ReadBatch is named Read now

.github/workflows/smoke-extra.yml

@@ -18,8 +18,6 @@ jobs:
     if: github.ref == 'refs/heads/master' || contains(github.event.pull_request.labels.*.name, 'smoke-test-extra')
     name: Run extra smoke tests
     runs-on: ubuntu-latest
-    env:
-      VAGRANT_DEFAULT_PROVIDER: libvirt
     steps:
 
     - uses: actions/checkout@v6
@@ -32,13 +30,11 @@ jobs:
     - name: add hashicorp source
       run: wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg && echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
 
-    - name: install vagrant and libvirt
-      run: |
-        sudo apt-get update && sudo apt-get install -y vagrant libvirt-daemon-system libvirt-dev
-        sudo chmod 666 /dev/kvm
-        sudo usermod -aG libvirt $(whoami)
-        sudo chmod 666 /var/run/libvirt/libvirt-sock
-        vagrant plugin install vagrant-libvirt
+    - name: workaround AMD-V issue  # https://github.com/cri-o/packaging/pull/306
+      run: sudo rmmod kvm_amd
+
+    - name: install vagrant
+      run: sudo apt-get update && sudo apt-get install -y vagrant virtualbox
 
     - name: freebsd-amd64
       run: make smoke-vagrant/freebsd-amd64
@@ -49,19 +45,10 @@ jobs:
     - name: netbsd-amd64
       run: make smoke-vagrant/netbsd-amd64
 
+    - name: linux-386
+      run: make smoke-vagrant/linux-386
+
     - name: linux-amd64-ipv6disable
       run: make smoke-vagrant/linux-amd64-ipv6disable
 
-    # linux-386 runs last because it requires disabling KVM to use VirtualBox,
-    # which prevents libvirt (used by the other tests) from working after this point.
-    - name: install virtualbox for i386 test
-      run: |
-        sudo apt-get install -y virtualbox
-        sudo rmmod kvm_amd kvm_intel kvm 2>/dev/null || true
-
-    - name: linux-386
-      env:
-        VAGRANT_DEFAULT_PROVIDER: virtualbox
-      run: make smoke-vagrant/linux-386
-
     timeout-minutes: 30

.github/workflows/smoke/build-relay.sh

@@ -16,10 +16,8 @@ relay:
   am_relay: true
 EOF
 
-    # TEST-NET-3 placeholder IPs; smoke-relay.sh seds them to real container IPs.
-    # Mapping: .2 lighthouse1, .3 host2, .4 host3, .5 host4.
-    export LIGHTHOUSES="192.168.100.1 203.0.113.2:4242"
-    export REMOTE_ALLOW_LIST='{"203.0.113.4/32": false, "203.0.113.5/32": false}'
+    export LIGHTHOUSES="192.168.100.1 172.17.0.2:4242"
+    export REMOTE_ALLOW_LIST='{"172.17.0.4/32": false, "172.17.0.5/32": false}'
 
     HOST="host2" ../genconfig.sh >host2.yml <<EOF
 relay:
@@ -27,7 +25,7 @@ relay:
     - 192.168.100.1
 EOF
 
-    export REMOTE_ALLOW_LIST='{"203.0.113.3/32": false}'
+    export REMOTE_ALLOW_LIST='{"172.17.0.3/32": false}'
 
     HOST="host3" ../genconfig.sh >host3.yml
 

.github/workflows/smoke/build.sh

@@ -5,15 +5,9 @@ set -e -x
 rm -rf ./build
 mkdir ./build
 
-# Smoke containers run on a dedicated docker network whose subnet is allocated
-# at smoke time, not known at build time. Configs are written with TEST-NET-3
-# placeholder IPs (RFC 5737) and smoke.sh / smoke-vagrant.sh / smoke-relay.sh
-# sed the real container IPs in before starting nebula.
-#
-# Placeholder mapping (last octet == fixed container slot):
-#   203.0.113.2 -> lighthouse1, 203.0.113.3 -> host2,
-#   203.0.113.4 -> host3,       203.0.113.5 -> host4.
-LIGHTHOUSE_IP="203.0.113.2"
+# TODO: Assumes your docker bridge network is a /24, and the first container that launches will be .1
+# - We could make this better by launching the lighthouse first and then fetching what IP it is.
+NET="$(docker network inspect bridge -f '{{ range .IPAM.Config }}{{ .Subnet }}{{ end }}' | cut -d. -f1-3)"
 
 (
     cd build
@@ -31,16 +25,16 @@ LIGHTHOUSE_IP="203.0.113.2"
         ../genconfig.sh >lighthouse1.yml
 
     HOST="host2" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         ../genconfig.sh >host2.yml
 
     HOST="host3" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         INBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
         ../genconfig.sh >host3.yml
 
     HOST="host4" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         OUTBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
         ../genconfig.sh >host4.yml
 

.github/workflows/smoke/smoke-relay.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 mkdir -p logs
 
-NETWORK="nebula-smoke-relay"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -18,53 +16,22 @@ cleanup() {
     then
         docker kill lighthouse1 host2 host3 host4
     fi
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2, .4 host3, .5 host4 — matches the placeholders in build-relay.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-HOST3_IP="$PREFIX.4"
-HOST4_IP="$PREFIX.5"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-for f in build/host2.yml build/host3.yml build/host4.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 docker run --name lighthouse1 --rm nebula:smoke-relay -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" nebula:smoke-relay -config host2.yml -test
-docker run --name host3 --rm -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" nebula:smoke-relay -config host3.yml -test
-docker run --name host4 --rm -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" nebula:smoke-relay -config host4.yml -test
+docker run --name host2 --rm nebula:smoke-relay -config host2.yml -test
+docker run --name host3 --rm nebula:smoke-relay -config host3.yml -test
+docker run --name host4 --rm nebula:smoke-relay -config host4.yml -test
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
-docker run --name host3 --network "$NETWORK" --ip "$HOST3_IP" -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
+docker run --name host3 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 1
-docker run --name host4 --network "$NETWORK" --ip "$HOST4_IP" -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
+docker run --name host4 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
 sleep 1
 
 set +x
@@ -109,13 +76,7 @@ docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit rather than relying on a
-# fixed sleep.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 5
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/smoke-vagrant.sh

@@ -8,8 +8,6 @@ export VAGRANT_CWD="$PWD/vagrant-$1"
 
 mkdir -p logs
 
-NETWORK="nebula-smoke"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -21,51 +19,32 @@ cleanup() {
         docker kill lighthouse1 host2
     fi
     vagrant destroy -f
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2 — matches the placeholders in build.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-# This must happen before `vagrant up` rsyncs build/ into the VM for host3.
-for f in build/host2.yml build/host3.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 CONTAINER="nebula:${NAME:-smoke}"
 
 docker run --name lighthouse1 --rm "$CONTAINER" -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" "$CONTAINER" -config host2.yml -test
+docker run --name host2 --rm "$CONTAINER" -config host2.yml -test
 
 vagrant up
+
+# OpenBSD: synced folders are disabled because Vagrant's rsync installer
+# uses ftp.openbsd.org which no longer hosts packages for older releases.
+# Copy build artifacts in via scp instead.
+case "$1" in
+    openbsd-*)
+        vagrant ssh -c "sudo mkdir -p /nebula" -- -T
+        tar -cf - -C build . | vagrant ssh -c "sudo tar -xf - -C /nebula && sudo chmod -R a+r /nebula" -- -T
+        ;;
+esac
+
 vagrant ssh -c "cd /nebula && /nebula/$1-nebula -config host3.yml -test" -- -T
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
 vagrant ssh -c "cd /nebula && sudo sh -c 'echo \$\$ >/nebula/pid && exec /nebula/$1-nebula -config host3.yml'" 2>&1 -- -T | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 15
@@ -128,14 +107,7 @@ vagrant ssh -c "ping -c1 192.168.100.2" -- -T
 vagrant ssh -c "sudo xargs kill </nebula/pid" -- -T
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit. vagrant ssh in particular
-# takes a beat to tear down after nebula exits on the VM, so a fixed sleep is
-# racy.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 1
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/smoke.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 mkdir -p logs
 
-NETWORK="nebula-smoke"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -18,56 +16,24 @@ cleanup() {
     then
         docker kill lighthouse1 host2 host3 host4
     fi
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2, .4 host3, .5 host4 — matches the placeholders in build.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-HOST3_IP="$PREFIX.4"
-HOST4_IP="$PREFIX.5"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-# build/lighthouse1.yml has no IPs to rewrite so it's skipped.
-for f in build/host2.yml build/host3.yml build/host4.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 CONTAINER="nebula:${NAME:-smoke}"
 
 docker run --name lighthouse1 --rm "$CONTAINER" -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" "$CONTAINER" -config host2.yml -test
-docker run --name host3 --rm -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" "$CONTAINER" -config host3.yml -test
-docker run --name host4 --rm -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" "$CONTAINER" -config host4.yml -test
+docker run --name host2 --rm "$CONTAINER" -config host2.yml -test
+docker run --name host3 --rm "$CONTAINER" -config host3.yml -test
+docker run --name host4 --rm "$CONTAINER" -config host4.yml -test
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
-docker run --name host3 --network "$NETWORK" --ip "$HOST3_IP" -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
+docker run --name host3 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 1
-docker run --name host4 --network "$NETWORK" --ip "$HOST4_IP" -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
+docker run --name host4 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
 sleep 1
 
 # grab tcpdump pcaps for debugging
@@ -165,13 +131,7 @@ docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit rather than relying on a
-# fixed sleep.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 5
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/vagrant-linux-amd64-ipv6disable/Vagrantfile

@@ -1,7 +1,7 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 Vagrant.configure("2") do |config|
-  config.vm.box = "bento/ubuntu-24.04"
+  config.vm.box = "ubuntu/jammy64"
 
   config.vm.synced_folder "../build", "/nebula"
 

.github/workflows/smoke/vagrant-openbsd-amd64/Vagrantfile

@@ -1,7 +1,7 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 Vagrant.configure("2") do |config|
-  config.vm.box = "DefinedNet/openbsd78"
+  config.vm.box = "generic/openbsd7"
 
-  config.vm.synced_folder "../build", "/nebula", type: "rsync"
+  config.vm.synced_folder ".", "/vagrant", disabled: true
 end

batch_test.go

@@ -50,6 +50,74 @@ func TestSendBatchBookkeeping(t *testing.T) {
 	}
 }
 
+func TestBatchSegmentable(t *testing.T) {
+	ap := netip.MustParseAddrPort("10.0.0.1:4242")
+	other := netip.MustParseAddrPort("10.0.0.2:4242")
+
+	mk := func(addrs []netip.AddrPort, sizes []int) *sendBatch {
+		b := newSendBatch(len(addrs), 64)
+		for i, a := range addrs {
+			s := b.Next()
+			for j := 0; j < sizes[i]; j++ {
+				s = append(s, byte(j))
+			}
+			b.Commit(len(s), a)
+		}
+		return b
+	}
+
+	t.Run("uniform same dst", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 10})
+		seg, ok := batchSegmentable(b)
+		if !ok || seg != 10 {
+			t.Fatalf("got seg=%d ok=%v", seg, ok)
+		}
+	})
+
+	t.Run("last segment short ok", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 4})
+		seg, ok := batchSegmentable(b)
+		if !ok || seg != 10 {
+			t.Fatalf("got seg=%d ok=%v", seg, ok)
+		}
+	})
+
+	t.Run("mixed dst rejected", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, other, ap}, []int{10, 10, 10})
+		if _, ok := batchSegmentable(b); ok {
+			t.Fatalf("expected rejection for mixed dst")
+		}
+	})
+
+	t.Run("mid-batch short rejected", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 4, 10})
+		if _, ok := batchSegmentable(b); ok {
+			t.Fatalf("expected rejection for short mid-batch")
+		}
+	})
+
+	t.Run("mid-batch longer rejected", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 11, 10})
+		if _, ok := batchSegmentable(b); ok {
+			t.Fatalf("expected rejection for longer mid-batch")
+		}
+	})
+
+	t.Run("last longer rejected", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap, ap}, []int{10, 10, 11})
+		if _, ok := batchSegmentable(b); ok {
+			t.Fatalf("expected rejection for longer last segment")
+		}
+	})
+
+	t.Run("first zero rejected", func(t *testing.T) {
+		b := mk([]netip.AddrPort{ap, ap}, []int{0, 10})
+		if _, ok := batchSegmentable(b); ok {
+			t.Fatalf("expected rejection for zero first")
+		}
+	})
+}
+
 func TestSendBatchSlotsDoNotOverlap(t *testing.T) {
 	b := newSendBatch(3, 8)
 	ap := netip.MustParseAddrPort("10.0.0.1:80")

cmd/nebula-service/main.go

@@ -88,6 +88,7 @@ func main() {
 
 		if err := wait(); err != nil {
 			l.WithError(err).Error("Nebula stopped due to fatal error")
+			l.Info("Goodbye")
 			os.Exit(2)
 		}
 

cmd/nebula/main.go

@@ -83,6 +83,7 @@ func main() {
 
 		if err := wait(); err != nil {
 			l.WithError(err).Error("Nebula stopped due to fatal error")
+			l.Info("Goodbye")
 			os.Exit(2)
 		}
 

control.go

@@ -18,16 +18,12 @@ import (
 type RunState int
 
 const (
-	StateUnknown RunState = iota
-	StateReady
-	StateStarted
-	StateStopping
-	StateStopped
+	Stopped  RunState = 0 // The control has yet to be started
+	Started  RunState = 1 // The control has been started
+	Stopping RunState = 2 // The control is stopping
 )
 
 var ErrAlreadyStarted = errors.New("nebula is already started")
-var ErrAlreadyStopped = errors.New("nebula cannot be restarted")
-var ErrUnknownState = errors.New("nebula state is invalid")
 
 // Every interaction here needs to take extra care to copy memory and not return or use arguments "as is" when touching
 // core. This means copying IP objects, slices, de-referencing pointers and taking the actual value, etc
@@ -75,22 +71,15 @@ type ControlHostInfo struct {
 // triggered the shutdown.
 func (c *Control) Start() (func() error, error) {
 	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
-	switch c.state {
-	case StateReady:
-		//yay!
-	case StateStopped, StateStopping:
-		return nil, ErrAlreadyStopped
-	case StateStarted:
+	if c.state != Stopped {
+		c.stateLock.Unlock()
 		return nil, ErrAlreadyStarted
-	default:
-		return nil, ErrUnknownState
 	}
 
 	// Activate the interface
 	err := c.f.activate()
 	if err != nil {
-		c.state = StateStopped
+		c.stateLock.Unlock()
 		return nil, err
 	}
 
@@ -114,13 +103,9 @@ func (c *Control) Start() (func() error, error) {
 	c.f.triggerShutdown = c.Stop
 
 	// Start reading packets.
-	out, err := c.f.run()
-	if err != nil {
-		c.state = StateStopped
-		return nil, err
-	}
-	c.state = StateStarted
-	return out, nil
+	c.state = Started
+	c.stateLock.Unlock()
+	return c.f.run()
 }
 
 func (c *Control) State() RunState {
@@ -136,13 +121,13 @@ func (c *Control) Context() context.Context {
 // Stop is a non-blocking call that signals nebula to close all tunnels and shut down
 func (c *Control) Stop() {
 	c.stateLock.Lock()
-	if c.state != StateStarted {
+	if c.state != Started {
 		c.stateLock.Unlock()
 		// We are stopping or stopped already
 		return
 	}
 
-	c.state = StateStopping
+	c.state = Stopping
 	c.stateLock.Unlock()
 
 	// Stop the handshakeManager (and other services), to prevent new tunnels from
@@ -154,7 +139,7 @@ func (c *Control) Stop() {
 		c.l.WithError(err).Error("Close interface failed")
 	}
 	c.stateLock.Lock()
-	c.state = StateStopped
+	c.state = Stopped
 	c.stateLock.Unlock()
 }
 

control_test.go

@@ -79,7 +79,6 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 	}, &Interface{})
 
 	c := Control{
-		state: StateReady,
 		f: &Interface{
 			hostMap: hm,
 		},

interface.go

@@ -16,8 +16,6 @@ import (
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
-	"github.com/slackhq/nebula/overlay/coalesce"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/udp"
 )
 
@@ -87,11 +85,11 @@ type Interface struct {
 	conntrackCacheTimeout time.Duration
 
 	writers []udp.Conn
-	readers []tio.Queue
+	readers []overlay.Queue
 	// tunCoalescers is one tcpCoalescer per tun queue, wrapping readers[i].
 	// decryptToTun sends plaintext into the coalescer; listenOut calls its
 	// Flush at the end of each UDP recvmmsg batch.
-	tunCoalescers []*coalesce.TCPCoalescer
+	tunCoalescers []*tcpCoalescer
 	wg            sync.WaitGroup
 
 	// fatalErr holds the first unexpected reader error that caused shutdown.
@@ -189,8 +187,8 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		routines:              c.routines,
 		version:               c.version,
 		writers:               make([]udp.Conn, c.routines),
-		readers:               make([]tio.Queue, c.routines),
-		tunCoalescers:         make([]*coalesce.TCPCoalescer, c.routines),
+		readers:               make([]overlay.Queue, c.routines),
+		tunCoalescers:         make([]*tcpCoalescer, c.routines),
 		myVpnNetworks:         cs.myVpnNetworks,
 		myVpnNetworksTable:    cs.myVpnNetworksTable,
 		myVpnAddrs:            cs.myVpnAddrs,
@@ -245,22 +243,20 @@ func (f *Interface) activate() error {
 	metrics.GetOrRegisterGauge("routines", nil).Update(int64(f.routines))
 
 	// Prepare n tun queues
+	var reader overlay.Queue = f.inside
 	for i := 0; i < f.routines; i++ {
 		if i > 0 {
-			err = f.inside.NewMultiQueueReader()
+			reader, err = f.inside.NewMultiQueueReader()
 			if err != nil {
 				return err
 			}
 		}
-	}
-	f.readers = f.inside.Readers()
-	for i := range f.readers {
-		f.tunCoalescers[i] = coalesce.NewTCPCoalescer(f.readers[i]) //todo don't always do this
+		f.readers[i] = reader
+		f.tunCoalescers[i] = newTCPCoalescer(reader)
 	}
 
 	f.wg.Add(1) // for us to wait on Close() to return
 	if err = f.inside.Activate(); err != nil {
-		f.wg.Done()
 		f.inside.Close()
 		return err
 	}
@@ -342,10 +338,10 @@ func (f *Interface) listenOut(i int) {
 		f.onFatal(err)
 	}
 
-	f.l.Debugf("underlay reader %v is done", i)
+	f.l.Infof("underlay reader %v is done", i)
 }
 
-func (f *Interface) listenIn(reader tio.Queue, i int) {
+func (f *Interface) listenIn(reader overlay.Queue, i int) {
 	rejectBuf := make([]byte, mtu)
 	batch := newSendBatch(sendBatchCap, udp.MTU+32)
 	fwPacket := &firewall.Packet{}
@@ -376,15 +372,58 @@ func (f *Interface) listenIn(reader tio.Queue, i int) {
 		}
 	}
 
-	f.l.Debugf("overlay reader %v is done", i)
+	f.l.Infof("overlay reader %v is done", i)
 }
 
 func (f *Interface) flushBatch(batch *sendBatch, q int) {
-	if err := f.writers[q].WriteBatch(batch.bufs, batch.dsts); err != nil {
+	//if len(batch.bufs) == 1 {
+	//	if err := f.writers[q].WriteTo(batch.bufs[0], batch.dsts[0]); err != nil {
+	//		f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing single-batch")
+	//	}
+	//	return
+	//}
+	w := f.writers[q]
+	if w.SupportsGSO() {
+		if segSize, ok := batchSegmentable(batch); ok {
+			if err := w.WriteSegmented(batch.bufs, batch.dsts[0], segSize); err != nil {
+				f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing GSO batch")
+			}
+			return
+		}
+	}
+	if err := w.WriteBatch(batch.bufs, batch.dsts); err != nil {
 		f.l.WithError(err).WithField("writer", q).Error("Failed to write outgoing batch")
 	}
 }
 
+// batchSegmentable reports whether a batch can be emitted as a single UDP GSO
+// superpacket: all packets go to the same destination, and every packet
+// except possibly the last has the same length. Returns the segment size on
+// success. The single-packet case is handled in flushBatch before this runs.
+func batchSegmentable(b *sendBatch) (int, bool) {
+	segSize := len(b.bufs[0])
+	if segSize == 0 {
+		return 0, false
+	}
+	dst := b.dsts[0]
+	last := len(b.bufs) - 1
+	for i := 1; i <= last; i++ {
+		if b.dsts[i] != dst {
+			return 0, false
+		}
+		if i < last {
+			if len(b.bufs[i]) != segSize {
+				return 0, false
+			}
+		} else {
+			if len(b.bufs[i]) == 0 || len(b.bufs[i]) > segSize {
+				return 0, false
+			}
+		}
+	}
+	return segSize, true
+}
+
 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
 	c.RegisterReloadCallback(f.reloadFirewall)
 	c.RegisterReloadCallback(f.reloadSendRecvError)
@@ -557,23 +596,19 @@ func (f *Interface) GetCertState() *CertState {
 }
 
 func (f *Interface) Close() error {
-	var errs []error
+	var err error
 	f.closed.Store(true)
 
 	// Release the udp readers
 	for i, u := range f.writers {
-		err := u.Close()
+		err = u.Close()
 		if err != nil {
 			f.l.WithError(err).WithField("writer", i).Error("Error while closing udp socket")
-			errs = append(errs, err)
 		}
 	}
 
 	// Release the tun device (closing the tun also closes all readers)
-	closeErr := f.inside.Close()
-	if closeErr != nil {
-		errs = append(errs, closeErr)
-	}
+	err = f.inside.Close()
 	f.wg.Done()
-	return errors.Join(errs...)
+	return err
 }

main.go

@@ -3,10 +3,7 @@ package nebula
 import (
 	"context"
 	"fmt"
-	"log"
 	"net"
-	"net/http"
-	_ "net/http/pprof"
 	"net/netip"
 	"runtime/debug"
 	"strings"
@@ -52,11 +49,6 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		l.Println(string(b))
 	}
 
-	//todo!!!
-	go func() {
-		log.Println(http.ListenAndServe("0.0.0.0:6060", nil))
-	}()
-
 	err := configLogger(l, c)
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Failed to configure the logger", err)
@@ -296,7 +288,6 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 	}
 
 	return &Control{
-		state:                  StateReady,
 		f:                      ifce,
 		l:                      l,
 		ctx:                    ctx,

noise.go

@@ -15,14 +15,14 @@ type endianness interface {
 var noiseEndianness endianness = binary.BigEndian
 
 type NebulaCipherState struct {
-	c cipher.AEAD
+	c noise.Cipher
 	//k [32]byte
 	//n uint64
 }
 
 func NewNebulaCipherState(s *noise.CipherState) *NebulaCipherState {
-	x := s.Cipher()
-	return &NebulaCipherState{c: x.(cipher.AEAD)}
+	return &NebulaCipherState{c: s.Cipher()}
+
 }
 
 // EncryptDanger encrypts and authenticates a given payload.
@@ -46,7 +46,7 @@ func (s *NebulaCipherState) EncryptDanger(out, ad, plaintext []byte, n uint64, n
 		nb[2] = 0
 		nb[3] = 0
 		noiseEndianness.PutUint64(nb[4:], n)
-		out = s.c.Seal(out, nb, plaintext, ad)
+		out = s.c.(cipher.AEAD).Seal(out, nb, plaintext, ad)
 		//l.Debugf("Encryption: outlen: %d, nonce: %d, ad: %s, plainlen %d", len(out), n, ad, len(plaintext))
 		return out, nil
 	} else {
@@ -61,7 +61,7 @@ func (s *NebulaCipherState) DecryptDanger(out, ad, ciphertext []byte, n uint64,
 		nb[2] = 0
 		nb[3] = 0
 		noiseEndianness.PutUint64(nb[4:], n)
-		return s.c.Open(out, nb, ciphertext, ad)
+		return s.c.(cipher.AEAD).Open(out, nb, ciphertext, ad)
 	} else {
 		return []byte{}, nil
 	}
@@ -69,7 +69,7 @@ func (s *NebulaCipherState) DecryptDanger(out, ad, ciphertext []byte, n uint64,
 
 func (s *NebulaCipherState) Overhead() int {
 	if s != nil {
-		return s.c.Overhead()
+		return s.c.(cipher.AEAD).Overhead()
 	}
 	return 0
 }

overlay/device.go

@@ -4,7 +4,6 @@ import (
 	"io"
 	"net/netip"
 
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -12,13 +11,59 @@ import (
 // that don't do TSO segmentation. 65535 covers any single IP packet.
 const defaultBatchBufSize = 65535
 
-type Device interface {
+// Queue is a readable/writable tun queue. One Queue is driven by a single
+// read goroutine plus concurrent writers (see Write / WriteReject below).
+type Queue interface {
 	io.Closer
+
+	// Read returns one or more packets. The returned slices are borrowed
+	// from the Queue's internal buffer and are only valid until the next
+	// Read or Close on this Queue — callers must encrypt or copy each
+	// slice before the next call. Not safe for concurrent Reads; exactly
+	// one goroutine per Queue reads.
+	Read() ([][]byte, error)
+
+	// Write emits a single packet on the plaintext (outside→inside)
+	// delivery path. May run concurrently with WriteReject on the same
+	// Queue, but not with itself.
+	Write(p []byte) (int, error)
+
+	// WriteReject writes a single packet that originated from the inside
+	// path (reject replies or self-forward) using scratch state distinct
+	// from Write, so it can run concurrently with Write on the same Queue
+	// without a data race. On backends without a shared-scratch Write, a
+	// trivial delegation to Write is acceptable.
+	WriteReject(p []byte) (int, error)
+}
+
+type Device interface {
+	Queue
 	Activate() error
 	Networks() []netip.Prefix
 	Name() string
 	RoutesFor(netip.Addr) routing.Gateways
-	SupportsMultiqueue() bool //todo remove?
-	NewMultiQueueReader() error
-	Readers() []tio.Queue
+	SupportsMultiqueue() bool
+	NewMultiQueueReader() (Queue, error)
+}
+
+// GSOWriter is implemented by Queues that can emit a TCP TSO superpacket
+// assembled from a header prefix plus one or more borrowed payload
+// fragments, in a single vectored write (writev with a leading
+// virtio_net_hdr). This lets the coalescer avoid copying payload bytes
+// between the caller's decrypt buffer and the TUN. Backends without GSO
+// support return false from GSOSupported and coalescing is skipped.
+//
+// hdr contains the IPv4/IPv6 + TCP header prefix (mutable — callers will
+// have filled in total length and pseudo-header partial). pays are
+// non-overlapping payload fragments whose concatenation is the full
+// superpacket payload; they are read-only from the writer's perspective
+// and must remain valid until the call returns. gsoSize is the MSS:
+// every segment except possibly the last is exactly that many bytes.
+// csumStart is the byte offset where the TCP header begins within hdr.
+//
+// hdr's TCP checksum field must already hold the pseudo-header partial
+// sum (single-fold, not inverted), per virtio NEEDS_CSUM semantics.
+type GSOWriter interface {
+	WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error
+	GSOSupported() bool
 }

overlay/noop.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net/netip"
 
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -42,12 +41,8 @@ func (NoopTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (NoopTun) NewMultiQueueReader() error {
-	return errors.New("unsupported")
-}
-
-func (NoopTun) Readers() []tio.Queue {
-	return []tio.Queue{NoopTun{}}
+func (NoopTun) NewMultiQueueReader() (Queue, error) {
+	return nil, errors.New("unsupported")
 }
 
 func (NoopTun) Close() error {

overlay/tio/container_gso_linux.go

@@ -1,70 +0,0 @@
-package tio
-
-import (
-	"encoding/binary"
-	"errors"
-	"fmt"
-
-	"golang.org/x/sys/unix"
-)
-
-type offloadContainer struct {
-	pq []*Offload
-	// pqi is exactly the same as pq, but stored as the interface type
-	pqi        []Queue
-	shutdownFd int
-}
-
-func NewOffloadContainer() (Container, error) {
-	shutdownFd, err := unix.Eventfd(0, unix.EFD_NONBLOCK|unix.EFD_CLOEXEC)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create eventfd: %w", err)
-	}
-
-	out := &offloadContainer{
-		pq:         []*Offload{},
-		pqi:        []Queue{},
-		shutdownFd: shutdownFd,
-	}
-
-	return out, nil
-}
-
-func (c *offloadContainer) Queues() []Queue {
-	return c.pqi
-}
-
-func (c *offloadContainer) Add(fd int) error {
-	x, err := newOffload(fd, c.shutdownFd)
-	if err != nil {
-		return err
-	}
-	c.pq = append(c.pq, x)
-	c.pqi = append(c.pqi, x)
-
-	return nil
-}
-
-func (c *offloadContainer) wakeForShutdown() error {
-	var buf [8]byte
-	binary.NativeEndian.PutUint64(buf[:], 1)
-	_, err := unix.Write(c.shutdownFd, buf[:])
-	return err
-}
-
-func (c *offloadContainer) Close() error {
-	errs := []error{}
-
-	// Signal all readers blocked in poll to wake up and exit
-	if err := c.wakeForShutdown(); err != nil {
-		errs = append(errs, err)
-	}
-
-	for _, x := range c.pq {
-		if err := x.Close(); err != nil {
-			errs = append(errs, err)
-		}
-	}
-
-	return errors.Join(errs...)
-}

overlay/tio/container_poll_linux.go

@@ -1,69 +0,0 @@
-package tio
-
-import (
-	"encoding/binary"
-	"errors"
-	"fmt"
-
-	"golang.org/x/sys/unix"
-)
-
-type pollContainer struct {
-	pq []*Poll
-	// pqi is exactly the same as pq, but stored as the interface type
-	pqi        []Queue
-	shutdownFd int
-}
-
-func NewPollContainer() (Container, error) {
-	shutdownFd, err := unix.Eventfd(0, unix.EFD_NONBLOCK|unix.EFD_CLOEXEC)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create eventfd: %w", err)
-	}
-
-	out := &pollContainer{
-		pq:         []*Poll{},
-		pqi:        []Queue{},
-		shutdownFd: shutdownFd,
-	}
-
-	return out, nil
-}
-
-func (c *pollContainer) Queues() []Queue {
-	return c.pqi
-}
-
-func (c *pollContainer) Add(fd int) error {
-	x, err := newPoll(fd, c.shutdownFd)
-	if err != nil {
-		return err
-	}
-	c.pq = append(c.pq, x)
-	c.pqi = append(c.pqi, x)
-
-	return nil
-}
-
-func (c *pollContainer) wakeForShutdown() error {
-	var buf [8]byte
-	binary.NativeEndian.PutUint64(buf[:], 1)
-	_, err := unix.Write(int(c.shutdownFd), buf[:])
-	return err
-}
-
-func (c *pollContainer) Close() error {
-	errs := []error{}
-
-	if err := c.wakeForShutdown(); err != nil {
-		errs = append(errs, err)
-	}
-
-	for _, x := range c.pq {
-		if err := x.Close(); err != nil {
-			errs = append(errs, err)
-		}
-	}
-
-	return errors.Join(errs...)
-}

overlay/tio/tio.go

@@ -1,63 +0,0 @@
-package tio
-
-import "io"
-
-// defaultBatchBufSize is the per-Queue scratch size for Read on backends
-// that don't do TSO segmentation. 65535 covers any single IP packet.
-const defaultBatchBufSize = 65535
-
-type Container interface {
-	Queues() []Queue
-	Add(fd int) error
-
-	io.Closer
-}
-
-// Queue is a readable/writable Poll queue. One Queue is driven by a single
-// read goroutine plus concurrent writers (see Write / WriteReject below).
-type Queue interface {
-	io.Closer
-
-	// Read returns one or more packets. The returned slices are borrowed
-	// from the Queue's internal buffer and are only valid until the next
-	// Read or Close on this Queue — callers must encrypt or copy each
-	// slice before the next call. Not safe for concurrent Reads; exactly
-	// one goroutine per Queue reads.
-	Read() ([][]byte, error)
-
-	// Write emits a single packet on the plaintext (outside→inside)
-	// delivery path. May run concurrently with WriteReject on the same
-	// Queue, but not with itself.
-	Write(p []byte) (int, error)
-
-	// WriteReject writes a single packet that originated from the inside
-	// path (reject replies or self-forward) using scratch state distinct
-	// from Write, so it can run concurrently with Write on the same Queue
-	// without a data race. On backends without a shared-scratch Write, a
-	// trivial delegation to Write is acceptable.
-	WriteReject(p []byte) (int, error)
-}
-
-// GSOWriter is implemented by Queues that can emit a TCP TSO superpacket
-// assembled from a header prefix plus one or more borrowed payload
-// fragments, in a single vectored write (writev with a leading
-// virtio_net_hdr). This lets the coalescer avoid copying payload bytes
-// between the caller's decrypt buffer and the TUN. Backends without GSO
-// support return false from GSOSupported and coalescing is skipped.
-//
-// hdr contains the IPv4/IPv6 + TCP header prefix (mutable — callers will
-// have filled in total length and pseudo-header partial). pays are
-// non-overlapping payload fragments whose concatenation is the full
-// superpacket payload; they are read-only from the writer's perspective
-// and must remain valid until the call returns. gsoSize is the MSS:
-// every segment except possibly the last is exactly that many bytes.
-// csumStart is the byte offset where the TCP header begins within hdr.
-//
-// # TODO fold into Queue
-//
-// hdr's TCP checksum field must already hold the pseudo-header partial
-// sum (single-fold, not inverted), per virtio NEEDS_CSUM semantics.
-type GSOWriter interface {
-	WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error
-	GSOSupported() bool
-}

overlay/tio/tio_gso_linux.go

@@ -1,390 +0,0 @@
-package tio
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"runtime"
-	"sync/atomic"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// Space for segmented output. Worst case is many small segments, each paying
-// an IP+TCP header. Should be a multiple of 64KiB.
-// const tunSegBufSize = 0xffff * 8 TODO larger? config?
-const tunSegBufSize = 131072
-
-// tunSegBufCap is the total size we allocate for the per-reader segment
-// buffer. It is sized as one worst-case TSO superpacket (tunSegBufSize) plus
-// the same again as drain headroom so a Read wake can accumulate
-// additional packets after an initial big read without overflowing.
-const tunSegBufCap = tunSegBufSize * 2
-
-// tunDrainCap caps how many packets a single Read will accumulate via
-// the post-wake drain loop. Sized to soak up a burst of small ACKs while
-// bounding how much work a single caller holds before handing off.
-const tunDrainCap = 64 //256
-
-// gsoInitialPayIovs is the starting capacity (in payload fragments) of
-// Offload.gsoIovs. Sized to cover the default coalesce segment cap without
-// any reallocations.
-const gsoInitialPayIovs = 66
-
-// validVnetHdr is the 10-byte virtio_net_hdr we prepend to every non-GSO TUN
-// write. Only flag set is VIRTIO_NET_HDR_F_DATA_VALID, which marks the skb
-// CHECKSUM_UNNECESSARY so the receiving network stack skips L4 checksum
-// verification. All packets that reach the plain Write / WriteReject paths
-// already carry a valid L4 checksum (either supplied by a remote peer whose
-// ciphertext we AEAD-authenticated, or produced by finishChecksum during TSO
-// segmentation, or built locally by CreateRejectPacket), so trusting them is
-// safe.
-var validVnetHdr = [virtioNetHdrLen]byte{unix.VIRTIO_NET_HDR_F_DATA_VALID}
-
-// Offload wraps a TUN file descriptor with poll-based reads. The FD provided will be changed to non-blocking.
-// A shared eventfd allows Close to wake all readers blocked in poll.
-type Offload struct {
-	fd         int
-	shutdownFd int
-	readPoll   [2]unix.PollFd
-	writePoll  [2]unix.PollFd
-	closed     atomic.Bool
-	readBuf    []byte        // scratch for a single raw read (virtio hdr + superpacket)
-	segBuf     []byte        // backing store for segmented output
-	segOff     int           // cursor into segBuf for the current Read drain
-	pending    [][]byte      // segments returned from the most recent Read
-	writeIovs  [2]unix.Iovec // preallocated iovecs for Write (coalescer passthrough); iovs[0] is fixed to validVnetHdr
-	// rejectIovs is a second preallocated iovec scratch used exclusively by
-	// WriteReject (reject + self-forward from the inside path). It mirrors
-	// writeIovs but lets listenIn goroutines emit reject packets without
-	// racing with the listenOut coalescer that owns writeIovs.
-	rejectIovs [2]unix.Iovec
-
-	// gsoHdrBuf is a per-queue 10-byte scratch for the virtio_net_hdr emitted
-	// by WriteGSO. Separate from validVnetHdr so a concurrent non-GSO Write on
-	// another queue never observes a half-written header.
-	gsoHdrBuf [virtioNetHdrLen]byte
-	// gsoIovs is the writev iovec scratch for WriteGSO. Sized to hold the
-	// virtio header + IP/TCP header + up to gsoInitialPayIovs payload
-	// fragments; grown on demand if a coalescer pushes more.
-	gsoIovs []unix.Iovec
-}
-
-func newOffload(fd int, shutdownFd int) (*Offload, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
-	}
-
-	out := &Offload{
-		fd:         fd,
-		shutdownFd: shutdownFd,
-		closed:     atomic.Bool{},
-		readBuf:    make([]byte, tunReadBufSize),
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-
-		segBuf:  make([]byte, tunSegBufCap),
-		gsoIovs: make([]unix.Iovec, 2, 2+gsoInitialPayIovs),
-	}
-
-	out.writeIovs[0].Base = &validVnetHdr[0]
-	out.writeIovs[0].SetLen(virtioNetHdrLen)
-	out.rejectIovs[0].Base = &validVnetHdr[0]
-	out.rejectIovs[0].SetLen(virtioNetHdrLen)
-	out.gsoIovs[0].Base = &out.gsoHdrBuf[0]
-	out.gsoIovs[0].SetLen(virtioNetHdrLen)
-
-	return out, nil
-}
-
-func (r *Offload) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.readPoll[0].Revents
-	shutdownEvents := r.readPoll[1].Revents
-	r.readPoll[0].Revents = 0
-	r.readPoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *Offload) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.writePoll[0].Revents
-	shutdownEvents := r.writePoll[1].Revents
-	r.writePoll[0].Revents = 0
-	r.writePoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *Offload) readRaw(buf []byte) (int, error) {
-	for {
-		if n, err := unix.Read(r.fd, buf); err == nil {
-			return n, nil
-		} else if err == unix.EAGAIN {
-			if err = r.blockOnRead(); err != nil {
-				return 0, err
-			}
-			continue
-		} else if err == unix.EINTR {
-			continue
-		} else if err == unix.EBADF {
-			return 0, os.ErrClosed
-		} else {
-			return 0, err
-		}
-	}
-}
-
-// Read reads one or more superpackets from the tun and returns the
-// resulting packets. The first read blocks via poll; once the fd is known
-// readable we drain additional packets non-blocking until the kernel queue
-// is empty (EAGAIN), we've collected tunDrainCap packets, or we're out of
-// segBuf headroom. This amortizes the poll wake over bursts of small
-// packets (e.g. TCP ACKs). Slices point into the Offload's internal buffers
-// and are only valid until the next Read or Close on this Queue.
-func (r *Offload) Read() ([][]byte, error) {
-	r.pending = r.pending[:0]
-	r.segOff = 0
-
-	// Initial (blocking) read. Retry on decode errors so a single bad
-	// packet does not stall the reader.
-	for {
-		n, err := r.readRaw(r.readBuf)
-		if err != nil {
-			return nil, err
-		}
-		if err := r.decodeRead(n); err != nil {
-			// Drop and read again — a bad packet should not kill the reader.
-			continue
-		}
-		break
-	}
-
-	// Drain: non-blocking reads until the kernel queue is empty, the drain
-	// cap is reached, or segBuf no longer has room for another worst-case
-	// superpacket.
-	for len(r.pending) < tunDrainCap && tunSegBufCap-r.segOff >= tunSegBufSize {
-		n, err := unix.Read(r.fd, r.readBuf)
-		if err != nil {
-			// EAGAIN / EINTR / anything else: stop draining. We already
-			// have a valid batch from the first read.
-			break
-		}
-		if n <= 0 {
-			break
-		}
-		if err := r.decodeRead(n); err != nil {
-			// Drop this packet and stop the drain; we'd rather hand off
-			// what we have than keep spinning here.
-			break
-		}
-	}
-
-	return r.pending, nil
-}
-
-// decodeRead decodes the virtio header plus payload in r.readBuf[:n], appends
-// the segments to r.pending, and advances r.segOff by the total scratch used.
-// Caller must have already ensured r.vnetHdr is true.
-func (r *Offload) decodeRead(n int) error {
-	if n < virtioNetHdrLen {
-		return fmt.Errorf("short tun read: %d < %d", n, virtioNetHdrLen)
-	}
-	var hdr VirtioNetHdr
-	hdr.decode(r.readBuf[:virtioNetHdrLen])
-	before := len(r.pending)
-	if err := segmentInto(r.readBuf[virtioNetHdrLen:n], hdr, &r.pending, r.segBuf[r.segOff:]); err != nil {
-		return err
-	}
-	for k := before; k < len(r.pending); k++ {
-		r.segOff += len(r.pending[k])
-	}
-	return nil
-}
-
-func (r *Offload) Write(buf []byte) (int, error) {
-	return r.writeWithScratch(buf, &r.writeIovs)
-}
-
-// WriteReject emits a packet using a dedicated iovec scratch (rejectIovs)
-// distinct from the one used by the coalescer's Write path. This avoids a
-// data race between the inside (listenIn) goroutine emitting reject or
-// self-forward packets and the outside (listenOut) goroutine flushing TCP
-// coalescer passthroughs on the same Offload.
-func (r *Offload) WriteReject(buf []byte) (int, error) {
-	return r.writeWithScratch(buf, &r.rejectIovs)
-}
-
-func (r *Offload) writeWithScratch(buf []byte, iovs *[2]unix.Iovec) (int, error) {
-	if len(buf) == 0 {
-		return 0, nil
-	}
-	// Point the payload iovec at the caller's buffer. iovs[0] is pre-wired
-	// to validVnetHdr during Offload construction so we don't rebuild it here.
-	iovs[1].Base = &buf[0]
-	iovs[1].SetLen(len(buf))
-	iovPtr := unsafe.Pointer(&iovs[0])
-	// Pin the caller's buffer AND the iovec array through the syscall.
-	return r.rawWrite(iovPtr, 2, buf, iovs)
-}
-
-func (r *Offload) rawWrite(iovs unsafe.Pointer, iovcnt int, keepAlive ...interface{}) (int, error) {
-	for {
-		n, _, errno := syscall.Syscall(unix.SYS_WRITEV, uintptr(r.fd), uintptr(iovs), uintptr(iovcnt))
-		// Anchor the iovec array + every user-supplied payload slice
-		// through the syscall return. Without these, Go's GC may move or
-		// collect the underlying backing arrays while the kernel is still
-		// reading them via DMA (we pass the iovec as uintptr, so the
-		// compiler does not keep it live). Observed in practice as a
-		// kernel refcount underflow on tun_chr_write_iter / sock_wfree.
-		runtime.KeepAlive(iovs)
-		for _, ka := range keepAlive {
-			runtime.KeepAlive(ka)
-		}
-		if errno == 0 {
-			if int(n) < virtioNetHdrLen {
-				return 0, io.ErrShortWrite
-			}
-			return int(n) - virtioNetHdrLen, nil
-		}
-		if errno == unix.EAGAIN {
-			if err := r.blockOnWrite(); err != nil {
-				return 0, err
-			}
-			continue
-		}
-		if errno == unix.EINTR {
-			continue
-		}
-		if errno == unix.EBADF {
-			return 0, os.ErrClosed
-		}
-		return 0, errno
-	}
-}
-
-// GSOSupported reports whether this queue was opened with IFF_VNET_HDR and
-// can accept WriteGSO. When false, callers should fall back to per-segment
-// Write calls.
-func (r *Offload) GSOSupported() bool { return true }
-
-// WriteGSO emits a TCP TSO superpacket in a single writev. hdr is the
-// IPv4/IPv6 + TCP header prefix (already finalized — total length, IP csum,
-// and TCP pseudo-header partial set by the caller). pays are payload
-// fragments whose concatenation forms the full coalesced payload; each
-// slice is read-only and must stay valid until return. gsoSize is the MSS;
-// every segment except possibly the last is exactly gsoSize bytes.
-// csumStart is the byte offset where the TCP header begins within hdr.
-func (r *Offload) WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error {
-	if len(hdr) == 0 || len(pays) == 0 {
-		return nil
-	}
-
-	// Build the virtio_net_hdr. When pays total to <= gsoSize the kernel
-	// would produce a single segment; keep NEEDS_CSUM semantics but skip
-	// the GSO type so the kernel doesn't spuriously mark this as TSO.
-	vhdr := VirtioNetHdr{
-		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-		HdrLen:     uint16(len(hdr)),
-		GSOSize:    gsoSize,
-		CsumStart:  csumStart,
-		CsumOffset: 16, // TCP checksum field lives 16 bytes into the TCP header
-	}
-	var totalPay int
-	for _, p := range pays {
-		totalPay += len(p)
-	}
-	if totalPay > int(gsoSize) {
-		if isV6 {
-			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV6
-		} else {
-			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV4
-		}
-	} else {
-		vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_NONE
-		vhdr.GSOSize = 0
-	}
-	vhdr.encode(r.gsoHdrBuf[:])
-
-	// Build the iovec array: [virtio_hdr, hdr, pays...]. r.gsoIovs[0] is
-	// wired to gsoHdrBuf at construction and never changes.
-	need := 2 + len(pays)
-	if cap(r.gsoIovs) < need {
-		grown := make([]unix.Iovec, need)
-		grown[0] = r.gsoIovs[0]
-		r.gsoIovs = grown
-	} else {
-		r.gsoIovs = r.gsoIovs[:need]
-	}
-	r.gsoIovs[1].Base = &hdr[0]
-	r.gsoIovs[1].SetLen(len(hdr))
-	for i, p := range pays {
-		r.gsoIovs[2+i].Base = &p[0]
-		r.gsoIovs[2+i].SetLen(len(p))
-	}
-
-	iovPtr := unsafe.Pointer(&r.gsoIovs[0])
-	iovCnt := len(r.gsoIovs)
-	// Pin EVERYTHING the kernel might still read via DMA: the backing iovec
-	// slice, the IP/TCP header buffer, and every individual payload
-	// fragment. Skipping any of these risks a use-after-free in
-	// tun_chr_write_iter if GC runs mid-syscall.
-	_, err := r.rawWrite(iovPtr, iovCnt, r.gsoIovs, hdr, pays)
-	return err
-}
-
-func (r *Offload) Close() error {
-	if r.closed.Swap(true) {
-		return nil
-	}
-
-	//shutdownFd is owned by the container, so we should not close it
-	var err error
-	if r.fd >= 0 {
-		err = unix.Close(r.fd)
-		r.fd = -1
-	}
-
-	return err
-}

overlay/tio/tio_poll_linux.go

@@ -1,217 +0,0 @@
-package tio
-
-import (
-	"fmt"
-	"os"
-	"runtime"
-	"sync/atomic"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// Maximum size we accept for a single read from a TUN with IFF_VNET_HDR. A
-// TSO superpacket can be up to 64KiB of payload plus a single L2/L3/L4 header
-// prefix plus the virtio header.
-const tunReadBufSize = 65535
-
-type Poll struct {
-	fd int
-
-	readPoll  [2]unix.PollFd
-	writePoll [2]unix.PollFd
-	closed    atomic.Bool
-
-	readBuf  []byte
-	batchRet [1][]byte
-}
-
-func newPoll(fd int, shutdownFd int) (*Poll, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("failed to set Poll device as nonblocking: %w", err)
-	}
-
-	out := &Poll{
-		fd:      fd,
-		readBuf: make([]byte, tunReadBufSize),
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-	}
-	return out, nil
-}
-
-// blockOnRead waits until the Poll fd is readable or shutdown has been signaled.
-// Returns os.ErrClosed if Close was called.
-func (t *Poll) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.readPoll[0].Revents
-	shutdownEvents := t.readPoll[1].Revents
-	t.readPoll[0].Revents = 0
-	t.readPoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (t *Poll) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.writePoll[0].Revents
-	shutdownEvents := t.writePoll[1].Revents
-	t.writePoll[0].Revents = 0
-	t.writePoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (t *Poll) Read() ([][]byte, error) {
-	if t.readBuf == nil {
-		t.readBuf = make([]byte, defaultBatchBufSize)
-	}
-	n, err := t.readOne(t.readBuf)
-	if err != nil {
-		return nil, err
-	}
-	t.batchRet[0] = t.readBuf[:n]
-	return t.batchRet[:], nil
-}
-
-func (t *Poll) readOne(to []byte) (int, error) {
-	// first 4 bytes is protocol family, in network byte order
-	var head [4]byte
-	iovecs := [2]syscall.Iovec{ //todo plat-specific
-		{&head[0], 4},
-		{&to[0], uint64(len(to))},
-	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		// Pin the iovec + destination buffer backing array across the syscall.
-		// Without these the Go runtime may move/GC them while the kernel is
-		// still writing via DMA (we pass the iovec as uintptr, which hides it
-		// from escape analysis). Same class of bug as rawWrite in the Offload
-		// path.
-		runtime.KeepAlive(iovecs)
-		runtime.KeepAlive(to)
-		if errno == 0 {
-			bytesRead := int(n)
-			if bytesRead < 4 {
-				return 0, nil
-			}
-			return bytesRead - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnRead(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
-	}
-}
-
-// Write is only valid for single threaded use
-func (t *Poll) Write(from []byte) (int, error) {
-	if len(from) <= 1 {
-		return 0, syscall.EIO
-	}
-
-	ipVer := from[0] >> 4
-	var head [4]byte
-	// first 4 bytes is protocol family, in network byte order
-	switch ipVer {
-	case 4:
-		head[3] = syscall.AF_INET
-	case 6:
-		head[3] = syscall.AF_INET6
-	default:
-		return 0, fmt.Errorf("unable to determine IP version from packet")
-	}
-
-	iovecs := [2]syscall.Iovec{ //todo plat specific
-		{&head[0], 4},
-		{&from[0], uint64(len(from))},
-	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		// Pin the iovec + source buffer backing array across the syscall.
-		// See readOne's KeepAlive comment for rationale.
-		runtime.KeepAlive(iovecs)
-		runtime.KeepAlive(from)
-		if errno == 0 {
-			return int(n) - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnWrite(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
-	}
-}
-
-func (t *Poll) Close() error {
-	if t.closed.Swap(true) {
-		return nil
-	}
-
-	//shutdownFd is owned by the container, so we should not close it
-
-	var err error
-	if t.fd >= 0 {
-		err = unix.Close(t.fd)
-		t.fd = -1
-	}
-
-	return err
-}
-
-func (t *Poll) WriteReject(p []byte) (int, error) {
-	return t.Write(p)
-}

overlay/tio/tun_file_linux_test.go

@@ -1,86 +0,0 @@
-//go:build linux && !android && !e2e_testing
-// +build linux,!android,!e2e_testing
-
-package tio
-
-import (
-	"errors"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/unix"
-)
-
-// newReadPipe returns a read fd. The matching write fd is registered for cleanup.
-// The caller takes ownership of the read fd (pass it to newOffload / newFriend).
-func newReadPipe(t *testing.T) int {
-	t.Helper()
-	var fds [2]int
-	if err := unix.Pipe2(fds[:], unix.O_CLOEXEC); err != nil {
-		t.Fatalf("pipe2: %v", err)
-	}
-	t.Cleanup(func() { _ = unix.Close(fds[1]) })
-	return fds[0]
-}
-
-func TestOffload_WakeForShutdown_WakesFriends(t *testing.T) {
-	pipe1 := newReadPipe(t)
-	pipe2 := newReadPipe(t)
-	parent, err := NewOffloadContainer()
-	if err != nil {
-		t.Fatalf("newOffload: %v", err)
-	}
-	require.NoError(t, parent.Add(pipe1))
-	require.NoError(t, parent.Add(pipe2))
-	t.Cleanup(func() {
-		_ = unix.Close(pipe1)
-		_ = unix.Close(pipe2)
-	})
-
-	readers := parent.Queues()
-	errs := make([]error, len(readers))
-	var wg sync.WaitGroup
-	for i, r := range readers {
-		wg.Add(1)
-		go func(i int, r Queue) {
-			defer wg.Done()
-			_, errs[i] = r.Read()
-		}(i, r)
-	}
-
-	time.Sleep(50 * time.Millisecond)
-
-	if err := parent.Close(); err != nil {
-		t.Fatalf("Close: %v", err)
-	}
-
-	done := make(chan struct{})
-	go func() { wg.Wait(); close(done) }()
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("readers did not wake")
-	}
-
-	for i, err := range errs {
-		if !errors.Is(err, os.ErrClosed) {
-			t.Errorf("reader %d: expected os.ErrClosed, got %v", i, err)
-		}
-	}
-}
-
-func TestTunFile_Close_Idempotent(t *testing.T) {
-	tf, err := newOffload(newReadPipe(t), 1)
-	if err != nil {
-		t.Fatalf("newOffload: %v", err)
-	}
-	if err := tf.Close(); err != nil {
-		t.Fatalf("first Close: %v", err)
-	}
-	if err := tf.Close(); err != nil {
-		t.Fatalf("second Close should be a no-op, got %v", err)
-	}
-}

overlay/tio/tun_linux_offload.go

@@ -1,281 +0,0 @@
-//go:build linux && !android && !e2e_testing
-// +build linux,!android,!e2e_testing
-
-package tio
-
-import (
-	"encoding/binary"
-	"fmt"
-
-	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/tcpip/checksum"
-)
-
-// Protocol header size bounds used to validate / cap kernel-supplied offsets.
-const (
-	ipv4HeaderMinLen = 20 // IHL=5, no options
-	ipv4HeaderMaxLen = 60 // IHL=15, max options
-	ipv6FixedLen     = 40 // IPv6 base header; extensions would extend this
-	tcpHeaderMinLen  = 20 // data-offset=5, no options
-	tcpHeaderMaxLen  = 60 // data-offset=15, max options
-)
-
-// Byte offsets inside an IPv4 header.
-const (
-	ipv4TotalLenOff = 2
-	ipv4IDOff       = 4
-	ipv4ChecksumOff = 10
-	ipv4SrcOff      = 12
-	ipv4AddrsEnd    = 20 // end of dst address (ipv4SrcOff + 2*4)
-)
-
-// Byte offsets inside an IPv6 header.
-const (
-	ipv6PayloadLenOff = 4
-	ipv6SrcOff        = 8
-	ipv6AddrsEnd      = 40 // end of dst address (ipv6SrcOff + 2*16)
-)
-
-// Byte offsets inside a TCP header (relative to its start, i.e. csumStart).
-const (
-	tcpSeqOff      = 4
-	tcpDataOffOff  = 12 // upper nibble is header len in 32-bit words
-	tcpFlagsOff    = 13
-	tcpChecksumOff = 16
-)
-
-// tcpFinPshMask is cleared on every segment except the last of a TSO burst.
-const tcpFinPshMask = 0x09 // FIN(0x01) | PSH(0x08)
-
-// segmentInto splits a TUN-side packet described by hdr into one or more
-// IP packets, each appended to *out as a slice of scratch. scratch must be
-// sized to hold every segment (including replicated headers).
-func segmentInto(pkt []byte, hdr VirtioNetHdr, out *[][]byte, scratch []byte) error {
-	// When RSC_INFO is set the csum_start/csum_offset fields are repurposed to
-	// carry coalescing info rather than checksum offsets. A TUN writing via
-	// IFF_VNET_HDR should never emit this, but if it did we would silently
-	// miscompute the segment checksums — refuse the packet instead.
-	if hdr.Flags&unix.VIRTIO_NET_HDR_F_RSC_INFO != 0 {
-		return fmt.Errorf("virtio RSC_INFO flag not supported on TUN reads")
-	}
-
-	switch hdr.GSOType {
-	case unix.VIRTIO_NET_HDR_GSO_NONE:
-		if len(pkt) > len(scratch) {
-			return fmt.Errorf("packet larger than segment buffer: %d > %d", len(pkt), len(scratch))
-		}
-		copy(scratch, pkt)
-		seg := scratch[:len(pkt)]
-		if hdr.Flags&unix.VIRTIO_NET_HDR_F_NEEDS_CSUM != 0 {
-			if err := finishChecksum(seg, hdr); err != nil {
-				return err
-			}
-		}
-		*out = append(*out, seg)
-		return nil
-
-	case unix.VIRTIO_NET_HDR_GSO_TCPV4, unix.VIRTIO_NET_HDR_GSO_TCPV6:
-		return segmentTCP(pkt, hdr, out, scratch)
-
-	default:
-		return fmt.Errorf("unsupported virtio gso type: %d", hdr.GSOType)
-	}
-}
-
-// finishChecksum computes the L4 checksum for a non-GSO packet that the kernel
-// handed us with NEEDS_CSUM set. csum_start / csum_offset point at the 16-bit
-// checksum field; we zero it, fold a full sum (the field was pre-loaded with
-// the pseudo-header partial sum by the kernel), and store the result.
-func finishChecksum(seg []byte, hdr VirtioNetHdr) error {
-	cs := int(hdr.CsumStart)
-	co := int(hdr.CsumOffset)
-	if cs+co+2 > len(seg) {
-		return fmt.Errorf("csum offsets out of range: start=%d offset=%d len=%d", cs, co, len(seg))
-	}
-	// The kernel stores a partial pseudo-header sum at [cs+co:]; sum over the
-	// L4 region starting at cs, folding the prior partial in as the seed.
-	partial := binary.BigEndian.Uint16(seg[cs+co : cs+co+2])
-	seg[cs+co] = 0
-	seg[cs+co+1] = 0
-	binary.BigEndian.PutUint16(seg[cs+co:cs+co+2], ^checksum.Checksum(seg[cs:], partial))
-	return nil
-}
-
-// segmentTCP software-segments a TSO superpacket into one IP packet per MSS
-// chunk. The caller guarantees hdr.GSOType is TCPV4 or TCPV6.
-//
-// Hot-path shape: the per-segment loop only sums the payload chunk. The TCP
-// header, the IPv4 header, and the pseudo-header src/dst/proto contributions
-// are each summed once up front — every segment reuses those three pre-folded
-// uint32 values and combines them with small per-segment deltas (seq, flags,
-// tcpLen, ip_id, total_len) that are cheap to fold in.
-func segmentTCP(pkt []byte, hdr VirtioNetHdr, out *[][]byte, scratch []byte) error {
-	if hdr.GSOSize == 0 {
-		return fmt.Errorf("gso_size is zero")
-	}
-	if hdr.CsumStart == 0 {
-		return fmt.Errorf("csum_start is zero")
-	}
-
-	isV4 := hdr.GSOType == unix.VIRTIO_NET_HDR_GSO_TCPV4
-	csumStart := int(hdr.CsumStart)
-
-	if isV4 && csumStart < ipv4HeaderMinLen {
-		return fmt.Errorf("csum_start %d too small for IPv4", csumStart)
-	}
-	if !isV4 && csumStart < ipv6FixedLen {
-		return fmt.Errorf("csum_start %d too small for IPv6", csumStart)
-	}
-
-	// Don't trust hdr.HdrLen from the kernel: on some paths it can be set
-	// to the full length of the first packet rather than the true L3+L4 header length.
-	// Instead, read the TCP data-offset field from the packet itself and derive
-	// headerLen = csum_start + tcpHdrLen. Matches wireguard-go's approach.
-	if csumStart+tcpFlagsOff+1 > len(pkt) {
-		return fmt.Errorf("packet too short for tcp header at csum_start=%d (pkt %d)", csumStart, len(pkt))
-	}
-	tcpHdrLen := int(pkt[csumStart+tcpDataOffOff]>>4) * 4
-	if tcpHdrLen < tcpHeaderMinLen || tcpHdrLen > tcpHeaderMaxLen {
-		return fmt.Errorf("tcp data-offset out of range: %d", tcpHdrLen)
-	}
-	headerLen := csumStart + tcpHdrLen
-	if headerLen > len(pkt) {
-		return fmt.Errorf("derived hdr_len %d > pkt %d", headerLen, len(pkt))
-	}
-
-	payload := pkt[headerLen:]
-	payLen := len(payload)
-	gso := int(hdr.GSOSize)
-	numSeg := (payLen + gso - 1) / gso
-	if numSeg == 0 {
-		numSeg = 1
-	}
-
-	need := numSeg*headerLen + payLen
-	if need > len(scratch) {
-		return fmt.Errorf("scratch too small for %d segments: need %d have %d", numSeg, need, len(scratch))
-	}
-
-	origSeq := binary.BigEndian.Uint32(pkt[csumStart+tcpSeqOff : csumStart+tcpSeqOff+4])
-	origFlags := pkt[csumStart+tcpFlagsOff]
-
-	// Precompute the TCP header sum with seq/flags/csum zeroed. Copy onto
-	// the stack, zero the per-segment-varying fields, sum once.
-	var tmp [tcpHeaderMaxLen]byte
-	copy(tmp[:tcpHdrLen], pkt[csumStart:headerLen])
-	tmp[tcpSeqOff], tmp[tcpSeqOff+1], tmp[tcpSeqOff+2], tmp[tcpSeqOff+3] = 0, 0, 0, 0
-	tmp[tcpFlagsOff] = 0
-	tmp[tcpChecksumOff], tmp[tcpChecksumOff+1] = 0, 0
-	baseTcpHdrSum := uint32(checksum.Checksum(tmp[:tcpHdrLen], 0))
-
-	// Pseudo-header src+dst+proto contribution (tcpLen varies per segment).
-	var baseProtoSum uint32
-	if isV4 {
-		baseProtoSum = uint32(checksum.Checksum(pkt[ipv4SrcOff:ipv4AddrsEnd], 0))
-	} else {
-		baseProtoSum = uint32(checksum.Checksum(pkt[ipv6SrcOff:ipv6AddrsEnd], 0))
-	}
-	baseProtoSum += uint32(unix.IPPROTO_TCP)
-
-	// Precompute IPv4 header sum with total_len/id/csum zeroed.
-	var origIPID uint16
-	var ihl int
-	var baseIPHdrSum uint32
-	if isV4 {
-		origIPID = binary.BigEndian.Uint16(pkt[ipv4IDOff : ipv4IDOff+2])
-		ihl = int(pkt[0]&0x0f) * 4
-		if ihl < ipv4HeaderMinLen || ihl > csumStart {
-			return fmt.Errorf("bad IPv4 IHL: %d", ihl)
-		}
-		var ipTmp [ipv4HeaderMaxLen]byte
-		copy(ipTmp[:ihl], pkt[:ihl])
-		ipTmp[ipv4TotalLenOff], ipTmp[ipv4TotalLenOff+1] = 0, 0
-		ipTmp[ipv4IDOff], ipTmp[ipv4IDOff+1] = 0, 0
-		ipTmp[ipv4ChecksumOff], ipTmp[ipv4ChecksumOff+1] = 0, 0
-		baseIPHdrSum = uint32(checksum.Checksum(ipTmp[:ihl], 0))
-	}
-
-	off := 0
-	for i := 0; i < numSeg; i++ {
-		segStart := i * gso
-		segEnd := segStart + gso
-		if segEnd > payLen {
-			segEnd = payLen
-		}
-		segPayLen := segEnd - segStart
-
-		copy(scratch[off:], pkt[:headerLen])
-		copy(scratch[off+headerLen:], payload[segStart:segEnd])
-		seg := scratch[off : off+headerLen+segPayLen]
-		off += headerLen + segPayLen
-
-		segSeq := origSeq + uint32(segStart)
-		segFlags := origFlags
-		if i != numSeg-1 {
-			segFlags = origFlags &^ tcpFinPshMask
-		}
-		totalLen := headerLen + segPayLen
-
-		// Patch IP header and write the v4 header checksum from the precomputed base.
-		if isV4 {
-			segID := origIPID + uint16(i)
-			binary.BigEndian.PutUint16(seg[ipv4TotalLenOff:ipv4TotalLenOff+2], uint16(totalLen))
-			binary.BigEndian.PutUint16(seg[ipv4IDOff:ipv4IDOff+2], segID)
-			ipSum := baseIPHdrSum + uint32(totalLen) + uint32(segID)
-			binary.BigEndian.PutUint16(seg[ipv4ChecksumOff:ipv4ChecksumOff+2], foldComplement(ipSum))
-		} else {
-			// IPv6 payload length excludes the fixed header but includes any
-			// extension headers between [ipv6FixedLen:csumStart].
-			binary.BigEndian.PutUint16(seg[ipv6PayloadLenOff:ipv6PayloadLenOff+2], uint16(headerLen-ipv6FixedLen+segPayLen))
-		}
-
-		// Patch TCP header.
-		binary.BigEndian.PutUint32(seg[csumStart+tcpSeqOff:csumStart+tcpSeqOff+4], segSeq)
-		seg[csumStart+tcpFlagsOff] = segFlags
-		// (csum is written below; its prior contents in `seg` don't affect the
-		// computation since we never sum over the segment's own header.)
-
-		tcpLen := tcpHdrLen + segPayLen
-		paySum := uint32(checksum.Checksum(payload[segStart:segEnd], 0))
-
-		// Combine pre-folded uint32s into a wider accumulator, then fold. Using
-		// uint64 guards against overflow when segSeq's high bits set.
-		wide := uint64(baseTcpHdrSum) + uint64(paySum) + uint64(baseProtoSum)
-		wide += uint64(segSeq) + uint64(segFlags) + uint64(tcpLen)
-		wide = (wide & 0xffffffff) + (wide >> 32)
-		wide = (wide & 0xffffffff) + (wide >> 32)
-		binary.BigEndian.PutUint16(seg[csumStart+tcpChecksumOff:csumStart+tcpChecksumOff+2], foldComplement(uint32(wide)))
-
-		*out = append(*out, seg)
-	}
-
-	return nil
-}
-
-// foldComplement folds a 32-bit one's-complement partial sum to 16 bits and
-// complements it, yielding the on-wire Internet checksum value.
-func foldComplement(sum uint32) uint16 {
-	sum = (sum & 0xffff) + (sum >> 16)
-	sum = (sum & 0xffff) + (sum >> 16)
-	return ^uint16(sum)
-}
-
-// pseudoHeaderIPv4 returns the folded pseudo-header sum used to verify a TCP
-// segment's checksum in tests. src/dst are 4 bytes each.
-func pseudoHeaderIPv4(src, dst []byte, proto byte, tcpLen int) uint16 {
-	s := uint32(checksum.Checksum(src, 0)) + uint32(checksum.Checksum(dst, 0))
-	s += uint32(proto) + uint32(tcpLen)
-	s = (s & 0xffff) + (s >> 16)
-	s = (s & 0xffff) + (s >> 16)
-	return uint16(s)
-}
-
-// pseudoHeaderIPv6 returns the folded pseudo-header sum used to verify a TCP
-// segment's checksum in tests. src/dst are 16 bytes each.
-func pseudoHeaderIPv6(src, dst []byte, proto byte, tcpLen int) uint16 {
-	s := uint32(checksum.Checksum(src, 0)) + uint32(checksum.Checksum(dst, 0))
-	s += uint32(tcpLen>>16) + uint32(tcpLen&0xffff) + uint32(proto)
-	s = (s & 0xffff) + (s >> 16)
-	s = (s & 0xffff) + (s >> 16)
-	return uint16(s)
-}

overlay/tio/vnethdr_linux.go

@@ -1,39 +0,0 @@
-package tio
-
-import "encoding/binary"
-
-// Size of the legacy struct virtio_net_hdr that the kernel prepends/expects on
-// a TUN opened with IFF_VNET_HDR (TUNSETVNETHDRSZ not set).
-const virtioNetHdrLen = 10
-
-type VirtioNetHdr struct {
-	Flags      uint8
-	GSOType    uint8
-	HdrLen     uint16
-	GSOSize    uint16
-	CsumStart  uint16
-	CsumOffset uint16
-}
-
-// decode reads a virtio_net_hdr in host byte order (TUN default; we never
-// call TUNSETVNETLE so the kernel matches our endianness).
-func (h *VirtioNetHdr) decode(b []byte) {
-	h.Flags = b[0]
-	h.GSOType = b[1]
-	h.HdrLen = binary.NativeEndian.Uint16(b[2:4])
-	h.GSOSize = binary.NativeEndian.Uint16(b[4:6])
-	h.CsumStart = binary.NativeEndian.Uint16(b[6:8])
-	h.CsumOffset = binary.NativeEndian.Uint16(b[8:10])
-}
-
-// encode is the inverse of decode: writes the virtio_net_hdr fields into b
-// (must be at least virtioNetHdrLen bytes). Used to emit a TSO superpacket
-// on egress.
-func (h *VirtioNetHdr) encode(b []byte) {
-	b[0] = h.Flags
-	b[1] = h.GSOType
-	binary.NativeEndian.PutUint16(b[2:4], h.HdrLen)
-	binary.NativeEndian.PutUint16(b[4:6], h.GSOSize)
-	binary.NativeEndian.PutUint16(b[6:8], h.CsumStart)
-	binary.NativeEndian.PutUint16(b[8:10], h.CsumOffset)
-}

overlay/tun_android.go

@@ -13,7 +13,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 )
@@ -127,6 +126,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for android")
 }

overlay/tun_darwin.go

@@ -16,7 +16,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
@@ -573,6 +572,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for darwin")
 }

overlay/tun_disabled.go

@@ -9,7 +9,6 @@ import (
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/iputil"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -18,10 +17,9 @@ type disabledTun struct {
 	vpnNetworks []netip.Prefix
 
 	// Track these metrics since we don't have the tun device to do it for us
-	tx         metrics.Counter
-	rx         metrics.Counter
-	l          *logrus.Logger
-	numReaders int
+	tx metrics.Counter
+	rx metrics.Counter
+	l  *logrus.Logger
 
 	batchRet [1][]byte
 }
@@ -46,7 +44,6 @@ func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled boo
 		vpnNetworks: vpnNetworks,
 		read:        make(chan []byte, queueLen),
 		l:           l,
-		numReaders:  1,
 	}
 
 	if metricsEnabled {
@@ -115,17 +112,8 @@ func (t *disabledTun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *disabledTun) NewMultiQueueReader() error {
-	t.numReaders++
-	return nil
-}
-
-func (t *disabledTun) Readers() []tio.Queue {
-	out := make([]tio.Queue, t.numReaders)
-	for i := range t.numReaders {
-		out[i] = t
-	}
-	return out
+func (t *disabledTun) NewMultiQueueReader() (Queue, error) {
+	return t, nil
 }
 
 func (t *disabledTun) Close() error {

overlay/tun_freebsd.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io/fs"
 	"net/netip"
-	"os"
 	"sync/atomic"
 	"syscall"
 	"time"
@@ -18,7 +17,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
@@ -94,70 +92,12 @@ type tun struct {
 	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
 	linkAddr    *netroute.LinkAddr
 	l           *logrus.Logger
-
-	fd        int
-	shutdownR int // read end of the shutdown pipe; closing the write end wakes blocked polls
-	shutdownW int // write end of the shutdown pipe; closing this signals shutdown to any blocked reader/writer
-	readPoll  [2]unix.PollFd
-	writePoll [2]unix.PollFd
-	closed    atomic.Bool
+	devFd       int
 
 	readBuf  []byte
 	batchRet [1][]byte
 }
 
-// blockOnRead waits until the tun fd is readable or shutdown has been signaled.
-// Returns os.ErrClosed if Close was called.
-func (t *tun) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.readPoll[0].Revents
-	shutdownEvents := t.readPoll[1].Revents
-	t.readPoll[0].Revents = 0
-	t.readPoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (t *tun) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.writePoll[0].Revents
-	shutdownEvents := t.writePoll[1].Revents
-	t.writePoll[0].Revents = 0
-	t.writePoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
 func (t *tun) Read() ([][]byte, error) {
 	if t.readBuf == nil {
 		t.readBuf = make([]byte, defaultBatchBufSize)
@@ -175,122 +115,103 @@ func (t *tun) WriteReject(p []byte) (int, error) {
 }
 
 func (t *tun) readOne(to []byte) (int, error) {
+	// use readv() to read from the tunnel device, to eliminate the need for copying the buffer
+	if t.devFd < 0 {
+		return -1, syscall.EINVAL
+	}
+
 	// first 4 bytes is protocol family, in network byte order
-	var head [4]byte
-	iovecs := [2]syscall.Iovec{
+	head := make([]byte, 4)
+
+	iovecs := []syscall.Iovec{
 		{&head[0], 4},
 		{&to[0], uint64(len(to))},
 	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		if errno == 0 {
-			bytesRead := int(n)
-			if bytesRead < 4 {
-				return 0, nil
-			}
-			return bytesRead - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnRead(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
+
+	var err error
+	if errno != 0 {
+		err = syscall.Errno(errno)
+	} else {
+		err = nil
+	}
+	// fix bytes read number to exclude header
+	bytesRead := int(n)
+	if bytesRead < 0 {
+		return bytesRead, err
+	} else if bytesRead < 4 {
+		return 0, err
+	} else {
+		return bytesRead - 4, err
 	}
 }
 
 // Write is only valid for single threaded use
 func (t *tun) Write(from []byte) (int, error) {
+	// use writev() to write to the tunnel device, to eliminate the need for copying the buffer
+	if t.devFd < 0 {
+		return -1, syscall.EINVAL
+	}
+
 	if len(from) <= 1 {
 		return 0, syscall.EIO
 	}
-
 	ipVer := from[0] >> 4
-	var head [4]byte
+	var head []byte
 	// first 4 bytes is protocol family, in network byte order
-	switch ipVer {
-	case 4:
-		head[3] = syscall.AF_INET
-	case 6:
-		head[3] = syscall.AF_INET6
-	default:
+	if ipVer == 4 {
+		head = []byte{0, 0, 0, syscall.AF_INET}
+	} else if ipVer == 6 {
+		head = []byte{0, 0, 0, syscall.AF_INET6}
+	} else {
 		return 0, fmt.Errorf("unable to determine IP version from packet")
 	}
-
-	iovecs := [2]syscall.Iovec{
+	iovecs := []syscall.Iovec{
 		{&head[0], 4},
 		{&from[0], uint64(len(from))},
 	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		if errno == 0 {
-			return int(n) - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnWrite(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
+
+	var err error
+	if errno != 0 {
+		err = syscall.Errno(errno)
+	} else {
+		err = nil
 	}
+
+	return int(n) - 4, err
 }
 
 func (t *tun) Close() error {
-	if t.closed.Swap(true) {
-		return nil
-	}
-
-	// Closing the write end of the shutdown pipe causes any blocked Poll to
-	// return with POLLHUP on the shutdown fd, so readers/writers wake up and
-	// exit with os.ErrClosed.
-	if t.shutdownW >= 0 {
-		_ = unix.Close(t.shutdownW)
-		t.shutdownW = -1
-	}
-
-	if t.fd >= 0 {
-		if err := unix.Close(t.fd); err != nil {
+	if t.devFd >= 0 {
+		err := syscall.Close(t.devFd)
+		if err != nil {
 			t.l.WithError(err).Error("Error closing device")
 		}
-		t.fd = -1
-	}
+		t.devFd = -1
 
-	if t.shutdownR >= 0 {
-		_ = unix.Close(t.shutdownR)
-		t.shutdownR = -1
-	}
+		c := make(chan struct{})
+		go func() {
+			// destroying the interface can block if a read() is still pending. Do this asynchronously.
+			defer close(c)
+			s, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
+			if err == nil {
+				defer syscall.Close(s)
+				ifreq := ifreqDestroy{Name: t.deviceBytes()}
+				err = ioctl(uintptr(s), syscall.SIOCIFDESTROY, uintptr(unsafe.Pointer(&ifreq)))
+			}
+			if err != nil {
+				t.l.WithError(err).Error("Error destroying tunnel")
+			}
+		}()
 
-	c := make(chan struct{})
-	go func() {
-		// destroying the interface can block if a read() is still pending. Do this asynchronously.
-		defer close(c)
-		s, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
-		if err == nil {
-			defer syscall.Close(s)
-			ifreq := ifreqDestroy{Name: t.deviceBytes()}
-			err = ioctl(uintptr(s), syscall.SIOCIFDESTROY, uintptr(unsafe.Pointer(&ifreq)))
+		// wait up to 1 second so we start blocking at the ioctl
+		select {
+		case <-c:
+		case <-time.After(1 * time.Second):
 		}
-		if err != nil {
-			t.l.WithError(err).Error("Error destroying tunnel")
-		}
-	}()
-
-	// wait up to 1 second so we start blocking at the ioctl
-	select {
-	case <-c:
-	case <-time.After(1 * time.Second):
 	}
 
 	return nil
@@ -306,38 +227,16 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 	var err error
 	deviceName := c.GetString("tun.dev", "")
 	if deviceName != "" {
-		fd, err = unix.Open("/dev/"+deviceName, os.O_RDWR, 0)
+		fd, err = syscall.Open("/dev/"+deviceName, syscall.O_RDWR, 0)
 	}
 	if errors.Is(err, fs.ErrNotExist) || deviceName == "" {
 		// If the device doesn't already exist, request a new one and rename it
-		fd, err = unix.Open("/dev/tun", os.O_RDWR, 0)
+		fd, err = syscall.Open("/dev/tun", syscall.O_RDWR, 0)
 	}
 	if err != nil {
 		return nil, err
 	}
 
-	if err = unix.SetNonblock(fd, true); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("failed to set tun device as nonblocking: %w", err)
-	}
-
-	// Shutdown pipe lets Close wake any reader/writer blocked in Poll.
-	var pipeFds [2]int
-	if err = unix.Pipe2(pipeFds[:], unix.O_CLOEXEC|unix.O_NONBLOCK); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("failed to create shutdown pipe: %w", err)
-	}
-	shutdownR, shutdownW := pipeFds[0], pipeFds[1]
-
-	closeOnErr := true
-	defer func() {
-		if closeOnErr {
-			_ = unix.Close(fd)
-			_ = unix.Close(shutdownR)
-			_ = unix.Close(shutdownW)
-		}
-	}()
-
 	// Read the name of the interface
 	var name [16]byte
 	arg := fiodgnameArg{length: 16, buf: unsafe.Pointer(&name)}
@@ -356,7 +255,7 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 	}
 
 	if ctrlErr != nil {
-		return nil, ctrlErr
+		return nil, err
 	}
 
 	ifName := string(bytes.TrimRight(name[:], "\x00"))
@@ -372,6 +271,8 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 		}
 		defer syscall.Close(s)
 
+		fd := uintptr(s)
+
 		var fromName [16]byte
 		var toName [16]byte
 		copy(fromName[:], ifName)
@@ -383,7 +284,7 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 		}
 
 		// Set the device name
-		_ = ioctl(uintptr(s), syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
+		_ = ioctl(fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
 	}
 
 	t := &tun{
@@ -391,24 +292,13 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 		vpnNetworks: vpnNetworks,
 		MTU:         c.GetInt("tun.mtu", DefaultMTU),
 		l:           l,
-		fd:          fd,
-		shutdownR:   shutdownR,
-		shutdownW:   shutdownW,
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownR), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownR), Events: unix.POLLIN},
-		},
+		devFd:       fd,
 	}
 
 	err = t.reload(c, true)
 	if err != nil {
 		return nil, err
 	}
-	closeOnErr = false
 
 	c.RegisterReloadCallback(func(c *config.C) {
 		err := t.reload(c, false)
@@ -582,7 +472,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for freebsd")
 }
 

overlay/tun_ios.go

@@ -16,7 +16,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 )
@@ -183,6 +182,6 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for ios")
 }

overlay/tun_linux.go

@@ -4,28 +4,472 @@
 package overlay
 
 import (
+	"encoding/binary"
 	"fmt"
+	"io"
 	"net"
 	"net/netip"
 	"os"
+	"runtime"
 	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"time"
 	"unsafe"
 
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/sys/unix"
 )
 
+// tunFile wraps a TUN file descriptor with poll-based reads. The FD provided will be changed to non-blocking.
+// A shared eventfd allows Close to wake all readers blocked in poll.
+type tunFile struct {
+	fd         int
+	shutdownFd int
+	lastOne    bool
+	readPoll   [2]unix.PollFd
+	writePoll  [2]unix.PollFd
+	closed     bool
+
+	// vnetHdr is true when this fd was opened with IFF_VNET_HDR and the
+	// kernel successfully accepted TUNSETOFFLOAD. Reads include a leading
+	// virtio_net_hdr and may carry a TSO superpacket we must segment;
+	// writes must prepend a zeroed virtio_net_hdr.
+	vnetHdr   bool
+	readBuf   []byte        // scratch for a single raw read (virtio hdr + superpacket)
+	segBuf    []byte        // backing store for segmented output
+	segOff    int           // cursor into segBuf for the current Read drain
+	pending   [][]byte      // segments returned from the most recent Read
+	writeIovs [2]unix.Iovec // preallocated iovecs for Write (coalescer passthrough); iovs[0] is fixed to validVnetHdr
+	// rejectIovs is a second preallocated iovec scratch used exclusively by
+	// WriteReject (reject + self-forward from the inside path). It mirrors
+	// writeIovs but lets listenIn goroutines emit reject packets without
+	// racing with the listenOut coalescer that owns writeIovs.
+	rejectIovs [2]unix.Iovec
+
+	// gsoHdrBuf is a per-queue 10-byte scratch for the virtio_net_hdr emitted
+	// by WriteGSO. Separate from validVnetHdr so a concurrent non-GSO Write on
+	// another queue never observes a half-written header.
+	gsoHdrBuf [virtioNetHdrLen]byte
+	// gsoIovs is the writev iovec scratch for WriteGSO. Sized to hold the
+	// virtio header + IP/TCP header + up to gsoInitialPayIovs payload
+	// fragments; grown on demand if a coalescer pushes more.
+	gsoIovs []unix.Iovec
+}
+
+// gsoInitialPayIovs is the starting capacity (in payload fragments) of
+// tunFile.gsoIovs. Sized to cover the default coalesce segment cap without
+// any reallocations.
+const gsoInitialPayIovs = 66
+
+// validVnetHdr is the 10-byte virtio_net_hdr we prepend to every non-GSO TUN
+// write. Only flag set is VIRTIO_NET_HDR_F_DATA_VALID, which marks the skb
+// CHECKSUM_UNNECESSARY so the receiving network stack skips L4 checksum
+// verification. All packets that reach the plain Write / WriteReject paths
+// already carry a valid L4 checksum (either supplied by a remote peer whose
+// ciphertext we AEAD-authenticated, or produced by finishChecksum during TSO
+// segmentation, or built locally by CreateRejectPacket), so trusting them is
+// safe.
+var validVnetHdr = [virtioNetHdrLen]byte{unix.VIRTIO_NET_HDR_F_DATA_VALID}
+
+// newFriend makes a tunFile for a MultiQueueReader that copies the shutdown eventfd from the parent tun
+func (r *tunFile) newFriend(fd int) (*tunFile, error) {
+	if err := unix.SetNonblock(fd, true); err != nil {
+		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
+	}
+	out := &tunFile{
+		fd:         fd,
+		shutdownFd: r.shutdownFd,
+		vnetHdr:    r.vnetHdr,
+		readBuf:    make([]byte, tunReadBufSize),
+		readPoll: [2]unix.PollFd{
+			{Fd: int32(fd), Events: unix.POLLIN},
+			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
+		},
+		writePoll: [2]unix.PollFd{
+			{Fd: int32(fd), Events: unix.POLLOUT},
+			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
+		},
+	}
+	if r.vnetHdr {
+		out.segBuf = make([]byte, tunSegBufCap)
+		out.writeIovs[0].Base = &validVnetHdr[0]
+		out.writeIovs[0].SetLen(virtioNetHdrLen)
+		out.rejectIovs[0].Base = &validVnetHdr[0]
+		out.rejectIovs[0].SetLen(virtioNetHdrLen)
+		out.gsoIovs = make([]unix.Iovec, 2, 2+gsoInitialPayIovs)
+		out.gsoIovs[0].Base = &out.gsoHdrBuf[0]
+		out.gsoIovs[0].SetLen(virtioNetHdrLen)
+	}
+	return out, nil
+}
+
+func newTunFd(fd int, vnetHdr bool) (*tunFile, error) {
+	if err := unix.SetNonblock(fd, true); err != nil {
+		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
+	}
+
+	shutdownFd, err := unix.Eventfd(0, unix.EFD_NONBLOCK|unix.EFD_CLOEXEC)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create eventfd: %w", err)
+	}
+
+	out := &tunFile{
+		fd:         fd,
+		shutdownFd: shutdownFd,
+		lastOne:    true,
+		vnetHdr:    vnetHdr,
+		readBuf:    make([]byte, tunReadBufSize),
+		readPoll: [2]unix.PollFd{
+			{Fd: int32(fd), Events: unix.POLLIN},
+			{Fd: int32(shutdownFd), Events: unix.POLLIN},
+		},
+		writePoll: [2]unix.PollFd{
+			{Fd: int32(fd), Events: unix.POLLOUT},
+			{Fd: int32(shutdownFd), Events: unix.POLLIN},
+		},
+	}
+	if vnetHdr {
+		out.segBuf = make([]byte, tunSegBufCap)
+		out.writeIovs[0].Base = &validVnetHdr[0]
+		out.writeIovs[0].SetLen(virtioNetHdrLen)
+		out.rejectIovs[0].Base = &validVnetHdr[0]
+		out.rejectIovs[0].SetLen(virtioNetHdrLen)
+		out.gsoIovs = make([]unix.Iovec, 2, 2+gsoInitialPayIovs)
+		out.gsoIovs[0].Base = &out.gsoHdrBuf[0]
+		out.gsoIovs[0].SetLen(virtioNetHdrLen)
+	}
+
+	return out, nil
+}
+
+func (r *tunFile) blockOnRead() error {
+	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
+	var err error
+	for {
+		_, err = unix.Poll(r.readPoll[:], -1)
+		if err != unix.EINTR {
+			break
+		}
+	}
+	//always reset these!
+	tunEvents := r.readPoll[0].Revents
+	shutdownEvents := r.readPoll[1].Revents
+	r.readPoll[0].Revents = 0
+	r.readPoll[1].Revents = 0
+	//do the err check before trusting the potentially bogus bits we just got
+	if err != nil {
+		return err
+	}
+	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
+		return os.ErrClosed
+	} else if tunEvents&problemFlags != 0 {
+		return os.ErrClosed
+	}
+	return nil
+}
+
+func (r *tunFile) blockOnWrite() error {
+	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
+	var err error
+	for {
+		_, err = unix.Poll(r.writePoll[:], -1)
+		if err != unix.EINTR {
+			break
+		}
+	}
+	//always reset these!
+	tunEvents := r.writePoll[0].Revents
+	shutdownEvents := r.writePoll[1].Revents
+	r.writePoll[0].Revents = 0
+	r.writePoll[1].Revents = 0
+	//do the err check before trusting the potentially bogus bits we just got
+	if err != nil {
+		return err
+	}
+	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
+		return os.ErrClosed
+	} else if tunEvents&problemFlags != 0 {
+		return os.ErrClosed
+	}
+	return nil
+}
+
+func (r *tunFile) readRaw(buf []byte) (int, error) {
+	for {
+		if n, err := unix.Read(r.fd, buf); err == nil {
+			return n, nil
+		} else if err == unix.EAGAIN {
+			if err = r.blockOnRead(); err != nil {
+				return 0, err
+			}
+			continue
+		} else {
+			return 0, err
+		}
+	}
+}
+
+// Read reads one or more superpackets from the tun and returns the
+// resulting packets. The first read blocks via poll; once the fd is known
+// readable we drain additional packets non-blocking until the kernel queue
+// is empty (EAGAIN), we've collected tunDrainCap packets, or we're out of
+// segBuf headroom. This amortizes the poll wake over bursts of small
+// packets (e.g. TCP ACKs). Slices point into the tunFile's internal buffers
+// and are only valid until the next Read or Close on this Queue.
+func (r *tunFile) Read() ([][]byte, error) {
+	r.pending = r.pending[:0]
+	r.segOff = 0
+
+	// Initial (blocking) read. Retry on decode errors so a single bad
+	// packet does not stall the reader.
+	for {
+		n, err := r.readRaw(r.readBuf)
+		if err != nil {
+			return nil, err
+		}
+		if !r.vnetHdr {
+			r.pending = append(r.pending, r.readBuf[:n])
+			// Non-vnetHdr mode shares one readBuf so we can't drain safely
+			// without copying; return the single packet as before.
+			return r.pending, nil
+		}
+		if err := r.decodeRead(n); err != nil {
+			// Drop and read again — a bad packet should not kill the reader.
+			continue
+		}
+		break
+	}
+
+	// Drain: non-blocking reads until the kernel queue is empty, the drain
+	// cap is reached, or segBuf no longer has room for another worst-case
+	// superpacket.
+	for len(r.pending) < tunDrainCap && tunSegBufCap-r.segOff >= tunSegBufSize {
+		n, err := unix.Read(r.fd, r.readBuf)
+		if err != nil {
+			// EAGAIN / EINTR / anything else: stop draining. We already
+			// have a valid batch from the first read.
+			break
+		}
+		if n <= 0 {
+			break
+		}
+		if err := r.decodeRead(n); err != nil {
+			// Drop this packet and stop the drain; we'd rather hand off
+			// what we have than keep spinning here.
+			break
+		}
+	}
+
+	return r.pending, nil
+}
+
+// decodeRead decodes the virtio header plus payload in r.readBuf[:n], appends
+// the segments to r.pending, and advances r.segOff by the total scratch used.
+// Caller must have already ensured r.vnetHdr is true.
+func (r *tunFile) decodeRead(n int) error {
+	if n < virtioNetHdrLen {
+		return fmt.Errorf("short tun read: %d < %d", n, virtioNetHdrLen)
+	}
+	var hdr virtioNetHdr
+	hdr.decode(r.readBuf[:virtioNetHdrLen])
+	before := len(r.pending)
+	if err := segmentInto(r.readBuf[virtioNetHdrLen:n], hdr, &r.pending, r.segBuf[r.segOff:]); err != nil {
+		return err
+	}
+	for k := before; k < len(r.pending); k++ {
+		r.segOff += len(r.pending[k])
+	}
+	return nil
+}
+
+func (r *tunFile) Write(buf []byte) (int, error) {
+	return r.writeWithScratch(buf, &r.writeIovs)
+}
+
+// WriteReject emits a packet using a dedicated iovec scratch (rejectIovs)
+// distinct from the one used by the coalescer's Write path. This avoids a
+// data race between the inside (listenIn) goroutine emitting reject or
+// self-forward packets and the outside (listenOut) goroutine flushing TCP
+// coalescer passthroughs on the same tunFile.
+func (r *tunFile) WriteReject(buf []byte) (int, error) {
+	return r.writeWithScratch(buf, &r.rejectIovs)
+}
+
+func (r *tunFile) writeWithScratch(buf []byte, iovs *[2]unix.Iovec) (int, error) {
+	if !r.vnetHdr {
+		for {
+			if n, err := unix.Write(r.fd, buf); err == nil {
+				return n, nil
+			} else if err == unix.EAGAIN {
+				if err = r.blockOnWrite(); err != nil {
+					return 0, err
+				}
+				continue
+			} else if err == unix.EINTR {
+				continue
+			} else {
+				return 0, err
+			}
+		}
+	}
+
+	if len(buf) == 0 {
+		return 0, nil
+	}
+	// Point the payload iovec at the caller's buffer. iovs[0] is pre-wired
+	// to validVnetHdr during tunFile construction so we don't rebuild it here.
+	iovs[1].Base = &buf[0]
+	iovs[1].SetLen(len(buf))
+	iovPtr := uintptr(unsafe.Pointer(&iovs[0]))
+	// The TUN fd is non-blocking (set in newTunFd / newFriend), so writev
+	// either completes promptly or returns EAGAIN — it cannot park the
+	// goroutine inside the kernel. That lets us use syscall.RawSyscall and
+	// skip the runtime.entersyscall / exitsyscall bookkeeping on every
+	// packet; we only pay that cost when we fall through to blockOnWrite.
+	for {
+		n, _, errno := syscall.RawSyscall(unix.SYS_WRITEV, uintptr(r.fd), iovPtr, 2)
+		if errno == 0 {
+			runtime.KeepAlive(buf)
+			if int(n) < virtioNetHdrLen {
+				return 0, io.ErrShortWrite
+			}
+			return int(n) - virtioNetHdrLen, nil
+		}
+		if errno == unix.EAGAIN {
+			runtime.KeepAlive(buf)
+			if err := r.blockOnWrite(); err != nil {
+				return 0, err
+			}
+			continue
+		}
+		if errno == unix.EINTR {
+			continue
+		}
+		runtime.KeepAlive(buf)
+		return 0, errno
+	}
+}
+
+// GSOSupported reports whether this queue was opened with IFF_VNET_HDR and
+// can accept WriteGSO. When false, callers should fall back to per-segment
+// Write calls.
+func (r *tunFile) GSOSupported() bool { return r.vnetHdr }
+
+// WriteGSO emits a TCP TSO superpacket in a single writev. hdr is the
+// IPv4/IPv6 + TCP header prefix (already finalized — total length, IP csum,
+// and TCP pseudo-header partial set by the caller). pays are payload
+// fragments whose concatenation forms the full coalesced payload; each
+// slice is read-only and must stay valid until return. gsoSize is the MSS;
+// every segment except possibly the last is exactly gsoSize bytes.
+// csumStart is the byte offset where the TCP header begins within hdr.
+func (r *tunFile) WriteGSO(hdr []byte, pays [][]byte, gsoSize uint16, isV6 bool, csumStart uint16) error {
+	if !r.vnetHdr {
+		return fmt.Errorf("WriteGSO called on tun without IFF_VNET_HDR")
+	}
+	if len(hdr) == 0 || len(pays) == 0 {
+		return nil
+	}
+
+	// Build the virtio_net_hdr. When pays total to <= gsoSize the kernel
+	// would produce a single segment; keep NEEDS_CSUM semantics but skip
+	// the GSO type so the kernel doesn't spuriously mark this as TSO.
+	vhdr := virtioNetHdr{
+		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
+		HdrLen:     uint16(len(hdr)),
+		GSOSize:    gsoSize,
+		CsumStart:  csumStart,
+		CsumOffset: 16, // TCP checksum field lives 16 bytes into the TCP header
+	}
+	var totalPay int
+	for _, p := range pays {
+		totalPay += len(p)
+	}
+	if totalPay > int(gsoSize) {
+		if isV6 {
+			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV6
+		} else {
+			vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_TCPV4
+		}
+	} else {
+		vhdr.GSOType = unix.VIRTIO_NET_HDR_GSO_NONE
+		vhdr.GSOSize = 0
+	}
+	vhdr.encode(r.gsoHdrBuf[:])
+
+	// Build the iovec array: [virtio_hdr, hdr, pays...]. r.gsoIovs[0] is
+	// wired to gsoHdrBuf at construction and never changes.
+	need := 2 + len(pays)
+	if cap(r.gsoIovs) < need {
+		grown := make([]unix.Iovec, need)
+		grown[0] = r.gsoIovs[0]
+		r.gsoIovs = grown
+	} else {
+		r.gsoIovs = r.gsoIovs[:need]
+	}
+	r.gsoIovs[1].Base = &hdr[0]
+	r.gsoIovs[1].SetLen(len(hdr))
+	for i, p := range pays {
+		r.gsoIovs[2+i].Base = &p[0]
+		r.gsoIovs[2+i].SetLen(len(p))
+	}
+
+	iovPtr := uintptr(unsafe.Pointer(&r.gsoIovs[0]))
+	iovCnt := uintptr(len(r.gsoIovs))
+	for {
+		n, _, errno := syscall.RawSyscall(unix.SYS_WRITEV, uintptr(r.fd), iovPtr, iovCnt)
+		if errno == 0 {
+			runtime.KeepAlive(hdr)
+			runtime.KeepAlive(pays)
+			if int(n) < virtioNetHdrLen {
+				return io.ErrShortWrite
+			}
+			return nil
+		}
+		if errno == unix.EAGAIN {
+			runtime.KeepAlive(hdr)
+			runtime.KeepAlive(pays)
+			if err := r.blockOnWrite(); err != nil {
+				return err
+			}
+			continue
+		}
+		if errno == unix.EINTR {
+			continue
+		}
+		runtime.KeepAlive(hdr)
+		runtime.KeepAlive(pays)
+		return errno
+	}
+}
+
+func (r *tunFile) wakeForShutdown() error {
+	var buf [8]byte
+	binary.NativeEndian.PutUint64(buf[:], 1)
+	_, err := unix.Write(int(r.readPoll[1].Fd), buf[:])
+	return err
+}
+
+func (r *tunFile) Close() error {
+	if r.closed { // avoid closing more than once. Technically a fd could get re-used, which would be a problem
+		return nil
+	}
+	r.closed = true
+	if r.lastOne {
+		_ = unix.Close(r.shutdownFd)
+	}
+	return unix.Close(r.fd)
+}
+
 type tun struct {
-	readers     tio.Container
+	*tunFile
+	readers     []*tunFile
 	closeLock   sync.Mutex
 	Device      string
 	vpnNetworks []netip.Prefix
@@ -34,7 +478,6 @@ type tun struct {
 	TXQueueLen  int
 	deviceIndex int
 	ioctlFd     uintptr
-	vnetHdr     bool
 
 	Routes                    atomic.Pointer[[]Route]
 	routeTree                 atomic.Pointer[bart.Table[routing.Gateways]]
@@ -173,28 +616,15 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueu
 
 // newTunGeneric does all the stuff common to different tun initialization paths. It will close your files on error.
 func newTunGeneric(c *config.C, l *logrus.Logger, fd int, vnetHdr bool, vpnNetworks []netip.Prefix) (*tun, error) {
-	var container tio.Container
-	var err error
-	if vnetHdr {
-		container, err = tio.NewOffloadContainer()
-	} else {
-		container, err = tio.NewPollContainer()
-	}
-
+	tfd, err := newTunFd(fd, vnetHdr)
 	if err != nil {
 		_ = unix.Close(fd)
 		return nil, err
 	}
-	err = container.Add(fd)
-	if err != nil {
-		_ = unix.Close(fd)
-		return nil, err
-	}
-
 	t := &tun{
-		readers:                   container,
+		tunFile:                   tfd,
+		readers:                   []*tunFile{tfd},
 		closeLock:                 sync.Mutex{},
-		vnetHdr:                   vnetHdr,
 		vpnNetworks:               vpnNetworks,
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
@@ -296,13 +726,13 @@ func (t *tun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *tun) NewMultiQueueReader() error {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	t.closeLock.Lock()
 	defer t.closeLock.Unlock()
 
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	flags := uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
@@ -311,23 +741,25 @@ func (t *tun) NewMultiQueueReader() error {
 	}
 	if _, err = tunSetIff(fd, t.Device, flags); err != nil {
 		_ = unix.Close(fd)
-		return err
+		return nil, err
 	}
 
 	if t.vnetHdr {
 		if err = ioctl(uintptr(fd), unix.TUNSETOFFLOAD, uintptr(tsoOffloadFlags)); err != nil {
 			_ = unix.Close(fd)
-			return fmt.Errorf("failed to enable offload on multiqueue tun fd: %w", err)
+			return nil, fmt.Errorf("failed to enable offload on multiqueue tun fd: %w", err)
 		}
 	}
 
-	err = t.readers.Add(fd)
+	out, err := t.tunFile.newFriend(fd)
 	if err != nil {
 		_ = unix.Close(fd)
-		return err
+		return nil, err
 	}
 
-	return nil
+	t.readers = append(t.readers, out)
+
+	return out, nil
 }
 
 func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
@@ -757,10 +1189,6 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 	t.routeTree.Store(newTree)
 }
 
-func (t *tun) Readers() []tio.Queue {
-	return t.readers.Queues()
-}
-
 func (t *tun) Close() error {
 	t.closeLock.Lock()
 	defer t.closeLock.Unlock()
@@ -770,10 +1198,32 @@ func (t *tun) Close() error {
 		t.routeChan = nil
 	}
 
+	// Signal all readers blocked in poll to wake up and exit
+	_ = t.tunFile.wakeForShutdown()
+
 	if t.ioctlFd > 0 {
 		_ = unix.Close(int(t.ioctlFd))
 		t.ioctlFd = 0
 	}
 
-	return t.readers.Close()
+	for i := range t.readers {
+		if i == 0 {
+			continue //we want to close the zeroth reader last
+		}
+		err := t.readers[i].Close()
+		if err != nil {
+			t.l.WithField("reader", i).WithError(err).Error("error closing tun reader")
+		} else {
+			t.l.WithField("reader", i).Info("closed tun reader")
+		}
+	}
+
+	//this is t.readers[0] too
+	err := t.tunFile.Close()
+	if err != nil {
+		t.l.WithField("reader", 0).WithError(err).Error("error closing tun reader")
+	} else {
+		t.l.WithField("reader", 0).Info("closed tun reader")
+	}
+	return err
 }

overlay/tun_linux_offload.go

@@ -0,0 +1,331 @@
+//go:build linux && !android && !e2e_testing
+// +build linux,!android,!e2e_testing
+
+package overlay
+
+import (
+	"encoding/binary"
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
+
+// Size of the legacy struct virtio_net_hdr that the kernel prepends/expects on
+// a TUN opened with IFF_VNET_HDR (TUNSETVNETHDRSZ not set).
+const virtioNetHdrLen = 10
+
+// Maximum size we accept for a single read from a TUN with IFF_VNET_HDR. A
+// TSO superpacket can be up to 64KiB of payload plus a single L2/L3/L4 header
+// prefix plus the virtio header.
+const tunReadBufSize = 65535
+
+// Space for segmented output. Worst case is many small segments, each paying
+// an IP+TCP header. 128KiB comfortably covers the 64KiB payload ceiling.
+const tunSegBufSize = 131072
+
+// tunSegBufCap is the total size we allocate for the per-reader segment
+// buffer. It is sized as one worst-case TSO superpacket (tunSegBufSize) plus
+// the same again as drain headroom so a Read wake can accumulate
+// additional packets after an initial big read without overflowing.
+const tunSegBufCap = tunSegBufSize * 2
+
+// tunDrainCap caps how many packets a single Read will accumulate via
+// the post-wake drain loop. Sized to soak up a burst of small ACKs while
+// bounding how much work a single caller holds before handing off.
+const tunDrainCap = 64
+
+type virtioNetHdr struct {
+	Flags      uint8
+	GSOType    uint8
+	HdrLen     uint16
+	GSOSize    uint16
+	CsumStart  uint16
+	CsumOffset uint16
+}
+
+// decode reads a virtio_net_hdr in host byte order (TUN default; we never
+// call TUNSETVNETLE so the kernel matches our endianness).
+func (h *virtioNetHdr) decode(b []byte) {
+	h.Flags = b[0]
+	h.GSOType = b[1]
+	h.HdrLen = binary.NativeEndian.Uint16(b[2:4])
+	h.GSOSize = binary.NativeEndian.Uint16(b[4:6])
+	h.CsumStart = binary.NativeEndian.Uint16(b[6:8])
+	h.CsumOffset = binary.NativeEndian.Uint16(b[8:10])
+}
+
+// encode is the inverse of decode: writes the virtio_net_hdr fields into b
+// (must be at least virtioNetHdrLen bytes). Used to emit a TSO superpacket
+// on egress.
+func (h *virtioNetHdr) encode(b []byte) {
+	b[0] = h.Flags
+	b[1] = h.GSOType
+	binary.NativeEndian.PutUint16(b[2:4], h.HdrLen)
+	binary.NativeEndian.PutUint16(b[4:6], h.GSOSize)
+	binary.NativeEndian.PutUint16(b[6:8], h.CsumStart)
+	binary.NativeEndian.PutUint16(b[8:10], h.CsumOffset)
+}
+
+// segmentInto splits a TUN-side packet described by hdr into one or more
+// IP packets, each appended to *out as a slice of scratch. scratch must be
+// sized to hold every segment (including replicated headers).
+func segmentInto(pkt []byte, hdr virtioNetHdr, out *[][]byte, scratch []byte) error {
+	// When RSC_INFO is set the csum_start/csum_offset fields are repurposed to
+	// carry coalescing info rather than checksum offsets. A TUN writing via
+	// IFF_VNET_HDR should never emit this, but if it did we would silently
+	// miscompute the segment checksums — refuse the packet instead.
+	if hdr.Flags&unix.VIRTIO_NET_HDR_F_RSC_INFO != 0 {
+		return fmt.Errorf("virtio RSC_INFO flag not supported on TUN reads")
+	}
+
+	switch hdr.GSOType {
+	case unix.VIRTIO_NET_HDR_GSO_NONE:
+		if len(pkt) > len(scratch) {
+			return fmt.Errorf("packet larger than segment buffer: %d > %d", len(pkt), len(scratch))
+		}
+		copy(scratch, pkt)
+		seg := scratch[:len(pkt)]
+		if hdr.Flags&unix.VIRTIO_NET_HDR_F_NEEDS_CSUM != 0 {
+			if err := finishChecksum(seg, hdr); err != nil {
+				return err
+			}
+		}
+		*out = append(*out, seg)
+		return nil
+
+	case unix.VIRTIO_NET_HDR_GSO_TCPV4, unix.VIRTIO_NET_HDR_GSO_TCPV6:
+		return segmentTCP(pkt, hdr, out, scratch)
+
+	default:
+		return fmt.Errorf("unsupported virtio gso type: %d", hdr.GSOType)
+	}
+}
+
+// finishChecksum computes the L4 checksum for a non-GSO packet that the kernel
+// handed us with NEEDS_CSUM set. csum_start / csum_offset point at the 16-bit
+// checksum field; we zero it, fold a full sum (the field was pre-loaded with
+// the pseudo-header partial sum by the kernel), and store the result.
+func finishChecksum(seg []byte, hdr virtioNetHdr) error {
+	cs := int(hdr.CsumStart)
+	co := int(hdr.CsumOffset)
+	if cs+co+2 > len(seg) {
+		return fmt.Errorf("csum offsets out of range: start=%d offset=%d len=%d", cs, co, len(seg))
+	}
+	// The kernel stores a partial pseudo-header sum at [cs+co:]; sum over the
+	// L4 region starting at cs, folding the prior partial in as the seed.
+	partial := uint32(binary.BigEndian.Uint16(seg[cs+co : cs+co+2]))
+	seg[cs+co] = 0
+	seg[cs+co+1] = 0
+	sum := checksumBytes(seg[cs:], partial)
+	binary.BigEndian.PutUint16(seg[cs+co:cs+co+2], checksumFold(sum))
+	return nil
+}
+
+// segmentTCP software-segments a TSO superpacket into one IP packet per MSS
+// chunk. The caller guarantees hdr.GSOType is TCPV4 or TCPV6.
+//
+// Hot-path shape: the per-segment loop only sums the payload chunk. The TCP
+// header, the IPv4 header, and the pseudo-header src/dst/proto contributions
+// are each summed once up front — every segment reuses those three pre-folded
+// uint32 values and combines them with small per-segment deltas (seq, flags,
+// tcpLen, ip_id, total_len) that are cheap to fold in.
+func segmentTCP(pkt []byte, hdr virtioNetHdr, out *[][]byte, scratch []byte) error {
+	if hdr.GSOSize == 0 {
+		return fmt.Errorf("gso_size is zero")
+	}
+	if int(hdr.HdrLen) > len(pkt) || hdr.HdrLen == 0 {
+		return fmt.Errorf("hdr_len %d out of range (pkt %d)", hdr.HdrLen, len(pkt))
+	}
+	if hdr.CsumStart == 0 || hdr.CsumStart >= hdr.HdrLen {
+		return fmt.Errorf("csum_start %d out of range (hdr_len %d)", hdr.CsumStart, hdr.HdrLen)
+	}
+
+	isV4 := hdr.GSOType == unix.VIRTIO_NET_HDR_GSO_TCPV4
+	headerLen := int(hdr.HdrLen)
+	csumStart := int(hdr.CsumStart)
+
+	if isV4 && csumStart < 20 {
+		return fmt.Errorf("csum_start %d too small for IPv4", csumStart)
+	}
+	if !isV4 && csumStart < 40 {
+		return fmt.Errorf("csum_start %d too small for IPv6", csumStart)
+	}
+	tcpHdrLen := headerLen - csumStart
+	if tcpHdrLen < 20 {
+		return fmt.Errorf("tcp header region too small: %d", tcpHdrLen)
+	}
+
+	payload := pkt[headerLen:]
+	payLen := len(payload)
+	gso := int(hdr.GSOSize)
+	numSeg := (payLen + gso - 1) / gso
+	if numSeg == 0 {
+		numSeg = 1
+	}
+
+	need := numSeg*headerLen + payLen
+	if need > len(scratch) {
+		return fmt.Errorf("scratch too small for %d segments: need %d have %d", numSeg, need, len(scratch))
+	}
+
+	origSeq := binary.BigEndian.Uint32(pkt[csumStart+4 : csumStart+8])
+	origFlags := pkt[csumStart+13]
+	const tcpFinPsh = 0x09 // FIN(0x01) | PSH(0x08)
+
+	// Precompute the TCP header sum with seq/flags/csum zeroed. The max TCP
+	// header is 60 bytes; copy onto the stack, zero the per-segment-varying
+	// fields, sum once.
+	var tmp [60]byte
+	copy(tmp[:tcpHdrLen], pkt[csumStart:headerLen])
+	tmp[4], tmp[5], tmp[6], tmp[7] = 0, 0, 0, 0 // seq
+	tmp[13] = 0                                 // flags
+	tmp[16], tmp[17] = 0, 0                     // csum
+	baseTcpHdrSum := checksumBytes(tmp[:tcpHdrLen], 0)
+
+	// Pseudo-header src+dst+proto contribution (tcpLen varies per segment).
+	var baseProtoSum uint32
+	if isV4 {
+		baseProtoSum = checksumBytes(pkt[12:16], 0)
+		baseProtoSum = checksumBytes(pkt[16:20], baseProtoSum)
+	} else {
+		baseProtoSum = checksumBytes(pkt[8:24], 0)
+		baseProtoSum = checksumBytes(pkt[24:40], baseProtoSum)
+	}
+	baseProtoSum += uint32(unix.IPPROTO_TCP)
+
+	// Precompute IPv4 header sum with total_len/id/csum zeroed.
+	var origIPID uint16
+	var ihl int
+	var baseIPHdrSum uint32
+	if isV4 {
+		origIPID = binary.BigEndian.Uint16(pkt[4:6])
+		ihl = int(pkt[0]&0x0f) * 4
+		if ihl < 20 || ihl > csumStart {
+			return fmt.Errorf("bad IPv4 IHL: %d", ihl)
+		}
+		var ipTmp [60]byte
+		copy(ipTmp[:ihl], pkt[:ihl])
+		ipTmp[2], ipTmp[3] = 0, 0   // total_len
+		ipTmp[4], ipTmp[5] = 0, 0   // id
+		ipTmp[10], ipTmp[11] = 0, 0 // checksum
+		baseIPHdrSum = checksumBytes(ipTmp[:ihl], 0)
+	}
+
+	off := 0
+	for i := 0; i < numSeg; i++ {
+		segStart := i * gso
+		segEnd := segStart + gso
+		if segEnd > payLen {
+			segEnd = payLen
+		}
+		segPayLen := segEnd - segStart
+
+		copy(scratch[off:], pkt[:headerLen])
+		copy(scratch[off+headerLen:], payload[segStart:segEnd])
+		seg := scratch[off : off+headerLen+segPayLen]
+		off += headerLen + segPayLen
+
+		segSeq := origSeq + uint32(segStart)
+		segFlags := origFlags
+		if i != numSeg-1 {
+			segFlags = origFlags &^ tcpFinPsh
+		}
+		totalLen := headerLen + segPayLen
+
+		// Patch IP header and write the v4 header checksum from the precomputed base.
+		if isV4 {
+			segID := origIPID + uint16(i)
+			binary.BigEndian.PutUint16(seg[2:4], uint16(totalLen))
+			binary.BigEndian.PutUint16(seg[4:6], segID)
+			ipSum := baseIPHdrSum + uint32(totalLen) + uint32(segID)
+			binary.BigEndian.PutUint16(seg[10:12], checksumFold(ipSum))
+		} else {
+			// IPv6 payload length excludes the 40-byte fixed header but
+			// includes any extension headers between [40:csumStart].
+			binary.BigEndian.PutUint16(seg[4:6], uint16(headerLen-40+segPayLen))
+		}
+
+		// Patch TCP header.
+		binary.BigEndian.PutUint32(seg[csumStart+4:csumStart+8], segSeq)
+		seg[csumStart+13] = segFlags
+		// (csum is written below; its prior contents in `seg` don't affect the
+		// computation since we never sum over the segment's own header.)
+
+		tcpLen := tcpHdrLen + segPayLen
+		paySum := checksumBytes(payload[segStart:segEnd], 0)
+
+		// Combine pre-folded uint32s into a wider accumulator, then fold. Using
+		// uint64 guards against overflow when segSeq's high bits set.
+		wide := uint64(baseTcpHdrSum) + uint64(paySum) + uint64(baseProtoSum)
+		wide += uint64(segSeq) + uint64(segFlags) + uint64(tcpLen)
+		wide = (wide & 0xffffffff) + (wide >> 32)
+		wide = (wide & 0xffffffff) + (wide >> 32)
+		binary.BigEndian.PutUint16(seg[csumStart+16:csumStart+18], checksumFold(uint32(wide)))
+
+		*out = append(*out, seg)
+	}
+
+	return nil
+}
+
+// checksumBytes returns the Internet-checksum partial sum of b, seeded with
+// initial. Result is a 32-bit accumulator; the caller folds to 16.
+//
+// Each 4-byte load is added directly into a 64-bit accumulator. Two parallel
+// accumulators break the serial dependency through `sum` and let the CPU
+// overlap independent adds. The final fold from 64 → 32 → 16 handles the
+// carries that accumulated across the 32-bit lane boundary.
+func checksumBytes(b []byte, initial uint32) uint32 {
+	s0 := uint64(initial)
+	var s1 uint64
+	for len(b) >= 32 {
+		s0 += uint64(binary.BigEndian.Uint32(b[0:4]))
+		s1 += uint64(binary.BigEndian.Uint32(b[4:8]))
+		s0 += uint64(binary.BigEndian.Uint32(b[8:12]))
+		s1 += uint64(binary.BigEndian.Uint32(b[12:16]))
+		s0 += uint64(binary.BigEndian.Uint32(b[16:20]))
+		s1 += uint64(binary.BigEndian.Uint32(b[20:24]))
+		s0 += uint64(binary.BigEndian.Uint32(b[24:28]))
+		s1 += uint64(binary.BigEndian.Uint32(b[28:32]))
+		b = b[32:]
+	}
+	sum := s0 + s1
+	for len(b) >= 4 {
+		sum += uint64(binary.BigEndian.Uint32(b[:4]))
+		b = b[4:]
+	}
+	if len(b) >= 2 {
+		sum += uint64(binary.BigEndian.Uint16(b[:2]))
+		b = b[2:]
+	}
+	if len(b) == 1 {
+		sum += uint64(b[0]) << 8
+	}
+	sum = (sum & 0xffffffff) + (sum >> 32)
+	sum = (sum & 0xffffffff) + (sum >> 32)
+	return uint32(sum)
+}
+
+func checksumFold(sum uint32) uint16 {
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}
+
+func pseudoHeaderIPv4(src, dst []byte, proto byte, tcpLen int) uint32 {
+	sum := checksumBytes(src, 0)
+	sum = checksumBytes(dst, sum)
+	sum += uint32(proto)
+	sum += uint32(tcpLen)
+	return sum
+}
+
+func pseudoHeaderIPv6(src, dst []byte, proto byte, tcpLen int) uint32 {
+	sum := checksumBytes(src, 0)
+	sum = checksumBytes(dst, sum)
+	sum += uint32(tcpLen >> 16)
+	sum += uint32(tcpLen & 0xffff)
+	sum += uint32(proto)
+	return sum
+}

overlay/tun_linux_offload_test.go

@@ -1,7 +1,7 @@
 //go:build linux && !android && !e2e_testing
 // +build linux,!android,!e2e_testing
 
-package tio
+package overlay
 
 import (
 	"encoding/binary"
@@ -9,18 +9,21 @@ import (
 	"testing"
 
 	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/tcpip/checksum"
 )
 
-// verifyChecksum confirms that the one's-complement sum across `b`, seeded
-// with a folded pseudo-header sum, equals all-ones (valid).
-func verifyChecksum(b []byte, pseudo uint16) bool {
-	return checksum.Checksum(b, pseudo) == 0xffff
+// verifyChecksum confirms that the one's-complement sum across `b`, optionally
+// seeded with a pseudo-header sum, folds to all-ones (valid).
+func verifyChecksum(b []byte, pseudo uint32) bool {
+	sum := checksumBytes(b, pseudo)
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return uint16(sum) == 0xffff
 }
 
 // buildTSOv4 builds a synthetic IPv4/TCP TSO superpacket with a payload of
 // `payLen` bytes split at `mss`.
-func buildTSOv4(t *testing.T, payLen, mss int) ([]byte, VirtioNetHdr) {
+func buildTSOv4(t *testing.T, payLen, mss int) ([]byte, virtioNetHdr) {
 	t.Helper()
 	const ipLen = 20
 	const tcpLen = 20
@@ -50,7 +53,7 @@ func buildTSOv4(t *testing.T, payLen, mss int) ([]byte, VirtioNetHdr) {
 		pkt[ipLen+tcpLen+i] = byte(i & 0xff)
 	}
 
-	return pkt, VirtioNetHdr{
+	return pkt, virtioNetHdr{
 		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
 		GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV4,
 		HdrLen:     uint16(ipLen + tcpLen),
@@ -171,7 +174,7 @@ func TestSegmentTCPv6(t *testing.T) {
 		pkt[ipLen+tcpLen+i] = byte(i)
 	}
 
-	hdr := VirtioNetHdr{
+	hdr := virtioNetHdr{
 		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
 		GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV6,
 		HdrLen:     uint16(ipLen + tcpLen),
@@ -237,7 +240,7 @@ func TestSegmentGSONonePassesThrough(t *testing.T) {
 }
 
 func TestSegmentRejectsUDP(t *testing.T) {
-	hdr := VirtioNetHdr{GSOType: unix.VIRTIO_NET_HDR_GSO_UDP}
+	hdr := virtioNetHdr{GSOType: unix.VIRTIO_NET_HDR_GSO_UDP}
 	var out [][]byte
 	if err := segmentInto(nil, hdr, &out, nil); err == nil {
 		t.Fatalf("expected rejection for UDP GSO")
@@ -276,7 +279,7 @@ func BenchmarkSegmentTCPv4(b *testing.B) {
 			for i := 0; i < sz.payLen; i++ {
 				pkt[ipLen+tcpLen+i] = byte(i)
 			}
-			hdr := VirtioNetHdr{
+			hdr := virtioNetHdr{
 				Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
 				GSOType:    unix.VIRTIO_NET_HDR_GSO_TCPV4,
 				HdrLen:     uint16(ipLen + tcpLen),
@@ -309,7 +312,7 @@ func TestTunFileWriteVnetHdrNoAlloc(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = unix.Close(fd) })
 
-	tf := &Offload{fd: fd}
+	tf := &tunFile{fd: fd, vnetHdr: true}
 	tf.writeIovs[0].Base = &validVnetHdr[0]
 	tf.writeIovs[0].SetLen(virtioNetHdrLen)
 

overlay/tun_linux_test.go

@@ -3,9 +3,7 @@
 
 package overlay
 
-import (
-	"testing"
-)
+import "testing"
 
 var runAdvMSSTests = []struct {
 	name     string

overlay/tun_netbsd.go

@@ -16,7 +16,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
@@ -413,7 +412,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for netbsd")
 }
 

overlay/tun_openbsd.go

@@ -16,7 +16,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
@@ -333,7 +332,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *tun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *tun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for openbsd")
 }
 

overlay/tun_tester.go

@@ -13,7 +13,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -143,6 +142,6 @@ func (t *TestTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *TestTun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *TestTun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented")
 }

overlay/tun_windows.go

@@ -17,7 +17,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	"github.com/slackhq/nebula/wintun"
@@ -256,7 +255,7 @@ func (t *winTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *winTun) NewMultiQueueReader() (tio.Queue, error) {
+func (t *winTun) NewMultiQueueReader() (Queue, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for windows")
 }
 

overlay/user.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -24,13 +23,11 @@ func NewUserDevice(vpnNetworks []netip.Prefix) (Device, error) {
 		outboundWriter: ow,
 		inboundReader:  ir,
 		inboundWriter:  iw,
-		numReaders:     1,
 	}, nil
 }
 
 type UserDevice struct {
 	vpnNetworks []netip.Prefix
-	numReaders  int
 
 	outboundReader *io.PipeReader
 	outboundWriter *io.PipeWriter
@@ -68,17 +65,8 @@ func (d *UserDevice) SupportsMultiqueue() bool {
 	return true
 }
 
-func (d *UserDevice) NewMultiQueueReader() error {
-	d.numReaders++
-	return nil
-}
-
-func (d *UserDevice) Readers() []tio.Queue {
-	out := make([]tio.Queue, d.numReaders)
-	for i := range d.numReaders {
-		out[i] = d
-	}
-	return out
+func (d *UserDevice) NewMultiQueueReader() (Queue, error) {
+	return d, nil
 }
 
 func (d *UserDevice) Pipe() (*io.PipeReader, *io.PipeWriter) {

tcp_coalesce.go

@@ -1,11 +1,11 @@
-package coalesce
+package nebula
 
 import (
 	"bytes"
 	"encoding/binary"
 	"io"
 
-	"github.com/slackhq/nebula/overlay/tio"
+	"github.com/slackhq/nebula/overlay"
 )
 
 // ipProtoTCP is the IANA protocol number for TCP. Hardcoded instead of
@@ -66,14 +66,14 @@ type coalesceSlot struct {
 	payIovs [][]byte
 }
 
-// TCPCoalescer accumulates adjacent in-flow TCP data segments across
+// tcpCoalescer accumulates adjacent in-flow TCP data segments across
 // multiple concurrent flows and emits each flow's run as a single TSO
-// superpacket via tio.GSOWriter. All output — coalesced or not — is
+// superpacket via overlay.GSOWriter. All output — coalesced or not — is
 // deferred until Flush so arrival order is preserved on the wire. Owns
 // no locks; one coalescer per TUN write queue.
-type TCPCoalescer struct {
+type tcpCoalescer struct {
 	plainW io.Writer
-	gsoW   tio.GSOWriter // nil when the queue doesn't support TSO
+	gsoW   overlay.GSOWriter // nil when the queue doesn't support TSO
 
 	// slots is the ordered event queue. Flush walks it once and emits each
 	// entry as either a WriteGSO (coalesced) or a plainW.Write (passthrough).
@@ -86,14 +86,14 @@ type TCPCoalescer struct {
 	pool      []*coalesceSlot // free list for reuse
 }
 
-func NewTCPCoalescer(w io.Writer) *TCPCoalescer {
-	c := &TCPCoalescer{
+func newTCPCoalescer(w io.Writer) *tcpCoalescer {
+	c := &tcpCoalescer{
 		plainW:    w,
 		slots:     make([]*coalesceSlot, 0, initialSlots),
 		openSlots: make(map[flowKey]*coalesceSlot, initialSlots),
 		pool:      make([]*coalesceSlot, 0, initialSlots),
 	}
-	if gw, ok := w.(tio.GSOWriter); ok && gw.GSOSupported() {
+	if gw, ok := w.(overlay.GSOWriter); ok && gw.GSOSupported() {
 		c.gsoW = gw
 	}
 	return c
@@ -197,7 +197,7 @@ func (p parsedTCP) coalesceable() bool {
 // Add borrows pkt. The caller must keep pkt valid until the next Flush,
 // whether or not the packet was coalesced — passthrough (non-admissible)
 // packets are queued and written at Flush time, not synchronously.
-func (c *TCPCoalescer) Add(pkt []byte) error {
+func (c *tcpCoalescer) Add(pkt []byte) error {
 	if c.gsoW == nil {
 		c.addPassthrough(pkt)
 		return nil
@@ -237,7 +237,7 @@ func (c *TCPCoalescer) Add(pkt []byte) error {
 // via WriteGSO; passthrough slots go out via plainW.Write. Returns the
 // first error observed; keeps draining so one bad packet doesn't hold up
 // the rest. After Flush returns, borrowed payload slices may be recycled.
-func (c *TCPCoalescer) Flush() error {
+func (c *tcpCoalescer) Flush() error {
 	var first error
 	for _, s := range c.slots {
 		var err error
@@ -261,14 +261,14 @@ func (c *TCPCoalescer) Flush() error {
 	return first
 }
 
-func (c *TCPCoalescer) addPassthrough(pkt []byte) {
+func (c *tcpCoalescer) addPassthrough(pkt []byte) {
 	s := c.take()
 	s.passthrough = true
 	s.rawPkt = pkt
 	c.slots = append(c.slots, s)
 }
 
-func (c *TCPCoalescer) seed(pkt []byte, info parsedTCP) {
+func (c *tcpCoalescer) seed(pkt []byte, info parsedTCP) {
 	if info.hdrLen > tcpCoalesceHdrCap || info.hdrLen+info.payLen > tcpCoalesceBufSize {
 		// Pathological shape — can't fit our scratch, emit as-is.
 		c.addPassthrough(pkt)
@@ -297,7 +297,7 @@ func (c *TCPCoalescer) seed(pkt []byte, info parsedTCP) {
 // canAppend reports whether info's packet extends the slot's seed: same
 // header shape and stable contents, adjacent seq, not oversized, chain not
 // closed.
-func (c *TCPCoalescer) canAppend(s *coalesceSlot, pkt []byte, info parsedTCP) bool {
+func (c *tcpCoalescer) canAppend(s *coalesceSlot, pkt []byte, info parsedTCP) bool {
 	if s.psh {
 		return false
 	}
@@ -322,7 +322,7 @@ func (c *TCPCoalescer) canAppend(s *coalesceSlot, pkt []byte, info parsedTCP) bo
 	return true
 }
 
-func (c *TCPCoalescer) appendPayload(s *coalesceSlot, pkt []byte, info parsedTCP) {
+func (c *tcpCoalescer) appendPayload(s *coalesceSlot, pkt []byte, info parsedTCP) {
 	s.payIovs = append(s.payIovs, pkt[info.hdrLen:info.hdrLen+info.payLen])
 	s.numSeg++
 	s.totalPay += info.payLen
@@ -332,7 +332,7 @@ func (c *TCPCoalescer) appendPayload(s *coalesceSlot, pkt []byte, info parsedTCP
 	}
 }
 
-func (c *TCPCoalescer) take() *coalesceSlot {
+func (c *tcpCoalescer) take() *coalesceSlot {
 	if n := len(c.pool); n > 0 {
 		s := c.pool[n-1]
 		c.pool[n-1] = nil
@@ -342,7 +342,7 @@ func (c *TCPCoalescer) take() *coalesceSlot {
 	return &coalesceSlot{}
 }
 
-func (c *TCPCoalescer) release(s *coalesceSlot) {
+func (c *tcpCoalescer) release(s *coalesceSlot) {
 	s.passthrough = false
 	s.rawPkt = nil
 	for i := range s.payIovs {
@@ -357,7 +357,7 @@ func (c *TCPCoalescer) release(s *coalesceSlot) {
 
 // flushSlot patches the header and calls WriteGSO. Does not remove the
 // slot from c.slots.
-func (c *TCPCoalescer) flushSlot(s *coalesceSlot) error {
+func (c *tcpCoalescer) flushSlot(s *coalesceSlot) error {
 	total := s.hdrLen + s.totalPay
 	l4Len := total - s.ipHdrLen
 	hdr := s.hdrBuf[:s.hdrLen]

tcp_coalesce_test.go

@@ -1,4 +1,4 @@
-package coalesce
+package nebula
 
 import (
 	"encoding/binary"
@@ -114,7 +114,7 @@ const (
 
 func TestCoalescerPassthroughWhenGSOUnavailable(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: false}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pkt := buildTCPv4(1000, tcpAck, []byte("hello"))
 	if err := c.Add(pkt); err != nil {
 		t.Fatal(err)
@@ -133,7 +133,7 @@ func TestCoalescerPassthroughWhenGSOUnavailable(t *testing.T) {
 
 func TestCoalescerNonTCPPassthrough(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pkt := make([]byte, 28)
 	pkt[0] = 0x45
 	binary.BigEndian.PutUint16(pkt[2:4], 28)
@@ -153,7 +153,7 @@ func TestCoalescerNonTCPPassthrough(t *testing.T) {
 
 func TestCoalescerSeedThenFlushAlone(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pkt := buildTCPv4(1000, tcpAck, make([]byte, 1000))
 	if err := c.Add(pkt); err != nil {
 		t.Fatal(err)
@@ -180,7 +180,7 @@ func TestCoalescerSeedThenFlushAlone(t *testing.T) {
 
 func TestCoalescerCoalescesAdjacentACKs(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
 		t.Fatal(err)
@@ -220,7 +220,7 @@ func TestCoalescerCoalescesAdjacentACKs(t *testing.T) {
 
 func TestCoalescerRejectsSeqGap(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
 		t.Fatal(err)
@@ -239,7 +239,7 @@ func TestCoalescerRejectsSeqGap(t *testing.T) {
 
 func TestCoalescerRejectsFlagMismatch(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
 		t.Fatal(err)
@@ -260,7 +260,7 @@ func TestCoalescerRejectsFlagMismatch(t *testing.T) {
 
 func TestCoalescerRejectsFIN(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	fin := buildTCPv4(1000, tcpAck|tcpFin, []byte("x"))
 	if err := c.Add(fin); err != nil {
 		t.Fatal(err)
@@ -276,7 +276,7 @@ func TestCoalescerRejectsFIN(t *testing.T) {
 
 func TestCoalescerShortLastSegmentClosesChain(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	full := make([]byte, 1200)
 	half := make([]byte, 500)
 	if err := c.Add(buildTCPv4(1000, tcpAck, full)); err != nil {
@@ -311,7 +311,7 @@ func TestCoalescerShortLastSegmentClosesChain(t *testing.T) {
 
 func TestCoalescerPSHFinalizesChain(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 	if err := c.Add(buildTCPv4(1000, tcpAck, pay)); err != nil {
 		t.Fatal(err)
@@ -336,7 +336,7 @@ func TestCoalescerPSHFinalizesChain(t *testing.T) {
 
 func TestCoalescerRejectsDifferentFlow(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 	p1 := buildTCPv4(1000, tcpAck, pay)
 	p2 := buildTCPv4(2200, tcpAck, pay)
@@ -358,7 +358,7 @@ func TestCoalescerRejectsDifferentFlow(t *testing.T) {
 
 func TestCoalescerRejectsIPOptions(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 500)
 	pkt := buildTCPv4(1000, tcpAck, pay)
 	// Bump IHL to 6 to simulate 4 bytes of IP options. Don't actually add
@@ -378,7 +378,7 @@ func TestCoalescerRejectsIPOptions(t *testing.T) {
 
 func TestCoalescerCapBySegments(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 512)
 	seq := uint32(1000)
 	for i := 0; i < tcpCoalesceMaxSegs+5; i++ {
@@ -402,7 +402,7 @@ func TestCoalescerCapBySegments(t *testing.T) {
 // flows coalesce independently in a single Flush.
 func TestCoalescerMultipleFlowsInSameBatch(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 
 	// Flow A: sport 1000. Flow B: sport 3000.
@@ -459,7 +459,7 @@ func TestCoalescerMultipleFlowsInSameBatch(t *testing.T) {
 // writing passthrough packets synchronously.
 func TestCoalescerPreservesArrivalOrder(t *testing.T) {
 	w := &orderedFakeWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	// Sequence: coalesceable TCP, ICMP (passthrough), coalesceable TCP on
 	// a different flow. Expected emit order: gso(X), plain(ICMP), gso(Y).
 	pay := make([]byte, 1200)
@@ -525,7 +525,7 @@ func stringSliceEq(a, b []string) bool {
 // packet (SYN) mid-flow only flushes its own flow, not others.
 func TestCoalescerInterleavedFlowsPreserveOrdering(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
-	c := NewTCPCoalescer(w)
+	c := newTCPCoalescer(w)
 	pay := make([]byte, 1200)
 
 	// Flow A two segments.

udp/conn.go

@@ -35,6 +35,16 @@ type Conn interface {
 	// WriteTo loop. Returns on the first error; callers may observe a
 	// partial send if some packets went out before the error.
 	WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error
+	// WriteSegmented sends bufs as a single UDP GSO sendmsg when the kernel
+	// supports it: all bufs go to the same addr, each must be exactly segSize
+	// bytes except the last which may be shorter. The kernel emits one
+	// datagram per buf on the wire. Backends / kernels without GSO support
+	// fall back to a per-packet WriteTo loop. Returns on the first error.
+	WriteSegmented(bufs [][]byte, addr netip.AddrPort, segSize int) error
+	// SupportsGSO reports whether WriteSegmented takes the single-syscall
+	// GSO path. Callers use this to decide at batch-assembly time whether
+	// the uniform-size / same-dst check is worth running.
+	SupportsGSO() bool
 	ReloadConfig(c *config.C)
 	SupportsMultipleReaders() bool
 	Close() error
@@ -60,6 +70,12 @@ func (NoopConn) WriteTo(_ []byte, _ netip.AddrPort) error {
 func (NoopConn) WriteBatch(_ [][]byte, _ []netip.AddrPort) error {
 	return nil
 }
+func (NoopConn) WriteSegmented(_ [][]byte, _ netip.AddrPort, _ int) error {
+	return nil
+}
+func (NoopConn) SupportsGSO() bool {
+	return false
+}
 func (NoopConn) ReloadConfig(_ *config.C) {
 	return
 }

udp/udp_generic.go

@@ -10,11 +10,9 @@ package udp
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net"
 	"net/netip"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
@@ -96,21 +94,11 @@ type rawMessage struct {
 func (u *GenericConn) ListenOut(r EncReader, flush func()) error {
 	buffer := make([]byte, MTU)
 
-	var lastRecvErr time.Time
-
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.ReadFromUDPAddrPort(buffer)
 		if err != nil {
-			if errors.Is(err, net.ErrClosed) {
-				return err
-			}
-			// Dampen unexpected message warns to once per minute
-			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
-				lastRecvErr = time.Now()
-				u.l.WithError(err).Warn("unexpected udp socket receive error")
-			}
-			continue
+			return err
 		}
 
 		r(netip.AddrPortFrom(rua.Addr().Unmap(), rua.Port()), buffer[:n])

udp/udp_linux.go

@@ -32,17 +32,6 @@ type StdConn struct {
 	writeIovs  []iovec
 	writeNames [][]byte
 
-	// Per-entry UDP_SEGMENT cmsg scratch. writeCmsg is one contiguous slab
-	// of MaxWriteBatch * writeCmsgSpace bytes; each entry's cmsg header is
-	// pre-filled once in prepareWriteMessages. WriteBatch only rewrites the
-	// 2-byte gso_size payload (and toggles Hdr.Control on/off) per call.
-	writeCmsg      []byte
-	writeCmsgSpace int
-
-	// writeEntryEnd[e] is the bufs index *after* the last packet packed
-	// into mmsghdr entry e. Used to rewind `i` on partial sendmmsg success.
-	writeEntryEnd []int
-
 	// Preallocated closure + in/out slots for sendmmsg, so the hot path
 	// does not heap-allocate a fresh closure per call.
 	writeChunk int
@@ -54,13 +43,13 @@ type StdConn struct {
 	// probed once at socket creation. When true, WriteSegmented takes a
 	// single-syscall GSO path; otherwise it falls back to a WriteTo loop.
 	gsoSupported bool
-
-	// UDP GRO (recvmsg with UDP_GRO cmsg) support. groSupported is probed
-	// once at socket creation. When true, listenOutBatch allocates larger
-	// RX buffers and a per-entry cmsg slot so the kernel can coalesce
-	// consecutive same-flow datagrams into a single recvmmsg entry; the
-	// delivered cmsg carries the gso_size used to split them back apart.
-	groSupported bool
+	gsoMsg       msghdr
+	gsoIovs      []iovec
+	gsoName      []byte // SizeofSockaddrInet6
+	gsoCmsg      []byte // CmsgSpace(2)
+	gsoSent      int
+	gsoErrno     syscall.Errno
+	gsoFunc      func(fd uintptr) bool
 }
 
 func setReusePort(network, address string, c syscall.RawConn) error {
@@ -111,44 +100,10 @@ func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch in
 	out.writeFunc = out.sendmmsgRawWrite
 
 	out.prepareGSO()
-	// GRO delivers coalesced superpackets that need a cmsg to split back
-	// into segments. The single-packet RX path uses ReadFromUDPAddrPort
-	// and cannot see that cmsg, so only enable GRO for the batch path.
-	if batch > 1 {
-		out.prepareGRO()
-	}
 
 	return out, nil
 }
 
-// prepareWriteMessages allocates one mmsghdr/iovec/sockaddr/cmsg scratch
-// slot per sendmmsg entry. The iovec slab is sized to the same n so a
-// single entry can fan out to up to n iovecs (needed for UDP_SEGMENT runs
-// that coalesce consecutive bufs into one entry). Hdr.Iov / Hdr.Iovlen /
-// Hdr.Control / Hdr.Controllen are wired per call since each entry can
-// span a variable number of iovecs and may or may not carry a cmsg.
-func (u *StdConn) prepareWriteMessages(n int) {
-	u.writeMsgs = make([]rawMessage, n)
-	u.writeIovs = make([]iovec, n)
-	u.writeNames = make([][]byte, n)
-	u.writeEntryEnd = make([]int, n)
-
-	u.writeCmsgSpace = unix.CmsgSpace(2)
-	u.writeCmsg = make([]byte, n*u.writeCmsgSpace)
-	for k := 0; k < n; k++ {
-		off := k * u.writeCmsgSpace
-		h := (*unix.Cmsghdr)(unsafe.Pointer(&u.writeCmsg[off]))
-		h.Level = unix.SOL_UDP
-		h.Type = unix.UDP_SEGMENT
-		setCmsgLen(h, unix.CmsgLen(2))
-	}
-
-	for i := range u.writeMsgs {
-		u.writeNames[i] = make([]byte, unix.SizeofSockaddrInet6)
-		u.writeMsgs[i].Hdr.Name = &u.writeNames[i][0]
-	}
-}
-
 // maxGSOSegments caps the per-sendmsg GSO fan-out. Linux kernels have
 // historically capped UDP_MAX_SEGMENTS at 64; newer kernels raise it to 128
 // but we stay conservative so the same code works everywhere.
@@ -161,7 +116,9 @@ const maxGSOSegments = 64
 // fits, avoiding EMSGSIZE on large TSO superpackets.
 const maxGSOBytes = 65535
 
-// prepareGSO probes UDP_SEGMENT support
+// prepareGSO probes UDP_SEGMENT support and, on success, sets up the
+// reusable sendmsg scratch (iovecs, sockaddr, cmsg) plus the preallocated
+// raw-write closure used to avoid heap allocations on the hot path.
 func (u *StdConn) prepareGSO() {
 	var probeErr error
 	if err := u.rawConn.Control(func(fd uintptr) {
@@ -173,34 +130,25 @@ func (u *StdConn) prepareGSO() {
 		return
 	}
 	u.gsoSupported = true
-}
+	u.gsoIovs = make([]iovec, maxGSOSegments)
+	u.gsoName = make([]byte, unix.SizeofSockaddrInet6)
+	u.gsoCmsg = make([]byte, unix.CmsgSpace(2))
 
-// udpGROBufferSize sizes the per-entry recvmmsg buffer when UDP_GRO is on.
-// The kernel stitches a run of same-flow datagrams into a single skb whose
-// length is bounded by sk_gso_max_size (typically 65535); anything larger
-// would be MSG_TRUNCed. We use the maximum representable UDP length so a
-// full superpacket always lands intact.
-const udpGROBufferSize = 65535
+	// Wire up the static pieces of gsoMsg. Iovlen / Controllen / Namelen /
+	// cmsg contents get refreshed per call; Iov, Name, Control pointers are
+	// fixed because the scratch slices never move.
+	u.gsoMsg.Iov = &u.gsoIovs[0]
+	u.gsoMsg.Name = &u.gsoName[0]
+	u.gsoMsg.Control = &u.gsoCmsg[0]
 
-// udpGROCmsgPayload is the size of the UDP_GRO cmsg data delivered by the
-// kernel: a single int (gso_size in bytes). See udp_cmsg_recv() in
-// net/ipv4/udp.c.
-const udpGROCmsgPayload = 4
+	// Prepopulate the cmsg header. Len/Level/Type are constant for our use;
+	// only the 2-byte gso_size payload changes per call.
+	cmsghdr := (*unix.Cmsghdr)(unsafe.Pointer(&u.gsoCmsg[0]))
+	cmsghdr.Level = unix.SOL_UDP
+	cmsghdr.Type = unix.UDP_SEGMENT
+	setCmsgLen(cmsghdr, unix.CmsgLen(2))
 
-// prepareGRO turns on UDP_GRO so the kernel coalesces consecutive same-flow
-// datagrams into one recvmmsg entry, with a cmsg carrying the gso_size used
-// to split them back apart on the application side.
-func (u *StdConn) prepareGRO() {
-	var probeErr error
-	if err := u.rawConn.Control(func(fd uintptr) {
-		probeErr = unix.SetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_GRO, 1)
-	}); err != nil {
-		return
-	}
-	if probeErr != nil {
-		return
-	}
-	u.groSupported = true
+	u.gsoFunc = u.sendmsgRawWriteGSO
 }
 
 func (u *StdConn) SupportsMultipleReaders() bool {
@@ -323,13 +271,7 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 	var n int
 	var operr error
 
-	bufSize := MTU
-	cmsgSpace := 0
-	if u.groSupported {
-		bufSize = udpGROBufferSize
-		cmsgSpace = unix.CmsgSpace(udpGROCmsgPayload)
-	}
-	msgs, buffers, names, _ := u.PrepareRawMessages(u.batch, bufSize, cmsgSpace)
+	msgs, buffers, names := u.PrepareRawMessages(u.batch)
 
 	//reader needs to capture variables from this function, since it's used as a lambda with rawConn.Read
 	//defining it outside the loop so it gets re-used
@@ -339,11 +281,6 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 	}
 
 	for {
-		if cmsgSpace > 0 {
-			for i := range msgs {
-				setMsgControllen(&msgs[i].Hdr, cmsgSpace)
-			}
-		}
 		err := u.rawConn.Read(reader)
 		if err != nil {
 			return err
@@ -359,28 +296,7 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 			} else {
 				ip, _ = netip.AddrFromSlice(names[i][8:24])
 			}
-			from := netip.AddrPortFrom(ip.Unmap(), binary.BigEndian.Uint16(names[i][2:4]))
-			payload := buffers[i][:msgs[i].Len]
-
-			segSize := 0
-			if u.groSupported {
-				segSize = parseUDPGRO(&msgs[i].Hdr)
-			}
-			if segSize <= 0 || segSize >= len(payload) {
-				// No coalescing happened (or a lone datagram).
-				r(from, payload)
-				continue
-			}
-			// GRO superpacket: the kernel guarantees every segment is
-			// exactly segSize bytes except for the final one, which may be
-			// short.
-			for off := 0; off < len(payload); off += segSize {
-				end := off + segSize
-				if end > len(payload) {
-					end = len(payload)
-				}
-				r(from, payload[off:end])
-			}
+			r(netip.AddrPortFrom(ip.Unmap(), binary.BigEndian.Uint16(names[i][2:4])), buffers[i][:msgs[i].Len])
 		}
 		// End-of-batch: let callers (e.g. TUN write coalescer) flush any
 		// state they accumulated across this batch.
@@ -388,38 +304,6 @@ func (u *StdConn) listenOutBatch(r EncReader, flush func()) error {
 	}
 }
 
-// parseUDPGRO walks the control buffer on hdr looking for a SOL_UDP/UDP_GRO
-// cmsg and returns the gso_size (bytes per coalesced segment) it carries.
-// Returns 0 when no UDP_GRO cmsg is present, which is the normal case for
-// lone datagrams that the kernel did not coalesce.
-func parseUDPGRO(hdr *msghdr) int {
-	controllen := int(hdr.Controllen)
-	if controllen < unix.SizeofCmsghdr || hdr.Control == nil {
-		return 0
-	}
-	ctrl := unsafe.Slice(hdr.Control, controllen)
-	off := 0
-	for off+unix.SizeofCmsghdr <= len(ctrl) {
-		ch := (*unix.Cmsghdr)(unsafe.Pointer(&ctrl[off]))
-		clen := int(ch.Len)
-		if clen < unix.SizeofCmsghdr || off+clen > len(ctrl) {
-			return 0
-		}
-		if ch.Level == unix.SOL_UDP && ch.Type == unix.UDP_GRO {
-			dataOff := off + unix.CmsgLen(0)
-			if dataOff+udpGROCmsgPayload <= len(ctrl) {
-				return int(int32(binary.NativeEndian.Uint32(ctrl[dataOff : dataOff+udpGROCmsgPayload])))
-			}
-			return 0
-		}
-		// Advance by the aligned cmsg space. CmsgSpace(n) is the stride
-		// from one header to the next (len aligned up to the platform's
-		// cmsg alignment).
-		off += unix.CmsgSpace(clen - unix.CmsgLen(0))
-	}
-	return 0
-}
-
 func (u *StdConn) ListenOut(r EncReader, flush func()) error {
 	if u.batch == 1 {
 		return u.listenOutSingle(r, flush)
@@ -434,143 +318,62 @@ func (u *StdConn) WriteTo(b []byte, ip netip.AddrPort) error {
 }
 
 // WriteBatch sends bufs via sendmmsg(2) using the preallocated scratch on
-// StdConn. Consecutive packets to the same destination with matching segment
-// sizes (all but possibly the last) are coalesced into a single mmsghdr entry
-// carrying a UDP_SEGMENT cmsg, so one syscall can mix runs of GSO superpackets
-// with plain one-off datagrams. Without GSO support every packet is its own
-// entry, matching the prior behaviour.
-//
-// Chunks larger than the scratch are processed across multiple syscalls. If
-// sendmmsg returns a fatal error before any entry is sent we fall back to
-// per-packet WriteTo for that chunk so the caller still gets best-effort
-// delivery.
+// StdConn. Chunks larger than the scratch are processed in multiple syscalls.
+// If sendmmsg returns a fatal error mid-chunk we fall back to single WriteTo
+// calls for the remainder so the caller still gets best-effort delivery.
 func (u *StdConn) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) error {
 	if len(bufs) != len(addrs) {
 		return fmt.Errorf("WriteBatch: len(bufs)=%d != len(addrs)=%d", len(bufs), len(addrs))
 	}
-
+	//u.l.WithField("bufs", len(bufs)).Info("WriteBatch")
 	i := 0
 	for i < len(bufs) {
-		baseI := i
-		entry := 0
-		iovIdx := 0
+		chunk := len(bufs) - i
+		if chunk > len(u.writeMsgs) {
+			chunk = len(u.writeMsgs)
+		}
 
-		for entry < len(u.writeMsgs) && i < len(bufs) {
-			iovBudget := len(u.writeIovs) - iovIdx
-			if iovBudget < 1 {
-				break
+		for k := 0; k < chunk; k++ {
+			b := bufs[i+k]
+			if len(b) == 0 {
+				// sendmmsg with an empty iovec is legal but pointless; fall
+				// through after filling the slot so Base is still valid.
+				u.writeIovs[k].Base = nil
+				setIovLen(&u.writeIovs[k], 0)
+			} else {
+				u.writeIovs[k].Base = &b[0]
+				setIovLen(&u.writeIovs[k], len(b))
 			}
-			runLen, segSize := u.planRun(bufs, addrs, i, iovBudget)
-			if runLen == 0 {
-				break
-			}
-
-			for k := 0; k < runLen; k++ {
-				b := bufs[i+k]
-				if len(b) == 0 {
-					u.writeIovs[iovIdx+k].Base = nil
-					setIovLen(&u.writeIovs[iovIdx+k], 0)
-				} else {
-					u.writeIovs[iovIdx+k].Base = &b[0]
-					setIovLen(&u.writeIovs[iovIdx+k], len(b))
-				}
-			}
-
-			nlen, err := writeSockaddr(u.writeNames[entry], addrs[i], u.isV4)
+			nlen, err := writeSockaddr(u.writeNames[k], addrs[i+k], u.isV4)
 			if err != nil {
 				return err
 			}
-
-			hdr := &u.writeMsgs[entry].Hdr
-			hdr.Iov = &u.writeIovs[iovIdx]
-			setMsgIovlen(hdr, runLen)
-			hdr.Namelen = uint32(nlen)
-
-			if runLen >= 2 {
-				off := entry * u.writeCmsgSpace
-				dataOff := off + unix.CmsgLen(0)
-				binary.NativeEndian.PutUint16(u.writeCmsg[dataOff:dataOff+2], uint16(segSize))
-				hdr.Control = &u.writeCmsg[off]
-				setMsgControllen(hdr, u.writeCmsgSpace)
-			} else {
-				hdr.Control = nil
-				setMsgControllen(hdr, 0)
-			}
-
-			i += runLen
-			iovIdx += runLen
-			u.writeEntryEnd[entry] = i
-			entry++
+			u.writeMsgs[k].Hdr.Namelen = uint32(nlen)
 		}
 
-		if entry == 0 {
-			return fmt.Errorf("sendmmsg: no progress")
-		}
-
-		sent, serr := u.sendmmsg(entry)
-		if serr != nil && sent <= 0 {
-			// Nothing went out for this chunk; fall back to WriteTo for each
-			// packet that was queued this iteration.
-			for k := baseI; k < i; k++ {
-				if werr := u.WriteTo(bufs[k], addrs[k]); werr != nil {
-					return werr
+		sent, serr := u.sendmmsg(chunk)
+		if serr != nil {
+			if sent <= 0 {
+				// nothing went out; fall back to WriteTo for this chunk.
+				for k := 0; k < chunk; k++ {
+					if err := u.WriteTo(bufs[i+k], addrs[i+k]); err != nil {
+						return err
+					}
 				}
+				i += chunk
+				continue
 			}
-			continue
+			// partial: treat as success for the sent packets and retry the
+			// remainder on the next outer-loop iteration.
 		}
 		if sent == 0 {
 			return fmt.Errorf("sendmmsg made no progress")
 		}
-		// Rewind i to the end of the last successfully sent entry. For a
-		// full-success send this leaves i unchanged; for a partial send it
-		// replays the remainder on the next outer-loop iteration.
-		i = u.writeEntryEnd[sent-1]
+		i += sent
 	}
 	return nil
 }
 
-// planRun groups consecutive packets starting at `start` that can be sent as
-// a single UDP GSO superpacket (one sendmmsg entry with UDP_SEGMENT cmsg).
-// A run of length 1 means the entry carries no cmsg and the kernel treats
-// it as a plain datagram. Returns the run length and the per-segment size
-// (which equals len(bufs[start])). Without GSO support every call returns
-// runLen=1.
-func (u *StdConn) planRun(bufs [][]byte, addrs []netip.AddrPort, start, iovBudget int) (int, int) {
-	if start >= len(bufs) || iovBudget < 1 {
-		return 0, 0
-	}
-	segSize := len(bufs[start])
-	if !u.gsoSupported || segSize == 0 || segSize > maxGSOBytes {
-		return 1, segSize
-	}
-	dst := addrs[start]
-	maxLen := maxGSOSegments
-	if iovBudget < maxLen {
-		maxLen = iovBudget
-	}
-	runLen := 1
-	total := segSize
-	for runLen < maxLen && start+runLen < len(bufs) {
-		nextLen := len(bufs[start+runLen])
-		if nextLen == 0 || nextLen > segSize {
-			break
-		}
-		if addrs[start+runLen] != dst {
-			break
-		}
-		if total+nextLen > maxGSOBytes {
-			break
-		}
-		total += nextLen
-		runLen++
-		if nextLen < segSize {
-			// A short packet must be the last in the run.
-			break
-		}
-	}
-	return runLen, segSize
-}
-
 // sendmmsgRawWrite is the preallocated callback passed to rawConn.Write. It
 // reads its input (u.writeChunk) and writes its outputs (u.writeSent,
 // u.writeErrno) through StdConn fields so the closure itself does not
@@ -593,6 +396,115 @@ func (u *StdConn) sendmmsgRawWrite(fd uintptr) bool {
 	return true
 }
 
+func (u *StdConn) SupportsGSO() bool {
+	return u.gsoSupported
+}
+
+// WriteSegmented sends bufs to addr as a UDP GSO superpacket. The kernel
+// emits one datagram per iovec on the wire; all iovecs except the last must
+// be exactly segSize bytes. Non-GSO kernels hit the WriteTo fallback.
+// Called with len(bufs) >= 1. len(bufs) > maxGSOSegments is chunked.
+func (u *StdConn) WriteSegmented(bufs [][]byte, addr netip.AddrPort, segSize int) error {
+	if len(bufs) == 0 {
+		return nil
+	}
+	if !u.gsoSupported {
+		for _, b := range bufs {
+			if err := u.WriteTo(b, addr); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	nlen, err := writeSockaddr(u.gsoName, addr, u.isV4)
+	if err != nil {
+		return err
+	}
+	u.gsoMsg.Namelen = uint32(nlen)
+	setMsgControllen(&u.gsoMsg, unix.CmsgSpace(2))
+
+	// Cap the per-syscall fan-out by both segment count and total bytes.
+	// Kernel rejects sendmsg with EMSGSIZE when segCount*segSize would
+	// exceed sk_gso_max_size (typically 65536). For segSize > maxGSOBytes
+	// we can't use GSO at all and must fall back per-packet.
+	segsByBytes := maxGSOBytes / segSize
+	if segsByBytes == 0 {
+		for _, b := range bufs {
+			if werr := u.WriteTo(b, addr); werr != nil {
+				return werr
+			}
+		}
+		return nil
+	}
+	maxChunk := maxGSOSegments
+	if segsByBytes < maxChunk {
+		maxChunk = segsByBytes
+	}
+
+	i := 0
+	for i < len(bufs) {
+		chunk := len(bufs) - i
+		if chunk > maxChunk {
+			chunk = maxChunk
+		}
+		for k := 0; k < chunk; k++ {
+			b := bufs[i+k]
+			if len(b) == 0 {
+				u.gsoIovs[k].Base = nil
+				setIovLen(&u.gsoIovs[k], 0)
+			} else {
+				u.gsoIovs[k].Base = &b[0]
+				setIovLen(&u.gsoIovs[k], len(b))
+			}
+		}
+		setMsgIovlen(&u.gsoMsg, chunk)
+		binary.NativeEndian.PutUint16(u.gsoCmsg[unix.CmsgLen(0):unix.CmsgLen(0)+2], uint16(segSize))
+
+		if serr := u.sendmsgGSO(); serr != nil {
+			// Fall back to a per-packet loop for the remainder of the
+			// batch. Dropping the GSO call entirely is safer than
+			// returning mid-superpacket and losing bytes.
+			for k := 0; k < chunk; k++ {
+				if werr := u.WriteTo(bufs[i+k], addr); werr != nil {
+					return werr
+				}
+			}
+		}
+		i += chunk
+	}
+	return nil
+}
+
+// sendmsgRawWriteGSO is the preallocated rawConn.Write callback for the GSO
+// path. Reads the prebuilt u.gsoMsg and writes u.gsoSent / u.gsoErrno.
+func (u *StdConn) sendmsgRawWriteGSO(fd uintptr) bool {
+	r1, _, errno := unix.Syscall(
+		unix.SYS_SENDMSG,
+		fd,
+		uintptr(unsafe.Pointer(&u.gsoMsg)),
+		0,
+	)
+	if errno == syscall.EAGAIN || errno == syscall.EWOULDBLOCK {
+		return false
+	}
+	u.gsoSent = int(r1)
+	u.gsoErrno = errno
+	return true
+}
+
+func (u *StdConn) sendmsgGSO() error {
+	u.gsoSent = 0
+	u.gsoErrno = 0
+	if err := u.rawConn.Write(u.gsoFunc); err != nil {
+		return err
+	}
+	if u.gsoErrno != 0 {
+		return &net.OpError{Op: "sendmsg", Err: u.gsoErrno}
+	}
+	return nil
+}
+
 func (u *StdConn) sendmmsg(n int) (int, error) {
 	u.writeChunk = n
 	u.writeSent = 0

udp/udp_linux_32.go

@@ -30,18 +30,13 @@ type rawMessage struct {
 	Len uint32
 }
 
-func (u *StdConn) PrepareRawMessages(n, bufSize, cmsgSpace int) ([]rawMessage, [][]byte, [][]byte, []byte) {
+func (u *StdConn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
 	msgs := make([]rawMessage, n)
 	buffers := make([][]byte, n)
 	names := make([][]byte, n)
 
-	var cmsgs []byte
-	if cmsgSpace > 0 {
-		cmsgs = make([]byte, n*cmsgSpace)
-	}
-
 	for i := range msgs {
-		buffers[i] = make([]byte, bufSize)
+		buffers[i] = make([]byte, MTU)
 		names[i] = make([]byte, unix.SizeofSockaddrInet6)
 
 		vs := []iovec{
@@ -53,14 +48,25 @@ func (u *StdConn) PrepareRawMessages(n, bufSize, cmsgSpace int) ([]rawMessage, [
 
 		msgs[i].Hdr.Name = &names[i][0]
 		msgs[i].Hdr.Namelen = uint32(len(names[i]))
-
-		if cmsgSpace > 0 {
-			msgs[i].Hdr.Control = &cmsgs[i*cmsgSpace]
-			msgs[i].Hdr.Controllen = uint32(cmsgSpace)
-		}
 	}
 
-	return msgs, buffers, names, cmsgs
+	return msgs, buffers, names
+}
+
+// prepareWriteMessages allocates one Mmsghdr/iovec/sockaddr scratch per slot,
+// wired up so each writeMsgs[i] already points at writeIovs[i] and
+// writeNames[i]. Callers fill in the iovec Base/Len, the sockaddr bytes, and
+// Namelen before each sendmmsg.
+func (u *StdConn) prepareWriteMessages(n int) {
+	u.writeMsgs = make([]rawMessage, n)
+	u.writeIovs = make([]iovec, n)
+	u.writeNames = make([][]byte, n)
+	for i := range u.writeMsgs {
+		u.writeNames[i] = make([]byte, unix.SizeofSockaddrInet6)
+		u.writeMsgs[i].Hdr.Iov = &u.writeIovs[i]
+		u.writeMsgs[i].Hdr.Iovlen = 1
+		u.writeMsgs[i].Hdr.Name = &u.writeNames[i][0]
+	}
 }
 
 func setIovLen(v *iovec, n int) {

udp/udp_linux_64.go

@@ -33,18 +33,13 @@ type rawMessage struct {
 	Pad0 [4]byte
 }
 
-func (u *StdConn) PrepareRawMessages(n, bufSize, cmsgSpace int) ([]rawMessage, [][]byte, [][]byte, []byte) {
+func (u *StdConn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
 	msgs := make([]rawMessage, n)
 	buffers := make([][]byte, n)
 	names := make([][]byte, n)
 
-	var cmsgs []byte
-	if cmsgSpace > 0 {
-		cmsgs = make([]byte, n*cmsgSpace)
-	}
-
 	for i := range msgs {
-		buffers[i] = make([]byte, bufSize)
+		buffers[i] = make([]byte, MTU)
 		names[i] = make([]byte, unix.SizeofSockaddrInet6)
 
 		vs := []iovec{
@@ -56,14 +51,25 @@ func (u *StdConn) PrepareRawMessages(n, bufSize, cmsgSpace int) ([]rawMessage, [
 
 		msgs[i].Hdr.Name = &names[i][0]
 		msgs[i].Hdr.Namelen = uint32(len(names[i]))
-
-		if cmsgSpace > 0 {
-			msgs[i].Hdr.Control = &cmsgs[i*cmsgSpace]
-			msgs[i].Hdr.Controllen = uint64(cmsgSpace)
-		}
 	}
 
-	return msgs, buffers, names, cmsgs
+	return msgs, buffers, names
+}
+
+// prepareWriteMessages allocates one Mmsghdr/iovec/sockaddr scratch per slot,
+// wired up so each writeMsgs[i] already points at writeIovs[i] and
+// writeNames[i]. Callers fill in the iovec Base/Len, the sockaddr bytes, and
+// Namelen before each sendmmsg.
+func (u *StdConn) prepareWriteMessages(n int) {
+	u.writeMsgs = make([]rawMessage, n)
+	u.writeIovs = make([]iovec, n)
+	u.writeNames = make([][]byte, n)
+	for i := range u.writeMsgs {
+		u.writeNames[i] = make([]byte, unix.SizeofSockaddrInet6)
+		u.writeMsgs[i].Hdr.Iov = &u.writeIovs[i]
+		u.writeMsgs[i].Hdr.Iovlen = 1
+		u.writeMsgs[i].Hdr.Name = &u.writeNames[i][0]
+	}
 }
 
 func setIovLen(v *iovec, n int) {