Bump github.com/gaissmai/bart from 0.28.0 to 0.29.0

Bumps [github.com/gaissmai/bart](https://github.com/gaissmai/bart) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/gaissmai/bart/releases)
- [Commits](https://github.com/gaissmai/bart/compare/v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: github.com/gaissmai/bart
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/armon/go-radix v1.0.0
 	github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432
 	github.com/flynn/noise v1.1.0
-	github.com/gaissmai/bart v0.28.0
+	github.com/gaissmai/bart v0.29.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.3.0

go.sum

@@ -26,8 +26,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
 github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
-github.com/gaissmai/bart v0.28.0 h1:89yZLo8NmyqD0RYgJ3QO9HhqqGGw+oWhf90cZm69Lko=
-github.com/gaissmai/bart v0.28.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
+github.com/gaissmai/bart v0.29.0 h1:wO6HGE8g9YE0Wm0bCpYxwRzfQ4+fbJKOhL64e5ACGCI=
+github.com/gaissmai/bart v0.29.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=

main.go

@@ -22,12 +22,9 @@ type m = map[string]any
 
 func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, deviceFactory overlay.DeviceFactory) (retcon *Control, reterr error) {
 	ctx, cancel := context.WithCancel(context.Background())
-	// The goroutines started below stop only when this context does, and only a caller holding the
-	// Control can arrange that. Cancel whenever we are not handing one back, which covers an error
-	// and a config test alike: a config test used to leave the lighthouse query worker, and a
-	// hostname resolver per dns named static host, running for the life of the process.
+	// Automatically cancel the context if Main returns an error, to signal all created goroutines to quit.
 	defer func() {
-		if retcon == nil {
+		if reterr != nil {
 			cancel()
 		}
 	}()

main_test.go

@@ -1,82 +0,0 @@
-package nebula
-
-import (
-	"fmt"
-	"net/netip"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	cert_test "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/goleak"
-)
-
-// TestMain_ConfigTestReleasesItsGoroutines pins the rule that Main only leaves goroutines running
-// when it hands back a Control to stop them with.
-//
-// A config test gets no Control, so anything it started had nothing to stop it: the lighthouse
-// query worker, and a hostname resolver per dns named static host, ran for the life of the
-// process. That matters to every embedder that validates a config in process rather than by
-// exec'ing, dnclient and the apple clients included, because they do it on each config load and
-// the leak accumulates.
-func TestMain_ConfigTestReleasesItsGoroutines(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-
-	l := test.NewLogger()
-	dir := t.TempDir()
-
-	before := time.Now().Add(-time.Hour)
-	after := time.Now().Add(time.Hour)
-	ca, _, caKey, caPEM := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, before, after, nil, nil, nil)
-	networks := []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}
-	_, _, keyPEM, certPEM := cert_test.NewTestCert(
-		cert.Version2, cert.Curve_CURVE25519, ca, caKey, "config-test", before, after, networks, nil, nil)
-
-	caPath := filepath.Join(dir, "ca.pem")
-	certPath := filepath.Join(dir, "cert.pem")
-	keyPath := filepath.Join(dir, "key.pem")
-	require.NoError(t, os.WriteFile(caPath, caPEM, 0o600))
-	require.NoError(t, os.WriteFile(certPath, certPEM, 0o600))
-	require.NoError(t, os.WriteFile(keyPath, keyPEM, 0o600))
-
-	// A static host by address, not by name: the query worker is the goroutine under test and a
-	// hostname would drag a real dns lookup into a unit test.
-	configBody := fmt.Sprintf(`
-pki:
-  ca: %s
-  cert: %s
-  key: %s
-static_host_map:
-  "10.0.0.2": ["192.0.2.1:4242"]
-lighthouse:
-  hosts:
-    - "10.0.0.2"
-listen:
-  host: 127.0.0.1
-  port: 0
-tun:
-  disabled: true
-firewall:
-  outbound:
-    - port: any
-      proto: any
-      host: any
-  inbound:
-    - port: any
-      proto: any
-      host: any
-`, caPath, certPath, keyPath)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte(configBody), 0o600))
-
-	c := config.NewC(l)
-	require.NoError(t, c.Load(dir))
-
-	ctrl, err := Main(c, true, "config-test", l, nil)
-	require.NoError(t, err)
-	require.Nil(t, ctrl, "a config test hands back nothing to stop, so it must stop itself")
-}

overlay/tun_darwin.go

@@ -30,10 +30,7 @@ type tun struct {
 	Routes      atomic.Pointer[[]Route]
 	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
 	linkAddr    *netroute.LinkAddr
-	// hostOwned means the fd arrived from the OS, which has already configured addressing, mtu
-	// and routes for it. NEPacketTunnelProvider on darwin does this.
-	hostOwned bool
-	l         *slog.Logger
+	l           *slog.Logger
 }
 
 type ifReq struct {
@@ -153,48 +150,8 @@ func (t *tun) deviceBytes() (o [16]byte) {
 	return
 }
 
-// newTunFromFd adopts a utun the host already created and configured, which is how a darwin
-// network extension is handed its device. Everything about moving packets is shared with newTun,
-// only the setup differs: the host owns addressing and routing here.
-func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
-	if err := unix.SetNonblock(deviceFd, true); err != nil {
-		// We own the fd from the moment it is handed to us
-		_ = unix.Close(deviceFd)
-		return nil, fmt.Errorf("failed to set the tun fd to non-blocking mode: %w", err)
-	}
-
-	file := os.NewFile(uintptr(deviceFd), "/dev/tun")
-	t := &tun{
-		f:           file,
-		Device:      utunNameFromFd(deviceFd),
-		vpnNetworks: vpnNetworks,
-		DefaultMTU:  c.GetInt("tun.mtu", DefaultMTU),
-		hostOwned:   true,
-		l:           l,
-	}
-
-	if err := t.reload(c, true); err != nil {
-		_ = file.Close()
-		return nil, err
-	}
-
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := t.reload(c, false); err != nil {
-			util.LogWithContextIfNeeded("failed to reload tun device", err, t.l)
-		}
-	})
-
-	return t, nil
-}
-
-// utunNameFromFd asks the socket what interface it is, for logs. A blank name is not worth
-// failing a tunnel over, so an error just leaves it empty.
-func utunNameFromFd(fd int) string {
-	name, err := unix.GetsockoptString(fd, unix.AF_SYS_CONTROL, _UTUN_OPT_IFNAME)
-	if err != nil {
-		return ""
-	}
-	return name
+func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
+	return nil, fmt.Errorf("newTunFromFd not supported in Darwin")
 }
 
 func (t *tun) Close() error {
@@ -205,12 +162,6 @@ func (t *tun) Close() error {
 }
 
 func (t *tun) Activate() error {
-	// The host handed us a configured device. Its addresses, mtu and routes come from the network
-	// settings it applied, and a sandboxed extension cannot change them anyway.
-	if t.hostOwned {
-		return nil
-	}
-
 	devName := t.deviceBytes()
 
 	s, err := unix.Socket(
@@ -424,11 +375,6 @@ func getLinkAddr(name string) (*netroute.LinkAddr, error) {
 }
 
 func (t *tun) addRoutes(logErrors bool) error {
-	// The route tree is still ours, the system routing table is not
-	if t.hostOwned {
-		return nil
-	}
-
 	routes := *t.Routes.Load()
 
 	for _, r := range routes {
@@ -458,10 +404,6 @@ func (t *tun) addRoutes(logErrors bool) error {
 }
 
 func (t *tun) removeRoutes(routes []Route) error {
-	if t.hostOwned {
-		return nil
-	}
-
 	for _, r := range routes {
 		if !r.Install {
 			continue