, udp.MTU+32)
+
+	packet := make([]byte, mtu)
+	out := make([]byte, mtu)
 	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)
 
 	conntrackCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 
 	for {
-		pkts, err := reader.Read()
+		n, err := reader.Read(packet)
 		if err != nil {
-			if !f.closed.Load() {
+			if errors.Is(err, os.ErrClosed) && f.closed.Load() {
-				f.l.WithError(err).WithField("reader", i).Error("Error while reading outbound packet, closing")
-				f.onFatal(err)
-			}
-			break
-		}
-
-		batch.Reset()
-		for _, pkt := range pkts {
-			if batch.Len() >= batch.Cap() {
-				f.flushBatch(batch, i)
-				batch.Reset()
-			}
-			f.consumeInsidePacket(pkt, fwPacket, nb, batch, rejectBuf, i, conntrackCache.Get(f.l))
-		}
-		if batch.Len() > 0 {
-			f.flushBatch(batch, i)
-		}
-	}
-
-	f.l.Infof("overlay reader %v is done", i)
-}
-
-func (f *Interface) flushBatch(batch *sendBatch, q int) {
-	//if len(batch.bufs) == 1 {
-	//	if err := f.writers[q].WriteTo(batch.bufs[0], batch.dsts[0]); err != nil {
-	//		f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing single-batch")
-	//	}
-	//	return
-	//}
-	w := f.writers[q]
-	if w.SupportsGSO() {
-		if segSize, ok := batchSegmentable(batch); ok {
-			if err := w.WriteSegmented(batch.bufs, batch.dsts[0], segSize); err != nil {
-				f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing GSO batch")
-			}
 				return
 			}
-	}
-	if err := w.WriteBatch(batch.bufs, batch.dsts); err != nil {
-		f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing batch")
-	}
-}
 
-// batchSegmentable reports whether a batch can be emitted as a single UDP GSO
+			f.l.WithError(err).Error("Error while reading outbound packet")
-// superpacket: all packets go to the same destination, and every packet
+			// This only seems to happen when something fatal happens to the fd, so exit.
-// except possibly the last has the same length. Returns the segment size on
+			os.Exit(2)
-// success. The single-packet case is handled in flushBatch before this runs.
-func batchSegmentable(b *sendBatch) (int, bool) {
-	segSize := len(b.bufs[0])
-	if segSize == 0 {
-		return 0, false
 		}
-	dst := b.dsts[0]
+
-	last := len(b.bufs) - 1
+		f.consumeInsidePacket(packet[:n], fwPacket, nb, out, i, conntrackCache.Get(f.l))
-	for i := 1; i <= last; i++ {
-		if b.dsts[i] != dst {
-			return 0, false
 	}
-		if i < last {
-			if len(b.bufs[i]) != segSize {
-				return 0, false
-			}
-		} else {
-			if len(b.bufs[i]) == 0 || len(b.bufs[i]) > segSize {
-				return 0, false
-			}
-		}
-	}
-	return segSize, true
 }
 
 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
@@ -596,19 +480,23 @@ func (f *Interface) GetCertState() *CertState {
 }
 
 func (f *Interface) Close() error {
-	var err error
 	f.closed.Store(true)
 
-	// Release the udp readers
+	for _, u := range f.writers {
-	for i, u := range f.writers {
+		err := u.Close()
-		err = u.Close()
 		if err != nil {
-			f.l.WithError(err).WithField("writer", i).Error("Error while closing udp socket")
+			f.l.WithError(err).Error("Error while closing udp socket")
+		}
+	}
+	for i, r := range f.readers {
+		if i == 0 {
+			continue // f.readers[0] is f.inside, which we want to save for last
+		}
+		if err := r.Close(); err != nil {
+			f.l.WithError(err).Error("Error while closing tun reader")
 		}
 	}
 
-	// Release the tun device (closing the tun also closes all readers)
+	// Release the tun device
-	err = f.inside.Close()
+	return f.inside.Close()
-	f.wg.Done()
-	return err
 }

main.go

@@ -288,15 +288,15 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 	}
 
 	return &Control{
-		f:                      ifce,
+		ifce,
-		l:                      l,
+		l,
-		ctx:                    ctx,
+		ctx,
-		cancel:                 cancel,
+		cancel,
-		sshStart:               sshStart,
+		sshStart,
-		statsStart:             statsStart,
+		statsStart,
-		dnsStart:               dnsStart,
+		dnsStart,
-		lighthouseStart:        lightHouse.StartUpdateWorker,
+		lightHouse.StartUpdateWorker,
-		connectionManagerStart: connManager.Start,
+		connManager.Start,
 	}, nil
 }
 

outside.go

@@ -190,13 +190,6 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 		if !f.handleEncrypted(ci, via, h) {
 			return
 		}
-		_, err = f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
-		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("from", via).
-				WithField("packet", packet).
-				Error("Failed to decrypt CloseTunnel packet")
-			return
-		}
 
 		hostinfo.logger(f.l).WithField("from", via).
 			Info("Close tunnel received, tearing down.")
@@ -535,7 +528,7 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 	}
 
 	f.connectionManager.In(hostinfo)
-	err = f.tunCoalescers[q].Add(out)
+	_, err = f.readers[q].Write(out)
 	if err != nil {
 		f.l.WithError(err).Error("Failed to write to tun")
 	}

overlay/device.go

@@ -7,63 +7,12 @@ import (
 	"github.com/slackhq/nebula/routing"
 )
 
-// defaultBatchBufSize is the per-Queue scratch size for Read on backends
-// that don't do TSO segmentation. 65535 covers any single IP packet.
-const defaultBatchBufSize = 65535
-
-// Queue is a readable/writable tun queue. One Queue is driven by a single
-// read goroutine plus concurrent writers (see Write / WriteReject below).
-type Queue interface {
-	io.Closer
-
-	// Read returns one or more packets. The returned slices are borrowed
-	// from the Queue's internal buffer and are only valid until the next
-	// Read or Close on this Queue — callers must encrypt or copy each
-	// slice before the next call. Not safe for concurrent Reads; exactly
-	// one goroutine per Queue reads.
-	Read() ([][]byte, error)
-
-	// Write emits a single packet on the plaintext (outside→inside)
-	// delivery path. May run concurrently with WriteReject on the same
-	// Queue, but not with itself.
-	Write(p []byte) (int, error)
-
-	// WriteReject writes a single packet that originated from the inside
-	// path (reject replies or self-forward) using scratch state distinct
-	// from Write, so it can run concurrently with Write on the same Queue
-	// without a data race. On backends without a shared-scratch Write, a
-	// trivial delegation to Write is acceptable.
-	WriteReject(p []byte) (int, error)
-}
-
 type Device interface {
-	Queue
+	io.ReadWriteCloser
 	Activate() error
 	Networks() []netip.Prefix
 	Name() string
 	RoutesFor(netip.Addr) routing.Gateways
 	SupportsMultiqueue() bool
-	NewMultiQueueReader() (Queue, error)
+	NewMultiQueueReader() (io.ReadWriteCloser, error)
-}
-
-// GSOWriter is implemented by Queues that can emit a TCP TSO superpacket
-// assembled from a header prefix plus one or more borrowed payload
-// fragments, in a single vectored write (writev with a leading
-// virtio_net_hdr). This lets the coalescer avoid copying payload bytes
-// between the caller's decrypt buffer and the TUN. Backends without GSO
-// support return false from GSOSupported and coalescing is skipped.
-//
-// hdr contains the IPv4/IPv6 + TCP header prefix (mutable — callers will
-// have filled in total length and pseudo-header partial). pays are
-// non-overlapping payload fragments whose concatenation is the full
-// superpacket payload; they are read-only from the writer's perspective
-// and must remain valid until the call returns. gsoSize is the MSS:
-// every segment except possibly the last is exactly that many bytes.
-// csumStart is the byte offset where the TCP header begins within hdr.
-//
-// hdr's TCP checksum field must already hold the pseudo-header partial
-// sum (single-fold, not inverted), per virtio NEEDS_CSUM semantics.
-type GSOWriter interface {
-	WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error
-	GSOSupported() bool
 }

overlay/tun_android.go

@@ -18,39 +18,12 @@ import (
 )
 
 type tun struct {
-	rwc         io.ReadWriteCloser
+	io.ReadWriteCloser
 	fd          int
 	vpnNetworks []netip.Prefix
 	Routes      atomic.Pointer[[]Route]
 	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
 	l           *logrus.Logger
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (t *tun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.rwc.Read(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) Write(p []byte) (int, error) {
-	return t.rwc.Write(p)
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.rwc.Write(p)
-}
-
-func (t *tun) Close() error {
-	return t.rwc.Close()
 }
 
 func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
@@ -59,7 +32,7 @@ func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []net
 	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
 
 	t := &tun{
-		rwc:         file,
+		ReadWriteCloser: file,
 		fd:              deviceFd,
 		vpnNetworks:     vpnNetworks,
 		l:               l,
@@ -126,6 +99,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for android")
 }

overlay/tun_darwin.go

@@ -23,7 +23,7 @@ import (
 )
 
 type tun struct {
-	rwc         io.ReadWriteCloser
+	io.ReadWriteCloser
 	Device      string
 	vpnNetworks []netip.Prefix
 	DefaultMTU  int
@@ -34,9 +34,6 @@ type tun struct {
 
 	// cache out buffer since we need to prepend 4 bytes for tun metadata
 	out []byte
-
-	readBuf  []byte
-	batchRet [1][]byte
 }
 
 type ifReq struct {
@@ -127,7 +124,7 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 	}
 
 	t := &tun{
-		rwc:         os.NewFile(uintptr(fd), ""),
+		ReadWriteCloser: os.NewFile(uintptr(fd), ""),
 		Device:          name,
 		vpnNetworks:     vpnNetworks,
 		DefaultMTU:      c.GetInt("tun.mtu", DefaultMTU),
@@ -161,8 +158,8 @@ func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*tun,
 }
 
 func (t *tun) Close() error {
-	if t.rwc != nil {
+	if t.ReadWriteCloser != nil {
-		return t.rwc.Close()
+		return t.ReadWriteCloser.Close()
 	}
 	return nil
 }
@@ -506,31 +503,15 @@ func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 	return nil
 }
 
-func (t *tun) readOne(to []byte) (int, error) {
+func (t *tun) Read(to []byte) (int, error) {
 	buf := make([]byte, len(to)+4)
 
-	n, err := t.rwc.Read(buf)
+	n, err := t.ReadWriteCloser.Read(buf)
 
 	copy(to, buf[4:])
 	return n - 4, err
 }
 
-func (t *tun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.readOne(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
-}
-
 // Write is only valid for single threaded use
 func (t *tun) Write(from []byte) (int, error) {
 	buf := t.out
@@ -556,7 +537,7 @@ func (t *tun) Write(from []byte) (int, error) {
 
 	copy(buf[4:], from)
 
-	n, err := t.rwc.Write(buf)
+	n, err := t.ReadWriteCloser.Write(buf)
 	return n - 4, err
 }
 
@@ -572,6 +553,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for darwin")
 }

overlay/tun_disabled.go

@@ -20,23 +20,6 @@ type disabledTun struct {
 	tx metrics.Counter
 	rx metrics.Counter
 	l  *logrus.Logger
-
-	batchRet [1][]byte
-}
-
-func (t *disabledTun) Read() ([][]byte, error) {
-	r, ok := <-t.read
-	if !ok {
-		return nil, io.EOF
-	}
-
-	t.tx.Inc(1)
-	if t.l.Level >= logrus.DebugLevel {
-		t.l.WithField("raw", prettyPacket(r)).Debugf("Write payload")
-	}
-
-	t.batchRet[0] = r
-	return t.batchRet[:], nil
 }
 
 func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled bool, l *logrus.Logger) *disabledTun {
@@ -73,6 +56,24 @@ func (*disabledTun) Name() string {
 	return "disabled"
 }
 
+func (t *disabledTun) Read(b []byte) (int, error) {
+	r, ok := <-t.read
+	if !ok {
+		return 0, io.EOF
+	}
+
+	if len(r) > len(b) {
+		return 0, fmt.Errorf("packet larger than mtu: %d > %d bytes", len(r), len(b))
+	}
+
+	t.tx.Inc(1)
+	if t.l.Level >= logrus.DebugLevel {
+		t.l.WithField("raw", prettyPacket(r)).Debugf("Write payload")
+	}
+
+	return copy(b, r), nil
+}
+
 func (t *disabledTun) handleICMPEchoRequest(b []byte) bool {
 	out := make([]byte, len(b))
 	out = iputil.CreateICMPEchoResponse(b, out)
@@ -104,15 +105,11 @@ func (t *disabledTun) Write(b []byte) (int, error) {
 	return len(b), nil
 }
 
-func (t *disabledTun) WriteReject(b []byte) (int, error) {
-	return t.Write(b)
-}
-
 func (t *disabledTun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *disabledTun) NewMultiQueueReader() (Queue, error) {
+func (t *disabledTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return t, nil
 }
 

overlay/tun_freebsd.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
 	"net/netip"
 	"sync/atomic"
@@ -93,28 +94,9 @@ type tun struct {
 	linkAddr    *netroute.LinkAddr
 	l           *logrus.Logger
 	devFd       int
-
-	readBuf  []byte
-	batchRet [1][]byte
 }
 
-func (t *tun) Read() ([][]byte, error) {
+func (t *tun) Read(to []byte) (int, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.readOne(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
-}
-
-func (t *tun) readOne(to []byte) (int, error) {
 	// use readv() to read from the tunnel device, to eliminate the need for copying the buffer
 	if t.devFd < 0 {
 		return -1, syscall.EINVAL
@@ -472,7 +454,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for freebsd")
 }
 

overlay/tun_ios.go

@@ -21,38 +21,11 @@ import (
 )
 
 type tun struct {
-	rwc         io.ReadWriteCloser
+	io.ReadWriteCloser
 	vpnNetworks []netip.Prefix
 	Routes      atomic.Pointer[[]Route]
 	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
 	l           *logrus.Logger
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (t *tun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.rwc.Read(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) Write(p []byte) (int, error) {
-	return t.rwc.Write(p)
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.rwc.Write(p)
-}
-
-func (t *tun) Close() error {
-	return t.rwc.Close()
 }
 
 func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ bool) (*tun, error) {
@@ -63,7 +36,7 @@ func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []net
 	file := os.NewFile(uintptr(deviceFd), "/dev/tun")
 	t := &tun{
 		vpnNetworks:     vpnNetworks,
-		rwc:         &tunReadCloser{f: file},
+		ReadWriteCloser: &tunReadCloser{f: file},
 		l:               l,
 	}
 
@@ -182,6 +155,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for ios")
 }

overlay/tun_linux.go

@@ -4,17 +4,14 @@
 package overlay
 
 import (
-	"encoding/binary"
 	"fmt"
 	"io"
 	"net"
 	"net/netip"
 	"os"
-	"runtime"
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 	"unsafe"
 
@@ -27,450 +24,9 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// tunFile wraps a TUN file descriptor with poll-based reads. The FD provided will be changed to non-blocking.
-// A shared eventfd allows Close to wake all readers blocked in poll.
-type tunFile struct {
-	fd         int
-	shutdownFd int
-	lastOne    bool
-	readPoll   [2]unix.PollFd
-	writePoll  [2]unix.PollFd
-	closed     bool
-
-	// vnetHdr is true when this fd was opened with IFF_VNET_HDR and the
-	// kernel successfully accepted TUNSETOFFLOAD. Reads include a leading
-	// virtio_net_hdr and may carry a TSO superpacket we must segment;
-	// writes must prepend a zeroed virtio_net_hdr.
-	vnetHdr   bool
-	readBuf   []byte        // scratch for a single raw read (virtio hdr + superpacket)
-	segBuf    []byte        // backing store for segmented output
-	segOff    int           // cursor into segBuf for the current Read drain
-	pending   [][]byte      // segments returned from the most recent Read
-	writeIovs [2]unix.Iovec // preallocated iovecs for Write (coalescer passthrough); iovs[0] is fixed to validVnetHdr
-	// rejectIovs is a second preallocated iovec scratch used exclusively by
-	// WriteReject (reject + self-forward from the inside path). It mirrors
-	// writeIovs but lets listenIn goroutines emit reject packets without
-	// racing with the listenOut coalescer that owns writeIovs.
-	rejectIovs [2]unix.Iovec
-
-	// gsoHdrBuf is a per-queue 10-byte scratch for the virtio_net_hdr emitted
-	// by WriteGSO. Separate from validVnetHdr so a concurrent non-GSO Write on
-	// another queue never observes a half-written header.
-	gsoHdrBuf [virtioNetHdrLen]byte
-	// gsoIovs is the writev iovec scratch for WriteGSO. Sized to hold the
-	// virtio header + IP/TCP header + up to gsoInitialPayIovs payload
-	// fragments; grown on demand if a coalescer pushes more.
-	gsoIovs []unix.Iovec
-}
-
-// gsoInitialPayIovs is the starting capacity (in payload fragments) of
-// tunFile.gsoIovs. Sized to cover the default coalesce segment cap without
-// any reallocations.
-const gsoInitialPayIovs = 66
-
-// validVnetHdr is the 10-byte virtio_net_hdr we prepend to every non-GSO TUN
-// write. Only flag set is VIRTIO_NET_HDR_F_DATA_VALID, which marks the skb
-// CHECKSUM_UNNECESSARY so the receiving network stack skips L4 checksum
-// verification. All packets that reach the plain Write / WriteReject paths
-// already carry a valid L4 checksum (either supplied by a remote peer whose
-// ciphertext we AEAD-authenticated, or produced by finishChecksum during TSO
-// segmentation, or built locally by CreateRejectPacket), so trusting them is
-// safe.
-var validVnetHdr = [virtioNetHdrLen]byte{unix.VIRTIO_NET_HDR_F_DATA_VALID}
-
-// newFriend makes a tunFile for a MultiQueueReader that copies the shutdown eventfd from the parent tun
-func (r *tunFile) newFriend(fd int) (*tunFile, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
-	}
-	out := &tunFile{
-		fd:         fd,
-		shutdownFd: r.shutdownFd,
-		vnetHdr:    r.vnetHdr,
-		readBuf:    make([]byte, tunReadBufSize),
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
-		},
-	}
-	if r.vnetHdr {
-		out.segBuf = make([]byte, tunSegBufCap)
-		out.writeIovs[0].Base = &validVnetHdr[0]
-		out.writeIovs[0].SetLen(virtioNetHdrLen)
-		out.rejectIovs[0].Base = &validVnetHdr[0]
-		out.rejectIovs[0].SetLen(virtioNetHdrLen)
-		out.gsoIovs = make([]unix.Iovec, 2, 2+gsoInitialPayIovs)
-		out.gsoIovs[0].Base = &out.gsoHdrBuf[0]
-		out.gsoIovs[0].SetLen(virtioNetHdrLen)
-	}
-	return out, nil
-}
-
-func newTunFd(fd int, vnetHdr bool) (*tunFile, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
-	}
-
-	shutdownFd, err := unix.Eventfd(0, unix.EFD_NONBLOCK|unix.EFD_CLOEXEC)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create eventfd: %w", err)
-	}
-
-	out := &tunFile{
-		fd:         fd,
-		shutdownFd: shutdownFd,
-		lastOne:    true,
-		vnetHdr:    vnetHdr,
-		readBuf:    make([]byte, tunReadBufSize),
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-	}
-	if vnetHdr {
-		out.segBuf = make([]byte, tunSegBufCap)
-		out.writeIovs[0].Base = &validVnetHdr[0]
-		out.writeIovs[0].SetLen(virtioNetHdrLen)
-		out.rejectIovs[0].Base = &validVnetHdr[0]
-		out.rejectIovs[0].SetLen(virtioNetHdrLen)
-		out.gsoIovs = make([]unix.Iovec, 2, 2+gsoInitialPayIovs)
-		out.gsoIovs[0].Base = &out.gsoHdrBuf[0]
-		out.gsoIovs[0].SetLen(virtioNetHdrLen)
-	}
-
-	return out, nil
-}
-
-func (r *tunFile) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.readPoll[0].Revents
-	shutdownEvents := r.readPoll[1].Revents
-	r.readPoll[0].Revents = 0
-	r.readPoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *tunFile) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.writePoll[0].Revents
-	shutdownEvents := r.writePoll[1].Revents
-	r.writePoll[0].Revents = 0
-	r.writePoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *tunFile) readRaw(buf []byte) (int, error) {
-	for {
-		if n, err := unix.Read(r.fd, buf); err == nil {
-			return n, nil
-		} else if err == unix.EAGAIN {
-			if err = r.blockOnRead(); err != nil {
-				return 0, err
-			}
-			continue
-		} else {
-			return 0, err
-		}
-	}
-}
-
-// Read reads one or more superpackets from the tun and returns the
-// resulting packets. The first read blocks via poll; once the fd is known
-// readable we drain additional packets non-blocking until the kernel queue
-// is empty (EAGAIN), we've collected tunDrainCap packets, or we're out of
-// segBuf headroom. This amortizes the poll wake over bursts of small
-// packets (e.g. TCP ACKs). Slices point into the tunFile's internal buffers
-// and are only valid until the next Read or Close on this Queue.
-func (r *tunFile) Read() ([][]byte, error) {
-	r.pending = r.pending[:0]
-	r.segOff = 0
-
-	// Initial (blocking) read. Retry on decode errors so a single bad
-	// packet does not stall the reader.
-	for {
-		n, err := r.readRaw(r.readBuf)
-		if err != nil {
-			return nil, err
-		}
-		if !r.vnetHdr {
-			r.pending = append(r.pending, r.readBuf[:n])
-			// Non-vnetHdr mode shares one readBuf so we can't drain safely
-			// without copying; return the single packet as before.
-			return r.pending, nil
-		}
-		if err := r.decodeRead(n); err != nil {
-			// Drop and read again — a bad packet should not kill the reader.
-			continue
-		}
-		break
-	}
-
-	// Drain: non-blocking reads until the kernel queue is empty, the drain
-	// cap is reached, or segBuf no longer has room for another worst-case
-	// superpacket.
-	for len(r.pending) < tunDrainCap && tunSegBufCap-r.segOff >= tunSegBufSize {
-		n, err := unix.Read(r.fd, r.readBuf)
-		if err != nil {
-			// EAGAIN / EINTR / anything else: stop draining. We already
-			// have a valid batch from the first read.
-			break
-		}
-		if n <= 0 {
-			break
-		}
-		if err := r.decodeRead(n); err != nil {
-			// Drop this packet and stop the drain; we'd rather hand off
-			// what we have than keep spinning here.
-			break
-		}
-	}
-
-	return r.pending, nil
-}
-
-// decodeRead decodes the virtio header plus payload in r.readBuf[:n], appends
-// the segments to r.pending, and advances r.segOff by the total scratch used.
-// Caller must have already ensured r.vnetHdr is true.
-func (r *tunFile) decodeRead(n int) error {
-	if n < virtioNetHdrLen {
-		return fmt.Errorf("short tun read: %d < %d", n, virtioNetHdrLen)
-	}
-	var hdr virtioNetHdr
-	hdr.decode(r.readBuf[:virtioNetHdrLen])
-	before := len(r.pending)
-	if err := segmentInto(r.readBuf[virtioNetHdrLen:n], hdr, &r.pending, r.segBuf[r.segOff:]); err != nil {
-		return err
-	}
-	for k := before; k < len(r.pending); k++ {
-		r.segOff += len(r.pending[k])
-	}
-	return nil
-}
-
-func (r *tunFile) Write(buf []byte) (int, error) {
-	return r.writeWithScratch(buf, &r.writeIovs)
-}
-
-// WriteReject emits a packet using a dedicated iovec scratch (rejectIovs)
-// distinct from the one used by the coalescer's Write path. This avoids a
-// data race between the inside (listenIn) goroutine emitting reject or
-// self-forward packets and the outside (listenOut) goroutine flushing TCP
-// coalescer passthroughs on the same tunFile.
-func (r *tunFile) WriteReject(buf []byte) (int, error) {
-	return r.writeWithScratch(buf, &r.rejectIovs)
-}
-
-func (r *tunFile) writeWithScratch(buf []byte, iovs *[2]unix.Iovec) (int, error) {
-	if !r.vnetHdr {
-		for {
-			if n, err := unix.Write(r.fd, buf); err == nil {
-				return n, nil
-			} else if err == unix.EAGAIN {
-				if err = r.blockOnWrite(); err != nil {
-					return 0, err
-				}
-				continue
-			} else if err == unix.EINTR {
-				continue
-			} else {
-				return 0, err
-			}
-		}
-	}
-
-	if len(buf) == 0 {
-		return 0, nil
-	}
-	// Point the payload iovec at the caller's buffer. iovs[0] is pre-wired
-	// to validVnetHdr during tunFile construction so we don't rebuild it here.
-	iovs[1].Base = &buf[0]
-	iovs[1].SetLen(len(buf))
-	iovPtr := uintptr(unsafe.Pointer(&iovs[0]))
-	// The TUN fd is non-blocking (set in newTunFd / newFriend), so writev
-	// either completes promptly or returns EAGAIN — it cannot park the
-	// goroutine inside the kernel. That lets us use syscall.RawSyscall and
-	// skip the runtime.entersyscall / exitsyscall bookkeeping on every
-	// packet; we only pay that cost when we fall through to blockOnWrite.
-	for {
-		n, _, errno := syscall.RawSyscall(unix.SYS_WRITEV, uintptr(r.fd), iovPtr, 2)
-		if errno == 0 {
-			runtime.KeepAlive(buf)
-			if int(n) < virtioNetHdrLen {
-				return 0, io.ErrShortWrite
-			}
-			return int(n) - virtioNetHdrLen, nil
-		}
-		if errno == unix.EAGAIN {
-			runtime.KeepAlive(buf)
-			if err := r.blockOnWrite(); err != nil {
-				return 0, err
-			}
-			continue
-		}
-		if errno == unix.EINTR {
-			continue
-		}
-		runtime.KeepAlive(buf)
-		return 0, errno
-	}
-}
-
-// GSOSupported reports whether this queue was opened with IFF_VNET_HDR and
-// can accept WriteGSO. When false, callers should fall back to per-segment
-// Write calls.
-func (r *tunFile) GSOSupported() bool { return r.vnetHdr }
-
-// WriteGSO emits a TCP TSO superpacket in a single writev. hdr is the
-// IPv4/IPv6 + TCP header prefix (already finalized — total length, IP csum,
-// and TCP pseudo-header partial set by the caller). pays are payload
-// fragments whose concatenation forms the full coalesced payload; each
-// slice is read-only and must stay valid until return. gsoSize is the MSS;
-// every segment except possibly the last is exactly gsoSize bytes.
-// csumStart is the byte offset where the TCP header begins within hdr.
-func (r *tunFile) WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error {
-	if !r.vnetHdr {
-		return fmt.Errorf("WriteGSO called on tun without IFF_VNET_HDR")
-	}
-	if len(hdr) == 0 || len(pays) == 0 {
-		return nil
-	}
-
-	// Build the virtio_net_hdr. When pays total to <= gsoSize the kernel
-	// would produce a single segment; keep NEEDS_CSUM semantics but skip
-	// the GSO type so the kernel doesn't spuriously mark this as TSO.
-	vhdr := virtioNetHdr{
-		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-		HdrLen:     uint16(len(hdr)),
-		GSOSize:    gsoSize,
-		CsumStart:  csumStart,
-		CsumOffset: 16, // TCP checksum field lives 16 bytes into the TCP header
-	}
-	var totalPay int
-	for _, p := range pays {
-		totalPay += len(p)
-	}
-	if totalPay > int(gsoSize) {
-		if isV6 {
-			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV6
-		} else {
-			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV4
-		}
-	} else {
-		vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_NONE
-		vhdr.GSOSize = 0
-	}
-	vhdr.encode(r.gsoHdrBuf[:])
-
-	// Build the iovec array: [virtio_hdr, hdr, pays...]. r.gsoIovs[0] is
-	// wired to gsoHdrBuf at construction and never changes.
-	need := 2 + len(pays)
-	if cap(r.gsoIovs) < need {
-		grown := make([]unix.Iovec, need)
-		grown[0] = r.gsoIovs[0]
-		r.gsoIovs = grown
-	} else {
-		r.gsoIovs = r.gsoIovs[:need]
-	}
-	r.gsoIovs[1].Base = &hdr[0]
-	r.gsoIovs[1].SetLen(len(hdr))
-	for i, p := range pays {
-		r.gsoIovs[2+i].Base = &p[0]
-		r.gsoIovs[2+i].SetLen(len(p))
-	}
-
-	iovPtr := uintptr(unsafe.Pointer(&r.gsoIovs[0]))
-	iovCnt := uintptr(len(r.gsoIovs))
-	for {
-		n, _, errno := syscall.RawSyscall(unix.SYS_WRITEV, uintptr(r.fd), iovPtr, iovCnt)
-		if errno == 0 {
-			runtime.KeepAlive(hdr)
-			runtime.KeepAlive(pays)
-			if int(n) < virtioNetHdrLen {
-				return io.ErrShortWrite
-			}
-			return nil
-		}
-		if errno == unix.EAGAIN {
-			runtime.KeepAlive(hdr)
-			runtime.KeepAlive(pays)
-			if err := r.blockOnWrite(); err != nil {
-				return err
-			}
-			continue
-		}
-		if errno == unix.EINTR {
-			continue
-		}
-		runtime.KeepAlive(hdr)
-		runtime.KeepAlive(pays)
-		return errno
-	}
-}
-
-func (r *tunFile) wakeForShutdown() error {
-	var buf [8]byte
-	binary.NativeEndian.PutUint64(buf[:], 1)
-	_, err := unix.Write(int(r.readPoll[1].Fd), buf[:])
-	return err
-}
-
-func (r *tunFile) Close() error {
-	if r.closed { // avoid closing more than once. Technically a fd could get re-used, which would be a problem
-		return nil
-	}
-	r.closed = true
-	if r.lastOne {
-		_ = unix.Close(r.shutdownFd)
-	}
-	return unix.Close(r.fd)
-}
-
 type tun struct {
-	*tunFile
+	io.ReadWriteCloser
-	readers     []*tunFile
+	fd          int
-	closeLock   sync.Mutex
 	Device      string
 	vpnNetworks []netip.Prefix
 	MaxMTU      int
@@ -516,9 +72,9 @@ type ifreqQLEN struct {
 }
 
 func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
-	// We don't know what flags the caller opened this fd with and can't turn
+	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
-	// on IFF_VNET_HDR after TUNSETIFF, so skip offload on inherited fds.
+
-	t, err := newTunGeneric(c, l, deviceFd, false, vpnNetworks)
+	t, err := newTunGeneric(c, l, file, vpnNetworks)
 	if err != nil {
 		return nil, err
 	}
@@ -528,83 +84,46 @@ func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []net
 	return t, nil
 }
 
-// openTunDev opens /dev/net/tun, creating the device node first if it's
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
-// missing (docker containers occasionally omit it).
-func openTunDev() (int, error) {
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
-	if err == nil {
+	if err != nil {
-		return fd, nil
+		// If /dev/net/tun doesn't exist, try to create it (will happen in docker)
+		if os.IsNotExist(err) {
+			err = os.MkdirAll("/dev/net", 0755)
+			if err != nil {
+				return nil, fmt.Errorf("/dev/net/tun doesn't exist, failed to mkdir -p /dev/net: %w", err)
 			}
-	if !os.IsNotExist(err) {
+			err = unix.Mknod("/dev/net/tun", unix.S_IFCHR|0600, int(unix.Mkdev(10, 200)))
-		return -1, err
+			if err != nil {
-	}
+				return nil, fmt.Errorf("failed to create /dev/net/tun: %w", err)
-	if err = os.MkdirAll("/dev/net", 0755); err != nil {
-		return -1, fmt.Errorf("/dev/net/tun doesn't exist, failed to mkdir -p /dev/net: %w", err)
-	}
-	if err = unix.Mknod("/dev/net/tun", unix.S_IFCHR|0600, int(unix.Mkdev(10, 200))); err != nil {
-		return -1, fmt.Errorf("failed to create /dev/net/tun: %w", err)
 			}
+
 			fd, err = unix.Open("/dev/net/tun", os.O_RDWR, 0)
 			if err != nil {
-		return -1, fmt.Errorf("created /dev/net/tun, but still failed: %w", err)
+				return nil, fmt.Errorf("created /dev/net/tun, but still failed: %w", err)
+			}
+		} else {
+			return nil, err
+		}
 	}
-	return fd, nil
-}
 
-// tunSetIff runs TUNSETIFF with the given flags and returns the kernel-chosen
-// device name on success.
-func tunSetIff(fd int, name string, flags uint16) (string, error) {
 	var req ifReq
-	req.Flags = flags
+	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI)
-	copy(req.Name[:], name)
-	if err := ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		return "", err
-	}
-	return strings.Trim(string(req.Name[:]), "\x00"), nil
-}
-
-// tsoOffloadFlags are the TUN_F_* bits we ask the kernel to enable when a
-// TSO-capable TUN is available. CSUM is required as a prerequisite for TSO.
-const tsoOffloadFlags = unix.TUN_F_CSUM | unix.TUN_F_TSO4 | unix.TUN_F_TSO6
-
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
-	baseFlags := uint16(unix.IFF_TUN | unix.IFF_NO_PI)
 	if multiqueue {
-		baseFlags |= unix.IFF_MULTI_QUEUE
+		req.Flags |= unix.IFF_MULTI_QUEUE
 	}
 	nameStr := c.GetString("tun.dev", "")
+	copy(req.Name[:], nameStr)
+	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
+		return nil, &NameError{
+			Name:       nameStr,
+			Underlying: err,
+		}
+	}
+	name := strings.Trim(string(req.Name[:]), "\x00")
 
-	// First try to open with IFF_VNET_HDR + TUNSETOFFLOAD so we can receive
+	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-	// TSO superpackets. If either step fails (older kernel, unprivileged
+	t, err := newTunGeneric(c, l, file, vpnNetworks)
-	// container, etc.) we close and fall back to a plain TUN.
-	fd, err := openTunDev()
-	if err != nil {
-		return nil, err
-	}
-	vnetHdr := true
-	name, err := tunSetIff(fd, nameStr, baseFlags|unix.IFF_VNET_HDR|unix.IFF_NAPI)
-	if err != nil {
-		_ = unix.Close(fd)
-		vnetHdr = false
-	} else if err = ioctl(uintptr(fd), unix.TUNSETOFFLOAD, uintptr(tsoOffloadFlags)); err != nil {
-		l.WithError(err).Warn("Failed to enable TUN offload (TSO); proceeding without virtio headers")
-		_ = unix.Close(fd)
-		vnetHdr = false
-	}
-
-	if !vnetHdr {
-		fd, err = openTunDev()
-		if err != nil {
-			return nil, err
-		}
-		name, err = tunSetIff(fd, nameStr, baseFlags)
-		if err != nil {
-			_ = unix.Close(fd)
-			return nil, &NameError{Name: nameStr, Underlying: err}
-		}
-	}
-
-	t, err := newTunGeneric(c, l, fd, vnetHdr, vpnNetworks)
 	if err != nil {
 		return nil, err
 	}
@@ -614,17 +133,10 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueu
 	return t, nil
 }
 
-// newTunGeneric does all the stuff common to different tun initialization paths. It will close your files on error.
+func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []netip.Prefix) (*tun, error) {
-func newTunGeneric(c *config.C, l *logrus.Logger, fd int, vnetHdr bool, vpnNetworks []netip.Prefix) (*tun, error) {
-	tfd, err := newTunFd(fd, vnetHdr)
-	if err != nil {
-		_ = unix.Close(fd)
-		return nil, err
-	}
 	t := &tun{
-		tunFile:                   tfd,
+		ReadWriteCloser:           file,
-		readers:                   []*tunFile{tfd},
+		fd:                        int(file.Fd()),
-		closeLock:                 sync.Mutex{},
 		vpnNetworks:               vpnNetworks,
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
@@ -633,8 +145,8 @@ func newTunGeneric(c *config.C, l *logrus.Logger, fd int, vnetHdr bool, vpnNetwo
 		l:                         l,
 	}
 
-	if err = t.reload(c, true); err != nil {
+	err := t.reload(c, true)
-		_ = t.Close()
+	if err != nil {
 		return nil, err
 	}
 
@@ -726,40 +238,22 @@ func (t *tun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	t.closeLock.Lock()
-	defer t.closeLock.Unlock()
-
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
 		return nil, err
 	}
 
-	flags := uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
+	var req ifReq
-	if t.vnetHdr {
+	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
-		flags |= unix.IFF_VNET_HDR | unix.IFF_NAPI
+	copy(req.Name[:], t.Device)
-	}
+	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-	if _, err = tunSetIff(fd, t.Device, flags); err != nil {
-		_ = unix.Close(fd)
 		return nil, err
 	}
 
-	if t.vnetHdr {
+	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-		if err = ioctl(uintptr(fd), unix.TUNSETOFFLOAD, uintptr(tsoOffloadFlags)); err != nil {
-			_ = unix.Close(fd)
-			return nil, fmt.Errorf("failed to enable offload on multiqueue tun fd: %w", err)
-		}
-	}
 
-	out, err := t.tunFile.newFriend(fd)
+	return file, nil
-	if err != nil {
-		_ = unix.Close(fd)
-		return nil, err
-	}
-
-	t.readers = append(t.readers, out)
-
-	return out, nil
 }
 
 func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
@@ -767,6 +261,29 @@ func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
 	return r
 }
 
+func (t *tun) Write(b []byte) (int, error) {
+	var nn int
+	maximum := len(b)
+
+	for {
+		n, err := unix.Write(t.fd, b[nn:maximum])
+		if n > 0 {
+			nn += n
+		}
+		if nn == len(b) {
+			return nn, err
+		}
+
+		if err != nil {
+			return nn, err
+		}
+
+		if n == 0 {
+			return nn, io.ErrUnexpectedEOF
+		}
+	}
+}
+
 func (t *tun) deviceBytes() (o [16]byte) {
 	for i, c := range t.Device {
 		o[i] = byte(c)
@@ -1190,40 +707,18 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 }
 
 func (t *tun) Close() error {
-	t.closeLock.Lock()
-	defer t.closeLock.Unlock()
-
 	if t.routeChan != nil {
 		close(t.routeChan)
-		t.routeChan = nil
 	}
 
-	// Signal all readers blocked in poll to wake up and exit
+	if t.ReadWriteCloser != nil {
-	_ = t.tunFile.wakeForShutdown()
+		_ = t.ReadWriteCloser.Close()
+	}
 
 	if t.ioctlFd > 0 {
-		_ = unix.Close(int(t.ioctlFd))
+		_ = os.NewFile(t.ioctlFd, "ioctlFd").Close()
 		t.ioctlFd = 0
 	}
 
-	for i := range t.readers {
+	return nil
-		if i == 0 {
-			continue //we want to close the zeroth reader last
-		}
-		err := t.readers[i].Close()
-		if err != nil {
-			t.l.WithField("reader", i).WithError(err).Error("error closing tun reader")
-		} else {
-			t.l.WithField("reader", i).Info("closed tun reader")
-		}
-	}
-
-	//this is t.readers[0] too
-	err := t.tunFile.Close()
-	if err != nil {
-		t.l.WithField("reader", 0).WithError(err).Error("error closing tun reader")
-	} else {
-		t.l.WithField("reader", 0).Info("closed tun reader")
-	}
-	return err
 }

overlay/tun_linux_offload.go

@@ -1,331 +0,0 @@
-//go:build linux && !android && !e2e_testing
-// +build linux,!android,!e2e_testing
-
-package overlay
-
-import (
-	"encoding/binary"
-	"fmt"
-
-	"golang.org/x/sys/unix"
-)
-
-// Size of the legacy struct virtio_net_hdr that the kernel prepends/expects on
-// a TUN opened with IFF_VNET_HDR (TUNSETVNETHDRSZ not set).
-const virtioNetHdrLen = 10
-
-// Maximum size we accept for a single read from a TUN with IFF_VNET_HDR. A
-// TSO superpacket can be up to 64KiB of payload plus a single L2/L3/L4 header
-// prefix plus the virtio header.
-const tunReadBufSize = 65535
-
-// Space for segmented output. Worst case is many small segments, each paying
-// an IP+TCP header. 128KiB comfortably covers the 64KiB payload ceiling.
-const tunSegBufSize = 131072
-
-// tunSegBufCap is the total size we allocate for the per-reader segment
-// buffer. It is sized as one worst-case TSO superpacket (tunSegBufSize) plus
-// the same again as drain headroom so a Read wake can accumulate
-// additional packets after an initial big read without overflowing.
-const tunSegBufCap = tunSegBufSize * 2
-
-// tunDrainCap caps how many packets a single Read will accumulate via
-// the post-wake drain loop. Sized to soak up a burst of small ACKs while
-// bounding how much work a single caller holds before handing off.
-const tunDrainCap = 64
-
-type virtioNetHdr struct {
-	Flags      uint8
-	GSOType    uint8
-	HdrLen     uint16
-	GSOSize    uint16
-	CsumStart  uint16
-	CsumOffset uint16
-}
-
-// decode reads a virtio_net_hdr in host byte order (TUN default; we never
-// call TUNSETVNETLE so the kernel matches our endianness).
-func (h *virtioNetHdr) decode(b []byte) {
-	h.Flags = b[0]
-	h.GSOType = b[1]
-	h.HdrLen = binary.NativeEndian.Uint16(b[2:4])
-	h.GSOSize = binary.NativeEndian.Uint16(b[4:6])
-	h.CsumStart = binary.NativeEndian.Uint16(b[6:8])
-	h.CsumOffset = binary.NativeEndian.Uint16(b[8:10])
-}
-
-// encode is the inverse of decode: writes the virtio_net_hdr fields into b
-// (must be at least virtioNetHdrLen bytes). Used to emit a TSO superpacket
-// on egress.
-func (h *virtioNetHdr) encode(b []byte) {
-	b[0] = h.Flags
-	b[1] = h.GSOType
-	binary.NativeEndian.PutUint16(b[2:4], h.HdrLen)
-	binary.NativeEndian.PutUint16(b[4:6], h.GSOSize)
-	binary.NativeEndian.PutUint16(b[6:8], h.CsumStart)
-	binary.NativeEndian.PutUint16(b[8:10], h.CsumOffset)
-}
-
-// segmentInto splits a TUN-side packet described by hdr into one or more
-// IP packets, each appended to *out as a slice of scratch. scratch must be
-// sized to hold every segment (including replicated headers).
-func segmentInto(pkt []byte, hdr virtioNetHdr, out *[][]byte, scratch []byte) error {
-	// When RSC_INFO is set the csum_start/csum_offset fields are repurposed to
-	// carry coalescing info rather than checksum offsets. A TUN writing via
-	// IFF_VNET_HDR should never emit this, but if it did we would silently
-	// miscompute the segment checksums — refuse the packet instead.
-	if hdr.Flags&unix.VIRTIO_NET_HDR_F_RSC_INFO != 0 {
-		return fmt.Errorf("virtio RSC_INFO flag not supported on TUN reads")
-	}
-
-	switch hdr.GSOType {
-	case unix.VIRTIO_NET_HDR_GSO_NONE:
-		if len(pkt) > len(scratch) {
-			return fmt.Errorf("packet larger than segment buffer: %d > %d", len(pkt), len(scratch))
-		}
-		copy(scratch, pkt)
-		seg := scratch[:len(pkt)]
-		if hdr.Flags&unix.VIRTIO_NET_HDR_F_NEEDS_CSUM != 0 {
-			if err := finishChecksum(seg, hdr); err != nil {
-				return err
-			}
-		}
-		*out = append(*out, seg)
-		return nil
-
-	case unix.VIRTIO_NET_HDR_GSO_TCPV4, unix.VIRTIO_NET_HDR_GSO_TCPV6:
-		return segmentTCP(pkt, hdr, out, scratch)
-
-	default:
-		return fmt.Errorf("unsupported virtio gso type: %d", hdr.GSOType)
-	}
-}
-
-// finishChecksum computes the L4 checksum for a non-GSO packet that the kernel
-// handed us with NEEDS_CSUM set. csum_start / csum_offset point at the 16-bit
-// checksum field; we zero it, fold a full sum (the field was pre-loaded with
-// the pseudo-header partial sum by the kernel), and store the result.
-func finishChecksum(seg []byte, hdr virtioNetHdr) error {
-	cs := int(hdr.CsumStart)
-	co := int(hdr.CsumOffset)
-	if cs+co+2 > len(seg) {
-		return fmt.Errorf("csum offsets out of range: start=%d offset=%d len=%d", cs, co, len(seg))
-	}
-	// The kernel stores a partial pseudo-header sum at [cs+co:]; sum over the
-	// L4 region starting at cs, folding the prior partial in as the seed.
-	partial := uint32(binary.BigEndian.Uint16(seg[cs+co : cs+co+2]))
-	seg[cs+co] = 0
-	seg[cs+co+1] = 0
-	sum := checksumBytes(seg[cs:], partial)
-	binary.BigEndian.PutUint16(seg[cs+co:cs+co+2], checksumFold(sum))
-	return nil
-}
-
-// segmentTCP software-segments a TSO superpacket into one IP packet per MSS
-// chunk. The caller guarantees hdr.GSOType is TCPV4 or TCPV6.
-//
-// Hot-path shape: the per-segment loop only sums the payload chunk. The TCP
-// header, the IPv4 header, and the pseudo-header src/dst/proto contributions
-// are each summed once up front — every segment reuses those three pre-folded
-// uint32 values and combines them with small per-segment deltas (seq, flags,
-// tcpLen, ip_id, total_len) that are cheap to fold in.
-func segmentTCP(pkt []byte, hdr virtioNetHdr, out *[][]byte, scratch []byte) error {
-	if hdr.GSOSize == 0 {
-		return fmt.Errorf("gso_size is zero")
-	}
-	if int(hdr.HdrLen) > len(pkt) || hdr.HdrLen == 0 {
-		return fmt.Errorf("hdr_len %d out of range (pkt %d)", hdr.HdrLen, len(pkt))
-	}
-	if hdr.CsumStart == 0 || hdr.CsumStart >= hdr.HdrLen {
-		return fmt.Errorf("csum_start %d out of range (hdr_len %d)", hdr.CsumStart, hdr.HdrLen)
-	}
-
-	isV4 := hdr.GSOType == unix.VIRTIO_NET_HDR_GSO_TCPV4
-	headerLen := int(hdr.HdrLen)
-	csumStart := int(hdr.CsumStart)
-
-	if isV4 && csumStart < 20 {
-		return fmt.Errorf("csum_start %d too small for IPv4", csumStart)
-	}
-	if !isV4 && csumStart < 40 {
-		return fmt.Errorf("csum_start %d too small for IPv6", csumStart)
-	}
-	tcpHdrLen := headerLen - csumStart
-	if tcpHdrLen < 20 {
-		return fmt.Errorf("tcp header region too small: %d", tcpHdrLen)
-	}
-
-	payload := pkt[headerLen:]
-	payLen := len(payload)
-	gso := int(hdr.GSOSize)
-	numSeg := (payLen + gso - 1) / gso
-	if numSeg == 0 {
-		numSeg = 1
-	}
-
-	need := numSeg*headerLen + payLen
-	if need > len(scratch) {
-		return fmt.Errorf("scratch too small for %d segments: need %d have %d", numSeg, need, len(scratch))
-	}
-
-	origSeq := binary.BigEndian.Uint32(pkt[csumStart+4 : csumStart+8])
-	origFlags := pkt[csumStart+13]
-	const tcpFinPsh = 0x09 // FIN(0x01) | PSH(0x08)
-
-	// Precompute the TCP header sum with seq/flags/csum zeroed. The max TCP
-	// header is 60 bytes; copy onto the stack, zero the per-segment-varying
-	// fields, sum once.
-	var tmp [60]byte
-	copy(tmp[:tcpHdrLen], pkt[csumStart:headerLen])
-	tmp[4], tmp[5], tmp[6], tmp[7] = 0, 0, 0, 0 // seq
-	tmp[13] = 0                                 // flags
-	tmp[16], tmp[17] = 0, 0                     // csum
-	baseTcpHdrSum := checksumBytes(tmp[:tcpHdrLen], 0)
-
-	// Pseudo-header src+dst+proto contribution (tcpLen varies per segment).
-	var baseProtoSum uint32
-	if isV4 {
-		baseProtoSum = checksumBytes(pkt[12:16], 0)
-		baseProtoSum = checksumBytes(pkt[16:20], baseProtoSum)
-	} else {
-		baseProtoSum = checksumBytes(pkt[8:24], 0)
-		baseProtoSum = checksumBytes(pkt[24:40], baseProtoSum)
-	}
-	baseProtoSum += uint32(unix.IPPROTO_TCP)
-
-	// Precompute IPv4 header sum with total_len/id/csum zeroed.
-	var origIPID uint16
-	var ihl int
-	var baseIPHdrSum uint32
-	if isV4 {
-		origIPID = binary.BigEndian.Uint16(pkt[4:6])
-		ihl = int(pkt[0]&0x0f) * 4
-		if ihl < 20 || ihl > csumStart {
-			return fmt.Errorf("bad IPv4 IHL: %d", ihl)
-		}
-		var ipTmp [60]byte
-		copy(ipTmp[:ihl], pkt[:ihl])
-		ipTmp[2], ipTmp[3] = 0, 0   // total_len
-		ipTmp[4], ipTmp[5] = 0, 0   // id
-		ipTmp[10], ipTmp[11] = 0, 0 // checksum
-		baseIPHdrSum = checksumBytes(ipTmp[:ihl], 0)
-	}
-
-	off := 0
-	for i := 0; i < numSeg; i++ {
-		segStart := i * gso
-		segEnd := segStart + gso
-		if segEnd > payLen {
-			segEnd = payLen
-		}
-		segPayLen := segEnd - segStart
-
-		copy(scratch[off:], pkt[:headerLen])
-		copy(scratch[off+headerLen:], payload[segStart:segEnd])
-		seg := scratch[off : off+headerLen+segPayLen]
-		off += headerLen + segPayLen
-
-		segSeq := origSeq + uint32(segStart)
-		segFlags := origFlags
-		if i != numSeg-1 {
-			segFlags = origFlags &^ tcpFinPsh
-		}
-		totalLen := headerLen + segPayLen
-
-		// Patch IP header and write the v4 header checksum from the precomputed base.
-		if isV4 {
-			segID := origIPID + uint16(i)
-			binary.BigEndian.PutUint16(seg[2:4], uint16(totalLen))
-			binary.BigEndian.PutUint16(seg[4:6], segID)
-			ipSum := baseIPHdrSum + uint32(totalLen) + uint32(segID)
-			binary.BigEndian.PutUint16(seg[10:12], checksumFold(ipSum))
-		} else {
-			// IPv6 payload length excludes the 40-byte fixed header but
-			// includes any extension headers between [40:csumStart].
-			binary.BigEndian.PutUint16(seg[4:6], uint16(headerLen-40+segPayLen))
-		}
-
-		// Patch TCP header.
-		binary.BigEndian.PutUint32(seg[csumStart+4:csumStart+8], segSeq)
-		seg[csumStart+13] = segFlags
-		// (csum is written below; its prior contents in `seg` don't affect the
-		// computation since we never sum over the segment's own header.)
-
-		tcpLen := tcpHdrLen + segPayLen
-		paySum := checksumBytes(payload[segStart:segEnd], 0)
-
-		// Combine pre-folded uint32s into a wider accumulator, then fold. Using
-		// uint64 guards against overflow when segSeq's high bits set.
-		wide := uint64(baseTcpHdrSum) + uint64(paySum) + uint64(baseProtoSum)
-		wide += uint64(segSeq) + uint64(segFlags) + uint64(tcpLen)
-		wide = (wide & 0xffffffff) + (wide >> 32)
-		wide = (wide & 0xffffffff) + (wide >> 32)
-		binary.BigEndian.PutUint16(seg[csumStart+16:csumStart+18], checksumFold(uint32(wide)))
-
-		*out = append(*out, seg)
-	}
-
-	return nil
-}
-
-// checksumBytes returns the Internet-checksum partial sum of b, seeded with
-// initial. Result is a 32-bit accumulator; the caller folds to 16.
-//
-// Each 4-byte load is added directly into a 64-bit accumulator. Two parallel
-// accumulators break the serial dependency through `sum` and let the CPU
-// overlap independent adds. The final fold from 64 → 32 → 16 handles the
-// carries that accumulated across the 32-bit lane boundary.
-func checksumBytes(b []byte, initial uint32) uint32 {
-	s0 := uint64(initial)
-	var s1 uint64
-	for len(b) >= 32 {
-		s0 += uint64(binary.BigEndian.Uint32(b[0:4]))
-		s1 += uint64(binary.BigEndian.Uint32(b[4:8]))
-		s0 += uint64(binary.BigEndian.Uint32(b[8:12]))
-		s1 += uint64(binary.BigEndian.Uint32(b[12:16]))
-		s0 += uint64(binary.BigEndian.Uint32(b[16:20]))
-		s1 += uint64(binary.BigEndian.Uint32(b[20:24]))
-		s0 += uint64(binary.BigEndian.Uint32(b[24:28]))
-		s1 += uint64(binary.BigEndian.Uint32(b[28:32]))
-		b = b[32:]
-	}
-	sum := s0 + s1
-	for len(b) >= 4 {
-		sum += uint64(binary.BigEndian.Uint32(b[:4]))
-		b = b[4:]
-	}
-	if len(b) >= 2 {
-		sum += uint64(binary.BigEndian.Uint16(b[:2]))
-		b = b[2:]
-	}
-	if len(b) == 1 {
-		sum += uint64(b[0]) << 8
-	}
-	sum = (sum & 0xffffffff) + (sum >> 32)
-	sum = (sum & 0xffffffff) + (sum >> 32)
-	return uint32(sum)
-}
-
-func checksumFold(sum uint32) uint16 {
-	for sum>>16 != 0 {
-		sum = (sum & 0xffff) + (sum >> 16)
-	}
-	return ^uint16(sum)
-}
-
-func pseudoHeaderIPv4(src, dst []byte, proto byte, tcpLen int) uint32 {
-	sum := checksumBytes(src, 0)
-	sum = checksumBytes(dst, sum)
-	sum += uint32(proto)
-	sum += uint32(tcpLen)
-	return sum
-}
-
-func pseudoHeaderIPv6(src, dst []byte, proto byte, tcpLen int) uint32 {
-	sum := checksumBytes(src, 0)
-	sum = checksumBytes(dst, sum)
-	sum += uint32(tcpLen >> 16)
-	sum += uint32(tcpLen & 0xffff)
-	sum += uint32(proto)
-	return sum
-}

overlay/tun_linux_offload_test.go

@@ -1,333 +0,0 @@
-//go:build linux && !android && !e2e_testing
-// +build linux,!android,!e2e_testing
-
-package overlay
-
-import (
-	"encoding/binary"
-	"os"
-	"testing"
-
-	"golang.org/x/sys/unix"
-)
-
-// verifyChecksum confirms that the one's-complement sum across `b`, optionally
-// seeded with a pseudo-header sum, folds to all-ones (valid).
-func verifyChecksum(b []byte, pseudo uint32) bool {
-	sum := checksumBytes(b, pseudo)
-	for sum>>16 != 0 {
-		sum = (sum & 0xffff) + (sum >> 16)
-	}
-	return uint16(sum) == 0xffff
-}
-
-// buildTSOv4 builds a synthetic IPv4/TCP TSO superpacket with a payload of
-// `payLen` bytes split at `mss`.
-func buildTSOv4(t *testing.T, payLen, mss int) ([]byte, virtioNetHdr) {
-	t.Helper()
-	const ipLen = 20
-	const tcpLen = 20
-	pkt := make([]byte, ipLen+tcpLen+payLen)
-
-	// IPv4 header
-	pkt[0] = 0x45 // version 4, IHL 5
-	// total length is meaningless for TSO but set it anyway
-	binary.BigEndian.PutUint16(pkt[2:4], uint16(ipLen+tcpLen+payLen))
-	binary.BigEndian.PutUint16(pkt[4:6], 0x4242) // original ID
-	pkt[8] = 64                                  // TTL
-	pkt[9] = unix.IPPROTO_TCP
-	copy(pkt[12:16], []byte{10, 0, 0, 1}) // src
-	copy(pkt[16:20], []byte{10, 0, 0, 2}) // dst
-
-	// TCP header
-	binary.BigEndian.PutUint16(pkt[20:22], 12345) // sport
-	binary.BigEndian.PutUint16(pkt[22:24], 80)    // dport
-	binary.BigEndian.PutUint32(pkt[24:28], 10000) // seq
-	binary.BigEndian.PutUint32(pkt[28:32], 20000) // ack
-	pkt[32] = 0x50                                // data offset 5 words
-	pkt[33] = 0x18                                // ACK | PSH
-	binary.BigEndian.PutUint16(pkt[34:36], 65535) // window
-
-	// payload
-	for i := 0; i < payLen; i++ {
-		pkt[ipLen+tcpLen+i] = byte(i & 0xff)
-	}
-
-	return pkt, virtioNetHdr{
-		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-		GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV4,
-		HdrLen:     uint16(ipLen + tcpLen),
-		GSOSize:    uint16(mss),
-		CsumStart:  uint16(ipLen),
-		CsumOffset: 16,
-	}
-}
-
-func TestSegmentTCPv4(t *testing.T) {
-	const mss = 100
-	const numSeg = 3
-	pkt, hdr := buildTSOv4(t, mss*numSeg, mss)
-
-	scratch := make([]byte, tunSegBufSize)
-	var out [][]byte
-	if err := segmentTCP(pkt, hdr, &out, scratch); err != nil {
-		t.Fatalf("segmentTCP: %v", err)
-	}
-	if len(out) != numSeg {
-		t.Fatalf("expected %d segments, got %d", numSeg, len(out))
-	}
-
-	for i, seg := range out {
-		if len(seg) != 40+mss {
-			t.Errorf("seg %d: unexpected len %d", i, len(seg))
-		}
-		totalLen := binary.BigEndian.Uint16(seg[2:4])
-		if totalLen != uint16(40+mss) {
-			t.Errorf("seg %d: total_len=%d want %d", i, totalLen, 40+mss)
-		}
-		id := binary.BigEndian.Uint16(seg[4:6])
-		if id != 0x4242+uint16(i) {
-			t.Errorf("seg %d: ip id=%#x want %#x", i, id, 0x4242+uint16(i))
-		}
-		seq := binary.BigEndian.Uint32(seg[24:28])
-		wantSeq := uint32(10000 + i*mss)
-		if seq != wantSeq {
-			t.Errorf("seg %d: seq=%d want %d", i, seq, wantSeq)
-		}
-		flags := seg[33]
-		wantFlags := byte(0x10) // ACK only, PSH cleared
-		if i == numSeg-1 {
-			wantFlags = 0x18 // ACK | PSH preserved on last
-		}
-		if flags != wantFlags {
-			t.Errorf("seg %d: flags=%#x want %#x", i, flags, wantFlags)
-		}
-		// IPv4 header checksum must verify against itself.
-		if !verifyChecksum(seg[:20], 0) {
-			t.Errorf("seg %d: bad IPv4 header checksum", i)
-		}
-		// TCP checksum must verify against the pseudo-header.
-		psum := pseudoHeaderIPv4(seg[12:16], seg[16:20], unix.IPPROTO_TCP, 20+mss)
-		if !verifyChecksum(seg[20:], psum) {
-			t.Errorf("seg %d: bad TCP checksum", i)
-		}
-	}
-}
-
-func TestSegmentTCPv4OddTail(t *testing.T) {
-	// Payload of 250 bytes with MSS 100 → segments of 100, 100, 50.
-	pkt, hdr := buildTSOv4(t, 250, 100)
-	scratch := make([]byte, tunSegBufSize)
-	var out [][]byte
-	if err := segmentTCP(pkt, hdr, &out, scratch); err != nil {
-		t.Fatalf("segmentTCP: %v", err)
-	}
-	if len(out) != 3 {
-		t.Fatalf("want 3 segments, got %d", len(out))
-	}
-	wantPayLens := []int{100, 100, 50}
-	for i, seg := range out {
-		if len(seg)-40 != wantPayLens[i] {
-			t.Errorf("seg %d: pay len %d want %d", i, len(seg)-40, wantPayLens[i])
-		}
-		if !verifyChecksum(seg[:20], 0) {
-			t.Errorf("seg %d: bad IPv4 header checksum", i)
-		}
-		psum := pseudoHeaderIPv4(seg[12:16], seg[16:20], unix.IPPROTO_TCP, 20+wantPayLens[i])
-		if !verifyChecksum(seg[20:], psum) {
-			t.Errorf("seg %d: bad TCP checksum", i)
-		}
-	}
-}
-
-func TestSegmentTCPv6(t *testing.T) {
-	const ipLen = 40
-	const tcpLen = 20
-	const mss = 120
-	const numSeg = 2
-	payLen := mss * numSeg
-	pkt := make([]byte, ipLen+tcpLen+payLen)
-
-	// IPv6 header
-	pkt[0] = 0x60 // version 6
-	binary.BigEndian.PutUint16(pkt[4:6], uint16(tcpLen+payLen))
-	pkt[6] = unix.IPPROTO_TCP
-	pkt[7] = 64
-	// src/dst fe80::1 / fe80::2
-	pkt[8] = 0xfe
-	pkt[9] = 0x80
-	pkt[23] = 1
-	pkt[24] = 0xfe
-	pkt[25] = 0x80
-	pkt[39] = 2
-
-	// TCP header
-	binary.BigEndian.PutUint16(pkt[40:42], 12345)
-	binary.BigEndian.PutUint16(pkt[42:44], 80)
-	binary.BigEndian.PutUint32(pkt[44:48], 7)
-	binary.BigEndian.PutUint32(pkt[48:52], 99)
-	pkt[52] = 0x50
-	pkt[53] = 0x19 // FIN | ACK | PSH — exercise FIN clearing too
-	binary.BigEndian.PutUint16(pkt[54:56], 65535)
-
-	for i := 0; i < payLen; i++ {
-		pkt[ipLen+tcpLen+i] = byte(i)
-	}
-
-	hdr := virtioNetHdr{
-		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-		GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV6,
-		HdrLen:     uint16(ipLen + tcpLen),
-		GSOSize:    uint16(mss),
-		CsumStart:  uint16(ipLen),
-		CsumOffset: 16,
-	}
-
-	scratch := make([]byte, tunSegBufSize)
-	var out [][]byte
-	if err := segmentTCP(pkt, hdr, &out, scratch); err != nil {
-		t.Fatalf("segmentTCP: %v", err)
-	}
-	if len(out) != numSeg {
-		t.Fatalf("want %d segments, got %d", numSeg, len(out))
-	}
-
-	for i, seg := range out {
-		if len(seg) != ipLen+tcpLen+mss {
-			t.Errorf("seg %d: len %d want %d", i, len(seg), ipLen+tcpLen+mss)
-		}
-		pl := binary.BigEndian.Uint16(seg[4:6])
-		if pl != uint16(tcpLen+mss) {
-			t.Errorf("seg %d: payload_length=%d want %d", i, pl, tcpLen+mss)
-		}
-		seq := binary.BigEndian.Uint32(seg[44:48])
-		if seq != uint32(7+i*mss) {
-			t.Errorf("seg %d: seq=%d want %d", i, seq, 7+i*mss)
-		}
-		flags := seg[53]
-		// Original flags = 0x19 (FIN|ACK|PSH). FIN(0x01)+PSH(0x08) should be
-		// cleared on all but the last; ACK(0x10) always preserved.
-		wantFlags := byte(0x10)
-		if i == numSeg-1 {
-			wantFlags = 0x19
-		}
-		if flags != wantFlags {
-			t.Errorf("seg %d: flags=%#x want %#x", i, flags, wantFlags)
-		}
-		psum := pseudoHeaderIPv6(seg[8:24], seg[24:40], unix.IPPROTO_TCP, tcpLen+mss)
-		if !verifyChecksum(seg[ipLen:], psum) {
-			t.Errorf("seg %d: bad TCP checksum", i)
-		}
-	}
-}
-
-func TestSegmentGSONonePassesThrough(t *testing.T) {
-	pkt, hdr := buildTSOv4(t, 100, 100)
-	hdr.GSOType = unix.VIRTIO_NET_HDR_GSO_NONE
-	hdr.Flags = 0 // no NEEDS_CSUM, leave packet untouched
-
-	scratch := make([]byte, tunSegBufSize)
-	var out [][]byte
-	if err := segmentInto(pkt, hdr, &out, scratch); err != nil {
-		t.Fatalf("segmentInto: %v", err)
-	}
-	if len(out) != 1 {
-		t.Fatalf("want 1 segment, got %d", len(out))
-	}
-	if len(out[0]) != len(pkt) {
-		t.Fatalf("unexpected length: %d vs %d", len(out[0]), len(pkt))
-	}
-}
-
-func TestSegmentRejectsUDP(t *testing.T) {
-	hdr := virtioNetHdr{GSOType: unix.VIRTIO_NET_HDR_GSO_UDP}
-	var out [][]byte
-	if err := segmentInto(nil, hdr, &out, nil); err == nil {
-		t.Fatalf("expected rejection for UDP GSO")
-	}
-}
-
-func BenchmarkSegmentTCPv4(b *testing.B) {
-	sizes := []struct {
-		name   string
-		payLen int
-		mss    int
-	}{
-		{"64KiB_MSS1460", 65000, 1460},
-		{"16KiB_MSS1460", 16384, 1460},
-		{"4KiB_MSS1460", 4096, 1460},
-	}
-	for _, sz := range sizes {
-		b.Run(sz.name, func(b *testing.B) {
-			const ipLen = 20
-			const tcpLen = 20
-			pkt := make([]byte, ipLen+tcpLen+sz.payLen)
-			pkt[0] = 0x45
-			binary.BigEndian.PutUint16(pkt[2:4], uint16(ipLen+tcpLen+sz.payLen))
-			binary.BigEndian.PutUint16(pkt[4:6], 0x4242)
-			pkt[8] = 64
-			pkt[9] = unix.IPPROTO_TCP
-			copy(pkt[12:16], []byte{10, 0, 0, 1})
-			copy(pkt[16:20], []byte{10, 0, 0, 2})
-			binary.BigEndian.PutUint16(pkt[20:22], 12345)
-			binary.BigEndian.PutUint16(pkt[22:24], 80)
-			binary.BigEndian.PutUint32(pkt[24:28], 10000)
-			binary.BigEndian.PutUint32(pkt[28:32], 20000)
-			pkt[32] = 0x50
-			pkt[33] = 0x18
-			binary.BigEndian.PutUint16(pkt[34:36], 65535)
-			for i := 0; i < sz.payLen; i++ {
-				pkt[ipLen+tcpLen+i] = byte(i)
-			}
-			hdr := virtioNetHdr{
-				Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-				GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV4,
-				HdrLen:     uint16(ipLen + tcpLen),
-				GSOSize:    uint16(sz.mss),
-				CsumStart:  uint16(ipLen),
-				CsumOffset: 16,
-			}
-
-			scratch := make([]byte, tunSegBufSize)
-			out := make([][]byte, 0, 64)
-
-			b.SetBytes(int64(len(pkt)))
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				out = out[:0]
-				if err := segmentTCP(pkt, hdr, &out, scratch); err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-}
-
-// TestTunFileWriteVnetHdrNoAlloc verifies the IFF_VNET_HDR fast-path write is
-// allocation-free. We write to /dev/null so every call succeeds synchronously.
-func TestTunFileWriteVnetHdrNoAlloc(t *testing.T) {
-	fd, err := unix.Open("/dev/null", os.O_WRONLY, 0)
-	if err != nil {
-		t.Fatalf("open /dev/null: %v", err)
-	}
-	t.Cleanup(func() { _ = unix.Close(fd) })
-
-	tf := &tunFile{fd: fd, vnetHdr: true}
-	tf.writeIovs[0].Base = &validVnetHdr[0]
-	tf.writeIovs[0].SetLen(virtioNetHdrLen)
-
-	payload := make([]byte, 1400)
-	// Warm up (first call may trigger one-time internal allocations elsewhere).
-	if _, err := tf.Write(payload); err != nil {
-		t.Fatalf("Write: %v", err)
-	}
-
-	allocs := testing.AllocsPerRun(1000, func() {
-		if _, err := tf.Write(payload); err != nil {
-			t.Fatalf("Write: %v", err)
-		}
-	})
-	if allocs != 0 {
-		t.Fatalf("Write allocated %.1f times per call, want 0", allocs)
-	}
-}

overlay/tun_netbsd.go

@@ -6,6 +6,7 @@ package overlay
 import (
 	"errors"
 	"fmt"
+	"io"
 	"net/netip"
 	"os"
 	"regexp"
@@ -65,25 +66,6 @@ type tun struct {
 	l           *logrus.Logger
 	f           *os.File
 	fd          int
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (t *tun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.readOne(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
 }
 
 var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
@@ -159,7 +141,7 @@ func (t *tun) Close() error {
 	return nil
 }
 
-func (t *tun) readOne(to []byte) (int, error) {
+func (t *tun) Read(to []byte) (int, error) {
 	rc, err := t.f.SyscallConn()
 	if err != nil {
 		return 0, fmt.Errorf("failed to get syscall conn for tun: %w", err)
@@ -412,7 +394,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for netbsd")
 }
 

overlay/tun_openbsd.go

@@ -6,6 +6,7 @@ package overlay
 import (
 	"errors"
 	"fmt"
+	"io"
 	"net/netip"
 	"os"
 	"regexp"
@@ -58,25 +59,6 @@ type tun struct {
 	fd          int
 	// cache out buffer since we need to prepend 4 bytes for tun metadata
 	out []byte
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (t *tun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.readOne(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *tun) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
 }
 
 var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
@@ -142,7 +124,7 @@ func (t *tun) Close() error {
 	return nil
 }
 
-func (t *tun) readOne(to []byte) (int, error) {
+func (t *tun) Read(to []byte) (int, error) {
 	buf := make([]byte, len(to)+4)
 
 	n, err := t.f.Read(buf)
@@ -332,7 +314,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (Queue, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for openbsd")
 }
 

overlay/tun_tester.go

@@ -26,17 +26,6 @@ type TestTun struct {
 	closed    atomic.Bool
 	rxPackets chan []byte // Packets to receive into nebula
 	TxPackets chan []byte // Packets transmitted outside by nebula
-
-	batchRet [1][]byte
-}
-
-func (t *TestTun) Read() ([][]byte, error) {
-	p, ok := <-t.rxPackets
-	if !ok {
-		return nil, os.ErrClosed
-	}
-	t.batchRet[0] = p
-	return t.batchRet[:], nil
 }
 
 func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*TestTun, error) {
@@ -126,10 +115,6 @@ func (t *TestTun) Write(b []byte) (n int, err error) {
 	return len(b), nil
 }
 
-func (t *TestTun) WriteReject(b []byte) (int, error) {
-	return t.Write(b)
-}
-
 func (t *TestTun) Close() error {
 	if t.closed.CompareAndSwap(false, true) {
 		close(t.rxPackets)
@@ -138,10 +123,19 @@ func (t *TestTun) Close() error {
 	return nil
 }
 
+func (t *TestTun) Read(b []byte) (int, error) {
+	p, ok := <-t.rxPackets
+	if !ok {
+		return 0, os.ErrClosed
+	}
+	copy(b, p)
+	return len(p), nil
+}
+
 func (t *TestTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *TestTun) NewMultiQueueReader() (Queue, error) {
+func (t *TestTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented")
 }

overlay/tun_windows.go

@@ -6,6 +6,7 @@ package overlay
 import (
 	"crypto"
 	"fmt"
+	"io"
 	"net/netip"
 	"os"
 	"path/filepath"
@@ -35,25 +36,6 @@ type winTun struct {
 	l           *logrus.Logger
 
 	tun *wintun.NativeTun
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (t *winTun) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.tun.Read(t.readBuf, 0)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *winTun) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
 }
 
 func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (Device, error) {
@@ -247,6 +229,10 @@ func (t *winTun) Name() string {
 	return t.Device
 }
 
+func (t *winTun) Read(b []byte) (int, error) {
+	return t.tun.Read(b, 0)
+}
+
 func (t *winTun) Write(b []byte) (int, error) {
 	return t.tun.Write(b, 0)
 }
@@ -255,7 +241,7 @@ func (t *winTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *winTun) NewMultiQueueReader() (Queue, error) {
+func (t *winTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for windows")
 }
 

overlay/user.go

@@ -34,21 +34,6 @@ type UserDevice struct {
 
 	inboundReader *io.PipeReader
 	inboundWriter *io.PipeWriter
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func (d *UserDevice) Read() ([][]byte, error) {
-	if d.readBuf == nil {
-		d.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := d.outboundReader.Read(d.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	d.batchRet[0] = d.readBuf[:n]
-	return d.batchRet[:], nil
 }
 
 func (d *UserDevice) Activate() error {
@@ -65,7 +50,7 @@ func (d *UserDevice) SupportsMultiqueue() bool {
 	return true
 }
 
-func (d *UserDevice) NewMultiQueueReader() (Queue, error) {
+func (d *UserDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return d, nil
 }
 
@@ -73,12 +58,12 @@ func (d *UserDevice) Pipe() (*io.PipeReader, *io.PipeWriter) {
 	return d.inboundReader, d.outboundWriter
 }
 
+func (d *UserDevice) Read(p []byte) (n int, err error) {
+	return d.outboundReader.Read(p)
+}
 func (d *UserDevice) Write(p []byte) (n int, err error) {
 	return d.inboundWriter.Write(p)
 }
-func (d *UserDevice) WriteReject(p []byte) (n int, err error) {
-	return d.Write(p)
-}
 func (d *UserDevice) Close() error {
 	d.inboundWriter.Close()
 	d.outboundWriter.Close()

pki.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"net/netip"
 	"os"
@@ -488,25 +487,25 @@ func loadCertificate(b []byte) (cert.Certificate, []byte, error) {
 }
 
 func loadCAPoolFromConfig(l *logrus.Logger, c *config.C) (*cert.CAPool, error) {
+	var rawCA []byte
+	var err error
+
 	caPathOrPEM := c.GetString("pki.ca", "")
 	if caPathOrPEM == "" {
 		return nil, errors.New("no pki.ca path or PEM data provided")
 	}
 
-	var caReader io.ReadCloser
-	var err error
-
 	if strings.Contains(caPathOrPEM, "-----BEGIN") {
-		caReader = io.NopCloser(strings.NewReader(caPathOrPEM))
+		rawCA = []byte(caPathOrPEM)
+
 	} else {
-		caReader, err = os.Open(caPathOrPEM)
+		rawCA, err = os.ReadFile(caPathOrPEM)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read pki.ca file %s: %s", caPathOrPEM, err)
 		}
 	}
-	defer caReader.Close()
 
-	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
+	caPool, err := cert.NewCAPoolFromPEM(rawCA)
 	if errors.Is(err, cert.ErrExpired) {
 		var expired int
 		for _, crt := range caPool.CAs {

pki_hup_benchmark_test.go

@@ -1,121 +0,0 @@
-package nebula
-
-import (
-	"bytes"
-	"fmt"
-	"net/netip"
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	cert_test "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/require"
-)
-
-func BenchmarkReloadConfigWithCAs(b *testing.B) {
-	prevProcs := runtime.GOMAXPROCS(1)
-	b.Cleanup(func() { runtime.GOMAXPROCS(prevProcs) })
-
-	for _, size := range []int{100, 250, 500, 1000, 5000} {
-		b.Run(fmt.Sprintf("%dCAs", size), func(b *testing.B) {
-			l := test.NewLogger()
-			dir := b.TempDir()
-
-			ca, caKey, caBundle := buildCABundle(b, size)
-			caPath, certPath, keyPath := writePKIFiles(b, dir, ca, caKey, caBundle)
-
-			configBody := fmt.Sprintf(`pki:
-  ca: %s
-  cert: %s
-  key: %s
-`, caPath, certPath, keyPath)
-
-			configPath := filepath.Join(dir, "config.yml")
-			require.NoError(b, os.WriteFile(configPath, []byte(configBody), 0o600))
-
-			c := config.NewC(l)
-			require.NoError(b, c.Load(dir))
-
-			_, err := NewPKIFromConfig(l, c)
-			require.NoError(b, err)
-
-			b.ReportAllocs()
-			b.ResetTimer()
-
-			for b.Loop() {
-				c.ReloadConfig()
-			}
-		})
-	}
-}
-
-func buildCABundle(b *testing.B, count int) (cert.Certificate, []byte, []byte) {
-	b.Helper()
-	require.GreaterOrEqual(b, count, 1)
-
-	before := time.Now().Add(-24 * time.Hour)
-	after := time.Now().Add(24 * time.Hour)
-
-	ca, _, caKey, pem := cert_test.NewTestCaCert(
-		cert.Version2,
-		cert.Curve_CURVE25519,
-		before,
-		after,
-		nil,
-		nil,
-		nil,
-	)
-
-	buf := bytes.NewBuffer(pem)
-	buf.Write([]byte("\n# a comment!\n"))
-
-	for i := 1; i < count; i++ {
-		_, _, _, extraPEM := cert_test.NewTestCaCert(
-			cert.Version2,
-			cert.Curve_CURVE25519,
-			time.Now(),
-			time.Now().Add(time.Hour),
-			nil,
-			nil,
-			nil,
-		)
-		buf.Write([]byte("\n# a comment!\n"))
-		buf.Write(extraPEM)
-	}
-
-	return ca, caKey, buf.Bytes()
-}
-
-func writePKIFiles(b *testing.B, dir string, ca cert.Certificate, caKey []byte, caBundle []byte) (string, string, string) {
-	b.Helper()
-
-	networks := []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}
-
-	_, _, keyPEM, certPEM := cert_test.NewTestCert(
-		cert.Version2,
-		cert.Curve_CURVE25519,
-		ca,
-		caKey,
-		"reload-benchmark",
-		time.Now(),
-		time.Now().Add(time.Hour),
-		networks,
-		nil,
-		nil,
-	)
-
-	caPath := filepath.Join(dir, "ca.pem")
-	certPath := filepath.Join(dir, "cert.pem")
-	keyPath := filepath.Join(dir, "key.pem")
-
-	require.NoError(b, os.WriteFile(caPath, caBundle, 0o600))
-	require.NoError(b, os.WriteFile(certPath, certPEM, 0o600))
-	require.NoError(b, os.WriteFile(keyPath, keyPEM, 0o600))
-
-	return caPath, certPath, keyPath
-}

service/service.go

@@ -44,10 +44,7 @@ type Service struct {
 }
 
 func New(control *nebula.Control) (*Service, error) {
-	wait, err := control.Start()
+	control.Start()
-	if err != nil {
-		return nil, err
-	}
 
 	ctx := control.Context()
 	eg, ctx := errgroup.WithContext(ctx)
@@ -144,12 +141,6 @@ func New(control *nebula.Control) (*Service, error) {
 		}
 	})
 
-	// Add the nebula wait function to the group so a fatal reader error
-	// propagates out through errgroup.Wait().
-	eg.Go(func() error {
-		return wait()
-	})
-
 	return &s, nil
 }
 

ssh.go

@@ -10,7 +10,6 @@ import (
 	"net"
 	"net/netip"
 	"os"
-	"path/filepath"
 	"reflect"
 	"runtime"
 	"runtime/pprof"
@@ -189,12 +188,6 @@ func configSSH(l *logrus.Logger, ssh *sshd.SSHServer, c *config.C) (func(), erro
 }
 
 func attachCommands(l *logrus.Logger, c *config.C, ssh *sshd.SSHServer, f *Interface) {
-	// sandboxDir defaults to a dir in temp. The intention is that end user will
-	// create this dir as needed. Overriding this config value to "" allows
-	// writing to anywhere in the system.
-	defaultDir := filepath.Join(os.TempDir(), "nebula-debug")
-	sandboxDir := c.GetString("sshd.sandbox_dir", defaultDir)
-
 	ssh.RegisterCommand(&sshd.Command{
 		Name:             "list-hostmap",
 		ShortDescription: "List all known previously connected hosts",
@@ -253,9 +246,7 @@ func attachCommands(l *logrus.Logger, c *config.C, ssh *sshd.SSHServer, f *Inter
 	ssh.RegisterCommand(&sshd.Command{
 		Name:             "start-cpu-profile",
 		ShortDescription: "Starts a cpu profile and write output to the provided file, ex: `cpu-profile.pb.gz`",
-		Callback: func(fs any, a []string, w sshd.StringWriter) error {
+		Callback:         sshStartCpuProfile,
-			return sshStartCpuProfile(sandboxDir, fs, a, w)
-		},
 	})
 
 	ssh.RegisterCommand(&sshd.Command{
@@ -270,9 +261,7 @@ func attachCommands(l *logrus.Logger, c *config.C, ssh *sshd.SSHServer, f *Inter
 	ssh.RegisterCommand(&sshd.Command{
 		Name:             "save-heap-profile",
 		ShortDescription: "Saves a heap profile to the provided path, ex: `heap-profile.pb.gz`",
-		Callback: func(fs any, a []string, w sshd.StringWriter) error {
+		Callback:         sshGetHeapProfile,
-			return sshGetHeapProfile(sandboxDir, fs, a, w)
-		},
 	})
 
 	ssh.RegisterCommand(&sshd.Command{
@@ -284,9 +273,7 @@ func attachCommands(l *logrus.Logger, c *config.C, ssh *sshd.SSHServer, f *Inter
 	ssh.RegisterCommand(&sshd.Command{
 		Name:             "save-mutex-profile",
 		ShortDescription: "Saves a mutex profile to the provided path, ex: `mutex-profile.pb.gz`",
-		Callback: func(fs any, a []string, w sshd.StringWriter) error {
+		Callback:         sshGetMutexProfile,
-			return sshGetMutexProfile(sandboxDir, fs, a, w)
-		},
 	})
 
 	ssh.RegisterCommand(&sshd.Command{
@@ -519,43 +506,13 @@ func sshListLighthouseMap(lightHouse *LightHouse, a any, w sshd.StringWriter) er
 	return nil
 }
 
-// sshSanitizeFilePath validates that the given file path is within the sandbox directory.
+func sshStartCpuProfile(fs any, a []string, w sshd.StringWriter) error {
-// If sandboxDir is empty, the path is returned as-is for backwards compatibility.
-func sshSanitizeFilePath(sandboxDir, filePath string) (string, error) {
-	if sandboxDir == "" {
-		return filePath, nil
-	}
-
-	// Clean and resolve the path relative to the sandbox directory
-	if !filepath.IsAbs(filePath) {
-		filePath = filepath.Join(sandboxDir, filePath)
-	}
-	cleaned := filepath.Clean(filePath)
-
-	// Ensure the resolved path is within the sandbox directory
-	cleanedSandbox := filepath.Clean(sandboxDir)
-	if cleaned == cleanedSandbox {
-		return "", fmt.Errorf("path %q resolves to the sandbox directory itself %q", filePath, sandboxDir)
-	}
-	if !strings.HasPrefix(cleaned, cleanedSandbox+string(filepath.Separator)) {
-		return "", fmt.Errorf("path %q is outside the sandbox directory %q", filePath, sandboxDir)
-	}
-
-	return cleaned, nil
-}
-
-func sshStartCpuProfile(sandboxDir string, fs any, a []string, w sshd.StringWriter) error {
 	if len(a) == 0 {
 		err := w.WriteLine("No path to write profile provided")
 		return err
 	}
 
-	filePath, err := sshSanitizeFilePath(sandboxDir, a[0])
+	file, err := os.Create(a[0])
-	if err != nil {
-		return w.WriteLine(err.Error())
-	}
-
-	file, err := os.Create(filePath)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 		return err
@@ -719,17 +676,12 @@ func sshChangeRemote(ifce *Interface, fs any, a []string, w sshd.StringWriter) e
 	return w.WriteLine("Changed")
 }
 
-func sshGetHeapProfile(sandboxDir string, fs any, a []string, w sshd.StringWriter) error {
+func sshGetHeapProfile(fs any, a []string, w sshd.StringWriter) error {
 	if len(a) == 0 {
 		return w.WriteLine("No path to write profile provided")
 	}
 
-	filePath, err := sshSanitizeFilePath(sandboxDir, a[0])
+	file, err := os.Create(a[0])
-	if err != nil {
-		return w.WriteLine(err.Error())
-	}
-
-	file, err := os.Create(filePath)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 		return err
@@ -760,17 +712,12 @@ func sshMutexProfileFraction(fs any, a []string, w sshd.StringWriter) error {
 	return w.WriteLine(fmt.Sprintf("New value: %d. Old value: %d", newRate, oldRate))
 }
 
-func sshGetMutexProfile(sandboxDir string, fs any, a []string, w sshd.StringWriter) error {
+func sshGetMutexProfile(fs any, a []string, w sshd.StringWriter) error {
 	if len(a) == 0 {
 		return w.WriteLine("No path to write profile provided")
 	}
 
-	filePath, err := sshSanitizeFilePath(sandboxDir, a[0])
+	file, err := os.Create(a[0])
-	if err != nil {
-		return w.WriteLine(err.Error())
-	}
-
-	file, err := os.Create(filePath)
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 	}

tcp_coalesce.go

@@ -1,484 +0,0 @@
-package nebula
-
-import (
-	"bytes"
-	"encoding/binary"
-	"io"
-
-	"github.com/slackhq/nebula/overlay"
-)
-
-// ipProtoTCP is the IANA protocol number for TCP. Hardcoded instead of
-// reaching for golang.org/x/sys/unix — that package doesn't define the
-// constant on Windows, which would break cross-compiles even though this
-// file runs unchanged on every platform.
-const ipProtoTCP = 6
-
-// tcpCoalesceBufSize caps total bytes per superpacket. Mirrors the kernel's
-// sk_gso_max_size of ~64KiB; anything beyond this would be rejected anyway.
-const tcpCoalesceBufSize = 65535
-
-// tcpCoalesceMaxSegs caps how many segments we'll coalesce into a single
-// superpacket. Keeping this well below the kernel's TSO ceiling bounds
-// latency.
-const tcpCoalesceMaxSegs = 64
-
-// tcpCoalesceHdrCap is the scratch space we copy a seed's IP+TCP header
-// into. IPv6 (40) + TCP with full options (60) = 100 bytes.
-const tcpCoalesceHdrCap = 100
-
-// initialSlots is the starting capacity of the slot pool. One flow per
-// packet is the worst case so this matches a typical UDP recvmmsg batch.
-const initialSlots = 64
-
-// flowKey identifies a TCP flow by {src, dst, sport, dport, family}.
-// Comparable, so linear scans over the slot list stay tight.
-type flowKey struct {
-	src, dst     [16]byte
-	sport, dport uint16
-	isV6         bool
-}
-
-// coalesceSlot is one entry in the coalescer's ordered event queue. When
-// passthrough is true the slot holds a single borrowed packet that must be
-// emitted verbatim (non-TCP, non-admissible TCP, or oversize seed). When
-// passthrough is false the slot is an in-progress coalesced superpacket:
-// hdrBuf is a mutable copy of the seed's IP+TCP header (we patch total
-// length and pseudo-header partial at flush), and payIovs are *borrowed*
-// slices from the caller's plaintext buffers — no payload is ever copied.
-// The caller (listenOut) must keep those buffers alive until Flush.
-type coalesceSlot struct {
-	passthrough bool
-	rawPkt      []byte // borrowed when passthrough
-
-	fk       flowKey
-	hdrBuf   [tcpCoalesceHdrCap]byte
-	hdrLen   int
-	ipHdrLen int
-	isV6     bool
-	gsoSize  int
-	numSeg   int
-	totalPay int
-	nextSeq  uint32
-	// psh closes the chain: set when the last-accepted segment had PSH or
-	// was sub-gsoSize. No further appends after that.
-	psh     bool
-	payIovs [][]byte
-}
-
-// tcpCoalescer accumulates adjacent in-flow TCP data segments across
-// multiple concurrent flows and emits each flow's run as a single TSO
-// superpacket via overlay.GSOWriter. All output — coalesced or not — is
-// deferred until Flush so arrival order is preserved on the wire. Owns
-// no locks; one coalescer per TUN write queue.
-type tcpCoalescer struct {
-	plainW io.Writer
-	gsoW   overlay.GSOWriter // nil when the queue doesn't support TSO
-
-	// slots is the ordered event queue. Flush walks it once and emits each
-	// entry as either a WriteGSO (coalesced) or a plainW.Write (passthrough).
-	slots []*coalesceSlot
-	// openSlots maps a flow key to its most recent non-sealed slot, so new
-	// segments can extend an in-progress superpacket in O(1). Slots are
-	// removed from this map when they close (PSH or short-last-segment),
-	// when a non-admissible packet for that flow arrives, or in Flush.
-	openSlots map[flowKey]*coalesceSlot
-	pool      []*coalesceSlot // free list for reuse
-}
-
-func newTCPCoalescer(w io.Writer) *tcpCoalescer {
-	c := &tcpCoalescer{
-		plainW:    w,
-		slots:     make([]*coalesceSlot, 0, initialSlots),
-		openSlots: make(map[flowKey]*coalesceSlot, initialSlots),
-		pool:      make([]*coalesceSlot, 0, initialSlots),
-	}
-	if gw, ok := w.(overlay.GSOWriter); ok && gw.GSOSupported() {
-		c.gsoW = gw
-	}
-	return c
-}
-
-// parsedTCP holds the fields extracted from a single parse so later steps
-// (admission, slot lookup, canAppend) don't re-walk the header.
-type parsedTCP struct {
-	fk        flowKey
-	ipHdrLen  int
-	tcpHdrLen int
-	hdrLen    int
-	payLen    int
-	seq       uint32
-	flags     byte
-}
-
-// parseTCPBase extracts the flow key and IP/TCP offsets for any TCP packet,
-// regardless of whether it's admissible for coalescing. Returns ok=false
-// for non-TCP or malformed input. Accepts IPv4 (no options, no fragmentation)
-// and IPv6 (no extension headers).
-func parseTCPBase(pkt []byte) (parsedTCP, bool) {
-	var p parsedTCP
-	if len(pkt) < 20 {
-		return p, false
-	}
-	v := pkt[0] >> 4
-	switch v {
-	case 4:
-		ihl := int(pkt[0]&0x0f) * 4
-		if ihl != 20 {
-			return p, false
-		}
-		if pkt[9] != ipProtoTCP {
-			return p, false
-		}
-		// Reject actual fragmentation (MF or non-zero frag offset).
-		if binary.BigEndian.Uint16(pkt[6:8])&0x3fff != 0 {
-			return p, false
-		}
-		totalLen := int(binary.BigEndian.Uint16(pkt[2:4]))
-		if totalLen > len(pkt) || totalLen < ihl {
-			return p, false
-		}
-		p.ipHdrLen = 20
-		p.fk.isV6 = false
-		copy(p.fk.src[:4], pkt[12:16])
-		copy(p.fk.dst[:4], pkt[16:20])
-		pkt = pkt[:totalLen]
-	case 6:
-		if len(pkt) < 40 {
-			return p, false
-		}
-		if pkt[6] != ipProtoTCP {
-			return p, false
-		}
-		payloadLen := int(binary.BigEndian.Uint16(pkt[4:6]))
-		if 40+payloadLen > len(pkt) {
-			return p, false
-		}
-		p.ipHdrLen = 40
-		p.fk.isV6 = true
-		copy(p.fk.src[:], pkt[8:24])
-		copy(p.fk.dst[:], pkt[24:40])
-		pkt = pkt[:40+payloadLen]
-	default:
-		return p, false
-	}
-
-	if len(pkt) < p.ipHdrLen+20 {
-		return p, false
-	}
-	tcpOff := int(pkt[p.ipHdrLen+12]>>4) * 4
-	if tcpOff < 20 || tcpOff > 60 {
-		return p, false
-	}
-	if len(pkt) < p.ipHdrLen+tcpOff {
-		return p, false
-	}
-	p.tcpHdrLen = tcpOff
-	p.hdrLen = p.ipHdrLen + tcpOff
-	p.payLen = len(pkt) - p.hdrLen
-	p.seq = binary.BigEndian.Uint32(pkt[p.ipHdrLen+4 : p.ipHdrLen+8])
-	p.flags = pkt[p.ipHdrLen+13]
-	p.fk.sport = binary.BigEndian.Uint16(pkt[p.ipHdrLen : p.ipHdrLen+2])
-	p.fk.dport = binary.BigEndian.Uint16(pkt[p.ipHdrLen+2 : p.ipHdrLen+4])
-	return p, true
-}
-
-// coalesceable reports whether a parsed TCP segment is eligible for
-// coalescing. Accepts only ACK or ACK|PSH with a non-empty payload.
-func (p parsedTCP) coalesceable() bool {
-	const ack = 0x10
-	const psh = 0x08
-	if p.flags&^(ack|psh) != 0 || p.flags&ack == 0 {
-		return false
-	}
-	return p.payLen > 0
-}
-
-// Add borrows pkt. The caller must keep pkt valid until the next Flush,
-// whether or not the packet was coalesced — passthrough (non-admissible)
-// packets are queued and written at Flush time, not synchronously.
-func (c *tcpCoalescer) Add(pkt []byte) error {
-	if c.gsoW == nil {
-		c.addPassthrough(pkt)
-		return nil
-	}
-
-	info, ok := parseTCPBase(pkt)
-	if !ok {
-		// Non-TCP or malformed — can't possibly collide with an open flow.
-		c.addPassthrough(pkt)
-		return nil
-	}
-	if !info.coalesceable() {
-		// TCP but not admissible (SYN/FIN/RST/URG/CWR/ECE or zero-payload).
-		// Seal this flow's open slot so later in-flow packets don't extend
-		// it and accidentally reorder past this passthrough.
-		delete(c.openSlots, info.fk)
-		c.addPassthrough(pkt)
-		return nil
-	}
-
-	if open := c.openSlots[info.fk]; open != nil {
-		if c.canAppend(open, pkt, info) {
-			c.appendPayload(open, pkt, info)
-			if open.psh {
-				delete(c.openSlots, info.fk)
-			}
-			return nil
-		}
-		// Can't extend — seal it and fall through to seed a fresh slot.
-		delete(c.openSlots, info.fk)
-	}
-	c.seed(pkt, info)
-	return nil
-}
-
-// Flush emits every queued event in arrival order. Coalesced slots go out
-// via WriteGSO; passthrough slots go out via plainW.Write. Returns the
-// first error observed; keeps draining so one bad packet doesn't hold up
-// the rest. After Flush returns, borrowed payload slices may be recycled.
-func (c *tcpCoalescer) Flush() error {
-	var first error
-	for _, s := range c.slots {
-		var err error
-		if s.passthrough {
-			_, err = c.plainW.Write(s.rawPkt)
-		} else {
-			err = c.flushSlot(s)
-		}
-		if err != nil && first == nil {
-			first = err
-		}
-		c.release(s)
-	}
-	for i := range c.slots {
-		c.slots[i] = nil
-	}
-	c.slots = c.slots[:0]
-	for k := range c.openSlots {
-		delete(c.openSlots, k)
-	}
-	return first
-}
-
-func (c *tcpCoalescer) addPassthrough(pkt []byte) {
-	s := c.take()
-	s.passthrough = true
-	s.rawPkt = pkt
-	c.slots = append(c.slots, s)
-}
-
-func (c *tcpCoalescer) seed(pkt []byte, info parsedTCP) {
-	if info.hdrLen > tcpCoalesceHdrCap || info.hdrLen+info.payLen > tcpCoalesceBufSize {
-		// Pathological shape — can't fit our scratch, emit as-is.
-		c.addPassthrough(pkt)
-		return
-	}
-	s := c.take()
-	s.passthrough = false
-	s.rawPkt = nil
-	copy(s.hdrBuf[:], pkt[:info.hdrLen])
-	s.hdrLen = info.hdrLen
-	s.ipHdrLen = info.ipHdrLen
-	s.isV6 = info.fk.isV6
-	s.fk = info.fk
-	s.gsoSize = info.payLen
-	s.numSeg = 1
-	s.totalPay = info.payLen
-	s.nextSeq = info.seq + uint32(info.payLen)
-	s.psh = info.flags&0x08 != 0
-	s.payIovs = append(s.payIovs[:0], pkt[info.hdrLen:info.hdrLen+info.payLen])
-	c.slots = append(c.slots, s)
-	if !s.psh {
-		c.openSlots[info.fk] = s
-	}
-}
-
-// canAppend reports whether info's packet extends the slot's seed: same
-// header shape and stable contents, adjacent seq, not oversized, chain not
-// closed.
-func (c *tcpCoalescer) canAppend(s *coalesceSlot, pkt []byte, info parsedTCP) bool {
-	if s.psh {
-		return false
-	}
-	if info.hdrLen != s.hdrLen {
-		return false
-	}
-	if info.seq != s.nextSeq {
-		return false
-	}
-	if s.numSeg >= tcpCoalesceMaxSegs {
-		return false
-	}
-	if info.payLen > s.gsoSize {
-		return false
-	}
-	if s.hdrLen+s.totalPay+info.payLen > tcpCoalesceBufSize {
-		return false
-	}
-	if !headersMatch(s.hdrBuf[:s.hdrLen], pkt[:info.hdrLen], s.isV6, s.ipHdrLen) {
-		return false
-	}
-	return true
-}
-
-func (c *tcpCoalescer) appendPayload(s *coalesceSlot, pkt []byte, info parsedTCP) {
-	s.payIovs = append(s.payIovs, pkt[info.hdrLen:info.hdrLen+info.payLen])
-	s.numSeg++
-	s.totalPay += info.payLen
-	s.nextSeq = info.seq + uint32(info.payLen)
-	if info.payLen < s.gsoSize || info.flags&0x08 != 0 {
-		s.psh = true
-	}
-}
-
-func (c *tcpCoalescer) take() *coalesceSlot {
-	if n := len(c.pool); n > 0 {
-		s := c.pool[n-1]
-		c.pool[n-1] = nil
-		c.pool = c.pool[:n-1]
-		return s
-	}
-	return &coalesceSlot{}
-}
-
-func (c *tcpCoalescer) release(s *coalesceSlot) {
-	s.passthrough = false
-	s.rawPkt = nil
-	for i := range s.payIovs {
-		s.payIovs[i] = nil
-	}
-	s.payIovs = s.payIovs[:0]
-	s.numSeg = 0
-	s.totalPay = 0
-	s.psh = false
-	c.pool = append(c.pool, s)
-}
-
-// flushSlot patches the header and calls WriteGSO. Does not remove the
-// slot from c.slots.
-func (c *tcpCoalescer) flushSlot(s *coalesceSlot) error {
-	total := s.hdrLen + s.totalPay
-	l4Len := total - s.ipHdrLen
-	hdr := s.hdrBuf[:s.hdrLen]
-
-	if s.isV6 {
-		binary.BigEndian.PutUint16(hdr[4:6], uint16(l4Len))
-	} else {
-		binary.BigEndian.PutUint16(hdr[2:4], uint16(total))
-		hdr[10] = 0
-		hdr[11] = 0
-		binary.BigEndian.PutUint16(hdr[10:12], ipv4HdrChecksum(hdr[:s.ipHdrLen]))
-	}
-
-	var psum uint32
-	if s.isV6 {
-		psum = pseudoSumIPv6(hdr[8:24], hdr[24:40], ipProtoTCP, l4Len)
-	} else {
-		psum = pseudoSumIPv4(hdr[12:16], hdr[16:20], ipProtoTCP, l4Len)
-	}
-	tcsum := s.ipHdrLen + 16
-	binary.BigEndian.PutUint16(hdr[tcsum:tcsum+2], foldOnceNoInvert(psum))
-
-	return c.gsoW.WriteGSO(hdr, s.payIovs, uint16(s.gsoSize), s.isV6, uint16(s.ipHdrLen))
-}
-
-// headersMatch compares two IP+TCP header prefixes for byte-for-byte
-// equality on every field that must be identical across coalesced
-// segments. Size/IPID/IPCsum/seq/flags/tcpCsum are masked out.
-func headersMatch(a, b []byte, isV6 bool, ipHdrLen int) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	if isV6 {
-		// IPv6: bytes [0:4] = version/TC/flow-label, [6:8] = next_hdr/hop,
-		// [8:40] = src+dst. Skip [4:6] payload length.
-		if !bytes.Equal(a[0:4], b[0:4]) {
-			return false
-		}
-		if !bytes.Equal(a[6:40], b[6:40]) {
-			return false
-		}
-	} else {
-		// IPv4: [0:2] version/IHL/TOS, [6:10] flags/fragoff/TTL/proto,
-		// [12:20] src+dst. Skip [2:4] total len, [4:6] id, [10:12] csum.
-		if !bytes.Equal(a[0:2], b[0:2]) {
-			return false
-		}
-		if !bytes.Equal(a[6:10], b[6:10]) {
-			return false
-		}
-		if !bytes.Equal(a[12:20], b[12:20]) {
-			return false
-		}
-	}
-	// TCP: compare [0:4] ports, [8:13] ack+dataoff, [14:16] window,
-	// [18:tcpHdrLen] options (incl. urgent).
-	tcp := ipHdrLen
-	if !bytes.Equal(a[tcp:tcp+4], b[tcp:tcp+4]) {
-		return false
-	}
-	if !bytes.Equal(a[tcp+8:tcp+13], b[tcp+8:tcp+13]) {
-		return false
-	}
-	if !bytes.Equal(a[tcp+14:tcp+16], b[tcp+14:tcp+16]) {
-		return false
-	}
-	if !bytes.Equal(a[tcp+18:], b[tcp+18:]) {
-		return false
-	}
-	return true
-}
-
-// ipv4HdrChecksum computes the IPv4 header checksum over hdr (which must
-// already have its checksum field zeroed) and returns the folded/inverted
-// 16-bit value to store.
-func ipv4HdrChecksum(hdr []byte) uint16 {
-	var sum uint32
-	for i := 0; i+1 < len(hdr); i += 2 {
-		sum += uint32(binary.BigEndian.Uint16(hdr[i : i+2]))
-	}
-	if len(hdr)%2 == 1 {
-		sum += uint32(hdr[len(hdr)-1]) << 8
-	}
-	for sum>>16 != 0 {
-		sum = (sum & 0xffff) + (sum >> 16)
-	}
-	return ^uint16(sum)
-}
-
-// pseudoSumIPv4 / pseudoSumIPv6 build the TCP pseudo-header partial sum
-// expected by the virtio NEEDS_CSUM kernel path: the 32-bit accumulator
-// before folding.
-func pseudoSumIPv4(src, dst []byte, proto byte, l4Len int) uint32 {
-	var sum uint32
-	sum += uint32(binary.BigEndian.Uint16(src[0:2]))
-	sum += uint32(binary.BigEndian.Uint16(src[2:4]))
-	sum += uint32(binary.BigEndian.Uint16(dst[0:2]))
-	sum += uint32(binary.BigEndian.Uint16(dst[2:4]))
-	sum += uint32(proto)
-	sum += uint32(l4Len)
-	return sum
-}
-
-func pseudoSumIPv6(src, dst []byte, proto byte, l4Len int) uint32 {
-	var sum uint32
-	for i := 0; i < 16; i += 2 {
-		sum += uint32(binary.BigEndian.Uint16(src[i : i+2]))
-		sum += uint32(binary.BigEndian.Uint16(dst[i : i+2]))
-	}
-	sum += uint32(l4Len >> 16)
-	sum += uint32(l4Len & 0xffff)
-	sum += uint32(proto)
-	return sum
-}
-
-// foldOnceNoInvert folds the 32-bit accumulator to 16 bits and returns it
-// unchanged (no one's complement). This is what virtio NEEDS_CSUM wants in
-// the L4 checksum field — the kernel will add the payload sum and invert.
-func foldOnceNoInvert(sum uint32) uint16 {
-	for sum>>16 != 0 {
-		sum = (sum & 0xffff) + (sum >> 16)
-	}
-	return uint16(sum)
-}

tcp_coalesce_test.go

@@ -1,576 +0,0 @@
-package nebula
-
-import (
-	"encoding/binary"
-	"testing"
-)
-
-// fakeTunWriter records plain Writes and WriteGSO calls without touching a
-// real TUN fd. WriteGSO preserves the split between hdr and borrowed pays
-// so tests can inspect each independently.
-type fakeTunWriter struct {
-	gsoEnabled bool
-	writes     [][]byte
-	gsoWrites  []fakeGSOWrite
-}
-
-type fakeGSOWrite struct {
-	hdr       []byte
-	pays      [][]byte
-	gsoSize   uint16
-	isV6      bool
-	csumStart uint16
-}
-
-// total returns hdrLen + sum of pay lens.
-func (g fakeGSOWrite) total() int {
-	n := len(g.hdr)
-	for _, p := range g.pays {
-		n += len(p)
-	}
-	return n
-}
-
-// payLen sums the pays.
-func (g fakeGSOWrite) payLen() int {
-	var n int
-	for _, p := range g.pays {
-		n += len(p)
-	}
-	return n
-}
-
-func (w *fakeTunWriter) Write(p []byte) (int, error) {
-	buf := make([]byte, len(p))
-	copy(buf, p)
-	w.writes = append(w.writes, buf)
-	return len(p), nil
-}
-
-func (w *fakeTunWriter) WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error {
-	hcopy := make([]byte, len(hdr))
-	copy(hcopy, hdr)
-	paysCopy := make([][]byte, len(pays))
-	for i, p := range pays {
-		pc := make([]byte, len(p))
-		copy(pc, p)
-		paysCopy[i] = pc
-	}
-	w.gsoWrites = append(w.gsoWrites, fakeGSOWrite{
-		hdr:       hcopy,
-		pays:      paysCopy,
-		gsoSize:   gsoSize,
-		isV6:      isV6,
-		csumStart: csumStart,
-	})
-	return nil
-}
-
-func (w *fakeTunWriter) GSOSupported() bool { return w.gsoEnabled }
-
-// buildTCPv4 constructs a minimal IPv4+TCP packet with the given payload,
-// seq, and flags. Assumes no IP options and a 20-byte TCP header.
-func buildTCPv4(seq uint32, flags byte, payload []byte) []byte {
-	return buildTCPv4Ports(1000, 2000, seq, flags, payload)
-}
-
-// buildTCPv4Ports is buildTCPv4 with caller-specified ports so tests can
-// build distinct flows.
-func buildTCPv4Ports(sport, dport uint16, seq uint32, flags byte, payload []byte) []byte {
-	const ipHdrLen = 20
-	const tcpHdrLen = 20
-	total := ipHdrLen + tcpHdrLen + len(payload)
-	pkt := make([]byte, total)
-
-	pkt[0] = 0x45
-	pkt[1] = 0x00
-	binary.BigEndian.PutUint16(pkt[2:4], uint16(total))
-	binary.BigEndian.PutUint16(pkt[4:6], 0)
-	binary.BigEndian.PutUint16(pkt[6:8], 0x4000)
-	pkt[8] = 64
-	pkt[9] = ipProtoTCP
-	copy(pkt[12:16], []byte{10, 0, 0, 1})
-	copy(pkt[16:20], []byte{10, 0, 0, 2})
-
-	binary.BigEndian.PutUint16(pkt[20:22], sport)
-	binary.BigEndian.PutUint16(pkt[22:24], dport)
-	binary.BigEndian.PutUint32(pkt[24:28], seq)
-	binary.BigEndian.PutUint32(pkt[28:32], 12345)
-	pkt[32] = 0x50
-	pkt[33] = flags
-	binary.BigEndian.PutUint16(pkt[34:36], 0xffff)
-
-	copy(pkt[40:], payload)
-	return pkt
-}
-
-const (
-	tcpAck    = 0x10
-	tcpPsh    = 0x08
-	tcpSyn    = 0x02
-	tcpFin    = 0x01
-	tcpAckPsh = tcpAck | tcpPsh
-)
-
-func TestCoalescerPassthroughWhenGSOUnavailable(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: false}
-	c := newTCPCoalescer(w)
-	pkt := buildTCPv4(1000, tcpAck, []byte("hello"))
-	if err := c.Add(pkt); err != nil {
-		t.Fatal(err)
-	}
-	// No sync write — passthrough is deferred to Flush.
-	if len(w.writes) != 0 || len(w.gsoWrites) != 0 {
-		t.Fatalf("no Add-time writes: got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	if len(w.writes) != 1 || len(w.gsoWrites) != 0 {
-		t.Fatalf("want single plain write, got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerNonTCPPassthrough(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pkt := make([]byte, 28)
-	pkt[0] = 0x45
-	binary.BigEndian.PutUint16(pkt[2:4], 28)
-	pkt[9] = 1
-	copy(pkt[12:16], []byte{10, 0, 0, 1})
-	copy(pkt[16:20], []byte{10, 0, 0, 2})
-	if err := c.Add(pkt); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	if len(w.writes) != 1 || len(w.gsoWrites) != 0 {
-		t.Fatalf("ICMP should pass through unchanged")
-	}
-}
-
-func TestCoalescerSeedThenFlushAlone(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pkt := buildTCPv4(1000, tcpAck, make([]byte, 1000))
-	if err := c.Add(pkt); err != nil {
-		t.Fatal(err)
-	}
-	if len(w.writes) != 0 || len(w.gsoWrites) != 0 {
-		t.Fatalf("unexpected output before flush")
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// Single-segment flush now goes through WriteGSO with GSO_NONE
-	// (virtio NEEDS_CSUM lets the kernel fill in the L4 csum).
-	if len(w.gsoWrites) != 1 || len(w.writes) != 0 {
-		t.Fatalf("single-seg flush: writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-	g := w.gsoWrites[0]
-	if g.total() != 40+1000 {
-		t.Errorf("super total=%d want %d", g.total(), 40+1000)
-	}
-	if g.payLen() != 1000 {
-		t.Errorf("payLen=%d want 1000", g.payLen())
-	}
-}
-
-func TestCoalescerCoalescesAdjacentACKs(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(2200, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(3400, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	if len(w.gsoWrites) != 1 {
-		t.Fatalf("want 1 gso write, got %d (plain=%d)", len(w.gsoWrites), len(w.writes))
-	}
-	g := w.gsoWrites[0]
-	if g.gsoSize != 1200 {
-		t.Errorf("gsoSize=%d want 1200", g.gsoSize)
-	}
-	if len(g.hdr) != 40 {
-		t.Errorf("hdrLen=%d want 40", len(g.hdr))
-	}
-	if g.csumStart != 20 {
-		t.Errorf("csumStart=%d want 20", g.csumStart)
-	}
-	if len(g.pays) != 3 {
-		t.Errorf("pay count=%d want 3", len(g.pays))
-	}
-	if g.total() != 40+3*1200 {
-		t.Errorf("superpacket len=%d want %d", g.total(), 40+3*1200)
-	}
-	if tot := binary.BigEndian.Uint16(g.hdr[2:4]); int(tot) != g.total() {
-		t.Errorf("ip total_length=%d want %d", tot, g.total())
-	}
-}
-
-func TestCoalescerRejectsSeqGap(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(3000, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// Each packet flushes as its own single-segment WriteGSO now.
-	if len(w.gsoWrites) != 2 || len(w.writes) != 0 {
-		t.Fatalf("seq gap: want 2 gso writes got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerRejectsFlagMismatch(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	// SYN|ACK is non-admissible. Must flush matching flow's slot (gso)
-	// and then plain-write the SYN packet itself.
-	syn := buildTCPv4(2200, tcpSyn|tcpAck, pay)
-	if err := c.Add(syn); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	if len(w.writes) != 1 || len(w.gsoWrites) != 1 {
-		t.Fatalf("flag mismatch: want 1 plain + 1 gso, got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerRejectsFIN(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	fin := buildTCPv4(1000, tcpAck|tcpFin, []byte("x"))
-	if err := c.Add(fin); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// FIN isn't admissible — passthrough as plain, no slot, no gso.
-	if len(w.writes) != 1 || len(w.gsoWrites) != 0 {
-		t.Fatalf("FIN should be passthrough, got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerShortLastSegmentClosesChain(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	full := make([]byte, 1200)
-	half := make([]byte, 500)
-	if err := c.Add(buildTCPv4(1000, tcpAck, full)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(2200, tcpAck, half)); err != nil {
-		t.Fatal(err)
-	}
-	// Chain now closed; next packet seeds a new slot on the same flow
-	// after flushing the old one.
-	if err := c.Add(buildTCPv4(2700, tcpAck, full)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// Expect two gso writes: the first two packets coalesced, then the
-	// third flushed alone (single-seg via GSO_NONE).
-	if len(w.gsoWrites) != 2 {
-		t.Fatalf("want 2 gso writes got %d", len(w.gsoWrites))
-	}
-	if len(w.writes) != 0 {
-		t.Fatalf("want 0 plain writes got %d", len(w.writes))
-	}
-	if w.gsoWrites[0].gsoSize != 1200 {
-		t.Errorf("gsoSize=%d want 1200", w.gsoWrites[0].gsoSize)
-	}
-	if got, want := w.gsoWrites[0].total(), 40+1200+500; got != want {
-		t.Errorf("super len=%d want %d", got, want)
-	}
-}
-
-func TestCoalescerPSHFinalizesChain(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(2200, tcpAckPsh, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4(3400, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// First two coalesce; the third seeds a fresh slot that flushes alone.
-	if len(w.gsoWrites) != 2 {
-		t.Fatalf("want 2 gso writes got %d", len(w.gsoWrites))
-	}
-	if len(w.writes) != 0 {
-		t.Fatalf("want 0 plain writes got %d", len(w.writes))
-	}
-}
-
-func TestCoalescerRejectsDifferentFlow(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-	p1 := buildTCPv4(1000, tcpAck, pay)
-	p2 := buildTCPv4(2200, tcpAck, pay)
-	binary.BigEndian.PutUint16(p2[20:22], 9999)
-	if err := c.Add(p1); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(p2); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// Two independent flows, each flushes its own single-segment WriteGSO.
-	if len(w.gsoWrites) != 2 || len(w.writes) != 0 {
-		t.Fatalf("diff flow: want 2 gso writes got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerRejectsIPOptions(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 500)
-	pkt := buildTCPv4(1000, tcpAck, pay)
-	// Bump IHL to 6 to simulate 4 bytes of IP options. Don't actually add
-	// bytes — parser should bail before it matters.
-	pkt[0] = 0x46
-	if err := c.Add(pkt); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	// Non-admissible parse → passthrough as plain.
-	if len(w.writes) != 1 || len(w.gsoWrites) != 0 {
-		t.Fatalf("IP options should passthrough, got writes=%d gso=%d", len(w.writes), len(w.gsoWrites))
-	}
-}
-
-func TestCoalescerCapBySegments(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 512)
-	seq := uint32(1000)
-	for i := 0; i < tcpCoalesceMaxSegs+5; i++ {
-		if err := c.Add(buildTCPv4(seq, tcpAck, pay)); err != nil {
-			t.Fatal(err)
-		}
-		seq += uint32(len(pay))
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	for _, g := range w.gsoWrites {
-		segs := len(g.pays)
-		if segs > tcpCoalesceMaxSegs {
-			t.Fatalf("super exceeded seg cap: %d > %d", segs, tcpCoalesceMaxSegs)
-		}
-	}
-}
-
-// TestCoalescerMultipleFlowsInSameBatch proves two interleaved bulk TCP
-// flows coalesce independently in a single Flush.
-func TestCoalescerMultipleFlowsInSameBatch(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-
-	// Flow A: sport 1000. Flow B: sport 3000.
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 100, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 500, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 1300, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 1700, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 2500, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 2900, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-
-	if len(w.gsoWrites) != 2 {
-		t.Fatalf("want 2 gso writes (one per flow), got %d", len(w.gsoWrites))
-	}
-	if len(w.writes) != 0 {
-		t.Fatalf("want no plain writes, got %d", len(w.writes))
-	}
-	// Each superpacket should carry 3 segments.
-	for i, g := range w.gsoWrites {
-		if len(g.pays) != 3 {
-			t.Errorf("gso[%d]: segs=%d want 3", i, len(g.pays))
-		}
-		if g.gsoSize != 1200 {
-			t.Errorf("gso[%d]: gsoSize=%d want 1200", i, g.gsoSize)
-		}
-	}
-	// Verify each superpacket carries the source port it was seeded with.
-	seenSports := map[uint16]bool{}
-	for _, g := range w.gsoWrites {
-		sp := binary.BigEndian.Uint16(g.hdr[20:22])
-		seenSports[sp] = true
-	}
-	if !seenSports[1000] || !seenSports[3000] {
-		t.Errorf("expected superpackets for sports 1000 and 3000, got %v", seenSports)
-	}
-}
-
-// TestCoalescerPreservesArrivalOrder confirms that with passthrough and
-// coalesced events both queued, Flush emits them in Add order rather than
-// writing passthrough packets synchronously.
-func TestCoalescerPreservesArrivalOrder(t *testing.T) {
-	w := &orderedFakeWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	// Sequence: coalesceable TCP, ICMP (passthrough), coalesceable TCP on
-	// a different flow. Expected emit order: gso(X), plain(ICMP), gso(Y).
-	pay := make([]byte, 1200)
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 100, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	icmp := make([]byte, 28)
-	icmp[0] = 0x45
-	binary.BigEndian.PutUint16(icmp[2:4], 28)
-	icmp[9] = 1
-	copy(icmp[12:16], []byte{10, 0, 0, 1})
-	copy(icmp[16:20], []byte{10, 0, 0, 3})
-	if err := c.Add(icmp); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 500, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	// Nothing should have hit the writer synchronously.
-	if len(w.events) != 0 {
-		t.Fatalf("Add emitted events synchronously: %v", w.events)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-	if got, want := w.events, []string{"gso", "plain", "gso"}; !stringSliceEq(got, want) {
-		t.Fatalf("flush order=%v want %v", got, want)
-	}
-}
-
-// orderedFakeWriter records only the sequence of call types so tests can
-// assert arrival order without inspecting bytes.
-type orderedFakeWriter struct {
-	gsoEnabled bool
-	events     []string
-}
-
-func (w *orderedFakeWriter) Write(p []byte) (int, error) {
-	w.events = append(w.events, "plain")
-	return len(p), nil
-}
-
-func (w *orderedFakeWriter) WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error {
-	w.events = append(w.events, "gso")
-	return nil
-}
-
-func (w *orderedFakeWriter) GSOSupported() bool { return w.gsoEnabled }
-
-func stringSliceEq(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for i := range a {
-		if a[i] != b[i] {
-			return false
-		}
-	}
-	return true
-}
-
-// TestCoalescerInterleavedFlowsPreserveOrdering checks that a non-admissible
-// packet (SYN) mid-flow only flushes its own flow, not others.
-func TestCoalescerInterleavedFlowsPreserveOrdering(t *testing.T) {
-	w := &fakeTunWriter{gsoEnabled: true}
-	c := newTCPCoalescer(w)
-	pay := make([]byte, 1200)
-
-	// Flow A two segments.
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 100, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(1000, 2000, 1300, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	// Flow B two segments.
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 500, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 1700, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	// Flow A SYN (non-admissible) — must flush only flow A's slot.
-	syn := buildTCPv4Ports(1000, 2000, 9999, tcpSyn|tcpAck, pay)
-	if err := c.Add(syn); err != nil {
-		t.Fatal(err)
-	}
-	// Flow B continues — should still be coalesced with its seed.
-	if err := c.Add(buildTCPv4Ports(3000, 2000, 2900, tcpAck, pay)); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Flush(); err != nil {
-		t.Fatal(err)
-	}
-
-	// Expected:
-	//   - 1 gso for flow A (first 2 segments)
-	//   - 1 plain for flow A SYN
-	//   - 1 gso for flow B (3 segments)
-	if len(w.gsoWrites) != 2 {
-		t.Fatalf("want 2 gso writes, got %d", len(w.gsoWrites))
-	}
-	if len(w.writes) != 1 {
-		t.Fatalf("want 1 plain write (SYN), got %d", len(w.writes))
-	}
-	// Find the 3-segment gso (flow B) and the 2-segment gso (flow A).
-	var segCounts []int
-	for _, g := range w.gsoWrites {
-		segCounts = append(segCounts, len(g.pays))
-	}
-	if !(segCounts[0] == 2 && segCounts[1] == 3) && !(segCounts[0] == 3 && segCounts[1] == 2) {
-		t.Errorf("unexpected segment counts: %v (want 2 and 3)", segCounts)
-	}
-}

test/tun.go

@@ -1,7 +1,8 @@
-package overlay
+package test
 
 import (
 	"errors"
+	"io"
 	"net/netip"
 
 	"github.com/slackhq/nebula/routing"
@@ -25,15 +26,11 @@ func (NoopTun) Name() string {
 	return "noop"
 }
 
-func (NoopTun) Read() ([][]byte, error) {
+func (NoopTun) Read([]byte) (int, error) {
-	return nil, nil
-}
-
-func (NoopTun) Write([]byte) (int, error) {
 	return 0, nil
 }
 
-func (NoopTun) WriteReject(p []byte) (int, error) {
+func (NoopTun) Write([]byte) (int, error) {
 	return 0, nil
 }
 
@@ -41,7 +38,7 @@ func (NoopTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (NoopTun) NewMultiQueueReader() (Queue, error) {
+func (NoopTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, errors.New("unsupported")
 }
 

udp/conn.go

@@ -8,12 +8,6 @@ import (
 
 const MTU = 9001
 
-// MaxWriteBatch is the largest batch any Conn.WriteBatch implementation is
-// required to accept. Callers SHOULD NOT pass more than this per call; Linux
-// backends preallocate sendmmsg scratch sized to this value, so exceeding it
-// only costs a chunked retry.
-const MaxWriteBatch = 128
-
 type EncReader func(
 	addr netip.AddrPort,
 	payload []byte,
@@ -22,29 +16,8 @@ type EncReader func(
 type Conn interface {
 	Rebind() error
 	LocalAddr() (netip.AddrPort, error)
-	// ListenOut invokes r for each received packet. On batch-capable
+	ListenOut(r EncReader)
-	// backends (recvmmsg), flush is called after each batch is fully
-	// delivered — callers use it to flush per-batch accumulators such as
-	// TUN write coalescers. Single-packet backends call flush after each
-	// packet. flush must not be nil.
-	ListenOut(r EncReader, flush func()) error
 	WriteTo(b []byte, addr netip.AddrPort) error
-	// WriteBatch sends a contiguous batch of packets, each with its own
-	// destination. bufs and addrs must have the same length. Linux uses
-	// sendmmsg(2) for a single syscall; other backends fall back to a
-	// WriteTo loop. Returns on the first error; callers may observe a
-	// partial send if some packets went out before the error.
-	WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error
-	// WriteSegmented sends bufs as a single UDP GSO sendmsg when the kernel
-	// supports it: all bufs go to the same addr, each must be exactly segSize
-	// bytes except the last which may be shorter. The kernel emits one
-	// datagram per buf on the wire. Backends / kernels without GSO support
-	// fall back to a per-packet WriteTo loop. Returns on the first error.
-	WriteSegmented(bufs [][]byte, addr netip.AddrPort, segSize int) error
-	// SupportsGSO reports whether WriteSegmented takes the single-syscall
-	// GSO path. Callers use this to decide at batch-assembly time whether
-	// the uniform-size / same-dst check is worth running.
-	SupportsGSO() bool
 	ReloadConfig(c *config.C)
 	SupportsMultipleReaders() bool
 	Close() error
@@ -58,8 +31,8 @@ func (NoopConn) Rebind() error {
 func (NoopConn) LocalAddr() (netip.AddrPort, error) {
 	return netip.AddrPort{}, nil
 }
-func (NoopConn) ListenOut(_ EncReader, _ func()) error {
+func (NoopConn) ListenOut(_ EncReader) {
-	return nil
+	return
 }
 func (NoopConn) SupportsMultipleReaders() bool {
 	return false
@@ -67,15 +40,6 @@ func (NoopConn) SupportsMultipleReaders() bool {
 func (NoopConn) WriteTo(_ []byte, _ netip.AddrPort) error {
 	return nil
 }
-func (NoopConn) WriteBatch(_ [][]byte, _ []netip.AddrPort) error {
-	return nil
-}
-func (NoopConn) WriteSegmented(_ [][]byte, _ netip.AddrPort, _ int) error {
-	return nil
-}
-func (NoopConn) SupportsGSO() bool {
-	return false
-}
 func (NoopConn) ReloadConfig(_ *config.C) {
 	return
 }

udp/udp_darwin.go

@@ -140,26 +140,6 @@ func (u *StdConn) WriteTo(b []byte, ap netip.AddrPort) error {
 	}
 }
 
-func (u *StdConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
-	for i, b := range bufs {
-		if err := u.WriteTo(b, addrs[i]); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *StdConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, _ int) error {
-	for _, b := range bufs {
-		if err := u.WriteTo(b, addr); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *StdConn) SupportsGSO() bool { return false }
-
 func (u *StdConn) LocalAddr() (netip.AddrPort, error) {
 	a := u.UDPConn.LocalAddr()
 
@@ -185,7 +165,7 @@ func NewUDPStatsEmitter(udpConns []Conn) func() {
 	return func() {}
 }
 
-func (u *StdConn) ListenOut(r EncReader, flush func()) error {
+func (u *StdConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
 	for {
@@ -193,14 +173,14 @@ func (u *StdConn) ListenOut(r EncReader, flush func()) error {
 		n, rua, err := u.ReadFromUDPAddrPort(buffer)
 		if err != nil {
 			if errors.Is(err, net.ErrClosed) {
-				return err
+				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+				return
 			}
 
 			u.l.WithError(err).Error("unexpected udp socket receive error")
 		}
 
 		r(netip.AddrPortFrom(rua.Addr().Unmap(), rua.Port()), buffer[:n])
-		flush()
 	}
 }
 

udp/udp_generic.go

@@ -10,9 +10,11 @@ package udp
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
+	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
@@ -42,26 +44,6 @@ func (u *GenericConn) WriteTo(b []byte, addr netip.AddrPort) error {
 	return err
 }
 
-func (u *GenericConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
-	for i, b := range bufs {
-		if _, err := u.UDPConn.WriteToUDPAddrPort(b, addrs[i]); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *GenericConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, _ int) error {
-	for _, b := range bufs {
-		if _, err := u.UDPConn.WriteToUDPAddrPort(b, addr); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *GenericConn) SupportsGSO() bool { return false }
-
 func (u *GenericConn) LocalAddr() (netip.AddrPort, error) {
 	a := u.UDPConn.LocalAddr()
 
@@ -91,18 +73,28 @@ type rawMessage struct {
 	Len uint32
 }
 
-func (u *GenericConn) ListenOut(r EncReader, flush func()) error {
+func (u *GenericConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
+	var lastRecvErr time.Time
+
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.ReadFromUDPAddrPort(buffer)
 		if err != nil {
-			return err
+			if errors.Is(err, net.ErrClosed) {
+				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+				return
+			}
+			// Dampen unexpected message warns to once per minute
+			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
+				lastRecvErr = time.Now()
+				u.l.WithError(err).Warn("unexpected udp socket receive error")
+			}
+			continue
 		}
 
 		r(netip.AddrPortFrom(rua.Addr().Unmap(), rua.Port()), buffer[:n])
-		flush()
 	}
 }
 

udp/udp_linux.go

@@ -21,35 +21,10 @@ import (
 type StdConn struct {
 	udpConn *net.UDPConn
 	rawConn syscall.RawConn
+	sockFd  int
 	isV4    bool
 	l       *logrus.Logger
 	batch   int
-
-	// sendmmsg scratch. Each queue has its own StdConn, so no locking is
-	// needed. Sized to MaxWriteBatch at construction; WriteBatch chunks
-	// larger inputs.
-	writeMsgs  []rawMessage
-	writeIovs  []iovec
-	writeNames [][]byte
-
-	// Preallocated closure + in/out slots for sendmmsg, so the hot path
-	// does not heap-allocate a fresh closure per call.
-	writeChunk int
-	writeSent  int
-	writeErrno syscall.Errno
-	writeFunc  func(fd uintptr) bool
-
-	// UDP GSO (sendmsg with UDP_SEGMENT cmsg) support. gsoSupported is
-	// probed once at socket creation. When true, WriteSegmented takes a
-	// single-syscall GSO path; otherwise it falls back to a WriteTo loop.
-	gsoSupported bool
-	gsoMsg       msghdr
-	gsoIovs      []iovec
-	gsoName      []byte // SizeofSockaddrInet6
-	gsoCmsg      []byte // CmsgSpace(2)
-	gsoSent      int
-	gsoErrno     syscall.Errno
-	gsoFunc      func(fd uintptr) bool
 }
 
 func setReusePort(network, address string, c syscall.RawConn) error {
@@ -70,8 +45,12 @@ func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch in
 	if multi {
 		lc.Control = setReusePort
 	}
+	network := "udp"
+	if ip.Is4() { //todo I am not a fan of this, would prefer a default where we always bind dual-stack unless given a non-wildcard v4 addr
+		network = "udp4"
+	}
 	//this context is only used during the bind operation, you can't cancel it to kill the socket
-	pc, err := lc.ListenPacket(context.Background(), "udp", listen.String())
+	pc, err := lc.ListenPacket(context.Background(), network, listen.String())
 	if err != nil {
 		return nil, fmt.Errorf("unable to open socket: %s", err)
 	}
@@ -81,74 +60,25 @@ func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch in
 		_ = udpConn.Close()
 		return nil, err
 	}
-	//gotta find out if we got an AF_INET6 socket or not:
-	out := &StdConn{
-		udpConn: udpConn,
-		rawConn: rawConn,
-		l:       l,
-		batch:   batch,
-	}
 
-	af, err := out.getSockOptInt(unix.SO_DOMAIN)
+	//steal the socket's fd for sending
+	var sockFd uintptr
+	err = rawConn.Control(func(fd uintptr) {
+		sockFd = fd
+	})
 	if err != nil {
-		_ = out.Close()
+		_ = udpConn.Close()
 		return nil, err
 	}
-	out.isV4 = af == unix.AF_INET
 
-	out.prepareWriteMessages(MaxWriteBatch)
+	return &StdConn{
-	out.writeFunc = out.sendmmsgRawWrite
+		udpConn: udpConn,
-
+		rawConn: rawConn,
-	out.prepareGSO()
+		sockFd:  int(sockFd),
-
+		isV4:    ip.Is4(),
-	return out, nil
+		l:       l,
-}
+		batch:   batch,
-
+	}, err
-// maxGSOSegments caps the per-sendmsg GSO fan-out. Linux kernels have
-// historically capped UDP_MAX_SEGMENTS at 64; newer kernels raise it to 128
-// but we stay conservative so the same code works everywhere.
-const maxGSOSegments = 64
-
-// maxGSOBytes bounds the total payload per sendmsg() when UDP_SEGMENT is
-// set. The kernel stitches all iovecs into a single skb whose length the
-// UDP length field can represent, and also enforces sk_gso_max_size (which
-// on most devices is 65536). We use 65535 so ciphertext + headers always
-// fits, avoiding EMSGSIZE on large TSO superpackets.
-const maxGSOBytes = 65535
-
-// prepareGSO probes UDP_SEGMENT support and, on success, sets up the
-// reusable sendmsg scratch (iovecs, sockaddr, cmsg) plus the preallocated
-// raw-write closure used to avoid heap allocations on the hot path.
-func (u *StdConn) prepareGSO() {
-	var probeErr error
-	if err := u.rawConn.Control(func(fd uintptr) {
-		probeErr = unix.SetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_SEGMENT, 0)
-	}); err != nil {
-		return
-	}
-	if probeErr != nil {
-		return
-	}
-	u.gsoSupported = true
-	u.gsoIovs = make([]iovec, maxGSOSegments)
-	u.gsoName = make([]byte, unix.SizeofSockaddrInet6)
-	u.gsoCmsg = make([]byte, unix.CmsgSpace(2))
-
-	// Wire up the static pieces of gsoMsg. Iovlen / Controllen / Namelen /
-	// cmsg contents get refreshed per call; Iov, Name, Control pointers are
-	// fixed because the scratch slices never move.
-	u.gsoMsg.Iov = &u.gsoIovs[0]
-	u.gsoMsg.Name = &u.gsoName[0]
-	u.gsoMsg.Control = &u.gsoCmsg[0]
-
-	// Prepopulate the cmsg header. Len/Level/Type are constant for our use;
-	// only the 2-byte gso_size payload changes per call.
-	cmsghdr := (*unix.Cmsghdr)(unsafe.Pointer(&u.gsoCmsg[0]))
-	cmsghdr.Level = unix.SOL_UDP
-	cmsghdr.Type = unix.UDP_SEGMENT
-	setCmsgLen(cmsghdr, unix.CmsgLen(2))
-
-	u.gsoFunc = u.sendmsgRawWriteGSO
 }
 
 func (u *StdConn) SupportsMultipleReaders() bool {
@@ -213,19 +143,8 @@ func (u *StdConn) GetSoMark() (int, error) {
 }
 
 func (u *StdConn) LocalAddr() (netip.AddrPort, error) {
-	a := u.udpConn.LocalAddr()
+	addr := u.udpConn.LocalAddr()
-
+	return netip.ParseAddrPort(addr.String())
-	switch v := a.(type) {
-	case *net.UDPAddr:
-		addr, ok := netip.AddrFromSlice(v.IP)
-		if !ok {
-			return netip.AddrPort{}, fmt.Errorf("LocalAddr returned invalid IP address: %s", v.IP)
-		}
-		return netip.AddrPortFrom(addr, uint16(v.Port)), nil
-
-	default:
-		return netip.AddrPort{}, fmt.Errorf("LocalAddr returned: %#v", a)
-	}
 }
 
 func recvmmsg(fd uintptr, msgs []rawMessage) (int, bool, error) {
@@ -249,7 +168,7 @@ func recvmmsg(fd uintptr, msgs []rawMessage) (int, bool, error) {
 	return int(n), true, nil
 }
 
-func (u *StdConn) listenOutSingle(r EncReader, flush func()) error {
+func (u *StdConn) listenOutSingle(r EncReader) {
 	var err error
 	var n int
 	var from netip.AddrPort
@@ -258,15 +177,15 @@ func (u *StdConn) listenOutSingle(r EncReader, flush func()) error {
 	for {
 		n, from, err = u.udpConn.ReadFromUDPAddrPort(buffer)
 		if err != nil {
-			return err
+			u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+			return
 		}
 		from = netip.AddrPortFrom(from.Addr().Unmap(), from.Port())
 		r(from, buffer[:n])
-		flush()
 	}
 }
 
-func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
+func (u *StdConn) listenOutBatch(r EncReader) {
 	var ip netip.Addr
 	var n int
 	var operr error
@@ -283,10 +202,12 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 	for {
 		err := u.rawConn.Read(reader)
 		if err != nil {
-			return err
+			u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+			return
 		}
 		if operr != nil {
-			return operr
+			u.l.WithError(operr).Debug("operr: udp socket is closed, exiting read loop")
+			return
 		}
 
 		for i := 0; i < n; i++ {
@@ -298,254 +219,79 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 			}
 			r(netip.AddrPortFrom(ip.Unmap(), binary.BigEndian.Uint16(names[i][2:4])), buffers[i][:msgs[i].Len])
 		}
-		// End-of-batch: let callers (e.g. TUN write coalescer) flush any
-		// state they accumulated across this batch.
-		flush()
 	}
 }
 
-func (u *StdConn) ListenOut(r EncReader, flush func()) error {
+func (u *StdConn) ListenOut(r EncReader) {
 	if u.batch == 1 {
-		return u.listenOutSingle(r, flush)
+		//save some ram by not calling PrepareRawMessages for fields we won't use
+		//we could also make this path more common by calling recvmmsg with msgs[:1],
+		//but that's still the recvmmsg syscall, which would be a change
+		u.listenOutSingle(r)
 	} else {
-		return u.listenOutBatch(r, flush)
+		u.listenOutBatch(r)
 	}
 }
 
 func (u *StdConn) WriteTo(b []byte, ip netip.AddrPort) error {
-	_, err := u.udpConn.WriteToUDPAddrPort(b, ip)
+	if u.isV4 {
-	return err
+		return u.writeTo4(b, ip)
+	}
+	return u.writeTo6(b, ip)
 }
 
-// WriteBatch sends bufs via sendmmsg(2) using the preallocated scratch on
+func (u *StdConn) writeTo6(b []byte, ip netip.AddrPort) error {
-// StdConn. Chunks larger than the scratch are processed in multiple syscalls.
+	var rsa unix.RawSockaddrInet6
-// If sendmmsg returns a fatal error mid-chunk we fall back to single WriteTo
+	rsa.Family = unix.AF_INET6
-// calls for the remainder so the caller still gets best-effort delivery.
+	rsa.Addr = ip.Addr().As16()
-func (u *StdConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
+	binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&rsa.Port))[:], ip.Port())
-	if len(bufs) != len(addrs) {
-		return fmt.Errorf("WriteBatch: len(bufs)=%d != len(addrs)=%d", len(bufs), len(addrs))
-	}
-	//u.l.WithField("bufs", len(bufs)).Info("WriteBatch")
-	i := 0
-	for i < len(bufs) {
-		chunk := len(bufs) - i
-		if chunk > len(u.writeMsgs) {
-			chunk = len(u.writeMsgs)
-		}
 
-		for k := 0; k < chunk; k++ {
+	for {
-			b := bufs[i+k]
+		_, _, err := unix.Syscall6(
-			if len(b) == 0 {
+			unix.SYS_SENDTO,
-				// sendmmsg with an empty iovec is legal but pointless; fall
+			uintptr(u.sockFd),
-				// through after filling the slot so Base is still valid.
+			uintptr(unsafe.Pointer(&b[0])),
-				u.writeIovs[k].Base = nil
+			uintptr(len(b)),
-				setIovLen(&u.writeIovs[k], 0)
+			uintptr(0),
-			} else {
+			uintptr(unsafe.Pointer(&rsa)),
-				u.writeIovs[k].Base = &b[0]
+			uintptr(unix.SizeofSockaddrInet6),
-				setIovLen(&u.writeIovs[k], len(b))
-			}
-			nlen, err := writeSockaddr(u.writeNames[k], addrs[i+k], u.isV4)
-			if err != nil {
-				return err
-			}
-			u.writeMsgs[k].Hdr.Namelen = uint32(nlen)
-		}
-
-		sent, serr := u.sendmmsg(chunk)
-		if serr != nil {
-			if sent <= 0 {
-				// nothing went out; fall back to WriteTo for this chunk.
-				for k := 0; k < chunk; k++ {
-					if err := u.WriteTo(bufs[i+k], addrs[i+k]); err != nil {
-						return err
-					}
-				}
-				i += chunk
-				continue
-			}
-			// partial: treat as success for the sent packets and retry the
-			// remainder on the next outer-loop iteration.
-		}
-		if sent == 0 {
-			return fmt.Errorf("sendmmsg made no progress")
-		}
-		i += sent
-	}
-	return nil
-}
-
-// sendmmsgRawWrite is the preallocated callback passed to rawConn.Write. It
-// reads its input (u.writeChunk) and writes its outputs (u.writeSent,
-// u.writeErrno) through StdConn fields so the closure itself does not
-// capture per-call locals and therefore does not heap-allocate.
-func (u *StdConn) sendmmsgRawWrite(fd uintptr) bool {
-	r1, _, errno := unix.Syscall6(
-		unix.SYS_SENDMMSG,
-		fd,
-		uintptr(unsafe.Pointer(&u.writeMsgs[0])),
-		uintptr(u.writeChunk),
-		0,
-		0,
-		0,
 		)
-	if errno == syscall.EAGAIN || errno == syscall.EWOULDBLOCK {
+
-		return false
+		if err != 0 {
+			return &net.OpError{Op: "sendto", Err: err}
+		}
+
+		return nil
 	}
-	u.writeSent = int(r1)
-	u.writeErrno = errno
-	return true
 }
 
-func (u *StdConn) SupportsGSO() bool {
+func (u *StdConn) writeTo4(b []byte, ip netip.AddrPort) error {
-	return u.gsoSupported
+	if !ip.Addr().Is4() {
-}
+		return ErrInvalidIPv6RemoteForSocket
-
-// WriteSegmented sends bufs to addr as a UDP GSO superpacket. The kernel
-// emits one datagram per iovec on the wire; all iovecs except the last must
-// be exactly segSize bytes. Non-GSO kernels hit the WriteTo fallback.
-// Called with len(bufs) >= 1. len(bufs) > maxGSOSegments is chunked.
-func (u *StdConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, segSize int) error {
-	if len(bufs) == 0 {
-		return nil
-	}
-	if !u.gsoSupported {
-		for _, b := range bufs {
-			if err := u.WriteTo(b, addr); err != nil {
-				return err
-			}
-		}
-		return nil
 	}
 
-	nlen, err := writeSockaddr(u.gsoName, addr, u.isV4)
+	var rsa unix.RawSockaddrInet4
-	if err != nil {
+	rsa.Family = unix.AF_INET
-		return err
+	rsa.Addr = ip.Addr().As4()
-	}
+	binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&rsa.Port))[:], ip.Port())
-	u.gsoMsg.Namelen = uint32(nlen)
-	setMsgControllen(&u.gsoMsg, unix.CmsgSpace(2))
 
-	// Cap the per-syscall fan-out by both segment count and total bytes.
+	for {
-	// Kernel rejects sendmsg with EMSGSIZE when segCount*segSize would
+		_, _, err := unix.Syscall6(
-	// exceed sk_gso_max_size (typically 65536). For segSize > maxGSOBytes
+			unix.SYS_SENDTO,
-	// we can't use GSO at all and must fall back per-packet.
+			uintptr(u.sockFd),
-	segsByBytes := maxGSOBytes / segSize
+			uintptr(unsafe.Pointer(&b[0])),
-	if segsByBytes == 0 {
+			uintptr(len(b)),
-		for _, b := range bufs {
+			uintptr(0),
-			if werr := u.WriteTo(b, addr); werr != nil {
+			uintptr(unsafe.Pointer(&rsa)),
-				return werr
+			uintptr(unix.SizeofSockaddrInet4),
-			}
-		}
-		return nil
-	}
-	maxChunk := maxGSOSegments
-	if segsByBytes < maxChunk {
-		maxChunk = segsByBytes
-	}
-
-	i := 0
-	for i < len(bufs) {
-		chunk := len(bufs) - i
-		if chunk > maxChunk {
-			chunk = maxChunk
-		}
-		for k := 0; k < chunk; k++ {
-			b := bufs[i+k]
-			if len(b) == 0 {
-				u.gsoIovs[k].Base = nil
-				setIovLen(&u.gsoIovs[k], 0)
-			} else {
-				u.gsoIovs[k].Base = &b[0]
-				setIovLen(&u.gsoIovs[k], len(b))
-			}
-		}
-		setMsgIovlen(&u.gsoMsg, chunk)
-		binary.NativeEndian.PutUint16(u.gsoCmsg[unix.CmsgLen(0):unix.CmsgLen(0)+2], uint16(segSize))
-
-		if serr := u.sendmsgGSO(); serr != nil {
-			// Fall back to a per-packet loop for the remainder of the
-			// batch. Dropping the GSO call entirely is safer than
-			// returning mid-superpacket and losing bytes.
-			for k := 0; k < chunk; k++ {
-				if werr := u.WriteTo(bufs[i+k], addr); werr != nil {
-					return werr
-				}
-			}
-		}
-		i += chunk
-	}
-	return nil
-}
-
-// sendmsgRawWriteGSO is the preallocated rawConn.Write callback for the GSO
-// path. Reads the prebuilt u.gsoMsg and writes u.gsoSent / u.gsoErrno.
-func (u *StdConn) sendmsgRawWriteGSO(fd uintptr) bool {
-	r1, _, errno := unix.Syscall(
-		unix.SYS_SENDMSG,
-		fd,
-		uintptr(unsafe.Pointer(&u.gsoMsg)),
-		0,
 		)
-	if errno == syscall.EAGAIN || errno == syscall.EWOULDBLOCK {
-		return false
-	}
-	u.gsoSent = int(r1)
-	u.gsoErrno = errno
-	return true
-}
 
-func (u *StdConn) sendmsgGSO() error {
+		if err != 0 {
-	u.gsoSent = 0
+			return &net.OpError{Op: "sendto", Err: err}
-	u.gsoErrno = 0
-	if err := u.rawConn.Write(u.gsoFunc); err != nil {
-		return err
-	}
-	if u.gsoErrno != 0 {
-		return &net.OpError{Op: "sendmsg", Err: u.gsoErrno}
 		}
+
 		return nil
-}
-
-func (u *StdConn) sendmmsg(n int) (int, error) {
-	u.writeChunk = n
-	u.writeSent = 0
-	u.writeErrno = 0
-	if err := u.rawConn.Write(u.writeFunc); err != nil {
-		return u.writeSent, err
 	}
-	if u.writeErrno != 0 {
-		return u.writeSent, &net.OpError{Op: "sendmmsg", Err: u.writeErrno}
-	}
-	return u.writeSent, nil
-}
-
-// writeSockaddr encodes addr into buf (which must be at least
-// SizeofSockaddrInet6 bytes). Returns the number of bytes used. If isV4 is
-// true and addr is not a v4 (or v4-in-v6) address, returns an error.
-func writeSockaddr(buf []byte, addr netip.AddrPort, isV4 bool) (int, error) {
-	ap := addr.Addr().Unmap()
-	if isV4 {
-		if !ap.Is4() {
-			return 0, ErrInvalidIPv6RemoteForSocket
-		}
-		// struct sockaddr_in: { sa_family_t(2), in_port_t(2, BE), in_addr(4), zero(8) }
-		// sa_family is host endian.
-		binary.NativeEndian.PutUint16(buf[0:2], unix.AF_INET)
-		binary.BigEndian.PutUint16(buf[2:4], addr.Port())
-		ip4 := ap.As4()
-		copy(buf[4:8], ip4[:])
-		for j := 8; j < 16; j++ {
-			buf[j] = 0
-		}
-		return unix.SizeofSockaddrInet4, nil
-	}
-	// struct sockaddr_in6: { sa_family_t(2), in_port_t(2, BE), flowinfo(4), in6_addr(16), scope_id(4) }
-	binary.NativeEndian.PutUint16(buf[0:2], unix.AF_INET6)
-	binary.BigEndian.PutUint16(buf[2:4], addr.Port())
-	binary.NativeEndian.PutUint32(buf[4:8], 0)
-	ip6 := addr.Addr().As16()
-	copy(buf[8:24], ip6[:])
-	binary.NativeEndian.PutUint32(buf[24:28], 0)
-	return unix.SizeofSockaddrInet6, nil
 }
 
 func (u *StdConn) ReloadConfig(c *config.C) {

udp/udp_linux_32.go

@@ -52,35 +52,3 @@ func (u *StdConn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
 
 	return msgs, buffers, names
 }
-
-// prepareWriteMessages allocates one Mmsghdr/iovec/sockaddr scratch per slot,
-// wired up so each writeMsgs[i] already points at writeIovs[i] and
-// writeNames[i]. Callers fill in the iovec Base/Len, the sockaddr bytes, and
-// Namelen before each sendmmsg.
-func (u *StdConn) prepareWriteMessages(n int) {
-	u.writeMsgs = make([]rawMessage, n)
-	u.writeIovs = make([]iovec, n)
-	u.writeNames = make([][]byte, n)
-	for i := range u.writeMsgs {
-		u.writeNames[i] = make([]byte, unix.SizeofSockaddrInet6)
-		u.writeMsgs[i].Hdr.Iov = &u.writeIovs[i]
-		u.writeMsgs[i].Hdr.Iovlen = 1
-		u.writeMsgs[i].Hdr.Name = &u.writeNames[i][0]
-	}
-}
-
-func setIovLen(v *iovec, n int) {
-	v.Len = uint32(n)
-}
-
-func setMsgIovlen(m *msghdr, n int) {
-	m.Iovlen = uint32(n)
-}
-
-func setMsgControllen(m *msghdr, n int) {
-	m.Controllen = uint32(n)
-}
-
-func setCmsgLen(h *unix.Cmsghdr, n int) {
-	h.Len = uint32(n)
-}

udp/udp_linux_64.go

@@ -55,35 +55,3 @@ func (u *StdConn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
 
 	return msgs, buffers, names
 }
-
-// prepareWriteMessages allocates one Mmsghdr/iovec/sockaddr scratch per slot,
-// wired up so each writeMsgs[i] already points at writeIovs[i] and
-// writeNames[i]. Callers fill in the iovec Base/Len, the sockaddr bytes, and
-// Namelen before each sendmmsg.
-func (u *StdConn) prepareWriteMessages(n int) {
-	u.writeMsgs = make([]rawMessage, n)
-	u.writeIovs = make([]iovec, n)
-	u.writeNames = make([][]byte, n)
-	for i := range u.writeMsgs {
-		u.writeNames[i] = make([]byte, unix.SizeofSockaddrInet6)
-		u.writeMsgs[i].Hdr.Iov = &u.writeIovs[i]
-		u.writeMsgs[i].Hdr.Iovlen = 1
-		u.writeMsgs[i].Hdr.Name = &u.writeNames[i][0]
-	}
-}
-
-func setIovLen(v *iovec, n int) {
-	v.Len = uint64(n)
-}
-
-func setMsgIovlen(m *msghdr, n int) {
-	m.Iovlen = uint64(n)
-}
-
-func setMsgControllen(m *msghdr, n int) {
-	m.Controllen = uint64(n)
-}
-
-func setCmsgLen(h *unix.Cmsghdr, n int) {
-	h.Len = uint64(n)
-}

udp/udp_rio_windows.go

@@ -140,7 +140,7 @@ func (u *RIOConn) bind(l *logrus.Logger, sa windows.Sockaddr) error {
 	return nil
 }
 
-func (u *RIOConn) ListenOut(r EncReader, flush func()) error {
+func (u *RIOConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
 	var lastRecvErr time.Time
@@ -151,7 +151,8 @@ func (u *RIOConn) ListenOut(r EncReader, flush func()) error {
 
 		if err != nil {
 			if errors.Is(err, net.ErrClosed) {
-				return err
+				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+				return
 			}
 			// Dampen unexpected message warns to once per minute
 			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
@@ -162,7 +163,6 @@ func (u *RIOConn) ListenOut(r EncReader, flush func()) error {
 		}
 
 		r(netip.AddrPortFrom(netip.AddrFrom16(rua.Addr).Unmap(), (rua.Port>>8)|((rua.Port&0xff)<<8)), buffer[:n])
-		flush()
 	}
 }
 
@@ -317,26 +317,6 @@ func (u *RIOConn) WriteTo(buf []byte, ip netip.AddrPort) error {
 	return winrio.SendEx(u.rq, dataBuffer, 1, nil, addressBuffer, nil, nil, 0, 0)
 }
 
-func (u *RIOConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
-	for i, b := range bufs {
-		if err := u.WriteTo(b, addrs[i]); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *RIOConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, _ int) error {
-	for _, b := range bufs {
-		if err := u.WriteTo(b, addr); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *RIOConn) SupportsGSO() bool { return false }
-
 func (u *RIOConn) LocalAddr() (netip.AddrPort, error) {
 	sa, err := windows.Getsockname(u.sock)
 	if err != nil {

udp/udp_tester.go

@@ -6,7 +6,6 @@ package udp
 import (
 	"io"
 	"net/netip"
-	"os"
 	"sync/atomic"
 
 	"github.com/sirupsen/logrus"
@@ -107,34 +106,13 @@ func (u *TesterConn) WriteTo(b []byte, addr netip.AddrPort) error {
 	return nil
 }
 
-func (u *TesterConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
+func (u *TesterConn) ListenOut(r EncReader) {
-	for i, b := range bufs {
-		if err := u.WriteTo(b, addrs[i]); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *TesterConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, _ int) error {
-	for _, b := range bufs {
-		if err := u.WriteTo(b, addr); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (u *TesterConn) SupportsGSO() bool { return false }
-
-func (u *TesterConn) ListenOut(r EncReader, flush func()) error {
 	for {
 		p, ok := <-u.RxPackets
 		if !ok {
-			return os.ErrClosed
+			return
 		}
 		r(p.From, p.Data)
-		flush()
 	}
 }