windows: Fix NLMTU for ipv6 (#1871)

Copy the v1.11.1 CHANGELOG updates from release-v1.11

.github/workflows/smoke/smoke-windows.ps1

@@ -51,15 +51,19 @@ wsl -d $Distro -- bash -c "rm -rf $WslDir && mkdir -p $WslDir" | Out-Null
 $DevName = 'nebula-smoke'
 $Ip1 = '192.168.241.1'
 $Ip2 = '192.168.241.2'
+# Dual stack on purpose: a v4-only overlay never exercises the v6 side of tun.mtu.
+$Ip6_1 = 'fd42:4242:241::1'
+$Ip6_2 = 'fd42:4242:241::2'
+$Mtu = 1300
 $Port = 4242
 
 & $NebulaCert ca -name 'smoke-ca' -out-crt "$WorkDir\ca.crt" -out-key "$WorkDir\ca.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert ca failed (exit $LASTEXITCODE)" }
 
-& $NebulaCert sign -name 'lighthouse' -networks "$Ip1/24" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\lighthouse.crt" -out-key "$WorkDir\lighthouse.key"
+& $NebulaCert sign -name 'lighthouse' -networks "$Ip1/24,$Ip6_1/64" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\lighthouse.crt" -out-key "$WorkDir\lighthouse.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert sign lighthouse failed (exit $LASTEXITCODE)" }
 
-& $NebulaCert sign -name 'peer' -networks "$Ip2/24" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\peer.crt" -out-key "$WorkDir\peer.key"
+& $NebulaCert sign -name 'peer' -networks "$Ip2/24,$Ip6_2/64" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\peer.crt" -out-key "$WorkDir\peer.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert sign peer failed (exit $LASTEXITCODE)" }
 
 # Windows lighthouse config.
@@ -82,7 +86,7 @@ tun:
   drop_local_broadcast: false
   drop_multicast: false
   tx_queue: 500
-  mtu: 1300
+  mtu: $Mtu
   network_category: private
 logging:
   level: info
@@ -126,7 +130,7 @@ tun:
   drop_local_broadcast: false
   drop_multicast: false
   tx_queue: 500
-  mtu: 1300
+  mtu: $Mtu
 logging:
   level: info
   format: text
@@ -169,7 +173,7 @@ Write-Host '=== WSL diagnostic ==='
 wsl --version 2>&1 | Out-Host
 wsl --list --verbose 2>&1 | Out-Host
 wsl -d $Distro -u root -- uname -a | Out-Host
-wsl -d $Distro -u root -- bash -c "modprobe tun 2>&1 || true; mkdir -p /dev/net; [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200; chmod 600 /dev/net/tun; ls -l /dev/net/tun"
+wsl -d $Distro -u root -- bash -c "modprobe tun 2>&1 || true; mkdir -p /dev/net; [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200; chmod 600 /dev/net/tun; { echo 0 > /proc/sys/net/ipv6/conf/all/disable_ipv6; echo 0 > /proc/sys/net/ipv6/conf/default/disable_ipv6; } 2>/dev/null || true; ls -l /dev/net/tun"
 if ($LASTEXITCODE -ne 0) { throw "failed to prepare /dev/net/tun in WSL (TUN support missing?)" }
 
 # Deliberately no New-NetFirewallRule calls here -- nebula's windows_bypass_wdf
@@ -214,6 +218,16 @@ try {
     }
     Write-Host "OK: $DevName NetworkCategory=Private"
 
+    # v6 silently kept the adapter default of 65535 while v4 was correct.
+    foreach ($family in @('IPv4', 'IPv6')) {
+        Wait-Until -TimeoutSec 30 -What "$DevName $family NlMtu=$Mtu" -Predicate {
+            if ($lhProc.HasExited) { throw "lighthouse exited (code $($lhProc.ExitCode)) before $family mtu was set" }
+            $rows = @(Get-NetIPInterface -InterfaceAlias $DevName -AddressFamily $family -ErrorAction SilentlyContinue)
+            $rows.Count -gt 0 -and -not ($rows | Where-Object { $_.NlMtu -ne $Mtu })
+        }
+        Write-Host "OK: $DevName $family NlMtu=$Mtu"
+    }
+
     Wait-Until -TimeoutSec 30 -What "WSL nebula1 with $Ip2" -Predicate {
         if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before tun was ready" }
         $r = wsl -d $Distro -u root -- bash -c "ip -o addr show nebula1 2>/dev/null | grep -q 'inet $Ip2' && echo yes"
@@ -221,6 +235,13 @@ try {
     }
     Write-Host "OK: WSL nebula1 has $Ip2"
 
+    Wait-Until -TimeoutSec 30 -What "WSL nebula1 with $Ip6_2" -Predicate {
+        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before the v6 address was up" }
+        $r = wsl -d $Distro -u root -- bash -c "ip -o addr show nebula1 2>/dev/null | grep -q 'inet6 $Ip6_2' && echo yes"
+        ("$r").Trim() -eq 'yes'
+    }
+    Write-Host "OK: WSL nebula1 has $Ip6_2"
+
     Wait-Until -TimeoutSec 30 -What "ping from WSL peer to windows lighthouse ($Ip1)" -Predicate {
         if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before ping succeeded" }
         $r = wsl -d $Distro -u root -- bash -c "ping -c1 -W1 $Ip1 >/dev/null 2>&1 && echo OK"
@@ -234,6 +255,14 @@ try {
     }
     Write-Host "OK: windows lighthouse -> WSL peer"
 
+    # Otherwise the v6 networks only prove the interface exists, not that it forwards.
+    Wait-Until -TimeoutSec 30 -What "v6 ping from WSL peer to windows lighthouse ($Ip6_1)" -Predicate {
+        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before the v6 ping succeeded" }
+        $r = wsl -d $Distro -u root -- bash -c "ping -6 -c1 -W1 $Ip6_1 >/dev/null 2>&1 && echo OK"
+        ("$r").Trim() -eq 'OK'
+    }
+    Write-Host "OK: WSL peer -> windows lighthouse over v6"
+
     Write-Host ''
     Write-Host 'All smoke checks passed.'
 }

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.11.1] - 2026-08-21
+
+See the [v1.11.1](https://github.com/slackhq/nebula/milestone/30?closed=1) milestone for a complete list of changes.
+
 ### Changed
 
 - IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now
@@ -15,11 +19,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   their true protocol, so only a `proto: any` rule allows them. If you carry one of these protocols over the
   overlay, confirm a `proto: any` rule covers it before upgrading, it may have been passing only through this
   bypass. (#1840)
+- Drop the dependency on `github.com/cyberdelia/go-metrics-graphite`, which has been unmaintained for over ten
+  years, by inlining the small amount of code Nebula used. (#1832)
 
 ### Fixed
 
 - The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used
   for conntrack was never picked up. (#1840)
+- Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing
+  nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
+- Prevent `nebula-cert ca` from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
+- Tolerate `ErrDumpInterrupted` when listing tun addresses on Linux, so a transient interrupted netlink dump
+  no longer aborts startup. (#1835)
 
 ## [1.11.0] - 2026-07-23
 
@@ -884,7 +895,9 @@ created.)
 
 - Initial public release.
 
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.3...HEAD
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.11.1...HEAD
+[1.11.1]: https://github.com/slackhq/nebula/releases/tag/v1.11.1
+[1.11.0]: https://github.com/slackhq/nebula/releases/tag/v1.11.0
 [1.10.3]: https://github.com/slackhq/nebula/releases/tag/v1.10.3
 [1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
 [1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1

bits.go

@@ -79,7 +79,13 @@ func (b *Bits) clearRange(startPos, count uint64) uint64 {
 	// handle the potential partial word before pos becomes u64 aligned
 	word := pos >> 6
 	bit := pos & 63
-	take := min(min(uint64(64)-bit, remaining), b.length-pos)
+	take := uint64(64) - bit
+	if take > remaining {
+		take = remaining
+	}
+	if take > b.length-pos {
+		take = b.length - pos
+	}
 	var mask uint64
 	if take == 64 {
 		mask = math.MaxUint64
@@ -183,7 +189,10 @@ func (b *Bits) Update(l *slog.Logger, i uint64) bool {
 func (b *Bits) updateSlow(l *slog.Logger, i uint64) bool {
 	// If i is a jump, adjust the window, record lost, update current, and return true
 	if i > b.current {
-		end := min(i, b.current+b.length)
+		end := i
+		if end > b.current+b.length {
+			end = b.current + b.length
+		}
 		count := end - b.current
 		startPos := (b.current + 1) & b.lengthMask
 

cert/sign_test.go

@@ -120,7 +120,7 @@ func TestCertificate_SignP256_AlwaysNormalized(t *testing.T) {
 	pub := elliptic.Marshal(elliptic.P256(), priv.PublicKey.X, priv.PublicKey.Y)
 	rawPriv := priv.D.FillBytes(make([]byte, 32))
 
-	for i := range 1000 {
+	for i := 0; i < 1000; i++ {
 		if i&1 == 1 {
 			tbs.Version = Version1
 		} else {

cmd/nebula-cert/ca.go

@@ -151,7 +151,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 
 	var groups []string
 	if *cf.groups != "" {
-		for rg := range strings.SplitSeq(*cf.groups, ",") {
+		for _, rg := range strings.Split(*cf.groups, ",") {
 			g := strings.TrimSpace(rg)
 			if g != "" {
 				groups = append(groups, g)
@@ -171,7 +171,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 	}
 
 	if *cf.networks != "" {
-		for rs := range strings.SplitSeq(*cf.networks, ",") {
+		for _, rs := range strings.Split(*cf.networks, ",") {
 			rs := strings.Trim(rs, " ")
 			if rs != "" {
 				n, err := netip.ParsePrefix(rs)
@@ -193,7 +193,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 	}
 
 	if *cf.unsafeNetworks != "" {
-		for rs := range strings.SplitSeq(*cf.unsafeNetworks, ",") {
+		for _, rs := range strings.Split(*cf.unsafeNetworks, ",") {
 			rs := strings.Trim(rs, " ")
 			if rs != "" {
 				n, err := netip.ParsePrefix(rs)
@@ -221,7 +221,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 	if !isP11 && *cf.encryption {
 		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
 		if len(passphrase) == 0 {
-			for range 5 {
+			for i := 0; i < 5; i++ {
 				errOut.Write([]byte("Enter passphrase: "))
 				passphrase, err = pr.ReadPassword()
 

cmd/nebula-cert/ca_test.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package main
 

cmd/nebula-cert/sign.go

@@ -146,7 +146,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 			passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
 			if len(passphrase) == 0 {
 				// ask for a passphrase until we get one
-				for range 5 {
+				for i := 0; i < 5; i++ {
 					errOut.Write([]byte("Enter passphrase: "))
 					passphrase, err = pr.ReadPassword()
 
@@ -203,7 +203,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	}
 
 	if *sf.networks != "" {
-		for rs := range strings.SplitSeq(*sf.networks, ",") {
+		for _, rs := range strings.Split(*sf.networks, ",") {
 			rs := strings.Trim(rs, " ")
 			if rs != "" {
 				n, err := netip.ParsePrefix(rs)
@@ -228,7 +228,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	}
 
 	if *sf.unsafeNetworks != "" {
-		for rs := range strings.SplitSeq(*sf.unsafeNetworks, ",") {
+		for _, rs := range strings.Split(*sf.unsafeNetworks, ",") {
 			rs := strings.Trim(rs, " ")
 			if rs != "" {
 				n, err := netip.ParsePrefix(rs)
@@ -247,7 +247,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 
 	var groups []string
 	if *sf.groups != "" {
-		for rg := range strings.SplitSeq(*sf.groups, ",") {
+		for _, rg := range strings.Split(*sf.groups, ",") {
 			g := strings.TrimSpace(rg)
 			if g != "" {
 				groups = append(groups, g)

cmd/nebula-cert/sign_test.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package main
 

cmd/nebula-service/logs_generic.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package main
 

cmd/nebula/notify_notlinux.go

@@ -1,4 +1,5 @@
 //go:build !linux
+// +build !linux
 
 package main
 

config/config.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"maps"
 	"math"
 	"os"
 	"os/signal"
@@ -155,7 +154,9 @@ func (c *C) ReloadConfig() {
 	defer c.reloadLock.Unlock()
 
 	c.oldSettings = make(map[string]any)
-	maps.Copy(c.oldSettings, c.Settings)
+	for k, v := range c.Settings {
+		c.oldSettings[k] = v
+	}
 
 	err := c.Load(c.path)
 	if err != nil {
@@ -176,7 +177,9 @@ func (c *C) ReloadConfigString(raw string) error {
 	defer c.reloadLock.Unlock()
 
 	c.oldSettings = make(map[string]any)
-	maps.Copy(c.oldSettings, c.Settings)
+	for k, v := range c.Settings {
+		c.oldSettings[k] = v
+	}
 
 	err := c.LoadString(raw)
 	if err != nil {
@@ -213,7 +216,7 @@ func (c *C) GetStringSlice(k string, d []string) []string {
 	}
 
 	v := make([]string, len(rv))
-	for i := range v {
+	for i := 0; i < len(v); i++ {
 		v[i] = fmt.Sprintf("%v", rv[i])
 	}
 
@@ -307,8 +310,8 @@ func (c *C) IsSet(k string) bool {
 }
 
 func (c *C) get(k string, v any) any {
-	parts := strings.SplitSeq(k, ".")
-	for p := range parts {
+	parts := strings.Split(k, ".")
+	for _, p := range parts {
 		m, ok := v.(map[string]any)
 		if !ok {
 			return nil

connection_state_test.go

@@ -97,7 +97,7 @@ func TestConnectionState_NextMessageCounter(t *testing.T) {
 	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
 
 	// Continued send attempts stay refused and the counter never wraps
-	for range 10 {
+	for i := 0; i < 10; i++ {
 		_, ok = cs.NextMessageCounter()
 		assert.False(t, ok)
 	}

control_lifecycle_test.go

@@ -247,7 +247,7 @@ func TestControl_ConcurrentStopAndStart(t *testing.T) {
 	c, _, _ := newReadyControl(t)
 
 	var wg sync.WaitGroup
-	for range 2 {
+	for i := 0; i < 2; i++ {
 		wg.Go(func() { c.Stop() })
 	}
 	wg.Go(func() { _ = c.Start() })

e2e/echo_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/handshake_manager_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/handshakes_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/helpers_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/leak_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/rebind_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/recovery_timing_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/router/hostmap.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package router
 

e2e/router/router.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package router
 

e2e/sshd_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

e2e/tunnels_test.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package e2e
 

firewall/cache_test.go

@@ -22,7 +22,7 @@ func newFixedTicker(t *testing.T, l *slog.Logger, cacheLen int) *ConntrackCacheT
 		l:     l,
 		cache: make(ConntrackCache, cacheLen),
 	}
-	for i := range cacheLen {
+	for i := 0; i < cacheLen; i++ {
 		c.cache[Packet{LocalPort: uint16(i) + 1}] = struct{}{}
 	}
 	c.cacheTick.Store(1) // cacheV starts at 0, so Get() takes the reset path

lighthouse.go

@@ -34,7 +34,9 @@ type LightHouse struct {
 
 	myVpnNetworks      []netip.Prefix
 	myVpnNetworksTable *bart.Lite
-	punchy             *Punchy
+	// myVpnAddrsTable contains our overlay host addrs, as opposed to the overlay networks
+	myVpnAddrsTable *bart.Lite
+	punchy          *Punchy
 
 	// localAddrsFn enumerates the underlay addresses we advertise. It is a field so tests can supply simulated
 	// addresses rather than whatever this machine's NICs happen to be. Set it before Start.
@@ -104,6 +106,7 @@ func NewLightHouseFromConfig(ctx context.Context, l *slog.Logger, c *config.C, c
 		amLighthouse:       amLighthouse,
 		myVpnNetworks:      cs.myVpnNetworks,
 		myVpnNetworksTable: cs.myVpnNetworksTable,
+		myVpnAddrsTable:    cs.myVpnAddrsTable,
 		addrMap:            make(map[netip.Addr]*RemoteList),
 		nebulaPort:         nebulaPort,
 		punchy:             p,
@@ -1158,6 +1161,17 @@ func (lhh *LightHouseHandler) handleHostQuery(n *NebulaMeta, fromVpnAddrs []neti
 		return
 	}
 
+	// Don't respond to requests for us.
+	if lhh.lh.myVpnAddrsTable.Contains(queryVpnAddr) {
+		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
+			lhh.l.Debug("Ignoring HostQuery for one of my own addresses",
+				"fromVpnAddrs", fromVpnAddrs,
+				"queryVpnAddr", queryVpnAddr,
+			)
+		}
+		return
+	}
+
 	found, ln, err := lhh.lh.queryAndPrepMessage(queryVpnAddr, func(c *cache) (int, error) {
 		n = lhh.resetMeta()
 		n.Type = NebulaMeta_HostQueryReply

lighthouse_test.go

@@ -27,15 +27,27 @@ func TestOldIPv4Only(t *testing.T) {
 	assert.Equal(t, binary.BigEndian.Uint32(bp[:]), m.GetAddr())
 }
 
+func testCertState(networks ...netip.Prefix) *CertState {
+	cs := &CertState{
+		myVpnNetworks:      networks,
+		myVpnNetworksTable: new(bart.Lite),
+		myVpnAddrs:         make([]netip.Addr, 0, len(networks)),
+		myVpnAddrsTable:    new(bart.Lite),
+	}
+
+	for _, n := range networks {
+		cs.myVpnNetworksTable.Insert(n)
+		cs.myVpnAddrs = append(cs.myVpnAddrs, n.Addr())
+		cs.myVpnAddrsTable.Insert(netip.PrefixFrom(n.Addr(), n.Addr().BitLen()))
+	}
+
+	return cs
+}
+
 func Test_lhStaticMapping(t *testing.T) {
 	l := test.NewLogger()
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/16")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 	lh1 := "10.128.0.2"
 
 	c := config.NewC(l)
@@ -55,12 +67,7 @@ func Test_lhStaticMapping(t *testing.T) {
 func TestReloadLighthouseInterval(t *testing.T) {
 	l := test.NewLogger()
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/16")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 	lh1 := "10.128.0.2"
 
 	c := config.NewC(l)
@@ -90,12 +97,7 @@ func TestReloadLighthouseInterval(t *testing.T) {
 func BenchmarkLighthouseHandleRequest(b *testing.B) {
 	l := test.NewLogger()
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/0")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 
 	c := config.NewC(l)
 	lh, err := NewLightHouseFromConfig(b.Context(), l, c, cs, nil, nil)
@@ -195,12 +197,7 @@ func TestLighthouse_Memory(t *testing.T) {
 	c.Settings["listen"] = map[string]any{"port": 4242}
 
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	lh.ifce = &mockEncWriter{}
 	require.NoError(t, err)
@@ -280,12 +277,7 @@ func TestLighthouse_reload(t *testing.T) {
 	c.Settings["listen"] = map[string]any{"port": 4242}
 
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 
 	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
@@ -315,12 +307,7 @@ func TestLighthouse_reloadStaticHostMap(t *testing.T) {
 	}
 
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 
 	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
@@ -429,7 +416,9 @@ func TestLighthouse_reloadStaticHostMap(t *testing.T) {
 	assert.Equal(t, []netip.AddrPort{netip.MustParseAddrPort("3.3.3.3:4242")}, rl.CopyAddrs([]netip.Prefix{}))
 }
 
-func newLHHostRequest(fromAddr netip.AddrPort, myVpnIp, queryVpnIp netip.Addr, lhh *LightHouseHandler) testLhReply {
+// sendLHHostRequest delivers a HostQuery to lhh and hands back the writer that
+// captured what it emitted. Pass a nil filter to see every message.
+func sendLHHostRequest(fromAddr netip.AddrPort, myVpnIp, queryVpnIp netip.Addr, lhh *LightHouseHandler, filter *NebulaMeta_MessageType) *testEncWriter {
 	req := &NebulaMeta{
 		Type:    NebulaMeta_HostQuery,
 		Details: &NebulaMetaDetails{},
@@ -447,12 +436,59 @@ func newLHHostRequest(fromAddr netip.AddrPort, myVpnIp, queryVpnIp netip.Addr, l
 		panic(err)
 	}
 
-	filter := NebulaMeta_HostQueryReply
-	w := &testEncWriter{
-		metaFilter: &filter,
-	}
+	w := &testEncWriter{metaFilter: filter}
 	lhh.HandleRequest(fromAddr, []netip.Addr{myVpnIp}, b, w)
-	return w.lastReply
+	return w
+}
+
+func newLHHostRequest(fromAddr netip.AddrPort, myVpnIp, queryVpnIp netip.Addr, lhh *LightHouseHandler) testLhReply {
+	filter := NebulaMeta_HostQueryReply
+	return sendLHHostRequest(fromAddr, myVpnIp, queryVpnIp, lhh, &filter).lastReply
+}
+
+func TestLighthouse_IgnoresHostQueryForItself(t *testing.T) {
+	// Validate that we don't answer host queries for our own address.
+	l := test.NewLogger()
+
+	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
+	myVpnIp := myVpnNet.Addr()
+
+	c := config.NewC(l)
+	c.Settings["lighthouse"] = map[string]any{"am_lighthouse": true}
+	c.Settings["listen"] = map[string]any{"port": 4242}
+	// Add a static_host_map entry for ourselves, so our address
+	// is in the addrMap.
+	c.Settings["static_host_map"] = map[string]any{
+		myVpnIp.String(): []any{"192.168.100.1:4242"},
+	}
+
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, testCertState(myVpnNet), nil, nil)
+	require.NoError(t, err)
+	lh.ifce = &mockEncWriter{}
+	lhh := lh.NewRequestHandler()
+
+	peerVpnIp := netip.MustParseAddr("10.128.0.2")
+	peerUdpAddr := netip.MustParseAddrPort("10.0.0.2:4242")
+	otherVpnIp := netip.MustParseAddr("10.128.0.3")
+	otherUdpAddr := netip.MustParseAddrPort("10.0.0.3:4242")
+
+	newLHHostUpdate(peerUdpAddr, peerVpnIp, []netip.AddrPort{peerUdpAddr}, lhh)
+	newLHHostUpdate(otherUdpAddr, otherVpnIp, []netip.AddrPort{otherUdpAddr}, lhh)
+
+	// Control: a query about a real peer is still answered, and still ends with
+	// the punch notification aimed at the host that was asked about.
+	w := sendLHHostRequest(peerUdpAddr, peerVpnIp, otherVpnIp, lhh, nil)
+	require.NotNil(t, w.lastReply.msg)
+	assert.Equal(t, NebulaMeta_HostPunchNotification, w.lastReply.msg.Type)
+	assert.Equal(t, otherVpnIp, w.lastReply.vpnIp)
+
+	// Now validate that we don't send to ourselves.
+	found, _, err := lh.queryAndPrepMessage(myVpnIp, func(*cache) (int, error) { return 0, nil })
+	require.NoError(t, err)
+	require.True(t, found, "the lighthouse should hold a cache entry for its own address")
+
+	w = sendLHHostRequest(peerUdpAddr, peerVpnIp, myVpnIp, lhh, nil)
+	assert.Nil(t, w.lastReply.msg, "a query about our own address must produce no reply and no punch notification")
 }
 
 func newLHHostUpdate(fromAddr netip.AddrPort, vpnIp netip.Addr, addrs []netip.AddrPort, lhh *LightHouseHandler) {
@@ -642,12 +678,7 @@ func TestLighthouse_Dont_Delete_Static_Hosts(t *testing.T) {
 	}
 
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
@@ -708,12 +739,7 @@ func TestLighthouse_DeletesWork(t *testing.T) {
 	}
 
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/24")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
+	cs := testCertState(myVpnNet)
 	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}

noiseutil/boring.go

@@ -1,4 +1,5 @@
 //go:build boringcrypto
+// +build boringcrypto
 
 package noiseutil
 

noiseutil/boring_test.go

@@ -1,4 +1,5 @@
 //go:build boringcrypto
+// +build boringcrypto
 
 package noiseutil
 

overlay/batch/checksum_seed_test.go

@@ -127,7 +127,7 @@ func TestPseudoSumIPv6MatchesReference(t *testing.T) {
 func TestIPv4HdrChecksumMatchesReference(t *testing.T) {
 	rng := rand.New(rand.NewSource(0x1791))
 	for _, hdrLen := range []int{20, 24, 40, 60} {
-		for trial := range 200 {
+		for trial := 0; trial < 200; trial++ {
 			hdr := make([]byte, hdrLen)
 			rng.Read(hdr)
 			hdr[0] = 0x40 | byte(hdrLen/4)
@@ -156,7 +156,7 @@ func TestIPv4HdrChecksumMatchesReference(t *testing.T) {
 // the way a receiver does (pseudo-header + L4 must sum to all-ones).
 func TestChecksumSeedReceiverAcceptance(t *testing.T) {
 	rng := rand.New(rand.NewSource(0x1826))
-	for trial := range 200 {
+	for trial := 0; trial < 200; trial++ {
 		src := [4]byte{byte(rng.Intn(256)), byte(rng.Intn(256)), byte(rng.Intn(256)), byte(rng.Intn(256))}
 		dst := [4]byte{byte(rng.Intn(256)), byte(rng.Intn(256)), byte(rng.Intn(256)), byte(rng.Intn(256))}
 		payLen := rng.Intn(1500)

overlay/batch/tcp_coalesce_test.go

@@ -540,7 +540,7 @@ func TestCoalescerCapBySegments(t *testing.T) {
 	c := newTestTCPCoalescer(t, w)
 	pay := make([]byte, 512)
 	seq := uint32(1000)
-	for range tcpCoalesceMaxSegs + 5 {
+	for i := 0; i < tcpCoalesceMaxSegs+5; i++ {
 		if err := c.Commit(buildTCPv4(seq, tcpAck, pay)); err != nil {
 			t.Fatal(err)
 		}

overlay/batch/tx_batch_test.go

@@ -28,7 +28,7 @@ func TestSendBatchReserveCommitFlush(t *testing.T) {
 	b := NewSendBatch(fw, 4, 32)
 
 	ap := netip.MustParseAddrPort("10.0.0.1:4242")
-	for i := range 4 {
+	for i := 0; i < 4; i++ {
 		slot := b.Reserve(32)
 		if cap(slot) != 32 {
 			t.Fatalf("slot %d: cap=%d want 32", i, cap(slot))
@@ -72,7 +72,7 @@ func TestSendBatchSlotsDoNotOverlap(t *testing.T) {
 	b := NewSendBatch(fw, 3, 8)
 	ap := netip.MustParseAddrPort("10.0.0.1:80")
 
-	for i := range 3 {
+	for i := 0; i < 3; i++ {
 		s := b.Reserve(8)
 		pkt := append(s[:0], byte(0xA0+i), byte(0xB0+i))
 		b.Commit(pkt, ap)

overlay/batch/udp_coalesce_test.go

@@ -129,7 +129,7 @@ func TestUDPCoalescerCoalescesEqualSized(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
 	c := newTestUDPCoalescer(t, w)
 	pay := make([]byte, 1200)
-	for range 3 {
+	for i := 0; i < 3; i++ {
 		if err := c.Commit(buildUDPv4(1000, 53, pay)); err != nil {
 			t.Fatal(err)
 		}
@@ -259,7 +259,7 @@ func TestUDPCoalescerCapsAtMaxSegs(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
 	c := newTestUDPCoalescer(t, w)
 	pay := make([]byte, 100)
-	for range udpCoalesceMaxSegs + 5 {
+	for i := 0; i < udpCoalesceMaxSegs+5; i++ {
 		if err := c.Commit(buildUDPv4(1000, 53, pay)); err != nil {
 			t.Fatal(err)
 		}
@@ -317,7 +317,7 @@ func TestUDPCoalescerIPv6Coalesces(t *testing.T) {
 	w := &fakeTunWriter{gsoEnabled: true}
 	c := newTestUDPCoalescer(t, w)
 	pay := make([]byte, 1200)
-	for range 3 {
+	for i := 0; i < 3; i++ {
 		if err := c.Commit(buildUDPv6(1000, 53, pay)); err != nil {
 			t.Fatal(err)
 		}

overlay/checksum/checksum_test.go

@@ -151,7 +151,7 @@ func TestChecksumTailPaths(t *testing.T) {
 			offsets := []int{0, 1, 3, 7, 15} // mix of aligned and odd starts
 
 			for k := 0; k <= maxK; k++ {
-				for tail := range 64 {
+				for tail := 0; tail < 64; tail++ {
 					length := 64*k + tail
 					for _, seed := range seeds {
 						for _, off := range offsets {

overlay/network_category_windows.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/network_category_windows_test.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tio/blockon_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/queueset_gso_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/queueset_poll_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/tio_gso_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/tio_poll_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/tun_file_linux_test.go

@@ -1,4 +1,5 @@
 //go:build linux && !android && !e2e_testing
+// +build linux,!android,!e2e_testing
 
 package tio
 
@@ -116,15 +117,17 @@ func TestPoll_ConcurrentWrite_NoRace(t *testing.T) {
 	}()
 
 	var wg sync.WaitGroup
-	for range writers {
-		wg.Go(func() {
-			for range perWriter {
+	for w := 0; w < writers; w++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < perWriter; i++ {
 				if _, werr := p.Write(payload); werr != nil {
 					t.Errorf("write: %v", werr)
 					return
 				}
 			}
-		})
+		}()
 	}
 	wg.Wait()
 

overlay/tio/tun_linux_offload.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package tio
 

overlay/tio/tun_linux_offload_test.go

@@ -1,4 +1,5 @@
 //go:build linux && !android && !e2e_testing
+// +build linux,!android,!e2e_testing
 
 package tio
 
@@ -136,7 +137,7 @@ func buildTSOv4(t *testing.T, payLen, mss int) ([]byte, virtio.Hdr) {
 	binary.BigEndian.PutUint16(pkt[34:36], 65535) // window
 
 	// payload
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+tcpLen+i] = byte(i & 0xff)
 	}
 	return pkt, virtio.NewHeader(
@@ -256,7 +257,7 @@ func TestSegmentTCPv6(t *testing.T) {
 	pkt[53] = 0x19 // FIN | ACK | PSH — exercise FIN clearing too
 	binary.BigEndian.PutUint16(pkt[54:56], 65535)
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+tcpLen+i] = byte(i)
 	}
 
@@ -360,7 +361,7 @@ func buildUSOv4(t *testing.T, payLen, gsoSize int) ([]byte, virtio.Hdr) {
 	binary.BigEndian.PutUint16(pkt[22:24], 53)                    // dport
 	binary.BigEndian.PutUint16(pkt[24:26], uint16(udpLen+payLen)) // superpacket length
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+udpLen+i] = byte(i & 0xff)
 	}
 
@@ -472,7 +473,7 @@ func TestSegmentUDPv6(t *testing.T) {
 	// Superpacket-wide length, as the kernel supplies it; see buildUSOv4.
 	binary.BigEndian.PutUint16(pkt[44:46], uint16(udpLen+payLen))
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+udpLen+i] = byte(i)
 	}
 
@@ -771,7 +772,7 @@ func buildTSOv6(payLen, gso int) []byte {
 	pkt[53] = 0x10 // ACK only
 	binary.BigEndian.PutUint16(pkt[54:56], 65535)
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+tcpLen+i] = byte(i)
 	}
 	return pkt

overlay/tio/virtio/header_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package virtio
 

overlay/tio/virtio/segment_linux.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 // Package virtio implements the pure validation, header-correction, and
 // per-segment slicing logic for kernel-supplied TSO/USO superpackets on
@@ -253,9 +254,12 @@ func SegmentTCP(pkt []byte, hdrLenU, csumStartU, gsoSizeU uint16, yield func(seg
 	var savedHdr [maxSegHdrLen]byte
 	copy(savedHdr[:headerLen], pkt[:headerLen])
 
-	for i := range numSeg {
+	for i := 0; i < numSeg; i++ {
 		segStart := i * gsoSize
-		segEnd := min(segStart+gsoSize, payLen)
+		segEnd := segStart + gsoSize
+		if segEnd > payLen {
+			segEnd = payLen
+		}
 		segPayLen := segEnd - segStart
 		segLen := headerLen + segPayLen
 		headerOff := i * gsoSize
@@ -355,9 +359,12 @@ func SegmentUDP(pkt []byte, hdrLenU, csumStartU, gsoSizeU uint16, yield func(seg
 	var savedHdr [maxSegHdrLen]byte
 	copy(savedHdr[:headerLen], pkt[:headerLen])
 
-	for i := range numSeg {
+	for i := 0; i < numSeg; i++ {
 		segStart := i * gsoSize
-		segEnd := min(segStart+gsoSize, payLen)
+		segEnd := segStart + gsoSize
+		if segEnd > payLen {
+			segEnd = payLen
+		}
 		segPayLen := segEnd - segStart
 		segLen := headerLen + segPayLen
 		headerOff := i * gsoSize

overlay/tio/virtio/segment_linux_test.go

@@ -1,4 +1,5 @@
 //go:build linux && !android
+// +build linux,!android
 
 package virtio
 
@@ -57,7 +58,7 @@ func buildTCPv4Super(payLen int) (pkt []byte, hdrLen, csumStart uint16) {
 	pkt[33] = 0x18                                // ACK | PSH
 	binary.BigEndian.PutUint16(pkt[34:36], 65535) // window
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+tcpLen+i] = byte(i & 0xff)
 	}
 	return pkt, ipLen + tcpLen, ipLen
@@ -81,7 +82,7 @@ func buildUDPv4Super(payLen int) (pkt []byte, hdrLen, csumStart uint16) {
 	binary.BigEndian.PutUint16(pkt[20:22], 12345) // sport
 	binary.BigEndian.PutUint16(pkt[22:24], 53)    // dport
 
-	for i := range payLen {
+	for i := 0; i < payLen; i++ {
 		pkt[ipLen+udpLen+i] = byte(i & 0xff)
 	}
 	return pkt, ipLen + udpLen, ipLen
@@ -187,7 +188,7 @@ func TestSegmentTCPHeaderNotCorrupted(t *testing.T) {
 				// Payload bytes must be the original contiguous slice.
 				segPayLen := len(seg) - int(hdrLen)
 				wantPay := make([]byte, segPayLen)
-				for k := range segPayLen {
+				for k := 0; k < segPayLen; k++ {
 					wantPay[k] = byte((off + k) & 0xff)
 				}
 				if !bytes.Equal(seg[hdrLen:], wantPay) {
@@ -316,7 +317,7 @@ func TestSegmentUDPHeaderNotCorrupted(t *testing.T) {
 				}
 
 				wantPay := make([]byte, segPayLen)
-				for k := range segPayLen {
+				for k := 0; k < segPayLen; k++ {
 					wantPay[k] = byte((off + k) & 0xff)
 				}
 				if !bytes.Equal(seg[hdrLen:], wantPay) {
@@ -364,7 +365,7 @@ func buildUDPv4Single(payload []byte) (pkt []byte, hdr Hdr) {
 // 0xffff, because all-zero is the reserved "no checksum" encoding that IPv6 rejects outright.
 func TestFinishChecksumUDPZeroStoresAllOnes(t *testing.T) {
 	var payload []byte
-	for i := range 0x10000 {
+	for i := 0; i < 0x10000; i++ {
 		p := []byte{byte(i >> 8), byte(i)}
 		pkt, hdr := buildUDPv4Single(p)
 		cs, co := int(hdr.CsumStart), int(hdr.CsumOffset)
@@ -543,7 +544,7 @@ func TestBaseSumsMatchZeroingReference(t *testing.T) {
 
 	t.Run("ipv4", func(t *testing.T) {
 		for ihl := ipv4HeaderMinLen; ihl <= ipv4HeaderMaxLen; ihl += 4 {
-			for range 5000 {
+			for iter := 0; iter < 5000; iter++ {
 				pkt := make([]byte, ihl)
 				for i := range pkt {
 					pkt[i] = randByte(&state)
@@ -573,7 +574,7 @@ func TestBaseSumsMatchZeroingReference(t *testing.T) {
 		for dataOff := 5; dataOff <= 15; dataOff++ {
 			tcpLen := dataOff * 4
 			headerLen := csumStart + tcpLen
-			for range 5000 {
+			for iter := 0; iter < 5000; iter++ {
 				pkt := make([]byte, headerLen+64)
 				for i := range pkt {
 					pkt[i] = randByte(&state)

overlay/tun.go

@@ -93,14 +93,14 @@ func prefixToMask(prefix netip.Prefix) netip.Addr {
 }
 
 func flipBytes(b []byte) []byte {
-	for i := range b {
+	for i := 0; i < len(b); i++ {
 		b[i] ^= 0xFF
 	}
 	return b
 }
 func orBytes(a []byte, b []byte) []byte {
 	ret := make([]byte, len(a))
-	for i := range a {
+	for i := 0; i < len(a); i++ {
 		ret[i] = a[i] | b[i]
 	}
 	return ret

overlay/tun_android.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_bypass_windows_386.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_darwin.go

@@ -1,4 +1,5 @@
 //go:build !ios && !e2e_testing
+// +build !ios,!e2e_testing
 
 package overlay
 

overlay/tun_freebsd.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_ios.go

@@ -1,4 +1,5 @@
 //go:build ios && !e2e_testing
+// +build ios,!e2e_testing
 
 package overlay
 

overlay/tun_linux.go

@@ -1,4 +1,5 @@
 //go:build !android && !e2e_testing
+// +build !android,!e2e_testing
 
 package overlay
 
@@ -547,7 +548,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	if err != nil {
 		t.l.Warn("Failed to set default route MTU, retrying", "error", err, "cidr", cidr)
 		//retry twice more -- on some systems there appears to be a race condition where if we set routes too soon, netlink says `invalid argument`
-		for range 2 {
+		for i := 0; i < 2; i++ {
 			time.Sleep(100 * time.Millisecond)
 			err = netlink.RouteReplace(&nr)
 			if err == nil {

overlay/tun_linux_test.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_netbsd.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_notwin.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package overlay
 

overlay/tun_openbsd.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 

overlay/tun_tester.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package overlay
 

overlay/tun_windows.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package overlay
 
@@ -10,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"sync/atomic"
 	"syscall"
 	"unsafe"
@@ -181,6 +183,7 @@ func (t *winTun) addRoutes(logErrors bool) error {
 	luid := winipcfg.LUID(t.tun.LUID())
 	routes := *t.Routes.Load()
 	foundDefault4 := false
+	carriesV6 := slices.ContainsFunc(t.vpnNetworks, func(p netip.Prefix) bool { return p.Addr().Is6() })
 
 	for _, r := range routes {
 		if len(r.Via) == 0 || !r.Install {
@@ -188,6 +191,9 @@ func (t *winTun) addRoutes(logErrors bool) error {
 			continue
 		}
 
+		// A v6 unsafe_route is legal under a v4-only cert; uninstalled ones put nothing on the adapter.
+		carriesV6 = carriesV6 || r.Cidr.Addr().Is6()
+
 		// Add our unsafe route as an on-link route to the nebula tun device.
 		err := luid.AddRoute(r.Cidr, unspecifiedNextHop(r.Cidr), uint32(r.Metric))
 		if err != nil {
@@ -209,6 +215,11 @@ func (t *winTun) addRoutes(logErrors bool) error {
 		}
 	}
 
+	return t.setMTU(luid, foundDefault4, carriesV6)
+}
+
+// setMTU applies tun.mtu per address family. The default route metric rides along on the v4 handle.
+func (t *winTun) setMTU(luid winipcfg.LUID, foundDefault4, carriesV6 bool) error {
 	ipif, err := luid.IPInterface(windows.AF_INET)
 	if err != nil {
 		return fmt.Errorf("failed to get ip interface: %w", err)
@@ -223,6 +234,25 @@ func (t *winTun) addRoutes(logErrors bool) error {
 	if err := ipif.Set(); err != nil {
 		return fmt.Errorf("failed to set ip interface: %w", err)
 	}
+
+	// Windows tracks NLMTU per family and wintun sets neither, so v6 keeps the adapter default of 65535.
+	// Gated so a v4-only overlay under 1280 boots; a v6 one deliberately does not, as linux also refuses.
+	if !carriesV6 {
+		return nil
+	}
+
+	ipif6, err := luid.IPInterface(windows.AF_INET6)
+	if err != nil {
+		// No v6 on the adapter means there is no NLMTU to get wrong. A failed Set below is not the same thing.
+		t.l.Info("Skipping ipv6 MTU, no ipv6 interface on this adapter", "error", err)
+		return nil
+	}
+
+	ipif6.NLMTU = uint32(t.MTU)
+	if err := ipif6.Set(); err != nil {
+		return fmt.Errorf("failed to set ipv6 interface: %w", err)
+	}
+
 	return nil
 }
 

overlay/user_test.go

@@ -108,7 +108,7 @@ func TestUserDeviceReadersConcurrentRace(t *testing.T) {
 	var wg sync.WaitGroup
 	run := func(idx int) {
 		defer wg.Done()
-		for range iterations {
+		for i := 0; i < iterations; i++ {
 			pkts, err := readers[idx].Read()
 			if err != nil {
 				errs <- err
@@ -136,7 +136,7 @@ func TestUserDeviceReadersConcurrentRace(t *testing.T) {
 	// waiting reader's private buffer, so reusing buf between writes is safe.
 	go func() {
 		buf := make([]byte, 32)
-		for i := range 2 * iterations {
+		for i := 0; i < 2*iterations; i++ {
 			for j := range buf {
 				buf[j] = byte(i + j)
 			}

routing/balance_test.go

@@ -27,7 +27,7 @@ func TestPacketsAreBalancedEqually(t *testing.T) {
 	gw3count := 0
 
 	iterationCount := uint16(65535)
-	for i := range iterationCount {
+	for i := uint16(0); i < iterationCount; i++ {
 		packet := firewall.Packet{
 			LocalAddr:  netip.MustParseAddr("192.168.1.1"),
 			RemoteAddr: netip.MustParseAddr("10.0.0.1"),
@@ -74,7 +74,7 @@ func TestPacketsAreBalancedByPriority(t *testing.T) {
 	gw2count := 0
 
 	iterationCount := uint16(65535)
-	for i := range iterationCount {
+	for i := uint16(0); i < iterationCount; i++ {
 		packet := firewall.Packet{
 			LocalAddr:  netip.MustParseAddr("192.168.1.1"),
 			RemoteAddr: netip.MustParseAddr("10.0.0.1"),
@@ -115,7 +115,7 @@ func TestBalancePacketDistributsRandomlyAndReturnsFalseIfBucketsNotCalculated(t
 	gw1count := 0
 	gw2count := 0
 
-	for i := range iterationCount {
+	for i := uint16(0); i < iterationCount; i++ {
 		packet := firewall.Packet{
 			LocalAddr:  netip.MustParseAddr("192.168.1.1"),
 			RemoteAddr: netip.MustParseAddr("10.0.0.1"),

routing/gateway.go

@@ -3,7 +3,6 @@ package routing
 import (
 	"fmt"
 	"net/netip"
-	"strings"
 )
 
 const (
@@ -14,14 +13,14 @@ const (
 type Gateways []Gateway
 
 func (g Gateways) String() string {
-	var str strings.Builder
+	str := ""
 	for i, gw := range g {
-		str.WriteString(gw.String())
+		str += gw.String()
 		if i < len(g)-1 {
-			str.WriteString(", ")
+			str += ", "
 		}
 	}
-	return str.String()
+	return str
 }
 
 type Gateway struct {

scheduler_test.go

@@ -1,19 +1,21 @@
 package nebula
 
 import (
+	"context"
 	"testing"
 	"time"
 )
 
 func TestScheduler_PooledReuse(t *testing.T) {
-	ctx := t.Context()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	s := NewScheduler[int](16)
 	delivered := make(chan int, 256)
 	go s.Run(ctx, func(item int) { delivered <- item })
 
 	const N = 100
-	for i := range N {
+	for i := 0; i < N; i++ {
 		s.Schedule(ctx, i, time.Millisecond)
 	}
 
@@ -32,7 +34,8 @@ func TestScheduler_PooledReuse(t *testing.T) {
 // BenchmarkScheduler_Schedule reports allocations per Schedule call.
 // In steady state the Scheduler's sync.Pool means we should see zero allocs per op once the pool warms up.
 func BenchmarkScheduler_Schedule(b *testing.B) {
-	ctx := b.Context()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	s := NewScheduler[int](b.N)
 	go s.Run(ctx, func(int) {})
@@ -48,7 +51,8 @@ func BenchmarkScheduler_Schedule(b *testing.B) {
 // What we'd pay per Schedule if Punchy called time.AfterFunc directly without the pooled Scheduler.
 // Allocates a *time.Timer plus a closure each call.
 func BenchmarkBareAfterFunc(b *testing.B) {
-	ctx := b.Context()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	queue := make(chan int, b.N)
 	go func() {

test/assert.go

@@ -25,7 +25,7 @@ func AssertDeepCopyEqual(t *testing.T, a any, b any) {
 }
 
 func traverseDeepCopy(t *testing.T, v1 reflect.Value, v2 reflect.Value, name string) bool {
-	if v1.Type() == v2.Type() && v1.Type() == reflect.TypeFor[netip.Addr]() {
+	if v1.Type() == v2.Type() && v1.Type() == reflect.TypeOf(netip.Addr{}) {
 		// Ignore netip.Addr types since they reuse an interned global value
 		return false
 	}
@@ -72,7 +72,7 @@ func traverseDeepCopy(t *testing.T, v1 reflect.Value, v2 reflect.Value, name str
 		}
 		return traverseDeepCopy(t, v1.Elem(), v2.Elem(), name)
 
-	case reflect.Pointer:
+	case reflect.Ptr:
 		local := reflect.ValueOf(time.Local).Pointer()
 		if local == v1.Pointer() && local == v2.Pointer() {
 			return true

udp/netchange_darwin.go

@@ -1,4 +1,5 @@
 //go:build darwin && !ios && !e2e_testing
+// +build darwin,!ios,!e2e_testing
 
 package udp
 

udp/netchange_darwin_test.go

@@ -1,4 +1,5 @@
 //go:build darwin && !ios && !e2e_testing
+// +build darwin,!ios,!e2e_testing
 
 package udp
 

udp/netchange_generic.go

@@ -1,4 +1,5 @@
 //go:build !darwin || ios || e2e_testing
+// +build !darwin ios e2e_testing
 
 package udp
 

udp/udp_android.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package udp
 

udp/udp_bypass_windows_386.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package udp
 

udp/udp_darwin.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package udp
 

udp/udp_linux.go

@@ -294,7 +294,10 @@ func deliverSegments(r EncReader, from netip.AddrPort, payload []byte, segSize i
 		return
 	}
 	for off := 0; off < len(payload); off += segSize {
-		end := min(off+segSize, len(payload))
+		end := off + segSize
+		if end > len(payload) {
+			end = len(payload)
+		}
 		r(from, payload[off:end:end])
 	}
 }
@@ -476,7 +479,7 @@ func NewUDPStatsEmitter(udpConns []Conn) func() {
 	return func() {
 		for i, gauges := range udpGauges {
 			if err := udpConns[i].(*StdConn).getMemInfo(&meminfo); err == nil {
-				for j := range unix.SK_MEMINFO_VARS {
+				for j := 0; j < unix.SK_MEMINFO_VARS; j++ {
 					gauges[j].Update(int64(meminfo[j]))
 				}
 			}

udp/udp_linux_fixes_test.go

@@ -107,7 +107,7 @@ func TestWriteBatchBadFamilyDeliversOthers(t *testing.T) {
 	got := map[string]bool{}
 	rx.SetReadDeadline(time.Now().Add(2 * time.Second))
 	buf := make([]byte, 64)
-	for i := range 2 {
+	for i := 0; i < 2; i++ {
 		n, _, rerr := rx.ReadFromUDPAddrPort(buf)
 		if rerr != nil {
 			t.Fatalf("expected 2 delivered packets, read #%d failed: %v", i+1, rerr)
@@ -161,7 +161,7 @@ func TestWriteBatchUnreachableDestDeliversOthers(t *testing.T) {
 	got := map[string]bool{}
 	rx.SetReadDeadline(time.Now().Add(2 * time.Second))
 	buf := make([]byte, 64)
-	for i := range 4 {
+	for i := 0; i < 4; i++ {
 		n, _, rerr := rx.ReadFromUDPAddrPort(buf)
 		if rerr != nil {
 			t.Fatalf("expected 4 delivered packets, read #%d failed: %v (got so far: %v)", i+1, rerr, got)
@@ -691,7 +691,7 @@ func TestGSOEngagesOnLoopback(t *testing.T) {
 	// The kernel must deliver the original datagram boundaries and bytes.
 	_ = rx.SetReadDeadline(time.Now().Add(5 * time.Second))
 	got := make([]byte, pktLen+1)
-	for i := range numPkts {
+	for i := 0; i < numPkts; i++ {
 		n, _, err := rx.ReadFromUDP(got)
 		if err != nil {
 			t.Fatalf("rx read %d: %v", i, err)
@@ -699,7 +699,7 @@ func TestGSOEngagesOnLoopback(t *testing.T) {
 		if n != pktLen {
 			t.Fatalf("rx read %d: len=%d want %d (kernel segmented at wrong boundary)", i, n, pktLen)
 		}
-		for j := range n {
+		for j := 0; j < n; j++ {
 			if got[j] != byte(i) {
 				t.Fatalf("rx read %d: byte %d = %#x, want %#x", i, j, got[j], byte(i))
 			}

udp/udp_linux_writebatch.go

@@ -112,7 +112,7 @@ func (w *batchWriter) prepareWriteMessages(n int, offloadsEnabled bool) {
 
 	w.cmsg = make([]byte, n*w.cmsgSpace)
 
-	for k := range n {
+	for k := 0; k < n; k++ {
 		base := k * w.cmsgSpace
 		seg := (*unix.Cmsghdr)(unsafe.Pointer(&w.cmsg[base]))
 		seg.Level = unix.SOL_UDP
@@ -214,7 +214,7 @@ func (w *batchWriter) WriteBatch(bufs [][]byte, addrs []netip.AddrPort) (int, er
 				break
 			}
 
-			for k := range runLen {
+			for k := 0; k < runLen; k++ {
 				b := bufs[i+k]
 				if len(b) == 0 {
 					w.iovs[iovIdx+k].Base = nil
@@ -318,7 +318,10 @@ func (w *batchWriter) planRun(bufs [][]byte, addrs []netip.AddrPort, start, iovB
 		return 1, segSize
 	}
 	dst := addrs[start]
-	maxLen := min(iovBudget, w.maxGSOSegments)
+	maxLen := w.maxGSOSegments
+	if iovBudget < maxLen {
+		maxLen = iovBudget
+	}
 	runLen := 1
 	total := segSize
 	for runLen < maxLen && start+runLen < len(bufs) {

udp/udp_linux_writebatch_alloc_test.go

@@ -64,13 +64,13 @@ func TestWriteBatchNoAllocs(t *testing.T) {
 				addrs = append(addrs, dst)
 			}
 			// GSO-eligible run with a short tail.
-			for range 8 {
+			for k := 0; k < 8; k++ {
 				add(payload, dstA)
 			}
 			add(short, dstA)
 			add(payload, dstA)
 			// Alternating destinations defeat coalescing entirely.
-			for k := range 4 {
+			for k := 0; k < 4; k++ {
 				dst := dstA
 				if k%2 == 0 {
 					dst = dstB

udp/udp_netbsd.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package udp
 

udp/udp_rio_windows.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 // Inspired by https://git.zx2c4.com/wireguard-go/tree/conn/bind_windows.go
 
@@ -30,7 +31,8 @@ func procyield(cycles uint32)
 
 const (
 	packetsPerRing = 1024
-	bytesPerPacket = 2048 - 32
+	// Caps tun.mtu at MTU-32 direct, MTU-64 relayed, unenforced anywhere else. 17.6MB page locked per socket.
+	bytesPerPacket = MTU
 	receiveSpins   = 15
 )
 
@@ -68,12 +70,14 @@ func NewRIOListener(l *slog.Logger, addr netip.Addr, port int) (*RIOConn, error)
 
 	err := u.bind(l, &windows.SockaddrInet6{Addr: addr.As16(), Port: port})
 	if err != nil {
+		u.close()
 		return nil, fmt.Errorf("bind: %w", err)
 	}
 
 	for i := 0; i < packetsPerRing; i++ {
 		err = u.insertReceiveRequest()
 		if err != nil {
+			u.close()
 			return nil, fmt.Errorf("init rx ring: %w", err)
 		}
 	}
@@ -355,15 +359,25 @@ func (u *RIOConn) Close() error {
 		return nil
 	}
 
+	u.close()
+	return nil
+}
+
+// Also unwinds a partial build from NewRIOListener, where isOpen is false and Close would no-op.
+// Socket first, unlike wireguard-go: receive() re-arms every slot, so freeing the rings under a live socket
+// hands the kernel freed pages for all packetsPerRing outstanding receives.
+func (u *RIOConn) close() {
+	// WSASocket reports failure as InvalidHandle, not zero.
+	if u.sock != 0 && u.sock != windows.InvalidHandle {
+		windows.CloseHandle(u.sock)
+	}
+	u.sock = 0
+
 	windows.PostQueuedCompletionStatus(u.rx.iocp, 0, 0, nil)
 	windows.PostQueuedCompletionStatus(u.tx.iocp, 0, 0, nil)
 
 	u.rx.CloseAndZero()
 	u.tx.CloseAndZero()
-	if u.sock != 0 {
-		windows.CloseHandle(u.sock)
-	}
-	return nil
 }
 
 func (ring *ringBuffer) Push() *ringPacket {

udp/udp_tester.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package udp
 

udp/udp_windows.go

@@ -1,4 +1,5 @@
 //go:build !e2e_testing
+// +build !e2e_testing
 
 package udp
 

util/cpupin_linux.go

@@ -40,7 +40,7 @@ func AllowedCPUs() ([]int, error) {
 		return nil, err
 	}
 	cpus := make([]int, 0, set.Count())
-	for cpu := range len(set) * 64 {
+	for cpu := 0; cpu < len(set)*64; cpu++ {
 		if set.IsSet(cpu) {
 			cpus = append(cpus, cpu)
 		}